Hello mizu,
Are you are attempting to display the values of SPI1S and SPI1D within a debugger window? If so, it is likely that this process will clear the SPRF flag before the code can sense that the flag is set. See whether the function will complete when the registers are not monitored, and without single-stepping through the function.
I also think there may be some misunderstanding about the process of reading the SPI1D register. When a value is written to the register, this is the value that is sent by the SPI module. However, when the same register is read, the value will always be the returned receive value, as a result of the previous send.
For the serial flash device, after sending the command byte and the address bytes, you will likely need to send dummy byte(s) to read the contents.
Regards,
Mac