Magic Lantern Firmware Wiki
Register
Advertisement

DIGIC VI[]

QEMU log:

FC000008: MCR p15,0,Rd,cr6,cr2,0:       RGNR <- 0x0
FC000010: MCR p15,0,Rd,cr6,cr1,0:      DRBAR <- 0x0
FC000018: MCR p15,0,Rd,cr6,cr1,2:       DRSR <- 0x3F
FC000020: MCR p15,0,Rd,cr6,cr1,4:      DRACR <- 0x320
FC000028: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- (old & ~0x20000) | 0x1 => 0x2001 (enable MPU, disable background region; hivecs is enabled)
FE020040: MCR p15,0,Rd,cr9,cr1,1:       BTCM <- (old & 0x7D) | 0x1
FE025884: MCR p15,0,Rd,cr6,cr2,0:       RGNR <- 0x1
FE02588C: MCR p15,0,Rd,cr6,cr1,0:      DRBAR <- 0x0
FE025894: MCR p15,0,Rd,cr6,cr1,4:      DRACR <- 0x329
FE02589C: MCR p15,0,Rd,cr6,cr1,2:       DRSR <- 0x3B
FE0258A4: MCR p15,0,Rd,cr6,cr2,0:       RGNR <- 0x2
FE0258AC: MCR p15,0,Rd,cr6,cr1,0:      DRBAR <- 0xBFE00000
FE0258B4: MCR p15,0,Rd,cr6,cr1,4:      DRACR <- 0x324
FE0258BC: MCR p15,0,Rd,cr6,cr1,2:       DRSR <- 0x29
FE0258C4: MCR p15,0,Rd,cr6,cr2,0:       RGNR <- 0x4
FE0258CC: MCR p15,0,Rd,cr6,cr1,0:      DRBAR <- 0xDFE00000
FE0258D4: MCR p15,0,Rd,cr6,cr1,4:      DRACR <- 0x324
FE0258DC: MCR p15,0,Rd,cr6,cr1,2:       DRSR <- 0x29
FE0258E4: MCR p15,0,Rd,cr6,cr2,0:       RGNR <- 0x5
FE0258EC: MCR p15,0,Rd,cr6,cr1,0:      DRBAR <- 0xEE000000
FE0258F4: MCR p15,0,Rd,cr6,cr1,4:      DRACR <- 0x329
FE0258FC: MCR p15,0,Rd,cr6,cr1,2:       DRSR <- 0x31
FE025904: MCR p15,0,Rd,cr6,cr2,0:       RGNR <- 0x6
FE02590C: MCR p15,0,Rd,cr6,cr1,0:      DRBAR <- 0xFE000000
FE025914: MCR p15,0,Rd,cr6,cr1,4:      DRACR <- 0x329
FE02591C: MCR p15,0,Rd,cr6,cr1,2:       DRSR <- 0x31
FE025924: MCR p15,0,Rd,cr6,cr2,0:       RGNR <- 0x3
FE02592C: MCR p15,0,Rd,cr6,cr1,0:      DRBAR <- 0xC0000000
FE025934: MCR p15,0,Rd,cr6,cr1,4:      DRACR <- 0x305
FE02593C: MCR p15,0,Rd,cr6,cr1,2:       DRSR <- 0x3B
FE025944: MCR p15,0,Rd,cr15,cr5,0:       UNK <- 0x0
FE025944: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- (old & ~0x1002000) | 0x1004 => 0x1005 (clear VE, disable hivecs, enable instruction and data caches)
FE020400: MCR p15,0,Rd,cr9,cr1,0:       ATCM <- (old & 0x7D) | 0x80000001
[      init:fe237fa9 ] Memory region: start=00000000 end=00000000 flags=00000001
[      init:fe237fbf ] Memory region: start=00000000 end=00000000 flags=00000002
[      init:fe237fcb ] Memory region: start=E0000000 end=FFFFFFFF flags=00000020
[      init:fe237ffd ] Memory region: start=FE000000 end=FFFFFFFF flags=00000008
[      init:fe237ffd ] Memory region: start=EE000000 end=EFFFFFFF flags=00000008
[      init:fe237ffd ] Memory region: start=DFE00000 end=DFFFFFFF flags=00000004
[      init:fe237ffd ] Memory region: start=C0000000 end=FFFFFFFF flags=00000010
[      init:fe237ffd ] Memory region: start=BFE00000 end=BFFFFFFF flags=00000004
[      init:fe237ffd ] Memory region: start=00000000 end=3FFFFFFF flags=00000008
[      init:fe237ffd ] Memory region: start=00000000 end=FFFFFFFF flags=00000004
[      init:fe237e5f ] Memory region: start=00000000 end=FFFFFFFF flags=00000000

