modules/tpm-gpio-reset: TPM GPIO reset audit and assertion tools

Adds tpm-gpio-detect (audit) and tpm-gpio-assert (execute) from
tlaurion/tpm-gpio-fail, based on Mate Kukri original PoC. Libpci
PCI access. PCR output before/after assertion. ASCII output.

Module depends on pciutils, tpm2-tools. Built when CONFIG_TPM2_TOOLS=y.

TESTED: NV4x ADL-P (0x5182) — PCRs cleared to zero, confirmed.
ALL OTHER PLATFORMS UNTESTED.

Docs: TPM GPIO vulnerability docs point to Heads Wiki threat model.
initrd: .bash_history entries for recovery shell testing.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>

Author: tlaurion

Makefile

@@ -750,6 +750,7 @@ bin_modules-$(CONFIG_NKSTORECLI) += nkstorecli
 bin_modules-$(CONFIG_UTIL_LINUX) += util-linux
 bin_modules-$(CONFIG_OPENSSL) += openssl
 bin_modules-$(CONFIG_TPM2_TOOLS) += tpm2-tools
+bin_modules-$(CONFIG_TPM2_TOOLS) += tpm-gpio-reset
 bin_modules-$(CONFIG_BASH) += bash
 bin_modules-$(CONFIG_POWERPC_UTILS) += powerpc-utils
 bin_modules-$(CONFIG_IO386) += io386

doc/BOARDS_AND_TESTERS.md

@@ -95,19 +95,15 @@ QSB-107 exposure rates.
 
 ## TPM GPIO Reset Vulnerability
 
-*For a detailed analysis including per-platform feasibility, attack steps,
-and upstream tracking, see [TPM_GPIO_Reset_Vulnerability.md](TPM_GPIO_Reset_Vulnerability.md).*
-
-Heads relies on coreboot to lock PCH GPIO pad configuration before booting
-the OS. On many Intel platforms, coreboot fails to set these lock bits.
-If pads are unlocked, post-coreboot code can reprogram the PLTRST# pin to
-GPIO mode and assert it, forcing a TPM Reset.
-
-Attack chain:
-1. Attacker asserts PLTRST# via GPIO, resetting the TPM to power-on state
-   (PCRs cleared to zero; NVRAM preserved).
-2. Attacker replays known PCR measurements (boot hashes are deterministic)
-   to reconstruct the sealed PCR state.
+Many Intel platforms are vulnerable to a TPM GPIO reset bypass
+([mkukri.xyz, 2024](https://mkukri.xyz/2024/06/01/tpm-gpio-fail.html)).
+See the [Heads Wiki Threat Model](https://github.com/linuxboot/heads-wiki/blob/master/About/Heads-threat-model.md)
+for per-platform status and mitigation. Test with:
+
+```bash
+tpm-gpio-detect 2>&1 | tee /media/tpm-gpio-detect.log
+tpm-gpio-assert 2>&1 | tee /media/tpm-gpio-assert.log
+```
 3. Since PCRs match sealed values, `tpm2 unseal` succeeds, extracting the
    TOTP/HOTP shared secret.