Hello. Thank you all for coming. My name is Jennifer Hammond, and I've been an engineer at Pivotal for about four years. I spent about the last two of those years working on the UAA, which for anyone who doesn't know, is the identity and authorization component within Cloud Foundry. And as part of that work, I've really had a lot of opportunities to connect with other teams that are using UAA, other release authors trying to integrate different pieces of the component, as well as working with customers, and learning a lot about where their pain points are with the UAA. Over time, certain patterns emerge. And after you get asked the same question enough times, you realize, OK, this is a usability problem. The existing CLI out there in the wild has many of these sort of problems. And so as a result, I decided at some point that I really wanted to try to rewrite the CLI in Golang. And that's the work I'm going to be talking to you about today. This started as a side project and kind of migrated into a real thing that's being supported by the current UAA team. We've had collaboration from people at several companies, as well as people from three different teams at Pivotal. I want to give a special shout out to Joshua Karp from 18F. He gave our very first unsolicited pull request. And for me, that was a real milestone, because it sort of validated in my mind, like, OK, this is something people are interested in. They think it's valuable. They're going to work on it, too. And in addition to that, gotten some really great Golang expertise from members of the PCFS team. And I can't tell you it's been a real pleasure to work with this group. So today, my goal here is for this to be accessible to everyone. I don't know what any of your backgrounds are, but often I go to these identity-related talks, and they're very, like, if you're not deep in the weeds of how all this stuff works, you don't get a lot out of it. And I don't want this to be that kind of talk. So I'm going to first say a little bit about UAA's role on the platform, just so we all have a shared understanding. Then go into some of the problems with the Ruby-based CLI that we've had and how that's informed some decisions for the new CLI going forward. I'm going to show a bit about what those interactions look like today, and then say a few words about what's ahead. But first, I want to tell a little story. So I flew in yesterday from California and in the US, where I'm from, all the electrical outlets look like this thing on the right. I always thought they kind of look like sad faces, but I don't know, maybe that's just me. So I was in my hotel room and sort of confronted by what you see on the left, which is this very geometrically interesting Swedish electrical outlet, not Swedish, excuse me, Swiss electrical outlet. And I was thinking, oh my gosh, how am I going to practice this presentation? I can't plug in my laptop. This is a problem. And I had planned ahead to some extent. I knew that in Europe and around the world, there's different standards. And so I brought some adapters. Turns out none of the ones I brought were going to work for this type of outlet. So I went down to the front desk and I said, please help me.  And of course, this happens a lot in hotels. So they had this universal adapter. And I thought, OK, great, like I'm all good now. It's going to be fine. But of course, I got it back to my room and I realized I actually have some additional requirements, which is that I not only needed something to plug an American plug into, it needed to accommodate this rather large charging brick on my Mac charger. And so that was like kind of a setback. I realized that using the other adapters I had, I could stack them together and build this terrible thing that sticks out about a foot from the wall. And that was working for a little while. The plug kept falling out. And it also just seemed like probably not good for the outlet. So I made some modifications. I realized, OK, I have these nail clippers, nail tremors, and I was able to actually modify this adapter to accept my electrical plug and move forward. And so the lesson that I wanted to take from this, the reason I'm talking about it now, is that adapters are extremely valuable. Like without this, I wouldn't be able to run through these slides in the privacy of my hotel room, but also fairly complex. And they need to be working just so. And that's the problem, I guess, the value proposition of the UAA within Cloud Foundry is that it's acting as an identity adapter. And in a world with many competing standards, all solving the same or similar problems in slightly different ways, the UAA is wanting to be that super adapter that will let you bring all of your identity information, no matter the source, and plug it directly into the platform. So I thought this is a good visual metaphor of the many different identity standards versus the super adapter that you want. And so here's a cartoon of Cloud Foundry. The idea here is that it doesn't matter or shouldn't matter for companies where your user information is living. It could be in an LDAP server, a SAML server, maybe a cloud identity service that you're using. And as long as those things are exposing some kind of standards-based interface, you should be able to plug those directly into UAA and have users logging in and pushing apps and doing all the things that we like to do with Cloud Foundry. Everything within the platform, and I've only shown a few of the components, of course. They interact with OAuth only, which is an identity standard we have for solving the problem of delegated authorization. And so this is a simple-looking diagram, but it's providing a huge value. And as a result, you see UAAs all over in our various different products in our ecosystem. Every Bosh director has a UAA inside of it. Every Cloud Foundry deployment has multiple UAAs inside of it. Many people are running concourse and authenticating using UAA. And in addition, the UAA is baked into numerous proprietary products, Pivotal's distributions that I've shown here. And just in a little while that I've been at this conference, I've talked to several other people about other products that are also using the UAA because this functionality is very valuable. Another thing that we see is most customers of any size are running multiple foundations. It's like they have many deployments of Cloud Foundry. And this is where the story gets kind of gross, where this integration between your external identity providers and the UAA gets pretty complicated as you add more and more things to this picture. I've only shown three here, but it's not uncommon to hear if customers are running 10, 20, 50, 100 Cloud Foundry deployments. And managing all this configuration is quite painful. And so the image I had in my mind as I was putting together these slides was like at Christmas time, when you pull out the lights because you want to create this magical atmosphere of the holidays. And but first, you have to untangle this gnarly mess of tangled up lights. It's just not quite delivering on the promise of what you really want to get out of it. And so if we're going to have a really scalable platform, we also need scalable administration tools because what we have already today is some tools that are fairly confusing for integrators and operators. It's like sometimes a bottleneck for them in managing these environments. It also comes back as like a tax on the development team. That's where I feel the pain. If I'm on one of these teams, if I'm on UAA, and I'm having to divert a lot of my attention to helping people manage and configure these environments because they're lacking some understanding or the tools that we have aren't meeting their needs. And the third and probably most important thing is that if there's opportunity for confusion or things take a long time to update your configurations and things, there's an opportunity to make mistakes, I would say. And this is not an area where you want to leave yourself open to making mistakes because there's a large security implication of doing so. So next I want to talk about some of the things that observations that I made, learnings, I would say, from my experience of trying to help people use the existing Ruby CLI. And so the number one thing is that install experience matters. Today to get the Ruby CLI, sometimes you tell people, oh, just install this gem. Gem install CFUAAC. And if you're a Ruby developer, that's like, all right, great. We're all good. But most people are not Ruby developers. And we see that actually in the real world, people sometimes need to do these things in air-gapped environments. Sometimes they're operating on a Windows platform where it's difficult to get Ruby installed. And even frankly, if they're not under any of those constraints, if you're not a Ruby developer, it's kind of like, it's just not reasonable to tell someone, first install a development environment that you don't care about in order to use this tool. Yeah. And so what we've seen across many different projects is a shift towards using Golang for their CLIs. This is what you see with Docker. You see this with Bosch. I could name a bunch of others. And it simplifies this process to simply download a binary and run it. And so that sort of was guiding our choice because we're sort of achieving this benefit. The Golang has made it very easy to compile binaries for different platforms. And also, we're able to leverage CLI frameworks because so many people are writing CLIs in Golang. There's actually really great tooling around doing that. So we don't have to reinvent the wheel on how do you parse command line options, things of that nature. So it's pretty easy. The next thing I sort of observed is that ecosystems tend to seem to guide people's expectations for how to use a CLI. I can't tell you the number of times I've had people say, OK, I found this documentation that told me do this command uac-token-client-get. But what does that mean? And the name of the command doesn't communicate any information about it. They're just like, they're very confused. So cosmetically right away, one thing that stands out is that we're not even naming this CLI in the way that other projects in this ecosystem are doing so. So if the Bosch CLI is called Bosch and the CF CLI is called CF, CRETAB CLI is called CRETAB, then naturally the UAA CLI should be called the UAA. And so that's what you'll see now. If you go check out the go lang CLI, it's called UAA. And this gives it an additional benefit that there won't be any confusion as we update documentation. You'll see documentation using this new CLI, and it'll have this different name. I think that's one of the pain points that the Bosch community, users of the Bosch CLI, felt in the migration was that if you were looking at a piece of documentation, it wasn't immediately clear if you were dealing with the Ruby CLI or the newer go lang CLI. So this will help with that as well. Another thing that we see in these other CLIs that I consider to be part of our ecosystem is they follow this verb noun syntax. Sorry. There is, yes, I'll show the link at the end and you