Intel iGPU passthrough support for KVM/Xen with UEFI

[rucoder]

Description

Add Intel integrated GPU (iGPU) passthrough support for KVM guests running with UEFI (OVMF). Enables Windows and Linux VMs to use the Intel iGPU via VFIO passthrough with full display output (DP, HDMI, hot-plug) once the guest OS driver initializes.

How it works

Three components are modified:

pkg/uefi — builds VfioIgdPkg open-source IGD Option ROM alongside OVMF.
VfioIgdPkg provides IgdAssignmentDxe: a DXE driver that reads etc/igd-opregion and etc/igd-bdsm-size from fw_cfg and sets PCI config registers ASLS (0xFC) and BDSM (0x5C / 0xC0 for Gen11+) required by the Intel display driver. Unlike the classic out-of-tree IgdAssignmentDxe patch, VfioIgdPkg handles 150+ device IDs from Sandy Bridge through Panther Lake and correctly handles the Gen11+ 64-bit BDSM register at 0xC0 (required for Raptor Lake and later). The built igd.rom is shipped in the EVE image at /usr/lib/xen/boot/igd.rom.

pkg/pillar/hypervisor (kvm.go) — detects Intel iGPU in the passthrough device list and:

• Places iGPU at guest BDF 00:02.0 (pcie.0 addr=0x2) — required for VBIOS/GOP ROM initialization
• Enables x-igd-opregion=on to pass the host OpRegion (including VBT) via fw_cfg — required for DP/HDMI connector detection and hot-plug
• Moves USB root port from slot 0x2 to 0x1b to free slot 2 for the iGPU
• Always loads the bundled igd.rom as the Option ROM; if a proprietary GOP ROM exists in /persist/gop/<devid>.rom, it is used instead (adds IntelGopDriver: UEFI framebuffer during firmware phase)

pkg/xen-tools (qemu-xen patch) — refactors vfio_probe_igd_bar4_quirk():

• Moves GMCH emulation, etc/igd-bdsm-size fw_cfg write, and BDSM emulation to before the BDF/LPC bridge checks. On q35 the LPC check ("Sorry Q35") always fails so without this patch these registers are never set and the Windows driver fails with Code 43.
• Emulates BDSM to 0 before the BDF check so OVMF's IgdAssignmentDxe idempotency guard (skip if BDSM ≠ 0) is not falsely triggered by the host physical address.
• Fixes gen check: accept gen >= 0 instead of gen == 6 || gen == 8, which was blocking gen 9–12 devices.

Display paths

Configuration	UEFI framebuffer (pre-OS)	OS display (DP/HDMI/hot-plug)
Bundled igd.rom only (default)	No	Yes
+ Proprietary GOP ROM in /persist/gop/	Yes	Yes

DP/HDMI and hot-plug are handled entirely by the guest OS i915/display driver via the OpRegion VBT and HPD interrupts. The UEFI phase only matters if you need a display before the OS boots.

Proprietary GOP ROMs (optional)

GOP ROMs are not included in EVE (licensing). For use cases requiring UEFI framebuffer, ROMs can be placed at /persist/gop/<devid>.rom (lowercase hex, no 0x prefix).

NOTE: this is for testing only!!! this PR will be updated to implement other way to store GOP ROMs

ROMs are available at https://github.com/LongQT-sea/intel-igpu-passthru/releases/

Device ID to ROM filename mapping

LongQT-sea filename	Microarchitecture	Example PCI device IDs
SNB_GOPv2_igd.rom	Sandy Bridge	0102, 0106, 010a
IVB_GOPv3_igd.rom	Ivy Bridge	0152, 0156, 015a, 0162, 0166
HSW_BDW_GOPv5_igd.rom	Haswell, Broadwell	0402, 0406, 0412, 1602, 1606, 1612
SKL_CML_GOPv9_igd.rom	Skylake, Comet Lake (U)	1902, 1906, 190b, 9b41, 9bca, 9bc8
CFL_CML_GOPv9.1_igd.rom	Coffee Lake, Comet Lake (H)	3e90, 3e92, 3ea0, 9bc4, 9bc5
GLK_GOPv13_igd.rom	Gemini Lake	3184, 3185
ICL_GOPv14_igd.rom	Ice Lake	8a50, 8a51, 8a52, 8a56, 8a5a, 8a5c
RKL_TGL_ADL_RPL_GOPv17_igd.rom	Rocket Lake, Tiger Lake, Alder Lake-P/S/U, Raptor Lake-P/U	4c8a, 4c8b, 9a40, 9a49, 4628, 46a0, 46a2, a780, a7a0, a7a1, a7a8
RKL_TGL_ADL_RPL_GOPv17.1_igd.rom	same (newer GOP version)	same as above
JSL_GOPv18_igd.rom	Jasper Lake	4e51, 4e55, 4e57, 4e61
ADL-H_RPL-H_GOPv21_igd.rom	Alder Lake-H, Raptor Lake-H	4626, 4638, a706, a720, a721
ADL-N_TWL_GOPv21_igd.rom	Alder Lake-N	46d0, 46d1, 46d2
ARL_MTL_GOPv22_igd.rom	Arrow Lake, Meteor Lake	7d45, 7d67, 7d51, 7d55
LNL_GOPv2X_igd.rom	Lunar Lake	6420, 641b

Example for i5-1335UE (Raptor Lake-U, PCI device 0xa7a1):

cp ADL-H_RPL-H_GOPv21_igd.rom /persist/gop/a7a1.rom

How to test and validate this PR

1. Build EVE with HV=kvm on an x86_64 host with an Intel iGPU (e.g. Intel Core i5-1335UE, device 00:02.0)
2. Configure the iGPU as a passthrough device in an app instance
3. Boot a Windows 11 or Linux VM
4. Verify Intel display adapter appears without Code 43 (Windows) or i915 binds cleanly (Linux)
5. Verify DP/HDMI output works and hot-plug events are detected in the guest
6. Test with and without a GOP ROM in /persist/gop/
7. Verify QEMU logs show IGD bdsm-size: entries confirming the fw_cfg write

Changelog notes

Add Intel iGPU passthrough support for KVM/UEFI guests. Enables Windows and Linux VMs to use Intel integrated graphics (Sandy Bridge through Raptor Lake and beyond) via VFIO passthrough, with full DP/HDMI/hot-plug support through the guest OS driver.

PR Backports

• 16.0-stable: No
• 14.5-stable: No
• 13.4-stable: No

Checklist

• I've provided a proper description

• I've added the proper documentation

• I've tested my PR on amd64 device

• I've tested my PR on arm64 device

• I've written the test verification instructions

• I've set the proper labels to this PR

• I've checked the boxes above, or I've provided a good reason why I didn't check them.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 29.87%. Comparing base (2281599) to head (1dabb63).
⚠️ Report is 376 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff             @@
##           master    #5686       +/-   ##
===========================================
+ Coverage   19.52%   29.87%   +10.34%     
===========================================
  Files          19       18        -1     
  Lines        3021     2417      -604     
===========================================
+ Hits          590      722      +132     
+ Misses       2310     1549      -761     
- Partials      121      146       +25     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.