feat(tdx-attest): Add MUSL libc support for TDX attestation

Enable building with x86_64-unknown-linux-musl target by:

1. Vendoring minimal Linux kernel headers that are missing from MUSL:
   - linux/vm_sockets.h: vsock address family and sockaddr_vm struct
   - linux/types.h: kernel type aliases (__u8, __u32, __u64, etc.)
   - linux/ioctl.h: redirect to MUSL's sys/ioctl.h

2. Updating cfg conditions to include MUSL (target_env = "musl")
   alongside glibc (target_env = "gnu")

3. Modifying build.rs to prioritize vendored headers via include path

This allows building statically-linked TDX attestation binaries using
MUSL, which is useful for containerized deployments and systems without
glibc.

Tested: cargo build --target x86_64-unknown-linux-musl -p tdx-attest

Author: kvinwang

LICENSES/GPL-2.0.txt

@@ -10,6 +10,7 @@ use std::path::PathBuf;
 fn main() {
     println!("cargo:rerun-if-changed=csrc/tdx_attest.c");
     println!("cargo:rerun-if-changed=csrc/qgs_msg_lib.cpp");
+    println!("cargo:rerun-if-changed=csrc/linux/vm_sockets.h");
     let output_path = PathBuf::from(env::var("OUT_DIR").expect("OUT_DIR not set"));
     bindgen::Builder::default()
         .header("bindings.h")
@@ -21,5 +22,8 @@ fn main() {
     cc::Build::new()
         .file("csrc/tdx_attest.c")
         .file("csrc/qgs_msg_lib.cpp")
+        // Add csrc to include path first so our vendored linux/vm_sockets.h is found
+        // before system headers (needed for MUSL builds)
+        .include("csrc")
         .compile("tdx_attest");
 }

tdx-attest-sys/build.rs

@@ -0,0 +1,66 @@
+// SPDX-FileCopyrightText: Linux kernel contributors
+//
+// SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
+
+/*
+ * Vendored linux/ioctl.h for portable ioctl macros.
+ *
+ * This provides the _IO/_IOR/_IOW/_IOWR macros that accept struct types
+ * and compute ioctl numbers based on sizeof(). These are needed by
+ * tdx_attest.c and work consistently across glibc and MUSL.
+ *
+ * Based on: Linux kernel include/uapi/asm-generic/ioctl.h
+ */
+
+#ifndef _LINUX_IOCTL_H
+#define _LINUX_IOCTL_H
+
+/* ioctl command encoding: 32 bits total, command in lower 16 bits,
+ * size of the parameter structure in the lower 14 bits of the
+ * upper 16 bits.
+ */
+
+#define _IOC_NRBITS     8
+#define _IOC_TYPEBITS   8
+#define _IOC_SIZEBITS   14
+#define _IOC_DIRBITS    2
+
+#define _IOC_NRMASK     ((1 << _IOC_NRBITS)-1)
+#define _IOC_TYPEMASK   ((1 << _IOC_TYPEBITS)-1)
+#define _IOC_SIZEMASK   ((1 << _IOC_SIZEBITS)-1)
+#define _IOC_DIRMASK    ((1 << _IOC_DIRBITS)-1)
+
+#define _IOC_NRSHIFT    0
+#define _IOC_TYPESHIFT  (_IOC_NRSHIFT+_IOC_NRBITS)
+#define _IOC_SIZESHIFT  (_IOC_TYPESHIFT+_IOC_TYPEBITS)
+#define _IOC_DIRSHIFT   (_IOC_SIZESHIFT+_IOC_SIZEBITS)
+
+/* Direction bits */
+#define _IOC_NONE       0U
+#define _IOC_WRITE      1U
+#define _IOC_READ       2U
+
+#define _IOC(dir,type,nr,size) \
+    (((dir)  << _IOC_DIRSHIFT) | \
+     ((type) << _IOC_TYPESHIFT) | \
+     ((nr)   << _IOC_NRSHIFT) | \
+     ((size) << _IOC_SIZESHIFT))
+
+#define _IOC_TYPECHECK(t) (sizeof(t))
+
+/* Used to create numbers.
+ * NOTE: _IOW means userland is writing and kernel is reading.
+ *       _IOR means userland is reading and kernel is writing.
+ */
+#define _IO(type,nr)            _IOC(_IOC_NONE,(type),(nr),0)
+#define _IOR(type,nr,size)      _IOC(_IOC_READ,(type),(nr),(_IOC_TYPECHECK(size)))
+#define _IOW(type,nr,size)      _IOC(_IOC_WRITE,(type),(nr),(_IOC_TYPECHECK(size)))
+#define _IOWR(type,nr,size)     _IOC(_IOC_READ|_IOC_WRITE,(type),(nr),(_IOC_TYPECHECK(size)))
+
+/* Used to decode ioctl numbers */
+#define _IOC_DIR(nr)            (((nr) >> _IOC_DIRSHIFT) & _IOC_DIRMASK)
+#define _IOC_TYPE(nr)           (((nr) >> _IOC_TYPESHIFT) & _IOC_TYPEMASK)
+#define _IOC_NR(nr)             (((nr) >> _IOC_NRSHIFT) & _IOC_NRMASK)
+#define _IOC_SIZE(nr)           (((nr) >> _IOC_SIZESHIFT) & _IOC_SIZEMASK)
+
+#endif /* _LINUX_IOCTL_H */

