0xrsydn/gameboy-rust
1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(memory): return the Game Pak address pattern beyond the ROM chip

Browse source 
CPU and DMA reads past the supplied image returned Unmapped and stopped the
machine; a second game's boot code reads 0x09fe20f8 past a 16 MiB image. The
Game Pak shares data lines with the low address lines, so where no chip drives
the bus a read returns the halfword address, (A >> 1) & 0xffff, per lane
(GBATEK; mGBA uses the same pattern).

The chip is the image size rounded up to a power of two. Bytes between a
trimmed image's end and that boundary are unknown and stay diagnostic, as do
host reads and instruction fetches. Two truncation fixtures move into that gap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HhfHfHEuzv2AUTd6erW1gU
This commit is contained in:
0xrsydn 2026-10-14 11:58:36 +07:00
commit 4e4dde742d
11 changed files with 120 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

12
crates/gba-core/src/memory.rs
View file

@ -899,6 +899,18 @@ impl Memory {
.map(|word| (word >> ((address & 3) * 8)) as u8)
.ok_or(MemoryError::Unmapped(address));
}
if matches!(address >> 24, 0x08..=0x0d)
&& (address & 0x01ff_ffff) as usize >= self.rom.len().next_power_of_two()
&& !self.cartridge_state().mapped(address)
&& (self.cpu_access.is_some() || self.timer_step.get().is_some())
{
// Beyond the power-of-two ROM chip no device drives the Game Pak bus, which
// returns the halfword address (A/2, low 16 bits) on each lane. Bytes between a
// trimmed image's end and the chip boundary are unknown and stay diagnostic,
// as do host reads and instruction fetches.
let halfword = ((address & 0x01ff_fffe) >> 1) as u16;
return Ok(halfword.to_le_bytes()[(address & 1) as usize]);
}
if matches!(address, 0x0000_4000..=0x01ff_ffff | 0x1000_0000..=0xffff_ffff) {
if let Some(word) = self.cpu_access.and_then(|access| access.prefetch) {
return Ok((word >> ((address & 3) * 8)) as u8);