wince6.0 os image 下载成功但是启动失败？

Question

系统： OS image wince 6.0 R3 (RTL8139D)
必要条件：enable KITL
问题通过网络下载OS image成功后，在启动过程中wince重新启动!

串口消息：
EthDown::TFTPD_OPEN::boot.bin
-EbootSendBootmeAndWaitForTftp

Download file information:
-----------------------------------------------------
[0]: Address=0x220000 Length=0x1D794DC Name=

****** OEMVerifyMemory Checking Range [ 0x220000 ==> 0x1F994DB ]
****** RAM Address ******

rom_offset=0x80000000.
ROMHDR at Address 00220044h
OEMLaunch ucLoaderFlags is 7
Download successful! Jumping to image at 00226D10h...
Got EDBG_CMD_JUMPIMG
Got EDBG_CMD_CONFIG, flags:0x00000000
NAND_FLASH with g_bDownloadImage=1 , pBootArgs->ucLoaderFlags=7
Lauch Windows CE from address 0x226D10
Debug Serial Init

SysInit: GDTBase=81f9a000 IDTBase=81ff28c0 KData=81fa1800
Windows CE Kernel for i486 Built on Sep 25 2009 at 11:03:29
INFO:OALLogSetZones: dpCurSettings.ulZoneMask: 0xb
PCIBIOS:: BIOS Address static map to addr=a00e0000
GetPicRoutingIrqTable: Start
search_pci_bios start
CE Ethernet Bootloader found 32Bit BIOS Entry master_bios32=a00fa920
bios32_call
_offset=1ada0 for CE/PC
Return from First BIOS EAX=49435000 EBX=f0000,ECX=cf34 E
DX=adf0
32 PCI BIOS offset located.addr=1adf0
32 PCI BIOS Present EDX=20494350,EAX
=11 EBX=f0210,ECX=cf01
+GetRoutingOption
search_pci_routing
search_pci_routing found entry =a00fcea0 CE/PC
GetRoutingOption, found ROM vers
ion for Routing table.
GetRoutingOption return SUCCESS .AH=c28
ScanConfiguredIrq with PCI Exclusive Irq Bit (wExClusive) =c28
ScanConfigureIrq: BufferSize = 112 @ address 81f9d9ea
ScanConfigureIrq: for Bus=0 ,Device=9 SlotNumber=1
INTA_LinkValue=2,INTA_IrqBitMap=cef8
INTB_LinkValue=3,INTB_IrqBitMap=cef8
INTC_LinkValue=5,INTC_IrqBitMap=cef8
INTD_LinkValue=1,INTD_IrqBitMap=cef8
ScanConfigureIrq: for Bus=0 ,Device=10 SlotNumber=2
INTA_LinkValue=3,INTA_IrqBitMap=cef8
INTB_LinkValue=5,INTB_IrqBitMap=cef8
INTC_LinkValue=1,INTC_IrqBitMap=cef8
INTD_LinkValue=2,INTD_IrqBitMap=cef8
ScanConfigureIrq: for Bus=0 ,Device=11 SlotNumber=3
INTA_LinkValue=5,INTA_IrqBitMap=cef8
INTB_LinkValue=1,INTB_IrqBitMap=cef8
INTC_LinkValue=2,INTC_IrqBitMap=cef8
INTD_LinkValue=3,INTD_IrqBitMap=cef8
addIrqLink: LinkNumber=5,bus=0,device=11 associated with irq=5
ScanConfigureIrq: for Bus=0 ,Device=17 SlotNumber=0
INTA_LinkValue=1,INTA_IrqBitMap=cef8
INTB_LinkValue=2,INTB_IrqBitMap=cef8
INTC_LinkValue=3,INTC_IrqBitMap=cef8
INTD_LinkValue=5,INTD_IrqBitMap=cef8
ScanConfigureIrq: for Bus=0 ,Device=1 SlotNumber=0
INTA_LinkValue=1,INTA_IrqBitMap=cef8
INTB_LinkValue=2,INTB_IrqBitMap=cef8
INTC_LinkValue=3,INTC_IrqBitMap=cef8
INTD_LinkValue=5,INTD_IrqBitMap=cef8
ScanConfigureIrq: for Bus=0 ,Device=16 SlotNumber=0
INTA_LinkValue=1,INTA_IrqBitMap=cef8
INTB_LinkValue=2,INTB_IrqBitMap=cef8
INTC_LinkValue=3,INTC_IrqBitMap=cef8
INTD_LinkValue=5,INTD_IrqBitMap=cef8
addIrqLink: LinkNumber=1,bus=0,device=16 associated with irq=10
addIrqLink: LinkNumber=2,bus=0,device=16 associated with irq=3
ScanConfigureIrq: for Bus=0 ,Device=18 SlotNumber=0
INTA_LinkValue=1,INTA_IrqBitMap=cef8
INTB_LinkValue=2,INTB_IrqBitMap=cef8
INTC_LinkValue=3,INTC_IrqBitMap=cef8
INTD_LinkValue=5,INTD_IrqBitMap=cef8
addIrqLink: LinkNumber=1,bus=0,device=18 associated with irq=10
InitKitlNIC: Searching for PCI Ethernet NIC (dwIrq = 5, dwIoBase = 9000,
dwDfltT
ype = 4) ...
InitKitlNIC: Found PCI Ethernet NIC (type = 4, IRQ=5, IOBase=0x9000).
Using a KITL device on the PCI bus, not a legacy device.
DeviceId................. CEPC
pArgs->flags............. 0x29
pArgs->devLoc.IfcType.... 5
pArgs->devLoc.LogicalLoc. 0xB00
pArgs->devLoc.PhysicalLoc 0x0
pArgs->devLoc.Pin........ 5
pArgs->ip4address........ 1
pDevice->Name............ s
pDevice->ifcType......... 5
pDevice->id.............. 0x813910EC
pDevice->resource........ 0
pDevice->type............ 2
pDevice->pDriver......... 0x81FA3068
RTL8139InitDMABuffer():: Start[0x81FD4360]-[0x81FD4360] - Size[0x10000]
Tx[0x81FD4360] - Rx[0x81FD5B60] - RxLength[0x8000] - RxLengthBit[0x1000]
RTL8139:: built on [Sep 6 2006] [19:21:34]
