|
| 1 | +// SPDX-FileCopyrightText: © 2026 Phala Network <dstack@phala.network> |
| 2 | +// |
| 3 | +// SPDX-License-Identifier: Apache-2.0 |
| 4 | + |
| 5 | +use std::path::{Path, PathBuf}; |
| 6 | + |
| 7 | +use anyhow::{bail, Context, Result}; |
| 8 | +use clap::{Parser, ValueEnum}; |
| 9 | +use fuser::{Filesystem, MountOption, Session}; |
| 10 | +use tracing::info; |
| 11 | + |
| 12 | +mod tdx; |
| 13 | + |
| 14 | +#[derive(Clone, Copy, Debug, Default, Eq, PartialEq, ValueEnum)] |
| 15 | +enum TeePlatform { |
| 16 | + #[default] |
| 17 | + Tdx, |
| 18 | +} |
| 19 | + |
| 20 | +#[derive(Parser)] |
| 21 | +#[command(about = "Development-only simulator for Linux TEE guest ABIs")] |
| 22 | +struct Args { |
| 23 | + /// TEE platform ABI to simulate. |
| 24 | + #[arg(long, value_enum, default_value = "tdx")] |
| 25 | + platform: TeePlatform, |
| 26 | + |
| 27 | + /// Override the platform backend's default mountpoint. |
| 28 | + #[arg(long)] |
| 29 | + mountpoint: Option<PathBuf>, |
| 30 | +} |
| 31 | + |
| 32 | +/// Platform-specific simulator backend. |
| 33 | +/// |
| 34 | +/// Adding another TEE platform only requires a backend implementation and a |
| 35 | +/// CLI enum variant; the FUSE lifecycle and safety checks remain shared. |
| 36 | +trait TeeBackend { |
| 37 | + type Fs: Filesystem; |
| 38 | + |
| 39 | + const PLATFORM: &'static str; |
| 40 | + const DEFAULT_MOUNTPOINT: &'static str; |
| 41 | + |
| 42 | + fn create_filesystem() -> Result<Self::Fs>; |
| 43 | + fn prepare_mountpoint(mountpoint: &Path) -> Result<()>; |
| 44 | + fn real_tee_available() -> bool; |
| 45 | +} |
| 46 | + |
| 47 | +fn run_backend<B: TeeBackend>(mountpoint_override: Option<PathBuf>) -> Result<()> { |
| 48 | + let default_mountpoint = Path::new(B::DEFAULT_MOUNTPOINT); |
| 49 | + let mountpoint = mountpoint_override.as_deref().unwrap_or(default_mountpoint); |
| 50 | + |
| 51 | + if mountpoint == default_mountpoint && B::real_tee_available() { |
| 52 | + bail!( |
| 53 | + "refusing to start the {} simulator when a real TEE device is present", |
| 54 | + B::PLATFORM |
| 55 | + ); |
| 56 | + } |
| 57 | + B::prepare_mountpoint(mountpoint)?; |
| 58 | + |
| 59 | + let fs = B::create_filesystem()?; |
| 60 | + let mut session = Session::new( |
| 61 | + fs, |
| 62 | + mountpoint, |
| 63 | + &[ |
| 64 | + MountOption::FSName(format!("dstack-tee-simulator-{}", B::PLATFORM)), |
| 65 | + MountOption::DefaultPermissions, |
| 66 | + MountOption::NoSuid, |
| 67 | + MountOption::NoDev, |
| 68 | + MountOption::NoExec, |
| 69 | + ], |
| 70 | + ) |
| 71 | + .with_context(|| format!("failed to mount FUSE at {}", mountpoint.display()))?; |
| 72 | + |
| 73 | + info!( |
| 74 | + platform = B::PLATFORM, |
| 75 | + mountpoint = %mountpoint.display(), |
| 76 | + "development TEE simulator ready" |
| 77 | + ); |
| 78 | + sd_notify::notify(true, &[sd_notify::NotifyState::Ready]) |
| 79 | + .context("failed to notify systemd")?; |
| 80 | + session.run().context("fuse session failed")?; |
| 81 | + Ok(()) |
| 82 | +} |
| 83 | + |
| 84 | +fn main() -> Result<()> { |
| 85 | + tracing_subscriber::fmt() |
| 86 | + .with_env_filter(tracing_subscriber::EnvFilter::from_default_env()) |
| 87 | + .init(); |
| 88 | + let args = Args::parse(); |
| 89 | + |
| 90 | + match args.platform { |
| 91 | + TeePlatform::Tdx => run_backend::<tdx::TdxBackend>(args.mountpoint), |
| 92 | + } |
| 93 | +} |
| 94 | + |
| 95 | +#[cfg(test)] |
| 96 | +mod tests { |
| 97 | + use super::*; |
| 98 | + |
| 99 | + #[test] |
| 100 | + fn defaults_to_tdx() { |
| 101 | + let args = Args::try_parse_from(["dstack-tee-simulator"]).unwrap(); |
| 102 | + assert_eq!(args.platform, TeePlatform::Tdx); |
| 103 | + assert!(args.mountpoint.is_none()); |
| 104 | + } |
| 105 | +} |
0 commit comments