[coreboot-gerrit] Change in coreboot[master]: security/intel: Add option to enable SMM flash access only

[Angel Pons (Code Review)]

Attention is currently required from: Nico Huber, Patrick Rudolph, Benjamin Doron.
Angel Pons has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/40830 )

Change subject: security/intel: Add option to enable SMM flash access only
......................................................................

Patch Set 5:

(1 comment)

Patchset:

PS5:
> Why cling to the WPD bit? AFAIR, there is an exploitable race, e.g. one […]

InSMM.STS does not exist on older plaforms. Moreover, InSMM.STS needs special handling when using SMMSTORE, and the point of these patches is to protect the flash chip while allowsing SMMSTORE to work (otherwise I would've simply used protected ranges). Once I have InSMM.STS working, I can enable it by default where supported when one chooses to write-protect the flash through SMM.