2 * This file is part of the coreboot project.
4 * (C) 2007-2009 coresystems GmbH
5 * (See further copyright notices below)
7 * NOTE: This file is supposed to go away once the generic vm86 handler
8 * in util/x86emu is able to handle intXX hooks like yabel does.
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; version 2 of the License.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
24 #include <console/console.h>
25 #include <device/pci.h>
26 #include <device/pci_ids.h>
27 #include <device/pci_ops.h>
33 void write_protect_vgabios(void);
35 /* vgabios.c. Derived from: */
37 /*------------------------------------------------------------ -*- C -*-
38 * 2 Kernel Monte a.k.a. Linux loading Linux on x86
40 * Erik Arjan Hendriks <hendriks@lanl.gov>
42 * This version is a derivative of the original two kernel monte
43 * which is (C) 2000 Scyld.
45 * Copyright (C) 2000 Scyld Computing Corporation
47 * Portions related to the alpha architecture are:
49 * Copyright(C) 2001 University of California. LA-CC Number 01-67.
50 * This software has been authored by an employee or employees of the
51 * University of California, operator of the Los Alamos National
52 * Laboratory under Contract No. W-7405-ENG-36 with the U.S.
53 * Department of Energy. The U.S. Government has rights to use,
54 * reproduce, and distribute this software. If the software is
55 * modified to produce derivative works, such modified software should
56 * be clearly marked, so as not to confuse it with the version
57 * available from LANL.
59 * This software may be used and distributed according to the terms
60 * of the GNU General Public License, incorporated herein by
61 * reference to http://www.gnu.org/licenses/gpl.html.
63 * This software is provided by the author(s) "as is" and any express
64 * or implied warranties, including, but not limited to, the implied
65 * warranties of merchantability and fitness for a particular purpose
66 * are disclaimed. In no event shall the author(s) be liable for any
67 * direct, indirect, incidental, special, exemplary, or consequential
68 * damages (including, but not limited to, procurement of substitute
69 * goods or services; loss of use, data, or profits; or business
70 * interruption) however caused and on any theory of liability,
71 * whether in contract, strict liability, or tort (including
72 * negligence or otherwise) arising in any way out of the use of this
73 * software, even if advised of the possibility of such damage.
75 *--------------------------------------------------------------------*/
77 /* Modified to be a self sufficient plug in so that it can be used
78 without reliance on other parts of core Linuxbios
79 (C) 2005 Nick.Barker9@btinternet.com
81 Used initially for epia-m where there are problems getting the bios
82 emulator to successfully run this bios.
85 /* Declare a temporary global descriptor table - necessary because the
86 Core part of the bios no longer sets up any 16 bit segments */
88 /* pointer to original gdt */
92 /* compute the table limit */
93 "__mygdt_limit = __mygdt_end - __mygdt - 1 \n"
95 " .word __mygdt_limit \n"
98 /* selgdt 0, unused */
99 " .word 0x0000, 0x0000 \n"
100 " .byte 0x00, 0x00, 0x00, 0x00 \n"
101 /* selgdt 8, unused */
102 " .word 0x0000, 0x0000 \n"
103 " .byte 0x00, 0x00, 0x00, 0x00 \n"
104 /* selgdt 0x10, flat code segment */
105 " .word 0xffff, 0x0000 \n"
106 " .byte 0x00, 0x9b, 0xcf, 0x00 \n"
107 /* selgdt 0x18, flat data segment */
108 " .word 0xffff, 0x0000 \n"
109 " .byte 0x00, 0x93, 0xcf, 0x00 \n"
110 /* selgdt 0x20, unused */
111 " .word 0x0000, 0x0000 \n"
112 " .byte 0x00, 0x00, 0x00, 0x00 \n"
113 /* selgdt 0x28 16-bit 64k code at 0x00000000 */
114 " .word 0xffff, 0x0000 \n"
115 " .byte 0, 0x9a, 0, 0 \n"
116 /* selgdt 0x30 16-bit 64k data at 0x00000000 */
117 " .word 0xffff, 0x0000 \n"
118 " .byte 0, 0x92, 0, 0 \n"
121 /* Declare a pointer to where our idt is going to be i.e. at mem zero */
122 __asm__("__myidt: \n"
126 " .long 0 \n" " .word 0 \n");
128 /* The address arguments to this function are PHYSICAL ADDRESSES */
129 static void real_mode_switch_call_vga(unsigned long devfn)
131 __asm__ __volatile__(
132 // paranoia -- does ecx get saved? not sure. This is
133 // the easiest safe thing to do.
