Commit c28e41fc authored by alex@thinkpad's avatar alex@thinkpad
Browse files

QEMU README: initial notes on DIGIC 7

--HG--
branch : qemu
parent a20c79bcfe12
......@@ -302,11 +302,19 @@ Initial firmware analysis
DIGIC 5 and earlier models will start the bootloader at ``0xFFFF0000`` (HIVECS)
and will jump to main firmware at ``0xFF810000``, ``0xFF010000`` or ``0xFF0C0000``.
There is one main ROM (ROM1) at ``0xF8000000``, 4/8/16/32 MiB mirrored until ``0xFFFFFFFF``,
and there may be a second ROM (ROM0) at 0xF0000000, mirrored until ``0xF8000000 - 1 = 0xF7FFFFFF``.
and there may be a second ROM (ROM0) at ``0xF0000000``, mirrored until ``0xF8000000 - 1 = 0xF7FFFFFF``.
Some DIGIC 5 models also use a serial flash for storing properties (persistent settings).
DIGIC 6 will start at ``*(uint32_t*)0xFC000000``,
DIGIC 6 models will start at ``*(uint32_t*)0xFC000000``,
bootloader is at 0xFE020000 and main firmware starts at 0xFE0A0000. There is
a 32 MiB ROM mirrored at 0xFC000000 and 0xFE000000 (there may be others).
There is a serial flash as well, used for storing properties.
DIGIC 7 models will start at ``0xE0000000`` in ARM mode
and will jump to main firmware at ``0xE0040000`` in Thumb mode.
There is a 32 MiB ROM (ROM0) at ``0xE0000000``, mirrored until ``0xEFFFFFFF``,
and an unusually slow 16 MiB ROM (ROM1) at ``0xF0000000``, mirrored until ``0xFFFFFFFF``.
No serial flash was identified.
The ROM load address is the one you have used when dumping it (usually one of the mirrors).
The memory map is printed when starting QEMU — you'll see where each ROM is loaded
......
......@@ -27,12 +27,12 @@ What works:
- Limited support for secondary DryOS cores (such as Eeko or 5D4 AE processor)
- File I/O works on most models (both SD and CF); might be unreliable
- Bootloader emulation works on all supported models (from DIGIC 2 to DIGIC 7)
- Loading AUTOEXEC.BIN / DISKBOOT.BIN from the virtual SD/CF card (from DIGIC 2 to DIGIC 6)
- Loading AUTOEXEC.BIN / DISKBOOT.BIN from the virtual SD/CF card (from DIGIC 2 to DIGIC 7)
- Unmodified autoexec.bin works on many single-core camera models
(and, with major limitations, on dual-core models)
- ML modules and Lua scripts (within the limitations of the emulation)
- DryOS/VxWorks timer (heartbeat) and task switching (all supported models)
- UART emulation (DryOS shell aka Dry-shell or DrySh on DIGIC 4, 5 and 6 models)
- UART emulation (DryOS shell aka Dry-shell or DrySh on DIGIC 4, 5, 6 and 7 models)
- Deterministic execution with the ``-icount`` option (except CF PIO)
- Cache hacks are emulated to some extent (but "uninstalling" them does not work)
- EDMAC memcpy, including geometry parameters (matches the hardware closely, but not perfectly)
......@@ -1137,6 +1137,7 @@ History
:2017: `RTC emulation, many patches no longer needed <http://www.magiclantern.fm/forum/index.php?topic=2864.msg190823#msg190823>`_ (g3gg0)
:2017: `Major progress with DIGIC 6 emulation <http://www.magiclantern.fm/forum/index.php?topic=17360.msg194898#msg194898>`_
:2017: `Menu navigation works on 20 EOS models! (DIGIC 3-5) <http://www.magiclantern.fm/forum/index.php?topic=2864.msg195117#msg195117>`_
:2018: `Initial support for DIGIC 7 EOS models (77D, 200D, 6D Mark II) <https://www.magiclantern.fm/forum/index.php?topic=19737.msg200799#msg200799>`_
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment