initrd, doc, boards: TPM GPIO reset vulnerability analysis, PoC tool, and board annotations

Makefile

@@ -750,6 +750,7 @@ bin_modules-$(CONFIG_NKSTORECLI) += nkstorecli
 bin_modules-$(CONFIG_UTIL_LINUX) += util-linux
 bin_modules-$(CONFIG_OPENSSL) += openssl
 bin_modules-$(CONFIG_TPM2_TOOLS) += tpm2-tools
+bin_modules-$(CONFIG_TPM2_TOOLS) += tpm-gpio-reset
 bin_modules-$(CONFIG_BASH) += bash
 bin_modules-$(CONFIG_POWERPC_UTILS) += powerpc-utils
 bin_modules-$(CONFIG_IO386) += io386

blobs/m900/README.md

@@ -39,7 +39,7 @@ Sha256sums: `blobs/m900/hashes.txt`
 
 # CAVEATS for the board:
 
-> This board is vulnerable to a TPM reset attack, i.e. the PCRs are reset while the system is running.
+> This board is vulnerable to a TPM GPIO reset attack, i.e. the PCRs are reset while the system is running.
 > This attack can be used to bypass measured boot when an attacker succeeds at modifying the SPI flash.
 > Also it can be used to extract FDE keys from a TPM.
 > The related coreboot issue contains more information: https://ticket.coreboot.org/issues/576

blobs/xx80/README.md

@@ -42,7 +42,7 @@ Sha256sums: `blobs/xx80/hashes.txt`
 
 See the board configs `boards/t480-[hotp-]maximized/t480-[hotp-]maximized.config`:
 
-> This board is vulnerable to a TPM reset attack, i.e. the PCRs are reset while the system is running.
+> This board is vulnerable to a TPM GPIO reset attack, i.e. the PCRs are reset while the system is running.
 > This attack can be used to bypass measured boot when an attacker succeeds at modifying the SPI flash.
 > Also it can be used to extract FDE keys from a TPM.
 > The related coreboot issue contains more information: https://ticket.coreboot.org/issues/576

boards/EOL_UNTESTED_t530-hotp-maximized/EOL_UNTESTED_t530-hotp-maximized.config

@@ -1,4 +1,7 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
+#
+# CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- dedicated PLTRST# pin, not shared with GPIO
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 # Configuration for a T530 running Qubes and other Linux Based OSes (through kexec)
 #
 # Includes 

boards/EOL_UNTESTED_t530-maximized/EOL_UNTESTED_t530-maximized.config

@@ -1,4 +1,7 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
+#
+# CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- dedicated PLTRST# pin, not shared with GPIO
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 # Configuration for a T530 running Qubes and other Linux Based OSes (through kexec)
 #
 # Includes 

boards/EOL_librem_13v2/EOL_librem_13v2.config

@@ -1,6 +1,8 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
 # Configuration for a librem_13v2
 CONFIG_LINUX_CONFIG=config/linux-librem_common-6.1.8.config
+# CAVEATS: TPM_GPIO_RESET=VULNERABLE -- TOTP/HOTP secret extractable, DUK with passphrase safe
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 CONFIG_COREBOOT_CONFIG=config/coreboot-librem_13v2.config
 
 export CONFIG_COREBOOT=y

boards/EOL_librem_13v4/EOL_librem_13v4.config

@@ -1,6 +1,8 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
 # Configuration for a librem_13v4
 CONFIG_LINUX_CONFIG=config/linux-librem_common-6.1.8.config
+# CAVEATS: TPM_GPIO_RESET=VULNERABLE -- TOTP/HOTP secret extractable, DUK with passphrase safe
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 CONFIG_COREBOOT_CONFIG=config/coreboot-librem_13v4.config
 
 export CONFIG_COREBOOT=y

boards/EOL_librem_15v3/EOL_librem_15v3.config

@@ -1,6 +1,8 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
 # Configuration for a librem_15v3
 CONFIG_LINUX_CONFIG=config/linux-librem_common-6.1.8.config
+# CAVEATS: TPM_GPIO_RESET=VULNERABLE -- TOTP/HOTP secret extractable, DUK with passphrase safe
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 CONFIG_COREBOOT_CONFIG=config/coreboot-librem_15v3.config
 
 export CONFIG_COREBOOT=y

boards/EOL_librem_15v4/EOL_librem_15v4.config

@@ -1,6 +1,8 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
 # Configuration for a librem_15v4
 CONFIG_LINUX_CONFIG=config/linux-librem_common-6.1.8.config
+# CAVEATS: TPM_GPIO_RESET=VULNERABLE -- TOTP/HOTP secret extractable, DUK with passphrase safe
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 CONFIG_COREBOOT_CONFIG=config/coreboot-librem_15v4.config
 
