Opal v2 and above drives are required to support multiple locking ranges, so it's possible to block access entirely to the majority of the drive and only have the bootloader w/ PBA support section visible and read-only on such drives.
What security trade-offs are there to setting up a read only bootloader w/ PBA + locked OS, versus Shadow MBR + locked full drive?
