------------------------------------------------------------------------- GBATEK Gameboy Advance / Nintendo DS Technical Info Extracted from no$gba version 3.05 ------------------------------------------------------------------------- GBA Reference ------------- Overview --> GBA Technical Data --> GBA Memory Map --> GBA I/O Map Hardware Programming --> GBA LCD Video Controller --> GBA Sound Controller --> GBA Timers --> GBA DMA Transfers --> GBA Communication Ports --> GBA Keypad Input --> GBA Interrupt Control --> GBA System Control --> GBA Cartridges --> GBA Unpredictable Things Other --> ARM CPU Reference --> BIOS Functions --> External Connectors NDS Reference ------------- Overview --> DS Technical Data --> DS I/O Maps --> DS Memory Maps Hardware Programming --> DS Memory Control --> DS Video --> DS 3D Video --> DS Sound --> DS System and Built-in Peripherals --> DS Cartridges, Encryption, Firmware --> DS Xboo --> DS Wireless Communications Other --> BIOS Functions --> ARM CPU Reference --> External Connectors DSi Reference ------------- Basic Hardware Features (mostly same as NDS) --> NDS Reference --> DSi Basic Differences to NDS New Hardware Features --> DSi I/O Map --> DSi Control Registers (SCFG) --> DSi XpertTeak (DSP) --> DSi New Shared WRAM (for ARM7, ARM9, DSP) --> DSi New DMA (NDMA) --> DSi Microphone and SoundExt --> DSi Advanced Encryption Standard (AES) --> DSi Cartridge Header --> DSi Touchscreen/Sound Controller --> DSi I2C Bus --> DSi Cameras --> DSi SD/MMC Protocol and I/O Ports --> DSi SD/MMC Filesystem --> DSi Atheros Wifi SDIO Interface --> DSi Atheros Wifi Internal Hardware --> DSi GPIO Registers --> DSi Console IDs --> DSi Unknown Registers --> DSi Notes --> DSi Exploits --> DSi Regions General Info --> ARM CPU Reference --> BIOS Functions --> External Connectors 3DS Reference ------------- --> 3DS Reference CPU Reference ------------- General ARM7TDMI Information --> ARM CPU Overview --> ARM CPU Register Set --> ARM CPU Flags & Condition Field (cond) --> ARM CPU 26bit Memory Interface --> ARM CPU Exceptions --> ARM CPU Memory Alignments ARM 32bit Instruction Set (ARM Code) --> ARM Instruction Summary --> ARM Branch and Branch with Link (B,BL,BX,BLX,SWI,BKPT) --> ARM Data Processing (ALU) --> ARM Multiply and Multiply-Accumulate (MUL, MLA) --> ARM Special ARM9 Instructions (CLZ, QADD/QSUB) --> ARM PSR Transfer (MRS, MSR) --> ARM Memory: Single Data Transfer (LDR, STR, PLD) --> ARM Memory: Halfword, Doubleword, Signed Data Transfer --> ARM Memory: Block Data Transfer (LDM, STM) --> ARM Memory: Single Data Swap (SWP) --> ARM Coprocessor (MRC/MCR, LDC/STC, CDP, MCRR/MRRC) ARM 16bit Instruction Set (THUMB Code) --> THUMB Instruction Summary --> THUMB Register Operations (ALU, BX) --> THUMB Memory Load/Store (LDR/STR) --> THUMB Memory Addressing (ADD PC/SP) --> THUMB Memory Multiple Load/Store (PUSH/POP and LDM/STM) --> THUMB Jumps and Calls Further Information --> ARM Pseudo Instructions and Directives --> ARM CP15 System Control Coprocessor --> ARM CPU Instruction Cycle Times --> ARM CPU Versions --> ARM CPU Data Sheet About GBATEK ------------ About --> About this Document GBA Reference ------------- Overview --> GBA Technical Data --> GBA Memory Map --> GBA I/O Map Hardware Programming --> GBA LCD Video Controller --> GBA Sound Controller --> GBA Timers --> GBA DMA Transfers --> GBA Communication Ports --> GBA Keypad Input --> GBA Interrupt Control --> GBA System Control --> GBA Cartridges --> GBA Unpredictable Things Other --> ARM CPU Reference --> BIOS Functions --> External Connectors GBA Technical Data ------------------ CPU Modes ARM Mode ARM7TDMI 32bit RISC CPU, 16.78MHz, 32bit opcodes (GBA) THUMB Mode ARM7TDMI 32bit RISC CPU, 16.78MHz, 16bit opcodes (GBA) CGB Mode Z80/8080-style 8bit CPU, 4.2MHz or 8.4MHz (CGB compatibility) DMG Mode Z80/8080-style 8bit CPU, 4.2MHz (monochrome gameboy compatib.) Internal Memory BIOS ROM 16 KBytes Work RAM 288 KBytes (Fast 32K on-chip, plus Slow 256K on-board) VRAM 96 KBytes OAM 1 KByte (128 OBJs 3x16bit, 32 OBJ-Rotation/Scalings 4x16bit) Palette RAM 1 KByte (256 BG colors, 256 OBJ colors) Video Display 240x160 pixels (2.9 inch TFT color LCD display) BG layers 4 background layers BG types Tile/map based, or Bitmap based BG colors 256 colors, or 16 colors/16 palettes, or 32768 colors OBJ colors 256 colors, or 16 colors/16 palettes OBJ size 12 types (in range 8x8 up to 64x64 dots) OBJs/Screen max. 128 OBJs of any size (up to 64x64 dots each) OBJs/Line max. 128 OBJs of 8x8 dots size (under best circumstances) Priorities OBJ/OBJ: 0-127, OBJ/BG: 0-3, BG/BG: 0-3 Effects Rotation/Scaling, alpha blending, fade-in/out, mosaic, window Backlight GBA SP only (optionally by light on/off toggle button) Sound Analogue 4 channel CGB compatible (3x square wave, 1x noise) Digital 2 DMA sound channels Output Built-in speaker (mono), or headphones socket (stereo) Controls Gamepad 4 Direction Keys, 6 Buttons Communication Ports Serial Port Various transfer modes, 4-Player Link, Single Game Pak play External Memory GBA Game Pak max. 32MB ROM or flash ROM + max 64K SRAM CGB Game Pak max. 32KB ROM + 8KB SRAM (more memory requires banking) Case Dimensions Size (mm) GBA: 145x81x25 - GBA SP: 82x82x24 (closed), 155x82x24 (stretch) Power Supply Battery GBA GBA: 2x1.5V DC (AA), Life-time approx. 15 hours Battery SP GBA SP: Built-in rechargeable Lithium ion battery, 3.7V 600mAh External GBA: 3.3V DC 350mA - GBA SP: 5.2V DC 320mA ---------------------------------------------------------------------------- Original Gameboy Advance (GBA) ____._____________...___.____ ____/ : CARTRIDGE SIO : \____ | L _____________________ LED R | | | | | | _||_ | 2.9" TFT SCREEN | (A) | | |_ _| | 240x160pix 61x40mm | (B) | | || | NO BACKLIGHT | :::: | | | | SPEAKR | | STRT() |_____________________| :::: | | SLCT() GAME BOY ADVANCE VOLUME | |____ OFF-ON BATTERY 2xAA PHONES _==_| \__.##.__________________,,___/ GBA SP (GBA SP) _______________________ _ | _____________________ | / / || || / / || 2.9" TFT SCREEN || / / || 240x160pix 61x40mm || / / || WITH BACKLIGHT || / / || || GBA SP SIDE VIEWS / / ||_____________________|| / / | GAME BOY ADVANCE SP | _____________________(_) |_______________________| |. . . . . . . .'.'. _| |_|________|________|_|_| |_CARTRIDGE_:_BATT._:_|_| <-- EXT1/EXT2 |L EXT1 EXT2 R| | (*) LEDSo _____________________ _ (VOL_||_ (A) o |_____________________(_) | |_ _| ,,,,,(B) | |. . . . . . . .'.'. _| | || ;SPK; | |_CARTRIDGE_:_BATT._:_|_| <-- EXT1/EXT2 | ''''' ON # _ _____________________ | SLCT STRT OFF# _____________________(_)_____________________| | CART. () () | |. . . . . . . .'.'. _| |_:___________________:_| |_CARTRIDGE_:_BATT._:_|_| <-- EXT1/EXT2 Gameboy Micro (GBA Micro) ________________SIO_______________ | L __________________ R | | | GBA-MICRO | | | _||_ | 2.0" TFT SCREEN | (A)| + ||_ _| |240x160pix 42x28mm| (B) |VOL | || | BACKLIGHT | | - | |__________________| ... | |___________SELECT__START__________| PWR <--- CARTRIDGE SLOT ---> PHONES Nintendo DS (NDS) _____________________________________ | _____________________ | | | | | | | 3" TFT SCREEN | | | | 256x192pix 61x46mm | | | | BACKLIGHT | | | ::::: | Original NDS | ::::: | | ::::: |_____________________| ::::: | _| _ ______ _ |_ <-- gap between screens: 22mm |L|_______| |________| |_| |_______|R| (equivalent to 90 pixels) |_______ _____________________ _______| | PWR | | | |SEL STA| | _ | | 3" TFT SCREEN | | | | _| |_ | | 256x192pix 61x46mm | | X | ||_ _|| | BACKLIGHT | | Y A | | |_| | | TOUCH SCREEN | | B | | | |_____________________| | | |_______| NintendoDS |_______| | MIC LEDS | |_________________________________________| VOL SLOT2(GBA) MIC/PHONES Nintendo DS Lite (NDS-Lite) _____________________________________ | _____________________ | | | | | | | 3" TFT SCREEN | | | ... | 256x192pix 61x46mm | ... | | ... | BACKLIGHT | ... | | | NDS-LITE | | | |_____________________| | |___ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ____| <-- gap between screens: 23mm L| _ |_____________MIC____________|LEDS|R | _ _____________________ | | _| |_ | | X | ||_ _|| 3" TFT SCREEN | Y A |PWR | |_| | 256x192pix 61x46mm | B | | | BACKLIGHT | | | | TOUCH SCREEN |oSTART | | |_____________________|oSELECT| |_____________________________________| VOL SLOT2(GBA) MIC/PHONES Nintendo DSi (DSi) _____________________________________ | _____________________ | | | | O o | <-- CAM (O) and LED (o) | | 3.25" TFT SCREEN | | (on backside) | | 256x192pix 66x50mm | | | | BACKLIGHT | | | __ | DSi | __ | | (__) |_____________________| (__) | |___ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ____| <-- gap between screens: 23mm L|LEDS|__________CAM__MIC_________| __ |R (88 pixels) + | _ _____________________ | VOL| _| |_ | | X | <-- SD Card Slot - ||_ _|| 3.25" TFT SCREEN | Y A | | |_| | 256x192pix 66x50mm | B | | | BACKLIGHT | | | | TOUCH SCREEN |oSTART | | POWERo|_____________________|oSELECT| |_____________________________________| MIC/PHONES Nintendo DSi XL As DSi, but bigger case, and bigger 4.2" screens Gameboy Player (Gamecube Joypad) (GBA Player) _________ L____------- -------____R / ___ \ / (Y) \Z / / O \ | (START) | (X)\ Z = Gameboy Player Menu | \___/ \_______/ (A) | X or Y = Select button |\ _ \ / (B) /| | \___ _| |_ \ / ___ ___/ | optionally X/Y can be | |\ |_ _| / \ / C \ /| | swapped with L/R (?) | | \ |_| / \ \___/ / | | | | \_____/ \_____/ | | analogue sticks = ? \__/ \__/ Gameboy Player (Gamecube Bongos) (GBA Player) _______ _______ / Y \ / X \ Y/B = left bongo rear/front side | . . . . |_| . . . . | X/A = right bongo rear/front side | B |R| A | S = start/pause button |\_______/|_|\_______/| R = microphone (triggers R button) |\_______/|S|\_______/| | |_| | (the X/Y inputs can be assigned to |\_______/| |\_______/| GBA R/L inputs in GBA player setup) \_______/ \_______/ The GBA's separate 8bit/32bit CPU modes cannot be operated simultaneously. Switching is allowed between ARM and THUMB modes only (that are the two GBA modes). This manual does not describe CGB and DMG modes, both are completely different than GBA modes, and both cannot be accessed from inside of GBA modes anyways. Gameboy Player An GBA Adapter for the Gamecube console; allowing to play GBA games on a television set. --> GBA Gameboy Player GBA SP Notes Deluxe version of the original GBA. With backlight, new folded laptop-style case, and built-in rechargeable battery. Appears to be 100% compatible with GBA, there seems to be no way to detect SPs by software. Gameboy Micro (GBA Micro) Minituarized GBA. Supports 32bit GBA games only (no 8bit DMG/CGB games). The 256K Main RAM is a bit slower than usually (cannot be "overclocked via port 4000800h). Nintendo DS (Dual Screen) Notes New handheld with two screens, backwards compatible with GBA games, it is NOT backwards compatible with older 8bit games (mono/color gameboys) though.. Also, the DS has no link port, so that GBA games will thus work only in single player mode, link-port accessoires like printers cannot be used, and most unfortunately multiboot won't work (trying to press Select+Start at powerup will just lock up the DS). iQue Notes iQue is a brand name used by Nintendo in China, iQue GBA and iQue DS are essentially same as Nintendo GBA and Nintendo DS. The iQue DS contains a larger firmware chip (the charset additionally contains about 6700 simplified chinese characters), the bootmenu still allows to select (only) six languages (japanese has been replaced by chinese). The iQue DS can play normal international NDS games, plus chinese dedicated games. The latter ones won't work on normal NDS consoles (that, reportedly simply due to a firmware-version check contained in chinese dedicated games, aside from that check, the games should be fully compatible with NDS consoles). GBA Memory Map -------------- General Internal Memory 00000000-00003FFF BIOS - System ROM (16 KBytes) 00004000-01FFFFFF Not used 02000000-0203FFFF WRAM - On-board Work RAM (256 KBytes) 2 Wait 02040000-02FFFFFF Not used 03000000-03007FFF WRAM - On-chip Work RAM (32 KBytes) 03008000-03FFFFFF Not used 04000000-040003FE I/O Registers 04000400-04FFFFFF Not used Internal Display Memory 05000000-050003FF BG/OBJ Palette RAM (1 Kbyte) 05000400-05FFFFFF Not used 06000000-06017FFF VRAM - Video RAM (96 KBytes) 06018000-06FFFFFF Not used 07000000-070003FF OAM - OBJ Attributes (1 Kbyte) 07000400-07FFFFFF Not used External Memory (Game Pak) 08000000-09FFFFFF Game Pak ROM/FlashROM (max 32MB) - Wait State 0 0A000000-0BFFFFFF Game Pak ROM/FlashROM (max 32MB) - Wait State 1 0C000000-0DFFFFFF Game Pak ROM/FlashROM (max 32MB) - Wait State 2 0E000000-0E00FFFF Game Pak SRAM (max 64 KBytes) - 8bit Bus width 0E010000-0FFFFFFF Not used Unused Memory Area 10000000-FFFFFFFF Not used (upper 4bits of address bus unused) Default WRAM Usage By default, the 256 bytes at 03007F00h-03007FFFh in Work RAM are reserved for Interrupt vector, Interrupt Stack, and BIOS Call Stack. The remaining WRAM is free for whatever use (including User Stack, which is initially located at 03007F00h). Address Bus Width and CPU Read/Write Access Widths Shows the Bus-Width, supported read and write widths, and the clock cycles for 8/16/32bit accesses. Region Bus Read Write Cycles BIOS ROM 32 8/16/32 - 1/1/1 Work RAM 32K 32 8/16/32 8/16/32 1/1/1 I/O 32 8/16/32 8/16/32 1/1/1 OAM 32 8/16/32 16/32 1/1/1 * Work RAM 256K 16 8/16/32 8/16/32 3/3/6 ** Palette RAM 16 8/16/32 16/32 1/1/2 * VRAM 16 8/16/32 16/32 1/1/2 * GamePak ROM 16 8/16/32 - 5/5/8 **/*** GamePak Flash 16 8/16/32 16/32 5/5/8 **/*** GamePak SRAM 8 8 8 5 ** Timing Notes: * Plus 1 cycle if GBA accesses video memory at the same time. ** Default waitstate settings, see System Control chapter. *** Separate timings for sequential, and non-sequential accesses. One cycle equals approx. 59.59ns (ie. 16.78MHz clock). All memory (except GamePak SRAM) can be accessed by 16bit and 32bit DMA. GamePak Memory Only DMA3 (and the CPU of course) may access GamePak ROM. GamePak SRAM can be accessed by the CPU only - restricted to bytewise 8bit transfers. The SRAM region is supposed for as external FLASH backup memory, or for battery-backed SRAM. For details about configuration of GamePak Waitstates, see: --> GBA System Control VRAM, OAM, and Palette RAM Access These memory regions can be accessed during H-Blank or V-Blank only (unless display is disabled by Forced Blank bit in DISPCNT register). There is an additional restriction for OAM memory: Accesses during H-Blank are allowed only if 'H-Blank Interval Free' in DISPCNT is set (which'd reduce number of display-able OBJs though). The CPU appears to be able to access VRAM/OAM/Palette at any time, a waitstate (one clock cycle) being inserted automatically in case that the display controller was accessing memory simultaneously. (Ie. unlike as in old 8bit gameboy, the data will not get lost.) CPU Mode Performance Note that the GamePak ROM bus is limited to 16bits, thus executing ARM instructions (32bit opcodes) from inside of GamePak ROM would result in a not so good performance. So, it'd be more recommended to use THUMB instruction (16bit opcodes) which'd allow each opcode to be read at once. (ARM instructions can be used at best performance by copying code from GamePak ROM into internal Work RAM) Data Format Even though the ARM CPU itself would allow to select between Little-Endian and Big-Endian format by using an external circuit, in the GBA no such circuit exists, and the data format is always Little-Endian. That is, when accessing 16bit or 32bit data in memory, the least significant bits are stored in the first byte (smallest address), and the most significant bits in the last byte. (Ie. same as for 80x86 and Z80 CPUs.) GBA I/O Map ----------- LCD I/O Registers 4000000h 2 R/W DISPCNT LCD Control 4000002h 2 R/W - Undocumented - Green Swap 4000004h 2 R/W DISPSTAT General LCD Status (STAT,LYC) 4000006h 2 R VCOUNT Vertical Counter (LY) 4000008h 2 R/W BG0CNT BG0 Control 400000Ah 2 R/W BG1CNT BG1 Control 400000Ch 2 R/W BG2CNT BG2 Control 400000Eh 2 R/W BG3CNT BG3 Control 4000010h 2 W BG0HOFS BG0 X-Offset 4000012h 2 W BG0VOFS BG0 Y-Offset 4000014h 2 W BG1HOFS BG1 X-Offset 4000016h 2 W BG1VOFS BG1 Y-Offset 4000018h 2 W BG2HOFS BG2 X-Offset 400001Ah 2 W BG2VOFS BG2 Y-Offset 400001Ch 2 W BG3HOFS BG3 X-Offset 400001Eh 2 W BG3VOFS BG3 Y-Offset 4000020h 2 W BG2PA BG2 Rotation/Scaling Parameter A (dx) 4000022h 2 W BG2PB BG2 Rotation/Scaling Parameter B (dmx) 4000024h 2 W BG2PC BG2 Rotation/Scaling Parameter C (dy) 4000026h 2 W BG2PD BG2 Rotation/Scaling Parameter D (dmy) 4000028h 4 W BG2X BG2 Reference Point X-Coordinate 400002Ch 4 W BG2Y BG2 Reference Point Y-Coordinate 4000030h 2 W BG3PA BG3 Rotation/Scaling Parameter A (dx) 4000032h 2 W BG3PB BG3 Rotation/Scaling Parameter B (dmx) 4000034h 2 W BG3PC BG3 Rotation/Scaling Parameter C (dy) 4000036h 2 W BG3PD BG3 Rotation/Scaling Parameter D (dmy) 4000038h 4 W BG3X BG3 Reference Point X-Coordinate 400003Ch 4 W BG3Y BG3 Reference Point Y-Coordinate 4000040h 2 W WIN0H Window 0 Horizontal Dimensions 4000042h 2 W WIN1H Window 1 Horizontal Dimensions 4000044h 2 W WIN0V Window 0 Vertical Dimensions 4000046h 2 W WIN1V Window 1 Vertical Dimensions 4000048h 2 R/W WININ Inside of Window 0 and 1 400004Ah 2 R/W WINOUT Inside of OBJ Window & Outside of Windows 400004Ch 2 W MOSAIC Mosaic Size 400004Eh - - Not used 4000050h 2 R/W BLDCNT Color Special Effects Selection 4000052h 2 R/W BLDALPHA Alpha Blending Coefficients 4000054h 2 W BLDY Brightness (Fade-In/Out) Coefficient 4000056h - - Not used Sound Registers 4000060h 2 R/W SOUND1CNT_L Channel 1 Sweep register (NR10) 4000062h 2 R/W SOUND1CNT_H Channel 1 Duty/Length/Envelope (NR11, NR12) 4000064h 2 R/W SOUND1CNT_X Channel 1 Frequency/Control (NR13, NR14) 4000066h - - Not used 4000068h 2 R/W SOUND2CNT_L Channel 2 Duty/Length/Envelope (NR21, NR22) 400006Ah - - Not used 400006Ch 2 R/W SOUND2CNT_H Channel 2 Frequency/Control (NR23, NR24) 400006Eh - - Not used 4000070h 2 R/W SOUND3CNT_L Channel 3 Stop/Wave RAM select (NR30) 4000072h 2 R/W SOUND3CNT_H Channel 3 Length/Volume (NR31, NR32) 4000074h 2 R/W SOUND3CNT_X Channel 3 Frequency/Control (NR33, NR34) 4000076h - - Not used 4000078h 2 R/W SOUND4CNT_L Channel 4 Length/Envelope (NR41, NR42) 400007Ah - - Not used 400007Ch 2 R/W SOUND4CNT_H Channel 4 Frequency/Control (NR43, NR44) 400007Eh - - Not used 4000080h 2 R/W SOUNDCNT_L Control Stereo/Volume/Enable (NR50, NR51) 4000082h 2 R/W SOUNDCNT_H Control Mixing/DMA Control 4000084h 2 R/W SOUNDCNT_X Control Sound on/off (NR52) 4000086h - - Not used 4000088h 2 BIOS SOUNDBIAS Sound PWM Control 400008Ah .. - - Not used 4000090h 2x10h R/W WAVE_RAM Channel 3 Wave Pattern RAM (2 banks!!) 40000A0h 4 W FIFO_A Channel A FIFO, Data 0-3 40000A4h 4 W FIFO_B Channel B FIFO, Data 0-3 40000A8h - - Not used DMA Transfer Channels 40000B0h 4 W DMA0SAD DMA 0 Source Address 40000B4h 4 W DMA0DAD DMA 0 Destination Address 40000B8h 2 W DMA0CNT_L DMA 0 Word Count 40000BAh 2 R/W DMA0CNT_H DMA 0 Control 40000BCh 4 W DMA1SAD DMA 1 Source Address 40000C0h 4 W DMA1DAD DMA 1 Destination Address 40000C4h 2 W DMA1CNT_L DMA 1 Word Count 40000C6h 2 R/W DMA1CNT_H DMA 1 Control 40000C8h 4 W DMA2SAD DMA 2 Source Address 40000CCh 4 W DMA2DAD DMA 2 Destination Address 40000D0h 2 W DMA2CNT_L DMA 2 Word Count 40000D2h 2 R/W DMA2CNT_H DMA 2 Control 40000D4h 4 W DMA3SAD DMA 3 Source Address 40000D8h 4 W DMA3DAD DMA 3 Destination Address 40000DCh 2 W DMA3CNT_L DMA 3 Word Count 40000DEh 2 R/W DMA3CNT_H DMA 3 Control 40000E0h - - Not used Timer Registers 4000100h 2 R/W TM0CNT_L Timer 0 Counter/Reload 4000102h 2 R/W TM0CNT_H Timer 0 Control 4000104h 2 R/W TM1CNT_L Timer 1 Counter/Reload 4000106h 2 R/W TM1CNT_H Timer 1 Control 4000108h 2 R/W TM2CNT_L Timer 2 Counter/Reload 400010Ah 2 R/W TM2CNT_H Timer 2 Control 400010Ch 2 R/W TM3CNT_L Timer 3 Counter/Reload 400010Eh 2 R/W TM3CNT_H Timer 3 Control 4000110h - - Not used Serial Communication (1) 4000120h 4 R/W SIODATA32 SIO Data (Normal-32bit Mode; shared with below) 4000120h 2 R/W SIOMULTI0 SIO Data 0 (Parent) (Multi-Player Mode) 4000122h 2 R/W SIOMULTI1 SIO Data 1 (1st Child) (Multi-Player Mode) 4000124h 2 R/W SIOMULTI2 SIO Data 2 (2nd Child) (Multi-Player Mode) 4000126h 2 R/W SIOMULTI3 SIO Data 3 (3rd Child) (Multi-Player Mode) 4000128h 2 R/W SIOCNT SIO Control Register 400012Ah 2 R/W SIOMLT_SEND SIO Data (Local of MultiPlayer; shared below) 400012Ah 2 R/W SIODATA8 SIO Data (Normal-8bit and UART Mode) 400012Ch - - Not used Keypad Input 4000130h 2 R KEYINPUT Key Status 4000132h 2 R/W KEYCNT Key Interrupt Control Serial Communication (2) 4000134h 2 R/W RCNT SIO Mode Select/General Purpose Data 4000136h - - IR Ancient - Infrared Register (Prototypes only) 4000138h - - Not used 4000140h 2 R/W JOYCNT SIO JOY Bus Control 4000142h - - Not used 4000150h 4 R/W JOY_RECV SIO JOY Bus Receive Data 4000154h 4 R/W JOY_TRANS SIO JOY Bus Transmit Data 4000158h 2 R/? JOYSTAT SIO JOY Bus Receive Status 400015Ah - - Not used Interrupt, Waitstate, and Power-Down Control 4000200h 2 R/W IE Interrupt Enable Register 4000202h 2 R/W IF Interrupt Request Flags / IRQ Acknowledge 4000204h 2 R/W WAITCNT Game Pak Waitstate Control 4000206h - - Not used 4000208h 2 R/W IME Interrupt Master Enable Register 400020Ah - - Not used 4000300h 1 R/W POSTFLG Undocumented - Post Boot Flag 4000301h 1 W HALTCNT Undocumented - Power Down Control 4000302h - - Not used 4000410h ? ? ? Undocumented - Purpose Unknown / Bug ??? 0FFh 4000411h - - Not used 4000800h 4 R/W ? Undocumented - Internal Memory Control (R/W) 4000804h - - Not used 4xx0800h 4 R/W ? Mirrors of 4000800h (repeated each 64K) 4700000h 4 W (3DS) Disable ARM7 bootrom overlay (3DS only) All further addresses at 4XXXXXXh are unused and do not contain mirrors of the I/O area, with the only exception that 4000800h is repeated each 64K (ie. mirrored at 4010800h, 4020800h, etc.) GBA LCD Video Controller ------------------------ Registers --> LCD I/O Display Control --> LCD I/O Interrupts and Status --> LCD I/O BG Control --> LCD I/O BG Scrolling --> LCD I/O BG Rotation/Scaling --> LCD I/O Window Feature --> LCD I/O Mosaic Function --> LCD I/O Color Special Effects VRAM --> LCD VRAM Overview --> LCD VRAM Character Data --> LCD VRAM BG Screen Data Format (BG Map) --> LCD VRAM Bitmap BG Modes Sprites --> LCD OBJ - Overview --> LCD OBJ - OAM Attributes --> LCD OBJ - OAM Rotation/Scaling Parameters --> LCD OBJ - VRAM Character (Tile) Mapping Other --> LCD Color Palettes --> LCD Dimensions and Timings LCD I/O Display Control ----------------------- 4000000h - DISPCNT - LCD Control (Read/Write) Bit Expl. 0-2 BG Mode (0-5=Video Mode 0-5, 6-7=Prohibited) 3 Reserved / CGB Mode (0=GBA, 1=CGB; can be set only by BIOS opcodes) 4 Display Frame Select (0-1=Frame 0-1) (for BG Modes 4,5 only) 5 H-Blank Interval Free (1=Allow access to OAM during H-Blank) 6 OBJ Character VRAM Mapping (0=Two dimensional, 1=One dimensional) 7 Forced Blank (1=Allow FAST access to VRAM,Palette,OAM) 8 Screen Display BG0 (0=Off, 1=On) 9 Screen Display BG1 (0=Off, 1=On) 10 Screen Display BG2 (0=Off, 1=On) 11 Screen Display BG3 (0=Off, 1=On) 12 Screen Display OBJ (0=Off, 1=On) 13 Window 0 Display Flag (0=Off, 1=On) 14 Window 1 Display Flag (0=Off, 1=On) 15 OBJ Window Display Flag (0=Off, 1=On) The table summarizes the facilities of the separate BG modes (video modes). Mode Rot/Scal Layers Size Tiles Colors Features 0 No 0123 256x256..512x515 1024 16/16..256/1 SFMABP 1 Mixed 012- (BG0,BG1 as above Mode 0, BG2 as below Mode 2) 2 Yes --23 128x128..1024x1024 256 256/1 S-MABP 3 Yes --2- 240x160 1 32768 --MABP 4 Yes --2- 240x160 2 256/1 --MABP 5 Yes --2- 160x128 2 32768 --MABP Features: S)crolling, F)lip, M)osaic, A)lphaBlending, B)rightness, P)riority. BG Modes 0-2 are Tile/Map-based. BG Modes 3-5 are Bitmap-based, in these modes 1 or 2 Frames (ie. bitmaps, or 'full screen tiles') exists, if two frames exist, either one can be displayed, and the other one can be redrawn in background. Blanking Bits Setting Forced Blank (Bit 7) causes the video controller to display white lines, and all VRAM, Palette RAM, and OAM may be accessed. "When the internal HV synchronous counter cancels a forced blank during a display period, the display begins from the beginning, following the display of two vertical lines." What ? Setting H-Blank Interval Free (Bit 5) allows to access OAM during H-Blank time - using this feature reduces the number of sprites that can be displayed per line. Display Enable Bits By default, BG0-3 and OBJ Display Flags (Bit 8-12) are used to enable/disable BGs and OBJ. When enabling Window 0 and/or 1 (Bit 13-14), color special effects may be used, and BG0-3 and OBJ are controlled by the window(s). Frame Selection In BG Modes 4 and 5 (Bitmap modes), either one of the two bitmaps/frames may be displayed (Bit 4), allowing the user to update the other (invisible) frame in background. In BG Mode 3, only one frame exists. In BG Modes 0-2 (Tile/Map based modes), a similar effect may be gained by altering the base address(es) of BG Map and/or BG Character data. 4000002h - Undocumented - Green Swap (R/W) Normally, red green blue intensities for a group of two pixels is output as BGRbgr (uppercase for left pixel at even xloc, lowercase for right pixel at odd xloc). When the Green Swap bit is set, each pixel group is output as BgRbGr (ie. green intensity of each two pixels exchanged). Bit Expl. 0 Green Swap (0=Normal, 1=Swap) 1-15 Not used This feature appears to be applied to the final picture (ie. after mixing the separate BG and OBJ layers). Eventually intended for other display types (with other pin-outs). With normal GBA hardware it is just producing an interesting dirt effect. The NDS DISPCNT registers are 32bit (4000000h..4000003h), so Green Swap doesn't exist in NDS mode, however, the NDS does support Green Swap in GBA mode. LCD I/O Interrupts and Status ----------------------------- 4000004h - DISPSTAT - General LCD Status (Read/Write) Display status and Interrupt control. The H-Blank conditions are generated once per scanline, including for the 'hidden' scanlines during V-Blank. Bit Expl. 0 V-Blank flag (Read only) (1=VBlank) (set in line 160..226; not 227) 1 H-Blank flag (Read only) (1=HBlank) (toggled in all lines, 0..227) 2 V-Counter flag (Read only) (1=Match) (set in selected line) (R) 3 V-Blank IRQ Enable (1=Enable) (R/W) 4 H-Blank IRQ Enable (1=Enable) (R/W) 5 V-Counter IRQ Enable (1=Enable) (R/W) 6 Not used (0) / DSi: LCD Initialization Ready (0=Busy, 1=Ready) (R) 7 Not used (0) / NDS: MSB of V-Vcount Setting (LYC.Bit8) (0..262)(R/W) 8-15 V-Count Setting (LYC) (0..227) (R/W) The V-Count-Setting value is much the same as LYC of older gameboys, when its value is identical to the content of the VCOUNT register then the V-Counter flag is set (Bit 2), and (if enabled in Bit 5) an interrupt is requested. Although the drawing time is only 960 cycles (240*4), the H-Blank flag is "0" for a total of 1006 cycles. 4000006h - VCOUNT - Vertical Counter (Read only) Indicates the currently drawn scanline, values in range from 160..227 indicate 'hidden' scanlines within VBlank area. Bit Expl. 0-7 Current Scanline (LY) (0..227) (R) 8 Not used (0) / NDS: MSB of Current Scanline (LY.Bit8) (0..262) (R) 9-15 Not Used (0) Note: This is much the same than the 'LY' register of older gameboys. LCD I/O BG Control ------------------ 4000008h - BG0CNT - BG0 Control (R/W) (BG Modes 0,1 only) 400000Ah - BG1CNT - BG1 Control (R/W) (BG Modes 0,1 only) 400000Ch - BG2CNT - BG2 Control (R/W) (BG Modes 0,1,2 only) 400000Eh - BG3CNT - BG3 Control (R/W) (BG Modes 0,2 only) Bit Expl. 0-1 BG Priority (0-3, 0=Highest) 2-3 Character Base Block (0-3, in units of 16 KBytes) (=BG Tile Data) 4-5 Not used (must be zero) (except in NDS mode: MSBs of char base) 6 Mosaic (0=Disable, 1=Enable) 7 Colors/Palettes (0=16/16, 1=256/1) 8-12 Screen Base Block (0-31, in units of 2 KBytes) (=BG Map Data) 13 BG0/BG1: Not used (except in NDS mode: Ext Palette Slot for BG0/BG1) 13 BG2/BG3: Display Area Overflow (0=Transparent, 1=Wraparound) 14-15 Screen Size (0-3) Internal Screen Size (dots) and size of BG Map (bytes): Value Text Mode Rotation/Scaling Mode 0 256x256 (2K) 128x128 (256 bytes) 1 512x256 (4K) 256x256 (1K) 2 256x512 (4K) 512x512 (4K) 3 512x512 (8K) 1024x1024 (16K) In case that some or all BGs are set to same priority then BG0 is having the highest, and BG3 the lowest priority. In 'Text Modes', the screen size is organized as follows: The screen consists of one or more 256x256 pixel (32x32 tiles) areas. When Size=0: only 1 area (SC0), when Size=1 or Size=2: two areas (SC0,SC1 either horizontally or vertically arranged next to each other), when Size=3: four areas (SC0,SC1 in upper row, SC2,SC3 in lower row). Whereas SC0 is defined by the normal BG Map base address (Bit 8-12 of BGxCNT), SC1 uses same address +2K, SC2 address +4K, SC3 address +6K. When the screen is scrolled it'll always wraparound. In 'Rotation/Scaling Modes', the screen size is organized as follows, only one area (SC0) of variable size 128x128..1024x1024 pixels (16x16..128x128 tiles) exists. When the screen is rotated/scaled (or scrolled?) so that the LCD viewport reaches outside of the background/screen area, then BG may be either displayed as transparent or wraparound (Bit 13 of BGxCNT). LCD I/O BG Scrolling -------------------- 4000010h - BG0HOFS - BG0 X-Offset (W) 4000012h - BG0VOFS - BG0 Y-Offset (W) Bit Expl. 0-8 Offset (0-511) 9-15 Not used Specifies the coordinate of the upperleft first visible dot of BG0 background layer, ie. used to scroll the BG0 area. 4000014h - BG1HOFS - BG1 X-Offset (W) 4000016h - BG1VOFS - BG1 Y-Offset (W) Same as above BG0HOFS and BG0VOFS for BG1 respectively. 