Winmobile Suspend/Resume

The following list shows the characteristics of the power model for Windows Mobile 6 Standard:
1. Windows Mobile 6 Standard never suspends.
2. You can turn off the backlight and the screen.
3. You can run threads.
4. Power handling in the OEMIdle function is more important than it is in the power model for Windows Mobile 6 Classic and Windows Mobile 6 Professional.
5. Low overhead and fast wake-ups from low power states.

Windows Mobile 6 Classic and Windows Mobile 6 Professional: The Suspend Path
1. Power Manager disables all Power Manager-aware non-block drivers.
2. Power Manager calls the IOCTL_HAL_PRESUSPEND input/output control code.
3. Power Manager notifies file systems.
4. Power Manager disables all Power Manager-aware block drivers.
5. The operating system transitions to single threaded mode.
6. Power Manager calls all legacy XXX_PowerDown (Device Manager)callback functions. There can be no system calls in the xxx_PowerDown callback function, because they will make the driver non-pageable.
7. Power Manager calls the OEMPowerOff function, which is the OEM code that suspends the CPU.

Windows Mobile 6 Classic and Windows Mobile 6 Professional: Behavior While Suspended
1. The CPU is suspended, so no threads are running. Only a hardware interrupt can wake the CPU, and multiple interrupts are multiplexed to the CPU pin. Typical hardware interrupt wake sources are the keyboard, the power button, a real-time clock (RTC) alarm, or a ring from the cell radio.

Windows Mobile 6 Classic and Windows Mobile 6 Professional: The Resume Path
The resume path for Windows Mobile 6 Classic and Windows Mobile 6 Professional is the reverse of the suspend path for Windows Mobile 6 Classic and Windows Mobile 6 Professional.
1. CPU wakes up and continues executing where left off in the OEMPowerOff function.
2. The OEMPowerOff function returns.
3. Power Manager calls all legacy XXX_PowerUp (Device Manager) callback functions.
4. The operating system transitions into multi-threaded mode.
5. Power Manager enables Power Manager-aware drivers, Power Manager-aware block drivers, and Power Manager-aware file systems.

segment of program assembly

Text : This portion contains the actual m/c instructions to be executed. On many Operating Systems this is set to read only, so that the process can't modify its instructions. This allows multiple instances of the program to share the single copy of the text.

Data : This portion contains the program's data part. It furthere divided into
1) Initialized Read Only Data : This contains the data elements that are initialized by the program and they are read only during the execution of the process.
2) Initialized Read Write Data : This contains the data elements that are initialized by the program and will be modified in the course of process execution.
3)Uninitalized Data : This contains the elements are not initialized by the program and are set 0 before the processes executes. These can also be modified and referred as BSS(Block Started Symbol). The adv of such elements are, system doesn't have to allocate space in the program file for this area, b'coz it is initialized to 0 by OS before the process begins to execute.

Stack: This portion is used for local variables, stack frames

Heap: This portion contains the dynamically allocated memory, it begins at the end of BSS.

In embedded software, the BSS segment is mapped into "Uninitialized RAM" that in fact is initialized to zero by the C runtime before main () is entered

RTOS

A Real-Time Operating System (RTOS) is a multitasking operating system intended for real-time applications
Key factors in an RTOS are:
* a minimal interrupt latency
* and a minimal thread switching latency.

Scheduling:
* Event-driven (priority scheduling) designs switch tasks only when an event of higher priority needs service, called pre-emptive priority.
* Time-sharing designs switch tasks on a clock interrupt, and on events, called round robin.

Intertask communication and resource sharing:
* Temporarily masking/disabling interrupts
* Binary semaphores
* Message passing

A binary semaphore is either locked or unlocked. When it is locked, a queue of tasks can wait for the semaphore. Typically a task can set a timeout on its wait for a semaphore. Problems with semaphore based designs are well known: priority inversion and deadlocks.

first app of DirectShow

Follow Windows Mobile 6 - Sample playback Program.

