Michał Kowalczyk
3d31f2d18d
This is the next part of the great loader rework, with a lot of breaking changes: - Complete removal of the "trusted children" thing - now children processes can be spawned arbitrarily and from arbitrary mountpoint types, without any additional configuration needed. - There's a new, required option in the manifest: `libos.entrypoint` - it specifies the URI to the entry binary in the first process. There's no need anymore to name the manifest and the first binary identically. - On SGX, the main binary is not measured in MRENCLAVE anymore - only PAL, LibOS and the manifest are measured. This is enough to bind MRENCLAVE to a specific entrypoint user executable if wanted - it just has to be mounted as a trusted file. - All Graphene SGX enclaves have now exactly the same MRENCLAVE. This is a hash of a "Graphene stub", which can "fork" into one of two states in runtime: initial process or child. The initial process creates a new "Graphene namespace" with a clean state, it can also be attested remotely (contrary to child processes). The initial process can spawn children processes by spawning a Graphene stub and directing it to start in the child mode. It then attests it locally, and if successful, establishes an encrypted pipe, "connects" to its own namespace and treats as trusted (including sending protected files key). - Now, there's only one, central manifest describing the initial state of a Graphene instance which can be spawned from it (previously, each process required a separate manifest which could have different configuration - which wasn't actually supported and didn't make sense design-wise). One downside of central manifests is that all processes require the same enclave configuration (e.g. size), but that was already the case so far because of broken checkpointing code. Also, this is only a temporary problem, which will cease to exist after the introduction of EDMM. - `sgx.static_address` was renamed to `sgx.nonpie_binary` and now has to be inserted manually by users (`sgx_sign` tools doesn't know about the binaries run inside, which can be even provided or generated in runtime by the user's workload). - Caveat: the memory gap for non-PIE executables was removed because it requires adding a new option to the manifest to be cleanly implemented. This is left for some future loader rework PR.
OpenVINO
This directory contains a Makefile and a template manifest for the most recent version of OpenVINO toolkit (as of this writing, version 2020.4). We use the "Object Detection C++ Sample SSD" (object_detection_sample_ssd) example from the OpenVINO distribution as a concrete application running under Graphene-SGX. We test only the CPU backend (i.e., no GPU or FPGA). This was tested on a machine with SGX v1 and Ubuntu 18.04.
The Makefile and the template manifest contain extensive comments. Please review them to understand the requirements for OpenVINO/object_detection_sample_ssd running under Graphene-SGX.
We build OpenVINO from the source code instead of using an existing installation. Note: the build process requires ~1.1GB of disk space and takes ~20 minutes.
We also download the Open Model Zoo repository and use the SSD300 pre-trained model from it. Note: the model zoo requires ~350MB of disk space.
Prerequisites
For Ubuntu 18.04, install the following prerequisite packages:
-
Install CMake version >= 3.11 (on Ubuntu 18.04, this may require installing Cmake from a non-official APT repository like Kitware).
-
Install libusb version >= 1.0.0 (
sudo apt install libusb-1.0-0-dev). -
Install libtbb-dev
-
Install packages for Python3:
pip3 install pyyaml numpy networkx test-generator defusedxml protobuf>=3.6.1
Quick Start
# build OpenVINO together with object_detection_sample_ssd and the final manifest;
# note that it also downloads the SSD300 model and transforms it from the Caffe
# format to an optimized Intermediate Representation (IR)
make SGX=1
# run original OpenVINO/object_detection_sample_ssd
# note that this assumes the Release build of OpenVINO (no DEBUG=1)
./openvino/bin/intel64/Release/object_detection_sample_ssd -i images/horses.jpg \
-m model/VGG_VOC0712Plus_SSD_300x300_ft_iter_160000.xml -d CPU
# run OpenVINO/object_detection_sample_ssd in non-SGX Graphene
./pal_loader object_detection_sample_ssd.manifest -i images/horses.jpg \
-m model/VGG_VOC0712Plus_SSD_300x300_ft_iter_160000.xml -d CPU
# run OpenVINO/object_detection_sample_ssd in Graphene-SGX
SGX=1 ./pal_loader object_detection_sample_ssd.manifest.sgx -i images/horses.jpg \
-m model/VGG_VOC0712Plus_SSD_300x300_ft_iter_160000.xml -d CPU
# Each of these commands produces an image out_0.bmp with detected objects
xxd out_0.bmp # or open in any image editor