Kodewerx

//////////////////////////////
40001A0h - NDS7/NDS9 - AUXSPICNT - Gamecard ROM and SPI Control
  13    NDS Slot Mode       (0=Parallel/ROM, 1=Serial/SPI-Backup)
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

//////////////////////////////
40001A2h - NDS7/NDS9 - AUXSPIDATA - Gamecard SPI Bus Data/Strobe (R/W)
  0-7  Data
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

//////////////////////////////
40001A8h - NDS7/NDS9 - Gamecard bus 8-byte Command Out
  0-7   1st Command Byte (at 40001A8h) (eg. B7h) (MSB)
  8-15  2nd Command Byte (at 40001A9h) (eg. addr bit 24-31)
  16-23 3rd Command Byte (at 40001AAh) (eg. addr bit 16-23)
  24-31 4th Command Byte (at 40001ABh) (eg. addr bit 8-15) (when aligned=even)
  32-39 5th Command Byte (at 40001ACh) (eg. addr bit 0-7)  (when aligned=00h)
  40-47 6th Command Byte (at 40001ADh) (eg. 00h)
  48-57 7th Command Byte (at 40001AEh) (eg. 00h)
  56-63 8th Command Byte (at 40001AFh) (eg. 00h) (LSB)
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

//////////////////////////////
4100010h - NDS7/NDS9 - Gamecard bus 4-byte Data In (R)
  0-7   1st received Data Byte (at 4100010h)
  8-15  2nd received Data Byte (at 4100011h)
  16-23 3rd received Data Byte (at 4100012h)
  24-31 4th received Data Byte (at 4100013h)
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

//////////////////////////////
4000204h - NDS9 - EXMEMCNT - 16bit - External Memory Control (R/W)
4000204h - NDS7 - EXMEMSTAT - 16bit - External Memory Status (R/W..R)
  11    17-pin NDS Slot Access Rights     (0=ARM9, 1=ARM7)
  14    Main Memory Interface Mode Switch (0=Async/GBA/Reserved, 1=Synchronous)
  15    Main Memory Access Priority       (0=ARM9 Priority, 1=ARM7 Priority)
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

DS Cartridge Backup

SPI Bus Backup Memory
  Type   Total Size  Page Size  Chip/Example      Game/Example
  EEPROM 0.5K bytes   16 bytes  ST M95040-W       (eg. Metroid Demo)
  EEPROM   8K bytes   32 bytes  ST M95640-W       (eg. Super Mario DS)
  EEPROM  64K bytes  128 bytes  ST M95512-W       (eg. Downhill Jam)
  FLASH  256K bytes  256 bytes  ST M45PE20        (eg. Skateland)
  FLASH  512K bytes  256 bytes  ST M25PE40?       (eg. which/any games?)
  FRAM     8K bytes   No limit  ?                 (eg. which/any games?)
  FRAM    32K bytes   No limit  Ramtron FM25L256? (eg. which/any games?)

Lifetime Stats
  Type      Max Writes per Page    Data Retention
  EEPROM    100,000                40 years
  FLASH     100,000                20 years
  FRAM      No limit               10 years

SPI Bus Backup Memory is accessed via Ports 40001A0h and 40001A2h, see
DS Cartridge I/O Ports

Commands
For all EEPROM and FRAM types:
  06h WREN  Write Enable                Cmd, no parameters
  04h WRDI  Write Disable               Cmd, no parameters
  05h RDSR  Read Status Register        Cmd, read repeated status value(s)
  01h WRSR  Write Status Register       Cmd, write one-byte value
  9Fh RDID  Read JEDEC ID (not supported on EEPROM/FLASH, returns FFh-bytes)
For 0.5K EEPROM (8+1bit Address):
  03h RDLO  Read from Memory 000h-0FFh  Cmd, addr lsb, read byte(s)
  0Bh RDHI  Read from Memory 100h-1FFh  Cmd, addr lsb, read byte(s)
  02h WRLO  Write to Memory 000h-0FFh   Cmd, addr lsb, write 1..MAX byte(s)
  0Ah WRHI  Write to Memory 100h-1FFh   Cmd, addr lsb, write 1..MAX byte(s)
For 8K..64K EEPROM and for FRAM (16bit Address):
  03h RD    Read from Memory            Cmd, addr msb,lsb, read byte(s)
  02h WR    Write to Memory             Cmd, addr msb,lsb, write 1..MAX byte(s)
Note: MAX = Page Size (see above chip list) (no limit for FRAM).