4000018h - BG2HOFS - BG2 X-Offset (W) 400001Ah - BG2VOFS - BG2 Y-Offset (W) Same as above BG0HOFS and BG0VOFS for BG2 respectively. 400001Ch - BG3HOFS - BG3 X-Offset (W) 400001Eh - BG3VOFS - BG3 Y-Offset (W) Same as above BG0HOFS and BG0VOFS for BG3 respectively. The above BG scrolling registers are exclusively used in Text modes, ie. for all layers in BG Mode 0, and for the first two layers in BG mode 1. In other BG modes (Rotation/Scaling and Bitmap modes) above registers are ignored. Instead, the screen may be scrolled by modifying the BG Rotation/Scaling Reference Point registers. LCD I/O BG Rotation/Scaling --------------------------- 4000028h - BG2X_L - BG2 Reference Point X-Coordinate, lower 16 bit (W) 400002Ah - BG2X_H - BG2 Reference Point X-Coordinate, upper 12 bit (W) 400002Ch - BG2Y_L - BG2 Reference Point Y-Coordinate, lower 16 bit (W) 400002Eh - BG2Y_H - BG2 Reference Point Y-Coordinate, upper 12 bit (W) These registers are replacing the BG scrolling registers which are used for Text mode, ie. the X/Y coordinates specify the source position from inside of the BG Map/Bitmap of the pixel to be displayed at upper left of the GBA display. The normal BG scrolling registers are ignored in Rotation/Scaling and Bitmap modes. Bit Expl. 0-7 Fractional portion (8 bits) 8-26 Integer portion (19 bits) 27 Sign (1 bit) 28-31 Not used Because values are shifted left by eight, fractional portions may be specified in steps of 1/256 pixels (this would be relevant only if the screen is actually rotated or scaled). Normal signed 32bit values may be written to above registers (the most significant bits will be ignored and the value will be cut-down to 28bits, but this is no actual problem because signed values have set all MSBs to the same value). Internal Reference Point Registers The above reference points are automatically copied to internal registers during each vblank, specifying the origin for the first scanline. The internal registers are then incremented by dmx and dmy after each scanline. Caution: Writing to a reference point register by software outside of the Vblank period does immediately copy the new value to the corresponding internal register, that means: in the current frame, the new value specifies the origin of the scanline (instead of the topmost scanline). 4000020h - BG2PA - BG2 Rotation/Scaling Parameter A (alias dx) (W) 4000022h - BG2PB - BG2 Rotation/Scaling Parameter B (alias dmx) (W) 4000024h - BG2PC - BG2 Rotation/Scaling Parameter C (alias dy) (W) 4000026h - BG2PD - BG2 Rotation/Scaling Parameter D (alias dmy) (W) Bit Expl. 0-7 Fractional portion (8 bits) 8-14 Integer portion (7 bits) 15 Sign (1 bit) See below for details. 400003Xh - BG3X_L/H, BG3Y_L/H, BG3PA-D - BG3 Rotation/Scaling Parameters Same as above BG2 Reference Point, and Rotation/Scaling Parameters, for BG3 respectively. dx (PA) and dy (PC) When transforming a horizontal line, dx and dy specify the resulting gradient and magnification for that line. For example: Horizontal line, length=100, dx=1, and dy=1. The resulting line would be drawn at 45 degrees, f(y)=1/1*x. Note that this would involve that line is magnified, the new length is SQR(100^2+100^2)=141.42. Yup, exactly - that's the old a^2 + b^2 = c^2 formula. dmx (PB) and dmy (PD) These values define the resulting gradient and magnification for transformation of vertical lines. However, when rotating a square area (which is surrounded by horizontal and vertical lines), then the desired result should be usually a rotated area (ie. not a parallelogram, for example). Thus, dmx and dmy must be defined in direct relationship to dx and dy, taking the example above, we'd have to set dmx=-1, and dmy=1, f(x)=-1/1*y. Area Overflow In result of rotation/scaling it may often happen that areas outside of the actual BG area become moved into the LCD viewport. Depending of the Area Overflow bit (BG2CNT and BG3CNT, Bit 13) these areas may be either displayed (by wrapping the BG area), or may be displayed transparent. This works only in BG modes 1 and 2. The area overflow is ignored in Bitmap modes (BG modes 3-5), the outside of the Bitmaps is always transparent. --- more details and confusing or helpful formulas --- The following parameters are required for Rotation/Scaling Rotation Center X and Y Coordinates (x0,y0) Rotation Angle (alpha) Magnification X and Y Values (xMag,yMag) The display is rotated by 'alpha' degrees around the center. The displayed picture is magnified by 'xMag' along x-Axis (Y=y0) and 'yMag' along y-Axis (X=x0). Calculating Rotation/Scaling Parameters A-D A = Cos (alpha) / xMag ;distance moved in direction x, same line B = Sin (alpha) / xMag ;distance moved in direction x, next line C = Sin (alpha) / yMag ;distance moved in direction y, same line D = Cos (alpha) / yMag ;distance moved in direction y, next line Calculating the position of a rotated/scaled dot Using the following expressions, x0,y0 Rotation Center x1,y1 Old Position of a pixel (before rotation/scaling) x2,y2 New position of above pixel (after rotation scaling) A,B,C,D BG2PA-BG2PD Parameters (as calculated above) the following formula can be used to calculate x2,y2: x2 = A(x1-x0) + B(y1-y0) + x0 y2 = C(x1-x0) + D(y1-y0) + y0 LCD I/O Window Feature ---------------------- The Window Feature may be used to split the screen into four regions. The BG0-3,OBJ layers and Color Special Effects can be separately enabled or disabled in each of these regions. The DISPCNT Register DISPCNT Bits 13-15 are used to enable Window 0, Window 1, and/or OBJ Window regions, if any of these regions is enabled then the "Outside of Windows" region is automatically enabled, too. DISPCNT Bits 8-12 are kept used as master enable bits for the BG0-3,OBJ layers, a layer is displayed only if both DISPCNT and WININ/OUT enable bits are set. 4000040h - WIN0H - Window 0 Horizontal Dimensions (W) 4000042h - WIN1H - Window 1 Horizontal Dimensions (W) Bit Expl. 0-7 X2, Rightmost coordinate of window, plus 1 8-15 X1, Leftmost coordinate of window Garbage values of X2>240 or X1>X2 are interpreted as X2=240. 4000044h - WIN0V - Window 0 Vertical Dimensions (W) 4000046h - WIN1V - Window 1 Vertical Dimensions (W) Bit Expl. 0-7 Y2, Bottom-most coordinate of window, plus 1 8-15 Y1, Top-most coordinate of window Garbage values of Y2>160 or Y1>Y2 are interpreted as Y2=160. 4000048h - WININ - Control of Inside of Window(s) (R/W) Bit Expl. 0-3 Window 0 BG0-BG3 Enable Bits (0=No Display, 1=Display) 4 Window 0 OBJ Enable Bit (0=No Display, 1=Display) 5 Window 0 Color Special Effect (0=Disable, 1=Enable) 6-7 Not used 8-11 Window 1 BG0-BG3 Enable Bits (0=No Display, 1=Display) 12 Window 1 OBJ Enable Bit (0=No Display, 1=Display) 13 Window 1 Color Special Effect (0=Disable, 1=Enable) 14-15 Not used 400004Ah - WINOUT - Control of Outside of Windows & Inside of OBJ Window (R/W) Bit Expl. 0-3 Outside BG0-BG3 Enable Bits (0=No Display, 1=Display) 4 Outside OBJ Enable Bit (0=No Display, 1=Display) 5 Outside Color Special Effect (0=Disable, 1=Enable) 6-7 Not used 8-11 OBJ Window BG0-BG3 Enable Bits (0=No Display, 1=Display) 12 OBJ Window OBJ Enable Bit (0=No Display, 1=Display) 13 OBJ Window Color Special Effect (0=Disable, 1=Enable) 14-15 Not used The OBJ Window The dimension of the OBJ Window is specified by OBJs which are having the "OBJ Mode" attribute being set to "OBJ Window". Any non-transparent dots of any such OBJs are marked as OBJ Window area. The OBJ itself is not displayed. The color, palette, and display priority of these OBJs are ignored. Both DISPCNT Bits 12 and 15 must be set when defining OBJ Window region(s). Window Priority In case that more than one window is enabled, and that these windows do overlap, Window 0 is having highest priority, Window 1 medium, and Obj Window lowest priority. Outside of Window is having zero priority, it is used for all dots which are not inside of any window region. LCD I/O Mosaic Function ----------------------- 400004Ch - MOSAIC - Mosaic Size (W) The Mosaic function can be separately enabled/disabled for BG0-BG3 by BG0CNT-BG3CNT Registers, as well as for each OBJ0-127 by OBJ attributes in OAM memory. Also, setting all of the bits below to zero effectively disables the mosaic function. Bit Expl. 0-3 BG Mosaic H-Size (minus 1) 4-7 BG Mosaic V-Size (minus 1) 8-11 OBJ Mosaic H-Size (minus 1) 12-15 OBJ Mosaic V-Size (minus 1) 16-31 Not used Example: When setting H-Size to 5, then pixels 0-5 of each display row are colorized as pixel 0, pixels 6-11 as pixel 6, pixels 12-17 as pixel 12, and so on. Normally, a 'mosaic-pixel' is colorized by the color of the upperleft covered pixel. In many cases it might be more desireful to use the color of the pixel in the center of the covered area - this effect may be gained by scrolling the background (or by adjusting the OBJ position, as far as upper/left rows/columns of OBJ are transparent). LCD I/O Color Special Effects ----------------------------- Two types of Special Effects are supported: Alpha Blending (Semi-Transparency) allows to combine colors of two selected surfaces. Brightness Increase/Decrease adjust the brightness of the selected surface. 4000050h - BLDCNT - Color Special Effects Selection (R/W) Bit Expl. 0 BG0 1st Target Pixel (Background 0) 1 BG1 1st Target Pixel (Background 1) 2 BG2 1st Target Pixel (Background 2) 3 BG3 1st Target Pixel (Background 3) 4 OBJ 1st Target Pixel (Top-most OBJ pixel) 5 BD 1st Target Pixel (Backdrop) 6-7 Color Special Effect (0-3, see below) 0 = None (Special effects disabled) 1 = Alpha Blending (1st+2nd Target mixed) 2 = Brightness Increase (1st Target becomes whiter) 3 = Brightness Decrease (1st Target becomes blacker) 8 BG0 2nd Target Pixel (Background 0) 9 BG1 2nd Target Pixel (Background 1) 10 BG2 2nd Target Pixel (Background 2) 11 BG3 2nd Target Pixel (Background 3) 12 OBJ 2nd Target Pixel (Top-most OBJ pixel) 13 BD 2nd Target Pixel (Backdrop) 14-15 Not used Selects the 1st Target layer(s) for special effects. For Alpha Blending/Semi-Transparency, it does also select the 2nd Target layer(s), which should have next lower display priority as the 1st Target. However, any combinations are possible, including that all layers may be selected as both 1st+2nd target, in that case the top-most pixel will be used as 1st target, and the next lower pixel as 2nd target. 4000052h - BLDALPHA - Alpha Blending Coefficients (R/W) (not W) Used for Color Special Effects Mode 1, and for Semi-Transparent OBJs. Bit Expl. 0-4 EVA Coefficient (1st Target) (0..16 = 0/16..16/16, 17..31=16/16) 5-7 Not used 8-12 EVB Coefficient (2nd Target) (0..16 = 0/16..16/16, 17..31=16/16) 13-15 Not used For this effect, the top-most non-transparent pixel must be selected as 1st Target, and the next-lower non-transparent pixel must be selected as 2nd Target, if so - and only if so, then color intensities of 1st and 2nd Target are mixed together by using the parameters in BLDALPHA register, for each pixel each R, G, B intensities are calculated separately: I = MIN ( 31, I1st*EVA + I2nd*EVB ) Otherwise - for example, if only one target exists, or if a non-transparent non-2nd-target pixel is moved between the two targets, or if 2nd target has higher display priority than 1st target - then only the top-most pixel is displayed (at normal intensity, regardless of BLDALPHA). 4000054h - BLDY - Brightness (Fade-In/Out) Coefficient (W) (not R/W) Used for Color Special Effects Modes 2 and 3. Bit Expl. 0-4 EVY Coefficient (Brightness) (0..16 = 0/16..16/16, 17..31=16/16) 5-31 Not used For each pixel each R, G, B intensities are calculated separately: I = I1st + (31-I1st)*EVY ;For Brightness Increase I = I1st - (I1st)*EVY ;For Brightness Decrease The color intensities of any selected 1st target surface(s) are increased or decreased by using the parameter in BLDY register. Semi-Transparent OBJs OBJs that are defined as 'Semi-Transparent' in OAM memory are always selected as 1st Target (regardless of BLDCNT Bit 4), and are always using Alpha Blending mode (regardless of BLDCNT Bit 6-7). The BLDCNT register may be used to perform Brightness effects on the OBJ (and/or other BG/BD layers). However, if a semi-transparent OBJ pixel does overlap a 2nd target pixel, then semi-transparency becomes priority, and the brightness effect will not take place (neither on 1st, nor 2nd target). The OBJ Layer Before special effects are applied, the display controller computes the OBJ priority ordering, and isolates the top-most OBJ pixel. In result, only the top-most OBJ pixel is recursed at the time when processing special effects. Ie. alpha blending and semi-transparency can be used for OBJ-to-BG or BG-to-OBJ , but not for OBJ-to-OBJ. LCD VRAM Overview ----------------- The GBA contains 96 Kbytes VRAM built-in, located at address 06000000-06017FFF, depending on the BG Mode used as follows: BG Mode 0,1,2 (Tile/Map based Modes) 06000000-0600FFFF 64 KBytes shared for BG Map and Tiles 06010000-06017FFF 32 KBytes OBJ Tiles The shared 64K area can be split into BG Map area(s), and BG Tiles area(s), the respective addresses for Map and Tile areas are set up by BG0CNT-BG3CNT registers. The Map address may be specified in units of 2K (steps of 800h), the Tile address in units of 16K (steps of 4000h). BG Mode 0,1 (Tile/Map based Text mode) The tiles may have 4bit or 8bit color depth, minimum map size is 32x32 tiles, maximum is 64x64 tiles, up to 1024 tiles can be used per map. Item Depth Required Memory One Tile 4bit 20h bytes One Tile 8bit 40h bytes 1024 Tiles 4bit 8000h (32K) 1024 Tiles 8bit 10000h (64K) - excluding some bytes for BG map BG Map 32x32 800h (2K) BG Map 64x64 2000h (8K) BG Mode 1,2 (Tile/Map based Rotation/Scaling mode) The tiles may have 8bit color depth only, minimum map size is 16x16 tiles, maximum is 128x128 tiles, up to 256 tiles can be used per map. Item Depth Required Memory One Tile 8bit 40h bytes 256 Tiles 8bit 4000h (16K) BG Map 16x16 100h bytes BG Map 128x128 4000h (16K) BG Mode 3 (Bitmap based Mode for still images) 06000000-06013FFF 80 KBytes Frame 0 buffer (only 75K actually used) 06014000-06017FFF 16 KBytes OBJ Tiles BG Mode 4,5 (Bitmap based Modes) 06000000-06009FFF 40 KBytes Frame 0 buffer (only 37.5K used in Mode 4) 0600A000-06013FFF 40 KBytes Frame 1 buffer (only 37.5K used in Mode 4) 06014000-06017FFF 16 KBytes OBJ Tiles Note Additionally to the above VRAM, the GBA also contains 1 KByte Palette RAM (at 05000000h) and 1 KByte OAM (at 07000000h) which are both used by the display controller as well. LCD VRAM Character Data ----------------------- Each character (tile) consists of 8x8 dots (64 dots in total). The color depth may be either 4bit or 8bit (see BG0CNT-BG3CNT). 4bit depth (16 colors, 16 palettes) Each tile occupies 32 bytes of memory, the first 4 bytes for the topmost row of the tile, and so on. Each byte representing two dots, the lower 4 bits define the color for the left (!) dot, the upper 4 bits the color for the right dot. 8bit depth (256 colors, 1 palette) Each tile occupies 64 bytes of memory, the first 8 bytes for the topmost row of the tile, and so on. Each byte selects the palette entry for each dot. LCD VRAM BG Screen Data Format (BG Map) --------------------------------------- The display background consists of 8x8 dot tiles, the arrangement of these tiles is specified by the BG Screen Data (BG Map). The separate entries in this map are as follows: Text BG Screen (2 bytes per entry) Specifies the tile number and attributes. Note that BG tile numbers are always specified in steps of 1 (unlike OBJ tile numbers which are using steps of two in 256 color/1 palette mode). Bit Expl. 0-9 Tile Number (0-1023) (a bit less in 256 color mode, because there'd be otherwise no room for the bg map) 10 Horizontal Flip (0=Normal, 1=Mirrored) 11 Vertical Flip (0=Normal, 1=Mirrored) 12-15 Palette Number (0-15) (Not used in 256 color/1 palette mode) A Text BG Map always consists of 32x32 entries (256x256 pixels), 400h entries = 800h bytes. However, depending on the BG Size, one, two, or four of these Maps may be used together, allowing to create backgrounds of 256x256, 512x256, 256x512, or 512x512 pixels, if so, the first map (SC0) is located at base+0, the next map (SC1) at base+800h, and so on. Rotation/Scaling BG Screen (1 byte per entry) In this mode, only 256 tiles can be used. There are no x/y-flip attributes, the color depth is always 256 colors/1 palette. Bit Expl. 0-7 Tile Number (0-255) The dimensions of Rotation/Scaling BG Maps depend on the BG size. For size 0-3 that are: 16x16 tiles (128x128 pixels), 32x32 tiles (256x256 pixels), 64x64 tiles (512x512 pixels), or 128x128 tiles (1024x1024 pixels). The size and VRAM base address of the separate BG maps for BG0-3 are set up by BG0CNT-BG3CNT registers. LCD VRAM Bitmap BG Modes ------------------------ In BG Modes 3-5 the background is defined in form of a bitmap (unlike as for Tile/Map based BG modes). Bitmaps are implemented as BG2, with Rotation/Scaling support. As bitmap modes are occupying 80KBytes of BG memory, only 16KBytes of VRAM can be used for OBJ tiles. BG Mode 3 - 240x160 pixels, 32768 colors Two bytes are associated to each pixel, directly defining one of the 32768 colors (without using palette data, and thus not supporting a 'transparent' BG color). Bit Expl. 0-4 Red Intensity (0-31) 5-9 Green Intensity (0-31) 10-14 Blue Intensity (0-31) 15 Not used in GBA Mode (in NDS Mode: Alpha=0=Transparent, Alpha=1=Normal) The first 480 bytes define the topmost line, the next 480 the next line, and so on. The background occupies 75 KBytes (06000000-06012BFF), most of the 80 Kbytes BG area, not allowing to redraw an invisible second frame in background, so this mode is mostly recommended for still images only. BG Mode 4 - 240x160 pixels, 256 colors (out of 32768 colors) One byte is associated to each pixel, selecting one of the 256 palette entries. Color 0 (backdrop) is transparent, and OBJs may be displayed behind the bitmap. The first 240 bytes define the topmost line, the next 240 the next line, and so on. The background occupies 37.5 KBytes, allowing two frames to be used (06000000-060095FF for Frame 0, and 0600A000-060135FF for Frame 1). BG Mode 5 - 160x128 pixels, 32768 colors Colors are defined as for Mode 3 (see above), but horizontal and vertical size are cut down to 160x128 pixels only - smaller than the physical dimensions of the LCD screen. The background occupies exactly 40 KBytes, so that BG VRAM may be split into two frames (06000000-06009FFF for Frame 0, and 0600A000-06013FFF for Frame 1). In BG modes 4,5, one Frame may be displayed (selected by DISPCNT Bit 4), the other Frame is invisible and may be redrawn in background. LCD OBJ - Overview ------------------ General Objects (OBJs) are moveable sprites. Up to 128 OBJs (of any size, up to 64x64 dots each) can be displayed per screen, and under best circumstances up to 128 OBJs (of small 8x8 dots size) can be displayed per horizontal display line. Maximum Number of Sprites per Line The total available OBJ rendering cycles per line are 1210 (=304*4-6) If "H-Blank Interval Free" bit in DISPCNT register is 0 954 (=240*4-6) If "H-Blank Interval Free" bit in DISPCNT register is 1 The required rendering cycles are (depending on horizontal OBJ size) Cycles per Pixels OBJ Type OBJ Type Screen Pixel Range n*1 cycles Normal OBJs 8..64 pixels 10+n*2 cycles Rotation/Scaling OBJs 8..64 pixels (area clipped) 10+n*2 cycles Rotation/Scaling OBJs 16..128 pixels (double size) Caution: The maximum number of OBJs per line is also affected by undisplayed (offscreen) OBJs which are having higher priority than displayed OBJs. To avoid this, move displayed OBJs to the begin of OAM memory (ie. OBJ0 has highest priority, OBJ127 lowest). Otherwise (in case that the program logic expects OBJs at fixed positions in OAM) at least take care to set the OBJ size of undisplayed OBJs to 8x8 with Rotation/Scaling disabled (this reduces the overload). Does the above also apply for VERTICALLY OFFSCREEN (or VERTICALLY not on CURRENT LINE) sprites ? VRAM - Character Data OBJs are always combined of one or more 8x8 pixel Tiles (much like BG Tiles in BG Modes 0-2). However, OBJ Tiles are stored in a separate area in VRAM: 06010000-06017FFF (32 KBytes) in BG Mode 0-2, or 06014000-06017FFF (16 KBytes) in BG Mode 3-5. Depending on the size of the above area (16K or 32K), and on the OBJ color depth (4bit or 8bit), 256-1024 8x8 dots OBJ Tiles can be defined. OAM - Object Attribute Memory This memory area contains Attributes which specify position, size, color depth, etc. appearance for each of the 128 OBJs. Additionally, it contains 32 OBJ Rotation/Scaling Parameter groups. OAM is located at 07000000-070003FF (sized 1 KByte). LCD OBJ - OAM Attributes ------------------------ OBJ Attributes There are 128 entries in OAM for each OBJ0-OBJ127. Each entry consists of 6 bytes (three 16bit Attributes). Attributes for OBJ0 are located at 07000000, for OBJ1 at 07000008, OBJ2 at 07000010, and so on. As you can see, there are blank spaces at 07000006, 0700000E, 07000016, etc. - these 16bit values are used for OBJ Rotation/Scaling (as described in the next chapter) - they are not directly related to the separate OBJs. OBJ Attribute 0 (R/W) Bit Expl. 0-7 Y-Coordinate (0-255) 8 Rotation/Scaling Flag (0=Off, 1=On) When Rotation/Scaling used (Attribute 0, bit 8 set): 9 Double-Size Flag (0=Normal, 1=Double) When Rotation/Scaling not used (Attribute 0, bit 8 cleared): 9 OBJ Disable (0=Normal, 1=Not displayed) 10-11 OBJ Mode (0=Normal, 1=Semi-Transparent, 2=OBJ Window, 3=Prohibited) 12 OBJ Mosaic (0=Off, 1=On) 13 Colors/Palettes (0=16/16, 1=256/1) 14-15 OBJ Shape (0=Square,1=Horizontal,2=Vertical,3=Prohibited) Caution: A very large OBJ (of 128 pixels vertically, ie. a 64 pixels OBJ in a Double Size area) located at Y>128 will be treated as at Y>-128, the OBJ is then displayed parts offscreen at the TOP of the display, it is then NOT displayed at the bottom. OBJ Attribute 1 (R/W) Bit Expl. 0-8 X-Coordinate (0-511) When Rotation/Scaling used (Attribute 0, bit 8 set): 9-13 Rotation/Scaling Parameter Selection (0-31) (Selects one of the 32 Rotation/Scaling Parameters that can be defined in OAM, for details read next chapter.) When Rotation/Scaling not used (Attribute 0, bit 8 cleared): 9-11 Not used 12 Horizontal Flip (0=Normal, 1=Mirrored) 13 Vertical Flip (0=Normal, 1=Mirrored) 14-15 OBJ Size (0..3, depends on OBJ Shape, see Attr 0) Size Square Horizontal Vertical 0 8x8 16x8 8x16 1 16x16 32x8 8x32 2 32x32 32x16 16x32 3 64x64 64x32 32x64 OBJ Attribute 2 (R/W) Bit Expl. 0-9 Character Name (0-1023=Tile Number) 10-11 Priority relative to BG (0-3; 0=Highest) 12-15 Palette Number (0-15) (Not used in 256 color/1 palette mode) Notes: OBJ Mode The OBJ Mode may be Normal, Semi-Transparent, or OBJ Window. Semi-Transparent means that the OBJ is used as 'Alpha Blending 1st Target' (regardless of BLDCNT register, for details see chapter about Color Special Effects). OBJ Window means that the OBJ is not displayed, instead, dots with non-zero color are used as mask for the OBJ Window, see DISPCNT and WINOUT for details. OBJ Tile Number There are two situations which may divide the amount of available tiles by two (by four if both situations apply): 1. When using the 256 Colors/1 Palette mode, only each second tile may be used, the lower bit of the tile number should be zero (in 2-dimensional mapping mode, the bit is completely ignored). 2. When using BG Mode 3-5 (Bitmap Modes), only tile numbers 512-1023 may be used. That is because lower 16K of OBJ memory are used for BG. Attempts to use tiles 0-511 are ignored (not displayed). Priority In case that the 'Priority relative to BG' is the same than the priority of one of the background layers, then the OBJ becomes higher priority and is displayed on top of that BG layer. Caution: Take care not to mess up BG Priority and OBJ priority. For example, the following would cause garbage to be displayed: OBJ No. 0 with Priority relative to BG=1 ;hi OBJ prio, lo BG prio OBJ No. 1 with Priority relative to BG=0 ;lo OBJ prio, hi BG prio That is, OBJ0 is always having priority above OBJ1-127, so assigning a lower BG Priority to OBJ0 than for OBJ1-127 would be a bad idea. LCD OBJ - OAM Rotation/Scaling Parameters ----------------------------------------- As described in the previous chapter, there are blank spaces between each of the 128 OBJ Attribute Fields in OAM memory. These 128 16bit gaps are used to store OBJ Rotation/Scaling Parameters. Location of Rotation/Scaling Parameters in OAM Four 16bit parameters (PA,PB,PC,PD) are required to define a complete group of Rotation/Scaling data. These are spread across OAM as such: 1st Group - PA=07000006, PB=0700000E, PC=07000016, PD=0700001E 2nd Group - PA=07000026, PB=0700002E, PC=07000036, PD=0700003E etc. By using all blank space (128 x 16bit), up to 32 of these groups (4 x 16bit each) can be defined in OAM. OBJ Rotation/Scaling PA,PB,PC,PD Parameters (R/W) Each OBJ that uses Rotation/Scaling may select between any of the above 32 parameter groups. For details, refer to the previous chapter about OBJ Attributes. The meaning of the separate PA,PB,PC,PD values is identical as for BG, for details read the chapter about BG Rotation/Scaling. OBJ Reference Point & Rotation Center The OBJ Reference Point is the upper left of the OBJ, ie. OBJ X/Y coordinates: X+0, Y+0. The OBJ Rotation Center is always (or should be usually?) in the middle of the object, ie. for a 8x32 pixel OBJ, this would be at the OBJ X/Y coordinates: X+4, and Y+16. OBJ Double-Size Bit (for OBJs that use Rotation/Scaling) When Double-Size is zero: The sprite is rotated, and then display inside of the normal-sized (not rotated) rectangular area - the edges of the rotated sprite will become invisible if they reach outside of that area. When Double-Size is set: The sprite is rotated, and then display inside of the double-sized (not rotated) rectangular area - this ensures that the edges of the rotated sprite remain visible even if they would reach outside of the normal-sized area. (Except that, for example, rotating a 8x32 pixel sprite by 90 degrees would still cut off parts of the sprite as the double-size area isn't large enough.) LCD OBJ - VRAM Character (Tile) Mapping --------------------------------------- Each OBJ tile consists of 8x8 dots, however, bigger OBJs can be displayed by combining several 8x8 tiles. The horizontal and vertical size for each OBJ may be separately defined in OAM, possible H/V sizes are 8,16,32,64 dots - allowing 'square' OBJs to be used (such like 8x8, 16x16, etc) as well as 'rectangular' OBJs (such like 8x32, 64x16, etc.) When displaying an OBJ that contains of more than one 8x8 tile, one of the following two mapping modes can be used. In either case, the tile number of the upperleft tile must be specified in OAM memory. Two Dimensional Character Mapping (DISPCNT Bit 6 cleared) This mapping mode assumes that the 1024 OBJ tiles are arranged as a matrix of 32x32 tiles / 256x256 pixels (In 256 color mode: 16x32 tiles / 128x256 pixels). Ie. the upper row of this matrix contains tiles 00h-1Fh, the next row tiles 20h-3Fh, and so on. For example, when displaying a 16x16 pixel OBJ, with tile number set to 04h; The upper row of the OBJ will consist of tile 04h and 05h, the next row of 24h and 25h. (In 256 color mode: 04h and 06h, 24h and 26h.) One Dimensional Character Mapping (DISPCNT Bit 6 set) In this mode, tiles are mapped each after each other from 00h-3FFh. Using the same example as above, the upper row of the OBJ will consist of tile 04h and 05h, the next row of tile 06h and 07h. (In 256 color mode: 04h and 06h, 08h and 0Ah.) LCD Color Palettes ------------------ Color Palette RAM BG and OBJ palettes are using separate memory regions: 05000000-050001FF - BG Palette RAM (512 bytes, 256 colors) 05000200-050003FF - OBJ Palette RAM (512 bytes, 256 colors) Each BG and OBJ palette RAM may be either split into 16 palettes with 16 colors each, or may be used as a single palette with 256 colors. Note that some OBJs may access palette RAM in 16 color mode, while other OBJs may use 256 color mode at the same time. Same for BG0-BG3 layers. Transparent Colors Color 0 of all BG and OBJ palettes is transparent. Even though palettes are described as 16 (256) color palettes, only 15 (255) colors are actually visible. Backdrop Color Color 0 of BG Palette 0 is used as backdrop color. This color is displayed if an area of the screen is not covered by any non-transparent BG or OBJ dots. Color Definitions Each color occupies two bytes (same as for 32768 color BG modes): Bit Expl. 0-4 Red Intensity (0-31) 5-9 Green Intensity (0-31) 10-14 Blue Intensity (0-31) 15 Not used Intensities Under normal circumstances (light source/viewing angle), the intensities 0-14 are practically all black, and only intensities 15-31 are resulting in visible medium..bright colors. Note: The intensity problem appears in the 8bit CGB "compatibility" mode either. The original CGB display produced the opposite effect: Intensities 0-14 resulted in dark..medium colors, and intensities 15-31 resulted in bright colors. Any "medium" colors of CGB games will appear invisible/black on GBA hardware, and only very bright colors will be visible. LCD Dimensions and Timings -------------------------- Horizontal Dimensions The drawing time for each dot is 4 CPU cycles. Visible 240 dots, 57.221 us, 960 cycles - 78% of h-time H-Blanking 68 dots, 16.212 us, 272 cycles - 22% of h-time Total 308 dots, 73.433 us, 1232 cycles - ca. 13.620 kHz VRAM and Palette RAM may be accessed during H-Blanking. OAM can accessed only if "H-Blank Interval Free" bit in DISPCNT register is set. Vertical Dimensions Visible (*) 160 lines, 11.749 ms, 197120 cycles - 70% of v-time V-Blanking 68 lines, 4.994 ms, 83776 cycles - 30% of v-time Total 228 lines, 16.743 ms, 280896 cycles - ca. 59.737 Hz All VRAM, OAM, and Palette RAM may be accessed during V-Blanking. Note that no H-Blank interrupts are generated within V-Blank period. System Clock The system clock is 16.78MHz (16*1024*1024 Hz), one cycle is thus approx. 