关于mult-xip bin的一些资料整理

一.实现multbin

1.首先修改config.bib

比如:

#elif defined IMGMULTIBIN

; NAME START ADDR SIZE TYPE

; ----------------------------------------------------------------

NK 80220000 007DE000 RAMIMAGE

SHELL 809FE000 00100000 RAMIMAGE

APPS 80AFE000 00100000 RAMIMAGE

CHAIN 80BFE000 00002000 RESERVED ; XIP chain info

RAM 80C00000 01000000 RAM

pdwXIPLoc 00000000 80BFE000 FIXUPVAR ; XIP pTOC

AUTOSIZE=ON ;自动调整RAM 起始地址到 最近的 XIP region的末尾

ROM_AUTOSIZE=ON ；每个分隔的XIP regin 的大小自动调整

DLLADDR_AUTOSIZE=ON ；自动调整 dll地址空间大小根据 multiple XIP regions.

XIPSCHAIN=80bfe000 ; 指定CHAIN region 在内存段的地址.

Note This address is applicable for the example provided in the previous step of this procedure.

If you use a customized address for the CHAIN region or a different BSP, you will have to

update this variable to match your settings

pdwXIPLoc 必须定义START ADDR =00000000 SIZE=CHAIN的START ADDR

CHAIN 用来保存多个bin的chain info,CHAIN的位置和你bootloader代码有关,(cepc一般放在 NK region 后面)

所有的RAMIMAGE 必须在物理,虚拟地址上都连续

经验上每个bin 加32K (msdn：As a good practice, add the sizes of all files for a given region,

and then add an extra 32K as a buffer. Adding this extra amount provides room for the files to

reduce and expand as they change between each successive build)

2.修改platform.bib,把不同的部分放入到不动的region中 (其他bib也可以修改的)

比如

if IMGMULTIBIN

shell.exe $(_FLATRELEASEDIR)\shell.exe SHELL SH

filesys.exe $(_FLATRELEASEDIR)\filesys.exe SHELL SH

#else

shell.exe $(_FLATRELEASEDIR)\shell.exe NK SH

filesys.exe $(_FLATRELEASEDIR)\filesys.exe NK SH

#endif

表示把文件系统, shell放到 SHELL regin (shell.bin)

3.设置: 环境变量IMGMULTIBIN =1

4.在cfw.c中的OEMInit中的最后加上对InitRomChain的调用，来连接各个bin,最后连接到OEMRomChain 上!!!

void InitRomChain(void)

{

static ROMChain_t s_pNextRom[MAX_ROM] = {0};

DWORD dwRomCount = 0;

DWORD dwChainCount = 0;

DWORD *pdwCurXIP;

DWORD dwNumXIPs;

PXIPCHAIN_ENTRY pChainEntry = NULL;

if(pdwXIPLoc == NOT_FIXEDUP)

{

return; //pdwXIPLoc 必须是 FIXUPVAR ,否则表示没有chain或者设置不对

}

// set the top bit to mark it as a virtual address

pdwCurXIP = (DWORD*)(((DWORD)pdwXIPLoc) | 0x80000000);

// first DWORD is number of XIPs

dwNumXIPs = (*pdwCurXIP);

if(dwNumXIPs > MAX_ROM)

{

lpWriteDebugStringFunc(TEXT("ERROR: Number of XIPs exceeds MAX\n"));

return;

}

pChainEntry = (PXIPCHAIN_ENTRY)(pdwCurXIP + 1); //其实就是指向CHAIN 中chain info的相关信息

while(dwChainCount < dwNumXIPs)

{

if ((pChainEntry->usFlags & ROMXIP_OK_TO_LOAD) && // flags indicates valid XIP

*(LPDWORD)(((DWORD)(pChainEntry->pvAddr)) + ROM_SIGNATURE_OFFSET) == ROM_SIGNATURE)

