EMB426EMB426

Windows CE Memory Windows CE Memory ArchitectureArchitecture

Steve MailletSteve MailletCEO/Chief Software ArchitectCEO/Chief Software ArchitectEmbeddedFusionEmbeddedFusion

Part IPart IArchitecture and conceptsArchitecture and concepts

Virtual MemoryVirtual Memory

Kernel Mode versus User ModeKernel Mode versus User Mode

Statically mapped memoryStatically mapped memory

Process memoryProcess memory

System API CallsSystem API Calls

Access PermissionsAccess Permissions

Virtual Memory ModelVirtual Memory Model

Single 32-bit (4 Gigabyte) flat virtual Single 32-bit (4 Gigabyte) flat virtual memory address spacememory address space

Permits efficient use of physical Permits efficient use of physical memory with protectionmemory with protection

Virtual addresses translated to Virtual addresses translated to physical addresses by MMUphysical addresses by MMU

A valid virtual address maps to a A valid virtual address maps to a physical addressphysical address

Static or Dynamically mapped virtual Static or Dynamically mapped virtual addressingaddressing

Virtual MemoryVirtual Memory

2 GB2 GB

UserUserSpaceSpace

Slot 97: NK.EXESlot 97: NK.EXE

ReservedReserved

Statically Mapped Statically Mapped Virtual Addresses: Virtual Addresses:

Un-CachedUn-Cached

Statically Mapped Statically Mapped Virtual Addresses: Virtual Addresses:

CachedCached Slot 0 – Current ProcessSlot 0 – Current Process

Slot 1 – XIP DLL codeSlot 1 – XIP DLL code

Slots 2-32 - ProcessesSlots 2-32 - Processes

Slots 33-63Slots 33-63

Object Store and Object Store and Memory-Mapped FilesMemory-Mapped Files

FFFF FFFFFFFF FFFF

E000 0000E000 0000

C400 0000C400 0000

C200 0000C200 0000

C000 0000C000 0000

A000 0000A000 0000

8000 00008000 0000

7FFF FFFF7FFF FFFF

4200 00004200 0000

0400 00000400 0000

0200 00000200 0000

0000 00000000 0000

Total 4 GB Virtual SpaceTotal 4 GB Virtual Space

2 GB2 GB

Kernel Kernel SpaceSpace

Kernel SpaceKernel Space User SpaceUser Space

ReservedReserved

Kernel Addresses: Kernel Addresses: KPAGE, Trap Area, KPAGE, Trap Area,

OthersOthers

Kernel Mode Versus Kernel Mode Versus User ModeUser Mode

ONLY Difference is access to different regionsONLY Difference is access to different regionsKernel mode code has full access to all memoryKernel mode code has full access to all memory

Process protection still applies!Process protection still applies!

User Mode code only has access to User SpaceUser Mode code only has access to User Space

Kernel Space (0x80000000 – 0xFFFFFFFF)Kernel Space (0x80000000 – 0xFFFFFFFF)Used only by Kernel-mode code with privileged access Used only by Kernel-mode code with privileged access (“Kmode”)(“Kmode”)

SetKMode() protected API or ROMFLAGS Setting for ALL threads SetKMode() protected API or ROMFLAGS Setting for ALL threads in the systemin the system

User Space (0x00000000 – 0x7FFFFFFF)User Space (0x00000000 – 0x7FFFFFFF)Organized as 64 slots of 32 MB (225 bytes) eachOrganized as 64 slots of 32 MB (225 bytes) each

Applications, DLLs and Data located hereApplications, DLLs and Data located here

Statically Mapped MemoryStatically Mapped Memory

2 GB

2 GB

UserUser

512 MB

Uncached

512 MB

Cached

32 MB Flash

Physical MemoryPhysical Memory Virtual MemoryVirtual Memory

0400000004000000

8200000082000000

8000 00008000 0000

A000 0000A000 0000

C000 0000C000 0000

0000000000000000

64 MB RAM

0000 00000000 0000

64 MB RAM

32 MB Flash

64 MB RAM

FFFF FFFFFFFF FFFF

AddressTranslation

32 MB Flash

Kernel Kernel SpaceSpace

UserSpace

Statically Mapped MemoryStatically Mapped Memory

x86, ARMx86, ARMOEM provides OEMAddressTable in OAL OEM provides OEMAddressTable in OAL to define initial mappingsto define initial mappings

MIPS, SHxMIPS, SHxMapping is fixed in the MMU architectureMapping is fixed in the MMU architecture

Process MemoryProcess Memory01FF FFFF01FF FFFF

0001 00000001 0000

0000 00000000 0000

32 MB Process Space32 MB Process Space

Free Virtual SpaceFree Virtual Space

Slot 30Slot 30

Slot 31Slot 31

Slot 32Slot 32

. . .. . .

