CE6 hangs in GrabFSPages()



Hi Everyone,

I am developing a BSP for custom hardware designed around a PXA270. The BSP
was cloned from the Mainstone III platform.

CE6 sucessfully turns on the MMU and continues, which is usually the hardest
part. Later
on it hangs in GrabFSPages(). I added some traces to GrabFSPages:

void GrabFSPages(void)
{
LPBYTE pPageList;
DWORD loop,max;
DEBUGMSG (1, (L"+GrabFSPages()\r\n"));
DEBUGMSG (1, (L"LogPtr=0x%08X\r\n", LogPtr));

DEBUGMSG (1, (L"LogPtr->pFSList=0x%08X\r\n", LogPtr->pFSList));

pPageList = LogPtr->pFSList;
while (pPageList)
{
DEBUGMSG (1, (L"pPageList=0x%08X\r\n", pPageList));
max = *((LPDWORD)pPageList+1); <<<====== HANGING HERE
DEBUGMSG (1, (L" max=%d...", max));
RemovePage((DWORD)pPageList);
DEBUGMSG (1, (L"..Removed\r\n"));
for (loop = 0; loop < max; loop++)
{
DEBUGMSG (1, (L"loop=%d...", loop));
RemovePage(*((LPDWORD)pPageList+2+loop));
DEBUGMSG (1, (L"..Removed\r\n"));
}
DEBUGMSG (1, (L"EndLoop\r\n"));
pPageList = *(LPBYTE *)pPageList;
}
DEBUGMSG (1, (L"-GrabFSPages()\r\n"));
}


It gave me this output:

+GrabFSPages()
LogPtr=0x8049D000
LogPtr->pFSList=0x8409F000
pPageList=0x8409F000

Which means that it hangs when trying to dereference pPageList+1.

What am I doing wrong? It's got to be a memory configuration issue, right?
Any help would be greatly appreciated.

For completeness I have included the debug output, config.bib, and
the OEMAddressTable (in that order).


Thanks in advance,
steve


===========================================================================
----------------------------- BOOTLOADER SERIAL PORT
OUTPUT -----------------------------------
===========================================================================
-----------------------------
*****Ahura EBOOT Startup (CE 6.0)*****
MSC0: 0x7FFC7FF8
MSC1: 0x7FF97FF8
MSC2: 0x7FF47FF4
CCCR: 0x02000308
MDREFR: 0x0015E018
MDCNFG: 0x00000AC9
CLKCFG: 0x0000000A
Copying to SDRAM...done
Verifying Copy...
done
Jumping to SDRAM: Address: 0xA000EAD4
Jumping to SDRAM: Address: 0xA000EAD4
StartUp Addr: 0xA000E6D8
main Addr: 0xA000A74C
Jumping to main...
Welcome to main (OEMDebugInit)
+FlashInit
+DetectFlashDevice
-DetectFlashDevice-FORCING NO DETECTION! (busted!)
-FlashInit
ERROR: flash initialization failed - loading bootloader defaults...

Resetting factory default configuration...

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Jan 24 2007
15:31:32
Windows CE Ethernet Bootloader 1.22
Ahura PXA27x SBC Platform - Built Jan 24 2007
LAN9118: Chip Id 115 Revision 1
LAN9118: Chip Id 00000115 Revision 1
Auto Negotiation done
Link Type: 100 MPS Full

Press [ENTER] to download now or [SPACE] to cancel.

Initiating image download in 3 seconds. 2 seconds. 1
seconds. 0 seconds. INFO: Trying to initialize the built-in SMSC
NIC...
LAN9118: Chip Id 115 Revision 1
LAN9118: Chip Id 00000115 Revision 1
Auto Negotiation done
Link Type: 100 MPS Full
INFO: SMSC LAN911x Ethernet controller initialized.
INFO: MAC address: 0-12-22-5-CC-AA
System ready!
Preparing for download...
+OEMPreDownload()
INFO: Using device name: 'Ahura60Pxa52394'
InitDHCP():: Calling ProcessDHCP()
ProcessDHCP()::DHCP_INIT
Got Response from DHCP server, IP address: 192.168.0.100

