1 /*
2 * generic functions used by VFIO devices
3 *
4 * Copyright Red Hat, Inc. 2012
5 *
6 * Authors:
7 * Alex Williamson <alex.williamson@redhat.com>
8 *
9 * This work is licensed under the terms of the GNU GPL, version 2. See
10 * the COPYING file in the top-level directory.
11 *
12 * Based on qemu-kvm device-assignment:
13 * Adapted for KVM by Qumranet.
14 * Copyright (c) 2007, Neocleus, Alex Novik (alex@neocleus.com)
15 * Copyright (c) 2007, Neocleus, Guy Zana (guy@neocleus.com)
16 * Copyright (C) 2008, Qumranet, Amit Shah (amit.shah@qumranet.com)
17 * Copyright (C) 2008, Red Hat, Amit Shah (amit.shah@redhat.com)
18 * Copyright (C) 2008, IBM, Muli Ben-Yehuda (muli@il.ibm.com)
19 */
20
21 #include "qemu/osdep.h"
22 #include <sys/ioctl.h>
23 #include <linux/vfio.h>
24
25 #include "hw/vfio/vfio-device.h"
26 #include "system/address-spaces.h"
27 #include "system/memory.h"
28 #include "system/ram_addr.h"
29 #include "qemu/error-report.h"
30 #include "qemu/range.h"
31 #include "system/reset.h"
32 #include "trace.h"
33 #include "qapi/error.h"
34 #include "migration/cpr.h"
35 #include "migration/blocker.h"
36 #include "pci.h"
37 #include "hw/vfio/vfio-container.h"
38 #include "vfio-helpers.h"
39 #include "vfio-listener.h"
40
41 #define TYPE_HOST_IOMMU_DEVICE_LEGACY_VFIO TYPE_HOST_IOMMU_DEVICE "-legacy-vfio"
42
43 typedef QLIST_HEAD(VFIOGroupList, VFIOGroup) VFIOGroupList;
44 static VFIOGroupList vfio_group_list =
45 QLIST_HEAD_INITIALIZER(vfio_group_list);
46
vfio_ram_block_discard_disable(VFIOContainer * container,bool state)47 static int vfio_ram_block_discard_disable(VFIOContainer *container, bool state)
48 {
49 switch (container->iommu_type) {
50 case VFIO_TYPE1v2_IOMMU:
51 case VFIO_TYPE1_IOMMU:
52 /*
53 * We support coordinated discarding of RAM via the RamDiscardManager.
54 */
55 return ram_block_uncoordinated_discard_disable(state);
56 default:
57 /*
58 * VFIO_SPAPR_TCE_IOMMU most probably works just fine with
59 * RamDiscardManager, however, it is completely untested.
60 *
61 * VFIO_SPAPR_TCE_v2_IOMMU with "DMA memory preregistering" does
62 * completely the opposite of managing mapping/pinning dynamically as
63 * required by RamDiscardManager. We would have to special-case sections
64 * with a RamDiscardManager.
65 */
66 return ram_block_discard_disable(state);
67 }
68 }
69
vfio_dma_unmap_bitmap(const VFIOContainer * container,hwaddr iova,ram_addr_t size,IOMMUTLBEntry * iotlb)70 static int vfio_dma_unmap_bitmap(const VFIOContainer *container,
71 hwaddr iova, ram_addr_t size,
72 IOMMUTLBEntry *iotlb)
73 {
74 const VFIOContainerBase *bcontainer = &container->bcontainer;
75 struct vfio_iommu_type1_dma_unmap *unmap;
76 struct vfio_bitmap *bitmap;
77 VFIOBitmap vbmap;
78 int ret;
79
80 ret = vfio_bitmap_alloc(&vbmap, size);
81 if (ret) {
82 return ret;
83 }
84
85 unmap = g_malloc0(sizeof(*unmap) + sizeof(*bitmap));
86
87 unmap->argsz = sizeof(*unmap) + sizeof(*bitmap);
88 unmap->iova = iova;
89 unmap->size = size;
90 unmap->flags |= VFIO_DMA_UNMAP_FLAG_GET_DIRTY_BITMAP;
91 bitmap = (struct vfio_bitmap *)&unmap->data;
92
93 /*
94 * cpu_physical_memory_set_dirty_lebitmap() supports pages in bitmap of
95 * qemu_real_host_page_size to mark those dirty. Hence set bitmap_pgsize
96 * to qemu_real_host_page_size.
97 */
98 bitmap->pgsize = qemu_real_host_page_size();
99 bitmap->size = vbmap.size;
100 bitmap->data = (__u64 *)vbmap.bitmap;
101
102 if (vbmap.size > bcontainer->max_dirty_bitmap_size) {
103 error_report("UNMAP: Size of bitmap too big 0x%"PRIx64, vbmap.size);
104 ret = -E2BIG;
105 goto unmap_exit;
106 }
107
108 ret = ioctl(container->fd, VFIO_IOMMU_UNMAP_DMA, unmap);
109 if (!ret) {
110 cpu_physical_memory_set_dirty_lebitmap(vbmap.bitmap,
111 iotlb->translated_addr, vbmap.pages);
112 } else {
113 error_report("VFIO_UNMAP_DMA with DIRTY_BITMAP : %m");
114 }
115
116 unmap_exit:
117 g_free(unmap);
118 g_free(vbmap.bitmap);
119
120 return ret;
121 }
122
vfio_legacy_dma_unmap_one(const VFIOContainerBase * bcontainer,hwaddr iova,ram_addr_t size,IOMMUTLBEntry * iotlb)123 static int vfio_legacy_dma_unmap_one(const VFIOContainerBase *bcontainer,
124 hwaddr iova, ram_addr_t size,
125 IOMMUTLBEntry *iotlb)
126 {
127 const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
128 bcontainer);
129 struct vfio_iommu_type1_dma_unmap unmap = {
130 .argsz = sizeof(unmap),
131 .flags = 0,
132 .iova = iova,
133 .size = size,
134 };
135 bool need_dirty_sync = false;
136 int ret;
137 Error *local_err = NULL;
138
139 g_assert(!cpr_is_incoming());
140
141 if (iotlb && vfio_container_dirty_tracking_is_started(bcontainer)) {
142 if (!vfio_container_devices_dirty_tracking_is_supported(bcontainer) &&
143 bcontainer->dirty_pages_supported) {
144 return vfio_dma_unmap_bitmap(container, iova, size, iotlb);
145 }
146
147 need_dirty_sync = true;
148 }
149
150 while (ioctl(container->fd, VFIO_IOMMU_UNMAP_DMA, &unmap)) {
151 /*
152 * The type1 backend has an off-by-one bug in the kernel (71a7d3d78e3c
153 * v4.15) where an overflow in its wrap-around check prevents us from
154 * unmapping the last page of the address space. Test for the error
155 * condition and re-try the unmap excluding the last page. The
156 * expectation is that we've never mapped the last page anyway and this
157 * unmap request comes via vIOMMU support which also makes it unlikely
158 * that this page is used. This bug was introduced well after type1 v2
159 * support was introduced, so we shouldn't need to test for v1. A fix
160 * is queued for kernel v5.0 so this workaround can be removed once
161 * affected kernels are sufficiently deprecated.