Slot 63Slot 63

. . .. . .

Current ProcessCurrent Process

XIP ROM DLLsXIP ROM DLLs

nk.exenk.exe

filesys.exefilesys.exe

shell.exeshell.exe

device.exedevice.exe

gwes.exegwes.exe

Resource DLLsResource DLLs

Slot 2Slot 2

Slot 3Slot 3

Slot 4Slot 4

Slot 5Slot 5

Slot 1Slot 1

Slot 0Slot 0

. . .. . .

Slot 97Slot 97C400 0000C400 0000

C200 0000C200 0000

0A00 00000A00 0000

3E00 00003E00 0000

3C00 00003C00 0000

4000 00004000 0000

4200 00004200 0000

0000 00000000 0000

0400 00000400 0000

0200 00000200 0000

0600 00000600 0000

0800 00000800 0000

0C00 00000C00 0000

8000 00008000 0000

7E00 00007E00 0000

System API CallsSystem API CallsApplicationApplication

Win32 Win32 API API

ThunksThunks

Local Process ServicesLocal Process Services

PSL Process PSL Process SwitchingSwitching

filesys.exefilesys.exe gwes.exegwes.exe device.exedevice.exeVirtual MemoryVirtual MemoryProcess/ThreadProcess/ThreadException HandlingException HandlingSchedulingSchedulingLoaderLoaderSynchronizationSynchronizationInitializationInitializationProcess SwitchingProcess SwitchingMemory-Mapped FileMemory-Mapped File

Hardware AbstractionHardware Abstraction

Memory MapMemory MapInterruptsInterruptsBus MapBus Map

Function CallFunction Call

TrapsTraps

Process InterfaceProcess Interface

DLL InterfaceDLL Interface

Interrupt Interrupt HandlingHandling

OALOAL

HeapHeap

Coredll.dllCoredll.dll

N.EXEN.EXE

Nk.libNk.lib

services.exeservices.exeshell.exeshell.exe

System API CallsSystem API Calls

Coredll.dllCoredll.dllLocated at the top of every process slotLocated at the top of every process slotFields system API calls from user mode threadsFields system API calls from user mode threadsImplements some system API calls directlyImplements some system API calls directlyCauses an exception (trap) to pass on system Causes an exception (trap) to pass on system API requestAPI request

KernelKernelCatches system API request exception trapsCatches system API request exception trapsDispatches to a system EXE to fulfill requestDispatches to a system EXE to fulfill requestUser mode thread migrated to system EXE User mode thread migrated to system EXE process spaceprocess spaceAccess rights of user mode thread inherits current Access rights of user mode thread inherits current process rightsprocess rights

System API Calling System API Calling MechanismMechanism

User mode User mode threadthread

Win32 API Win32 API ThunksThunks

Function CallFunction Call

Coredll.dllCoredll.dll

App.exeApp.exe

KernelKernelTrapTrap

Win32 API Win32 API DispatchDispatch

Nk.exeNk.exe

JumpJumpFunction Function

CodeCode

system EXEsystem EXE

ReturnReturnCallCall

Access PermissionsAccess Permissions

Process Access PermissionsProcess Access PermissionsAccess permissions set on per-thread Access permissions set on per-thread basisbasis

GetProcPermissions() / SetProcPermissions()GetProcPermissions() / SetProcPermissions()

Threads accessing other process slots Threads accessing other process slots require permissionrequire permission

Violations cause exceptions reported to Violations cause exceptions reported to the Kernelthe Kernel

Structured exception handling allows Structured exception handling allows process to trap its faultsprocess to trap its faults

Access PermissionsAccess Permissions

Resource DLLs and Memory-Mapped Resource DLLs and Memory-Mapped filesfiles

Accessible by threads in all processesAccessible by threads in all processes

Shared HeapsShared HeapsWritable by threads in creating processWritable by threads in creating process

Read Only by threads in other processesRead Only by threads in other processes

Object Store (Optional)Object Store (Optional)Accessible only by kernel file system Accessible only by kernel file system (filesys.exe)(filesys.exe)

Access PermissionsAccess PermissionsSystem call process contextsSystem call process contexts

GetCurrentProcess()GetCurrentProcess()Process context in which the current thread is runningProcess context in which the current thread is running

GetOwnerProcess()GetOwnerProcess()Original process that created the current threadOriginal process that created the current thread

