vcomLink communication refactoring #4502

shjala · 2025-01-02T12:12:42Z

Description

New TPM communication APIs have been changed to use protobuf and the vcomlink package has been refactored to accommodate these changes. The existing custom message handling/protocol has been removed, and its functionalities have been integrated into the mentioned protobuf based API. This restructuring aims to streamline TPM-related operations and improve code maintainability.

New functions have been introduced to handle various TPM tasks more effectively. These include:

tpmReadNV: Reads data from a specified Non-Volatile (NV) index in the TPM
tpmGetPub: Retrieves the public key associated with a given handle
tpmSign: Signs data using a specified key index
certifykey: Certify a key using AK.

In addition this update introduces stricter security measures, such as enforcing security policies before performing TPM operations (for now a simple but sufficient policy, based on the key/NV index).

Relates to lf-edge/eve-tools#13 (not dependent).

How to test and validate this PR

Go tests are provided to fully test the vcomlink TPM related functionalities, the following are results of testing on HW TPM:

➜  pillar git:(vcomlink.refactor) ✗ /usr/bin/go test github.com/lf-edge/eve/pkg/pillar/cmd/vcomlink -v
time="2025-07-22T16:23:49+03:00" level=info msg="Containerd Init"
time="2025-07-22T16:23:49+03:00" level=info msg="VSOCK is supported, using VSOCK transport" pid=3783013 source=vcomlink_test
time="2025-07-22T16:23:49+03:00" level=info msg="Listening on vsock CID 1, port 2000" pid=3783013 source=vcomlink_test
=== RUN   TestValidGetPublic
TPM EK: 0001000b000300720000000600800043...
TPM EK Algorithm: RSA
TPM EK Attributes: FlagFixedParent | FlagSensitiveDataOrigin | FlagUserWithAuth | FlagRestricted | FlagDecrypt | FlagFixedTPM
--- PASS: TestValidGetPublic (0.02s)
=== RUN   TestValidGetEkCert
TPM EK cert issuer: CN=Nuvoton TPM Root CA 2112,O=Nuvoton Technology Corporation,C=TW
TPM EK URL: [https://www.nuvoton.com/security/NTC-TPM-EK-Cert/Nuvoton TPM Root CA 2112.cer]
Downloading issuing CA cert from URL: https://www.nuvoton.com/security/NTC-TPM-EK-Cert/Nuvoton TPM Root CA 2112.cer
EK cert verified successfully against issuing CA cert
--- PASS: TestValidGetEkCert (0.93s)
=== RUN   TestValidSigner
Signature verified successfully using RSA public key
--- PASS: TestValidSigner (0.11s)
=== RUN   TestValidActivateCred
Credential:           f63e0c102742a64374740b78995834828e8484e07d70a2a455af3c50202f9b3c
Recovered credential: f63e0c102742a64374740b78995834828e8484e07d70a2a455af3c50202f9b3c
Credential activation successful, we can trust the AIK
--- PASS: TestValidActivateCred (0.11s)
=== RUN   TestValidCertifyKey
    vcomlink_test.go:665: Successfully certified key with AIK and verified signature.
--- PASS: TestValidCertifyKey (0.10s)
PASS
ok      github.com/lf-edge/eve/pkg/pillar/cmd/vcomlink  3.282s

Changelog notes

Refactored vcomlink TPM communication to use protobuf-based APIs with updated vcomlink support, replacing custom messaging, adding tpmReadNV, tpmGetPub, and tpmSign functions, and introducing basic security policy enforcement.

Checklist

I've provided a proper description
I've added the proper documentation
I've tested my PR on amd64 device
I've tested my PR on arm64 device
I've written the test verification instructions
I've set the proper labels to this PR

For backport PRs (remove it if it's not a backport):

I've added a reference link to the original PR
PR's title follows the template

And the last but not least:

I've checked the boxes above, or I've provided a good reason why I didn't
check them.

Please, check the boxes above after submitting the PR in interactive mode.

shjala · 2025-07-14T13:52:02Z

Code ready for review, I'm fixing the CI errors and updating the documents.

OhmSpectator · 2025-07-17T16:30:47Z

I recall using code from this PR once... I had to modify it slightly to make it suitable... But I have no memory of the details... Will have to review again...

OhmSpectator · 2025-07-17T16:32:12Z

@shjala could you, please, meanwhile, check the Docker hash warning?...

shjala · 2025-07-18T08:15:27Z

@shjala could you, please, meanwhile, check the Docker hash warning?...

Sure, I have some more changes coming today, I'll fix that docker too.

shjala · 2025-07-18T08:16:16Z

I recall using code from this PR once... I had to modify it slightly to make it suitable... But I have no memory of the details... Will have to review again...

Yeah that probably was for sending monitoring data.

