doc: document TPM GPIO reset vulnerability and per-board lock status#2161
Closed
tlaurion wants to merge 3 commits into
Closed
doc: document TPM GPIO reset vulnerability and per-board lock status#2161tlaurion wants to merge 3 commits into
tlaurion wants to merge 3 commits into
Conversation
nic3-14159
reviewed
Jul 21, 2026
nic3-14159
reviewed
Jul 21, 2026
tlaurion
marked this pull request as draft
July 21, 2026 15:51
tlaurion
force-pushed
the
doc/tpm-gpio-vuln
branch
from
July 21, 2026 23:10
cd06dae to
bb767f2
Compare
tlaurion
force-pushed
the
doc/tpm-gpio-vuln
branch
3 times, most recently
from
July 22, 2026 01:14
7b7c758 to
2a2f021
Compare
tlaurion
requested review from
JonathonHall-Purism
and removed request for
nic3-14159
July 22, 2026 01:37
tlaurion
marked this pull request as ready for review
July 22, 2026 01:54
tlaurion
force-pushed
the
doc/tpm-gpio-vuln
branch
3 times, most recently
from
July 23, 2026 00:29
65daed3 to
bf8f0b3
Compare
…platform audit BusyBox shell script demonstrating TPM GPIO line assertion to trigger PLTRST# on non-PCH/CMP platforms. Tests tpm2 shutdown, GPIO assert via devmem (write bit to DW0), and tpm2 startup with sysfs PCR verification. Platform audit mode detects PCH/SoC type, GPIO DW0 register locking (PADCFGLOCK/PADCFGLOCKTX), chipset locked status, and mode switch attempt (write 0x80000000 to DW0 mode bits [12:10]). Logs all register reads, writes, and lock register dumps for off-platform analysis. Usage: tpm-gpio-reset-demo.sh [--audit | --full] --audit: probe platform, dump GPIO pin states and lock registers --full: run shutdown -> assert -> startup cycle with verification (no flag): interactive menu for all operations Signed-off-by: Thierry Laurion <insurgo@riseup.net>
…per-platform feasibility TPM_GPIO_Reset_Vulnerability.md — threat model, attack description, and per-platform feasibility table (Pre-Skylake: dedicated PLTRST# pin, Skylake-Tiger Lake: PCH multiplexing with locked pads, ADL-P/ADL-N: hardware-locked mode bits, AMD/POWER8: no Intel PCH). Board-specific CONFIG_TPM_GPIO_VULNERABLE flag rationale documented per chipset family. TPM_GPIO_Reset_Approaches.md — 8 approaches attempted on ADL-P NV4x: GPIO DW0 pin configuration probing, gpiochip sysfs toggling, ACPI pin-capability discovery (GpioInt/GpioIo/GpioIo+I2c), INTEL1 virtual GPIO events, PCH SRAM-based MMIO region scanning, pmc_ipc commands (Clean-Halt-Reset/GPE/globalstate_set), itco_wdt watchdog-triggered reset, and SUSWARN#/SUSACK# protocol analysis. All blocked by hardware locking on ADL-P. Conclusions and open questions for physical scope probing noted. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
tlaurion
force-pushed
the
doc/tpm-gpio-vuln
branch
3 times, most recently
from
July 23, 2026 03:08
028fe99 to
48c6511
Compare
Per-board CONFIG_TPM_GPIO_VULNERABLE flag set based on chipset generation: - Pre-Skylake (6th gen and earlier): VULNERABLE (dedicated PLTRST# pin) - Skylake through Tiger Lake: NOT VULNERABLE (PCH multiplexing, locked) - Alder Lake (ADL-P/ADL-N): NOT VULNERABLE (hardware-locked mode bits) - AMD/POWER8: NOT VULNERABLE (no Intel PCH) DOC/BOARDS_AND_TESTERS.md updated with EOL/ESU dates per generation, vulnerable boards listed with their PC/Alpine Ridge Thunderbolt controller. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
tlaurion
force-pushed
the
doc/tpm-gpio-vuln
branch
from
July 23, 2026 03:12
48c6511 to
8fdc061
Compare
Collaborator
Author
|
Superseded by PR #2165 from tlaurion/heads (correct fork). This PR will be closed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Documents the TPM GPIO reset vulnerability disclosed by Mate Kukri (June 2024), which allows an attacker with OS-level code execution to reset the discrete TPM and forge PCR measurements on Intel platforms where coreboot does not lock the PCH GPIO pad configuration.
3 commits, 56 files changed (+2497/-67).
Changes
New:
doc/TPM_GPIO_Reset_Vulnerability.mdComprehensive reference document covering:
New:
doc/TPM_GPIO_Reset_Approaches.mdAnalysis of 8 distinct mitigation approaches, ranked by viability:
Per-platform feasibility matrix for every Intel SoC generation supported by Heads (Sandy Bridge through Meteor Lake).
New:
initrd/bin/tpm-gpio-reset-demo.shRuntime PoC script that:
/sys/class/dmi/id/board_namedid not successfully replicate on nv4x_adl which is only platform code suggest vulnerable So help needed to validate this. Coreboot fixes must come from upstream.
Modified:
doc/BOARDS_AND_TESTERS.mdAdded "TPM GPIO Reset Vulnerability" section with per-board table mapping every Heads board to its GPIO lock status, with notes on Purism and Dasharo coreboot forks.
Modified: 49 board configs
Added
CONFIG_TPM_GPIO_RESET_STATUScomment block to all board configs documenting the platform's GPIO lock vulnerability status (VULNERABLE / PROTECTED / NOT APPLICABLE).Related