Windows CE 5.0Windows CE 5.0Memory ArchitectureMemory ArchitectureLi-Ming FanEscalation EngineerMicrosoft GCR-GTSC

Part IArchitecture and concepts

• Virtual Memory• Kernel Mode versus User Mode• Statically mapped memory• Process memory• System API Calls• Access Permissions

Virtual Memory Basic• Single Flat 32-bit Virtual Address Space• Virtual Addresses refer to any address

referenced by the CPU while MMU is active.• Physical Addresses are not directly addressable

by the CPU except during initialization before the kernel has enabled the MMU.

• Every valid virtual address must map to some real physical address that can be used to identify a physical resource such as ROM, RAM, Flash, CPU registers, SoC components, bus-mapped components, etc.

32-bit Virtual Address Space• Kernel Space is only

accessible by threads with privileged access, called KMode.

• User Space is accessible by all threads but is limited by process space protection.

User Space

0x0000 0000

0x7FFF FFFF

0x8000 0000

0xFFFF FFFF

Kernel Space

Kernel Address Space• Kernel Address Space

contains:– Statically mapped

virtual addresses– NK.EXE pseudo-slot– Other kernel mappings.

• Up to 512 MB of physical resources can be mapped in the main statically mapped areas.

0x8000 0000

Statically Mapped Virtual Addresses : CACHED

Statically Mapped Virtual Addresses : UNCACHED

Unused

Statically Mapped Virtual Addresses : OEM Additional

Kernel Addresses : KPAGE, Trap Area, others

0xA000 0000

0xC000 0000

0xC200 0000

0xC400 0000

Slot 97 : NK.EXE

0xE000 0000

0xFFFF FFFF

Statically Mapped Memory

2 GB

2 GB

UserUser

512 MB

Uncached512 M

BCached32 MB Flash

Physical MemoryPhysical Memory Virtual MemoryVirtual Memory

0400000004000000

8200000082000000

8000 00008000 0000

A000 0000A000 0000

C000 0000C000 0000

0000000000000000

64 MB RAM

0000 00000000 0000

64 MB RAM

32 MB Flash

64 MB RAM

FFFF FFFFFFFF FFFF

AddressTranslation

32 MB Flash

Kernel Kernel SpaceSpace

UserSpace

Statically Mapped Memory

• x86, ARM– OEM provides OEMAddressTable in OAL to

define initial mappings• MIPS, SHx

– Mapping is fixed in the MMU architecture

User Address Space• Divided into 64 “slots”

with 32 MB each• Slot is the basic unit

for virtual memory maintenance within the Windows CE kernel

0x0000 0000Slot 0

Slot 1

Slot 2

Slot 62

Slot 63

0x01FF FFFF

0x03FF FFFF

0x0200 0000

0x0400 0000

0x05FF FFFF

0x7C00 0000

0x7DFF FFFF

0x7E00 0000

0x7FFF FFFF

Slot Usage Grouping• Slot 0 - An alias to the currently

running process’s slot.• Slot 1 – Used for XIP DLLs• Slot 2 ~ 32 – Used for Process

– A maximum of 32 processes can be running at one time.

– Threads may only access addresses within slots in which they have permissions.

• Slot 33 ~ Slot 62 - Used for object store, memory mapped files and resource mappings.

– Object store is protected from all access outside of the file system manager.

– All memory mapped files are accessible by all threads.

• Slot 63 – Used for resource only DLLs– DLL Resources are accessible by all

threads.

0x0000 0000Slot 0 : Current Process

Slots 2 - 32 :Processes

Slots 33 - 62 :Object Store and Memory

Mapped Files

Slot 63 : Resource Mappings

0x0200 0000

0x4200 0000

0x7E00 0000

Slot 1 : XIP DLLs

Process Slot• 32MB Process slot is

shared by DLL, process, and all of its virtual allocations.

• DLL allocations in a slot start at the high addresses and grow down.

• Process and general allocations start at the low addresses and grow up.

• XIP DLL R/W data 0x0000 0000Guard Section (64k) + UserKInfo

Process Code + Data0x0001 0000

0x01FF FFFF

General Virtual Memory Allocations

DLL Virtual Memory Allocations

Thread Stack

Process Heap

Thread Stack

Process VirtualAlloc() calls

ROM DLLs : R/W Data

RAM DLL + Overflow ROM DLL : Code +Data

Check memory space with Platform Builder

• “MI FULL” command can provide a detailed look at virtual allocations in a process slot.

VirtualAlloc()• All virtual allocations are 64kB-aligned.• Pages may be committed within a virtual

allocation on a page granularity (4kB)• Limitation and Workarounds

Map Physical Memory (Dynamically)

• VirtualCopy()– Specifies the process specific physical to virtual

mapping– Usable by the process that performed the mapping– Extends the OS memory support beyond 512MB– Must first allocate virtual space with VirtualAlloc and

map physical address to the VirtualAlloc’d area– Used for mapping

• Device I/O • Device specific memory

Allocate Physical Contiguous Memory

• AllocPhysMem()– Useful for DMA, sharing to external devices– Guaranteed to be contiguous if successful– Succeeds only if the allocation size exists– No reshuffling of virtual to physical mappings

Access Permissions

• Process Access Permissions– Access permissions set on per-thread basis

• GetProcPermissions() / SetProcPermissions()– Threads accessing other process slots require

permission– Violations cause exceptions reported to the

Kernel– Structured exception handling allows process

to trap its faults

Access Permissions

• Resource DLLs and Memory-Mapped files– Accessible by threads in all processes

• Shared Heaps– Writable by threads in creating process– Read Only by threads in other processes

