Re: [PATCH v5 0/3] vfio/igd: Fix garbled screen on IGD passthrough with legacy VBIOS

[Alex Williamson <alex@shazbot.org>]

On Tue,  7 Jul 2026 16:35:47 +0800
Tomita Moeko <tomitamoeko@gmail.com> wrote:

> This series fixes the regression that on IGD passthrough with legacy
> BIOS boot and VBIOS, the screen is garbled during BIOS POST and GRUB
> (which uses standard VGA output routines), starting from QEMU 10.0.
> Though the kernel i915 driver still works, it reports an error about
> the initial GTT programmed by VBIOS is using invalid address.
> 
> i915 0000:00:02.0: [drm] *ERROR* Initial plane programming using invalid range, dma_addr=0x00000000db200000 ((null) [0x00000000baf00000-0x00000000beefffff])
> 
> With the help of AI disassembling the VBIOS image dumped from host, it
> is found that the VBIOS itself implements a routine like:
> 
>     uint32_t get_BDSM() {
>         static uint32_t saved = 0;
>         if (saved != 0) {
>             return saved;
>         }
>         return read_pci_config(BDSM_REG);
>     }
> 
> And the saved value is not cleared after initialization. Given that IGD
> devices don't have a real ROM BAR, the VBIOS image read by default from
> host is actually the VBIOS shadow RAM region, containing host-side
> modifications like the saved BDSM value above during POST. When the
> image is executed in guest, it still uses the saved host BDSM (HPA)
> instead of the value programmed by SeaBIOS in config space (GPA). This
> address mismatch leads to the garbled screen and i915 error.
> 
> The previous solution, c4c45e943e51 ("vfio/pci: Intel graphics legacy
> mode assignment"), adjusts GTT entry addresses to (addr - host BDSM +
> guest BDSM) to workaround that. But it is removed in 5aed8b0f0be2
> ("vfio/igd: Remove GTT write quirk in IO BAR 4") due to inconsistent
> values in MMIO BAR0 and IO BAR4. Considering it's unsafe to expose HPA
> to guest, a ROM quirk clearing the saved value in VBIOS image is
> introduced to fix the issue.

How is it unsafe to expose an HPA?  The initial values in the PCI BARs
expose their HPAs, it's not unsafe.  The issue here is that the host
value is latched into the BIOS, which breaks the virtualization since
we're not mapping the GTT at the same address in the VM.
 
> During debugging, it is also found that IGD VBIOS ROM doesn't always
> match the actual IGD device ID, due to the fact that IGD of the same
> CPU family has multiple device IDs but shares the same ROM image.
> However, SeaBIOS checks the device ID strictly and refuses to run if
> IDs does not match. Currently only the default path, reading ROM from
> kernel patches the device ID, but the romfile path doesn't. So the ROM
> ID patching logic is also refactored in this patch series to also handle
> the romfile path.

This is a separate feature from the regression fix.  Up until now we've
only modified the ROM as provided through the vfio interface as the
user is out of the loop.  Once the user is in the loop and providing
the ROM via a file, we've always assumed it's the user's responsibility
to fixup the ROM and QEMU should pass it through unmodified.  I have a
tool[1] in my github that has served this purpose, allowing a device ID
to be written into the ROM image and the checksum recalculated.  We've
always required a ROM provided as a romfile to be pre-modified to match
the device ID.  Even the existing fixup in the PCI code is only for
default ROMs, not the PCIDevice.romfile image.

As I understand this series, we're using the rationale that removing
the GTT hack introduced a regression in QEMU and the fix we've
discovered for that regression requires clearing a field in the ROM
image, therefore we want to do that regardless of whether the ROM image
is provided through vfio or by the user... and while we're already
mangling the user provided image, we might as well fixup the device ID.

Also, as I'm reading the gitlab issue resolved by patch 3, it's
reported against the ROM read through vfio path, not the romfile path.
So for the issue presented, this could be a single patch that adds an
igd callout/stub to vfio_pci_load_rom() to zero the BDSM field, and
we'd require the romfile path to provide a pristine ROM image, with
matching device ID (already a requirement) and now the BDSM workaround.

Given that QEMU 11.1 is already in soft-freeze, that sounds more like
the self-contained, no additional feature fix that we need.
Effectively patch 3 with the BDSM zeroing directly wired through
vfio_pci_load_rom() and a Fixes: tag referencing the 10.0 commit
removing the previous GTT hack.  Thanks,

Alex

[1]https://github.com/awilliam/rom-parser