SD3403 连接 MS41908M SPI读取到的值都是0xffff

有大佬用过吗，帮小弟指点一下迷津

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <linux/spi/spidev.h>

// 配置
#define SPI_DEVICE  "/dev/spidev1.0"   // SPI1_0
#define SPI_SPEED   2000000            // 2MHz
#define SPI_BITS    8
#define SPI_MODE    SPI_MODE_3 | SPI_LSB_FIRST         // CPOL=0,CPHA=0

// MS41908M 固定：24bit 帧 = 读/写位 + 6bit 地址 + 16bit 数据
#define MS41908M_WRITE  (0 << 7)       // C0=0 写
#define MS41908M_READ   (1 << 7)       // C0=1 读

// 测试寄存器：0x0C IRSAD（只读，默认0，可读即应答）
#define TEST_ADDR 0x0C

/**
 * @brief  MS41908M 单寄存器读写
 * @param  fd     SPI 文件描述符
 * @param  rw     0=写 1=读
 * @param  addr   6bit 地址(0~63)
 * @param  data   写数据(16bit)，读时无效
 * @return  读返回16bit数据，写返回0，失败-1
 */
int ms41908m_rw(int fd, int rw, unsigned char addr, unsigned short data)
{
    unsigned char tx[3] = {0};
    unsigned char rx[3] = {0};

    // 24bit 帧格式：[7:6]保留 [5]C0 [4:0]地址 | [15:0]数据
    tx[0] = (rw ? MS41908M_READ : MS41908M_WRITE) | (addr & 0x3F);
    tx[1] = (data >> 8) & 0xFF;
    tx[2] = data & 0xFF;

    struct spi_ioc_transfer tr = {
        .tx_buf        = (unsigned long)tx,
        .rx_buf        = (unsigned long)rx,
        .len           = 3,
        .speed_hz      = SPI_SPEED,
        .bits_per_word = SPI_BITS,
    };

    if (ioctl(fd, SPI_IOC_MESSAGE(1), &tr) < 0) {
        perror("spi transfer failed");
        return -1;
    }

    // 读模式：返回16bit数据
    if (rw)
        return ((rx[1] << 8) | rx[2]) & 0xFFFF;
    return 0;
}

int main(int argc, char *argv[])
{
    int fd;
    int ret;
    unsigned short read_val;
    int mode = SPI_MODE;
    int bits = SPI_BITS;
    int speed = SPI_SPEED;

    // 1. 打开 SPI
    fd = open(SPI_DEVICE, O_RDWR);
    if (fd < 0) {
        perror("open spi failed");
        return -1;
    }

    // 2. 设置模式/位宽/速率
    ret = ioctl(fd, SPI_IOC_WR_MODE, &mode);
    ret |= ioctl(fd, SPI_IOC_WR_BITS_PER_WORD, &bits);
    ret |= ioctl(fd, SPI_IOC_RD_BITS_PER_WORD, &bits);
    ret |= ioctl(fd, SPI_IOC_WR_MAX_SPEED_HZ, &speed);
    ret |= ioctl(fd, SPI_IOC_RD_MAX_SPEED_HZ, &speed);
    if (ret < 0) {
        perror("spi set param failed");
        close(fd);
        return -1;
    }

    printf("MS41908M SPI test start...\n");

    // 3. 读测试寄存器（0x0C 只读，能读到数据=芯片应答）
    read_val = ms41908m_rw(fd, 1, TEST_ADDR, 0x0000);
    if (read_val < 0) {
        printf("===== 通信失败：无应答 =====\n");
    } else {
        printf("===== 通信成功：读到 0x%04X =====\n", read_val);
    }

    close(fd);
    return 0;
}