The Chip Earns Its Trust One Level Down
The Chip Earns Its Trust One Level Down
Seed: ARM64 kernel initialization and boot sequence (bcm64 / Raspberry Pi 4).
Central fact: an ARM64 core does not wake up in the position it will compute from. It wakes at its most privileged exception level and spends its first instructions giving that privilege away, one level at a time, until it reaches the level where an operating system actually runs.
Power-on lands execution at EL3 or EL2 — secure or hypervisor territory — far above where a kernel belongs. The earliest code's job is not to compute anything useful yet; it is to configure the registers that describe how the chip will behave once it descends further, and then descend. SCTLR_EL1 and TCR_EL1 are set before the MMU is even switched on, so that the instant translation is enabled, the core already knows the shape of the address space it is entering — identity-mapped low addresses for the code still executing from physical memory, and high kernel-space mappings for where it is about to jump to. The page tables are built for a country the core has not yet arrived in.
Only after the MMU and caches are live, after a UART has been mapped by hand so the kernel can speak before it can print, does execution reach EL1 and something recognizable as main() begins. Every other core waits, spinning on a lock, until the first has finished laying this groundwork — a single thread of trust extended downward through privilege levels before it is allowed to fan out into the parallelism the chip was built for.
The chip is trusted with everything at boot and asks, level by level, to be trusted with less.