thinkpad-ec/docs/table_fnkeys.txt

The EC firmware has at leat two tables that control the Fn+key combinations.
There is some evidence that there is a third table, but the table itself has
not been found.

Simple Key Replacements table:
------------------------------

This table is a simple array of key replacement entries - if Fn is held
down at the same time as the keycode from the first byte, then the
keycode from the second byte is substituted (with possible modifier
keys from the third byte)

The table is big enough to hold 11 key replacements, and in the standard
firmare all but one of these are already used.

This structure of this table was identical in both the x220 and x230
firmware, just the contents differed.  The classic keyboard patch simply
patched the exact values from the x220 firmware into place.

    ; this three byte entry is repeated as needed
    db  ORIG_key
    db  NEW_key
    db  modifiers ; only 0x01 for Alt_L and 0x02 for Ctrl_L were seen

    (source: x220 EC firmware version 8DHT34WW, offset 0x1f05e)
    (source: x230 EC firmware version G2HT35WW, offset 0x21898)

The address of this table and the number of entries contained in it are
located in a pointer object. 

    ; x220 simple replacement table ptr
    org 0x1f058
    dw  11      ; number of entries
    dd  0x1f05e ; address of simple replacement table
    
    (source: x220 EC firmware version 8DHT34WW, offset 0x1f058)

    ; x230 simple replacement table ptr
    org 0x218d0
    dd  11      ; number of entries
    dd  0x21898 ; address of simple replacement table

    (source: x230 EC firmware version G2HT35WW, offset 0x218d0)


Complex Key Handling Table:
---------------------------

I call this table complex only because it appears to call special handler
functions for the key replacements.  The actual difference is probably
that the "simple" replacements are still generating normal key-presses and
this "complex" table is generating ACPI events.

The size of this table is big enough for 27 keys to be described and in the
standard x230 firmware, there are 14 entries that are clearly used and three
entries that may be used for something.

    ; this two byte entry is repeated as needed
    db  magic_code
    db  key

    (source: x220 EC firmware version 8DHT34WW, offset 0x1ee36)
    (source: x230 EC firmware version G2HT35WW, offset 0x2166c)

The magic_code appears to specify which handler to call and the key is the
key pressed to match this entry.

The following magic_codes have been seen in the firmware tables.  Due to the
risk of bricking the laptop, no experimentation on what other codes do has
been done.

    x220        x230    Action
    ----        ----    ------
    0x03        0xc0    Function handled by OS, sends a modified keypress
    0x3b        0xc7    Sleep
    0x27        0xe4    Brightness+
    0x2f        0xe5    Brightness-
    0x43        na      Hibernate
    0x33        0xc6    ThinkLight

Similar to the previous table, the address of this table and the number of
entries is located in a pointer object:

    org 0x216a4
    dd  8       ; number of entries in the jump table
    dd  0x2164c ; pointer to a list of function pointers
    dd  0x1b    ; number of entries in the complex replacement table
    dd  0x2166c ; pointer to the complex replacement table.

Since this pointer object also contains a pointer to a jump table, I have
assumed that the various codes in the replacement table end up indicating
the specific function used to handle that keypress.

    (source: x230 EC firmware version G2HT35WW, offset 0x2166c)