feat(attestation): measure QEMU swtpm device

Signed-off-by: Kevin Wang <wy721@qq.com>

Author: kvinwang

docs/tutorials/attestation-verification.md

@@ -254,7 +254,7 @@ cat /var/lib/dstack/images/dstack-0.5.7/metadata.json | jq .
 # Install QEMU build dependencies
 sudo apt-get update
 sudo apt-get install -y git libslirp-dev python3-pip ninja-build \
-  pkg-config libglib2.0-dev build-essential flex bison
+  pkg-config libglib2.0-dev build-essential flex bison swtpm
 
 # Clone the custom QEMU fork
 cd ~/dstack

docs/tutorials/kms-build-configuration.md

@@ -378,9 +378,10 @@ FROM dstacktee/dstack-kms@sha256:11ac59f524a22462ccd2152219b0bec48a28ceb734e3250
 FROM ubuntu:24.04
 
 # Install runtime dependencies
-# libglib2.0-0t64, libpixman-1-0, and libslirp0 are required by dstack-acpi-tables (QEMU binary)
+# The QEMU libraries are required by dstack-acpi-tables. swtpm is used when
+# reconstructing ACPI tables for VMs that attached a QEMU TPM device.
 RUN apt-get update && \
-    apt-get install -y ca-certificates curl libglib2.0-0t64 libpixman-1-0 libslirp0 && \
+    apt-get install -y ca-certificates curl libglib2.0-0t64 libpixman-1-0 libslirp0 swtpm && \
     rm -rf /var/lib/apt/lists/*
 
 # Install Node.js 20.x for auth-eth

dstack/dstack-mr/cli/src/main.rs

@@ -74,6 +74,10 @@ struct MachineConfig {
     #[arg(long, default_value = "0")]
     num_verity_volumes: u32,
 
+    /// Attach a QEMU tpm-tis device backed by swtpm
+    #[arg(long, default_value = "false")]
+    qemu_swtpm: bool,
+
     /// Disable hotplug
     #[arg(long, default_value = "false")]
     hotplug_off: Bool,
@@ -143,6 +147,7 @@ fn main() -> Result<()> {
                 .num_nvswitches(config.num_nvswitches)
                 .num_nics(config.num_nics)
                 .num_verity_volumes(config.num_verity_volumes)
+                .qemu_swtpm(config.qemu_swtpm)
                 .hotplug_off(config.hotplug_off)
                 .root_verity(config.root_verity)
                 .maybe_qemu_version(config.qemu_version.clone())

dstack/dstack-mr/src/acpi.rs

@@ -8,11 +8,70 @@
 use anyhow::{bail, Context, Result};
 use log::debug;
 use scale::Decode;
+use std::os::unix::fs::FileTypeExt;
+use std::path::PathBuf;
+use std::process::{Child, Command, Stdio};
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::thread;
+use std::time::Duration;
 
 use crate::Machine;
 
 const LDR_LENGTH: usize = 4096;
 const FIXED_STRING_LEN: usize = 56;
+static SWTPM_ID: AtomicU64 = AtomicU64::new(0);
+
+struct SwtpmGuard {
+    child: Child,
+    state_dir: PathBuf,
+    socket: PathBuf,
+}
+
+impl Drop for SwtpmGuard {
+    fn drop(&mut self) {
+        let _ = self.child.kill();
+        let _ = self.child.wait();
+        let _ = fs::remove_dir_all(&self.state_dir);
+    }
+}
+
+fn start_measurement_swtpm() -> Result<SwtpmGuard> {
+    let id = SWTPM_ID.fetch_add(1, Ordering::Relaxed);
+    let state_dir =
+        std::env::temp_dir().join(format!("dstack-mr-swtpm-{}-{id}", std::process::id()));
+    fs::create_dir_all(&state_dir).context("failed to create measurement swtpm state directory")?;
+    let socket = state_dir.join("swtpm.sock");
+    let child = Command::new("swtpm")
+        .args(["socket", "--tpm2", "--tpmstate"])
+        .arg(format!("dir={}", state_dir.display()))
+        .arg("--ctrl")
+        .arg(format!("type=unixio,path={}", socket.display()))
+        .args(["--flags", "startup-clear"])
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .spawn()
+        .inspect_err(|_| {
+            let _ = fs::remove_dir_all(&state_dir);
+        })
+        .context("failed to start swtpm for ACPI measurement")?;
+    let mut guard = SwtpmGuard {
+        child,
+        state_dir,
+        socket,
+    };
+
+    for _ in 0..100 {
+        if fs::metadata(&guard.socket).is_ok_and(|metadata| metadata.file_type().is_socket()) {
+            return Ok(guard);
+        }
+        if guard.child.try_wait()?.is_some() {
+            bail!("measurement swtpm exited before its socket was ready");
+        }
+        thread::sleep(Duration::from_millis(10));
+    }
+    bail!("timed out waiting for measurement swtpm socket")
+}
 
