Strange "Illegal word write" at Metroid Fusion intro

[spacy51]

About less than one second after starting Metroid Fusion (USA, Australia), I get "Illegal word write" warnings in the loging window if enabled.

 

DMA1: s=03002634 d=040000a0 c=b600 count=00000010
DMA1: s=03002624 d=040000a0 c=b600 count=00000010

DMA1: s=03002614 d=040000a0 c=b600 count=00000010

DMA1: s=03002604 d=040000a0 c=b600 count=00000010

DMA1: s=030025f4 d=040000a0 c=b600 count=00000010

DMA1: s=030025f4 d=040000a0 c=b600 count=00000010

Illegal word write: 00000000 to 00000000 from 080025fa

Illegal word write: 00000000 to 00000000 from 080025fa

Illegal word write: 00000000 to 00000000 from 080025fa

Illegal word write: 00000000 to 00000000 from 080025fa

Illegal word write: 00000000 to 00000000 from 080025f6

Illegal word write: 00000000 to 00000000 from 080025f6

Illegal word write: 00000000 to 00000000 from 080025f6

Illegal word write: 00000000 to 00000000 from 080025f6

DMA1: s=00000000 d=00000000 c=8440 count=00000010

DMA1: s=03002b04 d=040000a0 c=b600 count=00000010

DMA1: s=03002af4 d=040000a0 c=b600 count=00000010

DMA1: s=03002ae4 d=040000a0 c=b600 count=00000010

DMA1: s=03002ad4 d=040000a0 c=b600 count=00000010

DMA1: s=03002ac4 d=040000a0 c=b600 count=00000010

 

With the VC++ debugger I found out that this happens because the game requests the underlined DMA transfer with on DMA channel 1.

 

Now I wonder why would it do that. Before and after the warning is printed, it looks like DMA is used for the usual audio playback process.

 

Is it an emulation fault or is the game's sound engine maybe starving?

 

 

I have just begun looking into core emulation aspects, so some hints would be appreciated.

[Squall Leonhart]

not all of the illegal operations are actually bugs, Exophase mentioned to me earlier that sometimes they occur within the cart itself, so if the game works fine its probably nothing to worry about.

[aceloop]

same thing happens with Kingdom Hearts - Chain of Memories & Super Street Fighter II Turbo - Revival. BUT Squall it still can be a problem tho, right?

[Squall Leonhart]

it can be, but if it occurs within the cart itself, then it would've also occured on the hardware as well.

[spacy51]

The question is, if it would happen on hardware, would those wrong instructions actually freeze the hardware?

[Squall Leonhart]

No, the problem with the hardware probably comes from the backup techniques in the flash carts. In other words, we need to get the save formats even more accurate!

[Exophase]

GBA games read from and write to messed up places all the time. It's the result of sloppy buggy coding and a lack of memory protection on the GBA to tell them that they screwed up. A majority of it probably occurs from accidentally using uninitialized or NULL pointers.

 

The stores are harmless and can be ignored. The loads, on the other hand, although not being deliberate, still have to be emulated correctly because shockingly some games not only make them but then crash if the results are wrong. Zelda: Minish Cap is notorious for doing this in several places. It's a miracle these games ever worked in the first place. It probably just needs some of the bits to be right, but who knows which ones for which circumstances.

 

A lot of memory accesses happen at [0, offset], further suggesting NULL pointer de-referencing. These return the last thing that was on the prefetch buffer when you left the BIOS, if you're not currently executing in the BIOS. Some accesses happen way out past the first 256MB of address space where nothing sits on the bus, and these "open bus" reads return the last fetched instruction on the prefetch buffer (basically like doing an ldr reg, [pc]).

 

One exception to this is DMAs that come from the BIOS region, those are actually just read as zero by the DMA controller since it doesn't have access to the BIOS at all. GBA games do this unintentionally in order to set an area of memory to zero. But copying to 0 will do nothing and was not intentional. Probably the programmers of Metroid Fusion just wanted to initialize those DMA registers to 0 and didn't realize that they were triggering the DMA at the same time.