The memory API

The memory API models the memory and I/O buses and controllers of a QEMU machine. It attempts to allow modelling of:

ordinary RAM
memory-mapped I/O (MMIO)
memory controllers that can dynamically reroute physical memory regions to different destinations

The memory model provides support for

tracking RAM changes by the guest
setting up coalesced memory for kvm
setting up ioeventfd regions for kvm

Memory is modelled as an acyclic graph of MemoryRegion objects. Sinks (leaves) are RAM and MMIO regions, while other nodes represent buses, memory controllers, and memory regions that have been rerouted.

In addition to MemoryRegion objects, the memory API provides AddressSpace objects for every root and possibly for intermediate MemoryRegions too. These represent memory as seen from the CPU or a device’s viewpoint.

Types of regions

There are multiple types of memory regions (all represented by a single C type MemoryRegion):

RAM: a RAM region is simply a range of host memory that can be made available to the guest. You typically initialize these with memory_region_init_ram(). Some special purposes require the variants memory_region_init_resizeable_ram(), memory_region_init_ram_from_file(), or memory_region_init_ram_ptr().
MMIO: a range of guest memory that is implemented by host callbacks; each read or write causes a callback to be called on the host. You initialize these with memory_region_init_io(), passing it a MemoryRegionOps structure describing the callbacks.
ROM: a ROM memory region works like RAM for reads (directly accessing a region of host memory), and forbids writes. You initialize these with memory_region_init_rom().
ROM device: a ROM device memory region works like RAM for reads (directly accessing a region of host memory), but like MMIO for writes (invoking a callback). You initialize these with memory_region_init_rom_device().
IOMMU region: an IOMMU region translates addresses of accesses made to it and forwards them to some other target memory region. As the name suggests, these are only needed for modelling an IOMMU, not for simple devices. You initialize these with memory_region_init_iommu().
container: a container simply includes other memory regions, each at a different offset. Containers are useful for grouping several regions into one unit. For example, a PCI BAR may be composed of a RAM region and an MMIO region.

A container’s subregions are usually non-overlapping. In some cases it is useful to have overlapping regions; for example a memory controller that can overlay a subregion of RAM with MMIO or ROM, or a PCI controller that does not prevent card from claiming overlapping BARs.

You initialize a pure container with memory_region_init().
alias: a subsection of another region. Aliases allow a region to be split apart into discontiguous regions. Examples of uses are memory banks used when the guest address space is smaller than the amount of RAM addressed, or a memory controller that splits main memory to expose a “PCI hole”. You can also create aliases to avoid trying to add the original region to multiple parents via memory_region_add_subregion.

Aliases may point to any type of region, including other aliases, but an alias may not point back to itself, directly or indirectly. You initialize these with memory_region_init_alias().
reservation region: a reservation region is primarily for debugging. It claims I/O space that is not supposed to be handled by QEMU itself. The typical use is to track parts of the address space which will be handled by the host kernel when KVM is enabled. You initialize these by passing a NULL callback parameter to memory_region_init_io().

It is valid to add subregions to a region which is not a pure container (that is, to an MMIO, RAM or ROM region). This means that the region will act like a container, except that any addresses within the container’s region which are not claimed by any subregion are handled by the container itself (ie by its MMIO callbacks or RAM backing). However it is generally possible to achieve the same effect with a pure container one of whose subregions is a low priority “background” region covering the whole address range; this is often clearer and is preferred. Subregions cannot be added to an alias region.

Migration

Where the memory region is backed by host memory (RAM, ROM and ROM device memory region types), this host memory needs to be copied to the destination on migration. These APIs which allocate the host memory for you will also register the memory so it is migrated:

memory_region_init_ram()
memory_region_init_rom()
memory_region_init_rom_device()

For most devices and boards this is the correct thing. If you have a special case where you need to manage the migration of the backing memory yourself, you can call the functions:

memory_region_init_ram_nomigrate()
memory_region_init_rom_nomigrate()
memory_region_init_rom_device_nomigrate()

which only initialize the MemoryRegion and leave handling migration to the caller.

