内存 API

内存 API 建模 QEMU 机器的内存、I/O 总线和控制器，支持描述：

普通 RAM；
内存映射 I/O（MMIO）；
可动态将物理内存区域路由到不同目标的内存控制器。

内存模型支持：

跟踪客户机对 RAM 的修改；
为 KVM 设置合并访问内存；
为 KVM 设置 ioeventfd 区域。

内存表示为 MemoryRegion 对象组成的无环图。叶节点是 RAM 和 MMIO，其他节点表示总线、内存控制器和重新路由的内存区域。

API 还为每个根节点，以及可能的中间 MemoryRegion 提供 AddressSpace，表示从 CPU 或设备视角看到的内存。

区域类型

区域均以同一个 C 类型 MemoryRegion 表示，分为多种类型：

RAM：可暴露给客户机的一段主机内存。通常用 memory_region_init_ram() 初始化；特殊需求可使用 memory_region_init_resizeable_ram()、 memory_region_init_ram_from_file() 或 memory_region_init_ram_ptr()。
MMIO：由主机回调实现的客户机地址范围，每次读写都会调用回调。使用 memory_region_init_io()，传入描述回调的 MemoryRegionOps。
ROM：读取类似 RAM，直接访问主机内存，但禁止写入。使用 memory_region_init_rom()。
ROM 设备：读取类似 RAM，写入类似 MMIO，通过回调处理。使用 memory_region_init_rom_device()。
IOMMU 区域：转换访问地址，并转发到其他目标区域。仅用于建模 IOMMU，普通设备不需要。使用 memory_region_init_iommu()。
容器：包含位于不同偏移的其他区域，便于将多个区域组合为一个单元。例如 PCI BAR 可同时包含 RAM 和 MMIO。

子区域通常不重叠，但有时重叠很有用，例如用 MMIO 或 ROM 覆盖部分 RAM 的内存控制器，或不禁止设备声明重叠 BAR 的 PCI 控制器。

纯容器使用 memory_region_init() 初始化。
别名：另一区域的子范围，可将同一区域拆分为不连续地址段。例如客户机地址空间小于 RAM 容量时的内存分组，或形成 PCI 空洞的内存控制器。也可通过别名避免用 memory_region_add_subregion 将原区域添加到多个父节点。

别名可指向任何区域，包括其他别名，但不得直接或间接指向自身。使用 memory_region_init_alias() 初始化。
保留区域：主要用于调试，声明不应由 QEMU 自身处理的 I/O 空间。典型用途是跟踪启用 KVM 时由主机内核处理的地址段。初始化时向 memory_region_init_io() 传入 NULL 回调。

非纯容器的 MMIO、RAM 或 ROM 也可添加子区域。此时它类似容器，但未被子区域覆盖的地址由自身 MMIO 回调或 RAM 存储处理。通常可以用纯容器加覆盖全部范围的低优先级背景子区域实现相同效果，这种方式更清楚，应优先采用。别名区域不能添加子区域。

迁移

RAM、ROM 和 ROM 设备由主机内存支持，迁移时必须复制到目标。以下 API 分配主机内存时，也会自动注册迁移：

memory_region_init_ram()
memory_region_init_rom()
memory_region_init_rom_device()

对多数设备和开发板，这正是所需行为。需要自行管理后备内存迁移的特殊情况，可调用 memory_region_init_ram_flags_nomigrate()，它只初始化区域，迁移由调用者处理。

以下函数仅用于特殊场景：

memory_region_init_resizeable_ram()
memory_region_init_ram_from_file()
memory_region_init_ram_from_fd()
memory_region_init_ram_ptr()
memory_region_init_ram_device_ptr()

它们不自动注册后备内存迁移，必要时调用者必须自行管理。

区域名称

构造函数为区域命名。多数名称仅用于调试，但 RAM 区域名称还标识热迁移段，因此必须保持 ABI 稳定。

区域生命周期

区域通过 memory_region_init*() 创建，并关联一个作为所有者或父节点的对象。只要区域对客户机可见，或仍被 vCPU、其他设备使用，QEMU 就保证所有者存活。例如 address_space_map 与对应 address_space_unmap 之间，所有者不会销毁。

创建后，用 memory_region_add_subregion() 加入地址空间或容器，用 memory_region_del_subregion() 移除。

只读、脏页日志、合并 MMIO、ioeventfd 等属性可在生命周期内修改，在区域变为可见时生效，可能立即、稍后或永不生效。

所有者销毁时区域自动销毁。同一所有者下有多个区域时，API 保证逐个正确分离和终结，但不保证顺序。

若区域位于动态分配的数据结构中，应在 instance_finalize 回调中释放，例如 hw/vfio/pci.c 的 VFIOMSIXInfo 和 VFIOQuirk。

只要设备或 CPU 仍可能使用区域，就不得销毁它。一般规则是：不要在设备存活期间动态创建或销毁内存区域，绝不调用 object_unparent()。

否则可能发生：

memory_region_ref 为所有者取得引用，例如 address_space_map；
区域被解除父子关系，不再有所有者；
address_space_unmap 调用时，原所有者引用泄漏。

例外是别名和容器，可随时调用 object_unparent，因此也可在设备生命周期内动态创建或销毁。

这是因为它们只帮助构建客户机内存映射，永不直接访问， memory_region_ref/unref 不会作用于它们，因此不会出现上述问题。这种例外很少有必要，不建议滥用，但确实有少量使用场景。

创建时传 NULL、“没有所有者”的区域，实际以机器对象为所有者。

重叠区域与优先级

通常区域不重叠，每个地址只解析到一个目标。有时允许重叠并控制客户机可见区域很有用，可通过 memory_region_add_subregion_overlap() 实现。它允许同一容器内重叠，并指定优先级，由核心选择地址相同时的可见区域，高值优先。优先级有符号，默认为零：正值可覆盖其他区域，负值可作为底层背景区域。

若高优先级区域是容器或别名，其未映射的空洞会露出低优先级区域。规则递归适用：内部容器或别名留下的空洞同样如此。

例如容器 A 大小 0x8000，包含 B 和 C。 B 是位于 0x2000、大小 0x4000、优先级 2 的容器； C 是位于 0、大小 0x6000、优先级 1 的 MMIO。 B 内还有大小均为 0x1000 的 D 和 E，分别位于偏移 0 与 0x2000:

      0      1000   2000   3000   4000   5000   6000   7000   8000
      |------|------|------|------|------|------|------|------|
A:    [                                                      ]
C:    [CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC]
B:                  [                          ]
D:                  [DDDDD]
E:                                [EEEEE]

此范围内实际可见的区域为:

[CCCCCCCCCCCC][DDDDD][CCCCC][EEEEE][CCCCC]

B 比 C 优先，因此 B 的子区域即使与 C 重叠，也出现在平坦映射中。 B 未映射的位置则显示 C。

若 B 自身也有 MMIO 操作，不是纯容器，则 D、E 未处理的 B 内地址由 B 处理，结果为:

[CCCCCCCCCCCC][DDDDD][BBBBB][EEEEE][BBBBB]

优先级仅在同一容器内比较。因此负责该容器的设备，通常为总线或内存控制器，可管理子区域间关系而不影响系统其他部分。上例 D、E 互不重叠，优先级不重要。它们覆盖 C 是因为 B 相对 C 更高，D、E 的优先级从不与 C 比较。

可见性

客户机访问地址时，内存核心按以下规则选择区域：

按优先级降序检查根区域的全部直接子区域。
- 地址不在该子区域的偏移和大小范围内，则跳过。
- 子区域为 RAM 或 MMIO 叶节点，结束搜索并返回它。
- 子区域为容器，扣除其偏移后，在内部递归执行相同算法。
- 子区域为别名，按子区域偏移和别名偏移调整地址后，在目标区域继续搜索。
- 容器或别名内部因空洞而未匹配时，若该容器自身具有 MMIO 或 RAM，返回容器本身；否则按优先级继续检查下一个子区域。
所有子区域均不匹配时，搜索结束，返回无匹配。