Register Description

RGNR = MPU Region Number Register 
DRBAR = Data Region Base Address Register 
DRSR = Data Region Size and Enable Register 
DRACR = Data Region Access Control Register 
SCTLR = System Control Register (?) 
ATCM = DTCMRR = Data TCM Region Register (TCM = Tightly Coupled Memory)
BTCM = ITCMRR = Instruction or unified TCM Region Register
region base size end info
0 0x0 0x100000000 (4Gb) 0x100000000 non-shareable, can contain executable code, PL1:R/W PL0:R/W, cacheable: inner non-cacheable, outer non-cacheable

SCTLR: V(High exception vectors (Hivecs), base address 0xFFFF0000), M(MPU enabled)

TCM: ITCMRR, (current Instruction or unified Region Register) - enabled, base address=0x0(given as the physical address of the TCM in the memory map), size=unknown

1 0x0 0x40000000 (1Gb) 0x40000000 non-shareable, can contain executable code, PL1:R/W PL0:R/W, cacheable: outer Write-Back, Write-Allocate; inner Write-Back, Write-Allocate
2 0xBFE00000 0x200000 (2Mb) 0xC0000000 shareable, PL1:R/W PL0:R/W, can contain executable code, cacheable: inner non-cacheable, outer non-cacheable
3 0xC0000000 0x40000000 (1Gb) 0x100000000 shareable, can contain executable code, PL1:R/W PL0:R/W, Shareable Device (memory type: Device)

SCTLR: I(Instruction caches enabled), C(Data and unified caches enabled), M(MPU enabled)

TCM: DTCMRR, (current Data TCM Region Register) - enabled, base address=0x80000 (given as the physical address of the TCM in the memory map), size=unknown

4 0xDFE00000 0x200000 (2Mb) 0xE0000000 shareable, PL1:R/W PL0:R/W, can contain executable code, cacheable: inner non-cacheable, outer non-cacheable
5 0xEE000000 0x2000000 (32Mb) 0xF0000000 non-shareable, can contain executable code, PL1:R/W PL0:R/W, cacheable: outer Write-Back, Write-Allocate; inner Write-Back, Write-Allocate
6 0xFE000000 0x2000000 (32Mb) 0x100000000 non-shareable, can contain executable code, PL1:R/W PL0:R/W, cacheable: outer Write-Back, Write-Allocate; inner Write-Back, Write-Allocate


Here is a tentative to describe memory usage of the firmware

Digic IV[]

start length name description
0x800000 updater location
0xf0010000 0x540000? copy of 0xff010000
0xf8000000 0x10000 Flags and config area*. copy of 0xff800000
.0xf8000000 4? 0=enableMainFirmware, -1=disableMainFirmware
.0xf8000004 4? 0=disableBootdisk, -1=enableBootdisk
.0xf800000c 4? 0=disableFirmware, -1=enableFirmware
0xf8010000 0x540000 with single Digic? Main firmware. copy of 0xff810000 for dual Digic camera, a second and shorter firmware (<0x1c0000 bytes) is targeted at 0xf8010000.
0xf8300000 about 0x35000 FixData. only for 2nd Digic with shorter firmware? seen in 7d 121 update. 1st patch. Identical to data targeted to 0xf8910000
0xf85b0000 about 0x1f0000 ? seen in 7d 121 update
0xf8760000 0x60000 or 0x30000 FPGA config*.
0xf8790000 0x60000 or 0x30000 FPGA config? seen with 1dm4 106. same length as 0xf8760000 content. only for dual digic.
0xf87c0000 0x20000 Bind resource*
0xf87e0000 0x10000 Bootrom cipher extension*
0xf87f0000 0x10000 Bootloader (bootrom)*
0xf88f0000 0x20000 RingData
0xf8910000 0x40000 FixData
0xf8950000 0x20000?
0xf8970000 0x30000 RasenData
0xf8a00000 0x2c0000 TuneData
.0xf8eb0000 ? LensData.
0xf8cc0000 ? ?
0xff010000 0x540000? Main firmware (500D/T1i, 7D)

(*) from this message on CHDK forum : 5D Mark II by memset (14Mar2009)

Digic IV EOS ROM map

0xF8000000 - ROM0 (64Mb)
0xF0000000 - ROM1 (32Mb)