 export CONFIG_COREBOOT=y

boards/EOL_librem_l1um/EOL_librem_l1um.config

@@ -1,4 +1,7 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
+#
+# CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- dedicated PLTRST# pin, not shared with GPIO
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 # Configuration for a librem_l1um
 CONFIG_LINUX_CONFIG=config/linux-librem_common.config
 CONFIG_COREBOOT_CONFIG=config/coreboot-librem_l1um.config

boards/EOL_m900_tower-hotp-maximized/EOL_m900_tower-hotp-maximized.config

@@ -18,13 +18,8 @@
 # - PSU: 250W (85% efficiency) or optional 400W (92%)
 # - Form factor: Mini Tower (25L), 175 x 413 x 406 mm, ~12.5 kg
 #
-# CAVEATS:
-# This board is vulnerable to a TPM reset attack, i.e. the PCRs are reset while the system is running.
-# This attack can be used to bypass measured boot when an attacker succeeds at modifying the SPI flash.
-# Also it can be used to extract FDE keys from a TPM.
-# The related coreboot issue contains more information: https://ticket.coreboot.org/issues/576
-# Make sure you understand the implications of the attack for your threat model before using this board.
-# Includes
+# CAVEATS: TPM_GPIO_RESET=VULNERABLE -- TOTP/HOTP secret extractable, DUK with passphrase safe
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 # - Deactivated+partially neutered+deguarded ME and expanded consequent IFD BIOS regions
 # - More details can be found in the script under blobs/m900/m900_download_clean_deguard_me.sh
 # - Forged GBE MAC address to 00:DE:AD:C0:FF:EE

boards/EOL_m900_tower-maximized/EOL_m900_tower-maximized.config

@@ -18,13 +18,8 @@
 # - PSU: 250W (85% efficiency) or optional 400W (92%)
 # - Form factor: Mini Tower (25L), 175 x 413 x 406 mm, ~12.5 kg
 #
-# CAVEATS:
-# This board is vulnerable to a TPM reset attack, i.e. the PCRs are reset while the system is running.
-# This attack can be used to bypass measured boot when an attacker succeeds at modifying the SPI flash.
-# Also it can be used to extract FDE keys from a TPM.
-# The related coreboot issue contains more information: https://ticket.coreboot.org/issues/576
-# Make sure you understand the implications of the attack for your threat model before using this board.
-# Includes
+# CAVEATS: TPM_GPIO_RESET=VULNERABLE -- TOTP/HOTP secret extractable, DUK with passphrase safe
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 # - Deactivated+partially neutered+deguarded ME and expanded consequent IFD BIOS regions
 # - More details can be found in the script under blobs/m900/m900_download_clean_deguard_me.sh
 # - Forged GBE MAC address to 00:DE:AD:C0:FF:EE

boards/EOL_optiplex-7010_9010-hotp-maximized/EOL_optiplex-7010_9010-hotp-maximized.config

@@ -1,4 +1,7 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
+#
+# CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- dedicated PLTRST# pin, not shared with GPIO
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 # Configuration for a Optiplex 7010/9010 SFF running Qubes 4.1 and other Linux Based OSes (through kexec)
 #
 # Includes 

boards/EOL_optiplex-7010_9010-maximized/EOL_optiplex-7010_9010-maximized.config

@@ -1,4 +1,7 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
+#
+# CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- dedicated PLTRST# pin, not shared with GPIO
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 # Configuration for a Optiplex 7010/9010 SFF running Qubes 4.1 and other Linux Based OSes (through kexec)
 #
 # Includes 

boards/EOL_optiplex-7010_9010_TXT-hotp-maximized/EOL_optiplex-7010_9010_TXT-hotp-maximized.config

@@ -1,4 +1,7 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
+#
+# CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- dedicated PLTRST# pin, not shared with GPIO
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 # Configuration for a Optiplex 7010/9010 SFF running Qubes 4.1 and other Linux Based OSes (through kexec)
 #
 # Includes 

boards/EOL_optiplex-7010_9010_TXT-maximized/EOL_optiplex-7010_9010_TXT-maximized.config

