[coreboot-gerrit] Change in coreboot[master]: security/intel: Add option to enable SMM flash access only

[Nico Huber (Code Review)]

Attention is currently required from: Patrick Rudolph, Benjamin Doron, Angel Pons.
Nico Huber has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/40830 )

Change subject: security/intel: Add option to enable SMM flash access only
......................................................................

Patch Set 5:

(1 comment)

Patchset:

PS5: 
Why cling to the WPD bit? AFAIR, there is an exploitable race, e.g. one
core is busy SMI handling and before it is done resetting the WPD bit
another core already started a write cycle. And that's why the InSMM.STS
thing was invented. I'm not 100% sure. It was said the race was fixed,
but my interpretation was that only InSMM.STS fixes it.

In any case I would prefer a warning at the Kconfig option that this
probably isn't secure. Or just implement InSMM.STS right away. Then you
don't even need to reset WPD, AIUI.