Fix SPI-SD write-token timing and CMD13 response

ssi-sd now enters token mode as it returns the final R1 byte, so the
write-data token that immediately follows is not discarded. SPI CMD13
returns the internal sd_r1 response (upstream fix) instead of sd_r2_s,
which the adapter converts to the two-byte SPI R2 status; this stops the
repeated "Unexpected response to cmd 13" loop on guest status polls.

Drops the experimental store-TB TCI forcing and sd-watch OOB logging now
that the raw FAT32 image path is stable.

hw/sd/sd.c

@@ -1649,7 +1649,7 @@ static sd_rsp_type_t sd_cmd_SEND_STATUS(SDState *sd, SDRequest req)
     }
 
     if (sd_is_spi(sd)) {
-        return sd_r2_s;
+        return sd_r1;
     }
 
     return sd_req_rca_same(sd, req) ? sd_r1 : sd_r0;

hw/sd/ssi-sd.c

@@ -260,8 +260,16 @@ static uint32_t ssi_sd_transfer(SSIPeripheral *dev, uint32_t val)
         return SSI_DUMMY;
     case SSI_SD_RESPONSE:
         if (s->response_pos < s->arglen) {
-            DPRINTF("Response 0x%02x\n", s->response[s->response_pos]);
+            uint8_t response = s->response[s->response_pos++];
-            return s->response[s->response_pos++];
+
+            DPRINTF("Response 0x%02x\n", response);
+            /* Write Token Timing - A write-data token may immediately follow the final R1 byte.
+             * Enter token mode now so the next transfer is not discarded. */
+            if (s->response_pos == s->arglen &&
+                sdbus_receive_ready(&s->sdbus)) {
+                s->mode = SSI_SD_CMD;
+            }
+            return response;
         }
         if (s->stopping) {
             s->stopping = 0;

tcg/wasm32.c

@@ -29,7 +29,6 @@
 #include <emscripten.h>
 #include <emscripten/threading.h>
 #include "wasm32.h"
-#include "exec/translation-block.h"
 
 __thread uintptr_t tci_tb_ptr;
 __thread bool wasm_tci_only_tb;
@@ -511,19 +510,6 @@ static void tci_qemu_st(CPUArchState *env, uint64_t taddr, uint64_t val,
     uintptr_t ra = (uintptr_t)tb_ptr;
 
     uint64_t target_addr = tlb_load(env, taddr, mop, ptr, false);
-    if (target_addr != 0) {
-        uint64_t mem_bytes = (uint64_t)__builtin_wasm_memory_size(0) << 16;
-        if (target_addr + (1u << (mop & MO_SIZE)) > mem_bytes) {
-            TranslationBlock *tb = tcg_tb_lookup(ra);
-            fprintf(stderr,
-                "[sd-watch] OOB store pc=%08llx gaddr=%08llx haddr=%08llx size=%u value=%08llx membytes=%08llx\n",
-                (unsigned long long)(tb ? tb->pc : 0),
-                (unsigned long long)taddr, (unsigned long long)target_addr,
-                1u << (mop & MO_SIZE), (unsigned long long)val,
-                (unsigned long long)mem_bytes);
-            return;
-        }
-    }
     if (target_addr != 0) {
         switch (mop & MO_SIZE) {
         case MO_UB:

tcg/wasm32/tcg-target.c.inc

@@ -3370,7 +3370,6 @@ static void tcg_out_qemu_ld(TCGContext *s, TCGOpcode opc, const TCGArg *args, bo
 }
 static void tcg_out_qemu_st(TCGContext *s, TCGOpcode opc, const TCGArg *args, bool is_64)
 {
-    wasm_tci_only_tb = true;
     tcg_tci_out_qemu_ldst(s, opc, args);
     tcg_wasm_out_qemu_st(s, args, is_64);
 }