On 7/21/26 20:05, Cédric Le Goater wrote:
From: Tomita Moeko <[email protected]>IGD does not come with a ROM BAR [1], the ROM BAR read by default from kernel is actually the host VBIOS shadow RAM region that contains host modifications on boot. With AI-assisted reverse engineering on VBIOS binaries, it is observed that VBIOS saves BDSM register value on first access and uses saved value if present. When the image is executed in guest, since there is already a saved HPA in VBIOS, it keeps using that value instead of the GPA programmed by SeaBIOS in BDSM register in PCI config space, causing VBIOS to program GTT entries with wrong address, resulting in garbled output in BIOS POST and the error below detected by i915 driver. i915 0000:00:02.0: [drm] *ERROR* Initial plane programming using invalid range, dma_addr=0x00000000db200000 ((null) [0x00000000baf00000-0x00000000beefffff]) The previous solution, c4c45e943e51 ("vfio/pci: Intel graphics legacy mode assignment"), adjusts GTT entry addresses to (addr - host BDSM + guest BDSM) to workaround that. But it is removed in 5aed8b0f0be2 ("vfio/igd: Remove GTT write quirk in IO BAR 4") due to inconsistent values in MMIO BAR0 and IO BAR4. Since it was a value latched into the VBIOS that breaks virtualization (QEMU does not map the GTT at the same address in the VM), a ROM quirk clearing the saved value in VBIOS image is introduced. It searches the BDSM accessor routine by matching a 19-byte signature anchored on the unique `mov $0x105e,%ax` instruction, then locates the offset of saved BDSM and clears it. This makes the routine fall through to the PCI config read on the first call inside the guest. [1] 3.5.15, 4th Generation Intel Core Processor Family Datasheet Vol. 2 https://www.intel.com/content/dam/www/public/us/en/documents/datasheets/4th-gen-core-family-desktop-vol-2-datasheet.pdf Fixes: 5aed8b0f0be2 ("vfio/igd: Remove GTT write quirk in IO BAR 4") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3093 Reported-by: K S Maan <[email protected]> Cc: [email protected] Signed-off-by: Tomita Moeko <[email protected]> Reviewed-by: Alex Williamson <[email protected]> Link: https://lore.kernel.org/qemu-devel/[email protected] Signed-off-by: Cédric Le Goater <[email protected]>
--- hw/vfio/pci.h | 3 ++ hw/vfio/igd-stubs.c | 5 ++ hw/vfio/igd.c | 115 +++++++++++++++++++++++++++++++++++++++++++ hw/vfio/pci-quirks.c | 5 ++ hw/vfio/pci.c | 2 + hw/vfio/trace-events | 1 + 6 files changed, 131 insertions(+)
I'm picking this up for currently active stable qemu series. Since this change touches several files, including new file since last release (hw/vfio/igd-stubs.c), I'm also picking a few other changes to the stable series, namely, for 11.0.x: v11.0.0-2776-gc822ecd8066 vfio/pci: Initialize rom_read_failed in vfio_pci_load_rom() this is a little bugfix by its own, so it's okay to pick up v11.0.0-3-g55e25958aa1 hw/vfio/pci-quirks.c: remove CONFIG_VFIO_IGD, Add stubs for needed functions. This changes quite a few things, but not much. I can adjust this change (Clear saved BDSM) for the context before CONFIG_VFIO_IGD removal, but it feels like it would be better to pick up CONFIG_VFIO_IGD removal too, to make the branches more similar. For 10.0.x, things are a bit more complex here. In particular, 10.0.x lacks v10.0.0-290-ge218ccf0c94 vfio: Rename VFIODevice related services v10.0.0-756-g2e27becf17b vfio: consistently handle return value for helpers v10.2.0-2365-g988499515da "hw/display: Build stubs once" and these are more troublesome to pick up, including "CONFIG_VFIO_IGD removal", so I'm picking up "Initialize rom_read_failed", and adjusting "Clear saved BDSM" for the lack of "CONFIG_VFIO_IGD removal" (it's stright-forward, with #ifdef CONFIG_VFIO_IGD instead of empty stub). I'm not very comfortable with the different approach to 10.0.x and 11.0.x, maybe I should omit "CONFIG_VFIO_IGD removal" from 11.0.x too. What do you think? Maybe this whole thing doesn't need so much attention to begin with :) Thanks, /mjt
