gba-link-connection/docs/wireless_adapter.md

Game Boy Advance Wireless Adapter

• 🌎 Original post: https://blog.kuiper.dev/gba-wireless-adapter 🌎
• ✏️ Updates: @davidgfnet and I were discovering new things and we added them here!

The Wireless Adapter

The Game Boy Advance Wireless Adapter

The wireless adapter is a piece of hardware that connects to the link cable port of a GBA that then communicates wirelessly with other adapters. It also contains a multibootable1 rom for playing games only one player has a copy of (although I am not aware of many games that use it, some NES classic games use this). However, the most notable games to use it is probably the Pokémon games Fire Red, Leaf Green and Emerald (Sapphire and Ruby do not have wireless adapter support)2.

You can make this screen display any game

Communicating with the adapter

When I started, I used the following resources to start being able to talk with the wireless adapter:

• This Gist contains some details
• GBATEK has a section on the wireless adapter

Pinout

The wireless adapter connects using the link cable port to the GBA. It uses

• 3.3V
• Serial In
• Serial out
• SD
• Clock
• Ground

which is all 6 of the pins. If you are going to mess with interfacing with the link cable yourself, make sure you know which pin is which. If you just want to use the wireless adapter as part of the GBA this isn’t relevant.

Serial Peripheral Interface

Broadly speaking the GBA communicates with the wireless adapter using the Serial Peripheral Interface (SPI), however it can be somewhat weird. In the case of the GBA this is a three or four wire protocol depending on how you count. The clock, two data wires, and what is normally chip select but operates more as a reset.

The reason you would have a chip select normally is because then you can reuse the other three wires across all the chips on your board and switch using the chip select. On the GBA we only have one other device on this bus, so a chip select isn’t really an apt term for it.

A logic analyser can be used to probe the link cable protocol between the GBA and a Wireless Adapter

I will break up the ways in which you communicate into three parts:

• Initialisation
• Commands
• Waiting for data

One thing to make note of is that when I have screenshots showing the logic analyser traces, these all come from Pokémon Emerald as it is what I had at the time I did a lot of this.

Initialisation

The initialisation sequence captured using a logic analyser

Before starting sending and receiving commands, a handshake with the adapter needs to be done. During this, the clocks runs at 256 kHz. Real games start this process by resetting the adapter.

To reset you take the reset line high. Most people refer to this as SD. You can see this in the figure.

After this the GBA sends a single command, although we will ignore this for now.

Next is the Nintendo Exchange.

Nintendo Exchange

The GBA and the adapter exchange the word “NINTENDO” with each other in quite a strange way.

GBA sends 0x7FFF494E and wireless adapter sends 0x00000000.

The GBA here sends 0x7FFF494E, of this the relevant part is the 0x494E. If we look up what the bytes 0x49, 0x4E are you will find them to be the letters NI. As exchanges happen simultaneously, at this point the adapter doesn’t know what to respond with and so responds with all zeros.

GBA sends 0xFFFF494E and wireless adapter sends 0x494EB6B1.

Next the GBA sends 0xFFFF494E and now the wireless adapter does respond and responds with 0x494EB6B1. I can assure you there is a pattern here:

• GBA:
  • Two most significant bytes are the inverse of the adapters previous most significant bytes.
  • Two least significant bytes are the GBA’s own data.
• Adapter:
  • Two least significant bytes are the inverse of the GBA’s previous least significant bytes.
  • Two most significant bytes are the adapters own data.

The “own” data are the bytes of the string “NINTENDO”, and you advance to the next pair when the most significant bytes equal the inverse of the least significant bytes.

Following these rules the transfer looks like

GBA	Adapter
0x7FFF494E	0x00000000
0xFFFF494E	0x494EB6B1
0xB6B1494E	0x494EB6B1
0xB6B1544E	0x544EB6B1
0xABB1544E	0x544EABB1
0xABB14E45	0x4E45ABB1
0xB1BA4E45	0x4E45B1BA
0xB1BA4F44	0x4F44B1BA
0xB0BB4F44	0x4F44B0BB
0xB0BB8001	0x8001B0BB

Although note that due to the rules, the first few transfers may contain some junk data and be different to this in practice. And after this, you can start sending commands.

Commands

A command being sent by the GBA and acknowledged by the adapter

Commands are how you tell the adapter to do things. When in command mode the clock operates at 2 mHz. Some examples of commands include connect to adapter, send message, and receive message. All commands follow the same form:

• Command

  The command is a 32 bit value of the form 0x9966LLCC:

  • LL
    • The length of the data payload in number of 32 bit values. For example here it is 0x01, so one value is transmitted after this.
  • CC
    • The command type, there are a bunch of these! In this case the command type is 0x17.

