WindowsCE bootloader Startup Process

First, it is usually assembly. Code : 0 is triggered by system reset at startup. Take code 2440 as an example to directly enter the FW. s file. In some BSP packages, the name of the assembly code is startup. S. The main operations are to set the CPU frequency (PLL), initialize RTC, set memory parameters, prepare to apply for Ram for the second stage of bootloader, and read the bootloader of the second stage into RAM, then enter the main function of the C code in eboot. This stage is generally called N boot, which is the first software startup run when the machine starts up, this phase is generally achieved through reading and writing registers. Note that although many interrupt vectors are implemented in the form of this part of code, these codes are not executed at all. There will be some other means later to implement the interrupt vector function. Since this part of the file is reused with Hal, The called function name will be the same as the kernel startup function (for example, kernelstart), but the implementation content is completely different. At the end of this part, an oemaddresstable address pointer is saved to the next function for corresponding memory injection. The following uses 2440bsp as an example. According to the requirements of the WindowsCE system, the memory space to be operated should be projected into the 512m space after 0x8000, of which 0000 m is buffered, m in height is not buffered. Areas without buffering are usually required by the driver to access the device. This ensures that hardware operations are not affected by buffering. In addition to oemaddresstableProgramIf you want to launch a series of other shadows, you can usually apply all the devices/memories to the original address space for ease of use. In addition, the 0x0 position is projected to the memory. In this way, you can use this part to install the short vector to interrupt the service program. (The above memory shot is not necessary, just for the convenience of programming, the use of the same as the system shot table can make it unnecessary to create another pullover file, at the same time, you can keep saving eboot in the memory if needed, so that the memory space planning will be relatively easier ).

After completing the above work, you will enter the eboot entry function main provided by WindowsCE. The main function is mainly used in bootloadermain. This function is located in the wince420 \ public \ common \ oak \ drivers \ ethdbg \ blcommon. c file. The file in this directory is the eboot framework provided by Microsoft. Although this is not the implementation part, I will analyze it together. This part of content is interesting at the beginning. The first statement to be executed is as follows:
If (! Kernelrelocate (ptoc) {halt (blerr_kernelrelocate );}
The input parameter is defined as follows: romhdr * volatile const ptoc = (romhdr *)-1; according to the program content, this function must be an endless loop here, but in fact this endless loop won't be executed, that is, ptoc = (romhdr *)-1 does not really play a role. :) Check the ptoc value before ptoc is used for the first time. The result is as follows: ptoc = 0x8c04d694. That is to say, ptoc is no longer-1 before it is changed, and ptoc is defined as const, and there is no way to change it, it seems that the pointer is already passive in the compiler process. In eboot. MAP, the content corresponding to this address is actually the content of bootpart. obj. It seems like you have no way to start. This is confusing. Added a series of content that was not previously found after the partition. The ptoc content is part of the content. Because the image chain structure of WindowsCE is involved, you cannot continue the analysis. skip this part first. Let's look back later.

initialize the debugging interface in bootloadermain, the implementation of this function by oemdebuginit is determined by the specific hardware. Generally, it is the initialization of the serial port. After that, the debugging information will be released through the debugging interface.

then in oemplatforminit () initialize the hardware resources used by eboot. , usually these include: storage device (flash, hard disk, etc.), transmission interface (Ethernet Card, USB-rndis, wireless network card, CF-LAN, etc.), system clock, for the following OS image transmission, OS image storage, read, and so on.
after preparation, You can call oempredownload () , this function usually implements a series of functions, such as device settings, storage device formatting, Nic IP address designation, and so on. WindowsCE supports only two standard operations, one is jump, the other is download, corresponding to the OS image download and the entry point to jump to the OS, respectively, all the functions mentioned above are their own extensions.

Next, let's take a look at the branches of these two standard operations: the first is the download branch.OemreaddataTo obtain the data that is first received, that is, the magic number, to determine whether the transmitted content is WindowsCE image data, then, we will continue to obtain the verification and information of the received data, including the number of images to be received, the starting address and length of the image, and the following information, naturally, the image is received,

Then check the data validation and. The information of the next image is received until all the image information is received.

In short, the bootloader process is as follows:

Boot Loader can be divided into two categories according to the wince Boot Mode: one is the download mode and the other is the local boot mode.

The basic execution process of the download mode is:
Relocate Ram --- initialize debugging port --- initialize basic platform device --- print user menu --- initialize network parameters --- download OS Kernel --- start OS

Taking eboot as an example, the sequence and functions of function calls during the startup process are as follows:
Startup () ----------------- initialize CPU, memory controller, etc.
Kernelrelocate () ------- code relocation to ram
Oemdebuginit () ------- initialize the debug port (generally serial port)
Oemplatforminit () ---- initialize the device on the board (initialization display, RTC, oal and eboot share parameters, print user menus, network cards, etc)
Oempredownload () --- preparations before downloading (set the device name and initialize the MAC/IP Parameters)
Downloadimage () ------ download the image file
Oemlaunch () ----------- start the OS

Generally, eboot involves the following files:

Startup. S: includes the startup () function mentioned above,Source codeLocated in the directory % wince \ platform \ common \ SRC \ ***... and % wince \ platform \ *** \ SRC \ bootloader \ eboot

Main. c: including the oemdebuginit (), oemplatform (), oempredownload (), and oemlaunch () mentioned above. The source code is located in the % wince \ platform \ *** \ SRC \ bootloader \ eboot directory.

Blcommon. C: includes the kernelrelocate () and downloadimage () mentioned above. The source code is located in the % wince \ public \ common \ oak \ drivers \ ethdbg \ blcommon directory.

The eboot download process mainly includes:
(1) the device uses bootme to enable the development machine to obtain the IP address of the device (DHCP or specified IP address );
(2) The developer downloads the image to the device through the TFTP protocol;
(3) Burn the image to flash or directly start the OS from Ram as needed

I have attached a document here, which was found in the Journal of computer engineering. It is very good.

Design and Implementation of wincebootloader