diff --git a/common/cmd_sf.c b/common/cmd_sf.c
index 0a17782..19b0dc9 100644
--- a/common/cmd_sf.c
+++ b/common/cmd_sf.c
@@ -234,7 +234,7 @@
 	unsigned long len;
 	void *buf;
 	char *endp;
-	int ret;
+	int ret = 1;
 
 	if (argc < 4)
 		return -1;
@@ -264,19 +264,23 @@
 
 	if (strcmp(argv[0], "update") == 0)
 		ret = spi_flash_update(flash, offset, len, buf);
-	else if (strcmp(argv[0], "read") == 0)
-		ret = spi_flash_read(flash, offset, len, buf);
-	else
-		ret = spi_flash_write(flash, offset, len, buf);
+	else if (strncmp(argv[0], "read", 4) == 0 ||
+			strncmp(argv[0], "write", 5) == 0) {
+		int read;
+
+		read = strncmp(argv[0], "read", 4) == 0;
+		if (read)
+			ret = spi_flash_read(flash, offset, len, buf);
+		else
+			ret = spi_flash_write(flash, offset, len, buf);
+
+		printf("SF: %zu bytes @ %#x %s: %s\n", (size_t)len, (u32)offset,
+			read ? "Read" : "Written", ret ? "ERROR" : "OK");
+	}
 
 	unmap_physmem(buf, len);
 
-	if (ret) {
-		printf("SPI flash %s failed\n", argv[0]);
-		return 1;
-	}
-
-	return 0;
+	return ret == 0 ? 0 : 1;
 }
 
 static int do_spi_flash_erase(int argc, char * const argv[])
@@ -305,12 +309,10 @@
 	}
 
 	ret = spi_flash_erase(flash, offset, len);
-	if (ret) {
-		printf("SPI flash %s failed\n", argv[0]);
-		return 1;
-	}
+	printf("SF: %zu bytes @ %#x Erased: %s\n", (size_t)len, (u32)offset,
+			ret ? "ERROR" : "OK");
 
-	return 0;
+	return ret == 0 ? 0 : 1;
 }
 
 #ifdef CONFIG_CMD_SF_TEST
diff --git a/drivers/mtd/spi/spansion.c b/drivers/mtd/spi/spansion.c
index dad30b5..b3ef90f 100644
--- a/drivers/mtd/spi/spansion.c
+++ b/drivers/mtd/spi/spansion.c
@@ -90,6 +90,13 @@
 		.name = "S25FL032P",
 	},
 	{
+		.idcode1 = 0x0216,
+		.idcode2 = 0x4d00,
+		.pages_per_sector = 256,
+		.nr_sectors = 128,
+		.name = "S25FL064P",
+	},
+	{
 		.idcode1 = 0x2018,
 		.idcode2 = 0x4d01,
 		.pages_per_sector = 256,
@@ -101,7 +108,7 @@
 		.idcode2 = 0x4d01,
 		.pages_per_sector = 256,
 		.nr_sectors = 512,
-		.name = "S25FL256S",
+		.name = "S25FL256S_64K",
 	},
 };
 
diff --git a/drivers/mtd/spi/spi_flash.c b/drivers/mtd/spi/spi_flash.c
index 111185a..0e38f59 100644
--- a/drivers/mtd/spi/spi_flash.c
+++ b/drivers/mtd/spi/spi_flash.c
@@ -124,9 +124,6 @@
 		}
 	}
 
-	debug("SF: program %s %zu bytes @ %#x\n",
-	      ret ? "failure" : "success", len, offset);
-
 	spi_release_bus(flash->spi);
 	return ret;
 }
@@ -150,8 +147,10 @@
 	u8 cmd[5];
 
 	/* Handle memory-mapped SPI */
-	if (flash->memory_map)
+	if (flash->memory_map) {
 		memcpy(data, flash->memory_map + offset, len);
+		return 0;
+	}
 
 	cmd[0] = CMD_READ_ARRAY_FAST;
 	spi_flash_addr(offset, cmd);
@@ -205,7 +204,7 @@
 
 int spi_flash_cmd_erase(struct spi_flash *flash, u32 offset, size_t len)
 {
-	u32 start, end, erase_size;
+	u32 end, erase_size;
 	int ret;
 	u8 cmd[4];
 
@@ -225,8 +224,7 @@
 		cmd[0] = CMD_ERASE_4K;
 	else
 		cmd[0] = CMD_ERASE_64K;
-	start = offset;
-	end = start + len;
+	end = offset + len;
 
 	while (offset < end) {
 		spi_flash_addr(offset, cmd);
@@ -248,8 +246,6 @@
 			goto out;
 	}
 
