refactor(attestation): reject swtpm measurement

Author: kvinwang

docs/tutorials/attestation-verification.md

@@ -254,7 +254,7 @@ cat /var/lib/dstack/images/dstack-0.5.7/metadata.json | jq .
 # Install QEMU build dependencies
 sudo apt-get update
 sudo apt-get install -y git libslirp-dev python3-pip ninja-build \
-  pkg-config libglib2.0-dev build-essential flex bison swtpm
+  pkg-config libglib2.0-dev build-essential flex bison
 
 # Clone the custom QEMU fork
 cd ~/dstack

docs/tutorials/kms-build-configuration.md

@@ -378,10 +378,9 @@ FROM dstacktee/dstack-kms@sha256:11ac59f524a22462ccd2152219b0bec48a28ceb734e3250
 FROM ubuntu:24.04
 
 # Install runtime dependencies
-# The QEMU libraries are required by dstack-acpi-tables. swtpm is used when
-# reconstructing ACPI tables for VMs that attached a QEMU TPM device.
+# libglib2.0-0t64, libpixman-1-0, and libslirp0 are required by dstack-acpi-tables (QEMU binary)
 RUN apt-get update && \
-    apt-get install -y ca-certificates curl libglib2.0-0t64 libpixman-1-0 libslirp0 swtpm && \
+    apt-get install -y ca-certificates curl libglib2.0-0t64 libpixman-1-0 libslirp0 && \
     rm -rf /var/lib/apt/lists/*
 
 # Install Node.js 20.x for auth-eth

dstack/dstack-mr/cli/src/main.rs

@@ -76,7 +76,7 @@ struct MachineConfig {
 
     /// Attach a QEMU tpm-tis device backed by swtpm
     #[arg(long, default_value = "false")]
-    qemu_swtpm: bool,
+    swtpm: bool,
 
     /// Disable hotplug
     #[arg(long, default_value = "false")]
@@ -147,7 +147,7 @@ fn main() -> Result<()> {
                 .num_nvswitches(config.num_nvswitches)
                 .num_nics(config.num_nics)
                 .num_verity_volumes(config.num_verity_volumes)
-                .qemu_swtpm(config.qemu_swtpm)
+                .swtpm(config.swtpm)
                 .hotplug_off(config.hotplug_off)
                 .root_verity(config.root_verity)
                 .maybe_qemu_version(config.qemu_version.clone())

dstack/dstack-mr/src/acpi.rs

@@ -6,74 +6,14 @@
 //! translated from an original Go implementation.
 
 use anyhow::{bail, Context, Result};
-use fs_err as fs;
 use log::debug;
 use scale::Decode;
-use std::os::unix::fs::FileTypeExt;
-use std::path::PathBuf;
-use std::process::{Child, Command, Stdio};
-use std::sync::atomic::{AtomicU64, Ordering};
-use std::thread;
-use std::time::Duration;
+use std::process::Command;
 
 use crate::Machine;
 
