[SeaBIOS] [BUG?] Doesn't retrieve control after coreboot payload return

[Antonello Dettori]

On 02/08/16 17:02, Kevin O'Connor wrote:
> On Tue, Aug 02, 2016 at 04:53:16PM +0200, Antonello Dettori wrote:
>> On 02/08/16 16:39, Kevin O'Connor wrote:
>>> On Tue, Aug 02, 2016 at 03:37:44PM +0200, Antonello Dettori wrote:
>>>> Hi everyone.
>>>>
>>>> I'm currently working on coreboot but I stumbled on a strange SeaBIOS
>>>> behaviour.
>>>> After executing a payload and returning control to the caller SeaBIOS
>>>> crashes.
>>>>
>>>> The problem is currently solved by rebooting before the payload returns but
>>>> doing so also makes chaining multiple payloads impossible so I'm trying to
>>>> look into a solution.
>>> The SeaBIOS payload support was not designed to robustly handle
>>> returns from a payload.  It will crash if the payload alters the GDT,
>>> overwrite the stack, or otherwise messes up the SeaBIOS state.  As far
>>> as I know, payloads in general aren't designed to handle returns to
>>> their caller.
>> Some payloads can handle returns to the previous caller/payload.
>> Would it be possible in theory to re-design the payload support so as to
>> make it work (i.e. restoring the SeaBIOS state after returning)?
>> Are there any reasons why it would be unfeasible?
> Depends on what the payload is altering.  Which payload is it?
The payload that I'm trying is coreinfo (I removed the reboot and halt() 
section in order to be able to return and chain).
>
>>>> I tried to increment the debug level to 8 to get more information and the
>>>> attached log is what I got.
>>> That log isn't from SeaBIOS.  It's unclear what hardware you have.  In
>>> general, a serial port is the most robust way of obtaining a log.  See
>>> also: http://www.seabios.org/Debugging
>>>
>>> -Kevin
>> I run the image on QEMU, didn't realise that SeaBIOS probably doesn't
>> support QEMU debug port output.
>> I'll try on a hardware target later.
> SeaBIOS can support the qemu debug port, but it's probably easier to
> compile seabios with serial support and instruct qemu to write the
> serial log to a file: -serial file:foo.txt
>
> -Kevin
Oh, didn't think about that. Attached the full log.

-------------- next part --------------
QEMU debugcon not found [port 0x402]


coreboot-4.4-910-gdf732f5-dirty Tue Aug  2 11:33:57 UTC 2016 romstage starting...
CBMEM:
IMD: root @ 07fff000 254 entries.
IMD: root @ 07ffec00 62 entries.
CBFS: 'Master Header Locator' located CBFS at [100:1fffc0)
CBFS: Locating 'fallback/ramstage'
CBFS: Found @ offset 3800 size a639
QEMU debugcon not found [port 0x402]