The functions:

memory_region_init_resizeable_ram()
memory_region_init_ram_from_file()
memory_region_init_ram_from_fd()
memory_region_init_ram_ptr()
memory_region_init_ram_device_ptr()

are for special cases only, and so they do not automatically register the backing memory for migration; the caller must manage migration if necessary.

Region names

Regions are assigned names by the constructor. For most regions these are only used for debugging purposes, but RAM regions also use the name to identify live migration sections. This means that RAM region names need to have ABI stability.

Region lifecycle

A region is created by one of the memory_region_init*() functions and attached to an object, which acts as its owner or parent. QEMU ensures that the owner object remains alive as long as the region is visible to the guest, or as long as the region is in use by a virtual CPU or another device. For example, the owner object will not die between an address_space_map operation and the corresponding address_space_unmap.

After creation, a region can be added to an address space or a container with memory_region_add_subregion(), and removed using memory_region_del_subregion().

Various region attributes (read-only, dirty logging, coalesced mmio, ioeventfd) can be changed during the region lifecycle. They take effect as soon as the region is made visible. This can be immediately, later, or never.

Destruction of a memory region happens automatically when the owner object dies.

If however the memory region is part of a dynamically allocated data structure, you should call object_unparent() to destroy the memory region before the data structure is freed. For an example see VFIOMSIXInfo and VFIOQuirk in hw/vfio/pci.c.

You must not destroy a memory region as long as it may be in use by a device or CPU. In order to do this, as a general rule do not create or destroy memory regions dynamically during a device’s lifetime, and only call object_unparent() in the memory region owner’s instance_finalize callback. The dynamically allocated data structure that contains the memory region then should obviously be freed in the instance_finalize callback as well.

If you break this rule, the following situation can happen:

the memory region’s owner had a reference taken via memory_region_ref (for example by address_space_map)
the region is unparented, and has no owner anymore
when address_space_unmap is called, the reference to the memory region’s owner is leaked.

There is an exception to the above rule: it is okay to call object_unparent at any time for an alias or a container region. It is therefore also okay to create or destroy alias and container regions dynamically during a device’s lifetime.

This exceptional usage is valid because aliases and containers only help QEMU building the guest’s memory map; they are never accessed directly. memory_region_ref and memory_region_unref are never called on aliases or containers, and the above situation then cannot happen. Exploiting this exception is rarely necessary, and therefore it is discouraged, but nevertheless it is used in a few places.

For regions that “have no owner” (NULL is passed at creation time), the machine object is actually used as the owner. Since instance_finalize is never called for the machine object, you must never call object_unparent on regions that have no owner, unless they are aliases or containers.

Overlapping regions and priority

Usually, regions may not overlap each other; a memory address decodes into exactly one target. In some cases it is useful to allow regions to overlap, and sometimes to control which of an overlapping regions is visible to the guest. This is done with memory_region_add_subregion_overlap(), which allows the region to overlap any other region in the same container, and specifies a priority that allows the core to decide which of two regions at the same address are visible (highest wins). Priority values are signed, and the default value is zero. This means that you can use memory_region_add_subregion_overlap() both to specify a region that must sit ‘above’ any others (with a positive priority) and also a background region that sits ‘below’ others (with a negative priority).

If the higher priority region in an overlap is a container or alias, then the lower priority region will appear in any “holes” that the higher priority region has left by not mapping subregions to that area of its address range. (This applies recursively – if the subregions are themselves containers or aliases that leave holes then the lower priority region will appear in these holes too.)

For example, suppose we have a container A of size 0x8000 with two subregions B and C. B is a container mapped at 0x2000, size 0x4000, priority 2; C is an MMIO region mapped at 0x0, size 0x6000, priority 1. B currently has two of its own subregions: D of size 0x1000 at offset 0 and E of size 0x1000 at offset 0x2000. As a diagram:

      0      1000   2000   3000   4000   5000   6000   7000   8000
      |------|------|------|------|------|------|------|------|
A:    [                                                      ]
C:    [CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC]
B:                  [                          ]
D:                  [DDDDD]
E:                                [EEEEE]

The regions that will be seen within this address range then are:

[CCCCCCCCCCCC][DDDDD][CCCCC][EEEEE][CCCCC]

Since B has higher priority than C, its subregions appear in the flat map even where they overlap with C. In ranges where B has not mapped anything C’s region appears.