162 */
163 if (errno == EINVAL && unmap.size && !(unmap.iova + unmap.size) &&
164 container->iommu_type == VFIO_TYPE1v2_IOMMU) {
165 trace_vfio_legacy_dma_unmap_overflow_workaround();
166 unmap.size -= 1ULL << ctz64(bcontainer->pgsizes);
167 continue;
168 }
169 return -errno;
170 }
171
172 if (need_dirty_sync) {
173 ret = vfio_container_query_dirty_bitmap(bcontainer, iova, size,
174 iotlb->translated_addr, &local_err);
175 if (ret) {
176 error_report_err(local_err);
177 return ret;
178 }
179 }
180
181 return 0;
182 }
183
184 /*
185 * DMA - Mapping and unmapping for the "type1" IOMMU interface used on x86
186 */
vfio_legacy_dma_unmap(const VFIOContainerBase * bcontainer,hwaddr iova,ram_addr_t size,IOMMUTLBEntry * iotlb,bool unmap_all)187 static int vfio_legacy_dma_unmap(const VFIOContainerBase *bcontainer,
188 hwaddr iova, ram_addr_t size,
189 IOMMUTLBEntry *iotlb, bool unmap_all)
190 {
191 int ret;
192
193 if (unmap_all) {
194 /* The unmap ioctl doesn't accept a full 64-bit span. */
195 Int128 llsize = int128_rshift(int128_2_64(), 1);
196
197 ret = vfio_legacy_dma_unmap_one(bcontainer, 0, int128_get64(llsize),
198 iotlb);
199
200 if (ret == 0) {
201 ret = vfio_legacy_dma_unmap_one(bcontainer, int128_get64(llsize),
202 int128_get64(llsize), iotlb);
203 }
204
205 } else {
206 ret = vfio_legacy_dma_unmap_one(bcontainer, iova, size, iotlb);
207 }
208
209 return ret;
210 }
211
vfio_legacy_dma_map(const VFIOContainerBase * bcontainer,hwaddr iova,ram_addr_t size,void * vaddr,bool readonly,MemoryRegion * mr)212 static int vfio_legacy_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
213 ram_addr_t size, void *vaddr, bool readonly,
214 MemoryRegion *mr)
215 {
216 const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
217 bcontainer);
218 struct vfio_iommu_type1_dma_map map = {
219 .argsz = sizeof(map),
220 .flags = VFIO_DMA_MAP_FLAG_READ,
221 .vaddr = (__u64)(uintptr_t)vaddr,
222 .iova = iova,
223 .size = size,
224 };
225
226 if (!readonly) {
227 map.flags |= VFIO_DMA_MAP_FLAG_WRITE;
228 }
229
230 /*
231 * Try the mapping, if it fails with EBUSY, unmap the region and try
232 * again. This shouldn't be necessary, but we sometimes see it in
233 * the VGA ROM space.
234 */
235 if (ioctl(container->fd, VFIO_IOMMU_MAP_DMA, &map) == 0 ||
236 (errno == EBUSY &&
237 vfio_legacy_dma_unmap(bcontainer, iova, size, NULL, false) == 0 &&
238 ioctl(container->fd, VFIO_IOMMU_MAP_DMA, &map) == 0)) {
239 return 0;
240 }
241
242 return -errno;
243 }
244
245 static int
vfio_legacy_set_dirty_page_tracking(const VFIOContainerBase * bcontainer,bool start,Error ** errp)246 vfio_legacy_set_dirty_page_tracking(const VFIOContainerBase *bcontainer,
247 bool start, Error **errp)
248 {
249 const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
250 bcontainer);
251 int ret;
252 struct vfio_iommu_type1_dirty_bitmap dirty = {
253 .argsz = sizeof(dirty),
254 };
255
256 if (start) {
257 dirty.flags = VFIO_IOMMU_DIRTY_PAGES_FLAG_START;
258 } else {
259 dirty.flags = VFIO_IOMMU_DIRTY_PAGES_FLAG_STOP;
260 }
261
262 ret = ioctl(container->fd, VFIO_IOMMU_DIRTY_PAGES, &dirty);
263 if (ret) {
264 ret = -errno;
265 error_setg_errno(errp, errno, "Failed to set dirty tracking flag 0x%x",
266 dirty.flags);
267 }
268
269 return ret;
270 }
271
vfio_legacy_query_dirty_bitmap(const VFIOContainerBase * bcontainer,VFIOBitmap * vbmap,hwaddr iova,hwaddr size,Error ** errp)272 static int vfio_legacy_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
273 VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp)
274 {
275 const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
276 bcontainer);
277 struct vfio_iommu_type1_dirty_bitmap *dbitmap;
278 struct vfio_iommu_type1_dirty_bitmap_get *range;
279 int ret;
280
281 dbitmap = g_malloc0(sizeof(*dbitmap) + sizeof(*range));
282
283 dbitmap->argsz = sizeof(*dbitmap) + sizeof(*range);
284 dbitmap->flags = VFIO_IOMMU_DIRTY_PAGES_FLAG_GET_BITMAP;
285 range = (struct vfio_iommu_type1_dirty_bitmap_get *)&dbitmap->data;
286 range->iova = iova;
287 range->size = size;
288
289 /*
290 * cpu_physical_memory_set_dirty_lebitmap() supports pages in bitmap of
291 * qemu_real_host_page_size to mark those dirty. Hence set bitmap's pgsize
292 * to qemu_real_host_page_size.
