aiden/h8-536-decoder
1
0
Fork 0
Code Activity

EMualtor adjustments

Browse Source
This commit is contained in:
Aiden
2026-05-25 20:42:45 +10:00
parent d2e7609bbf
commit 3ab79648ff
17 changed files with 3047 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1014
build/rom_decompiled.json
View File

File diff suppressed because it is too large Load Diff

265
build/rom_serial_gate.json
View File

@@ -5,6 +5,185 @@
"Branch predicates are summarized from local instruction order and targets; this is not an emulator trace."
],
"evidence": {
"idle_heartbeat_gate_loc_4046": {
"candidate_timer_roles": [
{
"address": 63940,
"address_hex": "H'F9C4",
"evidence_address_hex": "H'BF2D",
"role": "candidate idle heartbeat/report gate countdown"
}
],
"decrement_address_hex": "H'BF2D",
"gate_address_hex": "H'4046",
"initial_reload_address_hex": "H'40E0",
"initial_reload_value_hex": "H'14",
"items": [
{
"address": 16454,
"address_hex": "H'4046",
"present": true,
"targets_hex": [],
"text": "TST.B @H'F9C4"
},
{
"address": 16458,
"address_hex": "H'404A",
"present": true,
"targets_hex": [
"H'4058"
],
"text": "BNE loc_4058"
},
{
"address": 16460,
"address_hex": "H'404C",
"present": true,
"targets_hex": [],
"text": "BTST.B #7, @H'FAA5"
},
{
"address": 16464,
"address_hex": "H'4050",
"present": true,
"targets_hex": [
"H'4059"
],
"text": "BEQ loc_4059"
},
{
"address": 16466,
"address_hex": "H'4052",
"present": true,
"targets_hex": [],
"text": "TST.B @H'F9C3"
},
{
"address": 16470,
"address_hex": "H'4056",
"present": true,
"targets_hex": [
"H'4059"
],
"text": "BEQ loc_4059"
},
{
"address": 16472,
"address_hex": "H'4058",
"present": true,
"targets_hex": [],
"text": "RTS"
},
{
"address": 16473,
"address_hex": "H'4059",
"present": true,
"targets_hex": [],
"text": "MOV:G.B @H'F9B0, R2"
},
{
"address": 16479,
"address_hex": "H'405F",
"present": true,
"targets_hex": [],
"text": "CMP:G.B @H'F9B5, R2"
},
{
"address": 16483,
"address_hex": "H'4063",
"present": true,
"targets_hex": [
"H'4074"
],
"text": "BNE loc_4074"
},
{
"address": 16487,
"address_hex": "H'4067",
"present": true,
"targets_hex": [],
"text": "MOV:G.W #H'00, @(-H'0790,R2)"
},
{
"address": 16492,
"address_hex": "H'406C",
"present": true,
"targets_hex": [],
"text": "ADD:Q.B #1, @H'F9B0"
},
{
"address": 16496,
"address_hex": "H'4070",
"present": true,
"targets_hex": [],
"text": "BCLR.B #7, @H'F9B0"
},
{
"address": 16608,
"address_hex": "H'40E0",
"present": true,
"targets_hex": [],
"text": "MOV:G.B #H'14, @H'F9C4"
},
{
"address": 47665,
"address_hex": "H'BA31",
"present": true,
"targets_hex": [],
"text": "MOV:G.B #H'07, @H'F9C4"
},
{
"address": 48931,
"address_hex": "H'BF23",
"present": true,
"targets_hex": [],
"text": "BCLR.B #5, @FRT2_TCSR"
},
{
"address": 48935,
"address_hex": "H'BF27",
"present": true,
"targets_hex": [],
"text": "TST.B @H'F9C4"
},
{
"address": 48941,
"address_hex": "H'BF2D",
