fix(memory): return the Game Pak address pattern beyond the ROM chip

CPU and DMA reads past the supplied image returned Unmapped and stopped the
machine; a second game's boot code reads 0x09fe20f8 past a 16 MiB image. The
Game Pak shares data lines with the low address lines, so where no chip drives
the bus a read returns the halfword address, (A >> 1) & 0xffff, per lane
(GBATEK; mGBA uses the same pattern).

The chip is the image size rounded up to a power of two. Bytes between a
trimmed image's end and that boundary are unknown and stay diagnostic, as do
host reads and instruction fetches. Two truncation fixtures move into that gap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HhfHfHEuzv2AUTd6erW1gU

crates/desktop/tests/rom_cli.rs

@@ -404,10 +404,15 @@ fn rtc_selection_is_explicit_and_does_not_modify_the_rom_file() {
     let path = fixture.rom(&rtc_setup());
     let original = fs::read(&path).unwrap();
     // Without the device, the GPIO store is an ordinary ignored ROM write. The read-back
-    // then reaches past this short image, which remains a diagnostic.
+    // lies beyond this short image's chip, so it returns the bus pattern (address / 2).
     let absent = run(&path, "100");
-    assert_eq!(absent.status.code(), Some(1));
-    assert!(stderr(&absent).contains("unmapped memory at 0x080000c8"));
+    assert!(absent.status.success(), "{}", stderr(&absent));
+    assert!(
+        stdout(&absent).contains("r2=0x00000064"),
+        "{}",
+        stdout(&absent)
+    );
+    assert!(!stdout(&absent).contains("RTC selected"));
     let selected = command()
         .arg("--rtc")
         .arg("--rom")

crates/gba-core/src/cpu/thumb_tests.rs

@@ -709,9 +709,11 @@ fn unsupported_thumb_instructions_preserve_registers_flags_and_state() {
 #[test]
 fn thumb_memory_errors_leave_state_unchanged() {
     for instruction in [
-        0x6801, 0x6001, 0x8801, 0x8001, 0x7801, 0x7001, 0x5e81, 0x9801, 0x9001, 0x4801,
+        0x6801, 0x6001, 0x8801, 0x8001, 0x7801, 0x7001, 0x5e81, 0x9801, 0x9001, 0x4802,
     ] {
-        let mut memory = program(&[instruction]);
+        // A 10-byte image in a 16-byte chip: LDR r0,[pc,#8] reads offset 12, an unknown
+        // byte past the trimmed image. Reads beyond the chip return the bus pattern instead.
+        let mut memory = program(&[instruction, 0, 0, 0, 0]);
         let mut cpu = thumb_cpu();
         cpu.flags = flags();
         cpu.registers[1] = 123;

crates/gba-core/src/cpu/transfer_tests.rs

@@ -343,9 +343,10 @@ fn block_load_can_read_rom_and_store_to_rom_is_ignored() {
 
 #[test]
 fn truncated_rom_does_not_partially_load_a_register_list() {
-    let mut memory = program(&[block(0x0080_0000, true, true, 0, 0x6), 11]);
+    // A 12-byte image in a 16-byte chip: the second word is unknown, so it stays diagnostic.
+    let mut memory = program(&[block(0x0080_0000, true, true, 0, 0x6), 0, 11]);
     let mut cpu = Cpu::new(ROM_START);
-    cpu.registers[0] = ROM_START + 4;
+    cpu.registers[0] = ROM_START + 8;
     let before = cpu.registers;
     assert!(matches!(cpu.step(&mut memory), Err(CpuError::Memory(_))));
     assert_eq!(cpu.registers, before);

