mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-31 12:05:05 +02:00
arti
7efb4880f0
A tcpdump on the tap plus a live execution trace settle the 'Disk full or allocation exceeded' abort: the TERMINAL sends TFTP error 3, from tftp_close (0x3F5EC860), which reports an incomplete read (the last DATA block read was a full 512-byte block) using its fixed text for code 3. It is not a capacity or disk condition. The font buffers (path/index read buffer bit 0x9316D0, fos parser stream buffer 0x227FD0, parsed-font cache 0x227F50) are all in main RAM (0x00000000-0x01FFFFFF), mapped and writable; the writes land in RAM dumps. No second map overlap exists, so the NVR fix did not cause this. vt1200.cpp is unchanged and every baseline is intact. New: fonttrace.lua, fontprobe.lua, two evidence pcaps, FONT_STORAGE_REPORT.md.
52 lines
2.2 KiB
Lua
52 lines
2.2 KiB
Lua
-- fontprobe.lua -- live values for the TFTP font-read capacity check.
|
|
--
|
|
-- Breaks inside the firmware's tftp_read (0x3f5ed230) at the point where the
|
|
-- per-datagram payload (a9) is compared with the buffer capacity (a11), and at
|
|
-- the error path. Prints the frame, PC, a9 (payload), a11 (capacity) and the
|
|
-- accumulated total (dword at a13+8) so the "disk full" verdict can be read
|
|
-- directly rather than inferred.
|
|
--
|
|
-- FP_FRAMES=<n> budget (default 20000)
|
|
-- <mame> vt1200 ... -debug -debugger none -debuglog \
|
|
-- -autoboot_script harness/mame/fontprobe.lua -autoboot_delay 0
|
|
|
|
local machine = manager.machine
|
|
local dbg = machine.debugger
|
|
local cpu = machine.devices[':maincpu']
|
|
|
|
if not dbg then
|
|
print("ERROR: debugger not enabled; pass -debug")
|
|
machine:exit()
|
|
return
|
|
end
|
|
|
|
FRAME = 0
|
|
|
|
-- tftp_read entry: dump the three arguments from the callee frame (a13-12/-8/-4)
|
|
dbg:command('bpset 3f5ed290,,{ printf "TFTP-ARGS fr=%d arg1(len)=%08X arg2(buf)=%08X arg3(sock)=%08X\\n", FRAME, d@(a13-12), d@(a13-8), d@(a13-4) ; g }')
|
|
-- capacity check, just after `cmp a11,a9` (a9 = payload, a11 = capacity)
|
|
dbg:command('bpset 3f5eed50,,{ printf "CHK fr=%d pc=%08X payload(a9)=%08X capacity(a11)=%08X a13=%08X [%08X %08X %08X | %08X %08X %08X]\\n", FRAME, PC, a9, a11, a13, d@(a13-12), d@(a13-8), d@(a13-4), d@(a13), d@(a13+4), d@(a13+8) ; g }')
|
|
-- error path just before the message is formatted (a9 = payload first arg, a11 = capacity second)
|
|
dbg:command('bpset 3f5eeda0,,{ printf "BUFSIZE-ERR fr=%d a9=%08X a11=%08X\\n", FRAME, a9, a11 ; g }')
|
|
-- ERROR code 3 being sent
|
|
dbg:command('bpset 3f5eee50,,{ printf "SEND-ERROR-3 fr=%d\\n", FRAME ; g }')
|
|
-- tftp_read entry, count calls
|
|
dbg:command('bpset 3f5ed230,,{ printf "TFTP-READ-ENTRY fr=%d a14=%08X\\n", FRAME, a14 ; g }')
|
|
-- received an ERROR packet from the peer
|
|
dbg:command('bpset 3f5edb30,,{ printf "GOT-ERROR-PKT fr=%d\\n", FRAME ; g }')
|
|
|
|
local maxframes = tonumber(os.getenv("FP_FRAMES") or "20000")
|
|
emu.register_frame_done(function()
|
|
FRAME = FRAME + 1
|
|
if FRAME % 2000 == 0 then
|
|
print(string.format("frame %d PC=%08X", FRAME, cpu.state['PC'].value))
|
|
end
|
|
if FRAME >= maxframes then
|
|
print("done (" .. FRAME .. " frames)")
|
|
machine:exit()
|
|
end
|
|
end, "vt1200-fp")
|
|
|
|
dbg.visible_cpu = cpu
|
|
dbg.execution_state = 'run'
|