The user guide incorrectly claimed that it is possible to load a
bootwrapped kernel over JTAG on Juno in the same manner as an EL3
payload. In the EL3 payload boot flow, some of the platform
initialisations in BL2 are modified. In particular, the TZC settings
are modified to allow unrestricted access to DRAM. This in turn allows
the debugger to access the DRAM and therefore to load the image there.

In the BL33-preloaded boot flow though, BL2 uses the default TZC
programming, which prevent access to most of the DRAM from secure state.
When execution reaches the SPIN_ON_BL1_EXIT loop, the MMU is disabled
and thus DS-5 presumably issues secure access transactions while trying
to load the image, which fails.

One way around it is to stop execution at the end of BL2 instead. At
this point, the MMU is still enabled and the DRAM is mapped as
non-secure memory. Therefore, the debugger is allowed to access this
memory in this context and to sucessfully load the bootwr...