OvmfPkg/QemuVideoDxe/VbeShim.c

   1 /** @file
   2   Install a fake VGABIOS service handler (real mode Int10h) for the buggy
   3   Windows 2008 R2 SP1 UEFI guest.
   4
   5   The handler is never meant to be directly executed by a VCPU; it's there for
   6   the internal real mode emulator of Windows 2008 R2 SP1.
   7
   8   The code is based on Ralf Brown's Interrupt List:
   9   <http://www.cs.cmu.edu/~ralf/files.html>
  10   <http://www.ctyme.com/rbrown.htm>
  11
  12   Copyright (C) 2014, Red Hat, Inc.
  13   Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>
  14
  15   SPDX-License-Identifier: BSD-2-Clause-Patent
  16 **/
  17
  18 #include <IndustryStandard/LegacyVgaBios.h>
  19 #include <Library/DebugLib.h>
  20 #include <Library/PciLib.h>
  21 #include <Library/PrintLib.h>
  22 #include <OvmfPlatforms.h>
  23
  24 #include "Qemu.h"
  25 #include "VbeShim.h"
  26
  27 #pragma pack (1)
  28 typedef struct {
  29   UINT16    Offset;
  30   UINT16    Segment;
  31 } IVT_ENTRY;
  32 #pragma pack ()
  33
  34 //
  35 // This string is displayed by Windows 2008 R2 SP1 in the Screen Resolution,
  36 // Advanced Settings dialog. It should be short.
  37 //
  38 STATIC CONST CHAR8  mProductRevision[] = "OVMF Int10h (fake)";
  39
  40 /**
  41   Install the VBE Info and VBE Mode Info structures, and the VBE service
  42   handler routine in the C segment. Point the real-mode Int10h interrupt vector
  43   to the handler. The only advertised mode is 1024x768x32.
  44
  45   @param[in] CardName         Name of the video card to be exposed in the
  46                               Product Name field of the VBE Info structure. The
  47                               parameter must originate from a
  48                               QEMU_VIDEO_CARD.Name field.
  49   @param[in] FrameBufferBase  Guest-physical base address of the video card's
  50                               frame buffer.
  51 **/
  52 VOID
  53 InstallVbeShim (
  54   IN CONST CHAR16          *CardName,
  55   IN EFI_PHYSICAL_ADDRESS  FrameBufferBase
  56   )
  57 {
  58   EFI_PHYSICAL_ADDRESS  Segment0, SegmentC, SegmentF;
  59   UINTN                 Segment0Pages;
  60   IVT_ENTRY             *Int0x10;
  61   EFI_STATUS            Segment0AllocationStatus;
  62   UINT16                HostBridgeDevId;
  63   UINTN                 Pam1Address;
  64   UINT8                 Pam1;
  65   UINTN                 SegmentCPages;
  66   VBE_INFO              *VbeInfoFull;
  67   VBE_INFO_BASE         *VbeInfo;
  68   UINT8                 *Ptr;
  69   UINTN                 Printed;
  70   VBE_MODE_INFO         *VbeModeInfo;
  71
  72   if ((PcdGet8 (PcdNullPointerDetectionPropertyMask) & (BIT0|BIT7)) == BIT0) {
  73     DEBUG ((
  74       DEBUG_WARN,
  75       "%a: page 0 protected, not installing VBE shim\n",
  76       __FUNCTION__
  77       ));
  78     DEBUG ((
  79       DEBUG_WARN,
  80       "%a: page 0 protection prevents Windows 7 from booting anyway\n",
  81       __FUNCTION__
  82       ));
  83     return;
  84   }
  85
  86   Segment0 = 0x00000;
  87   SegmentC = 0xC0000;
  88   SegmentF = 0xF0000;
  89
  90   //
  91   // Attempt to cover the real mode IVT with an allocation. This is a UEFI
  92   // driver, hence the arch protocols have been installed previously. Among
  93   // those, the CPU arch protocol has configured the IDT, so we can overwrite
  94   // the IVT used in real mode.
  95   //
  96   // The allocation request may fail, eg. if LegacyBiosDxe has already run.
  97   //
  98   Segment0Pages            = 1;
  99   Int0x10                  = (IVT_ENTRY *)(UINTN)(Segment0 + 0x10 * sizeof (IVT_ENTRY));
 100   Segment0AllocationStatus = gBS->AllocatePages (
 101                                     AllocateAddress,
 102                                     EfiBootServicesCode,
 103                                     Segment0Pages,
 104                                     &Segment0
 105                                     );
 106
 107   if (EFI_ERROR (Segment0AllocationStatus)) {
 108     EFI_PHYSICAL_ADDRESS  Handler;
 109
 110     //
 111     // Check if a video BIOS handler has been installed previously -- we
 112     // shouldn't override a real video BIOS with our shim, nor our own shim if
 113     // it's already present.
