VbeShim.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328
  1. /** @file
  2. Install a fake VGABIOS service handler (real mode Int10h) for the buggy
  3. Windows 2008 R2 SP1 UEFI guest.
  4. The handler is never meant to be directly executed by a VCPU; it's there for
  5. the internal real mode emulator of Windows 2008 R2 SP1.
  6. The code is based on Ralf Brown's Interrupt List:
  7. <http://www.cs.cmu.edu/~ralf/files.html>
  8. <http://www.ctyme.com/rbrown.htm>
  9. Copyright (C) 2014, Red Hat, Inc.
  10. Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>
  11. SPDX-License-Identifier: BSD-2-Clause-Patent
  12. **/
  13. #include <IndustryStandard/LegacyVgaBios.h>
  14. #include <Library/DebugLib.h>
  15. #include <Library/PciLib.h>
  16. #include <Library/PrintLib.h>
  17. #include <OvmfPlatforms.h>
  18. #include "Qemu.h"
  19. #include "VbeShim.h"
  20. #pragma pack (1)
  21. typedef struct {
  22. UINT16 Offset;
  23. UINT16 Segment;
  24. } IVT_ENTRY;
  25. #pragma pack ()
  26. //
  27. // This string is displayed by Windows 2008 R2 SP1 in the Screen Resolution,
  28. // Advanced Settings dialog. It should be short.
  29. //
  30. STATIC CONST CHAR8 mProductRevision[] = "OVMF Int10h (fake)";
  31. /**
  32. Install the VBE Info and VBE Mode Info structures, and the VBE service
  33. handler routine in the C segment. Point the real-mode Int10h interrupt vector
  34. to the handler. The only advertised mode is 1024x768x32.
  35. @param[in] CardName Name of the video card to be exposed in the
  36. Product Name field of the VBE Info structure. The
  37. parameter must originate from a
  38. QEMU_VIDEO_CARD.Name field.
  39. @param[in] FrameBufferBase Guest-physical base address of the video card's
  40. frame buffer.
  41. **/
  42. VOID
  43. InstallVbeShim (
  44. IN CONST CHAR16 *CardName,
  45. IN EFI_PHYSICAL_ADDRESS FrameBufferBase
  46. )
  47. {
  48. EFI_PHYSICAL_ADDRESS Segment0, SegmentC, SegmentF;
  49. UINTN Segment0Pages;
  50. IVT_ENTRY *Int0x10;
  51. EFI_STATUS Segment0AllocationStatus;
  52. UINT16 HostBridgeDevId;
  53. UINTN Pam1Address;
  54. UINT8 Pam1;
  55. UINTN SegmentCPages;
  56. VBE_INFO *VbeInfoFull;
  57. VBE_INFO_BASE *VbeInfo;
  58. UINT8 *Ptr;
  59. UINTN Printed;
  60. VBE_MODE_INFO *VbeModeInfo;
  61. if ((PcdGet8 (PcdNullPointerDetectionPropertyMask) & (BIT0|BIT7)) == BIT0) {
  62. DEBUG ((
  63. DEBUG_WARN,
  64. "%a: page 0 protected, not installing VBE shim\n",
  65. __FUNCTION__
  66. ));
  67. DEBUG ((
  68. DEBUG_WARN,
  69. "%a: page 0 protection prevents Windows 7 from booting anyway\n",
  70. __FUNCTION__
  71. ));
  72. return;
  73. }
  74. Segment0 = 0x00000;
  75. SegmentC = 0xC0000;
  76. SegmentF = 0xF0000;
  77. //
  78. // Attempt to cover the real mode IVT with an allocation. This is a UEFI
  79. // driver, hence the arch protocols have been installed previously. Among
  80. // those, the CPU arch protocol has configured the IDT, so we can overwrite
  81. // the IVT used in real mode.
  82. //
  83. // The allocation request may fail, eg. if LegacyBiosDxe has already run.
  84. //
  85. Segment0Pages = 1;
  86. Int0x10 = (IVT_ENTRY *)(UINTN)(Segment0 + 0x10 * sizeof (IVT_ENTRY));
  87. Segment0AllocationStatus = gBS->AllocatePages (
  88. AllocateAddress,
  89. EfiBootServicesCode,
  90. Segment0Pages,
  91. &Segment0
  92. );
  93. if (EFI_ERROR (Segment0AllocationStatus)) {
  94. EFI_PHYSICAL_ADDRESS Handler;
  95. //
  96. // Check if a video BIOS handler has been installed previously -- we
  97. // shouldn't override a real video BIOS with our shim, nor our own shim if
  98. // it's already present.