can go check it out. So it's still a work in progress, I would say, but there's quite a lot of functionality already in it. So this, coming back to this slide, sorry, I didn't say it, this question was, is the CLI available today? And the answer is yes. All right, so coming back to this slide, we wanna follow along with how other people are doing things and follow this verb noun. In the UAAC Ruby tool, we had this sort of crazy sub-command system which leads to confusion for a number of reasons. People are often, I've been asked many times, what does token owner get mean? It means get a token with the password grant type. How would you know that? You wouldn't. And then people are also like, what's up with this get keyword? Why do you need that? And it just doesn't really make a lot of sense. So we've kind of shifted to this verb noun syntax. I think these names are a little more clear and they're quite long. There's obviously opportunity to introduce some aliases and things, but at least as a first pass, we wanted to get in line with these other tools. Number three I would say is that people do want to help themselves. And when they come to me for help, usually they've gone through a number of different things already. They try to Google search. They've often tried to view help information in the CLI, which the Ruby CLI in the past didn't really include much useful information. If they're customers, they've often reached out to our commercial support at Pivotal and the Pivotal support person is escalating to me because they actually don't know the answer. And so that's just like, that's not a good experience for anybody. So I really tried to push for having much better help inside the tool itself. And if you look at, these are just some example questions that we get a lot. Like why didn't my token contain the expected scopes? Or why do I need a client to get a token? Some of these like reveal a lack of understanding of the identity domain, the basic concepts about OAuth, others like this last question, what skim filters does UAA support? To me that says the person has some knowledge about what the spec is that they're trying to leverage. And so there's a wide range of knowledge levels that we see in our users. It's important to like try to meet them where they are. And so, how that manifests in the CLI is that we wanna have as much useful information in the help strings as possible. And I'm sure you've probably all had the experience of looking at a man page, trying to figure out how to use a command and really not coming away with any useful understanding. So I don't wanna promote that. And I've tried to include some realistic copy-pasteable examples in the help strings. And also some like just really straightforward troubleshooting tips for common problems. Some of these other ones like meaningful error messages, that's more aspirational, that's like a longer term thing that will require some changes in the UAA, I would say, the UAA server. And actually like just language, using the right words so that when people view something they don't understand it in the help, they can go to the internet and find other resources. When you add all these things up together, these are like low tech, super low tech things, but communication is really powerful. And you can actually give people a better experience simply by putting the information where they need it. And this is just a screenshot from one of the help strings for searching about users that's demonstrating like how can you query the UAA for certain things? Like how would you find a user whose email is bob at example.com? Well, there's an example right there. And that's one less question coming to me in Slack because we have like actual real examples here. And thing number four, and this is the last sort of category of major problem I would say with the old tool is that it didn't lend itself to automation. And that's an essential use case when you're talking about scaling out your usage of UAA. Here I've shown some example output from one of the commands of the old CLI that for some reason it looks like Yamalish, but it's really not. And you're missing things like a colon here, a bit further down, there's a list, a space delimited list that's like oddly formatted. And if you're trying to like take this output and script it in any way around what you're getting back, like you're not gonna have a good time. It's like really the worst case scenario because you initially have the reaction like, oh yeah, this is great, it's just Yamal and then no, it's really not. It's not Yamal at all. And so super high priority has been the outputs from this new tool need to be parsable consistently. So far we've done a lot with JSON because JSON, all JSON is also valid Yamal. So if you have a tool that wants Yamal, you can input JSON, it's kind of neat that way. We've had like explicit testing around exit codes to make sure that when an error has occurred, the tool's gonna like tell your script that something bad happened. And then also thinking about making sure we can accept non-interactive inputs and environment variables, things like that. So that concludes sort of the overview of learnings. And next I wanna shift into a bit of an example. It's a bit contrived. I want us to imagine that we, the audience, are trying to create a client registration in the UAA for the CF CLI for the first time. So it's as if that CLI doesn't exist and you're trying to develop it yourself. So as in any OAuth thing, well first, OAuth is a standard for solving the problem of delegated authorization, which is a lot of words. What it basically means is you as a user want to use a piece of software to perform some actions on your behalf. And the OAuth standard describes these four different roles that are involved in that type of thing. So resource owner, that's the user. I think we all know who that is. In this scenario that we're talking about, the client, the thing that wants to perform actions on your behalf is gonna be the CLI itself. The auth server, that's the UAA. Its job is to authenticate users. In other words, verify that they are who they say they are because they provided the username and password. It also keeps track of what permissions users have and knows how to issue and validate tokens. And finally, the resource server, which is any API basically that requires a token to access it, would be said to be a resource server. So in our world, these roles, they map like this. So I sort of called some of them out already. Cloud controller is the resource server. The client is the CLI.  You provide your username and password to the CLI. The CLI will turn around and make a request to UAA to request a token. It passes some information with this request. It's gonna send the client ID and client secret, as well as the username and password. And assuming that all checks out, the UAA is gonna reply back with the token that it asked for, which the CLI is gonna save off in a text file. So that when the user types their next command, the user says, hey, I want a CF push. Well, now the CLI will say, okay, I can do that for you, because I have a token. So now I'm gonna request, I'm gonna post your app over to Cloud Controller with this token.  So what you've seen here is a password grant type Oauthflow. And so, if I'm trying to create a new integration between UAA and a client, the first thing I would do is sketch out something like this and figure out what the different roles are. Having done that, I would move on to actually setting up those configurations to test them out. So with the new CLI, or actually with any CLI, the first thing you always do is target the environment that you're hitting. I just put in a local host URL, but in real life, it would be some kind of UAA in the cloud. The next thing I need to do is retrieve a token with an administrative scope, because I need that token in order to do the other actions, like creating a client, creating a user, all those things. So yeah, I just do this get client credentials token admin command. Most distributions or instances of UAA will have an administrative client in them. Obviously, your secret's not going to be admin secret. But you would have to look in your deployment manifest or your ops manager credentials tab. It depends how you deploy your UAA. But someone available to you should know how to find that secret. And having done that, this UAA context command, you can use that to view the token that it retrieved. So that's like kind of getting set up. Once you've done that, you can create a client like this. And there shouldn't be any surprises here. We have to provide the client ID, which is CF, and a client secret. In this case, the client secret is empty string. And the reason for that is that with the CF CLI, we want anyone to be able to download CF and point it at any cloud foundry deployment. The only way to accomplish that is to have a constant value, a known constant value for the client secret. And someone back in the day decided that empty secret was the good value to use for known constant client secret. You have to tell the UAA what type of grant types are allowed to be used with this client. And finally, what scopes does this client need? Now, the real CF CLI is requesting a lot more scopes than just Cloud Controller admin. But if you're putting yourself in the shoes of the person who's creating that client, you're not gonna add everything to begin with. You're gonna start small and iterate. And so for this example, I just put in Cloud Controller admin as a good starting place. Yeah, so that should succeed because we have a token with administrative scope. And before we can test it out, we have to also create a user. So this is kind of what a create user command would look like. I really enjoyed Dr. Seuss as a child. I was lately enjoyed sharing that with my nephews. So I always use Dr. Seuss in my examples. Pretty straightforward, you need a password and an email address. The names are optional. And we also need to assign membership to our test user. So we're giving him membership in the Cloud Controller admin group. So this is where it all comes together. So now that we have that client and we have that test user, we can use this different token command, get password token, passing all four pieces of information. The client ID, the client secret, the username and the password to get that token. And this is exactly what the CF CLI does today. So from there, as an app developer at the developer of the CLI, I can continue iterating like adding memberships and adding scopes to build up a token with all the capabilities that I need. So where are we today? Gentleman in the front asked earlier, is this available today? And the answer is yes.  It has most of the CRUD operations that you need on major resources like clients, users and groups. We've also implemented all of the token commands for the major grant types, as well as the UAA curl command. And so the initial goal for this project was to replace the functionality of UAAC so that we can fully deprecate it. There's a few things still outstanding that I've listed here. I think external group mappings seems like the most important one because I know people use that quite a lot. But overall, it's getting very close to feature parity with the Ruby CLI. And looking ahead, I think I've talked a lot about these things that are important for app developers. Where we really wanna get to is having a nicer experience for platform operators who are configuring identity. This is future. This doesn't exist today. But we've seen and learned from the experience of people with the Bosch CLI and the Fly CLI that when you have these really large configuration objects you need to manage. A file-based configuration is really the way to go. And so something like this, where you would have a YAML file to provide that configuration for your identity zones and identity providers, I think is where we're headed. So that's all I had to say. Thank you all for listening to my talk. I hope you'll check out the repo here at Cloud Foundry Incubator slash UAA CLI. Give it a spin and let us know any feedback. Let me check the time. Okay, we have about five minutes left, so if anyone has any questions, I'm happy to take them.