内存映射示例

system_memory: container@0-2^48-1
 |
 +---- lomem: alias@0-0xdfffffff ---> #ram (0-0xdfffffff)
 |
 +---- himem: alias@0x100000000-0x11fffffff ---> #ram (0xe0000000-0xffffffff)
 |
 +---- vga-window: alias@0xa0000-0xbffff ---> #pci (0xa0000-0xbffff)
 |      (prio 1)
 |
 +---- pci-hole: alias@0xe0000000-0xffffffff ---> #pci (0xe0000000-0xffffffff)

pci (0-2^32-1)
 |
 +--- vga-area: container@0xa0000-0xbffff
 |      |
 |      +--- alias@0x00000-0x7fff  ---> #vram (0x010000-0x017fff)
 |      |
 |      +--- alias@0x08000-0xffff  ---> #vram (0x020000-0x027fff)
 |
 +---- vram: ram@0xe1000000-0xe1ffffff
 |
 +---- vga-mmio: mmio@0xe2000000-0xe200ffff

ram: ram@0x00000000-0xffffffff

这是简化的 PC 内存映射。 4 GB RAM 通过两个别名映射到系统地址空间：lomem 将前 3.5 GB 一一映射， himem 将最后 0.5 GB 映射到 4 GB 地址处。这样预留 0.5 GB 的 PCI 空洞，使 32 位 PCI 总线可用于具有 4 GB 内存的系统。

内存控制器把 640K～768K 地址转向 PCI 空间。通过较高优先级的 vga-window 别名建模，覆盖相同地址的 RAM。客户机可配置控制器移除 VGA 窗口，对应删除别名、露出下层 RAM。

PCI 地址空间不是系统空间的直接子节点，因为只希望暴露部分范围，使用别名实现。它有两个子区域：vga-area 建模传统 VGA 窗口，由两个 32K 内存分组占据，分别指向帧缓冲区的两部分。此外，VRAM 作为 BAR 映射到 e1000000，其后还有包含 MMIO 寄存器的 BAR。

客户机若把 BAR 映射到 PCI 空洞之外，该 BAR 不可见，因为 pci-hole 别名将可见范围限制为 0.5 GB。

MMIO 操作

MMIO 区域提供 ->read() 和 ->write() 回调，满足多数设备需求。若设备行为取决于内存事务属性，或需要返回总线错误而非成功完成，可以使用 ->read_with_attrs() 和 ->write_with_attrs()。

还可通过以下约束控制调用方式：

.valid.min_access_size、.valid.max_access_size：设备接受的访问字节数范围。超出时按设备和总线规则处理，例如忽略或触发机器检查。
.valid.unaligned：被建模设备是否支持非对齐访问。为假时，按总线或 CPU 专用规则处理。
.impl.min_access_size、.impl.max_access_size：实现实际支持的访问大小。其他大小由已有访问模拟，例如最大为 1 时，以四次单字节写模拟四字节写。
.impl.unaligned：实现是否支持非对齐访问。为假时，用两次对齐访问模拟。

API 参考

struct MemoryRegionSection: describes a fragment of a MemoryRegion

Definition:

struct MemoryRegionSection {
    Int128 size;
    MemoryRegion *mr;
    FlatView *fv;
    hwaddr offset_within_region;
    hwaddr offset_within_address_space;
    bool readonly;
    bool nonvolatile;
    bool unmergeable;
};

Members

size: the size of the section; will not exceed mr's boundaries
mr: the region, or NULL if empty
fv: the flat view of the address space the region is mapped in
offset_within_region: the beginning of the section, relative to mr's start
offset_within_address_space: the address of the first byte of the section relative to the region's address space
readonly: writes to this section are ignored
nonvolatile: this section is non-volatile
unmergeable: this section should not get merged with adjacent sections

MemoryRegion *memory_translate_iotlb(IOMMUTLBEntry *iotlb, hwaddr *xlat_p, Error **errp): Extract addresses from a TLB entry. Called with rcu_read_lock held.

Parameters

IOMMUTLBEntry *iotlb: pointer to an IOMMUTLBEntry
hwaddr *xlat_p: return the offset of the entry from the start of the returned MemoryRegion.
Error **errp: pointer to Error*, to store an error if it happens.

Return

On success, return the MemoryRegion containing the iotlb translated addr. The MemoryRegion must not be accessed after rcu_read_unlock. On failure, return NULL, setting errp with error.

struct MemoryListener: callbacks structure for updates to the physical memory map

Definition:

struct MemoryListener {
    void (*begin)(MemoryListener *listener);
    void (*commit)(MemoryListener *listener);
    void (*region_add)(MemoryListener *listener, MemoryRegionSection *section);
    void (*region_del)(MemoryListener *listener, MemoryRegionSection *section);
    void (*region_nop)(MemoryListener *listener, MemoryRegionSection *section);
    void (*log_start)(MemoryListener *listener, MemoryRegionSection *section, int old_val, int new_val);
    void (*log_stop)(MemoryListener *listener, MemoryRegionSection *section, int old_val, int new_val);
    void (*log_sync)(MemoryListener *listener, MemoryRegionSection *section);
    void (*log_sync_global)(MemoryListener *listener, bool last_stage);
    void (*log_clear)(MemoryListener *listener, MemoryRegionSection *section);
    bool (*log_global_start)(MemoryListener *listener, Error **errp);
    void (*log_global_stop)(MemoryListener *listener);
    void (*log_global_after_sync)(MemoryListener *listener);
    void (*eventfd_add)(MemoryListener *listener, MemoryRegionSection *section, bool match_data, uint64_t data, EventNotifier *e);
    void (*eventfd_del)(MemoryListener *listener, MemoryRegionSection *section, bool match_data, uint64_t data, EventNotifier *e);
    void (*coalesced_io_add)(MemoryListener *listener, MemoryRegionSection *section, hwaddr addr, hwaddr len);
    void (*coalesced_io_del)(MemoryListener *listener, MemoryRegionSection *section, hwaddr addr, hwaddr len);
    unsigned priority;
    const char *name;
};

Members

begin

Called at the beginning of an address space update transaction. Followed by calls to MemoryListener.region_add(), MemoryListener.region_del(), MemoryListener.region_nop(), MemoryListener.log_start() and MemoryListener.log_stop() in increasing address order.

listener: The MemoryListener.

commit

Called at the end of an address space update transaction, after the last call to MemoryListener.region_add(), MemoryListener.region_del() or MemoryListener.region_nop(), MemoryListener.log_start() and MemoryListener.log_stop().

listener: The MemoryListener.

region_add

Called during an address space update transaction, for a section of the address space that is new in this address space space since the last transaction.

listener: The MemoryListener. section: The new MemoryRegionSection.

region_del

Called during an address space update transaction, for a section of the address space that has disappeared in the address space since the last transaction.

listener: The MemoryListener. section: The old MemoryRegionSection.

region_nop

Called during an address space update transaction, for a section of the address space that is in the same place in the address space as in the last transaction.

listener: The MemoryListener. section: The MemoryRegionSection.

log_start

Called during an address space update transaction, after one of MemoryListener.region_add(), MemoryListener.region_del() or MemoryListener.region_nop(), if dirty memory logging clients have become active since the last transaction.

listener: The MemoryListener. section: The MemoryRegionSection. old: A bitmap of dirty memory logging clients that were active in the previous transaction. new: A bitmap of dirty memory logging clients that are active in the current transaction.

log_stop

Called during an address space update transaction, after one of MemoryListener.region_add(), MemoryListener.region_del() or MemoryListener.region_nop() and possibly after MemoryListener.log_start(), if dirty memory logging clients have become inactive since the last transaction.

listener: The MemoryListener. section: The MemoryRegionSection. old: A bitmap of dirty memory logging clients that were active in the previous transaction. new: A bitmap of dirty memory logging clients that are active in the current transaction.

log_sync

Called by memory_region_snapshot_and_clear_dirty() and memory_global_dirty_log_sync(), before accessing QEMU's "official" copy of the dirty memory bitmap for a MemoryRegionSection.

listener: The MemoryListener. section: The MemoryRegionSection.

log_sync_global

This is the global version of log_sync when the listener does not have a way to synchronize the log with finer granularity. When the listener registers with log_sync_global defined, then its log_sync must be NULL. Vice versa.

listener: The MemoryListener. last_stage: The last stage to synchronize the log during migration. The caller should guarantee that the synchronization with true for last_stage is triggered for once after all VCPUs have been stopped.

log_clear

Called before reading the dirty memory bitmap for a MemoryRegionSection.

listener: The MemoryListener. section: The MemoryRegionSection.

log_global_start

Called by memory_global_dirty_log_start(), which enables the DIRTY_LOG_MIGRATION client on all memory regions in the address space. MemoryListener.log_global_start() is also called when a MemoryListener is added, if global dirty logging is active at that time.

listener: The MemoryListener. errp: pointer to Error*, to store an error if it happens.