GetCallerProcessGetCallerProcessProcess that thread most recently migrated fromProcess that thread most recently migrated from

MapCallerPtr()MapCallerPtr()Adjusts a pointer to a specific process slot while validating Adjusts a pointer to a specific process slot while validating caller has access to the datacaller has access to the data

Typically maps a Slot 0 relative address to the owing Typically maps a Slot 0 relative address to the owing processes slot so a driver can use itprocesses slot so a driver can use it

Access PermissionsAccess Permissions

App.exe

Owner Process = App.exeCaller Process = noneCurrent Process = App.exe

Device.exe

Owner Process = App.exeCaller Process = FileSys.exeCurrent Process = Device.exe

FileSys Cache

App.exe

Owner Process = App.exeCaller Process = noneCurrent Process = App.exe

FileSys.exe

Owner Process = App.exeCaller Process = App.exeCurrent Process = FileSys.exe

Device.exe

Owner Process = App.exeCaller Process = FileSys.exeCurrent Process = Device.exe

Application Buffer

FileSys Cache

Security Security ViolationViolation

Part IIPart IIBuild ConfigurationBuild Configuration

BIB FilesBIB Files

BIB Memory TypesBIB Memory Types

ROMOFFSETROMOFFSET

Example SystemExample System

BIB FilesBIB Files

MEMORY section MEMORY section Defines the platform memory informationDefines the platform memory information

Partitions the physical memory into Data Partitions the physical memory into Data memory and Program memorymemory and Program memory

;Name Start address Size (bytes) Type;-----------------------------------------------NK 80300000 01E00000 RAMIMAGE ; (30M) "ROM"RAM 82100000 01E00000 RAM ; (30M)

;Name Start address Size (bytes) Type;-----------------------------------------------NK 80300000 01E00000 RAMIMAGE ; (30M) "ROM"RAM 82100000 01E00000 RAM ; (30M)

BIB Memory Section TypesBIB Memory Section Types

TypeType DescriptionDescriptionRAMIMAGERAMIMAGE OS Image (Read + Execute ONLY)OS Image (Read + Execute ONLY)

MUST start on a 64K boundary!MUST start on a 64K boundary!RAMRAM RAM for OS to partitionRAM for OS to partitionRESERVEDRESERVED Reserved region OS won’t useReserved region OS won’t useNANDIMAGENANDIMAGE Used with BINFS to mark memory Used with BINFS to mark memory

region for paging Files From NAND region for paging Files From NAND storage devicesstorage devices

FIXUPVARFIXUPVAR Used to set the value of a variable Used to set the value of a variable during image build timeduring image build time

BIB FilesBIB Files

Indicate the modules and components that Indicate the modules and components that should be included in the imageshould be included in the image

Text files with four types of sectionsText files with four types of sectionsThe FILES section: Memory reservation for static The FILES section: Memory reservation for static data filesdata files

;Name Path Memory Type-------------------------------------------------------Tahoma.ttf $(_FLATRELEASEDIR)\Tahoma.ttf NK SHU

;Name Path Memory Type-------------------------------------------------------Tahoma.ttf $(_FLATRELEASEDIR)\Tahoma.ttf NK SHU

Taskman.exe $(_FLATRELEASEDIR)\Taskman.exe NK Taskman.exe $(_FLATRELEASEDIR)\Taskman.exe NK

The MODULES section: Specifies object module to The MODULES section: Specifies object module to be loaded in memorybe loaded in memory

BIN File FormatBIN File Format

Header BlockHeader BlockB0000FB0000F Start AddressStart Address Image LengthImage Length

StartStart LengthLength ChecksumChecksum Data…Data…

00 Starting IPStarting IP 00

BIN Record(s)BIN Record(s)

Terminating RecordTerminating Record

ROMOFFSETROMOFFSET

ROMOFFSET is used to adjust the ROMOFFSET is used to adjust the address of records in the Microsoft BIN address of records in the Microsoft BIN file formatfile format

Boot loader uses physical memoryBoot loader uses physical memory

Boot loader copies image from flash Boot loader copies image from flash to RAMto RAM

Boot loader copies image from diskBoot loader copies image from disk

ROMOFFSETROMOFFSETROMIMAGE pseudo codeROMIMAGE pseudo code

WriteBinRecord(UINT32 StartAddress, UINT32 RomOffset,

UINT32 Length, UINT8* pData)

{

Write(StartAddress + RomOffset);Write(StartAddress + RomOffset);

Write(Length);

UINT32 ChkSum = WriteBinData(pData, Length);

Write(ChkSum);

}

Example SystemExample System

ARM core CPUARM core CPUOEMAddressTable requiredOEMAddressTable required

32M Ram at physical address 32M Ram at physical address 0x082000000x08200000

32M Flash at physical address 32M Flash at physical address 0x000000000x00000000

1M Block of “On-Chip” devices at 1M Block of “On-Chip” devices at physical address 0x01200000physical address 0x01200000

Static Mapped MemoryStatic Mapped MemoryCachedCached

RAMIMAGE

RAM

...