RTL8139Init():: BaseIO[0x9000] : MemOffset[0xB00]
RTL8139Init():: TxBuff[0x81FD4360] - RxBuff[0x81FD5B60] - LastRx[0x81FDDB5F]
RTL8139Init:: MAC = 00-B0-C4-B5-27-25
RTL8139 ethdbg library: perform auto negotiate.
RTL8139:: RTL8139HWSetMCRegs():: Set all to 0x00
x86KitlCreateName: Using Device Name 'CEPC10021'
OALKitlCreateName: Using Device Name 'CEPC10021'
KITL: *** Device Name CEPC10021 ***
OALIntrRequestIrqs:(Bus=0,Device=11,Pin=1)
OALIntrRequestIrqs: for Bus=0 ,Device=9 SlotNumber=1
INTA_LinkValue=2,INTA_IrqBitMap=cef8
INTB_LinkValue=3,INTB_IrqBitMap=cef8
INTC_LinkValue=5,INTC_IrqBitMap=cef8
INTD_LinkValue=1,INTC_IrqBitMap=cef8
OALIntrRequestIrqs: for Bus=0 ,Device=10 SlotNumber=2
INTA_LinkValue=3,INTA_IrqBitMap=cef8
INTB_LinkValue=5,INTB_IrqBitMap=cef8
INTC_LinkValue=1,INTC_IrqBitMap=cef8
INTD_LinkValue=2,INTC_IrqBitMap=cef8
OALIntrRequestIrqs: for Bus=0 ,Device=11 SlotNumber=3
INTA_LinkValue=5,INTA_IrqBitMap=cef8
INTB_LinkValue=1,INTB_IrqBitMap=cef8
INTC_LinkValue=2,INTC_IrqBitMap=cef8
INTD_LinkValue=3,INTC_IrqBitMap=cef8
-OALIntrRequestIrqs: Found full IRQ match returning existing IRQ=5
KITL: using sysintr 0x10
VBridge:: built on [Sep 6 2006] time [19:21:34]
VBridgeInit()...TX = [16384] bytes -- Rx = [16384] bytes
Tx buffer [0xA1FE4500] to [0xA1FE8500].
Rx buffer [0xA1FE8520] to [0xA1FEC520].
VBridge:: NK add MAC: [0-B0-C4-B5-27-25]
Connecting to Desktop
KITL: Connected host IP: 1 Port: 1969
KeyIndex 0 = -1
KeyIndex 1 = -1
KeyIndex 2 = -1
KeyIndex 3 = -1
KeyIndex 4 = -1
KeyIndex 5 = -4194305
KeyIndex 6 = -4194305
KeyIndex 7 = -1
+KITLRegisterDfltClient, service:0
+KITLRegisterDfltClient, service:1
Waiting for service 'DBGMSG' to connect..., fUseSysCalls = 0
ProcessAdminMsg: Receive Config message for service DBGMSG
ProcessAdminMsg: Receive Config message for service PPSH
ProcessAdminMsg: Receive Config message for service DBGMSG
ProcessAdminMsg: Receive Config message for service DBGMSG
ProcessAdminMsg: Receive Config message for service PPSH
!Received config for unrecognized service KDBG
+KITLRegisterDfltClient, service:2
ProcessAdminMsg: Receive Config message for service KDBG
ProcessAdminMsg: Receive Config message for service KDBG
KdpDeleteBreakpoint: Invalid handle
。。。。。。。。。。。。。。。。
。。。。。。。。。。。。。。。。。。
KdpDeleteBreakpoint: Invalid handle
KITL: Leaving polling mode... 0x81FD4060
KITL Checking client registrations
+RegisterClientPart2: Id 0x00000000
KITL Timer thread started, (hTh: 0x00520002, pTh: 0x83FDCC40)
Closing Handle of Timer Thread
-RegisterClientPart2 returns 1
+RegisterClientPart2: Id 0x00000001
-RegisterClientPart2 returns 1
KITL Creating IST
KITL Interrupt thread started (hTh: 0x005A0002, pTh: 0x83FBA414), using
SYSINTR
16
Enabling adapter ints...
+RTL8139EnableInts()..
-RTL8139EnableInts()..
Bad RX packet [Header: 0x9A2E -- Length : [17477]]...
Exception 'Access Violation' (14): Thread-Id=00630002(pth=83fbade8),
Proc-Id=004
00002(pprc=81fefc80) 'NK.EXE', VM-active=00400002(pprc=81fefc80) 'NK.EXE'
PC=802446fb(kitl.dll+0x000116fb) RA=802403df(kitl.dll+0x0000d3df)
SP=d00cf3cc, B
VA=00000024
Recursively calling KDEnableInt(FALSE, psvdThread != NULL) 1 time(s).
This OK if
KdStub stumbling on its own BP.
KdTrap: Exception in debugger, Addr=0x802446FB - attempting to recover
Eax=00000000 Ebx=d00cf9c0 Ecx=00000725 Edx=00000000
Esi=00000000 Edi=d00cfa8c Ebp=d00cf3ec Esp=d00cf3cc Eip=802446fb
CS=0019 DS=0040 ES=0040 SS=0021 FS=0060 GS=0000
URtlDispatchException: returning failure. Flags=0
KPSLExceptionHandler: flags=1 ControlPc=81f9a117
ERROR:
D:\Dublin2-14\private\winceos\COREOS\nk\kernel\nknormal\..\schedule.c lin
e 760: Abandoning CS 81fefd74 in PuntCritSec
Eax=8026ab20 Ebx=81ff01e8 Ecx=d00cf194 Edx=8026ab20
Esi=00000000 Edi=00000003 Ebp=00000000 Esp=d00cfb54 Eip=81f9a117
CS=0019 DS=0040 ES=0040 SS=0021 FS=0060 GS=0000
URtlDispatchException: returning failure. Flags=1
Recursively calling KDEnableInt(FALSE, psvdThread != NULL) 1 time(s).
This OK if
KdStub stumbling on its own BP.
KdTrap: Exception in debugger, Addr=0x81F9A117 - unable to recover

