Re: how does "hpcboot.exe" work?

[Warner Losh <imp%bsdimp.com@localhost>]

On Fri, May 23, 2025 at 8:54 AM Izumi Tsutsui <tsutsui%ceres.dti.ne.jp@localhost> wrote:
>
> > I am a bit shocked that "Windows-CE-v1" has no memory protection.
>
> IIRC it did but there were several development functions:
>  http://www.jp.netbsd.org/ja/JP/ml/port-hpcmips-ja/199812/msg00000.html
>  http://www.jp.netbsd.org/ja/JP/ml/port-hpcmips-ja/199812/msg00002.html
> (in Japanese)
>
> WindowsCE development kit provieded "VirtualCopy()" function that
> could map any physical memory address spaces to virtual address space.
>
> I cannot find evidence but IIRC pbsdboot (and also maybe hpcboot) used
> such functions and overwrote CPU interrupt/exception vectors to hook
> kernel mode access.

Thank you tsutsui-san.

I have these files open from my earlier email:

pbsdboot does this in mips.c to overwrite the interrupt vector. vr41xx.c and
tx39xx.c have the assembler that's copied into the vectors to bootstrap
things. After the copy in, it flushes the I and D caches and forces a trap
by accessing an illegal address.

Warner