Skip to content

BOARDS_AND_TESTERS.md

Latest commit

 

History

History
224 lines (181 loc) · 11.9 KB

BOARDS_AND_TESTERS.md

File metadata and controls

224 lines (181 loc) · 11.9 KB
Raw

General information

Intel and AMD CPU generations; Transient execution CPU vulnerability.

"ESU" means "End of Servicing Updates" -- the date after which Intel stops releasing microcode for a CPU generation; newly discovered vulnerabilities on past-ESU generations remain unpatched. The EOL_ prefix in board directories indicates ended microcode servicing. For future ESU dates refer to:

Per-board EOL/ESU status

The Last Microcode column links to the Intel microcode releases page. Dates below are as of the document's last update and may be stale.

EOL boards (EOL_ prefix present):

Board Gen Code Name ESU Date Last Microcode
EOL_t420 2nd Sandy Bridge No official ESU 2019-05-14
EOL_x220 2nd Sandy Bridge No official ESU 2019-05-14
EOL_t430 3rd Ivy Bridge No official ESU 2019-05-14
EOL_w530 3rd Ivy Bridge No official ESU 2019-05-14
EOL_x230 3rd Ivy Bridge No official ESU 2019-05-14
EOL_t530 3rd Ivy Bridge No official ESU 2019-05-14
EOL_optiplex-7010_9010 3rd Ivy Bridge No official ESU 2019-05-14
EOL_z220-cmt 3rd Ivy Bridge No official ESU 2019-05-14
EOL_t440p 4th Haswell Jun 30, 2021 2021-06
EOL_w541 4th Haswell Jun 30, 2021 2021-06
EOL_librem_l1um 5th Broadwell Jun 30, 2021 2020-06
EOL_librem_13v2 6th Skylake Sep 30, 2022 2022-11
EOL_librem_15v3 6th Skylake Sep 30, 2022 2022-11
EOL_m900_tower 6th Skylake Sep 30, 2022 2022-11
EOL_librem_13v4 7th Kaby Lake Mar 31, 2024 2024-03
EOL_librem_15v4 7th Kaby Lake Mar 31, 2024 2024-03
EOL_t480 8th Kaby Lake-R Mar 31, 2026 ¹ 2024-03
EOL_t480s 8th Kaby Lake-R Mar 31, 2026 ¹ 2024-03
EOL_x280 8th Kaby Lake-R Mar 31, 2026 ¹ 2024-03

¹ KBL-R falls under Whiskey Lake ESU (Mar 31, 2026); also classified under Coffee Lake ESU (Jun 30, 2025). Both dates have passed.

| librem_l1um_v2 | 9th | Coffee Lake Refresh | Jun 30, 2026 | Not in Feb 2026+ | | librem_mini | 8th | Whiskey Lake | Mar 31, 2026 | Not in Feb 2026+ | | UNTESTED_talos-2 | POWER9 | Talos II (IBM) | Jan 31, 2026 ² | Feb 2024 ² |

² IBM End of Standard Service for POWER9. Last Raptor firmware release: February 2024.

Active boards (ESU not yet reached; no EOL_ prefix):

Board Gen Code Name ESU Date Last Microcode
librem_14 10th Comet Lake Jun 30, 2027 2025-05 ³
librem_mini_v2 10th Comet Lake Jun 30, 2027 2025-05 ³
librem_11 Atom Jasper Lake TBD TBD
UNTESTED_nitropad-ns50 12th Alder Lake Active 2026-02
novacustom-nv4x_adl 12th Alder Lake Active 2026-02
UNTESTED_msi_z690a_ddr4 12th Alder Lake Active 2026-02
UNTESTED_msi_z690a_ddr5 12th Alder Lake Active 2026-02
msi_z790p_ddr5 13th Raptor Lake Active 2026-05
UNTESTED_msi_z790p_ddr4 13th Raptor Lake Active 2026-05
novacustom-v540tu Core Ultra S1 Meteor Lake Active 2026-05
novacustom-v560tu Core Ultra S1 Meteor Lake Active 2026-05

³ Comet Lake ESU runs through Jun 30, 2027. Check the Intel microcode releases page for recent updates.

