esp32s3_spi: fix tx/rx bounds and pad 0xEB dummy bytes

Author: ThomasFarstrike

hw/ssi/esp32s3_spi.c

@@ -150,11 +150,11 @@ static void esp32s3_spi_txrx_buffer(ESP32S3SpiState *s,
     int bytes = MAX(tx_bytes, rx_bytes);
     for (int i = 0; i < bytes; ++i) {
         uint8_t byte = 0;
-        if (byte < tx_bytes) {
+        if (i < tx_bytes) {
             memcpy(&byte, tx + i, 1);
         }
         uint32_t res = ssi_transfer(s->spi, byte);
-        if (byte < rx_bytes) {
+        if (i < rx_bytes) {
             memcpy(rx + i, &res, 1);
         }
     }
@@ -272,6 +272,10 @@ static void esp32s3_spi_begin_transaction(ESP32S3SpiState *s)
         }
     }
 
+    if (t.cmd == 0xeb && t.dummy_bytes < 2) {
+        t.dummy_bytes = 2;
+    }
+
     esp32s3_spi_perform_transaction(s, &t);
 }