fix(verity): measure attached volume device count

Author: kvinwang

dstack/dstack-mr/cli/src/main.rs

@@ -70,6 +70,10 @@ struct MachineConfig {
     #[arg(long, default_value = "1")]
     num_nics: u32,
 
+    /// Number of virtio-blk verity volumes
+    #[arg(long, default_value = "0")]
+    num_verity_volumes: u32,
+
     /// Disable hotplug
     #[arg(long, default_value = "false")]
     hotplug_off: Bool,
@@ -138,6 +142,7 @@ fn main() -> Result<()> {
                 .num_gpus(config.num_gpus)
                 .num_nvswitches(config.num_nvswitches)
                 .num_nics(config.num_nics)
+                .num_verity_volumes(config.num_verity_volumes)
                 .hotplug_off(config.hotplug_off)
                 .root_verity(config.root_verity)
                 .maybe_qemu_version(config.qemu_version.clone())

dstack/dstack-mr/src/acpi.rs

@@ -57,6 +57,16 @@ impl Machine<'_> {
             "virtio-blk-pci,drive=hd1",
         ]);
 
+        // Verity volumes are emitted after hd1 and before networking, matching
+        // dstack-vmm's QEMU device order.
+        for i in 0..self.num_verity_volumes {
+            let id = format!("vol{i}");
+            cmd.arg("-drive").arg(format!(
+                "file={dummy_disk},if=none,id={id},format=raw,readonly=on"
+            ));
+            cmd.arg("-device").arg(format!("virtio-blk-pci,drive={id}"));
+        }
+
         // One virtio-net-pci per NIC. Emitted at the same position and, for the
         // default single-NIC case, with the exact same args as the previous
         // hardcoded layout so RTMR0 stays byte-for-byte unchanged.

dstack/dstack-mr/src/machine.rs

@@ -33,6 +33,9 @@ pub struct Machine<'a> {
     /// predate this field keep the historical single-NIC layout.
     #[builder(default = 1)]
     pub num_nics: u32,
+    /// Number of virtio-blk verity volumes attached before the NICs.
+    #[builder(default)]
+    pub num_verity_volumes: u32,
     pub hotplug_off: bool,
     pub root_verity: bool,
     #[builder(default)]

dstack/dstack-mr/src/tdx.rs

@@ -83,6 +83,7 @@ fn select_mrtd(measurement: &TdxOsImageMeasurement, vm_config: &VmConfig) -> Res
         .hugepages(vm_config.hugepages)
         .num_gpus(vm_config.num_gpus)
         .num_nics(vm_config.num_nics)
+        .num_verity_volumes(vm_config.num_verity_volumes)
         .num_nvswitches(vm_config.num_nvswitches)
         .host_share_mode(vm_config.host_share_mode.clone())
         .ovmf_variant(measurement.tdvf.ovmf_variant)
@@ -474,6 +475,7 @@ pub fn tdx_measurements_for_image_dir_without_rtmr0(
         .hugepages(vm_config.hugepages)
         .num_gpus(vm_config.num_gpus)
         .num_nics(vm_config.num_nics)
+        .num_verity_volumes(vm_config.num_verity_volumes)
         .num_nvswitches(vm_config.num_nvswitches)
         .host_share_mode(vm_config.host_share_mode.clone())
         .ovmf_variant(ovmf_variant)
@@ -570,6 +572,7 @@ pub fn tdx_measurements_for_image_dir_with_acpi_hashes(
         .hugepages(vm_config.hugepages)
         .num_gpus(vm_config.num_gpus)
         .num_nics(vm_config.num_nics)
+        .num_verity_volumes(vm_config.num_verity_volumes)
         .num_nvswitches(vm_config.num_nvswitches)
         .host_share_mode(vm_config.host_share_mode.clone())
         .ovmf_variant(ovmf_variant)

dstack/dstack-types/src/lib.rs

@@ -792,6 +792,10 @@ fn is_default_num_nics(n: &u32) -> bool {
     *n == default_num_nics()
 }
 
