I'm using BBB in my project. I need to prevent any changes to the software running on it. I've been reading about uBoot and TPM. But if I understand everything correctly, this can't be implemented correctly, that is, in a really secure manner. I understand that during boot, each boot stage passes "something" to TPM, TPM hashes it with the previous value and stores the result in the proper register. But for it to work as expected, at least the first stage must be engraved in stone (or at least unchangeable by third party). This is not the case if the first stage (uBoot in my case) can be easily replaced and changed in such a way that what is passed to TPM is not what is executed later. This means that later stages can be changed (logic, data, anything) without TPM noticing them.
I believe there is a flaw in my logic or I failed to grasp some crucial detail, because AFAIK BIOS (first stage in aforementioned chain) can be overwritten with a new image, which means that an attacker with physical access to the machine could circumvent any security measures taken by the machine owner.
Where is the flaw in my thinking?