293 */
294 range->bitmap.pgsize = qemu_real_host_page_size();
295 range->bitmap.size = vbmap->size;
296 range->bitmap.data = (__u64 *)vbmap->bitmap;
297
298 ret = ioctl(container->fd, VFIO_IOMMU_DIRTY_PAGES, dbitmap);
299 if (ret) {
300 ret = -errno;
301 error_setg_errno(errp, errno,
302 "Failed to get dirty bitmap for iova: 0x%"PRIx64
303 " size: 0x%"PRIx64, (uint64_t)range->iova,
304 (uint64_t)range->size);
305 }
306
307 g_free(dbitmap);
308
309 return ret;
310 }
311
vfio_get_info_iova_range(struct vfio_iommu_type1_info * info,VFIOContainerBase * bcontainer)312 static bool vfio_get_info_iova_range(struct vfio_iommu_type1_info *info,
313 VFIOContainerBase *bcontainer)
314 {
315 struct vfio_info_cap_header *hdr;
316 struct vfio_iommu_type1_info_cap_iova_range *cap;
317
318 hdr = vfio_get_iommu_type1_info_cap(info,
319 VFIO_IOMMU_TYPE1_INFO_CAP_IOVA_RANGE);
320 if (!hdr) {
321 return false;
322 }
323
324 cap = (void *)hdr;
325
326 for (int i = 0; i < cap->nr_iovas; i++) {
327 Range *range = g_new(Range, 1);
328
329 range_set_bounds(range, cap->iova_ranges[i].start,
330 cap->iova_ranges[i].end);
331 bcontainer->iova_ranges =
332 range_list_insert(bcontainer->iova_ranges, range);
333 }
334
335 return true;
336 }
337
vfio_group_add_kvm_device(VFIOGroup * group)338 static void vfio_group_add_kvm_device(VFIOGroup *group)
339 {
340 Error *err = NULL;
341
342 if (vfio_kvm_device_add_fd(group->fd, &err)) {
343 error_reportf_err(err, "group ID %d: ", group->groupid);
344 }
345 }
346
vfio_group_del_kvm_device(VFIOGroup * group)347 static void vfio_group_del_kvm_device(VFIOGroup *group)
348 {
349 Error *err = NULL;
350
351 if (vfio_kvm_device_del_fd(group->fd, &err)) {
352 error_reportf_err(err, "group ID %d: ", group->groupid);
353 }
354 }
355
356 /*
357 * vfio_get_iommu_type - selects the richest iommu_type (v2 first)
358 */
vfio_get_iommu_type(int container_fd,Error ** errp)359 static int vfio_get_iommu_type(int container_fd,
360 Error **errp)
361 {
362 int iommu_types[] = { VFIO_TYPE1v2_IOMMU, VFIO_TYPE1_IOMMU,
363 VFIO_SPAPR_TCE_v2_IOMMU, VFIO_SPAPR_TCE_IOMMU };
364 int i;
365
366 for (i = 0; i < ARRAY_SIZE(iommu_types); i++) {
367 if (ioctl(container_fd, VFIO_CHECK_EXTENSION, iommu_types[i])) {
368 return iommu_types[i];
369 }
370 }
371 error_setg(errp, "No available IOMMU models");
372 return -EINVAL;
373 }
374
375 /*
376 * vfio_get_iommu_ops - get a VFIOIOMMUClass associated with a type
377 */
vfio_get_iommu_class_name(int iommu_type)378 static const char *vfio_get_iommu_class_name(int iommu_type)
379 {
380 switch (iommu_type) {
381 case VFIO_TYPE1v2_IOMMU:
382 case VFIO_TYPE1_IOMMU:
383 return TYPE_VFIO_IOMMU_LEGACY;
384 break;
385 case VFIO_SPAPR_TCE_v2_IOMMU:
386 case VFIO_SPAPR_TCE_IOMMU:
387 return TYPE_VFIO_IOMMU_SPAPR;
388 break;
389 default:
390 g_assert_not_reached();
391 };
392 }
393
vfio_set_iommu(int container_fd,int group_fd,int * iommu_type,Error ** errp)394 static bool vfio_set_iommu(int container_fd, int group_fd,
395 int *iommu_type, Error **errp)
396 {
397 if (ioctl(group_fd, VFIO_GROUP_SET_CONTAINER, &container_fd)) {
398 error_setg_errno(errp, errno, "Failed to set group container");
399 return false;
400 }
401
402 while (ioctl(container_fd, VFIO_SET_IOMMU, *iommu_type)) {
403 if (*iommu_type == VFIO_SPAPR_TCE_v2_IOMMU) {
404 /*
405 * On sPAPR, despite the IOMMU subdriver always advertises v1 and
406 * v2, the running platform may not support v2 and there is no
407 * way to guess it until an IOMMU group gets added to the container.
408 * So in case it fails with v2, try v1 as a fallback.
409 */
410 *iommu_type = VFIO_SPAPR_TCE_IOMMU;
411 continue;
412 }
413 error_setg_errno(errp, errno, "Failed to set iommu for container");
414 return false;
415 }
416
417 return true;
418 }
419
vfio_create_container(int fd,VFIOGroup * group,Error ** errp)420 static VFIOContainer *vfio_create_container(int fd, VFIOGroup *group,
421 Error **errp)
422 {
423 int iommu_type;
424 const char *vioc_name;
425 VFIOContainer *container;
426
427 iommu_type = vfio_get_iommu_type(fd, errp);
428 if (iommu_type < 0) {
429 return NULL;
430 }
431
432 /*
433 * During CPR, just set the container type and skip the ioctls, as the
434 * container and group are already configured in the kernel.