My name is Miklos Balint, and me and my co-presenter, Ken Liu, are from ARM's open source software group, and today we're going to focus on compartmentalization in IoT devices. And first of all, I should highlight, although most of you are very well aware that compartmentalization is important, and we all know at least one story when compartmentalization didn't go as planned, and that had great consequences. So this is important. But there are challenges when compartmentalization needs to be applied to IoT devices, and that's due to the fact that these are high-volume, low-cost, low-power devices, so there are compelling arguments for using microcontrollers in these devices, but they have some limitations or constraints that need to be considered, and that is that they have a small die area typically with limited hardware functionalities. They don't have a memory management unit, so there's a single physical address space which makes compartmentalization more of a challenge than in an MMU-based system. They execute code in place in a flash, and they have a limited amount of SRAM to store data. There's also the problem of having a wide spectrum of use cases. Each of them might have different threat models, and those have to be considered, so any solution needs to scale in order for them to have a reasonable penetration in this market, and all of this means that there is a need for a holistic approach to IoT security. First, let's talk about establishing the right level of security. The most basic issue is that if there is some vulnerability in the business code, you may want to separate security-aware aspects of the system, so you create a secure processing environment for them. That works for some threat models, for some IoT devices. This is sufficient isolation, but in other cases you want to be prepared to mitigate the vulnerabilities in one of your secure partitions, and you want to limit the impact of vulnerabilities thereby isolating a trusted compute base, so you separate trusted and secure components from each other, and you separate the root of trust protected. In this case, there's still a concern if you have multiple tenancy on the secure side, one vendor might provide one secure partition, a different vendor might provide a different secure partition, and they may not trust each other's code, and in that case, even more isolation is needed. You want in some cases to isolate all of the secure partitions from each other, and that of course introduces more and more complexity with all levels of isolation. There's an additional aspect to be considered. On the non-secure side, some non-secure OSs are already supporting compartmentalization for their execution environment, and in these cases it's beneficial if the secure partition manager can be made aware of the executing non-secure context, and so different access policies can be provided depending on the active non-secure context when a call is made for a secure service or access to a secure asset. Just a brief discussion of hardware isolation, which is the foundation of software isolation, you can either have physical separation in your system when non-secure code and secure code are executing on different physical processing elements. In other cases, you have temporal isolation, which means that secure and non-secure code share a single processing element, and the security is a state in the processing element itself. Now let's look at some interaction scenarios, and I will primarily focus on crossing boundaries in a single processing element, because that was the first task that we were addressing in the Trusted Firmware M project that we were working on. The problems I'm presenting also need to be investigated from a threat modeling point of view in a physical isolation, but as I mentioned, I will focus primarily on a single processing element, which has various execution states for the various components. The basic use case is that you have a non-secure thread that requests a secure service that is crossing from the non-secure to the secure state. I will be discussing isolated drivers, in which case you have some interrupt service routine that is implemented by a secure partition, and you don't want to run that interrupt service routine in privileged mode. There may be asynchronous events on the non-secure side that might preempt a secure execution, and I will also discuss those cases. Now, the simplest use case or the basic scenario for reference is when we have a secure state change, a non-secure thread requests a secure service. In order to do that, it needs a crossing from the non-secure state to the secure state, and in ARM's VATAM architecture, that is limited to some dedicated entry points into the secure system, which are called non-secure callable address ranges. In this case, we need some sort of wrapper functions to trigger some privileged management code that will help us check access policies for that given non-secure thread to perform parameter sanitization on behalf of the secure partition, set up the container or the secure partition. I contain that unit and then invoke the partition code, and for invoking the partition code, TrustedFirmwareM actually has two programming models. We will discuss those later in the talk. SecureInterruptDeprivileging. This is the scenario when we have a device driver in an isolated compartment in the system. Now, this flow actually has already been out there. It's supported on legacy architectures as well, so this is not something new, but it's important to highlight from a secure compartmentalization point of view. In this case, a privileged interrupt service routine serves as a wrapper. It triggers partition management code, which sets up the sandbox to execute a deprivileged interrupt service routine, which executes in the context of a secure partition. Non-secureExecution can be preempted in some cases. It's up to the system architect to decide if that is an allowed scenario, but from a real-time point of view, we anticipate that it's a quite common requirement to have some real-time behavior to provide real-time functionality on the non-secure side. What happens in this case is that when the non-secure interrupt preempts secure operation, the secure context is stacked. This is done by hardware on ARM V8M, and the non-secure interrupt service routine is executed in a non-secure state. When the interrupt service routine returns, the secure context is unstacked from the secure stack, so execution can resume. There are some threats that need to be investigated in such a scenario and some challenges. We have to make sure that the secure state remains consistent for the duration of the interrupt service routine. This can be done in multiple ways. We'll again discuss some of that later. There's also a concern that by using interrupts, the non-secure processing environment can starve secure execution. That's actually a very complex problem and we'll not discuss that in detail in this talk. There are a lot of aspects there and we can't take the discussions offline. We've been looking at that, but as I said, the time is limited. As I mentioned, there might be a need or a benefit of having awareness in the secure partition management of the non-secure execution context. For that, we have a reference implementation provided as part of CMC's trust zone context management functions where anytime a non-secure context, a non-secure thread is created, deleted, loaded or stored. Any context change happens on the non-secure side. There's a notification, a function call going directly to the secure partition manager to have the awareness and in this case, we practically mirror on the secure side in a client container the non-secure context if needed. An example use case, non-secure threads are created. We create or we prepare two contexts for these non-secure clients on the secure side. When thread one calls a secure service, then the first non-secure client context is activated and the secure service starts execution. Now in case a non-secure interrupt preempts that operation and if it triggers a context change, then we get notification in the secure partition manager from the non-secure RTOS and in that case, we activate the second context on the secure side and if that makes a call to a different secure service, then that service call is handled in different non-secure client context on the secure side. If that returns non-secure execution of thread two resumes and when thread two yields, then we just perform the same actions as previously. If a context change happens on the non-secure side, we again get notifications and the original context can be restored on the secure side based on that and the first secure service can complete its execution. So this was just, of course, an example use case, but there's quite a big scope of uses for managing for the awareness of states and as I mentioned, all these context, various non-secure contexts can be associated with different access policies on the secure side, so thread one might have access to different assets on the secure side, then thread two. It's important to note that this relies on non-secure context management and the non-secure RTOS. If there's a vulnerability in the non-secure RTOS, there is a concern that assets will be served to an unauthorized non-secure thread, but it's important to note that these vulnerabilities contained to the non-secure processing environment, so if the non-secure RTOS is compromised, assets might be mixed up on the non-secure side, but no assets are exposed which would anyway not be available to non-secure entities at all. So let's take a look at the two implementations, the two programming models that are supported by trusted firmware M, and one is the one we call the library model, in which case all secure services provided to the non-secure side or to other secure partitions is implemented as a function. This closely resembles a bare metal programming model, and there's very substantial support for this in ARM V8M architecture, and so essentially each secure partition is a collection, is