The recently added firmware_WriteProtect test checks that wpsw_boot and wpsw_cur values reported by crossystem match the physical hardware write-protect state of the system. This is good, but it would also be nice if the test could check that the thus-reported write-protect state is effective in protecting the system. The test should be expanded to check this as well.
Rough sketch:
- Run 'flashrom --wp-status' during init() to save old write-protect range
- Restore old write-protect range during clean-up (before restoring HW-WP state)
- Backup/restore firmware flash (like firmware_CorruptFwBodyA and similar tests)
1. Run 'flashrom -r ...' to save firmware flash in temp file
2. Force hardware write-protect state to 'disabled'
3. Run 'flashrom --wp-enable --wp-range ...' to protect whole flash
4. Force hardware write-protect state to 'enabled'
5. Run 'flashrom --wp-disable' to try to unprotect flash, ensure it returns non-zero
6. Run 'flashrom -n -E' to try to erase flash
7. Run 'flashrom -n -w /dev/zero' to try to fill flash with zeroes
8. Run 'flashrom -r ...' again to save in another temp file
9. Compare temp files, fail test if different
(Note that firmware flash content may legitimately change during reboots or certain other actions, so need to store copy of flash again right before this part of the test and cannot just compare to the backup stored during init.)