Send TPM logs and EFI variables to monitor app

pkg/monitor/.dockerignore

@@ -0,0 +1,4 @@
+eve-monitor-rs/target/
+.idea
+.vscode
+**/*.json

pkg/monitor/Dockerfile

@@ -1,8 +1,8 @@
 # Copyright (c) 2024 Zededa, Inc.
 # SPDX-License-Identifier: Apache-2.0
 
-ARG MONITOR_RS_VERSION=v0.2.0
-ARG RUST_VERSION=lfedge/eve-rust:1.80.1
+ARG MONITOR_RS_VERSION=v0.2.1
+ARG RUST_VERSION=lfedge/eve-rust:1.84.1
 FROM --platform=$BUILDPLATFORM ${RUST_VERSION} AS toolchain-base
 ARG TARGETARCH
 

pkg/pillar/cmd/monitor/ipc_server.go

@@ -90,8 +90,9 @@ func (s *monitorIPCServer) handleConnection(conn net.Conn) {
 	s.Lock()
 	defer s.Unlock()
 	// the format of the frame is length + data
-	// where the length is 16 bit unsigned integer
+	// where the length is 32 bit unsigned integer
 	s.codec = framed.NewReadWriteCloser(conn)
+	s.codec.EnableBigFrames()
 
 	go func() {
 		defer s.close()
@@ -169,14 +170,24 @@ func (s *monitorIPCServer) sendIpcMessage(t string, msg any) error {
 	defer s.Unlock()
 
 	var err error
+	var data []byte
 
-	if data, err := json.Marshal(msg); err == nil {
+	if data, err = json.Marshal(msg); err == nil {
 		ipcMessage := ipcMessage{Type: t, Message: json.RawMessage(data)}
 		if data, err = json.Marshal(ipcMessage); err == nil {
-			log.Noticef("Sending IPC message: %s", string(data))
+			if t == "TpmLogs" {
+				log.Noticef("Sending IPC message: %s", t)
+			} else {
+				log.Noticef("Sending IPC message: %s", string(data))
+			}
 			_, err = s.codec.Write(data)
+
+			if err != nil {
+				log.Errorf("Failed to send IPC message: %v", err)
+			}
 		}
 	}
+
 	return err
 }
 

pkg/pillar/cmd/monitor/messages.go

@@ -4,10 +4,29 @@
 package monitor
 
 import (
+	"io/fs"
+	"os"
+	"regexp"
+
+	"github.com/lf-edge/eve/pkg/pillar/evetpm"
 	"github.com/lf-edge/eve/pkg/pillar/types"
 	uuid "github.com/satori/go.uuid"
 )
 
+type efiVariable struct {
+	Name  string `json:"name,omitempty"`
+	Value []byte `json:"value,omitempty"`
+}
+
+type tpmLogs struct {
+	LastFailedLog   []byte        `json:"last_failed_log,omitempty"`
+	LastGoodLog     []byte        `json:"last_good_log,omitempty"`
+	BackupFailedLog []byte        `json:"backup_failed_log,omitempty"`
+	BackupGoodLog   []byte        `json:"backup_good_log,omitempty"`
+	EfiVarsSuccess  []efiVariable `json:"efi_vars_success,omitempty"`
+	EfiVarsFailed   []efiVariable `json:"efi_vars_failed,omitempty"`
+}
+
 type nodeStatus struct {
 	Server         string                   `json:"server,omitempty"`
 	NodeUUID       uuid.UUID                `json:"node_uuid,omitempty"`
@@ -24,9 +43,11 @@ func (ctx *monitor) isOnboarded() (bool, uuid.UUID) {
 	sub := ctx.subscriptions["OnboardingStatus"]
 	if item, err := sub.Get("global"); err == nil {
 		onboardingStatus := item.(types.OnboardingStatus)
-		return true, onboardingStatus.DeviceUUID
+		if onboardingStatus.DeviceUUID != uuid.Nil {
+			return true, onboardingStatus.DeviceUUID
+		}
 	}
-	return false, uuid.UUID{}
+	return false, uuid.Nil
 }
 
 func (ctx *monitor) getAppSummary() types.AppInstanceSummary {
@@ -90,3 +111,92 @@ func (ctx *monitor) sendAppsList() {
 	}
 	ctx.IPCServer.sendIpcMessage("AppsList", apps)
 }
+
+func readEfiVars(fsys fs.FS) ([]efiVariable, error) {
+	vars, err := fs.ReadDir(fsys, ".")
+	if err != nil {
+		return nil, err
+	}
+
+	// read boot order
+	bootOrder, err := fs.ReadFile(fsys, "BootOrder")
+	if err != nil {
+		return nil, err
+	}
+
+	re := regexp.MustCompile(`^Boot[0-9a-fA-F]{4}$`)
+
+	// read boot variables
+	bootVars := make([]efiVariable, 0)
+	for _, varFile := range vars {
+		varName := varFile.Name()
+		if varFile.IsDir() || !re.MatchString(varName) {
+			continue
+		}
+		varValue, err := fs.ReadFile(fsys, varName)
+		if err != nil {
+			return nil, err
+		}
+		bootVars = append(bootVars, efiVariable{Name: varName, Value: varValue})
+	}
+
+	bootVars = append(bootVars, efiVariable{Name: "BootOrder", Value: bootOrder})
+
+	return bootVars, nil
+}
+
+func (ctx *monitor) sendTpmLogs() {
+	currentGoodTpmLog, currentFailedTpmLog := evetpm.GetTpmLogFileNames()
+	backupGoodTpmLog, backupFailedTpmLog := evetpm.GetTpmLogBackupFileNames()
+
+	goodLog, err := os.ReadFile(currentGoodTpmLog)
+
+	if err != nil {
+		log.Warnf("Cannot read last good TPM log: %v", err)
+		goodLog = nil
+	}
+
+	failedLog, err := os.ReadFile(currentFailedTpmLog)
+	if err != nil {
+		log.Warnf("Cannot read failed TPM log: %v", err)
+		failedLog = nil
+	}
+
+	// backup logs
+	backupGoodLog, err := os.ReadFile(backupGoodTpmLog)
+	if err != nil {
+		log.Warnf("Cannot read backup good TPM log: %v", err)
+		backupGoodLog = nil
+	}
+
+	backupFailedLog, err := os.ReadFile(backupFailedTpmLog)
+	if err != nil {
+		log.Warnf("Cannot read backup failed TPM log: %v", err)
+		backupFailedLog = nil
+	}
+
+	efiVarsDirSuccess, efiVarsDirFailed := evetpm.GetBootVariablesDirNames()
+
+	bootVarsSuccess, err := readEfiVars(os.DirFS(efiVarsDirSuccess))
+	if err != nil {
+		log.Warnf("Cannot read boot variables: %v", err)
+		bootVarsSuccess = nil
+	}
+
+	bootVarsFailed, err := readEfiVars(os.DirFS(efiVarsDirFailed))
+	if err != nil {
+		log.Warnf("Cannot read boot variables: %v", err)
+		bootVarsFailed = nil
+	}
+
+	tpmLogs := tpmLogs{
+		LastFailedLog:   failedLog,
+		LastGoodLog:     goodLog,
+		BackupFailedLog: backupFailedLog,
+		BackupGoodLog:   backupGoodLog,
+		EfiVarsSuccess:  bootVarsSuccess,
+		EfiVarsFailed:   bootVarsFailed,
+	}
+
+	ctx.IPCServer.sendIpcMessage("TpmLogs", tpmLogs)
+}

pkg/pillar/cmd/monitor/messages_test.go

@@ -0,0 +1,85 @@
+// Copyright (c) 2025 Zededa, Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+package monitor
+
+import (
+	"io/fs"
+	"reflect"
+	"sort"
+	"testing"
+	"testing/fstest"
+)
+
+func TestReadEfiVars(t *testing.T) {
+	tests := []struct {
+		name    string
+		fsys    fstest.MapFS
+		want    []efiVariable
+		wantErr bool
+	}{
+		{
+			name: "successful read with multiple boot variables",
+			fsys: fstest.MapFS{
+				"BootOrder": &fstest.MapFile{Data: []byte{0x01, 0x02}},
+				"Boot0001":  &fstest.MapFile{Data: []byte("var1")},
+				"Boot0002":  &fstest.MapFile{Data: []byte("var2")},
+				"BootDir":   &fstest.MapFile{Mode: fs.ModeDir},        // Should be skipped
+				"Invalid":   &fstest.MapFile{Data: []byte("invalid")}, // Doesn't match regex
+			},
+			want: []efiVariable{
+				{Name: "BootOrder", Value: []byte{0x01, 0x02}},
+				{Name: "Boot0001", Value: []byte("var1")},
+				{Name: "Boot0002", Value: []byte("var2")},
+			},
+			wantErr: false,
+		},
+		{
+			name: "missing BootOrder file",
+			fsys: fstest.MapFS{
+				"Boot0001": &fstest.MapFile{Data: []byte("var1")},
+			},
+			want:    []efiVariable{},
+			wantErr: true,
+		},
+		{
+			name: "invalid boot variable",
+			fsys: fstest.MapFS{
+				"BootOrder": &fstest.MapFile{Data: []byte{0x01, 0x02}},
+				"Boot123":   &fstest.MapFile{Data: []byte("var1")}, // Doesn't match regex
+				"Boot0001":  &fstest.MapFile{Data: []byte("var1")},
+			},
+			want: []efiVariable{
+				{Name: "Boot0001", Value: []byte("var1")},
+				{Name: "BootOrder", Value: []byte{0x01, 0x02}},
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := readEfiVars(tt.fsys)
+			if (err != nil) != tt.wantErr {
+				t.Logf("Test: %s", tt.name)
+				t.Fatalf("readEfiVars() error = %v, wantErr %v", err, tt.wantErr)
+			}
+			if !tt.wantErr {
+				// Sort boot variables for consistent comparison
+				sortBootVars(got)
+				sortBootVars(tt.want)
+				if !reflect.DeepEqual(got, tt.want) {
+					t.Logf("Test: %s", tt.name)
+					t.Fatalf("readEfiVars() = %+v, want %+v", got, tt.want)
+				}
+			}
+		})
+	}
+}
+
+// sortBootVars sorts boot variables by Name
+func sortBootVars(vars []efiVariable) {
+	sort.Slice(vars, func(i, j int) bool {
+		return vars[i].Name < vars[j].Name
+	})
+}

pkg/pillar/cmd/monitor/subscriptions.go

@@ -147,6 +147,10 @@ func handleVaultStatusUpdate(statusArg interface{}, ctxArg interface{}) {
 	status := statusArg.(types.VaultStatus)
 	ctx := ctxArg.(*monitor)
 	ctx.IPCServer.sendIpcMessage("VaultStatus", status)
+
+	if status.IsVaultInError() {
+		ctx.sendTpmLogs()
+	}
 }
 
 func handleAppInstanceSummaryCreate(ctxArg interface{}, key string,

pkg/pillar/types/vaultmgrtypes.go

@@ -177,3 +177,8 @@ func (key EncryptedVaultKeyFromController) LogDelete(logBase *base.LogObject) {
 func (key EncryptedVaultKeyFromController) LogKey() string {
 	return string(base.EncryptedVaultKeyFromControllerLogType) + "-" + key.Key()
 }
+
+// IsVaultInError :
+func (status VaultStatus) IsVaultInError() bool {
+	return (status.Status == info.DataSecAtRestStatus_DATASEC_AT_REST_ERROR) && len(status.MismatchingPCRs) > 0
+}