FYI, the
latest QEMU branch is able to emulate a large part of the EOS M3 firmware, so it could be useful for those porting CHDK.
Emulation log:
EOSM3-qemu.logNotes:
- DryOS core (task scheduler, semaphores, meminfo) is pretty much identical to EOS firmware (e.g. 7D2)
- A lot less debug messages on M3 (unless I'm missing something, since there are plenty of strings)
- File I/O routines are different (Fopen_Fut on M3, similar to Powershot, FIO_OpenFile on EOS)
- Initialization appears simpler on M3 (a sequential routine; on EOS there are a bunch of things running in parallel)
- Low-level initialization looks pretty similar (cstart, init_task)
- SD card emulation is not done, but should be doable (if you look at how it's done on 60D or 5D3, for example)
- User-level code is totally different
- The log contains TurnOnDisplay, TurnOnBackLight and similar stuff, so if you find the display buffer address, it might actually show something

- To enter the debug shell, return '#' as the first character from the UART (TIO)
? Help
h Help
d <adr> <size> Dump memory
e <adr> Edit memory
i adr Input
o adr data Output
q Quit ( =Reset )
c CheckSiP ( don't return! )
f <adr> <file> File read
v <source> <target> <size> Verify memory
--- example ---
>> d A0000 1B0 ; dump 0xA000-0xA1AF
To prepare the ROM files for QEMU from the CHDK dump:
mv PRIMARY12.BIN EOSM3/ROM1.BIN # 32MB from FE000000
mv SECONDARY.BIN EOSM3/ROM0.BIN # 8MB from FB800000
The rest of details about how to run the emulator are in the
QEMU thread and in the install script.
I wouldn't say porting ML is impossible on this camera, but it would be one of the most difficult ports (it will require a lot of wrapper functions that mimic the behavior of DSLR firmware, and while you can probably easily get ML menu up and running, porting the features will be a lot more difficult - most things are very unlikely to work only with minor tweaking). It would be probably a little easier than porting ML to Nikon

Hope it helps.