If B had provided its own MMIO operations (ie it was not a pure container) then these would be used for any addresses in its range not handled by D or E, and the result would be:

[CCCCCCCCCCCC][DDDDD][BBBBB][EEEEE][BBBBB]

Priority values are local to a container, because the priorities of two regions are only compared when they are both children of the same container. This means that the device in charge of the container (typically modelling a bus or a memory controller) can use them to manage the interaction of its child regions without any side effects on other parts of the system. In the example above, the priorities of D and E are unimportant because they do not overlap each other. It is the relative priority of B and C that causes D and E to appear on top of C: D and E’s priorities are never compared against the priority of C.

Visibility

The memory core uses the following rules to select a memory region when the guest accesses an address:

all direct subregions of the root region are matched against the address, in descending priority order
- if the address lies outside the region offset/size, the subregion is discarded
- if the subregion is a leaf (RAM or MMIO), the search terminates, returning this leaf region
- if the subregion is a container, the same algorithm is used within the subregion (after the address is adjusted by the subregion offset)
- if the subregion is an alias, the search is continued at the alias target (after the address is adjusted by the subregion offset and alias offset)
- if a recursive search within a container or alias subregion does not find a match (because of a “hole” in the container’s coverage of its address range), then if this is a container with its own MMIO or RAM backing the search terminates, returning the container itself. Otherwise we continue with the next subregion in priority order
if none of the subregions match the address then the search terminates with no match found

Example memory map

system_memory: container@0-2^48-1
 |
 +---- lomem: alias@0-0xdfffffff ---> #ram (0-0xdfffffff)
 |
 +---- himem: alias@0x100000000-0x11fffffff ---> #ram (0xe0000000-0xffffffff)
 |
 +---- vga-window: alias@0xa0000-0xbffff ---> #pci (0xa0000-0xbffff)
 |      (prio 1)
 |
 +---- pci-hole: alias@0xe0000000-0xffffffff ---> #pci (0xe0000000-0xffffffff)

pci (0-2^32-1)
 |
 +--- vga-area: container@0xa0000-0xbffff
 |      |
 |      +--- alias@0x00000-0x7fff  ---> #vram (0x010000-0x017fff)
 |      |
 |      +--- alias@0x08000-0xffff  ---> #vram (0x020000-0x027fff)
 |
 +---- vram: ram@0xe1000000-0xe1ffffff
 |
 +---- vga-mmio: mmio@0xe2000000-0xe200ffff

ram: ram@0x00000000-0xffffffff

This is a (simplified) PC memory map. The 4GB RAM block is mapped into the system address space via two aliases: “lomem” is a 1:1 mapping of the first 3.5GB; “himem” maps the last 0.5GB at address 4GB. This leaves 0.5GB for the so-called PCI hole, that allows a 32-bit PCI bus to exist in a system with 4GB of memory.

The memory controller diverts addresses in the range 640K-768K to the PCI address space. This is modelled using the “vga-window” alias, mapped at a higher priority so it obscures the RAM at the same addresses. The vga window can be removed by programming the memory controller; this is modelled by removing the alias and exposing the RAM underneath.

The pci address space is not a direct child of the system address space, since we only want parts of it to be visible (we accomplish this using aliases). It has two subregions: vga-area models the legacy vga window and is occupied by two 32K memory banks pointing at two sections of the framebuffer. In addition the vram is mapped as a BAR at address e1000000, and an additional BAR containing MMIO registers is mapped after it.

Note that if the guest maps a BAR outside the PCI hole, it would not be visible as the pci-hole alias clips it to a 0.5GB range.

MMIO Operations

MMIO regions are provided with ->read() and ->write() callbacks, which are sufficient for most devices. Some devices change behaviour based on the attributes used for the memory transaction, or need to be able to respond that the access should provoke a bus error rather than completing successfully; those devices can use the ->read_with_attrs() and ->write_with_attrs() callbacks instead.