Return: true on success, else false setting errp with error.

log_global_stop

Called by memory_global_dirty_log_stop(), which disables the DIRTY_LOG_MIGRATION client on all memory regions in the address space.

listener: The MemoryListener.

log_global_after_sync

Called after reading the dirty memory bitmap for any MemoryRegionSection.

listener: The MemoryListener.

eventfd_add

Called during an address space update transaction, for a section of the address space that has had a new ioeventfd registration since the last transaction.

listener: The MemoryListener. section: The new MemoryRegionSection. match_data: The match_data parameter for the new ioeventfd. data: The data parameter for the new ioeventfd. e: The EventNotifier parameter for the new ioeventfd.

eventfd_del

Called during an address space update transaction, for a section of the address space that has dropped an ioeventfd registration since the last transaction.

listener: The MemoryListener. section: The new MemoryRegionSection. match_data: The match_data parameter for the dropped ioeventfd. data: The data parameter for the dropped ioeventfd. e: The EventNotifier parameter for the dropped ioeventfd.

coalesced_io_add

Called during an address space update transaction, for a section of the address space that has had a new coalesced MMIO range registration since the last transaction.

listener: The MemoryListener. section: The new MemoryRegionSection. addr: The starting address for the coalesced MMIO range. len: The length of the coalesced MMIO range.

coalesced_io_del

Called during an address space update transaction, for a section of the address space that has dropped a coalesced MMIO range since the last transaction.

listener: The MemoryListener. section: The new MemoryRegionSection. addr: The starting address for the coalesced MMIO range. len: The length of the coalesced MMIO range.

priority

Govern the order in which memory listeners are invoked. Lower priorities are invoked earlier for "add" or "start" callbacks, and later for "delete" or "stop" callbacks.

name

Name of the listener. It can be used in contexts where we'd like to identify one memory listener with the rest.

Description

Allows a component to adjust to changes in the guest-visible memory map. Use with memory_listener_register() and memory_listener_unregister().

struct AddressSpace: describes a mapping of addresses to MemoryRegion objects

Definition:

struct AddressSpace {
};

Members

flatview_cb: Typedef: callback for flatview_for_each_range()

Syntax

bool flatview_cb (Int128 start, Int128 len, const MemoryRegion *mr, hwaddr offset_in_region, void *opaque)

Parameters

Int128 start: start address of the range within the FlatView
Int128 len: length of the range in bytes
const MemoryRegion *mr: MemoryRegion covering this range
hwaddr offset_in_region: offset of the first byte of the range within mr
void *opaque: data pointer passed to flatview_for_each_range()

Return

true to stop the iteration, false to keep going.

void flatview_for_each_range(FlatView *fv, flatview_cb cb, void *opaque): Iterate through a FlatView

Parameters

FlatView *fv: the FlatView to iterate through
flatview_cb cb: function to call for each range
void *opaque: opaque data pointer to pass to cb

Description

A FlatView is made up of a list of non-overlapping ranges, each of which is a slice of a MemoryRegion. This function iterates through each range in fv, calling cb. The callback function can terminate iteration early by returning 'true'.

MemoryRegionSection *memory_region_section_new_copy(MemoryRegionSection *s): Copy a memory region section

Parameters

MemoryRegionSection *s: the MemoryRegionSection to copy

Description

Allocate memory for a new copy, copy the memory region section, and properly take a reference on all relevant members.

void memory_region_section_free_copy(MemoryRegionSection *s): Free a copied memory region section

Parameters

MemoryRegionSection *s: the MemoryRegionSection to copy

Description

Free a copy of a memory section created via memory_region_section_new_copy(). properly dropping references on all relevant members.

bool memory_region_section_intersect_range(MemoryRegionSection *s, uint64_t offset, uint64_t size): Adjust the memory section to cover the intersection with the given range.

Parameters

MemoryRegionSection *s: the MemoryRegionSection to be adjusted
uint64_t offset: the offset of the given range in the memory region
uint64_t size: the size of the given range

Description

Returns false if the intersection is empty, otherwise returns true.

void memory_region_init(MemoryRegion *mr, Object *owner, const char *name, uint64_t size): Initialize a memory region

Parameters

MemoryRegion *mr: the MemoryRegion to be initialized
Object *owner: the object that tracks the region's reference count
const char *name: used for debugging; not visible to the user or ABI
uint64_t size: size of the region; any subregions beyond this size will be clipped

Description

The region typically acts as a container for other memory regions. Use memory_region_add_subregion() to add subregions.

void memory_region_ref(MemoryRegion *mr): Add 1 to a memory region's reference count

Parameters

MemoryRegion *mr: the MemoryRegion

Description

Whenever memory regions are accessed outside the BQL, they need to be preserved against hot-unplug. MemoryRegions actually do not have their own reference count; they piggyback on a QOM object, their "owner". This function adds a reference to the owner.

All MemoryRegions must have an owner if they can disappear, even if the device they belong to operates exclusively under the BQL. This is because the region could be returned at any time by memory_region_find, and this is usually under guest control.

void memory_region_unref(MemoryRegion *mr): Remove 1 to a memory region's reference count

Parameters

MemoryRegion *mr: the MemoryRegion

Description

Whenever memory regions are accessed outside the BQL, they need to be preserved against hot-unplug. MemoryRegions actually do not have their own reference count; they piggyback on a QOM object, their "owner". This function removes a reference to the owner and possibly destroys it.

void memory_region_init_io(MemoryRegion *mr, Object *owner, const MemoryRegionOps *ops, void *opaque, const char *name, uint64_t size): Initialize an I/O memory region.

Parameters

MemoryRegion *mr: the MemoryRegion to be initialized.
Object *owner: the object that tracks the region's reference count
const MemoryRegionOps *ops: a structure containing read and write callbacks to be used when I/O is performed on the region.
void *opaque: passed to the read and write callbacks of the ops structure.
const char *name: used for debugging; not visible to the user or ABI
uint64_t size: size of the region.

Description

Accesses into the region will cause the callbacks in ops to be called. if size is nonzero, subregions will be clipped to size.

bool memory_region_init_ram_flags_nomigrate(MemoryRegion *mr, Object *owner, const char *name, uint64_t size, uint32_t ram_flags, Error **errp): Initialize RAM memory region. Accesses into the region will modify memory directly.

Parameters

MemoryRegion *mr: the MemoryRegion to be initialized.
Object *owner: the object that tracks the region's reference count
const char *name: Region name, becomes part of RAMBlock name used in migration stream must be unique within any device
uint64_t size: size of the region.
uint32_t ram_flags: RamBlock flags. Supported flags: RAM_SHARED, RAM_NORESERVE, RAM_GUEST_MEMFD.
Error **errp: pointer to Error*, to store an error if it happens.

Description

Note that this function does not do anything to cause the data in the RAM memory region to be migrated; that is the responsibility of the caller.

