Angel Pons d21b463fb0 security/intel: Add option to enable SMM flash access only ... On platforms where the boot media can be updated externally, e.g. using a BMC, add the possibility to enable writes in SMM only. This allows to protect the BIOS region even without the use of vboot, but keeps SMMSTORE working for use in payloads. Note that this breaks flashconsole, since the flash becomes read-only. Tested on Asrock B85M Pro4 and HP 280 G2, SMM BIOS write protection works as expected, and SMMSTORE can still be used. Change-Id: I157db885b5f1d0f74009ede6fb2342b20d9429fa Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Signed-off-by: Angel Pons <th3fanbus@gmail.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/40830 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Patrick Rudolph <siro@das-labor.org>		2021-06-21 08:11:11 +00:00
..
intel	security/intel/cbnt: Add logging	2021-06-21 05:42:00 +00:00
lockdown	security/intel: Add option to enable SMM flash access only	2021-06-21 08:11:11 +00:00
memory
tpm	security/tpm/tspi/crtm.c: Fix early init	2021-06-21 05:30:55 +00:00
vboot	security/vboot: Add timestamps when loading verstage	2021-06-14 05:11:07 +00:00
Kconfig	cbfs: Add verification for RO CBFS metadata hash	2020-12-03 00:11:08 +00:00
Makefile.inc