Roflin/rebbarb
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix command-space writes, and replay libogc's real init sequence

Browse Source 
Second protocol mismatch found the same way as the descriptor: by
disassembling libogc's own driver instead of trusting our notes.

COMMAND SPACE IS A 2-BYTE HEADER + DATA PHASE, not a single 4-byte transfer.
CLAUDE.md said [0x40|reg, 00, 00, data] and the decoder followed it, waiting
for a fourth byte and consuming the DATA byte as header byte 2 -- so every
command-space WRITE was silently dropped.  libogc's __bba_init writes command
register 2 (its interrupt mask) at both the start and the end of init, so none
of that took effect.  What it actually sends:

  EXI_Imm  (len=2, write) -> 42 00    the whole header, 0x4000 | (reg << 8)
  EXI_Sync
  EXI_ImmEx(len=1, write) -> 00       the data

Three bytes between CS fall and CS rise.  The device-ID read survived the wrong
decode only because SPIMode3Slave answers it on a fast path independent of this
FSM -- which is precisely why no test caught it: the only command-space traffic
under test bypassed the decoder being tested.

CHDR_2/CHDR_3 are replaced by CMD_WRITE, which takes the data byte straight
after header byte 1 and auto-increments the command register so a multi-byte
command write behaves like the register-space path.  cmd_wreg latches the
target because the write applies a cycle later, by which time cmd_reg has
moved on.  bba_register_file T10 writes command register 2 and reads it back,
and is mutation-tested: restoring the 4-byte decode fails it.

Also replaces the GUESSED init sequence in CLAUDE.md with the real transaction
list.  The old one was wrong in three ways that matter: libogc READS the MAC
out of PAR0-5 rather than writing one (so our reset value is what the console
uses), IMR is 0xDF not 0x86, and it writes RWP (0x0016/17) and RHBP (0x001A/1B)
which the register file does not accept.  The latter is harmless today -- RHBP
is 0x000F, matching our hardcoded 15-page ring -- but a driver configuring a
smaller ring would be ignored while the assembler kept writing outside it.

New gc_bba_test suite 7 "libogc init" replays the sequence on hardware:
cmd-space write (2-byte header, read back), MAC readable (one 6-byte PAR read,
Nintendo OUI), and init replay (all 30 writes in order, then NWAYS/HIPR/NCRA.SR
must still read correctly -- the old guessed header format turned a NWAYS read
into an NCRA reset, so a misdecoded write is a real risk).

bba.c gains bba_cmd_write/bba_cmd_read in libogc's shape.

Every module testbench and bba_top at EXI_HALF=1/2/8 pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Dennis Brentjes
2026-10-10 10:42:17 +02:00
parent d83f7beef8
commit 0aa1fa884a
5 changed files with 324 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+76 -17
View File
@@ -1057,13 +1057,33 @@ There are TWO address spaces, selected by bit 7 of the first byte, and **no
length field**:
```
COMMAND space (6-bit reg) one 4-byte READWRITE transfer
write: [0x40|reg, 00, 00, data]
read : [reg, 00, 00, xx ] <- response is the 4th byte
COMMAND space (6-bit reg) 2-byte header, then a SEPARATE data phase
write: [0x40|reg, 0x00] then N bytes written (libogc writes 1)
read : [reg, 0x00] then N bytes read (device ID reads 4)
REGISTER space (16-bit reg) 4-byte header, then a SEPARATE data phase
read : [0x80, reg>>8, reg&0xFF, 0x00] then N bytes read (Swiss uses DMA)
write: [0xC0, reg>>8, reg&0xFF, 0x00] then N bytes written
```
⚠️ **Command space is a 2-byte header + data phase — corrected 2026-10-10.**
This file previously said "one 4-byte READWRITE transfer,
`[0x40|reg, 00, 00, data]`", and the decoder followed it: it waited for a
fourth byte, consumed the DATA byte as header byte 2, and **silently dropped
every command-space write.** libogc's `__bba_init` writes command register 2
(its interrupt mask) at both the start and the end of init, so none of that
would have taken effect. The real shape, from the disassembly:
```
EXI_Imm (len=2, write) -> 42 00 the WHOLE header
EXI_Sync
EXI_ImmEx(len=1, write) -> 00 the data
```
Three bytes between CS fall and CS rise, not four. `0x4200 = 0x4000 |
(reg << 8)`. The device-ID read survived the wrong decode only because
`SPIMode3Slave` answers it on a fast path independent of the FSM — which is
exactly why no test caught it. `bba_register_file` **T10** now writes command
register 2 and reads it back, and is mutation-tested against the 4-byte decode.