435 */
436 if (!cpr_is_incoming() &&
437 !vfio_set_iommu(fd, group->fd, &iommu_type, errp)) {
438 return NULL;
439 }
440
441 vioc_name = vfio_get_iommu_class_name(iommu_type);
442
443 container = VFIO_IOMMU_LEGACY(object_new(vioc_name));
444 container->fd = fd;
445 container->iommu_type = iommu_type;
446 return container;
447 }
448
vfio_get_iommu_info(VFIOContainer * container,struct vfio_iommu_type1_info ** info)449 static int vfio_get_iommu_info(VFIOContainer *container,
450 struct vfio_iommu_type1_info **info)
451 {
452
453 size_t argsz = sizeof(struct vfio_iommu_type1_info);
454
455 *info = g_new0(struct vfio_iommu_type1_info, 1);
456 again:
457 (*info)->argsz = argsz;
458
459 if (ioctl(container->fd, VFIO_IOMMU_GET_INFO, *info)) {
460 g_free(*info);
461 *info = NULL;
462 return -errno;
463 }
464
465 if (((*info)->argsz > argsz)) {
466 argsz = (*info)->argsz;
467 *info = g_realloc(*info, argsz);
468 goto again;
469 }
470
471 return 0;
472 }
473
474 static struct vfio_info_cap_header *
vfio_get_iommu_info_cap(struct vfio_iommu_type1_info * info,uint16_t id)475 vfio_get_iommu_info_cap(struct vfio_iommu_type1_info *info, uint16_t id)
476 {
477 struct vfio_info_cap_header *hdr;
478 void *ptr = info;
479
480 if (!(info->flags & VFIO_IOMMU_INFO_CAPS)) {
481 return NULL;
482 }
483
484 for (hdr = ptr + info->cap_offset; hdr != ptr; hdr = ptr + hdr->next) {
485 if (hdr->id == id) {
486 return hdr;
487 }
488 }
489
490 return NULL;
491 }
492
vfio_get_iommu_info_migration(VFIOContainer * container,struct vfio_iommu_type1_info * info)493 static void vfio_get_iommu_info_migration(VFIOContainer *container,
494 struct vfio_iommu_type1_info *info)
495 {
496 struct vfio_info_cap_header *hdr;
497 struct vfio_iommu_type1_info_cap_migration *cap_mig;
498 VFIOContainerBase *bcontainer = &container->bcontainer;
499
500 hdr = vfio_get_iommu_info_cap(info, VFIO_IOMMU_TYPE1_INFO_CAP_MIGRATION);
501 if (!hdr) {
502 return;
503 }
504
505 cap_mig = container_of(hdr, struct vfio_iommu_type1_info_cap_migration,
506 header);
507
508 /*
509 * cpu_physical_memory_set_dirty_lebitmap() supports pages in bitmap of
510 * qemu_real_host_page_size to mark those dirty.
511 */
512 if (cap_mig->pgsize_bitmap & qemu_real_host_page_size()) {
513 bcontainer->dirty_pages_supported = true;
514 bcontainer->max_dirty_bitmap_size = cap_mig->max_dirty_bitmap_size;
515 bcontainer->dirty_pgsizes = cap_mig->pgsize_bitmap;
516 }
517 }
518
vfio_legacy_setup(VFIOContainerBase * bcontainer,Error ** errp)519 static bool vfio_legacy_setup(VFIOContainerBase *bcontainer, Error **errp)
520 {
521 VFIOContainer *container = container_of(bcontainer, VFIOContainer,
522 bcontainer);
523 g_autofree struct vfio_iommu_type1_info *info = NULL;
524 int ret;
525
526 ret = vfio_get_iommu_info(container, &info);
527 if (ret) {
528 error_setg_errno(errp, -ret, "Failed to get VFIO IOMMU info");
529 return false;
530 }
531
532 if (info->flags & VFIO_IOMMU_INFO_PGSIZES) {
533 bcontainer->pgsizes = info->iova_pgsizes;
534 } else {
535 bcontainer->pgsizes = qemu_real_host_page_size();
536 }
537
538 if (!vfio_get_info_dma_avail(info, &bcontainer->dma_max_mappings)) {
539 bcontainer->dma_max_mappings = 65535;
540 }
541
542 vfio_get_info_iova_range(info, bcontainer);
543
544 vfio_get_iommu_info_migration(container, info);
545 return true;
546 }
547
vfio_container_attach_discard_disable(VFIOContainer * container,VFIOGroup * group,Error ** errp)548 static bool vfio_container_attach_discard_disable(VFIOContainer *container,
549 VFIOGroup *group, Error **errp)
550 {
551 int ret;
552
553 /*
554 * VFIO is currently incompatible with discarding of RAM insofar as the
555 * madvise to purge (zap) the page from QEMU's address space does not
556 * interact with the memory API and therefore leaves stale virtual to
557 * physical mappings in the IOMMU if the page was previously pinned. We
558 * therefore set discarding broken for each group added to a container,
559 * whether the container is used individually or shared. This provides
560 * us with options to allow devices within a group to opt-in and allow
561 * discarding, so long as it is done consistently for a group (for instance
562 * if the device is an mdev device where it is known that the host vendor
563 * driver will never pin pages outside of the working set of the guest
564 * driver, which would thus not be discarding candidates).
565 *
566 * The first opportunity to induce pinning occurs here where we attempt to
567 * attach the group to existing containers within the AddressSpace. If any
568 * pages are already zapped from the virtual address space, such as from
569 * previous discards, new pinning will cause valid mappings to be
570 * re-established. Likewise, when the overall MemoryListener for a new
571 * container is registered, a replay of mappings within the AddressSpace
572 * will occur, re-establishing any previously zapped pages as well.
573 *
574 * Especially virtio-balloon is currently only prevented from discarding
575 * new memory, it will not yet set ram_block_discard_set_required() and
576 * therefore, neither stops us here or deals with the sudden memory
577 * consumption of inflated memory.
578 *
579 * We do support discarding of memory coordinated via the RamDiscardManager
580 * with some IOMMU types. vfio_ram_block_discard_disable() handles the
581 * details once we know which type of IOMMU we are using.
582 */
583
584 ret = vfio_ram_block_discard_disable(container, true);
585 if (ret) {
586 error_setg_errno(errp, -ret, "Cannot set discarding of RAM broken");
587 if (ioctl(group->fd, VFIO_GROUP_UNSET_CONTAINER, &container->fd)) {
588 error_report("vfio: error disconnecting group %d from"
589 " container", group->groupid);
590 }
591 }
592 return !ret;
593 }
594
vfio_container_group_add(VFIOContainer * container,VFIOGroup * group,Error ** errp)595 static bool vfio_container_group_add(VFIOContainer *container, VFIOGroup *group,
596 Error **errp)
597 {
598 if (!vfio_container_attach_discard_disable(container, group, errp)) {
599 return false;
600 }
601 group->container = container;
602 QLIST_INSERT_HEAD(&container->group_list, group, container_next);
603 vfio_group_add_kvm_device(group);
604 /*
605 * Remember the container fd for each group, so we can attach to the same
606 * container after CPR.
