guest: add TEE ABI simulator for no-TEE development VMs#780
Open
kvinwang wants to merge 3 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR enables no_tee development VMs to exercise the same TDX-oriented guest setup, measurement, event log, and attestation code paths as production by introducing a development-image-only TDX/TSM ABI simulator and improving TDX detection.
Changes:
- Add a FUSE-based
dstack-tdx-simulatorthat serves a simulated configfs TSM provider, RTMR measurement files, and a CCEL fixture (dev images only). - Improve TDX detection to recognize configfs TSM
tdx_guest*providers (not only/dev/tdx_guest) and add env overrides for simulator wiring. - Enforce that
no_tee=trueis only allowed with development images and document the workflow.
Reviewed changes
Copilot reviewed 17 out of 18 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| os/yocto/layers/meta-dstack/recipes-core/images/dstack-rootfs-dev.inc | Adds dstack-tdx-simulator to the dev rootfs image package set. |
| os/yocto/layers/meta-dstack/recipes-core/dstack-tdx-simulator/dstack-tdx-simulator.bb | New Yocto recipe to build/install the simulator binary, unit, and prepare ordering drop-in. |
| os/common/rootfs/dstack-tdx-simulator.service | New systemd service to start the simulator ahead of guest preparation and set env overrides. |
| os/common/rootfs/dstack-prepare.sh | Extends guest-side TEE detection to include configfs TSM provider probing. |
| os/common/rootfs/dstack-prepare.service.d/tdx-simulator.conf | Ensures dstack-prepare requires/starts after the simulator on dev images. |
| dstack/vmm/src/one_shot.rs | Validates no_tee is only permitted with dev images in one-shot mode. |
| dstack/vmm/src/app.rs | Adds validate_tee_image_mode() and applies it to VM create/reload paths; includes a unit test. |
| dstack/tdx-simulator/src/main.rs | New FUSE implementation of a simulated TSM report tree with quote + RTMR behaviors and tests. |
| dstack/tdx-simulator/Cargo.toml | New crate definition for dstack-tdx-simulator. |
| dstack/tdx-attest/src/linux.rs | Adds is_tdx_available() (device or provider), configfs provider scanning, RTMR sysfs env override, and tests. |
| dstack/tdx-attest/src/dummy.rs | Adds dummy is_tdx_available() for non-Linux/non-x86_64 targets. |
| dstack/tdx-attest/Cargo.toml | Adds tempfile for new configfs-provider tests. |
| dstack/dstack-attest/src/attestation.rs | Switches TDX presence detection to tdx_attest::is_tdx_available(). |
| dstack/cc-eventlog/src/tdx.rs | Exposes decode_ccel() helper (used by simulator) and adds a test for bundled CCEL. |
| dstack/cc-eventlog/src/tcg.rs | Adds DSTACK_CCEL_FILE env override for CCEL reading (simulator integration). |
| dstack/Cargo.toml | Adds tdx-simulator workspace member and the fuser workspace dependency. |
| dstack/Cargo.lock | Locks new crate and dependency additions (fuser, page_size, tempfile, etc.). |
| CONTRIBUTING.md | Documents the dev --no-tee workflow and simulator semantics/safety expectations. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
5488897 to
4a4dfa0
Compare
2 tasks
39b07f8 to
40335d7
Compare
Add a FUSE-based TEE simulator (default TDX backend) that exposes the configfs-tsm quote, RTMR, and CCEL interfaces used by the existing guest path. Packaged only into development images.
Use provider value tdx_guest like the kernel TSM interface, and keep the systemd unit plus prepare drop-in under the Yocto recipe files/ tree instead of os/common/rootfs.
33a4988 to
006b210
Compare
After the SDK workspace split, dstack-tee-simulator only builds from the core workspace, so staging sdk/rust is unnecessary (same as dstack-guest).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Developers need to boot dstack guests without real TEE hardware and still exercise the real guest setup path: prepare, key provisioning, encrypted storage, measurements, event logs, guest-agent, and quote/RTMR APIs.
PR #766 solves this by threading a
no_teeflag through VMM, compose, guest setup, and guest-agent, then branching the security path when that flag is set (skip encryption, skip attestation, short-circuit key provider checks, disable quote APIs, and so on). That works for local bring-up, but it has two lasting costs:if no_teespecial cases. Those branches are easy to get subtly wrong, hardto audit, and they permanently dilute the production code that reviewers and
verifiers care about.
avoids the production path. Bugs that only exist when encryption,
measurement, quote generation, or RTMR extension run still cannot be caught
by no-TEE development boots.
Approach in this PR
Instead of teaching guest software about “no TEE”, keep guest software on the
production path and simulate the TEE ABI under the guest.
This PR adds
dstack-tee-simulator, a FUSE service packaged only intodevelopment images:
--platform)/sys/kernel/config/tsm/reporttdx-attestdstack-prepare, then the existing guest stack runs unchangedSimulated quotes parse for guest integration work but carry an intentionally
invalid signature, so production verifiers and KMS reject them.
Why this replaces #766
no_teebranches)if no_teechecks in prepare, key setup, encryption, attestation, guest-agentThe point is not that #766 is unusable for local testing. It is that the cost of
that design sits on the wrong side of the boundary: it complicates the code we
ship and audit, and it stops development VMs from covering the path we most need
to keep correct.
Safety
dstack-rootfs-dev.inc(development images)./dev/tdx_guest,/dev/sev-guest, or a realtdx_guest*/sev_guest*TSM provider is present.verifiers/KMS.
production workloads or secrets.
Validation
Previous local validation on this series also included a
dstack-devimagebuild and a
no_teeKVM boot where prepare, temporary app keys, LUKS/ZFS setup,guest-agent, quote generation, event-log read, and RTMR extend all succeeded on
the production guest path.
Docs
Maintainer workflow is documented in
CONTRIBUTING.md.