Hi, as these patches fixes legacy mode grabled grub screen they add
regression to UEFI guest where monitor won't woke up until grub timeout.
CMD used : -device
vfio-pci,host=00:02.0,id=igpu,addr=2.0,x-igd-legacy-mode=off,x-igd-lpc=on,romfile=/home/maan/QemuVMs/MyGopRomfiles/InteligdGopHD4600.rom
romfile is patched with intelgopdriver.efi from VfioIgdPkg repo.
Here is what i915 logs say in guest with patched qemu :
[ 10.823656] i915 0000:00:02.0: [drm] Found haswell (device ID 0412)
integrated display version 7.00 stepping N/A
[ 10.824300] i915 0000:00:02.0: [drm] VT-d active for gfx access
[ 10.824763] i915 0000:00:02.0: vgaarb: deactivate vga console
[ 10.824867] i915 0000:00:02.0: [drm] Using Transparent Hugepages
[ 10.824871] i915 0000:00:02.0: [drm] DMAR active, disabling use of
stolen memory
[ 10.832111] i915 0000:00:02.0: Invalid PCI ROM header signature:
expecting 0xaa55, got 0x0000
[ 10.832118] i915 0000:00:02.0: [drm] Failed to find VBIOS tables (VBT)
[ 10.832154] i915 0000:00:02.0: vgaarb: VGA decodes changed:
olddecodes=io+mem,decodes=io+mem:owns=io+mem
[ 10.842837] i915 0000:00:02.0: [drm] Registered 3 planes with drm panic
[ 10.850377] [drm] Initialized i915 1.6.0 for 0000:00:02.0 on minor 0
[ 11.678013] fbcon: i915drmfb (fb0) is primary device
[ 11.748610] i915 0000:00:02.0: [drm] fb0: i915drmfb frame buffer device
So look like VBT table is not expose to guest.
These are the logs of stock qemu with working grub and all :
[ 28.945622] i915 0000:00:02.0: [drm] Found haswell (device ID 0412)
integrated display version 7.00 stepping N/A
[ 28.946393] i915 0000:00:02.0: [drm] VT-d active for gfx access
[ 28.961770] i915 0000:00:02.0: vgaarb: deactivate vga console
[ 28.961830] i915 0000:00:02.0: [drm] Using Transparent Hugepages
[ 28.961833] i915 0000:00:02.0: [drm] DMAR active, disabling use of
stolen memory
[ 29.016673] i915 0000:00:02.0: vgaarb: VGA decodes changed:
olddecodes=io+mem,decodes=io+mem:owns=io+mem
[ 29.051910] i915 0000:00:02.0: [drm] Registered 3 planes with drm panic
[ 29.055360] [drm] Initialized i915 1.6.0 for 0000:00:02.0 on minor 1
[ 29.903202] fbcon: i915drmfb (fb0) is primary device
[ 29.990056] i915 0000:00:02.0: [drm] fb0: i915drmfb frame buffer device
Regards,
K S Maan
On 6/6/26 3:32 AM, Alex Williamson wrote:
On Thu, 4 Jun 2026 01:33:54 +0800
Tomita Moeko<[email protected]> wrote:
diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index 17437ae18d..e00f6f8315 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -739,3 +739,109 @@ bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev,
Error **errp)
return vfio_pci_igd_config_quirk(vdev, errp);
}
+
+/*
+ * IGD ROM BAR read from kernel is actually the host VBIOS shadow RAM region,
+ * which contains host modifications. In Gen 6-9 VBIOS, the routine below is
+ * used to get BDSM value when programming the initial GTT.
+ * xx xx xx xx v: .long ? # saved value
+ * 66 53 push %ebx
+ * 66 2e 83 3e xx xx 00 cmpl $0x0,%cs:v # is saved value empty?