136 " mov %esp, __stack \n"
138 "__stack: .long 0 \n" "1:\n"
139 /* get devfn into %ecx */
140 " movl %esp, %ebp \n"
141 " movl 8(%ebp), %ecx \n"
143 " lgdt %cs:__mygdtaddr \n"
144 /* This configures CS properly for real mode. */
145 " ljmp $0x28, $__rms_16bit\n"
148 /* 16 bit code from here on... */
149 /* Load the segment registers w/ properly configured segment
150 * descriptors. They will retain these configurations (limits,
151 * writability, etc.) once protected mode is turned off. */
158 /* Turn off protection (bit 0 in CR0) */
159 " movl %cr0, %eax \n"
160 " andl $0xFFFFFFFE, %eax \n"
161 " movl %eax, %cr0 \n"
162 /* Now really going into real mode */
163 " ljmp $0, $__rms_real\n"
165 /* put the stack at the end of page zero.
166 * that way we can easily share it between real and protected,
167 * since the 16-bit ESP at segment 0 will work for any case.
172 " movl $0x1000, %eax \n"
173 " movl %eax, %esp \n"
174 /* Load our 16 it idt */
178 /* Dump zeros in the other segregs */
185 /* run VGA BIOS at 0xc000:0003 */
186 " lcall $0xc000, $0x0003\n"
187 /* if we got here, just about done.
188 * Need to get back to protected mode */
189 " movl %cr0, %eax \n" " orl $0x0000001, %eax\n" /* PE = 1 */
190 " movl %eax, %cr0 \n"
191 /* Now that we are in protected mode jump to a 32 bit code segment. */
192 " data32 ljmp $0x10, $vgarestart\n"
195 " movw $0x18, %ax \n"
201 /* restore proper gdt and idt */
202 " lgdt %cs:gdtarg \n"
206 " mov __stack, %esp \n"
210 __asm__(".text\n" "real_mode_switch_end:\n");
211 extern char real_mode_switch_end[];
213 /* call vga bios int 10 function 0x4f14 to enable main console
214 epia-m does not always autosence the main console so forcing it on is good !! */
215 void vga_enable_console(void)
217 __asm__ __volatile__(
218 /* paranoia -- does ecx get saved? not sure. This is
219 * the easiest safe thing to do. */
222 " mov %esp, __stack \n"
224 " lgdt %cs:__mygdtaddr \n"
225 /* This configures CS properly for real mode. */
226 " ljmp $0x28, $__vga_ec_16bit\n"
229 /* 16 bit code from here on... */
230 /* Load the segment registers w/ properly configured segment
231 * descriptors. They will retain these configurations (limits,
232 * writability, etc.) once protected mode is turned off. */
239 /* Turn off protection (bit 0 in CR0) */
240 " movl %cr0, %eax \n"
241 " andl $0xFFFFFFFE, %eax\n"
242 " movl %eax, %cr0 \n"
243 /* Now really going into real mode */
244 " ljmp $0, $__vga_ec_real \n"
246 /* put the stack at the end of page zero.
247 * that way we can easily share it between real and protected,
248 * since the 16-bit ESP at segment 0 will work for any case.
253 " movl $0x1000, %eax \n"
254 " movl %eax, %esp \n"
255 /* debugging for RGM */
257 " outb %al, $0x80 \n"
258 /* Load our 16 it idt */
262 /* Dump zeros in the other segregs */
267 /* ask bios to enable main console */
268 /* set up for int 10 call - values found from X server
269 * bios call routines */
270 " movw $0x4f14,%ax \n"
271 " movw $0x8003,%bx \n"
276 " movb $0x55, %al \n"
277 " outb %al, $0x80 \n"
278 /* if we got here, just about done.
