feat(tdx-attest): Rewrite TDX attestation in pure Rust (#466)

* feat(tdx-attest): Add MUSL libc support for TDX attestation

Enable building with x86_64-unknown-linux-musl target by:

1. Vendoring minimal Linux kernel headers that are missing from MUSL:
   - linux/vm_sockets.h: vsock address family and sockaddr_vm struct
   - linux/types.h: kernel type aliases (__u8, __u32, __u64, etc.)
   - linux/ioctl.h: redirect to MUSL's sys/ioctl.h

2. Updating cfg conditions to include MUSL (target_env = "musl")
   alongside glibc (target_env = "gnu")

3. Modifying build.rs to prioritize vendored headers via include path

This allows building statically-linked TDX attestation binaries using
MUSL, which is useful for containerized deployments and systems without
glibc.

Tested: cargo build --target x86_64-unknown-linux-musl -p tdx-attest

* feat(tdx-attest): Rewrite TDX attestation in pure Rust

Implement TDX attestation without C library dependencies:

- get_quote: ConfigFS (Linux 6.7+) → VSock/QGS fallback
- extend_rtmr: sysfs → ioctl fallback
- get_report: ioctl via /dev/tdx_guest
- get_supported_att_key_ids: returns Intel TDQE UUID

Key changes:
- Add vsock crate for QGS protocol communication
- Probe availability before execution (separate NotSupported from errors)
- Include original error context in error messages
- Support both new dstack OS (ConfigFS/sysfs) and legacy 0.5.4 (VSock/ioctl)

Tested on:
- New dstack OS: ConfigFS for quote, sysfs for extend_rtmr
- dstack 0.5.4: VSock for quote, ioctl for extend_rtmr

Author: kvinwang

CLAUDE.md

@@ -210,8 +210,7 @@ RPC definitions use `prpc` framework with Protocol Buffers:
 
 ### Working with TDX Quotes
 
-- Low-level bindings: `tdx-attest-sys/` (FFI to libtdx-attest)
-- High-level API: `tdx-attest/`
+- Pure Rust API: `tdx-attest/`
 - Verification: `verifier/` using `dcap-qvl`
 - Event log parsing: `cc-eventlog/`
 

Cargo.lock

@@ -18,7 +18,6 @@ members = [
     "kms/rpc",
     "ra-rpc",
     "ra-tls",
-    "tdx-attest-sys",
     "tdx-attest",
     "dstack-attest",
     "dstack-util",
@@ -69,7 +68,6 @@ cc-eventlog = { path = "cc-eventlog" }
 supervisor = { path = "supervisor" }
 supervisor-client = { path = "supervisor/client" }
 tdx-attest = { path = "tdx-attest" }
-tdx-attest-sys = { path = "tdx-attest-sys" }
 dstack-attest = { path = "dstack-attest" }
 certbot = { path = "certbot" }
 rocket-vsock-listener = { path = "rocket-vsock-listener" }

Cargo.toml

@@ -115,11 +115,6 @@ SPDX-FileCopyrightText = "NONE"
 SPDX-License-Identifier = "Apache-2.0"
 precedence = "override"
 
-[[annotations]]
-path = "tdx-attest-sys/csrc/*"
-SPDX-FileCopyrightText = "Copyright (C) 2011-2021 Intel Corporation. All rights reserved."
-SPDX-License-Identifier = "BSD-3-Clause"
-
 [[annotations]]
 path = "mod-tdx-guest/Kconfig"
 SPDX-FileCopyrightText = "© 2022 Intel Corporation"