aiden/h8-536-decoder
1
0
Fork 0
Code Activity

EEPROM layout

Browse Source
This commit is contained in:
Aiden
2026-05-26 11:35:21 +10:00
parent 1ad03d5692
commit edb8ed78f3
19 changed files with 169583 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

179
build/rom_eeprom_layout.txt Normal file
View File

@@ -0,0 +1,179 @@
H8/536 EEPROM Layout Report
Summary: The ROM treats the traced P9 bus as two X24164-style EEPROM banks, mirrors a 0x100-byte factory/default block into F400-F4FF, and loads sixteen 8-byte persistent records into F7B0-F82F at boot.
Confidence: medium-high
Physical / Logical Model:
- lower_x24164_candidate: logical 0x000-0x7FF control A0/A1
- upper_x24164_candidate: logical 0x800-0xFFF control E0/E1
- bus: P91/SCL and P97/SDA bit-banged two-wire bus through ROM routines C121/C08B/C0DB/C10C/C142
- page model: 16 logical pages of 0x100 bytes; low 8 address bits are sent as the EEPROM word address
Boot Flow:
- H'40BB eeprom_boot_gate: initializes queue/table scratch, checks P7DR.7, then checks F402 == H'6B6F before trusting persisted state
- H'4103 factory_default_fill: copies ROM C964-CA63 into F400-F4FF and writes the same 0x100-byte defaults to each EEPROM page
- H'4187 record_header_blank: overwrites page offsets 0x00-0x07 on pages 0x1-0xF with four H'2020 words after factory replication; page 0 keeps the signature/options header
- H'41D2 persistent_record_load: reads page offsets 0x00-0x07 from pages 0x0-0xF into F7B0-F82F; record 0 is a signature/options header, records 1-F are label/identity-like slots
- H'BD2B serial_persist_path: command-4 continuation writes the live value into F400+map[selector] and persists it through BFE0 when F76E.7 is set
Factory Shadow Block:
- ROM H'C964 length 0x100 mirrors to H'F400-H'F4FF
- H'F402 offset 0x02 default 0x6B6F (ascii='ko'; xrefs=1)
- H'F404 offset 0x04 default 0xFE00 (xrefs=8)
- H'F408 offset 0x08 default 0x8000 (selectors=0x004)
- H'F40A offset 0x0A default 0x0000 (selectors=0x012)
- H'F40C offset 0x0C default 0x0000 (selectors=0x013)
- H'F40E offset 0x0E default 0x8000 (selectors=0x017)
- H'F410 offset 0x10 default 0x8000 (selectors=0x018)
- H'F412 offset 0x12 default 0x0808 (selectors=0x01A)
- H'F414 offset 0x14 default 0x0000 (selectors=0x01F)
- H'F416 offset 0x16 default 0x0000 (selectors=0x020)
- H'F418 offset 0x18 default 0x0000 (selectors=0x023)
- H'F41A offset 0x1A default 0x0000 (selectors=0x037)
- H'F41C offset 0x1C default 0x0000 (selectors=0x038)
- H'F41E offset 0x1E default 0x8000 (selectors=0x080)
- H'F420 offset 0x20 default 0x8000 (selectors=0x081)
- H'F422 offset 0x22 default 0x0020 (ascii='. '; selectors=0x083)
- H'F424 offset 0x24 default 0x0000 (selectors=0x088)
- H'F426 offset 0x26 default 0x0400 (selectors=0x089)
- H'F428 offset 0x28 default 0x0800 (selectors=0x08B)
- H'F42A offset 0x2A default 0x0040 (ascii='.@'; selectors=0x08D)
- H'F42C offset 0x2C default 0x0000 (selectors=0x08F)
- H'F42E offset 0x2E default 0x8000 (selectors=0x091)
- H'F430 offset 0x30 default 0xFF80 (selectors=0x092)
- H'F432 offset 0x32 default 0x4040 (ascii='@@'; selectors=0x093)
- H'F434 offset 0x34 default 0x0000 (selectors=0x095)
- H'F436 offset 0x36 default 0x0000 (selectors=0x098)
- H'F438 offset 0x38 default 0x8000 (selectors=0x09A)
- H'F43A offset 0x3A default 0x0000 (selectors=0x09D)
- H'F43C offset 0x3C default 0x8000 (selectors=0x09E)
- H'F43E offset 0x3E default 0x8000 (selectors=0x09F)
- H'F440 offset 0x40 default 0x8000 (selectors=0x0A3)
- H'F442 offset 0x42 default 0x8000 (selectors=0x0A4)
Persistent 8-Byte Records:
- 16 records: EEPROM 0x000-0x007 .. 0xF00-0xF07 load into RAM H'F7B0-H'F7B7 .. H'F828-H'F82F
- record 0x0: EEPROM 0x000-0x007 -> RAM H'F7B0-H'F7B7 default '..ko....'