In addition various constraints can be supplied to control how these callbacks are called:

.valid.min_access_size, .valid.max_access_size define the access sizes (in bytes) which the device accepts; accesses outside this range will have device and bus specific behaviour (ignored, or machine check)
.valid.unaligned specifies that the device being modelled supports unaligned accesses; if false, unaligned accesses will invoke the appropriate bus or CPU specific behaviour.
.impl.min_access_size, .impl.max_access_size define the access sizes (in bytes) supported by the implementation; other access sizes will be emulated using the ones available. For example a 4-byte write will be emulated using four 1-byte writes, if .impl.max_access_size = 1.
.impl.unaligned specifies that the implementation supports unaligned accesses; if false, unaligned accesses will be emulated by two aligned accesses.

API Reference

struct MemoryRegionSection: describes a fragment of a MemoryRegion

Definition

struct MemoryRegionSection {
  Int128 size;
  MemoryRegion *mr;
  FlatView *fv;
  hwaddr offset_within_region;
  hwaddr offset_within_address_space;
  bool readonly;
  bool nonvolatile;
};

Members

size: the size of the section; will not exceed mr’s boundaries
mr: the region, or NULL if empty
fv: the flat view of the address space the region is mapped in
offset_within_region: the beginning of the section, relative to mr’s start
offset_within_address_space: the address of the first byte of the section relative to the region’s address space
readonly: writes to this section are ignored
nonvolatile: this section is non-volatile

struct MemoryListener: callbacks structure for updates to the physical memory map

Definition

struct MemoryListener {
  void (*begin)(MemoryListener *listener);
  void (*commit)(MemoryListener *listener);
  void (*region_add)(MemoryListener *listener, MemoryRegionSection *section);
  void (*region_del)(MemoryListener *listener, MemoryRegionSection *section);
  void (*region_nop)(MemoryListener *listener, MemoryRegionSection *section);
  void (*log_start)(MemoryListener *listener, MemoryRegionSection *section, int old, int new);
  void (*log_stop)(MemoryListener *listener, MemoryRegionSection *section, int old, int new);
  void (*log_sync)(MemoryListener *listener, MemoryRegionSection *section);
  void (*log_sync_global)(MemoryListener *listener, bool last_stage);
  void (*log_clear)(MemoryListener *listener, MemoryRegionSection *section);
  void (*log_global_start)(MemoryListener *listener);
  void (*log_global_stop)(MemoryListener *listener);
  void (*log_global_after_sync)(MemoryListener *listener);
  void (*eventfd_add)(MemoryListener *listener, MemoryRegionSection *section, bool match_data, uint64_t data, EventNotifier *e);
  void (*eventfd_del)(MemoryListener *listener, MemoryRegionSection *section, bool match_data, uint64_t data, EventNotifier *e);
  void (*coalesced_io_add)(MemoryListener *listener, MemoryRegionSection *section, hwaddr addr, hwaddr len);
  void (*coalesced_io_del)(MemoryListener *listener, MemoryRegionSection *section, hwaddr addr, hwaddr len);
  unsigned priority;
  const char *name;
};

Members

begin

Called at the beginning of an address space update transaction. Followed by calls to MemoryListener.region_add(), MemoryListener.region_del(), MemoryListener.region_nop(), MemoryListener.log_start() and MemoryListener.log_stop() in increasing address order.

listener: The MemoryListener.

commit

Called at the end of an address space update transaction, after the last call to MemoryListener.region_add(), MemoryListener.region_del() or MemoryListener.region_nop(), MemoryListener.log_start() and MemoryListener.log_stop().

listener: The MemoryListener.

region_add

Called during an address space update transaction, for a section of the address space that is new in this address space space since the last transaction.

listener: The MemoryListener. section: The new MemoryRegionSection.

region_del

Called during an address space update transaction, for a section of the address space that has disappeared in the address space since the last transaction.

listener: The MemoryListener. section: The old MemoryRegionSection.

region_nop

Called during an address space update transaction, for a section of the address space that is in the same place in the address space as in the last transaction.

