Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
magic-lantern
magic-lantern
Commits
ad4f694c1a8c
Commit
9da7eb0b
authored
Jan 22, 2018
by
alex@thinkpad
Browse files
QEMU readme: table of contents; minor typos
--HG-- branch : qemu
parent
067abb6fae76
Changes
2
Hide whitespace changes
Inline
Side-by-side
contrib/qemu/HACKING.rst
View file @
ad4f694c
...
...
@@ -10,6 +10,8 @@ For "user" documentation and installation guide, please see the main `README.rst
This is bleeding-edge development used primarily for reverse engineering.
You will want to modify the sources, sooner or later.
.. contents::
How is this code organazized?
`````````````````````````````
...
...
@@ -117,14 +119,14 @@ somewhere within ``0xC0000000 - 0xDFFFFFFF`` (with variations: ``C0000000 - CFFF
A **Register** is a 32-bit wide (4-byte) location in some peripheral's address range, used to control that peripheral.
These registers are at predefined offsets from the peripheral’s base address.
For example, i
t is quite common for at least one register to be a control register,
I
t is quite common for at least one register to be a control register,
where each bit in the register corresponds to a certain behavior that the hardware should have.
Another common register is a write register, where anything written in it gets sent off to the hardware.
Some peripherals also have a status register (which may be either read-only or shared with a control register).
For example, there are 8 DMA channels placed at ``0xC0A10000-0xC0A100FF``,
``0xC0A20000-0xC0A200FF``, ..., ``0xC0A80000-0xC0A800FF``. All these DMA channels
share the same behavior
, and
are controlled by registers located in the above ranges.
share the same behavior
; moreover, they
are controlled by registers located in the above ranges.
For example, at offset ``0x08`` you will find the control register (``0xC0A10008``, ``0xC0A20008``, ..., ``0xC0A80008``),
offset ``0x18`` is the source address, ``0x1C`` is the destination address
and offset ``0x20`` is the transfer size (see ``eos_handle_dma`` in ``eos.c``).
...
...
@@ -136,7 +138,7 @@ what values are expected to be read, what the hardware is supposed to do with th
and by `cross-checking the register values with those obtained on physical hardware`__ (by logging what Canon code does).
Generally, the behavior of these peripherals is common across many camera models; very often,
compatibility is maintained across many generations of the hardware. For example, a 20-bit microsecond timer
("D
ryOS
timer") can be read from register ``0xC0242014`` on all EOS and PowerShot models from DIGIC 2 to DIGIC 5.
("D
IGIC
timer") can be read from register ``0xC0242014`` on all EOS and PowerShot models from DIGIC 2 to DIGIC 5.
__ `Cross-checking the emulation with actual hardware`_
...
...
contrib/qemu/README.rst
View file @
ad4f694c
...
...
@@ -5,8 +5,6 @@ How can I run Magic Lantern in QEMU?
This guide shows you how to emulate Magic Lantern (or plain Canon firmware) in QEMU.
Eager to get started? Scroll down to `Installation`_.
.. class:: align-center
|pic1| |pic2|
...
...
@@ -16,6 +14,8 @@ Eager to get started? Scroll down to `Installation`_.
.. |pic2| image:: doc/img/qemu-M2-hello.jpg
:width: 32.3 %
.. contents::
Current state
-------------
...
...
@@ -1094,8 +1094,8 @@ Debugging symbols from ML can be made available to instrumentation routines from
The address of DebugMsg is exported by ``run_canon_fw.sh`` (extracted from the GDB script, where it's commented out for speed reasons).
Hacking
-------
Development and reverse engineering guide
-------
----------------------------------
For the following topics, please see `HACKING.rst <HACKING.rst>`_:
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment