1 #include "config.h"
2 
3 #include "utils.hpp"
4 
5 #include <phosphor-logging/lg2.hpp>
6 
7 #include <filesystem>
8 #include <fstream>
9 #include <string>
10 
11 PHOSPHOR_LOG2_USING;
12 
13 constexpr auto PROPERTY_INTERFACE = "org.freedesktop.DBus.Properties";
14 
15 // Utilize the QuiesceOnHwError setting as an indication that the system
16 // is operating in an environment where the user should be notified of
17 // security settings (i.e. "Manufacturing")
18 bool isMfgModeEnabled()
19 {
20     auto bus = sdbusplus::bus::new_default();
21     std::string path = "/xyz/openbmc_project/logging/settings";
22     std::string interface = "xyz.openbmc_project.Logging.Settings";
23     std::string propertyName = "QuiesceOnHwError";
24     std::variant<bool> mfgModeEnabled;
25 
26     std::string service =
27         phosphor::state::manager::utils::getService(bus, path, interface);
28 
29     auto method = bus.new_method_call(service.c_str(), path.c_str(),
30                                       PROPERTY_INTERFACE, "Get");
31 
32     method.append(interface, propertyName);
33 
34     try
35     {
36         auto reply = bus.call(method);
37         reply.read(mfgModeEnabled);
38     }
39     catch (const sdbusplus::exception::exception& e)
40     {
41         error("Error in property Get, error {ERROR}, property {PROPERTY}",
42               "ERROR", e, "PROPERTY", propertyName);
43         throw;
44     }
45 
46     return std::get<bool>(mfgModeEnabled);
47 }
48 
49 int main()
50 {
51     // Read the secure boot gpio
52     auto secureBootGpio =
53         phosphor::state::manager::utils::getGpioValue("bmc-secure-boot");
54     if (secureBootGpio == -1)
55     {
56         debug("bmc-secure-boot gpio not present or can not be read");
57     }
58     else if (secureBootGpio == 0)
59     {
60         info("bmc-secure-boot gpio found and indicates it is NOT enabled");
61     }
62     else
63     {
64         info("bmc-secure-boot found and indicates it is enabled");
65     }
66 
67     // Now read the /sys/kernel/debug/aspeed/ files
68     std::string dbgVal;
69     std::ifstream dbgFile;
70     int secureBootVal = -1;
71     int abrImage = -1;
72 
73     dbgFile.exceptions(std::ifstream::failbit | std::ifstream::badbit |
74                        std::ifstream::eofbit);
75 
76     if (std::filesystem::exists(SYSFS_SECURE_BOOT_PATH))
77     {
78         try
79         {
80             dbgFile.open(SYSFS_SECURE_BOOT_PATH);
81             dbgFile >> dbgVal;
82             dbgFile.close();
83             info("Read {SECURE_BOOT_VAL} from secure_boot", "SECURE_BOOT_VAL",
84                  dbgVal);
85             secureBootVal = std::stoi(dbgVal);
86         }
87         catch (std::exception& e)
88         {
89             error("Failed to read secure boot sysfs file: {ERROR}", "ERROR", e);
90             // just continue and error will be logged at end if in mfg mode
91         }
92     }
93     else
94     {
95         info("sysfs file secure_boot not present");
96     }
97 
98     if (std::filesystem::exists(SYSFS_ABR_IMAGE_PATH))
99     {
100 
101         try
102         {
103             dbgFile.open(SYSFS_ABR_IMAGE_PATH);
104             dbgFile >> dbgVal;
105             dbgFile.close();
106             info("Read {ABR_IMAGE_VAL} from abr_image", "ABR_IMAGE_VAL",
107                  dbgVal);
108             abrImage = std::stoi(dbgVal);
109         }
110         catch (std::exception& e)
111         {
112             error("Failed to read abr image sysfs file: {ERROR}", "ERROR", e);
113             // just continue and error will be logged at end if in mfg mode
114         }
115     }
116     else
117     {
118         info("sysfs file abr_image not present");
119     }
120 
121     if (isMfgModeEnabled())
122     {
123         if ((secureBootGpio != 1) || (secureBootVal != 1) || (abrImage != 0))
124         {
125             error("The system is not secure");
126             std::map<std::string, std::string> additionalData;
127             additionalData.emplace("SECURE_BOOT_GPIO",
128                                    std::to_string(secureBootGpio));
129             additionalData.emplace("SYSFS_SECURE_BOOT_VAL",
130                                    std::to_string(secureBootVal));
131             additionalData.emplace("SYSFS_ABR_IMAGE_VAL",
132                                    std::to_string(abrImage));
133 
134             auto bus = sdbusplus::bus::new_default();
135             phosphor::state::manager::utils::createError(
136                 bus, "xyz.openbmc_project.State.Error.SecurityCheckFail",
137                 sdbusplus::xyz::openbmc_project::Logging::server::Entry::Level::
138                     Warning,
139                 additionalData);
140         }
141     }
142 
143     return 0;
144 }
145