Problems that I met:
1. Compile error which is couldn't find some interface GUID;
Solved: after include the header file like "strmif.h" "control.h", problem got solved;

2. got linking error 2001: couldn't find extern definition;
Solved: follow MS link to solve http://support.microsoft.com/kb/130869, and also include 'strmiids.lib";

3. while running app, render function return errors and couldn't play media file;
Solved: codec is not properly used, after using the popular file .wav, it can play the wave file.

void TestPlay(void)
{
IGraphBuilder *pGraph;
IMediaControl *pMediaControl;
HRESULT hRes;

CoInitialize(NULL);
CoCreateInstance(CLSID_FilterGraph, NULL, CLSCTX_INPROC,
IID_IGraphBuilder, (void **)&pGraph);
pGraph->QueryInterface(IID_IMediaControl, (void **)&pMediaControl);
// Query for IMediaControl (not shown)
// Filenames start with a \\ instead of a drive letter.
//hRes = pGraph->RenderFile(L"\\music\\AllGoodThings\\drive.wma", NULL);
hRes = pGraph->RenderFile(L"\\music\\pegconn.wav", NULL);
hRes = pMediaControl->Run();
// Block until the user clicks the OK button.
// The filter graph runs on a separate thread.
MessageBox(NULL, L"Click me to end playback.", L"DirectShow", MB_OK);
// Clean up.
pMediaControl->Release();
pGraph->Release();
CoUninitialize();

};

local variable

In C , a variable declared as static is local to a particular function. It is initialised once and on leaving the function, the static variable retains the value. Next time when the function is called again, the static variable already has the value from the previous function call.

global and static variables are stored in DSS.

In memory. A variable of static storage duration must beavailable throughout the lifetime of the program. The C standarddoesn't require any specific method of making this happen, and different compilers can do it differently

ARM registers

ARM registers

R0 : Argument1, Return Value; Temporary register
R1 : Argument2, Second 32-bits if double/int Return Value; Temporary register
R2-R3 : Arguments; Temporary registers
R4-R10 : R7 is THUMB frame pointer; Permanent registers.
R11 : ARM frame pointer; Permanent register
R12 : Temporary register
R13 : Stack pointer; Permanent register
R14 : Link register; Permanent register
R15 : Program Counter

tracing registry corruption issue

1. Hopper test reported sth like and paused:
@18:15:34.838 MTTF: RegCreateKeyEx failed to create the key SOFTWARE\Microsoft\Hopper, error code 14, hKey 0x0

2. Setting up a DEBUGBREAK at the place frequently check registry and catch the issue;

3. CeDebugX reported:
======================================================= Fixed-sized heap in filesys.exe is full =======================================================
Process : filesys.exe Proc Id : 0x00000001 Heap : 0x040b0000 Heap max size : 1048576 Free bytes : 64 Largest free block : 64
This does not necessarily indicate a bug in itself. However, it may be thecause of other problems, e.g. if allocation attempts on this heap are failing,and should be examined.

Tags for bug matcher:+DEFECT:LOW_MEMORY:FIXED_HEAP_FULL:filesys.exe:

it means that windows registry handle pool(0x040b0000, 1M) got full;

dump out the whole 1m memory and analyzed the handle, found out that most of handles are belong to device.exe; Sample:

cedebugx50>dumpitem 0x040B7098 filesys.exe
Creating heap list...
pItem : 0x040b7078
Type : Normal Alloc
Total size : 96 (including header)
Data size : 88 (allocation size)
Heap ptr : 0x040b0030

addr value
========================== header
0x040b7078 : 0x00000060 size
0x040b707c : 0x040b0030 region ptr
========================== data
0x040b7080 : 0x040b7080 <-- pCur
0x040b7084 : 0xe3a2641e <-- hProc : application handle
0x040b7088 : 0x000003f5 <-- bDepth : 3; bMagic: 0xf5
0x040b708c : 0x040b7020 <-- pNext
0x040b7090 : 0x00000001 <-- dwFlags
0x040b7094 : 0x000540f0 <--pHives
0x040b7098 : 0x80000002 <-- HKLM
0x040b709c : 0x00000008 <-- System
0x040b70a0 : 0x000000c4 <-- State
0x040b70a4 : 0x00000106 <-- ???
0x040b70a8 : 0x00000000
0x040b70ac : 0x00000000
0x040b70b0 : 0x00000000
0x040b70b4 : 0x00000000
0x040b70b8 : 0x00000000
0x040b70bc : 0x00000000
0x040b70c0 : 0x00000000
0x040b70c4 : 0x00000000
0x040b70c8 : 0x00000000
0x040b70cc : 0x00000000
0x040b70d0 : 0x00000000
0x040b70d4 : 0x00000000

