VbeShim.c 8.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278
  1. /** @file
  2. Install a fake VGABIOS service handler (real mode Int10h) for the buggy
  3. Windows 2008 R2 SP1 UEFI guest.
  4. The handler is never meant to be directly executed by a VCPU; it's there for
  5. the internal real mode emulator of Windows 2008 R2 SP1.
  6. The code is based on Ralf Brown's Interrupt List:
  7. <http://www.cs.cmu.edu/~ralf/files.html>
  8. <http://www.ctyme.com/rbrown.htm>
  9. Copyright (C) 2020, Rebecca Cran <rebecca@bsdio.com>
  10. Copyright (C) 2015, Nahanni Systems, Inc.
  11. Copyright (C) 2014, Red Hat, Inc.
  12. Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>
  13. SPDX-License-Identifier: BSD-2-Clause-Patent
  14. **/
  15. #include <IndustryStandard/LegacyVgaBios.h>
  16. #include <Library/DebugLib.h>
  17. #include <Library/PciLib.h>
  18. #include <Library/PrintLib.h>
  19. #include "Gop.h"
  20. #include "VbeShim.h"
  21. #pragma pack (1)
  22. typedef struct {
  23. UINT16 Offset;
  24. UINT16 Segment;
  25. } IVT_ENTRY;
  26. #pragma pack ()
  27. //
  28. // This string is displayed by Windows 2008 R2 SP1 in the Screen Resolution,
  29. // Advanced Settings dialog. It should be short.
  30. //
  31. STATIC CONST CHAR8 mProductRevision[] = "2.0";
  32. #define NUM_VBE_MODES 3
  33. STATIC CONST UINT16 vbeModeIds[] = {
  34. 0x13f, // 640x480x32
  35. 0x140, // 800x600x32
  36. 0x141 // 1024x768x32
  37. };
  38. // Modes can be toggled with bit-0
  39. #define VBE_MODE_ENABLED 0x00BB
  40. #define VBE_MODE_DISABLED 0x00BA
  41. STATIC VBE2_MODE_INFO vbeModes[] = {
  42. { // 0x13f 640x480x32
  43. // ModeAttr - BytesPerScanLine
  44. VBE_MODE_DISABLED, 0x07, 0x00, 0x40, 0x40, 0xA000, 0x00, 0x0000, 640*4,
  45. // Width, Height..., Vbe3
  46. 640, 480, 16, 8, 1, 32, 1, 0x06, 0, 0, 1,
  47. // Masks
  48. 0x08, 0x10, 0x08, 0x08, 0x08, 0x00, 0x08, 0x18, 0x00,
  49. // Framebuffer
  50. 0xdeadbeef, 0x0000, 0x0000
  51. },
  52. { // 0x140 800x600x32
  53. // ModeAttr - BytesPerScanLine
  54. VBE_MODE_DISABLED, 0x07, 0x00, 0x40, 0x40, 0xA000, 0x00, 0x0000, 800*4,
  55. // Width, Height..., Vbe3
  56. 800, 600, 16, 8, 1, 32, 1, 0x06, 0, 0, 1,
  57. // Masks
  58. 0x08, 0x10, 0x08, 0x08, 0x08, 0x00, 0x08, 0x18, 0x00,
  59. // Framebuffer
  60. 0xdeadbeef, 0x0000, 0x0000
  61. },
  62. { // 0x141 1024x768x32
  63. // ModeAttr - BytesPerScanLine
  64. VBE_MODE_ENABLED, 0x07, 0x00, 0x40, 0x40, 0xA000, 0x00, 0x0000, 1024*4,
  65. // Width, Height..., Vbe3
  66. 1024, 768, 16, 8, 1, 32, 1, 0x06, 0, 0, 1,
  67. // Masks
  68. 0x08, 0x10, 0x08, 0x08, 0x08, 0x00, 0x08, 0x18, 0x00,
  69. // Framebuffer
  70. 0xdeadbeef, 0x0000, 0x0000
  71. }
  72. };
  73. /**
  74. Install the VBE Info and VBE Mode Info structures, and the VBE service
  75. handler routine in the C segment. Point the real-mode Int10h interrupt vector
  76. to the handler. The only advertised mode is 1024x768x32.