"present": true,
"targets_hex": [],
"text": "ADD:Q.B #-1, @H'F9C4"
}
],
"post_tx_reload_address_hex": "H'BA31",
"post_tx_reload_value_hex": "H'07",
"present": true,
"queue_write_address_hex": "H'4067",
"required_addresses_hex": [
"H'4046",
"H'4050",
"H'4067",
"H'40E0",
"H'BA31",
"H'BF23",
"H'BF2D"
],
"summary": "F9C4 gates the idle/default report enqueue. Reset/init loads H'14, each BA26 send reloads H'07, and the FRT2 OCIA handler decrements it; when it reaches zero loc_4046 can enqueue H'00FF if the queue is empty and the FAA5/F9C3 RX gate permits it. With FRT2 OCRA H'7A12 and CKS=phi/32, a phi near 10 MHz gives about 0.7s for H'07, matching the observed heartbeat cadence.",
"tick_handler_address_hex": "H'BF23",
"timer": {
"clock_select": "CKS1=1 CKS0=0 => phi/32",
"handler_address_hex": "H'BF23",
"manual_reference": "Manual/0900766b802125d0.md:12038 FRT CKS1/CKS0 clock select",
"observed_period_ms_candidate": 700,
"ocra_address_hex": "H'FEA4",
"ocra_value_hex": "H'7A12",
"source": "FRT2 OCIA",
"tcr_address_hex": "H'FEA0",
"tcsr_address_hex": "H'FEA1",
"vector_address_hex": "H'006A",
"vector_target_label": "vec_frt2_ocia_BF23"
},
"title": "loc_4046 idle heartbeat/report gate"
},
"queue_send_gate_loc_BAF2": {
"items": [
{
@@ -1330,6 +1509,87 @@
],
"write_count": 4
},
{
"accesses": [
{
"access": "read",
"address": 16454,
"address_hex": "H'4046",
"function": "loc_4046",
"text": "TST.B @H'F9C4"
},
{
"access": "write",
"address": 16608,
"address_hex": "H'40E0",
"function": "loc_40BB",
"text": "MOV:G.B #H'14, @H'F9C4"
},
{
"access": "write",
"address": 47665,
"address_hex": "H'BA31",
"function": "loc_BA26",
"text": "MOV:G.B #H'07, @H'F9C4"
},
{
"access": "read",
"address": 48935,
"address_hex": "H'BF27",
"function": "vec_frt2_ocia_BF23",
"text": "TST.B @H'F9C4"
},
{
"access": "read_write",
"address": 48941,
"address_hex": "H'BF2D",
"function": "vec_frt2_ocia_BF23",
"text": "ADD:Q.B #-1, @H'F9C4"
}
],
"address": 63940,
"address_hex": "H'F9C4",
"read_count": 2,
"read_write_count": 1,
"sample_accesses": [
{
"access": "read",
"address": 16454,
"address_hex": "H'4046",
"function": "loc_4046",
"text": "TST.B @H'F9C4"
},
{
"access": "write",
"address": 16608,
"address_hex": "H'40E0",
"function": "loc_40BB",
"text": "MOV:G.B #H'14, @H'F9C4"
},
{
"access": "write",
"address": 47665,
"address_hex": "H'BA31",
"function": "loc_BA26",
"text": "MOV:G.B #H'07, @H'F9C4"
},
{
"access": "read",
"address": 48935,
"address_hex": "H'BF27",
"function": "vec_frt2_ocia_BF23",
"text": "TST.B @H'F9C4"
},
{
"access": "read_write",
"address": 48941,
"address_hex": "H'BF2D",
"function": "vec_frt2_ocia_BF23",
"text": "ADD:Q.B #-1, @H'F9C4"
}
],
"write_count": 2
},
{
"accesses": [
{
@@ -1993,6 +2253,11 @@
"address_hex": "H'F9C3",
"symbol": "ram_F9C3"
},
{
"address": 63940,
"address_hex": "H'F9C4",
"symbol": "ram_F9C4"
},
{
"address": 63941,
"address_hex": "H'F9C5",