4. use tools to test different key value and find the reprents in handle heap, here is the sample.
0x040b3c18 80000002 20001551 00000000 00000000 .... Q... .... .... <------- Explorer
0x040b5538 80000002 200010FA 00000000 00000000 .... .... .... .... <------- ExtModems
0x040b5598 80000002 000002B2 00000000 00000000 .... .... .... .... <------- HARDWARE
0x040b55f8 80000002 00000033 00000000 00000000 .... 3... .... .... <------- Ident
0x040b5658 80000002 20000001 00000000 00000000 .... .... .... .... <------- init
0x040b56b8 80000002 2000009F 00000000 00000000 .... .... .... .... <------- Loader
0x040b5718 80000002 20000118 00000000 00000000 .... .... .... .... <------- MUI
0x040b5778 80000002 00000001 00000000 00000000 .... .... .... .... <------- nls
0x040b57d8 80000002 2000164E 00000000 00000000 .... N... .... .... <------- Platform
0x040b5838 80000002 00000014 00000000 00000000 .... .... .... .... <------- Security
0x040b5898 80000002 000000CA 00000000 00000000 .... .... .... .... <------- Services
0x040b58f8 80000002 000002F4 00000000 00000000 .... .... .... .... <------- Snd
0x040b5958 80000002 00000028 00000000 00000000 .... (... .... .... <------- Software
0x040b59b8 80000002 00000008 00000000 00000000 .... .... .... .... <------- System
0x040b5a78 80000002 00000023 00000000 00000000 .... #... .... .... <------- TAPI
0x040b5d18 80000002 2000297D 00000000 00000000 .... }).. .... .... <------- Audio
0x040b5dd8 80000002 20000DC2 00000000 00000000 .... .... .... .... <------- AudioCompressionManager
0x040b5e38 80000002 20001C4A 00000000 00000000 .... J... .... .... <------- ButtonApps
0x040b5e98 80000002 0000001E 00000000 00000000 .... .... .... .... <------- Comm
0x040b5ef8 80000002 00000301 00000000 00000000 .... .... .... .... <------- ControlPanel
0x040b5f58 80000002 00000003 00000000 00000000 .... .... .... .... <------- Drivers
0x040b5fb8 80000002 20000DC0 00000000 00000000 .... .... .... .... <------- Drivers32
0x040b6018 80000002 00000023 00000000 00000000 .... #... .... .... <------- TAPI
0x040b6078 80000002 00000023 00000024 00000000 .... #... $... .... <------- TAPI\TSP
0x040b60d8 80000002 00000023 00000024 20001EC5 .... #... $... .... <------- TAPI\TSP\CellTSP.dll
0x040b6138 80000002 00000023 00000024 00000025 .... #... $... %... <------- TAPI\TSP\Unimodem.dll
0x040b6198 80000002 20001642 00000000 00000000 .... B... .... .... <------- Telephony
0x040b61f8 80000002 20000001 00000000 00000000 .... .... .... .... <------- init
0x040b6258 80000002 2000058B 00000000 00000000 .... .... .... .... <------- Windows CE Services
0x040b62b8 80000002 20001559 00000000 00000000 .... Y... .... .... <------- Windows CE Tools
0x040b6318 80000002 00000008 20001468 00000000 .... .... h... .... <------- System\ActiveSync
0x040b6378 80000002 00000008 200001C7 00000000 .... .... .... .... <------- System\Autoupdate
0x040b63d8 80000002 00000008 00000009 00000000 .... .... .... .... <------- System\Ceddk
0x040b6438 80000002 00000008 20002CCE 00000000 .... .... .,.. .... <------- System\ChoosePicture
0x040b6498 80000002 00000008 00000047 00000000 .... .... G... .... <------- System\CurrentControlSet
0x040b64f8 80000002 00000008 2000294C 00000000 .... .... L).. .... <------- System\D3DM
0x040b6558 80000002 00000008 20000543 00000000 .... .... C... .... <------- System\DOWNLOADINSTALLSERVICE
0x040b65b8 80000002 00000008 0000004F 00000000 .... .... O... .... <------- System\ErrorReporting
0x040b6618 80000002 00000008 2000000D 00000000 .... .... .... .... <------- System\Events
0x040b6678 80000002 00000008 20001238 00000000 .... .... 8... .... <------- System\Explorer
0x040b66d8 80000002 00000008 000000C6 00000000 .... .... .... .... <------- System\FileSys
0x040b6738 80000002 00000008 000000B5 00000000 .... .... .... .... <------- System\GDI
0x040b6798 80000002 00000008 000000BC 00000000 .... .... .... .... <------- System\GWE
0x040b67f8 80000002 00000008 200000BE 00000000 .... .... .... .... <------- System\ImageUpdate
0x040b6858 80000002 00000008 000000C0 00000000 .... .... .... .... <------- System\IME
0x040b68b8 80000002 00000008 0000034F 00000000 .... .... O... .... <------- System\Inbox
0x040b6918 80000002 00000008 000000FC 00000000 .... .... .... .... <------- System\IPSecVPN
0x040b6978 80000002 00000008 00000019 00000000 .... .... .... .... <------- System\Loader
0x040b69d8 80000002 00000008 200017ED 00000000 .... .... .... .... <------- System\Notifications
0x040b6a38 80000002 00000008 2000008E 00000000 .... .... .... .... <------- System\ObjectStore
0x040b6a98 80000002 00000008 20000126 00000000 .... .... &... .... <------- System\OOM
0x040b6af8 80000002 00000008 0000035E 00000000 .... .... ^... .... <------- System\Pictures
0x040b6b58 80000002 00000008 0000033E 00000000 .... .... >... .... <------- System\PIMSources
0x040b6bb8 80000002 00000008 2000011B 00000000 .... .... .... .... <------- System\Platform
0x040b6c18 80000002 00000008 00000368 00000000 .... .... h... .... <------- System\Shell
0x040b6c78 80000002 00000008 200005B2 00000000 .... .... .... .... <------- System\SQM
0x040b6cd8 80000002 00000008 000000C4 00000000 .... .... .... .... <------- System\State
0x040b6d38 80000002 00000008 0000000B 00000000 .... .... .... .... <------- System\StorageManager
0x040b6d98 80000002 00000008 00000376 00000000 .... .... v... .... <------- System\Uptime
0x040b6df8 80000002 00000008 20001374 00000000 .... .... t... .... <------- System\Versions
0x040b6e58 80000002 00000008 200002DE 00000000 .... .... .... .... <------- System\WelcomeCenter
0x040b6eb8 80000002 00000008 20001468 00000000 .... .... h... .... <------- System\ActiveSync
0x040b6f18 80000002 00000008 000000C4 00000000 .... .... .... .... <------- System\State
0x040b6f78 80000002 00000008 000000C4 000000F6 .... .... .... .... <------- System\State\ActiveSync
0x040b6fd8 80000002 00000008 000000C4 00000102 .... .... .... .... <------- System\State\Battery
0x040b7038 80000002 00000008 000000C4 00000370 .... .... .... p... <------- System\State\Connections
0x040b7098 80000002 00000008 000000C4 00000106 .... .... .... .... <------- System\State\Connectivity
0x040b70f8 80000002 00000008 000000C4 0000036F .... .... .... o... <------- System\State\DateTime
0x040b7158 80000002 00000008 000000C4 00000110 .... .... .... .... <------- System\State\Hardware
0x040b71b8 80000002 00000008 000000C4 000000C8 .... .... .... .... <------- System\State\Phone
0x040b7218 80000002 00000008 000000C4 20000E5E .... .... .... ^... <------- System\State\Power
0x040b7278 80000002 00000008 000000C4 0000010D .... .... .... .... <------- System\State\Shell
0x040b72d8 80000002 00000008 000000C4 000000D8 .... .... .... .... <------- System\State\VoIP
0x040b7338 80000002 00000008 000000C4 00000000 .... .... .... .... <------- System\State

