-- Problem Description --
Grub crashes if it tries to run in video mode.

I'm currently testing with grub rpm from f18 in a lpar inside a Power 7R2 machine using a matrox video card attached.

To reproduce you need to redirect the console to the video output.

This will happens:

IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM 
IBM IBM IBM IBM IBM IBM                             IBM IBM IBM IBM IBM IBM
IBM IBM IBM IBM IBM IBM     STARTING SOFTWARE       IBM IBM IBM IBM IBM IBM
IBM IBM IBM IBM IBM IBM        PLEASE WAIT...       IBM IBM IBM IBM IBM IBM
IBM IBM IBM IBM IBM IBM                             IBM IBM IBM IBM IBM IBM
IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM 
IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM 
IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM 
IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM 
IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM 
IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM 
IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM 
IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM 
IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM 
IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM 
IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM IBM 

Welcome to GRUB

DEFAULT CATCH!, exception-handler=fff00300 
at   %SRR0: 000000000020ac80   %SRR1: 0000000000003002 
Open Firmware exception handler entered from non-OF code

Client's Fix Pt Regs:
 00 0000000000780c38 0000000001adfc40 0000000000000000 0000000018000000
 04 0000000000780850 000000000004afff 00000000001d2bb0 0000000000000000
 08 0000000018000000 fffffffffffb5000 000000001804b000 0000000001adfc50
 0c 0000000000000008 0000000000000000 0000000000800050 0000000002000066
 10 0000000002000065 0000000002000070 000000000200006e 0000000002000067
 14 0000000002000063 0000000000000001 00000000001a0000 0000000000000002
 18 0000000000000002 0000000000000000 0000000000780dce 00000000ffff8080
 1c 0000000000000067 00000000001d3de0 00000000001d2b30 0000000000000002
Special Regs:
    %IV: 00000300     %CR: 22002084    %XER: 20000000  %DSISR: 42000000 
  %SRR0: 000000000020ac80   %SRR1: 0000000000003002 
    %LR: 0000000000006584    %CTR: 000000000004b000 
   %DAR: 000000001804afff 
Virtual PID = 0 
 ok
0 >

In Power, GRUB has video support and works fine with PowerMAC.

Theorically it should works with IBM machines as well but, using a Matrox videocard and grub.cfg with the video option enabled, GRUB crashes as we saw above.

Using GRUB debug we saw that the crash happens because GRUB tries to access the video card address:

video/ieee1275.c:236: IEEE1275: keeping current mode 640x480
video/ieee1275.c:266: IEEE1275: initialising FB @ 0x18000000 640x480x8


GRUB gets the address from the display card node from openfirmware. The property is called "address":

0 > dev /pci@80000002000000d/pci@0/display@0  ok
0 > .properties 
ibm,loc-code            U78AB.001.WZSHS9P-P1-C7-T1
vendor-id               0000102b 
device-id               00002527 
revision-id             00000001 
class-code              00030000 
interrupts              00000001 
min-grant               00000010 
max-latency             00000020 
subsystem-vendor-id     0000102b 
subsystem-id            00002300 
devsel-speed            00000001 
fast-back-to-back       
built-in                
name                    display
compatible              MTRX,G550
                        pci102b,2527
                        pciclass,030000
                        display
reg                     00990000 00000000 00000000  00000000 00000000 
                        02990030 00000000 00000000  00000000 00010000 
                        02990010 00000000 00000000  00000000 04000000 
                        02990014 00000000 00000000  00000000 00800000 
                        02990018 00000000 00000000  00000000 00800000 
fcode-rom-offset        00009000 
device_type             display
character-set           ISO8859-1
iso6429-1983-colors     
power-consumption       00000000 00000000 007270e0 007270e0 00000000 00000000 007b98a0 007b98a0 
ibm,fw-revision-level   00000100 
assigned-addresses      82990010 00000000 f8000000  00000000 04000000 
                        82990014 00000000 f7000000  00000000 00800000 
                        82990018 00000000 f7800000  00000000 00800000 
                        82990030 00000000 f6fe0000  00000000 00020000 
address                 18000000 17000000 
width                   00000280 
height                  000001e0 
depth                   00000008 
linebytes               00000280 
bios release            01000000 

 ok
0 > 


Kleber Sacilotto sent me the address that linux returned from the probe:

99:00.0 VGA compatible controller: Matrox Electronics Systems Ltd. Millennium G550 (rev 01) (prog-if 00 [VGA controller])
	Subsystem: Matrox Electronics Systems Ltd. Millennium G550 LP PCIE
	Control: I/O- Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Interrupt: pin A routed to IRQ 0
	Region 0: Memory at 3da318000000 (32-bit, prefetchable) [size=64M]
	Region 1: Memory at 3da317000000 (32-bit, non-prefetchable) [size=8M]
	Region 2: Memory at 3da317800000 (32-bit, non-prefetchable) [size=8M]
	Expansion ROM at 3da316fe0000 [disabled] [size=128K]
	Capabilities: [dc] Power Management version 2
		Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0-,D1-,D2-,D3hot-,D3cold-)
		Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=0 PME-
	Capabilities: [f0] AGP version 2.0
		Status: RQ=32 Iso- ArqSz=0 Cal=0 SBA+ ITACoh- GART64- HTrans- 64bit- FW- AGP3- Rate=x1,x2
		Command: RQ=1 ArqSz=0 Cal=0 SBA- AGP- GART64- 64bit- FW- Rate=<none>
	Kernel driver in use: matroxfb


The address is 64bit and display property in openfirmware was cut because it's "encode-int" (32bit):

From linux:
Region 0: Memory at 3da318000000 (32-bit, prefetchable) [size=64M]
Region 1: Memory at 3da317000000 (32-bit, non-prefetchable) [size=8M]

From openfirmware:
address                 18000000 17000000

David Randall confirmed that the linux address is right after getting the full address using other properties from the videocard node.

We talked with Colleen about the address property from the Matrox card and she said that the node is generated from a FCode that is inside the card, owned by Matrox.

Openfirmware works in 32bit mode so GRUB for Power is hotwired in 32bit, even for 64bit machines.

David taught us how to get the full address but, as GRUB is build in 32bit and the value is 64 we need to implement an asm helper in order to access it.

Marcelo Cerri, from ltc security team, helped me writing an asm help to access the address but we still didn't managed to make it work.

We will continue to work in the asm to see if we can access the address.

Besides that, I'm going to implement an address validation in GRUB before it tries to access the address. If the address is invalid it will return an exception and will continue to run in text mode.