Coreboot on the X210

[flyingfishfinger]

Can you post this here? https://review.coreboot.org/c/coreboot/+/32531/

At risk of revealing my lack of "software prowess", I'm not actually sure how to do that properly / safely

But I also made a mistake in my above post, it should be:

register "usb2_ports[2]" = "USB2_PORT_FLEX(OC1)" # FPR
register "usb2_ports[3]" = "USB2_PORT_FLEX(OC1)" # SD

Port 4 appears to be the internal one. I had enabled all three and both the SD and the fingerprint worked.

I've now confirmed that both of the above are correct and work cross-platform.

@harryk I saw that you added these changes to your repo already, sorry for the mistake. Please update.

R

[harryK]

Can you post this here? https://review.coreboot.org/c/coreboot/+/32531/

At risk of revealing my lack of "software prowess", I'm not actually sure how to do that properly / safely

But I also made a mistake in my above post, it should be:

register "usb2_ports[2]" = "USB2_PORT_FLEX(OC1)" # FPR
register "usb2_ports[3]" = "USB2_PORT_FLEX(OC1)" # SD

Port 4 appears to be the internal one. I had enabled all three and both the SD and the fingerprint worked.

I've now confirmed that both of the above are correct and work cross-platform.

@harryk I saw that you added these changes to your repo already, sorry for the mistake. Please update.

R

Hi,
I updated the repository with the correct port. SD card and FPR are still not working for me, but they weren't working with the stock bios either, so I trusted you
I also built a new image with the current coreboot revision and the updated devicetree, if someone wants to try it and maybe confirm that SD card and FPR are working it's here https://github.com/harrykipper/x210

[flyingfishfinger]

I just logged in to Win10 with my fingerprint and downloaded some photos from an SD card, so I'm pretty sure it works :p

Note that when I first received the machine the SD card didn't work either. Turns out the sub-card they chose seems to have been busted, so I swapped in the one from my old X201. Now it works.

R

[evil]

and included the latest CPU microcode from Intel

It really sucks, because newer firmware decreses performance(so it will suck more battery to do same operations). so I've locked intel microcode in package manager to stay at "20171117". It's the last version that will allow using full capabilities of Intel CPUs (a bit less secure, but as laptops tends to be single user only, then who cares really?...)
It's also goode idea to add
GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT mitigations=off mds=off noibrs noibpb nopti spectre_v2=off l1tf=off nospec_store_bypass_disable no_stf_barrier kvm-intel.vmentry_l1d_flush=never "
to /etc/default/grub

Otherwise great job. I hope I will be able to use that (but Jacky is keeping my $3800 from nearly two years and not sending me any of paid machines[claiming that some were confiscated at boarder{it doesn't matter that they were never shipped}] and responding less often than 2 months...)

[skx]

It really sucks, because newer firmware decreses performance(so it will suck more battery to do same operations). so I've locked intel microcode in package manager to stay at "20171117". It's the last version that will allow using full capabilities of Intel CPUs (a bit less secure, but as laptops tends to be single user only, then who cares really?...)

I don't know why single user machine is not important to be secure. The latest intel microcode updates are to partially prevent the intel clusterfck. Having access to full ram memory is making all your security measures worthless. I would say it is important for any vulnerable intel machine.

[verynice]

It really sucks, because newer firmware decreses performance(so it will suck more battery to do same operations). so I've locked intel microcode in package manager to stay at "20171117". It's the last version that will allow using full capabilities of Intel CPUs (a bit less secure, but as laptops tends to be single user only, then who cares really?...)

I don't know why single user machine is not important to be secure. The latest intel microcode updates are to partially prevent the intel clusterfck. Having access to full ram memory is making all your security measures worthless. I would say it is important for any vulnerable intel machine.

can you elaborate your statement?
Why should user care of xxx mitigations?
there is _no_ real-world exploits for such cases, and even if there were:
a) one must use unsafe code from 3rd parties (and this leads to more some reeaaaaly dangerous problems)
b) be a server with multiple VMs which are used by different users
c) almost every browser has patches for spec/meltd or patched js, and even better Pale Moon had js implementation which _wasn't_ affected by those
so, why should one care of so called _pseudosecurity_
this kind of security (through obscurity) only makes the whole world worse because almost everyone starts to sing that song even though they can't name a _single_ attack vector.

[verynice]

I had enabled all three and both the SD and the fingerprint worked.

register "usb2_ports[2]" = "USB2_PORT_FLEX(OC1)" # FPR
register "usb2_ports[3]" = "USB2_PORT_FLEX(OC1)" # SD
register "usb2_ports[4]" = "USB2_PORT_FLEX(OC1)" # INT
is this correct?

[flyingfishfinger]

is this correct?

I haven't tested the internal port, but the other two are working for me yes.