RegCreateKeyEx and RegOpenKeyEx

both RegCreateKeyEx and RegOpenKeyEx doesn't return the same handle even for the same registry string/location.

Baseband vs Broadband

Data signals can be sent over a network cable in one of two ways: broadband or baseband. One good example of broadband signaling would be how you view different channels through your cable box and a signal coaxial cable carrying multiple signals in cable television.Whereas, baseband signaling only sends a single signal over the cable. This type of signaling is typically used in Ethernet networks, with the exception of 10Broad3 standard (rarely used).

Baseband uses very simple transceiver devices that send and receive signals on a cable. The simplicity behind baseband signaling is that only three states need to be distinquished: one, zero and idle. Broadband transceivers are much more complex because they must be able to distinquish those same states, but on multiple channels within the same cable. Because of its simplicity, baseband signaling is used on most Ethernet networks

http://www.bellaonline.com/articles/art14917.asp

Breakpoint

How Breakpoints Work
==================
A hardware breakpoint stops your target code from running using external emulator-mounted electronics that is completely independent of your hardware. Logic circuits (often implemented as RAM arrays) watch every bus cycle, stopping execution when the address at which you've set the breakpoint occurs.

A hardware breakpoint never alters your code, stack, or any other target resource; it is completely non-intrusive.

A software breakpoint, by contrast, always modifies your code. Typically the source level debugger inserts an INT3 instruction in your code at each breakpoint address. (INT3 does a call through location 0000C).

When properly implemented the debugger remembers the instruction that was at the breakpoint address, replacing it after the code hits any breakpoint.The emulator detects the software breakpoint by watching the system execute the INT3 - specifically, by catching the INT3's read from location 0000C. It then switches to its own internal operation, stopping your code and running its own.

software breakpoints must modify your code, you cannot debug ROMed code with software breakpoints.

