vboot_reference/make_dev_firmware: check write protection status before making changes

scripts/image_signing/make_dev_firmware.sh

Index: scripts/image_signing/make_dev_firmware.sh
diff --git a/scripts/image_signing/make_dev_firmware.sh b/scripts/image_signing/make_dev_firmware.sh
index f4e7d49d7052c013f91c1bbd371859119c7534ae..18e5c1a145f8229d5e5f47f33d06710757fdd0bd 100755
--- a/scripts/image_signing/make_dev_firmware.sh
+++ b/scripts/image_signing/make_dev_firmware.sh
@@ -62,6 +62,21 @@ debug_msg() {
   fi
 }
 
+# Disables write protection status registers
+disable_write_protection() {
+  # No need to change WP status in file mode
+  if [ -n "$FLAGS_from" ]; then

[Randall Spangler, 2011/01/04 21:27:44]

$FLAGS_to, right?  Doesn't matter where the image comes from; what matters is
where we're writing to.

[Hung-Te, 2011/01/05 03:43:37]

Done. Thanks for finding this!

+    return $FLAGS_TRUE
+  fi
+
+  # --wp-disable command may return success even if WP is still enabled,
+  # so we should use --wp-status to verify the results.
+  echo "Disabling system software write protection status..."
+  (flashrom --wp-disable && flashrom --wp-status) 2>&1 |
+    tee "$EXEC_LOG" |
+    grep -q '^WP: .* is disabled\.$'
+}
+
 # Reads $IMAGE from $FLAGS_from
 read_image() {
   if [ -z "$FLAGS_from" ]; then
@@ -141,7 +156,14 @@ main() {
     ensure_files_exist "$FLAGS_from"
   fi
 
-  # TODO(hungte) check if GPIO.3 (WP) is enabled
+  debug_msg "Checking software write protection status"
+  disable_write_protection ||
+    if is_debug_mode; then
+      err_die "Failed to disable WP. Diagnose Message: $(cat "$EXEC_LOG")"
+    else
+      err_die "Write protection is still enabled. " \
+              "Please verify that hardware write protection is disabled."
+    fi
 
   debug_msg "Pulling image to $IMAGE"
   (read_image && [ -s "$IMAGE" ]) ||