reference: map the ROM's third-party code -- MIT X11 R4, BSD 4.3 TCP/IP + BIND + telnet, TI RTS, and the font licences

reference/third-party-code.md

@@ -0,0 +1,153 @@
+# Third-party and open-source code in the VT1200 ROM
+
+A map of the non-DEC code in `vt1200_v22.bin` (md5
+`b46a3e442ccb86134d2356bd70d22fd2`), and how each identification was made.
+
+Two kinds of evidence are used, and they are not equivalent:
+
+* **Source IDs** — `$Header:` (RCS) and `@(#)` (SCCS) strings compiled into the
+  image. These name the original source file and, for RCS, the revision and
+  date. Strong, but they are file names, not a licence statement.
+* **Code match** — disassembly compared with a known source tree (e.g. the
+  X11R4 sources under `reference/x11/r4`).
+
+Copyright strings are quoted where they exist. **The absence of a copyright
+string is not evidence of absence**: most of this code carries its notice in
+source comments, which do not survive compilation.
+
+## Summary
+
+| component | evidence | notes |
+|---|---|---|
+| **MIT X11 R4** | `mfb*`, `pcf*`, `snf*`, `bdf*`, `Xlib` strings; exact match to `reference/x11/r4/.../pcfrbitmaps.c` | X server + Xlib + font parsers |
+| **BSD 4.3-era TCP/IP** | `$Header`/`@(#)` IDs for the full socket/TCP/IP/mbuf file set | ported at DEC by `craig`, 1989-10-05/06 |
+| **BSD BIND resolver** | `res_comp.c`, `res_init.c`, `res_mkquery.c`, `res_send.c`, `gethostent.c` | classic 4.8/4.9-era resolver |
+| **BSD telnet + TN3270** | `telnet.c`, `commands.c`, `network.c`, `ring.c`, `sys_bsd.c`, `terminal.c`, `utilities.c`, `tn3270.c` | same 1989 import |
+| **BSD inetd** | `inetd.c` | |
+| **BSD lpd lineage** | `lpd_lance_devdriver.c` | LANCE driver for the printer daemon |
+| **BSD libc pieces** | `strcasecmp.c`, `ctype.c`, `errlst.c`, `inet_addr.c`, `inet_ntoa.c` | mixed with the TI runtime (below) |
+| **TI C runtime V2.00** | ROM `strlen`/`strcpy`/`strcmp` match `RTS.SRC` instruction for instruction | proprietary, shipped with the SDK |
+| **Bitstream / Bigelow & Holmes / DEC Japan fonts** | copyright strings, font names | third-party, **not** open source |
+
+## 1. MIT X11 R4
+
+The largest non-BSD body. The server is the MIT sample server, with both
+framebuffer implementations:
+
+* `mfbValidateGC`, `mfbFaultGlyph`, `mfbFreeGlyphCacheSpace`,
+  `mfbDestroyDMD` — monochrome framebuffer (`mfb`).
+* `cfb` strings are present as well (colour framebuffer), though the VT1200 is
+  monochrome.
+* Font formats: `pcfReadBitmaps`, `pcfReadProperties`, `pcfReadMetrics`,
+  `pcfReadEncoding`, `pcfReadAccelerators`, `Invalid SNF font file format`,
+  `unknown bdf encoding format`.
+* Xlib: `BadLength - request length incorrect; internal Xlib error`,
+  `Xlib: sequence lost`, `XlibMessage`, `/usr/lib/X11/XErrorDB`.
+
+The PCF error strings match `reference/x11/r4/contrib/server/pcf/fonts/lib/pcf/pcfrbitmaps.c`
+byte for byte (including `allocation failure in pcfReadBitmaps (offsets,%d)`,
+which R5's monolithic `pcfread.c` does not contain). That is the basis for
+calling it R4 rather than "X11 generally".
+
+There is **no X11 copyright string** in the image; the identification is
+code-level.
+
+## 2. BSD TCP/IP stack
+
+The file IDs are the classic BSD 4.3/Net-1 set. RCS headers show a bulk import
+by `craig` on 1989-10-05/06, with later files (e.g. `route.c`) on 1990-03-15.
+
+| layer | source files |
+|---|---|
+| sockets / mbufs | `uipc_domain.c`, `uipc_mbuf.c`, `uipc_proto.c`, `uipc_socket.c`, `uipc_socket2.c`, `uipc_usrreq.c`, `sys_socket.c`, `mbuf_calls.c`, `uio.c`, `syscalls.c`, `af.c` |
+| TCP | `tcp_input.c`, `tcp_output.c`, `tcp_subr.c`, `tcp_timer.c`, `tcp_usrreq.c`, `tcp_debug.c` |
+| UDP / IP / ICMP / raw | `udp_usrreq.c`, `ip_input.c`, `ip_output.c`, `ip_icmp.c`, `raw_ip.c`, `raw_cb.c`, `raw_usrreq.c` |
+| interfaces / routing | `if.c`, `if_ether.c`, `if_loop.c`, `if_sl.c`, `route.c`, `in.c`, `in_pcb.c`, `in_cksum.c`, `in_proto.c`, `inet_addr.c`, `inet_ntoa.c` |
+
+`if_sl.c` (SLIP) is the clearest sign that this is the stock BSD file set rather
+than a lookalike.