Don't Read from 0000C!Another problem arises from the way most software breakpoints work. The emulator typically watches for reads from location 0000C (the INT3 vector address). Any read from this address causes the unit to immediately breakpoint _ even if no breakpoints were set

http://www.avocetsystems.com/company/articles/hints/aphwbk.htm

NAND & NOR

NOR and NAND flash differ in two important ways:
* the connections of the individual memory cells are different
* the interface provided for reading and writing the memory is different (NOR allows random-access for reading, NAND allows only page access)

NAND: the I/O interface of NAND flash does not provide a random-access external address bus, Rather, data must be read on a block-wise basis, NAND devices also require bad block management by the device driver software



http://en.wikipedia.org/wiki/Flash_memory

debuging kdump

Convert kdump
=============
open DumpConverter
Select file
Set Logical Address (same for Debug and regular build variants)
using offsets 0x80000000 for EBI.bin and 0x88000000 for SMI.bin (7200, 7500, 7200A, etc)
Select another text field (to update UI)
Save As...
Important: Does not work well opening/saving to network location (must do locally)Important: This only captures 90% of information so capturing kdmp via PB is preferred!

PB debug kdump
=============
In PB, open kdmp.
click edit->symbol search path, and paste in the flat release directory
click target->connectivity options->debugger->CE Dump File Reader
Click target->attach device

20090707-hopper seed

"Strictly speaking, you can reproduce any particular Hopper run by using its random seed as a parameter (-sxxx) when you invoke the test. Hopper derives its randomness by calling rand() which is completely predictable if you to know its seed. All Hopper actions are bound by this rand() functionality so keystrokes (and screen taps) sent to the device from one seed run will reproduce 100% to a similarly seeded device."

http://blogs.msdn.com/hopperx/archive/2005/08/24/455572.aspx

create a shortcut file like this will run hopper in \ with seed number 305780

256#\hopper.exe -s305780

QPST couldn't recognize the phone

sometims QPST couldn't recognize the phone, it may has conflict with ClearCase network operation.

kernel/OAL changed from Ce5 to Ce6

CE5 the kernel, OAL and the Kernel Independent Transport Layer (KITL) all linked into nk.exe. In CE6 these are broken into kernel.dll, oal.exe and kitl.dll

In Windows CE 5.0, the BSP directories built three different versions of the kernel exe.
OAL + Kernel = kern.exe
OAL + Kernel + KITL = kernkitl.exe
OAL + Kernel + KITL + Profiler = kernkitlprof.exe
In Windows CE 6, we don’t build multiple versions of the OAL. The separation of KITL into kitl.dll gets rid of the distinction between kern.exe and kernkitl.exe, the platform directory only needs to build one executable: oal.exe

http://blogs.msdn.com/ce_base/archive/2006/11/21/ce6-oal-what-you-need-to-know.aspx

qc notes

Apr 13, 2009
When divide 0 happened, GUI shows lockup, serial debug log halt;
If couldn’t replace \windows\dll, tried reflash it, then replace it.
Apr 13, 2009
Error 0xc0000409 is STATUS_STACK_BUFFER_OVERRUN refers to a stack buffer overflow;
Error 0xc00000fd is STATUS_STACK_OVERFLOW fefers to stack exhaustion
Exception code could be seen in ntstatus.h
Apr 11, 2009
Tested: the following statement will generate separate kdump indicates exception happened in system context.
RaiseException(0xffffffff,0,0,0),
ReportFault(GetExceptionInformation(),0), EXCEPTION_EXECUTE_HANDLER),
CaptureDumpOnDevice(0,0,0),
Divide 0
Apr 7, 2009
It seems while using SEH or CaptureDumpOnDevice would generate exception, it is not clear if this is correct behavior or issues
5. AKY=00040001 PC=03f62bf4(coredll.dll+0x00018bf4) RA=8001098c(NK.EXE+0x0001098c) BVA=00000000 FSR=00000000
PC: 0001:00017be4 xxx_RaiseException 10018be4 f coredll_ALL:tkfuncs.obj
RA: 0001:0000f884 PrefetchAbort 00020884 nk:armtrap.obj

6. AKY=00000041 PC=03f683bc(coredll.dll+0x0001e3bc) RA=8001098c(NK.EXE+0x0001098c) BVA=00000000 FSR=00000000
PC: 0001:0001d2e8 CaptureDumpFileOnDevice2 1001e2e8 f coredll_ALL:apis.obj
RA: 0001:0000f884 PrefetchAbort 00020884 nk:armtrap.obj

