On: Unlocking the Motorola Bootloader with a TrustZone...

[jtchang]

Interesting part about QFuses. How are they actually implemented in the hardware?

[tyingq → jtchang]

Generically, it would be referred to as "OTP NVM", or one time programmable non-volatile memory.

There are apparently a few different ways to implement that.

A little dry, but the only thing I could find with some comparison of approaches: http://www.kilopass.com/wp-content/uploads/2010/04/compariso...

[laginimaineb → jtchang]

AFAIK it's unknown - there's a controller on the SoC which is responsible for reading/writing the fuses, but its firmware is in mask ROM and isn't available. Perhaps it's a real chemical reaction? Maybe it's just emulated in firmware? Your guess is as good as mine.

[sliverstorm → laginimaineb]

Could easily be an actual fuse. A array of skinny pieces of metal with a big monster current source to pop them on command.