 114     //
 115     Handler = (Int0x10->Segment << 4) + Int0x10->Offset;
 116     if ((Handler >= SegmentC) && (Handler < SegmentF)) {
 117       DEBUG ((
 118         DEBUG_INFO,
 119         "%a: Video BIOS handler found at %04x:%04x\n",
 120         __FUNCTION__,
 121         Int0x10->Segment,
 122         Int0x10->Offset
 123         ));
 124       return;
 125     }
 126
 127     //
 128     // Otherwise we'll overwrite the Int10h vector, even though we may not own
 129     // the page at zero.
 130     //
 131     DEBUG ((
 132       DEBUG_INFO,
 133       "%a: failed to allocate page at zero: %r\n",
 134       __FUNCTION__,
 135       Segment0AllocationStatus
 136       ));
 137   } else {
 138     //
 139     // We managed to allocate the page at zero. SVN r14218 guarantees that it
 140     // is NUL-filled.
 141     //
 142     ASSERT (Int0x10->Segment == 0x0000);
 143     ASSERT (Int0x10->Offset  == 0x0000);
 144   }
 145
 146   //
 147   // Put the shim in place first.
 148   //
 149   // Start by determining the address of the PAM1 register.
 150   //
 151   HostBridgeDevId = PcdGet16 (PcdOvmfHostBridgePciDevId);
 152   switch (HostBridgeDevId) {
 153     case INTEL_82441_DEVICE_ID:
 154       Pam1Address = PMC_REGISTER_PIIX4 (PIIX4_PAM1);
 155       break;
 156     case INTEL_Q35_MCH_DEVICE_ID:
 157       Pam1Address = DRAMC_REGISTER_Q35 (MCH_PAM1);
 158       break;
 159     default:
 160       DEBUG ((
 161         DEBUG_ERROR,
 162         "%a: unknown host bridge device ID: 0x%04x\n",
 163         __FUNCTION__,
 164         HostBridgeDevId
 165         ));
 166       ASSERT (FALSE);
 167
 168       if (!EFI_ERROR (Segment0AllocationStatus)) {
 169         gBS->FreePages (Segment0, Segment0Pages);
 170       }
 171
 172       return;
 173   }
 174
 175   //
 176   // low nibble covers 0xC0000 to 0xC3FFF
 177   // high nibble covers 0xC4000 to 0xC7FFF
 178   // bit1 in each nibble is Write Enable
 179   // bit0 in each nibble is Read Enable
 180   //
 181   Pam1 = PciRead8 (Pam1Address);
 182   PciWrite8 (Pam1Address, Pam1 | (BIT1 | BIT0));
 183
 184   //
 185   // We never added memory space during PEI or DXE for the C segment, so we
 186   // don't need to (and can't) allocate from there. Also, guest operating
 187   // systems will see a hole in the UEFI memory map there.
 188   //
 189   SegmentCPages = 4;
 190
 191   ASSERT (sizeof mVbeShim <= EFI_PAGES_TO_SIZE (SegmentCPages));
 192   CopyMem ((VOID *)(UINTN)SegmentC, mVbeShim, sizeof mVbeShim);
 193
 194   //
 195   // Fill in the VBE INFO structure.
 196   //
 197   VbeInfoFull = (VBE_INFO *)(UINTN)SegmentC;
 198   VbeInfo     = &VbeInfoFull->Base;
 199   Ptr         = VbeInfoFull->Buffer;
 200
 201   CopyMem (VbeInfo->Signature, "VESA", 4);
 202   VbeInfo->VesaVersion = 0x0300;
 203
 204   VbeInfo->OemNameAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
 205   CopyMem (Ptr, "QEMU", 5);
 206   Ptr += 5;
 207
 208   VbeInfo->Capabilities = BIT0; // DAC can be switched into 8-bit mode
 209
 210   VbeInfo->ModeListAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
 211   *(UINT16 *)Ptr           = 0x00f1; // mode number
 212   Ptr                     += 2;
 213   *(UINT16 *)Ptr           = 0xFFFF; // mode list terminator
 214   Ptr                     += 2;
 215
 216   VbeInfo->VideoMem64K        = (UINT16)((1024 * 768 * 4 + 65535) / 65536);
 217   VbeInfo->OemSoftwareVersion = 0x0000;
 218
 219   VbeInfo->VendorNameAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
 220   CopyMem (Ptr, "OVMF", 5);
 221   Ptr += 5;
 222
 223   VbeInfo->ProductNameAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
 224   Printed                     = AsciiSPrint (
 225                                   (CHAR8 *)Ptr,
 226                                   sizeof VbeInfoFull->Buffer - (Ptr - VbeInfoFull->Buffer),
 227                                   "%s",
 228                                   CardName
 229                                   );
 230   Ptr += Printed + 1;
 231
 232   VbeInfo->ProductRevAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
 233   CopyMem (Ptr, mProductRevision, sizeof mProductRevision);
 234   Ptr += sizeof mProductRevision;
 235
 236   ASSERT (sizeof VbeInfoFull->Buffer >= Ptr - VbeInfoFull->Buffer);
 237   ZeroMem (Ptr, sizeof VbeInfoFull->Buffer - (Ptr - VbeInfoFull->Buffer));
 238
 239   //
 240   // Fil in the VBE MODE INFO structure.