{

s_pNextRom[dwRomCount].pTOC = *(ROMHDR **)(　　((DWORD)(pChainEntry->pvAddr)) + ROM_SIGNATURE_OFFSET + 4　　);

s_pNextRom[dwRomCount].pNext = NULL;

if (dwRomCount != 0)

{

s_pNextRom[dwRomCount-1].pNext = &s_pNextRom[dwRomCount];

}

else

{

OEMRomChain = s_pNextRom;

}

dwRomCount++;

}

else

{

lpWriteDebugStringFunc( _T("Invalid XIP found\n") );

}

++pChainEntry;

dwChainCount++;

}

}

//在romldr.h中　定义了上面的相关的

typedef struct _XIPCHAIN_ENTRY {

LPVOID pvAddr; // address of the XIP

DWORD dwLength; // the size of the XIP

DWORD dwMaxLength; // the biggest it can grow to

USHORT usOrder; // where to put into ROMChain_t

USHORT usFlags; // flags/status of XIP

DWORD dwVersion; // version info

CHAR szName[XIP_NAMELEN]; // Name of XIP, typically the bin file''s name, w/o .bin

DWORD dwAlgoFlags; // algorithm to use for signature verification

DWORD dwKeyLen; // length of key in byPublicKey

BYTE byPublicKey[596]; // public key data

} XIPCHAIN_ENTRY, *PXIPCHAIN_ENTRY;

#define ROMXIP_OK_TO_LOAD 0x0001

#define ROMXIP_IS_SIGNED 0x0002

#define ROM_SIGNATURE_OFFSET 64　　　//0x40

#define ROM_SIGNATURE 0x43454345 //cece 4byte =>ROMHDR 在0x44偏移处,

//每个bin 都有个pToc指向ROMHDR开头的地址,看下面的bin 文件结构,在0x44offset处地址里面放的是ROMHDR地址,开始是-1,由romimage.exe来设置的

//有点糊涂了 再分析下bin文件的结构

struct BinFile{

BYTE signature[7]; // = { ''''B'''', ''''0'''', ''''0'''', ''''0'''', ''''F'''', ''''F'''', ''''\a'''' }

DWORD ImageStart

DWORD ImageLength

Record ImageRecords[RecordNum]

};

struct Record{

DWORD address;

DWORD length;

DWORD chksum;

};

在文件的最开端，会放置一个BinFile结构，imageStart和ImageLength分别对应镜像展开后在内存中存放的首地址和长度。

该结构中的RecordNum为不确定的，通常在最后一个记录之后增加一个address和Chksum都为0的纪录表示结束，

而这个表示结束的结构中的Length则标示其实际入口点。

可以用viewbin -r 去看下nk.bin:

Image Start = 0x8C200000, length = 0x00E158C8

Start address = 0x8C201000

Checking record #22 for potential TOC (ROMOFFSET = 0xFF446658)

Checking record #177 for potential TOC (ROMOFFSET = 0x00000000)

Found pTOC = 0x8d013950

ROMOFFSET = 0x00000000

ROMHDR ----------------------------------------

DLL First : 0x01E401E7

DLL Last : 0x02000000

Physical First : 0x8C200000

Physical Last : 0x8D0158C8

RAM Start : 0x8E600000

RAM Free : 0x8E629000

RAM End : 0x8FF00000

Kernel flags : 0x00000002

Prof Symbol Offset : 0x00000000

Num Copy Entries : 1

Copy Entries Offset : 0x8CC7AE8C

Num Modules : 166

Num Files : 95

Kernel Debugger : No

CPU : 0x01c2 (Thumb)

