In cases where vboot isn't used, could this be extended later to only cover the COREBOOT region (decision in config), or is there a reason why this wouldn't work?

I would stick to the name WP_RO since COREBOOT doesn't always contain all the code. For example, on non-x86 devices the bootblock is usually stored in a separate BOOTBLOCK section. But if there's desire for it we could update the util/cbfstool/default.fmd and .../default-x86.fmd maps to include a WP_RO wrapper for the relevant sections (COREBOOT, BOOTBLOCK and FMAP, I'd say) and then we can make it available without CONFIG_VBOOT. (One issue with this is that if you want to use chip-based lockdown, the WP_RO vs. rest split must be on a power-of-two boundary. I guess this patch only implements controller-based lockdown so it's not relevant there, but it might become so if it were expanded later.)

Patch set 12:Code-Review +2

View Change

To view, visit change 32705. To unsubscribe, or for help writing mail filters, visit settings.