vboot_reference/make_dev_firmware: check write protection status before making changes

scripts/image_signing/make_dev_firmware.sh

 #!/bin/sh
 #
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 #
 # This script can change key (usually developer keys) in a firmware binary
 # image or system live firmware (EEPROM), and assign proper HWID, BMPFV as well.
 
 SCRIPT_BASE="$(dirname "$0")"
@@ skipping 44 matching lines @@
   [ "$FLAGS_debug" = $FLAGS_TRUE ]
 }
 
 # Prints messages (in parameters) in debug mode
 debug_msg() {
   if is_debug_mode; then
     echo "DEBUG: $*" 1>&2
   fi
 }
 
+# Disables write protection status registers
+disable_write_protection() {
+  # No need to change WP status in file mode
+  if [ -n "$FLAGS_to" ]; then
+    return $FLAGS_TRUE
+  fi
+
+  # --wp-disable command may return success even if WP is still enabled,
+  # so we should use --wp-status to verify the results.
+  echo "Disabling system software write protection status..."
+  (flashrom --wp-disable && flashrom --wp-status) 2>&1 |
+    tee "$EXEC_LOG" |
+    grep -q '^WP: .* is disabled\.$'
+}
+
 # Reads $IMAGE from $FLAGS_from
 read_image() {
   if [ -z "$FLAGS_from" ]; then
     echo "Reading system live firmware..."
     if is_debug_mode; then
       flashrom -V -r "$IMAGE"
     else
       flashrom -r "$IMAGE" >"$EXEC_LOG" 2>&1
     fi
   else
@@ skipping 59 matching lines @@
     "$kernel_sub_pubkey" \
     "$new_bmpfv" ||
     exit 1
 
   if [ -z "$FLAGS_from" ]; then
     is_from_live=1
   else
     ensure_files_exist "$FLAGS_from"
   fi
 
-  # TODO(hungte) check if GPIO.3 (WP) is enabled
+  debug_msg "Checking software write protection status"
+  disable_write_protection ||
+    if is_debug_mode; then
+      err_die "Failed to disable WP. Diagnose Message: $(cat "$EXEC_LOG")"
+    else
+      err_die "Write protection is still enabled. " \
+              "Please verify that hardware write protection is disabled."
+    fi
 
   debug_msg "Pulling image to $IMAGE"
   (read_image && [ -s "$IMAGE" ]) ||
     err_die "Failed to read image. Error message: $(cat "$EXEC_LOG")"
 
   debug_msg "Prepare to backup the file"
   if [ -n "$is_from_live" -o $FLAGS_force_backup = $FLAGS_TRUE ]; then
     backup_image="$(make_temp_file)"
     debug_msg "Creating backup file to $backup_image..."
     cp -f "$IMAGE" "$backup_image"
@@ skipping 77 matching lines @@
 
   debug_msg "Complete."
   if [ -z "$FLAGS_to" ]; then
     echo "Successfully changed firmware to Developer Keys. New HWID: $new_hwid"
   else
     echo "Firmware '$FLAGS_to' now uses Developer Keys. New HWID: $new_hwid"
   fi
 }
 
 main