59.59ns. (*) Even though vertical screen size is 160 lines, the upper 8 lines are not visible, these lines are covered by a shadow when holding the GBA orientated towards a light source, the lines are effectively black - and should not be used to display important information. Interlace The LCD display is using some sort of interlace in which even scanlines are dimmed in each second frame, and odd scanlines are dimmed in each other frame (it does always render ALL lines in ALL frames, but half of them are dimmed). The effect can be seen when displaying some horizontal lines in each second frame, and hiding them in each other frame: the hardware will randomly show the lines in dimmed or non-dimmed form (depending on whether the test was started in an even or odd frame). Unknown if it's possible to determine the even/off frame state by software (or possibly to reset the hardware to this or that state by software). Note: The NDS is applying some sort of frameskip to GBA games, about every 3 seconds there will by a missing (or maybe: inserted) frame, ie. a GBA game that is updating the display in sync with GBA interlace will get offsync on NDS consoles. GBA Sound Controller -------------------- The GBA supplies four 'analogue' sound channels for Tone and Noise (mostly compatible to CGB sound), as well as two 'digital' sound channels (which can be used to replay 8bit DMA sample data). --> GBA Sound Channel 1 - Tone & Sweep --> GBA Sound Channel 2 - Tone --> GBA Sound Channel 3 - Wave Output --> GBA Sound Channel 4 - Noise --> GBA Sound Channel A and B - DMA Sound --> GBA Sound Control Registers --> GBA Comparison of CGB and GBA Sound The GBA includes only a single (mono) speaker built-in, each channel may be output to either left and/or right channels by using the external line-out connector (for stereo headphones, etc). GBA Sound Channel 1 - Tone & Sweep ---------------------------------- 4000060h - SOUND1CNT_L (NR10) - Channel 1 Sweep register (R/W) Bit Expl. 0-2 R/W Number of sweep shift (n=0-7) 3 R/W Sweep Frequency Direction (0=Increase, 1=Decrease) 4-6 R/W Sweep Time; units of 7.8ms (0-7, min=7.8ms, max=54.7ms) 7-15 - Not used Sweep is disabled by setting Sweep Time to zero, if so, the direction bit should be set. The change of frequency (NR13,NR14) at each shift is calculated by the following formula where X(0) is initial freq & X(t-1) is last freq: X(t) = X(t-1) +/- X(t-1)/2^n 4000062h - SOUND1CNT_H (NR11, NR12) - Channel 1 Duty/Len/Envelope (R/W) Bit Expl. 0-5 W Sound length; units of (64-n)/256s (0-63) 6-7 R/W Wave Pattern Duty (0-3, see below) 8-10 R/W Envelope Step-Time; units of n/64s (1-7, 0=No Envelope) 11 R/W Envelope Direction (0=Decrease, 1=Increase) 12-15 R/W Initial Volume of envelope (1-15, 0=No Sound) Wave Duty: 0: 12.5% ( -_______-_______-_______ ) 1: 25% ( --______--______--______ ) 2: 50% ( ----____----____----____ ) (normal) 3: 75% ( ------__------__------__ ) The Length value is used only if Bit 6 in NR14 is set. 4000064h - SOUND1CNT_X (NR13, NR14) - Channel 1 Frequency/Control (R/W) Bit Expl. 0-10 W Frequency; 131072/(2048-n)Hz (0-2047) 11-13 - Not used 14 R/W Length Flag (1=Stop output when length in NR11 expires) 15 W Initial (1=Restart Sound) 16-31 - Not used GBA Sound Channel 2 - Tone -------------------------- This sound channel works exactly as channel 1, except that it doesn't have a Tone Envelope/Sweep Register. 4000068h - SOUND2CNT_L (NR21, NR22) - Channel 2 Duty/Length/Envelope (R/W) 400006Ah - Not used 400006Ch - SOUND2CNT_H (NR23, NR24) - Channel 2 Frequency/Control (R/W) For details, refer to channel 1 description. GBA Sound Channel 3 - Wave Output --------------------------------- This channel can be used to output digital sound, the length of the sample buffer (Wave RAM) can be either 32 or 64 digits (4bit samples). This sound channel can be also used to output normal tones when initializing the Wave RAM by a square wave. This channel doesn't have a volume envelope register. 4000070h - SOUND3CNT_L (NR30) - Channel 3 Stop/Wave RAM select (R/W) Bit Expl. 0-4 - Not used 5 R/W Wave RAM Dimension (0=One bank/32 digits, 1=Two banks/64 digits) 6 R/W Wave RAM Bank Number (0-1, see below) 7 R/W Sound Channel 3 Off (0=Stop, 1=Playback) 8-15 - Not used The currently selected Bank Number (Bit 6) will be played back, while reading/writing to/from wave RAM will address the other (not selected) bank. When dimension is set to two banks, output will start by replaying the currently selected bank. 4000072h - SOUND3CNT_H (NR31, NR32) - Channel 3 Length/Volume (R/W) Bit Expl. 0-7 W Sound length; units of (256-n)/256s (0-255) 8-12 - Not used. 13-14 R/W Sound Volume (0=Mute/Zero, 1=100%, 2=50%, 3=25%) 15 R/W Force Volume (0=Use above, 1=Force 75% regardless of above) The Length value is used only if Bit 6 in NR34 is set. 4000074h - SOUND3CNT_X (NR33, NR34) - Channel 3 Frequency/Control (R/W) Bit Expl. 0-10 W Sample Rate; 2097152/(2048-n) Hz (0-2047) 11-13 - Not used 14 R/W Length Flag (1=Stop output when length in NR31 expires) 15 W Initial (1=Restart Sound) 16-31 - Not used The above sample rate specifies the number of wave RAM digits per second, the actual tone frequency depends on the wave RAM content, for example: Wave RAM, single bank 32 digits Tone Frequency FFFFFFFFFFFFFFFF0000000000000000 65536/(2048-n) Hz FFFFFFFF00000000FFFFFFFF00000000 131072/(2048-n) Hz FFFF0000FFFF0000FFFF0000FFFF0000 262144/(2048-n) Hz FF00FF00FF00FF00FF00FF00FF00FF00 524288/(2048-n) Hz F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0 1048576/(2048-n) Hz 4000090h - WAVE_RAM0_L - Channel 3 Wave Pattern RAM (W/R) 4000092h - WAVE_RAM0_H - Channel 3 Wave Pattern RAM (W/R) 4000094h - WAVE_RAM1_L - Channel 3 Wave Pattern RAM (W/R) 4000096h - WAVE_RAM1_H - Channel 3 Wave Pattern RAM (W/R) 4000098h - WAVE_RAM2_L - Channel 3 Wave Pattern RAM (W/R) 400009Ah - WAVE_RAM2_H - Channel 3 Wave Pattern RAM (W/R) 400009Ch - WAVE_RAM3_L - Channel 3 Wave Pattern RAM (W/R) 400009Eh - WAVE_RAM3_H - Channel 3 Wave Pattern RAM (W/R) This area contains 16 bytes (32 x 4bits) Wave Pattern data which is output by channel 3. Data is played back ordered as follows: MSBs of 1st byte, followed by LSBs of 1st byte, followed by MSBs of 2nd byte, and so on - this results in a confusing ordering when filling Wave RAM in units of 16bit data - ie. samples would be then located in Bits 4-7, 0-3, 12-15, 8-11. In the GBA, two Wave Patterns exists (each 32 x 4bits), either one may be played (as selected in NR30 register), the other bank may be accessed by the users. After all 32 samples have been played, output of the same bank (or other bank, as specified in NR30) will be automatically restarted. Internally, Wave RAM is a giant shift-register, there is no pointer which is addressing the currently played digit. Instead, the entire 128 bits are shifted, and the 4 least significant bits are output. Thus, when reading from Wave RAM, data might have changed its position. And, when writing to Wave RAM all data should be updated (it'd be no good idea to assume that old data is still located at the same position where it has been written to previously). GBA Sound Channel 4 - Noise --------------------------- This channel is used to output white noise. This is done by randomly switching the amplitude between high and low at a given frequency. Depending on the frequency the noise will appear 'harder' or 'softer'. It is also possible to influence the function of the random generator, so the that the output becomes more regular, resulting in a limited ability to output Tone instead of Noise. 4000078h - SOUND4CNT_L (NR41, NR42) - Channel 4 Length/Envelope (R/W) Bit Expl. 0-5 W Sound length; units of (64-n)/256s (0-63) 6-7 - Not used 8-10 R/W Envelope Step-Time; units of n/64s (1-7, 0=No Envelope) 11 R/W Envelope Direction (0=Decrease, 1=Increase) 12-15 R/W Initial Volume of envelope (1-15, 0=No Sound) 16-31 - Not used The Length value is used only if Bit 6 in NR44 is set. 400007Ch - SOUND4CNT_H (NR43, NR44) - Channel 4 Frequency/Control (R/W) The amplitude is randomly switched between high and low at the given frequency. A higher frequency will make the noise to appear 'softer'. When Bit 3 is set, the output will become more regular, and some frequencies will sound more like Tone than Noise. Bit Expl. 0-2 R/W Dividing Ratio of Frequencies (r) 3 R/W Counter Step/Width (0=15 bits, 1=7 bits) 4-7 R/W Shift Clock Frequency (s) 8-13 - Not used 14 R/W Length Flag (1=Stop output when length in NR41 expires) 15 W Initial (1=Restart Sound) 16-31 - Not used Frequency = 524288 Hz / r / 2^(s+1) ;For r=0 assume r=0.5 instead Noise Random Generator (aka Polynomial Counter) Noise randomly switches between HIGH and LOW levels, the output levels are calculated by a shift register (X), at the selected frequency, as such: 7bit: X=X SHR 1, IF carry THEN Out=HIGH, X=X XOR 60h ELSE Out=LOW 15bit: X=X SHR 1, IF carry THEN Out=HIGH, X=X XOR 6000h ELSE Out=LOW The initial value when (re-)starting the sound is X=40h (7bit) or X=4000h (15bit). The data stream repeats after 7Fh (7bit) or 7FFFh (15bit) steps. GBA Sound Channel A and B - DMA Sound ------------------------------------- The GBA contains two DMA sound channels (A and B), each allowing to replay digital sound (signed 8bit data, ie. -128..+127). Data can be transferred from INTERNAL memory (not sure if EXTERNAL memory works also ?) to FIFO by using DMA channel 1 or 2, the sample rate is generated by using one of the Timers. 40000A0h - FIFO_A_L - Sound A FIFO, Data 0 and Data 1 (W) 40000A2h - FIFO_A_H - Sound A FIFO, Data 2 and Data 3 (W) These two registers may receive 32bit (4 bytes) of audio data (Data 0-3, Data 0 being located in least significant byte which is replayed first). Internally, the capacity of the FIFO is 8 x 32bit (32 bytes), allowing to buffer a small amount of samples. As the name says (First In First Out), oldest data is replayed first. 40000A4h - FIFO_B_L - Sound B FIFO, Data 0 and Data 1 (W) 40000A6h - FIFO_B_H - Sound B FIFO, Data 2 and Data 3 (W) Same as above, for Sound B. Initializing DMA-Sound Playback - Select Timer 0 or 1 in SOUNDCNT_H control register. - Clear the FIFO. - Manually write a sample byte to the FIFO. - Initialize transfer mode for DMA 1 or 2. - Initialize DMA Sound settings in sound control register. - Start the timer. DMA-Sound Playback Procedure The pseudo-procedure below is automatically repeated. If Timer overflows then Move 8bit data from FIFO to sound circuit. If FIFO contains only 4 x 32bits (16 bytes) then Request more data per DMA Receive 4 x 32bit (16 bytes) per DMA Endif Endif This playback mechanism will be repeated forever, regardless of the actual length of the sample buffer. Synchronizing Sample Buffers The buffer-end may be determined by counting sound Timer IRQs (each sample byte), or sound DMA IRQs (each 16th sample byte). Both methods would require a lot of CPU time (IRQ processing), and both would fail if interrupts are disabled for a longer period. Better solutions would be to synchronize the sample rate/buffer length with V-blanks, or to use a second timer (in count up/slave mode) which produces an IRQ after the desired number of samples. The Sample Rate The GBA hardware does internally re-sample all sound output to 32.768kHz (default SOUNDBIAS setting). It'd thus do not make much sense to use higher DMA/Timer rates. Best re-sampling accuracy can be gained by using DMA/Timer rates of 32.768kHz, 16.384kHz, or 8.192kHz (ie. fragments of the physical output rate). GBA Sound Control Registers --------------------------- 4000080h - SOUNDCNT_L (NR50, NR51) - Channel L/R Volume/Enable (R/W) Bit Expl. 0-2 R/W Sound 1-4 Master Volume RIGHT (0-7) 3 - Not used 4-6 R/W Sound 1-4 Master Volume LEFT (0-7) 7 - Not used 8-11 R/W Sound 1-4 Enable Flags RIGHT (each Bit 8-11, 0=Disable, 1=Enable) 12-15 R/W Sound 1-4 Enable Flags LEFT (each Bit 12-15, 0=Disable, 1=Enable) 4000082h - SOUNDCNT_H (GBA only) - DMA Sound Control/Mixing (R/W) Bit Expl. 0-1 R/W Sound # 1-4 Volume (0=25%, 1=50%, 2=100%, 3=Prohibited) 2 R/W DMA Sound A Volume (0=50%, 1=100%) 3 R/W DMA Sound B Volume (0=50%, 1=100%) 4-7 - Not used 8 R/W DMA Sound A Enable RIGHT (0=Disable, 1=Enable) 9 R/W DMA Sound A Enable LEFT (0=Disable, 1=Enable) 10 R/W DMA Sound A Timer Select (0=Timer 0, 1=Timer 1) 11 W? DMA Sound A Reset FIFO (1=Reset) 12 R/W DMA Sound B Enable RIGHT (0=Disable, 1=Enable) 13 R/W DMA Sound B Enable LEFT (0=Disable, 1=Enable) 14 R/W DMA Sound B Timer Select (0=Timer 0, 1=Timer 1) 15 W? DMA Sound B Reset FIFO (1=Reset) 4000084h - SOUNDCNT_X (NR52) - Sound on/off (R/W) Bits 0-3 are automatically set when starting sound output, and are automatically cleared when a sound ends. (Ie. when the length expires, as far as length is enabled. The bits are NOT reset when an volume envelope ends.) Bit Expl. 0 R Sound 1 ON flag (Read Only) 1 R Sound 2 ON flag (Read Only) 2 R Sound 3 ON flag (Read Only) 3 R Sound 4 ON flag (Read Only) 4-6 - Not used 7 R/W PSG/FIFO Master Enable (0=Disable, 1=Enable) (Read/Write) 8-31 - Not used While Bit 7 is cleared, both PSG and FIFO sounds are disabled, and all PSG registers at 4000060h..4000081h are reset to zero (and must be re-initialized after re-enabling sound). However, registers 4000082h and 4000088h are kept read/write-able (of which, 4000082h has no function when sound is off, whilst 4000088h does work even when sound is off). 4000088h - SOUNDBIAS - Sound PWM Control (R/W, see below) This register controls the final sound output. The default setting is 0200h, it is normally not required to change this value. Bit Expl. 0 - Not used 1-9 R/W Bias Level (Default=100h, converting signed samples into unsigned) 10-13 - Not used 14-15 R/W Amplitude Resolution/Sampling Cycle (Default=0, see below) 16-31 - Not used Amplitude Resolution/Sampling Cycle (0-3): 0 9bit / 32.768kHz (Default, best for DMA channels A,B) 1 8bit / 65.536kHz 2 7bit / 131.072kHz 3 6bit / 262.144kHz (Best for PSG channels 1-4) For more information on this register, read the descriptions below. 400008Ch - Not used 400008Eh - Not used Max Output Levels (with max volume settings) Each of the two FIFOs can span the FULL output range (+/-200h). Each of the four PSGs can span one QUARTER of the output range (+/-80h). The current output levels of all six channels are added together by hardware. So together, the FIFOs and PSGs, could reach THRICE the range (+/-600h). The BIAS value is added to that signed value. With default BIAS (200h), the possible range becomes -400h..+800h, however, values that exceed the unsigned 10bit output range of 0..3FFh are clipped to MinMax(0,3FFh). Resampling to 32.768kHz / 9bit (default) The PSG channels 1-4 are internally generated at 262.144kHz, and DMA sound A-B could be theoretically generated at timer rates up to 16.78MHz. However, the final sound output is resampled to a rate of 32.768kHz, at 9bit depth (the above 10bit value, divided by two). If necessary, rates higher than 32.768kHz can be selected in the SOUNDBIAS register, that would result in a depth smaller than 9bit though. PWM (Pulse Width Modulation) Output 16.78MHz / 1bit Okay, now comes the actual output. The GBA can output only two voltages (low and high), these 'bits' are output at system clock speed (16.78MHz). If using the default 32.768kHz sampling rate, then 512 bits are output per sample (512*32K=16M). Each sample value (9bit range, N=0..511), would be then output as N low bits, followed by 512-N high bits. The resulting 'noise' is smoothed down by capacitors, by the speaker, and by human hearing, so that it will effectively sound like clean D/A converted 9bit voltages at 32kHz sampling rate. Changing the BIAS Level Normally use 200h for clean sound output. A value of 000h might make sense during periods when no sound is output (causing the PWM circuit to output low-bits only, which is eventually reducing the power consumption, and/or preventing 32KHz noise). Note: Using the SoundBias function (SWI 19h) allows to change the level by slowly incrementing or decrementing it (without hard scratch noise). Low Power Mode When not using sound output, power consumption can be reduced by setting both 4000084h (PSG/FIFO) and 4000088h (BIAS) to zero. GBA Comparison of CGB and GBA Sound ----------------------------------- The GBA sound controller is mostly the same than that of older monochrome gameboy and CGB. The following changes have been done: New Sound Channels Two new sound channels have been added that may be used to replay 8bit digital sound. Sample rate and sample data must be supplied by using a Timer and a DMA channel. New Control Registers The SOUNDCNT_H register controls the new DMA channels - as well as mixing with the four old channels. The SOUNDBIAS register controls the final sound output. Sound Channel 3 Changes The length of the Wave RAM is doubled by dividing it into two banks of 32 digits each, either one or both banks may be replayed (one after each other), for details check NR30 Bit 5-6. Optionally, the sound may be output at 75% volume, for details check NR32 Bit 7. Changed Control Registers NR50 is not supporting Vin signals (that's been an external sound input from cartridge). Changed I/O Addresses The GBAs sound register are located at 04000060-040000AE instead of at FF10-FF3F as in CGB and monochrome gameboy. However, note that there have been new blank spaces inserted between some of the separate registers - therefore it is NOT possible to port CGB software to GBA just by changing the sound base address. Accessing I/O Registers In some cases two of the old 8bit registers are packed into a 16bit register and may be accessed as such. GBA Timers ---------- The GBA includes four incrementing 16bit timers. Timer 0 and 1 can be used to supply the sample rate for DMA sound channel A and/or B. 4000100h - TM0CNT_L - Timer 0 Counter/Reload (R/W) 4000104h - TM1CNT_L - Timer 1 Counter/Reload (R/W) 4000108h - TM2CNT_L - Timer 2 Counter/Reload (R/W) 400010Ch - TM3CNT_L - Timer 3 Counter/Reload (R/W) Writing to these registers initializes the value (but does not directly affect the current counter value). Reading returns the current value (or the recent/frozen counter value if the timer has been stopped). The reload value is copied into the counter only upon following two situations: Automatically upon timer overflows, or when the timer start bit becomes changed from 0 to 1. Note: When simultaneously changing the start bit from 0 to 1, and setting the reload value at the same time (by a single 32bit I/O operation), then the newly written reload value is recognized as new counter value. 4000102h - TM0CNT_H - Timer 0 Control (R/W) 4000106h - TM1CNT_H - Timer 1 Control (R/W) 400010Ah - TM2CNT_H - Timer 2 Control (R/W) 400010Eh - TM3CNT_H - Timer 3 Control (R/W) Bit Expl. 0-1 Prescaler Selection (0=F/1, 1=F/64, 2=F/256, 3=F/1024) 2 Count-up Timing (0=Normal, 1=See below) ;Not used in TM0CNT_H 3-5 Not used 6 Timer IRQ Enable (0=Disable, 1=IRQ on Timer overflow) 7 Timer Start/Stop (0=Stop, 1=Operate) 8-15 Not used When Count-up Timing is enabled, the prescaler value is ignored, instead the time is incremented each time when the previous counter overflows. This function cannot be used for Timer 0 (as it is the first timer). F = System Clock (16.78MHz). GBA DMA Transfers ----------------- Overview The GBA includes four DMA channels, the highest priority is assigned to DMA0, followed by DMA1, DMA2, and DMA3. DMA Channels with lower priority are paused until channels with higher priority have completed. The CPU is paused when DMA transfers are active, however, the CPU is operating during the periods when Sound/Blanking DMA transfers are paused. Special features of the separate DMA channels DMA0 - highest priority, best for timing critical transfers (eg. HBlank DMA). DMA1 and DMA2 - can be used to feed digital sample data to the Sound FIFOs. DMA3 - can be used to write to Game Pak ROM/FlashROM (but not GamePak SRAM). Beside for that, each DMA 0-3 may be used for whatever general purposes. 40000B0h,0B2h - DMA0SAD - DMA 0 Source Address (W) (internal memory) 40000BCh,0BEh - DMA1SAD - DMA 1 Source Address (W) (any memory) 40000C8h,0CAh - DMA2SAD - DMA 2 Source Address (W) (any memory) 40000D4h,0D6h - DMA3SAD - DMA 3 Source Address (W) (any memory) The most significant address bits are ignored, only the least significant 27 or 28 bits are used (max 07FFFFFFh internal memory, or max 0FFFFFFFh any memory - except SRAM ?!). 40000B4h,0B6h - DMA0DAD - DMA 0 Destination Address (W) (internal memory) 40000C0h,0C2h - DMA1DAD - DMA 1 Destination Address (W) (internal memory) 40000CCh,0CEh - DMA2DAD - DMA 2 Destination Address (W) (internal memory) 40000D8h,0DAh - DMA3DAD - DMA 3 Destination Address (W) (any memory) The most significant address bits are ignored, only the least significant 27 or 28 bits are used (max. 07FFFFFFh internal memory or 0FFFFFFFh any memory - except SRAM ?!). 40000B8h - DMA0CNT_L - DMA 0 Word Count (W) (14 bit, 1..4000h) 40000C4h - DMA1CNT_L - DMA 1 Word Count (W) (14 bit, 1..4000h) 40000D0h - DMA2CNT_L - DMA 2 Word Count (W) (14 bit, 1..4000h) 40000DCh - DMA3CNT_L - DMA 3 Word Count (W) (16 bit, 1..10000h) Specifies the number of data units to be transferred, each unit is 16bit or 32bit depending on the transfer type, a value of zero is treated as max length (ie. 4000h, or 10000h for DMA3). 40000BAh - DMA0CNT_H - DMA 0 Control (R/W) 40000C6h - DMA1CNT_H - DMA 1 Control (R/W) 40000D2h - DMA2CNT_H - DMA 2 Control (R/W) 40000DEh - DMA3CNT_H - DMA 3 Control (R/W) Bit Expl. 0-4 Not used 5-6 Dest Addr Control (0=Increment,1=Decrement,2=Fixed,3=Increment/Reload) 7-8 Source Adr Control (0=Increment,1=Decrement,2=Fixed,3=Prohibited) 9 DMA Repeat (0=Off, 1=On) (Must be zero if Bit 11 set) 10 DMA Transfer Type (0=16bit, 1=32bit) 11 Game Pak DRQ - DMA3 only - (0=Normal, 1=DRQ Game Pak, DMA3) 12-13 DMA Start Timing (0=Immediately, 1=VBlank, 2=HBlank, 3=Special) The 'Special' setting (Start Timing=3) depends on the DMA channel: DMA0=Prohibited, DMA1/DMA2=Sound FIFO, DMA3=Video Capture 14 IRQ upon end of Word Count (0=Disable, 1=Enable) 15 DMA Enable (0=Off, 1=On) After changing the Enable bit from 0 to 1, wait 2 clock cycles before accessing any DMA related registers. When accessing OAM (7000000h) or OBJ VRAM (6010000h) by HBlank Timing, then the "H-Blank Interval Free" bit in DISPCNT register must be set. Source and Destination Address and Word Count Registers The SAD, DAD, and CNT_L registers are holding the initial start addresses, and initial length. The hardware does NOT change the content of these registers during or after the transfer. The actual transfer takes place by using internal pointer/counter registers. The initial values are copied into internal regs under the following circumstances: Upon DMA Enable (Bit 15) changing from 0 to 1: Reloads SAD, DAD, CNT_L. Upon Repeat: Reloads CNT_L, and optionally DAD (Increment+Reload). DMA Repeat bit If the Repeat bit is cleared: The Enable bit is automatically cleared after the specified number of data units has been transferred. If the Repeat bit is set: The Enable bit remains set after the transfer, and the transfer will be restarted each time when the Start condition (eg. HBlank, Fifo) becomes true. The specified number of data units is transferred time when the transfer is (re-)started. The transfer will be repeated forever, until it gets stopped by software. Sound DMA (FIFO Timing Mode) (DMA1 and DMA2 only) In this mode, the DMA Repeat bit must be set, and the destination address must be FIFO_A (040000A0h) or FIFO_B (040000A4h). Upon DMA request from sound controller, 4 units of 32bits (16 bytes) are transferred (both Word Count register and DMA Transfer Type bit are ignored). The destination address will not be incremented in FIFO mode. Keep in mind that DMA channels of higher priority may offhold sound DMA. For example, when using a 64 kHz sample rate, 16 bytes of sound DMA data are requested each 0.25ms (4 kHz), at this time another 16 bytes are still in the FIFO so that there's still 0.25ms time to satisfy the DMA request. Thus DMAs with higher priority should not be operated for longer than 0.25ms. (This problem does not arise for HBlank transfers as HBlank time is limited to 16.212us.) Game Pak DMA Only DMA 3 may be used to transfer data to/from Game Pak ROM or Flash ROM - it cannot access Game Pak SRAM though (as SRAM data bus is limited to 8bit units). In normal mode, DMA is requested as long until Word Count becomes zero. When setting the 'Game Pack DRQ' bit, then the cartridge must contain an external circuit which outputs a /DREQ signal. Note that there is only one pin for /DREQ and /IREQ, thus the cartridge may not supply /IREQs while using DRQ mode. Video Capture Mode (DMA3 only) Intended to copy a bitmap from memory (or from external hardware/camera) to VRAM. When using this transfer mode, set the repeat bit, and write the number of data units (per scanline) to the word count register. Capture works similar like HBlank DMA, however, the transfer is started when VCOUNT=2, it is then repeated each scanline, and it gets stopped when VCOUNT=162. Transfer End The DMA Enable flag (Bit 15) is automatically cleared upon completion of the transfer. The user may also clear this bit manually in order to stop the transfer (obviously this is possible for Sound/Blanking DMAs only, in all other cases the CPU is stopped until the transfer completes by itself). Transfer Rate/Timing Except for the first data unit, all units are transferred by sequential reads and writes. For n data units, the DMA transfer time is: 2N+2(n-1)S+xI Of which, 1N+(n-1)S are read cycles, and the other 1N+(n-1)S are write cycles, actual number of cycles depends on the waitstates and bus-width of the source and destination areas (as described in CPU Instruction Cycle Times chapter). Internal time for DMA processing is 2I (normally), or 4I (if both source and destination are in gamepak memory area). DMA lockup when stopping while starting ??? Capture delayed, Capture Enable=AutoCleared ??? GBA Communication Ports ----------------------- The GBAs Serial Port may be used in various different communication modes. Normal mode may exchange data between two GBAs (or to transfer data from master GBA to several slave GBAs in one-way direction). Multi-player mode may exchange data between up to four GBAs. UART mode works much like a RS232 interface. JOY Bus mode uses a standardized Nintendo protocol. And General Purpose mode allows to mis-use the 'serial' port as bi-directional 4bit parallel port. Note: The Nintendo DS does not include a Serial Port. --> SIO Normal Mode --> SIO Multi-Player Mode --> SIO UART Mode --> SIO JOY BUS Mode --> SIO General-Purpose Mode --> SIO Control Registers Summary Wireless Adapter --> GBA Wireless Adapter Infrared Communication Adapters Even though early GBA prototypes have been intended to support IR communication, this feature has been removed. However, Nintendo is apparently considering to provide an external IR adapter (to be connected to the SIO connector, being accessed in General Purpose mode). Also, it'd be theoretically possible to include IR ports built-in in game cartridges (as done for some older 8bit/monochrome Hudson games). SIO Normal Mode --------------- This mode is used to communicate between two units. Transfer rates of 256Kbit/s or 2Mbit/s can be selected, however, the fast 2Mbit/s is intended ONLY for special hardware expansions that are DIRECTLY connected to the GBA link port (ie. without a cable being located between the GBA and expansion hardware). In normal cases, always use 256Kbit/s transfer rate which provides stable results. Transfer lengths of 8bit or 32bit may be used, the 8bit mode is the same as for older DMG/CGB gameboys, however, the voltages for "GBA cartridges in GBAs" are different as for "DMG/CGB cartridges in DMG/CGB/GBAs", ie. it is not possible to communicate between DMG/CGB games and GBA games. 