| 1 | /** @file
|
|---|
| 2 | Install a fake VGABIOS service handler (real mode Int10h) for the buggy
|
|---|
| 3 | Windows 2008 R2 SP1 UEFI guest.
|
|---|
| 4 |
|
|---|
| 5 | The handler is never meant to be directly executed by a VCPU; it's there for
|
|---|
| 6 | the internal real mode emulator of Windows 2008 R2 SP1.
|
|---|
| 7 |
|
|---|
| 8 | The code is based on Ralf Brown's Interrupt List:
|
|---|
| 9 | <http://www.cs.cmu.edu/~ralf/files.html>
|
|---|
| 10 | <http://www.ctyme.com/rbrown.htm>
|
|---|
| 11 |
|
|---|
| 12 | Copyright (C) 2014, Red Hat, Inc.
|
|---|
| 13 | Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>
|
|---|
| 14 |
|
|---|
| 15 | SPDX-License-Identifier: BSD-2-Clause-Patent
|
|---|
| 16 | **/
|
|---|
| 17 |
|
|---|
| 18 | #include <IndustryStandard/LegacyVgaBios.h>
|
|---|
| 19 | #include <Library/DebugLib.h>
|
|---|
| 20 | #include <Library/PciLib.h>
|
|---|
| 21 | #include <Library/PrintLib.h>
|
|---|
| 22 | #include <OvmfPlatforms.h>
|
|---|
| 23 |
|
|---|
| 24 | #include "Qemu.h"
|
|---|
| 25 | #include "VbeShim.h"
|
|---|
| 26 |
|
|---|
| 27 | #pragma pack (1)
|
|---|
| 28 | typedef struct {
|
|---|
| 29 | UINT16 Offset;
|
|---|
| 30 | UINT16 Segment;
|
|---|
| 31 | } IVT_ENTRY;
|
|---|
| 32 | #pragma pack ()
|
|---|
| 33 |
|
|---|
| 34 | //
|
|---|
| 35 | // This string is displayed by Windows 2008 R2 SP1 in the Screen Resolution,
|
|---|
| 36 | // Advanced Settings dialog. It should be short.
|
|---|
| 37 | //
|
|---|
| 38 | STATIC CONST CHAR8 mProductRevision[] = "OVMF Int10h (fake)";
|
|---|
| 39 |
|
|---|
| 40 | /**
|
|---|
| 41 | Install the VBE Info and VBE Mode Info structures, and the VBE service
|
|---|
| 42 | handler routine in the C segment. Point the real-mode Int10h interrupt vector
|
|---|
| 43 | to the handler. The only advertised mode is 1024x768x32.
|
|---|
| 44 |
|
|---|
| 45 | @param[in] CardName Name of the video card to be exposed in the
|
|---|
| 46 | Product Name field of the VBE Info structure. The
|
|---|
| 47 | parameter must originate from a
|
|---|
| 48 | QEMU_VIDEO_CARD.Name field.
|
|---|
| 49 | @param[in] FrameBufferBase Guest-physical base address of the video card's
|
|---|
| 50 | frame buffer.