Return

true on success, else false setting errp with error.

bool memory_region_init_resizeable_ram(MemoryRegion *mr, Object *owner, const char *name, uint64_t size, uint64_t max_size, void (*resized)(const char*, uint64_t length, void *host), Error **errp): Initialize memory region with resizable RAM. Accesses into the region will modify memory directly. Only an initial portion of this RAM is actually used. Changing the size while migrating can result in the migration being canceled.

Parameters

MemoryRegion *mr: the MemoryRegion to be initialized.
Object *owner: the object that tracks the region's reference count
const char *name: Region name, becomes part of RAMBlock name used in migration stream must be unique within any device
uint64_t size: used size of the region.
uint64_t max_size: max size of the region.
void (*resized)(const char*, uint64_t length, void *host): callback to notify owner about used size change.
Error **errp: pointer to Error*, to store an error if it happens.

Description

Note that this function does not do anything to cause the data in the RAM memory region to be migrated; that is the responsibility of the caller.

Return

true on success, else false setting errp with error.

bool memory_region_init_ram_from_file(MemoryRegion *mr, Object *owner, const char *name, uint64_t size, uint64_t align, uint32_t ram_flags, const char *path, ram_addr_t offset, Error **errp): Initialize RAM memory region with a mmap-ed backend.

Parameters

MemoryRegion *mr: the MemoryRegion to be initialized.
Object *owner: the object that tracks the region's reference count
const char *name: Region name, becomes part of RAMBlock name used in migration stream must be unique within any device
uint64_t size: size of the region.
uint64_t align: alignment of the region base address; if 0, the default alignment (getpagesize()) will be used.
uint32_t ram_flags: RamBlock flags. Supported flags: RAM_SHARED, RAM_PMEM, RAM_NORESERVE, RAM_PROTECTED, RAM_NAMED_FILE, RAM_READONLY, RAM_READONLY_FD, RAM_GUEST_MEMFD
const char *path: the path in which to allocate the RAM.
ram_addr_t offset: offset within the file referenced by path
Error **errp: pointer to Error*, to store an error if it happens.

Description

Note that this function does not do anything to cause the data in the RAM memory region to be migrated; that is the responsibility of the caller.

Return

true on success, else false setting errp with error.

bool memory_region_init_ram_from_fd(MemoryRegion *mr, Object *owner, const char *name, uint64_t size, uint32_t ram_flags, int fd, ram_addr_t offset, Error **errp): Initialize RAM memory region with a mmap-ed backend.

Parameters

MemoryRegion *mr: the MemoryRegion to be initialized.
Object *owner: the object that tracks the region's reference count
const char *name: the name of the region.
uint64_t size: size of the region.
uint32_t ram_flags: RamBlock flags. Supported flags: RAM_SHARED, RAM_PMEM, RAM_NORESERVE, RAM_PROTECTED, RAM_NAMED_FILE, RAM_READONLY, RAM_READONLY_FD, RAM_GUEST_MEMFD
int fd: the fd to mmap.
ram_addr_t offset: offset within the file referenced by fd
Error **errp: pointer to Error*, to store an error if it happens.

Description

Note that this function does not do anything to cause the data in the RAM memory region to be migrated; that is the responsibility of the caller.

Return

true on success, else false setting errp with error.

void memory_region_init_ram_ptr(MemoryRegion *mr, Object *owner, const char *name, uint64_t size, void *ptr): Initialize RAM memory region from a user-provided pointer. Accesses into the region will modify memory directly.

Parameters

MemoryRegion *mr: the MemoryRegion to be initialized.
Object *owner: the object that tracks the region's reference count
const char *name: Region name, becomes part of RAMBlock name used in migration stream must be unique within any device
uint64_t size: size of the region.
void *ptr: memory to be mapped; must contain at least size bytes.

Description

Note that this function does not do anything to cause the data in the RAM memory region to be migrated; that is the responsibility of the caller.

void memory_region_init_ram_device_ptr(MemoryRegion *mr, Object *owner, const char *name, uint64_t size, void *ptr): Initialize RAM device memory region from a user-provided pointer.

Parameters

MemoryRegion *mr: the MemoryRegion to be initialized.
Object *owner: the object that tracks the region's reference count
const char *name: the name of the region.
uint64_t size: size of the region.
void *ptr: memory to be mapped; must contain at least size bytes.

Description

A RAM device represents a mapping to a physical device, such as to a PCI MMIO BAR of an vfio-pci assigned device. The memory region may be mapped into the VM address space and access to the region will modify memory directly. However, the memory region should not be included in a memory dump (device may not be enabled/mapped at the time of the dump), and operations incompatible with manipulating MMIO should be avoided. Replaces skip_dump flag.

Note that this function does not do anything to cause the data in the RAM memory region to be migrated; that is the responsibility of the caller. (For RAM device memory regions, migrating the contents rarely makes sense.)

void memory_region_init_alias(MemoryRegion *mr, Object *owner, const char *name, MemoryRegion *orig, hwaddr offset, uint64_t size): Initialize a memory region that aliases all or a part of another memory region.

Parameters

MemoryRegion *mr: the MemoryRegion to be initialized.
Object *owner: the object that tracks the region's reference count
const char *name: used for debugging; not visible to the user or ABI
MemoryRegion *orig: the region to be referenced; mr will be equivalent to orig between offset and offset + size - 1.
hwaddr offset: start of the section in orig to be referenced.
uint64_t size: size of the region.

void memory_region_init_iommu(void *_iommu_mr, size_t instance_size, const char *mrtypename, Object *owner, const char *name, uint64_t size): Initialize a memory region of a custom type that translates addresses

Parameters

void *_iommu_mr: the IOMMUMemoryRegion to be initialized
size_t instance_size: the IOMMUMemoryRegion subclass instance size
const char *mrtypename: the type name of the IOMMUMemoryRegion
Object *owner: the object that tracks the region's reference count
const char *name: used for debugging; not visible to the user or ABI
uint64_t size: size of the region.

Description

An IOMMU region translates addresses and forwards accesses to a target memory region.

The IOMMU implementation must define a subclass of TYPE_IOMMU_MEMORY_REGION. _iommu_mr should be a pointer to enough memory for an instance of that subclass, instance_size is the size of that subclass, and mrtypename is its name. This function will initialize _iommu_mr as an instance of the subclass, and its methods will then be called to handle accesses to the memory region. See the documentation of IOMMUMemoryRegionClass for further details.

bool memory_region_init_ram(MemoryRegion *mr, Object *owner, const char *name, uint64_t size, Error **errp): Initialize RAM memory region. Accesses into the region will modify memory directly.

Parameters

MemoryRegion *mr: the MemoryRegion to be initialized
Object *owner: the object that tracks the region's reference count (must be TYPE_DEVICE or a subclass of TYPE_DEVICE, or NULL)
const char *name: name of the memory region
uint64_t size: size of the region in bytes
Error **errp: pointer to Error*, to store an error if it happens.

Description

This function allocates RAM for a board model or device, and arranges for it to be migrated (by calling vmstate_register_ram() if owner is a DeviceState, or vmstate_register_ram_global() if owner is NULL).

TODO: Currently we restrict owner to being either NULL (for global RAM regions with no owner) or devices, so that we can give the RAM block a unique name for migration purposes. We should lift this restriction and allow arbitrary Objects. If you pass a non-NULL non-device owner then we will assert.

Return

true on success, else false setting errp with error.

bool memory_region_init_rom(MemoryRegion *mr, Object *owner, const char *name, uint64_t size, Error **errp): Initialize a ROM memory region.

Parameters

MemoryRegion *mr: the MemoryRegion to be initialized.
Object *owner: the object that tracks the region's reference count
const char *name: Region name, becomes part of RAMBlock name used in migration stream must be unique within any device
uint64_t size: size of the region.
Error **errp: pointer to Error*, to store an error if it happens.

Description

This has the same effect as calling memory_region_init_ram() and then marking the resulting region read-only with memory_region_set_readonly(). This includes arranging for the contents to be migrated.

