Hello,
I was wondering if TI has any documentation on exactly what steps need to be taken to fully harden an AM62 and its bootloaders in the HS-SE configuration after the key fuses are burned. We have seen some things during testing that are concerning and we'd like to ensure we have covered our bases. For example, with U-Boot/SPL booting the PSDK documentation in Section 3.3.1.6 states: "Booting FIT image is not required for GP and HS-FS devices, but on HS-SE devices only the signed FIT image will be allowed to boot." However, we’ve found that an unsigned Linux kernel in the /boot directory of the boot media will in fact be booted by U-Boot’s autoboot feature on an HS-SE device if a signed FITImage is missing. This is with the default configurations.
An observation like this makes us wonder what else we may have initially missed. Aside from obvious steps, like disabling U-boot terminal, does TI have a clear list of steps documented anywhere to take in order to fully harden the AM62, TI SDK's U-Boot distribution, etc? Are there any settings we need to check when setting up the keywriter that aren't explicitly mentioned in the keywriter documentation?
Any guidance or documentation along these lines would be helpful.
Thanks in advance,
Garrett
