Joy Carry Cartridge Technical Documentation 0.1
December 10, 2021
Shonumi aka D.S. Baxter

***************************************************
1. Introduction
*************************************************** 

The Joy Carry Cartridge is a special Game Boy Advance cartridge that came bundled with the GameCube title Hikaru no Go 3. Released in Japan on March 20, 2003, it allowed players to rewrite most of the contents on the cartridge, working as an officially licensed flashcart of sorts. The underlying hardware is referred to as Nintendo's Debugging and Communication System, also known as DACS, and it was the only recorded instance where this technology was sold to the public. Joy Carry was the name of the GBA-to-GameCube functionality in Japan, often associated with temporary download. The Joy Carry Cartridge aimed to make large amounts of transferred data persistent.


***************************************************
2. General Hardware Information
*************************************************** 

- Uses a Sharp LH28F800BLE to provide flash memory.
- Cartridge capacity is 8M / 1MB.
- Features a permanent 8KB read-only ID sector.
- Maps ROM data to upper end of address space.
- Comes in a purple plastic shell that is identical to other normal cartridges.
- Contains no EEPROM, SRAM, or FRAM. All save data is written via flash commands.


***************************************************
3. GameCube Communication
***************************************************

Hikaru no Go 3 gives players the choice of sending two specific pieces of software to the Game Boy Advance. The first Igo Mondaishuu (囲碁問題集) consists of 200 individual Go-based challenges. Igo Mondaishuu is divided into 4 separate sections of 50 problems. Only 1 section at a time may be downloaded to the Joy Carry Cartridge. As players solve each Go question, their progress is saved with the results ("O" = Passed, "-" = Attempted, "X" = Failed). The second software Keitai Magnet Goban (携帯マグネット碁盤) is intended to act as a virtual, portable Go board. It lets players link up with other GBAs for 1v1 or 2v2 Go matches. It saves the results of recent matches along with various statistics. The software will also display the player's name, rank, win/loss counts, and their ID generated by Hikaru no Go 3 on GameCube.

When transferring data from the GameCube to the GBA, the handheld must be booted with the Joy Carry Cartridge inserted. Players must hold down both the START and SELECT buttons to force the BIOS to enter MultiBoot mode and wait for data via JoyBus communications. Initially, a small program is loaded to manage downloading data from the GameCube and overwriting the previous contents of the Joy Carry Cartridge. This program helpfully displays a progress bar, as does the GameCube's screen. Due to the amount of data sent and the time it takes to issue flash commands, the process takes several minutes. Once finished, the GBA may be turned off or reset and the Joy Carry Cartridge will boot its newly written software.


***************************************************
4. ROM Mapping
***************************************************

The data stored on the Joy Carry Cartridge's flash memory is mapped to the last 1MB of the GBA's ROM address space, from 0x9F00000 to 0x9FFFFFF. In order to properly start the game, however, an 8KB boot sector is mapped from 0x9FFC000 to 0x8000000. The ~31MB gap inbetween these two sections should read as zero. This unique mapping prevents most commercial games from simply being copied onto the Joy Carry Cartridge and treating it like a normal flashcart, as portions of code would need to be adapted to handle having data in the upper region of ROM address space. Additionally, the limited size of the Joy Carry Cartridge further complicates matters.

The last 8KB section of the Joy Carry Cartridge, located at 0x9FFE000 can be used to ID the cartridge. This data is not known to be rewritable, making it a reliable method of determining whether or not hardware is a Joy Carry Cartridge or not. Thanks to this, however, the full capacity of the Joy Carry Cartridge is only around 1016KB.


***************************************************
5. Flash Commands
***************************************************

The Joy Carry Cartridge accepts standard flash commands for manipulating data. The following commands have been verified to work on the LH28F800BLE:

-----------------------------------------------------------
Command Byte 	| Description
-----------------------------------------------------------
0x10		| Write Data
0x20		| Block Erase
0x40		| Write Data
0x60		| Set Block-lock Bit / Clear Block-lock bit
0x50		| Clear Status Register
0x70		| Read Status Register
0x90		| Read Flash ID Codes / Enter ID Mode
0xF0		| Terminate ID Mode
0xFF		| Read Data / Reset
-----------------------------------------------------------

Operations appear to work based on 8KB sectors or blocks. Depending on the address where certain commands are issued (such as the Set Block-lock Bit command or Block Erase command), it will have an effect on that specific block only. Note that these commands are all sent to mirrored addresses, specifically Wait State 2 (0xC000000 - 0xDFFFFFF).

Reading the Flash ID codes involves the following process. Take note which reads/writes are 16-bit and 32-bit:

-----------------------------------------------------------
WRITE-16 0x00AA to 0xDFE0AAA
WRITE-16 0x0055 to 0xDFE0554
WRITE-16 0x0090 to 0xDFE0AAA		//Enter ID Mode
WRITE-16 0x00F0 to 0xDFE0000		//Terminate ID Mode

WRITE-16 0x0055 to 0xDFE0554
WRITE-16 0x00AA to 0xDFE0AAA
WRITE-16 0x00E0 to 0xDFE0554		//???

WRITE-16 0x0055 to 0xDFE0554
WRITE-16 0x00AA to 0xDFE0AAA
WRITE-16 0x00E0 to 0xDFE0554		//???

READ-32 FROM 0xDF00000			//Read 16-bit Manufacture code + 16-bit Lock Bit data
WRITE-16 0x00FF to 0xDFE0AAA		//Reset, also exits ID Mode
-----------------------------------------------------------

Other commands don't appear to rely on writing to the 0x----554 addresses. Instead, they're issued as follows:

-----------------------------------------------------------
WRITE-16 COMMAND to 0xDFE0AAA
or
WRITE-16 COMMAND to 0xDF-----		//Issue command for specific 8KB block

...then for any parameters...

WRITE-16 PARAMETER to 0xDFE0AAA
or
WRITE-16 PARAMETER to 0xDF-----		//Issues command parameters for specific 8KB block
-----------------------------------------------------------

The above information is the bare minimum necesary for operating the Joy Carry Cartridge via the Game Boy Advance or GameCube. For more detailed information beyond the scope of this document, refer to other similar Sharp flash components with available datasheets such as the LH28F800BJE.

***************************************************
6. Status Register
***************************************************

The Status Register monitors the state of the flash controller. It works on a per-block level, typically reporting on the write or protection status of that block. While the LH28F800BLE should more or less resemble similar controllers, only the following status bits have been verified:

-----------------------------------------------------------
Bit		| Function
-----------------------------------------------------------
0		|
1		| Device Protection Status, 0 = Unlocked, 1 = Locked
2		|
3		|
4		|
5		|
6		|
7		| Write Status, 0 = Busy, 1 = Ready
-----------------------------------------------------------

When reading from any 0x----AAA address, it appears to return the Status Register for that block (e.g. if the program needs to determine if a specific block's Lock Bit is set). Otherwise, reading any other address will return data from flash memory or zeroes if the area is outside the mapped 1MB ROM.

It should be noted that the software often issues an unknown parameter (0x77) to the Set Lock Bit command. It is not well understood what this does exactly or how it affects the Status Register.

Also regarding the Status Register, both Igo Mondaishuu and Keitai Magnet Goban check it to assess whether the flash controller responds in a timely fashion. On boot, the software are particularly concerned with the Write Status and will abort initial flash operations such as verifying save data. Failing this part will not stop the programs from attempting to write data to flash memory later on, however. For the rest of flash operations, the programs generally examine whether a block is locked or unlocked. If a block is locked, they will abort writing any new save data.
