Heads-threat-model: per-board TPM GPIO reset protection table; restructure with H2/H3 hierarchy; embed 149 hyperlinks; add CVE timeline and ME/AMT video. Uniformize and add missing boards flashing guides - #224
Open
tlaurion wants to merge 3 commits into
Conversation
…H2/H3 hierarchy; embed 149 hyperlinks; add CVE timeline and ME/AMT video Add per-board GPIO TPM reset protection table with chipset generation, EOL/ESU dates, and protection status. Correct T480/T480s ESU to Mar 31, 2026. KBL-R vs Whiskey Lake comparison. Restructure document with consistent H2/H3/H4 section hierarchy. Add Further Learning and References sections. Move per-board table to prominent position. Consolidate evil maid attacks, CPU vulnerabilities, and mitigation guidance. Embed 149 inline hyperlinks: CVE numbers (NVD), tool names, vulnerability disclosures, Intel/AMD/IBM terms, TCG specifications. Add external references: coreboot docs, EFF Threat Modeling Handout, OST2 firmware security training, darkmentor.com timeline, SPI programmer selection guide. Fix broken/outdated URLs. Bonify content from primary sources: - michaelaltfield 'What is Heads': Boot Guard Verified vs Measured Boot, evil maid relay/suspend/TOTP extraction attacks, Enterprise Security vs Cypherpunk Security distinction - OST2: structured Further Learning section with 9 firmware security courses (free, open-source, Creative Commons) - darkmentor.com: replace prose vulnerability list with CVE tables (transient execution: 11 rows 2018-2025; firmware/platform: 16 rows 2017-2025) with per-CVE Heads platform impact - anarsec.guide: tamper-evident countermeasures, expanded Tails/Qubes OpSec guidance, defense-in-depth strategy - 2018 Intel promotional video (Ylian Saint-Hilaire, Principal Engineer): transcript quotes showing ME/AMT original pitch contrasted with security implications Add 44 previously-missing hyperlinks: TAO, Pomona clip, Dasharo, NovaCustom, Raspberry Pi Pico, flashprog, serprog, and others. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
…mmer] placeholders Every board page uses identical template: multiline TOC, EOL status links to BOARDS_AND_TESTERS.md and threat model, GPIO TPM reset protection status with per-board table and vulnerability doc links, Safety First with programmer recommendations, ## Disassembly and ## Flashing headings. 14 new board pages with Dasharo, Libreboot, coreboot doc references. 6 existing pages retrofitted. Alphabetical nav_order 1-20. SPI-Programmer-Best-Practices reworked: Tool Interchangeability section with [flasher] and [programmer] placeholders, consolidated safety warnings, reorganized sections. All command blocks use [flasher] --programmer [programmer] convention. Active boards use ✅ Active heading. Broken anchors fixed. T480s serprog examples generalized. Index page Dasharo link added. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
…ss-repo inconsistencies and URL fixes Correct NV4x/NS50 to INCONCLUSIVE. Correct V540TU/V560TU protection reason. Correct 3 no-TPM boards to NOT_APPLICABLE. Align ESU dates with BOARDS_AND_TESTERS.md authoritative sources. Fix remaining broken/stale URLs. Add Dasharo/KGPE-D16/Talos II cross-references. RecoveryShell and Keys: add cross-references to heads source docs. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
tlaurion
changed the title
Thrilleratplay
suggested changes
Jul 27, 2026
Thrilleratplay
left a comment
Thrilleratplay
left a comment
Contributor
There was a problem hiding this comment.
I feel "read twice" is not enough of a safe guard to ensure a user has a valid backup.
Other than that, looks good to me.
| Trammell Hudson ported [mjg59's tpmtotp](https://mjg59.dreamwidth.org/35742.html) | ||
| to run from inside the boot ROM of a Thinkpad x230 using CoreBoot with a Linux | ||
| [Trammell Hudson](https://trmm.net/) ported [mjg59's tpmtotp](https://mjg59.dreamwidth.org/35742.html) | ||
| to run from inside the boot ROM of a Thinkpad x230 using [CoreBoot](https://doc.coreboot.org/) with a Linux |
Contributor
There was a problem hiding this comment.
Pedantic, but coreboot should be all lowercase.
|  | ||
|
|
||
| Find the chip and create a backup and verify it (For me the SPI flash chip is `YYY`): | ||
| Find the chip and read from it twice (For me the SPI flash chip is `YYY`): |
Contributor
There was a problem hiding this comment.
"read from it twice and verify they have matching checksums". I have had times where it took me a dozen times before I had matching checksums.
There are multiple instances of this.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Heads Threat Model — Per-Board Protection Table
SPI Programmer Best Practices
20 Board Flashing Guides
Identical structure: TOC, EOL status (cross-ref to BOARDS_AND_TESTERS.md), TPM GPIO protection status, Safety First, Disassembly, Flashing. 14 new pages, 6 retrofitted. All using [flasher]/[programmer] placeholders.
Cross-Repo Corrections
Heads PR: linuxboot/heads#2165