BIOS code failed to check device and run into a infinite loop

Question

I'm hacking a thinkpad BIOS to remove the card whitelist. I run the bios firmware in qemu and debug with IDApro.

.\qemu-system-x86_64.exe -m 4096M -bios D:\W25Q32BV\old.bin -s -S

But, the code run into a infinite loop finally. Before run into the infinite loop, it tried to check if the memory is available. But the memory address is confusing. At this phase, the cpu is in protected mode with paging disabled, I know that 0xFEF00000 is just the physical address for a device on the mainboard. But I don't know which device 0xFEF00000 points to and why not available. I want to know if there is an easier and smarter way to find the whitelist or make the code run normally until it check the whitelist.

GDB>info registers
EAX=5a5a5ad0 EBX=00400000 ECX=00010000 EDX=00000000
ESI=000000ff EDI=fef00004 EBP=fffffaba ESP=00000028
EIP=fffffe96 EFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0018 00000000 ffffffff 00cf9300 DPL=0 DS   [-WA]
CS =0010 00000000 ffffffff 00cf9b00 DPL=0 CS32 [-RA]
SS =0018 00000000 ffffffff 00cf9300 DPL=0 DS   [-WA]
DS =0018 00000000 ffffffff 00cf9300 DPL=0 DS   [-WA]
FS =0018 00000000 ffffffff 00cf9300 DPL=0 DS   [-WA]
GS =0018 00000000 ffffffff 00cf9300 DPL=0 DS   [-WA]
LDT=0000 00000000 0000ffff 00008200 DPL=0 LDT
TR =0000 00000000 0000ffff 00008b00 DPL=0 TSS32-busy
GDT=     ffffff60 0000003f
IDT=     00000000 0000ffff
CR0=00000013 CR2=00000000 CR3=00000000 CR4=00000600
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000000
FCW=037f FSW=0000 [ST=0] FTW=ff MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000400 0000
FPR2=00000000fef40000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=000000000113326a 0000 FPR7=00000000fffffa4d 0000
XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000
XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000
XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000

Answer 1

This is most likely the Cache-As-RAM (CAR) area, used by the BIOS code before initializing DRAM. The BIOS code is checking that it is usable as RAM (writable and reads back the same value).

In general, it's going to be pretty difficult to use QEMU for running BIOS code, as its emulation is likely to be pretty different from the board the BIOS was written for, so you'll get failures like this all the time.