docs/devel/memory.rst

2 The memory API
5 The memory API models the memory and I/O buses and controllers of a QEMU
8 - ordinary RAM
9 - memory-mapped I/O (MMIO)
10 - memory controllers that can dynamically reroute physical memory regions
13 The memory model provides support for
15 - tracking RAM changes by the guest
16 - setting up coalesced memory for kvm
17 - setting up ioeventfd regions for kvm
19 Memory is modelled as an acyclic graph of MemoryRegion objects.  Sinks
21 buses, memory controllers, and memory regions that have been rerouted.
23 In addition to MemoryRegion objects, the memory API provides AddressSpace
25 These represent memory as seen from the CPU or a device's viewpoint.
28 ----------------
30 There are multiple types of memory regions (all represented by a single C type
33 - RAM: a RAM region is simply a range of host memory that can be made available
39 - MMIO: a range of guest memory that is implemented by host callbacks;
44 - ROM: a ROM memory region works like RAM for reads (directly accessing
45   a region of host memory), and forbids writes. You initialize these with
48 - ROM device: a ROM device memory region works like RAM for reads
49   (directly accessing a region of host memory), but like MMIO for
53 - IOMMU region: an IOMMU region translates addresses of accesses made to it
54   and forwards them to some other target memory region.  As the name suggests,
58 - container: a container simply includes other memory regions, each at
60   into one unit.  For example, a PCI BAR may be composed of a RAM region
61   and an MMIO region.
63   A container's subregions are usually non-overlapping.  In some cases it is
64   useful to have overlapping regions; for example a memory controller that
70 - alias: a subsection of another region. Aliases allow a region to be
71   split apart into discontiguous regions. Examples of uses are memory
73   of RAM addressed, or a memory controller that splits main memory to
75   add the original region to multiple parents via
78   Aliases may point to any type of region, including other aliases,
82 - reservation region: a reservation region is primarily for debugging.
88 It is valid to add subregions to a region which is not a pure container
89 (that is, to an MMIO, RAM or ROM region). This means that the region
91 region which are not claimed by any subregion are handled by the
94 one of whose subregions is a low priority "background" region covering
96 Subregions cannot be added to an alias region.
99 ---------
101 Where the memory region is backed by host memory (RAM, ROM and
102 ROM device memory region types), this host memory needs to be
104 the host memory for you will also register the memory so it is
107 - memory_region_init_ram()
108 - memory_region_init_rom()
109 - memory_region_init_rom_device()
113 the backing memory yourself, you can call the functions:
115 - memory_region_init_ram_nomigrate()
116 - memory_region_init_rom_nomigrate()
117 - memory_region_init_rom_device_nomigrate()
124 - memory_region_init_resizeable_ram()
125 - memory_region_init_ram_from_file()
126 - memory_region_init_ram_from_fd()
127 - memory_region_init_ram_ptr()
128 - memory_region_init_ram_device_ptr()
131 register the backing memory for migration; the caller must
134 Region names
135 ------------
139 live migration sections.  This means that RAM region names need to have ABI
142 Region lifecycle
143 ----------------
145 A region is created by one of the memory_region_init*() functions and
147 that the owner object remains alive as long as the region is visible to
148 the guest, or as long as the region is in use by a virtual CPU or another
152 After creation, a region can be added to an address space or a
156 Various region attributes (read-only, dirty logging, coalesced mmio,
157 ioeventfd) can be changed during the region lifecycle.  They take effect
158 as soon as the region is made visible.  This can be immediately, later,
161 Destruction of a memory region happens automatically when the owner
164 If however the memory region is part of a dynamically allocated data
165 structure, you should call object_unparent() to destroy the memory region
169 You must not destroy a memory region as long as it may be in use by a
171 destroy memory regions dynamically during a device's lifetime, and only
172 call object_unparent() in the memory region owner's instance_finalize
174 memory region then should obviously be freed in the instance_finalize
179 - the memory region's owner had a reference taken via memory_region_ref
182 - the region is unparented, and has no owner anymore
184 - when address_space_unmap is called, the reference to the memory region's
189 object_unparent at any time for an alias or a container region.  It is
194 QEMU building the guest's memory map; they are never accessed directly.
207 --------------------------------
208 Usually, regions may not overlap each other; a memory address decodes into
212 allows the region to overlap any other region in the same container, and
216 you can use memory_region_add_subregion_overlap() both to specify a region
218 background region that sits 'below' others (with a negative priority).
