pflash write timeout u-boot@qemu-system-aarch64

Host environment

• Operating system: Fedora 39, Fedora 40, Debian 12

• OS/kernel version: Linux fedora 6.8.8-300.fc40.x86_64 #1 SMP PREEMPT_DYNAMIC Sat Apr 27 17:53:31 UTC 2024 x86_64 GNU/Linux

• Architecture: x86_64

• QEMU flavor: qemu-system-aarch64

• QEMU version: QEMU emulator version 8.2.2 (qemu-8.2.2-1.fc40)

• QEMU command line:

  qemu-system-aarch64 -machine virt -cpu cortex-a35 -nographic  -smp 2 -m 1G -bios u-boot.bin -drive if=pflash,format=raw,file=varstore.img,readonly=off,index=1 -d guest_errors,unimp --trace "pflash_*"

Emulated/Virtualized environment

• Operating system: U-boot bootloader
• OS/kernel version: 2024.01
• Architecture: aarch64

Description of problem

Emulating the write into flash of environment variables within U-boot is not possible anymore. This works natively in Fedora 39 which has the 8.1.3 qemu version. Stopped working after transitioning to Fedora 40 which currently comes with 8.2.2, also doesn't work with Debian 12 which has 7.2.9.

The write fails with the following message:

=> saveenv
Saving Environment to Flash... Un-Protected 2 sectors
Erasing Flash...
.. done
Erased 2 sectors
Writing to Flash... pflash_write: Write to buffer emulation is flawed
pflash_write: Write to buffer emulation is flawed
pflash_write: Write to buffer emulation is flawed
Flash buffer write timeout at address 4000000 data ffffffffb64f6361
Timeout writing to Flash
Protected 2 sectors
Failed (1)

Steps to reproduce

1. Download or build u-boot for aarch64 qemu. You can extract from u-boot-qemu debian package https://packages.debian.org/unstable/u-boot-qemu .
2. truncate -s 64m varstore.img
3. qemu-system-aarch64 -machine virt -cpu cortex-a35 -nographic -smp 2 -m 1G -bios u-boot.bin -drive if=pflash,format=raw,file=varstore.img,readonly=off,index=1 -d guest_errors,unimp

Additional information

After building versions 8.1.3 and 8.1.4 I found both were working fine regartheless the host OS, the issue was introduced in 8.1.5. After inspecting commits history I drop the following commit hw/pflash: implement update buffer for block writes (hash:fcc79f2e09550b0461792491965fe202ed2219ae) rebuilt and the issue was gone. I then recheck all non working versions and both versions 8.2.2 and 7.2.9 also have this commit, this explains why it also doesn't work. I attached a trace running with v8.1.5 and v8.1.5 with drop commit. v8.1.5.log v8.1.5-drop-fcc79f2e.log