tdx-attest-sys/csrc/linux/ioctl.h

@@ -0,0 +1,32 @@
+// SPDX-FileCopyrightText: Linux kernel contributors
+//
+// SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
+
+/*
+ * Minimal vendored linux/types.h for MUSL compatibility.
+ *
+ * Provides kernel-style type aliases (__u8, __u16, __u32, __u64)
+ * using standard C types from stdint.h.
+ */
+
+#ifndef _LINUX_TYPES_H
+#define _LINUX_TYPES_H
+
+#include <stdint.h>
+
+typedef uint8_t  __u8;
+typedef uint16_t __u16;
+typedef uint32_t __u32;
+typedef uint64_t __u64;
+
+typedef int8_t   __s8;
+typedef int16_t  __s16;
+typedef int32_t  __s32;
+typedef int64_t  __s64;
+
+/* Kernel-style sa_family_t if not already defined */
+#ifndef __kernel_sa_family_t
+typedef unsigned short __kernel_sa_family_t;
+#endif
+
+#endif /* _LINUX_TYPES_H */

tdx-attest-sys/csrc/linux/types.h

@@ -0,0 +1,49 @@
+// SPDX-FileCopyrightText: VMware, Inc.
+// SPDX-FileCopyrightText: Linux kernel contributors
+//
+// SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
+
+/*
+ * Minimal vendored version of linux/vm_sockets.h for MUSL compatibility.
+ *
+ * This header provides the minimal definitions needed by tdx_attest.c
+ * without pulling in glibc-specific headers that conflict with MUSL.
+ *
+ * Based on: Linux kernel include/uapi/linux/vm_sockets.h
+ * Original copyright: VMware, Inc.
+ */
+
+#ifndef _VM_SOCKETS_H
+#define _VM_SOCKETS_H
+
+#include <stdint.h>
+#include <sys/socket.h>
+
+/* AF_VSOCK = PF_VSOCK = 40 */
+#ifndef AF_VSOCK
+#define AF_VSOCK 40
+#endif
+
+/* Use this as the destination CID in an address when referring to the host
+ * (any process other than the hypervisor).
+ */
+#define VMADDR_CID_HOST 2
+
+/* Address structure for vSockets. The address family should be set to
+ * AF_VSOCK.
+ */
+struct sockaddr_vm {
+    sa_family_t svm_family;           /* Address family: AF_VSOCK */
+    unsigned short svm_reserved1;     /* Reserved, must be zero */
+    unsigned int svm_port;            /* Port, in host byte order */
+    unsigned int svm_cid;             /* Context ID (CID) */
+    uint8_t svm_flags;                /* Flags */
+    unsigned char svm_zero[sizeof(struct sockaddr) -
+                           sizeof(sa_family_t) -
+                           sizeof(unsigned short) -
+                           sizeof(unsigned int) -
+                           sizeof(unsigned int) -
+                           sizeof(uint8_t)];
+};
+
+#endif /* _VM_SOCKETS_H */

tdx-attest-sys/csrc/linux/vm_sockets.h

@@ -23,7 +23,8 @@ fs-err.workspace = true
 serde_json = { workspace = true, features = ["alloc"] }
 sha2.workspace = true
 
-[target.'cfg(all(target_os = "linux", target_arch = "x86_64", target_env = "gnu"))'.dependencies]
+# Linux x86_64 with glibc or musl
+[target.'cfg(all(target_os = "linux", target_arch = "x86_64"))'.dependencies]
 tdx-attest-sys.workspace = true
 
 [dev-dependencies]

tdx-attest/Cargo.toml

@@ -2,15 +2,16 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 
-#[cfg(all(target_os = "linux", target_arch = "x86_64", target_env = "gnu"))]
+// Linux x86_64 with glibc or musl
+#[cfg(all(target_os = "linux", target_arch = "x86_64"))]
 pub use linux::*;
-#[cfg(all(target_os = "linux", target_arch = "x86_64", target_env = "gnu"))]
+#[cfg(all(target_os = "linux", target_arch = "x86_64"))]
 mod linux;
 
-#[cfg(not(all(target_os = "linux", target_arch = "x86_64", target_env = "gnu")))]
+// Fallback for non-Linux/non-x86_64 platforms (dummy implementation)
+#[cfg(not(all(target_os = "linux", target_arch = "x86_64")))]
 pub use dummy::*;
-
-#[cfg(not(all(target_os = "linux", target_arch = "x86_64", target_env = "gnu")))]
+#[cfg(not(all(target_os = "linux", target_arch = "x86_64")))]
 mod dummy;
 
 pub use cc_eventlog as eventlog;