-	debug("SF: Successfully erased %zu bytes @ %#x\n", len, start);
-
  out:
 	spi_release_bus(flash->spi);
 	return ret;
diff --git a/drivers/mtd/spi/winbond.c b/drivers/mtd/spi/winbond.c
index 2716209..8457808 100644
--- a/drivers/mtd/spi/winbond.c
+++ b/drivers/mtd/spi/winbond.c
@@ -18,6 +18,21 @@
 
 static const struct winbond_spi_flash_params winbond_spi_flash_table[] = {
 	{
+		.id			= 0x2014,
+		.nr_blocks		= 16,
+		.name			= "W25P80",
+	},
+	{
+		.id			= 0x2015,
+		.nr_blocks		= 32,
+		.name			= "W25P16",
+	},
+	{
+		.id			= 0x2016,
+		.nr_blocks		= 64,
+		.name			= "W25P32",
+	},
+	{
 		.id			= 0x3013,
 		.nr_blocks		= 8,
 		.name			= "W25X40",
@@ -63,13 +78,18 @@
 		.name			= "W25Q128",
 	},
 	{
+		.id			= 0x4019,
+		.nr_blocks		= 512,
+		.name			= "W25Q256",
+	},
+	{
 		.id			= 0x5014,
-		.nr_blocks		= 128,
-		.name			= "W25Q80",
+		.nr_blocks		= 16,
+		.name			= "W25Q80BW",
 	},
 	{
 		.id			= 0x6016,
-		.nr_blocks		= 512,
+		.nr_blocks		= 64,
 		.name			= "W25Q32DW",
 	},
 	{
@@ -104,7 +124,7 @@
 	}
 
 	flash->page_size = 256;
-	flash->sector_size = 4096;
+	flash->sector_size = (idcode[1] == 0x20) ? 65536 : 4096;
 	flash->size = 4096 * 16 * params->nr_blocks;
 
 	return flash;
diff --git a/drivers/spi/armada100_spi.c b/drivers/spi/armada100_spi.c
index afdbe05..b237c7c 100644
--- a/drivers/spi/armada100_spi.c
+++ b/drivers/spi/armada100_spi.c
@@ -182,15 +182,8 @@
 		goto done;
 	}
 
-	if (dout)
-		pss->tx = dout;
-	else
-		pss->tx = NULL;
-
-	if (din)
-		pss->rx = din;
-	else
-		pss->rx = NULL;
+	pss->tx = dout;
+	pss->rx = din;
 
 	if (flags & SPI_XFER_BEGIN) {
 		spi_cs_activate(slave);
diff --git a/drivers/spi/exynos_spi.c b/drivers/spi/exynos_spi.c
index 607e1cd..01378d0 100644
--- a/drivers/spi/exynos_spi.c
+++ b/drivers/spi/exynos_spi.c
@@ -51,6 +51,7 @@
 	unsigned int mode;
 	enum periph_id periph_id;	/* Peripheral ID for this device */
 	unsigned int fifo_size;
+	int skip_preamble;
 };
 
 static struct spi_bus *spi_get_bus(unsigned dev_index)
@@ -105,6 +106,8 @@
 	else
 		spi_slave->fifo_size = 256;
 
+	spi_slave->skip_preamble = 0;
+
 	spi_slave->freq = bus->frequency;
 	if (max_hz)
 		spi_slave->freq = min(max_hz, spi_slave->freq);
@@ -217,17 +220,23 @@
 	writel(count | SPI_PACKET_CNT_EN, &regs->pkt_cnt);
 }
 
-static void spi_rx_tx(struct exynos_spi_slave *spi_slave, int todo,
-			void **dinp, void const **doutp)
+static int spi_rx_tx(struct exynos_spi_slave *spi_slave, int todo,
+			void **dinp, void const **doutp, unsigned long flags)
 {
 	struct exynos_spi *regs = spi_slave->regs;
 	uchar *rxp = *dinp;
 	const uchar *txp = *doutp;
 	int rx_lvl, tx_lvl;
 	uint out_bytes, in_bytes;
+	int toread;
+	unsigned start = get_timer(0);
+	int stopping;
 
 	out_bytes = in_bytes = todo;
 
+	stopping = spi_slave->skip_preamble && (flags & SPI_XFER_END) &&
+					!(spi_slave->mode & SPI_SLAVE);
+
 	/*
 	 * If there's something to send, do a software reset and set a
 	 * transaction size.
@@ -238,6 +247,8 @@
 	 * Bytes are transmitted/received in pairs. Wait to receive all the
 	 * data because then transmission will be done as well.
 	 */
+	toread = in_bytes;
+
 	while (in_bytes) {
 		int temp;
 