NCRA, IR, NWAYS, RWP, RRP, PAR… all live in the REGISTER space
(`bba_in8`/`bba_out8`/`bba_ins`/`bba_outs`). Only the device-ID query uses a
short header — the single case where the two formats coincide.
@@ -1292,21 +1312,60 @@ unwritten cell; real SPRAM has no such tell.
---
## GC Initialisation Sequence (Swiss/BBA driver)
## GC Initialisation Sequence — read out of libogc, 2026-10-10
```
1. Write 0x0000 × 2, read 4 B → must get 0x04020200 (device ID)
2. Write NCRA = 0x01 (reset, self-clears; resets W5500 + SPRAM ptrs)
3. Poll NCRA bit 0 until 0 (wait reset complete)
4. Write PAR0–5 (MAC address)
5. Write MAR0–7 = 0xFF (promiscuous multicast)
6. Write ANALOG = 0xD6 (enable PHY — no FPGA effect, just store)
7. Write NWAYC (autoneg config — store only)
8. Write IMR = 0x86 (enable RBFI | TI | RI interrupts)
9. Write GCA (AUTOPUB bit)
10. Write NCRA SR bit = 0x08 (start receive)
11. Poll NWAYS until link up → return hardcoded 0x17 immediately
```
⚠️ **The sequence below replaces a GUESSED one.** The old version said the
driver *writes* PAR0–5, writes `MAR0–7 = 0xFF`, `ANALOG = 0xD6`, `NWAYC`,
`GCA` and `IMR = 0x86`. Disassembling libogc's `__bba_init`
(`/opt/devkitpro/libogc/lib/cube/libbba.a`, `gcif.o`) shows otherwise. This is
the actual transaction list, in order:
| # | transaction | note |
|---|---|---|
| 0 | **cmd** write reg 2 = `0x00` | interrupt mask (IRMASKALL) |
| 1 | reg `0x0060` = `0x00` | |
| 2 | **cmd** read reg `0x0F` | |
| 3 | reg `0x0000` = `0x01` | **NCRA reset** |
| 4 | reg `0x0000` = `0x00` | |
| 5 | **cmd** read reg `0x01` | |
| 6,7 | **cmd** writes reg `0x04`, `0x05` | |
| 8–15 | reg `0x0058`–`0x005F` = `80 00 03 83 32 FE 1F 1F` | PHY/analog block |
| 16,17 | reg `0x0001` = `0x52`, `0x0060` = `0x74` | |
| 18,19 | reg `0x0014` = `0x00`, `0x0015` = `0x06` | |
| 20 | reg `0x0050` = `0x80` | |
| 21–24 | reg `0x000C/0D` = `0x00`, `0x000A` = `0x01`, `0x000B` = `0x00` | |
| 25,26 | reg `0x001A/1B` = `0x000F` | **RHBP** — ring high boundary = page 15 |
| 27,28 | reg `0x0016/17` = `0x0001` | **writes RWP** |
| 29,30 | reg `0x0018/19` = `0x0001` | **writes RRP** |
| 31 | reg `0x0032` = `0x08` | |
| 32 | reg `0x0000` = `0x08` | **NCRA SR — start receive** |
| 33–36 | reg `0x0030` read, then writes `0x04`, `0x0C` | |
| 37 | reg `0x0020`, **6-byte READ** | **reads PAR0–5 — the MAC** |
| 38 | reg `0x0009` = `0xFF` | IR: clear all |
| 39 | reg `0x0008` = `0xDF` | **IMR — not `0x86`** |
| 40 | **cmd** write reg 2 = `0xF8` | IRMASKNONE (enable) |
Three corrections that matter:
- **The driver READS the MAC from PAR0–5; it does not write one.** So the
PAR0–5 reset value is what the console will use — keep a valid Nintendo OUI
there (`00:09:BF:00:00:01`). It is a single 6-byte register-space read.