279 * Need to get back to protected mode */
280 " movl %cr0, %eax \n" " orl $0x0000001, %eax\n" /* PE = 1 */
281 " movl %eax, %cr0 \n"
282 /* Now that we are in protected mode jump to a 32 bit code segment. */
283 " data32 ljmp $0x10, $vga_ec_restart\n"
286 " movw $0x18, %ax \n"
292 /* restore proper gdt and idt */
293 " lgdt %cs:gdtarg \n"
295 " .globl vga__ec_exit \n"
297 " mov __stack, %esp \n"
301 void do_vgabios(void)
304 unsigned long busdevfn;
305 unsigned int rom = 0;
307 unsigned int size = 64 * 1024;
310 /* clear vga bios data area */
311 for (i = 0x400; i < 0x500; i++) {
312 *(unsigned char *)i = 0;
315 dev = dev_find_class(PCI_CLASS_DISPLAY_VGA << 8, 0);
318 printk(BIOS_DEBUG, "NO VGA FOUND\n");
321 printk(BIOS_DEBUG, "found VGA: vid=%x, did=%x\n", dev->vendor, dev->device);
323 /* declare rom address here - keep any config data out of the way
324 * of core LXB stuff */
326 #warning ROM address hardcoded to 512K
327 rom = (unsigned int)cbfs_load_optionrom(dev->vendor, dev->device, 0);
328 pci_write_config32(dev, PCI_ROM_ADDRESS, rom | 1);
329 printk(BIOS_DEBUG, "rom base, size: %x\n", rom);
331 buf = (unsigned char *)rom;
332 if ((buf[0] == 0x55) && (buf[1] == 0xaa)) {
333 memcpy((void *)0xc0000, buf, size);
335 write_protect_vgabios(); // in northbridge
337 // check signature again
338 buf = (unsigned char *)0xc0000;
339 if (buf[0] == 0x55 && buf[1] == 0xAA) {
341 (dev->bus->secondary << 8) | dev->path.pci.devfn;
342 printk(BIOS_DEBUG, "bus/devfn = %#lx\n", busdevfn);
344 real_mode_switch_call_vga(busdevfn);
346 printk(BIOS_DEBUG, "Failed to copy VGA BIOS to 0xc0000\n");
348 printk(BIOS_DEBUG, "BAD SIGNATURE 0x%x 0x%x\n", buf[0], buf[1]);
350 pci_write_config32(dev, PCI_ROM_ADDRESS, 0);
353 // we had hoped to avoid this.
354 // this is a stub IDT only. It's main purpose is to ignore calls
356 // no longer. Dammit. We have to respond to these.
358 unsigned short offset, cs;
361 // from a handy writeup that andrey found.
364 // There are some assumptions we can make here.
365 // First, the Top Of Stack (TOS) is located on the top of page zero.
366 // we can share this stack between real and protected mode.
367 // that simplifies a lot of things ...
368 // we'll just push all the registers on the stack as longwords,
369 // and pop to protected mode.
370 // second, since this only ever runs as part of linuxbios,
371 // we know all the segment register values -- so we don't save any.
372 // keep the handler that calls things small. It can do a call to
373 // more complex code in linuxbios itself. This helps a lot as we don't
374 // have to do address fixup in this little stub, and calls are absolute
375 // so the handler is relocatable.
378 __asm__ __volatile__(" .code16 \n"
382 " ljmp $0, $callbiosint16\n"
387 void debughandler(void)
389 __asm__ __volatile__(" .code16 \n"
397 "end_debughandle: \n" ".code32 \n");
400 // Calling conventions. The first C function is called with this stuff
401 // on the stack. They look like value parameters, but note that if you
402 // modify them they will go back to the INTx function modified.
403 // the C function will call the biosint function with these as
404 // REFERENCE parameters. In this way, we can easily get
405 // returns back to the INTx caller (i.e. vgabios)
406 void callbiosint(void)
408 __asm__ __volatile__(" .code16 \n"
412 " push %fs \n" " push %gs \n"
413 // clean up the int #. To save space we put it in the lower
414 // byte. But the top 24 bits are junk.
415 " andl $0xff, %eax\n"
416 // this push does two things:
417 // - put the INT # on the stack as a parameter
418 // - provides us with a temp for the %cr0 mods.