8. AKY=00200001 PC=03f8e544(coredll.dll+0x00044544) RA=8001098c(NK.EXE+0x0001098c) BVA=00000000 FSR=00000000
PC: 0001:00043500 __CxxThrowException 10044500 f coredll_ALL:throw.obj
RA: 0001:0000f884 PrefetchAbort 00020884 nk:armtrap.obj

Mar 26, 2009
Tested: if kdump is not at RELEASEDIR folder, exception and process would show same, but symbol won’t be able to show in call stack/threads etc
Tested: if the build is same but not identilcal, then it won’t show assembly code.
Mar 25, 2009
When build process got stuck, it maybe caused by copy script need prompt from UI
Feb 24, 2009
Use symmap.exe or symmap2.exe for parsing Hopper logs
Feb 10, 2009
Sometimes for some reason device couldn’t connect with activesyn, try uninstall the Windows Mobile Connect x# driver.
Jan 29, 2009
Sometimes for some reason that while you created a snapshot view, but not showing up in ClearCase Explorer views; Try use “Refresh View Shortcuts” – Alt-F5.
Jan 14, 2009
For changing EBOOT size, need to see if BIB file specified big enough size for it; if .nb1 got generated, it means that size is over designed;
As EBOOT would be changed to mbn and managed by modem side, so we will need to change size value in partition.c in AMSS side, otherwise it would get JTAG flash errors.
It also need to changed IPL’s bib file to cordinate with EBOOT bib;
It also need to change image_cfg.inc and image_cfg.c for jumping to right PA.

Jan 14, 2009
IMPORTING A CERTIFICATE TO YOUR CERTIFICATE STORE
-------------------------------------------------

1) from a cmd prompt on your image-signing machine, launch mmc.exe
2) select File > Add/Remove Snap-In...
3) click Add...
4) choose Certificates; click Add
5) choose which certificate store to manage, as appropriate
(e.g. "My user account" if you want the certificate available only to
the currently logged-in user)
6) return to the main MMC window, and expand the tree view to:
Console Root > Certificates - Current User > Personal > Certificates
[Frank] if used system, it may cause ImageHash couldn’t find certificates
7) right-click on Certificates and choose All Tasks > Import...
8) browse to your certificate file (e.g. SBL_Test_Certificate.pfx)
10) when prompted for the private key password, enter "test123" (without
the quotes) if you are importing SBL_Test_Certificate.pfx.
11) finish the wizard
Example:
ImageHash.exe flash.bin flash_signed.bin 1024
Jan 5, 2009
For adding files to clearcase, make sure container directory must be checked in as well!
Dec 19, 2008
For getting device driver name, check HKEY_LOCAL_MACHINE\Drivers\Active
Issues that call from NK OAL to Coredll
Try to call SetSystemPowerState from OAL IOCTL handler;
got linkage error while building kernel\kern, kernkitl, kernkitlprof;
found the API is at coredll.dll, then tried put $(_SYSGENSDKROOT)\lib\$(_CPUINDPATH)\coredll.lib, into source TARGETLIBS= section; build got linking success!
However in runtime, got Prefetch Abort like logs below, looks like coredll function address didn’t get shed into NK right.
INFO: OALIoCtlHalWarmBoot
INFO: SetSystemPowerState(POWER_STATE_RESET...)
Prefetch Abort: Thread=835ce000 Proc=8037ba10 'consoleTester.exe'
AKY=00002001 PC=00000000(???+0x00000000) RA=80050924(NK.EXE+0x00050924) BVA=00000000 FSR=00000005
try put different path $(_COMMONOAKLIB)\$(_CPUINDPATH)\coredll.lib, $(_COMMONSDKLIB)\$(_CPUINDPATH)\coredll.lib into source, results were the same;
Also try using another coredll function LoadKernelLibrary, result is the same: prefetch abort
seach internet and found that OAL shouldn’t link with coredll.lib.
then tried using SC_CreateFile to get one device driver handle, call SC_DeviceIoControl trap the ioctl to device driver, device driver iocontrol proxy call to SetSystemPowerState;
Success!
Dec 10, 2008
Full build:
1. Goto \fenway\AMSS\products\7200\build\ms
2. Run rvct22.bat
3. Run FDOAAPZM(amss build), FDOAAPZA(wm build), or FDOAAPZD(both)
Unit build:
4. Goto \fenway\WM\BuildScripts\WPC_QCMSM_Retail_FDOAAPAA
5. Run BaseOSEnv
6. Goto the module directory
7. Run build
Dec 09, 2008
Study the source and found under WM, only WM\platform\QCMSM is under clearcase which means all the other like WM\platform\COMMON, WM\public is generated!
Nov 17, 2008
Using JTAG ARM9,
* flashing: do mjnand
Directory: \fenway\wm\platform\qcmsm\tools\jtag
* debugging: do mjnload
Directory: \fenway\AMSS\products\7200\build\ms
While prompting elf, giving M7200JFDOAAPZM524007.elf
While prompting NK.exe, giving fenway\WM\release\WPC_QCMSM_retail_FDOAAPAA\wpc
Start ARM11 T32 as well.
Dec 1, 2008
Enabling phone functionality, flash phone with Gold_umts_fenway.qcn and it locates at \\msmlabpc4\\Dropbox\7200AQcnFile on Hugo's Desktop (hromero1)