 const LDR_LENGTH: usize = 4096;
 const FIXED_STRING_LEN: usize = 56;
-static SWTPM_ID: AtomicU64 = AtomicU64::new(0);
-
-struct SwtpmGuard {
-    child: Child,
-    state_dir: PathBuf,
-    socket: PathBuf,
-}
-
-impl Drop for SwtpmGuard {
-    fn drop(&mut self) {
-        let _ = self.child.kill();
-        let _ = self.child.wait();
-        let _ = fs::remove_dir_all(&self.state_dir);
-    }
-}
-
-fn start_measurement_swtpm() -> Result<SwtpmGuard> {
-    let id = SWTPM_ID.fetch_add(1, Ordering::Relaxed);
-    let state_dir =
-        std::env::temp_dir().join(format!("dstack-mr-swtpm-{}-{id}", std::process::id()));
-    fs::create_dir_all(&state_dir).context("failed to create measurement swtpm state directory")?;
-    let socket = state_dir.join("swtpm.sock");
-    let child = Command::new("swtpm")
-        .args(["socket", "--tpm2", "--tpmstate"])
-        .arg(format!("dir={}", state_dir.display()))
-        .arg("--ctrl")
-        .arg(format!("type=unixio,path={}", socket.display()))
-        .args(["--flags", "startup-clear"])
-        .stdin(Stdio::null())
-        .stdout(Stdio::null())
-        .stderr(Stdio::null())
-        .spawn()
-        .inspect_err(|_| {
-            let _ = fs::remove_dir_all(&state_dir);
-        })
-        .context("failed to start swtpm for ACPI measurement")?;
-    let mut guard = SwtpmGuard {
-        child,
-        state_dir,
-        socket,
-    };
-
-    for _ in 0..100 {
-        if fs::metadata(&guard.socket).is_ok_and(|metadata| metadata.file_type().is_socket()) {
-            return Ok(guard);
-        }
-        if guard.child.try_wait()?.is_some() {
-            bail!("measurement swtpm exited before its socket was ready");
-        }
-        thread::sleep(Duration::from_millis(10));
-    }
-    bail!("timed out waiting for measurement swtpm socket")
-}
-
 #[derive(Debug, Clone)]
 pub struct Tables {
     pub tables: Vec<u8>,
@@ -83,6 +23,9 @@ pub struct Tables {
 
 impl Machine<'_> {
     fn create_tables(&self) -> Result<Vec<u8>> {
+        if self.swtpm {
+            bail!("swtpm measurement is not supported");
+        }
         if self.cpu_count == 0 {
             bail!("cpuCount must be greater than 0");
         }
@@ -136,18 +79,6 @@ impl Machine<'_> {
                 .arg(format!("virtio-net-pci,netdev=net{i}"));
         }
 
-        let swtpm = self.qemu_swtpm.then(start_measurement_swtpm).transpose()?;
-        if let Some(swtpm) = &swtpm {
-            cmd.arg("-chardev")
-                .arg(format!("socket,id=chrtpm,path={}", swtpm.socket.display()))
-                .args([
-                    "-tpmdev",
-                    "emulator,id=tpm0,chardev=chrtpm",
-                    "-device",
-                    "tpm-tis,tpmdev=tpm0",
-                ]);
-        }
-
         cmd.args([
             "-object",
             "tdx-guest,id=tdx",

dstack/dstack-mr/src/machine.rs

@@ -38,7 +38,7 @@ pub struct Machine<'a> {
     pub num_verity_volumes: u32,
     /// Whether QEMU attaches a tpm-tis device backed by swtpm.
     #[builder(default)]
-    pub qemu_swtpm: bool,
+    pub swtpm: bool,
     pub hotplug_off: bool,
     pub root_verity: bool,
     #[builder(default)]

dstack/dstack-mr/src/tdx.rs

@@ -84,7 +84,7 @@ fn select_mrtd(measurement: &TdxOsImageMeasurement, vm_config: &VmConfig) -> Res
         .num_gpus(vm_config.num_gpus)
         .num_nics(vm_config.num_nics)
         .num_verity_volumes(vm_config.num_verity_volumes)
-        .qemu_swtpm(vm_config.qemu_swtpm)
+        .swtpm(vm_config.swtpm)
         .num_nvswitches(vm_config.num_nvswitches)
         .host_share_mode(vm_config.host_share_mode.clone())
         .ovmf_variant(measurement.tdvf.ovmf_variant)
@@ -477,7 +477,7 @@ pub fn tdx_measurements_for_image_dir_without_rtmr0(
         .num_gpus(vm_config.num_gpus)
         .num_nics(vm_config.num_nics)
         .num_verity_volumes(vm_config.num_verity_volumes)
-        .qemu_swtpm(vm_config.qemu_swtpm)
+        .swtpm(vm_config.swtpm)
         .num_nvswitches(vm_config.num_nvswitches)
         .host_share_mode(vm_config.host_share_mode.clone())
         .ovmf_variant(ovmf_variant)
@@ -575,7 +575,7 @@ pub fn tdx_measurements_for_image_dir_with_acpi_hashes(
         .num_gpus(vm_config.num_gpus)
         .num_nics(vm_config.num_nics)
         .num_verity_volumes(vm_config.num_verity_volumes)
-        .qemu_swtpm(vm_config.qemu_swtpm)
+        .swtpm(vm_config.swtpm)
         .num_nvswitches(vm_config.num_nvswitches)
         .host_share_mode(vm_config.host_share_mode.clone())
         .ovmf_variant(ovmf_variant)