|
|---|
| 51 | **/
|
|---|
| 52 | VOID
|
|---|
| 53 | InstallVbeShim (
|
|---|
| 54 | IN CONST CHAR16 *CardName,
|
|---|
| 55 | IN EFI_PHYSICAL_ADDRESS FrameBufferBase
|
|---|
| 56 | )
|
|---|
| 57 | {
|
|---|
| 58 | EFI_PHYSICAL_ADDRESS Segment0, SegmentC, SegmentF;
|
|---|
| 59 | UINTN Segment0Pages;
|
|---|
| 60 | IVT_ENTRY *Int0x10;
|
|---|
| 61 | EFI_STATUS Segment0AllocationStatus;
|
|---|
| 62 | UINT16 HostBridgeDevId;
|
|---|
| 63 | UINTN Pam1Address;
|
|---|
| 64 | UINT8 Pam1;
|
|---|
| 65 | UINTN SegmentCPages;
|
|---|
| 66 | VBE_INFO *VbeInfoFull;
|
|---|
| 67 | VBE_INFO_BASE *VbeInfo;
|
|---|
| 68 | UINT8 *Ptr;
|
|---|
| 69 | UINTN Printed;
|
|---|
| 70 | VBE_MODE_INFO *VbeModeInfo;
|
|---|
| 71 |
|
|---|
| 72 | if ((PcdGet8 (PcdNullPointerDetectionPropertyMask) & (BIT0|BIT7)) == BIT0) {
|
|---|
| 73 | DEBUG ((
|
|---|
| 74 | DEBUG_WARN,
|
|---|
| 75 | "%a: page 0 protected, not installing VBE shim\n",
|
|---|
| 76 | __func__
|
|---|
| 77 | ));
|
|---|
| 78 | DEBUG ((
|
|---|
| 79 | DEBUG_WARN,
|
|---|
| 80 | "%a: page 0 protection prevents Windows 7 from booting anyway\n",
|
|---|
| 81 | __func__
|
|---|
| 82 | ));
|
|---|
| 83 | return;
|
|---|
| 84 | }
|
|---|
| 85 |
|
|---|
| 86 | Segment0 = 0x00000;
|
|---|
| 87 | SegmentC = 0xC0000;
|
|---|
| 88 | SegmentF = 0xF0000;
|
|---|
| 89 |
|
|---|
| 90 | //
|
|---|
| 91 | // Attempt to cover the real mode IVT with an allocation. This is a UEFI
|
|---|
| 92 | // driver, hence the arch protocols have been installed previously. Among
|
|---|
| 93 | // those, the CPU arch protocol has configured the IDT, so we can overwrite
|
|---|
| 94 | // the IVT used in real mode.
|
|---|
| 95 | //
|
|---|
| 96 | // The allocation request may fail, eg. if LegacyBiosDxe has already run.
|
|---|
| 97 | //
|
|---|
| 98 | Segment0Pages = 1;
|
|---|
| 99 | Int0x10 = (IVT_ENTRY *)(UINTN)(Segment0 + 0x10 * sizeof (IVT_ENTRY));
|
|---|
| 100 | Segment0AllocationStatus = gBS->AllocatePages (
|
|---|
| 101 | AllocateAddress,
|
|---|
| 102 | EfiBootServicesCode,
|
|---|
| 103 | Segment0Pages,
|
|---|
| 104 | &Segment0
|
|---|
| 105 | );
|
|---|
| 106 |
|
|---|
| 107 | if (EFI_ERROR (Segment0AllocationStatus)) {
|
|---|
| 108 | EFI_PHYSICAL_ADDRESS Handler;
|
|---|
| 109 |
|
|---|
| 110 | //
|
|---|
| 111 | // Check if a video BIOS handler has been installed previously -- we
|
|---|
| 112 | // shouldn't override a real video BIOS with our shim, nor our own shim if
|
|---|
| 113 | // it's already present.
|
|---|
| 114 | //
|
|---|
| 115 | Handler = (Int0x10->Segment << 4) + Int0x10->Offset;
|
|---|
| 116 | if ((Handler >= SegmentC) && (Handler < SegmentF)) {
|
|---|
| 117 | DEBUG ((
|
|---|
| 118 | DEBUG_INFO,
|
|---|
| 119 | "%a: Video BIOS handler found at %04x:%04x\n",
|
|---|
| 120 | __func__,
|
|---|
| 121 | Int0x10->Segment,
|
|---|
| 122 | Int0x10->Offset
|
|---|
| 123 | ));
|
|---|
| 124 | return;
|
|---|
| 125 | }
|
|---|
| 126 |
|
|---|
| 127 | //
|
|---|
| 128 | // Otherwise we'll overwrite the Int10h vector, even though we may not own
|
|---|
| 129 | // the page at zero.
|
|---|
| 130 | //
|
|---|
| 131 | DEBUG ((
|
|---|
| 132 | DEBUG_INFO,
|
|---|
| 133 | "%a: failed to allocate page at zero: %r\n",
|
|---|
| 134 | __func__,
|
|---|
| 135 | Segment0AllocationStatus
|
|---|
| 136 | ));
|
|---|
| 137 | } else {
|
|---|
| 138 | //
|
|---|
| 139 | // We managed to allocate the page at zero. SVN r14218 guarantees that it
|
|---|
| 140 | // is NUL-filled.