Formerly supported (unmaintained_boards/*/; reference only):

Board Gen Code Name ESU Date Last Microcode
KGPE-D16 AMD Family 15h Bulldozer No AMD ESU 2018-05 (dropped in coreboot 4.12)

KGPE-D16 is the last fully blob-free x86 platform (Talos II is the last fully blob-free platform overall, on POWER9). AMD ceased Family 15h microcode in 2018; removed from upstream coreboot in 4.12 (2019). The Dasharo fork was abandoned August 2025. An independent community port (15h.org, October 2025) exists but is not part of upstream coreboot.

Mitigation

Spectre Variant 2 (CVE-2017-5715) and related speculative execution vulnerabilities are unpatched on any board past its ESU date. Retpoline and similar software mitigations have limited effectiveness without microcode updates. On EOL platforms, run a single trusted workflow per boot session and reboot before switching tasks.

See the Heads threat model for detailed guidance including Tails OPSEC, QubesOS memory management, and QSB-107 exposure rates.

TPM GPIO Reset Vulnerability

Many Intel platforms are vulnerable to a TPM GPIO reset bypass (mkukri.xyz, 2024). See the Heads Wiki Threat Model for per-platform status and mitigation. Test with:

tpm-gpio-detect 2>&1 | tee /media/tpm-gpio-detect.log
tpm-gpio-assert 2>&1 | tee /media/tpm-gpio-assert.log

On ROMs that lock the PLTRST pad in coreboot (this branch), the expected result of tpm-gpio-assert is a failed pad write ("pad may be locked") with a non-zero exit: the lock is working and the reset edge cannot be created. tpm-gpio-detect reports the pad as locked. To demonstrate the reset flow itself, run the tools on firmware without the pad lock.

The tpm-gpio-* tools build on any x86 board with a TPM (1.2 or 2.0); tpm-gpio-assert dispatches at runtime on which TPM CLI the initramfs packs (bin/tpm2 = TPM 2.0, bin/tpm = TPM 1.2; bin/tpm2 wins when both are present, e.g. x280):

  • TPM 2.0 (t480/t480s/x280): tpm2 startup -c before and after, tpm2 pcrread (sha256) for the PCR dumps, and tpm2 shutdown -c immediately before the PLTRST# assertion for a clean session shutdown. The initrd carries the tpm2 multi-call binary; the TPM1 bin/tpm and libtpm.so are deliberately not shipped (except on x280, which packs both stacks).
  • TPM 1.2 (m900): tpm pcrread -ix <i> for PCRs 0-15 (bare SHA1 digests) before and after, a raw 16-byte TPM_Startup(TPM_STARTUP_FULL) on /dev/tpm0 after the assertion to reinitialize (the packed tpm-tools binary has no startup subcommand), and no shutdown step -- the PLTRST# pulse itself performs a full _TPM_Init (PCRs zero, NVRAM preserved). The initrd carries bin/tpm and libtpm.so; no tpm2 binary.

The TPM Reset clears all PCRs to zero. A subsequent attacker would need to replay known PCR measurements to reconstruct the sealed state and extract TOTP/HOTP shared secrets -- this PoC proves the reset is possible but does not perform PCR replay.

The TPM Disk Unlock Key with passphrase is not affected -- the passphrase is required regardless of PCR state. TPMTOTP/HOTP remote attestation is affected -- the shared secret at NVRAM index 0x4d47 has no passphrase, enabling unseal with forged PCRs.

The fix must come from coreboot. Tracked at coreboot ticket #576 and coreboot patch series.

The audit and reset tooling now works on both TPM versions, but affected boards remain VULNERABLE: the reset path has not been verified on hardware as part of this work, and no reseal behavior was changed.

Thunderbolt

The EOL_t480, EOL_t480s and EOL_x280 boards build with discrete Thunderbolt (dtbt) support enabled, and the compiled driver is part of the default configuration of every one of their variants (maximized and hotp). The evidence for this is build-level: the driver is configured and compiled for every variant. It has not been verified on hardware as part of this work.

Board Testers

Boards under boards/* must be tested by listed owners for coreboot/linux version bumps. This file is the primary board tester registry. To be added or removed as a tester, comment on issue #692. Board configs retain their HCL summaries and anchors. The companion HCL publication target is not live; see modules.md for its status.