  77. @param[in] CardName Name of the video card to be exposed in the
  78. Product Name field of the VBE Info structure.
  79. @param[in] FrameBufferBase Guest-physical base address of the video card's
  80. frame buffer.
  81. **/
  82. VOID
  83. InstallVbeShim (
  84. IN CONST CHAR16 *CardName,
  85. IN EFI_PHYSICAL_ADDRESS FrameBufferBase
  86. )
  87. {
  88. EFI_PHYSICAL_ADDRESS Segment0, SegmentC, SegmentF;
  89. UINTN Segment0Pages;
  90. IVT_ENTRY *Int0x10;
  91. EFI_STATUS Status;
  92. UINTN Pam1Address;
  93. UINT8 Pam1;
  94. UINTN SegmentCPages;
  95. VBE_INFO *VbeInfoFull;
  96. VBE_INFO_BASE *VbeInfo;
  97. UINT8 *Ptr;
  98. UINTN Printed;
  99. VBE_MODE_INFO *VbeModeInfo;
  100. UINTN i;
  101. Segment0 = 0x00000;
  102. SegmentC = 0xC0000;
  103. SegmentF = 0xF0000;
  104. //
  105. // Attempt to cover the real mode IVT with an allocation. This is a UEFI
  106. // driver, hence the arch protocols have been installed previously. Among
  107. // those, the CPU arch protocol has configured the IDT, so we can overwrite
  108. // the IVT used in real mode.
  109. //
  110. // The allocation request may fail, eg. if LegacyBiosDxe has already run.
  111. //
  112. Segment0Pages = 1;
  113. Int0x10 = (IVT_ENTRY *)(UINTN)Segment0 + 0x10;
  114. Status = gBS->AllocatePages (
  115. AllocateAddress,
  116. EfiBootServicesCode,
  117. Segment0Pages,
  118. &Segment0
  119. );
  120. if (EFI_ERROR (Status)) {
  121. EFI_PHYSICAL_ADDRESS Handler;
  122. //
  123. // Check if a video BIOS handler has been installed previously -- we
  124. // shouldn't override a real video BIOS with our shim, nor our own shim if
  125. // it's already present.
  126. //
  127. Handler = (Int0x10->Segment << 4) + Int0x10->Offset;
  128. if ((Handler >= SegmentC) && (Handler < SegmentF)) {
  129. DEBUG ((
  130. DEBUG_VERBOSE,
  131. "%a: Video BIOS handler found at %04x:%04x\n",
  132. __FUNCTION__,
  133. Int0x10->Segment,
  134. Int0x10->Offset
  135. ));
  136. return;
  137. }
  138. //
  139. // Otherwise we'll overwrite the Int10h vector, even though we may not own
  140. // the page at zero.
  141. //
  142. DEBUG ((
  143. DEBUG_VERBOSE,
  144. "%a: failed to allocate page at zero: %r\n",
  145. __FUNCTION__,
  146. Status
  147. ));
  148. } else {
  149. //
  150. // We managed to allocate the page at zero. SVN r14218 guarantees that it
  151. // is NUL-filled.
  152. //
  153. ASSERT (Int0x10->Segment == 0x0000);
  154. ASSERT (Int0x10->Offset == 0x0000);
  155. }
  156. //
  157. // Put the shim in place first.
  158. //
  159. Pam1Address = PCI_LIB_ADDRESS (0, 0, 0, 0x5A);
  160. //
  161. // low nibble covers 0xC0000 to 0xC3FFF
  162. // high nibble covers 0xC4000 to 0xC7FFF
  163. // bit1 in each nibble is Write Enable
  164. // bit0 in each nibble is Read Enable
  165. //
  166. Pam1 = PciRead8 (Pam1Address);
  167. PciWrite8 (Pam1Address, Pam1 | (BIT1 | BIT0));
  168. //
  169. // We never added memory space durig PEI or DXE for the C segment, so we
  170. // don't need to (and can't) allocate from there. Also, guest operating
  171. // systems will see a hole in the UEFI memory map there.
