Seabios blocked at running option rom at c000:0003

[Acewind]

Dear All,
These days I'm working on Intel IGD passthrough by qemu+vfio.
Success on i3-6100, but failed on i3-6100U.

The two cpus are both SkyLake arch.

I have successed to passthrough IGD device to Win7/Win10 on an  i3-6100
machine with Fedora 25. I use legacy mode and set x-igd-gms=1 on qemu
command line.

When I work on another machine of i3-6100U with the same solution.

CPU:  Intel(R) Core(TM) i3-6100U CPU @ 2.30GHz
VGA:   00:02.0 VGA compatible controller: Intel Corporation HD Graphics 520
(rev 07)

[root localhost ~]# dmesg | grep IOMMU
[    0.000000] DMAR: IOMMU enabled
[    0.067707] DMAR-IR: IOAPIC id 2 under DRHD base  0xfed91000 IOMMU 1

[root localhost ~]# cat /proc/cmdline
BOOT_IMAGE=/vmlinuz-4.8.6-300.fc25.x86_64 root=/dev/mapper/fedora-root ro
rd.lvm.lv=fedora/root rd.lvm.lv=fedora/swap rhgb quiet intel_iommu=on
iommu=pt

After virsh create command, nothing displays on the screen, there's always
no signal.
No other graphic and video devices, only passthrough hostdev:

<hostdev mode='subsystem' type='pci' managed='yes'>
      <driver name='vfio'/>
      <source>
        <address domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
      </source>
      <alias name='hostdev0'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x02'
function='0x0'/>
    </hostdev>

[root localhost ~]# ps -elf | grep qemu
6 S qemu      1541     1 99  80   0 - 804613 poll_s 17:34 ?       00:04:22
/usr/bin/qemu-system-x86_64 -machine accel=kvm -name
guest=cn_windows_10_enterprise_version_1703_updated_july_2017_x64_dvd_10925390,debug-threads=on
-S -object
secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain-2-cn_windows_10_enterp/master-key.aes
-machine pc-i440fx-2.7,accel=kvm,usb=off -cpu
Skylake-Client,hv_time,hv_relaxed,hv_vapic,hv_spinlocks=0x1fff -m 2048
-realtime mlock=off -smp 2,sockets=2,cores=1,threads=1 -uuid
128589da-017e-412d-b807-92de81ca7a29 -display none -no-user-config
-nodefaults -chardev
socket,id=charmonitor,path=/var/lib/libvirt/qemu/domain-2-cn_windows_10_enterp/monitor.sock,server,nowait
-mon chardev=charmonitor,id=monitor,mode=control -rtc
base=localtime,driftfix=slew -global kvm-pit.lost_tick_policy=discard
-no-hpet -no-shutdown -global PIIX4_PM.disable_s3=1 -global
PIIX4_PM.disable_s4=1 -boot strict=on -device
ich9-usb-ehci1,id=usb,bus=pci.0,addr=0x5.0x7 -device
ich9-usb-uhci1,masterbus=usb.0,firstport=0,bus=pci.0,multifunction=on,addr=0x5
-device ich9-usb-uhci2,masterbus=usb.0,firstport=2,bus=pci.0,addr=0x5.0x1
-device ich9-usb-uhci3,masterbus=usb.0,firstport=4,bus=pci.0,addr=0x5.0x2
-drive
file=/home/zwj/cn_windows_10_enterprise_version_1703_updated_july_2017_x64_dvd_10925390.qcow2,format=qcow2,if=none,id=drive-ide0-0-0
-device
ide-hd,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0,bootindex=1
-netdev tap,fd=26,id=hostnet0 -device
rtl8139,netdev=hostnet0,id=net0,mac=52:54:00:86:04:cc,bus=pci.0,addr=0x3
-chardev pty,id=charserial0 -device
isa-serial,chardev=charserial0,id=serial0 -device
usb-tablet,id=input0,bus=usb.0,port=1 -device
vfio-pci,host=00:02.0,id=hostdev0,bus=pci.0,addr=0x2 -device
virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x4 -bios
/usr/share/seabios/bios.bin -chardev file,id=seabios,path=/tmp/bios.log
-device isa-debugcon,iobase=0x402,chardev=seabios -set
device.hostdev0.x-igd-opregion=on -set device.hostdev0.x-igd-gms=1 -msg
timestamp=on