Laptops

xx20 (Sandy Bridge, 2nd Gen -- EOL)

  • t420 (xx20): @notgivenby @alexmaloteaux @akfhasodh @doob85
  • x220 (xx20): @srgrint @Thrilleratplay

xx30 (Ivy Bridge, 3rd Gen -- EOL)

  • t430 (xx30): @notgivenby @nestire @Thrilleratplay @alexmaloteaux @lsafd @bwachter(iGPU maximized) @shamen123 @eganonoa(iGPU) @nitrosimon @jans23 @icequbes1 (iGPU) @weyounsix (t430-dgpu)
  • w530 (xx30): @eganonoa @zifxify @weyounsix (dGPU: w530-k2000m) @jnscmns (dGPU K1000M) @computer-user123 (w530 / w530 k2000: prefers iGPU) @tlaurion
  • x230 (xx30): @nestire @tlaurion @merge @jan23 @MrChromebox @shamen123 @eganonoa @bwachter @Thrilleratplay @jnscmns @makkiato83
  • x230-fhd/edp variant: @n4ru @computer-user123 (nitro caster board) @Tonux599 @househead @pcm720 (eDP 4.0 board and 1440p display) @doob85
  • t530 (xx30): @3hhh @fhvyhjriur

ThinkCentre (Skylake, 6th Gen Desktop -- EOL)

  • M900 Tower: @notgivenby

xx4x (Haswell, 4th Gen -- EOL)

  • t440p: @srgrint @MattClifton76 @fhvyhjriur @ThePlexus @akunterkontrolle @rbreslow
  • w541 (similar to t440p): @gaspar-ilom @ResendeGHF

xx8x (Kaby Lake Refresh, 8th Gen Mobile -- EOL)

  • t480: @gaspar-ilom @doritos4mlady @MattClifton76 @notgivenby @akunterkontrolle @nestire (Nitrokey)
  • t480s: @thickfont @kjkent @HarleyGodfrey @nestire (Nitrokey)
  • x280: @NobodyNo0ne @AlguienSasaki

Librem

All EOL unless marked Active.

  • Librem 13v2 (Skylake, 6th Gen): @JonathonHall-Purism
  • Librem 15v3 (Skylake, 6th Gen): @JonathonHall-Purism
  • Librem 15v4 (Kaby Lake, 7th Gen): @JonathonHall-Purism
  • Librem 13v4 (Kaby Lake, 7th Gen): @JonathonHall-Purism
  • Librem 14 (Comet Lake, 10th Gen -- Active): @JonathonHall-Purism
  • Librem 11 (Jasper Lake, Atom -- Active): @JonathonHall-Purism

Clevo

All Active.

  • Nitropad NS50 (Alder Lake, 12th Gen): @daringer
  • Novacustom NV4x (Alder Lake, 12th Gen): @tlaurion @daringer
  • Novacustom v540tu (Meteor Lake, Core Ultra S1): @tlaurion @daringer @mkopec
  • Novacustom v560tu (Meteor Lake, Core Ultra S1): @tlaurion @daringer @mkopec

Chromebooks

  • Acer Chromebook Spin 714 CP714-1WN (KANO): @cwiggs

Desktops / Servers

All EOL unless marked Active.

  • Optiplex 7010/9010 SFF/DT (Ivy Bridge, 3rd Gen): @tlaurion(owns DT variant)
  • HP Z220 CMT (Ivy Bridge, 3rd Gen): @d-wid
  • KGPE-D16 (AMD Family 15h): @arhabd @Tonux599 @zifxify
  • Librem L1UM v1 (Broadwell, 5th Gen): @JonathonHall-Purism
  • Librem L1UM v2 (Coffee Lake, 9th Gen): @JonathonHall-Purism
  • Librem mini v1 (Whiskey Lake, 8th Gen): @JonathonHall-Purism
  • Librem mini v2 (Comet Lake, 10th Gen -- Active): @JonathonHall-Purism
  • Talos II (POWER9, PPC64LE): @tlaurion (became untested, low community interest despite large investment)

MSI (Alder/Raptor Lake — Active)

  • MSI PRO Z690-A (WIFI) (DDR4): None - Board is untested. (Active, Alder Lake 12th Gen)
  • MSI PRO Z690-A (WIFI) (DDR5): None - Board is untested. (Active, Alder Lake 12th Gen)
  • MSI PRO Z790-P (WIFI) (DDR4): None - Board is untested. (Active, Raptor Lake 13th Gen)
  • MSI PRO Z790-P (WIFI) (DDR5): @Tonux599 (Active, Raptor Lake 13th Gen)