2 Install a fake VGABIOS service handler (real mode Int10h) for the buggy
3 Windows 2008 R2 SP1 UEFI guest.
5 The handler is never meant to be directly executed by a VCPU; it's there for
6 the internal real mode emulator of Windows 2008 R2 SP1.
8 The code is based on Ralf Brown's Interrupt List:
9 <http://www.cs.cmu.edu/~ralf/files.html>
10 <http://www.ctyme.com/rbrown.htm>
12 Copyright (C) 2014, Red Hat, Inc.
13 Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>
15 This program and the accompanying materials are licensed and made available
16 under the terms and conditions of the BSD License which accompanies this
17 distribution. The full text of the license may be found at
18 http://opensource.org/licenses/bsd-license.php
20 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, WITHOUT
21 WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
24 #include <IndustryStandard/LegacyVgaBios.h>
25 #include <Library/DebugLib.h>
26 #include <Library/PciLib.h>
27 #include <Library/PrintLib.h>
28 #include <OvmfPlatforms.h>
41 // This string is displayed by Windows 2008 R2 SP1 in the Screen Resolution,
42 // Advanced Settings dialog. It should be short.
44 STATIC CONST CHAR8 mProductRevision
[] = "OVMF Int10h (fake)";
47 Install the VBE Info and VBE Mode Info structures, and the VBE service
48 handler routine in the C segment. Point the real-mode Int10h interrupt vector
49 to the handler. The only advertised mode is 1024x768x32.
51 @param[in] CardName Name of the video card to be exposed in the
52 Product Name field of the VBE Info structure. The
53 parameter must originate from a
54 QEMU_VIDEO_CARD.Name field.
55 @param[in] FrameBufferBase Guest-physical base address of the video card's
60 IN CONST CHAR16
*CardName
,
61 IN EFI_PHYSICAL_ADDRESS FrameBufferBase
64 EFI_PHYSICAL_ADDRESS Segment0
, SegmentC
, SegmentF
;
67 EFI_STATUS Segment0AllocationStatus
;
68 UINT16 HostBridgeDevId
;
72 VBE_INFO
*VbeInfoFull
;
73 VBE_INFO_BASE
*VbeInfo
;
76 VBE_MODE_INFO
*VbeModeInfo
;
78 if ((PcdGet8 (PcdNullPointerDetectionPropertyMask
) & (BIT0
|BIT7
)) == BIT0
) {
81 "%a: page 0 protected, not installing VBE shim\n",
86 "%a: page 0 protection prevents Windows 7 from booting anyway\n",
97 // Attempt to cover the real mode IVT with an allocation. This is a UEFI
98 // driver, hence the arch protocols have been installed previously. Among
99 // those, the CPU arch protocol has configured the IDT, so we can overwrite
100 // the IVT used in real mode.
102 // The allocation request may fail, eg. if LegacyBiosDxe has already run.
105 Int0x10
= (IVT_ENTRY
*)(UINTN
)Segment0
+ 0x10;
106 Segment0AllocationStatus
= gBS
->AllocatePages (
113 if (EFI_ERROR (Segment0AllocationStatus
)) {
114 EFI_PHYSICAL_ADDRESS Handler
;
117 // Check if a video BIOS handler has been installed previously -- we
118 // shouldn't override a real video BIOS with our shim, nor our own shim if
119 // it's already present.
121 Handler
= (Int0x10
->Segment
<< 4) + Int0x10
->Offset
;
122 if (Handler
>= SegmentC
&& Handler
< SegmentF
) {
123 DEBUG ((EFI_D_INFO
, "%a: Video BIOS handler found at %04x:%04x\n",
124 __FUNCTION__
, Int0x10
->Segment
, Int0x10
->Offset
));
129 // Otherwise we'll overwrite the Int10h vector, even though we may not own
134 "%a: failed to allocate page at zero: %r\n",
136 Segment0AllocationStatus
140 // We managed to allocate the page at zero. SVN r14218 guarantees that it
143 ASSERT (Int0x10
->Segment
== 0x0000);
144 ASSERT (Int0x10
->Offset
== 0x0000);
148 // Put the shim in place first.
150 // Start by determining the address of the PAM1 register.
