Patch Set 1: Code-Review-1

I think the concepts clashing here are too different
to be easily aligned: One idea is to write-protect
the whole flash *after* coreboot is done. The other
is the vboot idea of a readonly, trusted partition.
The latter has to be read-only *before* we jump to
an untrusted RW partition.

So while these two concepts can share the underlying
infrastructure to commit the write protection, IMO,
their setup and hookup should stay independent.

As vboot verifies the RW partitions, it's trusted code. Locking in ramstage is thus OK following your argumentation. Shouldn't that be +1 then?

View Change

To view, visit change 32705. To unsubscribe, or for help writing mail filters, visit settings.