listener: The MemoryListener. section: The MemoryRegionSection.

log_start

Called during an address space update transaction, after one of MemoryListener.region_add(), MemoryListener.region_del() or MemoryListener.region_nop(), if dirty memory logging clients have become active since the last transaction.

listener: The MemoryListener. section: The MemoryRegionSection. old: A bitmap of dirty memory logging clients that were active in the previous transaction. new: A bitmap of dirty memory logging clients that are active in the current transaction.

log_stop

Called during an address space update transaction, after one of MemoryListener.region_add(), MemoryListener.region_del() or MemoryListener.region_nop() and possibly after MemoryListener.log_start(), if dirty memory logging clients have become inactive since the last transaction.

listener: The MemoryListener. section: The MemoryRegionSection. old: A bitmap of dirty memory logging clients that were active in the previous transaction. new: A bitmap of dirty memory logging clients that are active in the current transaction.

log_sync

Called by memory_region_snapshot_and_clear_dirty() and memory_global_dirty_log_sync(), before accessing QEMU’s “official” copy of the dirty memory bitmap for a MemoryRegionSection.

listener: The MemoryListener. section: The MemoryRegionSection.

log_sync_global

This is the global version of log_sync when the listener does not have a way to synchronize the log with finer granularity. When the listener registers with log_sync_global defined, then its log_sync must be NULL. Vice versa.

listener: The MemoryListener. last_stage: The last stage to synchronize the log during migration. The caller should guarantee that the synchronization with true for last_stage is triggered for once after all VCPUs have been stopped.

log_clear

Called before reading the dirty memory bitmap for a MemoryRegionSection.

listener: The MemoryListener. section: The MemoryRegionSection.

log_global_start

Called by memory_global_dirty_log_start(), which enables the DIRTY_LOG_MIGRATION client on all memory regions in the address space. MemoryListener.log_global_start() is also called when a MemoryListener is added, if global dirty logging is active at that time.

listener: The MemoryListener.

log_global_stop

Called by memory_global_dirty_log_stop(), which disables the DIRTY_LOG_MIGRATION client on all memory regions in the address space.

listener: The MemoryListener.

log_global_after_sync

Called after reading the dirty memory bitmap for any MemoryRegionSection.

listener: The MemoryListener.

eventfd_add

Called during an address space update transaction, for a section of the address space that has had a new ioeventfd registration since the last transaction.

listener: The MemoryListener. section: The new MemoryRegionSection. match_data: The match_data parameter for the new ioeventfd. data: The data parameter for the new ioeventfd. e: The EventNotifier parameter for the new ioeventfd.

eventfd_del

Called during an address space update transaction, for a section of the address space that has dropped an ioeventfd registration since the last transaction.

listener: The MemoryListener. section: The new MemoryRegionSection. match_data: The match_data parameter for the dropped ioeventfd. data: The data parameter for the dropped ioeventfd. e: The EventNotifier parameter for the dropped ioeventfd.

coalesced_io_add

Called during an address space update transaction, for a section of the address space that has had a new coalesced MMIO range registration since the last transaction.

listener: The MemoryListener. section: The new MemoryRegionSection. addr: The starting address for the coalesced MMIO range. len: The length of the coalesced MMIO range.

coalesced_io_del

Called during an address space update transaction, for a section of the address space that has dropped a coalesced MMIO range since the last transaction.

listener: The MemoryListener. section: The new MemoryRegionSection. addr: The starting address for the coalesced MMIO range. len: The length of the coalesced MMIO range.

priority

Govern the order in which memory listeners are invoked. Lower priorities are invoked earlier for “add” or “start” callbacks, and later for “delete” or “stop” callbacks.

name

Name of the listener. It can be used in contexts where we’d like to identify one memory listener with the rest.