a library of secure functions. This is a synchronous execution model, so a non-secure thread is blocked on a function call to the secure side, and it has a low footprint because there's an opportunity to allocate resources on the secure side on demand, so resources can only be... It's possible to allocate resources only in case a call is made to one of the secure services. The other programming model or implementation model that we are supporting in trusted firmware M is the thread model in which secure partitions are implemented as execution threads. This is a more robust, more prescriptive framework. There's a static allocation of all secure resources which makes it more complex and more robust as I mentioned. In some cases it might be beneficial from a determinism point of view, but of course it has some overhead associated with it. In this case, interaction between the various partitions happens using connections and messages, and it's possible to have asynchronous processing of secure service requests, this is why it's well suited for physical isolation. If there's a physical isolation of secure and non-secure execution and each has its own associated processing element, then this model fits quite nicely on the secure side. With that, I would like to hand over to my co-presenter, Ken, who will talk more about the interaction within the thread model. Hello, guys. Let's continue. Here, in the following slides, we will introduce the interaction implementation in the thread model. We use the general concept inter-process communication for the name. The IPC is the interaction name of the thread model only. So there are two kinds of the secure partitions in TFM, sorry, two kinds of partitions in TFM, the secure partitions and the non-secure partitions. Secure partitions provide the secure services, and the non-secure partitions just request the services. The non-secure partitions reflect the whole NSPE. NSPE stands for the non-secure processing. So there is one thread in the secure partitions. After the necessary initialization tasks, it runs into an infinite wire loop and a wet message there. All the client calls are sent as messages. The client call was called by the secure clients. The non-secure partition is a client because non-secure partition does not provide any service, and the client could be a secure partition tool because some secure partition needs to request a service from other secure partitions. And the interrupt required by the secure partition is handled personally in thread mode. This is the point different with the library mode. So there's a compartmentalization consideration for the thread mode. So there's no shared memory between the partitions. The memory is copied by some streamed API. And during the copying and processing, the memory is checked for its integrity to ensure that the memory belongs to the corresponding secure partition. And the peripheral usage is also the same. The peripheral belongs to one secure partition is actively to be accessible only when the secure partition is running. And we changed the long-term production loop. We changed the production loop long-termly to switch the I-Solution. Let's take an animation for example. So the secure partition 1 requests a service from secure partition 2. And the memory information will be sent within the message, and the secure partition 2 will call the system API lead to copy the memory into its own area. And now you can see the yellow rectangle means the I-Solution board has been switched to a secure partition 2. And why secure partition 2 wants to return the result back? It calls a write function to copy the memory back to the destination memory. And then the result is returned back to secure partition 2. And now secure partition 2 is running. So the I-Solution board has been switched back. So we are not focusing on the secure partition scheduling or something because it's quite generic. We are focusing on the non-secure partition and the secure partition interactive on the ARM-waiter M platform with trust on technology. The trust on technology divided the whole processing environment into two. One is called the non-secure processing environment in the left side. And the right side is secure processing environment. The non-secure processing environment cannot access any resources that belong to secure processing environment. So since it cannot access any of the resources, how can it perform a secure call to request services? So there is a staging area called a secure and a non-secure callable for such kind of usage. There is a secure gateway in this area to check if the call has come from the non-secure part and check if currently the secure call happened in place is in the secure and non-secure callable area. And if the connection check passed, it will enable the calling to the secure side. During the secure call process, there are some logistics, some hardware condition status change. They mainly change the stack point. The hardware stack point, we are transitioning to the secure stack point during the secure call process. And during the whole, during the secure call process, the general purpose logistics may keep same and some status will just change it. And the most important thing is the hardware stack point. So let's take a simplest case. The single non-secure server requests a secure service. The non-secure side, one non-secure server requests a secure service and then the secure call happened and the hardware stack point switched to the secure entry area. And the secure entry area will call the connected API in the SPM. So during the non-privileged to the privileged call, a call frame is generated and pushed into the secure stack. And then the connected API was converted into messages and the messaging and scheduling would happen. And the destination secure partition will be activated as a learning and it will be served as a message and served. After the service is handled and the result is returned back to the client API area. During the returning process, the stack call frame is popped out and then we return the result back to the non-secure caller. We notice that there are two client API here, one in orange and other in yellow. The client API in the non-secure side and the secure side, the prototype and the behavior should be identical to the caller. The caller means one thread. So let's take a look at something more complicated. There are multiple non-skill threads because of the secure service. So as you are, the first secure call is performed and the secure partition is serving and the first frame is pushed into the secure stack. And then because our secure partition execution could be preempted by the non-skill side, so there's a chance that the non-skill authors get run again and another thread request and the second secure service. So the second, here comes the second secure service and the second call frame is pushed into a stack. And then the SPM schedule is working and we activate the corresponding scope position and handle the service. And after the service handled, we need to return. But the problem is that the non-skill side shares the secure or secure stack point. So there are actually two frames pushed into the stack. Which frame is the correct frame we should return to? Because we don't know the non-skill status now. So for this problem, there are two possible solutions. Actually, there may be more solutions, but the main solution, the main solution is two here. Solution one is quite simple. Here the first secure call comes and the call frame is pushed into a stack and the service is handling. And then during the second secure call, it wants to call the current API in secure side to generate another call frame. And we do a checking here. If we find there is an existing call frame there, which means that a secure, a provided secure call is still ongoing, so we just deny the second one. And solution two, we provide another set of APIs running the provision mode for the non-skill at all. The basic idea is that we could prepare a corresponding dedicated secure stack for each non-skill thread who needs the secure service. For the non-skill thread one, we could dedicate the secure stack one for it so that the non-skill thread two, let's take a look at a real working process. So the non-skill scheduler will activate the non-skill thread one, so it calls the API to notify the SPM to prepare the secure stack for the non-skill thread one. And then the non-skill thread one gets long, and it may perform a secure call. During the secure call, his call frame will be pushed into the secure stack one prepared for it. And then if the non-skill thread gets switched, it's still the same. The non-skill scheduler will sync with SPM to prepare the secure stack two for the non-skill thread two. And then secure thread two may perform the secure call. Okay, let's take a look at the interruptor things. So the secure execution in the secure partition could be pre-empted by the non-skill side interrupt. Let's take an example. A secure call is performing a service handling, service partition one is handling the service. And just before, just as it's secure partition one is running, there's a non-skill interrupt occurred. And then the context change would be something like this. There's a preempted context being pushed into the secure stack. But the non-skill scheduler, I think the non-skill thread maybe one is still running. It associated the preempted context with the current, with counter-learning non-skill thread. And then it service the ISR in the non-skill side. So the call is orange. And after the ISR handle the interrupt, it's returned back to the saved context and continue the secure execution in the secure partition. So the trust on hardware ensures that no information is leaked to the non-skill side. So during the secure context handling is something complicated to see, which means that the context is saved in the secure stack and all the general purpose registers are cleared to zero. And then hardware generates a magic number to the non-skill side to tell the non-skill scheduler that you have just preempted a secure execution, but you don't know the content. So the non-skill side just saves the magic into the non-skill thread context. And then after the non-skill execution is finished, then it's a switch back to the secure side. This is the non-skill interruptor preemptor secure service. And for the... Okay, missed some... missed some returning pass. So for the secure, secure interruptor preemptor execution, it's a bit different with the non-skill interruptor. So here we have a secure call and the service is handling the... Our service partition is handling a service and then you find that the secure partition finally needs an interruptor to finish the service. So it calls API wet for the interruptor event. And then the scheduler will return the execution to a potential partition. It may be secure partition, one secure partition or the non-skill partition. And then the secure interruptor occurred. So the secure isa first created a message in the thread mode or APIs, or APIs based on the messages. So create a message and push to the service stack. And the