+
+DEC's own additions in the same area are distinguishable by name and by the
+absence of SCCS/RCS IDs: `lance_inet_interface.c`, `dwt_file.c`, `dwt_tftp.c`,
+`sys_dwt.c`, `server.c`, `init.c`, `test.c`, `xclients_smlat_dispatch.c`,
+`inode.c`.
+
+**Licence caveat:** no "Regents of the University of California" string appears
+in the image. The BSD notice was in source comments. The RCS/SCCS IDs and the
+file set establish lineage; they do not establish the licence text that
+accompanied it.
+
+## 3. BSD resolver, telnet and inetd
+
+* **BIND resolver:** `res_comp.c`, `res_init.c`, `res_mkquery.c`,
+  `res_send.c`, plus `gethostent.c`. This is the 4.8/4.9-era resolver, the
+  source of the "Primary name server IP address %s is invalid." path.
+* **telnet:** `telnet.c`, `commands.c`, `main.c`, `network.c`, `ring.c`,
+  `sys_bsd.c`, `terminal.c`, `utilities.c`, `tn3270.c`. This is the whole BSD
+  telnet client source set, including TN3270.
+* **inetd:** `inetd.c`.
+* **lpd lineage:** `lpd_lance_devdriver.c` — the LANCE device driver for the
+  printer daemon; the `lpd_` prefix points at BSD `lpd`.
+
+## 4. TI C runtime — not open source, but identifiable
+
+The ROM's string and memory functions are the TI RTS V2.00, not BSD:
+
+* ROM `strlen` at `0x07F68B1A` implements exactly
+  `rstr = string - 1; n = 0; while (*++rstr) n++;`
+* ROM `strcpy` at `0x07F68AE4` matches the RTS loop and return value.
+* ROM `strcmp` at `0x07F68AA0` matches the RTS comparison.
+* ROM `memcpy` at `0x07F68880` is `PIXBLT_L_L`, consistent with the RTS
+  `memcpy` → `movmem`.
+
+The SDK ships `RTS.LIB`, `RTS.SRC` (full source), `FLIB.LIB` and the headers on
+the 1987 C-tools floppy (`1987-11-06 TMS34010 Simulator-C Tools-ASM Tools.img`,
+dir `C2`).
+
+**The allocator is not the RTS one.** `RTS.SRC`'s `memory.c` uses a 1000-byte
+static `sys_memory`; the ROM's `malloc` (`0x07EE0246`) is a multi-arena
+allocator over the 4 MiB RAM (`0x1E8930` arenas, global pool `0x1E8AC0`). So the
+firmware mixes the TI runtime (strings, ctype, qsort, printf) with a different
+memory manager.
+
+## 5. Fonts (third-party, not open source)
+
+Copyright strings in the font data:
+
+* `Copyright (c) 1988 Bigelow & Holmes Inc.` — Pellucida.
+* `Copyright (c) 1988 Bitstream, Inc., Portions Copyright 1988 Digital
+  Equipment Corp.` — Bitstream Terminal.
+* `Copyright (c) 1988 Digital Equipment Corporation Japan.` — JISX0208 Kanji.
+* `Copyright (c) 1988/1990 Digital Equipment Corp.` — DEC Terminal, DECtech.
+
+## 6. Checked and not found
+
+No `regex`/`regcomp`, no `curses` or `termcap`, no `getopt`, no `crypt`
+strings, no MD5, no zlib, no NFS, no SNMP, no Kerberos, no PEX/XIE server
+extensions. The `ICE` and `XIE` substring counts are noise ("device",
+"service", …), not the X11 protocols.
+
+## 7. Open question: the `dwt_prf` transform
+
+The rdebug challenge is structurally **DES**: eight 64-entry S-box tables at
+`0x1C0200`, 6-bit indices, 16 Feistel rounds, a fixed key schedule. There are
+no `DES` or `crypt` strings, so the implementation is not attributable from the
+binary alone. If it is standard DES with a fixed key, the challenge is much
+weaker than the "font render + Feistel" description first suggested.
+
+## Reproduce
+
+```sh
+cd /home/arti/code/k-space/vt1200
+
+# every compiled source id, unique
+rg -o '@\(#\)[A-Za-z0-9_.-]+|\$Header: [A-Za-z0-9_.-]+' \
+   reference/rom-strings.txt | sed 's/@(#)//; s/\$Header: //' | sort -u
+
+# X11 fingerprints
+rg -n 'mfb|pcf|snf|bdf|Xlib|XErrorDB' reference/rom-strings.txt
+
+# font copyrights
+rg -n 'Copyright \(c\) 1988 (Bigelow|Bitstream)|Digital Equipment Corporation Japan' \
+   reference/rom-strings.txt
+```