fix(simulator): gate startup on host config

Signed-off-by: Kevin Wang <wy721@qq.com>

Author: kvinwang

docs/development-without-tee.md

@@ -99,6 +99,10 @@ collateral_base_url = "http://10.0.2.2:18088"
 exe = "/home/USER/.local/bin/supervisor"
 ```
 
+The VMM writes these settings to the guest's development-only
+`.tee-simulator.json`. The guest starts the simulator only when that file is
+present in the host share.
+
 Start the VMM from a stable working directory because its default API socket is
 relative to that directory:
 

dstack/dstack-util/src/host_shared.rs

@@ -8,6 +8,7 @@ use anyhow::{Context, Result};
 use clap::{Parser, Subcommand};
 use dstack_types::shared_filenames::HOST_SHARED_DISK_LABEL;
 use fs_err as fs;
+use tracing::{info, warn};
 
 #[derive(Parser)]
 pub struct HostSharedArgs {
@@ -64,15 +65,24 @@ pub fn mount_host_shared(mount_point: &Path) -> Result<()> {
         .with_context(|| format!("failed to create {}", mount_point.display()))?;
 
     if let Some(device) = find_disk_by_label(HOST_SHARED_DISK_LABEL) {
+        info!(device = %device.display(), "found host-shared disk");
         let status = Command::new("mount")
             .args(["-o", "ro"])
             .arg(&device)
             .arg(mount_point)
             .status()
             .with_context(|| format!("failed to run mount for {}", device.display()))?;
         if status.success() {
+            info!(mount_point = %mount_point.display(), "mounted host-shared disk");
             return Ok(());
         }
+        warn!(
+            device = %device.display(),
+            status = %status,
+            "failed to mount host-shared disk, falling back to 9p"
+        );
+    } else {
+        info!("host-shared disk not found, trying 9p");
     }
 
     let status = Command::new("mount")
@@ -91,6 +101,7 @@ pub fn mount_host_shared(mount_point: &Path) -> Result<()> {
         "failed to mount host-shared at {}",
         mount_point.display()
     );
+    info!(mount_point = %mount_point.display(), "mounted host-shared via 9p");
     Ok(())
 }
 

dstack/tee-simulator/src/main.rs

@@ -26,7 +26,8 @@ struct Args {
     #[arg(long)]
     platform: Option<TeeVariant>,
 
-    /// Development-only simulator config.
+    /// Development-only simulator config. The systemd unit overrides this
+    /// standalone default with its early-mounted runtime path.
     #[arg(long, default_value = "/dstack/.host-shared/.tee-simulator.json")]
     config: PathBuf,
 
@@ -220,9 +221,7 @@ mod tests {
             fs_err::write(
                 &path,
                 serde_json::json!({
-                    "kms_urls": [], "gateway_urls": [], "pccs_url": null,
-                    "docker_registry": null, "host_api_url": null, "vm_config": "{}",
-                "platform": name
+                    "platform": name
                 })
                 .to_string(),
             )

dstack/vmm/src/app.rs

@@ -1108,16 +1108,7 @@ impl App {
         )?;
         fs::write(shared_dir.join(SYS_CONFIG), &sys_config_str)
             .context("Failed to write vm config")?;
-        if let Some(mut simulator_config) = cfg.cvm.tee_simulator.clone() {
-            let sys_config: dstack_types::SysConfig = serde_json::from_str(&sys_config_str)?;
-            simulator_config.mr_config = sys_config.mr_config;
-            simulator_config.vm_config = Some(sys_config.vm_config);
-            fs::write(
-                shared_dir.join(TEE_SIMULATOR_CONFIG),
-                serde_json::to_vec(&simulator_config)?,
-            )
-            .context("Failed to write TEE simulator config")?;
-        }
+        sync_tee_simulator_config(&shared_dir, cfg.cvm.tee_simulator.as_ref(), &sys_config_str)?;
         Ok(())
     }
 
@@ -1253,6 +1244,27 @@ fn rotate_serial_log(work_dir: &VmWorkDir, max_bytes: u64) {
     }
 }
 
+fn sync_tee_simulator_config(
+    shared_dir: &Path,
+    simulator_config: Option<&dstack_types::TeeSimulatorConfig>,