@@ -1,4 +1,7 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
+#
+# CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- dedicated PLTRST# pin, not shared with GPIO
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 # Configuration for a Optiplex 7010/9010 SFF running Qubes 4.1 and other Linux Based OSes (through kexec)
 #
 # Includes 

boards/EOL_t420-hotp-maximized/EOL_t420-hotp-maximized.config

@@ -1,4 +1,7 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
+#
+# CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- dedicated PLTRST# pin, not shared with GPIO
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 # Configuration for a T420 running Qubes 4.1 and other Linux Based OSes (through kexec)
 #
 # Includes

boards/EOL_t420-maximized/EOL_t420-maximized.config

@@ -1,4 +1,7 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
+#
+# CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- dedicated PLTRST# pin, not shared with GPIO
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 # Configuration for a T420 running Qubes 4.1 and other Linux Based OSes (through kexec)
 #
 # Includes

boards/EOL_t430-hotp-maximized/EOL_t430-hotp-maximized.config

@@ -1,4 +1,7 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
+#
+# CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- dedicated PLTRST# pin, not shared with GPIO
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 # Configuration for a T430 running Qubes 4.1 and other Linux Based OSes (through kexec)
 #
 # Includes 

boards/EOL_t430-maximized/EOL_t430-maximized.config

@@ -1,4 +1,7 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
+#
+# CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- dedicated PLTRST# pin, not shared with GPIO
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 # Configuration for a T430 running Qubes 4.1 and other Linux Based OSes (through kexec)
 #
 # Includes 

boards/EOL_t440p-hotp-maximized/EOL_t440p-hotp-maximized.config

@@ -1,4 +1,7 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
+#
+# CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- dedicated PLTRST# pin, not shared with GPIO
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 # Configuration for a ThinkPad T440p with HOTP Security dongle support
 CONFIG_COREBOOT_CONFIG=config/coreboot-t440p.config
 # TODO: Make a ThinkPad-common Linux config file.

boards/EOL_t440p-maximized/EOL_t440p-maximized.config

@@ -1,4 +1,7 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
+#
+# CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- dedicated PLTRST# pin, not shared with GPIO
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 # Configuration for a ThinkPad T440p without HOTP Security dongle support
 CONFIG_COREBOOT_CONFIG=config/coreboot-t440p.config
 # TODO: Make a ThinkPad-common Linux config file.

boards/EOL_t480-hotp-maximized/EOL_t480-hotp-maximized.config

@@ -1,14 +1,8 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
 # Configuration for a T480 running Qubes 4.2.3 and other Linux Based OSes (through kexec)
 #
-# CAVEATS:
-# This board is vulnerable to a TPM reset attack, i.e. the PCRs are reset while the system is running.
-# This attack can be used to bypass measured boot when an attacker succeeds at modifying the SPI flash.
-# Also it can be used to extract FDE keys from a TPM.
-# The related coreboot issue contains more information: https://ticket.coreboot.org/issues/576
-# Make sure you understand the implications of the attack for your threat model before using this board.
-#
-# Includes
+# CAVEATS: TPM_GPIO_RESET=VULNERABLE -- TOTP/HOTP secret extractable, DUK with passphrase safe
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 # - Deactivated+partially neutered+deguarded ME and expanded consequent IFD BIOS regions
 #   - More details can be found in the script under blobs/xx80/download_clean_deguard_me_pad_tb.sh
 # - Forged GBE MAC address to 00:DE:AD:C0:FF:EE MAC address (if not extracting gbe.bin from backup with blobs/xx80/extract.sh)

boards/EOL_t480-maximized/EOL_t480-maximized.config

@@ -1,14 +1,8 @@
 # WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
 # Configuration for a T480 running Qubes 4.2.3 and other Linux Based OSes (through kexec)
 #
-# CAVEATS:
-# This board is vulnerable to a TPM reset attack, i.e. the PCRs are reset while the system is running.
-# This attack can be used to bypass measured boot when an attacker succeeds at modifying the SPI flash.
-# Also it can be used to extract FDE keys from a TPM.
-# The related coreboot issue contains more information: https://ticket.coreboot.org/issues/576
-# Make sure you understand the implications of the attack for your threat model before using this board.
-#
-# Includes
+# CAVEATS: TPM_GPIO_RESET=VULNERABLE -- TOTP/HOTP secret extractable, DUK with passphrase safe
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
 # - Deactivated+partially neutered+deguarded ME and expanded consequent IFD BIOS regions
 #   - More details can be found in the script under blobs/xx80/download_clean_deguard_me_pad_tb.sh
 # - Forged GBE MAC address to 00:DE:AD:C0:FF:EE MAC address (if not extracting gbe.bin from backup with blobs/xx80/extract.sh)