[coreboot - Bug #617] Missing safeguard: CBFS_SIZE greater than BIOS region in the IFD

Issue #617 has been updated by gaspar ilom.


Thanks Matt DeVillier!

> there's something odd going on here, since the generated FMAP should have the IFD, ME, and GBE regions listed if you are including those blobs in the coreboot build.
> 
>

The metioned blobs are included. Here's my coreboot config: https://github.com/gaspar-ilom/heads/blob/try-cbfs-sanity-check-patch/config/coreboot-w541.config

> your manual invocation of ifdtool lacks the platform parameter, so all bets are off. But as above, since the IFD layout is not reflected in the FMAP as it should, then there is nothing to compare against.

This was not a manual invocation but an excerpt from the logs when building heads with CircleCI. It seems that for haswell `CONFIG_IFD_CHIPSET` is not set, which means that some special handling does not apply in the main makefile: https://github.com/coreboot/coreboot/blob/main/Makefile.mk#L1087-L1096

This looks very much like the culprit to me or am I missing something? Question is: What would be the right way to make this work?
* Should we set `CONFIG_IFD_CHIPSET` for this board?
  * If so to what?
* Or should we strip the platform parameter from `$(IFDTOOL) -p $(CONFIG_IFD_CHIPSET) -F $@ $<` in the referenced code in case it is not there?
  * That would mean calling without the platform parameter if the ifd blob is used and the param is not explicitly selected. Maybe this an option at least for some boards?


By the way here's a manual invocation, that shows that it should work if this was stored in `DEFAULT_FLASHMAP` before the `fmap.fmd` target is built https://github.com/coreboot/coreboot/blob/main/Makefile.mk#L1231-L1246:

```
./build/x86/coreboot-25.09/util/ifdtool/ifdtool -p ifd2 -F w541_fmap.fmd blobs/w541/ifd.bin && cat w541_fmap.fmd 
File blobs/w541/ifd.bin is 4096 bytes
Wrote layout to w541_fmap.fmd
FLASH ##ROM_SIZE## {
	SI_DESC@0x0 0x1000
	SI_GBE@0x1000 0x2000
	SI_ME@0x3000 0x1E000
	SI_BIOS@##BIOS_BASE## ##BIOS_SIZE## {
		##CONSOLE_ENTRY##
		##MRC_CACHE_ENTRY##
		##SMMSTORE_ENTRY##
		##SPD_CACHE_ENTRY##
		##VPD_ENTRY##
		FMAP@##FMAP_BASE## ##FMAP_SIZE##
		COREBOOT(CBFS)@##CBFS_BASE## ##CBFS_SIZE##
	}
}
```

----------------------------------------
Bug #617: Missing safeguard: CBFS_SIZE greater than BIOS region in the IFD
https://ticket.coreboot.org/issues/617#change-2185

* Author: gaspar ilom
* Status: New
* Priority: Normal
* Target version: none
* Start date: 2025-11-14
* Affected versions: main
* Affected hardware: haswell
----------------------------------------
There are no effective safeguards to enforce that the `CONFIG_CBFS_SIZE` does not exceed the bios region as declared in the IFD.

### Impact

- Downstream under Heads with a maximized bios region for the Haswell boards (T440p and W541) we could verify that this bug leads to an overflow when training the memory cache that makes it not work. This happens both with MRC blob and NRI and causes very slow boot times (20s) and S3 suspend/resume does not work.
- Effects on other boards have not been observed but are possible.

### Expected behavior

Coreboot should not build successfully if the `CBFS_SIZE` exceeds the bios region in the IFD and error out reporting the problem that caused this.

## Analysis

Full details are under the PR in Heads and in particular this comment by @tlaurion https://github.com/linuxboot/heads/pull/2025/#issuecomment-3524672338

Ifttool reports a bios region of 0xBDEFFF (BDEFFF).
However, the coreboot config contained: 

```
CONFIG_CBFS_SIZE=0xBE4FFF
```


```
./build/x86/coreboot-25.09/util/ifdtool/ifdtool --platform ifd2 --layout w541_layout blobs/w541/ifd.bin && cat w541_layout 
File blobs/w541/ifd.bin is 4096 bytes
Wrote layout to w541_layout
00000000:00000fff fd
00021000:00bfffff bios
00003000:00020fff me
00001000:00002fff gbe
```

After fixing the `CONFIG_CBFS_SIZE` the issues were fixed and fast boot with trained memory cache and S3 suspen/resume work again with NRI: https://github.com/linuxboot/heads/pull/2025/commits/9b8b9cacdcea4f67c95dcec10b3153fc8c016940



-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: https://ticket.coreboot.org/my/account
_______________________________________________
coreboot mailing list -- [email protected]
To unsubscribe send an email to [email protected]