From: Bernhard Beschow Date: Mon, 20 Jul 2026 20:11:32 +0000 (+0200) Subject: hw/sd/sdcard: Fix error case for CMD18 X-Git-Tag: v11.1.0-rc1~3^2~2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c477e32b645df6f72fe64f59615fd2195faa64c8;p=thirdparty%2Fqemu.git hw/sd/sdcard: Fix error case for CMD18 In commit 468fa450a7e0 ("hw/sd: Switch read/write primitive to buf+len"), `sd_read_byte()` changed its contract to return the read size rather than the read value (and was renamed to `sd_read_data()` accordingly). In an error case, however, `sd_read_data()` returns 0 by means of `dummy_byte` which is the code for the old contract. Moreover, `sdbus_read_data()` asserts the virtual method `read_data()` (and thus `sd_read_data()`) to return a non-zero size, i.e. to make progress and not loop forever. Fix the code to behave like the "DAT read illegal for command" case. Fixes: 468fa450a7e0 ("hw/sd: Switch read/write primitive to buf+len") Reviewed-by: Bin Meng Signed-off-by: Bernhard Beschow Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20260720201133.24796-2-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé --- diff --git a/hw/sd/sd.c b/hw/sd/sd.c index 3360757004..a30c541df0 100644 --- a/hw/sd/sd.c +++ b/hw/sd/sd.c @@ -2860,7 +2860,8 @@ static size_t sd_read_data(SDState *sd, void *buf, size_t length) if (sd->data_offset == 0) { if (!address_in_range(sd, "READ_MULTIPLE_BLOCK", sd->data_start, io_len)) { - return dummy_byte; + *value = dummy_byte; + return length; } partition_access = sd->ext_csd[EXT_CSD_PART_CONFIG] & EXT_CSD_PART_CONFIG_ACC_MASK;