25
build/rom_serial_gate.txt
View File

@@ -72,6 +72,29 @@ Evidence:
- H'BDF7: BCLR.B #7, @H'F9B5
- H'BDFB: CLR.B @H'FAA3
- H'BDFF: CLR.B @H'FAA2
- loc_4046 idle heartbeat/report gate: present
F9C4 gates the idle/default report enqueue. Reset/init loads H'14, each BA26 send reloads H'07, and the FRT2 OCIA handler decrements it; when it reaches zero loc_4046 can enqueue H'00FF if the queue is empty and the FAA5/F9C3 RX gate permits it. With FRT2 OCRA H'7A12 and CKS=phi/32, a phi near 10 MHz gives about 0.7s for H'07, matching the observed heartbeat cadence.
- H'4046: TST.B @H'F9C4
- H'404A: BNE loc_4058
- H'404C: BTST.B #7, @H'FAA5
- H'4050: BEQ loc_4059
- H'4052: TST.B @H'F9C3
- H'4056: BEQ loc_4059
- H'4058: RTS
- H'4059: MOV:G.B @H'F9B0, R2
- H'405F: CMP:G.B @H'F9B5, R2
- H'4063: BNE loc_4074
- H'4067: MOV:G.W #H'00, @(-H'0790,R2)
- H'406C: ADD:Q.B #1, @H'F9B0
- H'4070: BCLR.B #7, @H'F9B0
- H'40E0: MOV:G.B #H'14, @H'F9C4
- H'BA31: MOV:G.B #H'07, @H'F9C4
- H'BF23: BCLR.B #5, @FRT2_TCSR
- H'BF27: TST.B @H'F9C4
- H'BF2D: ADD:Q.B #-1, @H'F9C4
Candidate timer roles:
- H'F9C4: candidate idle heartbeat/report gate countdown
Timer: FRT2 OCIA, H'BF23, OCRA=H'7A12, observed period ~= 700ms
- FRT1 OCIA periodic tick countdowns: present
Static evidence links vector H'0062 to the FRT1 OCIA handler at H'BEEA; the handler clears FRT1_TCSR.OCFA and conditionally decrements H'F9C0, H'F9C1, and H'F9C6.
- H'BEEA: BCLR.B #5, @FRT1_TCSR
@@ -101,6 +124,8 @@ State address readers/writers:
H'BAED write CLR.B @H'F9C1; H'BB71 read TST.B @H'F9C1; H'BBA3 write MOV:G.B #H'05, @H'F9C1; H'BEF8 read TST.B @H'F9C1; H'BEFE read_write ADD:Q.B #-1, @H'F9C1
- H'F9C3: reads=6 writes=4 read/write=0
H'3FDF read TST.B @H'F9C3; H'4052 read TST.B @H'F9C3; H'BA90 read TST.B @H'F9C3; H'BB77 write CLR.B @H'F9C3; H'BB7D read CMP:G.B #H'05, @H'F9C3; H'BB8A read MOV:G.B @H'F9C3, R1
- H'F9C4: reads=2 writes=2 read/write=1
H'4046 read TST.B @H'F9C4; H'40E0 write MOV:G.B #H'14, @H'F9C4; H'BA31 write MOV:G.B #H'07, @H'F9C4; H'BF27 read TST.B @H'F9C4; H'BF2D read_write ADD:Q.B #-1, @H'F9C4
- H'F9C5: reads=2 writes=2 read/write=1
H'3FEF read TST.B @H'F9C5; H'BB9E write MOV:G.B #H'14, @H'F9C5; H'BEE4 write CLR.B @H'F9C5; H'BF31 read TST.B @H'F9C5; H'BF37 read_write ADD:Q.B #-1, @H'F9C5
- H'F9C6: reads=2 writes=2 read/write=1