+    sys_config: &str,
+) -> Result<()> {
+    let path = shared_dir.join(TEE_SIMULATOR_CONFIG);
+    let Some(simulator_config) = simulator_config else {
+        if path.exists() {
+            fs::remove_file(&path).context("failed to remove stale TEE simulator config")?;
+        }
+        return Ok(());
+    };
+
+    let sys_config: dstack_types::SysConfig = serde_json::from_str(sys_config)?;
+    let mut simulator_config = simulator_config.clone();
+    simulator_config.mr_config = sys_config.mr_config;
+    simulator_config.vm_config = Some(sys_config.vm_config);
+    fs::write(path, serde_json::to_vec(&simulator_config)?)
+        .context("failed to write TEE simulator config")
+}
+
 pub(crate) fn make_sys_config(
     cfg: &Config,
     manifest: &Manifest,
@@ -1474,6 +1486,40 @@ mod tests {
         hex::encode(vec![byte; len])
     }
 
+    #[test]
+    fn simulator_config_is_written_separately_with_measurement_inputs() -> Result<()> {
+        let dir = tempfile::tempdir()?;
+        let config = dstack_types::TeeSimulatorConfig {
+            platform: dstack_types::TeeVariant::DstackAmdSevSnp,
+            mock_attestation_seed: Some("11".repeat(32)),
+            collateral_base_url: Some("http://127.0.0.1:18088".into()),
+            ..Default::default()
+        };
+        let mr_config = r#"{"version":3}"#;
+        let vm_config = r#"{"image":"dev"}"#;
+        let sys_config = serde_json::json!({
+            "kms_urls": [],
+            "gateway_urls": [],
+            "vm_config": vm_config,
+            "mr_config": mr_config,
+        })
+        .to_string();
+
+        sync_tee_simulator_config(dir.path(), Some(&config), &sys_config)?;
+
+        let written: dstack_types::TeeSimulatorConfig =
+            serde_json::from_slice(&fs::read(dir.path().join(TEE_SIMULATOR_CONFIG))?)?;
+        assert_eq!(written.platform, config.platform);
+        assert_eq!(written.mock_attestation_seed, config.mock_attestation_seed);
+        assert_eq!(written.collateral_base_url, config.collateral_base_url);
+        assert_eq!(written.mr_config.as_deref(), Some(mr_config));
+        assert_eq!(written.vm_config.as_deref(), Some(vm_config));
+
+        sync_tee_simulator_config(dir.path(), None, &sys_config)?;
+        assert!(!dir.path().join(TEE_SIMULATOR_CONFIG).exists());
+        Ok(())
+    }
+
     #[test]
     fn gpu_config_has_gpus_only_when_resolved_gpu_list_is_non_empty() {
         assert!(!GpuConfig::default().has_gpus());

os/yocto/layers/meta-dstack/recipes-core/dstack-tee-simulator/files/dstack-tee-simulator.service

@@ -1,15 +1,11 @@
 [Unit]
-Description=dstack development TEE ABI simulator (TDX backend)
+Description=dstack development TEE ABI simulator
 Documentation=https://github.com/Dstack-TEE/dstack/blob/master/CONTRIBUTING.md
 Before=dstack-prepare.service
-ConditionPathExists=!/dev/tdx_guest
-ConditionPathExists=!/dev/sev-guest
 
 [Service]
 Type=notify
-ExecCondition=/bin/sh -c '! grep -qE "^(tdx_guest|sev_guest)" /sys/kernel/config/tsm/report/*/provider 2>/dev/null'
-ExecStartPre=/bin/mkdir -p /run/dstack/tee-simulator-host-shared
-ExecStartPre=/usr/bin/dstack-util host-shared mount --mount-point /run/dstack/tee-simulator-host-shared
+ExecCondition=/bin/sh -c '/usr/bin/dstack-util host-shared mount --mount-point /run/dstack/tee-simulator-host-shared && { test -f /run/dstack/tee-simulator-host-shared/.tee-simulator.json || { /usr/bin/dstack-util host-shared unmount --mount-point /run/dstack/tee-simulator-host-shared; exit 1; }; }'
 ExecStart=/usr/bin/dstack-tee-simulator --config /run/dstack/tee-simulator-host-shared/.tee-simulator.json
 ExecStartPost=/bin/systemctl set-environment DCAP_TDX_RTMR_SYSFS_PATH=/sys/kernel/config/tsm/report/com.intel.dcap/measurements DSTACK_CCEL_FILE=/sys/kernel/config/tsm/report/com.intel.dcap/ccel
 ExecStartPost=-/usr/bin/dstack-util host-shared unmount --mount-point /run/dstack/tee-simulator-host-shared