+fn is_zero(n: &u32) -> bool {
+    *n == 0
+}
+
 #[derive(Deserialize, Serialize, Debug, Clone)]
 pub struct VmConfig {
     #[serde(with = "hex_bytes", default)]
@@ -825,6 +829,11 @@ pub struct VmConfig {
         skip_serializing_if = "is_default_num_nics"
     )]
     pub num_nics: u32,
+    /// Number of read-only verity volume devices attached to the guest. Each
+    /// volume adds a virtio-blk PCI device before the NICs and therefore
+    /// changes the measured ACPI/DSDT layout.
+    #[serde(default, skip_serializing_if = "is_zero")]
+    pub num_verity_volumes: u32,
     #[serde(default)]
     pub hotplug_off: bool,
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -1819,7 +1828,7 @@ mod platform_tests {
 }
 
 #[cfg(test)]
-mod vm_config_num_nics_tests {
+mod vm_config_device_count_tests {
     use super::VmConfig;
 
     fn legacy_json() -> serde_json::Value {
@@ -1835,6 +1844,7 @@ mod vm_config_num_nics_tests {
     fn legacy_config_without_num_nics_defaults_to_one() {
         let cfg: VmConfig = serde_json::from_value(legacy_json()).unwrap();
         assert_eq!(cfg.num_nics, 1);
+        assert_eq!(cfg.num_verity_volumes, 0);
     }
 
     #[test]
@@ -1857,4 +1867,20 @@ mod vm_config_num_nics_tests {
         let serialized = serde_json::to_value(&cfg).unwrap();
         assert_eq!(serialized.get("num_nics").and_then(|v| v.as_u64()), Some(2));
     }
+
+    #[test]
+    fn verity_volume_count_is_serialized_only_when_nonzero() {
+        let mut cfg: VmConfig = serde_json::from_value(legacy_json()).unwrap();
+        let serialized = serde_json::to_value(&cfg).unwrap();
+        assert!(serialized.get("num_verity_volumes").is_none());
+
+        cfg.num_verity_volumes = 2;
+        let serialized = serde_json::to_value(&cfg).unwrap();
+        assert_eq!(
+            serialized
+                .get("num_verity_volumes")
+                .and_then(|v| v.as_u64()),
+            Some(2)
+        );
+    }
 }

dstack/verifier/src/verification.rs

@@ -341,6 +341,7 @@ impl CvmVerifier {
             .hugepages(vm_config.hugepages)
             .num_gpus(vm_config.num_gpus)
             .num_nics(vm_config.num_nics)
+            .num_verity_volumes(vm_config.num_verity_volumes)
             .num_nvswitches(vm_config.num_nvswitches)
             .host_share_mode(vm_config.host_share_mode.clone())
             .ovmf_variant(ovmf_variant)

dstack/vmm/src/app.rs

@@ -1400,6 +1400,7 @@ fn make_vm_config(
     // ACPI/DSDT layout and therefore RTMR0. Measure the interface count so the
     // verifier reconstructs the exact device layout.
     let num_nics = resolved_networks(manifest, &cfg.cvm).len() as u32;
+    let num_verity_volumes = manifest.volumes.len() as u32;
     let mut config = serde_json::to_value(dstack_types::VmConfig {
         os_image_hash,
         cpu_count: effective_vcpus,
@@ -1412,6 +1413,7 @@ fn make_vm_config(
         num_gpus: gpus.gpus.len() as u32,
         num_nvswitches: gpus.bridges.len() as u32,
         num_nics,
+        num_verity_volumes,
         host_share_mode: cfg.cvm.host_share_mode.clone(),
         hotplug_off: cfg.cvm.qemu_hotplug_off,
         image: Some(manifest.image.clone()),
@@ -1732,6 +1734,33 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    fn vm_measurement_config_includes_verity_volume_count() -> Result<()> {
+        let config = test_tdx_config()?;
+        let mut manifest = test_manifest(2048);
+        manifest.volumes = vec![
+            VmVolume {
+                source: "/volumes/a.img".into(),
+                read_only: true,
+            },
+            VmVolume {
+                source: "/volumes/b.img".into(),
+                read_only: true,
+            },
+        ];
+        let vm_config = make_vm_config(
+            &config,
+            &manifest,
+            &test_tdx_image(true),
+            &hex_of(0x22, 32),
+            None,
+            None,
+        )?;
+
+        assert_eq!(vm_config["num_verity_volumes"], 2);
+        Ok(())
+    }
+
     #[test]
     fn tdx_auto_variant_uses_legacy_for_low_non_2g_memory() -> Result<()> {
         let config = test_tdx_config()?;