Why does PBI stop after 0x300 bytes?

[tmoos]

Hi experts,

I'm trying to secure-boot from SD card, on a QorIQ T1023. I created a PBI which should do the following:

• Configure CPC as SRAM (256 KiB) and map it to 0xbff0_0000
• Configure ACS to be at 0xbef4_0000 (i.e. SRAM is part of ACS)
• Set SCRATCHRW1 to 0xbff3_fffc (which is located within SRAM)
• Setup SPI (this is legacy - I simply didn't touch it)
• Copy CSF from SD card into SRAM (starting at ACS+0xfd_7000)
• Copy U-Boot SPL from SD card into SRAM (starting at ACS+0xfd_8000)

I can monitor the SD card lines with an logic analyzer. What I see is:

1. The PBI is read from SD card, but only the first 70 bytes or so (i.e. the RCW is read)
2. 1,22 ms pause (maybe RCW is being applied?)
3. The PBI is read again from SD card, starting with RCW, but only the first 0x300 bytes.
4. The SoC stops. Nothing more happens.

I wonder that reading the PBI stops, even before the ISBC is started. I attach my binary to this post. It consists of the PBI and the main U-Boot (which comes after the PBI). I copied this binary to my SD card, at offset 0x1000.

Can you explain what happens?

Kind regards, Tanjeff

[tmoos]

Your solution works, thanks a lot!

However, I don't understand, why it works now. Can you give an explanation, please?

[ufedor]

256k is 0x40000.

Base address 0xBFFC0000 gives memory window up to 0xBFFFFFFF.

Addresses in the PBI instructions are provided as 3-byte (6 hexadecimal digits) offsets, so ACS base address for the above SRAM area has to be 0xBF000000.

[tmoos]

> 256k is 0x40000.

> Base address 0xBFFC0000 gives memory window up to 0xBFFFFFFF.

And base address 0xBFF00000 gives memory window up to 0xBFF40000. I still don't understand why that window doesn't work. Is there a limitation where the SRAM can be mapped? If yes, where is the limitation documented?

[ufedor]

Please check the U-Boot configuration parameters.

I believe that in default case it must be allocated starting from 0xBFFC0000.

[tmoos]

I found the reason for my problem: The ACS address must be 16 MiB aligned. My ACS address was 0xbef4_0000, which is not properly aligned. The PBL ignores the 24 lower bits, thus using 0xbe00_0000.

This is documented in the "QorIQ T1024 Reference Manual", Rev.0 (07/2015), section "4.5.5 Alternate configuration base address register low (LCC_ALTCBARL)".

[ufedor · Accepted solution]

You wrote:

> Configure CPC as SRAM (256 KiB) and map it to 0xbff0_0000

Please use address 0xBFFC0000.

> Configure ACS to be at 0xbef4_0000 (i.e. SRAM is part of ACS)

Please use address 0xBF000000.