|
|
All prior passes drove the graphics ring, the application command space or the ring control
registers. The bootloader mailbox, which loads the secure-OS components at boot, had never
been touched.
With the secure OS alive, the ring created and the heartbeat advancing, the bootloader's
ready bit is asserted. Because a latched idle bit proves nothing, the test used an invalid
component identifier pointing at a zeroed page, asking the bootloader to answer without
asking it to load anything. It answered with a status, so its mailbox is live and
processing host commands at runtime, concurrently with the secure OS, and rejects a bad
identifier cleanly rather than hanging.
Whether a valid component load is accepted after boot is left explicitly open rather than
guessed, since that is what decides between an architectural note and a primitive: an
accepted load would reinitialise firmware in place while the secure OS runs, and with
thirty-one distinct signed builds of one component in the corpus the interesting case is
loading an older signed build than the running one.
Safety notes are recorded for whoever continues, naming the component identifier that is a
known wedge and the two that would retrain memory on a running system.
|