|
|---|
| 141 | //
|
|---|
| 142 | ASSERT (Int0x10->Segment == 0x0000);
|
|---|
| 143 | ASSERT (Int0x10->Offset == 0x0000);
|
|---|
| 144 | }
|
|---|
| 145 |
|
|---|
| 146 | //
|
|---|
| 147 | // Put the shim in place first.
|
|---|
| 148 | //
|
|---|
| 149 | // Start by determining the address of the PAM1 register.
|
|---|
| 150 | //
|
|---|
| 151 | HostBridgeDevId = PcdGet16 (PcdOvmfHostBridgePciDevId);
|
|---|
| 152 | switch (HostBridgeDevId) {
|
|---|
| 153 | case INTEL_82441_DEVICE_ID:
|
|---|
| 154 | Pam1Address = PMC_REGISTER_PIIX4 (PIIX4_PAM1);
|
|---|
| 155 | break;
|
|---|
| 156 | case INTEL_Q35_MCH_DEVICE_ID:
|
|---|
| 157 | Pam1Address = DRAMC_REGISTER_Q35 (MCH_PAM1);
|
|---|
| 158 | break;
|
|---|
| 159 | case MICROVM_PSEUDO_DEVICE_ID:
|
|---|
| 160 | return;
|
|---|
| 161 | default:
|
|---|
| 162 | DEBUG ((
|
|---|
| 163 | DEBUG_ERROR,
|
|---|
| 164 | "%a: unknown host bridge device ID: 0x%04x\n",
|
|---|
| 165 | __func__,
|
|---|
| 166 | HostBridgeDevId
|
|---|
| 167 | ));
|
|---|
| 168 | ASSERT (FALSE);
|
|---|
| 169 |
|
|---|
| 170 | if (!EFI_ERROR (Segment0AllocationStatus)) {
|
|---|
| 171 | gBS->FreePages (Segment0, Segment0Pages);
|
|---|
| 172 | }
|
|---|
| 173 |
|
|---|
| 174 | return;
|
|---|
| 175 | }
|
|---|
| 176 |
|
|---|
| 177 | //
|
|---|
| 178 | // low nibble covers 0xC0000 to 0xC3FFF
|
|---|
| 179 | // high nibble covers 0xC4000 to 0xC7FFF
|
|---|
| 180 | // bit1 in each nibble is Write Enable
|
|---|
| 181 | // bit0 in each nibble is Read Enable
|
|---|
| 182 | //
|
|---|
| 183 | Pam1 = PciRead8 (Pam1Address);
|
|---|
| 184 | PciWrite8 (Pam1Address, Pam1 | (BIT1 | BIT0));
|
|---|
| 185 |
|
|---|
| 186 | //
|
|---|
| 187 | // We never added memory space during PEI or DXE for the C segment, so we
|
|---|
| 188 | // don't need to (and can't) allocate from there. Also, guest operating
|
|---|
| 189 | // systems will see a hole in the UEFI memory map there.
|
|---|
| 190 | //
|
|---|
| 191 | SegmentCPages = 4;
|
|---|
| 192 |
|
|---|
| 193 | ASSERT (sizeof mVbeShim <= EFI_PAGES_TO_SIZE (SegmentCPages));
|
|---|
| 194 | CopyMem ((VOID *)(UINTN)SegmentC, mVbeShim, sizeof mVbeShim);
|
|---|
| 195 |
|
|---|
| 196 | //
|
|---|
| 197 | // Fill in the VBE INFO structure.