scheduler will find... will trigger the secure partition who is waiting for the interruptor to running and the secure partition just run and handle the interrupt and finish the service. And then after all these processes are done, we return back to the preempted caller, which may be secure or non-secure. So the color is mixed. It may be orange and may be green. So, okay. So this is the case for the interaction between the partitions. We focus on the non-skill partition and the secure partition interactions. So, okay, that's all. I think I will give the talk back to me once again. Okay. So just to summarize the topics that we've discussed. And this is a very brief summary. Compartmentalization in IoT is not trivial. There is no one-size-fits-all. There might be different approaches to achieving secure and non-secure isolation. We might have various considerations on the need for privilege control, both on the secure side and on the non-secure side. And the interaction between the compartments in the system may happen based on function calls, an inter-process communication type behavior, or in case of physical isolation, interaction may be as simple as a hardware mailbox. In any case, it's up to the system designer to pick and choose the right approach, both from a hardware selection point of view to a software framework point of view. Trusted Firmware M project is focusing on providing a scalable framework which tries to cover as many of the use cases as possible with a single framework. And so we try to provide various build configurations to support multiple configurations out of this platoria of selection that's available. And we are trying to maintain a holistic view on the security of the system. So with that, I would like to highlight another talk that was made earlier by Ashutosh from our team, where he was talking about security and IoT in general and how Trusted Firmware M implements that. Trusted Firmware M is part of the open source, open governments, TrustedFirmware.org project. We have a team here at the Open IoT Summit, and we gladly take any questions at the arm booth via email, or actually we still have a few minutes left, but we're open to questions at this point. Thank you. Any questions? Did you consider to use RTOS native scheduler's data of scheduling inside secure part? For example, by adding some extension to support a plugin, some switch context code, or something like that. So our primary focus was to, in the first iteration when Trusted Firmware M was launched, the primary focus was to get a low overhead, a simple solution. Now we're at the stage, this is the second year we're running the project, and now we're looking at making the solution more modular and to create more of an alignment to APIs. For example, an API for plugging in standard OS interfaces or standard OS tooling for the scheduling part or for the interaction part. So we're looking at various options for that at the moment, and we are open to discussions for any proposals on how to solve that in Trusted Firmware M. Thank you. If there are no other questions, then thank you for listening.


Every time I hear it, boy, check it, man, check it, man, hey, man, this is boy ECO, and I'm here with the lovely official, Ms. Jamaica. You know the show, man, it's going on, man, Boss Talk 101, getting better every time. You know what I'm saying? And we have some of the most man, I want to say, the best guest. Exactly the best. We got we got a guy here today. Most talented. The most talented. TJ is here with us today. He does art. He officially from the prime time clip. And you did the shirt that you have on, right? Oh, yeah, I did. Hand painted the shirt. Hand painted it. That go hard with the paint. Wow. You the one? Yeah. Yeah, you go hard with the paint. Yeah, most definitely. So what got you into it? So at the age of four for Christmas. Yeah, yeah, we went all the way back at the age of four. At the age of four. He started young, yeah. I got a color book for Christmas. I fascinated with this color. And from there, I wanted to start doing my own color books. So I started drawing my own stuff out and coloring it in. So basically from the age of four, I just been into art and just drawing. Yeah, well, the thing I can say is did your parents hold you to it? You know, like keep you going in it. So my mom was artistic and my grandmother was, but. So this is third generation. So when you say your mom was artistic, like, did she draw things and sold it or to that point? Or did she just did? She just knew how to draw. All right, hold on, man. Hold on, man. Because, you know, let's do your intro song. Because we didn't come on right. Let's go. Yeah, he got an intro song. He got an intro song. Yeah. Oh, yeah. Now we on now. Yeah, man. That's where he's paying. That's where he's paying when he getting ready to play. Yeah. Now, now. Now, yeah. Quality work. Yo, yo, yo, work is it. Yo, yo, work is it. Yo, yo, yo, work is it. Yo, yo, yo, work is it. Quality work. Yo, yo, yo, work is it. Check it, man. Now we got TJ on the show, guys, man. Yes, yes, yes. He has his own intro song and everything. Yeah, you niggas didn't know I was going to bring it back. Nigga, don't make me start again. He ain't working in here. So what's up with you, man? What's good with you? Man, that's how we doing it now. Yeah. Oh, yeah. Yeah, baby, that's good, yeah. Yeah, this is going to start one-on-one. You said you started off with a coloring book, but when did you graduate into actual paint? So I graduated from Douglasville High School 2004. One of the trains back then was people paying cartoon characters on denim pants. I remember that. Yeah, so nobody would ever tell me how they would do it. So when I graduated from high school, went to Preview, rented to an old classmate who graduated in 2003, the previous year, went back to his dorm room. Whole room was just full of this art, hand-painted stuff. So he showed me basically everything that I needed to know to make my own pants. So I called my mama and told her to Western Union and give me some money, because that's how I was getting my food and everything. So instead of buying food with the money that she sent me, I went to Hobby Lobby and got all my paint supplies that I needed, and then started my business. You started your business. So you didn't tell her what you was doing at all? No, I ain't tell her at all. I was actually making money, yeah. And what did she say when you told her? She was proud, but she hit the little smart stuff talking about, well, I guess she don't need me anymore to send you money. I'm like, no. You won't have to send as much though. But you're going to have to drop out. No, you should have been like, no, mama, I'm going to start sending you money. Yeah. That's what you should have told her. No, no, you're going to have to drop out, because Prairie View is jumping up there. No. Did you finish? No, I didn't finish. I had 30 hours left. Wow, didn't we have somebody else who was at? Why not? Fat Pimp. Him and Fat Pimp. You seen it on there.  You got to finish. Well, see, when I came back to Dallas, I went to enroll the amount of you. I finished and got my associates in the art there. Then I went back and got another certification doing robotics. Wow. So, yeah. So, let me ask you, hold on, I want to know this question.  I don't have any student loans off me. That shot my credit, though. That pay money. But is it worth going to school for art, or if you just have that natural talent, is it best for you to just do your thing? Well, see, I just went just to complete something, made my mama happy, because I grew up educated. That's usually what happened. So, me not finishing, I would hear that all day long. My whole life, I would start something and not finish.  Right. Especially with your kids. So, yeah, that's basically what I wanted to do when I came back. Like, quit moving all around everywhere. Like, see them in one place, get something like that, then proceed to the next thing. So, wow. Well, the things that you learned in art school, did that help you with your craft? So, basically, when I got my associate in art, it didn't teach me anything about art. It was just a name. Like, that's the one thing about me even going to school and high school with art. I take art just to take it. They can't teach me something I already didn't know. And that would make the teachers mad, because I'm sitting here, breezing through stuff and doing stuff my own way, because I'm like, I already know how to do this. Like, why are you- So, God-given talent. Yes, sir. Especially when they want you to do it in a basic way, when your mind is already like- I'm triggered to do stuff- You are like Nick Cannon on Drumline. You naturally could play the- You could do it naturally, so it couldn't be, you know- Basically, he couldn't read the music- Music can read- Yeah, that's right. It's the same thing. Like, I can do it. I don't really need you to show me how, but I'll take the class because it'll get me a credit that I need. Exactly. What I wanna- Exactly. What I wanna know, because you have a lot of people in the art craft, especially when I look on social media, or when we go to the magic show or the different shows- Yeah, they can draw. We see people just, you know, play their music and they just go off and start drawing and doing all of this other art on whether canvas or on the wall or on wherever, and in no time it's done. Right. What would make you different from any of those other artists? I know I do everything when it comes to art. I don't limit myself to just one thing, so like I said, when I graduated from high school, went to Prairie View, I started painting on clothes. So I was painting on the pearl. I did that for so long, then I had to transition into doing something else because- Because that was out of style. But not so much out of style, but other people started doing it too. Right. So after I started painting on clothes, I was like, well, I gotta start drawing portraits. So I started drawing pictures and stuff like that, so I started getting another audience for people who wanna get portraits done, so after I did that, I was like, okay, well, now I see some other people doing portraits, canvases and stuff like that. So I started painting on shoes, and then I started doing murals. I just, every year, my whole mind frame was to elevate and keep doing something different. So I'm never gonna be stuck doing one thing. So no, I can't just, I don't just paint canvases, I don't just do murals, but I could paint shirts, I could paint your shoes, I could pay bad payers, I could draw you out a logo, I could paint on the wall.  It really just depends on what you want. Say the podcast, right here. We just want all of this painted on the wall. I give me a good ol' day. I probably say like 12 hours. That's it? Yeah. Oh, okay. Yeah, I tap in, get in my zone, and you just give me a theme or what you're trying to go with, what the rest you want to go with, and I'll go from there.  