- record 0x1: EEPROM 0x100-0x107 -> RAM H'F7B8-H'F7BF default ' '
- record 0x2: EEPROM 0x200-0x207 -> RAM H'F7C0-H'F7C7 default ' '
- record 0x3: EEPROM 0x300-0x307 -> RAM H'F7C8-H'F7CF default ' '
- record 0x4: EEPROM 0x400-0x407 -> RAM H'F7D0-H'F7D7 default ' '
- record 0x5: EEPROM 0x500-0x507 -> RAM H'F7D8-H'F7DF default ' '
- record 0x6: EEPROM 0x600-0x607 -> RAM H'F7E0-H'F7E7 default ' '
- record 0x7: EEPROM 0x700-0x707 -> RAM H'F7E8-H'F7EF default ' '
- record 0x8: EEPROM 0x800-0x807 -> RAM H'F7F0-H'F7F7 default ' '
- record 0x9: EEPROM 0x900-0x907 -> RAM H'F7F8-H'F7FF default ' '
- record 0xA: EEPROM 0xA00-0xA07 -> RAM H'F800-H'F807 default ' '
- record 0xB: EEPROM 0xB00-0xB07 -> RAM H'F808-H'F80F default ' '
- record 0xC: EEPROM 0xC00-0xC07 -> RAM H'F810-H'F817 default ' '
- record 0xD: EEPROM 0xD00-0xD07 -> RAM H'F818-H'F81F default ' '
- record 0xE: EEPROM 0xE00-0xE07 -> RAM H'F820-H'F827 default ' '
- record 0xF: EEPROM 0xF00-0xF07 -> RAM H'F828-H'F82F default ' '
Serial Selector -> Shadow/EEPROM Mapping:
- table H'C564 has 89 nonzero low-byte mappings
- formula: command 4 persists to EEPROM address (((F76E & 0x0F) << 8) | (mapping_low_byte & 0xFE)) when F76E.7 is set
- selector 0x004 map_word=0x4808 -> H'F408 page+0x08 default=0x8000
- selector 0x012 map_word=0x080A -> H'F40A page+0x0A default=0x0000
- selector 0x013 map_word=0x080C -> H'F40C page+0x0C default=0x0000
- selector 0x017 map_word=0x600E -> H'F40E page+0x0E default=0x8000
- selector 0x018 map_word=0x6010 -> H'F410 page+0x10 default=0x8000
- selector 0x01A map_word=0x1012 -> H'F412 page+0x12 default=0x0808
- selector 0x01F map_word=0x4414 -> H'F414 page+0x14 default=0x0000
- selector 0x020 map_word=0x4416 -> H'F416 page+0x16 default=0x0000
- selector 0x023 map_word=0x0418 -> H'F418 page+0x18 default=0x0000
- selector 0x037 map_word=0x641A -> H'F41A page+0x1A default=0x0000
- selector 0x038 map_word=0x641C -> H'F41C page+0x1C default=0x0000
- selector 0x080 map_word=0xE01E -> H'F41E page+0x1E default=0x8000
- selector 0x081 map_word=0x6020 -> H'F420 page+0x20 default=0x8000
- selector 0x083 map_word=0x6022 -> H'F422 page+0x22 default=0x0020
- selector 0x088 map_word=0x4024 -> H'F424 page+0x24 default=0x0000
- selector 0x089 map_word=0x4426 -> H'F426 page+0x26 default=0x0400
- selector 0x08B map_word=0x4428 -> H'F428 page+0x28 default=0x0800
- selector 0x08D map_word=0x442A -> H'F42A page+0x2A default=0x0040
- selector 0x08F map_word=0x602C -> H'F42C page+0x2C default=0x0000
- selector 0x091 map_word=0x602E -> H'F42E page+0x2E default=0x8000
- selector 0x092 map_word=0x6030 -> H'F430 page+0x30 default=0xFF80
- selector 0x093 map_word=0x6032 -> H'F432 page+0x32 default=0x4040
- selector 0x095 map_word=0x6034 -> H'F434 page+0x34 default=0x0000
- selector 0x098 map_word=0x4036 -> H'F436 page+0x36 default=0x0000
- selector 0x09A map_word=0x6038 -> H'F438 page+0x38 default=0x8000
- selector 0x09D map_word=0x443A -> H'F43A page+0x3A default=0x0000
- selector 0x09E map_word=0x603C -> H'F43C page+0x3C default=0x8000
