When authenticating the initial boot binary the ROM will check a debug type value in the certificate and based on that open JTAG access to that core.
The default is currently full access, on HS this is useful for early developers, but should not be the default as to prevent end system integrators from unintentionally leaving this open.
On non-HS devices JTAG is left open anyway so this does not change behavior on those devices. Change the default to off and allow it to be switched back on by command line flag if needed.
Signed-off-by: Andrew F. Davis afd@ti.com --- tools/k3_gen_x509_cert.sh | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/tools/k3_gen_x509_cert.sh b/tools/k3_gen_x509_cert.sh index b6d055f6f5..298cec1313 100755 --- a/tools/k3_gen_x509_cert.sh +++ b/tools/k3_gen_x509_cert.sh @@ -12,6 +12,7 @@ RAND_KEY=eckey.pem LOADADDR=0x41c00000 BOOTCORE_OPTS=0 BOOTCORE=16 +DEBUG_TYPE=0
gen_degen_template() { cat << 'EOF' > degen-template.txt @@ -79,7 +80,7 @@ cat << 'EOF' > x509-template.txt
[ debug ] debugUID = FORMAT:HEX,OCT:0000000000000000000000000000000000000000000000000000000000000000 - debugType = INTEGER:4 + debugType = INTEGER:TEST_DEBUG_TYPE coreDbgEn = INTEGER:0 coreDbgSecEn = INTEGER:0 EOF @@ -151,8 +152,9 @@ options_help[k]="key_file:file with key inside it. If not provided script genera options_help[o]="output_file:Name of the final output file. default to $OUTPUT" options_help[c]="core_id:target core id on which the image would be running. Default to $BOOTCORE" options_help[l]="loadaddr: Target load address of the binary in hex. Default to $LOADADDR" +options_help[d]="debug_type: Debug type, set to 4 to enable early JTAG. Default to $DEBUG_TYPE"
-while getopts "b:k:o:c:l:h" opt +while getopts "b:k:o:c:l:d:h" opt do case $opt in b) @@ -170,6 +172,9 @@ do c) BOOTCORE=$OPTARG ;; + d) + DEBUG_TYPE=$OPTARG + ;; h) usage exit 0 @@ -224,12 +229,15 @@ gen_cert() { #echo " LOADADDR = 0x$ADDR" #echo " IMAGE_SIZE = $BIN_SIZE" #echo " CERT_TYPE = $CERTTYPE" + #echo " DEBUG_TYPE = $DEBUG_TYPE" sed -e "s/TEST_IMAGE_LENGTH/$BIN_SIZE/" \ -e "s/TEST_IMAGE_SHA_VAL/$SHA_VAL/" \ -e "s/TEST_CERT_TYPE/$CERTTYPE/" \ -e "s/TEST_BOOT_CORE_OPTS/$BOOTCORE_OPTS/" \ -e "s/TEST_BOOT_CORE/$BOOTCORE/" \ - -e "s/TEST_BOOT_ADDR/$ADDR/" x509-template.txt > $TEMP_X509 + -e "s/TEST_BOOT_ADDR/$ADDR/" \ + -e "s/TEST_DEBUG_TYPE/$DEBUG_TYPE/" \ + x509-template.txt > $TEMP_X509 openssl req -new -x509 -key $KEY -nodes -outform DER -out $CERT -config $TEMP_X509 -sha512 }