ProcessDHCP()::DHCP IP Address Resolved as 192.168.0.100, netmask:
255.255.255.0
Lease time: 691200 seconds
Got Response from DHCP server, IP address: 192.168.0.100
No ARP response in 2 seconds, assuming ownership of 192.168.0.100
+EbootSendBootmeAndWaitForTftp
Sent BOOTME to 255.255.255.255
Packet has the following data:
boot.bin[NULL]octet[NULL]
TFTP packet could have 1 name/value pairs
Locked Down Link 1
Src IP 192.168.0.100 Port 03D4 Dest IP 192.168.0.103 Port 0FEA
Default TFTP block size set to: 512 bytes
There were no options detected in the TFTP
EthDown::TFTPD_OPEN::boot.bin
-EbootSendBootmeAndWaitForTftp

BL_IMAGE_TYPE_BIN


Download file information:
-------------------------------------------------------------------------------
[0]: Address=0xA0100000 Length=0x33125C Name=

****** OEMVerifyMemory checking physical range [ 0xA0100000 ==>
0xA043125B ]...
****** RAM address ******
ImageStart = 0xA0100000, ImageLength = 0x33125C, LaunchAddr = 0xA0105F50
Computing checksum: image start = 0xA0100000, len = 0x33125C
Checksum = 0x12FD1C4F (0x33125C bytes)

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0xA0100000 Length=0x33125C Name="" Target=RAM
ROMHDR at Address A0100044h
ERROR: FlashWrite: unrecognized flash part.
ERROR: StoreEBootCFG: failed to write configuration.
Download successful! Jumping to image at 0xA0105F50 (physical
0xA0105F50)...
DeviceAddr: 192.168.0.100:54275 4608:1314:43724
Waiting for host to connect...
Got EDBG_CMD_JUMPIMG
Got EDBG_CMD_CONFIG, flags:0x00000000
HostAddr: 192.168.0.103:60431 1792:16105:16217
Jumping to image...
ARM: Jumping to image at physical address: 0xA0105F50
***** AhuraStartup (OAL) *****
Windows CE Kernel for ARM (Thumb Enabled) Built on Feb 6 2007 at 16:37:02
ProcessorType=0411 Revision=7
OEMAddressTable = 80105ec0
INFO:OALLogSetZones: dpCurSettings.ulZoneMask: 0xbdff
+OEMInit
+OALArgsQuery(66)
-OALArgsQuery(pData = 0xa00ff060)
+OEMInitRTC()
-OEMInitRTC(g_pRTCRegs = 0xa8e00000)
+OEMSetRealTime(2007/1/1 0:0:0.000)
-OEMSetRealTime(retVal = 1)
DeviceId................. Ahura60PXA27x
pArgs->flags............. 0x2D
pArgs->devLoc.IfcType.... 0
pArgs->devLoc.LogicalLoc. 0x4000300
pArgs->devLoc.PhysicalLoc 0x4000300
pArgs->devLoc.Pin........ 0
pArgs->ip4address........ 0
pDevice->Name............ s
pDevice->ifcType......... 0
pDevice->id.............. 0x4000300
pDevice->resource........ 0
pDevice->type............ 2
pDevice->pDriver......... 0x80449000

+OEMIoControl(0x1010014, 0xffffc558, 40, 0x0, 0, 0x0)
+OALIoCtlHalDdkCall(...)
+OALIoTranslateBusAddress(0, 0, 0x0000000004000300, 0)
-OALTranslateBusAddress(addressSpace = 0, systemAddress =
0x0000000004000300, rc = 1)
-OALIoCtlHalDdkCall(rc = 1)
-OEMIoControl(rc = 1)
LAN9118: Chip Id 115 Revision 1
LAN9118: Chip Id 00000115 Revision 1

Auto Negotiation done
Link Type: 100 MPS Full

KITL: *** Device Name Ahura60PXA52394 ***

+OEMIoControl(0x1010090, 0x8046e204, 20, 0xffffc4e8, 4, 0x0)
-OEMIoControl(rc = 1)
+OEMIoControl(0x1010098, 0xffffc4f0, 12, 0xffffc4e4, 4, 0x0)
-OEMIoControl(rc = 1)
KITL: using sysintr 0x12

