feat(tdx-attest): Add MUSL libc support for TDX attestation

Enable building with x86_64-unknown-linux-musl target by:

1. Vendoring minimal Linux kernel headers that are missing from MUSL:
   - linux/vm_sockets.h: vsock address family and sockaddr_vm struct
   - linux/types.h: kernel type aliases (__u8, __u32, __u64, etc.)
   - linux/ioctl.h: redirect to MUSL's sys/ioctl.h

2. Updating cfg conditions to include MUSL (target_env = "musl")
   alongside glibc (target_env = "gnu")

3. Modifying build.rs to prioritize vendored headers via include path

This allows building statically-linked TDX attestation binaries using
MUSL, which is useful for containerized deployments and systems without
glibc.

Tested: cargo build --target x86_64-unknown-linux-musl -p tdx-attest

Author: kvinwang

tdx-attest-sys/build.rs

@@ -10,6 +10,7 @@ use std::path::PathBuf;
 fn main() {
     println!("cargo:rerun-if-changed=csrc/tdx_attest.c");
     println!("cargo:rerun-if-changed=csrc/qgs_msg_lib.cpp");
+    println!("cargo:rerun-if-changed=csrc/linux/vm_sockets.h");
     let output_path = PathBuf::from(env::var("OUT_DIR").expect("OUT_DIR not set"));
     bindgen::Builder::default()
         .header("bindings.h")
@@ -21,5 +22,8 @@ fn main() {
     cc::Build::new()
         .file("csrc/tdx_attest.c")
         .file("csrc/qgs_msg_lib.cpp")
+        // Add csrc to include path first so our vendored linux/vm_sockets.h is found
+        // before system headers (needed for MUSL builds)
+        .include("csrc")
         .compile("tdx_attest");
 }

tdx-attest-sys/csrc/linux/ioctl.h

@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Minimal vendored linux/ioctl.h for MUSL compatibility.
+ *
+ * This provides the _IO/_IOR/_IOW/_IOWR macros needed by tdx_attest.c
+ * MUSL provides sys/ioctl.h which already has these, so we just include that.
+ */
+
+#ifndef _LINUX_IOCTL_H
+#define _LINUX_IOCTL_H
+
+#include <sys/ioctl.h>
+
+#endif /* _LINUX_IOCTL_H */

tdx-attest-sys/csrc/linux/types.h

@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Minimal vendored linux/types.h for MUSL compatibility.
+ *
+ * Provides kernel-style type aliases (__u8, __u16, __u32, __u64)
+ * using standard C types from stdint.h.
+ */
+
+#ifndef _LINUX_TYPES_H
+#define _LINUX_TYPES_H
+
+#include <stdint.h>
+
+typedef uint8_t  __u8;
+typedef uint16_t __u16;
+typedef uint32_t __u32;
+typedef uint64_t __u64;
+
+typedef int8_t   __s8;
+typedef int16_t  __s16;
+typedef int32_t  __s32;
+typedef int64_t  __s64;
+
+/* Kernel-style sa_family_t if not already defined */
+#ifndef __kernel_sa_family_t
+typedef unsigned short __kernel_sa_family_t;
+#endif
+
+#endif /* _LINUX_TYPES_H */

tdx-attest-sys/csrc/linux/vm_sockets.h

@@ -0,0 +1,45 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Minimal vendored version of linux/vm_sockets.h for MUSL compatibility.
+ *
+ * This header provides the minimal definitions needed by tdx_attest.c
+ * without pulling in glibc-specific headers that conflict with MUSL.
+ *
+ * Based on: Linux kernel include/uapi/linux/vm_sockets.h
+ * Original copyright: VMware, Inc.
+ */
+
+#ifndef _VM_SOCKETS_H
+#define _VM_SOCKETS_H
+
+#include <stdint.h>
+#include <sys/socket.h>
+
+/* AF_VSOCK = PF_VSOCK = 40 */
+#ifndef AF_VSOCK
+#define AF_VSOCK 40
+#endif
+
+/* Use this as the destination CID in an address when referring to the host
+ * (any process other than the hypervisor).
+ */
+#define VMADDR_CID_HOST 2
+
+/* Address structure for vSockets. The address family should be set to
+ * AF_VSOCK.
+ */
+struct sockaddr_vm {
+    sa_family_t svm_family;           /* Address family: AF_VSOCK */
+    unsigned short svm_reserved1;     /* Reserved, must be zero */
+    unsigned int svm_port;            /* Port, in host byte order */
+    unsigned int svm_cid;             /* Context ID (CID) */
+    uint8_t svm_flags;                /* Flags */
+    unsigned char svm_zero[sizeof(struct sockaddr) -
+                           sizeof(sa_family_t) -
+                           sizeof(unsigned short) -
+                           sizeof(unsigned int) -
+                           sizeof(unsigned int) -
+                           sizeof(uint8_t)];
+};
+
+#endif /* _VM_SOCKETS_H */

tdx-attest/Cargo.toml

@@ -23,7 +23,8 @@ fs-err.workspace = true
 serde_json = { workspace = true, features = ["alloc"] }
 sha2.workspace = true
 
-[target.'cfg(all(target_os = "linux", target_arch = "x86_64", target_env = "gnu"))'.dependencies]
+# Linux x86_64 with glibc or musl
+[target.'cfg(all(target_os = "linux", target_arch = "x86_64"))'.dependencies]
 tdx-attest-sys.workspace = true
 
 [dev-dependencies]

tdx-attest/src/lib.rs

@@ -2,15 +2,16 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 
-#[cfg(all(target_os = "linux", target_arch = "x86_64", target_env = "gnu"))]
+// Linux x86_64 with glibc or musl
+#[cfg(all(target_os = "linux", target_arch = "x86_64"))]
 pub use linux::*;
-#[cfg(all(target_os = "linux", target_arch = "x86_64", target_env = "gnu"))]
+#[cfg(all(target_os = "linux", target_arch = "x86_64"))]
 mod linux;
 
-#[cfg(not(all(target_os = "linux", target_arch = "x86_64", target_env = "gnu")))]
+// Fallback for non-Linux/non-x86_64 platforms (dummy implementation)
+#[cfg(not(all(target_os = "linux", target_arch = "x86_64")))]
 pub use dummy::*;
-
-#[cfg(not(all(target_os = "linux", target_arch = "x86_64", target_env = "gnu")))]
+#[cfg(not(all(target_os = "linux", target_arch = "x86_64")))]
 mod dummy;
 
 pub use cc_eventlog as eventlog;