  172. //
  173. SegmentCPages = 4;
  174. ASSERT (sizeof mVbeShim <= EFI_PAGES_TO_SIZE (SegmentCPages));
  175. CopyMem ((VOID *)(UINTN)SegmentC, mVbeShim, sizeof mVbeShim);
  176. //
  177. // Fill in the VBE INFO structure.
  178. //
  179. VbeInfoFull = (VBE_INFO *)(UINTN)SegmentC;
  180. VbeInfo = &VbeInfoFull->Base;
  181. Ptr = VbeInfoFull->Buffer;
  182. CopyMem (VbeInfo->Signature, "VESA", 4);
  183. VbeInfo->VesaVersion = 0x0200;
  184. VbeInfo->OemNameAddress = (UINT32)SegmentC << 12 | (UINT16)((UINTN)Ptr-SegmentC);
  185. CopyMem (Ptr, "FBSD", 5);
  186. Ptr += 5;
  187. VbeInfo->Capabilities = BIT1 | BIT0; // DAC can be switched into 8-bit mode
  188. VbeInfo->ModeListAddress = (UINT32)SegmentC << 12 | (UINT16)((UINTN)Ptr-SegmentC);
  189. for (i = 0; i < NUM_VBE_MODES; i++) {
  190. *(UINT16 *)Ptr = vbeModeIds[i]; // mode number
  191. Ptr += 2;
  192. }
  193. *(UINT16 *)Ptr = 0xFFFF; // mode list terminator
  194. Ptr += 2;
  195. VbeInfo->VideoMem64K = (UINT16)((1024 * 768 * 4 + 65535) / 65536);
  196. VbeInfo->OemSoftwareVersion = 0x0200;
  197. VbeInfo->VendorNameAddress = (UINT32)SegmentC << 12 | (UINT16)((UINTN)Ptr-SegmentC);
  198. CopyMem (Ptr, "FBSD", 5);
  199. Ptr += 5;
  200. VbeInfo->ProductNameAddress = (UINT32)SegmentC << 12 | (UINT16)((UINTN)Ptr-SegmentC);
  201. Printed = AsciiSPrint (
  202. (CHAR8 *)Ptr,
  203. sizeof VbeInfoFull->Buffer - (Ptr - VbeInfoFull->Buffer),
  204. "%s",
  205. CardName
  206. );
  207. Ptr += Printed + 1;
  208. VbeInfo->ProductRevAddress = (UINT32)SegmentC << 12 | (UINT16)((UINTN)Ptr-SegmentC);
  209. CopyMem (Ptr, mProductRevision, sizeof mProductRevision);
  210. Ptr += sizeof mProductRevision;
  211. ASSERT (sizeof VbeInfoFull->Buffer >= Ptr - VbeInfoFull->Buffer);
  212. ZeroMem (Ptr, sizeof VbeInfoFull->Buffer - (Ptr - VbeInfoFull->Buffer));
  213. //
  214. // Fill in the VBE MODE INFO structure list
  215. //
  216. VbeModeInfo = (VBE_MODE_INFO *)(VbeInfoFull + 1);
  217. Ptr = (UINT8 *)VbeModeInfo;
  218. for (i = 0; i < NUM_VBE_MODES; i++) {
  219. vbeModes[i].LfbAddress = (UINT32)FrameBufferBase;
  220. CopyMem (Ptr, &vbeModes[i], 0x32);
  221. Ptr += 0x32;
  222. }
  223. ZeroMem (Ptr, 56); // Clear remaining bytes
  224. //
  225. // Clear Write Enable (bit1), keep Read Enable (bit0) set
  226. //
  227. PciWrite8 (Pam1Address, (Pam1 & ~BIT1) | BIT0);
  228. //
  229. // Second, point the Int10h vector at the shim.
  230. //
  231. Int0x10->Segment = (UINT16)((UINT32)SegmentC >> 4);
  232. Int0x10->Offset = (UINT16)((UINTN)(VbeModeInfo + 1) - SegmentC);
  233. DEBUG ((
  234. DEBUG_INFO,
  235. "%a: VBE shim installed to %x:%x\n",
  236. __FUNCTION__,
  237. Int0x10->Segment,
  238. Int0x10->Offset
  239. ));
  240. }