crates/gba-core/src/memory.rs

@@ -899,6 +899,18 @@ impl Memory {
                 .map(|word| (word >> ((address & 3) * 8)) as u8)
                 .ok_or(MemoryError::Unmapped(address));
         }
+        if matches!(address >> 24, 0x08..=0x0d)
+            && (address & 0x01ff_ffff) as usize >= self.rom.len().next_power_of_two()
+            && !self.cartridge_state().mapped(address)
+            && (self.cpu_access.is_some() || self.timer_step.get().is_some())
+        {
+            // Beyond the power-of-two ROM chip no device drives the Game Pak bus, which
+            // returns the halfword address (A/2, low 16 bits) on each lane. Bytes between a
+            // trimmed image's end and the chip boundary are unknown and stay diagnostic,
+            // as do host reads and instruction fetches.
+            let halfword = ((address & 0x01ff_fffe) >> 1) as u16;
+            return Ok(halfword.to_le_bytes()[(address & 1) as usize]);
+        }
         if matches!(address, 0x0000_4000..=0x01ff_ffff | 0x1000_0000..=0xffff_ffff) {
             if let Some(word) = self.cpu_access.and_then(|access| access.prefetch) {
                 return Ok((word >> ((address & 3) * 8)) as u8);

crates/gba-core/tests/rom_bus.rs

@@ -0,0 +1,84 @@
+//! Original Game Pak ROM reads beyond the supplied image; no game assets.
+use gba_core::{
+    cpu::{Cpu, CpuError},
+    dma::DMA_BASE,
+    machine::{Machine, MachineError, StepKind},
+    memory::{Memory, MemoryError, ROM_START},
+};
+
+fn words(values: &[u32]) -> Vec<u8> {
+    values
+        .iter()
+        .flat_map(|value| value.to_le_bytes())
+        .collect()
+}
+
+/// LDR r0,=address; then `load`; then loop. The image is 16 bytes, a whole chip.
+fn load(address: u32, load: u32) -> Machine {
+    let mut bus = Memory::new(words(&[0xe59f_0004, load, 0xeaff_fffe, address])).unwrap();
+    let mut cpu = Cpu::new(ROM_START);
+    cpu.step(&mut bus).unwrap();
+    Machine::new(cpu, bus)
+}
+
+#[test]
+fn cpu_reads_beyond_the_chip_return_the_halfword_address_in_every_rom_window() {
+    for (address, instruction, expected) in [
+        (0x0800_1234, 0xe590_1000, 0x091b_091a), // LDR: two halfword addresses.
+        (0x09fe_20f8, 0xe1d0_10b0, 0x107c),      // LDRH: past a 16 MiB image.
+        (0x0800_1235, 0xe5d0_1000, 0x09),        // LDRB of the high lane.
+        (0x0a00_1234, 0xe590_1000, 0x091b_091a), // Wait-state 1 window.
+        (0x0c00_1234, 0xe590_1000, 0x091b_091a), // Wait-state 2 window.
+    ] {
+        let mut machine = load(address, instruction);
+        assert_eq!(machine.step().unwrap(), StepKind::Instruction);
+        assert_eq!(machine.cpu().registers()[1], expected, "{address:#010x}");
+    }
+}
+
+#[test]
+fn unknown_bytes_of_a_trimmed_image_stay_diagnostic() {
+    // A 12-byte image occupies a 16-byte chip: offset 12 is unknown, offset 16 is not.
+    for (target, expected) in [
+        (ROM_START + 12, Err(MemoryError::Unmapped(ROM_START + 12))),
+        (ROM_START + 16, Ok(0x0009_0008)),
+    ] {
+        // LDR r0,[pc,#0] (the literal at offset 8); LDR r1,[r0]; literal.
+        let mut bus = Memory::new(words(&[0xe59f_0000, 0xe590_1000, target])).unwrap();
+        let mut cpu = Cpu::new(ROM_START);
+        cpu.step(&mut bus).unwrap();
+        let before = cpu.clone();
+        match expected {
+            Ok(value) => {
+                cpu.step(&mut bus).unwrap();
+                assert_eq!(cpu.registers()[1], value);
+            }
+            Err(error) => {
+                assert_eq!(cpu.step(&mut bus), Err(CpuError::Memory(error)));
+                assert_eq!(cpu, before);
+            }
+        }
+    }
+}
+
+#[test]
+fn host_reads_and_instruction_fetches_beyond_the_chip_stay_strict() {
+    let bus = Memory::new(words(&[0xeaff_fffe])).unwrap();
+    assert_eq!(
+        bus.read16(ROM_START + 4),
+        Err(MemoryError::Unmapped(ROM_START + 4))
+    );
+    let mut machine = Machine::new(Cpu::new(ROM_START + 0x100), bus);
+    assert!(matches!(machine.step(), Err(MachineError::Cpu(_))));
+}
+
+#[test]
+fn dma_reads_beyond_the_chip_return_the_halfword_address() {
+    let mut bus = Memory::new(words(&[0xeaff_fffe])).unwrap();
+    bus.write32(DMA_BASE + 0x24, 0x0800_1234).unwrap(); // DMA3 source
+    bus.write32(DMA_BASE + 0x28, 0x0300_0000).unwrap(); // DMA3 destination
+    bus.write32(DMA_BASE + 0x2c, 0x8400_0001).unwrap(); // One word, immediate
+    let mut machine = Machine::new(Cpu::new(ROM_START), bus);
+    assert_eq!(machine.step().unwrap(), StepKind::Dma { channel: 3 });
+    assert_eq!(machine.memory().read32(0x0300_0000).unwrap(), 0x091b_091a);
+}

