I traced the firmware write-protect (for first 512 bytes) to the SL1 contacts
http://www.bottledlight.com/ds/index.php/Hardware/RFU
Location: http://darkfader.net/ds/files/SL1 bridge.jpg
I'm not sure yet how to protect the firmware from malicious code, since only first 512 bytes are protected.
Perhaps we can exploit the firmware loader so that only first 512 bytes can hold some recovery code.
Nintendo might not have planned any firmware updates. So we have to do it ourselves. Loopy is making the first patch to original firmware to allow execution from GBA cartridge.
Any more suggestions of what to put into the new firmware?
Edit: current want-to-have list:
run GBA game
run DS game
settings for date/time, calibration
support multiple DS games using GBA, CF, SMC, SD card
support multiple GBA games using bankswitching
upload NDS with wifi
DS download play
filesystem driver (to be used for homebrew games)
filemanager
text viewer/editor/mailer
picture viewer
Telnet
FTP
IRC
background color/picture
(parental) lock
I got this from the gbadev forums.