TODO: Currently we restrict owner to being either NULL (for global RAM regions with no owner) or devices, so that we can give the RAM block a unique name for migration purposes. We should lift this restriction and allow arbitrary Objects. If you pass a non-NULL non-device owner then we will assert.

Return

true on success, else false setting errp with error.

bool memory_region_init_rom_device(MemoryRegion *mr, Object *owner, const MemoryRegionOps *ops, void *opaque, const char *name, uint64_t size, Error **errp): Initialize a ROM memory region. Writes are handled via callbacks.

Parameters

MemoryRegion *mr: the MemoryRegion to be initialized.
Object *owner: the object that tracks the region's reference count
const MemoryRegionOps *ops: callbacks for write access handling (must not be NULL).
void *opaque: passed to the read and write callbacks of the ops structure.
const char *name: Region name, becomes part of RAMBlock name used in migration stream must be unique within any device
uint64_t size: size of the region.
Error **errp: pointer to Error*, to store an error if it happens.

Description

This function initializes a memory region backed by RAM for reads and callbacks for writes, and arranges for the RAM backing to be migrated (by calling vmstate_register_ram() if owner is a DeviceState, or vmstate_register_ram_global() if owner is NULL).

TODO: Currently we restrict owner to being either NULL (for global RAM regions with no owner) or devices, so that we can give the RAM block a unique name for migration purposes. We should lift this restriction and allow arbitrary Objects. If you pass a non-NULL non-device owner then we will assert.

Return

true on success, else false setting errp with error.

Object *memory_region_owner(const MemoryRegion *mr): get a memory region's owner.

Parameters

const MemoryRegion *mr: the memory region being queried.

uint64_t memory_region_size(const MemoryRegion *mr): get a memory region's size.

Parameters

const MemoryRegion *mr: the memory region being queried.

bool memory_region_is_ram(const MemoryRegion *mr): check whether a memory region is random access

Parameters

const MemoryRegion *mr: the memory region being queried

Description

Returns true if a memory region is random access.

bool memory_region_is_ram_device(const MemoryRegion *mr): check whether a memory region is a ram device

Parameters

const MemoryRegion *mr: the memory region being queried

Description

Returns true if a memory region is a device backed ram region

bool memory_region_is_romd(const MemoryRegion *mr): check whether a memory region is in ROMD mode

Parameters

const MemoryRegion *mr: the memory region being queried

Description

Returns true if a memory region is a ROM device and currently set to allow direct reads.

bool memory_region_is_protected(const MemoryRegion *mr): check whether a memory region is protected

Parameters

const MemoryRegion *mr: the memory region being queried

Description

Returns true if a memory region is protected RAM and cannot be accessed via standard mechanisms, e.g. DMA.

bool memory_region_skip_iommu_map(const MemoryRegion *mr): check whether a memory region is excluded from IOMMU mapping

Parameters

const MemoryRegion *mr: the memory region being queried

Description

Returns true if mr is a RAM device region marked to skip IOMMU mapping.

void memory_region_set_skip_iommu_map(MemoryRegion *mr, bool skip): mark a RAM device region to skip IOMMU mapping

Parameters

MemoryRegion *mr: the memory region being modified
bool skip: true to skip IOMMU mapping, false to allow it

bool memory_region_has_guest_memfd(const MemoryRegion *mr): check whether a memory region has guest_memfd associated

Parameters

const MemoryRegion *mr: the memory region being queried

Description

Returns true if a memory region's ram_block has valid guest_memfd assigned.

IOMMUMemoryRegion *memory_region_get_iommu(const MemoryRegion *mr): check whether a memory region is an iommu

Parameters

const MemoryRegion *mr: the memory region being queried

Description

Returns pointer to IOMMUMemoryRegion if a memory region is an iommu, otherwise NULL.

IOMMUMemoryRegionClass *memory_region_get_iommu_class_nocheck(IOMMUMemoryRegion *iommu_mr): returns iommu memory region class if an iommu or NULL if not

Parameters

IOMMUMemoryRegion *iommu_mr: the memory region being queried

Description

Returns pointer to IOMMUMemoryRegionClass if a memory region is an iommu, otherwise NULL. This is fast path avoiding QOM checking, use with caution.

uint64_t memory_region_iommu_get_min_page_size(IOMMUMemoryRegion *iommu_mr): get minimum supported page size for an iommu

Parameters

IOMMUMemoryRegion *iommu_mr: the memory region being queried

Description

Returns minimum supported page size for an iommu.

void memory_region_notify_iommu(IOMMUMemoryRegion *iommu_mr, int iommu_idx, const IOMMUTLBEvent event): notify a change in an IOMMU translation entry.

Parameters

IOMMUMemoryRegion *iommu_mr: the memory region that was changed
int iommu_idx: the IOMMU index for the translation table which has changed
const IOMMUTLBEvent event: TLB event with the new entry in the IOMMU translation table. The entry replaces all old entries for the same virtual I/O address range.

Note

for any IOMMU implementation, an in-place mapping change should be notified with an UNMAP followed by a MAP.

void memory_region_notify_iommu_one(IOMMUNotifier *notifier, const IOMMUTLBEvent *event): notify a change in an IOMMU translation entry to a single notifier

Parameters

IOMMUNotifier *notifier: the notifier to be notified
const IOMMUTLBEvent *event: TLB event with the new entry in the IOMMU translation table. The entry replaces all old entries for the same virtual I/O address range.

Description

This works just like memory_region_notify_iommu(), but it only notifies a specific notifier, not all of them.

void memory_region_unmap_iommu_notifier_range(IOMMUNotifier *notifier): notify a unmap for an IOMMU translation that covers the range of a notifier

Parameters

IOMMUNotifier *notifier: the notifier to be notified

int memory_region_register_iommu_notifier(MemoryRegion *mr, IOMMUNotifier *n, Error **errp): register a notifier for changes to IOMMU translation entries.

Parameters

MemoryRegion *mr: the memory region to observe
IOMMUNotifier *n: the IOMMUNotifier to be added; the notify callback receives a pointer to an IOMMUTLBEntry as the opaque value; the pointer ceases to be valid on exit from the notifier.
Error **errp: pointer to Error*, to store an error if it happens.

Description

Returns 0 on success, or a negative errno otherwise. In particular, -EINVAL indicates that at least one of the attributes of the notifier is not supported (flag/range) by the IOMMU memory region. In case of error the error object must be created.

void memory_region_iommu_replay(IOMMUMemoryRegion *iommu_mr, IOMMUNotifier *n): replay existing IOMMU translations to a notifier with the minimum page granularity returned by mr->iommu_ops->get_page_size().

Parameters

IOMMUMemoryRegion *iommu_mr: the memory region to observe
IOMMUNotifier *n: the notifier to which to replay iommu mappings

Note

this is not related to record-and-replay functionality.

void memory_region_unregister_iommu_notifier(MemoryRegion *mr, IOMMUNotifier *n): unregister a notifier for changes to IOMMU translation entries.

Parameters

MemoryRegion *mr: the memory region which was observed and for which notify_stopped() needs to be called
IOMMUNotifier *n: the notifier to be removed.

int memory_region_iommu_get_attr(IOMMUMemoryRegion *iommu_mr, enum IOMMUMemoryRegionAttr attr, void *data): return an IOMMU attr if get_attr() is defined on the IOMMU.

Parameters

IOMMUMemoryRegion *iommu_mr: the memory region
enum IOMMUMemoryRegionAttr attr: the requested attribute
void *data: a pointer to the requested attribute data

Description

Returns 0 on success, or a negative errno otherwise. In particular, -EINVAL indicates that the IOMMU does not support the requested attribute.

int memory_region_iommu_attrs_to_index(IOMMUMemoryRegion *iommu_mr, MemTxAttrs attrs): return the IOMMU index to use for translations with the given memory transaction attributes.

Parameters

IOMMUMemoryRegion *iommu_mr: the memory region
MemTxAttrs attrs: the memory transaction attributes

int memory_region_iommu_num_indexes(IOMMUMemoryRegion *iommu_mr): return the total number of IOMMU indexes that this IOMMU supports.