When I say fancy, okay. When I say fancy, let me tell you what I'm thinking about. I've seen the craziest things on back again, social media. People will just have not use a brush. They'll sometimes use their hand, pop it in the paint and throw it up and they'll start doing this, and it comes out beautifully. I've seen people use their nose to paint. Yeah, they do all sorts of stuff. Very artistic with it. Right, because that's, in today's society, when everybody's doing the same thing, what's gonna make you stand out different from anybody else? Right. I do everything, so I can use a paintbrush, or sometimes I use, with favorite paint, they have the needle tip at the point of the bottle. I can use that. Sometimes I use my fingers to blend. It really just depends, I can use any and everything, depending on what it is that I'm trying to paint on, so. Yeah. Can you record everything you do? I have recently. Okay, because you know social media. Oh, you're on TikTok. And I'm not on TikTok yet. You gotta get on TikTok. You gotta get on all of those platforms. So people can see the process, and then you can speed it up. I've been putting everything on Instagram, so. You to get on TikTok. All right. You do, because that's where y'all hanging out at, right? Right, Chamarie? TikTok, where would he do good to show his crap? For me, and that's another thing, part elevating and growing, because you know, with time, you have to know how to adapt to. That's right. You have to change. Building a brand, building a brand, people don't understand, building a brand, no matter what craft or career you're in. If you're trying to market it yourself, it takes time. It takes a lot of effort. It's a job within itself to sit down and find the time to say, okay, I'm gonna post this on TikTok. I'm gonna post this on YouTube. And then sometimes, yes, there are apps that will allow you to post, but some apps you have to pay for, especially if you're doing videos. If you're just posting pictures, they're free apps you can use to just put everything on there, schedule it out, and everything goes to everywhere. So you can save time. But when you're posting videos that can show people, this is how I do it and speed it up and make it look all creative, you have apps, but you have to pay for those apps. Or you can say, okay, I'm gonna put something different on TikTok, something different on, but you have to sit down and spend that time again and time is money to sit down and spend that time to do that. That's another thing that I learned recently. I used to post pictures of the finished product all the time. So then, yeah, people don't really engage with just posting pictures. So I got to the point where, okay, I'm starting doing time-lapse videos of me, the whole process of me paying the shirt or paying the portrait or whatever like that. And I've gotten a lot more engagement with the audience, so. Exactly, because you're fast forward in any way. It's not like somebody's sitting there watching it for 12 hours doing it. You're gonna fast forward to the, and slow it down at the good scenes that you say something or you do something creative or whatever and all the other parts you just fast forward through and make it creative. Yeah, I'm loving everything though right now. It's just, especially recently, cause I just quit my job about three, four weeks ago. So you're gonna be doing this full time? Well, I've been doing it full time now for about a month. So you quit it to do this full time? Yes. So you have so much faith in? What I do, yes. And it took a long time for me to believe in myself. I can't imagine that, cause you've been doing this ever since you were younger. And how old are you now? I'm 35, I'll be 36 in July. You look, another July person. What's your date of birth? July 16th. Oh, so you were cancer, okay, you out of this. Why you made that?  Cause we all live, and then the gentleman who left earlier, he was also July the 27th. But at least you still July, you still July, so I'll give you that. You July. You July.  My best friend is a cancer, but we'll be getting into it because, her birthday, I started Leo Pact, I'm the 23rd. She ends the cancer pack, so she's the 22nd, she's the day before me. So I always tease her, I say, you a cancer. Cancer people, no, they're good. They're good people, cause she's my best friend, so. Right. So she wasn't your best friend, what was you doing? Say about, I can tell you, cause she's, I think, she's the only cancer that I really know. Thinking about it, and she's cool people. Oh, I'm cool. Okay. Yeah. Okay. So, where do you see this career taking you? In the next two years, let me give you a time limit, because if you quit your job, to do this full time, you should have goals set out, written down, time limit on this, so you know, okay, by next year, this is what I want to accomplish. My ultimate goal is to be more global with everything, so I'm not just so Texas-based, cause that's pretty much my whole following right now, it's been Texas ever since 2004, really. And how is it planned to do that? Hey, how do I plan to do that? More just put myself out there, like more traveling, I have people who live in Colorado, so I'm gonna go out to Colorado, I'm gonna go out there, and I have a, I already have a plan when I go out there, as far as like marketing and how I'm gonna do my artwork and stuff out there, but I can say each demographic is different, so it's like, how can I bring what I have to their culture and make it work and fit for me out there, so I know, I have a lot of figuring out to do, but I just know traveling, getting outside of Dallas, Texas, and getting outside of Texas in general, I'll be able to see a lot more, so I can adapt. Right, right.  But it's different from looking up something and actually go outside, I've never been somewhere. And talk to someone. I've never been to California before, so I mean, I know California palm trees, beaches and all that stuff, celebrities out there, but it's different once you actually go out there and you actually interact with the people because the culture is a lot different once you get there, opposed to just looking at on TV. Right. Which is true, because I've been there many times and it is very beautiful to go there and actually see the culture. But then, certain things you don't see, because. Yeah, yeah, like the Dallas downtown, you don't see that. I'm not talking that way. Then you know how like when you watch TV and you see certain things about California, so whenever you go to California, you're looking for that. You're looking for it, yes. Like I'm looking for those low riders going like, nah. I don't see that. She watches too many movies, yeah. But you don't see the Dallas, you know, that's high-rises and all that. Of course you don't see that because you're not in Dallas. That's right. So you got to be there. Right, you got to be there. You are in the midst of greatness and you don't realize it when you go up there, you're like, damn, I'm out. He's just talking about visiting. He's not talking about living. Yeah, well I'm just letting him know before you go up there. But that is just like the Dallas skyline. Because he just said Hollywood and all that. And yeah, it's cool, but it ain't Texas. Right, he right. But I said it's like, there's money here in Dallas alone. Boom, there it is. Yeah.  But for me, I want to be beyond Texas. Where you want to go? Everywhere. I want to be everywhere. If you could go anywhere in the world, where would you go? That's a good question. Honestly, I don't know. Ferry? Nah, I don't know. God, that's what it, when they talk about it. I'm not fascinated about it. When they talk about art, that's usually what I mean about it. Yes, I'm not a typical person. I'm not a typical person, I'm like. They think you want to go to a Decatur. No, I don't. Yeah, you know what I'm saying? That's where the money goes. He want to thug it out. He don't want to be out there. Ferry. I'm going to Australia. Antarctica. Man. How many clients do you have right now? Because when you say you quit your job to do this full-time, you should be able to. Better have some money. You should be making enough where you can pay bills. I know I'm making enough, for sure. I'm making enough. But as far as I have many clients, that just differentiates. Like, one week I can have 10 people, the next week I can have probably like five, but the jobs that I'm doing will carry me over. Because your jobs are pricey. Right. It just depends. They vary. They vary. I don't have to say pricey for anything because like I said, everything I do is pretty much custom. Okay, so when somebody say, how much do you normally charge? I'm going to tell you what they say. I got to take a look at it. See, once he said I got to take a look at it, then he feel to go over there and really give it to him. Like, I got to take a look at it. Yeah, I'm like, what do you want? I want to get a shirt, man. How much to get a shirt? Well, I'm like, what do you want on a shirt? What size? How many colors? Well, I said, I don't charge about the color. I just go more so on. The white thing I have to. How you depth the design. Some people might just want a name going across a shirt. I'm not going to charge your arm and then they just put, like, no. If you want. How much do you charge to put? I was talking, going across the shirt and just one color, like, all right, that's going to be cheap. I mean, most people be like, well, don't let them know that it's going to be cheap. You know, charge what you're going to charge. But for me, I'm more reasonable and I like for everybody to have my work. I don't want to be too hard to work. You can't afford me. But I also got to the point to where I know I have to charge what I'm worth. Exactly. Do you charge per hour? Or do you charge? Because you know, that was the hard part for me. That's a good question. Because when I started doing anything, DIY and all of that, I used to always just discharge something. And people always said, no, you need to calculate the products that you put in there. And how long did it take you to do it per hour? And when I started to do it, I'm like, ain't nobody can afford me then. Same thing, my brother talked to me all the time about. He's like, you know, so basically if I charge 50 dollars to do a shirt and it takes me, let's say two hours to do that shirt, basically I just got to pay 25 dollars an hour. So I wouldn't make that work in that Walmart. That's why I've been there before. So I was making like 15 an hour. So when I charge somebody to do $1,000 for a project that might take 10 hours, that's what, my math is crazy right now. But basically, you know, I make the money. But you should be the same all around. So even if somebody have a big project for you to do and you charge them $1,000 for that, but this one over here you just did for the $50 and it's $25 an hour, you need to say, okay, look at that paint and say, it's gonna take me about 10 hours. Okay, 25 times 10. This is how much I'm gonna charge you. Yeah, basically, for this, gotcha. They don't know how long it's gonna take me to do it. No, but you know, depending on all of the type of work you've done, you can look at an art, whatever they show you. I'm like, okay, I know XYZ, I know my schedule, I may not have to, okay, I can do that. Five hours. Yeah, and that's something I'm working on too, my whole schedule. As I said, my brother right here, he's important to me because, you know, a lot of people have yes men around them.  