- **`IMR` is `0xDF`**, and `IR` is cleared with `0xFF` first.
- **It writes `RWP` (0x0016/17) and `RHBP` (0x001A/1B)**, which the register
file does not accept. Harmless today — `RHBP` is `0x000F`, matching our
hardcoded 15-page ring, and the NCRA reset already puts `RWP` at page 1 —
but it is a real divergence: a driver that configured a SMALLER ring would
be ignored, and our assembler would write outside it.
- Registers `0x0058`–`0x005F`, `0x0060`, `0x0001`, `0x0014/15`, `0x0050`,
`0x000A`–`0x000D`, `0x0030`, `0x0032` are not decoded. Writes fall through
the `Switch` with no `Case`, so they are ignored rather than aliased —
which is the safe failure, but worth knowing when a driver expects one back.
`gc_bba_test` suite 7 (**libogc init**) replays this list on hardware and
checks the shapes: `cmd-space write` (2-byte header + data phase, read back),
`MAC readable` (one 6-byte PAR read, Nintendo OUI), and `init replay` (all 30
register writes in order, then NWAYS/HIPR/NCRA.SR must still be correct — the
old guessed header format turned a NWAYS read into an NCRA reset, so a
misdecoded write is a real risk, not a theoretical one).
---
exi_bba/bba_register_file.py
+95 -14
View File
@@ -256,6 +256,7 @@ class BBARegisterFile(Elaboratable):
is_write = Signal()
cmd_space = Signal() # this transaction is a command access
cmd_reg = Signal(6)
cmd_wreg = Signal(6) # target of a pending command-space write
byte_ctr = Signal(3) # response-byte index (device-ID sequence)
cmd_wr = Signal() # command-space write pending
prefetched = Signal() # first response byte already pushed
@@ -436,7 +437,25 @@ class BBARegisterFile(Elaboratable):
m.d.comb += [self.tx_data.eq(rd_val), self.tx_en.eq(1)]
m.d.sync += [eff_addr.eq(eff_addr + 1), prefetched.eq(1)]
# ── command space: [reg, 00, 00, data] in ONE 4-byte transfer ──
# ── command space: a 2-BYTE header, then a data phase ─────────
#
# [0x40|reg, 0x00] + N data bytes written, or
# [reg, 0x00] + N data bytes read.
#
# ⚠️ NOT a single 4-byte transfer. This file used to decode
# [reg, 00, 00, data] and wait for a fourth byte, taking the DATA
# byte as header byte 2 -- so every command-space WRITE was
# silently dropped. libogc's own driver (see the init map in
# CLAUDE.md) does, for a write of 0x00 to command register 2:
#
# EXI_Imm (len=2, write) -> 42 00 the whole header
# EXI_Sync
# EXI_ImmEx(len=1, write) -> 00 the data
#
# i.e. three bytes between CS fall and CS rise, not four. The
# device-ID read survived the old decode only because
# SPIMode3Slave answers it on the fast path, independently of
# this FSM, which is why nothing caught it.
with m.State("CHDR_1"):
with m.If(self.rx_rdy):
m.d.comb += self.rx_en.eq(1)
@@ -446,24 +465,31 @@ class BBARegisterFile(Elaboratable):
# 2-byte header has too few pops to drain.
with m.If(~is_write & (cmd_reg == 0) & id_phase):
m.next = "DEVID"
with m.Elif(is_write):
m.next = "CMD_WRITE"
with m.Else():
m.next = "CHDR_2"
# Read: the response was prefetched below and the pop
# at the end of this byte lands it in data slot 0.
m.next = "TRAILER"
with m.Elif(~is_write & self.tx_rdy & ~prefetched):