- selector 0x09F map_word=0x603E -> H'F43E page+0x3E default=0x8000
- selector 0x0A3 map_word=0x6040 -> H'F440 page+0x40 default=0x8000
- selector 0x0A4 map_word=0x6042 -> H'F442 page+0x42 default=0x8000
- selector 0x0A5 map_word=0x6044 -> H'F444 page+0x44 default=0x8000
- selector 0x0A6 map_word=0x6046 -> H'F446 page+0x46 default=0x8000
- selector 0x0A7 map_word=0x4048 -> H'F448 page+0x48 default=0xF000
- selector 0x0A9 map_word=0xE04A -> H'F44A page+0x4A default=0x8000
- selector 0x0AA map_word=0xC44C -> H'F44C page+0x4C default=0x2000
- selector 0x0AC map_word=0xC44E -> H'F44E page+0x4E default=0x8000
- selector 0x0AD map_word=0xC450 -> H'F450 page+0x50 default=0x8000
- selector 0x0AE map_word=0xC452 -> H'F452 page+0x52 default=0x8000
- selector 0x0AF map_word=0xC454 -> H'F454 page+0x54 default=0x8000
- selector 0x0B0 map_word=0xC456 -> H'F456 page+0x56 default=0x8000
- selector 0x0B2 map_word=0xC458 -> H'F458 page+0x58 default=0x8000
- selector 0x0B3 map_word=0xC45A -> H'F45A page+0x5A default=0x8000
- selector 0x0B4 map_word=0xC45C -> H'F45C page+0x5C default=0x8000
- selector 0x0B6 map_word=0xC45E -> H'F45E page+0x5E default=0x8000
- selector 0x0B7 map_word=0x4060 -> H'F460 page+0x60 default=0xF800
- selector 0x0B9 map_word=0x6862 -> H'F462 page+0x62 default=0x4000
- selector 0x0BC map_word=0xE064 -> H'F464 page+0x64 default=0x8000
- selector 0x0BD map_word=0xC066 -> H'F466 page+0x66 default=0x8000
- selector 0x0C0 map_word=0x4468 -> H'F468 page+0x68 default=0x8000
- selector 0x0C1 map_word=0xC46A -> H'F46A page+0x6A default=0x8000
- selector 0x0C3 map_word=0xE46C -> H'F46C page+0x6C default=0x4000
- selector 0x0C4 map_word=0x446E -> H'F46E page+0x6E default=0x8000
- selector 0x0C5 map_word=0xC070 -> H'F470 page+0x70 default=0x8000
- selector 0x0C6 map_word=0x4472 -> H'F472 page+0x72 default=0x8000
- selector 0x0C7 map_word=0xC474 -> H'F474 page+0x74 default=0x8000
- selector 0x0C8 map_word=0xC476 -> H'F476 page+0x76 default=0x0000
- selector 0x0C9 map_word=0xC478 -> H'F478 page+0x78 default=0x0000
- selector 0x0CA map_word=0xC47A -> H'F47A page+0x7A default=0x0000
- selector 0x0CB map_word=0xC47C -> H'F47C page+0x7C default=0x0000
- selector 0x0CC map_word=0xC47E -> H'F47E page+0x7E default=0x0000
- selector 0x0CD map_word=0xC480 -> H'F480 page+0x80 default=0x0000
- selector 0x0D4 map_word=0xC482 -> H'F482 page+0x82 default=0x8000
- selector 0x0D5 map_word=0xC484 -> H'F484 page+0x84 default=0x8000
- selector 0x0D6 map_word=0xC086 -> H'F486 page+0x86 default=0x8000
- selector 0x0D7 map_word=0xC088 -> H'F488 page+0x88 default=0x8000
- selector 0x0D8 map_word=0x408A -> H'F48A page+0x8A default=0x8000
- selector 0x0D9 map_word=0x408C -> H'F48C page+0x8C default=0x8000
- selector 0x0DA map_word=0x408E -> H'F48E page+0x8E default=0x8000
- selector 0x0F6 map_word=0x4090 -> H'F490 page+0x90 default=0x8000
- selector 0x0F9 map_word=0x4492 -> H'F492 page+0x92 default=0x8000
- selector 0x0FA map_word=0x4494 -> H'F494 page+0x94 default=0x8000
