[U-Boot] trouble booting spl/u-boot from emmc on i.mx6ul

[Robert Cagle]

I am trying to debug a failure to boot spl/u-boot on an NXP i.mx6ul using emmc.
I'm using u-boot source from:
https://github.com/Freescale/u-boot-fslc.git -b 2017.11+fslc 
and I'm building target mx6ul_14x14_evk_defconfig.

I asked for help on the "NXP Community Forum" but was referred here 
since NXP apparently doesn't support spl configurations. 
I'm hoping somebody here might be familiar enough with this soc to help.

Basically I get a brick after reset, with no output on the console. My jtag interface
won't let me halt the cpu immediately after reset, but I can still poke around. 
I can see the ivt (initial part of spl image) loaded in ocram, but the code at the
spl entry point is not correct (more details below).

However, if I manually reload (sdp or jtag) the spl image it runs fine. I can also load and run the 
same spl image on an sd card on a similar reference board (same soc/ddr, but 
sd instead of emmc). So I think the spl image itself is okay.

I should also mention that I can use an older, non-spl u-boot image
that boots from emmc just fine, so I think my hw bootmode/emmc
jumpers are okay. The big difference is the older u-boot is a monolithic
u-boot.imx image (ivt + dcd + u-boot.bin) rather than a split spl + u-boot.img.

For anyone familiar with i.mx6ul boot details, here is what I've tried:

a) checking imx_usb_loader scripts to make sure emmc installation was done correctly.
    dd if=/dev/zero of=/dev/mmcblk1 bs=1k seek=512 conv=fsync count=8
    echo 0 > /sys/block/mmcblk1boot0/force_ro
    dd if=SPL of=/dev/mmcblk1boot0 bs=512 seek=2
    dd if=u-boot.img of=/dev/mmcblk1boot0 bs=512 seek=138
    echo 1 > /sys/block/mmcblk1boot0/force_ro
    mmc bootpart enable 1 1 /dev/mmcblk1

    # My emmc has an 8g user area and two 16MiB boot partitions.
    # I've tried zeroing them all out and writing the spl image to one
    # at a time to verify I am programming/using the correct area
    # of flash. Everything appears ok, and I am able to boot my
    # 2015 version of u-boot from emmc using the same steps.

b) checking the extcsd info on the emmc to make sure boot
   partition is enabled. Also played around with Boot bus conditions
   but wound up leaving them at 0x0.
    
    Boot configuration bytes [PARTITION_CONFIG: 0x48]
     Boot Partition 1 enabled                                             
     No access to boot partition             

    Boot bus Conditions [BOOT_BUS_CONDITIONS: 0x00]         

    # I've tried all combinations I could find, none worked better,
    # many worked worse.

c) after reset, checking smbr1/sbmr2 (they look mostly ok)
    sbmr1=10004860   
            [cfg4: 10 - ECSPIx_SS1 - pulled high by mistake,
                             shouldn't hurt?]
            [cfg3: 00 - reserved]
            [cfg2: 48 - 8-bit, eSDHC2, 0-500/400mhz, 3.3v]
            [cfg1: 60 - emmc, regular-boot, high-speed,
                    fast-boot-ack-enb,
                    no-sd-power-cyc, thru-sd]

    sbmr2=02000041    [bmod=internal, 4=??, sec_config=open]

d) after reset, checking whether ivt got loaded in ocram (it was).
        J-Link>mem32 907400,c
        00907400 = 402000D1 00908000 00000000 00000000
        00907410 = 00907420 00907400 00000000 00000000
        00907420 = 00907000 0000D000 00000000 400400D2

e) checking spl ivt header for correctness (looks ok)
   (script from https://community.nxp.com/docs/DOC-102453)

    $ python3 imxbin.py SPL
    =================IVT data===================
    ivt_length=20
    ivt_entry=908000
    ivt_dcd=0
    ivt_boot_data=907420
    ivt_self=907400
    ivt_csf=0
    =================DCD data===================
    No DCD data in table

f) after reset, checking whether code got loaded into ocram (usually not!)
    Why is ivt okay but this never got loaded or was it overwritten?
    J-Link>mem32 908000,8
    00908000 = 5880BCE7 9EB3322F E4B82B75 BCA61DFB
    00908010 = D81D695D 59B3F13D 483D24F5 21F92F47

    when loading from usb-sdp this ocram location contains correct spl code, and it
    stays there all the way thru the main u-boot prompt. why the difference?
    J-Link>mem32 908000,8
    00908000 = EA00000F E59FF014 E59FF014 E59FF014
    00908010 = E59FF014 E59FF014 E59FF014 E59FF014

Any other ideas on how to debug this? It seems like (f) is a big clue, but
I don't know where to go with it. 

Sorry for the length of this email!

Bob Cagle