[coreboot-gerrit] Change in coreboot[master]: security/lockdown: Write-protect WP_RO

[Julius Werner (Code Review)]

Julius Werner has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/32705 )

Change subject: security/lockdown: Write-protect WP_RO
......................................................................

Patch Set 13:

(1 comment)

https://review.coreboot.org/c/coreboot/+/32705/13/src/security/lockdown/Kcon... 
File src/security/lockdown/Kconfig:

https://review.coreboot.org/c/coreboot/+/32705/13/src/security/lockdown/Kcon... 
PS13, Line 65: BOOTMEDIA_LOCK_IN_VERSTAGE
> It depends on BOOTMEDIA_LOCK_CONTROLLER_RO_VBOOT_RO. So it can't be in the list as separate option.

FWIW I think this would be a bit cleaner by moving even more options out of the choice block, because it's a bit overloaded. The choice really just needs to be about the basic locking mechanism (NONE, CHIP or CONTROLLER). Then you can have a separate choice about what to lock (ALL or VBOOT_RO, depends on mechanism != NONE), the LOCK_IN_VERSTAGE option here like it is (depends on lock area VBOOT_RO) and another boolean LOCK_BOTH_READ_AND_WRITE option (depends on lock type CONTROLLER) to cover the NO_ACCESS case (which you could combine with VBOOT_RO if you wanted, after all).