Attention is currently required from: Nico Huber, Angel Pons.
Angel Pons uploaded patch set #9 to the change originally created by Patrick Rudolph.
security/intel: Add option to enable SMM flash access only
On platforms where the boot media can be updated externally, e.g.
using a BMC, add the possibility to enable writes in SMM only. This
allows to protect the BIOS region even without the use of vboot, but
keeps SMMSTORE working for use in payloads. Note that this breaks
flashconsole, since the flash becomes read-only.
Tested on Asrock B85M Pro4, SMM protection works as expected.
Signed-off-by: Patrick Rudolph <firstname.lastname@example.org>
Signed-off-by: Angel Pons <email@example.com>
5 files changed, 72 insertions(+), 35 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/30/40830/9
To view, visit change 40830. To unsubscribe, or for help writing mail filters, visit settings.