4000134h - RCNT (R) - Mode Selection, in Normal/Multiplayer/UART modes (R/W) Bit Expl. 0-3 Undocumented (current SC,SD,SI,SO state, as for General Purpose mode) 4-8 Not used (Should be 0, bits are read/write-able though) 9-13 Not used (Always 0, read only) 14 Not used (Should be 0, bit is read/write-able though) 15 Must be zero (0) for Normal/Multiplayer/UART modes 4000128h - SIOCNT - SIO Control, usage in NORMAL Mode (R/W) Bit Expl. 0 Shift Clock (SC) (0=External, 1=Internal) 1 Internal Shift Clock (0=256KHz, 1=2MHz) 2 SI State (opponents SO) (0=Low, 1=High/None) --- (Read Only) 3 SO during inactivity (0=Low, 1=High) (applied ONLY when Bit7=0) 4-6 Not used (Read only, always 0 ?) 7 Start Bit (0=Inactive/Ready, 1=Start/Active) 8-11 Not used (R/W, should be 0) 12 Transfer Length (0=8bit, 1=32bit) 13 Must be "0" for Normal Mode 14 IRQ Enable (0=Disable, 1=Want IRQ upon completion) 15 Not used (Read only, always 0) The Start bit is automatically reset when the transfer completes, ie. when all 8 or 32 bits are transferred, at that time an IRQ may be generated. 400012Ah - SIODATA8 - SIO Normal Communication 8bit Data (R/W) For 8bit normal mode. Contains 8bit data (only lower 8bit are used). Outgoing data should be written to this register before starting the transfer. During transfer, transmitted bits are shifted-out (MSB first), and received bits are shifted-in simultaneously. Upon transfer completion, the register contains the received 8bit value. 4000120h - SIODATA32_L - SIO Normal Communication lower 16bit data (R/W) 4000122h - SIODATA32_H - SIO Normal Communication upper 16bit data (R/W) Same as above SIODATA8, for 32bit normal transfer mode respectively. SIOCNT/RCNT must be set to 32bit normal mode writing to SIODATA32. Initialization First, initialize RCNT register. Second, set mode/clock bits in SIOCNT with startbit cleared. For master: select internal clock, and (in most cases) specify 256KHz as transfer rate. For slave: select external clock, the local transfer rate selection is then ignored, as the transfer rate is supplied by the remote GBA (or other computer, which might supply custom transfer rates). Third, set the startbit in SIOCNT with mode/clock bits unchanged. Recommended Communication Procedure for SLAVE unit (external clock) - Initialize data which is to be sent to master. - Set Start flag. - Set SO to LOW to indicate that master may start now. - Wait for IRQ (or for Start bit to become zero). (Check timeout here!) - Set SO to HIGH to indicate that we are not ready. - Process received data. - Repeat procedure if more data is to be transferred. (or is so=high done automatically? would be fine - more stable - otherwise master may still need delay) Recommended Communication Procedure for SLAVE unit (external clock) - Initialize data which is to be sent to master. - Set Start=0 and SO=0 (SO=LOW indicates that slave is (almost) ready). - Set Start=1 and SO=1 (SO=HIGH indicates not ready, applied after transfer). (Expl. Old SO=LOW kept output until 1st clock bit received). (Expl. New SO=HIGH is automatically output at transfer completion). - Set SO to LOW to indicate that master may start now. - Wait for IRQ (or for Start bit to become zero). (Check timeout here!) - Process received data. - Repeat procedure if more data is to be transferred. Recommended Communication Procedure for MASTER unit (internal clock) - Initialize data which is to be sent to slave. - Wait for SI to become LOW (slave ready). (Check timeout here!) - Set Start flag. - Wait for IRQ (or for Start bit to become zero). - Process received data. - Repeat procedure if more data is to be transferred. Cable Protocol During inactive transfer, the shift clock (SC) is high. The transmit (SO) and receive (SI) data lines may be manually controlled as described above. When master sends SC=LOW, each master and slave must output the next outgoing data bit to SO. When master sends SC=HIGH, each master and slave must read out the opponents data bit from SI. This is repeated for each of the 8 or 32 bits, and when completed SC will be kept high again. Transfer Rates Either 256KHz or 2MHz rates can be selected for SC, so max 32KBytes (256Kbit) or 128KBytes (2Mbit) can be transferred per second. However, the software must process each 8bit or 32bit of transmitted data separately, so the actual transfer rate will be reduced by the time spent on handling each data unit. Only 256KHz provides stable results in most cases (such like when linking between two GBAs). The 2MHz rate is intended for special expansion hardware (with very short wires) only. Using Normal mode for One-Way Multiplayer communication When using normal mode with multiplay-cables, data isn't exchanged between first and second GBA as usually. Instead, data is shifted from first to last GBA (the first GBA receives zero, because master SI is shortcut to GND). This behaviour may be used for fast ONE-WAY data transfer from master to all other GBAs. For example (3 GBAs linked): Step Sender 1st Recipient 2nd Recipient Transfer 1: DATA #0 --> UNDEF --> UNDEF --> Transfer 2: DATA #1 --> DATA #0 --> UNDEF --> Transfer 3: DATA #2 --> DATA #1 --> DATA #0 --> Transfer 4: DATA #3 --> DATA #2 --> DATA #1 --> The recipients should not output any own data, instead they should forward the previously received data to the next recipient during next transfer (just keep the incoming data unmodified in the data register). Due to the delayed forwarding, 2nd recipient should ignore the first incoming data. After the last transfer, the sender must send one (or more) dummy data unit(s), so that the last data is forwarded to the 2nd (or further) recipient(s). SIO Multi-Player Mode --------------------- Multi-Player mode can be used to communicate between up to 4 units. 4000134h - RCNT (R) - Mode Selection, in Normal/Multiplayer/UART modes (R/W) Bit Expl. 0-3 Undocumented (current SC,SD,SI,SO state, as for General Purpose mode) 4-8 Not used (Should be 0, bits are read/write-able though) 9-13 Not used (Always 0, read only) 14 Not used (Should be 0, bit is read/write-able though) 15 Must be zero (0) for Normal/Multiplayer/UART modes Note: Even though undocumented, many Nintendo games are using Bit 0 to test current SC state in multiplay mode. 4000128h - SIOCNT - SIO Control, usage in MULTI-PLAYER Mode (R/W) Bit Expl. 0-1 Baud Rate (0-3: 9600,38400,57600,115200 bps) 2 SI-Terminal (0=Parent, 1=Child) (Read Only) 3 SD-Terminal (0=Bad connection, 1=All GBAs Ready) (Read Only) 4-5 Multi-Player ID (0=Parent, 1-3=1st-3rd child) (Read Only) 6 Multi-Player Error (0=Normal, 1=Error) (Read Only) 7 Start/Busy Bit (0=Inactive, 1=Start/Busy) (Read Only for Slaves) 8-11 Not used (R/W, should be 0) 12 Must be "0" for Multi-Player mode 13 Must be "1" for Multi-Player mode 14 IRQ Enable (0=Disable, 1=Want IRQ upon completion) 15 Not used (Read only, always 0) The ID Bits are undefined until the first transfer has completed. 400012Ah - SIOMLT_SEND - Data Send Register (R/W) Outgoing data (16 bit) which is to be sent to the other GBAs. 4000120h - SIOMULTI0 - SIO Multi-Player Data 0 (Parent) (R/W) 4000122h - SIOMULTI1 - SIO Multi-Player Data 1 (1st child) (R/W) 4000124h - SIOMULTI2 - SIO Multi-Player Data 2 (2nd child) (R/W) 4000126h - SIOMULTI3 - SIO Multi-Player Data 3 (3rd child) (R/W) These registers are automatically reset to FFFFh upon transfer start. After transfer, these registers contain incoming data (16bit each) from all remote GBAs (if any / otherwise still FFFFh), as well as the local outgoing SIOMLT_SEND data. Ie. after the transfer, all connected GBAs will contain the same values in their SIOMULTI0-3 registers. Initialization - Initialize RCNT Bit 14-15 and SIOCNT Bit 12-13 to select Multi-Player mode. - Read SIOCNT Bit 3 to verify that all GBAs are in Multi-Player mode. - Read SIOCNT Bit 2 to detect whether this is the Parent/Master unit. Recommended Transmission Procedure - Write outgoing data to SIODATA_SEND. - Master must set Start bit. - All units must process received data in SIOMULTI0-3 when transfer completed. - After the first successful transfer, ID Bits in SIOCNT are valid. - If more data is to be transferred, repeat procedure. The parent unit blindly sends data regardless of whether childs have already processed old data/supplied new data. So, parent unit might be required to insert delays between each transfer, and/or perform error checking. Also, slave units may signalize that they are not ready by temporarily switching into another communication mode (which does not output SD High, as Multi-Player mode does during inactivity). Transfer Protocol Beginning - The masters SI pin is always LOW. - When all GBAs are in Multiplayer mode (ready) SD is HIGH. - When master starts the transfer, it sets SC=LOW, slaves receive Busy bit. Step A - ID Bits in master unit are set to 0. - Master outputs Startbit (LOW), 16bit Data, Stopbit (HIGH) through SD. - This data is written to SIOMULTI0 of all GBAs (including master). - Master forwards LOW from its SO to 1st childs SI. - Transfer ends if next child does not output data after certain time. Step B - ID Bits in 1st child unit are set to 1. - 1st Child outputs Startbit (LOW), 16bit Data, Stopbit (HIGH) through SD. - This data is written to SIOMULTI1 of all GBAs (including 1st child). - 1st child forwards LOW from its SO to 2nd childs SI. - Transfer ends if next child does not output data after certain time. Step C - ID Bits in 2nd child unit are set to 2. - 2nd Child outputs Startbit (LOW), 16bit Data, Stopbit (HIGH) through SD. - This data is written to SIOMULTI2 of all GBAs (including 2nd child). - 2nd child forwards LOW from its SO to 3rd childs SI. - Transfer ends if next child does not output data after certain time. Step D - ID Bits in 3rd child unit are set to 3. - 3rd Child outputs Startbit (LOW), 16bit Data, Stopbit (HIGH) through SD. - This data is written to SIOMULTI3 of all GBAs (including 3rd child). - Transfer ends (this was the last child). Transfer end - Master sets SC=HIGH, all GBAs set SO=HIGH. - The Start/Busy bits of all GBAs are automatically cleared. - Interrupts are requested in all GBAs (as far as enabled). Error Bit This bit is set when a slave did not receive SI=LOW even though SC=LOW signalized a transfer (this might happen when connecting more than 4 GBAs, or when the previous child is not connected). Also, the bit is set when a Stopbit wasn't HIGH. The error bit may be undefined during active transfer - read only after transfer completion (the transfer continues and completes as normal even if errors have occurred for some or all GBAs). Don't know: The bit is automatically reset/initialized with each transfer, or must be manually reset? Transmission Time The transmission time depends on the selected Baud rate. And on the amount of Bits (16 data bits plus start/stop bits for each GBA), delays between data for each GBA, plus final timeout (if less than 4 GBAs). That is, depending on the number of connected GBAs: GBAs Bits Delays Timeout 1 18 None Yes 2 36 1 Yes 3 54 2 Yes 4 72 3 None (The average Delay and Timeout periods are unknown?) Above is not counting the additional CPU time that must be spent on initiating and processing each transfer. Fast One-Way Transmission Beside for the actual SIO Multiplayer mode, you can also use SIO Normal mode for fast one-way data transfer from Master unit to all Child unit(s). See chapter about SIO Normal mode for details. SIO UART Mode ------------- This mode works much like a RS232 port, however, the voltages are unknown, probably 0/3V rather than +/-12V ?. SI and SO are data lines (with crossed wires), SC and SD signalize Clear to Send (with crossed wires also, which requires special cable when linking between two GBAs ?) 4000134h - RCNT (R) - Mode Selection, in Normal/Multiplayer/UART modes (R/W) Bit Expl. 0-3 Undocumented (current SC,SD,SI,SO state, as for General Purpose mode) 4-8 Not used (Should be 0, bits are read/write-able though) 9-13 Not used (Always 0, read only) 14 Not used (Should be 0, bit is read/write-able though) 15 Must be zero (0) for Normal/Multiplayer/UART modes 4000128h - SCCNT_L - SIO Control, usage in UART Mode (R/W) Bit Expl. 0-1 Baud Rate (0-3: 9600,38400,57600,115200 bps) 2 CTS Flag (0=Send always/blindly, 1=Send only when SC=LOW) 3 Parity Control (0=Even, 1=Odd) 4 Send Data Flag (0=Not Full, 1=Full) (Read Only) 5 Receive Data Flag (0=Not Empty, 1=Empty) (Read Only) 6 Error Flag (0=No Error, 1=Error) (Read Only) 7 Data Length (0=7bits, 1=8bits) 8 FIFO Enable Flag (0=Disable, 1=Enable) 9 Parity Enable Flag (0=Disable, 1=Enable) 10 Send Enable Flag (0=Disable, 1=Enable) 11 Receive Enable Flag (0=Disable, 1=Enable) 12 Must be "1" for UART mode 13 Must be "1" for UART mode 14 IRQ Enable (0=Disable, 1=IRQ when any Bit 4/5/6 become set) 15 Not used (Read only, always 0) 400012Ah - SIODATA8 - usage in UART Mode (R/W) Addresses the send/receive shift register, or (when FIFO is used) the send/receive FIFO. In either case only the lower 8bit of SIODATA8 are used, the upper 8bit are not used. The send/receive FIFO may store up to four 8bit data units each. For example, while 1 unit is still transferred from the send shift register, it is possible to deposit another 4 units in the send FIFO, which are then automatically moved to the send shift register one after each other. Send/Receive Enable, CTS Feedback The receiver outputs SD=LOW (which is input as SC=LOW at the remote side) when it is ready to receive data (that is, when Receive Enable is set, and the Receive shift register (or receive FIFO) isn't full. When CTS flag is set to always/blindly, then the sender transmits data immediately when Send Enable is set, otherwise data is transmitted only when Send Enable is set and SC is LOW. Error Flag The error flag is set when a bad stop bit has been received (stop bit must be 0), when a parity error has occurred (if enabled), or when new data has been completely received while the receive data register (or receive FIFO) is already full. The error flag is automatically reset when reading from SIOCNT register. Init & Initback The content of the FIFO is reset when FIFO is disabled in UART mode, thus, when entering UART mode initially set FIFO=disabled. The Send/Receive enable bits must be reset before switching from UART mode into another SIO mode! SIO JOY BUS Mode ---------------- This communication mode uses Nintendo's standardized JOY Bus protocol. When using this communication mode, the GBA is always operated as SLAVE! In this mode, SI and SO pins are data lines (apparently synchronized by Start/Stop bits?), SC and SD are set to low (including during active transfer?), the transfer rate is unknown? 4000134h - RCNT (R) - Mode Selection, in JOY BUS mode (R/W) Bit Expl. 0-3 Undocumented (current SC,SD,SI,SO state, as for General Purpose mode) 4-8 Not used (Should be 0, bits are read/write-able though) 9-13 Not used (Always 0, read only) 14 Must be "1" for JOY BUS Mode 15 Must be "1" for JOY BUS Mode 4000128h - SIOCNT - SIO Control, not used in JOY BUS Mode This register is not used in JOY BUS mode. 4000140h - JOYCNT - JOY BUS Control Register (R/W) Bit Expl. 0 Device Reset Flag (Command FFh) (Read/Acknowledge) 1 Receive Complete Flag (Command 14h or 15h?) (Read/Acknowledge) 2 Send Complete Flag (Command 15h or 14h?) (Read/Acknowledge) 3-5 Not used 6 IRQ when receiving a Device Reset Command (0=Disable, 1=Enable) 7-31 Not used Bit 0-2 are working much like the bits in the IF register: Write a "1" bit to reset (acknowledge) the respective bit. UNCLEAR: Interrupts can be requested for Send/Receive commands also? 4000150h - JOY_RECV_L - Receive Data Register low (R/W) 4000152h - JOY_RECV_H - Receive Data Register high (R/W) 4000154h - JOY_TRANS_L - Send Data Register low (R/W) 4000156h - JOY_TRANS_H - Send Data Register high (R/W) Send/receive data registers. 4000158h - JOYSTAT - Receive Status Register (R/W) Bit Expl. 0 Not used 1 Receive Status Flag (0=Remote GBA is/was receiving) (Read Only?) 2 Not used 3 Send Status Flag (1=Remote GBA is/was sending) (Read Only?) 4-5 General Purpose Flag (Not assigned, may be used for whatever purpose) 6-31 Not used Bit 1 is automatically set when writing to local JOY_TRANS. Bit 3 is automatically reset when reading from local JOY_RECV. Below are the four possible commands which can be received by the GBA. Note that the GBA (slave) cannot send any commands itself, all it can do is to read incoming data, and to provide 'reply' data which may (or may not) be read out by the master unit. Command FFh - Device Reset Receive FFh (Command) Send 00h (GBA Type number LSB (or MSB?)) Send 04h (GBA Type number MSB (or LSB?)) Send XXh (lower 8bits of SIOSTAT register) Command 00h - Type/Status Data Request Receive 00h (Command) Send 00h (GBA Type number LSB (or MSB?)) Send 04h (GBA Type number MSB (or LSB?)) Send XXh (lower 8bits of SIOSTAT register) Command 15h - GBA Data Write (to GBA) Receive 15h (Command) Receive XXh (Lower 8bits of JOY_RECV_L) Receive XXh (Upper 8bits of JOY_RECV_L) Receive XXh (Lower 8bits of JOY_RECV_H) Receive XXh (Upper 8bits of JOY_RECV_H) Send XXh (lower 8bits of SIOSTAT register) Command 14h - GBA Data Read (from GBA) Receive 14h (Command) Send XXh (Lower 8bits of JOY_TRANS_L) Send XXh (Upper 8bits of JOY_TRANS_L) Send XXh (Lower 8bits of JOY_TRANS_H) Send XXh (Upper 8bits of JOY_TRANS_H) Send XXh (lower 8bits of SIOSTAT register) SIO General-Purpose Mode ------------------------ In this mode, the SIO is 'misused' as a 4bit bi-directional parallel port, each of the SI,SO,SC,SD pins may be directly controlled, each can be separately declared as input (with internal pull-up) or as output signal. 4000134h - RCNT (R) - SIO Mode, usage in GENERAL-PURPOSE Mode (R/W) Interrupts can be requested when SI changes from HIGH to LOW, as General Purpose mode does not require a serial shift clock, this interrupt may be produced even when the GBA is in Stop (low power standby) state. Bit Expl. 0 SC Data Bit (0=Low, 1=High) 1 SD Data Bit (0=Low, 1=High) 2 SI Data Bit (0=Low, 1=High) 3 SO Data Bit (0=Low, 1=High) 4 SC Direction (0=Input, 1=Output) 5 SD Direction (0=Input, 1=Output) 6 SI Direction (0=Input, 1=Output, but see below) 7 SO Direction (0=Input, 1=Output) 8 SI Interrupt Enable (0=Disable, 1=Enable) 9-13 Not used 14 Must be "0" for General-Purpose Mode 15 Must be "1" for General-Purpose or JOYBUS Mode SI should be always used as Input to avoid problems with other hardware which does not expect data to be output there. 4000128h - SIOCNT - SIO Control, not used in GENERAL-PURPOSE Mode This register is not used in general purpose mode. That is, the separate bits of SIOCNT still exist and are read- and/or write-able in the same manner as for Normal, Multiplay, or UART mode (depending on SIOCNT Bit 12,13), but are having no effect on data being output to the link port. SIO Control Registers Summary ----------------------------- Mode Selection (by RCNT.15-14 and SIOCNT.13-12) R.15 R.14 S.13 S.12 Mode 0 x 0 0 Normal 8bit 0 x 0 1 Normal 32bit 0 x 1 0 Multiplay 16bit 0 x 1 1 UART (RS232) 1 0 x x General Purpose 1 1 x x JOY BUS SIOCNT Bit 0 1 2 3 4 5 6 7 8 9 10 11 Normal Master Rate SI/In SO/Out - - - Start - - - - Multi Baud Baud SI/In SD/In ID# Err Start - - - - UART Baud Baud CTS Parity S R Err Bits FIFO Parity Send Recv GBA Wireless Adapter -------------------- GBA Wireless Adapter (AGB-015 or OXY-004) --> GBA Wireless Adapter Games --> GBA Wireless Adapter Login --> GBA Wireless Adapter Commands --> GBA Wireless Adapter Component Lists GBA Wireless Adapter Games -------------------------- GBA Wireless Adapter compatible Games bit Generations series (Japan only) Boktai 2: Solar Boy Django (Konami) Boktai 3: Sabata's Counterattack Classic NES Series: Donkey Kong Classic NES Series: Dr. Mario Classic NES Series: Ice Climber Classic NES Series: Pac-Man Classic NES Series: Super Mario Bros. Classic NES Series: Xevious Digimon Racing (Bandai) (No Wireless Adapter support in European release) Dragon Ball Z: Buu's Fury (Atari) Famicom Mini Series: #13 Balloon Fight Famicom Mini Series: #12 Clu Clu Land Famicom Mini Series: #16 Dig Dug Famicom Mini Series: #02 Donkey Kong Famicom Mini Series: #15 Dr. Mario Famicom Mini Series: #03 Ice Climber Famicom Mini Series: #18 Makaimura Famicom Mini Series: #08 Mappy Famicom Mini Series: #11 Mario Bros. Famicom Mini Series: #06 Pac-Man Famicom Mini Series: #30 SD Gundam World Scramble Wars Famicom Mini Series: #01 Super Mario Bros. Famicom Mini Series: #21 Super Mario Bros. Famicom Mini Series: #19 Twin Bee Famicom Mini Series: #14 Wrecking Crew Famicom Mini Series: #07 Xevious Hamtaro: Ham-Ham Games (Nintendo) Lord of the Rings: The Third Age, The (EA Games) Mario Golf: Advance Tour (Nintendo) Mario Tennis: Power Tour (Nintendo) Mega Man Battle Network 5: Team Protoman (Capcom) Mega Man Battle Network 5: Team Colonel (Capcom) Mega Man Battle Network 6: Cybeast Falzar Mega Man Battle Network 6: Cybeast Gregar Momotaro Dentetsu G: Make a Gold Deck! (Japan only) Pokemon Emerald (Nintendo) Pokemon FireRed (Nintendo) Pokemon LeafGreen (Nintendo) Sennen Kazoku (Japan only) Shrek SuperSlam Sonic Advance 3 GBA Wireless Adapter Login -------------------------- GBA Wireless Adapter Login rcnt=8000h ;\ rcnt=80A0h ; rcnt=80A2h ; reset adapter or so wait ; rcnt=80A0h ;/ siocnt=5003h ;\set 32bit normal mode, 2MHz internal clock rcnt=0000h ;/ passes=0, index=0 @@lop: passes=passes+1, if passes>32 then ERROR ;give up (usually only 10 passses) recv.lo=siodata AND FFFFh ;response from adapter recv.hi=siodata/10000h ;adapter's own "NI" data if send.hi<>recv.lo then index=0, goto @@stuck ;<-- fallback to index=0 if (send.lo XOR FFFFh)<>recv.lo then goto @@stuck if (send.hi XOR FFFFh)<>recv.hi then goto @@stuck index=index+1 @@stuck: send.lo=halfword[@@key_string+index*2] send.hi=recv.hi XOR FFFFh siodata=send.lo+(send.hi*10000h) siocnt.bit7=1 ;<-- start transmission if index<4 then goto @@lop ret @@key_string db 'NINTENDO',01h,80h ;10 bytes (5 halfwords; index=0..4) Data exchanged during Login GBA ADAPTER xxxx494E ;\ <--> xxxxxxxx xxxx494E ; "NI" <--> "NI"/; 494EB6B1 ;\ NOT("NI") /; B6B1494E ;/ <--> \; 494EB6B1 ; NOT("NI") \; B6B1544E ;\"NT" <--> "NT"/; 544EB6B1 ;/ NOT("NT") /; ABB1544E ;/ <--> \; 544EABB1 ;\NOT("NT") \; ABB14E45 ;\"EN" <--> "EN"/; 4E45ABB1 ;/ NOT("EN") /; B1BA4E45 ;/ <--> \; 4E45B1BA ;\NOT("EN") \; B1BA4F44 ;\"DO" <--> "DO"/; 4F44B1BA ;/ NOT("DO") /; B0BB4F44 ;/ <--> \; 4F44B0BB ;\NOT("DO") \; B0BB8001 ;-fin <--> fin-; 8001B0BB ;/ \ \ \ \ \ LSBs=Own \ LSBs=Inverse of \ Data.From.Gba \ Prev.Data.From.Gba \ \ MSBs=Inverse of MSBs=Own Prev.Data.From.Adapter Data.From.Adapter GBA Wireless Adapter Commands ----------------------------- Wireless Command/Parameter Transmission GBA Adapter 9966ppcch 80000000h ;-send command (cc), and num param_words (pp) 80000000h ;\ 80000000h ; send "pp" parameter word(s), if any ... ... ;/ 80000000h 9966rraah ;-recv ack (aa=cc+80h), and num response_words (rr) 80000000? ;\ 80000000? ; recv "rr" response word(s), if any ... ... ;/ Wireless 32bit Transfers wait until [4000128h].Bit2=0 ;want SI=0 set [4000128h].Bit3=1 ;set SO=1 wait until [4000128h].Bit2=1 ;want SI=1 set [4000128h].Bit3=0,Bit7=1 ;set SO=0 and start 32bit transfer All command/param/reply transfers should be done at Internal Clock (except, Response Words for command 25h,27h,35h,37h should use External Clock). Wireless Commands Cmd Para Reply Name 10h - - Hello (send immediately after login) 11h - 1 Good/Bad response to cmd 16h ? 12h 13h - 1 14h 15h 16h 6 - Introduce (send game/user name) 17h 1 - Config (send after Hello) (eg. param=003C0420h or 003C043Ch) 18h 19h 1Ah 1Bh 1Ch - - 1Dh - NN Get Directory? (receive list of game/user names?) 1Eh - NN Get Directory? (receive list of game/user names?) 1Fh 1 - Select Game for Download (send 16bit Game_ID) 20h - 1 21h - 1 Good/Bad response to cmd 1Fh ? 22h 23h 24h - - 25h ;use EXT clock! 26h - - 27h - - Begin Download ? ;use EXT clock! 28h 29h 2Ah 2Bh 2Ch 2Dh 2Eh 2Fh 30h 1 - 31h 32h 33h 34h 35h ;use EXT clock! 36h 37h ;use EXT clock! 38h 39h 3Ah 3Bh 3Ch 3Dh - - Bye (return to language select) 3Eh 3Fh Special Response 996601EEh for error or so? (only at software side?) GBA Wireless Adapter Component Lists ------------------------------------ Main Chipset U1 32pin Freescale MC13190 (2.4 GHz ISM band transceiver) U2 48pin Freescale CT3000 or CT3001 (depending on adapter version) X3 2pin 9.5MHz crystal The MC13190 is a Short-Range, Low-Power 2.4 GHz ISM band transceiver. The processor is Motorola's 32-bit M-Core RISC engine. (?) MCT3000 (?) See also: http://www.eetimes.com/document.asp?doc_id=1271943 Version with GERMAN Postal Code on sticker: Sticker on Case: "GAME BOY advance, WIRELESS ADAPTER" "Pat.Pend.Made in Philipines, CE0125(!)B" "MODEL NO./MODELE NO.AGB-015 D-63760 Grossosteim P/AGB-A-WA-EUR-2 E3" PCB: "19-C046-04, A-7" (top side) and "B-7" and Microchip ",\\" (bottom side) PCB: white stamp "3104, 94V-0, RU, TW-15" PCB: black stamp "22FDE" U1 32pin "Freescale 13190, 4WFQ" (MC13190) (2.4 GHz ISM band transceiver) U2 48pin "Freescale CT3001, XAC0445" (bottom side) X3 2pin "D959L4I" (9.5MHz) (top side) (ca. 19 clks per 2us) Further components... top side (A-7) D1 5pin "D6F, 44" (top side, below X3) U71 6pin ".., () 2" (top side, right of X3, tiny black chip) B71 6pin "[]" (top side, right of X3, small white chip) ANT 2pin on-board copper wings Q? 3pin (top side, above CN1) Q? 3pin (top side, above CN1) D? 2pin "72" (top side, above CN1) D3 2pin "F2" (top side, above CN1) U200 4pin "MSV" (top side, above CN1) U202 5pin "LXKA" (top side, right of CN1) U203 4pin "M6H" (top side, right of CN1) CN1 6pin connector to GBA link port (top side) Further components... bottom side (B-7) U201 5pin "LXVB" (bottom side, near CN1) U72 4pin "BMs" (bottom side, near ANT, tiny black chip) FL70 ?pin "[] o26" (bottom side, near ANT, bigger white chip) B70 6pin "[]" (bottom side, near ANT, small white chip) Plus, resistors and capacitors (without any markings). Version WITHOUT sticker: Sticker on Case: N/A PCB: "19-C046-03, A-1" (top side) and "B-1" and Microchip ",\\" (bottom side) PCB: white stamp "3204, TW-15, RU, 94V-0" PCB: black stamp "23MN" or "23NH" or so (smeared) U1 32pin "Freescale 13190, 4FGD" (top side) U2 48pin "Freescale CT3000, XAB0425" (bottom side) ;CT3000 (not CT3001) X3 2pin "9.5SKSS4GT" (top side) Further components... top side (A-1) D1 5pin "D6F, 31" (top side, below X3) U71 6pin "P3, () 2" (top side, right of X3, tiny black chip) B71 6pin "[]" (top side, right of X3, small white chip) ANT 2pin on-board copper wings Q70 3pin (top side, above CN1) D? 2pin "72" (top side, above CN1) D3 2pin "F2" (top side, above CN1) U200 4pin "MSV" (top side, above CN1) U202 5pin "LXKH" (top side, right of CN1) U203 4pin "M6H" (top side, right of CN1) CN1 6pin connector to GBA link port (top side) Further components... bottom side (B-1) U201 5pin "LXV2" (bottom side, near CN1) U70 6pin "AAG" (bottom side, near ANT, tiny black chip) FL70 ?pin "[] o26" (bottom side, near ANT, bigger white chip) B70 6pin "[]" (bottom side, near ANT, small white chip) Plus, resistors and capacitors (without any markings). Major Differences Sticker "N/A" vs "Grossosteim P/AGB-A-WA-EUR-2 E3" PCB-markings "19-C046-03, A-1, 3204" vs "19-C046-04, A-7, 3104" U1 "CT3000, XAB0425" vs "CT3001, XAC0445" Transistors One transistor (Q70) vs Two transistors (both nameless) U70/U72 U70 "AAG" (6pin) vs U72 "BMs" (4pin) Purpose of the changes is unknown (either older/newer revisions, or different regions with different FCC regulations). GBA Infrared Communication -------------------------- Early GBA prototypes have been intended to include a built-in IR port for sending and receiving IR signals. Among others, this port could have been used to communicate with other GBAs, or older CGB models, or TV Remote Controls, etc. [ THE INFRARED COMMUNICATION FEATURE IS -NOT- SUPPORTED ANYMORE ] Anyways, the prototype specifications have been as shown below... Keep in mind that the IR signal may be interrupted by whatever objects moved between sender and receiver - the IR port isn't recommended for programs that require realtime data exchange (such like action games). 