607 */
608 cpr_resave_fd("vfio_container_for_group", group->groupid, container->fd);
609 return true;
610 }
611
vfio_container_group_del(VFIOContainer * container,VFIOGroup * group)612 static void vfio_container_group_del(VFIOContainer *container, VFIOGroup *group)
613 {
614 QLIST_REMOVE(group, container_next);
615 group->container = NULL;
616 vfio_group_del_kvm_device(group);
617 vfio_ram_block_discard_disable(container, false);
618 cpr_delete_fd("vfio_container_for_group", group->groupid);
619 }
620
vfio_container_connect(VFIOGroup * group,AddressSpace * as,Error ** errp)621 static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
622 Error **errp)
623 {
624 VFIOContainer *container;
625 VFIOContainerBase *bcontainer;
626 int ret, fd = -1;
627 VFIOAddressSpace *space;
628 VFIOIOMMUClass *vioc = NULL;
629 bool new_container = false;
630 bool group_was_added = false;
631
632 space = vfio_address_space_get(as);
633 fd = cpr_find_fd("vfio_container_for_group", group->groupid);
634
635 if (!cpr_is_incoming()) {
636 QLIST_FOREACH(bcontainer, &space->containers, next) {
637 container = container_of(bcontainer, VFIOContainer, bcontainer);
638 if (!ioctl(group->fd, VFIO_GROUP_SET_CONTAINER, &container->fd)) {
639 return vfio_container_group_add(container, group, errp);
640 }
641 }
642
643 fd = qemu_open("/dev/vfio/vfio", O_RDWR, errp);
644 if (fd < 0) {
645 goto fail;
646 }
647 } else {
648 /*
649 * For incoming CPR, the group is already attached in the kernel.
650 * If a container with matching fd is found, then update the
651 * userland group list and return. If not, then after the loop,
652 * create the container struct and group list.
653 */
654 QLIST_FOREACH(bcontainer, &space->containers, next) {
655 container = container_of(bcontainer, VFIOContainer, bcontainer);
656
657 if (vfio_cpr_container_match(container, group, fd)) {
658 return vfio_container_group_add(container, group, errp);
659 }
660 }
661 }
662
663 ret = ioctl(fd, VFIO_GET_API_VERSION);
664 if (ret != VFIO_API_VERSION) {
665 error_setg(errp, "supported vfio version: %d, "
666 "reported version: %d", VFIO_API_VERSION, ret);
667 goto fail;
668 }
669
670 container = vfio_create_container(fd, group, errp);
671 if (!container) {
672 goto fail;
673 }
674 new_container = true;
675 bcontainer = &container->bcontainer;
676
677 if (!vfio_legacy_cpr_register_container(container, errp)) {
678 goto fail;
679 }
680
681 vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
682 assert(vioc->setup);
683
684 if (!vioc->setup(bcontainer, errp)) {
685 goto fail;
686 }
687
688 vfio_address_space_insert(space, bcontainer);
689
690 if (!vfio_container_group_add(container, group, errp)) {
691 goto fail;
692 }
693 group_was_added = true;
694
695 /*
696 * If CPR, register the listener later, after all state that may
697 * affect regions and mapping boundaries has been cpr load'ed. Later,
698 * the listener will invoke its callback on each flat section and call
699 * dma_map to supply the new vaddr, and the calls will match the mappings
700 * remembered by the kernel.
701 */
702 if (!cpr_is_incoming()) {
703 if (!vfio_listener_register(bcontainer, errp)) {
704 goto fail;
705 }
706 }
707
708 bcontainer->initialized = true;
709
710 return true;
711
712 fail:
713 vfio_listener_unregister(bcontainer);
714
715 if (group_was_added) {
716 vfio_container_group_del(container, group);
717 }
718 if (vioc && vioc->release) {
719 vioc->release(bcontainer);
720 }
721 if (new_container) {
722 vfio_legacy_cpr_unregister_container(container);
723 object_unref(container);
724 }
725 if (fd >= 0) {
726 close(fd);
727 }
728 vfio_address_space_put(space);
729
730 return false;
731 }
732
vfio_container_disconnect(VFIOGroup * group)733 static void vfio_container_disconnect(VFIOGroup *group)
734 {
735 VFIOContainer *container = group->container;
736 VFIOContainerBase *bcontainer = &container->bcontainer;
737 VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
738
739 QLIST_REMOVE(group, container_next);
740 group->container = NULL;
741 cpr_delete_fd("vfio_container_for_group", group->groupid);
742
743 /*
744 * Explicitly release the listener first before unset container,
745 * since unset may destroy the backend container if it's the last
746 * group.