  99. //
  100. Handler = (Int0x10->Segment << 4) + Int0x10->Offset;
  101. if ((Handler >= SegmentC) && (Handler < SegmentF)) {
  102. DEBUG ((
  103. DEBUG_INFO,
  104. "%a: Video BIOS handler found at %04x:%04x\n",
  105. __FUNCTION__,
  106. Int0x10->Segment,
  107. Int0x10->Offset
  108. ));
  109. return;
  110. }
  111. //
  112. // Otherwise we'll overwrite the Int10h vector, even though we may not own
  113. // the page at zero.
  114. //
  115. DEBUG ((
  116. DEBUG_INFO,
  117. "%a: failed to allocate page at zero: %r\n",
  118. __FUNCTION__,
  119. Segment0AllocationStatus
  120. ));
  121. } else {
  122. //
  123. // We managed to allocate the page at zero. SVN r14218 guarantees that it
  124. // is NUL-filled.
  125. //
  126. ASSERT (Int0x10->Segment == 0x0000);
  127. ASSERT (Int0x10->Offset == 0x0000);
  128. }
  129. //
  130. // Put the shim in place first.
  131. //
  132. // Start by determining the address of the PAM1 register.
  133. //
  134. HostBridgeDevId = PcdGet16 (PcdOvmfHostBridgePciDevId);
  135. switch (HostBridgeDevId) {
  136. case INTEL_82441_DEVICE_ID:
  137. Pam1Address = PMC_REGISTER_PIIX4 (PIIX4_PAM1);
  138. break;
  139. case INTEL_Q35_MCH_DEVICE_ID:
  140. Pam1Address = DRAMC_REGISTER_Q35 (MCH_PAM1);
  141. break;
  142. case MICROVM_PSEUDO_DEVICE_ID:
  143. return;
  144. default:
  145. DEBUG ((
  146. DEBUG_ERROR,
  147. "%a: unknown host bridge device ID: 0x%04x\n",
  148. __FUNCTION__,
  149. HostBridgeDevId
  150. ));
  151. ASSERT (FALSE);
  152. if (!EFI_ERROR (Segment0AllocationStatus)) {
  153. gBS->FreePages (Segment0, Segment0Pages);
  154. }
  155. return;
  156. }
  157. //
  158. // low nibble covers 0xC0000 to 0xC3FFF
  159. // high nibble covers 0xC4000 to 0xC7FFF
  160. // bit1 in each nibble is Write Enable
  161. // bit0 in each nibble is Read Enable
  162. //
  163. Pam1 = PciRead8 (Pam1Address);
  164. PciWrite8 (Pam1Address, Pam1 | (BIT1 | BIT0));
  165. //
  166. // We never added memory space during PEI or DXE for the C segment, so we
  167. // don't need to (and can't) allocate from there. Also, guest operating
  168. // systems will see a hole in the UEFI memory map there.
  169. //
  170. SegmentCPages = 4;
  171. ASSERT (sizeof mVbeShim <= EFI_PAGES_TO_SIZE (SegmentCPages));
  172. CopyMem ((VOID *)(UINTN)SegmentC, mVbeShim, sizeof mVbeShim);
  173. //
  174. // Fill in the VBE INFO structure.
  175. //
  176. VbeInfoFull = (VBE_INFO *)(UINTN)SegmentC;
  177. VbeInfo = &VbeInfoFull->Base;
  178. Ptr = VbeInfoFull->Buffer;
  179. CopyMem (VbeInfo->Signature, "VESA", 4);
  180. VbeInfo->VesaVersion = 0x0300;
  181. VbeInfo->OemNameAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
  182. CopyMem (Ptr, "QEMU", 5);
  183. Ptr += 5;
  184. VbeInfo->Capabilities = BIT0; // DAC can be switched into 8-bit mode
  185. VbeInfo->ModeListAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
  186. *(UINT16 *)Ptr = 0x00f1; // mode number
  187. Ptr += 2;
  188. *(UINT16 *)Ptr = 0xFFFF; // mode list terminator
  189. Ptr += 2;
  190. VbeInfo->VideoMem64K = (UINT16)((1024 * 768 * 4 + 65535) / 65536);
  191. VbeInfo->OemSoftwareVersion = 0x0000;
  192. VbeInfo->VendorNameAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
  193. CopyMem (Ptr, "OVMF", 5);
  194. Ptr += 5;
  195. VbeInfo->ProductNameAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
  196. Printed = AsciiSPrint (
  197. (CHAR8 *)Ptr,
  198. sizeof VbeInfoFull->Buffer - (Ptr - VbeInfoFull->Buffer),
  199. "%s",
  200. CardName
  201. );
  202. Ptr += Printed + 1;
  203. VbeInfo->ProductRevAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
  204. CopyMem (Ptr, mProductRevision, sizeof mProductRevision);
  205. Ptr += sizeof mProductRevision;
  206. ASSERT (sizeof VbeInfoFull->Buffer >= Ptr - VbeInfoFull->Buffer);
  207. ZeroMem (Ptr, sizeof VbeInfoFull->Buffer - (Ptr - VbeInfoFull->Buffer));
  208. //
  209. // Fil in the VBE MODE INFO structure.