152 HostBridgeDevId
= PcdGet16 (PcdOvmfHostBridgePciDevId
);
153 switch (HostBridgeDevId
) {
154 case INTEL_82441_DEVICE_ID
:
155 Pam1Address
= PMC_REGISTER_PIIX4 (PIIX4_PAM1
);
157 case INTEL_Q35_MCH_DEVICE_ID
:
158 Pam1Address
= DRAMC_REGISTER_Q35 (MCH_PAM1
);
163 "%a: unknown host bridge device ID: 0x%04x\n",
169 if (!EFI_ERROR (Segment0AllocationStatus
)) {
170 gBS
->FreePages (Segment0
, Segment0Pages
);
175 // low nibble covers 0xC0000 to 0xC3FFF
176 // high nibble covers 0xC4000 to 0xC7FFF
177 // bit1 in each nibble is Write Enable
178 // bit0 in each nibble is Read Enable
180 Pam1
= PciRead8 (Pam1Address
);
181 PciWrite8 (Pam1Address
, Pam1
| (BIT1
| BIT0
));
184 // We never added memory space during PEI or DXE for the C segment, so we
185 // don't need to (and can't) allocate from there. Also, guest operating
186 // systems will see a hole in the UEFI memory map there.
190 ASSERT (sizeof mVbeShim
<= EFI_PAGES_TO_SIZE (SegmentCPages
));
191 CopyMem ((VOID
*)(UINTN
)SegmentC
, mVbeShim
, sizeof mVbeShim
);
194 // Fill in the VBE INFO structure.
196 VbeInfoFull
= (VBE_INFO
*)(UINTN
)SegmentC
;
197 VbeInfo
= &VbeInfoFull
->Base
;
198 Ptr
= VbeInfoFull
->Buffer
;
200 CopyMem (VbeInfo
->Signature
, "VESA", 4);
201 VbeInfo
->VesaVersion
= 0x0300;
203 VbeInfo
->OemNameAddress
= (UINT32
)SegmentC
<< 12 | (UINT16
)(UINTN
)Ptr
;
204 CopyMem (Ptr
, "QEMU", 5);
207 VbeInfo
->Capabilities
= BIT0
; // DAC can be switched into 8-bit mode
209 VbeInfo
->ModeListAddress
= (UINT32
)SegmentC
<< 12 | (UINT16
)(UINTN
)Ptr
;
210 *(UINT16
*)Ptr
= 0x00f1; // mode number
212 *(UINT16
*)Ptr
= 0xFFFF; // mode list terminator
215 VbeInfo
->VideoMem64K
= (UINT16
)((1024 * 768 * 4 + 65535) / 65536);
216 VbeInfo
->OemSoftwareVersion
= 0x0000;
218 VbeInfo
->VendorNameAddress
= (UINT32
)SegmentC
<< 12 | (UINT16
)(UINTN
)Ptr
;
219 CopyMem (Ptr
, "OVMF", 5);
222 VbeInfo
->ProductNameAddress
= (UINT32
)SegmentC
<< 12 | (UINT16
)(UINTN
)Ptr
;
223 Printed
= AsciiSPrint ((CHAR8
*)Ptr
,
224 sizeof VbeInfoFull
->Buffer
- (Ptr
- VbeInfoFull
->Buffer
), "%s",
228 VbeInfo
->ProductRevAddress
= (UINT32
)SegmentC
<< 12 | (UINT16
)(UINTN
)Ptr
;
229 CopyMem (Ptr
, mProductRevision
, sizeof mProductRevision
);
230 Ptr
+= sizeof mProductRevision
;
232 ASSERT (sizeof VbeInfoFull
->Buffer
>= Ptr
- VbeInfoFull
->Buffer
);
233 ZeroMem (Ptr
, sizeof VbeInfoFull
->Buffer
- (Ptr
- VbeInfoFull
->Buffer
));
236 // Fil in the VBE MODE INFO structure.
