zynqmp-generic: Emulate FSBL hand-off for qemu boot

Qemu boots by loading ATF and jumping to it directory.  A recent change
adds a verification that the data structure passed by the FSBL is correct
in a 'mode 5' (SD card) boot.  If it's not valid ATF will fail to continue
to boot.  (JTAG, 'mode 0' boot will proceed but other system behavior
changes.)

In order to emulate the FSBL handoff to ATF, we need to populate a data
structure in fffc0000, and tell ATF to look at that address.  See the
comments for more information.  This also ends up hard-coding the u-boot
address.  If it changes booting will fail.

Signed-off-by: Mark Hatle <mark.hatle@amd.com>
(cherry picked from commit 800a7efd0aced9445b215451f6e2314cdd7025fc)
Signed-off-by: Mark Hatle <mark.hatle@amd.com>

1 files changed, 28 insertions, 0 deletions

diff --git a/meta-xilinx-core/conf/machine/zynqmp-generic.conf b/meta-xilinx-core/conf/machine/zynqmp-generic.conf
index a2d20869..d24da3b4 100644
--- a/meta-xilinx-core/conf/machine/zynqmp-generic.conf
+++ b/meta-xilinx-core/conf/machine/zynqmp-generic.conf
@@ -101,9 +101,37 @@ QEMU_HW_DTB_PS = "${QEMU_HW_DTB_PATH}/zcu102-arm.dtb"
 QEMU_HW_DTB_PMU = "${QEMU_HW_DTB_PATH}/zynqmp-pmu.dtb"
 
 # Replicate BootROM like behaviour, having loaded SPL and PMU(ROM+FW)
+#
+# In an actual device the FSBL will run first, load ATF and setup the
+# following data structure to tell ATF what to continue booting with.
+#
+# In QEMU emulation we start booting directly from ATF, so we need to
+# setup the structure ourselves.
+#
+# Write to OCM (See UG1085 for more information), address 0xfffc0000
+# the address to boot from (where u-boot is):
+# fffc0000  58 4c 4e 58  01 00 00 00  |XLNX....|
+# fffc0008  00 00 00 08  00 00 00 00  |........|
+# fffc0010  10 00 00 00  00 00 00 00  |........|
+#
+# Then write that address (fffc0000) to 0xffd80048 so ATF can find this block
+#
+# fffc0008 defines the u-boot load address as 0x8000000, if u-boot is
+# expected to be elsewhere in memory, you must adjust the value.
+#
+# We write the structure as big endian to make it easier to match/read
+# the table above.  Remember the CPU is running in little endian mode,
+# with the default resulting in:
+# 00000000fffc0000: 0x584e4c58 0x00000001 0x08000000 0x00000000
+# 00000000fffc0010: 0x00000010 0x00000000
+#
 QB_OPT_APPEND = " \
     -hw-dtb ${QEMU_HW_DTB_PS} \
     ${@qemu_zynqmp_unhalt(d, True)} \
+    -device loader,addr=0xfffc0000,data=0x584c4e5801000000,data-be=true,data-len=8 \
+    -device loader,addr=0xfffc0008,data=0x0000000800000000,data-be=true,data-len=8 \
+    -device loader,addr=0xfffc0010,data=0x1000000000000000,data-be=true,data-len=8 \
+    -device loader,addr=0xffd80048,data=0xfffc0000,data-len=4,attrs-secure=on \
     -device loader,file=${DEPLOY_DIR_IMAGE}/arm-trusted-firmware.elf,cpu-num=0 \
     -device loader,file=${DEPLOY_DIR_IMAGE}/u-boot.elf \
     -device loader,file=${DEPLOY_DIR_IMAGE}/system.dtb,addr=0x100000,force-raw=on \