ADSP-21571 SPI Slave Boot problem

Hi,

I'm trying to boot an ADSP-21571 using SPI Slave mode, but I just can't get it to work.
I'm pretty sure I have configured my SPI Master correctly (msb-first, pos. clk polarity). At the moment I'm running at a very low rate (1MHz).

When analyzing the Boot Stream (as generated by the elfloader tool), I can not quite understand the value of Target Address field in the Block Headers.
From what I understand, for a Normal Block, the Target Address should always be the byte address of where the payload should be loaded.
However, all Target Address fields have $28 in the most-significant byte. The other 24 bits seem to represent the correct address, but multiplied with a factor 2,4, 12 etc compared to the address found in the generated map-file.

Could someone please shed some light on this?

By the way, are there any examples on how to boot an ADSP-.21571 in SPI Slave mode available?

Thanks!