51
build/rom_serial_pseudocode.c
View File

@@ -173,17 +173,17 @@ extern volatile u8 MEM8[0x10000];
* state variable candidates:
* - event_queue_read_cursor_candidate H'F9B4: reads 1, writes 2; bits 5
* evidence: H'BE78, H'BE95, H'BE99
* - event_queue_write_or_pending_cursor_candidate H'F9B5: reads 1, writes 6; bits 7
* evidence: H'BAF2, H'BD6D, H'BD71, H'BDC8, H'BDCC, H'BDF3, H'BDF7
* - event_queue_write_or_pending_cursor_candidate H'F9B5: reads 2, writes 6; bits 7
* evidence: H'405F, H'BAF2, H'BD6D, H'BD71, H'BDC8, H'BDCC, H'BDF3, H'BDF7
* - event_queue_base_or_current_slot_candidate H'F9B9: reads 1, writes 0
* evidence: H'BE70
* - serial_tx_busy_timer_candidate H'F9C0: reads 2, writes 8
* evidence: H'BA26, H'BA2C, H'BAA2, H'BADA, H'BAE1, H'BAE8, H'BE1D, H'BE3E, H'BEEE, H'BEF4
* - autonomous_report_period_timer_candidate H'F9C6: reads 1, writes 2
* evidence: H'BB46, H'BEB5, H'BEC5
* - autonomous_report_resend_countdown_candidate H'F9C8: reads 1, writes 2
* evidence: H'BB4C, H'BEBB, H'BEC1
* - ... 5 more state-variable candidates
* - idle_heartbeat_gate_countdown_candidate H'F9C4: reads 2, writes 3
* evidence: H'4046, H'40E0, H'BA31, H'BF27, H'BF2D
* - rx_session_timeout_candidate H'F9C5: reads 1, writes 3
* evidence: H'BB9E, H'BEE4, H'BF31, H'BF37
* - ... 7 more state-variable candidates
* retry/error model candidate:
* - checksum path: 0x5A-seeded XOR over RX[0..4] differs from RX[5] -> loc_BE29
* - retry path: counter H'FAA6, threshold 2; Candidate retry path clears/consults serial flags, increments FAA6, compares it with 2, and when still below the apparent limit stages a command 0x07 response.
@@ -191,13 +191,16 @@ extern volatile u8 MEM8[0x10000];
* - evidence: H'BBD8, H'BBDC, H'BBE0, H'BBE4, H'BBE8, H'BBEC, H'BBF0, H'BE4D, H'BE56, H'BE5E, H'BE66, H'BE52, H'BE5A, H'BE62, H'BE6A, H'BE29, H'BE2D, H'BE33, H'BE37, H'BE43, H'BE47, H'BE05, H'BE0D, H'BE15, H'BE09, H'BE11, H'BE19, H'BE22
* gate/queue state machine candidate:
* - main_loop_may_enter_report_builder: FAA2 == 0 && F9C0 == 0 && ((FAA5.bit7 == 0) || (F9C3 == 0)); Main-loop report gate; session must be idle, TX busy timer clear, and RX gate open.
* - idle_heartbeat_report_may_enqueue: F9C4 == 0 && ((FAA5.bit7 == 0) || (F9C3 == 0)) && F9B0 == F9B5; Idle/default report gate; when the FRT2 countdown clears and the queue is empty, loc_4046 can enqueue H'00FF for the later loc_BAF2 -> loc_BA26 send path.
* - queue_has_pending_report: F9B5 != F9B0; Queue/pending cursor gate; non-empty state stages through BB43 before loc_BA26.
* - periodic_resend_may_fire: (FAA5 & FAA3 & 0x80) != 0 && F9C6 == 0 && F9C8 != 0 after countdown; Resend gate masks pending state with FAA5, checks F9C6/F9C8, then calls BA26 at BED5.
* - rx_completion_sets_session_timer: RX completion sets F9C5 (observed reload H'14) after the sixth byte is captured.
* - session_timeout_clears_gate_and_queue: When F9C5 is clear, loc_3FEF clears F9B5/F9B0 and clears FAA5.bit7; when nonzero, it sets FAA5.bit7.
* - idle_heartbeat_gate_initial_delay_loaded: Startup/init loads F9C4 with H'14 before the first idle/default report can be queued.
* - idle_heartbeat_gate_post_send_delay_loaded: loc_BA26 reloads F9C4 with H'07 after each send, matching the observed heartbeat spacing.
* - host_ack_can_advance_queue: Commands 0x05/0x06 are modeled as acknowledgement paths that can clear pending state or advance F9B5.; commands H'05, H'06
* - caveat: Many panel controls may require host/session traffic before reporting. Observed autonomous call/camera-power indexes are runtime/capture overlays, not ROM constants.
* - evidence: H'3FD3, H'3FD7, H'3FD9, H'3FDD, H'3FDF, H'3FE3, H'3FE5, H'3FE9, H'3FEB, H'3FEF, H'3FF3, H'3FF5, H'3FF9, H'3FFD, H'4001, H'4003, H'4005, H'4007, H'BAF2, H'BAF6, H'BAF8, H'BAFC, H'BAFE, H'BB00, H'BB04, H'BB06, H'BB08, H'BB0C, H'BB0E, H'BB11, H'BB13, H'BB15, H'BB17, H'BB19, H'BB1C, H'BB20, H'BB24, H'BB26, H'BB29, H'BB2B, H'BB2F, H'BB33, H'BB35, H'BB39, H'BB3D, H'BB3F, H'BB43, H'BE9E, H'BEA2, H'BEA5, H'BEA9, H'BEAD, H'BEAF, H'BEB3, H'BEB5, H'BEB9, H'BEBB, H'BEBF, H'BEC1, H'BEC5, H'BECB, H'BECF, H'BED1, H'BED5