419 " pushl %eax \n" " movl %cr0, %eax\n" " orl $0x00000001, %eax\n" /* PE = 1 */
421 /* Now that we are in protected mode jump to a 32 bit code segment. */
422 " data32 ljmp $0x10, $biosprotect\n"
425 " movw $0x18, %ax \n"
433 // back to real mode ...
434 " ljmp $0x28, $__rms_16bit2\n"
437 /* 16 bit code from here on... */
438 /* Load the segment registers w/ properly configured segment
439 * descriptors. They will retain these configurations (limits,
440 * writability, etc.) once protected mode is turned off. */
447 /* Turn off protection (bit 0 in CR0) */
448 " movl %cr0, %eax \n"
449 " andl $0xFFFFFFFE, %eax \n"
450 " movl %eax, %cr0 \n"
451 /* Now really going into real mode */
452 " ljmp $0, $__rms_real2 \n"
455 * FixME: where is esp? */
458 /* ebugging for RGM */
460 " outb %al, $0x80 \n"
461 /* Load our 16 it idt */
465 /* Dump zeros in the other segregs */
471 /* pop the INT # that you pushed earlier */
487 int pcibios(unsigned long *pedi, unsigned long *pesi, unsigned long *pebp,
488 unsigned long *pesp, unsigned long *pebx, unsigned long *pedx,
489 unsigned long *pecx, unsigned long *peax, unsigned long *pflags);
491 int handleint21(unsigned long *pedi, unsigned long *pesi, unsigned long *pebp,
492 unsigned long *pesp, unsigned long *pebx, unsigned long *pedx,
493 unsigned long *pecx, unsigned long *peax,
494 unsigned long *pflags);
496 extern void vga_exit(void);
498 int biosint(unsigned long intnumber,
499 unsigned long gsfs, unsigned long dses,
500 unsigned long edi, unsigned long esi,
501 unsigned long ebp, unsigned long esp,
502 unsigned long ebx, unsigned long edx,
503 unsigned long ecx, unsigned long eax,
504 unsigned long cs_ip, unsigned short stackflags)
515 printk(BIOS_DEBUG, "biosint: INT# 0x%lx\n", intnumber);
516 printk(BIOS_DEBUG, "biosint: eax 0x%lx ebx 0x%lx ecx 0x%lx edx 0x%lx\n",
518 printk(BIOS_DEBUG, "biosint: ebp 0x%lx esp 0x%lx edi 0x%lx esi 0x%lx\n",
520 printk(BIOS_DEBUG, "biosint: ip 0x%lx cs 0x%lx flags 0x%lx\n",
523 // cases in a good compiler are just as good as your own tables.
526 // These are not BIOS service, but the CPU-generated exceptions
527 printk(BIOS_INFO, "biosint: Oops, exception %lu\n", intnumber);
529 printk(BIOS_DEBUG, "Stack contents: ");
530 while (esp < 0x1000) {
531 printk(BIOS_DEBUG, "0x%04x ", *(unsigned short *)esp);
534 printk(BIOS_DEBUG, "\n");
536 printk(BIOS_DEBUG, "biosint: Bailing out\n");
542 ret = pcibios(&edi, &esi, &ebp, &esp,
543 &ebx, &edx, &ecx, &eax, &flags);
551 ret = handleint21(&edi, &esi, &ebp, &esp,
552 &ebx, &edx, &ecx, &eax, &flags);
555 printk(BIOS_INFO, "BIOSINT: Unsupport int #0x%lx\n", intnumber);
559 flags |= 1; // carry flags
566 void setup_realmode_idt(void)
568 extern unsigned char idthandle, end_idthandle;
569 extern unsigned char debughandle, end_debughandle;
572 struct realidt *idts = (struct realidt *)0;
573 int codesize = &end_idthandle - &idthandle;
574 unsigned char *intbyte, *codeptr;
576 // for each int, we create a customized little handler
577 // that just pushes %ax, puts the int # in %al,
578 // then calls the common interrupt handler.
579 // this necessitated because intel didn't know much about
580 // architecture when they did the 8086 (it shows)
581 // (hmm do they know anymore even now :-)
582 // obviously you can see I don't really care about memory
583 // efficiency. If I did I would probe back through the stack
584 // and get it that way. But that's really disgusting.
