Then I get the following boot log by EHCI debug serial，it hang in cbmem_top_init_once.

Adding debug print shows cbmem_top points to 7f800000. LPC debug card also stop on 0x3b.

I have no idea how to debug. Any help would be appreciated.

@@ -55,8 +55,11 @@ static void cbmem_top_init_once(void)
                return;
 
        /* The test is only effective on X86 and when address hits UC memory. */
-       if (ENV_X86)
-               quick_ram_check_or_die((uintptr_t)cbmem_top() - sizeof(u32));
+       if (ENV_X86) {
+               uintptr_t cbmem_top_p = (uintptr_t)cbmem_top();
+               printk(BIOS_DEBUG, "CBMEM top: %08lx ", cbmem_top_p);
+               quick_ram_check_or_die(cbmem_top_p - sizeof(u32));
+       }
 }

coreboot-4.12-2693-g0c1e8f44ec-dirty Sat Sep 12 11:15:18 UTC 2020 bootblock starting (log level: 8)...
FMAP: area COREBOOT found @ e30200 (1900032 bytes)
CBFS: Locating 'fallback/romstage'
CBFS: Found @ offset 80 size 1827c
BS: bootblock times (exec / console): total (unknown) / 8 ms


coreboot-4.12-2693-g0c1e8f44ec-dirty Sat Sep 12 11:15:18 UTC 2020 romstage starting (log level: 8)...
Disabling Watchdog reboot... done.
SMBus controller enabled
Setting up static northbridge registers... done.
Started PEG10 link training.
Temporarily hiding PEG10.
Initializing IGD...
Back from haswell_early_initialization()
POST: 0x3a
CPU id(306c3) ucode:00000028 Intel(R) Pentium(R) CPU G3240 @ 3.10GHz
AES NOT supported, TXT NOT supported, VT supported
PCH type: Q87, device id: 8c4e, rev id 5
Starting UEFI PEI System Agent
FMAP: area RW_MRC_CACHE found @ e20000 (65536 bytes)
MRC: no data in 'RW_MRC_CACHE'
FMAP: area COREBOOT found @ e30200 (1900032 bytes)
CBFS: Locating 'mrc.bin'
CBFS: Found @ offset 16fdc0 size 2e6e4
System Agent: Starting up...
System Agent: Initializing PCH
install_ppi: overwrite GUID {ed097352-9041-445a-80b6-b29d509e8845}
install_ppi: overwrite GUID {908c7f8b-5c48-47fb-8357-f5fd4e235276}
System Agent: Initializing PCH (SMBUS)
System Agent: Initializing PCH (USUSB
System Agent Version 1.6.1 Build 2
memcfg DDR3 clock 1333 MHz
memcfg channel assignment: A: 1, B  0, C  2
memcfg channel[0] config (00600000):
   ECC inactive
   enhanced interleave mode on
   rank interleave on
   DIMMA 0 MB width x8 or x32 single rank, selected
   DIMMB 0 MB width x8 or x32 single rank
memcfg channel[1] config (00600010):
   ECC inactive
   enhanced interleave mode on
   rank interleave on
   DIMMA 4096 MB width x8 or x32 single rank, selected
   DIMMB 0 MB width x8 or x32 single rank
POST: 0x3b
ME: FW Partition Table      : OK
ME: Bringup Loader Failure  : NO
ME: Firmware Init Complete  : NO
ME: Manufacturing Mode      : YES
ME: Boot Options Present    : NO
ME: Update In Progress      : NO
ME: Current Working State   : Initializing
ME: Current Operation State : Bring up
ME: Current Operation Mode  : Debug
ME: Error Code              : No Error
ME: Progress Phase          : BUP Phase
ME: Power Management Event  : Pseudo-global reset
ME: Progress Phase State    : 0x4d
CBMEM top: 7f800000