Document where Moto/DFU entry is, and let a boot key hold PTT plus a key

The bootloader's DFU handler is reachable only when SRAM[0x20000020] is 3, which only a program that then resets can write. The application's 0x05DD takes that path only with ENABLE_OVERLAY; this build resets straight back into the application instead. Ruled out by measurement: PTT alone, PTT+SIDE1/SIDE2, MENU, a host byte in the boot window including 0x0530, and 0x05DD.

boot-key now reads a + separated list, because the firmware's own BOOT_GetMode() needs PTT and a matrix key together for every special boot mode. Tested against all four documented combinations.

qemu/py32f071.c

@@ -3595,12 +3595,32 @@ static void uvk5_arm_boot_key(UVK5MachineState *s)
     if (key == NULL || *key == '\0') {
         return;
     }
-    s->boot_key_ptt = (g_ascii_strcasecmp(key, "PTT") == 0);
-    if (s->boot_key_ptt) {
-        object_property_set_bool(OBJECT(&s->keypad), "ptt", true, &err);
-    } else {
-        object_property_set_str(OBJECT(&s->keypad), "press", key, &err);
+    /*
+     * "+" holds more than one: the firmware's own BOOT_GetMode() reads PTT and a
+     * matrix key, and returns F_LOCK for PTT+SIDE1, AIRCOPY for PTT+SIDE2 and
+     * RESCUE_OPS for PTT plus the key named by the SET_KEY setting. A boot key that
+     * can only be one of those cannot reproduce any of the special boot modes, which
+     * is what made the bootloader look unreachable from here.
+     */
+    char **parts = g_strsplit(key, "+", -1);
+    for (char **part = parts; part != NULL && *part != NULL; part++) {
+        const char *one = g_strstrip(*part);
+        if (*one == '\0') {
+            continue;
+        }
+        if (g_ascii_strcasecmp(one, "PTT") == 0) {
+            s->boot_key_ptt = true;
+            object_property_set_bool(OBJECT(&s->keypad), "ptt", true, &err);
+        } else {
+            object_property_set_str(OBJECT(&s->keypad), "press", one, &err);
+        }
+        if (err != NULL) {
+            error_report("boot-key: %s", error_get_pretty(err));
+            error_free(err);
+            err = NULL;
+        }
     }
+    g_strfreev(parts);
     if (err) {
         warn_report("boot-key %s: %s", key, error_get_pretty(err));
         error_free(err);