[coreboot-gerrit] Change in ...coreboot[master]: security/lockdown: Write-protect WP_RO

[Nico Huber (Code Review)]

Nico Huber has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/32705 )

Change subject: security/lockdown: Write-protect WP_RO
......................................................................

Patch Set 1: Code-Review-1

I think the concepts clashing here are too different
to be easily aligned: One idea is to write-protect
the whole flash *after* coreboot is done. The other
is the vboot idea of a readonly, trusted partition.
The latter has to be read-only *before* we jump to
an untrusted RW partition.

So while these two concepts can share the underlying
infrastructure to commit the write protection, IMO,
their setup and hookup should stay independent.