+OEMGetRealTime(pTime = 0xffffc460)
-OEMGetRealTime(retVal = 1)
+OEMGetRealTime(pTime = 0xffffc460)
< 200 more lines of this - my RTC is not yet working!>
-OEMGetRealTime(retVal = 1)
+OEMGetRealTime(pTime = 0xffffc460)
-OEMGetRealTime(retVal = 1)
KITL: DHCP get/renew device IP: 1

VBridge:: built on [Sep 6 2006] time [19:25:01]

VBridgeInit()...TX = [16384] bytes -- Rx = [16384] bytes

Tx buffer [0xA048A460] to [0xA048E460].

Rx buffer [0xA048E480] to [0xA0492480].

VBridge:: NK add MAC: [0-12-33-55-CC-AA]

Connecting to Desktop

KITL: Connected host IP: 1 Port: 4037

KeyIndex 0 = -1
KeyIndex 1 = -1
KeyIndex 2 = -1
KeyIndex 3 = -1
KeyIndex 4 = -1
KeyIndex 5 = -4194305
KeyIndex 6 = -4194305
KeyIndex 7 = -1
+KITLRegisterDfltClient, service:0
+KITLRegisterDfltClient, service:1
Waiting for service 'DBGMSG' to connect..., fUseSysCalls = 0
ProcessAdminMsg: Receive Config message for service DBGMSG
ProcessAdminMsg: Receive Config message for service PPSH
!Received config for unrecognized service KDBG
ProcessAdminMsg: Receive Config message for service DBGMSG
ProcessAdminMsg: Receive Config message for service DBGMSG

===========================================================================
------------------------------------- PLATFORM BUILDER
OUTPUT --------------------------------------
===========================================================================

+OALIoCtlHalEnableWake(sysIntr = 13)
+OALIoCtlHalEnableWake(rc = 1)
Calling OALInitCoProc()
-OEMInit
+KernelFindMemory() -<O>-
Setting up softlog at 0x87ffc000 for 0x800 entries
Booting Windows CE version 6.00 for (ARM)
&pTOC = 80497c1c, pTOC = 8042c0d0, pTOC->ulRamFree = 8049c000, MemForPT =
00001000

Old or invalid version stamp in kernel structures - starting clean!
OEMGetExtensionDRAM(Ahura): Returning FALSE
ExtensionDRAM cExtSections: 0,
Configuring: Primary pages: 31566, Secondary pages: 0, Filesystem pages =
15783

Booting kernel with clean memory configuration:
Memory Sections:
[0] : start: 8049e000, extension: 00010000, length: 07b4e000
+GrabFSPages()
LogPtr=0x8049D000
LogPtr->pFSList=0x8409F000
pPageList=0x8409F000

===========================================================================
-----------------------------------------------
ONFIG.BIB -----------------------------------------------
===========================================================================
#include "$(_FLATRELEASEDIR)\config_cebase.bib"


; CONFIG Section Common Settings

KERNELFIXUPS=ON

; @CESYSGEN IF !NK_NKNOCOMP
COMPRESSION=ON
; @CESYSGEN ENDIF !NK_NKNOCOMP
; @CESYSGEN IF NK_NKNOCOMP
COMPRESSION=OFF
; @CESYSGEN ENDIF NK_NKNOCOMP

IF IMGPROFILER
PROFILE=ON
ELSE
PROFILE=OFF
ENDIF

;
; ROMFLAGS is a bitmask of options for the kernel
; ROMFLAGS 0x0001 Disallow Paging
; ROMFLAGS 0x0010 Trust Module only
;
IF IMGTRUSTROMONLY
ROMFLAGS=10
ELSE
ROMFLAGS=00
ENDIF

IF IMGPAGINGPOOL
#if $(PAGINGPOOLSIZE)==$()
; 4.5MB page pool makes sense when not XIPing, 2MB is better for XIPing
; You can reserve an area of RAM (~2MB) for the page pool (see arm4sku.bib)
which IMGFS
; uses to page code in and out of (otherwise, any code that's loaded into
RAM stays there until the process goes away).
; It'll cut down your RAM usage considerably. Customers may need to tune
the size for best performance.


