Heads-threat-model: per-board GPIO TPM reset protection table; uniformise 20 board flashing guide pages by tlaurion · Pull Request #221 · linuxboot/heads-wiki

tlaurion · 2026-07-21T01:41:54Z

Heads Threat Model — Per-Board Protection Table

Per-board protection status for all 20 boards with chipset generation, EOL/ESU dates, GPIO TPM reset protection
KBL-R vs Whiskey Lake comparison, QSB-107 context, Intel doc 834810 reference
Mitigation on EOL platforms with Tails/Qubes memory OPSEC guidance
New external references: coreboot docs (doc.coreboot.org), EFF Threat Modeling Handout, OST2 firmware security training (ost2.fyi), darkmentor.com firmware security timeline, SPI programmer selection guide
Preview: https://tlaurion.github.io/heads-wiki/Heads-threat-model/

SPI Programmer Best Practices

Reworked for clarity with Tool Interchangeability section explaining [flasher] and [programmer] placeholders
Preview: https://tlaurion.github.io/heads-wiki/SPI-Programmer-Best-Practices/

20 Board Flashing Guides

Identical structure: TOC, EOL status (cross-ref to BOARDS_AND_TESTERS.md), TPM GPIO protection status, Safety First, Disassembly, Flashing. 14 new pages, 6 retrofitted. All using [flasher]/[programmer] placeholders.

Cross-Repo Corrections

3 no-TPM boards corrected to NOT_APPLICABLE (Librem 11, Mini v1, Mini v2)
NV4x/NS50 reclassified to INCONCLUSIVE (unconfirmed)
V540TU/V560TU protection reason corrected
ESU dates aligned with authoritative sources
CONFIG_LINUX_CONFIG regression fixed on all Librem boards

Heads PR: linuxboot/heads#2165

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

nic3-14159 · 2026-07-21T02:19:34Z

+## TPM GPIO Reset Vulnerability (upstream coreboot bug)

-[T430 Hardware Maintenance Manual](https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/t430_t430i_hmm_en_0b48304_04.pdf)  
+Heads relies on [coreboot](https://coreboot.org/) for low-level platform initialization, including GPIO pad configuration. This platform (Ivy Bridge / Intel 3rd Gen) is affected by a coreboot bug where the PCH GPIO lock bits are not set before booting the OS, allowing an attacker with code execution to reset the discrete TPM and forge PCR measurements. Details: [TPM GPIO fail (mkukri.xyz)](https://mkukri.xyz/2024/06/01/tpm-gpio-fail.html).


Not true on this platform. The PLTRST signal connected to the TPM reset line is a dedicated pin on the older PCHs, so they can't be reset by changing it to a GPIO and manually toggling it.

nic3-14159 · 2026-07-21T02:21:39Z

-**Note**: See the [SPI Programmer Best Practices]({{ site.baseurl }}/SPI-Programmer-Best-Practices/) for programmer recommendations (Tigard recommended; CH347F preferred budget option; CH341A rev1.6+ acceptable with a physical selector).
+## TPM GPIO Reset Vulnerability (upstream coreboot bug)
+
+Heads relies on [coreboot](https://coreboot.org/) for low-level platform initialization, including GPIO pad configuration. This platform (Sandy Bridge / Intel 2nd Gen) is affected by a coreboot bug where the PCH GPIO lock bits are not set before booting the OS, allowing an attacker with code execution to reset the discrete TPM and forge PCR measurements. Details: [TPM GPIO fail (mkukri.xyz)](https://mkukri.xyz/2024/06/01/tpm-gpio-fail.html).


PLTRST is a dedicated pin on the older PCHs, and cannot be changed to a GPIO and manually toggled which is what TPM GPIO fail is.

nic3-14159 · 2026-07-21T02:22:03Z


+## TPM GPIO Reset Vulnerability (upstream coreboot bug)
+
+Heads relies on [coreboot](https://coreboot.org/) for low-level platform initialization, including GPIO pad configuration. This platform (Ivy Bridge / Intel 3rd Gen) is affected by a coreboot bug where the PCH GPIO lock bits are not set before booting the OS, allowing an attacker with code execution to reset the discrete TPM and forge PCR measurements. Details: [TPM GPIO fail (mkukri.xyz)](https://mkukri.xyz/2024/06/01/tpm-gpio-fail.html).


…uides - T480-maximized, T480s-maximized: add vulnerability section with per-generation GPIO lock status table, Heads impact breakdown, and upstream tracking links - T420-maximized (Sandy Bridge), T430-maximized (Ivy Bridge), x230-maximized (Ivy Bridge): mark as not affected — PLTRST# pin on pre-Skylake PCHs is a dedicated reset signal that cannot be reprogrammed to GPIO mode; coreboot GPIO driver analysis confirms no attack vector on these platforms - Heads-threat-model: expand TPMTOTP GPIO reset note with detailed attack description: PCR clearing preserves NVRAM, attacker replays measurement log extends to forge PCR values, enabling unseal of TOTP/HOTP secret at NVRAM index 0x4d47 without passphrase All platform claims verified against coreboot 25.09 and 26.06 source. Upstream: coreboot ticket #576, Gerrit topic intel_gpio_lock Signed-off-by: Thierry Laurion <insurgo@riseup.net>