coreboot-4.4-910-gdf732f5-dirty Tue Aug  2 11:33:57 UTC 2016 ramstage starting...
Moving GDT to 07ffe8a0...ok
Enumerating buses...
Show all devs... Before device enumeration.
Root Device: enabled 1
CPU_CLUSTER: 0: enabled 1
APIC: 00: enabled 1
DOMAIN: 0000: enabled 1
PCI: 00:00.0: enabled 1
PCI: 00:01.0: enabled 1
PCI: 00:01.1: enabled 1
PCI: 00:01.3: enabled 1
Compare with tree...
Root Device: enabled 1
 CPU_CLUSTER: 0: enabled 1
  APIC: 00: enabled 1
 DOMAIN: 0000: enabled 1
  PCI: 00:00.0: enabled 1
  PCI: 00:01.0: enabled 1
  PCI: 00:01.1: enabled 1
  PCI: 00:01.3: enabled 1
Root Device scanning...
root_dev_scan_bus for Root Device
CPU_CLUSTER: 0 enabled
DOMAIN: 0000 enabled
CPU_CLUSTER: 0 scanning...
QEMU: firmware config interface detected
QEMU: max_cpus is 1
CPU: APIC: 00 enabled
scan_bus: scanning of bus CPU_CLUSTER: 0 took 0 usecs
DOMAIN: 0000 scanning...
PCI: pci_scan_bus for bus 00
PCI: 00:00.0 [8086/1237] ops
PCI: 00:00.0 [8086/1237] enabled
PCI: 00:01.0 [8086/7000] bus ops
PCI: 00:01.0 [8086/7000] enabled
PCI: 00:01.1 [8086/7010] ops
PCI: 00:01.1 [8086/7010] enabled
PCI: 00:01.3 [8086/7113] bus ops
PCI: 00:01.3 [8086/7113] enabled
PCI: 00:02.0 [1234/1111] ops
PCI: 00:02.0 [1234/1111] enabled
PCI: 00:03.0 [8086/100e] enabled
PCI: 00:01.0 scanning...
scan_lpc_bus for PCI: 00:01.0
scan_lpc_bus for PCI: 00:01.0 done
scan_bus: scanning of bus PCI: 00:01.0 took 0 usecs
PCI: 00:01.3 scanning...
scan_smbus for PCI: 00:01.3
scan_smbus for PCI: 00:01.3 done
scan_bus: scanning of bus PCI: 00:01.3 took 0 usecs
scan_bus: scanning of bus DOMAIN: 0000 took 0 usecs
root_dev_scan_bus for Root Device done
scan_bus: scanning of bus Root Device took 0 usecs
done
found VGA at PCI: 00:02.0
Setting up VGA for PCI: 00:02.0
Setting PCI_BRIDGE_CTL_VGA for bridge DOMAIN: 0000
Setting PCI_BRIDGE_CTL_VGA for bridge Root Device
Allocating resources...
Reading resources...
Root Device read_resources bus 0 link: 0
CPU_CLUSTER: 0 read_resources bus 0 link: 0
CPU_CLUSTER: 0 read_resources bus 0 link: 0 done
QEMU: 11 files in fw_cfg
QEMU:     bootorder [size=0]
QEMU:     etc/acpi/rsdp [size=36]
QEMU:     etc/acpi/tables [size=131072]
QEMU:     etc/boot-fail-wait [size=4]
QEMU:     etc/e820 [size=20]
QEMU:     etc/smbios/smbios-anchor [size=31]
QEMU:     etc/smbios/smbios-tables [size=320]
QEMU:     etc/system-states [size=6]
QEMU:     etc/table-loader [size=4096]
QEMU:     etc/tpm/log [size=0]
QEMU:     genroms/kvmvapic.bin [size=9216]
QEMU: e820/ram: 0x00000000 +0x08000000
QEMU: reserve ioports 0x0510-0x0511 [firmware-config]
QEMU: reserve ioports 0x5658-0x5658 [vmware-port]
QEMU: reserve ioports 0xae00-0xae0f [pci-hotplug]
QEMU: reserve ioports 0xaf00-0xaf1f [cpu-hotplug]
QEMU: reserve ioports 0xafe0-0xafe3 [piix4-gpe0]
DOMAIN: 0000 read_resources bus 0 link: 0
DOMAIN: 0000 read_resources bus 0 link: 0 done
Root Device read_resources bus 0 link: 0 done
Done reading resources.
Show resources in subtree (Root Device)...After reading.
 Root Device child on link 0 CPU_CLUSTER: 0
  CPU_CLUSTER: 0 child on link 0 APIC: 00
   APIC: 00
  DOMAIN: 0000 child on link 0 PCI: 00:00.0
  DOMAIN: 0000 resource base 0 size 0 align 0 gran 0 limit ffff flags 40040100 index 10000000
  DOMAIN: 0000 resource base 0 size 0 align 0 gran 0 limit ffffffff flags 40040200 index 10000100
  DOMAIN: 0000 resource base 0 size a0000 align 0 gran 0 limit 0 flags e0004200 index a
  DOMAIN: 0000 resource base c0000 size 7f40000 align 0 gran 0 limit 0 flags e0004200 index b
  DOMAIN: 0000 resource base 510 size 2 align 0 gran 0 limit ffff flags e0000100 index c
  DOMAIN: 0000 resource base 5658 size 1 align 0 gran 0 limit ffff flags e0000100 index d
  DOMAIN: 0000 resource base ae00 size 10 align 0 gran 0 limit ffff flags e0000100 index e
  DOMAIN: 0000 resource base af00 size 20 align 0 gran 0 limit ffff flags e0000100 index f
  DOMAIN: 0000 resource base afe0 size 4 align 0 gran 0 limit ffff flags e0000100 index 10
  DOMAIN: 0000 resource base fec00000 size 100000 align 0 gran 0 limit ffffffff flags e0000200 index 2
  DOMAIN: 0000 resource base fee00000 size 10000 align 0 gran 0 limit ffffffff flags e0000200 index 3
   PCI: 00:00.0
   PCI: 00:01.0
   PCI: 00:01.0 resource base 0 size 1000 align 0 gran 0 limit ffff flags c0000100 index 1
   PCI: 00:01.0 resource base ff800000 size 800000 align 0 gran 0 limit 0 flags d0000200 index 2
   PCI: 00:01.1
   PCI: 00:01.1 resource base 0 size 10 align 4 gran 4 limit ffff flags 100 index 20
