65 lines
3.1 KiB
Markdown
65 lines
3.1 KiB
Markdown
# PT2 Known Button ROM Trace
|
|
|
|
This report follows the panel button edge path from the serial-visible reports back into the ROM input scanner.
|
|
The key table is the indirect handler table at `H'2706`, used by `loc_1C0E` after byte-level panel input changes are detected.
|
|
|
|
## Known Anchors
|
|
|
|
### CAM POWER
|
|
|
|
- Emitted selector: `0x0007`
|
|
- Handler: `H'1F40`
|
|
- Edge source: `F105 -> F6D4` via `F6F2.4`
|
|
- Trigger bit: `F6D4.3`
|
|
- Table slot: `H'274C` -> `H'1F40`
|
|
- Current-level tests: F6D4.3
|
|
- State writes: E80E
|
|
|
|
### CALL
|
|
|
|
- Emitted selector: `0x0015`
|
|
- Handler: `H'20A1`
|
|
- Edge source: `F006 -> F6DB` via `F6F3.3`
|
|
- Trigger bit: `F6DB.5`
|
|
- Table slot: `H'27C0` -> `H'20A1`
|
|
- Current-level tests: F6DB.5
|
|
- State writes: E82A
|
|
|
|
## Button Matrix Entries With Serial Reports
|
|
|
|
| Source | Shadow bit | Dirty | Handler | Selector(s) | State writes |
|
|
| --- | --- | --- | --- | --- | --- |
|
|
| `F105` | `F6D4.6` | `F6F2.4` | `H'2048` | `0x006B` | `E8D6` |
|
|
| `F105` | `F6D4.3` | `F6F2.4` | `H'1F40` | `0x0007` | `E80E` |
|
|
| `F105` | `F6D4.2` | `F6F2.4` | `H'1EDE` | `0x0017`, `0x0018` | `E82E`, `E830` |
|
|
| `F105` | `F6D4.1` | `F6F2.4` | `H'1EA9` | `0x00F8` | `E9F0` |
|
|
| `F105` | `F6D4.0` | `F6F2.4` | `H'1E20` | `0x00B7`, `0x00C4`, `0x00C6`, `0x0097` | `E96E`, `E988`, `E98C`, `E92E` |
|
|
| `F106` | `F6D3.7` | `F6F2.3` | `H'1DCE` | `0x0096` | `E92C` |
|
|
| `F106` | `F6D3.6` | `F6F2.3` | `H'1D87` | `0x0097` | `E92E` |
|
|
| `F106` | `F6D3.5` | `F6F2.3` | `H'1D56` | `0x001A` | `E834` |
|
|
| `F106` | `F6D3.4` | `F6F2.3` | `H'1D25` | `0x001A` | `E834` |
|
|
| `F106` | `F6D3.3` | `F6F2.3` | `H'1CF4` | `0x001A` | `E834` |
|
|
| `F106` | `F6D3.2` | `F6F2.3` | `H'1CCE` | `0x001A` | `E834` |
|
|
| `F106` | `F6D3.1` | `F6F2.3` | `H'1CB2` | `0x001A` | `E834` |
|
|
| `F109` | `F6D0.7` | `F6F2.0` | `H'24E8` | `0x008F` | `E91E` |
|
|
| `F109` | `F6D0.6` | `F6F2.0` | `H'252E` | `0x008F` | `E91E` |
|
|
| `F109` | `F6D0.3` | `F6F2.0` | `H'24A9` | `0x0083` | `E906` |
|
|
| `F109` | `F6D0.2` | `F6F2.0` | `H'2408` | `0x0083` | `E906` |
|
|
| `F109` | `F6D0.1` | `F6F2.0` | `H'2390` | `0x0083` | `E906` |
|
|
| `F005` | `F6DC.7` | `F6F3.4` | `H'20F1` | `0x00B9` | `E972` |
|
|
| `F005` | `F6DC.5` | `F6F3.4` | `H'2204` | `0x0093` | `E926` |
|
|
| `F005` | `F6DC.4` | `F6F3.4` | `H'226D` | `0x0093` | `E926` |
|
|
| `F005` | `F6DC.3` | `F6F3.4` | `H'22A6` | `0x0093` | `E926` |
|
|
| `F005` | `F6DC.1` | `F6F3.4` | `H'22FC` | `0x0093` | `E926` |
|
|
| `F005` | `F6DC.0` | `F6F3.4` | `H'2326` | `0x0093` | `E926` |
|
|
| `F006` | `F6DB.7` | `F6F3.3` | `H'200E` | `0x0013` | `E826` |
|
|
| `F006` | `F6DB.5` | `F6F3.3` | `H'20A1` | `0x0015` | `E82A` |
|
|
| `F006` | `F6DB.3` | `F6F3.3` | `H'20BE` | `0x009A` | `E934` |
|
|
|
|
## Practical Read
|
|
|
|
- CALL and CAM POWER do share the general panel edge path with many other buttons.
|
|
- The shared path is: panel byte snapshot -> shadow byte -> dirty bit -> `loc_1C0E` jump table -> handler -> `loc_3E54` report.
|
|
- Other buttons diverge in their handlers: many require `F731/F730/F791` session/menu gates, mutate page state, or emit different selectors.
|
|
- Some table entries are `H'1C25`, an immediate `RTS`, so those physical matrix positions are intentionally ignored in this firmware context.
|