[coreboot-gerrit] Change in coreboot[master]: security: Add common boot media write protection

[Patrick Rudolph (Code Review)]

Patrick Rudolph has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/32704 )

Change subject: security: Add common boot media write protection
......................................................................

Patch Set 9:

(2 comments)

https://review.coreboot.org/c/coreboot/+/32704/8/src/security/lockdown/Kconf... 
File src/security/lockdown/Kconfig:

https://review.coreboot.org/c/coreboot/+/32704/8/src/security/lockdown/Kconf... 
PS8, Line 17: 	  (e.g. by the payload or the OS).
> The help text should explain that this is only supported on certain controllers (e.g. Intel).

Done

https://review.coreboot.org/c/coreboot/+/32704/8/src/security/lockdown/Kconf... 
PS8, Line 28: The locking will take place during the chipset lockdown, which
            : 	  is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
            : 	  or has to be triggered later (e.g. by the payload or the OS).
> This is wrong for chip lockdown, isn't it? It happens immediately when the lockdown code runs.

Done