The Linux 4.7 kernel payload crashes early in the boot process with CoreBoot 4.4. I traced it to these instructions that are finding a safe spot to decompress the rest of the kernel and patched around it with a hard coded location:
diff -u --recursive /home/hudson/build/clean/linux-4.7/arch/x86/boot/compressed/head_64.S ./linux-4.7/arch/x86/boot/compressed/head_64.S --- /home/hudson/build/clean/linux-4.7/arch/x86/boot/compressed/head_64.S 2016-07-24 15:23:50.000000000 -0400 +++ ./linux-4.7/arch/x86/boot/compressed/head_64.S 2016-08-05 12:07:11.399854225 -0400 @@ -340,9 +357,15 @@ 1:
/* Target address to relocate to for decompression */ +#if 0 movl BP_init_size(%rsi), %ebx subl $_end, %ebx addq %rbp, %rbx +#else + // coreboot does not populate the init_size boot param? + // fake it with a hard coded value + movl $0x97b000, %ebx +#endif
/* Set up the stack */ leaq boot_stack_end(%rbx), %rsp
It seems that the Linux kernel bzImage is supposed to set this value, rather than coreboot, so my comment is likely incorrect.
Dumping linux-4.7/arch/x86/boot/header.o, it looks like init_siez is supposed to be 0xcf5000, so I wonder if %rsi is pointing to the wrong location.
In 4.6.4 the computed address was hardcoded:
movl $LOAD_PHYSICAL_ADDR, %ebx /* Target address to relocate to for decompression */ addl $z_extract_offset, %ebx
3e: bb 00 00 00 01 mov $0x1000000,%ebx 43: 81 c3 00 00 00 00 add $0x0,%ebx