SMI Platform locking on newer platforms (Skylake+)

[tlaurion]

There is some traction revisiting SMI platform locking on post-skylake. Here is anchor of past work, feel free to document your findings

@tlaurion it's simply not going to work on newer platforms where FSP locks those registers regardless of any coreboot settings. They simply can't be set by the payload, even in SMM.

CONFIG_INTEL_CHIPSET_LOCKDOWN has no effect on Skylake and newer. CONFIG_BOOTMEDIA_LOCK_CONTROLLER, I don't understand how it's not locking things prior to the payload execution on older platforms. I'd want to see a cbmem log from an x230 (eg) with SMM logging enabled to try and make sense of it

Originally posted by @MrChromebox in https://github.com/linuxboot/heads/issues/326#issuecomment-939176320

---

TODO: Skylake and newer have been tweaked to be able to do the same but it seems that upstreaming the changes to coreboot has not happened yet but had for older platforms. More info for coreboot devels to jump in from vaultbook fork for their x11 platform patch on unknown coreboot git commit

Originally posted by @tlaurion in https://github.com/linuxboot/heads/pull/1373#issue-1665206340

[tlaurion]

https://eclypsium.com/blog/firmware-security-realizations-part-3-spi-write-protections/