Nov 17, 2008
Sometimes device couldn’t turn into FTM, and it would boot in normal boot, when check 453NV, value is 0 even it did get changed verified last time; changing battery sometimes seems improve the situations. So the issue may relates to power management.
Nov 6, 2008
Sometimes device couldn’t connect to PC, neither KITL or ActiveSyn works; Suspect the battery or power do effect on this issue; needs more research. Since every time after flash battery charging image shows up. Strange thing is if boot from USB, it seems work reliable. Could it be EBOOT driver is more effective?
Oct 31, 2008
JTAG flashing Fenway. Launch T32 ARM9, goto \fenway\wm\platofrm\QCMSM\tools\jtag\, then “do mjnand”->input FDOAAPA build ->select 9 (flash all)-> select 14 (flash wm)
Oct 30, 2008
When QPST try reset device in DLOAD mode, it actually would enable reset WatchDog timer, so while connect the device with the blue box, SIP 1 off would disable the WatchDog timer which makes device couldn’t reset.
windows Mobile 6’s way of encrypting files on storage cards, the extention of file is .menc;
to disable encrytion do
Go to System Control Panel and tap on the Encryption icon, unchecked every file you create on the storage card is encrypted;

Oct 29, 2008
Any text written to FSAUXIN will be executed by CESH just as if it was typed interactively, except it is not echoed on the command line.
Oct 28, 2008
In CN4 EBOOT menu, it seems KITL active would makes ActiveSyn doesn’t work;
For creating a crash app for windows mobile:
1. Tried devide 0 like,
Int iNum = 6;
iNum = iNum/0;
Got compile error for deviding zero;

2. Tried delete null like,
char* pTest = 0;
delete pTest;
It doesn’t work;

3. Tried array out of bound like
const int iNum = 10;
char test[iNum];
for (volatile int i=0; i<= 100; i++)
{
test[i] = 'a';
}
Doesn’t work, it would write out of the bound, mess up other variables, but system would not complain.
finally tried
void* pTest;
pTest = (void*)0xFFFFFFFF;
delete pTest;
works! And got data abort like:
Data Abort: Thread=83c371f8 Proc=8037bbd0 'HelloWorldSD.exe'
AKY=00008001 PC=03f6e0b8(coredll.dll+0x000220b8) RA=50616548(???+0x50616548) BVA=fffffff7 FSR=00000001
Unhandled exception at 0x03f6e0b8 in HelloWorldSD.exe: 0x80000002: Datatype misalignment.
The thread 0xc3a31eb6 has exited with code 0 (0x0).
Windows Mobile popup ‘We’re sorry’ windows.