dstack/dstack-types/src/lib.rs

@@ -1078,7 +1078,7 @@ pub struct VmConfig {
     /// Whether QEMU attaches a software TPM device. The TPM changes the ACPI
     /// table layout and must therefore be included in TDX measurement inputs.
     #[serde(default, skip_serializing_if = "is_false")]
-    pub qemu_swtpm: bool,
+    pub swtpm: bool,
     #[serde(default)]
     pub hotplug_off: bool,
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -2131,15 +2131,15 @@ mod vm_config_device_count_tests {
     }
 
     #[test]
-    fn qemu_swtpm_is_serialized_only_when_enabled() {
+    fn swtpm_is_serialized_only_when_enabled() {
         let mut cfg: VmConfig = serde_json::from_value(legacy_json()).unwrap();
         let serialized = serde_json::to_value(&cfg).unwrap();
-        assert!(serialized.get("qemu_swtpm").is_none());
+        assert!(serialized.get("swtpm").is_none());
 
-        cfg.qemu_swtpm = true;
+        cfg.swtpm = true;
         let serialized = serde_json::to_value(&cfg).unwrap();
         assert_eq!(
-            serialized.get("qemu_swtpm").and_then(|v| v.as_bool()),
+            serialized.get("swtpm").and_then(|v| v.as_bool()),
             Some(true)
         );
     }

dstack/kms/dstack-app/builder/Dockerfile

@@ -44,8 +44,7 @@ RUN ./pin-packages.sh ./qemu-pinned-packages.txt && \
     python3-sphinx-rtd-theme \
     build-essential \
     flex \
-    bison \
-    swtpm && \
+    bison && \
     rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/ldconfig/aux-cache
 RUN git clone https://github.com/kvinwang/qemu-tdx.git --depth 1 --branch dstack-qemu-9.2.1 --single-branch && \
     cd qemu-tdx && git fetch --depth 1 origin ${QEMU_REV} && \

dstack/kms/dstack-app/builder/shared/qemu-pinned-packages.txt

@@ -159,7 +159,6 @@ libtinfo6:amd64=6.4-4
 libtirpc-common=1.3.3+ds-1
 libtirpc-dev:amd64=1.3.3+ds-1
 libtirpc3:amd64=1.3.3+ds-1
-libtpms0:amd64=0.9.2-3.1+deb12u1
 libtsan2:amd64=12.2.0-14+deb12u1
 libubsan1:amd64=12.2.0-14+deb12u1
 libudev1:amd64=252.38-1~deb12u1
@@ -224,8 +223,6 @@ sed=4.9-1
 sgml-base=1.31
 sphinx-common=5.3.0-4
 sphinx-rtd-theme-common=1.2.0+dfsg-1
-swtpm-libs:amd64=0.7.1-1.3
-swtpm=0.7.1-1.3
 sysvinit-utils=3.06-4
 tar=1.34+dfsg-1.2+deb12u1
 tzdata=2025b-0+deb12u1

dstack/verifier/builder/Dockerfile

@@ -76,7 +76,6 @@ RUN ./pin-packages.sh ./pinned-packages.txt && \
     curl \
     libglib2.0-0 \
     libslirp0 \
-    swtpm \
     && rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/ldconfig/aux-cache
 COPY --from=verifier-builder /build/repo/dstack/target/x86_64-unknown-linux-musl/release/dstack-verifier /usr/local/bin/dstack-verifier
 COPY --from=verifier-builder /build/.GIT_REV /etc/