docs/architecture.md

@@ -51,6 +51,7 @@ The repository is a Cargo workspace with three crates:
 | `crates/gba-core/src/cartridge.rs` | Explicit GPIO/RTC selection, ROM read overlay, pin directions, caller-clock routing, and bounded diagnostics |
 | `crates/gba-core/src/cartridge/flash.rs` | Explicit save devices, Macronix IDs/banks, delayed program/erase, bounded DQ7 polling, and staged mutations |
 | `crates/gba-core/src/cartridge/sram.rs` | 32 KiB byte-wide SRAM, mirrored offsets, one staged byte per step, and its save-state section |
+| `crates/gba-core/tests/rom_bus.rs` | Game Pak reads beyond the ROM chip in every window, trimmed-image gaps, strict host/fetch reads, and DMA sources |
 | `crates/gba-core/tests/sram.rs` | SRAM selection, mirroring, byte stores/loads from ROM code, SWPB, width/DMA diagnostics, and save states |
 | `crates/gba-core/tests/flash.rs` | Erased/supplied images, chip IDs, all bank addresses, invalid commands, reset limits, DMA rejection, and RTC independence |
 | `crates/gba-core/tests/flash_write.rs` | Program values, sector/chip scopes, delays, polling, cancellation, bit transitions, and HALT/STOP |

docs/hardware/cartridge.md

@@ -31,7 +31,8 @@ Bytes are not padded, patched, or written back.
 The loader does not validate a cartridge header, logo, or checksum.
 It does not decode archives or ELF executables. Supply a raw binary with an ARM instruction at offset zero.
 Headerless original programs are accepted.
-Reads past supplied cartridge bytes remain explicit memory errors, not open-bus values.
+CPU and DMA reads beyond the ROM chip, the image size rounded up to a power of two, return the halfword address (`(A >> 1) & 0xffff`) on each lane, as no device drives the Game Pak bus there.
+Bytes between a trimmed image's end and that chip boundary are unknown and remain explicit memory errors, as do host reads and instruction fetches beyond the image.
 All three Game Pak ROM windows use the same supplied bytes and existing wait-state rules.
 Ordinary cartridge bytes remain read-only. CPU and DMA writes to the `0x08`–`0x0c` ROM windows pay their bus cost and are ignored, as on hardware.
 Writes to the `0x0d` window remain `ReadOnly` diagnostics until EEPROM is modeled there. Host `Memory::write*` calls stay strict everywhere.

docs/references.md

@@ -6,6 +6,8 @@ Hardware references used for the core:
 