   PCI: 00:01.3
   PCI: 00:01.3 resource base e400 size 40 align 0 gran 0 limit ffff flags d0000100 index 1
   PCI: 00:01.3 resource base f00 size 10 align 0 gran 0 limit ffff flags d0000100 index 2
   PCI: 00:02.0
   PCI: 00:02.0 resource base 0 size 1000000 align 24 gran 24 limit ffffffff flags 1200 index 10
   PCI: 00:02.0 resource base 0 size 1000 align 12 gran 12 limit ffffffff flags 200 index 18
   PCI: 00:02.0 resource base 0 size 10000 align 16 gran 16 limit ffffffff flags 2200 index 30
   PCI: 00:03.0
   PCI: 00:03.0 resource base 0 size 20000 align 17 gran 17 limit ffffffff flags 200 index 10
   PCI: 00:03.0 resource base 0 size 40 align 6 gran 6 limit ffff flags 100 index 14
   PCI: 00:03.0 resource base 0 size 40000 align 18 gran 18 limit ffffffff flags 2200 index 30
DOMAIN: 0000 io: base: 0 size: 0 align: 0 gran: 0 limit: ffff
PCI: 00:03.0 14 *  [0x0 - 0x3f] io
PCI: 00:01.1 20 *  [0x40 - 0x4f] io
DOMAIN: 0000 io: base: 50 size: 50 align: 6 gran: 0 limit: ffff done
DOMAIN: 0000 mem: base: 0 size: 0 align: 0 gran: 0 limit: ffffffff
PCI: 00:02.0 10 *  [0x0 - 0xffffff] prefmem
PCI: 00:03.0 30 *  [0x1000000 - 0x103ffff] mem
PCI: 00:03.0 10 *  [0x1040000 - 0x105ffff] mem
PCI: 00:02.0 30 *  [0x1060000 - 0x106ffff] mem
PCI: 00:02.0 18 *  [0x1070000 - 0x1070fff] mem
DOMAIN: 0000 mem: base: 1071000 size: 1071000 align: 24 gran: 0 limit: ffffffff done
avoid_fixed_resources: DOMAIN: 0000
avoid_fixed_resources:@DOMAIN: 0000 10000000 limit 0000ffff
avoid_fixed_resources:@DOMAIN: 0000 10000100 limit ffffffff
constrain_resources: DOMAIN: 0000 0a base 00000000 limit 0009ffff mem (fixed)
constrain_resources: DOMAIN: 0000 0b base 000c0000 limit 07ffffff mem (fixed)
constrain_resources: DOMAIN: 0000 0c base 00000510 limit 00000511 io (fixed)
constrain_resources: DOMAIN: 0000 0d base 00005658 limit 00005658 io (fixed)
constrain_resources: DOMAIN: 0000 0e base 0000ae00 limit 0000ae0f io (fixed)
constrain_resources: DOMAIN: 0000 02 base fec00000 limit fecfffff mem (fixed)
avoid_fixed_resources:@DOMAIN: 0000 10000000 base 00005659 limit 0000adff
avoid_fixed_resources:@DOMAIN: 0000 10000100 base fd000000 limit febfffff
Setting resources...
DOMAIN: 0000 io: base:5659 size:50 align:6 gran:0 limit:adff
PCI: 00:03.0 14 *  [0x5800 - 0x583f] io
PCI: 00:01.1 20 *  [0x5840 - 0x584f] io
DOMAIN: 0000 io: next_base: 5850 size: 50 align: 6 gran: 0 done
DOMAIN: 0000 mem: base:fd000000 size:1071000 align:24 gran:0 limit:febfffff
PCI: 00:02.0 10 *  [0xfd000000 - 0xfdffffff] prefmem
PCI: 00:03.0 30 *  [0xfe000000 - 0xfe03ffff] mem
PCI: 00:03.0 10 *  [0xfe040000 - 0xfe05ffff] mem
PCI: 00:02.0 30 *  [0xfe060000 - 0xfe06ffff] mem
PCI: 00:02.0 18 *  [0xfe070000 - 0xfe070fff] mem
DOMAIN: 0000 mem: next_base: fe071000 size: 1071000 align: 24 gran: 0 done
Root Device assign_resources, bus 0 link: 0
DOMAIN: 0000 assign_resources, bus 0 link: 0
PCI: 00:01.1 20 <- [0x0000005840 - 0x000000584f] size 0x00000010 gran 0x04 io
PCI: 00:02.0 10 <- [0x00fd000000 - 0x00fdffffff] size 0x01000000 gran 0x18 prefmem
PCI: 00:02.0 18 <- [0x00fe070000 - 0x00fe070fff] size 0x00001000 gran 0x0c mem
PCI: 00:02.0 30 <- [0x00fe060000 - 0x00fe06ffff] size 0x00010000 gran 0x10 romem
PCI: 00:03.0 10 <- [0x00fe040000 - 0x00fe05ffff] size 0x00020000 gran 0x11 mem
PCI: 00:03.0 14 <- [0x0000005800 - 0x000000583f] size 0x00000040 gran 0x06 io
PCI: 00:03.0 30 <- [0x00fe000000 - 0x00fe03ffff] size 0x00040000 gran 0x12 romem
DOMAIN: 0000 assign_resources, bus 0 link: 0
Root Device assign_resources, bus 0 link: 0
Done setting resources.
Show resources in subtree (Root Device)...After assigning values.
 Root Device child on link 0 CPU_CLUSTER: 0
  CPU_CLUSTER: 0 child on link 0 APIC: 00
   APIC: 00
  DOMAIN: 0000 child on link 0 PCI: 00:00.0
  DOMAIN: 0000 resource base 5659 size 50 align 6 gran 0 limit adff flags 40040100 index 10000000
  DOMAIN: 0000 resource base fd000000 size 1071000 align 24 gran 0 limit febfffff flags 40040200 index 10000100
  DOMAIN: 0000 resource base 0 size a0000 align 0 gran 0 limit 0 flags e0004200 index a
  DOMAIN: 0000 resource base c0000 size 7f40000 align 0 gran 0 limit 0 flags e0004200 index b
  DOMAIN: 0000 resource base 510 size 2 align 0 gran 0 limit ffff flags e0000100 index c
  DOMAIN: 0000 resource base 5658 size 1 align 0 gran 0 limit ffff flags e0000100 index d
  DOMAIN: 0000 resource base ae00 size 10 align 0 gran 0 limit ffff flags e0000100 index e