747 */
748 if (QLIST_EMPTY(&container->group_list)) {
749 vfio_listener_unregister(bcontainer);
750 if (vioc->release) {
751 vioc->release(bcontainer);
752 }
753 }
754
755 if (ioctl(group->fd, VFIO_GROUP_UNSET_CONTAINER, &container->fd)) {
756 error_report("vfio: error disconnecting group %d from container",
757 group->groupid);
758 }
759
760 if (QLIST_EMPTY(&container->group_list)) {
761 VFIOAddressSpace *space = bcontainer->space;
762
763 trace_vfio_container_disconnect(container->fd);
764 vfio_legacy_cpr_unregister_container(container);
765 close(container->fd);
766 object_unref(container);
767
768 vfio_address_space_put(space);
769 }
770 }
771
vfio_group_get(int groupid,AddressSpace * as,Error ** errp)772 static VFIOGroup *vfio_group_get(int groupid, AddressSpace *as, Error **errp)
773 {
774 ERRP_GUARD();
775 VFIOGroup *group;
776 char path[32];
777 struct vfio_group_status status = { .argsz = sizeof(status) };
778
779 QLIST_FOREACH(group, &vfio_group_list, next) {
780 if (group->groupid == groupid) {
781 /* Found it. Now is it already in the right context? */
782 if (group->container->bcontainer.space->as == as) {
783 return group;
784 } else {
785 error_setg(errp, "group %d used in multiple address spaces",
786 group->groupid);
787 return NULL;
788 }
789 }
790 }
791
792 group = g_malloc0(sizeof(*group));
793
794 snprintf(path, sizeof(path), "/dev/vfio/%d", groupid);
795 group->fd = cpr_open_fd(path, O_RDWR, "vfio_group", groupid, errp);
796 if (group->fd < 0) {
797 goto free_group_exit;
798 }
799
800 if (ioctl(group->fd, VFIO_GROUP_GET_STATUS, &status)) {
801 error_setg_errno(errp, errno, "failed to get group %d status", groupid);
802 goto close_fd_exit;
803 }
804
805 if (!(status.flags & VFIO_GROUP_FLAGS_VIABLE)) {
806 error_setg(errp, "group %d is not viable", groupid);
807 error_append_hint(errp,
808 "Please ensure all devices within the iommu_group "
809 "are bound to their vfio bus driver.\n");
810 goto close_fd_exit;
811 }
812
813 group->groupid = groupid;
814 QLIST_INIT(&group->device_list);
815
816 if (!vfio_container_connect(group, as, errp)) {
817 error_prepend(errp, "failed to setup container for group %d: ",
818 groupid);
819 goto close_fd_exit;
820 }
821
822 QLIST_INSERT_HEAD(&vfio_group_list, group, next);
823
824 return group;
825
826 close_fd_exit:
827 cpr_delete_fd("vfio_group", groupid);
828 close(group->fd);
829
830 free_group_exit:
831 g_free(group);
832
833 return NULL;
834 }
835
vfio_group_put(VFIOGroup * group)836 static void vfio_group_put(VFIOGroup *group)
837 {
838 if (!group || !QLIST_EMPTY(&group->device_list)) {
839 return;
840 }
841
842 if (!group->ram_block_discard_allowed) {
843 vfio_ram_block_discard_disable(group->container, false);
844 }
845 vfio_group_del_kvm_device(group);
846 vfio_container_disconnect(group);
847 QLIST_REMOVE(group, next);
848 trace_vfio_group_put(group->fd);
849 cpr_delete_fd("vfio_group", group->groupid);
850 close(group->fd);
851 g_free(group);
852 }
853
vfio_device_get(VFIOGroup * group,const char * name,VFIODevice * vbasedev,Error ** errp)854 static bool vfio_device_get(VFIOGroup *group, const char *name,
855 VFIODevice *vbasedev, Error **errp)
856 {
857 g_autofree struct vfio_device_info *info = NULL;
858 int fd;
859
860 fd = vfio_cpr_group_get_device_fd(group->fd, name);
861 if (fd < 0) {
862 error_setg_errno(errp, errno, "error getting device from group %d",
863 group->groupid);
864 error_append_hint(errp,
865 "Verify all devices in group %d are bound to vfio-<bus> "
866 "or pci-stub and not already in use\n", group->groupid);
867 return false;
868 }
869
870 info = vfio_get_device_info(fd);
871 if (!info) {
872 error_setg_errno(errp, errno, "error getting device info");
873 goto fail;
874 }
875
876 /*
877 * Set discarding of RAM as not broken for this group if the driver knows
878 * the device operates compatibly with discarding. Setting must be
879 * consistent per group, but since compatibility is really only possible
880 * with mdev currently, we expect singleton groups.
881 */
882 if (vbasedev->ram_block_discard_allowed !=
883 group->ram_block_discard_allowed) {
884 if (!QLIST_EMPTY(&group->device_list)) {
885 error_setg(errp, "Inconsistent setting of support for discarding "
886 "RAM (e.g., balloon) within group");
887 goto fail;
888 }
889
890 if (!group->ram_block_discard_allowed) {
891 group->ram_block_discard_allowed = true;
892 vfio_ram_block_discard_disable(group->container, false);
893 }
894 }
895
896 vfio_device_prepare(vbasedev, &group->container->bcontainer, info);
897
898 vbasedev->fd = fd;
899 vbasedev->group = group;
900 QLIST_INSERT_HEAD(&group->device_list, vbasedev, next);
901
902 trace_vfio_device_get(name, info->flags, info->num_regions, info->num_irqs);
903
904 return true;
905
906 fail:
907 close(fd);
908 cpr_delete_fd(name, 0);
909 return false;
910 }
911
vfio_device_put(VFIODevice * vbasedev)912 static void vfio_device_put(VFIODevice *vbasedev)
913 {
914 if (!vbasedev->group) {
915 return;
916 }
917 QLIST_REMOVE(vbasedev, next);
918 vbasedev->group = NULL;
919 trace_vfio_device_put(vbasedev->fd);
920 cpr_delete_fd(vbasedev->name, 0);
921 close(vbasedev->fd);
922 }
923