4000136h - IR - Infrared Register (R/W) Bit Expl. 0 Transmission Data (0=LED Off, 1=LED On) 1 READ Enable (0=Disable, 1=Enable) 2 Reception Data (0=None, 1=Signal received) (Read only) 3 AMP Operation (0=Off, 1=On) 4 IRQ Enable Flag (0=Disable, 1=Enable) 5-15 Not used When IRQ is enabled, an interrupt is requested if the incoming signal was 0.119us Off (2 cycles), followed by 0.536us On (9 cycles) - minimum timing periods each. Transmission Notes When transmitting an IR signal, note that it'd be not a good idea to keep the LED turned On for a very long period (such like sending a 1 second synchronization pulse). The recipient's circuit would treat such a long signal as "normal IR pollution which is in the air" after a while, and thus ignore the signal. Reception Notes Received data is internally latched. Latched data may be read out by setting both READ and AMP bits. Note: Provided that you don't want to receive your own IR signal, be sure to set Bit 0 to zero before attempting to receive data. Power-consumption After using the IR port, be sure to reset the register to zero in order to reduce battery power consumption. GBA Keypad Input ---------------- The built-in GBA gamepad has 4 direction keys, and 6 buttons. 4000130h - KEYINPUT - Key Status (R) Bit Expl. 0 Button A (0=Pressed, 1=Released) 1 Button B (etc.) 2 Select (etc.) 3 Start (etc.) 4 Right (etc.) 5 Left (etc.) 6 Up (etc.) 7 Down (etc.) 8 Button R (etc.) 9 Button L (etc.) 10-15 Not used It'd be usually recommended to read-out this register only once per frame, and to store the current state in memory. As a side effect, this method avoids problems caused by switch bounce when a key is newly released or pressed. 4000132h - KEYCNT - Key Interrupt Control (R/W) The keypad IRQ function is intended to terminate the very-low-power Stop mode, it is not suitable for processing normal user input, to do this, most programs are invoking their keypad handlers from within VBlank IRQ. Bit Expl. 0 Button A (0=Ignore, 1=Select) 1 Button B (etc.) 2 Select (etc.) 3 Start (etc.) 4 Right (etc.) 5 Left (etc.) 6 Up (etc.) 7 Down (etc.) 8 Button R (etc.) 9 Button L (etc.) 10-13 Not used 14 Button IRQ Enable (0=Disable, 1=Enable) 15 Button IRQ Condition (0=Logical OR, 1=Logical AND) In logical OR mode, an interrupt is requested when at least one of the selected buttons is pressed. In logical AND mode, an interrupt is requested when ALL of the selected buttons are pressed. Notes In 8bit gameboy compatibility mode, L and R Buttons are used to toggle the screen size between normal 160x144 pixels and stretched 240x144 pixels. The GBA SP is additionally having a * Button used to toggle the backlight on and off (controlled by separate hardware logic, there's no way to detect or change the current backlight state by software). GBA Interrupt Control --------------------- 4000208h - IME - Interrupt Master Enable Register (R/W) Bit Expl. 0 Disable all interrupts (0=Disable All, 1=See IE register) 1-31 Not used 4000200h - IE - Interrupt Enable Register (R/W) Bit Expl. 0 LCD V-Blank (0=Disable) 1 LCD H-Blank (etc.) 2 LCD V-Counter Match (etc.) 3 Timer 0 Overflow (etc.) 4 Timer 1 Overflow (etc.) 5 Timer 2 Overflow (etc.) 6 Timer 3 Overflow (etc.) 7 Serial Communication (etc.) 8 DMA 0 (etc.) 9 DMA 1 (etc.) 10 DMA 2 (etc.) 11 DMA 3 (etc.) 12 Keypad (etc.) 13 Game Pak (external IRQ source) (etc.) 14-15 Not used Note that there is another 'master enable flag' directly in the CPUs Status Register (CPSR) accessible in privileged modes, see CPU reference for details. 4000202h - IF - Interrupt Request Flags / IRQ Acknowledge (R/W, see below) Bit Expl. 0 LCD V-Blank (1=Request Interrupt) 1 LCD H-Blank (etc.) 2 LCD V-Counter Match (etc.) 3 Timer 0 Overflow (etc.) 4 Timer 1 Overflow (etc.) 5 Timer 2 Overflow (etc.) 6 Timer 3 Overflow (etc.) 7 Serial Communication (etc.) 8 DMA 0 (etc.) 9 DMA 1 (etc.) 10 DMA 2 (etc.) 11 DMA 3 (etc.) 12 Keypad (etc.) 13 Game Pak (external IRQ source) (etc.) 14-15 Not used Interrupts must be manually acknowledged by writing a "1" to one of the IRQ bits, the IRQ bit will then be cleared. "[Cautions regarding clearing IME and IE] A corresponding interrupt could occur even while a command to clear IME or each flag of the IE register is being executed. When clearing a flag of IE, you need to clear IME in advance so that mismatching of interrupt checks will not occur." ? "[When multiple interrupts are used] When the timing of clearing of IME and the timing of an interrupt agree, multiple interrupts will not occur during that interrupt. Therefore, set (enable) IME after saving IME during the interrupt routine." ? BIOS Interrupt handling Upon interrupt execution, the CPU is switched into IRQ mode, and the physical interrupt vector is called - as this address is located in BIOS ROM, the BIOS will always execute the following code before it forwards control to the user handler: 00000018 b 128h ;IRQ vector: jump to actual BIOS handler 00000128 stmfd r13!,r0-r3,r12,r14 ;save registers to SP_irq 0000012C mov r0,4000000h ;ptr+4 to 03FFFFFC (mirror of 03007FFC) 00000130 add r14,r15,0h ;retadr for USER handler $+8=138h 00000134 ldr r15,[r0,-4h] ;jump to [03FFFFFC] USER handler 00000138 ldmfd r13!,r0-r3,r12,r14 ;restore registers from SP_irq 0000013C subs r15,r14,4h ;return from IRQ (PC=LR-4, CPSR=SPSR) As shown above, a pointer to the 32bit/ARM-code user handler must be setup in [03007FFCh]. By default, 160 bytes of memory are reserved for interrupt stack at 03007F00h-03007F9Fh. Recommended User Interrupt handling - If necessary switch to THUMB state manually (handler is called in ARM state) - Determine reason(s) of interrupt by examining IF register - User program may freely assign priority to each reason by own logic - Process the most important reason of your choice - User MUST manually acknowledge by writing to IF register - If user wants to allow nested interrupts, save SPSR_irq, then enable IRQs. - If using other registers than BIOS-pushed R0-R3, manually save R4-R11 also. - Note that Interrupt Stack is used (which may have limited size) - So, for memory consuming stack operations use system mode (=user stack). - When calling subroutines in system mode, save LSR_usr also. - Restore SPSR_irq and/or R4-R11 if you've saved them above. - Finally, return to BIOS handler by BX LR (R14_irq) instruction. Default memory usage at 03007FXX (and mirrored to 03FFFFXX) Addr. Size Expl. 3007FFCh 4 Pointer to user IRQ handler (32bit ARM code) 3007FF8h 2 Interrupt Check Flag (for IntrWait/VBlankIntrWait functions) 3007FF4h 4 Allocated Area 3007FF0h 4 Pointer to Sound Buffer 3007FE0h 16 Allocated Area 3007FA0h 64 Default area for SP_svc Supervisor Stack (4 words/time) 3007F00h 160 Default area for SP_irq Interrupt Stack (6 words/time) Memory below 7F00h is free for User Stack and user data. The three stack pointers are initially initialized at the TOP of the respective areas: SP_svc=03007FE0h SP_irq=03007FA0h SP_usr=03007F00h The user may redefine these addresses and move stacks into other locations, however, the addresses for system data at 7FE0h-7FFFh are fixed. Not sure, is following free for user ? Registers R8-R12_fiq, R13_fiq, R14_fiq, SPSR_fiq Registers R13-R14_abt, SPSR_abt Registers R13-R14_und, SPSR_und Fast Interrupt (FIQ) The ARM CPU provides two interrupt sources, IRQ and FIQ. In the GBA only IRQ is used. In normal GBAs, the FIQ signal is shortcut to VDD35, ie. the signal is always high, and there is no way to generate a FIQ by hardware. The registers R8..12_fiq could be used by software (when switching into FIQ mode by writing to CPSR) - however, this might make the game incompatible with hardware debuggers (which are reportedly using FIQs for debugging purposes). GBA System Control ------------------ 4000204h - WAITCNT - Waitstate Control (R/W) This register is used to configure game pak access timings. The game pak ROM is mirrored to three address regions at 08000000h, 0A000000h, and 0C000000h, these areas are called Wait State 0-2. Different access timings may be assigned to each area (this might be useful in case that a game pak contains several ROM chips with different access times each). Bit Expl. 0-1 SRAM Wait Control (0..3 = 4,3,2,8 cycles) 2-3 Wait State 0 First Access (0..3 = 4,3,2,8 cycles) 4 Wait State 0 Second Access (0..1 = 2,1 cycles) 5-6 Wait State 1 First Access (0..3 = 4,3,2,8 cycles) 7 Wait State 1 Second Access (0..1 = 4,1 cycles; unlike above WS0) 8-9 Wait State 2 First Access (0..3 = 4,3,2,8 cycles) 10 Wait State 2 Second Access (0..1 = 8,1 cycles; unlike above WS0,WS1) 11-12 PHI Terminal Output (0..3 = Disable, 4.19MHz, 8.38MHz, 16.78MHz) 13 Not used 14 Game Pak Prefetch Buffer (Pipe) (0=Disable, 1=Enable) 15 Game Pak Type Flag (Read Only) (0=GBA, 1=CGB) (IN35 signal) 16-31 Not used At startup, the default setting is 0000h. Currently manufactured cartridges are using the following settings: WS0/ROM=3,1 clks; SRAM=8 clks; WS2/EEPROM: 8,8 clks; prefetch enabled; that is, WAITCNT=4317h, for more info see "GBA Cartridges" chapter. First Access (Non-sequential) and Second Access (Sequential) define the waitstates for N and S cycles, the actual access time is 1 clock cycle PLUS the number of waitstates. GamePak uses 16bit data bus, so that a 32bit access is split into TWO 16bit accesses (of which, the second fragment is always sequential, even if the first fragment was non-sequential). --> GBA GamePak Prefetch NOTES: The GBA forcefully uses non-sequential timing at the beginning of each 128K-block of gamepak ROM, eg. "LDMIA [801fff8h],r0-r7" will have non-sequential timing at 8020000h. The PHI Terminal output (PHI Pin of Gamepak Bus) should be disabled. 4000300h - POSTFLG - BYTE - Undocumented - Post Boot / Debug Control (R/W) After initial reset, the GBA BIOS initializes the register to 01h, and any further execution of the Reset vector (00000000h) will pass control to the Debug vector (0000001Ch) when sensing the register to be still set to 01h. Bit Expl. 0 Undocumented. First Boot Flag (0=First, 1=Further) 1-7 Undocumented. Not used. Normally the debug handler rejects control unless it detects Debug flags in cartridge header, in that case it may redirect to a cut-down boot procedure (bypassing Nintendo logo and boot delays, much like nocash burst boot for multiboot software). I am not sure if it is possible to reset the GBA externally without automatically resetting register 300h though. 4000301h - HALTCNT - BYTE - Undocumented - Low Power Mode Control (W) Writing to this register switches the GBA into battery saving mode. In Halt mode, the CPU is paused as long as (IE AND IF)=0, this should be used to reduce power-consumption during periods when the CPU is waiting for interrupt events. In Stop mode, most of the hardware including sound and video are paused, this very-low-power mode could be used much like a screensaver. Bit Expl. 0-6 Undocumented. Not used. 7 Undocumented. Power Down Mode (0=Halt, 1=Stop) The current GBA BIOS addresses only the upper eight bits of this register (by writing 00h or 80h to address 04000301h), however, as the register isn't officially documented, some or all of the bits might have different meanings in future GBA models. For best forwards compatibility, it'd generally be more recommended to use the BIOS Functions SWI 2 (Halt) or SWI 3 (Stop) rather than writing to this register directly. 4000410h - Undocumented - Purpose Unknown ? 8bit (W) The BIOS writes the 8bit value 0FFh to this address. Purpose Unknown. Probably just another bug in the BIOS. 4000800h - 32bit - Undocumented - Internal Memory Control (R/W) Supported by GBA and GBA SP only - NOT supported by DS (even in GBA mode). Also supported by GBA Micro - but crashes on "overclocked" WRAM setting. Initialized to 0D000020h (by hardware). Unlike all other I/O registers, this register is mirrored across the whole I/O area (in increments of 64K, ie. at 4000800h, 4010800h, 4020800h, ..., 4FF0800h) Bit Expl. 0 Disable 32K+256K WRAM (0=Normal, 1=Disable) (when off: empty/prefetch) From endrift: bit0 swaps 00000000h-01FFFFFFh and 02000000h-03FFFFFFh in GBA mode (but keeps BIOS protection) 1 Unknown (Read/Write-able) 2 Unknown (Read/Write-able) 3 Unknown, CGB? (Read/Write-able) From shinyquagsire23: bit3 seems to disable the CGB bootrom (carts without SRAM will typically boot with Nintendo logo skipped, and carts with SRAM will typically crash somehow) 4 Unused (0) 5 Enable 256K WRAM (0=Disable, 1=Normal) (when off: mirror of 32K WRAM) 6-23 Unused (0) 24-27 Wait Control WRAM 256K (0-14 = 15..1 Waitstates, 15=Lockup) 28-31 Unknown (Read/Write-able) The default value 0Dh in Bits 24-27 selects 2 waitstates for 256K WRAM (ie. 3/3/6 cycles 8/16/32bit accesses). The fastest possible setting would be 0Eh (1 waitstate, 2/2/4 cycles for 8/16/32bit), that works on GBA and GBA SP only, the GBA Micro locks up with that setting (it's on-chip RAM is too slow, and works only with 2 or more waitstates). Note: One cycle equals approx. 59.59ns (ie. 16.78MHz clock). GBA GamePak Prefetch -------------------- GamePak Prefetch can be enabled in WAITCNT register. When prefetch buffer is enabled, the GBA attempts to read opcodes from Game Pak ROM during periods when the CPU is not using the bus (if any). Memory access is then performed with 0 Waits if the CPU requests data which is already stored in the buffer. The prefetch buffer stores up to eight 16bit values. GamePak ROM Opcodes The prefetch feature works only with fetched from GamePak ROM. Opcodes executed in RAM or BIOS are not affected by the prefetch feature (even if that opcodes read from GamePak ROM). Prefetch Enable For GamePak ROM opcodes, prefetch may occur in two situations: 1) opcodes with internal cycles (I) which do not change R15, shift/rotate register-by-register, load opcodes (ldr,ldm,pop,swp), multiply opcodes 2) opcodes that load/store memory (ldr,str,ldm,stm,etc.) Prefetch Disable Bug When Prefetch is disabled, the Prefetch Disable Bug will occur for all "Opcodes in GamePak ROM with Internal Cycles which do not change R15" for those opcodes, the bug changes the opcode fetch time from 1S to 1N. Note: Affected opcodes (with I cycles) are: Shift/rotate register-by-register opcodes, multiply opcodes, and load opcodes (ldr,ldm,pop,swp). GBA Cartridges -------------- ROM --> GBA Cartridge Header --> GBA Cartridge ROM Backup Media Aside from ROM, cartridges may also include one of the following backup medias, used to store game positions, highscore tables, options, or other data. --> GBA Cart Backup IDs --> GBA Cart Backup SRAM/FRAM --> GBA Cart Backup EEPROM --> GBA Cart Backup Flash ROM --> GBA Cart Backup DACS Add-Ons --> GBA Cart I/O Port (GPIO) --> GBA Cart Real-Time Clock (RTC) --> GBA Cart Solar Sensor --> GBA Cart Tilt Sensor --> GBA Cart Gyro Sensor --> GBA Cart Rumble --> GBA Cart e-Reader --> GBA Cart Unknown Devices --> GBA Cart Protections Other Accessoires --> GBA Flashcards --> GBA Cheat Devices GBA Cartridge Header -------------------- The first 192 bytes at 8000000h-80000BFh in ROM are used as cartridge header. The same header is also used for Multiboot images at 2000000h-20000BFh (plus some additional multiboot entries at 20000C0h and up). Header Overview Address Bytes Expl. 000h 4 ROM Entry Point (32bit ARM branch opcode, eg. "B rom_start") 004h 156 Nintendo Logo (compressed bitmap, required!) 0A0h 12 Game Title (uppercase ascii, max 12 characters) 0ACh 4 Game Code (uppercase ascii, 4 characters) 0B0h 2 Maker Code (uppercase ascii, 2 characters) 0B2h 1 Fixed value (must be 96h, required!) 0B3h 1 Main unit code (00h for current GBA models) 0B4h 1 Device type (usually 00h) (bit7=DACS/debug related) 0B5h 7 Reserved Area (should be zero filled) 0BCh 1 Software version (usually 00h) 0BDh 1 Complement check (header checksum, required!) 0BEh 2 Reserved Area (should be zero filled) --- Additional Multiboot Header Entries --- 0C0h 4 RAM Entry Point (32bit ARM branch opcode, eg. "B ram_start") 0C4h 1 Boot mode (init as 00h - BIOS overwrites this value!) 0C5h 1 Slave ID Number (init as 00h - BIOS overwrites this value!) 0C6h 26 Not used (seems to be unused) 0E0h 4 JOYBUS Entry Pt. (32bit ARM branch opcode, eg. "B joy_start") Note: With all entry points, the CPU is initially set into system mode. 000h - Entry Point, 4 Bytes Space for a single 32bit ARM opcode that redirects to the actual startaddress of the cartridge, this should be usually a "B " instruction. Note: This entry is ignored by Multiboot slave GBAs (in fact, the entry is then overwritten and redirected to a separate Multiboot Entry Point, as described below). 004h..09Fh - Nintendo Logo, 156 Bytes Contains the Nintendo logo which is displayed during the boot procedure. Cartridge won't work if this data is missing or modified. In detail: This area contains Huffman compression data (but excluding the compression header which is hardcoded in the BIOS, so that it'd be probably not possible to hack the GBA by producing de-compression buffer overflows). A copy of the compression data is stored in the BIOS, the GBA will compare this data and lock-up itself if the BIOS data isn't exactly the same as in the cartridge (or multiboot header). The only exception are the two entries below which are allowed to have variable settings in some bits. 09Ch Bit 2,7 - Debugging Enable This is part of the above Nintendo Logo area, and must be commonly set to 21h, however, Bit 2 and Bit 7 may be set to other values. When both bits are set (ie. A5h), the FIQ/Undefined Instruction handler in the BIOS becomes unlocked, the handler then forwards these exceptions to the user handler in cartridge ROM (entry point defined in 80000B4h, see below). Other bit combinations currently do not seem to have special functions. 09Eh Bit 0,1 - Cartridge Key Number MSBs This is part of the above Nintendo Logo area, and must be commonly set to F8h, however, Bit 0-1 may be set to other values. During startup, the BIOS performs some dummy-reads from a stream of pre-defined addresses, even though these reads seem to be meaningless, they might be intended to unlock a read-protection inside of commercial cartridge. There are 16 pre-defined address streams - selected by a 4bit key number - of which the upper two bits are gained from 800009Eh Bit 0-1, and the lower two bits from a checksum across header bytes 09Dh..0B7h (bytewise XORed, divided by 40h). 0A0h - Game Title, Uppercase Ascii, max 12 characters Space for the game title, padded with 00h (if less than 12 chars). 0ACh - Game Code, Uppercase Ascii, 4 characters This is the same code as the AGB-UTTD code which is printed on the package and sticker on (commercial) cartridges (excluding the leading "AGB-" part). U Unique Code (usually "A" or "B" or special meaning) TT Short Title (eg. "PM" for Pac Man) D Destination/Language (usually "J" or "E" or "P" or specific language) The first character (U) is usually "A" or "B", in detail: A Normal game; Older titles (mainly 2001..2003) B Normal game; Newer titles (2003..) C Normal game; Not used yet, but might be used for even newer titles F Famicom/Classic NES Series (software emulated NES games) K Yoshi and Koro Koro Puzzle (acceleration sensor) P e-Reader (dot-code scanner) (or NDS PassMe image when gamecode="PASS") R Warioware Twisted (cartridge with rumble and z-axis gyro sensor) U Boktai 1 and 2 (cartridge with RTC and solar sensor) V Drill Dozer (cartridge with rumble) The second/third characters (TT) are: Usually an abbreviation of the game title (eg. "PM" for "Pac Man") (unless that gamecode was already used for another game, then TT is just random) The fourth character (D) indicates Destination/Language: J Japan P Europe/Elsewhere F French S Spanish E USA/English D German I Italian 0B0h - Maker code, Uppercase Ascii, 2 characters Identifies the (commercial) developer. For example, "01"=Nintendo. 0B2h - Fixed value, 1 Byte Must be 96h. 0B3h - Main unit code, 1 Byte Identifies the required hardware. Should be 00h for current GBA models. 0B4h - Device type, 1 Byte Normally, this entry should be zero. With Nintendo's hardware debugger Bit 7 identifies the debugging handlers entry point and size of DACS (Debugging And Communication System) memory: Bit7=0: 9FFC000h/8MBIT DACS, Bit7=1: 9FE2000h/1MBIT DACS. The debugging handler can be enabled in 800009Ch (see above), normal cartridges do not have any memory (nor any mirrors) at these addresses though. 0B5h - Reserved Area, 7 Bytes Reserved, zero filled. 0BCh - Software version number Version number of the game. Usually zero. 0BDh - Complement check, 1 Byte Header checksum, cartridge won't work if incorrect. Calculate as such: chk=0:for i=0A0h to 0BCh:chk=chk-[i]:next:chk=(chk-19h) and 0FFh 0BEh - Reserved Area, 2 Bytes Reserved, zero filled. Below required for Multiboot/slave programs only. For Multiboot, the above 192 bytes are required to be transferred as header-block (loaded to 2000000h-20000BFh), and some additional header-information must be located at the beginning of the actual program/data-block (loaded to 20000C0h and up). This extended header consists of Multiboot Entry point(s) which must be set up correctly, and of two reserved bytes which are overwritten by the boot procedure: 0C0h - Normal/Multiplay mode Entry Point This entry is used only if the GBA has been booted by using Normal or Multiplay transfer mode (but not by Joybus mode). Typically deposit a ARM-32bit "B " branch opcode at this location, which is pointing to your actual initialization procedure. 0C4h (BYTE) - Boot mode The slave GBA download procedure overwrites this byte by a value which is indicating the used multiboot transfer mode. Value Expl. 01h Joybus mode 02h Normal mode 03h Multiplay mode Typically set this byte to zero by inserting DCB 00h in your source. Be sure that your uploaded program does not contain important program code or data at this location, or at the ID-byte location below. 0C5h (BYTE) - Slave ID Number If the GBA has been booted in Normal or Multiplay mode, this byte becomes overwritten by the slave ID number of the local GBA (that'd be always 01h for normal mode). Value Expl. 01h Slave #1 02h Slave #2 03h Slave #3 Typically set this byte to zero by inserting DCB 00h in your source. When booted in Joybus mode, the value is NOT changed and remains the same as uploaded from the master GBA. 0C6h..0DFh - Not used Appears to be unused. 0E0h - Joybus mode Entry Point If the GBA has been booted by using Joybus transfer mode, then the entry point is located at this address rather than at 20000C0h. Either put your initialization procedure directly at this address, or redirect to the actual boot procedure by depositing a "B " opcode here (either one using 32bit ARM code). Or, if you are not intending to support joybus mode (which is probably rarely used), ignore this entry. GBA Cartridge ROM ----------------- ROM Size The games F-ZERO and Super Mario Advance use ROMs of 4 MBytes each. Zelda uses 8 MBytes. Not sure if other sizes are manufactured. ROM Waitstates The GBA starts the cartridge with 4,2 waitstates (N,S) and prefetch disabled. The program may change these settings by writing to WAITCNT, the games F-ZERO and Super Mario Advance use 3,1 waitstates (N,S) each, with prefetch enabled. Third-party flashcards are reportedly running unstable with these settings. Also, prefetch and shorter waitstates are allowing to read more data and opcodes from ROM is less time, the downside is that it increases the power consumption. ROM Chip Because of how 24bit addresses are squeezed through the Gampak bus, the cartridge must include a circuit that latches the lower 16 address bits on non-sequential access, and that increments these bits on sequential access. Nintendo includes this circuit directly in the ROM chip. Also, the ROM must have 16bit data bus (or a circuit which converts two 8bit data units into one 16bit unit - by not exceeding the waitstate timings). GBA Cart Backup IDs ------------------- Nintendo didn't include a backup-type entry in the ROM header, however, the required type can be detected by ID strings in the ROM-image. Nintendo's tools are automatically inserting these strings (as part of their library headers). When using other tools, you may insert ID strings by hand. ID Strings The ID string must be located at a word-aligned memory location, the string length should be a multiple of 4 bytes (padded with zero's). EEPROM_Vnnn EEPROM 512 bytes or 8 Kbytes (4Kbit or 64Kbit) SRAM_Vnnn SRAM 32 Kbytes (256Kbit) FLASH_Vnnn FLASH 64 Kbytes (512Kbit) (ID used in older files) FLASH512_Vnnn FLASH 64 Kbytes (512Kbit) (ID used in newer files) FLASH1M_Vnnn FLASH 128 Kbytes (1Mbit) For Nintendo's tools, "nnn" is a 3-digit library version number. When using other tools, best keep it set to "nnn" rather than inserting numeric digits. Notes No$gba does auto-detect most backup types, even without ID strings, except for 128K FLASH (without ID "FLASH1M_Vnnn", the FLASH size defaults to 64K). Ideally, for faster detection, the ID should be put into the first some bytes of the ROM-image (ie. somewhere right after the ROM header). GBA Cart Backup SRAM/FRAM ------------------------- SRAM - 32 KBytes (256Kbit) Lifetime: Depends on back-up battery FRAM - 32 KBytes (256Kbit) Lifetime: 10,000,000,000 read/write per bit Hyundai GM76V256CLLFW10 SRAM (Static RAM) (eg. F-Zero) Fujitsu MB85R256 FRAM (Ferroelectric RAM) (eg. Warioware Twisted) Addressing and Waitstates SRAM/FRAM is mapped to E000000h-E007FFFh, it should be accessed with 8 waitstates (write a value of 3 into Bit0-1 of WAITCNT). Databus Width The SRAM/FRAM databus is restricted to 8 bits, it should be accessed by LDRB, LDRSB, and STRB opcodes only. Reading and Writing Reading from SRAM/FRAM should be performed by code executed in WRAM only (but not by code executed in ROM). There is no such restriction for writing. Preventing Data Loss The GBA SRAM/FRAM carts do not include a write-protect function (unlike older 8bit gameboy carts). This seems to be a problem and may cause data loss when a cartridge is removed or inserted while the GBA is still turned on. As far as I understand, this is not so much a hardware problem, but rather a software problem, ie. theoretically you could remove/insert the cartridge as many times as you want, but you should take care that your program does not crash (and write blindly into memory). Recommended Workaround Enable the Gamepak Interrupt (it'll most likely get triggered when removing the cartridge), and hang-up the GBA in an endless loop when your interrupt handler senses a Gamepak IRQ. For obvious reason, your interrupt handler should be located in WRAM, ie. not in the (removed) ROM cartridge. The handler should process Gamepak IRQs at highest priority. Periods during which interrupts are disabled should be kept as short as possible, if necessary allow nested interrupts. When to use the above Workaround A program that relies wholly on code and data in WRAM, and that does not crash even when ROM is removed, may keep operating without having to use the above mechanism. Do NOT use the workaround for programs that run without a cartridge inserted (ie. single gamepak/multiboot slaves), or for programs that use Gamepak IRQ/DMA for other purposes. All other programs should use it. It'd be eventually a good idea to include it even in programs that do not use SRAM/FRAM themselves (eg. otherwise removing a SRAM/FRAM-less cartridge may lock up the GBA, and may cause it to destroy backup data when inserting a SRAM/FRAM cartridge). SRAM vs FRAM FRAM (Ferroelectric RAM) is a newer technology, used in newer GBA carts, unlike SRAM (Static RAM), it doesn't require a battery to hold the data. At software side, it is accessed exactly like SRAM, ie. unlike EEPROM/FLASH, it doesn't require any Write/Erase commands/delays. Note In SRAM/FRAM cartridges, the /REQ pin (Pin 31 of Gamepak bus) should be a little bit shorter as than the other pins; when removing the cartridge, this causes the gamepak IRQ signal to get triggered before the other pins are disconnected. GBA Cart Backup EEPROM ---------------------- 9853 - EEPROM 512 Bytes (0200h) (4Kbit) (eg. used by Super Mario Advance) 9854 - EEPROM 8 KBytes (2000h) (64Kbit) (eg. used by Boktai) Lifetime: 100,000 writes per address Addressing and Waitstates The eeprom is connected to Bit0 of the data bus, and to the upper 1 bit (or upper 17 bits in case of large 32MB ROM) of the cartridge ROM address bus, communication with the chip takes place serially. The eeprom must be used with 8 waitstates (set WAITCNT=X3XXh; 8,8 clks in WS2 area), the eeprom can be then addressed at DFFFF00h..DFFFFFFh. Respectively, with eeprom, ROM is restricted to 8000000h-9FFFeFFh (max. 1FFFF00h bytes = 32MB minus 256 bytes). On carts with 16MB or smaller ROM, eeprom can be alternately accessed anywhere at D000000h-DFFFFFFh. Data and Address Width Data can be read from (or written to) the EEPROM in units of 64bits (8 bytes). Writing automatically erases the old 64bits of data. Addressing works in units of 64bits respectively, that is, for 512 Bytes EEPROMS: an address range of 0-3Fh, 6bit bus width; and for 8KByte EEPROMs: a range of 0-3FFh, 14bit bus width (only the lower 10 address bits are used, upper 4 bits should be zero). Set Address (For Reading) Prepare the following bitstream in memory: 2 bits "11" (Read Request) n bits eeprom address (MSB first, 6 or 14 bits, depending on EEPROM) 1 bit "0" Then transfer the stream to eeprom by using DMA. Read Data Read a stream of 68 bits from EEPROM by using DMA, then decipher the received data as follows: 4 bits - ignore these 64 bits - data (conventionally MSB first) Write Data to Address Prepare the following bitstream in memory, then transfer the stream to eeprom by using DMA, it'll take ca. 108368 clock cycles (ca. 6.5ms) until the old data is erased and new data is programmed. 