# Ordinary command read: response lands in byte slot 3.
# Ordinary command read: push during header byte 1 so the
# byte-boundary pop presents it in data slot 0.
m.d.comb += [self.tx_data.eq(rd_val), self.tx_en.eq(1)]
m.d.sync += prefetched.eq(1)
with m.State("CHDR_2"):
with m.State("CMD_WRITE"):
# Data phase. Each byte writes the running command register,
# which auto-increments so a multi-byte command write behaves
# like the register-space path. cmd_wreg latches the target
# separately because the handler below applies the write a
# cycle later, by which time cmd_reg has already moved on.
with m.If(self.rx_rdy):
m.d.comb += self.rx_en.eq(1)
m.next = "CHDR_3"
with m.State("CHDR_3"):
with m.If(self.rx_rdy):
m.d.comb += self.rx_en.eq(1)
with m.If(is_write):
m.d.sync += cmd_wr.eq(1) # applied below
m.d.sync += cmd_wdata.eq(self.rx_data)
m.d.sync += [cmd_wr.eq(1),
cmd_wdata.eq(self.rx_data),
cmd_wreg.eq(cmd_reg),
cmd_reg.eq(cmd_reg + 1)]
with m.If(~self.cs_active):
m.next = "TRAILER"
with m.State("TRAILER"):
@@ -659,10 +685,10 @@ class BBARegisterFile(Elaboratable):
m.d.comb += [self.tx_data.eq(sp_hold), self.tx_en.eq(1)]
m.d.sync += sp_pending.eq(0)
# ── Command-space write, applied the cycle after CHDR_3 ──────────
# ── Command-space write, applied the cycle after the data byte ───
with m.If(cmd_wr):
m.d.sync += cmd_wr.eq(0)
with m.Switch(cmd_reg):
with m.Switch(cmd_wreg):
with m.Case(0x02): m.d.sync += r_cmd_imr.eq(cmd_wdata)
with m.Case(0x03): m.d.sync += r_cmd_ir.eq(r_cmd_ir & ~cmd_wdata)
@@ -807,6 +833,38 @@ if __name__ == "__main__":
await ctx.tick("sync").repeat(6)
return result
async def cmd_write(ctx, creg, data):
"""Command-space write in libogc's REAL shape: a 2-byte header
[0x40|reg, 0x00] then the data bytes -- three bytes total for a
single-byte write, NOT a 4-byte transfer."""
ctx.set(reg.cs_active, 1)
await push_rx(ctx, 0x40 | (creg & 0x3F))
await push_rx(ctx, 0x00)
for b in data:
await push_rx(ctx, b)
ctx.set(reg.cs_active, 0)
await ctx.tick("sync").repeat(6)
async def cmd_read(ctx, creg, length=1):
"""Command-space read: 2-byte header, then clock `length` bytes."""
