From nobody Sat Sep 26 20:01:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1790055456; cv=none; d=zohomail.com; s=zohoarc; b=MIzDMQlwBFjgdHkk03fEuxbae6EETZ29NJKcOlY4OkHn2eXPnRMMhTUULLBUdR4Fl0pir2Y5XTNutwGzz4pPv4IML/7MsHULmphNImUkK7N0pR6u+tD6W4FAGNLphT6JISecDrVLJdt2dAF2dt1WcHITqhHpnHVSQSUlPrPQ0eg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790055456; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=GefUR65gFJCCaZop3bPg0gK4neLNxXzidD5dedncl8M=; b=az81mAZv4pBIafFJ8xlUGk099DkQBb0HhwC/Ln326yQYB8JLHkx9vipyelHz4OhpEtqnBRQQ4sICMSbBuAfqgTXibH+TG8STzUFxRBEfxIh5yTCbGqkVIJNZHu0lqE/9NA58/2OFFBAJKCEA2adKx4PHLSe9tMie3myh9J0zRlw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790055456060239.81768372494594; Mon, 21 Sep 2026 22:37:36 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x8tBt-0007w9-JA; Tue, 22 Sep 2026 01:37:17 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x8tBr-0007vh-7F for qemu-devel@nongnu.org; Tue, 22 Sep 2026 01:37:15 -0400 Received: from mgamail.intel.com ([192.198.163.16]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x8tBo-0007uG-8l for qemu-devel@nongnu.org; Tue, 22 Sep 2026 01:37:14 -0400 Received: from fmviesa005.fm.intel.com ([10.60.135.145]) by fmvoesa110.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 Sep 2026 22:37:08 -0700 Received: from qat-wangyuan-17e.sh.intel.com ([10.239.92.81]) by fmviesa005.fm.intel.com with ESMTP; 21 Sep 2026 22:37:06 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1790055432; x=1821591432; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=16GSDUfnCzoWmPo/ZEZ2Onmp82IVxzOOqISR2OG7tdY=; b=EVotYV404cbBpawDBUE6Y0MbtOQQfNTsnVWLtpTHSkWO9ZHjsB4ESnHa jYuQ26Gg+JqIGNFCCJaeCh6bZplcLmJ+66A9JfI/nwS/+QKeKAyEHps9v Oc60fk5ELgNFkceRwgFghE5ZCFIomWK+TQ/z3rtweT5THGizKs3kn/N9h 9+kRafRK9HgXWI9FrExc1kxTG/m7DB1ytaLgyws6ExaF5P2MNJjZ8KbrR 69L9bUc6ydmq+d6PtA49LQ4sdle3J5bEPyIfe1ZyV+0KYjYxbcqEULsD1 WPMhxnwwpQVutrso/LhwyXnG8kjLbpe8jh2B0/0wh2JzAOR1h6t+rlBQr g==; X-CSE-ConnectionGUID: hEKAP3gDQ86pGfj892z/Ow== X-CSE-MsgGUID: /Xl5g8o6SHGnXUEZakG2ZA== X-IronPort-AV: E=McAfee;i="6800,10657,11912"; a="78181598" X-IronPort-AV: E=Sophos;i="6.27,115,1787036400"; d="scan'208";a="78181598" X-CSE-ConnectionGUID: 10u07CziQhayCDCGoNBMiw== X-CSE-MsgGUID: mlJCyYVhSGKWEO4OrOdZvA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.27,115,1787036400"; d="scan'208";a="281037310" From: Yuan Wang To: qemu-devel@nongnu.org Cc: alex@shazbot.org, clg@redhat.com, tomitamoeko@gmail.com, bosheng.xue@intel.com, junjie.cao@intel.com, Yuan Wang Subject: [PATCH v4] vfio/igd: Make MTL/ARL guests fall back to BAR-based framebuffer access Date: Tue, 22 Sep 2026 13:36:58 +0800 Message-Id: <20260922053658.2758332-1-yuan1.wang@intel.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=192.198.163.16; envelope-from=yuan1.wang@intel.com; helo=mgamail.intel.com X-Spam_score_int: -43 X-Spam_score: -4.4 X-Spam_bar: ---- X-Spam_report: (-4.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_NONE=0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @intel.com) X-ZM-MESSAGEID: 1790055458161158500 Meteor Lake and Arrow Lake GOP can read BAR0 MMIO offset 0x138914 to detect whether direct framebuffer access via DSM is available. In a VFIO passthrough VM, the guest cannot access the host DSM memory region via such a pointer. If the guest GOP enables that path, it may hand off a DSM-based framebuffer address that the guest cannot actually use. Intercept reads from the detection register and return 0 so the guest does not enable the DSM-based path