 #[derive(Debug, Clone)]
 pub struct Tables {
@@ -33,7 +92,7 @@ impl Machine<'_> {
         let shared_dir = "/bin";
 
         // Prepare the command arguments
-        let mut cmd = std::process::Command::new("dstack-acpi-tables");
+        let mut cmd = Command::new("dstack-acpi-tables");
         cmd.args([
             "-cpu",
             "qemu64",
@@ -76,6 +135,18 @@ impl Machine<'_> {
                 .arg(format!("virtio-net-pci,netdev=net{i}"));
         }
 
+        let swtpm = self.qemu_swtpm.then(start_measurement_swtpm).transpose()?;
+        if let Some(swtpm) = &swtpm {
+            cmd.arg("-chardev")
+                .arg(format!("socket,id=chrtpm,path={}", swtpm.socket.display()))
+                .args([
+                    "-tpmdev",
+                    "emulator,id=tpm0,chardev=chrtpm",
+                    "-device",
+                    "tpm-tis,tpmdev=tpm0",
+                ]);
+        }
+
         cmd.args([
             "-object",
             "tdx-guest,id=tdx",

dstack/dstack-mr/src/machine.rs

@@ -36,6 +36,9 @@ pub struct Machine<'a> {
     /// Number of virtio-blk verity volumes attached before the NICs.
     #[builder(default)]
     pub num_verity_volumes: u32,
+    /// Whether QEMU attaches a tpm-tis device backed by swtpm.
+    #[builder(default)]
+    pub qemu_swtpm: bool,
     pub hotplug_off: bool,
     pub root_verity: bool,
     #[builder(default)]

dstack/dstack-mr/src/tdx.rs

@@ -84,6 +84,7 @@ fn select_mrtd(measurement: &TdxOsImageMeasurement, vm_config: &VmConfig) -> Res
         .num_gpus(vm_config.num_gpus)
         .num_nics(vm_config.num_nics)
         .num_verity_volumes(vm_config.num_verity_volumes)
+        .qemu_swtpm(vm_config.qemu_swtpm)
         .num_nvswitches(vm_config.num_nvswitches)
         .host_share_mode(vm_config.host_share_mode.clone())
         .ovmf_variant(measurement.tdvf.ovmf_variant)
@@ -476,6 +477,7 @@ pub fn tdx_measurements_for_image_dir_without_rtmr0(
         .num_gpus(vm_config.num_gpus)
         .num_nics(vm_config.num_nics)
         .num_verity_volumes(vm_config.num_verity_volumes)
+        .qemu_swtpm(vm_config.qemu_swtpm)
         .num_nvswitches(vm_config.num_nvswitches)
         .host_share_mode(vm_config.host_share_mode.clone())
         .ovmf_variant(ovmf_variant)
@@ -573,6 +575,7 @@ pub fn tdx_measurements_for_image_dir_with_acpi_hashes(
         .num_gpus(vm_config.num_gpus)
         .num_nics(vm_config.num_nics)
         .num_verity_volumes(vm_config.num_verity_volumes)
+        .qemu_swtpm(vm_config.qemu_swtpm)
         .num_nvswitches(vm_config.num_nvswitches)
         .host_share_mode(vm_config.host_share_mode.clone())
         .ovmf_variant(ovmf_variant)