vfio_device_get_groupid(VFIODevice * vbasedev,Error ** errp)924 static int vfio_device_get_groupid(VFIODevice *vbasedev, Error **errp)
925 {
926 char *tmp, group_path[PATH_MAX];
927 g_autofree char *group_name = NULL;
928 int ret, groupid;
929 ssize_t len;
930
931 tmp = g_strdup_printf("%s/iommu_group", vbasedev->sysfsdev);
932 len = readlink(tmp, group_path, sizeof(group_path));
933 g_free(tmp);
934
935 if (len <= 0 || len >= sizeof(group_path)) {
936 ret = len < 0 ? -errno : -ENAMETOOLONG;
937 error_setg_errno(errp, -ret, "no iommu_group found");
938 return ret;
939 }
940
941 group_path[len] = 0;
942
943 group_name = g_path_get_basename(group_path);
944 if (sscanf(group_name, "%d", &groupid) != 1) {
945 error_setg_errno(errp, errno, "failed to read %s", group_path);
946 return -errno;
947 }
948 return groupid;
949 }
950
951 /*
952 * vfio_device_attach: attach a device to a security context
953 * @name and @vbasedev->name are likely to be different depending
954 * on the type of the device, hence the need for passing @name
955 */
vfio_legacy_attach_device(const char * name,VFIODevice * vbasedev,AddressSpace * as,Error ** errp)956 static bool vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
957 AddressSpace *as, Error **errp)
958 {
959 int groupid = vfio_device_get_groupid(vbasedev, errp);
960 VFIODevice *vbasedev_iter;
961 VFIOGroup *group;
962
963 if (groupid < 0) {
964 return false;
965 }
966
967 trace_vfio_device_attach(vbasedev->name, groupid);
968
969 group = vfio_group_get(groupid, as, errp);
970 if (!group) {
971 return false;
972 }
973
974 QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
975 if (strcmp(vbasedev_iter->name, vbasedev->name) == 0) {
976 error_setg(errp, "device is already attached");
977 goto group_put_exit;
978 }
979 }
980 if (!vfio_device_get(group, name, vbasedev, errp)) {
981 goto group_put_exit;
982 }
983
984 if (!vfio_device_hiod_create_and_realize(vbasedev,
985 TYPE_HOST_IOMMU_DEVICE_LEGACY_VFIO,
986 errp)) {
987 goto device_put_exit;
988 }
989
990 if (vbasedev->mdev) {
991 error_setg(&vbasedev->cpr.mdev_blocker,
992 "CPR does not support vfio mdev %s", vbasedev->name);
993 migrate_add_blocker_modes(&vbasedev->cpr.mdev_blocker, &error_fatal,
994 MIG_MODE_CPR_TRANSFER, -1);
995 }
996
997 return true;
998
999 device_put_exit:
1000 vfio_device_put(vbasedev);
1001 group_put_exit:
1002 vfio_group_put(group);
1003 return false;
1004 }
1005
vfio_legacy_detach_device(VFIODevice * vbasedev)1006 static void vfio_legacy_detach_device(VFIODevice *vbasedev)
1007 {
1008 VFIOGroup *group = vbasedev->group;
1009
1010 trace_vfio_device_detach(vbasedev->name, group->groupid);
1011
1012 vfio_device_unprepare(vbasedev);
1013
1014 migrate_del_blocker(&vbasedev->cpr.mdev_blocker);
1015 object_unref(vbasedev->hiod);
1016 vfio_device_put(vbasedev);
1017 vfio_group_put(group);
1018 }
1019
vfio_legacy_pci_hot_reset(VFIODevice * vbasedev,bool single)1020 static int vfio_legacy_pci_hot_reset(VFIODevice *vbasedev, bool single)
1021 {
1022 VFIOPCIDevice *vdev = container_of(vbasedev, VFIOPCIDevice, vbasedev);
1023 VFIOGroup *group;
1024 struct vfio_pci_hot_reset_info *info = NULL;
1025 struct vfio_pci_dependent_device *devices;
1026 struct vfio_pci_hot_reset *reset;
1027 int32_t *fds;
1028 int ret, i, count;
1029 bool multi = false;
1030
1031 trace_vfio_pci_hot_reset(vdev->vbasedev.name, single ? "one" : "multi");
1032
1033 if (!single) {
1034 vfio_pci_pre_reset(vdev);
1035 }
1036 vdev->vbasedev.needs_reset = false;
1037
1038 ret = vfio_pci_get_pci_hot_reset_info(vdev, &info);
1039
1040 if (ret) {
1041 goto out_single;
1042 }
1043 devices = &info->devices[0];
1044
1045 trace_vfio_pci_hot_reset_has_dep_devices(vdev->vbasedev.name);
1046
1047 /* Verify that we have all the groups required */
1048 for (i = 0; i < info->count; i++) {
1049 PCIHostDeviceAddress host;
1050 VFIOPCIDevice *tmp;
1051 VFIODevice *vbasedev_iter;
1052
1053 host.domain = devices[i].segment;
1054 host.bus = devices[i].bus;
1055 host.slot = PCI_SLOT(devices[i].devfn);
1056 host.function = PCI_FUNC(devices[i].devfn);
1057
1058 trace_vfio_pci_hot_reset_dep_devices(host.domain,
1059 host.bus, host.slot, host.function, devices[i].group_id);
1060
1061 if (vfio_pci_host_match(&host, vdev->vbasedev.name)) {
1062 continue;
1063 }
1064
1065 QLIST_FOREACH(group, &vfio_group_list, next) {
1066 if (group->groupid == devices[i].group_id) {
1067 break;
1068 }
1069 }
1070
1071 if (!group) {
1072 if (!vdev->has_pm_reset) {
1073 error_report("vfio: Cannot reset device %s, "
1074 "depends on group %d which is not owned.",
1075 vdev->vbasedev.name, devices[i].group_id);
1076 }
1077 ret = -EPERM;
1078 goto out;
1079 }
1080
1081 /* Prep dependent devices for reset and clear our marker. */
1082 QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
1083 if (!vbasedev_iter->dev->realized ||
1084 vbasedev_iter->type != VFIO_DEVICE_TYPE_PCI) {
1085 continue;
1086 }
1087 tmp = container_of(vbasedev_iter, VFIOPCIDevice, vbasedev);
1088 if (vfio_pci_host_match(&host, tmp->vbasedev.name)) {
1089 if (single) {
1090 ret = -EINVAL;
1091 goto out_single;
1092 }
1093 vfio_pci_pre_reset(tmp);
1094 tmp->vbasedev.needs_reset = false;
1095 multi = true;
1096 break;
1097 }
1098 }
1099 }
1100
1101 if (!single && !multi) {