  DOMAIN: 0000 resource base af00 size 20 align 0 gran 0 limit ffff flags e0000100 index f
  DOMAIN: 0000 resource base afe0 size 4 align 0 gran 0 limit ffff flags e0000100 index 10
  DOMAIN: 0000 resource base fec00000 size 100000 align 0 gran 0 limit ffffffff flags e0000200 index 2
  DOMAIN: 0000 resource base fee00000 size 10000 align 0 gran 0 limit ffffffff flags e0000200 index 3
   PCI: 00:00.0
   PCI: 00:01.0
   PCI: 00:01.0 resource base 0 size 1000 align 0 gran 0 limit ffff flags c0000100 index 1
   PCI: 00:01.0 resource base ff800000 size 800000 align 0 gran 0 limit 0 flags d0000200 index 2
   PCI: 00:01.1
   PCI: 00:01.1 resource base 5840 size 10 align 4 gran 4 limit 584f flags 60000100 index 20
   PCI: 00:01.3
   PCI: 00:01.3 resource base e400 size 40 align 0 gran 0 limit ffff flags d0000100 index 1
   PCI: 00:01.3 resource base f00 size 10 align 0 gran 0 limit ffff flags d0000100 index 2
   PCI: 00:02.0
   PCI: 00:02.0 resource base fd000000 size 1000000 align 24 gran 24 limit fdffffff flags 60001200 index 10
   PCI: 00:02.0 resource base fe070000 size 1000 align 12 gran 12 limit fe070fff flags 60000200 index 18
   PCI: 00:02.0 resource base fe060000 size 10000 align 16 gran 16 limit fe06ffff flags 60002200 index 30
   PCI: 00:03.0
   PCI: 00:03.0 resource base fe040000 size 20000 align 17 gran 17 limit fe05ffff flags 60000200 index 10
   PCI: 00:03.0 resource base 5800 size 40 align 6 gran 6 limit 583f flags 60000100 index 14
   PCI: 00:03.0 resource base fe000000 size 40000 align 18 gran 18 limit fe03ffff flags 60002200 index 30
Done allocating resources.
Enabling resources...
PCI: 00:00.0 cmd <- 00
PCI: 00:01.0 cmd <- 00
PCI: 00:01.1 cmd <- 01
PCI: 00:01.3 cmd <- 00
PCI: 00:02.0 cmd <- 03
PCI: 00:03.0 cmd <- 03
done.
Initializing devices...
Root Device init ...
CPU_CLUSTER: 0 init ...
Initializing CPU #0
CPU: vendor AMD device 663
CPU: family 06, model 06, stepping 03
Setting up local apic... apic_id: 0x00 done.
CPU #0 initialized
PCI: 00:00.0 init ...
Assigning IRQ 10 to 0:1.3
Assigning IRQ 11 to 0:3.0
PCI: 00:01.0 init ...
RTC Init
PCI: 00:01.1 init ...
IDE: Primary IDE interface: on
IDE: Secondary IDE interface: on
IDE: Access to legacy IDE ports: off
PCI: 00:02.0 init ...
PCI: 00:03.0 init ...
Devices initialized
Show all devs... After init.
Root Device: enabled 1
CPU_CLUSTER: 0: enabled 1
APIC: 00: enabled 1
DOMAIN: 0000: enabled 1
PCI: 00:00.0: enabled 1
PCI: 00:01.0: enabled 1
PCI: 00:01.1: enabled 1
PCI: 00:01.3: enabled 1
PCI: 00:02.0: enabled 1
PCI: 00:03.0: enabled 1
Finalize devices...
Devices finalized
Copying Interrupt Routing Table to 0x000f0000... done.
Copying Interrupt Routing Table to 0x07fd5000... done.
PIRQ table: 128 bytes.
QEMU: found acpi tables in fw_cfg.
QEMU: loading "etc/acpi/rsdp" to 0x7fb1000 (len 36)
QEMU: loading "etc/acpi/tables" to 0x7fb1040 (len 131072)
QEMU: loaded acpi tables from fw_cfg.
ACPI tables: 131136 bytes.
smbios_write_tables: 07fb0000
Root Device (Emulation QEMU x86 i440fx/piix4)
CPU_CLUSTER: 0 (QEMU Northbridge i440fx)
APIC: 00 (unknown)
DOMAIN: 0000 (QEMU Northbridge i440fx)
QEMU: found smbios tables in fw_cfg (len 320).
QEMU: coreboot type0 table found at 0x7fb0020.
QEMU: loading smbios tables to 0x7fb0064
PCI: 00:00.0 (QEMU Northbridge i440fx)
PCI: 00:01.0 (Intel 82371FB/SB/MX/AB/EB/MB Southbridge)
PCI: 00:01.1 (Intel 82371FB/SB/MX/AB/EB/MB Southbridge)
PCI: 00:01.3 (Intel 82371FB/SB/MX/AB/EB/MB Southbridge)
PCI: 00:02.0 (unknown)
PCI: 00:03.0 (unknown)
SMBIOS tables: 420 bytes.
Writing table forward entry at 0x00000500
Wrote coreboot table at: 00000500, 0x10 bytes, checksum 97e1
Writing coreboot table at 0x07fd6000
 0. 0000000000000000-0000000000000fff: CONFIGURATION TABLES
 1. 0000000000001000-000000000009ffff: RAM
 2. 00000000000c0000-0000000007faffff: RAM
 3. 0000000007fb0000-0000000007ffffff: CONFIGURATION TABLES
 4. 00000000ff800000-00000000ffffffff: RESERVED
CBFS: 'Master Header Locator' located CBFS at [100:1fffc0)
FMAP: Found "FLASH" version 1.1 at 0.
FMAP: base = ffe00000 size = 200000 #areas = 3
Wrote coreboot table at: 07fd6000, 0x230 bytes, checksum ba3b
coreboot table: 584 bytes.
IMD ROOT    0. 07fff000 00001000
IMD SMALL   1. 07ffe000 00001000
CONSOLE     2. 07fde000 00020000
COREBOOT    3. 07fd6000 00008000
IRQ TABLE   4. 07fd5000 00001000
ACPI        5. 07fb1000 00024000
SMBIOS      6. 07fb0000 00000800
IMD small region:
  IMD ROOT    0. 07ffec00 00000400
  CAR GLOBALS 1. 07ffeac0 00000140