Yeah, you know, let me get up in that too. My work, call me. You can have my number when you get through today.  Oh yeah, I already know that. You want to talk love? Hell, I'm the one. I'll give you all the love you need because if you're selling them shirts too cheap, I'm gonna come hard at you about that. If you're selling them too high, I'm gonna say, hey, man, that's too, if you is not selling them because you ain't moving fast enough, I'm your guy. I'm gonna be the one to tell you. Me too, because I want to get some stuff put in here. Yeah, well, a lot of people do, you know, but I just don't know what kind of tag you got in these shirts. I don't know who, man, who's shirt. Stipulation, yeah, yeah, yeah, you got to be legitimate business, man. Yeah, we're gonna have to, we'll buy the T-shirts and you put the stuff on them and we taking half the profit or something. All right, we'll work something out.    You got to think again, TJ. Yeah. Stop it, man. You know what I'm talking about? Yeah. But I will help you if you want. Oh yeah, teamwork made the dream work. Yeah, yeah, yeah. And definitely, and we maybe could critique it and do some things together for some artists. That's what I mean. I'm talking about music artists because there's a hundred thousand, hundred million rappers out here. That's where I would go with it because they, every nigga want to rap. So I would more than likely try to make rapper's shirts. But these niggas want to rap. Are you right? I know I'm right. I just look for what a sweet spot at and I think if you can make something that appeal to that people, those guys? Oh man, you enter the money then. All right, so when I was at PV, of course, I was doing stuff for people on the campus. You know, of course, I used to rap back in the day. D'Rose, one of the rappers from Dallas, went to Preview as well. I made the search for the ice cream paint job video. Yeah, yeah. I remember that. Yeah. So I done stuff for him, you're doing that back then.  There was some nice shirts, too. I love tweets, everybody. Really? Yeah. What do you think that you've done? Do you still deal with some of those same customers? Like I just had a guy coming here, been coming here for 15 years. Right. Can you say that? I have a couple of people who I've been dealing with since I first started paying. That's good. That's a good road. Imagine how many artwork they probably have from you in their house. I love it. I told everybody, hold on to it, cause it's gonna be worth a lot of my money. It's already worth a lot of money. Yes, sir. If you did it, you put your heart and blood, sweat, and tears into it. I'm gonna give it all I like to cuss.  I'm gonna be better than them. Well, see, I don't look at it as a competition. I just use it as motivation. My favorite artist right now, he's from Fort Worth, Trey Wilder. Trey Wilder. What makes him your favorite? What does he do that's different? This is approach to every project. I'm always ready to see what he's gonna do next. He's always coming up with some random different stuff. How do you see it? He said, how do I see it? Oh, Instagram. Okay. So you've never met him person? I never met a Trey in person. But we talk plenty of times about linking up or whatever like that and try to do a collaboration on the piece. But he's sending people, when he can't do something, he'll be like, I will teach that, I have a customer of yours who wants to get this, this done. I'm gonna send them your way. Let me know how it work out, whatever like that. So my whole thing is, they're working and building the communication. Yeah. Like a community where everybody working together. Because the fact that he has faith in you to know that you will deliver and satisfy that customer. You know what I mean? Because we were talking about something like that the other day is that be careful of who you recommend because it's your name behind it. As much as you can tell a person, well, you can try them. I don't know this. You are the one recommending them. So your name is sort of behind them no matter what. Even if you say, I don't know, then just don't recommend them. But for the main fact that he recommended you, I mean, he's putting his name behind you. He's trusting in you that you will be able to satisfy them. But if you don't deliver that, nigga, it's not gonna take the blame for you. I can promise you that. I know. I didn't hear it though. Bro, come on.   And you deliver every time. And do those people come back to you? Yeah. And then I send people his way as well. So if I'm not able to do something, I'll go to another artist who I feel like can accommodate what the customer wants in. I have one girl right now who I have worked with me as well, another upcoming artist named Marissa. So I'm showing her how I do everything. So, you know, if I can't do something, she's gonna be the person who I work with me. And so I'm like, well, if I can't do this job, Marissa, here, go over there and knock that out. Do what you do, because, yeah. I never could connect with the pain side. I see them and say, that look good, but it's not my thing. Yeah, I mean, the whole thing. You gotta love it. You have to have a creative side. And that's the thing with painting. Okay, what kind of painting do you, because I've seen, I get in movies because I don't go to those art galleries. Paintings on wall where people have to stare at them and be like, what do you get from, you know, that abstract type of art, where he's like, what do you get from that? And one person said they get this and the artist felt this way and the artist. Yeah, see, I'm not that type of artist. I'm the, I don't do too much thinking when I look at stuff. It's either it catches my attention or it doesn't. But I know they have different mediums that people use from watercolors to acrylics. For my canvases, I use the paint from Home Depot.  And that's how I paint my canvases because I like the way the colors look. It's more vibrant. You don't have to. And that's not even acrylic. That's not, it's wall paint. That's wall paint. I didn't know you can use wall paint on canvas. You can use anything. You can ketchup, mustard, whatever you want. I've heard that before, food art. I haven't heard about that, food art.  Really? Yeah, I need it for my sandwiches and my hamburgers. Not for your art. Put half of it on the wall and half of it on your burger. Yeah, you know. Just flick it just a little bit on there. Wow. It's just paint. It's just paint. That's what they say. So, you talk about your mom a lot. Did you have your father in your life? Yeah, he was there in and out, but... I never skipped out on you. Yeah, he did early in my life, but he came around, but he came around. That's what I'm saying. You don't blame it on him. Because he came around. Well, and another thing, I can speak on that subject a little bit. He only mimicking what he knows. You can only do what you know. And that's the problem with us. We get mad at our parents, right? A lot of times, or our parents' parents. But they're only doing what they was taught from their parents. So, we have to have a... Understanding. Yeah, we have to forgive, first of all. And we gotta stop that curse so we can move on, man, because our people went through a lot. I gotta always say that on here. So, don't let that be the reason. And I'm not saying you, but that's, I mean, my dad was the same way. Like, when they broke up, my mom and my dad broke up. How old were you when that happened? Nine years old. But at the end of the day, I didn't like some of the stuff he'd done, but as I looked at my grandfather, and as I grew older, and when I started to understand God a little more, I started to look at the fact of what all his dad, dad went through and his dad went through. Yeah, see, my old man's dad, he was like a little rose of stone. See what I'm saying? And you start to see this stuff. But see, my old man, he was a hustler, a grinder. He'd do whatever he gotta do to make money. My mom, she's more... Homebody. Homebody, so she did stuff, yeah, structured. She did stuff by the books. So she, school, he'd buy the, you know, hustle, get it, how you gotta get it. So put them two together, you give me. That's right. So I was trying to do the school. I was like... Trying to please parents. Trying to please my parents. But then inside of me, it's always been a grinder. I gotta go get it. So, you know, my old man came down like a month or so ago and he had to talk with me. Came down from where? Colorado. Okay. He came down to Colorado. He be smoking that weed? Nah, he call him funny sticks. Yeah, he not inside this, but we at the Gaylord Hotel. I had two of my kids out there. So he could see them.  He's like, you know, you could be making a whole lot more money doing what you love to do. And he's like, you know, I'm up here doing this, this, this, this, and this.  Like you just gotta get out there and just do it. He's like, at least try. Because if it don't work out, you can always go back and do what you wanna do. But he's like, that shouldn't even be in the back of your mind. So, for somebody who wasn't there for me growing up, like he's made up. You can't make up for a lot of time, but I feel like the information that he gave me at that time that we had- It came when it mattered. Yeah, when it mattered. So, was that your deciding factor to quit your job? It was one of them. Like, I really wanted more for my kids, one more for myself. I've always known what I'm capable of doing, but like I say, it's the people around me who see it in the known. Like my brother here cares. Like, I've been knowing him since 2004.   And sometimes people get really defensive and sensitive when people tell them what they don't wanna hear.  Cause when people out there, like when you get online and start talking about you and everything like that, a lot of people take that stuff to heart. And a lot of people end up- Do your kids live with you? No, they don't. Okay. So that mean you're not with the mom? No, well, he's basically doing the same thing his dad did, the in and out thing. No, no in and out. I'm very active with my kids. But you don't say what I'm coming from? Yeah, so I gotta ask you, man, top three artists of all time, man, did or alive. Do you love music? Well, you should. You was friends with DeRoe. Yeah, I love music. Okay. Well, give me something. I like- You know what I'm saying? Hey, listen, Eric Gabbadu, shout out Eric Gabbadu in Dallas, Texas, man. Say, man, we love you, man. Over at Boss Talk, you gotta come check out the show.  