[PATCH v5 2/3] vfio/igd: Patch device ID for romfile-provided VBIOS

[Tomita Moeko <tomitamoeko@gmail.com>]

Multiple IGD devices of the same generation share the same rom,
the device ID in its PCIR structure may not match. As SeaBIOS checks
the device ID strictly and refuses to run the VBIOS on a mismatch,
the ID has to be patched.

For a ROM read from the kernel ROM BAR, vfio_pci_load_rom() already
patches the device ID and recomputes the checksum. A VBIOS provided by
the user via romfile, however, is loaded by the generic PCI core and
does not receive this IGD-specific fixup.

Introduce vfio_igd_legacy_rom_quirk() in igd.c, which patches the
device ID and recomputes the (known bogus) checksum of a Gen 6-9 IGD
legacy VBIOS. This is registered as romfile_fixup hook when a romfile
is configured so that the romfile-provided VBIOS then receives the
same fixup as one read from the kernel ROM BAR.

Reported-by: K S Maan <kirandeepmaan45@gmail.com>
Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
---
 hw/vfio/igd-stubs.c  |  5 +++++
 hw/vfio/igd.c        | 53 ++++++++++++++++++++++++++++++++++++++++++++
 hw/vfio/pci.h        |  2 ++
 hw/vfio/trace-events |  1 +
 4 files changed, 61 insertions(+)

diff --git a/hw/vfio/igd-stubs.c b/hw/vfio/igd-stubs.c
index f7687d9091..29110f7568 100644
--- a/hw/vfio/igd-stubs.c
+++ b/hw/vfio/igd-stubs.c
@@ -18,3 +18,8 @@ bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
 {
     return true;
 }
+
+void vfio_igd_legacy_rom_quirk(PCIDevice *pdev, uint8_t *ptr, uint32_t size)
+{
+    return;
+}
diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index e091f21b6a..a5c1b57ce4 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -610,6 +610,10 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
         goto error;
     }
 
+    if (pdev->romfile) {
+        pdev->romfile_fixup = vfio_igd_legacy_rom_quirk;
+    }
+
     /*
      * ASLS (OpRegion address) is read-only, emulated
      * It contains HPA, guest firmware need to reprogram it with GPA.
@@ -724,3 +728,52 @@ bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
 
     return vfio_pci_igd_config_quirk(vdev, errp);
 }
+
+void vfio_igd_legacy_rom_quirk(PCIDevice *pdev, uint8_t *ptr, uint32_t size)
+{
+    VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(pdev);
+    int gen;
+    uint16_t pcir_offset;
+    uint8_t checksum = 0;
+    uint32_t i;
+
+    if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) ||
+        !vfio_is_vga(vdev) || !vdev->vga) {
+        return;
+    }
+
+    /* Only Gen 6~9 devices have legacy VBIOS as Option ROM */
+    gen = igd_gen(vdev);
+    if (gen < 6 || gen > 9) {
+        return;
+    }
+
+    if (pci_get_word(ptr) != 0xaa55) {
+        return;
+    }
+
+    /* Must be a legacy ROM */
+    pcir_offset = pci_get_word(ptr + 0x18);
+    if (pcir_offset + 0x14 >= size || memcmp(ptr + pcir_offset, "PCIR", 4) ||
+        pci_get_byte(ptr + pcir_offset + 0x14) != 0x00) {
+        return;
+    }
+
+    /*
+     * Patch device ID as multiple IGD devices share the same rom with possible
+     * non-matching IDs. This duplicates with vfio_pci_load_rom(), but required
+     * for romfile.
+     */
+    pci_set_word(ptr + pcir_offset + 6, vdev->device_id);
+
+    /*
+     * IGD roms are known to have bogus checksums. No matter we changed the
+     * device ID or not, we need to recalculate the checksum and patch it.
+     */
+    for (i = 0; i < size; i++) {
+        checksum += ptr[i];
+    }
+    ((uint8_t *)ptr)[6] -= checksum;
+
+    trace_vfio_pci_igd_vbios_patched(vdev->vbasedev.name);
+}
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index cf56711587..65a1385ce3 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -253,8 +253,10 @@ void vfio_setup_resetfn_quirk(VFIOPCIDevice *vdev);
 bool vfio_add_virt_caps(VFIOPCIDevice *vdev, Error **errp);
 void vfio_quirk_reset(VFIOPCIDevice *vdev);
 VFIOQuirk *vfio_quirk_alloc(int nr_mem);
+
 void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr);
 bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp);
+void vfio_igd_legacy_rom_quirk(PCIDevice *pdev, uint8_t *ptr, uint32_t size);
 
 extern const PropertyInfo qdev_prop_nv_gpudirect_clique;
 
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index 4c28b3291c..e472a65a44 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -90,6 +90,7 @@ vfio_pci_igd_bar4_write(const char *name, uint32_t index, uint32_t data, uint32_
 vfio_pci_igd_bdsm_enabled(const char *name, int size) "%s %dMB"
 vfio_pci_igd_host_bridge_enabled(const char *name) "%s"
 vfio_pci_igd_lpc_bridge_enabled(const char *name) "%s"
+vfio_pci_igd_vbios_patched(const char *name) "%s"
 
 # listener.c
 vfio_iommu_map_notify(const char *op, uint64_t iova_start, uint64_t iova_end) "iommu %s @ 0x%"PRIx64" - 0x%"PRIx64
-- 
2.53.0