initrd, doc, boards: TPM GPIO reset vulnerability analysis, PoC tool, and board annotations - #2165
Open
tlaurion wants to merge 5 commits into
Open
initrd, doc, boards: TPM GPIO reset vulnerability analysis, PoC tool, and board annotations#2165tlaurion wants to merge 5 commits into
tlaurion wants to merge 5 commits into
Conversation
This comment was marked as duplicate.
This comment was marked as duplicate.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
tlaurion
force-pushed
the
doc/tpm-gpio-vuln
branch
17 times, most recently
from
July 24, 2026 17:50
b3e7502 to
a2d99a3
Compare
13 tasks
tlaurion
force-pushed
the
doc/tpm-gpio-vuln
branch
3 times, most recently
from
July 24, 2026 18:39
f5c6544 to
4aa3965
Compare
tlaurion
force-pushed
the
doc/tpm-gpio-vuln
branch
2 times, most recently
from
July 24, 2026 18:45
b7b3da1 to
ba642c6
Compare
…tion PoC Bash script with --audit and --execute modes. Detects PCH/SoC via PCI device ID, reads DW0, PADCFGLOCK, and PADCFGLOCKTX from /dev/mem. Reports 3-tier vulnerability classification (confirmed, unconfirmed, uncertain). Performs GPIO assertion, deassert, and tpm2 startup, distinguishing bus reset from software TPM2_Startup clearing via sysfs pcrs presence. Includes bus pin lock checking (kukri detect parity), eSPI vs LPC auto-detection, and platform support for SPT/KBP, CNP-LP, CFL-S, CML-U, CML-DT, TGL, ADL-P, ADL-S, RPL-S, ARL-S, MTL, and pre-Skylake. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
TPM_GPIO_Reset_Vulnerability.md — per-platform feasibility table. Pre-Skylake: not vulnerable (dedicated PLTRST# pin, architecture documentation — no hardware verification). SPT/KBP (T480, M900): vulnerable per kukri. CNP-LP (T480s): unconfirmed. ADL-P 0x5182 (NV4x, NS50): inconclusive — writes verify via /dev/mem readback, PCRs non-zero after toggle, kernel TPM driver detects no bus reset. ADL-S/RPL-S (MSI Z690/Z790): vulnerable per kukri. MTL (V540TU/ V560TU): not vulnerable (eSPI TPM, SLB 9672). PCR0 analysis per TCG PC Client TIS spec: no protection against TPM GPIO reset. TPM_GPIO_Reset_Approaches.md — 8 approaches on NV4x ADL-P. Platform register maps for SPT/KBP, CNP-LP, CFL-S, CML-U, CML-DT, TGL, ADL-P, ADL-S, RPL-S, ARL-S, MTL. Star Labs PchUnlockGpioPads fix and coreboot patch series status. Intel doc 834810 (public) cross-referenced for PADCFGLOCK/PADCFGLOCKTX documentation. doc/BOARDS_AND_TESTERS.md — per-generation EOL/ESU dates, TPM GPIO reset status, QSB-107 EOL_ prefix convention, M900 Tower owner. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Add '# CAVEATS: TPM_GPIO_RESET=' comment to 50 hardware board configs. NOT_VULNERABLE for Pre-Skylake (dedicated PLTRST# pin) and Talos II (POWER9). VULNERABLE for Skylake through Comet Lake. VULNERABILITY UNCERTAIN for ADL-P 0x5182 (NV4x, NS50 — writes verify, PLTRST# not confirmed on this die). NOT_APPLICABLE for Librem 11, Mini v1, Mini v2 (CONFIG_NO_TPM=y, no TPM hardware). NOT_VULNERABLE for MTL v540tu/v560tu (eSPI TPM, SLB 9672). blobs: update TPM reset attack references in m900 and xx80 READMEs. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
tlaurion
force-pushed
the
doc/tpm-gpio-vuln
branch
from
July 24, 2026 18:45
ba642c6 to
d16719c
Compare
Collaborator
Author
modules/tpm-gpio-reset: update commit hash to 89ea206835e7 which includes fix for PAD_CFG_BASE and pad_stride on SPT/KBP/CML-DT initrd/bin/tpm-gpio-reset: fix exec detect to forward so --assert/--execute flags reach the C binary; add full help text documenting all supported flags and platform families Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Module builds kukrimate/tpm-gpio-fail (tlaurion fork, commit 660d745) with extended platform support for 13 Intel PCH families plus pre-Skylake and POWER9. MMCFG-based PCI access via /dev/mem (zero-library, MUSL dynamic linking via heads_cc CC). initrd/bin/tpm-gpio-reset: thin wrapper calling 'detect' binary. Makefile: bin_modules- entry for initrd inclusion. Non-breaking: CONFIG_TPM2_TOOLS-gated. No impact on existing board builds including t420-hotp-maximized and x220-hotp-maximized CircleCI targets. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
tlaurion
force-pushed
the
doc/tpm-gpio-vuln
branch
from
July 26, 2026 22:15
aba3d96 to
857ced4
Compare
|
|
||
| # Summary | ||
| DEBUG "" | ||
| if [ -s "$_totp_secret" ]; then |
Contributor
There was a problem hiding this comment.
Shouldn't this be checking for $_hotp_secret as well?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
initrd/bin/tpm-gpio-reset-demo.sh
doc/TPM_GPIO_Reset_Vulnerability.md
doc/TPM_GPIO_Reset_Approaches.md
doc/BOARDS_AND_TESTERS.md
boards/
Related