U-Boot with OpenSBI on HiFive Unleashed in QEMU: Store/AMO access fault

I've been trying to get U-Boot to work in QEMU for the sifive_u machine. I've tried using both the built in OpenSBI 'BIOS' and building my own OpenSBI, but I keep running into the same issue.

I'm building U-Boot using the riscv64 toolchain from the Arch repos:

➜  u-boot git:(0b0c6af387) riscv64-linux-gnu-gcc --version
riscv64-linux-gnu-gcc (GCC) 9.2.0
Copyright (C) 2019 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
➜  u-boot git:(0b0c6af387) export CROSS_COMPILE=riscv64-linux-gnu-
➜  u-boot git:(0b0c6af387) export ARCH=riscv
➜  u-boot git:(0b0c6af387) make sifive_fu540_defconfig
...
➜  u-boot git:(0b0c6af387) make

I've tried to run this as follows:

➜  opensbi git:(master) ✗ qemu-system-riscv64 -M sifive_u -m 256M -bios default -display none -serial stdio -device loader,addr=0x80200000,file=../u-boot/u-boot.bin

OpenSBI v0.5 (Oct  9 2019 12:03:04)
   ____                    _____ ____ _____
  / __ \                  / ____|  _ \_   _|
 | |  | |_ __   ___ _ __ | (___ | |_) || |
 | |  | | '_ \ / _ \ '_ \ \___ \|  _ < | |
 | |__| | |_) |  __/ | | |____) | |_) || |_
  \____/| .__/ \___|_| |_|_____/|____/_____|
        | |
        |_|

Platform Name          : SiFive Freedom U540
Platform HART Features : RV64ACDFIMSU
Platform Max HARTs     : 5
Current Hart           : 1
Firmware Base          : 0x80000000
Firmware Size          : 96 KB
Runtime SBI Version    : 0.2

PMP0: 0x0000000080000000-0x000000008001ffff (A)
PMP1: 0x0000000000000000-0xffffffffffffffff (A,R,W,X)


U-Boot 2020.01 (Jan 20 2020 - 18:14:27 +0000)

CPU:   rv64imafdc
Model: SiFive HiFive Unleashed A00
DRAM:  exception code: 7 , Store/AMO access fault , epc 8023cbdc , ra 8020c670
### ERROR ### Please RESET the board ###

I've also tried bundling U-Boot as a payload into my own build of OpenSBI:

➜  opensbi git:(master) ✗ export CROSS_COMPILE=riscv64-unknown-elf-
➜  opensbi git:(master) ✗ make PLATFORM=sifive/fu540 FW_PAYLOAD_PATH=../u-boot/u-boot.bin

➜  opensbi git:(master) ✗ qemu-system-riscv64 -M sifive_u -m 256M -bios none -display none -serial stdio -device loader,addr=0x80000000,file=./build/platform/sifive/fu540/firmware/fw_payload.bin


OpenSBI v0.5-32-gc0849cd
   ____                    _____ ____ _____
  / __ \                  / ____|  _ \_   _|
 | |  | |_ __   ___ _ __ | (___ | |_) || |
 | |  | | '_ \ / _ \ '_ \ \___ \|  _ < | |
 | |__| | |_) |  __/ | | |____) | |_) || |_
  \____/| .__/ \___|_| |_|_____/|____/_____|
        | |
        |_|

Platform Name          : SiFive Freedom U540
Platform HART Features : RV64ACDFIMSU
Platform Max HARTs     : 5
Current Hart           : 1
Firmware Base          : 0x80000000
Firmware Size          : 100 KB
Runtime SBI Version    : 0.2

PMP0: 0x0000000080000000-0x000000008001ffff (A)
PMP1: 0x0000000000000000-0xffffffffffffffff (A,R,W,X)


U-Boot 2020.01 (Jan 20 2020 - 18:14:27 +0000)

CPU:   rv64imafdc
Model: SiFive HiFive Unleashed A00
DRAM:  exception code: 7 , Store/AMO access fault , epc 8023cbdc , ra 8020c670
### ERROR ### Please RESET the board ###

I've tried looking at the offending instruction (which I presume is at 0x8023cbdc) based on the error message:

➜  u-boot git:(0b0c6af387) riscv64-unknown-elf-objdump --start-address=0x8023cbdc -d ./u-boot | head -8

./u-boot:     file format elf64-littleriscv


Disassembly of section .text_rest:

000000008023cbdc <memset+0x40>:
    8023cbdc:   fee7bc23                sd      a4,-8(a5)

It's a store, so it's plausible that this is indeed accessing an invalid location; I'm trying to get GDB working so I can examine what's actually happening in more detail, but that's causing issues of its own...

Has anyone had any success with this?

UPDATE

I've managed to fix this specific error by changing the amount of memory with -M 2G; I presume the address it's trying to access lies outside the 256M range, but I'm not sure what it's doing that requires this much RAM.

Now I'm getting the following error:

➜  opensbi git:(master) ✗ qemu-system-riscv64 -M sifive_u -m 8G -bios default -display none -serial stdio -device loader,addr=0x80200000,file=../u-boot/u-boot-dtb.bin

OpenSBI v0.5 (Oct  9 2019 12:03:04)
   ____                    _____ ____ _____
  / __ \                  / ____|  _ \_   _|
 | |  | |_ __   ___ _ __ | (___ | |_) || |
 | |  | | '_ \ / _ \ '_ \ \___ \|  _ < | |
 | |__| | |_) |  __/ | | |____) | |_) || |_
  \____/| .__/ \___|_| |_|_____/|____/_____|
        | |
        |_|

Platform Name          : SiFive Freedom U540
Platform HART Features : RV64ACDFIMSU
Platform Max HARTs     : 5
Current Hart           : 1
Firmware Base          : 0x80000000
Firmware Size          : 96 KB
Runtime SBI Version    : 0.2

PMP0: 0x0000000080000000-0x000000008001ffff (A)
PMP1: 0x0000000000000000-0xffffffffffffffff (A,R,W,X)


U-Boot 2020.01 (Jan 20 2020 - 21:40:02 +0000)

CPU:   rv64imafdc
Model: SiFive HiFive Unleashed A00
DRAM:  8 GiB
MMC:   exception code: 5 , Load access fault , epc fffadbd6 , ra fffadbd2
### ERROR ### Please RESET the board ###
qemu-system-riscv64: terminating on signal 2

Again it's similar (although a load this time); interestingly, the address fffadbd6 isn't part of U-Boot so I've no idea what's happening here; I very much doubt it's running off the end, because then I would expect undefined behaviour as opposed to consistently getting the same bad load.