|
|---|
| 198 | //
|
|---|
| 199 | VbeInfoFull = (VBE_INFO *)(UINTN)SegmentC;
|
|---|
| 200 | VbeInfo = &VbeInfoFull->Base;
|
|---|
| 201 | Ptr = VbeInfoFull->Buffer;
|
|---|
| 202 |
|
|---|
| 203 | CopyMem (VbeInfo->Signature, "VESA", 4);
|
|---|
| 204 | VbeInfo->VesaVersion = 0x0300;
|
|---|
| 205 |
|
|---|
| 206 | VbeInfo->OemNameAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
|
|---|
| 207 | CopyMem (Ptr, "QEMU", 5);
|
|---|
| 208 | Ptr += 5;
|
|---|
| 209 |
|
|---|
| 210 | VbeInfo->Capabilities = BIT0; // DAC can be switched into 8-bit mode
|
|---|
| 211 |
|
|---|
| 212 | VbeInfo->ModeListAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
|
|---|
| 213 | *(UINT16 *)Ptr = 0x00f1; // mode number
|
|---|
| 214 | Ptr += 2;
|
|---|
| 215 | *(UINT16 *)Ptr = 0xFFFF; // mode list terminator
|
|---|
| 216 | Ptr += 2;
|
|---|
| 217 |
|
|---|
| 218 | VbeInfo->VideoMem64K = (UINT16)((1024 * 768 * 4 + 65535) / 65536);
|
|---|
| 219 | VbeInfo->OemSoftwareVersion = 0x0000;
|
|---|
| 220 |
|
|---|
| 221 | VbeInfo->VendorNameAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
|
|---|
| 222 | CopyMem (Ptr, "OVMF", 5);
|
|---|
| 223 | Ptr += 5;
|
|---|
| 224 |
|
|---|
| 225 | VbeInfo->ProductNameAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
|
|---|
| 226 | Printed = AsciiSPrint (
|
|---|
| 227 | (CHAR8 *)Ptr,
|
|---|
| 228 | sizeof VbeInfoFull->Buffer - (Ptr - VbeInfoFull->Buffer),
|
|---|
| 229 | "%s",
|
|---|
| 230 | CardName
|
|---|
| 231 | );
|
|---|
| 232 | Ptr += Printed + 1;
|
|---|
| 233 |
|
|---|
| 234 | VbeInfo->ProductRevAddress = (UINT32)SegmentC << 12 | (UINT16)(UINTN)Ptr;
|
|---|
| 235 | CopyMem (Ptr, mProductRevision, sizeof mProductRevision);
|
|---|
| 236 | Ptr += sizeof mProductRevision;
|
|---|
| 237 |
|
|---|
| 238 | ASSERT (sizeof VbeInfoFull->Buffer >= Ptr - VbeInfoFull->Buffer);
|
|---|
| 239 | ZeroMem (Ptr, sizeof VbeInfoFull->Buffer - (Ptr - VbeInfoFull->Buffer));
|
|---|
| 240 |
|
|---|
| 241 | //
|
|---|
| 242 | // Fil in the VBE MODE INFO structure.
|
|---|
| 243 | //
|
|---|
| 244 | VbeModeInfo = (VBE_MODE_INFO *)(VbeInfoFull + 1);
|
|---|
| 245 |
|
|---|
| 246 | //
|
|---|
| 247 | // bit0: mode supported by present hardware configuration
|
|---|
| 248 | // bit1: optional information available (must be =1 for VBE v1.2+)
|
|---|
| 249 | // bit3: set if color, clear if monochrome
|
|---|
| 250 | // bit4: set if graphics mode, clear if text mode
|
|---|
| 251 | // bit5: mode is not VGA-compatible
|
|---|
| 252 | // bit7: linear framebuffer mode supported
|
|---|
| 253 | //
|
|---|
| 254 | VbeModeInfo->ModeAttr = BIT7 | BIT5 | BIT4 | BIT3 | BIT1 | BIT0;
|
|---|
| 255 |
|
|---|
| 256 | //
|
|---|
| 257 | // bit0: exists
|
|---|
| 258 | // bit1: bit1: readable
|
|---|
| 259 | // bit2: writeable
|
|---|
| 260 | //
|
|---|
| 261 | VbeModeInfo->WindowAAttr = BIT2 | BIT1 | BIT0;
|
|---|
| 262 |
|
|---|
| 263 | VbeModeInfo->WindowBAttr = 0x00;
|
|---|
| 264 | VbeModeInfo->WindowGranularityKB = 0x0040;
