refactor(vmm): allow swtpm for all Dstack VMs

Author: kvinwang

CONTRIBUTING.md

@@ -66,7 +66,7 @@ To exercise persistent TPM-backed app keys as well, install `swtpm` on the VMM
 host and select `key_provider=tpm` in the VMM console (or pass `--key-provider
 tpm` in tooling that exposes the compose option). The VMM keeps the software
 TPM state in the VM work directory so that seal/unseal survives guest restarts.
-This development provider is available only to no-TEE development images.
+The software TPM is host-controlled and does not provide hardware isolation.
 
 The simulator package is installed only in development images. This mode
 provides no hardware isolation and must never be used with production

docs/security/cvm-boundaries.md

@@ -44,7 +44,7 @@ This is the main configuration file for the application in JSON format:
 | init_script | 0.5.5 | string | Bash script that executed prior to dockerd startup |
 | storage_fs | 0.5.5 | string | Filesystem type for the data disk of the CVM. Supported values: "zfs", "ext4". default to "zfs". **ZFS:** Ensures filesystem integrity with built-in data protection features. **ext4:** Provides better performance for database applications with lower overhead and faster I/O operations, but no strong integrity protection. |
 | swap_size | 0.5.5 | string/integer | The linux swap size. default to 0. Can be in byte or human-readable format (e.g., "1G", "256M"). |
-| key_provider | 0.5.6 | string | Key provider type. Supported values: "none", "kms", "local", "tpm". GCP vTPM and AWS EC2 NitroTPM are part of their platform trust models. The Dstack development platform can use VMM-managed swtpm to exercise seal/unseal and restart persistence, but it offers no protection against the host and is intentionally not accepted by remote verifiers. |
+| key_provider | 0.5.6 | string | Key provider type. Supported values: "none", "kms", "local", "tpm". GCP vTPM and AWS EC2 NitroTPM are part of their platform trust models. The Dstack platform can use VMM-managed swtpm for seal/unseal and restart persistence, but it offers no protection against the host and is intentionally not accepted by remote verifiers. |
 
 
 The hash of this file content is extended as the dstack `compose-hash` launch event. On TDX-family platforms the launch event is measured into RTMR3. On AWS NitroTPM it is measured into non-resettable SHA384 PCR14 before the `system-ready` launch boundary. Remote verifiers extract and replay this event during attestation.

dstack/vmm/src/app/qemu.rs

@@ -224,9 +224,6 @@ impl PreparedQemuLaunch {
         };
         let (swtpm_socket, swtpm_path) =
             if matches!(app_compose.key_provider(), KeyProviderKind::Tpm) {
-                if !vm.manifest.no_tee || !vm.image.info.is_dev {
-                    bail!("swtpm key provider is only available to no-TEE development VMs");
-                }
                 let swtpm_path = which::which("swtpm")
                     .context("tpm key provider requested but swtpm is not installed")?;
                 let state_dir = workdir.swtpm_state_dir();