- selector 0x0FB map_word=0x4496 -> H'F496 page+0x96 default=0x8000
- selector 0x0FC map_word=0x4498 -> H'F498 page+0x98 default=0x8000
- selector 0x0FD map_word=0x409A -> H'F49A page+0x9A default=0x8000
- selector 0x0FE map_word=0x449C -> H'F49C page+0x9C default=0x8000
- selector 0x0FF map_word=0x449E -> H'F49E page+0x9E default=0x8000
- selector 0x100 map_word=0x44A0 -> H'F4A0 page+0xA0 default=0x8000
- selector 0x101 map_word=0x44A2 -> H'F4A2 page+0xA2 default=0x8000
- selector 0x10F map_word=0xC4A4 -> H'F4A4 page+0xA4 default=0x8000
- selector 0x110 map_word=0x48A6 -> H'F4A6 page+0xA6 default=0x0000
- ... 9 more mapped selectors omitted
State Byte Hints:
- H'F402 factory_signature_word: factory 0x6B6F; boot accepts persisted state only when this word is H'6B6F (xrefs=1)
- H'F404 feature_or_option_flags_candidate: factory 0xFE00; bits 1-4 are tested with F791 gates in display/status routines (xrefs=8)
- H'F730 connect_display_state_candidate: volatile/no factory word (xrefs=3)
- H'F731 session_latch_candidate: volatile/no factory word (xrefs=22)
- H'F732 display_dispatch_selector_candidate: volatile display dispatch selector feeding the 493E pointer table and 48FA report bridge (xrefs=11)
- H'F76E eeprom_page_and_persist_flags: bit7 enables command-4 EEPROM persistence, bit6 suppresses 48FA dispatch, low nibble selects EEPROM page (xrefs=4)
- H'F790 connection_latch_shadow_candidate: volatile/no factory word (xrefs=1)
- H'F791 feature_flag_gate_candidate: volatile gate tested alongside F404 option bits before setting report/display flags (xrefs=12)
- H'FB03 report_bridge_suppress_candidate: volatile/no factory word (xrefs=10)
Bench Implications:
- A live EEPROM dump should first compare F400-F4FF shadow-equivalent offsets against the ROM factory table, especially F402/F404 and mapped offsets.
- Pages 0x0-0xF offset 0x00-0x07 are loaded into F7B0-F82F; page 0 carries the signature/options header and pages 1-F default to spaces, so non-space bytes there are high-value identity/config data.
- Serial command 0/4 can mirror values into F400 offsets selected by the ROM mapping table, but command 4 only persists when the continuation path reaches BD2B and F76E.7 is set.
- F76E is not just a page byte: bit7 gates EEPROM persistence, bit6 suppresses the 48FA dispatch path, and only its low nibble survives into the EEPROM page address.
- CONNECT OK is still likely gated by volatile table/session state as well as EEPROM-backed defaults; EEPROM differences may explain why bench and emulator diverge, but are unlikely to be the whole protocol by themselves.
Caveats:
- The selector map proves where firmware mirrors/persists serial values, not what every field means to the panel UI.
- High bytes in the C564 selector map look structured, but the observed command-0/command-4 paths only use the low byte for F400/EEPROM offsets.
- Indexed F7B0-F82F record consumers can be missed by a static xref pass; dynamic emulator traces should be used once interesting record bytes are found.