[coreboot-gerrit] Change in ...coreboot[master]: security/lockdown: Write-protect WP_RO

[Patrick Rudolph (Code Review)]

Patrick Rudolph has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/32705 )

Change subject: security/lockdown: Write-protect WP_RO
......................................................................

Patch Set 1:
> Patch Set 1:
>
> TOCTOU attacks are possible, also you should always directly lockdown the WP_RO is executed. It is never a good idea to do that in a later stage. So please add a hook for vboot_logic.c in the earliest possible part

Please give an example. I don't see how that's possible.

Locking it early will break other functionally in ramstage, like protecting mrc cache.