Hey, man, it's up to you. You might as well get on early. My favorite artist for me, Nip, I like to be- Whoa, whoa, whoa, whoa, whoa, Nip. Nip C. Hussle. Yeah, let's say it's his whole name. Don't do that, bro. Nip, like y'all are first name and base name. Man, look, Nip. Where's I? Nip. Well, technically, I met Nip before. You met him? Okay, I did. Do what you meet him at. At DeRoe's video show. Oh, okay, now it's coming together. What y'all doing over there? Y'all smoking that stuff with y'all? I don't smoke it, I don't smoke it. Nah, I stay away from the funny sticks. Yeah, yeah. Funny sticks. So how was it meeting him? Did you talk to him and everything? Not like other people have, but I had a little conversation, but it wasn't long. That's fine. At least you did that. I love his music, though. Yeah, so you saying your number one is? Nip C, for sure. I just like the message that he was putting out there. Is that the first number one for Nip C? I believe so. What's number two? Ludacris, he was another one of my favorite. Luda? That nigga be hollering.  Isn't that the first Luda we've had on here? Yeah, yeah. Yeah, yeah. Yeah, and Luda. This last one, if I were gonna be another first. Who is it? That one was Big Tuck. I love Big Tuck. Big Tuck, yeah. Same. Same. This is my personal, this is my favorite life. For me growing up and what I listen to, like when I, whether it be this art or this in general, this is for me. Hold on, I thought that you would have been, Hold on, I thought you would have been so happy because Big Tuck is from the south. I'm happy because Lisa got one in there. You know what I'm saying? But the trip that part is him and Darrow friends and he didn't even say Darrow. Yeah, I said it. Yeah, yeah, let's get it in, yeah. Yeah, Darrow, shout out to Darrow for coming over and blessing my platform. This nigga ain't saying your name, but I'm saying it. Darrow, man, I love that candy paint job, ice cream paint job, being on BET. Okay, now the thing I'm gonna say here, Lisa, what is it? The thing I'm gonna say, Lisa, I brought the nigga up. You know what I'm talking about? You was gonna pay it right back. Now, so do y'all still talk? I ain't now, let's do it earlier. Now I'm talking about boys on the top three. Do y'all, you know, do you think? No, he can't see this.  His sound to me seemed like he was commercial already when he came when I heard the way his voice sound. More than anybody else in Dallas that I couldn't even think of. Yeah, bro, talent's it for real. So I know that for a fact in my heart, I know why he platinum. I know why he went platinum cause he sound like he should be. Yeah, a lot of people just hating on him. Who hating on him?  Wait a minute, wait a minute, ain't nobody saying that? Nah, I'm just saying, it doesn't get you. Yeah. Now, you already know people on line like, we already talked about it. They hate on me. They hate it on Jesus Christ.  Ain't nobody going to let you make it. You're going to have to grind through it and you better have some tough skin or you don't belong here. Real talk. Cause at the end of the day, you keep mentioning the fact that your brother always giving you constructive criticism. And at the end of the day, you got to have somebody that you got to have tough skin. But you got to have tough skin through all of it.  Then you have to deflect the lies, right? It's so much different. It's like fits her out. Yeah, yeah, yeah, it was really, it was not, you know. The one thing I can say about y'all, man, I love all y'all and the fact that y'all was pulling balls tall. When I called DeRoe, DeRoe pulled up. Like it wasn't nothing. And at the end of the day, when I called Watts, after I found the niggle, he pulled it up. You want ice in that? I know. So, he drank it hot. That was room temperature. So, and I just, I love y'all chemistry, man. And I love the history of the music in Dallas, Texas, man. They're like, you got, yeah, I know it. I know it. I know it goes deep. Y'all, you was a part of the boogie movement. You want them dancing? Nah, I don't do it without the dancing. Oh, you didn't dance? I had my stanky leg moment, but. I never did. Far as to walk that walk when you first heard it, cause that was one of the first ones that he did. Did you think it was hot? Yeah, I mean it. No, no, no, no, no, no, no, no, no, no, no, no, no. Like, so when I partnered with DJ Murk, that's part of the doors up coming with cash. We're out in a. Primetime click? Primetime click, it's in the same bag. Yeah, yeah, let's say it. Primetime click, it's in the same bag. Yeah. Got it tatted on my bag. Let me see it. I don't believe it. I never say he from the primetime click. Let me see it. Keep the camera, no, get that camera, get that camera rolling. Scoot over a little bit. Right there, yeah, right here.  The boy got primetime click on his back. Your genius entertainment.  Nigga, don't put that tattoo on him unless he really, really mean it. Family, I'm big on loyalty. Yeah, so. So you really believe in that primetime click. So all of y'all, how many of y'all was in this primetime click? How many members was it? But rap wise, I believe like six to eight, I feel like we would like to cast money of our era. Like everybody brought something to the table. And what was your role in this click? Well, I rapped, but for me.  Let me get a beat, hold up. I know. No, no, no, no, no, no, no, no, no, no, no, no, no, no. The rock gon' be like, that's why, that's why.  I know, but I feel like for me, I'm more marketing, branding, and just move my art. Like that's what I brought. That's your point.  Well, yeah. So that means something to me. I didn't know that.   I want to be a rapper. I want to do that. And I'm still gonna paint these shirts. And I'm still gonna paint. And it was like my best friend, his dad told me like, your car is gonna be art. Like he's like, you can rap, like music, you good at it, but he's like. You wasn't that good, though. No, no, no, no, no, no. He didn't want to see. He's gonna say you bad. He ain't like my boy. Was he good? Yeah, I can rap. He wasn't that good in rap. I know it. I can rap. Yeah. I can rap. That's your, that's the one tell the truth. What did you just say earlier? That's the one tell the truth right there. That nigga tell the truth. That nigga, what's your name? Cash. Cash tell the truth. Cash is, he said you couldn't rap, man. I couldn't at the beginning.  It's okay not to be a good rapper. No, no, no, no, no, no, no, no, no, no, no. I'm, I'm cool with it. You really think that- Okay, well go ahead and give us some now. Yeah. Get with it. I ain't that cool. No, no, no, no. Drop up to 16. Hey, you like, mm. You, I mean give us some, you know, but like, like, Walla P did. Just come with it. Let's see.  What? No. Oh yeah. She bein' on the table for you. Keep on bein' on the table. We gotta get on instrumental. So you really, you really, okay, what happened? What made you- So basically, when I look at everything, it's like, well, what's bringing money in for me? Okay. Artwork. I make more money doing art than I was making CDs, mixtapes and all that stuff. So I had to come to realization that, you know, music is just somethin' I love to do when I have free time or whatever like that. But I needed to direct my focus more on to the creative side as far as like artwork and everything like that. Cause I've been doin' that since four. That's what I had to love, passin' for before I got into doin' music. So. So, but you said how many people was in the prime time clip? It was probably like 16, 18. It was enough. It was a lot of people who just did different things too as well. So we had the artists as well as, we had like a skateboard team. Of course we had people who DJ had the promotion like, it was deep. Okay. So when Walk That Walk came out again, was you like, this is gonna be one? Yeah, I was excited. You was excited? Yeah. Cause the reaction that we got forward. Y'all was gettin' cause it was, all y'all gettin' the reaction. Right. And did you ever talk to, say Watts or DeRoe and say, hey man, we doin' it big right now? No, but it's one of the things where, we are interacting with each other, but we just already, it's one of the things we already knew. Like DeRoe's word at the, nobody can ever say like it's unmatched. Like his grind, like he be out there middle of the night. We doin' good.  He been there mix and mastering his own stuff like. Oh. Yeah. So he basically was doin', he was a one man show, y'all wasn't doin' nothin'. Nah, everybody, nah, everybody did something, everybody could chill with him. Oh, oh, I just got that. I just got shot at DeRoe, one man show. Nah, I'm sure, but y'all about to do that. But I know, I get it, I get it.  You know what I mean? So I get it, and y'all was in college cause I know, I could look at you and tell, you runnin' out of them little girls dorms and all kinds of stuff. You ain't never been out of Dallas. You go down now, and you start runnin' out of these girl parties, they party at Privy. Don't lie, you wasn't all about the music like you actin' right here. Yeah, it's a mess to your title. What? What? So, but no, no, no, I just know it's a, it's a party town, right? Like, you young, and you get ready to go to college? I feel like every college is a party town. Yeah, this is, like, but not like, but not like PV, not like, no. Have a name to it. So you really, yeah, y'all turned that thing out, bro?  Like, that's what you do when you go to college, though. Well, it was a lot of music down there, bro. Oh, yeah, it was. Y'all was down there really kickin', and Dallas came through that real hard and live, so much so that it permeated into Dallas, Texas, from down there. Yeah, y'all did that. Shout out to them boys.  Yeah. Yeah, spelled it a primetime clear. That was, I don't like how you just laugh when you say that. No, because I know y'all really did it.  Ain't nobody did it like y'all. Yeah. Well, you put that on. Nobody did it like y'all. Like y'all made history. Right or wrong? Most definitely. I'm gonna say it, yeah. I'm just the one to bring it out in the interview, but I know what's going on. I think back, and ain't nobody else did that since it didn't really like that. There's lots of stuff down there. During that time, who was down there to party boys, who else? Yeah, party boys, Bones. Yeah, Bones, Bones, Bones out of Atlanta, Texas. Yeah, he straight out the country. Why you niggas, y'all had who else? Kirk O'Baines. You see what I'm saying? No, no, ain't nobody else did that like they come out of the preview like they did and did that music like that. No, yeah, you niggas is special. Think about it. We said the same thing when Dora was in here. Did her? No, yeah, we talked about a little bit, but not like we talking about hell. No, we going into it. Me and my boy here, he got something for him, baby. He got it tatted on his back. Hell, this nigga crazy. Does everybody in the clique have it tatted on their back? Nah, I think I'm the only one. I know what I just told you. It's one of the pairs. Not one of the pairs. Ace got one. Yeah, on his own. On his hand. Yeah, nigga. Yeah, yeah, he about this himself.   You was serious about it. You know what I'm saying? From West Texas. That's right, yeah. But there ain't nothing wrong with it. You're an artist too, so you like creativeness. Well, yeah, and for me, like I say, everything that's tatted on me has a meaning anyway. So me getting it tatted on my back, along with ingenious, it's like, it means more to me than just a business. Like with family, how we move, like just that whole era coming up, traveling, going to different places. It's like.