tree c741eec478d2c57bcc4ac3166a04c15bdcb2d74c
parent 0428a0b88fe7c1b85be0e6c66227fc51150336e6
author Andrew F. Davis <afd@ti.com> 1590587275 -0400
committer Lokesh Vutla <lokeshvutla@ti.com> 1592070137 +0530

tools: k3_gen_x509_cert: Set default early HS JTAG access to disabled

When authenticating the initial boot binary the ROM will check a debug
type value in the certificate and based on that open JTAG access to that
core. This only effects HS devices as non-HS device ROM allows JTAG
by default.

This can be useful for HS developers working in the early boot stage,
before SYSFW is loaded. After that point the JTAG access can be
changed based on board configurations passed to SYSFW.

This access can also be a large security problem as JTAG access on
HS devices can be used to circumvent the chain-of-trust controls.
Accidentally leaving this open defeats the security on HS, due to this
change the default to disabled.

This should only effect those working on early HS boot code, which
is a limited crowd who will already know how to re-enable this access
as needed.

Signed-off-by: Andrew F. Davis <afd@ti.com>