Oct 27, 2008
\windows\cprog.exe is the dealer program running in windows mobile;
try put the same name executable at \ to do custom cprog.exe test;
use dumpbin.exe /disasm to dump out the detail info of module;
[From: Sue Loh (MS)]
Anytime you see a TLSKERN_NOFAULT message, it's because exceptions are known to be a possible (accepted) occurrence at that time. For example as I understand it, using invalid window handles will cause these messages to be printed without breaking into the debugger. I'm the wrong person to tell you if there's anything you could do to make them go away, but I do know they're not serious.
Data Abort troubleshooting: AKY(Access Key), PC(Program Counter), RA(Return Address), BVA(Base Virtual Address), FSR(Fault Status Register)
0:22:15.181 Data Abort: Thread=829aa7c8 Proc=8037b250 'gwes.exe'
0:22:15.181 AKY=00200021 PC=00048a2c(gwes.exe+0x00038a2c) RA=00048a24(gwes.exe+0x00038a24) BVA=0c000100 FSR=00000007
· Return Address (RA) is at 0x00038a24
· Subtract 0x1000 to find the Module Offset(MO) of 0x00038a24
· We can now look up the Module Offset in gwes.map. Here is a small section of gwes.map:
Address Publics by Value Rva+Base Lib:Object0001:00037984 ??0TimerEntry_t@@QAA@PAVMsgQueue@@PAUHWND__@@IIP6AX1IIK@ZPAX_N@Z 00048984 f gwes:timer.obj
0001:00037a04 ?IsValidTimerEntry@TimerEntry_t@@QAA_NXZ 00048a04 f gwes:timer.obj
0001:00037a70 ?TimerQueuesRemoveSingleEvent@TimerEntry_t@@SAPAU1@PAUHWND__@@IPAVMsgQueue@@@Z 00048a70 f gwes:timer.obj
0001:00037b64 ?TimerQueuesRemoveAllMsgQueueOrHwnd@TimerEntry_t@@SAXPAVMsgQueue@@PAUHWND__@@@Z 00048b64 f gwes:timer.obj
Looking at the addresses we find that the MO is between 00037a04 IsValidTimerEntry and 00037a70 TimerQueuesRemoveSingleEvent. To calculate the Instruction Offset(IO) subtract the Function Offset(FO) from the Module Offset: 0x00037a24- 00037a04 = 0x20.
· we need COD file, which contains the C code as comments mixed with the assembly code that was created when the file was compiled. The COD files are in the same folder that the OBJ files are in. If you don't have the COD files, set WINCECOD=1 and rebuild.



Oct 22, 2008
For create branch, it needs VOB which under.


ClearCase connection problem. The view space ccstg_c has to be shared out from the local machine; also check if the abld service is running.
Goto [ClearCase Home Base]->[Control Panel]->[Service Startup]

Oct 20, 2008
couldn’t connect to \\msmlabpc6\, reason is Microsoft Client is not installed with the network. Same root cause to couldn’t print to network printers.




Oct 20, 2008
· If disable DHCP in EBOOT menu, it seems affected ActiveSyn connectivity with the PC, not proved it yet, just some experienmental feeling.
· Enable KITL and VMINI may caused AcitveSyn connection failiure.
· If set EBOOT IPL from network, the device would broadcast BOOTME to 255.255.255.255

Secure CRT settings to connect to device



Oct 17, 2008
Debugging on CE5.0 device without Activesync
This information ONLY applies to the Visual Studio 2005 Beta 2
Without the help of ActiveSync, VS 2005 does not automatically copy the connectivity binaries down to the device and hence debugging becomes problematic.
In order to use debugger on Windows CE 5.0 devices without active sync, you need to:
Step 1. Manually copy the following files down to the device
Clientshutdown.exeConmanClient2.exeCMaccept.exeeDbgTL.dllTcpConnectionA.dll
From the desktop folder: \Program Files\Common Files\Microsoft Shared\CoreCon\1.0\Target\wce400\, to \windows on device
Step 2. Manually launch the conmanclient2.exe
On the device side, open the command prompt and run "Conmanclient2.exe"
Step 3. Set the correct IP address
On the desktop side, open VS 2005Tools à options à device tools à devicesChoose Windows CE 5.0 device, click on “properties”.On the “Windows CE 5.0 device properties” dialog, click on “configure”.On the “Configure TCP/IP” Transport dialog, choose “use specific IP address” and type in the IP address of your windows CE 5.0 device.Click OK.
Step 4. Enable the connection (You can skip this step if the security is already disabled on the CE device by setting "HLKM\System\CoreConOverrideSecurity = 1". But disabling security may expose your device to malicious attack)
Run cMaccept.exe
Connect to the device within 3 minutes after you run cMaccept.exe. (The 3 minutes window is for the first connection. As long as you establish the first connection within 3 minutes, the following deployment/debugging sessions using the same VS instance is not limited by this 3 minutes window)
You need to perform Step 4 again when you try to connect from another instance of VS.
Now debugger is ready to go, and you should be able to deploy and debug program(s) running on Windows CE 5.0 device now.

issue: couldn't connect to device with QPST even install USB driver properly
symptons:
ActiveSyn connection is working well. QPST couldn’t detect the phone.
Solutions:


issue: couldn't use USB Keyboard and Mouse in the desktop
symptons:
Sometimes when playing with USB connection between device and desktop, desktop would show this behavior
Solutions:
Power off desktop, unplug power cord, wait for 10 minutes then power on.

Oct 16, 2008
issue: couldn't install Wince 6.0
symptons:
While in updating registry, it got problem and roll back the installation.
Showing popup:
Solutions:
1. turn off the Restrict CD-ROM access to locally logged on user only. Doesn’t work.
2. grant access right to registry. Doesn’t work.
3. unstall PB5, and try again. Works!