P2 asked whether the ENE at 0x27 has readable state. The answer had been
reached twice by elimination, and the last link in that chain was a comment
in a third party's patched OpenRGB detector, not a measurement of ours.
probe-ene-receive-byte.sh runs the experiment the driver made possible on
2026-07-27, when PNTR_SEL (BIT(18)) gave us a bare Receive Byte: a read with
no command byte on the wire cannot return a transform of a register that was
never sent. It does, however, return the last command byte the chip received
— 12/12 on both channels — so the value is still ours, not the device's. A
Receive Byte taken from 0x31 after addressing 0x27 answers 0xff instead of
the echo, which places the latch in the device and not in the iMC engine;
empty addresses NACK, so the transaction is real.
Everything here is read-only: Receive Byte and Read Byte Data at 0x27, SPD
reads through ee1004 sysfs, and the four SPD serials compared before and
after every run.
Two engine behaviours the script has to work around, both measured:
the first transaction on a channel answers with a stale value (hence the
discarded warm-up read), and a read following a successful one usually
NACKs, which one retry always clears — the P1 policy, confirmed.
lore-thread-check.py is unrelated to the probe but shares the same motive:
lore and patchwork now sit behind an Anubis bot check, so a shell cannot
tell "not published" from "not allowed to look". The NNTP mirror can.
Simone
2c7675a104