vmm: add per-VM swtpm key provider

[kvinwang]

Problem

The no-TEE development image can exercise the production guest setup path via the TEE ABI simulator, but it only has temporary app keys when no KMS/local SGX key provider is available. The VMM's existing key_provider=tpm support passes through a host hardware TPM and the guest rejects TPM provisioning on Platform::Dstack.

Changes

• replace VMM hardware TPM passthrough with a per-VM swtpm backend
• persist swtpm state under the VM work directory so seal/unseal survives guest restarts;
• run the existing dstack-vmm binary in a hidden vm-launcher mode as the single Supervisor-managed VM process;
• have the launcher start swtpm, wait for its socket, start QEMU, and keep both child lifecycles fail-closed;
• let VMM signal the launcher through Linux pidfd for graceful Stop/Remove without changing Supervisor;
• allow guest-side TPM seal/unseal on Platform::Dstack using the existing SHA-256 PCR 0/2/14 policy;
• keep the supported VMM console key-provider selector with tpm, and ensure TPM emits an empty provider ID;
• remove the unsupported legacy console_v0 route and file.

The remote attestation/verifier side is intentionally unchanged. It does not accept Dstack software-TPM evidence.

Process failure handling

• QEMU exit: launcher terminates and reaps swtpm before it exits;
• swtpm exit: launcher terminates and reaps QEMU, then exits with failure;
• VMM Stop/Remove: VMM sends SIGTERM to the launcher using pidfd; launcher gracefully stops both process groups and exits only after reaping them;
• graceful timeout: launcher sends SIGKILL to the remaining child process group;
• forced launcher death: QEMU and swtpm have PR_SET_PDEATHSIG=SIGKILL as a final fallback;
• stale socket: launcher removes it before startup and on exit;
• the swtpm socket is mode 0600 and owned by the configured QEMU user.

Safety

• production KMS/verifier trust policy is unchanged;
• software TPM state is host-controlled and is not presented as a hardware trust root.

Validation

• cargo check -p dstack-vmm -p tpm-attest
• cargo clippy -p dstack-vmm --all-targets -- -D warnings
• cargo test -p dstack-vmm --no-fail-fast
• cargo test -p tpm-attest
• launcher integration with real swtpm: verified socket readiness, SIGTERM graceful shutdown, and no surviving QEMU process

[Copilot]

Pull request overview

This PR updates the dstack-vmm no-TEE development VM path to support persistent TPM-backed app keys by running a per-VM swtpm backend (instead of hardware TPM passthrough), and wires that through the VMM lifecycle, UI, and documentation. This enables exercising seal/unseal + restart persistence on the Dstack dev platform while explicitly keeping remote attestation/verifier trust unchanged.

Changes:

• Add per-VM swtpm process management (state/socket under VM workdir), wait-for-socket gating before QEMU starts, and attach TPM via QEMU’s emulator backend.
• Update VMM lifecycle cleanup to stop/remove dependent supervisor processes associated with a VM.
• Update the VMM console UI and docs to reflect key_provider selection (kms|local|tpm|none) and Dstack dev-only swtpm semantics; expand TPM PCR policy support for Platform::Dstack in tpm-attest.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
dstack/vmm/src/console_v0.html	Replaces KMS/local checkboxes with a key_provider selector and updates payload serialization.
dstack/vmm/src/app/workdir.rs	Adds workdir helpers for swtpm state directory and socket path.
dstack/vmm/src/app/qemu.rs	Implements swtpm-backed TPM for dev no-TEE VMs and hooks it into QEMU launch.
dstack/vmm/src/app.rs	Adds dependent-process stop/remove logic so auxiliary processes follow VM lifecycle.
dstack/tpm-attest/src/lib.rs	Allows Dstack platform to use the existing SHA-256 PCR 0/2/14 policy and adds a test.
docs/security/cvm-boundaries.md	Documents Dstack dev swtpm behavior and clarifies it is not a remote trust root.
CONTRIBUTING.md	Documents how to use key_provider=tpm with swtpm for no-TEE dev images.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 15 changed files in this pull request and generated 2 comments.