Attention is currently required from: Patrick Rudolph, Benjamin Doron, Angel Pons. Nico Huber has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/40830 )
Change subject: security/intel: Add option to enable SMM flash access only ......................................................................
Patch Set 6:
(1 comment)
Patchset:
PS5:
InSMM.STS does not exist on older plaforms.
That's right, and it's known that those platforms can't be SMM protected.
Moreover, InSMM.STS needs special handling when using SMMSTORE, and the point of these patches is to protect the flash chip while allowsing SMMSTORE to work (otherwise I would've simply used protected ranges).
I know what you are up to. It just seems to me that all the WPD related patches are effectively about a no-op.
Once I have InSMM.STS working, I can enable it by default where supported when one chooses to write-protect the flash through SMM.
Again, on older platforms it's not really write-protected without InSMM.STS. So you would just leave a Kconfig there that only pretends to protect?
Well, we could also just call it "protection against accidental writes".