tx_log.clear()
ctx.set(reg.cs_active, 1)
await push_rx(ctx, creg & 0x3F)
# Idle while header byte 1 is "on the wire". The device must push its
# response DURING that byte: the engine's byte-boundary pop for data
# slot 0 happens at the end of byte 1, which is before the FSM has even
# seen byte 1 (the rx CDC is ~125 ns). A response pushed in reaction
# to consuming byte 1 would land in slot 1 instead, so pushing both
# header bytes back-to-back here would not model the real transfer.
for _ in range(4):
sample_tx(ctx) # the push lands HERE; a bare tick loses it
await ctx.tick("sync")
await push_rx(ctx, 0x00)
result = await collect_tx(ctx, length)
ctx.set(reg.cs_active, 0)
await ctx.tick("sync").repeat(6)
return result
# SPRAM contents the streaming-read test reads back (byte i = 0xA0+i).
spram_mem = {0x100 + i: (0xA0 + i) & 0xFF for i in range(64)}
@@ -1030,6 +1088,29 @@ if __name__ == "__main__":
print(f"T9 second ST trigger queues: {bool(ctx.get(reg.tx_ctrl_r_rdy))} "
f"(was {bool(tx_ctrl_before)})")
# ── T10: command-space write in libogc's real 3-byte shape ───────
# The decoder used to expect [reg, 00, 00, data] and wait for a fourth
# byte, consuming the DATA byte as header byte 2 -- so every
# command-space write was silently DROPPED. libogc writes command
# register 2 (its interrupt mask) at both the start and the end of
# init, so a dropped write means that mask is never applied.
#
# Nothing caught this before because no test issued a command-space
# write at all: the device-ID READ is answered by SPIMode3Slave's fast
# path, independently of this FSM, so the only command-space traffic
# under test bypassed the decoder being tested.
await cmd_write(ctx, 0x02, [0xF8]) # libogc's IRMASKNONE
got = await cmd_read(ctx, 0x02, 1)
print(f"T10 cmd write reg2=0xF8 -> read back {[hex(x) for x in got]}")
if got != [0xF8]:
errors.append(f"T10 command-space write dropped: read back {got}")
await cmd_write(ctx, 0x02, [0x00]) # ... and IRMASKALL
got2 = await cmd_read(ctx, 0x02, 1)
print(f"T10b cmd write reg2=0x00 -> read back {[hex(x) for x in got2]}")
if got2 != [0x00]:
errors.append(f"T10b command-space rewrite failed: {got2}")
# NO T10 FOR THE LATE-RESPONSE LEAK -- and that is deliberate.
#
# The guard added to the response handler (outstanding != 0) and the
gc_bba_test/source/bba.c
+37
View File
@@ -102,6 +102,43 @@ int bba_devid(u8 id[4])
return 0;
}
/* COMMAND-space access: a 2-BYTE header then a data phase -- three bytes
* total for a single-byte write, NOT a 4-byte transfer. This is the shape
* libogc's own driver uses (gcif.o, __bba_init):
*
* EXI_Imm (len=2, write) -> [0x40|reg, 0x00] write, or [reg, 0x00] read
* EXI_Sync
* EXI_ImmEx(len=N, write/read)
*
* The device-ID query is the same form with reg 0 and a 4-byte read, which is
* why bba_devid above looks like this too. */
int bba_cmd_write(u8 creg, u8 val)
{
int rc;
u16 h = (u16)(((0x40 | (creg & 0x3F)) << 8));
if ((rc = begin()) < 0) return rc;
if (EXI_Imm(BBA_EXI_CHAN, &h, 2, EXI_WRITE, NULL) <= 0) { end(); return -3; }
if (EXI_Sync(BBA_EXI_CHAN) <= 0) { end(); return -4; }
gap();
if (EXI_ImmEx(BBA_EXI_CHAN, &val, 1, EXI_WRITE) <= 0) { end(); return -5; }