2 bits "10" (Write Request) n bits eeprom address (MSB first, 6 or 14 bits, depending on EEPROM) 64 bits data (conventionally MSB first) 1 bit "0" After the DMA, keep reading from the chip, by normal LDRH [DFFFF00h], until Bit 0 of the returned data becomes "1" (Ready). To prevent your program from locking up in case of malfunction, generate a timeout if the chip does not reply after 10ms or longer. Using DMA Transferring a bitstreams to/from the EEPROM must be done via DMA3 (manual transfers via LDRH/STRH won't work; probably because they don't keep /CS=LOW and A23=HIGH throughout the transfer). For using DMA, a buffer in memory must be used (that buffer would be typically allocated temporarily on stack, one halfword for each bit, bit1-15 of the halfwords are don't care, only bit0 is used). The buffer must be transfered as a whole to/from EEPROM by using DMA3 (DMA0-2 can't access external memory), use 16bit transfer mode, both source and destination address incrementing (ie. DMA3CNT=80000000h+length). DMA channels of higher priority should be disabled during the transfer (ie. H/V-Blank or Sound FIFO DMAs). And, of course any interrupts that might mess with DMA registers should be disabled. Pin-Outs The EEPROM chips are having only 8 pins, these are connected, Pin 1..8, to ROMCS, RD, WR, AD0, GND, GND, A23, VDD of the GamePak bus. Carts with 32MB ROM must have A7..A22 logically ANDed with A23. Notes There seems to be no autodection mechanism, so that a hardcoded bus width must be used. GBA Cart Backup Flash ROM ------------------------- 64 KBytes - 512Kbits Flash ROM - Lifetime: 10,000 writes per sector 128 KBytes - 1Mbit Flash ROM - Lifetime: ??? writes per sector Chip Identification (all device types) [E005555h]=AAh, [E002AAAh]=55h, [E005555h]=90h (enter ID mode) dev=[E000001h], man=[E000000h] (get device & manufacturer) [E005555h]=AAh, [E002AAAh]=55h, [E005555h]=F0h (terminate ID mode) Used to detect the type (and presence) of FLASH chips. See Device Types below. Reading Data Bytes (all device types) dat=[E00xxxxh] (read byte from address xxxx) Erase Entire Chip (all device types) [E005555h]=AAh, [E002AAAh]=55h, [E005555h]=80h (erase command) [E005555h]=AAh, [E002AAAh]=55h, [E005555h]=10h (erase entire chip) wait until [E000000h]=FFh (or timeout) Erases all memory in chip, erased memory is FFh-filled. Erase 4Kbyte Sector (all device types, except Atmel) [E005555h]=AAh, [E002AAAh]=55h, [E005555h]=80h (erase command) [E005555h]=AAh, [E002AAAh]=55h, [E00n000h]=30h (erase sector n) wait until [E00n000h]=FFh (or timeout) Erases memory at E00n000h..E00nFFFh, erased memory is FFh-filled. Erase-and-Write 128 Bytes Sector (only Atmel devices) old=IME, IME=0 (disable interrupts) [E005555h]=AAh, [E002AAAh]=55h, [E005555h]=A0h (erase/write sector command) [E00xxxxh+00h..7Fh]=dat[00h..7Fh] (write 128 bytes) IME=old (restore old IME state) wait until [E00xxxxh+7Fh]=dat[7Fh] (or timeout) Interrupts (and DMAs) should be disabled during command/write phase. Target address must be a multiple of 80h. Write Single Data Byte (all device types, except Atmel) [E005555h]=AAh, [E002AAAh]=55h, [E005555h]=A0h (write byte command) [E00xxxxh]=dat (write byte to address xxxx) wait until [E00xxxxh]=dat (or timeout) The target memory location must have been previously erased. Terminate Command after Timeout (only Macronix devices, ID=1CC2h) [E005555h]=F0h (force end of write/erase command) Use if timeout occurred during "wait until" periods, for Macronix devices only. Bank Switching (devices bigger than 64K only) [E005555h]=AAh, [E002AAAh]=55h, [E005555h]=B0h (select bank command) [E000000h]=bnk (write bank number 0..1) Specifies 64K bank number for read/write/erase operations. Required because gamepak flash/sram addressbus is limited to 16bit width. Device Types Nintendo puts different FLASH chips in commercial game cartridges. Developers should thus detect & support all chip types. For Atmel chips it'd be recommended to simulate 4K sectors by software, though reportedly Nintendo doesn't use Atmel chips in newer games anymore. Also mind that different timings should not disturb compatibility and performance. ID Name Size Sectors AverageTimings Timeouts/ms Waits D4BFh SST 64K 16x4K 20us?,?,? 10, 40, 200 3,2 1CC2h Macronix 64K 16x4K ?,?,? 10,2000,2000 8,3 1B32h Panasonic 64K 16x4K ?,?,? 10, 500, 500 4,2 3D1Fh Atmel 64K 512x128 ?,?,? ...40.., 40 8,8 1362h Sanyo 128K ? ?,?,? ? ? ? ? 09C2h Macronix 128K ? ?,?,? ? ? ? ? Identification Codes MSB=Device Type, LSB=Manufacturer. Size in bytes, and numbers of sectors * sector size in bytes. Average medium Write, Erase Sector, Erase Chips timings are unknown? Timeouts in milliseconds for Write, Erase Sector, Erase Chips. Waitstates for Writes, and Reads in clock cycles. Accessing FLASH Memory FLASH memory is located in the "SRAM" area at E000000h..E00FFFFh, which is restricted to 16bit address and 8bit data buswidths. Respectively, the memory can be accessed by 8bit read/write LDRB/STRB opcodes. Also, reading anything (data or status/busy information) can be done by opcodes executed in WRAM (not from opcodes in ROM) (there's no such restriction for writing). FLASH Waitstates Use 8 clk waitstates for initial detection (WAITCNT Bits 0,1 both set). After detection of certain device types smaller wait values may be used for write/erase, and even smaller wait values for raw reading, see Device Types table. In practice, games seem to use smaller values only for write/erase (even though those operations are slow anyways), whilst raw reads are always done at 8 clk waits (even though reads could actually benefit slightly from smaller wait values). Verify Write/Erase and Retry Even though device signalizes the completion of write/erase operations, it'd be recommended to read/confirm the content of the changed memory area by software. In practice, Nintendo's "erase-write-verify-retry" function typically repeats the operation up to three times in case of errors. Also, for SST devices only, the "erase-write" and "erase-write-verify-retry" functions repeat the erase command up to 80 times, additionally followed by one further erase command if no retries were needed, otherwise followed by six further erase commands. Note FLASH (64Kbytes) is used by the game Sonic Advance, and possibly others. GBA Cart Backup DACS -------------------- 128 KBytes - 1Mbit DACS - Lifetime: 100,000 writes. 1024 KBytes - 8Mbit DACS - Lifetime: 100,000 writes. DACS (Debugging And Communication System) is used in Nintendo's hardware debugger only, DACS is NOT used in normal game cartridges. Parts of DACS memory is used to store the debugging exception handlers (entry point/size defined in cartridge header), the remaining memory could be used to store game positions or other data. The address space is the upper end of the 32MB ROM area, the memory can be read directly by the CPU, including for ability to execute program code in this area. GBA Cart I/O Port (GPIO) ------------------------ 4bit General Purpose I/O Port (GPIO) - contained in the ROM-chip Used by Boktai for RTC and Solar Sensor: --> GBA Cart Real-Time Clock (RTC) --> GBA Cart Solar Sensor And by Warioware Twisted for Rumble and Z-Axis Sensor: --> GBA Cart Rumble --> GBA Cart Gyro Sensor Might be also used by other games for other purposes, such like other sensors, or SRAM bank switching, etc. The I/O registers are mapped to a 6-byte region in the ROM-area at 80000C4h, the 6-byte region should be zero-filled in the ROM-image. In Boktai, the size of the zero-filled region is 0E0h bytes - that probably due to an incorrect definition (the additional bytes do not contain any extra ports, nor mirrors of the ports in the 6-byte region). Observe that ROM-bus writes are limited to 16bit/32bit access (STRB opcodes are ignored; that, only in DS mode?). 80000C4h - I/O Port Data (selectable W or R/W) bit0-3 Data Bits 0..3 (0=Low, 1=High) bit4-15 not used (0) 80000C6h - I/O Port Direction (for above Data Port) (selectable W or R/W) bit0-3 Direction for Data Port Bits 0..3 (0=In, 1=Out) bit4-15 not used (0) 80000C8h - I/O Port Control (selectable W or R/W) bit0 Register 80000C4h..80000C8h Control (0=Write-Only, 1=Read/Write) bit1-15 not used (0) In write-only mode, reads return 00h (or possible other data, if the rom contains non-zero data at that location). Connection Examples GPIO | Boktai | Wario Bit Pin | RTC SOL | GYR RBL -----------+---------+--------- 0 ROM.1 | SCK CLK | RES - 1 ROM.2 | SIO RST | CLK - 2 ROM.21 | CS - | DTA - 3 ROM.22 | - FLG | - MOT -----------+---------+--------- IRQ ROM.43 | IRQ - | - - Aside from the I/O Port, the ROM-chip also includes an inverter (used for inverting the RTC /IRQ signal), and some sort of an (unused) address decoder output (which appears to be equal or related to A23 signal) (ie. reacting on ROM A23, or SRAM D7, which share the same pin on GBA slot). GBA Cart Real-Time Clock (RTC) ------------------------------ S3511 - 8pin RTC with 3-wire serial bus (used in Boktai) The RTC chip is (almost) the same as used in NDS consoles: --> DS Real-Time Clock (RTC) The chip is accessed via 4bit I/O port (only 3bits are used for RTC): --> GBA Cart I/O Port (GPIO) Comparision of RTC Registers NDS_________GBA_________GBA/Params___ stat2 control (1-byte) datetime datetime (7-byte) time time (3-byte) stat1 force reset (0-byte) clkadjust force irq (0-byte) alarm1/int1 always FFh (boktai contains code for writing 1-byte to it) alarm2 always FFh (unused) free always FFh (unused) Control Register Bit Dir Expl. 0 - Not used 1 R/W IRQ duty/hold related? 2 - Not used 3 R/W Per Minute IRQ (30s duty) (0=Disable, 1=Enable) 4 - Not used 5 R/W Unknown? 6 R/W 12/24-hour Mode (0=12h, 1=24h) (usually 1) 7 R Power-Off (auto cleared on read) (0=Normal, 1=Failure, time lost) Setting after Battery-Shortcut is 82h. Setting after Force-Reset is 00h. Unused bits seem to be always zero, but might be read-only or write-only? Datetime and Time Registers Same as NDS, except AM/PM flag moved from hour.bit6 (NDS) to hour.bit7 (GBA). Force Reset/Irq Registers Used to reset all RTC registers (all used registers become 00h, except day/month which become 01h), or to drag the IRQ output LOW for a short moment. These registers are strobed by ANY access to them, ie. by both writing to, as well as reading from these registers. RTC Games Boktai series ;which/how many titles? P-Letter series ;which/how many titles? Rockman EXE 4.5 Real Operation Pin-Outs / IRQ Signal The package has identical pin-outs as in NDS, although it is slightly larger than the miniature chip in the DS. For whatever reason, the RTC's /IRQ output is passed through an inverter (contained in the ROM-chip), the inverted signal is then passed to the /IRQ pin on the cartridge slot. So, IRQ's will be triggered on the "wrong" edge - possible somehow in relation with detecting cartridge-removal IRQs? GBA Cart Solar Sensor --------------------- Uses a Photo Diode as Solar Sensor (used in Boktai, allowing to defeat vampires when the cartridge is exposed to sunlight). The cartridge comes in transparent case, and it's slightly longer than normal carts, so the sensor reaches out of the cartridge slot. According to the manual, the sensor works only with sunlight, but actually it works with any strong light source (eg. a 100 Watt bulb at 1-2 centimeters distance). The sensor is accessed via 4bit I/O port (only 3bits used), which is contained in the ROM-chip. --> GBA Cart I/O Port (GPIO) A/D Conversion The cartridge uses a self-made digital-ramp converter A/D converter, which is (maybe) better than measuring a capacitor charge-up time, and/or less expensive than a real ADC-chip: It contains a 74LV4040 12bit binary counter (clocked by CPU via the I/O port), of which only the lower 8bit are used, which are passed to a resistor ladder-type D/A converter, which is generating a linear increasing voltage, which is passed to a TLV272 voltage comparator, which is passing a signal to the I/O port when the counter voltage becomes greater than the sensor voltage. Example Code strh 0001h,[80000c8h] ;-enable R/W mode strh 0007h,[80000c6h] ;-init I/O direction strh 0002h,[80000c4h] ;-reset counter to zero (high=reset) (I/O bit0) strh 0000h,[80000c4h] ;-clear reset (low=normal) mov r0,0 ;-initial level @@lop: strh 0001h,[80000c4h] ;-clock high ;\increase counter (I/O bit1) strh 0000h,[80000c4h] ;-clock low ;/ ldrh r1,[80000c4h] ;-read port (I/O bit3) tst r1,08h ;\ addeq r0,1 ; loop until voltage match (exit with r0=00h..FFh), tsteq r0,100h ; or until failure/timeout (exit with r0=100h) beq @@lop ;/ The results vary depending on the clock rate used. In above example, ensure that IRQs or DMAs do not interrupt the function. Alternately, use a super-slow clock rate (eg. like 666Hz used in Boktai) so that additional small IRQ/DMA delays have little effect on the overall timing. Results should be somewhat: E8h total darkness (including LED light, or daylight on rainy days) Dxh close to a 100 Watt Bulb 5xh reaches max level in boktai's solar gauge 00h close to a tactical nuclear bomb dropped on your city The exact values may change from cartridge to cartridge, so it'd be recommened to include a darkness calibration function, prompting the user to cover the sensor for a moment (in Boktai, access Options by pressing left/right in title screen) (alternately, auto-calibration could theoretically memorize the darkest in-game level ever seen). GBA Cart Tilt Sensor -------------------- Yoshi's Universal Gravitation / Yoshi Topsy Turvy (X/Y-Axis) Koro Koro Puzzle (probably same as Yoshi, X/Y-Axis, too) (?) Yoshi-Type (X/Y-Axis) All of the registers are one byte wide, mapped into the top "half" of the SRAM memory range. E008000h (W) Write 55h to start sampling E008100h (W) Write AAh to start sampling E008200h (R) Lower 8 bits of X axis E008300h (R) Upper 4 bits of X axis, and Bit7: ADC Status (0=Busy, 1=Ready) E008400h (R) Lower 8 bits of Y axis E008500h (R) Upper 4 bits of Y axis You must set SRAM wait control to 8 clocks to access it correctly. You must also set the cartridge PHI terminal to 4 MHz to make it work. Sampling routine (typically executed once a frame during VBlank): wait until [E008300h].Bit7=1 or until timeout ;wait ready x = ([E008300h] AND 0Fh)*100h + [E008200h] ;get x y = ([E008500h] AND 0Fh)*100h + [E008400h] ;get y [E008000h]=55h, [E008100h]=AAh ;start next conversion Example values (may vary on different carts and on temperature, etc): X ranged between 0x2AF to 0x477, center at 0x392. Huh? Y ranged between 0x2C3 to 0x480, center at 0x3A0. Huh? Thanks to Flubba for Yoshi-Type information. Unknown if the Yoshi-Type sensors are sensing rotation, or orientation, or motion, or something else? In case of rotation, rotation around X-axis would result in motion in Y-direction, so not too sure whether X and Y have which meaning? Most probably, the sensors are measuring (both) static acceleration (gravity), and dynamic acceleration (eg. shaking the device left/right). The X/Y values are likely to be mirrored depending on using a back-loading cartridge slot (original GBA), or front-loading cartridge slot (newer GBA SP, and NDS, and NDS-Lite). GBA Cart Gyro Sensor -------------------- Warioware Twisted (Z-Axis Gyro Sensor, plus Rumble) Wario-Type (Z-Axis) Uses a single-axis sensor, which senses rotation around the Z-axis. The sensor is connected to an analogue-in, serial-out ADC chip, which is accessed via lower 3 bits of the GPIO, --> GBA Cart I/O Port (GPIO) The four I/O Lines are connected like so, GPIO.Bit0 (W) Start Conversion GPIO.Bit1 (W) Serial Clock GPIO.Bit2 (R) Serial Data GPIO.Bit3 (W) Used for Rumble (not gyro related) There should be at least between the STRH opcodes which toggle the CLK signal. Wario uses WAITCNT=45B7h (SRAM=8clks, WS0/WS1/WS2=3,1clks, Prefetch=On, PHI=Off). The data stream consists of: 4 dummy bits (usually zero), followed by 12 data bits, followed by endless unused bits (usually zero). read_gyro: mov r1,8000000h ;-cartridge base address mov r0,01h ;\enable R/W access strh r0,[r1,0c8h] ;/ mov r0,0bh ;\init direction (gpio2=input, others=output) strh r0,[r1,0c6h] ;/ ldrh r2,[r1,0c4h] ;-get current state (for keeping gpio3=rumble) orr r2,3 ;\ strh r2,[r1,0c4h] ;gpio0=1 ; start ADC conversion bic r2,1 ; strh r2,[r1,0c4h] ;gpio0=0 ;/ mov r0,00010000h ;stop-bit ;\ bic r2,2 ; @@lop: ; ldrh r3,[r1,0c4h] ;get gpio2=data ; read 16 bits strh r2,[r1,0c4h] ;gpio1=0=clk=low ; (4 dummy bits, plus 12 data bits) movs r3,r3,lsr 3 ;gpio2 to cy=data ; adcs r0,r0,r0 ;merge data, cy=done; orr r3,r2,2 ;set bit1 and delay ; strh r3,[r1,0c4h] ;gpio1=1=clk=high ; bcc @@lop ;/ bic r0,0f000h ;-strip upper 4 dummy bits (isolate 12bit adc) bx lr Example values (may vary on different carts, battery charge, temperature, etc): 354h rotated in anti-clockwise direction (shock-speed) 64Dh rotated in anti-clockwise direction (normal fast) 6A3h rotated in anti-clockwise direction (slow) 6C0h no rotation (stopped) 6DAh rotation in clockwise direction (slow) 73Ah rotation in clockwise direction (normal fast) 9E3h rotation in clockwise direction (shock-speed) For detection, values 000h and FFFh would indicate that there's no sensor. The Z-axis always points into same direction; no matter of frontloading or backloading cartridge slots. Thanks to Momo Vampire for contributing a Wario cartridge. X/Y/Z-Axes X-Axis and Y-Axis are meant to be following the screens X and Y coordinates, so the Z-Axis would point into the screens depth direction. DSi Cameras DSi consoles can mis-use the built-in cameras as Gyro sensor (as done by the System Flaw DSi game). GBA Cart Rumble --------------- Warioware Twisted (Rumble, plus Z-Axis Gyro Sensor) Drill Dozer (Rumble only) <-- and ALSO supports Gameboy Player rumble? GBA Rumble Carts are containing a small motor, which is causing some vibration when/while it is switched on (that, unlike DS Rumble, which must be repeatedly toggled on/off). In Warioware Twisted, rumble is controlled via GPIO.Bit3 (Data 0=Low=Off, 1=High=On) (and Direction 1=Output), the other GPIO Bits are used for the gyro sensor. --> GBA Cart I/O Port (GPIO) Note: GPIO3 is connected to an external pulldown resistor (so the HighZ level gets dragged to Low=Off when direction is set to Input). Unknown if Drill Dozer is controlled via GPIO.Bit3, too? DS Rumble Pak Additionally, there's a Rumble Pak for the NDS, which connects to the GBA slot, so it can be used also for GBA games (provided that the game doesn't require the GBA slot, eg. GBA multiboot games). --> DS Cart Rumble Pak Gamecube Rumble Moreover, GBA games that are running on a Gameboy Player are having access to the Rumble function of Gamecube joypads. --> GBA Gameboy Player GBA Cart e-Reader ----------------- --> GBA Cart e-Reader Overview --> GBA Cart e-Reader I/O Ports --> GBA Cart e-Reader Dotcode Format --> GBA Cart e-Reader Data Format --> GBA Cart e-Reader Program Code --> GBA Cart e-Reader API Functions --> GBA Cart e-Reader VPK Decompression --> GBA Cart e-Reader Error Correction --> GBA Cart e-Reader File Formats ________________ | ShortStrip | |L L| |o Center o| |n Region n| |g g| | may contain | |S pictures, S| |t instructions t| |r etc. r| |i i| |p p| |___ShortStrip___| GBA Cart e-Reader Overview -------------------------- The e-Reader is a large GBA cartridge (about as big as the GBA console), with built-in dotcode scanning hardware. Dotcodes are tiny strips of black and white pixels printed on the edges of cardboard cards. The cards have to be pulled through a slot on the e-Reader, which is giving it a feeling like using a magnet card reader. The binary data on the dotcodes contains small games, either in native GBA code (ARM/THUMB), or in software emulated 8bit Z80 or NES/Famicom (6502) code. The e-Reader Hardware The hardware consists of regular 8MByte ROM and 128KByte FLASH chips, two link ports, a custom PGA chip, the camera module (with two red LEDs, used as light source), and some analogue components for generating the LED voltages, etc. The camera supports 402x302 pixels with 7bit monochrome color depth, but the PGA clips it to max 320 pixels per scanline with 1bit color depth. Link Port Plug/Socket The e-Reader's two link ports are simply interconnected with each other; without connection to the rest of the e-Reader hardware. These ports are used only on the original GBA (where the large e-Reader cartridge would be covering the GBA's link socket). When trying to insert the e-Reader into an original NDS (or GBA-Micro), then the e-Reader's link plug will hit against the case of the NDS, so it works only with some minor modification to the hardware. There's no such problem with GBA-SP and NDS-Lite. Region/Version There are 3 different e-Reader's: Japanese/Original, Japanese/Plus, and Non-Japanese. The Original version has only 64K FLASH, no Link Port, and reportedly supports only Z80 code, but no NES/GBA code. The Plus and Non-Japanese versions should be almost identical, except that they reject cards from the wrong region, and that the title strings aren't ASCII in Japan, the Plus version should be backwards compatible to the Original one. The Problem Nintendo's current programmers are definetly unable to squeeze a Pac-Man style game into less than 4MBytes. Their solution has been: MORE memory. That is, they've put a whopping 8MByte BIOS ROM into the e-Reader, which contains the User Interface, and software emulation for running some of their 20 years old 8bit NES and Game&Watch titles, which do fit on a few dotcode strips. GBA Cart e-Reader I/O Ports --------------------------- DF80000h Useless Register (R/W) 0 Output to PGA.Pin93 (which seems to be not connected to anything) 1-3 Unknown, read/write-able (not used by e-Reader BIOS) 4-15 Always zero (0) DFA0000h Reset Register (R/W) 0 Always zero (0) 1 Reset Something? (0=Normal, 1=Reset) 2 Unknown, always set (1) 3 Unknown, read/write-able (not used by e-Reader BIOS) 4-7 Always zero (0) 8 Unknown, read/write-able (not used by e-Reader BIOS) 9-15 Always zero (0) DFC0000h..DFC0027h Scanline Data (R) Scanline data (40 bytes, for 320 pixels, 1bit per pixel, 0=black, 1=white). The first (leftmost) pixel is located in the LSB of the LAST byte. Port E00FFB1h.Bit1 (and [4000202h].Bit13) indicates when a new scanline is present, the data should be then transferred to RAM via DMA3 (SAD=DFC0000h, DAD=buf+y*28h, CNT=80000014h; a slower non-DMA transfer method would result in missed scanlines). After the DMA, software must reset E00FFB1h.Bit1. Note: The scanning resolution is 1000 DPI. DFC0028h+(0..2Fh*2) Brightest Pixels of 8x6 Blocks (R) 0-6 Max Brightness (00h..7Fh; 00h=All black, 7Fh=One or more white) 7-15 Always zero Can be used to adjust the Port E00FF80h..E00FFAFh settings. DFC0088h Darkest Pixel of whole Image (R) 0-7 Max Darkness (00h..7Fh; 00h=One or more black, 7Fh=All white) 8-15 Always zero Can be used to adjust the Port E00FF80h..E00FFAFh settings. E00FF80h..E00FFAFh Intensity Boundaries for 8x6 Blocks (R/W) The 320x246 pixel camera input is split into 8x6 blocks (40x41 pixels each), with Block00h=Upper-right, Block07h=Upper-left, ..., Block27h=Lower-left. The boundary values for the separate blocks are used for 128-grayscale to 2-color conversion, probably done like "IF Pixel>Boundary THEN white ELSE black". 0-6 Block Intensity Boundaries (0..7Fh; 7Fh=Whole block gets black) 7 Always zero The default boundary values are stored in FLASH memory, the values are typically ranging from 28h (outer edges) to 34h (center image), that in respect to the light source (the two LEDs are emitting more light to the center region). E00FFB0h Control Register 0 (R/W) 0 Serial Data (Low/High) 1 Serial Clock (Low/High) 2 Serial Direction (0=Input, 1=Output) 3 Led/Irq Enable (0=Off, 1=On; Enable LED and Gamepak IRQ) 4 Start Scan (0=Off, 1=Start) (0-to-1 --> Resync line 0) 5 Phi 16MHz Output (0=Off, 1=On; Enable Clock for Camera, and for LED) 6 Power 3V Enable (0=Off, 1=On; Enable 3V Supply for Camera) 7 Not used (always 0) (sometimes 1) (Read only) E00FFB1h Control Register 1 (R/W) 0 Not used (always 0) 1 Scanline Flag (1=Scanline Received, 0=Acknowledge) 2-3 Not used (always 0) 4 Strange Bit (0=Normal, 1=Force Resync/Line0 on certain interval?) 5 LED Anode Voltage (0=3.0V, 1=5.1V; requires E00FFB0h.Bit3+5 to be set) 6 Not used (always 0) 7 Input from PGA.Pin22, always high (not used by e-Reader) (Read Only) Bit1 can be SET by hardware only, software can only RESET that bit, the Gamepak IRQ flag (Port 4000202h.Bit13) becomes set on 0-to-1 transitions. E00FFB2h Light Source LED Kathode Duration (LSB) (R/W) E00FFB3h Light Source LED Kathode Duration (MSB) (R/W) Selects the LED Kathode=LOW Duration, aka the LED=ON Duration. That does act as pulse width modulated LED brightness selection (the camera seems to react slowly enough to view the light as being dimmed to medium, rather than seeing the actual light ON and OFF states). The PWM timer seems to be clocked at 8MHz. The hardware clips timer values 2000h..FFFFh to max 2000h (=1ms). Additionally, the e-Reader BIOS clips values to max 11B3h. Default setting is found in FLASH calibration data. A value of 0000h disables the LED. Serial Port Registers (Camera Type 1) (DV488800) (calib_data[3Ch]=1) All 16bit values are ordered MSB,LSB. All registers are whole 8bit Read/Write-able, except 00h,57h-5Ah (read only), and 53h-55h (2bit only). Port Expl. (e-Reader Setting) 00h Maybe Chip ID (12h) (not used by e-Reader BIOS) (Read Only) 01h (05h) ;-Bit0: 1=auto-repeat scanning? 