====== EZ Flash (GBA) programming ======

It appears many EZ Flash GBA cartridges use a compatible interface across the product line.

===== Unlocking =====

To unlock the cartridge's interface, the following writes must be issued:

  * 0x9FE0000 = 0xD200
  * 0x8000000 = 0x1500
  * 0x8020000 = 0xD200
  * 0x8040000 = 0x1500

To lock the interface:

  * 0x9FC0000 = 0x1500

===== Specifications =====

==== EZ-Flash III ====

  * 1 Gbit NAND (Samsung K9F1G08U0M).
  * 256 Mbit NOR
  * 32 Mbit NOR (firmware),
  * 128 Mbit RAM
  * 2Mbit SRAM

Memory Map (OS mode):

^ Start ^ End ^ Role ^
| 0x8000000 | 0x83FFFFF | 32 Mbit NOR (firmware) |
| 0x8400000 | 0x93FFFFF | 128 Mbit RAM |
| 0x9400000 | 0x9BFFFFF | 64 Mbit window of 256 Mbit NOR |

Memory Map (Game mode):

^ ROM page (Mbits) ^ Role ^
| 0 | 256 Mbit NOR |
| 256 | 128 Mbit SRAM |
| 384 | 32 Mbit NOR (firmware) |

==== EZ-Flash IV ====

=== EZ402TF 2014.08.14 ===

  * S71WS512ND0 (512Mbit NOR + 128Mbit PSRAM)
  * M6MGT321S4TP (32Mbit NOR + 4Mbit SRAM)

==== EZ-Flash Reform =====

  * S71WS512ND0 (512Mbit NOR + 128Mbit PSRAM)

==== EZ-Flash Omega/Omega DE ====

  * S98WS512PE0 (512Mbit NOR + 256Mbit PSRAM)
  * S71GL064A08 (64Mbit NOR + 8Mbit SRAM)
  * FM28V100 (1Mbit FRAM)
  * XC6SLX9 (FPGA)
  * W25Q16 (SPI flash)

Memory Map (S71GL064A08 NOR):

^ Start ^ End ^ Role ^
| 0x000000 | 0x00FFFF | Boot loader |
| 0x040000 | 0x7FFFFF? | Kernel |

Memory Map (Game mode):

^ ROM page (Mbits) ^ Role ^
| 0 | 512 Mbit NOR |
| 512 | Special value - map 256 Mbit PSRAM |

Memory Map (OS mode):

^ Start ^ End ^ Role ^
| 0x8000000 | 0x87FFFFF | 64 Mbit NOR (bootloader/kernel) |
| 0x8800000 | 0x8FFFFFF | 64 Mbit window of 256 Mbit PSRAM |
| 0x9000000 | 0x97FFFFF | 64 Mbit window of 512 Mbit NOR |
| 0xE000000 | 0xE01FFFF | 1 Mbit FRAM |

TODO: 0xE020000?

===== Memory-mapped I/O =====

==== NAND Flash (III) ====

=== EZ_NAND_CONTROL (0x9400000; III) ===

=== EZ_NAND_DATA (0x9FFC000; III) ===

=== EZ_NAND_ADDR (0x9FFFFE0; III) ===

=== EZ_NAND_CMD (0x9FFFFE2; III) ===

==== SD Card (IV) ====

=== ? (0x9FEA000; IV) ===

=== ? (0x9FFFF40; IV) ===

==== SD Card (Omega) ====

=== EZ_SDCARD_CONTROL (0x9400000; Omega, Omega DE) ===

=== EZ_SDCARD_BUFFER_ADDR_LO (0x9600000; Omega, Omega DE) ===

=== EZ_SDCARD_BUFFER_ADDR_HI (0x9620000; Omega, Omega DE) ===

=== EZ_SDCARD_BUFFER_CONTROL (0x9640000; Omega, Omega DE) ===

<code>
15       bit       0
 m... .... .... .ccc
 |               |||
 |               +++- Sector count (0-4)
 +------------------- Mode: 0 - Read, 1 - Write
</code>

=== EZ_SDCARD_BUFFER_DATA (0x9E00000; Omega, Omega DE) ===

2KB buffer for read and/or written sectors.

==== SPI (IV) ====

=== EZ_SPI_DATA (0x80000C4; IV) ===

=== EZ_SPI_CONTROL (0x80000C6; IV) ===

<code>
15       bit       0
 .... .... .... .csk
                 |||
                 ||+- SCK
                 |+-- SIO
                 +--- CS
</code>

=== EZ_SPI_ENABLE (0x80000C8; IV) ====

<code>
15       bit       0
 .... .... .... ...e
                   |
                   +- Enable
</code>

==== Cartridge ====

=== EZ_RTC_CONTROL (0x96A0000; Omega, Omega DE) ===

=== EZ_AUTO_SAVE_CONTROL (0x96C0000; Omega, Omega DE) ===

=== EZ_LED_CONTROL (0x96E0000; Omega DE) ===

=== EZ_64MROM_CONTROL (0x9700000; Omega DE) ===

<code>
15       bit       0
 .... .... .... ...v
                   |
                   +- Emulate GBA Video 64M mapper
</code>

=== EZ_PSRAM_OFFSET (0x9860000; Omega, Omega DE) ===

PSRAM offset, in megabits.

=== EZ_ROM_OFFSET (0x9880000; III, IV, Omega, Omega DE) ===

ROM offset, in megabits.

=== EZ_RAM_OFFSET (0x9C00000; III, IV, Omega, Omega DE) ===

RAM offset, in megabits.

=== EZ_NOR_WRITE_ENABLE (0x9C40000; III, IV) ===

=== EZ_RUMBLE_STRENGTH (0x9E20000; Omega DE) ===

  * Minimum: 0xF0
  * Maximum: 0xF1
  * Regular: 0xF2

==== FPGA SPI ====

=== EZ_SPI_CONTROL (0x9660000; Omega, Omega DE) ===

=== EZ_SPI_WRITE (0x9680000; Omega, Omega DE) ===

==== Other/Unknown ====

=== ? (0x9420000; Omega, Omega DE) ====

=== ? (0x9A40000; IV) ====