ast2600 fails to run u-boot

qemu 9.1 fails to boot upstream u-boot for the ast2600-evb, crashing in the spl.

git clone https://github.com/u-boot/u-boot.git
cd u-boot
make evb-ast2600_defconfig
make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf-
truncate -s 64M u-boot-with-spl.bin

qemu-system-arm -nographic -M ast2600-evb -drive file=u-boot-with-spl.bin,if=mtd,format=raw

u32 spl_boot_device(void)
{
...
        scu = devfdt_get_addr_ptr(scu_dev);
        if (IS_ERR_OR_NULL(scu)) {
                debug("%s: failed to get SCU base\n", __func__);
                goto out;
        }

        /* boot from UART has higher priority */
        if (scu->hwstrap2 & SCU_HWSTRAP2_BOOT_UART)
                return BOOT_DEVICE_UART;

        if (scu->hwstrap1 & SCU_HWSTRAP1_BOOT_EMMC)
                return BOOT_DEVICE_MMC1;

out:
        return BOOT_DEVICE_RAM;
}

   0x00000394 <+24>:	bl	0x8fa0 <devfdt_get_addr_ptr>
   0x00000398 <+28>:	cmp	r0, #0
   0x0000039a <+30>:	beq.n	0x38a <spl_boot_device+14>
   0x0000039c <+32>:	cmn.w	r0, #4096	@ 0x1000
   0x000003a0 <+36>:	bhi.n	0x38a <spl_boot_device+14>
   0x000003a2 <+38>:	ldr.w	r3, [r0, #1296]	@ 0x510
   0x000003a6 <+42>:	lsls	r3, r3, #23
   0x000003a8 <+44>:	itet	pl
=> 0x000003aa <+46>:	ldrbpl.w	r0, [r0, #1280]	@ 0x500
   0x000003ae <+50>:	movmi	r0, #7
   0x000003b0 <+52>:	ubfxpl	r0, r0, #2, #1
   0x000003b4 <+56>:	b.n	0x38c <spl_boot_device+16>

(gdb) info registers 
r0             0x1e6e2000          510533632
r1             0x0                 0
r2             0x82fffe5c          -2097152420
r3             0x1800000           25165824
r4             0x82fffed4          -2097152300
r5             0xaac8              43720
r6             0x0                 0
r7             0x0                 0
r8             0x0                 0
r9             0x82ffff20          -2097152224
r10            0xdeadbeef          -559038737
r11            0x0                 0
r12            0x1c                28
sp             0x82fffeb0          0x82fffeb0
lr             0x1e8f              7823
pc             0x3aa               0x3aa <spl_boot_device+46>

The instruction ldrbpl.w appears to be a load:

Load Register Byte (immediate) calculates an address from a base register value and an immediate offset, loads a byte from memory, zero-extends it to form a 32-bit word, and writes it to a register. It can use offset, post-indexed, or pre-indexed addressing. For information about memory accesses see Memory accesses.

The SCU memory region is defined:

static const MemoryRegionOps aspeed_ast2600_scu_ops = {
    .read = aspeed_ast2600_scu_read,
    .write = aspeed_ast2600_scu_write,
    .endianness = DEVICE_LITTLE_ENDIAN,
    .valid.min_access_size = 4,
    .valid.max_access_size = 4,
    .valid.unaligned = false,
};

So changing min_access_size to 1 should resolve this. I don't think it's a u-boot bug as on hardware we can do byte loads to the peripheral.

The 2500 model would have the same issue.