• Data

  All the data along with the command, must transmit the number given in the command

• Acknowledge

  The adapter responds with a command, the length is the number of 32 bit values and the command type is always what you send + 0x80. In this case the length is zero and the command is 0x17 + 0x80 = 0x97.

  • ⚠️ When you send invalid commands or a one you're not supposed to send in the current state (like sending a 0x1d before a 0x1c), the adapter responds 0x996601ee. If you read the next word (as the response size is 01), it gives you an error code (2 when using an invalid command, 1 when using a valid command in an invalid state, or 0).

• Response

  The data that the adapter responds with. Equal to the length given in the acknowledgement.

• Ready

  In the figure, you’ll see that after exchanging any 32 bit value using SPI, some out of clock communication happens. This is the GBA and the Adapter signalling to each other that they are ready to communicate. This happens over the following stages:

  1. The GBA goes low as soon as it can.
  2. The adapter goes high.
  3. The GBA goes high.
  4. The adapter goes low when it’s ready.
  5. The GBA goes low when it’s ready.
  6. The GBA starts a transfer, clock starts pulsing, and both sides exchange the next 32 bit value.

⌛ If this acknowledge procedure doesn't complete, the adapter "gives up" after ~800μs and start listening again for commands. That means that if a game doesn't implement this logic, it has to wait almost 1 millisecond between transfers (vs ~40μs in normal scenarios).

🔀 Also, the ACK protocol is different after a Wait command:

1.  The GBA goes high as soon as it can.
2.  The adapter goes high.
3.  The GBA goes low _when it’s ready_.
4.  The adapter goes low when it’s ready.
5.  The adapter starts a transfer, clock starts pulsing, and both sides exchange the next 32 bit value.

Whenever either side expects something to be sent from the other (as SPI is always dual direction, although one side is often not used), the value 0x80000000 is used.

List of commands

Hello - 0x10

• Send length: 0, Response length: 0

• First thing to be called after finishing the initialisation sequence.

Setup - 0x17

• Send length: 1, response length: 0

• Games set this. It seems to setup the adapter's configuration.

Both Pokemon games and the multiboot ROM that the adapter sends when no cartridge is inserted use 0x003C0420.

Broadcast - 0x16

• Send length: 6, response length: 0

• The data to be broadcast out to all adapters. Examples of use include the union room, broadcasting game name and username in download play, and the username in direct multiplayer in Pokémon.

💻 This is the first command used to start a server. The 6 parameters are the ASCII characters of the game and user name, plus some bytes indicating whether the server should appear in the Download Play list or not. Here's a byte by byte explanation:

(if you read from right to left, it says ICE CLIMBER - NINTENDO)

🆔 The Game ID is what games use to avoid listing servers from another game. This is done on the software layer (GBA), the adapter does not enforce this in any way, nor does gba-link-connection.

🔥 This command can be called to update the broadcast data even when the server has already started using StartHost. Some games include metadata in the game/user name fields, such as the player's gender or a busy flag.

StartHost - 0x19

• Send length: 0, response length: 0

• This uses the broadcast data given by the broadcast command and actually does the broadcasting.

EndHost - 0x1b

• Send length: 0, response length: 2+

• This command stops host broadcast. This allows to "close" the session and stop allowing new clients, but also keeping the existing connections alive. Sends and Receives still work, but:

  • Clients cannot connect, even if they already know the host ID (FinishConnection will fail).
  • Calls to AcceptConnections on the host side will fail.

BroadcastRead - 0x1d, 0x1e and 0x1c

• Send length: 0, response length: 7 * number of broadcasts

• All currently broadcasting devices are returned here along with an ID at the start of each.

• IDs have 16 bits.

🆔 IDs are randomly generated. Each time you broadcast or connect, the adapter assigns you a new id.

✅ Reading broadcasts is a three-step process: First, you send 0x1c (you will get an ACK instantly), and start waiting until the adapter retrieves data (games usually wait 1 full second). Then, send a 0x1d and it will return what's described above. Lastly, send a 0x1e to finish the process (you can ignore what the adapter returns here). If you don't send that last 0x1e, the next command will fail.

⌚ Although games wait 1 full second, small waits (like ~160ms) also work.