OhmSpectator · 2025-09-18T09:03:44Z

@shjala, I think it's better to rebase the branch

eriknordmark · 2025-09-23T18:40:13Z

There are failures in TestEdenScripts/eden_vcom, and also SPDX license headers to address.

pkg/pillar/cmd/vcomlink/tpmcom.go

pkg/pillar/cmd/vcomlink/vcomlink_test.go

eriknordmark

There are failures in TestEdenScripts/eden_vcom, and also SPDX license headers to address.

shjala · 2025-09-25T12:54:44Z

There are failures in TestEdenScripts/eden_vcom, and also SPDX license headers to address.

@eriknordmark the test failure is expected, I can disable that test for now in Eden until this gets merged lf-edge/eden#1095, but @OhmSpectator is in favour of not doing that and letting the test to fail.

eriknordmark

Note one more SPDX failure:
Checking tests/tpm/prep-and-run.sh

SPDX-License-Identifier: OK
Copyright: does not have the current year 2025 in the copyright notice!

Letting the test fail until Eden is fixed should be ok, but presumably we need a new version of eden so we can run the older one on 14.5.0?

shjala · 2025-09-25T13:40:49Z

Letting the test fail until Eden is fixed should be ok, but presumably we need a new version of eden so we can run the older one on 14.5.0?

But the older branches point to the old Eden right? so we need one for the master...

shjala · 2025-09-25T14:39:07Z

Yetus is picking up on unrelated files, my local run shows nothing :

shah in 🌐 shah-MS-7E12 in eve on  vcomlink.refactor [$?] via 🐍 v3.12.3 took 5s 
❯ make mini-yetus MYETUS_VERBOSE=y
shah in 🌐 shah-MS-7E12 in eve on  vcomlink.refactor [$?] via 🐍 v3.12.3 took 8s 
❯ cat /tmp/yetus.WZ5B3epSZ1/yetus-output/results-full.txt 
shah in 🌐 shah-MS-7E12 in eve on  vcomlink.refactor [$?] via 🐍 v3.12.3 
❯

eriknordmark · 2025-09-25T16:34:31Z

Yetus is picking up on unrelated files, my local run shows nothing :

shah in 🌐 shah-MS-7E12 in eve on  vcomlink.refactor [$?] via 🐍 v3.12.3 took 5s 
❯ make mini-yetus MYETUS_VERBOSE=y
shah in 🌐 shah-MS-7E12 in eve on  vcomlink.refactor [$?] via 🐍 v3.12.3 took 8s 
❯ cat /tmp/yetus.WZ5B3epSZ1/yetus-output/results-full.txt 
shah in 🌐 shah-MS-7E12 in eve on  vcomlink.refactor [$?] via 🐍 v3.12.3 
❯

I did see a comment in the output that the pr is not on top of current master so it might pick up other files.

VSOCKListener implements the net.Conn and net.Listener interfaces for vsock. Signed-off-by: Shahriyar Jalayeri <[email protected]>

Add vcom link API protobufs definition and generated code for Go and Python. Signed-off-by: Shahriyar Jalayeri <[email protected]>

New TPM communication APIs have been changed to use protbuf and the vcomlink package has been refactored to accommodate these changes. Signed-off-by: Shahriyar Jalayeri <[email protected]>

Updated the vcomlink.md documentation to reflect recent changes in the TPM service protobuf API. Signed-off-by: Shahriyar Jalayeri <[email protected]>

Make sure read syscall does not return n < 0 which then panics the bufio. Signed-off-by: Shahriyar Jalayeri <[email protected]>

Add a script to prepare and run SWTPM to test vcomlink locally. Signed-off-by: Shahriyar Jalayeri <[email protected]>

shjala · 2025-09-25T17:05:10Z

I did see a comment in the output that the pr is not on top of current master so it might pick up other files.

rebased, let's see if Yetus is happy now...

Disable vComLink test temporarily until we have an EVE release that includes the changes introduced in lf-edge/eve#4502. Signed-off-by: Shahriyar Jalayeri <[email protected]>

shjala requested review from OhmSpectator, eriknordmark, rene and rouming as code owners January 2, 2025 12:12

github-actions bot requested a review from rucoder January 2, 2025 12:13

shjala marked this pull request as draft January 2, 2025 12:15

shjala force-pushed the vcomlink.refactor branch 2 times, most recently from ba73204 to 3597b93 Compare February 5, 2025 13:21

github-actions bot requested a review from zedi-pramodh February 5, 2025 13:22

shjala force-pushed the vcomlink.refactor branch from 3597b93 to ed98a85 Compare February 5, 2025 14:02

shjala force-pushed the vcomlink.refactor branch 4 times, most recently from 21fb09d to 10803cd Compare July 14, 2025 13:29

shjala added the enhancement New feature or request label Jul 14, 2025

shjala self-assigned this Jul 14, 2025

shjala marked this pull request as ready for review July 14, 2025 13:51

shjala changed the title ~~[WIP] Vcomlink refactor~~ vcomLink communication refactoring Jul 14, 2025