Unhandled exception c0000005:
Terminating thread 83fbade8
Secondary thread in proc 00400002 faulted, Exception code = c0000005,
Exception
Address = 81f9a117!
Terminating Thread 00630002

Faulted in KCall, pCurThread->dwStartAddr = 8023cf20, PageFreeCount =
00000b9b!!

Original Context when thread faulted:
Exception Access Violation (14): Thread-Id=005a0002(pth=83fba414),
Proc-Id=00400
002(pprc=81fefc80) 'NK.EXE', VM-active=00400002(pprc=81fefc80) 'NK.EXE'
EIP=80269a11 Flags=00003246 EA=00000024
Eax=81fc7608 Ebx=00000000 Ecx=000005f0 Edx=d009fc1c
Esi=00000000 Edi=80244810 Ebp=d009fc08 Esp=d009fc04
CS=0019 DS=0040 ES=0040 SS=0021 FS=0060 GS=0000
Context when faulted in KCall:
Exception Access Violation (14): Thread-Id=005a0002(pth=83fba414),
Proc-Id=00400
002(pprc=81fefc80) 'NK.EXE', VM-active=00400002(pprc=81fefc80) 'NK.EXE'
EIP=80244899 Flags=00013206 EA=00000024
Eax=00000725 Ebx=81fa1800 Ecx=00000000 Edx=d009fc1c
Esi=83fba484 Edi=80244810 Ebp=81fa17e8 Esp=81fa17d0
CS=0008 DS=0040 ES=0040 SS=0010 FS=0060 GS=0000
NK Kernel: DEBUGCHK failed in file
D:\Dublin2-14\private\winceos\COREOS\nk\kerne
l\nknormal\..\vm.c at line 1251

Faulted in KCall, pCurThread->dwStartAddr = 8023cf20, PageFreeCount =
00000b9b!!