• Object Store (Optional)– Accessible only by kernel file system

(filesys.exe)

System API Calling Mechanism

User mode User mode threadthread

Win32 API Win32 API ThunksThunks

Function CallFunction Call

Coredll.dllCoredll.dll

App.exeApp.exe

KernelKernelTrapTrap

Win32 API Win32 API DispatchDispatch

Nk.exeNk.exe

JumpJump Function Function CodeCode

system EXEsystem EXE

ReturnReturnCallCall

Access PermissionsSystem call process contexts

• GetCurrentProcess()– Process context in which the current thread is running

• GetOwnerProcess()– Original process that created the current thread

• GetCallerProcess– Process that thread most recently migrated from

• MapCallerPtr()– Adjusts a pointer to a specific process slot while validating caller

has access to the data– Typically maps a Slot 0 relative address to the owing processes slot

so a driver can use it

Part IIBuild Configuration

• BIB Files• BIB Memory Types• ROMOFFSET• Example System

BIB Files• MEMORY section

– Defines the platform memory information– Partitions the physical memory into Data

memory and Program memory

;Name Start address Size (bytes) Type;-----------------------------------------------NK 80300000 01E00000 RAMIMAGE ; (30M) "ROM"RAM 82100000 01E00000 RAM ; (30M)

BIB Memory section typesType DescriptionRAMIMAGE OS Image (Read + Execute ONLY)

MUST start on a 64K boundary!RAM RAM for OS to partitionRESERVED Reserved region OS won’t useNANDIMAGE Used with BINFS to mark memory

region for paging Files From NAND storage devices

FIXUPVAR Used to set the value of a variable during image build time

BIB Files• Indicate the modules and components that should be

included in the image• Text files with four types of sections

– The FILES section: Memory reservation for static data files

;Name Path Memory Type-------------------------------------------------------Tahoma.ttf $(_FLATRELEASEDIR)\Tahoma.ttf NK SHU

Taskman.exe $(_FLATRELEASEDIR)\Taskman.exe NK

–The MODULES section: Specifies object module to be loaded in memory

BIN File Format

• Header Block

B000FF\x0A Start Address Image Length

Start Length Checksum Data…

0 Starting IP 0

• BIN Record(s)

• Terminating Record

ROMOFFSET• ROMOFFSET is used to adjust the address

of records in the Microsoft BIN file format– Boot loader uses physical memory– Boot loader copies image from flash

to RAM

Example System

• ARM core CPU– OEMAddressTable required

• 32M Ram at physical address 0x08200000• 32M Flash at physical address

0x00000000• 1M Block of “On-Chip” devices at physical

address 0x01200000

OEMAddressTableCached Address

Physical Address

Size (MB)

Description

0x80000000 0x08200000 32 RAM

0x9CD00000 0x00000000 32 FLASH

0x9FF00000 0x01200000 1 On Chip Devices

0 0 0 NULL Terminator

Static Mapped MemoryCached

RAMIMAGE

RAM

...

SDRAMSDRAM

0x9FFFFFFF0x9FFFFFFFOn-Chip Devices

...

FLASH

0x9FF000000x9FF00000

0x9ED000000x9ED00000

0x9CD000000x9CD00000

0x820000000x82000000

0x802000000x80200000

0x800000000x80000000

Static Mapped MemoryUncached

RAMIMAGE

RAM

...

SDRAMSDRAM

0xBFFFFFFF0xBFFFFFFFOn-Chip Devices

...

FLASH

0xBFF000000xBFF00000

0xBED000000xBED00000

0xBCD000000xBCD00000

0xA20000000xA2000000

0xA02000000xA0200000

0xA00000000xA0000000

Summary• Virtual memory central to Windows CE• Configuration controlled by OEMs

– CONFIG.BIB• Device developers need to understand and

keep total system in mind when configuring their device images

Tools & Resources

msdn.microsoft.com/msdn.microsoft.com/ embeddedembedded

microsoft.public.microsoft.public. windowsxp.embeddedwindowsxp.embedded windowsce.platbuilderwindowsce.platbuilder windowsce.embedded.vcwindowsce.embedded.vc

blogs.msdn.com/blogs.msdn.com/ mikehallmikehall

Windows CE 5.0 Eval KitWindows CE 5.0 Eval KitWindows XP Embedded Eval KitWindows XP Embedded Eval Kit

msdn.microsoft.com/msdn.microsoft.com/ mobilitymobility

microsoft.public.microsoft.public. pocketpc.developer pocketpc.developer smartphone.developer smartphone.developer dotnet.framework.compactframeworkdotnet.framework.compactframework

blogs.msdn.com/blogs.msdn.com/ windowsmobilewindowsmobile vsdteamvsdteam netcfteamnetcfteam

Windows Mobile 5.0 Eval KitWindows Mobile 5.0 Eval Kit

WebsitesWebsites

NewsgroupsNewsgroups

BlogsBlogs

ToolsTools

BuildBuild DevelopDevelop

请在课程结束后填写课程培训反馈表，参加抽奖。请填写资料袋内的蓝色大会满意度反馈表，到大会接待台领取《 Windows Mobile手机应用开发》工具书。您还可以：参加 Windows Mobile 动手实验室；参观微软及合作伙伴展区；体验基于 Windows Mobile 平台开发的最新硬件产品及解决方案。

大会注意事项