From 3623a36693d4e29e116f2fb8461fee115180b1dd Mon Sep 17 00:00:00 2001
From: Evan Reichard <evan@reichard.io>
Date: Tue, 21 Jul 2026 07:42:41 -0400
Subject: [PATCH] Fix SPI-SD write-token timing and CMD13 response

ssi-sd now enters token mode as it returns the final R1 byte, so the
write-data token that immediately follows is not discarded. SPI CMD13
returns the internal sd_r1 response (upstream fix) instead of sd_r2_s,
which the adapter converts to the two-byte SPI R2 status; this stops the
repeated "Unexpected response to cmd 13" loop on guest status polls.

Drops the experimental store-TB TCI forcing and sd-watch OOB logging now
that the raw FAT32 image path is stable.
---
 hw/sd/sd.c                  |  2 +-
 hw/sd/ssi-sd.c              | 12 ++++++++++--
 tcg/wasm32.c                | 14 --------------
 tcg/wasm32/tcg-target.c.inc |  1 -
 4 files changed, 11 insertions(+), 18 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index f9bd03f3fd..c72d0fe254 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -1649,7 +1649,7 @@ static sd_rsp_type_t sd_cmd_SEND_STATUS(SDState *sd, SDRequest req)
     }
 
     if (sd_is_spi(sd)) {
-        return sd_r2_s;
+        return sd_r1;
     }
 
     return sd_req_rca_same(sd, req) ? sd_r1 : sd_r0;
diff --git a/hw/sd/ssi-sd.c b/hw/sd/ssi-sd.c
index eb12207897..8391b1f2de 100644
--- a/hw/sd/ssi-sd.c
+++ b/hw/sd/ssi-sd.c
@@ -260,8 +260,16 @@ static uint32_t ssi_sd_transfer(SSIPeripheral *dev, uint32_t val)
         return SSI_DUMMY;
     case SSI_SD_RESPONSE:
         if (s->response_pos < s->arglen) {
-            DPRINTF("Response 0x%02x\n", s->response[s->response_pos]);
-            return s->response[s->response_pos++];
+            uint8_t response = s->response[s->response_pos++];
+
+            DPRINTF("Response 0x%02x\n", response);
+            /* Write Token Timing - A write-data token may immediately follow the final R1 byte.
+             * Enter token mode now so the next transfer is not discarded. */
+            if (s->response_pos == s->arglen &&
+                sdbus_receive_ready(&s->sdbus)) {
+                s->mode = SSI_SD_CMD;
+            }
+            return response;
         }
         if (s->stopping) {
             s->stopping = 0;
diff --git a/tcg/wasm32.c b/tcg/wasm32.c
index 19b31ed4df..3405dc4425 100644
--- a/tcg/wasm32.c
+++ b/tcg/wasm32.c
@@ -29,7 +29,6 @@
 #include <emscripten.h>
 #include <emscripten/threading.h>
 #include "wasm32.h"
-#include "exec/translation-block.h"
 
 __thread uintptr_t tci_tb_ptr;
 __thread bool wasm_tci_only_tb;
@@ -511,19 +510,6 @@ static void tci_qemu_st(CPUArchState *env, uint64_t taddr, uint64_t val,
     uintptr_t ra = (uintptr_t)tb_ptr;
 
     uint64_t target_addr = tlb_load(env, taddr, mop, ptr, false);
-    if (target_addr != 0) {
-        uint64_t mem_bytes = (uint64_t)__builtin_wasm_memory_size(0) << 16;
-        if (target_addr + (1u << (mop & MO_SIZE)) > mem_bytes) {
-            TranslationBlock *tb = tcg_tb_lookup(ra);
-            fprintf(stderr,
-                "[sd-watch] OOB store pc=%08llx gaddr=%08llx haddr=%08llx size=%u value=%08llx membytes=%08llx\n",
-                (unsigned long long)(tb ? tb->pc : 0),
-                (unsigned long long)taddr, (unsigned long long)target_addr,
-                1u << (mop & MO_SIZE), (unsigned long long)val,
-                (unsigned long long)mem_bytes);
-            return;
-        }
-    }
     if (target_addr != 0) {
         switch (mop & MO_SIZE) {
         case MO_UB:
diff --git a/tcg/wasm32/tcg-target.c.inc b/tcg/wasm32/tcg-target.c.inc
index 053c941f99..bbdb2de88f 100644
--- a/tcg/wasm32/tcg-target.c.inc
+++ b/tcg/wasm32/tcg-target.c.inc
@@ -3370,7 +3370,6 @@ static void tcg_out_qemu_ld(TCGContext *s, TCGOpcode opc, const TCGArg *args, bo
 }
 static void tcg_out_qemu_st(TCGContext *s, TCGOpcode opc, const TCGArg *args, bool is_64)
 {
-    wasm_tci_only_tb = true;
     tcg_tci_out_qemu_ldst(s, opc, args);
     tcg_wasm_out_qemu_st(s, args, is_64);
 }