OvmfPkg/QemuVideoDxe/VbeShim.c

   1 /** @file
   2   Install a fake VGABIOS service handler (real mode Int10h) for the buggy
   3   Windows 2008 R2 SP1 UEFI guest.
   4
   5   The handler is never meant to be directly executed by a VCPU; it's there for
   6   the internal real mode emulator of Windows 2008 R2 SP1.
   7
   8   The code is based on Ralf Brown's Interrupt List:
   9   <http://www.cs.cmu.edu/~ralf/files.html>
  10   <http://www.ctyme.com/rbrown.htm>
  11
  12   Copyright (C) 2014, Red Hat, Inc.
  13   Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>
  14
  15   This program and the accompanying materials are licensed and made available
  16   under the terms and conditions of the BSD License which accompanies this
  17   distribution. The full text of the license may be found at
  18   http://opensource.org/licenses/bsd-license.php
  19
  20   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, WITHOUT
  21   WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  22 **/
  23
  24 #include <IndustryStandard/LegacyVgaBios.h>
  25 #include <Library/DebugLib.h>
  26 #include <Library/PciLib.h>
  27 #include <Library/PrintLib.h>
  28 #include <OvmfPlatforms.h>
  29
  30 #include "Qemu.h"
  31 #include "VbeShim.h"
  32
  33 #pragma pack (1)
  34 typedef struct {
  35   UINT16 Offset;
  36   UINT16 Segment;
  37 } IVT_ENTRY;
  38 #pragma pack ()
  39
  40 //
  41 // This string is displayed by Windows 2008 R2 SP1 in the Screen Resolution,
  42 // Advanced Settings dialog. It should be short.
  43 //
  44 STATIC CONST CHAR8 mProductRevision[] = "OVMF Int10h (fake)";
  45
  46 /**
  47   Install the VBE Info and VBE Mode Info structures, and the VBE service
  48   handler routine in the C segment. Point the real-mode Int10h interrupt vector
  49   to the handler. The only advertised mode is 1024x768x32.
  50
  51   @param[in] CardName         Name of the video card to be exposed in the
  52                               Product Name field of the VBE Info structure. The
  53                               parameter must originate from a
  54                               QEMU_VIDEO_CARD.Name field.
  55   @param[in] FrameBufferBase  Guest-physical base address of the video card's
  56                               frame buffer.
  57 **/
  58 VOID
  59 InstallVbeShim (
  60   IN CONST CHAR16         *CardName,
  61   IN EFI_PHYSICAL_ADDRESS FrameBufferBase
  62   )
  63 {
  64   EFI_PHYSICAL_ADDRESS Segment0, SegmentC, SegmentF;
  65   UINTN                Segment0Pages;
  66   IVT_ENTRY            *Int0x10;
  67   EFI_STATUS           Segment0AllocationStatus;
  68   UINT16               HostBridgeDevId;
  69   UINTN                Pam1Address;
  70   UINT8                Pam1;
  71   UINTN                SegmentCPages;
  72   VBE_INFO             *VbeInfoFull;
  73   VBE_INFO_BASE        *VbeInfo;
  74   UINT8                *Ptr;
  75   UINTN                Printed;
  76   VBE_MODE_INFO        *VbeModeInfo;
  77
  78   if ((PcdGet8 (PcdNullPointerDetectionPropertyMask) & (BIT0|BIT7)) == BIT0) {
  79     DEBUG ((
  80       DEBUG_WARN,
  81       "%a: page 0 protected, not installing VBE shim\n",
  82       __FUNCTION__
  83       ));
  84     DEBUG ((
  85       DEBUG_WARN,
  86       "%a: page 0 protection prevents Windows 7 from booting anyway\n",
  87       __FUNCTION__
  88       ));
  89     return;
  90   }
  91
  92   Segment0 = 0x00000;
  93   SegmentC = 0xC0000;
  94   SegmentF = 0xF0000;
  95
  96   //
  97   // Attempt to cover the real mode IVT with an allocation. This is a UEFI
  98   // driver, hence the arch protocols have been installed previously. Among
  99   // those, the CPU arch protocol has configured the IDT, so we can overwrite
 100   // the IVT used in real mode.
 101   //
 102   // The allocation request may fail, eg. if LegacyBiosDxe has already run.
 103   //
 104   Segment0Pages = 1;
 105   Int0x10       = (IVT_ENTRY *)(UINTN)Segment0 + 0x10;
 106   Segment0AllocationStatus = gBS->AllocatePages (
 107                                     AllocateAddress,
 108                                     EfiBootServicesCode,
 109                                     Segment0Pages,
 110                                     &Segment0
 111                                     );
 112
 113   if (EFI_ERROR (Segment0AllocationStatus)) {
 114     EFI_PHYSICAL_ADDRESS Handler;
 115
 116     //
 117     // Check if a video BIOS handler has been installed previously -- we
 118     // shouldn't override a real video BIOS with our shim, nor our own shim if
 119     // it's already present.