238 VbeModeInfo
= (VBE_MODE_INFO
*)(VbeInfoFull
+ 1);
241 // bit0: mode supported by present hardware configuration
242 // bit1: optional information available (must be =1 for VBE v1.2+)
243 // bit3: set if color, clear if monochrome
244 // bit4: set if graphics mode, clear if text mode
245 // bit5: mode is not VGA-compatible
246 // bit7: linear framebuffer mode supported
248 VbeModeInfo
->ModeAttr
= BIT7
| BIT5
| BIT4
| BIT3
| BIT1
| BIT0
;
252 // bit1: bit1: readable
255 VbeModeInfo
->WindowAAttr
= BIT2
| BIT1
| BIT0
;
257 VbeModeInfo
->WindowBAttr
= 0x00;
258 VbeModeInfo
->WindowGranularityKB
= 0x0040;
259 VbeModeInfo
->WindowSizeKB
= 0x0040;
260 VbeModeInfo
->WindowAStartSegment
= 0xA000;
261 VbeModeInfo
->WindowBStartSegment
= 0x0000;
262 VbeModeInfo
->WindowPositioningAddress
= 0x0000;
263 VbeModeInfo
->BytesPerScanLine
= 1024 * 4;
265 VbeModeInfo
->Width
= 1024;
266 VbeModeInfo
->Height
= 768;
267 VbeModeInfo
->CharCellWidth
= 8;
268 VbeModeInfo
->CharCellHeight
= 16;
269 VbeModeInfo
->NumPlanes
= 1;
270 VbeModeInfo
->BitsPerPixel
= 32;
271 VbeModeInfo
->NumBanks
= 1;
272 VbeModeInfo
->MemoryModel
= 6; // direct color
273 VbeModeInfo
->BankSizeKB
= 0;
274 VbeModeInfo
->NumImagePagesLessOne
= 0;
275 VbeModeInfo
->Vbe3
= 0x01;
277 VbeModeInfo
->RedMaskSize
= 8;
278 VbeModeInfo
->RedMaskPos
= 16;
279 VbeModeInfo
->GreenMaskSize
= 8;
280 VbeModeInfo
->GreenMaskPos
= 8;
281 VbeModeInfo
->BlueMaskSize
= 8;
282 VbeModeInfo
->BlueMaskPos
= 0;
283 VbeModeInfo
->ReservedMaskSize
= 8;
284 VbeModeInfo
->ReservedMaskPos
= 24;
287 // bit1: Bytes in reserved field may be used by application
289 VbeModeInfo
->DirectColorModeInfo
= BIT1
;
291 VbeModeInfo
->LfbAddress
= (UINT32
)FrameBufferBase
;
292 VbeModeInfo
->OffScreenAddress
= 0;
293 VbeModeInfo
->OffScreenSizeKB
= 0;
295 VbeModeInfo
->BytesPerScanLineLinear
= 1024 * 4;
296 VbeModeInfo
->NumImagesLessOneBanked
= 0;
297 VbeModeInfo
->NumImagesLessOneLinear
= 0;
298 VbeModeInfo
->RedMaskSizeLinear
= 8;
299 VbeModeInfo
->RedMaskPosLinear
= 16;
300 VbeModeInfo
->GreenMaskSizeLinear
= 8;
301 VbeModeInfo
->GreenMaskPosLinear
= 8;
302 VbeModeInfo
->BlueMaskSizeLinear
= 8;
303 VbeModeInfo
->BlueMaskPosLinear
= 0;
304 VbeModeInfo
->ReservedMaskSizeLinear
= 8;
305 VbeModeInfo
->ReservedMaskPosLinear
= 24;
306 VbeModeInfo
->MaxPixelClockHz
= 0;
308 ZeroMem (VbeModeInfo
->Reserved
, sizeof VbeModeInfo
->Reserved
);
311 // Clear Write Enable (bit1), keep Read Enable (bit0) set
313 PciWrite8 (Pam1Address
, (Pam1
& ~BIT1
) | BIT0
);
316 // Second, point the Int10h vector at the shim.
318 Int0x10
->Segment
= (UINT16
) ((UINT32
)SegmentC
>> 4);
319 Int0x10
->Offset
= (UINT16
) ((UINTN
) (VbeModeInfo
+ 1) - SegmentC
);
321 DEBUG ((EFI_D_INFO
, "%a: VBE shim installed\n", __FUNCTION__
));