@@ -248,15 +259,43 @@
 			writel(temp, &regs->tx_data);
 			out_bytes--;
 		}
-		if (rx_lvl > 0 && in_bytes) {
+		if (rx_lvl > 0) {
 			temp = readl(&regs->rx_data);
-			if (rxp)
-				*rxp++ = temp;
-			in_bytes--;
+			if (spi_slave->skip_preamble) {
+				if (temp == SPI_PREAMBLE_END_BYTE) {
+					spi_slave->skip_preamble = 0;
+					stopping = 0;
+				}
+			} else {
+				if (rxp || stopping)
+					*rxp++ = temp;
+				in_bytes--;
+			}
+			toread--;
+		} else if (!toread) {
+			/*
+			 * We have run out of input data, but haven't read
+			 * enough bytes after the preamble yet. Read some more,
+			 * and make sure that we transmit dummy bytes too, to
+			 * keep things going.
+			 */
+			assert(!out_bytes);
+			out_bytes = in_bytes;
+			toread = in_bytes;
+			txp = NULL;
+			spi_request_bytes(regs, toread);
+		}
+		if (spi_slave->skip_preamble && get_timer(start) > 100) {
+			printf("SPI timeout: in_bytes=%d, out_bytes=%d, ",
+			       in_bytes, out_bytes);
+			return -1;
 		}
 	}
+
 	*dinp = rxp;
 	*doutp = txp;
+
+	return 0;
 }
 
 /**
@@ -276,6 +315,7 @@
 	struct exynos_spi_slave *spi_slave = to_exynos_spi(slave);
 	int upto, todo;
 	int bytelen;
+	int ret = 0;
 
 	/* spi core configured to do 8 bit transfers */
 	if (bitlen % 8) {
@@ -289,16 +329,24 @@
 
 	/* Exynos SPI limits each transfer to 65535 bytes */
 	bytelen =  bitlen / 8;
-	for (upto = 0; upto < bytelen; upto += todo) {
+	for (upto = 0; !ret && upto < bytelen; upto += todo) {
 		todo = min(bytelen - upto, (1 << 16) - 1);
-		spi_rx_tx(spi_slave, todo, &din, &dout);
+		ret = spi_rx_tx(spi_slave, todo, &din, &dout, flags);
+		if (ret)
+			break;
 	}
 
 	/* Stop the transaction, if necessary. */
-	if ((flags & SPI_XFER_END))
+	if ((flags & SPI_XFER_END) && !(spi_slave->mode & SPI_SLAVE)) {
 		spi_cs_deactivate(slave);
+		if (spi_slave->skip_preamble) {
+			assert(!spi_slave->skip_preamble);
+			debug("Failed to complete premable transaction\n");
+			ret = -1;
+		}
+	}
 
-	return 0;
+	return ret;
 }
 
 /**
@@ -325,6 +373,7 @@
 
 	clrbits_le32(&spi_slave->regs->cs_reg, SPI_SLAVE_SIG_INACT);
 	debug("Activate CS, bus %d\n", spi_slave->slave.bus);
+	spi_slave->skip_preamble = spi_slave->mode & SPI_PREAMBLE;
 }
 
 /**
diff --git a/drivers/spi/tegra114_spi.c b/drivers/spi/tegra114_spi.c
index b11a0a1..4d2af48 100644
--- a/drivers/spi/tegra114_spi.c
+++ b/drivers/spi/tegra114_spi.c
@@ -152,13 +152,11 @@
 		return NULL;
 	}
 
-	spi = malloc(sizeof(struct tegra_spi_slave));
+	spi = spi_alloc_slave(struct tegra_spi_slave, bus, cs);
 	if (!spi) {
 		printf("SPI error: malloc of SPI structure failed\n");
 		return NULL;
 	}
-	spi->slave.bus = bus;
-	spi->slave.cs = cs;
 	spi->ctrl = &spi_ctrls[bus];
 	if (!spi->ctrl) {
 		printf("SPI error: could not find controller for bus %d\n",
diff --git a/drivers/spi/tegra20_sflash.c b/drivers/spi/tegra20_sflash.c
index 9322ce7..7c3a3fc 100644
--- a/drivers/spi/tegra20_sflash.c
+++ b/drivers/spi/tegra20_sflash.c
@@ -132,8 +132,6 @@
 		printf("SPI error: malloc of SPI structure failed\n");
 		return NULL;
 	}
-	spi->slave.bus = bus;
-	spi->slave.cs = cs;
 	spi->ctrl = &spi_ctrls[bus];
 	if (!spi->ctrl) {
 		printf("SPI error: could not find controller for bus %d\n",
diff --git a/include/spi.h b/include/spi.h
index 3fe2e1e..1638b50 100644
--- a/include/spi.h
+++ b/include/spi.h
@@ -37,11 +37,16 @@
 #define	SPI_LSB_FIRST	0x08			/* per-word bits-on-wire */
 #define	SPI_3WIRE	0x10			/* SI/SO signals shared */
 #define	SPI_LOOP	0x20			/* loopback mode */
+#define	SPI_SLAVE	0x40			/* slave mode */
+#define	SPI_PREAMBLE	0x80			/* Skip preamble bytes */
 
 /* SPI transfer flags */
 #define SPI_XFER_BEGIN	0x01			/* Assert CS before transfer */
 #define SPI_XFER_END	0x02			/* Deassert CS after transfer */
 
+/* Header byte that marks the start of the message */
+#define SPI_PREAMBLE_END_BYTE	0xec
+
 /*-----------------------------------------------------------------------
  * Representation of a SPI slave, i.e. what we're communicating with.
  *