mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-30 12:03:54 +02:00
arti
307df67f9d
The TFTP font path loads through 3F96B850 and parses with the metadata reader 3F97EF00, which handles only PROPERTIES/ACCELERATORS/METRICS/ ENCODINGS and silently skips BITMAPS. A font with num_chars=0x40000001 therefore passes the loader (LOADER-A-SUCCESS) without the field ever being read, and pcfReadBitmaps (3F984970, multiply 3F985050) is never entered. pcfReadBitmaps has exactly one caller, 3F98BB70, in the X11 font-request reader 3F98AC20, not the TFTP fetch path. The 'refused after 1024 bytes' of evil-real.pcf is the METRICS table: its big-endian compressed count 0x00DF is read little-endian as 57088, so fosAlloc(57088*16) fails at ~906 bytes; BITMAPS (offset 2024) is never reached. Baseline.pcf fails the same way; baseline_le.pcf puts that one 2-byte field in the order the loader reads it, parses cleanly, and still ignores the crafted BITMAPS count. No ROM patch, no check disabled, no serve.py edit. Baselines unchanged: no env samples=198, stub samples=53.
50 lines
1.7 KiB
Lua
50 lines
1.7 KiB
Lua
-- pcfflow.lua -- coarse call-graph trace of the font path (no per-iteration spam).
|
|
local machine = manager.machine
|
|
local dbg = machine.debugger
|
|
local cpu = machine.devices[':maincpu']
|
|
if not dbg then print("ERROR: no debugger"); machine:exit(); return end
|
|
FRAME = 0
|
|
|
|
local function bp(addr, what)
|
|
dbg:command(string.format('bpset %s,,{ printf "%s fr=%%d\\n", FRAME ; g }', addr, what))
|
|
end
|
|
|
|
-- Font-file loaders / openers.
|
|
bp('3f9629e0', 'OPEN-cache-call')
|
|
bp('3f962af0', 'OPEN->parserC')
|
|
bp('3f962cb0', 'OPEN-else-SNF')
|
|
bp('3f9643e0', 'FN-B-ENTRY')
|
|
bp('3f964850', 'FN-B-850')
|
|
bp('3f964900', 'FN-B->parserB')
|
|
bp('3f96d300', 'LOAD-A-call')
|
|
bp('3f96b850', 'LOADER-A-ENTRY')
|
|
bp('3f96bb80', 'LOADER-A->parserA')
|
|
bp('3f96c990', 'CACHE-LOOKUP')
|
|
-- Parsers.
|
|
bp('3f97ef00', 'PARSER-A-ENTRY')
|
|
bp('3f981690', 'PARSER-C-ENTRY')
|
|
bp('3f98ac20', 'PARSER-B-ENTRY')
|
|
bp('3f984970', 'pcfReadBitmaps-ENTRY')
|
|
bp('3f985060', 'pcfReadBitmaps-MULTIPLY')
|
|
-- Other font-file reader with SNF dispatch (3f964850's sibling at 3f96b850 is loader A).
|
|
bp('3f964ac0', 'FN-B-SNF-check')
|
|
|
|
-- pcfReadFont outer dispatch of parser B (label).
|
|
bp('3f98c370', 'B-TOC')
|
|
-- pcfReadFont-ish wrappers: string messages tell us which reader bails.
|
|
bp('3f98ef08', 'ERR-msg-3f98ef08')
|
|
bp('3f98f088', 'ERR-msg-3f98f088')
|
|
bp('3f98f210', 'ERR-msg-3f98f210')
|
|
bp('3f98f428', 'ADDR-3f98f428')
|
|
|
|
local maxframes = tonumber(os.getenv("PCT_FRAMES") or "20000")
|
|
emu.register_frame_done(function()
|
|
FRAME = FRAME + 1
|
|
if FRAME % 4000 == 0 then
|
|
print(string.format("frame %d PC=%08X", FRAME, cpu.state['PC'].value))
|
|
end
|
|
if FRAME >= maxframes then print("done"); machine:exit() end
|
|
end, "vt1200-flow")
|
|
dbg.visible_cpu = cpu
|
|
dbg.execution_state = 'run'
|