- "reprogram the TPM reset pin" -> "assert PLTRST# via PCH register" - /tmp/measurements -> /tmp/measuring_trace.log - Tone down certainty about attacker obtaining secrets Signed-off-by: Thierry Laurion <insurgo@riseup.net>

- Replace verbose TPM GPIO note with concise cross-reference to new table - Add 12-row per-board table covering all boards from BOARDS_AND_TESTERS.md - Three attack columns: Evil Maid detection, Disk encryption, USB Dongle - Clear y/n symbols per PeonyThePeon issue #2159 comment #17 request Signed-off-by: Thierry Laurion <insurgo@riseup.net>

tlaurion · 2026-07-24T21:06:49Z

Superseded by new PR from tlaurion/heads-wiki (correct fork) at #224

Copilot AI review requested due to automatic review settings July 21, 2026 01:41

Copilot AI reviewed Jul 21, 2026

nic3-14159 reviewed Jul 21, 2026

View reviewed changes

tlaurion marked this pull request as draft July 21, 2026 15:52

tlaurion force-pushed the doc/tpm-gpio-vuln branch 2 times, most recently from b79ff6d to 8dc218e Compare July 22, 2026 00:54

This comment was marked as duplicate.

Sign in to view

tlaurion added 3 commits July 21, 2026 21:32

doc: fix mechanism descriptions and log filename

4e97860

- "reprogram the TPM reset pin" -> "assert PLTRST# via PCH register" - /tmp/measurements -> /tmp/measuring_trace.log - Tone down certainty about attacker obtaining secrets Signed-off-by: Thierry Laurion <insurgo@riseup.net>

tlaurion force-pushed the doc/tpm-gpio-vuln branch from 565aef7 to 059a51d Compare July 22, 2026 01:33

tlaurion mentioned this pull request Jul 22, 2026

GPIO locking is broken on Kaby Lake and possibly other platforms linuxboot/heads#2159

Closed

tlaurion requested review from JonathonHall-Purism and nic3-14159 and removed request for nic3-14159 July 22, 2026 01:36

tlaurion marked this pull request as ready for review July 22, 2026 01:54

This was referenced Jul 22, 2026

doc: document TPM GPIO reset vulnerability and per-board lock status linuxboot/heads#2161

Closed

modules/tpm-gpio-reset: TPM GPIO reset audit and assertion tools linuxboot/heads#2165

Merged

tlaurion changed the title ~~doc: add TPM GPIO reset vulnerability warning to all board flashing guides~~ Flashing-Guides: uniformise all 20 board pages with TPM GPIO reset warnings and consistent structure Jul 23, 2026

tlaurion changed the title ~~Flashing-Guides: uniformise all 20 board pages with TPM GPIO reset warnings and consistent structure~~ Heads-threat-model: per-board GPIO TPM reset protection table; uniformise 20 board flashing guide pages Jul 23, 2026

tlaurion linked an issue Jul 23, 2026 that may be closed by this pull request

GPIO locking is broken on Kaby Lake and possibly other platforms linuxboot/heads#2159

Closed

tlaurion mentioned this pull request Jul 24, 2026

boards: Add Star Labs Heads targets linuxboot/heads#2164

Open

13 tasks

tlaurion closed this Jul 24, 2026

tlaurion deleted the doc/tpm-gpio-vuln branch July 24, 2026 21:06

tlaurion removed a link to an issue Jul 24, 2026

GPIO locking is broken on Kaby Lake and possibly other platforms linuxboot/heads#2159

Closed

Navigation Menu

Uh oh!

Uh oh!

Heads-threat-model: per-board GPIO TPM reset protection table; uniformise 20 board flashing guide pages - #221

Heads-threat-model: per-board GPIO TPM reset protection table; uniformise 20 board flashing guide pages#221
tlaurion wants to merge 3 commits into
masterfrom
doc/tpm-gpio-vuln

tlaurion commented Jul 21, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

nic3-14159 Jul 21, 2026

Uh oh!

nic3-14159 Jul 21, 2026

Uh oh!

nic3-14159 Jul 21, 2026

Uh oh!

This comment was marked as duplicate.

tlaurion commented Jul 24, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		## TPM GPIO Reset Vulnerability (upstream coreboot bug)

		Heads relies on [coreboot](https://coreboot.org/) for low-level platform initialization, including GPIO pad configuration. This platform (Ivy Bridge / Intel 3rd Gen) is affected by a coreboot bug where the PCH GPIO lock bits are not set before booting the OS, allowing an attacker with code execution to reset the discrete TPM and forge PCR measurements. Details: [TPM GPIO fail (mkukri.xyz)](https://mkukri.xyz/2024/06/01/tpm-gpio-fail.html).

Uh oh!

Uh oh!

Conversation

tlaurion commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Heads Threat Model — Per-Board Protection Table

SPI Programmer Best Practices

20 Board Flashing Guides

Cross-Repo Corrections

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

nic3-14159 Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

nic3-14159 Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

nic3-14159 Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

This comment was marked as duplicate.

tlaurion commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tlaurion commented Jul 21, 2026 •

edited

Loading

tlaurion commented Jul 24, 2026 •

edited

Loading