  210. //
  211. VbeModeInfo = (VBE_MODE_INFO *)(VbeInfoFull + 1);
  212. //
  213. // bit0: mode supported by present hardware configuration
  214. // bit1: optional information available (must be =1 for VBE v1.2+)
  215. // bit3: set if color, clear if monochrome
  216. // bit4: set if graphics mode, clear if text mode
  217. // bit5: mode is not VGA-compatible
  218. // bit7: linear framebuffer mode supported
  219. //
  220. VbeModeInfo->ModeAttr = BIT7 | BIT5 | BIT4 | BIT3 | BIT1 | BIT0;
  221. //
  222. // bit0: exists
  223. // bit1: bit1: readable
  224. // bit2: writeable
  225. //
  226. VbeModeInfo->WindowAAttr = BIT2 | BIT1 | BIT0;
  227. VbeModeInfo->WindowBAttr = 0x00;
  228. VbeModeInfo->WindowGranularityKB = 0x0040;
  229. VbeModeInfo->WindowSizeKB = 0x0040;
  230. VbeModeInfo->WindowAStartSegment = 0xA000;
  231. VbeModeInfo->WindowBStartSegment = 0x0000;
  232. VbeModeInfo->WindowPositioningAddress = 0x0000;
  233. VbeModeInfo->BytesPerScanLine = 1024 * 4;
  234. VbeModeInfo->Width = 1024;
  235. VbeModeInfo->Height = 768;
  236. VbeModeInfo->CharCellWidth = 8;
  237. VbeModeInfo->CharCellHeight = 16;
  238. VbeModeInfo->NumPlanes = 1;
  239. VbeModeInfo->BitsPerPixel = 32;
  240. VbeModeInfo->NumBanks = 1;
  241. VbeModeInfo->MemoryModel = 6; // direct color
  242. VbeModeInfo->BankSizeKB = 0;
  243. VbeModeInfo->NumImagePagesLessOne = 0;
  244. VbeModeInfo->Vbe3 = 0x01;
  245. VbeModeInfo->RedMaskSize = 8;
  246. VbeModeInfo->RedMaskPos = 16;
  247. VbeModeInfo->GreenMaskSize = 8;
  248. VbeModeInfo->GreenMaskPos = 8;
  249. VbeModeInfo->BlueMaskSize = 8;
  250. VbeModeInfo->BlueMaskPos = 0;
  251. VbeModeInfo->ReservedMaskSize = 8;
  252. VbeModeInfo->ReservedMaskPos = 24;
  253. //
  254. // bit1: Bytes in reserved field may be used by application
  255. //
  256. VbeModeInfo->DirectColorModeInfo = BIT1;
  257. VbeModeInfo->LfbAddress = (UINT32)FrameBufferBase;
  258. VbeModeInfo->OffScreenAddress = 0;
  259. VbeModeInfo->OffScreenSizeKB = 0;
  260. VbeModeInfo->BytesPerScanLineLinear = 1024 * 4;
  261. VbeModeInfo->NumImagesLessOneBanked = 0;
  262. VbeModeInfo->NumImagesLessOneLinear = 0;
  263. VbeModeInfo->RedMaskSizeLinear = 8;
  264. VbeModeInfo->RedMaskPosLinear = 16;
  265. VbeModeInfo->GreenMaskSizeLinear = 8;
  266. VbeModeInfo->GreenMaskPosLinear = 8;
  267. VbeModeInfo->BlueMaskSizeLinear = 8;
  268. VbeModeInfo->BlueMaskPosLinear = 0;
  269. VbeModeInfo->ReservedMaskSizeLinear = 8;
  270. VbeModeInfo->ReservedMaskPosLinear = 24;
  271. VbeModeInfo->MaxPixelClockHz = 0;
  272. ZeroMem (VbeModeInfo->Reserved, sizeof VbeModeInfo->Reserved);
  273. //
  274. // Clear Write Enable (bit1), keep Read Enable (bit0) set
  275. //
  276. PciWrite8 (Pam1Address, (Pam1 & ~BIT1) | BIT0);
  277. //
  278. // Second, point the Int10h vector at the shim.
  279. //
  280. Int0x10->Segment = (UINT16)((UINT32)SegmentC >> 4);
  281. Int0x10->Offset = (UINT16)((UINTN)(VbeModeInfo + 1) - SegmentC);
  282. DEBUG ((DEBUG_INFO, "%a: VBE shim installed\n", __FUNCTION__));
  283. }