Skip to main content

Introduction

VComLink is a lightweight communication service built into EVE-OS that lets virtual machines access specific host-level services over a secure, kernel-mediated channel. Rather than exposing the full hardware TPM to guest VMs (as the EVE-OS Virtual TPM feature does), VComLink relays only specific, well-defined operations that a VM is permitted to invoke. The first available service is the TPM channel, which lets VMs delegate cryptographic operations to the hardware TPM on the EVE-OS host. Additional service channels are under development.

Prerequisites

  • EVE-OS 14.5.0-LTS or later.
  • A KVM-based EVE-OS image.

How It Works

VComLink runs as a daemon on the EVE-OS host and is automatically exposed to all virtual machines through the virtio socket (vsock) interface on port 2000. No network setup or additional configuration is required. When a VM sends a request, VComLink routes it to the appropriate service handler based on the target channel specified in the message. Each request and response pair is handled independently, which simplifies concurrency and improves reliability. Communication between the VM and VComLink stays within the host kernel space, avoiding the overhead and exposure of traditional TCP/IP networking. VComLink communication framework diagram showing message routing between VMs and EVE-OS host services over vsock.

Key Features

Available Channels

TPM service channel

The TPM channel lets VMs invoke cryptographic operations on the hardware TPM hosted by EVE-OS. All communication uses Protocol Buffers (protobuf) to define request and response message structures. Example operations available through the TPM channel:
  • Retrieving a TPM-stored public key.
  • Signing data with a hardware-backed key.
  • Performing remote attestation via credential activation.
  • Reading non-volatile TPM memory.
  • Certifying a TPM key for integrity validation.
VComLink is designed for application developers building workloads that need access to host TPM capabilities from inside a VM. Because communication uses protobuf over HTTP on vsock, you can implement a client in any language that supports protobuf and vsock socket connections. To get started:
  1. Review the VComLink .proto API definition files in the EVE-OS repository to understand the message structure for each supported channel.
  2. Generate protobuf client stubs in your preferred language. Go and Python bindings are available in the repository.
  3. Implement your VM application using the generated stubs to send requests over vsock to port 2000 on the host CID.

Example: retrieve a TPM public key (Python)

The following Python example sends a TpmRequestGetPub message over HTTP on vsock to request the public part of a TPM key from the VComLink TPM service channel.
Sample output:

Next Steps

EVE-OS Virtual TPM

Use vTPM when your VM workload needs a complete, dedicated TPM 2.0 device.

Overview of the TPM in EVE-OS

Background on how EVE-OS uses the physical TPM for platform security.

Deploy an Application Instance

Deploy a VM workload that uses VComLink.