@samitouri / QOSamiQemu / commits / 42b6165cd7

hw/block: m25p80: Fix dummy byte handling for Numonyx/Micron flash

Numonyx/Micron flashes [1] do not use one fixed dummy-phase width for all fast-read commands. The volatile configuration register stores a number of dummy clock cycles, and QEMU must convert that value to the number of SSI bytes consumed by the flash model. Keep the existing default: 10 dummy clocks in Quad I/O mode and 8 dummy clocks otherwise. In Quad I/O and Dual I/O protocol modes, all command phases are transferred on 4 or 2 lines, so the dummy clock count still needs to be scaled by that bus width. Standard SPI, also called extended SPI in the Micron datasheet, is more subtle. Quad Output Fast Read (6Bh) and Dual Output Fast Read (3Bh) keep the opcode and address phases on DQ0; their dummy phase is just a clock gap before data is returned on four or two output lines. Do not scale the dummy count for those output-only commands. Only Quad I/O Fast Read (EBh) and Dual I/O Fast Read (BBh) transfer the address and dummy phases on the 4-bit or 2-bit bus, so keep scaling those commands. [1] https://docs.rs-online.com/cad7/0900766b8121bd3c.pdf Fixes: 23af26856606 ("hw/block/m25p80: Fix Numonyx fast read dummy cycle count") Signed-off-by: Bin Meng <bin.meng@processmission.com> Tested-by: Cédric Le Goater <clg@redhat.com> Message-ID: <20260707083431.219671-3-bin.meng@processmission.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

Bin Meng committed Jul 7, 2026 at 16:34 UTC 42b6165cd76fda7a2b1fcb2819811883178c53f5

1 file changed +42 -13

hw/block/m25p80.c

+42 -13

@@ -971,28 +971,57 @@ static uint8_t numonyx_mode(Flash *s)

971 }

972 }

973

974 -static uint8_t numonyx_extract_cfg_num_dummies(Flash *s)

974 +static uint8_t numonyx_extract_cfg_dummy_bytes(Flash *s)

975 {

976 - uint8_t num_dummies;

976 + uint8_t dummy_bits;

977 uint8_t mode;

978 - assert(get_man(s) == MAN_NUMONYX);

978

979 mode = numonyx_mode(s);

981 - num_dummies = extract32(s->volatile_cfg, 4, 4);

980 + dummy_bits = extract32(s->volatile_cfg, 4, 4);

981

983 - if (num_dummies == 0x0 || num_dummies == 0xf) {

982 + /*

983 + * The default nubmer of dummy cycles is only related to the SPI

984 + * protocol mode. For QSPI it is 10, otherwise it is 8.

985 + */

986 + if (dummy_bits == 0x0 || dummy_bits == 0xf) {

987 + dummy_bits = (mode == MODE_QIO) ? 10 : 8;

988 + }

989 +

990 + /*

991 + * Convert the number of dummy cycles to bytes.

992 + *

993 + * In the Dual I/O and Quad I/O protocols, all command phases use 2 or 4

994 + * lines. In standard/extended SPI mode the phase width depends on the

995 + * command sequence: output-only fast reads keep the dummy clocks on the

996 + * single address line, while input/output fast reads use the same 2-line

997 + * or 4-line phase as the address.

998 + */

999 +

1000 + if (mode == MODE_QIO) {

1001 + dummy_bits *= 4;

1002 + } else if (mode == MODE_DIO) {

1003 + dummy_bits *= 2;

1004 + } else {

1005 switch (s->cmd_in_progress) {

1006 case QIOR:

1007 case QIOR4:

987 - num_dummies = 10;

1008 + dummy_bits *= 4;

1009 break;

989 - default:

990 - num_dummies = (mode == MODE_QIO) ? 10 : 8;

1010 + case DIOR:

1011 + case DIOR4:

1012 + dummy_bits *= 2;

1013 break;

992 - }

1014 + }

1015 }

1016

995 - return num_dummies;

1017 + /*

1018 + * Assert that the dummy bit count is byte-aligned

1019 + * as SSI core can only consume whole dummy bytes.

1020 + */

1021 + assert(dummy_bits % 8 == 0);

1022 +

1023 + /* return the number of dummy bytes */

1024 + return dummy_bits / 8;

1025 }

1026

1027 static void decode_fast_read_cmd(Flash *s)

@@ -1007,7 +1036,7 @@ static void decode_fast_read_cmd(Flash *s)

1036 s->needed_bytes += 1;

1037 break;

1038 case MAN_NUMONYX:

1010 - s->needed_bytes += numonyx_extract_cfg_num_dummies(s);

1039 + s->needed_bytes += numonyx_extract_cfg_dummy_bytes(s);

1040 break;

1041 case MAN_MACRONIX:

1042 if (extract32(s->volatile_cfg, 6, 2) == 1) {

@@ -1059,7 +1088,7 @@ static void decode_dio_read_cmd(Flash *s)

1088 );

1089 break;

1090 case MAN_NUMONYX:

1062 - s->needed_bytes += numonyx_extract_cfg_num_dummies(s);

1091 + s->needed_bytes += numonyx_extract_cfg_dummy_bytes(s);

1092 break;

1093 case MAN_MACRONIX:

1094 switch (extract32(s->volatile_cfg, 6, 2)) {

@@ -1109,7 +1138,7 @@ static void decode_qio_read_cmd(Flash *s)

1138 );

1139 break;

1140 case MAN_NUMONYX:

1112 - s->needed_bytes += numonyx_extract_cfg_num_dummies(s);

1141 + s->needed_bytes += numonyx_extract_cfg_dummy_bytes(s);

1142 break;

1143 case MAN_MACRONIX:

1144 switch (extract32(s->volatile_cfg, 6, 2)) {