220 If the higher priority region in an overlap is a container or alias, then
221 the lower priority region will appear in any "holes" that the higher priority
222 region has left by not mapping subregions to that area of its address range.
223 (This applies recursively -- if the subregions are themselves containers or
224 aliases that leave holes then the lower priority region will appear in these
229 an MMIO region mapped at 0x0, size 0x6000, priority 1. B currently has two
234         |------|------|------|------|------|------|------|------|
247 C's region appears.
258 a bus or a memory controller) can use them to manage the interaction of
266 ----------
267 The memory core uses the following rules to select a memory region when the
270 - all direct subregions of the root region are matched against the address, in
273   - if the address lies outside the region offset/size, the subregion is
275   - if the subregion is a leaf (RAM or MMIO), the search terminates, returning
276     this leaf region
277   - if the subregion is a container, the same algorithm is used within the
279   - if the subregion is an alias, the search is continued at the alias target
281   - if a recursive search within a container or alias subregion does not
287 - if none of the subregions match the address then the search terminates
290 Example memory map
291 ------------------
295   system_memory: container@0-2^48-1
297    +---- lomem: alias@0-0xdfffffff ---> #ram (0-0xdfffffff)
299    +---- himem: alias@0x100000000-0x11fffffff ---> #ram (0xe0000000-0xffffffff)
301    +---- vga-window: alias@0xa0000-0xbffff ---> #pci (0xa0000-0xbffff)
304    +---- pci-hole: alias@0xe0000000-0xffffffff ---> #pci (0xe0000000-0xffffffff)
306   pci (0-2^32-1)
308    +--- vga-area: container@0xa0000-0xbffff
310    |      +--- alias@0x00000-0x7fff  ---> #vram (0x010000-0x017fff)
312    |      +--- alias@0x08000-0xffff  ---> #vram (0x020000-0x027fff)
314    +---- vram: ram@0xe1000000-0xe1ffffff
316    +---- vga-mmio: mmio@0xe2000000-0xe200ffff
318   ram: ram@0x00000000-0xffffffff
320 This is a (simplified) PC memory map. The 4GB RAM block is mapped into the
323 so-called PCI hole, that allows a 32-bit PCI bus to exist in a system with
324 4GB of memory.
326 The memory controller diverts addresses in the range 640K-768K to the PCI
327 address space.  This is modelled using the "vga-window" alias, mapped at a
329 can be removed by programming the memory controller; this is modelled by
334 It has two subregions: vga-area models the legacy vga window and is occupied
335 by two 32K memory banks pointing at two sections of the framebuffer.
340 visible as the pci-hole alias clips it to a 0.5GB range.
343 ---------------
345 MMIO regions are provided with ->read() and ->write() callbacks,
347 based on the attributes used for the memory transaction, or need
350 ->read_with_attrs() and ->write_with_attrs() callbacks instead.
355 - .valid.min_access_size, .valid.max_access_size define the access sizes
358 - .valid.unaligned specifies that the *device being modelled* supports
361 - .impl.min_access_size, .impl.max_access_size define the access sizes
363   emulated using the ones available.  For example a 4-byte write will be
364   emulated using four 1-byte writes, if .impl.max_access_size = 1.
365 - .impl.unaligned specifies that the *implementation* supports unaligned
370 -------------
372 .. kernel-doc:: include/system/memory.h