summaryrefslogtreecommitdiff
path: root/src/soc/intel/common/pch
diff options
context:
space:
mode:
authorAngel Pons <th3fanbus@gmail.com>2021-02-10 17:12:05 +0100
committerPatrick Rudolph <siro@das-labor.org>2021-06-21 08:11:11 +0000
commitd21b463fb058deccef3a2c2ad80d771b5aba9f19 (patch)
treefdb4d134ffe185f67500f3419960996f0cbb8679 /src/soc/intel/common/pch
parent44a4c0a58dd4ef725c7ff24f9889b12d42a4c5f2 (diff)
security/intel: Add option to enable SMM flash access only
On platforms where the boot media can be updated externally, e.g. using a BMC, add the possibility to enable writes in SMM only. This allows to protect the BIOS region even without the use of vboot, but keeps SMMSTORE working for use in payloads. Note that this breaks flashconsole, since the flash becomes read-only. Tested on Asrock B85M Pro4 and HP 280 G2, SMM BIOS write protection works as expected, and SMMSTORE can still be used. Change-Id: I157db885b5f1d0f74009ede6fb2342b20d9429fa Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Signed-off-by: Angel Pons <th3fanbus@gmail.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/40830 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Patrick Rudolph <siro@das-labor.org>
Diffstat (limited to 'src/soc/intel/common/pch')
-rw-r--r--src/soc/intel/common/pch/lockdown/lockdown.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/src/soc/intel/common/pch/lockdown/lockdown.c b/src/soc/intel/common/pch/lockdown/lockdown.c
index d9495a432b..87f36fc91c 100644
--- a/src/soc/intel/common/pch/lockdown/lockdown.c
+++ b/src/soc/intel/common/pch/lockdown/lockdown.c
@@ -65,6 +65,12 @@ static void fast_spi_lockdown_cfg(int chipset_lockdown)
/* BIOS Interface Lock */
fast_spi_set_bios_interface_lock_down();
+ /* Only allow writes in SMM */
+ if (CONFIG(BOOTMEDIA_SMM_BWP)) {
+ //fast_spi_set_eiss(); /* TODO */
+ fast_spi_enable_wp();
+ }
+
/* BIOS Lock */
fast_spi_set_lock_enable();