Description

Allows a component to adjust to changes in the guest-visible memory map. Use with memory_listener_register() and memory_listener_unregister().

struct AddressSpace: describes a mapping of addresses to MemoryRegion objects

Definition

struct AddressSpace {
};

Members

flatview_cb: Typedef: callback for flatview_for_each_range()

Syntax

bool flatview_cb (Int128 start, Int128 len, const MemoryRegion *mr, hwaddr offset_in_region, void *opaque)

Parameters

Int128 start: start address of the range within the FlatView
Int128 len: length of the range in bytes
const MemoryRegion *mr: MemoryRegion covering this range
hwaddr offset_in_region: offset of the first byte of the range within mr
void *opaque: data pointer passed to flatview_for_each_range()

Return

true to stop the iteration, false to keep going.

void flatview_for_each_range(FlatView *fv, flatview_cb cb, void *opaque): Iterate through a FlatView

Parameters

FlatView *fv: the FlatView to iterate through
flatview_cb cb: function to call for each range
void *opaque: opaque data pointer to pass to cb

Description

A FlatView is made up of a list of non-overlapping ranges, each of which is a slice of a MemoryRegion. This function iterates through each range in fv, calling cb. The callback function can terminate iteration early by returning ‘true’.

MemoryRegionSection *memory_region_section_new_copy(MemoryRegionSection *s): Copy a memory region section

Parameters

MemoryRegionSection *s: the MemoryRegionSection to copy

Description

Allocate memory for a new copy, copy the memory region section, and properly take a reference on all relevant members.

void memory_region_section_free_copy(MemoryRegionSection *s): Free a copied memory region section

Parameters

MemoryRegionSection *s: the MemoryRegionSection to copy

Description

Free a copy of a memory section created via memory_region_section_new_copy(). properly dropping references on all relevant members.

void memory_region_init(MemoryRegion *mr, Object *owner, const char *name, uint64_t size): Initialize a memory region

Parameters

MemoryRegion *mr: the MemoryRegion to be initialized
Object *owner: the object that tracks the region’s reference count
const char *name: used for debugging; not visible to the user or ABI
uint64_t size: size of the region; any subregions beyond this size will be clipped

Description

The region typically acts as a container for other memory regions. Use memory_region_add_subregion() to add subregions.

void memory_region_ref(MemoryRegion *mr): Add 1 to a memory region’s reference count

Parameters

MemoryRegion *mr: the MemoryRegion

Description

Whenever memory regions are accessed outside the BQL, they need to be preserved against hot-unplug. MemoryRegions actually do not have their own reference count; they piggyback on a QOM object, their “owner”. This function adds a reference to the owner.

All MemoryRegions must have an owner if they can disappear, even if the device they belong to operates exclusively under the BQL. This is because the region could be returned at any time by memory_region_find, and this is usually under guest control.

void memory_region_unref(MemoryRegion *mr): Remove 1 to a memory region’s reference count

Parameters

MemoryRegion *mr: the MemoryRegion

Description

Whenever memory regions are accessed outside the BQL, they need to be preserved against hot-unplug. MemoryRegions actually do not have their own reference count; they piggyback on a QOM object, their “owner”. This function removes a reference to the owner and possibly destroys it.

void memory_region_init_io(MemoryRegion *mr, Object *owner, const MemoryRegionOps *ops, void *opaque, const char *name, uint64_t size): Initialize an I/O memory region.

Parameters

MemoryRegion *mr: the MemoryRegion to be initialized.
Object *owner: the object that tracks the region’s reference count
const MemoryRegionOps *ops: a structure containing read and write callbacks to be used when I/O is performed on the region.
void *opaque: passed to the read and write callbacks of the ops structure.
const char *name: used for debugging; not visible to the user or ABI
uint64_t size: size of the region.

Description

Accesses into the region will cause the callbacks in ops to be called. if size is nonzero, subregions will be clipped to size.

void memory_region_init_ram_nomigrate(MemoryRegion *mr, Object *owner, const char *name, uint64_t size, Error **errp): Initialize RAM memory region. Accesses into the region will modify memory directly.

Parameters

MemoryRegion *mr: the MemoryRegion to be initialized.
Object *owner: the object that tracks the region’s reference count
const char *name: Region name, becomes part of RAMBlock name used in migration stream must be unique within any device
uint64_t size: size of the region.
Error **errp: pointer to Error*, to store an error if it happens.

Description