and instead keeps using the standard BAR-based framebuffer address. Suggested-by: Tomita Moeko Reviewed-by: Tomita Moeko Reviewed-by: Bosheng Xue Reviewed-by: Junjie Cao Reviewed-by: C=C3=A9dric Le Goater Signed-off-by: Yuan Wang --- Changes: v4: - Address review comments from Tomita Moeko (update macro/variable names and comments). - Pick up Reviewed-by tags from Tomita Moeko and C=C3=A9dric Le Goater. v3: - Emulated register 0x138914 to return 0x0, which signals the guest GOP driver to fall back to BAR-based mapping since DSM is unavailable in the VM. v2: - Resending because the v1 patch was sent with an incorrect future system timestamp due to an unsynchronized local clock. No code changes. Notes: MTL/ARL device IDs remain in igd_gen(). This is required because vfio_probe_igd_bar0_quirk() checks the generation before installing BAR0 quirks, and the 0x138914 quirk is added afterward. Meanwhile, we also plan to remove the bdsm-size check in the OVMF offline patches. --- hw/vfio/igd.c | 49 ++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 46 insertions(+), 3 deletions(-) diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c index 413a49aae9..fe9ffc93c8 100644 --- a/hw/vfio/igd.c +++ b/hw/vfio/igd.c @@ -96,6 +96,8 @@ static int igd_gen(VFIOPCIDevice *vdev) case 0x4C00: /* Rocket Lake */ case 0x4600: /* Alder Lake */ case 0xA700: /* Raptor Lake */ + case 0x7D00: /* Meteor Lake / Arrow Lake */ + case 0xB600: /* Arrow Lake */ return 12; } =20 @@ -452,12 +454,34 @@ static bool vfio_pci_igd_override_gms(int gen, uint32= _t gms, uint32_t *gmch) return ret; } =20 -#define IGD_GGC_MMIO_OFFSET 0x108040 -#define IGD_BDSM_MMIO_OFFSET 0x1080C0 +#define IGD_GGC_MMIO_OFFSET 0x108040 +#define IGD_BDSM_MMIO_OFFSET 0x1080C0 +#define IGD_MTL_PCODE_STOLEN_ACCESS 0x138914 + +#define IGD_IS_MTL_OR_ARL(vdev) \ + ((((vdev)->device_id & 0xff00) =3D=3D 0x7d00) || \ + (((vdev)->device_id & 0xff00) =3D=3D 0xb600)) + +static uint64_t vfio_igd_pcode_stolen_access_read(void *opaque, hwaddr add= r, + unsigned size) +{ + return 0; +} + +static void vfio_igd_pcode_stolen_access_write(void *opaque, hwaddr addr, + uint64_t data, unsigned siz= e) +{ +} + +static const MemoryRegionOps vfio_igd_pcode_stolen_access_quirk =3D { + .read =3D vfio_igd_pcode_stolen_access_read, + .write =3D vfio_igd_pcode_stolen_access_write, + .endianness =3D DEVICE_LITTLE_ENDIAN, +}; =20 void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr) { - VFIOQuirk *ggc_quirk, *bdsm_quirk; + VFIOQuirk *ggc_quirk, *bdsm_quirk, *pcode_stolen_access_quirk; VFIOConfigMirrorQuirk *ggc_mirror, *bdsm_mirror; int gen; =20 @@ -472,6 +496,25 @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, in= t nr) return; } =20 + /* + * MTL/ARL guests must keep using the BAR-based framebuffer address. + * Return 0 for PCODE stolen memory access detection (0x138914) so GOP + * stays on the standard access path in the VM. + */ + if (IGD_IS_MTL_OR_ARL(vdev)) { + pcode_stolen_access_quirk =3D vfio_quirk_alloc(1); + memory_region_init_io(pcode_stolen_access_quirk->mem, OBJECT(vdev), + &vfio_igd_pcode_stolen_access_quirk, vdev, + "vfio-igd-pcode-stolen-access-quirk", 4); + memory_region_add_subregion_overlap(vdev->bars[nr].region.mem, + IGD_MTL_PCODE_STOLEN_ACCESS, + pcode_stolen_access_quirk->mem, + 1); + + QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, + pcode_stolen_access_quirk, next); + } + if (vdev->igd_gms) { ggc_quirk =3D vfio_quirk_alloc(1); ggc_mirror =3D ggc_quirk->data =3D g_malloc0(sizeof(*ggc_mirror)); --=20 2.34.1