⏳ If a client sends a 0x1c and then starts a 0x1d loop (1 command per frame), and a console that was broadcasting is turned off, it disappears after 3 seconds.

AcceptConnections - 0x1a

• Send length: 0, response length: 0+

• Accepts new connections and returns a list with the connected adapters. The length of the response is zero if there are no connected adapters.

• It includes one value per connected client, in which the most significant byte is the clientNumber (see IsFinishedConnect) and the least significant byte is the ID.

🔗 If this command reports 3 connected consoles, after turning off one of them, it will still report 3 consoles. Servers need to detect timeouts in another way.

Connect - 0x1f

• Send length: 1, response length: 0

• Send the ID of the adapter you want to connect to from BroadcastRead.

IsFinishedConnect - 0x20

• Send length: 0, response length: 1

• Responds with 16 bit ID as lower 16 bits if finished, otherwise responds with 0x01000000.

👆 It also responds in its bits 16 and 17 a number that represents the clientNumber (0 to 3). Lets say our ID is abcd, it will respond 0x0000abcd if we are the first client that connects to that server, 0x0001abcd if we are the second one, 0x0002abcd third, and 0x0003abcd fourth. Games allow 5 simultaneous adapters at max.

FinishConnection - 0x21

• Send length: 0, response length: 1

• Called after IsFinishedConnect, responds with the same ID as in that response (and zeros in its high 16 bits, like 0x0000abcd)

SendData - 0x24

• Send length: N, response length: 0

• Send N 32 bit values to connected adapter.

⚠️ The first value is a header, and has to be correct. Otherwise, the adapter will ignore the command and won't send any data. The header is as follows:

• For hosts: the number of bytes that come next. For example, if we want to send 0xaabbccdd and 0x12345678 in the same command, we need to send:
  • 0x00000008, 0xaabbccdd, 0x12345678.
• For clients: (bytes << (3 + (1+clientNumber) * 5)). The clientNumber is what I described in IsFinishedConnect. For example, if we want to send a single 4-byte value (0xaabbccdd):
  • The first client should send: 0x400, 0xaabbccdd
  • The second client should send: 0x8000, 0xaabbccdd
  • The third client should send: 0x100000, 0xaabbccdd
  • The fourth client should send: 0x2000000, 0xaabbccdd

🔝 Each SendData can send up to:

• Host: 87 bytes (or 21.75 values)
• Clients: 16 bytes (or 4 values)
• (the header doesn't count)

🗂️ Any non-multiple of 4 byte count will send LSB bytes first. For example, a host sending 0x00000003, 0xaabbccdd will result in bytes 0xbb, 0xcc and 0xdd being received by clients (the clients will receive 0x00bbccdd).

🤝 Note that when having more than 2 connected adapters, data is not transferred between different clients. If a client wants to tell something to another client, it has to talk first with the host with SendData, and then the host needs to relay that information to the other client.

👑 Internally, data is only sent when the host calls SendData:

• The send/receive buffer size is 1 packet, so calling SendData multiple times on either side (before the other side calls ReceiveData) will result in data loss.
• Clients only schedule the data transfer, but they don't do it until the host sends something. This is problematic because the command overrides previously scheduled transfers, so calling SendData multiple times on the client side before the host calls SendData would also result in data loss. I believe this is why most games use SendDataWait on the client side.
• Here's an example of this behavior:
  • Client: SendData {sndHeader}, 10
  • Host: SendData {sndHeader}, 1 (*)
    • (here, the adapter internally receives the 10 from the client)
  • Host: SendData {sndHeader}, 2
    • (here, the previous packet with 1 is lost since nobody received it yet)
  • Client: ReceiveData
    • Receives {rcvHeader}, 2
  • Client: SendData {sndHeader}, 20
  • Host: ReceiveData
    • Receives {rcvHeader}, 10 (pending from (*))
  • Host: ReceiveData
    • Receives nothing
  • Host: SendData {sndHeader}, 3
    • (here, the adapter internally receives the 20 from the client)
  • Host: ReceiveData
    • Receives {rcvHeader}, 20

🔁 This command can also be used with one header and no data. In this case, it will resend the last N bytes (based on the header) of the last packet.

SendDataWait - 0x25

• Send length: N, response length: 0

• The same as SendData but with the additional effect of Wait

• See Waiting for more details on this.

ReceiveData - 0x26

• Send length: 0, response length: N

• Responds with all the data from all adapters. No IDs are included, this is just what was sent concatenated together.

• Once data has been pulled out, it clears the data buffer, so calling this again can only get new data.