0xF8000000 - 0xF0010000 - Flags & config area
0xF8010000 - 0xF874FFFF - User area
0xF8760000 - 0xF87BFFFF - FPGA config
0xF87C0000 - 0xF7DFFFFF - Bind resource 
0xF87E0000 - 0xF87EFFFF - Bootrom cipher extension
0xF87F0000 - 0xF87FFFFF - Bootloader (bootrom)

FPGA config area: byte-by-byte interleaved bitstreams: 
bitstream 0: Xilinx Spartan-3E XC3S250E 
bitstream 1: Xilinx Spartan-3E XC3S100E


See also Setting up memory maps hudson (9May2009)

below for 5DMark II 1.0.7 and 7D 1.1.0:


5d Mark II, 1.0.7[]

;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0201d/I1039570.html
;Register 6, Protection Region Base and Size Registers
 ROM:FFFF2368
 MOV     R0, #0x3F          ;region0, 0x3f=0011 1111 : base=0, size=4Gb (0xffff ffff)
 MCR     p15, 0, R0,c6,c0
 MOV     R0, #0x3D          ;region1, 0x3d=0011 1101 : base=0, size=2Gb (0x8000 0000)
 MCR     p15, 0, R0,c6,c1
 LDR     R0, =0xE0000039    ;region2, 0x39=0011 1001 : base=0xe000 0000, size=512Mb (0x2000 0000)
 MCR     p15, 0, R0,c6,c2
 MOV     R0, #0xC0000039    ;region3, 0x39=0011 1001 : base=0xc000 0000, size=512Mb (0x2000 0000)
 MCR     p15, 0, R0,c6,c3
 LDR     R0, =unk_FF80002D  ;region4, 0x2D=0010 1101 : base=0xff80 0000, size=8Mb (0x0080 0000)
 MCR     p15, 0, R0,c6,c4
 MOV     R0, #0x39          ;region5, 0x39=0011 1001 : base=0, size=512Mb (0x2000 0000)
 MCR     p15, 0, R0,c6,c5
 LDR     R0, =0xF780002D    ;region6, 0x2d=0010 1101 : base=0xf780 0000, size=8Mb (0x0080 0000)
 MCR     p15, 0, R0,c6,c6

7D, 1.1.0[]

ROM:FFFF2364                 MOV     R0, #0x3F          ;region0, 0x3f=0011 1111 : base=0, size=4Gb (0xffff ffff)
ROM:FFFF2368                 MCR     p15, 0, R0,c6,c0
ROM:FFFF236C                 MOV     R0, #0x3D          ;region1, 0x3d=0011 1101 : base=0, size=2Gb (0x8000 0000)
ROM:FFFF2370                 MCR     p15, 0, R0,c6,c1
ROM:FFFF2374                 LDR     R0, =0xE0000039    ;region2, 0x39=0011 1001 : base=0xe000 0000, size=512Mb (0x2000 0000)
ROM:FFFF2378                 MCR     p15, 0, R0,c6,c2
ROM:FFFF237C                 MOV     R0, #0xC0000039    ;region3, 0x39=0011 1001 : base=0xc000 0000, size=512Mb (0x2000 0000)
ROM:FFFF2380                 MCR     p15, 0, R0,c6,c3
ROM:FFFF2384                 LDR     R0, =unk_FF80002F  ;region4, 0x2F=0010 1111 : base=0xff80 0000, size=16Mb (0x0100 0000)
ROM:FFFF2388                 MCR     p15, 0, R0,c6,c4
ROM:FFFF238C                 MOV     R0, #0x39          ;region5, 0x39=0011 1001 : base=0, size=512Mb (0x2000 0000)
ROM:FFFF2390                 MCR     p15, 0, R0,c6,c5
ROM:FFFF2394                 MOV     R0, #0x8000002F    ;region6, 0x2F=0010 1111 : base=0x8000 0000, size=16Mb (0x0100 0000)
ROM:FFFF2398                 MCR     p15, 0, R0,c6,c6

550D 1.0.8[]