dstack/dstack-types/src/lib.rs

@@ -1033,6 +1033,10 @@ fn is_zero(n: &u32) -> bool {
     *n == 0
 }
 
+fn is_false(value: &bool) -> bool {
+    !value
+}
+
 #[derive(Deserialize, Serialize, Debug, Clone)]
 pub struct VmConfig {
     #[serde(with = "hex_bytes", default)]
@@ -1071,6 +1075,10 @@ pub struct VmConfig {
     /// changes the measured ACPI/DSDT layout.
     #[serde(default, skip_serializing_if = "is_zero")]
     pub num_verity_volumes: u32,
+    /// Whether QEMU attaches a software TPM device. The TPM changes the ACPI
+    /// table layout and must therefore be included in TDX measurement inputs.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub qemu_swtpm: bool,
     #[serde(default)]
     pub hotplug_off: bool,
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -2121,4 +2129,18 @@ mod vm_config_device_count_tests {
             Some(2)
         );
     }
+
+    #[test]
+    fn qemu_swtpm_is_serialized_only_when_enabled() {
+        let mut cfg: VmConfig = serde_json::from_value(legacy_json()).unwrap();
+        let serialized = serde_json::to_value(&cfg).unwrap();
+        assert!(serialized.get("qemu_swtpm").is_none());
+
+        cfg.qemu_swtpm = true;
+        let serialized = serde_json::to_value(&cfg).unwrap();
+        assert_eq!(
+            serialized.get("qemu_swtpm").and_then(|v| v.as_bool()),
+            Some(true)
+        );
+    }
 }

dstack/kms/dstack-app/builder/Dockerfile

@@ -44,7 +44,8 @@ RUN ./pin-packages.sh ./qemu-pinned-packages.txt && \
     python3-sphinx-rtd-theme \
     build-essential \
     flex \
-    bison && \
+    bison \
+    swtpm && \
     rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/ldconfig/aux-cache
 RUN git clone https://github.com/kvinwang/qemu-tdx.git --depth 1 --branch dstack-qemu-9.2.1 --single-branch && \
     cd qemu-tdx && git fetch --depth 1 origin ${QEMU_REV} && \

dstack/kms/dstack-app/builder/shared/qemu-pinned-packages.txt

@@ -159,6 +159,7 @@ libtinfo6:amd64=6.4-4
 libtirpc-common=1.3.3+ds-1
 libtirpc-dev:amd64=1.3.3+ds-1
 libtirpc3:amd64=1.3.3+ds-1
+libtpms0:amd64=0.9.2-3.1+deb12u1
 libtsan2:amd64=12.2.0-14+deb12u1
 libubsan1:amd64=12.2.0-14+deb12u1
 libudev1:amd64=252.38-1~deb12u1
@@ -223,6 +224,8 @@ sed=4.9-1
 sgml-base=1.31
 sphinx-common=5.3.0-4
 sphinx-rtd-theme-common=1.2.0+dfsg-1
+swtpm-libs:amd64=0.7.1-1.3
+swtpm=0.7.1-1.3
 sysvinit-utils=3.06-4
 tar=1.34+dfsg-1.2+deb12u1
 tzdata=2025b-0+deb12u1

dstack/verifier/builder/Dockerfile

@@ -76,6 +76,7 @@ RUN ./pin-packages.sh ./pinned-packages.txt && \
     curl \
     libglib2.0-0 \
     libslirp0 \
+    swtpm \
     && rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/ldconfig/aux-cache
 COPY --from=verifier-builder /build/repo/dstack/target/x86_64-unknown-linux-musl/release/dstack-verifier /usr/local/bin/dstack-verifier
 COPY --from=verifier-builder /build/.GIT_REV /etc/