shjala force-pushed the vcomlink.refactor branch 2 times, most recently from db381cd to 251b958 Compare July 14, 2025 15:04

shjala added the main-quest The fate of the project rests on this PR. Prioritise review to advance the storyline! label Jul 15, 2025

shjala force-pushed the vcomlink.refactor branch 3 times, most recently from 6f1b902 to 30fbca9 Compare July 15, 2025 11:05

shjala force-pushed the vcomlink.refactor branch from 30fbca9 to e1be23b Compare July 18, 2025 08:28

europaul approved these changes Sep 17, 2025

View reviewed changes

shjala mentioned this pull request Sep 17, 2025

update vcom test to use the protobuf based API lf-edge/eden#1095

Open

shjala force-pushed the vcomlink.refactor branch from 022b171 to e8e5aa9 Compare September 22, 2025 08:15

eriknordmark reviewed Sep 24, 2025

View reviewed changes

pkg/pillar/cmd/vcomlink/tpmcom.go Outdated Show resolved Hide resolved

eriknordmark reviewed Sep 24, 2025

View reviewed changes

pkg/pillar/cmd/vcomlink/vcomlink_test.go Outdated Show resolved Hide resolved

eriknordmark requested changes Sep 24, 2025

View reviewed changes

shjala force-pushed the vcomlink.refactor branch from e8e5aa9 to 0d744cb Compare September 25, 2025 12:53

github-actions bot requested a review from eriknordmark September 25, 2025 12:53

eriknordmark approved these changes Sep 25, 2025

View reviewed changes

shjala force-pushed the vcomlink.refactor branch from 0d744cb to 83912e2 Compare September 25, 2025 13:36

github-actions bot requested a review from eriknordmark September 25, 2025 13:37

shjala force-pushed the vcomlink.refactor branch from 83912e2 to 8ca6886 Compare September 25, 2025 13:52

shjala added 6 commits September 25, 2025 19:04

Implement net.Listener and net.Conn interface for vsock

132d76c

VSOCKListener implements the net.Conn and net.Listener interfaces for vsock. Signed-off-by: Shahriyar Jalayeri <[email protected]>

Implement vcom link API using protobufs

cc058ca

Add vcom link API protobufs definition and generated code for Go and Python. Signed-off-by: Shahriyar Jalayeri <[email protected]>

Refactor vcomlink TPM APIs

d56ae91

New TPM communication APIs have been changed to use protbuf and the vcomlink package has been refactored to accommodate these changes. Signed-off-by: Shahriyar Jalayeri <[email protected]>

Update vcomlink.md documentation

0467afe

Updated the vcomlink.md documentation to reflect recent changes in the TPM service protobuf API. Signed-off-by: Shahriyar Jalayeri <[email protected]>

Make sure read syscall does not return n < 0

862f554

Make sure read syscall does not return n < 0 which then panics the bufio. Signed-off-by: Shahriyar Jalayeri <[email protected]>

Add script and description on testing vcomlink locally

ed75b9a

Add a script to prepare and run SWTPM to test vcomlink locally. Signed-off-by: Shahriyar Jalayeri <[email protected]>

shjala force-pushed the vcomlink.refactor branch from 8ca6886 to ed75b9a Compare September 25, 2025 17:04

eriknordmark merged commit cbe9231 into lf-edge:master Sep 25, 2025
44 of 47 checks passed

shjala mentioned this pull request Sep 30, 2025

Disable vComLink test temporarily lf-edge/eden#1099

Merged

vcomLink communication refactoring #4502

vcomLink communication refactoring #4502

Uh oh!

Conversation

shjala commented Jan 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

How to test and validate this PR

Changelog notes

Checklist

Uh oh!

shjala commented Jul 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

OhmSpectator commented Jul 17, 2025

Uh oh!

OhmSpectator commented Jul 17, 2025

Uh oh!

shjala commented Jul 18, 2025

Uh oh!

shjala commented Jul 18, 2025

Uh oh!

OhmSpectator commented Sep 18, 2025

Uh oh!

eriknordmark commented Sep 23, 2025

Uh oh!

Uh oh!

Uh oh!

eriknordmark left a comment

Choose a reason for hiding this comment

Uh oh!

shjala commented Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eriknordmark left a comment

Choose a reason for hiding this comment

Uh oh!

shjala commented Sep 25, 2025

Uh oh!

shjala commented Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eriknordmark commented Sep 25, 2025

Uh oh!

shjala commented Sep 25, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

shjala commented Jan 2, 2025 •

edited

Loading

shjala commented Jul 14, 2025 •

edited

Loading

shjala commented Sep 25, 2025 •

edited

Loading

shjala commented Sep 25, 2025 •

edited

Loading