Nk.exe Boot Process

Other versions of this page are also available for the following:

Windows Mobile Not SupportedWindows Embedded CE Supported


During the boot process, the system calls the kernel, Nk.exe is initialized, and then booted.

In the kernel boot process, the following calls are made in the order shown:


  • StartUp
  • KernelStart or KernelInitialize
  • <Main kernel initialization function>
  • OEMInitDebugSerial
  • OEMInit
  • KernelInit
  • HeapInit
  • InitMemoryPool
  • ProcInit
  • SchedInit
  • FirstSchedule
  • SystemStartupFunc


This is the first function that is called during kernel startup, and it initializes the CPU to a known state. The StartUp function performs the following tasks:

  • Performs minimal processor and hardware initialization.
  • Disables interrupts, caches, and the memory management unit (MMU).
  • After the StartUp function initializes the CPU, it calls the KernelStart or KernelInitialize function.

The StartUp function, under %_WINCEROOT%\Platform\<Hardware Platform Name>\Common\Src\Soc\<bsp identifier>\Startup\Startup.*, is usually written in assembly language and is shared with the boot loader.

KernelStart or KernelInitialize

The OEM adaptation layer (OAL) sets up any platform- or CPU-specific settings that are required for the kernel to access ROM and RAM. To start the system, it then jumps to KernelInitialize, for x86-based hardware platforms, or KernelStart, for all other hardware platforms. At this point, the MMU and caches should not be enabled. The KernelStart or KernelInitialize function performs the following tasks:

  • Initialize kernel globals by calling KernelRelocate from the Copy section in ROM.
  • (ARM and X86 only) Initializes the first-level page table based on the contents of OEMAddressTable.
  • (ARM and x86 only) Enables the MMU and the caches.
  • Initializes the stacks for each mode of operation.
  • Finds the entry-point of Kernel.dll by using table of contents.
  • Jumps to the entry point of Kernel.dll, the main kernel initialization function.

For MIPS and SHx platforms, both cache and MMU are enabled in the entry point of Kernel.dll. Until the MMU is enabled, the kernel symbolic addresses are invalid and must be translated through the OEMAddressTable to obtain the correct physical addresses. The implementation of the KernelStart and the KernelInitialize function are under %_WINCEROOT%\Private\Winceos\Coreos\Nk\Ldr\<cpu>. After KernelStart or KernelInitialize has performed all its tasks, it calls the main initialization function for the kernel that you are using.

Main Kernel Initialization Function

The main kernel initialization function is responsible for calling the OEM-supplied initialization functions. It also performs the following tasks:

  • Sets up the NKGLOBALS structure
    This defines all kernel exports to the kernel independent transport layer (KITL) and the OEM adaptation layer (OAL).
  • Initializes the OEMGLOBALS structure.
    This defines all the OAL exports to kernel and KITL.
  • If the image has KITL built in, kernel initialization function loads Kitl.dll and calls the entry point of Kitl.dll.
  • Initializes the debug serial port with OEMInitDebugSerial.
  • Displays the Windows Embedded CE sign-on message through the debug port.
  • Initializes the hardware platform with OEMInit.
  • Sets up memory by using the KernelFindMemory routine.
  • Jumps to the KernelInit routine to complete the initialization, and jumps to the first thread.

If you have an ARM kernel, KernelStart calls ARMInit as the main kernel initialization function.


OEMInitDebugSerial initializes the debug serial port on the target device. The debug functions typically communicate with a serial device. Because the boot loader implements the same code, a single implementation can be shared between the OAL and the boot loader. These are serial debug functions that OEMs need to implement:

The NK banner is displayed after the OEMInitDebugSerial function is completed.


OEMInit is implemented by OEMs to initialize all hardware interfaces for the target device. At this point in the kernel boot process, interrupts are disabled, and the kernel is unable to handle exceptions. The only kernel service available to OEMInit is HookInterrupt. OEMInit can register interrupt service routines (ISRs) by calling HookInterrupt. The following hardware initialization is usually required:

  • Interrupts
  • System timer
  • KITL interface

Depending on the hardware, optional initialization includes the following:

  • Bus interfaces.

Sample implementations of the OEMInit function are in %_WINCEROOT%\Platform\<Hardware Platform Name>\Src\OAL\.


The KernelInit function encapsulates the initialization of the kernel. It initializes the following parts of the kernel through calls to different initialization functions:

  • Heap
  • Memory pool.
  • Kernel process.
  • Scheduler.

After the call to this function, the system is ready to schedule the first thread through SystemStartupFunc. The implementation of the KernelInit function is under the private directory.


HeapInit initializes the kernel heap.

The implementation of the HeapInit function is under the private directory.


InitMemoryPool initializes the kernel memory pool.

The implementation of the InitMemoryPool function is under the private directory.


ProcInit initializes the Windows Embedded CE kernel process.

The implementation of the ProcInit function is under the private directory.


SchedInit initializes the scheduler and creates the SystemStartupFunc thread.

The implementation of the SchedInit function is under the private directory.


FirstSchedule starts the scheduler.

The implementation of the FirstSchedule function is under the private directory.


SystemStartupFunc runs IOCTL_HAL_POSTINIT. Implementation of this function can be handled by OEM code to complete the kernel initialization process. The implementation of the SystemStartupFunc function is under the private directory.

See Also


Kernel Overview

Other Resources

File System Boot Process
Bringing Up a Hardware Platform
Developing a Device Driver
Kernel Migration