 120     //
 121     Handler = (Int0x10->Segment << 4) + Int0x10->Offset;
 122     if (Handler >= SegmentC && Handler < SegmentF) {
 123       DEBUG ((EFI_D_INFO, "%a: Video BIOS handler found at %04x:%04x\n",
 124         __FUNCTION__, Int0x10->Segment, Int0x10->Offset));
 125       return;
 126     }
 127
 128     //
 129     // Otherwise we'll overwrite the Int10h vector, even though we may not own
 130     // the page at zero.
 131     //
 132     DEBUG ((
 133       DEBUG_INFO,
 134       "%a: failed to allocate page at zero: %r\n",
 135       __FUNCTION__,
 136       Segment0AllocationStatus
 137       ));
 138   } else {
 139     //
 140     // We managed to allocate the page at zero. SVN r14218 guarantees that it
 141     // is NUL-filled.
 142     //
 143     ASSERT (Int0x10->Segment == 0x0000);
 144     ASSERT (Int0x10->Offset  == 0x0000);
 145   }
 146
 147   //
 148   // Put the shim in place first.
 149   //
 150   // Start by determining the address of the PAM1 register.
 151   //
 152   HostBridgeDevId = PcdGet16 (PcdOvmfHostBridgePciDevId);
 153   switch (HostBridgeDevId) {
 154   case INTEL_82441_DEVICE_ID:
 155     Pam1Address = PMC_REGISTER_PIIX4 (PIIX4_PAM1);
 156     break;
 157   case INTEL_Q35_MCH_DEVICE_ID:
 158     Pam1Address = DRAMC_REGISTER_Q35 (MCH_PAM1);
 159     break;
 160   default:
 161     DEBUG ((
 162       DEBUG_ERROR,
 163       "%a: unknown host bridge device ID: 0x%04x\n",
 164       __FUNCTION__,
 165       HostBridgeDevId
 166       ));
 167     ASSERT (FALSE);
 168
 169     if (!EFI_ERROR (Segment0AllocationStatus)) {
 170       gBS->FreePages (Segment0, Segment0Pages);
 171     }
 172     return;
 173   }
 174   //
 175   // low nibble covers 0xC0000 to 0xC3FFF
 176   // high nibble covers 0xC4000 to 0xC7FFF
 177   // bit1 in each nibble is Write Enable
 178   // bit0 in each nibble is Read Enable
 179   //
 180   Pam1 = PciRead8 (Pam1Address);
 181   PciWrite8 (Pam1Address, Pam1 | (BIT1 | BIT0));
 182
 183   //
 184   // We never added memory space during PEI or DXE for the C segment, so we
 185   // don't need to (and can't) allocate from there. Also, guest operating
 186   // systems will see a hole in the UEFI memory map there.
 187   //
 188   SegmentCPages = 4;
 189
 190   ASSERT (sizeof mVbeShim <= EFI_PAGES_TO_SIZE (SegmentCPages));
 191   CopyMem ((VOID *)(UINTN)SegmentC, mVbeShim, sizeof mVbeShim);
 192
 193   //
 194   // Fill in the VBE INFO structure.
 195   //
 196   VbeInfoFull = (VBE_INFO *)(UINTN)SegmentC;
 197   VbeInfo     = &VbeInfoFull->Base;
 198   Ptr         = VbeInfoFull->Buffer;
 199
 200   CopyMem (VbeInfo->Signature, "VESA", 4);
 201   VbeInfo->VesaVersion = 0x0300;
 202
 203   VbeInfo->OemNameAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
 204   CopyMem (Ptr, "QEMU", 5);
 205   Ptr += 5;
 206
 207   VbeInfo->Capabilities = BIT0; // DAC can be switched into 8-bit mode
 208
 209   VbeInfo->ModeListAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
 210   *(UINT16*)Ptr = 0x00f1; // mode number
 211   Ptr += 2;
 212   *(UINT16*)Ptr = 0xFFFF; // mode list terminator
 213   Ptr += 2;
 214
 215   VbeInfo->VideoMem64K = (UINT16)((1024 * 768 * 4 + 65535) / 65536);
 216   VbeInfo->OemSoftwareVersion = 0x0000;
 217
 218   VbeInfo->VendorNameAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
 219   CopyMem (Ptr, "OVMF", 5);
 220   Ptr += 5;
 221
 222   VbeInfo->ProductNameAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
 223   Printed = AsciiSPrint ((CHAR8 *)Ptr,
 224               sizeof VbeInfoFull->Buffer - (Ptr - VbeInfoFull->Buffer), "%s",
 225               CardName);
 226   Ptr += Printed + 1;
 227
 228   VbeInfo->ProductRevAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
 229   CopyMem (Ptr, mProductRevision, sizeof mProductRevision);
 230   Ptr += sizeof mProductRevision;
 231
 232   ASSERT (sizeof VbeInfoFull->Buffer >= Ptr - VbeInfoFull->Buffer);
 233   ZeroMem (Ptr, sizeof VbeInfoFull->Buffer - (Ptr - VbeInfoFull->Buffer));
 234
 235   //
 236   // Fil in the VBE MODE INFO structure.
