[coreboot-gerrit] Change in ...coreboot[master]: security/lockdown: Write-protect WP_RO

[Patrick Rudolph (Code Review)]

Patrick Rudolph has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/32705 )

Change subject: security/lockdown: Write-protect WP_RO
......................................................................

Patch Set 1:
> Patch Set 1:
>
> The mrc cache has nothing to do with WP_RO AFAIK it is its own FMAP partition.

You could set FPR in verstage, but it doesn't improve security as the SPIBAR is still locked at end of ramstage. Locking the SPIBAR earlier is not possible as said MRC cache needs to be protected at end of ramstage as well.