demo: add SGX EPC stress-ng using Gramine

Signed-off-by: Mikko Ylinen <[email protected]>

Author: mythi

.github/workflows/lib-build.yaml

@@ -38,6 +38,7 @@ jobs:
           - sgx-aesmd-demo
           - dlb-dpdk-demo
           - dlb-libdlb-demo
+          - stress-ng-gramine
         builder: [buildah, docker]
     steps:
       - uses: actions/checkout@v4

.github/workflows/lib-e2e.yaml

@@ -43,7 +43,7 @@ jobs:
             images: intel-qat-plugin intel-qat-initcontainer openssl-qat-engine
           - name: e2e-sgx
             runner: sgx
-            images: intel-sgx-plugin intel-sgx-initcontainer intel-sgx-admissionwebhook sgx-sdk-demo intel-deviceplugin-operator
+            images: intel-sgx-plugin intel-sgx-initcontainer intel-sgx-admissionwebhook sgx-sdk-demo intel-deviceplugin-operator stress-ng-gramine
 
     name: ${{ matrix.name }}
     runs-on: ${{ matrix.runner }}

demo/stress-ng-gramine/Dockerfile

@@ -0,0 +1,13 @@
+FROM gramineproject/gramine:v1.5
+
+RUN apt-get update \
+ && env DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    stress-ng \
+    make
+
+COPY * /stress-ng/
+WORKDIR /stress-ng
+
+RUN gramine-sgx-gen-private-key && \
+    make SGX=1
+ENTRYPOINT ["/usr/bin/gramine-sgx"]

demo/stress-ng-gramine/build/Makefile

@@ -0,0 +1,50 @@
+ARCH_LIBDIR ?= /lib/x86_64-linux-gnu
+
+ifeq ($(DEBUG),1)
+	GRAMINE_LOG_LEVEL = debug
+else
+	GRAMINE_LOG_LEVEL = error
+endif
+
+.PHONY: all
+all: stress-ng.manifest stress-ng-edmm.manifest
+ifeq ($(SGX),1)
+all: stress-ng.manifest.sgx stress-ng.sig stress-ng-edmm.manifest.sgx stress-ng-edmm.sig
+endif
+
+stress-ng.manifest: stress-ng.manifest.template
+	gramine-manifest \
+		-Dlog_level=$(GRAMINE_LOG_LEVEL) \
+		-Dedmm='false' \
+		-Dexecdir=$(shell dirname $(shell which stress-ng)) \
+		-Darch_libdir=$(ARCH_LIBDIR) \
+		$< >$@
+
+stress-ng.manifest.sgx: stress-ng.manifest
+	gramine-sgx-sign \
+		--manifest stress-ng.manifest \
+		--output $@
+
+stress-ng.sig: stress-ng.manifest.sgx
+
+stress-ng-edmm.manifest: stress-ng.manifest.template
+	gramine-manifest \
+		-Dlog_level=$(GRAMINE_LOG_LEVEL) \
+		-Dedmm='true' \
+		-Dexecdir=$(shell dirname $(shell which stress-ng)) \
+		-Darch_libdir=$(ARCH_LIBDIR) \
+		$< >$@
+
+stress-ng-edmm.manifest.sgx: stress-ng.manifest
+	gramine-sgx-sign \
+		--manifest stress-ng-edmm.manifest \
+		--output $@
+
+stress-ng-edmm.sig: stress-ng-edmm.manifest.sgx
+
+.PHONY: clean
+clean:
+	$(RM) *.manifest *.manifest.sgx *.token *.sig OUTPUT
+
+.PHONY: distclean
+distclean: clean

demo/stress-ng-gramine/build/stress-ng.manifest.template

@@ -0,0 +1,29 @@
+loader.entrypoint = "file:{{ gramine.libos }}"
+libos.entrypoint = "{{ execdir }}/stress-ng"
+
+loader.log_level = "{{ log_level }}"
+loader.insecure__use_cmdline_argv = true
+
+loader.env.LD_LIBRARY_PATH = "/lib:{{ arch_libdir }}:/usr{{ arch_libdir }}"
+loader.env.PATH = "{{ execdir }}"
+
+fs.mounts = [
+  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
+  { path = "{{ arch_libdir }}", uri = "file:{{ arch_libdir }}" },
+  { path = "/usr/lib", uri = "file:/usr/lib" },
+  { path = "/stress-ng", uri = "file:/stress-ng" },
+  { path = "{{ execdir }}", uri = "file:{{ execdir }}" },
+]
+
+sgx.debug = false
+sgx.edmm_enable = {{ edmm }}
+sgx.enclave_size = "128M"
+sgx.max_threads = 6
+
+sgx.trusted_files = [
+  "file:{{ gramine.libos }}",
+  "file:{{ execdir }}/",
+  "file:{{ gramine.runtimedir() }}/",
+  "file:{{ arch_libdir }}/",
+  "file:/usr/{{ arch_libdir }}/",
+]