end();
return 0;
}
int bba_cmd_read(u8 creg)
{
int rc;
u8 v = 0;
u16 h = (u16)(((creg & 0x3F) << 8));
if ((rc = begin()) < 0) return rc;
if (EXI_Imm(BBA_EXI_CHAN, &h, 2, EXI_WRITE, NULL) <= 0) { end(); return -3; }
if (EXI_Sync(BBA_EXI_CHAN) <= 0) { end(); return -4; }
gap();
if (EXI_ImmEx(BBA_EXI_CHAN, &v, 1, EXI_READ) <= 0) { end(); return -5; }
end();
return (int)v;
}
int bba_r8(u16 addr)
{
u8 v;
gc_bba_test/source/bba.h
+6
View File
@@ -76,6 +76,12 @@ int bba_devid(u8 id[4]);
int begin_raw(void);
void end_raw(void);
/* COMMAND-space access: 2-byte header + data phase (3 bytes total for a
* single-byte write), the shape libogc uses. bba_cmd_read returns the byte
* or <0 on error. */
int bba_cmd_write(u8 creg, u8 val);
int bba_cmd_read(u8 creg);
/* Convenience single-byte helpers. bba_r8 returns the byte, or <0 on error. */
int bba_r8(u16 addr);
int bba_w8(u16 addr, u8 val);
gc_bba_test/source/tests.c
+110
View File
@@ -389,6 +389,109 @@ static int t_rx(char *m, size_t n)
return 1;
}
/* ─────────────────── suite 7: libogc init sequence ─────────────────── */
/* These replay what libogc's own BBA driver does, in its real transaction
* shapes, rather than what our docs said it does. The whole sequence was
* read out of /opt/devkitpro/libogc/lib/cube/libbba.a (gcif.o, __bba_init) --
* see CLAUDE.md. Two of the mismatches it exposed were silent:
* - command space is a 2-byte header + data phase, not a 4-byte transfer,
* so every command-space write was being dropped; and
* - libogc READS the MAC out of PAR0-5 rather than writing it. */
static int t_cmd_write(char *m, size_t n)
{
int rc, rb;
/* Command register 2 is libogc's interrupt mask: it writes 0x00
* (IRMASKALL) at the start of init and 0xF8 (IRMASKNONE) at the end. */
if ((rc = bba_cmd_write(0x02, 0xF8)) < 0) {
snprintf(m, n, "cmd write failed: EXI error %d", rc); return 1;
}
if ((rb = bba_cmd_read(0x02)) < 0) {
snprintf(m, n, "cmd read failed: EXI error %d", rb); return 1;
}
if (rb != 0xF8) {
snprintf(m, n, "wrote 0xF8, read back 0x%02X "
"(2-byte cmd header not honoured?)", rb);
return 1;
}
/* Put it back the way libogc leaves it at the start of init. */
bba_cmd_write(0x02, 0x00);
rb = bba_cmd_read(0x02);
snprintf(m, n, "0xF8 then 0x00 read back (0x%02X)", rb);
return rb == 0x00 ? 0 : 1;
}
static int t_mac_is_readable(char *m, size_t n)
{
u8 mac[6];
/* libogc does ONE 6-byte register read of 0x0020 and uses whatever it
* finds as the console's MAC -- it does not write one. So PAR0-5 must
* hold a sane address out of reset, and a 6-byte read must work. */
if (bba_read(REG_PAR0, mac, 6) < 0) {
snprintf(m, n, "6-byte PAR read failed"); return 1;
}
snprintf(m, n, "%02X:%02X:%02X:%02X:%02X:%02X%s",
mac[0], mac[1], mac[2], mac[3], mac[4], mac[5],
(mac[0] == 0x00 && mac[1] == 0x09 && mac[2] == 0xBF)
? " (Nintendo OUI)" : " - NOT a Nintendo OUI");
if (mac[0] == 0xFF || (mac[0] | mac[1] | mac[2] | mac[3] | mac[4] | mac[5]) == 0)
return 1; /* all-ones or all-zero is unusable */
return (mac[0] == 0x00 && mac[1] == 0x09 && mac[2] == 0xBF) ? 0 : 1;
}
static int t_init_sequence(char *m, size_t n)
{
/* The register writes libogc issues, in order, with the values it uses.
