[REGRESSION] imx8mm_evk: FSPI build broken by 37e50627e

[Marek Vasut]

On 4/3/26 9:23 PM, Alexander Koch wrote:
> I think I have narrowed down the cause for the broken SPL blob but I don't fully
> understand it.
> 
> Comparing hexdumps of the last working SPL+DDR blob and the first broken one we
> can see three chunks of difference:
> 
> 1) two bytes near the IVT
> 2) U-Boot version string and compile timestamp
> 3) four bytes around offset 0x18b50 (striped at 16 bytes)
> 
> Let's ignore number 2) as that is expected and focus on 1) and 3).
> 
> For the first difference we have at offset 0x20 in spl.bin (0x1020 in
> flash.bin):
> 
>    good: 0000 0020:  C0 0F 7E 00 00 DC 02 00
>     bad: 0000 0020:  C0 1B 7E 00 00 D0 02 00
> 
> I first thought it could be the boot data pointer not reflecting the FSPI config
> blob offset but if I read `struct ivt` correctly this is actually _after_ the
> IVT itself.
> 
> So I patched these two bytes in the broken 'flash.bin' and that made the SPL run
> (while console output still stopped before ATF).

board/nxp/imx8mm_evk/imximage-8mm-lpddr4.cfg:LOADER 
u-boot-spl-ddr.bin      0x7E1000

configs/imx8mm_evk_defconfig:CONFIG_SPL_TEXT_BASE=0x7E1000

It seems the SPL entry point address somehow changed ... from 0x7e0fc0 
to 0x7e1bc0 .. the delta is 0xc00 , does that fit into some offset in 
the imx8mm-u-boot.dtsi binman node ?

> The second chunk of interest is at offset 0x18b50 in spl.bin (0x19b50 in
> flash.bin):
> 
> good:
>    0001 8B50:  B8 C4 80 00 00 00 00 00
>    0001 8B60:  F8 69 80 00 00 00 00 00
>    0001 8B70:  74 63 80 00 00 00 00 00
>    0001 8B80:  80 E5 7F 00 00 00 00 00
> 
> bad:
>    0001 8B50:  B8 D4 80 00 00 00 00 00
>    0001 8B60:  F8 79 80 00 00 00 00 00
>    0001 8B70:  74 73 80 00 00 00 00 00
>    0001 8B80:  80 F5 7F 00 00 00 00 00
> 
> After patching those 4 bytes I got ATF and U-Boot proper running so I'd consider
> that flash.bin fixed.
> 
> Can anybody tell me what we have in those two locations?
These locations are offsets of the lpddr4_pmu_train_* DRAM init blobs , 
see arch/arm/dts/imx8mm-u-boot.dtsi . When binman bundles those blobs 
together with SPL, it patches the locations of those blobs into the SPL 
binary. It seems it patches in the wrong offsets ... offset by 0x1000 
Bytes , isn't that the size of the FSPI page ?

Thank you for investigating this problem, it is much appreciated !

+CC Simon, maybe he can help with binman ?