Extensions : 0x8C20266C

ROMHDR Extensions -----------------------------

PID[0] = 0x00000000

PID[1] = 0x00000000

PID[2] = 0x00000000

PID[3] = 0x00000000

PID[4] = 0x00000000

PID[5] = 0x00000000

PID[6] = 0x00000000

PID[7] = 0x00000000

PID[8] = 0x00000000

PID[9] = 0x00000000

Next: 00000000

COPY Sections ---------------------------------

Src: 0x8CD18DA8 Dest: 0x8E606000 CLen: 0x228 DLen: 0x22B4C

MODULES ---------------------------------------

11/20/2006 03:20:28 268800 nk.exe

11/20/2006 03:25:22 550400 coredll.dll

11/20/2006 03:25:22 205824 filesys.exe

11/20/2006 03:25:22 723968 gwes.exe

11/20/2006 03:09:08 25600 device.exe

.......................

.......................

FILES ----------------------------------------

11/20/2006 03:10:42 C_R_ 2897 12461 ceconfig.h (ROM 0x8C55E4AC)

11/20/2006 03:25:18 _HRS 0 694654 wince.nls (ROM 0x8CE36984)

5/09/2007 14:06:14 CHRS 3427 20574 initobj.dat (ROM 0x8C730280)

.......................

.......................

done.

分布结构:

Image :

Offset -----------

0x00 | ImageStart

|

|

0x40 | Rom Signature { 0x43454345 }

0x44 | Pointer to the ROMHDR for this Region

|

|

0x???? | ROMHDR{ 　　　　　　　　　　　　　　　<-pToc所指

| };

|

Chain file

struct _XIPCHAIN_ENTRY {

LPVOID pvAddr; // address of the XIP

DWORD dwLength; // the size of the XIP

DWORD dwMaxLength; // the biggest it can grow to

USHORT usOrder; // where to put into ROMChain_t

USHORT usFlags; // flags/status of XIP

DWORD dwVersion; // version info

CHAR szName[XIP_NAMELEN]; // Name of XIP, typically the bin file''''s name, w/o .bin

DWORD dwAlgoFlags; // algorithm to use for signature verification

DWORD dwKeyLen; // length of key in byPublicKey

BYTE byPublicKey[596]; // public key data

};

Offset --------------------------

0x00 | DWORD Count;

0x04 | XIPCHAIN_ENTRY[1]{

| };

| XIPCHAIN_ENTRY[2]{

| };

| ...

二.关于OEMMultiBINNotify ,他是被blcommon 来调用，来让我们获得一个或多个 BIN regions的信息的

比如

用结构

typedef struct _MultiBINInfo_

{

DWORD dwNumRegions;

RegionInfo Region[BL_MAX_BIN_REGIONS];

} MultiBINInfo, *PMultiBINInfo;

定义一个MultiBINInfo g_BINRegionInfo;全局变量在OEMMultiBINNotify中获得每个bin regins的信息

ReginInfo结构:

typedef struct _RegionInfo_

{

DWORD dwRegionStart;

DWORD dwRegionLength;

} RegionInfo, *PRegionInfo;

g_BINRegionInfo 被WriteRegionsToBootMedia　写regions到flash用到,

我用的是nandflash,

WriteRegionsToBootMedia中这段

// Look in the kernel region''s extension area for a multi-BIN extension descriptor.

// This region, if found, details the number, start, and size of each BIN region.

//

//for (nCount = 0, dwNumExts = 0 ; (nCount < g_BINRegionInfo.dwNumRegions) && !pChainInfo ; nCount++)

for (nCount = 0, dwNumExts = 0 ; (nCount < g_BINRegionInfo.dwNumRegions); nCount++)

{

// Does this region contain nk.exe and an extension pointer?

//

pExt = (EXTENSION *)GetKernelExtPointer(g_BINRegionInfo.Region[nCount].dwRegionStart,

g_BINRegionInfo.Region[nCount].dwRegionLength );

if ( pExt != NULL)

{

// If there is an extension pointer region, walk it until the end.

