[coreboot-gerrit] Change in coreboot[master]: security/lockdown: Write-protect WP_RO

[Julius Werner (Code Review)]

Julius Werner has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/32705 )

Change subject: security/lockdown: Write-protect WP_RO
......................................................................

Patch Set 5:

(3 comments)

https://review.coreboot.org/c/coreboot/+/32705/5/src/include/boot_device.h 
File src/include/boot_device.h:

https://review.coreboot.org/c/coreboot/+/32705/5/src/include/boot_device.h@7... 
PS5, Line 78: Looks
Locks

https://review.coreboot.org/c/coreboot/+/32705/5/src/security/lockdown/Kconf... 
File src/security/lockdown/Kconfig:

https://review.coreboot.org/c/coreboot/+/32705/5/src/security/lockdown/Kconf... 
PS5, Line 61: chip
nit: should probably say "boot media", not "chip"

https://review.coreboot.org/c/coreboot/+/32705/5/src/security/vboot/verstage... 
File src/security/vboot/verstage.c:

https://review.coreboot.org/c/coreboot/+/32705/5/src/security/vboot/verstage... 
PS5, Line 35: 		boot_device_security_lockdown(NULL);
Note that this code is only executed in CONFIG_SEPARATE_VERSTAGE builds. You probably want to put it in verstage_main() instead.