02h (0Eh) 10h-11h Vertical Scroll (calib_data[30h]+7) 12h-13h Horizontal Scroll (0030h) 14h-15h Vertical Size (00F6h=246) 16h-17h Horizontal Size (0140h=320) 20h-21h H-Blank Duration (00C4h) 22h-23h (0400h) ;-Upper-Blanking in dot-clock units? 25h (var) ;-bit1: 0=enable [57h..5Ah] ? 26h (var) ;\maybe a 16bit value 27h (var) ;/ 28h (00h) 30h Brightness/contrast (calib_data[31h]+/-nn) 31h-33h (014h,014h,014h) 34h Brightness/contrast (02h) 50h-52h 8bit Read/Write (not used by e-Reader BIOS) 53h-55h 2bit Read/Write (not used by e-Reader BIOS) 56h 8bit Read/Write (not used by e-Reader BIOS) 57h-58h 16bit value, used to autodetect/adjust register[30h] (Read Only) 59h-5Ah 16bit value, used to autodetect/adjust register[30h] (Read Only) 80h-FFh Mirrors of 00h..7Fh (not used by e-Reader BIOS) All other ports are unused, writes to those ports are ignored, and reads are returning data mirrored from other ports; that is typically data from 2 or more ports, ORed together. Serial Port Registers (Camera Type 2) (calib_data[3Ch]=2) All 16bit values are using more conventional LSB,MSB ordering, and port numbers are arranged in a more reasonable way. The e-Reader BIOS doesn't support (or doesn't require) brightness adjustment for this camera module. Port Expl. (e-Reader Setting) 00h (22h) 01h (50h) 02h-03h Vertical Scroll (calib_data[30h]+28h) 04h-05h Horizontal Scroll (001Eh) 06h-07h Vertical Size (00F6h) ;=246 08h-09h Horizontal Size (0140h) ;=320 0Ah-0Ch (not used by e-Reader BIOS) 0Dh (01h) 0Eh-0Fh (01EAh) ;=245*2 10h-11h (00F5h) ;=245 12h-13h (20h,F0h) ;maybe min/max values? 14h-15h (31h,C0h) ;maybe min/max values? 16h (00h) 17h-18h (77h,77h) 19h-1Ch (30h,30h,30h,30h) 1Dh-20h (80h,80h,80h,80h) 21h-FFh (not used by e-Reader BIOS) This appears to be a Micron (aka Aptina) camera (resembling the DSi cameras). My own e-Reader uses a Type 1 camera module. Not sure if Nintendo has ever manufactured any e-Readers with Type 2 cameras? Calibration Data in FLASH Memory (Bank 0, Sector 0Dh) E00D000 14h ID String ('Card-E Reader 2001',0,0) E00D014 2 Sector Checksum (NOT(x+x/10000h); x=sum of all other halfwords) Begin of actual data (40h bytes) E00D016 8x6 [00h] Intensity Boundaries for 8x6 blocks ;see E00FF80h..AFh E00D046 1 [30h] Vertical scroll (0..36h) ;see type1.reg10h/type2.reg02h E00D047 1 [31h] Brightness or contrast ;see type1.reg30h E00D048 2 [32h] LED Duration ;see E00FFB2h..B3h E00D04A 2 [34h] Not used? (0000h) E00D04C 2 [36h] Signed value, related to adjusting the 8x6 blocks E00D04E 4 [38h] Not used? (00000077h) E00D052 4 [3Ch] Camera Type (0=none,1=DV488800,2=Whatever?) Remaining bytes in this Sector... E00D056 FAAh Not used (zerofilled) (included in above checksum) Flowchart for Overall Camera Access ereader_scan_camera: call ereader_power_on call ereader_initialize for z=1 to number_of_frames for y=0 to 245 Wait until E00FFB1h.Bit1 gets set by hardware (can be handled by IRQ) Copy 14h halfwords from DFC0000h to buf+y*28h via DMA3 Reset E00FFB1h.Bit1 by software next y ;(could now check DFC0028h..DFC0086h/DFC0088h for adjusting E00FF00h..2Fh) ;(could now show image on screen, that may require to stop/pause scanning) next z call ereader_power_off Ret ereader_power_on: [4000204h]=5803h ;Init waitstates, and enable Phi 16MHz [DFA0000h].Bit1=1 Wait(10ms) [E00FFB0h]=40h ;Enable Power3V and reset other bits [DFA0000h].Bit1=0 [E00FFB1h]=20h ;Enable Power5V and reset other bits Wait(40ms) [E00FFB1h].Bit4=0 ;...should be already 0 ? [E00FFB0h]=40h+27h ;Phi16MHz=On, SioDtaClkDir=HighHighOut Ret ereader_power_off: [E00FFB0h]=04h ;Power3V=Off, Disable Everything, SioDtaClkDir=LowLowOut [DFA0000h].Bit1=0 ;...should be already 0 [E00FFB1h].Bit5=0 ;Power5V=Off Ret ereader_initialize: IF calib_data[3Ch] AND 03h = 1 THEN init_camera_type1 [E00FFB0h].Bit4=1 ;ScanStart IF calib_data[3Ch] AND 03h = 2 THEN init_camera_type2 Copy calib_data[00h..2Fh] to [E00FF80h+00h..2Fh] ;Intensity Boundaries Copy calib_data[32h..33h] to [E00FFB2h+00h..01h] ;LED Duration LSB,MSB [E00FFB0h].Bit3=1 ;LedIrqOn Ret init_camera_type1: x=MIN(0,calib_data[31h]-0Bh) Set Sio Registers (as shown for Camera Type 1, except below values...) Set Sio Registers [30h]=x [25h]=04h, [26h]=58h, [27h]=6Ch ;(could now detect/adjust based on Sio Registers [57h..5Ah]) Set Sio Registers [30h]=x [25h]=06h, [26h]=E8h, [27h]=6Ch Ret init_camera_type2: Wait(0.5ms) Set Sio Registers (as shown for Camera Type 2) Ret Accessing Serial Registers via E00FFB0h Begin Write(A) Write(B) Read(C) Read(D) End Idle PwrOff Dir ooooooo ooooooo ooooooo iiiiiii iiiiiii ooooooo ooooooo ooooooo Dta ---____ AAAAAAA BBBBBBB xxxxxCx xxxxxDx ______- ------- _______ Clk ------_ ___---_ ___---_ ___---_ ___---_ ___---- ------- _______ Flowchart for accessing Serial Registers via E00FFB0h (looks like I2C bus) Delay: Wait circa 2.5us, Ret SioBegin: SioDta=1, SioDir=Out, SioClk=1, Delay, SioDta=0, Delay, SioClk=0, Ret SioEnd: SioDta=0, SioDir=Out, Delay, SioClk=1, Delay, SioDta=1, Ret SioRead1bit: ;out: databit SioDir=In, Delay, SioClk=1, Delay, databit=SioDta, SioClk=0, Ret SioWrite1bit: ;in: databit SioDta=databit, SioDir=Out, Delay, SioClk=1, Delay, SioClk=0, Ret SioReadByte: ;in: endflag - out: data for i=7 to 0, data.bit=SioRead1bit, next i, SioWrite1bit(endflag), Ret SioWriteByte: ;in: data - out: errorflag for i=7 to 0, Delay(huh/why?), SioWrite1bit(data.bit), next i errorflag=SioRead1bit, SioDir=Out(huh/why?), Ret SioWriteRegisters: ;in: index, len, buffer SioBegin SioWriteByte(22h) ;command (set_index) (and write_data) SioWriteByte(index) ;index for i=0 to len-1 SioWriteByte(buffer[i]) ;write data (and auto-increment index) next SioEnd ret SioReadRegisters: ;in: index, len - out: buffer SioBegin SioWriteByte(22h) ;command (set_index) (without any write_data here) SioWriteByte(index) ;index SioBegin SioWriteByte(23h) ;command (read_data) (using above index) for i=0 to len-1 if i=len-1 then endflag=1 else endflag=0 buffer[i]=SioReadByte(endflag) ;read data (and auto-increment index) next SioEnd Ret Caution: Accessing the SIO registers appears highly unstable, and seems to require error handling with retries. Not sure what is causing that problem, possibly the registers cannot be accessed during camera-data-scans...? WAITCNT The e-Reader BIOS uses WAITCNT [4000204h]=5803h when accessing the PGA, that is, gamepak 16.78MHz phi output (bit11-12=3), 8 waits for SRAM region (bit0-1=3), gamepak prefetch enabled (bit14=1), also sets WS0 to 4,2 waits (bit2-4=0), and sets WS2 to odd 4,8 waits (bit8-10=0). The WS2 (probably WS0 too) settings are nonsense, and should work with faster timings (the e-Reader can be accessed in NDS mode, which doesn't support that slow timings). e-Reader Memory and I/O Map (with all used/unused/mirrored regions) C000000h-C7FFFFFh ROM (8MB) C800000h-DF7FFFFh Open Bus DF80000h-DF80001h Useless Register (R/W) DF80002h-DF9FFFFh Mirrors of DF80000h-DF80001h DFA0000h-DFA0001h Reset Register (R/W) DFA0002h-DFBFFFFh Mirrors of DFA0000h-DFA0001h DFC0000h-DFC0027h Scanline Data (320 Pixels) (R) DFC0028h-DFC0087h Brightest Pixels of 8x6 Blocks (R) DFC0088h Darkest Pixel of whole Image (R) DFC0089h-DFC00FFh Always zero DFC0100h-DFDFFFFh Mirrors of DFC0000h-DFC00FFh DFE0000h-DFFFFFFh Open Bus E000000h-E00CFFFh FLASH Bank 0 - Data E00D000h-E00DFFFh FLASH Bank 0 - Calibration Data E00E000h-E00EFFFh FLASH Bank 0 - Copy of Calibration Data E00F000h-E00FF7Fh FLASH Bank 0 - Unused region E000000h-E00EFFFh FLASH Bank 1 - Data E00F000h-E00FF7Fh FLASH Bank 1 - Unused region E00FF80h-E00FFAFh Intensity Boundaries for 8x6 Blocks (R/W) E00FFB0h Control Register 0 (R/W) E00FFB1h Control Register 1 (R/W) E00FFB2h-E00FFB3h LED Duration (16bit) (R/W) E00FFB4h-E00FFBFh Always zero E00FFC0h-E00FFFFh Mirror of E00FF80h-E00FFBFh Mind that WS2 should be accessed by LDRH/STRH, and SRAM region by LDRB/STRB. Additionally about 32 serial bus registers are contained in the camera module. Camera Module Notes The Type 1 initial setting on power-on is 402x302 pixels, the e-Reader uses only 320x246 pixels. The full vertical resolution could be probably used without problems. Port DFC0000h-DFC0027h are restricted to 320 pixels, so larger horizontal resolutions could be probably obtained only by changing the horizontal scroll offset on each 2nd scan. The camera output is 128 grayscales (via parallel 7bit databus), but the PGA converts it to 2 colors (1bit depth). For still images, it might be possible to get 4 grayshades via 3 scans with different block intensity boundary settings. No idea if the camera supports serial commands other than 22h and 23h. Namely, it be a quite obvious and basic feature to allow to receive the bitmap via the 2-wire serial bus (alternately to the 7bit databus), if supported, it'd allow to get 7bit images, bypassing 1bit PGA conversion. When used as actual camera (by cutting an opening in the case), the main problem is the 1bit color depth, which allows only black and white schemes, when/if solving that problem, focusing might be also a problem. Either the camera or the PGA seem to have a problem on white-to-black transitions in vertical direction, the upper some black pixels are sorts of getting striped or dithered. For example, scanning the large sync marks appears as: Actual Shape Scanned Shape XXXXX X X XXXXXXX X X X XXXXXXXXX X X X XX XXXXXXXXX X X X XX XXXXXXX XXXXXXX XXXXX XXXXX That appears only on large black shapes (the smaller data dots look better). Probably the image is scanned from bottom upwards (and the camera senses only the initial transition at the bottom, and then looses track of what it is doing). GBA Cart e-Reader Dotcode Format -------------------------------- Resolution is 342.39 DPI (almost 10 blocks per inch). Resolution is 134.8 dots/cm (almost 4 blocks per centimeter). The width and height of each block, and the spacing to the bottom edge of the card is ca. 1/10 inch, or ca. 4 millimeters. XXX BLOCK 1 XXX BLOCK 2 XXX XXXXX XXXXX XXXXX XXXXX X X X X X X X X X X X X XXXXX X X X X X X X X X X X X XXXXX XXXXX XXXXX XXXXX XXX HHHHHHHHHHHHHHHHHHHH...... XXX HHHHHHHHHHHHHHHHHHHH...... XXX .......................... .......................... ...... 3 short lines ..... .......................... A..................................A..................................A.. A.... 26 long lines ....A........ X = Sync Marks ........A.. A.... (each 34 data dots) ....A........ H = Block Header ........A.. A....(not all lines shown here)....A........ . = Data Bits ........A.. A..................................A........ A = Address Bits ........A.. ...... 3 short lines ..... .......................... ...(each 26 data dots).... .......................... XXX .......................... XXX .......................... XXX XXXXX XXXXX XXXXX XXXXX X X X X X X X X X X X X XXXXX X X X X X X X X X X X X XXXXX XXXXX XXXXX XXXXX XXX XXX XXX ___Snip____________________________________________________________________ Address Columns Each Column consists of 26 dots. From top to bottom: 1 black dot, 8 blank dots, 16 address dots (MSB topmost), and 1 blank dot. The 16bit address values can be calculated as: addr[0] = 03FFh for i = 1 to 53 addr[i] = addr[i-1] xor ((i and (-i)) * 769h) if (i and 07h)=0 then addr[i] = addr[i] xor (769h) if (i and 0Fh)=0 then addr[i] = addr[i] xor (769h*2) if (i and 1Fh)=0 then addr[i] = addr[i] xor (769h*4) xor (769h) next i Short strips use addr[1..19], long strips use addr[25..53], left to right. Block Header The 18h-byte Block Header is taken from the 1st two bytes (20 dots) of the 1st 0Ch blocks (and is then repeated in the 1st two bytes of further blocks). 00h Unknown (00h) 01h Dotcode type (02h=Short, 03h=Long) 02h Unknown (00h) 03h Address of 1st Block (01h=Short, 19h=Long) 04h Total Fragment Size (40h) ;64 bytes per fragment, of which, ;48 bytes are actual data, the remaining 05h Error-Info Size (10h) ;16 bytes are error-info 06h Unknown (00h) 07h Interleave Value (1Ch=Short, 2Ch=Long) 08h..17h 16 bytes Reed-solomon error correction info for Block Header Data 4-Bit to 5-bit Conversion In the Block Header (HHHHH), and Data Region (.....), each 4bit are expanded to 5bit, so one byte occupies 10 dots, and each block (1040 data dots) contains 104 bytes. 4bit 00h 01h 02h 03h 04h 05h 06h 07h 08h 09h 0Ah 0Bh 0Ch 0Dh 0Eh 0Fh 5bit 00h 01h 02h 12h 04h 05h 06h 16h 08h 09h 0Ah 14h 0Ch 0Dh 11h 10h That formatting ensures that there are no more than two continous black dots (in horizontal direction), neither inside of a 5bit value, nor between two 5bit values, however, the address bars are violating that rule, and up to 5 continous black dots can appear at the (..A..) block boundaries. Data Order Data starts with the upper bit of the 5bit value for the upper 4bit of the first byte, which is located at the leftmost dot of the upper line of the leftmost block, it does then extend towards rightmost dot of that block, and does then continue in the next line, until reaching the bottom of the block, and does then continue in the next block. The 1st two bytes of each block contain a portion of the Block Header, the remaining 102 bytes in each block contain data. Data Size A long strip consists of 28 blocks (28*104 = 2912 bytes), a short strip of 18 blocks (18*104 = 1872 bytes). Of which, less than 75% can be actually used for program code, the remaining data contains error correction info, and various headers. See Data Format for more info. Interleaved Fragments The Interleave Value (I) specifies the number of fragments, and does also specify the step to the next byte inside of a fragment; except that, at the block boundaries (every 104 bytes), the step is 2 bigger (for skipping the next two Block Header bytes). RAW Offset Content 000h..001h 1st 2 bytes of RAW Header 002h 1st byte of 1st fragment 003h 1st byte of 2nd fragment ... ... 002h+I-1 1st byte of last fragment 002h+I 2nd byte of 1st fragment 003h+I 2nd byte of 2nd fragment ... ... 002h+I*2-1 2nd byte of last fragment ... ... Each fragment consists of 48 actual data bytes, followed by 16 error correction bytes, followed by 0..2 unused bytes (since I*40h doesn't exactly match num_blocks*102). GBA Cart e-Reader Data Format ----------------------------- Data Strip Format The size of the data region is I*48 bytes (I=Interleave Value, see Dotcode Format), the first 48-byte fragment contains the Data Header, the remaining (I-1) fragments are Data Fragments (which contain title(s), and VPK compressed program code). First Strip Data Header (48 bytes) Main-Title (17 bytes, or 33 bytes) Sub-Title(s) (3+18 bytes, or 33 bytes) (for each strip) (optional) VPK Size (2 byte value, total length of VPK Data in ALL strips) NULL Value (4 bytes, contained ONLY in 1st strip of GBA strips) VPK Data (length as defined in VPK Size entry, see above) Further Strip(s) Data Header (48 bytes) Main-Title (17 bytes, or 33 bytes) Sub-Title(s) (3+18 bytes, or 33 bytes) (for each strip) (optional) VPK Data (continued from previous strip) Data Header (30h bytes) (1st fragment) 00h-01h Fixed (00h,30h) 02h Fixed (01h) ;01h="Do not calculate Global Checksum" ? 03h Primary Type (see below) 04h-05h Fixed (00h,01h) (don't care) 06h-07h Strip Size (0510h=Short, 0810h=Long Strip) ((I-1)*30h) (MSB,LSB) 08h-0Bh Fixed (00h,00h,10h,12h) 0Ch-0Dh Region/Type (see below) 0Eh Strip Type (02h=Short Strip, 01h=Long Strip) (don't care) 0Fh Fixed (00h) (don't care) 10h-11h Unknown (whatever) (don't care) 12h Fixed (10h) ;10h="Do calculate Data Checksum" ? 13h-14h Data Checksum (see below) (MSB,LSB) 15h-19h Fixed (19h,00h,00h,00h,08h) 1Ah-21h ID String ('NINTENDO') 22h-25h Fixed (00h,22h,00h,09h) 26h-29h Size Info (see below) 2Ah-2Dh Flags (see below) 2Eh Header Checksum (entries [0Ch-0Dh,10h-11h,26h-2Dh] XORed together) 2Fh Global Checksum (see below) Primary Type [03h] is 8bit, 0 Card Type (upper bit) (see below) 1 Unknown (usually opposite of Bit0) (don't care) 2-7 Unknown (usually zero) Region/Type [0Ch..0Dh] is 16bit, 0-3 Unknown (don't care) 4-7 Card Type (lower bits) (see below) 8-11 Region/Version (0=Japan/Original, 1=Non-japan, 2=Japan/Plus) 12-15 Unknown (don't care) Size Info [26h-29h] is 32bit, 0 Unknown (don't care) 1-4 Strip Number (01h..Number of strips) 5-8 Number of Strips (01h..0Ch) (01h..08h for Japan/Original version) 9-23 Size of all Strips (excluding Headers and Main/Sub-Titles) (same as "VPK Size", but also including the 2-byte "VPK Size" value, plus the 4-byte NULL value; if it is present) 24-31 Fixed (02h) (don't care) Flags [2Ah-2Dh] is 32bit, 0 Permission to save (0=Start Immediately, 1=Prompt for FLASH Saving) 1 Sub-Title Flag (0=Yes, 1=None) (Japan/Original: always 0=Yes) 2 Application Type (0=GBA/Z80, 1=NES) (Japan/Original: always 0=Z80) 3-31 Zero (0) (don't care) Data Checksum [13h-14h] is the complement (NOT) of the sum of all halfwords in all Data Fragments, however, it's all done in reversed byte order: checksum is calculated with halfwords that are read in MSB,LSB order, and the resulting checksum is stored in MSB,LSB order in the Header Fragment. Global Checksum [2Fh] is the complement (NOT) of the sum of the first 2Fh bytes in the Data Header plus the sum of all Data Fragment checksums; the Data Fragment checksums are all 30h bytes in a fragment XORed with each other. Titles (3+N bytes, or N bytes) Titles can be 33 bytes for both Main and Sub (Format 0Eh), or Main=17 bytes and Sub=3+18 bytes (Formats 02h..05h). In the 3+N bytes form, the first 3 bytes (24bit) are are used to display "stats" information in form of "HP: h1 ID: i1-i2-i3", defined as: Bit Expl. 0-3 h1, values 1..15 shown as "10..150", value 0 is not displayed 4-6 i3, values 0..7 shown as "A..G,#" 7-13 i2, values 0..98 shown as "01..99" values 99..127 as "A0..C8" 14-18 i1, values 0..31 shown as "A..Z,-,_,{HP},.,{ID?},:" 19-22 Unknown 23 Disable stats (0=Show as "HP: h1 ID: i1-i2-i3", 1=Don't show it) The N bytes portion contains the actual title, which must be terminated by 00h (so the max length is N-1 characters, if it is shorter than N-1, then the unused bytes are padded by further 00h's). The character set is normal ASCII for non-Japan (see Region/Version entry in header), and 2-byte SHIFT-JIS for Japanese long-titles (=max 16 2-byte chars) with values as so: 00h --> end-byte 81h,40h --> SPC 81h,43h..97h --> punctuation marks 82h,4Fh..58h --> "0..9" 82h,60h..79h --> "A..Z" 82h,81h..9Ah --> "a..z" And 1-byte chars for Japanese short-titles, 00 = end-byte 01 = spc 02..0B = 0..9 0C..AF = japanese B0..B4 = dash, male, female, comma, round-dot B5..C0 = !"%&~?/+-:.' C1..DA = A..Z DB..DF = unused (blank) E0..E5 = japanese E6..FF = a..z N/A = #$()*;<=>@[\]^_`{|} Additionally to the Main-Title, optional Sub-Titles for each strip can be included (see Sub-Title Flag in header). If enabled, then ALL strip titles are included in each strip (allowing to show a preview of which strips have/haven't been scanned yet). The e-Reader can display maximum of 8 sub-titles, if the data consists of more than 8 strips, then sub-titles aren't displayed (so it'd be waste of space to include them in the dotcodes). The Main Title gets clipped to 128 pixels width (that are, circa 22 characters), and, the e-Reader BIOS acts confused on multi-strip games with Main Titles longer than 26 characters (so the full 33 bytes may be used only in Japan; with 16bit charset). If the title is empty (00h-filled), and there is only one card in the application, then the application is started immediately. That, without allowing the user to save it in FLASH memory. Caution: Although shorter Titles do save memory, they do act unpleasant: the text "(C) P-Letter" will be displayed at the bottom of the loading screen. On Japanese/Original, 8bit sub-titles can be up to 18 characters (without any end-byte) (or less when stats are enabled, due to limited screen width). Card Types (Primary Type.Bit0 and Region/Type.Bit12-15) 00h..01h Blank Screen (?) 02h..03h Dotcode Application with 17byte-title, with stats, load music A 04h..05h Dotcode Application with 17byte-title, with stats, load music B 06h..07h P-Letter Attacks 08h..09h Construction Escape 0Ah..0Bh Construction Action 0Ch..0Dh Construction Melody Box 0Eh Dotcode Application with 33byte-title, without stats, load music A 0Fh Game specific cards 10h..1Dh P-Letter Viewer 1Eh..1Fh Same as 0Eh and 0Fh (see above) The 'Application' types are meant to be executable GBA/Z80/NES programs. GBA Cart e-Reader Program Code ------------------------------ The GBA/Z80/NES program code is stored in the VPK compressed area. NES-type is indicated by header [2Ah].Bit2, GBA-type is indicated by the NULL value inserted between VPK Size and VPK Data, otherwise Z80-type is used. GBA Format Load Address and Entrypoint are at 2000000h (in ARM state). The 32bit word at 2000008h is eventually destroyed by the e-Reader. Namely, IF e-Reader is Non-Japanese, AND [2000008h] is outside of range of 2000000h..20000E3h, AND only if booted from camera (not when booted from FLASH?), THEN [2000008h]=[2000008h]-0001610Ch ELSE [2000008h] kept intact Existing multiboot-able GBA binaries can be converted to e-Reader format by, Store "B 20000C0h" at 2000000h ;redirect to RAM-entrypoint Zerofill 2000004h..20000BFh ;erase header (for better compression rate) Store 01h,01h at 20000C4h ;indicate RAM boot The GBA code has full access to the GBA hardware, and may additionally use whatever API functions contained in the e-Reader BIOS. With the incoming LR register value, "mov r0,N, bx lr" returns to the e-Reader BIOS (with N being 0=Restart, or 2=To_Menu). No idea if it's necessary to preserve portions of RAM when returning to the e-Reader BIOS? Caution: Unlike for normal GBA cartridges/multiboot files, the hardware is left uninitialized when booting dotcodes (among others: sound DMA is active, and brightness is set to zero), use "mov r0,0feh, swi 010000h" to get the normal settings. NES Format Emulates a NES (Nintendo Entertainment System) console (aka Family Computer). The visible 240x224 pixel NES/NTSC screen resolution is resampled to 240x160 to match the smaller vertical resolution of the GBA hardware. So, writing e-Reader games in NES format will result in blurred screen output. The screen/sound/joypad is accessed via emulated NES I/O ports, program code is running on an emulated 6502 8bit CPU, for more info on the NES hardware, see no$nes debugger specifications, or http://problemkaputt.de/everynes.htm The e-Reader's NES emulator supports only 16K PRG ROM, followed by 8K VROM. The emulation accuracy is very low, barely working with some of Nintendo's own NES titles; running the no$nes diagnostics program on it has successfully failed on ALL hardware tests ;-) The load address for the 16K PRG-ROM is C000h, the 16bit NMI vector at [FFFAh] is encrypted like so: for i=17h to 0 for j=07h to 0, nmi = nmi shr 1, if carry then nmi = nmi xor 8646h, next j nmi = nmi xor (byte[dmca_data+i] shl 8) next i dmca_data: db 0,0,'DMCA NINTENDO E-READER' The 16bit reset vector at [FFFCh] contains: Bit0-14 Lower bits of Entrypoint (0..7FFFh = Address 8000h..FFFFh) Bit15 Nametable Mode (0=Vertical Mirroring, 1=Horizontal Mirroring) reportedly, (NES limitations, 1 16K program rom + 1-2 8K CHR rom, mapper 0 and 1) ines mapper 1 would be MMC1, rather than CNROM (ines mapper 3)? but, there are more or less NONE games that have 16K PRG ROM + 16K VROM? The L+R Button key-combination allows to reset the NES, however, there seems to be no way to return to the e-Reader BIOS. Z80/8080 Format The e-Reader doesn't support the following Z80 opcodes: CB [Prefix] E0 RET PO E2 JP PO,nn E4 CALL PO,nn 27 DAA 76 HALT ED [Prefix] E8 RET PE EA JP PE,nn EC CALL PE,nn D3 OUT (n),A DD [IX Prefix] F3 DI 08 EX AF,AF' F4 CALL P,nn DB IN A,(n) FD [IY Prefix] FB EI D9 EXX FC CALL M,nn xx RST 00h..38h That is leaving not more than six supported Z80 opcodes (DJNZ, JR, JR c/nc/z/nz), everything else are 8080 opcodes. Custom opcodes are: 76 WAIT A frames, D3 WAIT n frames, and C7/CF RST 0/8 used for API calls. The load address and entrypoint are at 0100h in the emulated Z80 address space. The Z80 doesn't have direct access to the GBA hardware, instead video/sound/joypad are accessed via API functions, invoked via RST 0 and RST 8 opcodes, followed by an 8bit data byte, and with parameters in the Z80 CPU registers. For example, "ld a,02h, rst 8, db 00h" does return to the e-Reader BIOS. The Z80/8080 emulation is incredibly inefficient, written in HLL code, developed by somebody whom knew nothing about emulation nor about ARM nor about Z80/8080 processors. Running GBA-code on Japanese/Original e-Reader Original e-Reader supports Z80 code only, but can be tweaked to run GBA-code: retry: ld bc,data // ld hl,00c8h ;src/dst lop: ld a,[bc] // inc bc // ld e,a ;lsb ld a,[bc] // inc bc // ld d,a ;msb dw 0bcfh ;aka rst 8 // db 0bh ;[4000000h+hl]=de (DMA registers) inc hl // inc hl // ld a,l cp a,0dch // jr nz,lop mod1 equ $+1 dw 37cfh ;aka rst 8 // db 37h ;bx 3E700F0h ;below executed only on jap/plus... on jap/plus, above 37cfh is hl=[400010Ch] ld a,3Ah // ld [mod1],a ;bx 3E700F0h (3Ah instead 37h) ld hl,1 // ld [mod2],hl // ld [mod3],hl ;base (0200010Ch instead 0201610Ch) jr retry data: mod2 equ $+1 dd loader ;40000C8h dma2sad (loader) ;\ dd 030000F0h ;40000CCh dma2dad (mirrored 3E700F0h) ; relocate loader dd 8000000ah ;40000D0h dma2cnt (copy 0Ah x 16bit) ;/ mod3 equ $+1 dd main ;40000D4h dma3sad (main) ;\prepare main reloc dd 02000000h ;40000D8h dma3dad (2000000h) ;/dma3cnt see loader .align 2 ;alignment for 16bit-halfword org $+201600ch ;jap/plus: adjusted to org $+200000ch loader: mov r0,80000000h ;(dma3cnt, copy 10000h x 16bit) mov r1,04000000h ;i/o base strb r1,[r1,208h] ;ime=0 (better disable ime before moving ram) str r0,[r1,0DCh] ;dma3cnt (relocate to 2000000h) mov r15,2000000h ;start relocated code at 2000000h in ARM state main: ;...insert/append whatever ARM code here... end GBA Cart e-Reader API Functions ------------------------------- Z80 Interface (Special Opcodes) db 76h ;Wait8bit A db D3h,xxh ;Wait8bit xxh db C7h,xxh ;RST0_xxh db CFh,xxh ;RST8_xxh ld r,[00xxh] ;get system values (addresses differ on jap/ori) ld r,[00C2h..C3h] ;GetKeyStateSticky (jap/ori: 9F02h..9F03h) ld r,[00C4h..C5h] ;GetKeyStateRaw (jap/ori: 9F04h..9F05h) ld r,[00C0h..C1h] ;see Exit and ExitRestart ld r,[00D0h..D3h] ;see Mul16bit For jap/ori, 9Fxxh isn't forwards compatible with jap/plus, so it'd be better to check joypad via IoRead. GBA Interface bx [30075FCh] ;ApiVector ;in: r0=func_no,r1,r2,r3,[sp+0],[sp+4],[sp+8]=params bx lr ;Exit ;in: r0 (0=Restart, 2=To_Menu) Wait8bit/Wait16bit The various Wait opcodes and functions are waiting as many frames as specified. Many API functions have no effect until the next Wait occurs. Z80 RST0_xxh Functions / GBA Functions 02xxh RST0_00h FadeIn, A speed, number of frames (0..x) RST0_01h FadeOut RST0_02h BlinkWhite RST0_03h (?) RST0_04h (?) blend_func_unk1 RST0_05h (?) RST0_06h (?) RST0_07h (?) RST0_08h (?) RST0_09h (?) _020264CC_check RST0_0Ah (?) _020264CC_free RST0_0Bh N/A (bx 0) RST0_0Ch N/A (bx 0) RST0_0Dh N/A (bx 0) RST0_0Eh N/A (bx 0) RST0_0Fh N/A (bx 0) RST0_10h LoadSystemBackground, A number of background (1..101), E bg# (0..3) RST0_11h SetBackgroundOffset, A=bg# (0..3), DE=X, BC=Y RST0_12h SetBackgroundAutoScroll RST0_13h SetBackgroundMirrorToggle RST0_14h (?) RST0_15h (?) RST0_16h (?) write_000000FF_to_02029494_ RST0_17h (?) RST0_18h (?) RST0_19h SetBackgroundMode, A=mode (0..2) RST0_1Ah (?) RST0_1Bh (?) RST0_1Ch (?) RST0_1Dh (?) RST0_1Eh (?) RST0_1Fh (?) RST0_20h LayerShow RST0_21h LayerHide RST0_22h (?) RST0_23h (?) RST0_24h ... [20264DCh+A*20h+1Ah]=DE, [20264DCh+A*20h+1Ch]=BC RST0_25h (?) RST0_26h (?) RST0_27h (?) RST0_28h (?) RST0_29h (?) RST0_2Ah (?) RST0_2Bh (?) RST0_2Ch (?) RST0_2Dh LoadCustomBackground, A bg# (0..3), DE pointer to struct_background, max. tile data size = 3000h bytes, max. map data size = 1000h bytes RST0_2Eh GBA: N/A - Z80: (?) RST0_2Fh (?) RST0_30h CreateSystemSprite, - - (what "- -" ???) RST0_31h SpriteFree, HL sprite handle RST0_32h SetSpritePos, HL=sprite