🧩 The data is only concatenated on the host side, and its order is based on the clientNumber. It doesn't matter who called SendData first.

⚠️ When the data is concatenated, the headers sent to SendData are not included, just the raw data. A single header is included as the first value of the response. This header is as follows:

• Bits 0-6: # of received bytes from host.
• Bits 8-12: # of received bytes from client 0.
• Bits 13-17: # of received bytes from client 1.
• Bits 18-22: # of received bytes from client 2.
• Bits 23-27: # of received bytes from client 3.
• The rest of the bits are 0.

Wait - 0x27

• Send length: 0, response length: 0

• See Waiting for more details on this.

DisconnectClient - 0x30

• Send length 1, reponse length: 0

• This command disconnects clients. The argument is a bitmask of the client ID to disconnect. Sending 0x1 means "disconnect client number 0", sending 0x2 means "disconnect client number 1", and sending 0xF would disconnect all the clients. After disconnecting a client, its ID won't appear on AcceptConnection calls and its clientNumber will be liberated, so other peers can connect.

⚡ The clients also are able to disconnect themselves using this command, but they can only send its corresponding bit or 0xF, other bits are ignored (they cannot disconnect other clients). Also, the host won't know if a client disconnects itself, so this feature is not very useful:

• The host still needs to monitor clients to ensure they are still alive (ie. through some PING like mechanism) and disconnect them if they are not, to allow new clients to connect. 4

Bye - 0x3d

• Send length: 0, Response length: 0

• This sets the adapter in a low power mode. Games use it when the player exits the multiplayer mode. To use the adapter again after this command, a new reset/initialization is needed.

Other commands

SignalLevel - 0x11

• Send length: 0, response length: 1

• This returns the signal level of the other adapters from 0 to 0xFF (0 means disconnected).

• The levels are returned in a single value, the first byte being the signal level of client 0, and the last byte being the signal level of client 3.

• When called from a client, it only returns the signal level of that client in its corresponding byte. The rest of the bytes will be 0.

VersionStatus - 0x12

• Send length: 0, Response length: 1

• In my adapter, it always returns 8585495 (decimal). It contains the hardware and firmware version of the adapter.

SystemStatus - 0x13

• Send length: 0, Response length: 1

• Returns some information about the current connection and device state. The returned word contains the device ID in the lower 16 bits (or zero if the device is not connected nor hosting). For clients, it contains the clientNumber (0 to 3) in bits 17 and 16. For a host, bit 24 is set, but this could be more complex.

SlotStatus - 0x14

• Send length: 0, Response length: 1+

• It's returns a list of the connected adapters, similar to what AcceptConnections responds, but also:

  • SlotStatus has an extra word at the start of the response, indicating the clientNumber that the next connection will have (or 0xFF if there are already 4 connected clients).
  • SlotStatus can be called after EndHost, while AcceptConnections fails.

ConfigStatus - 0x15

• Send length: 0, Response length: 7 (as client), or 8 (as host)

🤔 In my tests...

• As client, it returned: 0, 0, 0, 0, 0, 0, 257.
• As host, it returned: 1, 2, 3, 4, 5, 6, 3933216, 257.
  • 1, 2, 3, 4, 5, 6 would be the broadcast data.
  • 3933216 and 257 are fixed values. No idea what this means.

Waiting

• After either SendDataWait or Wait, clock control switches to the wireless adapter.
• Once the adapter has something to tell the GBA about, the adapter sends a command to the GBA, 0x99660028.
• These transfers are dealt with in much the same way as before but with the roles of the GBA and the adapter reversed, see the figure!
• The GBA then sends the response back, 0x996600A8 as 0x28 + 0x80 = 0xA8.
• After this, control of the clock returns to the GBA, and it can start sending commands back again. For example this might be receiving the command sent by the other device using ReceiveData.

This timeouts after 500ms of the adapter not having anything to tell the GBA about. In this case, the adapter sends 0x99660027 instead of 0x99660028, having the same effect and switching things back to normal.

SPI config

Here's how SPI works on the GBA:

I know more!

If you know any extra details about the wireless adapter, get in touch!. For specific details I’ve left footnotes around if you happen to know that piece of information.

1. Multiboot is what we call a rom that can be booted over link cable. This can be used for something akin to download play software for the DS. ↩︎

2. Games compatible with the wireless adapter ↩︎

3. Send me an email if you know more about this

4. Some interesting data about the RFU adapter can be found in Pokemon Games, see the FireRed Decompilation for more information.