* - evidence: H'3FD3, H'3FD7, H'3FD9, H'3FDD, H'3FDF, H'3FE3, H'3FE5, H'3FE9, H'3FEB, H'3FEF, H'3FF3, H'3FF5, H'3FF9, H'3FFD, H'4001, H'4003, H'4005, H'4007, H'4046, H'404A, H'404C, H'4050, H'4052, H'4056, H'4058, H'4059, H'405D, H'405F, H'4063, H'4065, H'4067, H'406C, H'4070, H'BAF2, H'BAF6, H'BAF8, H'BAFC, H'BAFE, H'BB00, H'BB04, H'BB06, H'BB08, H'BB0C, H'BB0E, H'BB11, H'BB13, H'BB15, H'BB17, H'BB19, H'BB1C, H'BB20, H'BB24, H'BB26, H'BB29, H'BB2B, H'BB2F, H'BB33, H'BB35, H'BB39, H'BB3D, H'BB3F, H'BB43, H'BE9E, H'BEA2, H'BEA5, H'BEA9, H'BEAD, H'BEAF, H'BEB3, H'BEB5, H'BEB9, H'BEBB, H'BEBF, H'BEC1, H'BEC5, H'BECB, H'BECF, H'BED1, H'BED5
* TX/autonomous report model candidate:
* - loc_BB43 -> loc_BA26: bytes 0..2 encode candidate logical index/report id; bytes 3..4 come from current_value_table_candidate; byte5 is 0x5A XOR checksum
* - observed overlay candidates: heartbeat_or_idle_report_candidate: 00 00 00 00 80 DA; call_button_report_candidate: 00 00 15 80 00 CF, 00 00 15 00 00 4F; camera_power_report_candidate: 00 00 07 80 00 DD
@@ -210,10 +213,14 @@ extern volatile u8 MEM8[0x10000];
* - BED5 resend path: Candidate periodic resend path feeding the TX staging/send-builder flow.
* - evidence: H'BB46, H'BEC5, H'BB4C, H'BB51, H'BECB, H'BED5
* interrupt/timer architecture candidate:
* - FRT1 OCIA H'BEEA appears to be a periodic tick ISR for serial gate/cadence counters.
* - FRT1 OCIA H'BEEA: Candidate periodic tick ISR for serial busy, interbyte, and resend counters.
* - FRT2 OCIA H'BF23: Candidate periodic tick ISR for idle heartbeat/report and RX session counters.
* - H'F9C0 tx_report_gate_counter_candidate: candidate gate counter used before entering the report builder.
* - H'F9C1 rx_interbyte_timeout_candidate: candidate RX interbyte timeout counter.
* - H'F9C6 periodic_resend_cadence_counter_candidate: candidate periodic resend/heartbeat cadence counter.
* - H'F9C4 idle_heartbeat_gate_countdown_candidate: candidate idle/default report enqueue countdown.
* - H'F9C5 rx_session_timeout_candidate: candidate RX/session maintenance timeout counter.
* - evidence: H'BEEA, H'BEEE, H'BEF2, H'BEF4, H'BEF8, H'BEFC, H'BEFE, H'BF02, H'BF06, H'BF08, H'BF23, H'BF27, H'BF2B, H'BF2D, H'BF31, H'BF35, H'BF37
*/
static u8 sci1_rx_candidate_command(void)
@@ -257,6 +264,15 @@ static bool sci1_candidate_report_queue_nonempty(void)
return MEM8[0xF9B5u] != MEM8[0xF9B0u];
}
static bool sci1_candidate_idle_heartbeat_enqueue_gate_open(void)
{
bool idle_timer_clear = MEM8[0xF9C4u] == 0u;
bool rx_gate_open = (MEM8[0xFAA5u] & 0x80u) == 0u || MEM8[0xF9C3u] == 0u;
bool queue_empty = MEM8[0xF9B0u] == MEM8[0xF9B5u];
return idle_timer_clear && rx_gate_open && queue_empty;
}
static bool sci1_candidate_periodic_resend_gate_open(void)
{
bool pending = (MEM8[0xFAA5u] & MEM8[0xFAA3u] & 0x80u) != 0u;
@@ -268,7 +284,7 @@ static bool sci1_candidate_periodic_resend_gate_open(void)
void frt1_ocia_candidate_tick_isr(void)
{
/* Candidate periodic tick at H'BEEA: decrement nonzero serial gate/cadence counters. */
/* Candidate periodic tick at H'BEEA: decrement nonzero serial counters. */
/* TX_REPORT_GATE_COUNTER_CANDIDATE: candidate gate counter used before entering the report builder. */
if (MEM8[0xF9C0u] != 0u) {
MEM8[0xF9C0u] = (u8)(MEM8[0xF9C0u] - 1u);
@@ -286,6 +302,21 @@ void frt1_ocia_candidate_tick_isr(void)
}
void frt2_ocia_candidate_tick_isr(void)
{
/* Candidate periodic tick at H'BF23: decrement nonzero serial counters. */
/* IDLE_HEARTBEAT_GATE_COUNTDOWN_CANDIDATE: candidate idle/default report enqueue countdown. */
if (MEM8[0xF9C4u] != 0u) {
MEM8[0xF9C4u] = (u8)(MEM8[0xF9C4u] - 1u);
}
/* RX_SESSION_TIMEOUT_CANDIDATE: candidate RX/session maintenance timeout counter. */
if (MEM8[0xF9C5u] != 0u) {
MEM8[0xF9C5u] = (u8)(MEM8[0xF9C5u] - 1u);
}
}
void sci1_process_candidate_protocol_command(void)
{
u8 command = sci1_rx_candidate_command();