Parameters

IOMMUMemoryRegion *iommu_mr: the memory region

const char *memory_region_name(const MemoryRegion *mr): get a memory region's name

Parameters

const MemoryRegion *mr: the memory region being queried

Description

Returns the string that was used to initialize the memory region.

bool memory_region_is_logging(const MemoryRegion *mr, uint8_t client): return whether a memory region is logging writes

Parameters

const MemoryRegion *mr: the memory region being queried
uint8_t client: the client being queried

Description

Returns true if the memory region is logging writes for the given client

uint8_t memory_region_get_dirty_log_mask(const MemoryRegion *mr): return the clients for which a memory region is logging writes.

Parameters

const MemoryRegion *mr: the memory region being queried

Description

Returns a bitmap of clients, in which the DIRTY_MEMORY_* constants are the bit indices.

bool memory_region_is_rom(const MemoryRegion *mr): check whether a memory region is ROM

Parameters

const MemoryRegion *mr: the memory region being queried

Description

Returns true if a memory region is read-only memory.

bool memory_region_is_nonvolatile(const MemoryRegion *mr): check whether a memory region is non-volatile

Parameters

const MemoryRegion *mr: the memory region being queried

Description

Returns true is a memory region is non-volatile memory.

int memory_region_get_fd(const MemoryRegion *mr): Get a file descriptor backing a RAM memory region.

Parameters

const MemoryRegion *mr: the RAM or alias memory region being queried.

Description

Returns a file descriptor backing a file-based RAM memory region, or -1 if the region is not a file-based RAM memory region.

MemoryRegion *memory_region_from_host(void *ptr, ram_addr_t *offset): Convert a pointer into a RAM memory region and an offset within it.

Parameters

void *ptr: the host pointer to be converted
ram_addr_t *offset: the offset within memory region

Description

Given a host pointer inside a RAM memory region (created with memory_region_init_ram() or memory_region_init_ram_ptr()), return the MemoryRegion and the offset within it.

Use with care; by the time this function returns, the returned pointer is not protected by RCU anymore. If the caller is not within an RCU critical section and does not hold the BQL, it must have other means of protecting the pointer, such as a reference to the region that includes the incoming ram_addr_t.

void *memory_region_get_ram_ptr(const MemoryRegion *mr): Get a pointer into a RAM memory region.

Parameters

const MemoryRegion *mr: the memory region being queried.

Description

Returns a host pointer to a RAM memory region (created with memory_region_init_ram() or memory_region_init_ram_ptr()).

Use with care; by the time this function returns, the returned pointer is not protected by RCU anymore. If the caller is not within an RCU critical section and does not hold the BQL, it must have other means of protecting the pointer, such as a reference to the region that includes the incoming ram_addr_t.

void memory_region_msync(MemoryRegion *mr, hwaddr addr, hwaddr size): Synchronize selected address range of a memory mapped region

Parameters

MemoryRegion *mr: the memory region to be msync
hwaddr addr: the initial address of the range to be sync
hwaddr size: the size of the range to be sync

void memory_region_writeback(MemoryRegion *mr, hwaddr addr, hwaddr size): Trigger cache writeback for selected address range

Parameters

MemoryRegion *mr: the memory region to be updated
hwaddr addr: the initial address of the range to be written back
hwaddr size: the size of the range to be written back

void memory_region_set_log(MemoryRegion *mr, bool log, unsigned client): Turn dirty logging on or off for a region.

Parameters

MemoryRegion *mr: the memory region being updated.
bool log: whether dirty logging is to be enabled or disabled.
unsigned client: the user of the logging information; DIRTY_MEMORY_VGA only.

Description

Turns dirty logging on or off for a specified client (display, migration). Only meaningful for RAM regions.

void memory_region_set_dirty(MemoryRegion *mr, hwaddr addr, hwaddr size): Mark a range of bytes as dirty in a memory region.

Parameters

MemoryRegion *mr: the memory region being dirtied.
hwaddr addr: the address (relative to the start of the region) being dirtied.
hwaddr size: size of the range being dirtied.

Description

Marks a range of bytes as dirty, after it has been dirtied outside guest code.

void memory_region_clear_dirty_bitmap(MemoryRegion *mr, hwaddr start, hwaddr len): clear dirty bitmap for memory range

Parameters

MemoryRegion *mr: the memory region to clear the dirty log upon
hwaddr start: start address offset within the memory region
hwaddr len: length of the memory region to clear dirty bitmap

Description

This function is called when the caller wants to clear the remote dirty bitmap of a memory range within the memory region. This can be used by e.g. KVM to manually clear dirty log when KVM_CAP_MANUAL_DIRTY_LOG_PROTECT is declared support by the host kernel.

DirtyBitmapSnapshot *memory_region_snapshot_and_clear_dirty(MemoryRegion *mr, hwaddr addr, hwaddr size, unsigned client): Get a snapshot of the dirty bitmap and clear it.

Parameters

MemoryRegion *mr: the memory region being queried.
hwaddr addr: the address (relative to the start of the region) being queried.
hwaddr size: the size of the range being queried.
unsigned client: the user of the logging information; typically DIRTY_MEMORY_VGA.

Description

Creates a snapshot of the dirty bitmap, clears the dirty bitmap and returns the snapshot. The snapshot can then be used to query dirty status, using memory_region_snapshot_get_dirty. Snapshotting allows querying the same page multiple times, which is especially useful for display updates where the scanlines often are not page aligned.

The dirty bitmap region which gets copied into the snapshot (and cleared afterwards) can be larger than requested. The boundaries are rounded up/down so complete bitmap longs (covering 64 pages on 64bit hosts) can be copied over into the bitmap snapshot. Which isn't a problem for display updates as the extra pages are outside the visible area, and in case the visible area changes a full display redraw is due anyway. Should other use cases for this function emerge we might have to revisit this implementation detail.

Use g_free to release DirtyBitmapSnapshot.

bool memory_region_snapshot_get_dirty(MemoryRegion *mr, DirtyBitmapSnapshot *snap, hwaddr addr, hwaddr size): Check whether a range of bytes is dirty in the specified dirty bitmap snapshot.

Parameters

MemoryRegion *mr: the memory region being queried.
DirtyBitmapSnapshot *snap: the dirty bitmap snapshot
hwaddr addr: the address (relative to the start of the region) being queried.
hwaddr size: the size of the range being queried.

void memory_region_reset_dirty(MemoryRegion *mr, hwaddr addr, hwaddr size, unsigned client): Mark a range of pages as clean, for a specified client.

Parameters

MemoryRegion *mr: the region being updated.
hwaddr addr: the start of the subrange being cleaned.
hwaddr size: the size of the subrange being cleaned.
unsigned client: the user of the logging information; DIRTY_MEMORY_MIGRATION or DIRTY_MEMORY_VGA.

Description

Marks a range of pages as no longer dirty.

void memory_region_flush_rom_device(MemoryRegion *mr, hwaddr addr, hwaddr size): Mark a range of pages dirty and invalidate TBs (for self-modifying code).

Parameters

MemoryRegion *mr: the region being flushed.
hwaddr addr: the start, relative to the start of the region, of the range being flushed.
hwaddr size: the size, in bytes, of the range being flushed.

Description

The MemoryRegionOps->write() callback of a ROM device must use this function to mark byte ranges that have been modified internally, such as by directly accessing the memory returned by memory_region_get_ram_ptr().

This function marks the range dirty and invalidates TBs so that TCG can detect self-modifying code.

void memory_region_set_readonly(MemoryRegion *mr, bool readonly): Turn a memory region read-only (or read-write)

Parameters

MemoryRegion *mr: the region being updated.
bool readonly: whether the region is to be ROM or RAM.

Description

Allows a memory region to be marked as read-only (turning it into a ROM). only useful on RAM regions.

void memory_region_set_nonvolatile(MemoryRegion *mr, bool nonvolatile): Turn a memory region non-volatile

Parameters

MemoryRegion *mr: the region being updated.
bool nonvolatile: whether the region is to be non-volatile.