 237   //
 238   VbeModeInfo = (VBE_MODE_INFO *)(VbeInfoFull + 1);
 239
 240   //
 241   // bit0: mode supported by present hardware configuration
 242   // bit1: optional information available (must be =1 for VBE v1.2+)
 243   // bit3: set if color, clear if monochrome
 244   // bit4: set if graphics mode, clear if text mode
 245   // bit5: mode is not VGA-compatible
 246   // bit7: linear framebuffer mode supported
 247   //
 248   VbeModeInfo->ModeAttr = BIT7 | BIT5 | BIT4 | BIT3 | BIT1 | BIT0;
 249
 250   //
 251   // bit0: exists
 252   // bit1: bit1: readable
 253   // bit2: writeable
 254   //
 255   VbeModeInfo->WindowAAttr              = BIT2 | BIT1 | BIT0;
 256
 257   VbeModeInfo->WindowBAttr              = 0x00;
 258   VbeModeInfo->WindowGranularityKB      = 0x0040;
 259   VbeModeInfo->WindowSizeKB             = 0x0040;
 260   VbeModeInfo->WindowAStartSegment      = 0xA000;
 261   VbeModeInfo->WindowBStartSegment      = 0x0000;
 262   VbeModeInfo->WindowPositioningAddress = 0x0000;
 263   VbeModeInfo->BytesPerScanLine         = 1024 * 4;
 264
 265   VbeModeInfo->Width                = 1024;
 266   VbeModeInfo->Height               = 768;
 267   VbeModeInfo->CharCellWidth        = 8;
 268   VbeModeInfo->CharCellHeight       = 16;
 269   VbeModeInfo->NumPlanes            = 1;
 270   VbeModeInfo->BitsPerPixel         = 32;
 271   VbeModeInfo->NumBanks             = 1;
 272   VbeModeInfo->MemoryModel          = 6; // direct color
 273   VbeModeInfo->BankSizeKB           = 0;
 274   VbeModeInfo->NumImagePagesLessOne = 0;
 275   VbeModeInfo->Vbe3                 = 0x01;
 276
 277   VbeModeInfo->RedMaskSize      = 8;
 278   VbeModeInfo->RedMaskPos       = 16;
 279   VbeModeInfo->GreenMaskSize    = 8;
 280   VbeModeInfo->GreenMaskPos     = 8;
 281   VbeModeInfo->BlueMaskSize     = 8;
 282   VbeModeInfo->BlueMaskPos      = 0;
 283   VbeModeInfo->ReservedMaskSize = 8;
 284   VbeModeInfo->ReservedMaskPos  = 24;
 285
 286   //
 287   // bit1: Bytes in reserved field may be used by application
 288   //
 289   VbeModeInfo->DirectColorModeInfo = BIT1;
 290
 291   VbeModeInfo->LfbAddress       = (UINT32)FrameBufferBase;
 292   VbeModeInfo->OffScreenAddress = 0;
 293   VbeModeInfo->OffScreenSizeKB  = 0;
 294
 295   VbeModeInfo->BytesPerScanLineLinear = 1024 * 4;
 296   VbeModeInfo->NumImagesLessOneBanked = 0;
 297   VbeModeInfo->NumImagesLessOneLinear = 0;
 298   VbeModeInfo->RedMaskSizeLinear      = 8;
 299   VbeModeInfo->RedMaskPosLinear       = 16;
 300   VbeModeInfo->GreenMaskSizeLinear    = 8;
 301   VbeModeInfo->GreenMaskPosLinear     = 8;
 302   VbeModeInfo->BlueMaskSizeLinear     = 8;
 303   VbeModeInfo->BlueMaskPosLinear      = 0;
 304   VbeModeInfo->ReservedMaskSizeLinear = 8;
 305   VbeModeInfo->ReservedMaskPosLinear  = 24;
 306   VbeModeInfo->MaxPixelClockHz        = 0;
 307
 308   ZeroMem (VbeModeInfo->Reserved, sizeof VbeModeInfo->Reserved);
 309
 310   //
 311   // Clear Write Enable (bit1), keep Read Enable (bit0) set
 312   //
 313   PciWrite8 (Pam1Address, (Pam1 & ~BIT1) | BIT0);
 314
 315   //
 316   // Second, point the Int10h vector at the shim.
 317   //
 318   Int0x10->Segment = (UINT16) ((UINT32)SegmentC >> 4);
 319   Int0x10->Offset  = (UINT16) ((UINTN) (VbeModeInfo + 1) - SegmentC);
 320
 321   DEBUG ((EFI_D_INFO, "%a: VBE shim installed\n", __FUNCTION__));
 322 }