dmesg has an error:
[五 10月 12 17:34:21 2018] Console: switching to colour dummy device 80x25
[五 10月 12 17:34:21 2018] vgaarb: device changed decodes:
PCI:0000:00:02.0,olddecodes=io+mem,decodes=io+mem:owns=io+mem
[五 10月 12 17:34:21 2018] virbr0: port 2(vnet0) entered blocking state
[五 10月 12 17:34:21 2018] virbr0: port 2(vnet0) entered disabled state
[五 10月 12 17:34:21 2018] device vnet0 entered promiscuous mode
[五 10月 12 17:34:21 2018] virbr0: port 2(vnet0) entered blocking state
[五 10月 12 17:34:21 2018] virbr0: port 2(vnet0) entered listening state
[五 10月 12 17:34:22 2018] DMAR: DRHD: handling fault status reg 2
[五 10月 12 17:34:22 2018] DMAR: [DMA Write] Request device [00:02.0] fault
addr 0 [fault reason 02] Present bit in context entry is clear
[五 10月 12 17:34:22 2018] vfio_ecap_init: 0000:00:02.0 hiding ecap 0x1b 0x100
[五 10月 12 17:34:23 2018] virbr0: port 2(vnet0) entered learning state
[五 10月 12 17:34:25 2018] virbr0: port 2(vnet0) entered forwarding state
[五 10月 12 17:34:25 2018] virbr0: topology change detected, propagating

Below is log of SeaBIOS, it stops at running rom:

[root localhost ~]# cat /tmp/bios.log
SeaBIOS (version 1.9.3-1.fc25)
BUILD: gcc: (GCC) 6.1.1 20160621 (Red Hat Cross 6.1.1-2) binutils: version
2.26.1-1.fc25
RamSize: 0x80000000 [cmos]
Relocating init from 0x000e4080 to 0x7ffb2320 (size 56384)
Found QEMU fw_cfg
QEMU fw_cfg DMA interface supported
RamBlock: addr 0x0000000000000000 len 0x0000000080000000 [e820]
Moving pm_base to 0x600
boot order:
1: /pci i0cf8/ide 1,1/drive 0/disk 0
2: HALT
=== PCI bus & bridge init ===
PCI: pci_bios_init_bus_rec bus = 0x0
=== PCI device probing ===
Found 12 PCI devices (max PCI bus is 00)
=== PCI new allocation pass #1 ===
PCI: check devices
=== PCI new allocation pass #2 ===
PCI: IO: c000 - c1cf
PCI: 32: 0000000080000000 - 00000000fec00000
PCI: map device bdf=00:03.0  bar 0, addr 0000c000, size 00000100 [io]
PCI: map device bdf=00:02.0  bar 4, addr 0000c100, size 00000040 [io]
PCI: map device bdf=00:04.0  bar 0, addr 0000c140, size 00000020 [io]
PCI: map device bdf=00:05.0  bar 4, addr 0000c160, size 00000020 [io]
PCI: map device bdf=00:05.1  bar 4, addr 0000c180, size 00000020 [io]
PCI: map device bdf=00:05.2  bar 4, addr 0000c1a0, size 00000020 [io]
PCI: map device bdf=00:01.1  bar 4, addr 0000c1c0, size 00000010 [io]
PCI: map device bdf=00:02.0  bar 0, addr fd000000, size 01000000 [mem]
PCI: map device bdf=00:03.0  bar 6, addr fe000000, size 00040000 [mem]
PCI: map device bdf=00:02.0  bar 6, addr fe040000, size 00020000 [mem]
PCI: map device bdf=00:03.0  bar 1, addr fe060000, size 00001000 [mem]
PCI: map device bdf=00:05.7  bar 0, addr fe061000, size 00001000 [mem]
PCI: map device bdf=00:02.0  bar 2, addr e0000000, size 10000000 [prefmem]
PCI: map device bdf=00:04.0  bar 4, addr f0000000, size 00800000 [prefmem]
PCI: init bdf=00:00.0 id=8086:1237
PCI: init bdf=00:01.0 id=8086:7000
PIIX3/PIIX4 init: elcr=00 0c
PCI: init bdf=00:01.1 id=8086:7010
PCI: init bdf=00:01.3 id=8086:7113
Using pmtimer, ioport 0x608
PCI: init bdf=00:02.0 id=8086:1916
Intel IGD OpRegion enabled at 0x7fffe000, size 8KB, dev 00:02.0
Intel IGD BDSM enabled at 0x7d700000, size 40MB, dev 00:02.0
PCI: init bdf=00:03.0 id=10ec:8139
PCI: init bdf=00:04.0 id=1af4:1002
PCI: init bdf=00:05.0 id=8086:2934
PCI: init bdf=00:05.1 id=8086:2935
PCI: init bdf=00:05.2 id=8086:2936
PCI: init bdf=00:05.7 id=8086:293a
PCI: init bdf=00:1f.0 id=8086:9d48
PCI: Using 00:02.0 for primary VGA
handle_smp: apic_id=1
Found 2 cpu(s) max supported 2 cpu(s)
Copying PIR from 0x7ffbfca0 to 0x000f1c40
Copying MPTABLE from 0x00006e90/7ffa8e80 to 0x000f1b10
Copying SMBIOS entry point from 0x00006e90 to 0x000f1930
Scan for VGA option rom
Running option rom at c000:0003

Now seabios stops and monitor shows no signal.
I have install win10 directly on the host and it works well. Does it means
the vga rom image is ok? What can I do for further debug? Thanks!