Description

Allows a memory region to be marked as non-volatile. only useful on RAM regions.

void memory_region_rom_device_set_romd(MemoryRegion *mr, bool romd_mode): enable/disable ROMD mode

Parameters

MemoryRegion *mr: the memory region to be updated
bool romd_mode: true to put the region into ROMD mode

Description

Allows a ROM device (initialized with memory_region_init_rom_device() to set to ROMD mode (default) or MMIO mode. When it is in ROMD mode, the device is mapped to guest memory and satisfies read access directly. When in MMIO mode, reads are forwarded to the MemoryRegion.read function. Writes are always handled by the MemoryRegion.write function.

void memory_region_set_coalescing(MemoryRegion *mr): Enable memory coalescing for the region.

Parameters

MemoryRegion *mr: the memory region to be write coalesced

Description

Enabled writes to a region to be queued for later processing. MMIO ->write callbacks may be delayed until a non-coalesced MMIO is issued. Only useful for IO regions. Roughly similar to write-combining hardware.

void memory_region_add_coalescing(MemoryRegion *mr, hwaddr offset, uint64_t size): Enable memory coalescing for a sub-range of a region.

Parameters

MemoryRegion *mr: the memory region to be updated.
hwaddr offset: the start of the range within the region to be coalesced.
uint64_t size: the size of the subrange to be coalesced.

Description

Like memory_region_set_coalescing(), but works on a sub-range of a region. Multiple calls can be issued coalesced disjoint ranges.

void memory_region_clear_coalescing(MemoryRegion *mr): Disable MMIO coalescing for the region.

Parameters

MemoryRegion *mr: the memory region to be updated.

Description

Disables any coalescing caused by memory_region_set_coalescing() or memory_region_add_coalescing(). Roughly equivalent to uncacheble memory hardware.

void memory_region_set_flush_coalesced(MemoryRegion *mr): Enforce memory coalescing flush before accesses.

Parameters

MemoryRegion *mr: the memory region to be updated.

Description

Ensure that pending coalesced MMIO request are flushed before the memory region is accessed. This property is automatically enabled for all regions passed to memory_region_set_coalescing() and memory_region_add_coalescing().

void memory_region_clear_flush_coalesced(MemoryRegion *mr): Disable memory coalescing flush before accesses.

Parameters

MemoryRegion *mr: the memory region to be updated.

Description

Clear the automatic coalesced MMIO flushing enabled via memory_region_set_flush_coalesced. Note that this service has no effect on memory regions that have MMIO coalescing enabled for themselves. For them, automatic flushing will stop once coalescing is disabled.

void memory_region_enable_lockless_io(MemoryRegion *mr): Enable lockless (BQL free) acceess.

Parameters

MemoryRegion *mr: the memory region to be updated.

Description

Enable BQL-free access for devices that are well prepared to handle locking during I/O themselves: either by doing fine grained locking or by providing lock-free I/O schemes.

void memory_region_add_eventfd(MemoryRegion *mr, hwaddr addr, unsigned size, bool match_data, uint64_t data, EventNotifier *e): Request an eventfd to be triggered when a word is written to a location.

Parameters

MemoryRegion *mr: the memory region being updated.
hwaddr addr: the address within mr that is to be monitored
unsigned size: the size of the access to trigger the eventfd
bool match_data: whether to match against data, instead of just addr
uint64_t data: the data to match against the guest write
EventNotifier *e: event notifier to be triggered when addr, size, and data all match.

Description

Marks a word in an IO region (initialized with memory_region_init_io()) as a trigger for an eventfd event. The I/O callback will not be called. The caller must be prepared to handle failure (that is, take the required action if the callback _is_ called).

void memory_region_del_eventfd(MemoryRegion *mr, hwaddr addr, unsigned size, bool match_data, uint64_t data, EventNotifier *e): Cancel an eventfd.

Parameters

MemoryRegion *mr: the memory region being updated.
hwaddr addr: the address within mr that is to be monitored
unsigned size: the size of the access to trigger the eventfd
bool match_data: whether to match against data, instead of just addr
uint64_t data: the data to match against the guest write
EventNotifier *e: event notifier to be triggered when addr, size, and data all match.

Description

Cancels an eventfd trigger requested by a previous memory_region_add_eventfd() call.

void memory_region_add_subregion(MemoryRegion *mr, hwaddr offset, MemoryRegion *subregion): Add a subregion to a container.

Parameters

MemoryRegion *mr: the region to contain the new subregion; must be a container initialized with memory_region_init().
hwaddr offset: the offset relative to mr where subregion is added.
MemoryRegion *subregion: the subregion to be added.

Description

Adds a subregion at offset. The subregion may not overlap with other subregions (except for those explicitly marked as overlapping). A region may only be added once as a subregion (unless removed with memory_region_del_subregion()); use memory_region_init_alias() if you want a region to be a subregion in multiple locations.

void memory_region_add_subregion_overlap(MemoryRegion *mr, hwaddr offset, MemoryRegion *subregion, int priority): Add a subregion to a container with overlap.

Parameters

MemoryRegion *mr: the region to contain the new subregion; must be a container initialized with memory_region_init().
hwaddr offset: the offset relative to mr where subregion is added.
MemoryRegion *subregion: the subregion to be added.
int priority: used for resolving overlaps; highest priority wins.

Description

Adds a subregion at offset. The subregion may overlap with other subregions. Conflicts are resolved by having a higher priority hide a lower priority. Subregions without priority are taken as priority 0. A region may only be added once as a subregion (unless removed with memory_region_del_subregion()); use memory_region_init_alias() if you want a region to be a subregion in multiple locations.

ram_addr_t memory_region_get_ram_addr(const MemoryRegion *mr): Get the ram address associated with a memory region

Parameters

const MemoryRegion *mr: the region to be queried

void memory_region_del_subregion(MemoryRegion *mr, MemoryRegion *subregion): Remove a subregion.

Parameters

MemoryRegion *mr: the container to be updated.
MemoryRegion *subregion: the region being removed; must be a current subregion of mr.

Description

Removes a subregion from its container.

bool memory_region_present(MemoryRegion *container, hwaddr addr): checks if an address relative to a container translates into MemoryRegion within container

Parameters

MemoryRegion *container: a MemoryRegion within which addr is a relative address
hwaddr addr: the area within container to be searched

Description

Answer whether a MemoryRegion within container covers the address addr.

bool memory_region_is_mapped(const MemoryRegion *mr): returns true if MemoryRegion is mapped into another memory region, which does not necessarily imply that it is mapped into an address space.

Parameters

const MemoryRegion *mr: a MemoryRegion which should be checked if it's mapped

RamDiscardManager *memory_region_get_ram_discard_manager(MemoryRegion *mr): get the RamDiscardManager for a MemoryRegion

Parameters

MemoryRegion *mr: the MemoryRegion

Description

The RamDiscardManager cannot change while a memory region is mapped.

bool memory_region_has_ram_discard_manager(MemoryRegion *mr): check whether a MemoryRegion has a RamDiscardManager assigned

Parameters

MemoryRegion *mr: the MemoryRegion

int memory_region_add_ram_discard_source(MemoryRegion *mr, RamDiscardSource *source): add a RamDiscardSource for a MemoryRegion

Parameters

MemoryRegion *mr: the MemoryRegion
RamDiscardSource *source: RamDiscardSource to add

int memory_region_del_ram_discard_source(MemoryRegion *mr, RamDiscardSource *source): remove a RamDiscardSource for a MemoryRegion

Parameters

MemoryRegion *mr: the MemoryRegion
RamDiscardSource *source: RamDiscardSource to remove

Return

0 on success, or a negative error code on failure.

MemoryRegionSection memory_region_find(MemoryRegion *mr, hwaddr addr, uint64_t size): translate an address/size relative to a MemoryRegion into a MemoryRegionSection.

