<!--This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, please consult https://www.qemu.org/contribute/security-process/--> ## Host environment - Operating system: macOS 14.8.7 (build 23J520) - OS/kernel version: Darwin 23.6.0 (xnu-10063.141.1.712.16\~1) - Architecture: arm64 (Apple Silicon) - QEMU flavor: qemu-system-arm, system-mode emulation using the qtest accelerator - QEMU version: EMU emulator version 11.0.91 (v11.0.0-3229-g300438ffbb)   Commit: 300438ffbb8d9430cac2fcc15cba6f482b2c0587 - QEMU command line: Destination:   qemu-system-arm \\     -machine virt \\     -accel qtest \\     -display none \\     -nodefaults \\     -S \\     -qmp unix:/tmp/d.qmp,server=on,wait=off \\     -qtest unix:/tmp/d.qt,server=on,wait=off \\     -incoming unix:/tmp/mig   Source:   qemu-system-arm \\     -machine virt \\     -accel qtest \\     -display none \\     -nodefaults \\     -S \\     -qmp unix:/tmp/s.qmp,server=on,wait=off \\     -qtest unix:/tmp/s.qt,server=on,wait=off - OS/kernel version: N/A. No guest OS or kernel is required; the reproducer accesses the   pflash device directly through qtest. - Architecture: 32-bit ARM, virt machine ## Description of problem ROMD mode is derived from `cmd` and `wcycle`, but never set in `pflash_post_load`. The destination therefore retains the default ROMD=true state. When the  flash was migrated in a non-array mode, reads bypass pflash_read() and return bytes from the backing array instead of the response associated with the migrated command. ## Steps to reproduce 1. ./configure --target-list=arm-softmmu --disable-docs --disable-werror 2. ninja -C build qemu-system-arm 3. Start the destination and source using the command lines above. 4. Through a persistent connection to the source qtest socket, enter ID  mode and read the flash. writel 0x0 0x90  readl 0x0  The read returns:  0x0000000000890089 5. Through the source QMP socket, enable QMP and start migration:  {"execute":"qmp_capabilities"}      {"execute":"migrate","arguments":{"uri":"unix:/tmp/mig"}} 6. Poll query-migrate until its status is "completed": {"execute":"query-migrate"} 7. Through the destination qtest socket, read the flash without issuing another command: readl 0x0 The read incorrectly returns: 0x0000000000000000 8. Re-enter ID mode on the destination and read again: writel 0x0 0x90 readl 0x0 The expected value returns again: 0x0000000000890089 ## Additional information <!--Attach logs, stack traces, screenshots, etc. Compress the files if necessary. If using libvirt, libvirt logs and XML domain information may be relevant.--> <!--The line below ensures that proper tags are added to the issue. Please do not remove it.-->