Commit 9da7eb0b authored by alex@thinkpad's avatar alex@thinkpad
Browse files

QEMU readme: table of contents; minor typos

--HG--
branch : qemu
parent 067abb6fae76
......@@ -10,6 +10,8 @@ For "user" documentation and installation guide, please see the main `README.rst
This is bleeding-edge development used primarily for reverse engineering.
You will want to modify the sources, sooner or later.
.. contents::
How is this code organazized?
`````````````````````````````
......@@ -117,14 +119,14 @@ somewhere within ``0xC0000000 - 0xDFFFFFFF`` (with variations: ``C0000000 - CFFF
A **Register** is a 32-bit wide (4-byte) location in some peripheral's address range, used to control that peripheral.
These registers are at predefined offsets from the peripheral’s base address.
For example, it is quite common for at least one register to be a control register,
It is quite common for at least one register to be a control register,
where each bit in the register corresponds to a certain behavior that the hardware should have.
Another common register is a write register, where anything written in it gets sent off to the hardware.
Some peripherals also have a status register (which may be either read-only or shared with a control register).
For example, there are 8 DMA channels placed at ``0xC0A10000-0xC0A100FF``,
``0xC0A20000-0xC0A200FF``, ..., ``0xC0A80000-0xC0A800FF``. All these DMA channels
share the same behavior, and are controlled by registers located in the above ranges.
share the same behavior; moreover, they are controlled by registers located in the above ranges.
For example, at offset ``0x08`` you will find the control register (``0xC0A10008``, ``0xC0A20008``, ..., ``0xC0A80008``),
offset ``0x18`` is the source address, ``0x1C`` is the destination address
and offset ``0x20`` is the transfer size (see ``eos_handle_dma`` in ``eos.c``).
......@@ -136,7 +138,7 @@ what values are expected to be read, what the hardware is supposed to do with th
and by `cross-checking the register values with those obtained on physical hardware`__ (by logging what Canon code does).
Generally, the behavior of these peripherals is common across many camera models; very often,
compatibility is maintained across many generations of the hardware. For example, a 20-bit microsecond timer
("DryOS timer") can be read from register ``0xC0242014`` on all EOS and PowerShot models from DIGIC 2 to DIGIC 5.
("DIGIC timer") can be read from register ``0xC0242014`` on all EOS and PowerShot models from DIGIC 2 to DIGIC 5.
__ `Cross-checking the emulation with actual hardware`_
......
......@@ -5,8 +5,6 @@ How can I run Magic Lantern in QEMU?
This guide shows you how to emulate Magic Lantern (or plain Canon firmware) in QEMU.
Eager to get started? Scroll down to `Installation`_.
.. class:: align-center
|pic1| |pic2|
......@@ -16,6 +14,8 @@ Eager to get started? Scroll down to `Installation`_.
.. |pic2| image:: doc/img/qemu-M2-hello.jpg
:width: 32.3 %
.. contents::
Current state
-------------
......@@ -1094,8 +1094,8 @@ Debugging symbols from ML can be made available to instrumentation routines from
The address of DebugMsg is exported by ``run_canon_fw.sh`` (extracted from the GDB script, where it's commented out for speed reasons).
Hacking
-------
Development and reverse engineering guide
-----------------------------------------
For the following topics, please see `HACKING.rst <HACKING.rst>`_:
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment