Background:
On HAB closed part, before loading an image, ROM code will check the image target address and size to make sure it fits into valid memory range.
The reason that ROM performs this check is that SD/EMMC data are read by block (512 Byte), and NAND are read by page. The maximum NAND page size supported by ROM is 16KB, and NAND driver puts its auxiliary buffer after the page read-to address + 16KB. Without this check, there could be a security hole when NAND driver loads Metadata from NAND page (the Metadata could be controlled by a hacker) to overwrite the memory that is reserved by ROM. So, this check is mandatory for NAND boot.
Issue:
If the image target address is OCRAM, ROM does this check to make sure it fits into OCRAM Free Space and also makes sure ROM's internal data will not be overwritten. While doing the check, ROM aligns up the image size with an alignment-up value which depends on the boot device. See table below for the alignment-up values.
Boot Device | Alignment-up Value |
SD/EMMC | 512 Byte |
NAND | 18KB (if supported on this chip) |
No alignment-up will be done for other boot devices.
On 6UL 1.2, the OCRAM free space is 0x00907000~0x00917FFC, which is 0x10FFC in bytes. Thus, NAND boot will allow a maximum size of 0xD800 in bytes to download to the OCRAM free space.
Workaround:
For large size boot image with SD/EMMC and NAND boot, it is suggested that user loads the image to DDR rather than OCRAM.
Affected Chips:
| i.MX Chip | Tape Out |
|---|
| i.MX6 DQP | 1.1 |
|---|
| i.MX6 DQ | 1.6 |
|---|
| i.MX6 SDL | 1.4 |
|---|
| i.MX6 SX | 1.4 |
|---|
| i.MX6 SL | 1.4 |
|---|
| i.MX6 SLL | 1.1 |
|---|
| i.MX6 UL | 1.2 |
|---|
i.MX6 ULL | 1.1 |
|---|
i.MX7 D | 1.3 |
|---|
P.S. - Please email me for any suggestions/changes to this document.
P.P.S. - This document is up to date as of 06-06-2018