handle, DE=X, BC=Y RST0_33h (?) sprite_unk2 RST0_34h SpriteFrameNext RST0_35h SpriteFramePrev RST0_36h SetSpriteFrame, HL=sprite handle, E=frame number (0..x) RST0_37h (?) sprite_unk3 RST0_38h (?) sprite_unk4 RST0_39h SetSpriteAutoMove, HL=sprite handle, DE=X, BC=Y RST0_3Ah (?) sprite_unk5 RST0_3Bh (?) sprite_unk6 RST0_3Ch SpriteAutoAnimate RST0_3Dh (?) sprite_unk7 RST0_3Eh SpriteAutoRotateUntilAngle RST0_3Fh SpriteAutoRotateByAngle RST0_40h SpriteAutoRotateByTime RST0_41h (?) sprite_unk8 RST0_42h SetSpriteAutoMoveHorizontal RST0_43h SetSpriteAutoMoveVertical RST0_44h (?) sprite_unk9 RST0_45h SpriteDrawOnBackground RST0_46h SpriteShow, HL=sprite handle RST0_47h SpriteHide, HL=sprite handle RST0_48h SpriteMirrorToggle RST0_49h (?) sprite_unk10 RST0_4Ah (?) sprite_unk11 RST0_4Bh (?) sprite_unk12 RST0_4Ch GetSpritePos RST0_4Dh CreateCustomSprite RST0_4Eh (?) RST0_4Fh (?) sprite_unk14 RST0_50h (?) sprite_unk15 RST0_51h (?) sprite_unk16 RST0_52h (?) sprite_unk17 RST0_53h (?) sprite_unk18 RST0_54h (?) RST0_55h (?) sprite_unk20 RST0_56h (?) RST0_57h SpriteMove RST0_58h (?) sprite_unk22 RST0_59h (?) sprite_unk23 RST0_5Ah (?) sprite_unk24 RST0_5Bh SpriteAutoScaleUntilSize, C=speed (higher value is slower), HL=sprite handle, DE=size (0100h = normal size, lower value = larger, higher value = smaller) RST0_5Ch SpriteAutoScaleBySize RST0_5Dh SpriteAutoScaleWidthUntilSize RST0_5Eh SpriteAutoScaleHeightBySize RST0_5Fh (?) RST0_60h (?) RST0_61h (?) RST0_62h (?) RST0_63h (?) RST0_64h hl=[[2024D28h+a*4]+12h] RST0_65h (?) sprite_unk25 RST0_66h SetSpriteVisible, HL=sprite handle, E=(0=not visible, 1=visible) RST0_67h (?) sprite_unk26 RST0_68h (?) set_sprite_unk27 RST0_69h (?) get_sprite_unk27 RST0_6Ah (?) RST0_6Bh (?) RST0_6Ch (?) RST0_6Dh (?) RST0_6Eh hl=[hl+000Ah] ;r0=[r1+0Ah] RST0_6Fh (?) RST0_70h (?) RST0_71h (?) RST0_72h (?) RST0_73h (?) RST0_74h (?) RST0_75h (?) RST0_76h (?) RST0_77h (?) RST0_78h (?) RST0_79h (?) RST0_7Ah (?) RST0_7Bh (?) RST0_7Ch (?) _0202FD2C_unk12 RST0_7Dh Wait16bit ;HL=num_frames (16bit variant of Wait8bit opcode/function) RST0_7Eh SetBackgroundPalette, HL=src_addr, DE=offset, C=num_colors (1..x) RST0_7Fh GetBackgroundPalette(a,b,c) RST0_80h SetSpritePalette, HL=src_addr, DE=offset, C=num_colors (1..x) RST0_81h GetSpritePalette(a,b,c) RST0_82h ClearPalette RST0_83h (?) _0202FD2C_unk11 RST0_84h (?) RST0_85h (?) RST0_86h (?) RST0_87h (?) _0202FD2C_unk8 RST0_88h (?) _0202FD2C_unk7 RST0_89h (?) RST0_8Ah (?) _0202FD2C_unk6 RST0_8Bh (?) _0202FD2C_unk5 RST0_8Ch GBA: N/A - Z80: (?) RST0_8Dh GBA: N/A - Z80: (?) RST0_8Eh (?) RST0_8Fh WindowHide RST0_90h CreateRegion, H=bg# (0..3), L=palbank# (0..15), D,E,B,C=x1,y1,cx,cy (in tiles), return: n/a (no$note: n/a ???) RST0_91h SetRegionColor RST0_92h ClearRegion RST0_93h SetPixel RST0_94h GetPixel RST0_95h DrawLine RST0_96h DrawRect RST0_97h (?) _0202FD2C_unk4 RST0_98h SetTextColor, A=region handle, D=color foreground (0..15), E=color background (0..15) RST0_99h DrawText, A=region handle, BC=pointer to text, D=X, E=Y (non-japan uses ASCII text, but japanese e-reader's use STH ELSE?) RST0_9Ah SetTextSize RST0_9Bh (?) RegionUnk7 RST0_9Ch (?) _0202FD2C_unk3 RST0_9Dh (?) _0202FD2C_unk2 RST0_9Eh (?) _0202FD2C_unk1 RST0_9Fh Z80: (?) - GBA: SetBackgroundModeRaw RST0_A0h (?) RST0_A1h (?) RST0_A2h (?) RegionUnk6 RST0_A3h GBA: N/A - Z80: (?) RST0_A4h GBA: N/A - Z80: (?) RST0_A5h (?) RST0_A6h (?) RST0_A7h (?) RST0_A8h (?) RST0_A9h (?) RST0_AAh (?) RST0_ABh (?) RST0_ACh (?) RST0_ADh (?) RegionUnk5 RST0_AEh [202FD2Ch+122h]=A RST0_AFh [202FD2Ch+123h]=A RST0_B0h [202FD2Ch+124h]=A RST0_B1h (?) RST0_B2h (?) RST0_B3h GBA: N/A - Z80: Sqrt ;hl=sqrt(hl) RST0_B4h GBA: N/A - Z80: ArcTan ;hl=ArcTan2(hl,de) RST0_B5h Sine ;hl=sin(a)*de RST0_B6h Cosine ;hl=cos(a)*de RST0_B7h (?) RST0_B8h (?) RST0_B9h N/A (bx 0) RST0_BAh N/A (bx 0) RST0_BBh N/A (bx 0) RST0_BCh N/A (bx 0) RST0_BDh N/A (bx 0) RST0_BEh N/A (bx 0) RST0_BFh N/A (bx 0) Below Non-Japan and Japan/Plus only (not Japan/Ori) RST0_C0h GetTextWidth(a,b) RST0_C1h GetTextWidthEx(a,b,c) RST0_C2h (?) RST0_C3h Z80: N/A (bx 0) - GBA: (?) RST0_C4h (?) RST0_C5h (?) RST0_C6h (?) RST0_C7h (?) RST0_C8h (?) RST0_C9h (?) RST0_CAh (?) RST0_CBh (?) RST0_CCh (?) RST0_CDh N/A (bx lr) RST0_CEh ;same as RST0_3Bh, but with 16bit mask RST0_CFh ;same as RST0_3Eh, but with 16bit de RST0_D0h ;same as RST0_3Fh, but with 16bit de RST0_D1h ;same as RST0_5Bh, but with 16bit de RST0_D2h ;same as RST0_5Ch, but with 16bit de RST0_D3h ;same as RST0_5Dh, but with 16bit de RST0_D4h ;same as RST0_5Eh, but with 16bit de RST0_D5h (?) RST0_D6h (?) RST0_D7h ;[202FD2Ch+125h]=A RST0_D8h (?) RST0_D9h (?) RST0_DAh (?) RST0_DBh ;A=[3003E51h] RST0_DCh ;[3004658h]=01h RST0_DDh DecompressVPKorNonVPK RST0_DEh FlashWriteSectorSingle(a,b) RST0_DFh FlashReadSectorSingle(a,b) RST0_E0h SoftReset RST0_E1h GetCartridgeHeader ;[hl+0..BFh]=[8000000h..80000BFh] RST0_E2h GBA: N/A - Z80: bx hl ;in: hl=addr, af,bc,de,sp=param, out: a RST0_E3h Z80: N/A (bx 0) - GBA: (?) RST0_E4h (?) RST0_E5h (?) RST0_E6h (?) RST0_E7h (?) RST0_E8h (?) RST0_E9h ;[2029498h]=0000h RST0_EAh Z80: N/A (bx 0) - GBA: InitMemory(a) RST0_EBh (?) BL_irq_sio_dma3 RST0_ECh ;hl = [3003E30h]*100h + [3003E34h] RST0_EDh FlashWriteSectorMulti(a,b,c) RST0_EEh FlashReadPart(a,b,c) RST0_EFh ;A=((-([2029416h] xor 1)) OR (+([2029416h] xor 1))) SHR 31 RST0_F0h (?) _unk1 RST0_F1h RandomInit ;in: hl=random_seed RST0_F2h (?) Below Japan/Plus only RST0_F3h (?) RST0_F4h (?) RST0_F5h (?) RST0_F6h (?) RST0_F7h GBA: N/A - Z80: (?) Below is undefined/garbage (values as so in Z80 mode) Jap/Ori: RST0_C0h N/A (bx 0) Jap/Ori: RST0_C1h..FFh Overlaps RST8 jump list Non-Jap: RST0_F3h..FFh Overlaps RST8 jump list Jap/Pls: RST0_F8h..FFh Overlaps RST8 jump list Z80 RST8_xxh Functions / GBA Functions 01xxh RST8_00h GBA: N/A - Z80: Exit ;[00C0h]=a ;(1=restart, 2=exit) RST8_01h GBA: N/A - Z80: Mul8bit ;hl=a*e RST8_02h GBA: N/A - Z80: Mul16bit ;hl=hl*de, s32[00D0h]=hl*de RST8_03h Div ;hl=hl/de RST8_04h DivRem ;hl=hl mod de RST8_05h PlaySystemSound ;in: hl=sound_number RST8_06h (?) sound_unk1 RST8_07h Random8bit ;a=random(0..FFh) RST8_08h SetSoundVolume RST8_09h BcdTime ;[de+0..5]=hhmmss(hl*bc) RST8_0Ah BcdNumber ;[de+0..4]=BCD(hl), [de+5]=00h RST8_0Bh IoWrite ;[4000000h+hl]=de RST8_0Ch IoRead ;de=[4000000h+hl] RST8_0Dh GBA: N/A - Z80: (?) RST8_0Eh GBA: N/A - Z80: (?) RST8_0Fh GBA: N/A - Z80: (?) RST8_10h GBA: N/A - Z80: (?) RST8_11h DivSigned ;hl=hl/de, signed RST8_12h RandomMax ;a=random(0..a-1) RST8_13h SetSoundSpeed RST8_14h hl=[202FD20h]=[2024CACh] RST8_15h hl=[2024CACh]-[202FD20h] RST8_16h SoundPause RST8_17h SoundResume RST8_18h PlaySystemSoundEx RST8_19h IsSoundPlaying RST8_1Ah (?) RST8_1Bh (?) RST8_1Ch (?) RST8_1Dh GetExitCount ;a=[2032D34h] RST8_1Eh Permille ;hl=de*1000/hl RST8_1Fh GBA: N/A - Z80: ExitRestart;[2032D38h]=a, [00C0h]=0001h ;a=? RST8_20h GBA: N/A - Z80: WaitJoypad ;wait until joypad<>0, set hl=joypad RST8_21h GBA: N/A - Z80: (?) RST8_22h (?) _sound_unk7 RST8_23h (?) _sound_unk8 RST8_24h (?) _sound_unk9 RST8_25h (?) _sound_unk10 RST8_26h Mosaic ;bgcnt.bit6=a.bit, [400004Ch]=de RST8_27h (?) RST8_28h (?) RST8_29h (?) RST8_2Ah (?) get_8bit_from_2030110h RST8_2Bh (?) RST8_2Ch (?) get_16bit_from_2030112h ;jap/ori: hl=[20077B2h] RST8_2Dh (?) get_16bit_from_2030114h ;jap/ori: hl=[20077B4h] RST8_2Eh (?) RST8_2Fh PlayCustomSound(a,b) Below not for Japanese/Original (the renumbered functions can be theoretically used on japanese/original) (but, doing so would blow forwards compatibility with japanese/plus) RST8_30h (ori: none) GBA: N/A - Z80: (?) RST8_31h (ori: none) PlayCustomSoundEx(a,b,c) RST8_32h (ori: RST8_30h) BrightnessHalf ;[4000050h]=00FFh,[4000054h]=0008h RST8_33h (ori: RST8_31h) BrightnessNormal ;[4000050h]=0000h RST8_34h (ori: RST8_32h) N/A (bx lr) RST8_35h (ori: RST8_33h) (?) RST8_36h (ori: RST8_34h) ResetTimer ;[400010Ch]=00000000h, [400010Eh]=A+80h RST8_37h (ori: RST8_35h) GetTimer ;hl=[400010Ch] RST8_38h (ori: none) GBA: N/A - Z80: (?) Below is undefined/reserved/garbage (values as so in Z80 mode) (can be used to tweak jap/ori to start GBA-code from inside of Z80-code) (that, after relocating code to 3000xxxh via DMA via IoWrite function) RST8_39h (ori: RST8_36h) bx 0140014h RST8_3Ah (ori: RST8_37h) bx 3E700F0h RST8_3Bh (ori: RST8_38h) bx 3E70000h+1 RST8_3Ch (ori: RST8_39h) bx 3E703E6h+1 RST8_3Dh (ori: RST8_3Ah) bx 3E703E6h+1 RST8_3Eh (ori: RST8_3Bh) bx 3E703E6h+1 RST8_3Fh (ori: RST8_3Ch) bx 3E703E6h+1 40h-FFh (ori: 3Dh-FFh) bx ... GBA Functions 03xxh (none such in Z80 mode) RSTX_00h Wait8bit ;for 16bit: RST0_7Dh RSTX_01h GetKeyStateSticky() RSTX_02h GetKeyStateRaw() RSTX_03h (?) RSTX_04h (?) GBA Cart e-Reader VPK Decompression ----------------------------------- vpk_decompress(src,dest) collected32bit=80000000h ;initially empty (endflag in bit31) for i=0 to 3, id[i]=read_bits(8), next i, if id[0..3]<>'vpk0' then error dest_end=dest+read_bits(32) ;size of decompressed data (of all strips) method=read_bits(8), if method>1 then error tree_index=0, load_huffman_tree, disproot=tree_index tree_index=tree_index+1, load_huffman_tree, lenroot=tree_index ;above stuff is contained only in the first strip. below loop starts at ;current location in first strip, and does then continue in further strips. decompress_loop: if read_bits(1)=0 then ;copy one uncompressed data byte, [dest]=read_bits(8), dest=dest+1 ;does work without huffman trees else if disproot=-1 or lenroot=-1 then error ;compression does require trees disp=read_tree(disproot) if method=1 ;disp*4 is good for 32bit ARM opcodes if disp>2 then disp=disp*4-8 else disp=disp+4*read_tree(disproot)-7 len=read_tree(lenroot) if len=0 or disp<=0 or dest+len-1>dest_end then error ;whoops for j=1 to len, [dest]=[dest-disp], dest=dest+1, next j if dest-1 ;loop until reaching data node if read_bits(1)=1 then i=node[i].right else i=node[i].left i=node[i].left ;get number of bits i=read_bits(i) ;read that number of bits ret(i) ;return that value load_huffman_tree stacktop=sp if read_bits(1)=1 then tree_index=-1, ret ;exit (empty) node[tree_index].right=-1 ;indicate data node node[tree_index].left=read_bits(8) ;store data value if read_bits(1)=1 then ret ;exit (only 1 data node at root) push tree_index ;save previous (child) node tree_index=tree_index+1 jmp data_injump load_loop: push tree_index ;save previous (child) node tree_index=tree_index+1 if read_bits(1)=1 then parent_node data_injump: node[tree_index].right=-1 ;indicate data node node[tree_index].left=read_bits(8) ;store data value jmp load_loop parent_node: pop node[tree_index].right ;store 1st child pop node[tree_index].left ;store 2nd child if sp<>stacktop then jmp load_loop if read_bits(1)=0 then error ;end bit (must be 1) ret The best values for the huffman trees that I've found are 6,9,12-bit displacements for method 0 (best for NES/Z80 code), and two less for method 1, ie. 4,7,10-bit (best for GBA code). And 2,4,10-bit for the length values. The smallest value in node 0, and the other values in node 10 and 11. Notes The decompression works similar to the GBA BIOS'es LZ77 decompression function, but without using fixed bit-widths of length=4bit and displacement=12bit, instead, the bit-widths are read from huffman trees (which can also define fixed bit-widths; if data is located directly in the root node). Unlike the GBA BIOS'es Huffman decompression function, the trees are starting with data entries, end are ending with the root entry. The above load function deciphers the data, and returns the root index. With the variable bit-widths, the VPK compression rate is quite good, only, it's a pity that the length/disp values are zero-based, eg. for 2bit and 4bit lengths, it'd be much better to assign 2bit as 2..5, and 4bit as 6..21. Non-VPK The e-Reader additionally supports an alternate decompression function, indicated by the absence of the "vpk0" ID, which supports compression of increasing byte-values, which isn't useful for program code. Bit15 of the VPK Size value seems to disable (de-)compression, the VPK Data field is then containing plain uncompressed data. GBA Cart e-Reader Error Correction ---------------------------------- The Error Correction Information that is appended at the end of the Block Header & Data Fragments consists of standard Reed-Solomon codes, which are also used for CD/DVD disks, DSL modems, and digital DVB television signals. That info allows to locate and repair a number of invalid data bytes. Below code shows how to create and verify error-info (but not how to do the actual error correction). The dtalen,errlen values should be 18h,10h for the Block Header, and 40h,10h for Data Fragments; the latter settings might be possible to get changed to other values though? append_error_info(data,dtalen,errlen) reverse_byte_order(data,dtalen) zerofill_error_bytes(data,errlen) for i=dtalen-1 to errlen ;loop across data portion z = rev[ data[i] xor data[errlen-1] ] ; for j=errlen-1 to 0 ;loop across error-info portion if j=0 then x=00h else x=data[j-1] if z<>FFh then y=gg[j], if y<>FFh then y=y+z, if y>=FFh then y=y-FFh x=x xor pow[y] data[j]=x next j next i invert_error_bytes(data,errlen) reverse_byte_order(data,dtalen) verify_error_info(data,dtalen,errlen) reverse_byte_order(data,dtalen) invert_error_bytes(data,errlen) make_rev(data,dtalen) for i=78h to 78h+errlen-1 x=0, z=0 for j=0 to dtalen-1 y=data[j] if y<>FFh then y=y+z, if y>=FFh then y=y-FFh x=x xor pow[y] z=z+i, if z>=FFh then z=z-FFh next j if x<>0 then error next i ;(if errors occured, could correct them now) make_pow(data,dtalen) invert_error_bytes(data,errlen) reverse_byte_order(data,dtalen) make_rev(data,len) for i=0 to len-1, data[i]=rev[data[i]], next i make_pow(data,len) for i=0 to len-1, data[i]=pow[data[i]], next i invert_error_bytes(data,len) for i=0 to len-1, data[i]=data[i] xor FFh, next i zerofill_error_bytes(data,len) for i=0 to len-1, data[i]=00h, next i reverse_byte_order(data,len) for i=0 to (len-1)/2, x=data[i], data[i]=data[len-i], data[len-i]=x, next i create_pow_and_rev_tables x=01h, pow[FFh]=00h, rev[00h]=FFh for i=00h to FEh pow[i]=x, rev[x]=i, x=x*2, if x>=100h then x=x xor 187h next i create_gg_table gg[0]=pow[78h] for i=1 to errlen-1 gg[i]=01h for j=i downto 0 if j=0 then y=00h else y=gg[j-1] x=gg[j], if x<>00h then x=rev[x]+78h+i, if x>=FFh then x=x-FFh y=y xor pow[x] gg[j]=y next j next i make_rev(gg,errlen) With above value of 78h, and errlen=10h, gg[00h..0Fh] will be always: 00h,4Bh,EBh,D5h,EFh,4Ch,71h,00h,F4h,00h,71h,4Ch,EFh,D5h,EBh,4Bh So using a hardcoded table should take up less memory than calculating it. Notes The actual error correction should be able to fix up to "errlen" errors at known locations (eg. data from blocks that haven't been scanned, or whose 5bit-to-4bit conversion had failed due to an invalid 5bit value), or up to "errlen/2" errors at unknown locations. The corrected data isn't guaranteed to be correct (even if it looks okay to the "verify" function), so the Data Header checksums should be checked, too. More Info For more info, I've found Reed-Solomon source code from Simon Rockliff, and an updated version from Robert Morelos-Zaragoza and Hari Thirumoorthy to be useful. For getting started with that source, some important relationships & differences are: pow = alpha_to, but generated as shown above rev = index_of, dito b0 = 78h nn = dtalen kk = dtalen-errlen %nn = MOD FFh (for the ereader that isn't MOD dtalen) -1 = FFh And, the ereader processes data/errinfo backwards, starting at the last byte. GBA Cart e-Reader File Formats ------------------------------ .BMP Files (homebrew 300 DPI strips) Contains a picture of the whole dotcode strip with address bars and sync marks (see Dotcode chapter) in Microsoft's Bitmap format. The image is conventionally surrounded by a blank 2-pixel border, resulting in a size of 989x44 pixels for long strips. The file should should have 1bit color depth. The pixels per meter entry should match the desired printing resolution, either 300 DPI or 360 DPI. But, resolution of printer hardware is typically specified in inch rather than in meters, so an exact match isn't supported by Microsoft. Most homebrew .BMP files contain nonsense resolutions like 200 DPI, or 300 dots per meter (ca. 8 DPI). .JPG Files (scanned 1200 DPI strips) Same as BMP, but should contain a dotcode scanned at 1200 DPI, with correct orientation (the card-edge side at the bottom of the image), and containing only the dotcode (not the whole card), so the JPG size should be about 3450x155 pixels for long strips. No$gba currently doesn't work with progressive JPGs. Scans with white background can be saved as monochrome JPG. Scans with red/yellow background should contain a correct RED layer (due to the red LED light source) (the brightness of the green/blue layers can be set to zero for better compression). .RAW Files Contains the "raw" information from the BMP format, that is, 2-byte block header, 102-byte data, 2-byte block header, 102-byte data, etc. The data portion is interleaved, and includes the full 48-byte data header, titles, vpk compressed data, error-info, and unused bytes. RAW files are excluding Address Bars, Sync Marks, and 4bit-to-5bit encoding. Each RAW file contains one or more strip(s), so the RAW filesize is either 18*104 bytes (short strip), or 28*104 bytes (long strip), or a multiple thereof (if it contains more than one strip) (although multi-strip games are often stored in separate files for each strip; named file1.raw, file2.raw, etc). .BIN Files Filesize should be I*30h, with I=1Ch for short strips, and I=2Ch for long strips, or a multiple thereof (if it contains more than one strip). Each strip consists of the 48-byte Data Header, followed by title(s), and vpk compressed data. Unlike .RAW files, .BIN files aren't interleaved, and do not contain Block Headers, nor error-info, nor unused bytes (in last block). The files do contain padding bytes to match a full strip-size of I*30h. Caution: Older .BIN files have been using a size-reduced 12-byte header (taken from entries 0Dh, 0Ch, 10h-11h, 26h-2Dh of the 48-byte Data Header; in that order), that files have never contained more than one strip per file, so the filesize should be exactly I*30h-36, the size-reduced header doesn't contain a Primary Type entry, so it's everyone's bet which Card Type is to be used (hint: the 12-byte headers were based on the assumption that Primary Type would be always 01h on Short Strips, and 02h on Long Strips). .SAV Files Contains a copy of the e-Reader's 128Kbyte FLASH memory. With the saved e-Reader application being located in the 2nd 64K-bank, the data consists of a header with title and gba/nes/z80 format info, followed by the vpk compressed data. The FLASH memory does also contain e-Reader calibration settings, the remaining 100Kbytes are typically FFh-filled. GBA Cart Unknown Devices ------------------------ GBA Infra-Red Port (AGB-006) No info? GBA Cart Protections -------------------- Classic NES Series These are some NES/Famicom games ported or emulated to work on GBA. The games are doing some uncommon stuff that can cause compatibility problems when not using original GBA consoles or cartridges. - CPU pipeline (selfmodifying code that shall NOT affect prefetched opcodes) - STMDA write to I/O ports (writes in INCREASING order, not DECREASING order) - SRAM detection (refuses to run if SRAM exists; the games do contain EEPROM) - ROM mirrors (instead of the usual increasing numbers in unused ROM area) - RAM mirrors (eg. main RAM accessed at 2F00000h instead of 2000000h) Note: These games can be detected by checking [80000ACh]="F" (ie. game code="Fxxx"). GBA Flashcards -------------- Flashcards are re-writable cartridges using FLASH memory, allowing to test even multiboot-incompatible GBA software on real hardware, providing a good development environment when used in combination with a reasonable software debugger. The carts can be written to from external tools, or directly from GBA programs. Below are pseudo code flowcharts for detect, erase, and write operations. All flash reads/writes are meant to be 16bit (ldrh/strh) memory accesses. detect_flashcard: configure_flashcard(9E2468Ah,9413h) ;unlock flash advance cards turbo=1, send_command(8000000h,90h) ;enter ID mode (both chips, if any) maker=[8000000h], device=[8000000h+2] IF maker=device THEN device=[8000000h+4] ELSE turbo=0 flashcard_read_mode ;exit ID mode search (maker+device*10000h) in device_list total/erase/write_block_size = list_entry SHL turbo flashcard_erase(dest,len): FOR x=1 to len/erase_block_size send_command(dest,20h) ;erase sector command send_command(dest,D0h) ;confirm erase sector dest=dest+erase_block_size IF wait_busy=okay THEN NEXT x enter_read_mode ;exit erase/status mode flashcard_write(src,dest,len): siz=write_block_size FOR x=1 to len/siz IF siz=2 THEN send_command(dest,10h) ;write halfword command IF siz>2 THEN send_command(dest,E8h) ;write to buffer command IF siz>2 THEN send_command(dest,16-1) ;buffer size 16 halfwords (per chip) FOR y=1 TO siz/2 [dest]=[src], dest=dest+2, src=src+2 ;write data to buffer NEXT y IF siz>2 THEN send_command(dest,D0h) ;confirm write to buffer IF wait_busy=okay THEN NEXT x enter_read_mode ;exit write/status mode send_command(adr,val): [adr]=val IF turbo THEN [adr+2]=val enter_read_mode: send_command(8000000h,FFh) ;exit status mode send_command(8000000h,FFh) ;again maybe more stable (as in jeff's source) flashcard_wait_busy: start=time REPEAT stat=[8000000h] XOR 80h IF turbo THEN stat=stat OR ([8000000h+2] XOR 80h) IF (stat AND 7Fh)>0 THEN error IF (stat AND 80h)=0 THEN ready IF time-start>5secs THEN timeout UNTIL ready OR error OR timeout IF error OR timeout THEN send_command(8000000h,50h) ;clear status configure_flashcard(adr,val): ;required for Flash Advance cards only [930ECA8h]=5354h [802468Ah]=1234h, repeated 500 times [800ECA8h]=5354h [802468Ah]=5354h [802468Ah]=5678h, repeated 500 times [930ECA8h]=5354h [802468Ah]=5354h [8ECA800h]=5678h [80268A0h]=1234h [802468Ah]=ABCDh, repeated 500 times [930ECA8h]=5354h [adr]=val init_backup: ;no info how to use that exactly configure_flashcard(942468Ah,???) device_list: (id code, total/erase/write sizes in bytes) ID Code Total Erase Write Name -??-00DCh ? ? ? Hudson Cart (???) 00160089h 4M 128K 32 Intel i28F320J3A (Flash Advance) 00170089h 8M 128K 32 Intel i28F640J3A (Flash Advance) 00180089h 16M 128K 32 Intel i28F128J3A (Flash Advance) 00E200B0h ? 64K 2 Sharp LH28F320BJE ? (Nintendo) Notes All flashcards should work at 4,2 waitstates (power on default), most commercial games change waits to 3,1 which may work unstable with some/older FA flashcards. Intel FLASH specified to have a lifetime of 100,000 erases, and average block erase time 1 second (up to 5 second in worst cases). Aside from the main FLASH memory, Flash Advance (FA) (aka Visoly) cards additionally contain battery buffered SRAM backup, and FLASH backup, and in some cases also EEPROM backup. Turbo FA cards are containing two chips interlaced (at odd/even halfword addresses), allowing to write/erase both chips simultaneously, resulting in twice as fast programming time. Standard Nintendo flash carts have to be modified before you can actually write to them. This is done by removing resistor R7 and putting it at empty location R8. Mind that write/erase/detect modes output status information in ROM area, so that in that modes all GBA program code (and any interrupt handlers) must be executed in WRAM, not in ROM. Thanks to Jeff Frohwein for his FAQ and CARTLIB sample in FLGBA at devrs.com GBA Cheat Devices ----------------- Codebreaker (US) aka Xploder (EUR). Gameshark (US) aka Action Replay (EUR). --> GBA Cheat Codes - General Info --> GBA Cheat Codes - Codebreaker/Xploder --> GBA Cheat Codes - Gameshark/Action Replay V1/V2 --> GBA Cheat Codes - Pro Action Replay V3 GBA Cheat Codes - General Info ------------------------------ Cheat devices are external adapters, connected between the GBA and the game cartridge. The devices include a BIOS ROM which is, among others, used to prompt the user to enter cheat codes. These codes are used to patch specified memory locations for a certain GBA game, allowing the user to gain goodies such like Infinite sex, 255 Cigarettes, etc. ROM and RAM Patches For ROM Patches, the device watches the address bus, if it matches a specified address then it outputs a patched value to the data bus, that mechanism is implemented by hardware, aside from the Hook Enable Code some devices also allow a limited number of cheats to use ROM patches. Most cheat codes are RAM patches, each time when the hook procedure is executed it will process all codes and overwrite the specified addresses in RAM (or VRAM or I/O area) by the desired values. Enable Codes (Must Be On) Enable codes usually consist of the Game ID, Hook Address, and eventually a third code used to encrypt all following codes. The Game ID is used to confirm that the correct cartridge is inserted, just a verification, though the device may insist on the ID code. The Hook Address specifies an address in cartridge ROM, and should point to an opcode which is executed several times per second (eg. once per frame, many codes place the hook in the joypad handler). At the hook address, the device redirects to its own BIOS, processes the RAM patches, and does then return control to the game cartridge. Note: The hook address should not point to opcodes with relative addressing (eg. B, BL, LDR Rd,=Imm, ADD Rd,=Imm opcodes - which are all relative to PC program counter register). Alignment Addresses for 16bit or 32bit values should be properly aligned. GBA Cheat Codes - Codebreaker/Xploder ------------------------------------- Codebreaker Codes 0000xxxx 000y Enable Code 1 - Game ID 1aaaaaaa 000z Enable Code 2 - Hook Address 2aaaaaaa yyyy [aaaaaaa]=[aaaaaaa] OR yyyy 3aaaaaaa 00yy [aaaaaaa]=yy 4aaaaaaa yyyy [aaaaaaa+0..(cccc-1)*ssss]=yyyy+0..(cccc-1)*ssss iiiicccc ssss parameters for above code 5aaaaaaa cccc [aaaaaaa+0..(cccc-1)]=11,22,33,44,etc. 11223344 5566 parameter bytes 1..6 for above code (example) 77880000 0000 parameter bytes 7..8 for above code (padded with zero) 6aaaaaaa yyyy [aaaaaaa]=[aaaaaaa] AND yyyy 7aaaaaaa yyyy IF [aaaaaaa]=yyyy THEN (next code) 8aaaaaaa yyyy [aaaaaaa]=yyyy 9xyyxxxx xxxx Enable Code 0 - Encrypt all following codes (optional) Aaaaaaaa yyyy IF [aaaaaaa]<>yyyy THEN (next code) Baaaaaaa yyyy IF [aaaaaaa]>yyyy THEN (next code) (signed comparison) Caaaaaaa yyyy IF [aaaaaaa] THEN 00000000 60000000 ELSE (?) 00000000 40000000 ENDIF (?) 00000000 0800xx00 AR Slowdown : loops the AR xx times 00000000 00000000 End of the code list 00000000 10aaaaaa 000000zz 00000000 IF AR_BUTTON THEN [a0aaaaa]=zz 00000000 12aaaaaa 0000zzzz 00000000 IF AR_BUTTON THEN [a0aaaaa]=zzzz 00000000 14aaaaaa zzzzzzzz 00000000 IF AR_BUTTON THEN [a0aaaaa]=zzzzzzzz 00000000 18aaaaaa 0000zzzz 00000000 [8000000+aaaaaa*2]=zzzz (ROM Patch 1) 00000000 1Aaaaaaa 0000zzzz 00000000 [8000000+aaaaaa*2]=zzzz (ROM Patch 2) 00000000 1Caaaaaa 0000zzzz 00000000 [8000000+aaaaaa*2]=zzzz (ROM Patch 3) 00000000 1Eaaaaaa 0000zzzz 00000000 [8000000+aaaaaa*2]=zzzz (ROM Patch 4) 00000000 80aaaaaa 000000yy ssccssss repeat cc times [a0aaaaa]=yy (with yy=yy+ss, a0aaaaa=a0aaaaa+ssss after each step) 00000000 82aaaaaa 0000yyyy ssccssss repeat cc times [a0aaaaa]=yyyy (with yyyy=yyyy+ss, a0aaaaa=a0aaaaa+ssss*2 after each step) 00000000 84aaaaaa yyyyyyyy ssccssss repeat cc times [a0aaaaa]=yyyyyyyy (with yyyy=yyyy+ss, a0aaaaa=a0aaaaa+ssss*4 after each step) Warning: There is a bug on the real AR (v2 upgraded to v3, and maybe on real v3) with the 32bit Increment Slide code. You HAVE to add a code (best choice is 80000000 00000000 : add 0 to value at address 0) right after it, else the AR will erase the 2 last 8 digits lines of the 32 Bits Inc. Slide code when you enter it !!! Final Notes The 'turn off all codes' makes an infinite loop (that can't be broken, unless the condition becomes True). - How? By Interrupt? Huh? ROM Patch1 works on real V3 and, on V1/V2 upgraded to V3. ROM Patch2,3,4 work on real V3 hardware only. Pro Action Replay V3 Conditional Codes - iiaaaaaa yyyyyyyy The 'ii' is composed of + + . 08 Equal = 00 8bit zz 00 execute next code 10 Not equal <> 02 16bit zzzz 40 execute next two codes 18 Signed < 04 32bit zzzzzzzz 80 execute all following 20 Signed > 06 (always false) codes until ELSE or ENDIF 28 Unsigned < C0 normal ELSE turn off all codes 30 Unsigned > 38 Logical AND For example, ii=18h+02h+40h=5Ah, produces IF [a0aaaaa]