//

while (pExt)

{

DWORD dwBaseAddr = g_BINRegionInfo.Region[nCount].dwRegionStart;

pExt = (EXTENSION *)OEMMapMemAddr(dwBaseAddr, (DWORD)pExt);

EdbgOutputDebugString("INFO: OEMLaunch: Found chain extenstion: ''%s'' @ 0x%x\r\n", pExt->name, dwBaseAddr);

if ((pExt->type == 0) && !strcmp(pExt->name, "chain information"))

{

pChainInfo = (PXIPCHAIN_SUMMARY) OEMMapMemAddr(dwBaseAddr, (DWORD)pExt->pdata);

dwNumExts = (pExt->length / sizeof(XIPCHAIN_SUMMARY));

EdbgOutputDebugString("INFO: OEMLaunch: Found ''chain information'' (pChainInfo=0x%x Extensions=0x%x).\r\n", (DWORD)pChainInfo, dwNumExts);

break;

}

pExt = (EXTENSION *)pExt->pNextExt;

}

}

else {

// Search for Chain region. Chain region doesn''t have the ROMSIGNATURE set

DWORD dwRegionStart = g_BINRegionInfo.Region[nCount].dwRegionStart;

DWORD dwSig = *(LPDWORD) OEMMapMemAddr(dwRegionStart, dwRegionStart + ROM_SIGNATURE_OFFSET);

if ( dwSig != ROM_SIGNATURE) {

// It is the chain

dwChainStart = dwRegionStart;

dwChainLength = g_BINRegionInfo.Region[nCount].dwRegionLength;

EdbgOutputDebugString("Found the Chain region: StartAddress: 0x%X; Length: 0x%X\n", dwChainStart, dwChainLength);

}

}

}

// nk.exe and an extension pointer 这个是什么意思，就是说nk.exe　包含一个扩展point是派什么用处的，那位知道告诉我

感觉是一个是bootlaod时的概念，一个是运行是的概念

bootlaoder时　：通过OEMMultiBINNotify　获得的信息来进行下载等应用

运行时，是根据config.bib中CHAIN的关于regions的信息,通过InitRomChain　来把他串起来，

三.toc block ,是和nand boot有关的东西

typedef struct _TOC {

DWORD dwSignature;

// How to boot the images in this TOC.

// This could be moved into the image descriptor if desired,

// but I prefer to conserve space.

BOOT_CFG BootCfg;

// Array of Image Descriptors.

IMAGE_DESCRIPTOR id[MAX_TOC_DESCRIPTORS];

// UCHAR Pad[12]; // align on SECTOR_SIZE

CHAININFO chainInfo;

} TOC, *PTOC; // 512 bytes

typedef struct _IMAGE_DESCRIPTOR {

// File version info

DWORD dwVersion; // e.g: build number

DWORD dwSignature; // e.g: "EBOT", "CFSH", etc

UCHAR ucString[IMAGE_STRING_LEN]; // e.g: "PocketPC_2002"

DWORD dwImageType; // IMAGE_TYPE_ flags

DWORD dwTtlSectors; // TTL image size in sectors.

// We store size in sectors instead of bytes

// to simplify sector reads in Nboot.

DWORD dwLoadAddress; // Virtual address to load image (ImageStart)

DWORD dwJumpAddress; // Virtual address to jump (StartAddress/LaunchAddr)

// This array equates to a sector-based MXIP MultiBINInfo in blcommon.

// Unused entries are zeroed.

// You could chain image descriptors if needed.

SG_SECTOR sgList[MAX_SG_SECTORS];

// BinFS support to load nk region only

//struct

//{

ULONG dwStoreOffset; // byte offset - not needed - remove!

//ULONG RunAddress; // nk dwRegionStart address

//ULONG Length; // nk dwRegionLength in bytes

//ULONG LaunchAddress; // nk dwLaunchAddr

//} NKRegion;

} IMAGE_DESCRIPTOR, *PIMAGE_DESCRIPTOR;

这些信息被写入block 1,

为nboot启动　nk,或 eboot提供信息的