Parameters

MemoryRegion *mr: a MemoryRegion within which addr is a relative address
hwaddr addr: start of the area within as to be searched
uint64_t size: size of the area to be searched

Description

Locates the first MemoryRegion within mr that overlaps the range given by addr and size.

Returns a MemoryRegionSection that describes a contiguous overlap. It will have the following characteristics: - size = 0 iff no overlap was found - mr is non-NULL iff an overlap was found

Remember that in the return value the offset_within_region is relative to the returned region (in the .**mr** field), not to the mr argument.

Similarly, the .**offset_within_address_space** is relative to the address space that contains both regions, the passed and the returned one. However, in the special case where the mr argument has no container (and thus is the root of the address space), the following will hold: - offset_within_address_space >= addr - offset_within_address_space + .**size** <= addr + size

void memory_global_dirty_log_sync(bool last_stage): synchronize the dirty log for all memory

Parameters

bool last_stage: whether this is the last stage of live migration

Description

Synchronizes the dirty page log for all address spaces.

void memory_global_after_dirty_log_sync(void): synchronize the dirty log for all memory

Parameters

void: no arguments

Description

Synchronizes the vCPUs with a thread that is reading the dirty bitmap. This function must be called after the dirty log bitmap is cleared, and before dirty guest memory pages are read. If you are using DirtyBitmapSnapshot, memory_region_snapshot_and_clear_dirty() takes care of doing this.

void memory_region_transaction_begin(void): Start a transaction.

Parameters

void: no arguments

Description

During a transaction, changes will be accumulated and made visible only when the transaction ends (is committed).

void memory_region_transaction_commit(void): Commit a transaction and make changes visible to the guest.

Parameters

void: no arguments

void memory_listener_register(MemoryListener *listener, AddressSpace *filter): register callbacks to be called when memory sections are mapped or unmapped into an address space

Parameters

MemoryListener *listener: an object containing the callbacks to be called
AddressSpace *filter: if non-NULL, only regions in this address space will be observed

void memory_listener_unregister(MemoryListener *listener): undo the effect of memory_listener_register()

Parameters

MemoryListener *listener: an object containing the callbacks to be removed

bool memory_global_dirty_log_start(unsigned int flags, Error **errp): begin dirty logging for all regions

Parameters

unsigned int flags: purpose of starting dirty log, migration or dirty rate
Error **errp: pointer to Error*, to store an error if it happens.

Return

true on success, else false setting errp with error.

void memory_global_dirty_log_stop(unsigned int flags): end dirty logging for all regions

Parameters

unsigned int flags: purpose of stopping dirty log, migration or dirty rate

MemTxResult memory_region_dispatch_read(MemoryRegion *mr, hwaddr addr, uint64_t *pval, MemOp op, MemTxAttrs attrs): perform a read directly to the specified MemoryRegion.

Parameters

MemoryRegion *mr: MemoryRegion to access
hwaddr addr: address within that region
uint64_t *pval: pointer to uint64_t which the data is written to
MemOp op: size, sign, and endianness of the memory operation
MemTxAttrs attrs: memory transaction attributes to use for the access

MemTxResult memory_region_dispatch_write(MemoryRegion *mr, hwaddr addr, uint64_t data, MemOp op, MemTxAttrs attrs): perform a write directly to the specified MemoryRegion.

Parameters

MemoryRegion *mr: MemoryRegion to access
hwaddr addr: address within that region
uint64_t data: data to write
MemOp op: size, sign, and endianness of the memory operation
MemTxAttrs attrs: memory transaction attributes to use for the access

void address_space_init(AddressSpace *as, MemoryRegion *root, const char *name): initializes an address space

Parameters

AddressSpace *as: an uninitialized AddressSpace
MemoryRegion *root: a MemoryRegion that routes addresses for the address space
const char *name: an address space name. The name is only used for debugging output.

void address_space_destroy(AddressSpace *as): destroy an address space

Parameters

AddressSpace *as: address space to be destroyed

Description

Releases all resources associated with an address space. After an address space is destroyed, the reference the AddressSpace had to its root memory region is dropped, which may result in the destruction of that memory region as well.

Note that destruction of the AddressSpace is done via RCU; it is therefore not valid to free the memory the AddressSpace struct is in until after that RCU callback has completed. If you want to g_free() the AddressSpace after destruction you can do that with address_space_destroy_free().

void address_space_destroy_free(AddressSpace *as): destroy an address space and free it

Parameters

AddressSpace *as: address space to be destroyed

Description

This does the same thing as address_space_destroy(), and then also frees (via g_free()) the AddressSpace itself once the destruction is complete.

void address_space_remove_listeners(const AddressSpace *as): unregister all listeners of an address space

Parameters

const AddressSpace *as: an initialized AddressSpace

Description

Removes all callbacks previously registered with memory_listener_register() for as.

MemTxResult address_space_rw(const AddressSpace *as, hwaddr addr, MemTxAttrs attrs, void *buf, hwaddr len, bool is_write): read from or write to an address space.

Parameters

const AddressSpace *as: AddressSpace to be accessed
hwaddr addr: address within that address space
MemTxAttrs attrs: memory transaction attributes
void *buf: buffer with the data transferred
hwaddr len: the number of bytes to read or write
bool is_write: indicates the transfer direction

Description

Return a MemTxResult indicating whether the operation succeeded or failed (eg unassigned memory, device rejected the transaction, IOMMU fault).

MemTxResult address_space_write(const AddressSpace *as, hwaddr addr, MemTxAttrs attrs, const void *buf, hwaddr len): write to address space.

Parameters

const AddressSpace *as: AddressSpace to be accessed
hwaddr addr: address within that address space
MemTxAttrs attrs: memory transaction attributes
const void *buf: buffer with the data transferred
hwaddr len: the number of bytes to write

Description

Return a MemTxResult indicating whether the operation succeeded or failed (eg unassigned memory, device rejected the transaction, IOMMU fault).

MemTxResult address_space_write_rom(AddressSpace *as, hwaddr addr, MemTxAttrs attrs, const void *buf, hwaddr len): write to address space, including ROM.

Parameters

AddressSpace *as: AddressSpace to be accessed
hwaddr addr: address within that address space
MemTxAttrs attrs: memory transaction attributes
const void *buf: buffer with the data transferred
hwaddr len: the number of bytes to write

Description

This function writes to the specified address space, but will write data to both ROM and RAM. This is used for non-guest writes like writes from the gdb debug stub or initial loading of ROM contents.

Note that portions of the write which attempt to write data to a device will be silently ignored -- only real RAM and ROM will be written to.

Return a MemTxResult indicating whether the operation succeeded or failed (eg unassigned memory, device rejected the transaction, IOMMU fault).

bool address_space_is_io(AddressSpace *as, hwaddr addr): check whether an guest physical addresses whithin an address space is I/O memory.

Parameters

AddressSpace *as: AddressSpace to be accessed
hwaddr addr: address within that address space

MemTxResult address_space_read(const AddressSpace *as, hwaddr addr, MemTxAttrs attrs, void *buf, hwaddr len): read from an address space.

Parameters

const AddressSpace *as: AddressSpace to be accessed
hwaddr addr: address within that address space
MemTxAttrs attrs: memory transaction attributes
void *buf: buffer with the data transferred
hwaddr len: length of the data transferred

Description

Return a MemTxResult indicating whether the operation succeeded or failed (eg unassigned memory, device rejected the transaction, IOMMU fault). Called within RCU critical section.

MemTxResult address_space_set(const AddressSpace *as, hwaddr addr, uint8_t c, hwaddr len, MemTxAttrs attrs): Fill address space with a constant byte.

Parameters

const AddressSpace *as: AddressSpace to be accessed
hwaddr addr: address within that address space
uint8_t c: constant byte to fill the memory
hwaddr len: the number of bytes to fill with the constant byte
MemTxAttrs attrs: memory transaction attributes

Description

Return a MemTxResult indicating whether the operation succeeded or failed (eg unassigned memory, device rejected the transaction, IOMMU fault).