 - [GBATEK ARM instruction cycle times](https://problemkaputt.de/gbatek-arm-cpu-instruction-cycle-times.htm).
 - [GBATEK GBA system control and WAITCNT](https://problemkaputt.de/gbatek-gba-system-control.htm), including HALTCNT power-mode selection.
+- [GBATEK GBA unpredictable things](https://problemkaputt.de/gbatek-gba-unpredictable-things.htm): with no cartridge, the ROM area reads as `Address/2 AND FFFFh`, because the Game Pak shares its data lines with the low address lines. The emulator applies the same undriven-bus pattern beyond the ROM chip.
+- [mGBA `src/gba/memory.c`](https://github.com/mgba-emu/mgba/blob/master/src/gba/memory.c): out-of-bounds ROM loads return `(address >> 1) & 0xFFFF` per halfword. mGBA applies it from the image size; this emulator keeps bytes up to the power-of-two chip boundary diagnostic.
 - [GBATEK BIOS reset functions](https://problemkaputt.de/gbatek-bios-reset-functions.htm), for SoftReset state and restart selection, plus RegisterRamReset flags, RAM bounds, and forced blank.
 - [GBATEK BIOS halt functions](https://problemkaputt.de/gbatek-bios-halt-functions.htm), for wait contracts, STOP clock gating, allowed wake sources, and the clock-off IF note.
 - [GBATEK BIOS function calling conventions](https://problemkaputt.de/gbatek-bios-functions.htm).

docs/research/emerald-visible-progress.md

@@ -92,7 +92,8 @@ a deliberate policy decision against the explicit-error convention. See
 [the usability roadmap](../usability-roadmap.md) for sequencing.
 
 Update: emulated writes to the `0x08`–`0x0c` ROM windows are now ignored, which removes the
-`0x09fe2ffe` store diagnostic. Reads past the end of the image remain explicit errors.
+`0x09fe2ffe` store diagnostic. CPU reads beyond the 16 MiB chip, such as `0x09fe20f8`, now return the
+Game Pak halfword-address pattern instead of faulting.
 
 ## References
 

docs/status.md

@@ -230,7 +230,7 @@ BIOS protection uses separate retained BIOS fetch snapshots as described in [BIO
 Host inspection and instruction fetches remain strict. Other unmapped reads return errors.
 CPU and DMA writes to unused I/O addresses are ignored, as on hardware; host writes there stay strict.
 The unmodeled internal memory control register at `0x04xx0800` and all unused I/O reads remain diagnostics.
-Reads beyond the supplied cartridge bytes also return errors.
+CPU and DMA reads beyond the power-of-two ROM chip return the Game Pak halfword-address pattern; reads inside a trimmed image's chip, host reads, and instruction fetches past the image return errors.
 Direct memory-bus halfword and word accesses require alignment.
 CPU load/store instructions apply ARM7TDMI alignment and rotation rules before accessing the bus.
 CPU and DMA writes to the `0x08`–`0x0c` ROM windows are ignored; the `0x0d` window stays diagnostic until EEPROM exists. Explicitly selected cartridge GPIO and supported Flash command writes are separate from ROM storage.

docs/usability-roadmap.md

@@ -65,7 +65,7 @@ A reproducible source build or an accessible upstream ROM is needed before recor
 Next implementation steps:
 
 1. Visible startup/menu progress is established: attract mode reaches the start menu and Birch dialogue, and sparse taps reach the in-game start menu by 12,000 frames ([probe](research/emerald-visible-progress.md)).
-   The first demonstrated second-game failure is a boot-init halfword store to ROM mirror `0x09fe2ffe`. ROM-window writes are now ignored; reads past the image end remain diagnostics.
+   The first demonstrated second-game failure is a boot-init halfword store to ROM mirror `0x09fe2ffe`. ROM-window writes are now ignored, and reads beyond the ROM chip return the Game Pak address pattern.
    Use original regressions for any hardware correction; do not invent connected serial devices.
 2. Validate an external game's completed save/restart/load cycle using a disposable `--save-file` path.
    Refine nominal Flash timing and polling only with independent evidence and original regressions.