Patrick Rudolph has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/32705 )
Change subject: security/lockdown: Write-protect WP_RO ......................................................................
Patch Set 13:
(2 comments)
https://review.coreboot.org/c/coreboot/+/32705/13/src/include/boot_device.h File src/include/boot_device.h:
https://review.coreboot.org/c/coreboot/+/32705/13/src/include/boot_device.h@... PS13, Line 79: ENV_VERSTAGE
This doesn't work because ENV_VERSTAGE isn't always a real stage (if CONFIG_SEPARATE_VERSTAGE=n this […]
Ok, will change.
https://review.coreboot.org/c/coreboot/+/32705/13/src/security/lockdown/Kcon... File src/security/lockdown/Kconfig:
https://review.coreboot.org/c/coreboot/+/32705/13/src/security/lockdown/Kcon... PS13, Line 65: BOOTMEDIA_LOCK_IN_VERSTAGE
why is this option outside of the 'choice' menu?
It depends on BOOTMEDIA_LOCK_CONTROLLER_RO_VBOOT_RO. So it can't be in the list as separate option.