#define PAGINGPOOLSIZE 00480000
#endif

cbNKPagingPoolSize 00000000 $(PAGINGPOOLSIZE) FIXUPVAR
ENDIF IMGPAGINGPOOL

; Always make an NB0 file for disassembly
ROMSTART = 80100000
ROMSIZE = 00300000
ROMWIDTH = 32
AUTOSIZE = ON

ROMOFFSET=20000000 ; A0000000-80000000

===========================================================================
-----------------------------------------------
onfig_cebase.bib ---------------------------------------------
===========================================================================
;
; Copyright (c) Microsoft Corporation. All rights reserved.
;
;
; Use of this sample source code is subject to the terms of the Microsoft
; license agreement under which you licensed this sample source code. If
; you did not accept the terms of the license agreement, you are not
; authorized to use this sample source code. For the terms of the license,
; please see the license agreement between you and Microsoft or, if
applicable,
; see the LICENSE.RTF on your install media or the root of your tools
installation.
; THE SAMPLE SOURCE CODE IS PROVIDED "AS IS", WITH NO WARRANTIES.
;
; Memory Map
; ----------
;
; 8000.0000 -+
; | Bootloader Stack (64KB)
; 8001.0000 -+
; | Bootloader RAM (64KB)
; 8002.0000 -+
; | Bootloader Code (256KB)
; 8006.0000 -+
; | GAP (reserved for future)
; 800F.F000 -+
; | ARGS (4KB)
; 8010.0000 -+
; |
; | OS (NK) Code (48MB)
; |
; 8310.0000 -+ **auto-size**
; |
; | OS (NK) RAM (79MB or 15MB)
; |
; 8800.0000 or 8400.0000 -+
;

; config_cebase.bib

IF IMGFLASH !
#define NK_START 80100000
#define NK_SIZE 03000000
#define NKRAM_START 83100000

IF SDRAM_SIZE_64_MB
#define NKRAM_SIZE 00F00000 ; 15MB SDRAM
ELSE
#define NKRAM_SIZE 04F00000 ; 79MB SDRAM
ENDIF

ELSE ;IMGFLASH

#define NK_START 9AA80000
#define NK_SIZE 03F00000 ; 0x9AB0_0000 -> END (63MB FLASH)
#define NKRAM_START 80100000

IF SDRAM_SIZE_64_MB
#define NKRAM_SIZE 03F00000 ; 63MB SDRAM
ELSE
#define NKRAM_SIZE 07F00000 ; 127MB SDRAM
ENDIF

ENDIF ;IMGFLASH


MEMORY

; Name Start Size Type
; ------- -------- -------- ----
RSVD 80000000 000FF000 RESERVED
;0x8000_0000 -> 0x8010_0000 (1MB EBOOT RAM & ARGS)
ARGS 800FF000 00001000 RESERVED

NK $(NK_START) $(NK_SIZE) RAMIMAGE
RAM $(NKRAM_START) $(NKRAM_SIZE) RAM

ZBANK 9A500000 00100000 RESERVED ;Reserve
ZBANK virtual block (No physical memory
;is required
to back this virtual range).

EBOOT 9AA00000 00040000 RESERVED ;EBOOT Flash
image
BOOTCFG 9AA40000 00040000 RESERVED ;BOOT config
parameters

; This fix-up variable determines the amount of memory the BSP
; reserves for Watson dump capture. The current default behavior is
; to default to zero unless the image has SYSGEN_WATSON_DMPGEN
; defined. The default size is 300KiB.
;
; @CESYSGEN IF CE_MODULES_OSAXST0
nk.exe:dwOEMDrWatsonSize 00000000 0x4B000 FIXUPVAR
; @CESYSGEN ENDIF


CONFIG

IF IMGFLASH
ROMSTART = 9AA80000
ROMSIZE = 03F00000
ROMWIDTH = 32
ELSE
AUTOSIZE = ON
ENDIF



===========================================================================
--------------------------------------------
OEMAddressTable ---------------------------------------------
===========================================================================

