The issue with the AllWinner Sunxi chips is somewhat similar to the VideoCore booter where an internal ROM is required to boot the CPU; this has been open sourced somewhat recently, but we can't really inspect or change it.
On the other hand, it's not really that much of a big deal since unlike some other chips, it doesn't lock you out of anything, it just does normal basic stuff like making sure the WDT doesn't reset your CPU before you have had a chance to setup the bare minimum of registers and interrupt tables. For me, I'd either have a chip that has a boot vector outside of itself (i.e. some fixed SPI address) or something so small and measurable that it doesn't really matter much (like this BROM).
The big 'next gen' problem we have is somewhat separate but regarding root of trust in hardware it's nearly impossible to make trusted hardware (from a software perspective) without some device specific PKI that is inside the main CPU and cannot be modified from the outside. The big downside is that there is no way to do this after the fact (otherwise a malicious person could do the same), and doing it ahead of time ties it to the hardware vendor or even the chip fab. Sharing things like private keys to whoever buys the chip doesn't work either, as that would make all of the other chips vulnerable as well. PKI-per-chip doesn't work either, as you wouldn't want to maintain a PKI and re-sign everything for evert individual chip.
eFuses seem to be the only other way, or (E)PROM, but those can be attacked using power hacks (i.e. using a ChipWhisperer).
Perhaps a free and open hardware root of trust is just not feasible.
Comments
The issue with the AllWinner Sunxi chips is somewhat similar to the VideoCore booter where an internal ROM is required to boot the CPU; this has been open sourced somewhat recently, but we can't really inspect or change it.
On the other hand, it's not really that much of a big deal since unlike some other chips, it doesn't lock you out of anything, it just does normal basic stuff like making sure the WDT doesn't reset your CPU before you have had a chance to setup the bare minimum of registers and interrupt tables. For me, I'd either have a chip that has a boot vector outside of itself (i.e. some fixed SPI address) or something so small and measurable that it doesn't really matter much (like this BROM).
The big 'next gen' problem we have is somewhat separate but regarding root of trust in hardware it's nearly impossible to make trusted hardware (from a software perspective) without some device specific PKI that is inside the main CPU and cannot be modified from the outside. The big downside is that there is no way to do this after the fact (otherwise a malicious person could do the same), and doing it ahead of time ties it to the hardware vendor or even the chip fab. Sharing things like private keys to whoever buys the chip doesn't work either, as that would make all of the other chips vulnerable as well. PKI-per-chip doesn't work either, as you wouldn't want to maintain a PKI and re-sign everything for evert individual chip.
eFuses seem to be the only other way, or (E)PROM, but those can be attacked using power hacks (i.e. using a ChipWhisperer).
Perhaps a free and open hardware root of trust is just not feasible.