+ * 74 07 je 1f # if zero, go compute
+ * 66 2e a1 xx xx mov %cs:v,%eax # else return saved
value
+ * eb 0f jmp 2f
+ * b8 5e 10 1: mov $0x105e,%ax # dev 00:02.0, offset 5E
+ * e8 xx xx call pci_read_cfg_word
+ * 66 c1 e0 10 shl $0x10,%eax # left shift 16 bits
+ * 66 2e a3 xx xx mov %eax,%cs:v # save the result
+ * 66 5b 2：pop %ebx
+ * c3 ret
+ * When running the VBIOS in guest, saved value still reflects the host stolen
+ * memory base address, which is not correct in guest. So we need to patch the
+ * VBIOS to clear the saved value.
+ *
+ * The unique 19-byte starts at `cmpl $0,%cs:v` and ends at `mov $0x105e,%ax`
+ * anchors the match to the routine. Both `cs:` displacements must reference
+ * the same offset.
+ */
Neat, cool quirk.
+static int igd_vbios_find_saved_bdsm(const uint8_t *rom, size_t rom_size,
+ uint16_t *bdsm_offset)
+{
+ static const uint8_t start[] = { 0x66, 0x2e, 0x83, 0x3e };
+ static const uint8_t middle[] = { 0x00, 0x74, 0x07, 0x66, 0x2e, 0xa1 };
+ static const uint8_t end[] = { 0xeb, 0x0f, 0xb8, 0x5e, 0x10 };
+ size_t i;
+ bool found = false;
+
+ if (rom_size < 19) {
+ return -ENOENT;
+ }
+
+ for (i = 0; i + 19 <= rom_size; i++) {
+ if (memcmp(rom + i, start, sizeof(start)) != 0 ||
+ memcmp(rom + i + 6, middle, sizeof(middle)) != 0 ||
+ memcmp(rom + i + 14, end, sizeof(end)) != 0) {
+ continue;
+ }
+
+ /* same saved value address? */
+ if (rom[i + 4] != rom[i + 12] || rom[i + 5] != rom[i + 13]) {
+ continue;
+ }
+
+ if (found) {
+ return -EEXIST;
+ }
+
+ *bdsm_offset = rom[i + 4] | ((uint16_t)rom[i + 5] << 8);
This needs a bounds check to make sure it's still within the ROM,
either here or before the memset().
+ found = true;
+ }
+
+ if (!found) {
+ return -ENOENT;
+ }
+
+ return 0;
+}
+
+void vfio_probe_igd_legacy_rom_quirk(VFIOPCIDevice *vdev)
+{
+ int ret, gen;
+ uint16_t pcir_offset, bdsm_offset = 0;
+ uint8_t checksum;
+
+ if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) ||
+ !vfio_is_vga(vdev) || !vdev->vga) {
+ return;
+ }
+
+ /* Only Gen 6~9 devices have legacy VBIOS as Option ROM */
+ gen = igd_gen(vdev);
+ if (gen < 6 || gen > 9) {
+ return;
+ }
+
+ if (pci_get_word(vdev->rom) != 0xaa55) {
+ return;
+ }
+
+ /* Must be a legacy ROM */
+ pcir_offset = pci_get_word(vdev->rom + 0x18);
+ if (pcir_offset >= vdev->rom_size ||
This gates the below test to pcir_offset + 0x14, so should be:
if (pcir_offset + 0x14 >= vdev->rom_size ||
+ memcmp(vdev->rom + pcir_offset, "PCIR", 4) ||
+ pci_get_byte(vdev->rom + pcir_offset + 0x14) != 0x00) {
+ return;
+ }
+
+ ret = igd_vbios_find_saved_bdsm(vdev->rom, vdev->rom_size, &bdsm_offset);
+ if (ret < 0) {
+ return;
+ }
+
+ memset(vdev->rom + bdsm_offset, 0, sizeof(uint32_t));
+
+ checksum = pci_rom_calculate_checksum(vdev->rom, vdev->rom_size);
+ ((uint8_t *)vdev->rom)[6] = checksum;
If updated per previous recommendation, this becomes:
((uint8_t *)vdev->rom)[6] -= checksum;
Thanks,
Alex
