@samitouri / QOSamiQemu / commits / b9662d6c44

hw/block: m25p80: Fix dummy byte handling for Winbond flash

The m25p80 model uses s->needed_bytes to track how many bytes a controller must send after an opcode before the flash model can enter the data phase. For address-bearing commands this includes the address bytes. For fast-read commands it also includes the dummy phase. The tricky part is that flash datasheets describe the dummy phase in clock cycles, while the QEMU SSI interface advances the flash model one transferred byte at a time. The dummy clock count therefore has to be converted to the number of SSI bytes that the controller will actually emit. Some controllers have drivers that push these dummy bytes into a FIFO. Other controllers are programmed with a dummy-cycle count and generate the clocks themselves. The flash model still has to use the same byte count that a FIFO-style controller or the Linux spi-mem layer would use, otherwise the model waits too long and drops the first data bytes. Let's fix the inconsistency from the flash side first. We start from an easy one, the Winbond flashes. Per the Windbond W25Q256JV datasheet [1] instruction set table (chapter 8.1.2, 8.1.3, 8.1.4, 8.1.5), fix the wrong number of dummy bytes needed for fast read commands. [1] https://www.winbond.com/resource-files/w25q256jv%20spi%20revb%2009202016.pdf Fixes: fe8477052831 ("m25p80: Fix QIOR/DIOR handling for Winbond") Fixes: 3830c7a460b8 ("m25p80: Fix WINBOND fast read command handling") Fixes: cf6f1efe0b57 ("m25p80: Fast read commands family changes") Signed-off-by: Bin Meng <bin.meng@processmission.com> Tested-by: Cédric Le Goater <clg@redhat.com> Message-ID: <20260707083431.219671-2-bin.meng@processmission.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

Bin Meng committed Jul 7, 2026 at 16:34 UTC b9662d6c4452e8c1861e4201b232e97970f4eb35

1 file changed +2 -2

hw/block/m25p80.c

+2 -2

@@ -1004,7 +1004,7 @@ static void decode_fast_read_cmd(Flash *s)

1004 s->needed_bytes += 1;

1005 break;

1006 case MAN_WINBOND:

1007 - s->needed_bytes += 8;

1007 + s->needed_bytes += 1;

1008 break;

1009 case MAN_NUMONYX:

1010 s->needed_bytes += numonyx_extract_cfg_num_dummies(s);

@@ -1099,7 +1099,7 @@ static void decode_qio_read_cmd(Flash *s)

1099 switch (get_man(s)) {

1100 case MAN_WINBOND:

1101 s->needed_bytes += WINBOND_CONTINUOUS_READ_MODE_CMD_LEN;

1102 - s->needed_bytes += 4;

1102 + s->needed_bytes += 2;

1103 break;

1104 case MAN_SPANSION:

1105 s->needed_bytes += SPANSION_CONTINUOUS_READ_MODE_CMD_LEN;