1102 ret = -EINVAL;
1103 goto out_single;
1104 }
1105
1106 /* Determine how many group fds need to be passed */
1107 count = 0;
1108 QLIST_FOREACH(group, &vfio_group_list, next) {
1109 for (i = 0; i < info->count; i++) {
1110 if (group->groupid == devices[i].group_id) {
1111 count++;
1112 break;
1113 }
1114 }
1115 }
1116
1117 reset = g_malloc0(sizeof(*reset) + (count * sizeof(*fds)));
1118 reset->argsz = sizeof(*reset) + (count * sizeof(*fds));
1119 fds = &reset->group_fds[0];
1120
1121 /* Fill in group fds */
1122 QLIST_FOREACH(group, &vfio_group_list, next) {
1123 for (i = 0; i < info->count; i++) {
1124 if (group->groupid == devices[i].group_id) {
1125 fds[reset->count++] = group->fd;
1126 break;
1127 }
1128 }
1129 }
1130
1131 /* Bus reset! */
1132 ret = ioctl(vdev->vbasedev.fd, VFIO_DEVICE_PCI_HOT_RESET, reset);
1133 g_free(reset);
1134 if (ret) {
1135 ret = -errno;
1136 }
1137
1138 trace_vfio_pci_hot_reset_result(vdev->vbasedev.name,
1139 ret ? strerror(errno) : "Success");
1140
1141 out:
1142 /* Re-enable INTx on affected devices */
1143 for (i = 0; i < info->count; i++) {
1144 PCIHostDeviceAddress host;
1145 VFIOPCIDevice *tmp;
1146 VFIODevice *vbasedev_iter;
1147
1148 host.domain = devices[i].segment;
1149 host.bus = devices[i].bus;
1150 host.slot = PCI_SLOT(devices[i].devfn);
1151 host.function = PCI_FUNC(devices[i].devfn);
1152
1153 if (vfio_pci_host_match(&host, vdev->vbasedev.name)) {
1154 continue;
1155 }
1156
1157 QLIST_FOREACH(group, &vfio_group_list, next) {
1158 if (group->groupid == devices[i].group_id) {
1159 break;
1160 }
1161 }
1162
1163 if (!group) {
1164 break;
1165 }
1166
1167 QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
1168 if (!vbasedev_iter->dev->realized ||
1169 vbasedev_iter->type != VFIO_DEVICE_TYPE_PCI) {
1170 continue;
1171 }
1172 tmp = container_of(vbasedev_iter, VFIOPCIDevice, vbasedev);
1173 if (vfio_pci_host_match(&host, tmp->vbasedev.name)) {
1174 vfio_pci_post_reset(tmp);
1175 break;
1176 }
1177 }
1178 }
1179 out_single:
1180 if (!single) {
1181 vfio_pci_post_reset(vdev);
1182 }
1183 g_free(info);
1184
1185 return ret;
1186 }
1187
vfio_iommu_legacy_class_init(ObjectClass * klass,const void * data)1188 static void vfio_iommu_legacy_class_init(ObjectClass *klass, const void *data)
1189 {
1190 VFIOIOMMUClass *vioc = VFIO_IOMMU_CLASS(klass);
1191
1192 vioc->setup = vfio_legacy_setup;
1193 vioc->dma_map = vfio_legacy_dma_map;
1194 vioc->dma_unmap = vfio_legacy_dma_unmap;
1195 vioc->attach_device = vfio_legacy_attach_device;
1196 vioc->detach_device = vfio_legacy_detach_device;
1197 vioc->set_dirty_page_tracking = vfio_legacy_set_dirty_page_tracking;
1198 vioc->query_dirty_bitmap = vfio_legacy_query_dirty_bitmap;
1199 vioc->pci_hot_reset = vfio_legacy_pci_hot_reset;
1200 };
1201
hiod_legacy_vfio_realize(HostIOMMUDevice * hiod,void * opaque,Error ** errp)1202 static bool hiod_legacy_vfio_realize(HostIOMMUDevice *hiod, void *opaque,
1203 Error **errp)
1204 {
1205 VFIODevice *vdev = opaque;
1206
1207 hiod->name = g_strdup(vdev->name);
1208 hiod->agent = opaque;
1209
1210 return true;
1211 }
1212
hiod_legacy_vfio_get_cap(HostIOMMUDevice * hiod,int cap,Error ** errp)1213 static int hiod_legacy_vfio_get_cap(HostIOMMUDevice *hiod, int cap,
1214 Error **errp)
1215 {
1216 switch (cap) {
1217 case HOST_IOMMU_DEVICE_CAP_AW_BITS:
1218 return vfio_device_get_aw_bits(hiod->agent);
1219 default:
1220 error_setg(errp, "%s: unsupported capability %x", hiod->name, cap);
1221 return -EINVAL;
1222 }
1223 }
1224
1225 static GList *
hiod_legacy_vfio_get_iova_ranges(HostIOMMUDevice * hiod)1226 hiod_legacy_vfio_get_iova_ranges(HostIOMMUDevice *hiod)
1227 {
1228 VFIODevice *vdev = hiod->agent;
1229
1230 g_assert(vdev);
1231 return vfio_container_get_iova_ranges(vdev->bcontainer);
1232 }
1233
1234 static uint64_t
hiod_legacy_vfio_get_page_size_mask(HostIOMMUDevice * hiod)1235 hiod_legacy_vfio_get_page_size_mask(HostIOMMUDevice *hiod)
1236 {
1237 VFIODevice *vdev = hiod->agent;
1238
1239 g_assert(vdev);
1240 return vfio_container_get_page_size_mask(vdev->bcontainer);
1241 }
1242
vfio_iommu_legacy_instance_init(Object * obj)1243 static void vfio_iommu_legacy_instance_init(Object *obj)
1244 {
1245 VFIOContainer *container = VFIO_IOMMU_LEGACY(obj);
1246
1247 QLIST_INIT(&container->group_list);
1248 }
1249
hiod_legacy_vfio_class_init(ObjectClass * oc,const void * data)1250 static void hiod_legacy_vfio_class_init(ObjectClass *oc, const void *data)
1251 {
1252 HostIOMMUDeviceClass *hioc = HOST_IOMMU_DEVICE_CLASS(oc);
1253
1254 hioc->realize = hiod_legacy_vfio_realize;
1255 hioc->get_cap = hiod_legacy_vfio_get_cap;
1256 hioc->get_iova_ranges = hiod_legacy_vfio_get_iova_ranges;
1257 hioc->get_page_size_mask = hiod_legacy_vfio_get_page_size_mask;
1258 };
1259
1260 static const TypeInfo types[] = {
1261 {
1262 .name = TYPE_VFIO_IOMMU_LEGACY,
1263 .parent = TYPE_VFIO_IOMMU,
1264 .instance_init = vfio_iommu_legacy_instance_init,
1265 .instance_size = sizeof(VFIOContainer),
1266 .class_init = vfio_iommu_legacy_class_init,
1267 }, {
1268 .name = TYPE_HOST_IOMMU_DEVICE_LEGACY_VFIO,
1269 .parent = TYPE_HOST_IOMMU_DEVICE,
1270 .class_init = hiod_legacy_vfio_class_init,
1271 }
1272 };
1273
1274 DEFINE_TYPES(types)
1275