00x8x8 02000000200000

00x8x8 00000000000000

SDRAMSDRAM

00x9FFFFFFFx9FFFFFFF

00x9FFx9FF0000000000On-Chip Devices

Static Mapped MemoryStatic Mapped MemoryUncachedUncached

RAMIMAGE

RAM

...

00xAxA02000000200000

00xAxA00000000000000

SDRAMSDRAM

00xBFFFFFFFxBFFFFFFF

00xBFFxBFF0000000000

On-Chip Devices

OEMAddressTableOEMAddressTable

Cached Cached AddressAddress

Physical Physical AddressAddress

Size Size (MB)(MB)

DescriptionDescription

0x800000000x80000000 0x082000000x08200000 3232 RAMRAM

0x9CD000000x9CD00000 0x000000000x00000000 3232 FLASHFLASH

0x9FF000000x9FF00000 0x012000000x01200000 11 On Chip On Chip DevicesDevices

00 00 00 NULL NULL TerminatorTerminator

SummarySummary

Virtual memory central to Windows CEVirtual memory central to Windows CE

Configuration controlled by OEMsConfiguration controlled by OEMsCONFIG.BIBCONFIG.BIB

Device developers need to understand Device developers need to understand and keep total system in mind when and keep total system in mind when configuring their device imagesconfiguring their device images

While At MEDC 2005…While At MEDC 2005…Fill outFill out an evaluation for this session an evaluation for this session

Randomly selected instant Randomly selected instant WINWIN prizes! prizes!

Use Use real technology in a labreal technology in a lab Instructor led Instructor led Reef E/FReef E/F & & Breakers LBreakers L

Self-paced Self-paced Reef B/CReef B/C

VisitVisit the Microsoft Product Pavilion the Microsoft Product Pavilion

in the Exhibit Hall in the Exhibit Hall Shorelines BShorelines B

After The Conference…After The Conference…

DevelopDevelop

BuildBuild

InstallInstall

BuildBuild

JoinJoin

InstallInstall

EnterEnter

JoinJoin

Full-featured trial versions of Windows CE Full-featured trial versions of Windows CE and/or Windows XP Embeddedand/or Windows XP Embedded

Cool stuff & tell us about it: Cool stuff & tell us about it: msdn.microsoft.com/embedded/community

Windows Embedded Partner Program:Windows Embedded Partner Program:www.mswep.com

Windows Mobile 5.0 Eval Kit including Windows Mobile 5.0 Eval Kit including Visual Studio 2005 Beta 2Visual Studio 2005 Beta 2

Mobile2Market Contest and win up to $25000: Mobile2Market Contest and win up to $25000: mobile2marketcontest.com

Microsoft Solutions Partner Program:Microsoft Solutions Partner Program:partner.microsoft.com

Tools & ResourcesTools & Resources

msdn.microsoft.com/msdn.microsoft.com/ embeddedembedded

microsoft.public.microsoft.public. windowsxp.embeddedwindowsxp.embedded windowsce.platbuilderwindowsce.platbuilder windowsce.embedded.vcwindowsce.embedded.vc

blogs.msdn.com/blogs.msdn.com/ mikehallmikehall

Windows CE 5.0 Eval KitWindows CE 5.0 Eval KitWindows XP Embedded Eval KitWindows XP Embedded Eval Kit

msdn.microsoft.com/msdn.microsoft.com/ mobilitymobility

microsoft.public.microsoft.public. pocketpc.developer pocketpc.developer smartphone.developer smartphone.developer dotnet.framework.compactframeworkdotnet.framework.compactframework

blogs.msdn.com/blogs.msdn.com/ windowsmobilewindowsmobile vsdteamvsdteam netcfteamnetcfteam

Windows Mobile 5.0 Eval KitWindows Mobile 5.0 Eval Kit

WebsitesWebsites

NewsgroupsNewsgroups

BlogsBlogs

ToolsTools

BuildBuild DevelopDevelop

© 2005 Microsoft Corporation. All rights reserved.This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.