  ROMSTAGE    2. 07ffeaa0 00000004
  GDT         3. 07ffe8a0 00000200
CBFS: 'Master Header Locator' located CBFS at [100:1fffc0)
CBFS: Locating 'fallback/payload'
CBFS: Found @ offset 27f00 size 1243f
Loading segment from rom address 0xffe28038
  code (compression=1)
  New segment dstaddr 0xdc280 memsize 0x23d80 srcaddr 0xffe28070 filesize 0x12407
Loading segment from rom address 0xffe28054
  Entry Point 0x000ff06e
Bounce Buffer at 07f71000, 256032 bytes
Loading Segment: addr: 0x00000000000dc280 memsz: 0x0000000000023d80 filesz: 0x0000000000012407
lb: [0x0000000000100000, 0x000000000011f410)
Post relocation: addr: 0x00000000000dc280 memsz: 0x0000000000023d80 filesz: 0x0000000000012407
using LZMA
[ 0x000dc280, 00100000, 0x00100000) <- ffe28070
dest 000dc280, end 00100000, bouncebuffer 7f71000
Loaded segments
Jumping to boot code at 000ff06e(07fd6000)
CPU0: stack: 00116000 - 00117000, lowest used address 00116c30, stack used: 976 bytes
entry    = 0x000ff06e
lb_start = 0x00100000
lb_size  = 0x0001f410
buffer   = 0x07f71000
SeaBIOS (version rel-1.9.0-140-g09e24ac)
BUILD: gcc: (coreboot toolchain v1.35 January 29th, 2016) 5.2.0 binutils: (GNU Binutils) 2.25
Running on QEMU (i440fx)
Attempting to find coreboot table
Found coreboot table forwarder.
Now attempting to find coreboot memory map
Add to e820 map: 00000000 00001000 2
Add to e820 map: 00001000 0009f000 1
Add to e820 map: 000c0000 07ef0000 1
Add to e820 map: 07fb0000 00050000 2
Add to e820 map: ff800000 00800000 2
Add to e820 map: 00000000 00004000 1
SeaBIOS (version rel-1.9.0-140-g09e24ac)
BUILD: gcc: (coreboot toolchain v1.35 January 29th, 2016) 5.2.0 binutils: (GNU Binutils) 2.25
Found coreboot cbmem console @ 7fde000
Found mainboard Emulation QEMU x86 i440fx/piix4
malloc preinit
Add to e820 map: 000a0000 00050000 -1
Add to e820 map: 000f0000 00010000 2
Add to e820 map: 07f70000 00040000 2
phys_alloc zone=0x000ebaf0 size=57280 align=20 ret=7f61fa0 (detail=0x07f61f70)
Relocating init from 0x000ddc40 to 0x07f61fa0 (size 57280)
malloc init
Found QEMU fw_cfg
QEMU fw_cfg DMA interface supported
phys_alloc zone=0x07f6fe50 size=148 align=10 ret=7f61e70 (detail=0x07f61e40)
Add romfile: bootorder (size=0)
phys_alloc zone=0x07f6fe50 size=148 align=10 ret=7f61da0 (detail=0x07f61d70)
Add romfile: etc/acpi/rsdp (size=36)
phys_alloc zone=0x07f6fe50 size=148 align=10 ret=7f61cd0 (detail=0x07f61ca0)
Add romfile: etc/acpi/tables (size=131072)
phys_alloc zone=0x07f6fe50 size=148 align=10 ret=7f61c00 (detail=0x07f61bd0)
Add romfile: etc/boot-fail-wait (size=4)
phys_alloc zone=0x07f6fe50 size=148 align=10 ret=7f61b30 (detail=0x07f61b00)
Add romfile: etc/e820 (size=20)
phys_alloc zone=0x07f6fe50 size=148 align=10 ret=7f61a60 (detail=0x07f61a30)
Add romfile: etc/smbios/smbios-anchor (size=31)
phys_alloc zone=0x07f6fe50 size=148 align=10 ret=7f61990 (detail=0x07f61960)
Add romfile: etc/smbios/smbios-tables (size=320)
phys_alloc zone=0x07f6fe50 size=148 align=10 ret=7f618c0 (detail=0x07f61890)
Add romfile: etc/system-states (size=6)
phys_alloc zone=0x07f6fe50 size=148 align=10 ret=7f617f0 (detail=0x07f617c0)
Add romfile: etc/table-loader (size=4096)
phys_alloc zone=0x07f6fe50 size=148 align=10 ret=7f61720 (detail=0x07f616f0)
Add romfile: etc/tpm/log (size=0)
phys_alloc zone=0x07f6fe50 size=148 align=10 ret=7f61650 (detail=0x07f61620)
Add romfile: genroms/kvmvapic.bin (size=9216)
Moving pm_base to 0x600
Found CBFS header at 0xffe00138
phys_alloc zone=0x07f6fe50 size=156 align=10 ret=7f61580 (detail=0x07f61550)
Add romfile: cbfs master header (size=32)
phys_alloc zone=0x07f6fe50 size=156 align=10 ret=7f614b0 (detail=0x07f61480)
Add romfile: fallback/romstage (size=14084)
phys_alloc zone=0x07f6fe50 size=156 align=10 ret=7f613e0 (detail=0x07f613b0)
Add romfile: fallback/ramstage (size=42553)
phys_alloc zone=0x07f6fe50 size=156 align=10 ret=7f61310 (detail=0x07f612e0)
Add romfile: config (size=196)
phys_alloc zone=0x07f6fe50 size=156 align=10 ret=7f61240 (detail=0x07f61210)
Add romfile: revision (size=575)
phys_alloc zone=0x07f6fe50 size=156 align=10 ret=7f61170 (detail=0x07f61140)
Add romfile: cmos_layout.bin (size=772)
phys_alloc zone=0x07f6fe50 size=156 align=10 ret=7f610a0 (detail=0x07f61070)
Add romfile: fallback/dsdt.aml (size=4021)
phys_alloc zone=0x07f6fe50 size=156 align=10 ret=7f60fd0 (detail=0x07f60fa0)
Add romfile: img/coreinfo (size=100728)
phys_alloc zone=0x07f6fe50 size=156 align=10 ret=7f60f00 (detail=0x07f60ed0)