 241   //
 242   VbeModeInfo = (VBE_MODE_INFO *)(VbeInfoFull + 1);
 243
 244   //
 245   // bit0: mode supported by present hardware configuration
 246   // bit1: optional information available (must be =1 for VBE v1.2+)
 247   // bit3: set if color, clear if monochrome
 248   // bit4: set if graphics mode, clear if text mode
 249   // bit5: mode is not VGA-compatible
 250   // bit7: linear framebuffer mode supported
 251   //
 252   VbeModeInfo->ModeAttr = BIT7 | BIT5 | BIT4 | BIT3 | BIT1 | BIT0;
 253
 254   //
 255   // bit0: exists
 256   // bit1: bit1: readable
 257   // bit2: writeable
 258   //
 259   VbeModeInfo->WindowAAttr = BIT2 | BIT1 | BIT0;
 260
 261   VbeModeInfo->WindowBAttr              = 0x00;
 262   VbeModeInfo->WindowGranularityKB      = 0x0040;
 263   VbeModeInfo->WindowSizeKB             = 0x0040;
 264   VbeModeInfo->WindowAStartSegment      = 0xA000;
 265   VbeModeInfo->WindowBStartSegment      = 0x0000;
 266   VbeModeInfo->WindowPositioningAddress = 0x0000;
 267   VbeModeInfo->BytesPerScanLine         = 1024 * 4;
 268
 269   VbeModeInfo->Width                = 1024;
 270   VbeModeInfo->Height               = 768;
 271   VbeModeInfo->CharCellWidth        = 8;
 272   VbeModeInfo->CharCellHeight       = 16;
 273   VbeModeInfo->NumPlanes            = 1;
 274   VbeModeInfo->BitsPerPixel         = 32;
 275   VbeModeInfo->NumBanks             = 1;
 276   VbeModeInfo->MemoryModel          = 6; // direct color
 277   VbeModeInfo->BankSizeKB           = 0;
 278   VbeModeInfo->NumImagePagesLessOne = 0;
 279   VbeModeInfo->Vbe3                 = 0x01;
 280
 281   VbeModeInfo->RedMaskSize      = 8;
 282   VbeModeInfo->RedMaskPos       = 16;
 283   VbeModeInfo->GreenMaskSize    = 8;
 284   VbeModeInfo->GreenMaskPos     = 8;
 285   VbeModeInfo->BlueMaskSize     = 8;
 286   VbeModeInfo->BlueMaskPos      = 0;
 287   VbeModeInfo->ReservedMaskSize = 8;
 288   VbeModeInfo->ReservedMaskPos  = 24;
 289
 290   //
 291   // bit1: Bytes in reserved field may be used by application
 292   //
 293   VbeModeInfo->DirectColorModeInfo = BIT1;
 294
 295   VbeModeInfo->LfbAddress       = (UINT32)FrameBufferBase;
 296   VbeModeInfo->OffScreenAddress = 0;
 297   VbeModeInfo->OffScreenSizeKB  = 0;
 298
 299   VbeModeInfo->BytesPerScanLineLinear = 1024 * 4;
 300   VbeModeInfo->NumImagesLessOneBanked = 0;
 301   VbeModeInfo->NumImagesLessOneLinear = 0;
 302   VbeModeInfo->RedMaskSizeLinear      = 8;
 303   VbeModeInfo->RedMaskPosLinear       = 16;
 304   VbeModeInfo->GreenMaskSizeLinear    = 8;
 305   VbeModeInfo->GreenMaskPosLinear     = 8;
 306   VbeModeInfo->BlueMaskSizeLinear     = 8;
 307   VbeModeInfo->BlueMaskPosLinear      = 0;
 308   VbeModeInfo->ReservedMaskSizeLinear = 8;
 309   VbeModeInfo->ReservedMaskPosLinear  = 24;
 310   VbeModeInfo->MaxPixelClockHz        = 0;
 311
 312   ZeroMem (VbeModeInfo->Reserved, sizeof VbeModeInfo->Reserved);
 313
 314   //
 315   // Clear Write Enable (bit1), keep Read Enable (bit0) set
 316   //
 317   PciWrite8 (Pam1Address, (Pam1 & ~BIT1) | BIT0);
 318
 319   //
 320   // Second, point the Int10h vector at the shim.
 321   //
 322   Int0x10->Segment = (UINT16)((UINT32)SegmentC >> 4);
 323   Int0x10->Offset  = (UINT16)((UINTN)(VbeModeInfo + 1) - SegmentC);
 324
 325   DEBUG ((DEBUG_INFO, "%a: VBE shim installed\n", __FUNCTION__));
 326 }