ALIGN
g_oalAddressTable

IF :DEF: SDRAM_SIZE_64_MB
DCD 0x80000000, 0xA0000000, 64 ; MAINSTONEII: SDRAM (64MB).
ELSE
DCD 0x80000000, 0xA0000000, 128 ; MAINSTONEII: SDRAM
(128MB).
ENDIF
DCD 0x88000000, 0x5C000000, 1 ; BULVERDE: Internal SRAM
(64KB bank 0).
DCD 0x88100000, 0x58000000, 1 ; BULVERDE: Internal memory
PM registers.
DCD 0x88200000, 0x4C000000, 1 ; BULVERDE: USB host
controller.
DCD 0x88300000, 0x48000000, 1 ; BULVERDE: Memory
controller.
DCD 0x88400000, 0x44000000, 1 ; BULVERDE: LCD controller.
DCD 0x88500000, 0x40000000, 32 ; BULVERDE: Memory-mapped
registers (peripherals).
;DCD 0x8A500000, 0x3C000000, 16 ; BULVERDE: PCMCIA S1
common memory space.
;DCD 0x8B500000, 0x38000000, 64 ; BULVERDE: PCMCIA S1
attribute memory space.
;DCD 0x8F500000, 0x30000000, 1 ; BULVERDE: PCMCIA S1 I/O
space.
;DCD 0x8F600000, 0x2C000000, 16 ; BULVERDE: PCMCIA S0
common memory space.
;DCD 0x90600000, 0x28000000, 64 ; BULVERDE: PCMCIA S0
attribute memory space.
;DCD 0x94600000, 0x20000000, 1 ; BULVERDE: PCMCIA S0 I/O
space.
DCD 0x9A500000, 0xE0000000, 1 ; Pxa27x: Zero-bank (in
reserved slot - no physical memory required).
;DCD 0x9A600000, 0x14000000, 1 ; MAINSTONEII: nCS5:
eXpansion board header.
;DCD 0x9A700000, 0x10000000, 1 ; MAINSTONEII: nCS4: SMSC
91C111 Ethernet controller.
;DCD 0x9A800000, 0x0A000000, 1 ; MAINSTONEII: nCS2 (upper
half): 2MB SRAM.
DCD 0x9A900000, 0x08000000, 1 ; Pxa27x: nCS2 (lower half):
Moe FPGA

DCD 0x9AA00000, 0x04000000, 32 ; Pxa27x: nCS1: SMSC 9115
Ethernet controller
DCD 0x9CA00000, 0x00000000, 32 ; Pxa27x: nCS0: Boot Flash
(32MB).

;DCD 0x9EA00000, 0x50000000, 1 ; BULVERDE: Camera
peripheral interface.

DCD 0x00000000, 0x00000000, 0 ; end of table



.



Relevant Pages

  • [PATCH] 2.6.21-git15 - Kconfig Cleanup
    ... config EXCPT_IRQ_SYSC_L1 ... bool "Locate frequently called do_irq dispatcher function in L1 Memory" ... This driver is for the ...
    (Linux-Kernel)
  • Re: [PATCH] 2.6.21-git15 - Kconfig Cleanup
    ... config EXCPT_IRQ_SYSC_L1 ... bool "Locate frequently called do_irq dispatcher function in L1 Memory" ... This driver is for the ...
    (Linux-Kernel)
  • Re: Possible memory leak?
    ... Telstra's cable Internet. ... In the Top command, I found the system started with 93MB free memory, ... Here is the hardware config from its dmesg: ... miibus0: <MII bus> on sis0 ...
    (comp.unix.bsd.freebsd.misc)
  • Re: eboot.bib question
    ... PM registers. ... controller. ... attribute memory space. ...
    (microsoft.public.windowsce.platbuilder)
  • System crash: invalid memory read access from kernel
    ... we have just upgraded the memory on a alpha computer DS20 ... I was able to read from the crash data the following information: ... _config: struct { ... memory channel software inited - node 0 on mc0 ...
    (Tru64-UNIX-Managers)