Add romfile: fallback/payload (size=74815)
phys_alloc zone=0x07f6fe50 size=156 align=10 ret=7f60e30 (detail=0x07f60e00)
Add romfile: payload_config (size=1681)
phys_alloc zone=0x07f6fe50 size=156 align=10 ret=7f60d60 (detail=0x07f60d30)
Add romfile: payload_revision (size=238)
phys_alloc zone=0x07f6fe50 size=156 align=10 ret=7f60c90 (detail=0x07f60c60)
Add romfile:  (size=1855256)
phys_alloc zone=0x07f6fe50 size=156 align=10 ret=7f60bc0 (detail=0x07f60b90)
Add romfile: bootblock (size=960)
multiboot: eax=0, ebx=0
init ivt
init bda
Add to e820 map: 0009fc00 00000400 2
init bios32
init PMM
init PNPBIOS table
init keyboard
init mouse
init pic
math cp init
PCI probe
phys_alloc zone=0x07f6fe50 size=32 align=10 ret=7f60b70 (detail=0x07f60b40)
PCI device 00:00.0 (vd=8086:1237 c=0600)
phys_alloc zone=0x07f6fe50 size=32 align=10 ret=7f60b20 (detail=0x07f60af0)
PCI device 00:01.0 (vd=8086:7000 c=0601)
phys_alloc zone=0x07f6fe50 size=32 align=10 ret=7f60ad0 (detail=0x07f60aa0)
PCI device 00:01.1 (vd=8086:7010 c=0101)
phys_alloc zone=0x07f6fe50 size=32 align=10 ret=7f60a80 (detail=0x07f60a50)
PCI device 00:01.3 (vd=8086:7113 c=0680)
phys_alloc zone=0x07f6fe50 size=32 align=10 ret=7f60a30 (detail=0x07f60a00)
PCI device 00:02.0 (vd=1234:1111 c=0300)
phys_alloc zone=0x07f6fe50 size=32 align=10 ret=7f609e0 (detail=0x07f609b0)
PCI device 00:03.0 (vd=8086:100e c=0200)
Found 6 PCI devices (max PCI bus is 00)
Relocating coreboot bios tables
phys_alloc zone=0x07f6fe58 size=31 align=10 ret=f5b00 (detail=0x07f60980)
Copying SMBIOS entry point from 0x07fb0000 to 0x000f5b00
phys_alloc zone=0x07f6fe58 size=20 align=10 ret=f5ae0 (detail=0x07f60950)
Copying ACPI RSDP from 0x07fb1000 to 0x000f5ae0
phys_alloc zone=0x07f6fe58 size=128 align=10 ret=f5a60 (detail=0x07f60920)
Copying PIR from 0x07fd5000 to 0x000f5a60
rsdp=0x000f5ae0
rsdt=0x07fb2777
fadt=0x07fb2653
pm_tmr_blk=e408
Using pmtimer, ioport 0xe408
init timer
Scan for VGA option rom
Attempting to init PCI bdf 00:02.0 (vd 1234:1111)
Attempting to map option rom on dev 00:02.0
Option rom sizing returned fe060000 ffff0000
Inspecting possible rom at 0xfe060000 (vd=1234:1111 bdf=00:02.0)
Copying option rom (size 39424) from 0xfe060000 to 0x000c0000
Checking rom 0x000c0000 (sig aa55 size 77)
Running option rom at c000:0003
pmm call arg1=0
pmm00: length=20 handle=ffffffff flags=9
phys_alloc zone=0x07f6fe60 size=512 align=10 ret=eb160 (detail=0x07f608f0)
Turning on vga text mode console
SeaBIOS (version rel-1.9.0-140-g09e24ac)
init usb
init ps2port
phys_alloc zone=0x07f6fe50 size=4096 align=1000 ret=7f5f000 (detail=0x07f608c0)
/07f5f000\ Start thread
|07f5f000| i8042_flush
|07f5f000| i8042_command cmd=1aa
|07f5f000| i8042_wait_write
|07f5f000| i8042_wait_read
|07f5f000| i8042 param=55
|07f5f000| i8042_command cmd=1ab
|07f5f000| i8042_wait_write
|07f5f000| i8042_wait_read
|07f5f000| i8042 param=0
|07f5f000| ps2_command aux=0 cmd=1ff
|07f5f000| i8042 ctr old=30 new=30
|07f5f000| i8042_command cmd=1060
|07f5f000| i8042_wait_write
|07f5f000| i8042_wait_write
init floppy drives
init hard drives
phys_alloc zone=0x07f6fe58 size=20 align=10 ret=f5a40 (detail=0x07f60890)
ATA controller 1 at 1f0/3f4/0 (irq 14 dev 9)
phys_alloc zone=0x07f6fe50 size=4096 align=1000 ret=7f5e000 (detail=0x07f60860)
/07f5e000\ Start thread
|07f5e000| powerup iobase=1f0 st=0
|07f5e000| powerup iobase=1f0 st=0
|07f5e000| ata_detect ata0-0: sc=0 sn=0 dh=0
|07f5e000| powerup iobase=1f0 st=0
|07f5e000| powerup iobase=1f0 st=0
|07f5e000| ata_detect ata0-1: sc=0 sn=0 dh=0
\07f5e000/ End thread
phys_free 7f5e000 (detail=0x07f60860)
|07f5f000| i8042_command cmd=1060
|07f5f000| i8042_wait_write
|07f5f000| i8042_wait_write
|07f5f000| ps2_sendbyte aux=0 cmd=ff
|07f5f000| i8042_kbd_write c=255
|07f5f000| i8042_wait_write
|07f5f000| ps2 read fa
|07f5f000| ps2 read aa
|07f5f000| i8042_command cmd=1060
|07f5f000| i8042_wait_write
|07f5f000| i8042_wait_write
|07f5f000| ps2_command aux=0 cmd=f5
|07f5f000| i8042 ctr old=30 new=30
|07f5f000| i8042_command cmd=1060
|07f5f000| i8042_wait_write
|07f5f000| i8042_wait_write
phys_alloc zone=0x07f6fe58 size=20 align=10 ret=f5a20 (detail=0x07f60860)
ATA controller 2 at 170/374/0 (irq 15 dev 9)
phys_alloc zone=0x07f6fe50 size=4096 align=1000 ret=7f5e000 (detail=0x07f60830)
/07f5e000\ Start thread
|07f5e000| powerup iobase=170 st=50
|07f5e000| powerup iobase=170 st=50
|07f5e000| ata_detect ata1-0: sc=55 sn=aa dh=a0
|07f5e000| ata_reset drive=0x07f5edc0