* Most are store-only (PHY/analog) and we ignore them; what matters is
* that none of them is misdecoded into something harmful -- the old
* guessed header format turned a NWAYS read into an NCRA reset, so this
* is a real risk, not a theoretical one. */
static const struct { u16 a; u8 v; } seq[] = {
{0x0060, 0x00},
{0x0000, 0x01}, /* NCRA reset */
{0x0000, 0x00},
{0x0058, 0x80}, {0x0059, 0x00}, {0x005A, 0x03}, {0x005B, 0x83},
{0x005C, 0x32}, {0x005D, 0xFE}, {0x005E, 0x1F}, {0x005F, 0x1F},
{0x0001, 0x52}, {0x0060, 0x74},
{0x0014, 0x00}, {0x0015, 0x06}, {0x0050, 0x80},
{0x000C, 0x00}, {0x000D, 0x00}, {0x000A, 0x01}, {0x000B, 0x00},
{0x001A, 0x0F}, {0x001B, 0x00}, /* RHBP = page 15 */
{0x0016, 0x01}, {0x0017, 0x00}, /* RWP = page 1 */
{0x0018, 0x01}, {0x0019, 0x00}, /* RRP = page 1 */
{0x0032, 0x08},
{0x0000, 0x08}, /* NCRA SR: start receive */
{0x0009, 0xFF}, /* IR: clear all */
{0x0008, 0xDF}, /* IMR (NOT 0x86) */
};
unsigned i;
int v;
for (i = 0; i < sizeof(seq) / sizeof(seq[0]); i++) {
if (bba_w8(seq[i].a, seq[i].v) < 0) {
snprintf(m, n, "write %u (0x%04X=0x%02X) failed",
i, seq[i].a, seq[i].v);
return 1;
}
}
g_ncra_reset_done = 1;
/* The sentinels must still read correctly afterwards -- if any write in
* that list had been misdecoded, the most likely casualty is the state
* these two report. */
if ((v = bba_r8(REG_NWAYS)) != NWAYS_LINKUP) {
snprintf(m, n, "NWAYS 0x%02X after init (want 0x%02X)",
v, NWAYS_LINKUP);
return 1;
}
if ((v = bba_r8(REG_HIPR)) != HIPR_PRESENT) {
snprintf(m, n, "HIPR 0x%02X after init (want 0x%02X)",
v, HIPR_PRESENT);
return 1;
}
v = bba_r8(REG_NCRA);
snprintf(m, n, "%u writes replayed; NCRA=0x%02X NWAYS/HIPR ok",
(unsigned)(sizeof(seq) / sizeof(seq[0])), v);
return (v & 0x08) ? 0 : 1; /* SR must still be set */
}
/* ─────────────────────── suite 6: SPRAM / DMA ──────────────────────── */
static int t_dma(char *m, size_t n)
@@ -518,6 +621,12 @@ static test_t s_spram[] = {
{"Stream length", "reads >= 0x100 stream until CS, length-independent",t_dma_stream_len, T_PENDING, {0}},
};
static test_t s_init[] = {
{"cmd-space write","2-byte header + data phase, as libogc sends it", t_cmd_write, T_PENDING, {0}},
{"MAC readable", "libogc READS the MAC from PAR0-5; it must be sane", t_mac_is_readable, T_PENDING, {0}},
{"init replay", "libogc's 30 init writes, in order, do no harm", t_init_sequence, T_PENDING, {0}},
};
suite_t g_suites[] = {
{"Identity", "device enumerates and reports itself", s_identity, 3},
{"Registers", "register file is readable and writable", s_regs, 4},
@@ -525,6 +634,7 @@ suite_t g_suites[] = {
{"EXI integrity", "the EXI link is error-free, and how fast", s_exi, 6},
{"Ethernet", "frames get to and from the W5100", s_eth, 3},
{"SPRAM/DMA", "bulk reads stream correctly from the ring", s_spram, 2},
{"libogc init", "the real driver's init sequence and shapes", s_init, 3},
};
const int g_nsuites = sizeof(g_suites) / sizeof(g_suites[0]);