Original Context when thread faulted:
Exception Access Violation (14): Thread-Id=005a0002(pth=83fba414),
Proc-Id=00400
002(pprc=81fefc80) 'NK.EXE', VM-active=00400002(pprc=81fefc80) 'NK.EXE'
EIP=80269a11 Flags=00003246 EA=00000729
Eax=81fc7608 Ebx=00000000 Ecx=000005f0 Edx=d009fc1c
Esi=00000000 Edi=80244810 Ebp=d009fc08 Esp=d009fc04
CS=0019 DS=0040 ES=0040 SS=0021 FS=0060 GS=0000
Context when faulted in KCall:
Exception Access Violation (14): Thread-Id=005a0002(pth=83fba414),
Proc-Id=00400
002(pprc=81fefc80) 'NK.EXE', VM-active=00400002(pprc=81fefc80) 'NK.EXE'
EIP=802ae8ef Flags=00013212 EA=00000729
Eax=81fa1730 Ebx=81fa1800 Ecx=81fa1730 Edx=00000725
Esi=0000000e Edi=81fa1730 Ebp=81fa1700 Esp=81fa16d0
CS=0008 DS=0040 ES=0040 SS=0010 FS=0060 GS=0000
NK Kernel: DEBUGCHK failed in file
D:\Dublin2-14\private\winceos\COREOS\nk\kerne
l\nknormal\..\vm.c at line 1251

Faulted in KCall, pCurThread->dwStartAddr = 8023cf20, PageFreeCount =
00000b9b!!

Original Context when thread faulted:
Exception Access Violation (14): Thread-Id=005a0002(pth=83fba414),
Proc-Id=00400
002(pprc=81fefc80) 'NK.EXE', VM-active=00400002(pprc=81fefc80) 'NK.EXE'
EIP=80269a11 Flags=00003246 EA=00000005
Eax=81fc7608 Ebx=00000000 Ecx=000005f0 Edx=d009fc1c
Esi=00000000 Edi=80244810 Ebp=d009fc08 Esp=d009fc04
CS=0019 DS=0040 ES=0040 SS=0021 FS=0060 GS=0000
Context when faulted in KCall:
Exception Access Violation (14): Thread-Id=005a0002(pth=83fba414),
Proc-Id=00400
002(pprc=81fefc80) 'NK.EXE', VM-active=00400002(pprc=81fefc80) 'NK.EXE'
EIP=802ae8ef Flags=00013213 EA=00000005
Eax=81fa1630 Ebx=81fa1800 Ecx=81fa1630 Edx=00000001
Esi=0000000e Edi=81fa1630 Ebp=81fa1600 Esp=81fa15d0
CS=0008 DS=0040 ES=0040 SS=0010 FS=0060 GS=0000
E
Faulted in KCall, pCurThread->dwStartAddr = 8023cf20, PageFreeCount =
00000b9b!!

Original Context when thread faulted:
Exception Access Violation (14): Thread-Id=005a0002(pth=83fba414),
Proc-Id=00400
002(pprc=81fefc80) 'NK.EXE', VM-active=00400002(pprc=81fefc80) 'NK.EXE'
EIP=8022d338 Flags=00003202 EA=00000300
Eax=00000008 Ebx=00000300 Ecx=81fef780 Edx=00000002
Esi=81fef7ec Edi=83fba498 Ebp=81fe03fd Esp=81fef630
CS=0019 DS=81fef630 ES=000e SS=0021 FS=81fef8b8 GS=0040
Context when faulted in KCall:
Exception Access Violation (14): Thread-Id=005a0002(pth=83fba414),
Proc-Id=00400
002(pprc=81fefc80) 'NK.EXE', VM-active=00400002(pprc=81fefc80) 'NK.EXE'
EIP=81fef780 Flags=00013002 EA=00000300
Eax=00000300 Ebx=81fef7ec Ecx=00000000 Edx=81fe03fd
Esi=0000000e Edi=81fef8b8 Ebp=81fef630 Esp=83fba4a8
CS=0008 DS=0040 ES=0040 SS=0010 FS=0060 GS=0000