|07f5f000| i8042_command cmd=1060
|07f5f000| i8042_wait_write
|07f5f000| i8042_wait_write
|07f5f000| ps2_sendbyte aux=0 cmd=f5
|07f5f000| i8042_kbd_write c=245
|07f5f000| i8042_wait_write
|07f5f000| ps2 read fa
|07f5f000| i8042_command cmd=1060
|07f5f000| i8042_wait_write
|07f5f000| i8042_wait_write
|07f5f000| ps2_command aux=0 cmd=10f0
|07f5f000| i8042 ctr old=30 new=30
|07f5f000| i8042_command cmd=1060
|07f5f000| i8042_wait_write
|07f5f000| i8042_wait_write
init ahci
init virtio-blk
init virtio-scsi
init lsi53c895a
init esp
init megasas
init pvscsi
init MPT
init lpt
Found 1 lpt ports
init serial
Found 1 serial ports
phys_alloc zone=0x07f6fe50 size=80 align=10 ret=7f607e0 (detail=0x07f607b0)
Searching bootorder for: /rom at img/coreinfo
phys_alloc zone=0x07f6fe50 size=24 align=10 ret=7f60790 (detail=0x07f60760)
Registering bootable: Payload [coreinfo] (type:32 prio:9999 data:ffe0f640)
|07f5e000| ata_reset exit status=0
|07f5e000| phys_alloc zone=0x07f6fe58 size=44 align=10 ret=f59f0 (detail=0x07f60730)
|07f5e000| phys_alloc zone=0x07f6fe50 size=80 align=10 ret=7f606e0 (detail=0x07f606b0)
|07f5e000| DVD/CD [ata1-0: QEMU DVD-ROM ATAPI-4 DVD/CD]
|07f5e000| Searching bootorder for: /pci at i0cf8/*@1,1/drive at 1/disk at 0
|07f5e000| phys_alloc zone=0x07f6fe50 size=24 align=10 ret=7f60690 (detail=0x07f60660)
|07f5e000| Registering bootable: DVD/CD [ata1-0: QEMU DVD-ROM ATAPI-4 DVD/CD] (type:3 prio:102 data:f59f0)
|07f5e000| ata_detect resetresult=0000
|07f5e000| powerup iobase=170 st=50
|07f5e000| powerup iobase=170 st=0
|07f5e000| ata_detect ata1-1: sc=55 sn=aa dh=b0
|07f5e000| send_cmd : DRQ not set (status 00)
\07f5e000/ End thread
phys_free 7f5e000 (detail=0x07f60830)
|07f5f000| i8042_command cmd=1060
|07f5f000| i8042_wait_write
|07f5f000| i8042_wait_write
|07f5f000| ps2_sendbyte aux=0 cmd=f0
|07f5f000| i8042_kbd_write c=240
|07f5f000| i8042_wait_write
|07f5f000| ps2 read fa
|07f5f000| ps2_sendbyte aux=0 cmd=2
|07f5f000| i8042_kbd_write c=2
|07f5f000| i8042_wait_write
|07f5f000| ps2 read fa
|07f5f000| i8042_command cmd=1060
|07f5f000| i8042_wait_write
|07f5f000| i8042_wait_write
|07f5f000| ps2_command aux=0 cmd=f4
|07f5f000| i8042 ctr old=61 new=70
|07f5f000| i8042_command cmd=1060
|07f5f000| i8042_wait_write
|07f5f000| i8042_wait_write
|07f5f000| i8042_command cmd=1060
|07f5f000| i8042_wait_write
|07f5f000| i8042_wait_write
|07f5f000| ps2_sendbyte aux=0 cmd=f4
|07f5f000| i8042_kbd_write c=244
|07f5f000| i8042_wait_write
|07f5f000| ps2 read fa
|07f5f000| i8042_command cmd=1060
|07f5f000| i8042_wait_write
|07f5f000| i8042_wait_write
|07f5f000| PS2 keyboard initialized
\07f5f000/ End thread
phys_free 7f5f000 (detail=0x07f608c0)
All threads complete.
Scan for option roms
Attempting to init PCI bdf 00:00.0 (vd 8086:1237)
Attempting to map option rom on dev 00:00.0
Option rom sizing returned 0 0
Attempting to init PCI bdf 00:01.0 (vd 8086:7000)
Attempting to map option rom on dev 00:01.0
Option rom sizing returned 0 0
Attempting to init PCI bdf 00:01.1 (vd 8086:7010)
Attempting to map option rom on dev 00:01.1
Option rom sizing returned 0 0
Attempting to init PCI bdf 00:01.3 (vd 8086:7113)
Attempting to map option rom on dev 00:01.3
Option rom sizing returned 0 0
Attempting to init PCI bdf 00:03.0 (vd 8086:100e)
Attempting to map option rom on dev 00:03.0
Option rom sizing returned fe000000 fffc0000
Inspecting possible rom at 0xfe000000 (vd=8086:100e bdf=00:03.0)
Copying option rom (size 64000) from 0xfe000000 to 0x000ca000
Checking rom 0x000ca000 (sig aa55 size 125)
Running option rom at ca00:0003
pmm call arg1=1
pmm01: handle=18ae1000
pmm call arg1=0
pmm00: length=1000 handle=18ae1000 flags=2
phys_alloc zone=0x07f6fe50 size=65536 align=10 ret=7f50660 (detail=0x07f608c0)
pmm call arg1=1
pmm01: handle=18ae200a
pmm call arg1=0
pmm00: length=a000 handle=18ae200a flags=2
phys_alloc zone=0x07f6fe50 size=655360 align=10 ret=7eb0660 (detail=0x07f60830)
Checking rom 0x000cb000 (sig aa55 size 18)
Checking rom 0x000ca000 (sig aa55 size 7)
Searching bootorder for: /pci at i0cf8/*@3
phys_alloc zone=0x07f6fe50 size=24 align=10 ret=7eb0640 (detail=0x07eb0610)
Registering bootable: iPXE (PCI 00:03.0) (type:128 prio:104 data:ca000361)
Checking rom 0x000cb000 (sig aa55 size 18)
Searching bootorder for: /rom at genroms/kvmvapic.bin
phys_alloc zone=0x07f6fe50 size=24 align=10 ret=7eb05f0 (detail=0x07eb05c0)
Registering bootable: Legacy option rom (type:129 prio:103 data:cb000003)