585 for (i = 0; i < 256; i++) {
587 codeptr = (unsigned char *)4096 + i * codesize;
588 idts[i].offset = (unsigned)codeptr;
589 memcpy(codeptr, &idthandle, codesize);
590 intbyte = codeptr + 3;
594 // fixed entry points
596 // VGA BIOSes tend to hardcode f000:f065 as the previous handler of
598 // calling convention here is the same as INTs, we can reuse
599 // the int entry code.
600 codeptr = (unsigned char *)0xff065;
601 memcpy(codeptr, &idthandle, codesize);
602 intbyte = codeptr + 3;
603 *intbyte = 0x42; /* int42 is the relocated int10 */
605 // VIA's VBIOS will call f000:f859 instead of sending int15.
606 codeptr = (unsigned char *)0xff859;
607 memcpy(codeptr, &idthandle, codesize);
608 intbyte = codeptr + 3;
611 /* debug handler - useful to set a programmable delay between instructions if the
612 TF bit is set upon call to real mode */
614 idts[1].offset = 16384;
615 memcpy((void *)16384UL, &debughandle, &end_debughandle - &debughandle);
621 READCONFBYTE = 0xb108,
622 READCONFWORD = 0xb109,
623 READCONFDWORD = 0xb10a,
624 WRITECONFBYTE = 0xb10b,
625 WRITECONFWORD = 0xb10c,
626 WRITECONFDWORD = 0xb10d
629 // errors go in AH. Just set these up so that word assigns
632 PCIBIOS_NODEV = 0x8600,
633 PCIBIOS_BADREG = 0x8700
637 pcibios(unsigned long *pedi, unsigned long *pesi, unsigned long *pebp,
638 unsigned long *pesp, unsigned long *pebx, unsigned long *pedx,
639 unsigned long *pecx, unsigned long *peax, unsigned long *pflags)
641 unsigned short func = (unsigned short)(*peax);
643 unsigned short devid, vendorid, devfn;
644 short devindex; /* Use short to get rid of garbage in upper half of 32-bit register */
660 while ((dev = dev_find_device(vendorid, devid, dev))) {
666 unsigned short busdevfn;
668 // busnum is an unsigned char;
669 // devfn is an int, so we mask it off.
670 busdevfn = (dev->bus->secondary << 8)
671 | (dev->path.pci.devfn & 0xff);
672 printk(BIOS_DEBUG, "0x%x: return 0x%x\n", func,
677 *peax = PCIBIOS_NODEV;
694 devfn = *pebx & 0xff;
697 dev = dev_find_slot(bus, devfn);
699 printk(BIOS_DEBUG, "0x%x: BAD DEVICE bus %d devfn 0x%x\n",
701 // idiots. the pcibios guys assumed you'd never pass a bad bus/devfn!
702 *peax = PCIBIOS_BADREG;
707 byte = pci_read_config8(dev, reg);
711 word = pci_read_config16(dev, reg);
715 dword = pci_read_config32(dev, reg);
720 pci_write_config8(dev, reg, byte);
724 pci_write_config16(dev, reg, word);
728 pci_write_config32(dev, reg, dword);
733 retval = PCIBIOS_BADREG;
734 printk(BIOS_DEBUG, "0x%x: bus %d devfn 0x%x reg 0x%x val 0x%lx\n",
735 func, bus, devfn, reg, *pecx);
741 printk(BIOS_ERR, "UNSUPPORTED PCIBIOS FUNCTION 0x%x\n", func);
748 int handleint21(unsigned long *edi, unsigned long *esi, unsigned long *ebp,
749 unsigned long *esp, unsigned long *ebx, unsigned long *edx,
750 unsigned long *ecx, unsigned long *eax, unsigned long *flags)
753 switch (*eax & 0xffff) {
758 *ebx = 0x545; // MCLK = 133, 32M frame buffer, 256 M main memory
767 *ecx = (*ecx & 0xffffff00) | 2; // panel type = 2 = 1024 * 768
772 *ebx = (*ebx & 0xffff0000) | 2;
773 *ecx = (*ecx & 0xffff0000) | 0x401; // PAL + crt only
774 *edx = (*edx & 0xffff0000) | 0; // TV Layout - default