Re: [Freemint-discuss] Disassembly of TOS 1.00 with Ghidra

[Vincent R. <vin...@fr...>]

On 17/01/2025 à 07:24, Thorsten Otto via Freemint-discuss wrote:
> BTW, i noticed some BDOS variables that you have added, a large memory pool 
> amongst others. OTOH, some variables from later versions are missing. I 
> haven't looked at it yet, but could it be that the BDOS is also very 
> different?

Yes, in TOS 1.00 there is mainly something that I called "bdos_mempool". It 
is a 6000-byte buffer used for BDOS internal structures. Blocks are 
allocated there, with sizes multiple of 2. Such blocks are used, then when 
freed they are put into a "free list". There is one per block size. So the 
big memory pool is progressively split into smaller chunks, either used or 
free. But that memory pool itself is never recovered, this is by design.

In my Ghidra archive, type G bdos_walloc and look at the decompiled source. 
It's purpose is to definitely alloc a memory block if any size (in WORDs) 
from the bdos_mempool.

See also the high-level functions:
- mgetofd() to alloc a block, either from the free list or a new block from 
the memory pool
- oftdel() to free a block, by putting it into the free list.

There are 20 free lists located at the "root" label 0x56fa. One for each 
block size, multiple of 2.

Important: I took those names mgetofd/oftdel from your TOS 1.04 
reconstructed sources. But indeed, this part looks very different in TOS 
1.00. Specially, it seems that later mgetofd/oftdel were specialized for the 
OFD stucts (used for folders). But int TOS 1.00, they are used for many 
other types. See references to mgetofd() for details. It seems obvious that 
the original names for those functions were actually different (no idea 
which ones).

For that memory stuff, I have renamed the parameters and local variables in 
the Ghidra decompilation window. So the functions are now pretty readable. 
This was my main task last month, when I was hunting for that bug.

As I understand, in TOS 1.02 Atari reworked that BDOS memory management. 
With some memory dedicated to the OFD struct for folders. Hence the 
40-folder limit. But in TOS 1.00, there is no such thing. All BDOS structs 
share the same pool.

> And did you document the bug that you initially was looking for?

I will do precisely, as I did many tests. Mainly I traced the state of the 
BDOS memory pool and the free lists. I took a lot of notes.

Main thing is a memory leak in TOS 1.00 Fsfirst. This means ixsfirst and 
more precisely the "scan" function. It was the GetDnd() call in scan(). If 
the directory contents is entirely in memory cache, fine. But if the disk 
directory needs to be walked, all directories found before finding the 
requested file name cause a DND memory leak. On each Fopen(). And of course, 
at some point, the 6000 bytes pool is exhausted. Fopens returns a "File not 
found" error, then everything else quickly crashes. There is no such issue 
in later TOS versions.

-- 
Vincent Rivière