Press ESC for boot menu.

Checking for bootsplash
i8042_command cmd=ae
i8042_wait_write
Select boot device:

1. DVD/CD [ata1-0: QEMU DVD-ROM ATAPI-4 DVD/CD]
2. Legacy option rom
3. iPXE (PCI 00:03.0)
4. Payload [coreinfo]
i8042_command cmd=ae
i8042_wait_write
i8042_command cmd=ae
i8042_wait_write

Searching bootorder for: HALT
Mapping cd drive 0x000f59f0
Running option rom at cb00:0003
phys_alloc zone=0x07f6fe60 size=2048 align=10 ret=ea960 (detail=0x07eb0590)
phys_alloc zone=0x07f6fe58 size=36 align=10 ret=f59c0 (detail=0x07eb0560)
finalize PMM
malloc finalize
Add to e820 map: 0009fc00 00000400 2
Space available for UMB: cd800-ea800, f5320-f59c0
Add to e820 map: 07f70000 00040000 1
Returned 262144 bytes of ZoneHigh
e820 map has 6 items:
  0: 0000000000000000 - 000000000009fc00 = 1 RAM
  1: 000000000009fc00 - 00000000000a0000 = 2 RESERVED
  2: 00000000000f0000 - 0000000000100000 = 2 RESERVED
  3: 0000000000100000 - 0000000007fb0000 = 1 RAM
  4: 0000000007fb0000 - 0000000008000000 = 2 RESERVED
  5: 00000000ff800000 - 0000000100000000 = 2 RESERVED
Jump to int19
enter handle_19:
  NULL
Booting from CBFS...
Run img/coreinfo
Segment 45444f43 100672 at 0xffe0f6a0 -> 403120 at 0x00100000
Calling addr 0x00100000
[?25h(B                                  coreinfo 0.1                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  (B CPU Information                                                                 (0qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq(B  Vendor: AMD                                                                     Processor: QEMU Virtual CPU version 2.5+                                        Family: 6                                                                       Model: 6                                                                        Stepping: 3                                                                     Brand: 0                                                                        CPU Speed: 51007 Mhz                                                                                                                                            Features:                                                                        fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat                   pse36 clflsh mmx fxsr sse sse2                                                 AMD Extended Flags:                                                              fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat                   lahf/sahf svm xsr lm                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          (B[A: CPU Info] [B: PCI] [C: NVRAM] [D: RAM Dump]                                 F1: System F2: Firmware                                  08/02/2016 - 15:02:56  (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:56 (B08/02/2016 - 15:02:57 (B08/02/2016 - 15:02:57 (B08/02/2016 - 15:02:57 (B08/02/2016 - 15:02:57 (B08/02/2016 - 15:02:57 (B08/02/2016 - 15:02:57 (B08/02/2016 - 15:02:57 (B08/02/2016 - 15:02:57 (B08/02/2016 - 15:02:57 (B08/02/2016 - 15:02:57 (B08/02/2016 - 15:02:57 General Protection Fault Exception

Error code: 0x20 - descriptor 0x4 in the GDT, internal to the CPU

EIP:    0x000fcb1e

CS:     0x0010

EFLAGS: 0x00000002

EAX:    0x00006fca

ECX:    0x00000020

EDX:    0x000060a0

EBX:    0x00000000

ESP:    0x00006fb0

EBP:    0xffe0f684

ESI:    0x00008462

EDI:    0x00000000

DS:     0x0018

ES:     0x0018

SS:     0x0018

FS:     0x0018

GS:     0x0018

Dumping stack:

0x71a0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 

0x7180: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 

0x7160: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 

0x7140: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 

0x7120: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 

0x7100: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 

0x70e0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 

0x70c0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 

0x70a0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 

0x7080: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 

0x7060: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 

0x7040: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 

0x7020: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 

0x7000: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 

0x6fe0: 00000000 00000000 e9840000 0200f000 00000000 00000000 00000000 00000000 

0x6fc0: 00000000 ffe0f668 00006ff8 00000000 00000000 00000000 00000000 00000000 

0x6fa0: 00000020 000fcb1e 00000010 00000002 00006fb4 00006fb4 001626b0 000f1a06