R

[mjg59]

can you elaborate your statement?
Why should user care of xxx mitigations?
there is _no_ real-world exploits for such cases, and even if there were:
a) one must use unsafe code from 3rd parties (and this leads to more some reeaaaaly dangerous problems)
b) be a server with multiple VMs which are used by different users
c) almost every browser has patches for spec/meltd or patched js, and even better Pale Moon had js implementation which _wasn't_ affected by those
so, why should one care of so called _pseudosecurity_
this kind of security (through obscurity) only makes the whole world worse because almost everyone starts to sing that song even though they can't name a _single_ attack vector.

It's entirely possible to exploit Spectre via in-browser code (tough with Javascript, but certainly possible with WASM). It's not a purely VM attack, if your browser is running on one thread then an attacker can extract information from processes running on the other thread on the same core.

[verynice]

It's entirely possible to exploit Spectre via in-browser code (tough with Javascript, but certainly possible with WASM). It's not a purely VM attack, if your browser is running on one thread then an attacker can extract information from processes running on the other thread on the same core.

First of all, glad to hear from you!
Second, can you update boardconfig on review.coreboot? I haven't tested the fixes provided earlier but it would be great to have working sd.
---
Now, let's go to the business:
Right you are, about WASM (I thought about WASM too) but WASM is a dangerous technology in itself (and nothing justifies the usage of it), there are numerous things which one could exploit through the usage of it
and miners are only the beginning. Still I prefer to ban WASM (I even ban sockets ws wss) and use only 1st party js, or don't use it at all. But we're not talking about me,
we talk about users (and this is wide) 1. I don't know how Chrome/Firefox fixed WASM 2. Do the new compiler flags help against "bad" usage of WASM and I don't want to speculate.

[L29Ah]

So, does me_cleaner work properly on X210? https://github.com/corna/me_cleaner/issues/3 doesn't have any reports on it.

[flyingfishfinger]

I'm still having trouble with long boot delays. 20 seconds on EVERY boot, it looks like it's redoing the RAM training each time.

SECURITY_CLEAR_DRAM_ON_REGULAR_BOOT is NOT set.

Does anyone have a clue why coreboot would be spending 20 seconds on FsPMemoryInit anyway?

Thanks,
Rafael

[harryK]

The X210 was just merged in the official Coreboot tree
https://review.coreboot.org/c/coreboot/+/32531

[flyingfishfinger]

Yay!

However, it seems like the updated devicetree.cb didn't make it in (abandoned?) which enables the FPR and SD card. I wonder what happened there..

R

[mjg59]

That was merged in as a separate commit.

[flyingfishfinger]

Yup, found it about half an hour after I asked. My bad

[harryK]

Hello all,

has anyone built coreboot for the X210 recently? In the last couple of months I haven't been able to make a bootable build and can't figure why...

[mjg59]

Just did a build as of 3858fb121e4322f7a835b23622bf9452790fcec6, with https://gist.github.com/mjg59/41072100b ... 9baef25f99 as the config. Works fine for me, other than the firmware splash screen being upside down.

[harryK]

Just did a build as of 3858fb121e4322f7a835b23622bf9452790fcec6, with https://gist.github.com/mjg59/41072100b ... 9baef25f99 as the config. Works fine for me, other than the firmware splash screen being upside down.

Hmmm. Doesn't work. Compiles fine, but doesn't boot. The only difference (that I can think of) is that I have the 3k screen. Something happened between 25 and 28 April. I can boot April 25, but not April 28 (52f8926159917d87cc33c33183225be7eb470e0d) or anything past then

*EDIT*
Ok, it was this commit ---> https://review.coreboot.org/c/coreboot/+/40558

I had my ram stick in the second slot and it wasn't being detected ............

I spent 2+ months in lockdown without my laptop, and all I had to do was to switch ram slots.

sigh.

[mjg59]

I've now got Coreboot running correctly on the X2100 - https://github.com/mjg59/coreboot/tree/x2100_ng is my current tree.

[chakaponden]

Can somebody post here the latest coreboot with seabios payload for x210?

[flyingfishfinger]

I've now got Coreboot running correctly on the X2100 - https://github.com/mjg59/coreboot/tree/x2100_ng is my current tree.

Any plans to upstream this? By the looks of it, it's a little out of date at this point...

R

[dotmpfs]

I've now got Coreboot running correctly on the X2100 - https://github.com/mjg59/coreboot/tree/x2100_ng is my current tree.

Any plans to upstream this? By the looks of it, it's a little out of date at this point...

R

Yeah I’m also wondering.

I was thinking about purchasing x2100 but I’d like to flash Coreboot. Do you think I can just download new Coreboot and copy in those files from his repo? Or best to wait for upstream?

Thanks

[flyingfishfinger]

Just managed to build mjg59's coreboot version for the X2100, it seems to run fine. . Nope, the keyboard doesn't work at all in the Tianocore picker. Once I figure out how to get back into Ubuntu.... let's see what can be done.

It takes a bit of fiddling, since it's based on an older version of coreboot. My main issue was that the xgcc tools in the X2100 fork wouldn't compile on Ubuntu 22.05, (a) solution was to "make crossgcc" in the lastest coreboot master, then replace the entire xgcc folder in the X2100 tree with that. And a few dependency resolution problems for good measure, but those weren't that hard to fix.

Good luck,
R