For FLASH backup, commands should be same as for Firmware FLASH memory:
DS Firmware Serial Flash Memory

Status Register
  0   WIP  Write in Progress (1=Busy) (Read only) (always 0 for FRAM chips)
  1   WEL  Write Enable Latch (1=Enable) (Read only, except by WREN,WRDI)
  2-3 WP   Write Protect (0=None, 1=Upper quarter, 2=Upper Half, 3=All memory)
For 0.5K EEPROM:
  4-7 ONEs Not used (all four bits are always set to "1" each)
For 8K..64K EEPROM and for FRAM:
  4-6 ZERO Not used (all three bits are always set to "0" each)
  7   SRWD Status Register Write Disable (0=Normal, 1=Lock) (Only if /W=LOW)
WEL gets reset on Power-up, WRDI, WRSR, WRITE/LO/HI, and on /W=LOW.
The WRSR command allows to change ONLY the two WP bits, and the SRWD bit (if any), these bits are non-volatile (remain intact during power-down), respectively, the WIP bit must be checked to sense WRSR completion.

Detection (by examining hardware responses)
The overall memory type and bus-width can be detected by RDSR/RDID commands:
  RDSR  RDID          Type         (bus-width)
  FFh,  FFh,FFh,FFh   None         (none)
  F0h,  FFh,FFh,FFh   EEPROM       (with 8+1bit address bus)
  00h,  FFh,FFh,FFh   EEPROM/FRAM  (with 16bit address bus)
  00h,  xxh,xxh,xxh   FLASH        (usually with 24bit address bus)
And, the RD commands can be used to detect the memory size/mirrors (though that won't work if the memory is empty).

Pin-Outs for EEPROM and FRAM chips
  Pin Name Expl.
  1  /S    Chip Select
  2  Q     Data Out
  3  /W    Write-Protect (not used in NDS, wired to VCC)
  4  VSS   Ground
  5  D     Data In
  6  C     Clock
  7  /HOLD Transfer-pause (not used in NDS, wired to VCC)
  8  VCC   Supply 2.5 to 5.5V for M95xx0-W

FRAM (Ferroelectric Nonvolatile RAM) is fully backwards compatible with normal EEPROMs, but comes up with faster write/erase time (no delays), and with lower power consumption, and unlimited number of write/erase cycles. Unlike as for normal RAM, as far as I understand, the data remains intact without needing any battery.

#ifndef __SPI_H__
#define __SPI_H__

#include <nds.h>


void inline spi_wait();
void inline spi_open(u8 freq);
u8 inline spi_exch(u8 data);
void inline spi_send(u8 data);
u8 inline spi_recv();
void inline spi_close();
u8 inline eeprom_active();

#endif // __SPI_H__

#include "spi.h"


void inline spi_wait() {
   while (*(vu16*)0x040001A0 & 0x80);
}

void inline spi_open(u8 freq) {
   *(vu16*)0x040001A0 = 0xA040 | (freq & 0x03);
}

u8 inline spi_exch(u8 data) {
   *(vu16*)0x040001A2 = data;
   spi_wait();
   return *(vu16*)0x040001A2;
}

void inline spi_send(u8 data) {
   spi_exch(data);
}

u8 inline spi_recv() {
   return spi_exch(0xFF);
}

void inline spi_close() {
   *(vu16*)0x040001A0 = 0x0000;
}

u8 inline eeprom_active() {
   u8 active;

   spi_open(3);
   spi_send(0x05);
   active = (spi_recv() & 0x01);
   spi_close();

   return active;
}

#define BACKUP_CMD_WRSR      0x01
#define BACKUP_CMD_WRITE     0x02
#define BACKUP_CMD_READ      0x03
#define BACKUP_CMD_WRDI      0x04
#define BACKUP_CMD_RDSR      0x05
#define BACKUP_CMD_WREN      0x06

#define STATUS_BP1      0x08
#define STATUS_BP0      0x04
#define STATUS_WEL      0x02
#define STATUS_WIP      0x01

*(vu32*)0x04000204 &= ~0x0800; // Card bus access = ARM9

*(vu32*)0x04000204 |= 0x0800; // Card bus access = ARM7

spi_open(3);
spi_send(0x03); // BACKUP_CMD_READ
spi_send(0x00); // Address high
spi_send(0x00); // Address mid
spi_send(0x00); // Address low
for (i = 0; i < 0x80000; i++) { // 4Mbit (512Kbyte)
    next_byte = spi_read(); // Here it comes!
}
spi_close();

#define FLASH_PAGE_WRITE      0x0A
#define FLASH_CHIP_ERASE      0xC7
#define FLASH_SECTOR_ERASE    0xD8
#define FLASH_PAGE_ERASE      0xDB

spi_open(3);
spi_send(0x03); // BACKUP_CMD_READ
spi_send(0x00); // Address high
spi_send(0x00); // Address mid
spi_send(0x00); // Address low
for (i = 0; i < 0x80000; i++) { // 4Mbit (512Kbyte)
    next_byte = spi_read(); // Here it comes!
}
spi_close();

spi_send(0x02 | 0x08); // BACKUP_CMD_WRITE + address high bit
spi_send(0x00); // Address low byte

            WriteByteBACKUP(BACKUP_CMD_WRITE | ((i >> 5) & 0x08));   // Write Array & Address High
            WriteByteBACKUP(i);                              // Address Low

            // Write one page at a time
            for (j = 0; j < EEPROM_4_PAGE; j++) {
               WriteByteBACKUP(fgetc(fin));
            }