ROM:F8FF22B0 sub_F8FF22B0                            ; CODE XREF: ROM:F8FF0608�p
ROM:F8FF22B0                 MOV     R0, #0x3F
ROM:F8FF22B4                 MCR     p15, 0, R0,c6,c0
ROM:F8FF22B8                 MOV     R0, #0x3D
ROM:F8FF22BC                 MCR     p15, 0, R0,c6,c1
ROM:F8FF22C0                 LDR     R0, =0xE0000039
ROM:F8FF22C4                 MCR     p15, 0, R0,c6,c2
ROM:F8FF22C8                 MOV     R0, #0xC0000039
ROM:F8FF22CC                 MCR     p15, 0, R0,c6,c3
ROM:F8FF22D0                 LDR     R0, =0xFF00002F
ROM:F8FF22D4                 MCR     p15, 0, R0,c6,c4
ROM:F8FF22D8                 MOV     R0, #0x39
ROM:F8FF22DC                 MCR     p15, 0, R0,c6,c5
ROM:F8FF22E0                 LDR     R0, =0xF780002D
ROM:F8FF22E4                 MCR     p15, 0, R0,c6,c6
ROM:F8FF22E8                 MOV     R0, #0x70
ROM:F8FF22EC                 MCR     p15, 0, R0,c2,c0
ROM:F8FF22F0                 MCR     p15, 0, R0,c3,c0
ROM:F8FF22F4                 MCR     p15, 0, R0,c2,c0, 1
ROM:F8FF22F8                 LDR     R0, =0x3FFF
ROM:F8FF22FC                 MCR     p15, 0, R0,c5,c0
ROM:F8FF2300                 MCR     p15, 0, R0,c5,c0, 1
ROM:F8FF2304                 MRC     p15, 0, R0,c1,c0
ROM:F8FF2308                 ORR     R0, R0, #1
ROM:F8FF230C                 ORR     R0, R0, #0x1000
ROM:F8FF2310                 ORR     R0, R0, #4
ROM:F8FF2314                 ORR     R0, R0, #0xC0000000
ROM:F8FF2318                 ORR     R0, R0, #8
ROM:F8FF231C                 ORR     R0, R0, #0x10
ROM:F8FF2320                 ORR     R0, R0, #0x20
ROM:F8FF2324                 ORR     R0, R0, #0x40
ROM:F8FF2328                 MCR     p15, 0, R0,c1,c0
ROM:F8FF232C                 RET
ROM:F8FF232C ; End of function sub_F8FF22B0


Based on this ARM code :

base length end usage
0x00000000 0x20000000 (512Mb) 0x20000000 5D and 7D
0x00000000 0x80000000 (2Gb) 0x80000000 5D and 7D
0x80000000 0x01000000 (16Mb) 0x81000000 7D only (dual digic)
0xc0000000 0x20000000 (512Mb) 0xe0000000
0xe0000000 0x20000000 (512Mb) 0xffffffff
0xf7800000 5D Mark II: 0x00800000 (8Mb) 0xf8000000 5dm2 only (single digic)
0xff800000 7D: 0x01000000 (16Mb) >0xfffffffff !!
0xff800000 5D Mark II: 0x00800000 (8Mb) 0xffffffff

Digic III[]

start length name description
0x00000000 0x40000000 (1Gb)
0xC0000000 0x20000000 (512Mb)
0xF8000000 0x00400000 (4Mb)
0xFF800000 0x00800000 (8Mb)

from ARM memory protection code of

  • 1000d boot code (0xFFFF1C8C in 1.0.5 [1]msg34042.html#msg34042%7C dump)
  • and 40D boot code (0xFFFF1CCC in 1.0.8 dump)


Hardware registers[]

Registers start at 0xc0220000.

QEMU[]

00000000 - 3FFFFFFF: eos.ram
40000000 - 7FFFFFFF: eos.ram_uncached
F0000000 - F0FFFFFF: eos.rom0
F1000000 - F1FFFFFF: eos.rom0_mirror_F1
F2000000 - F2FFFFFF: eos.rom0_mirror_F2
F3000000 - F3FFFFFF: eos.rom0_mirror_F3
F4000000 - F4FFFFFF: eos.rom0_mirror_F4
F5000000 - F5FFFFFF: eos.rom0_mirror_F5
F6000000 - F6FFFFFF: eos.rom0_mirror_F6
F7000000 - F7FFFFFF: eos.rom0_mirror_F7
F8000000 - F8FFFFFF: eos.rom1
F9000000 - F9FFFFFF: eos.rom1_mirror_F9
FA000000 - FAFFFFFF: eos.rom1_mirror_FA
FB000000 - FBFFFFFF: eos.rom1_mirror_FB
FC000000 - FCFFFFFF: eos.rom1_mirror_FC
FD000000 - FDFFFFFF: eos.rom1_mirror_FD
FE000000 - FEFFFFFF: eos.rom1_mirror_FE
FF000000 - FFFFFFFF: eos.rom1_mirror_FF
C0000000 - CFFFFFFF: eos.iomem
Advertisement