[qubes-users] NitroPad T430 passes hardware certification for Qubes 4.0!

Mailing Lists qubes-users
1

Dear Qubes Community,

It is our pleasure to announce that the NitroPad T430 [01] has become
the third Qubes-certified Laptop [02] for Qubes 4.0! This makes Nitrokey
[03] the first vendor to have *two* products that pass Qubes hardware
certification, the other being the NitroPad X230 [04].

## What is Qubes Certified Hardware?

Qubes Certified Hardware [05] is hardware that has been certified by the
Qubes developers as compatible with Qubes OS. Beginning with Qubes 4.0,
in order to achieve certification, the hardware must satisfy a rigorous
set of requirements [06], and the vendor must commit to offering
customers the very same configuration (same motherboard, same screen,
same BIOS version, same Wi-Fi module, etc.) for at least one year.

Qubes-certified Laptops [02], in particular, are regularly tested by the
Qubes developers to ensure compatibility with all of Qubes' features.
The developers test all new major versions and updates to ensure that no
regressions are introduced.

It is important to note, however, that Qubes Hardware Certification
certifies only that a particular hardware *configuration* is *supported*
by Qubes. The Qubes OS Project takes no responsibility for any vendor's
manufacturing, shipping, payment, or other practices, nor can we control
whether physical hardware is modified (whether maliciously or otherwise)
*en route* to the user. (However, see below for information about how
this risk is mitigated.)

## About the NitroPad T430

Key features of the NitroPad T430 [01] include:

   - Tamper detection through measured boot with Coreboot [07], Heads
     [08], and Nitrokey USB hardware, including support for Anti Evil
     Maid (AEM) [09]

   - Deactivated Intel Management Engine [10]

   - User-replaceable cryptographic keys

   - Included Nitrokey USB key

   - Professional ThinkPad hardware based on the ThinkPad T430 [11]

   - Security-conscious shipping to mitigate against third-party
     interdiction [12]

For further details, please see the NitroPad T430 [01] product page.

## How to get one

Please see the NitroPad T430 [01] on the Nitrokey website [03] for
purchasing information.

[01] NitroPad T430 | www.nitrokey.com
[02] Certified Hardware | Qubes OS
[03] https://www.nitrokey.com/
[04] Certified Hardware | Qubes OS
[05] Certified Hardware | Qubes OS
[06] Certified Hardware | Qubes OS
[07] https://www.coreboot.org/
[08] GitHub - osresearch/heads: A minimal Linux that runs as a coreboot or LinuxBoot ROM payload to provide a secure, flexible boot environment for laptops and servers.
[09] Anti Evil Maid (AEM) | Qubes OS
[10] Libreboot – Frequently Asked Questions
[11] Category:T430 - ThinkWiki
[12] Interdiction - Wikipedia

This announcement is also available on the Qubes website:

1 Like
2

UPDATE: Please be advised that the i7-3632QM option is *not* compatible with Qubes OS, as it does not support VT-d. The option specifically tested by the Qubes team is the i5-3320M.

3

Are you sure? Intel tells that i7-3632QM supports VT-d: https://ark.intel.com/content/www/us/en/ark/products/71670/intel-core-i73632qm-processor-6m-cache-up-to-3-20-ghz-bga.html

4

Are you sure? Intel tells that i7-3632QM supports VT-d

5

Many thanks Simon,
I do not have a T430, I have a W520 with coreboot, but the problem is just the same. I was wondering why VT-d is not working and your email explained it. So many thanks.
Now I suppose I should buy some other Ivy Bridge CPU that fully supports virtualization. But if Intel gave the same name to CPUs having different features I am very afraid to go wrong again. May you please give me some hints to find a compatible CPU?
Best
Franz

6

Sure -

On the intel ark pages, just check the ‘package size’ section and make sure that its rPGA988. Make sure the cpu has VT-d.

I havent done any work on the w520 so I cant really advise on which would be the best CPU. On the t430 I run 3740QM but this requires changing the heatsink as the CPU is 45w TDP where the original CPU was 35w TDP. Sven runs the 3840QM on his laptop. Both CPUs are the top end of what you can get with both VTd and staying at 45w TDP for heat.

This page https://forums.lenovo.com/t5/ThinkPad-P-and-W-Series-Mobile/w520-cpu-upgrade/m-p/1559926 over at lenovo forums seems to imply that some fan assemblies for the w520 can handle 55wTDP (they have part numbers on the page too). This means that the best performing CPU you could use with Qubes in the w520 is i7 3940XM but its going to throw out some heat when its under load. Its a small gain over the 3840QM, so if burning your legs is a concern then maybe just go for the 3740/3840 … just make sure your existing fan assembly can handle 45w TDP (or 55w TDP if you chose 3940).

7

Love you Simon, many thanks