Protected Regions and other flash protection platform features

[zaolin]

Hey,

Maybe we want to implement them as well. Or extend the current implementation of coreboot itself. I know only PR is secure but I guess it would be good to have them in a security section with the BP feature.

[osresearch]

The nonvolatile BP bits are definitely on the list of things to enable (issue #12), as well as experiments with disconnecting/grounding the #WP pin.

Figuring out where to set the PRR is wrapped up with the "how to do upgrades" issue. If the BP bits sufficiently protect the bootblock and allow the hardware root of trust to be established, then it might be sufficient to leave the PRR unlocked in the recovery shell (in ROM). Any updates would invalidate the TPM PCRs, allowing malicious changes to be detected.

[osresearch]

The update strategy is also discussed in #17