|
|---|
| 265 | VbeModeInfo->WindowSizeKB = 0x0040;
|
|---|
| 266 | VbeModeInfo->WindowAStartSegment = 0xA000;
|
|---|
| 267 | VbeModeInfo->WindowBStartSegment = 0x0000;
|
|---|
| 268 | VbeModeInfo->WindowPositioningAddress = 0x0000;
|
|---|
| 269 | VbeModeInfo->BytesPerScanLine = 1024 * 4;
|
|---|
| 270 |
|
|---|
| 271 | VbeModeInfo->Width = 1024;
|
|---|
| 272 | VbeModeInfo->Height = 768;
|
|---|
| 273 | VbeModeInfo->CharCellWidth = 8;
|
|---|
| 274 | VbeModeInfo->CharCellHeight = 16;
|
|---|
| 275 | VbeModeInfo->NumPlanes = 1;
|
|---|
| 276 | VbeModeInfo->BitsPerPixel = 32;
|
|---|
| 277 | VbeModeInfo->NumBanks = 1;
|
|---|
| 278 | VbeModeInfo->MemoryModel = 6; // direct color
|
|---|
| 279 | VbeModeInfo->BankSizeKB = 0;
|
|---|
| 280 | VbeModeInfo->NumImagePagesLessOne = 0;
|
|---|
| 281 | VbeModeInfo->Vbe3 = 0x01;
|
|---|
| 282 |
|
|---|
| 283 | VbeModeInfo->RedMaskSize = 8;
|
|---|
| 284 | VbeModeInfo->RedMaskPos = 16;
|
|---|
| 285 | VbeModeInfo->GreenMaskSize = 8;
|
|---|
| 286 | VbeModeInfo->GreenMaskPos = 8;
|
|---|
| 287 | VbeModeInfo->BlueMaskSize = 8;
|
|---|
| 288 | VbeModeInfo->BlueMaskPos = 0;
|
|---|
| 289 | VbeModeInfo->ReservedMaskSize = 8;
|
|---|
| 290 | VbeModeInfo->ReservedMaskPos = 24;
|
|---|
| 291 |
|
|---|
| 292 | //
|
|---|
| 293 | // bit1: Bytes in reserved field may be used by application
|
|---|
| 294 | //
|
|---|
| 295 | VbeModeInfo->DirectColorModeInfo = BIT1;
|
|---|
| 296 |
|
|---|
| 297 | VbeModeInfo->LfbAddress = (UINT32)FrameBufferBase;
|
|---|
| 298 | VbeModeInfo->OffScreenAddress = 0;
|
|---|
| 299 | VbeModeInfo->OffScreenSizeKB = 0;
|
|---|
| 300 |
|
|---|
| 301 | VbeModeInfo->BytesPerScanLineLinear = 1024 * 4;
|
|---|
| 302 | VbeModeInfo->NumImagesLessOneBanked = 0;
|
|---|
| 303 | VbeModeInfo->NumImagesLessOneLinear = 0;
|
|---|
| 304 | VbeModeInfo->RedMaskSizeLinear = 8;
|
|---|
| 305 | VbeModeInfo->RedMaskPosLinear = 16;
|
|---|
| 306 | VbeModeInfo->GreenMaskSizeLinear = 8;
|
|---|
| 307 | VbeModeInfo->GreenMaskPosLinear = 8;
|
|---|
| 308 | VbeModeInfo->BlueMaskSizeLinear = 8;
|
|---|
| 309 | VbeModeInfo->BlueMaskPosLinear = 0;
|
|---|
| 310 | VbeModeInfo->ReservedMaskSizeLinear = 8;
|
|---|
| 311 | VbeModeInfo->ReservedMaskPosLinear = 24;
|
|---|
| 312 | VbeModeInfo->MaxPixelClockHz = 0;
|
|---|
| 313 |
|
|---|
| 314 | ZeroMem (VbeModeInfo->Reserved, sizeof VbeModeInfo->Reserved);
|
|---|
| 315 |
|
|---|
| 316 | //
|
|---|
| 317 | // Clear Write Enable (bit1), keep Read Enable (bit0) set
|
|---|
| 318 | //
|
|---|
| 319 | PciWrite8 (Pam1Address, (Pam1 & ~BIT1) | BIT0);
|
|---|
| 320 |
|
|---|
| 321 | //
|
|---|
| 322 | // Second, point the Int10h vector at the shim.
|
|---|
| 323 | //
|
|---|
| 324 | Int0x10->Segment = (UINT16)((UINT32)SegmentC >> 4);
|
|---|
| 325 | Int0x10->Offset = (UINT16)((UINTN)(VbeModeInfo + 1) - SegmentC);
|
|---|
| 326 |
|
|---|
| 327 | DEBUG ((DEBUG_INFO, "%a: VBE shim installed\n", __func__));
|
|---|
| 328 | }
|
|---|
