Artifact for OSDI #15

Introduction

We have renamed our project from HEIMDALL to Penglai! In this document, we just use Penglai to represent our enclave system, and we will unify the name in our final version.

Penglai is a software-hardware co-design enclave system. The main claim in our paper is that we make enclave more scalable. For convenience, we provide two simulators (QEMU, Gem5) to evaluate Penglai.

Note: We have upgraded Penglai to OpenSBI and Linux-5.10.2. Opensbi is the most widely-used M mode routine and linux-v5 is the latest linux version, comparing with old Penglai (bbl+linux-v4).

All the tests in AE are based on this new version. Note, our final version paper will also change the implementations and all evaluation results to the new version (but our claims does not change).

Prerequisite:

Git: Penglai uses git for version control
Docker: Penglai uses docker to create the build environment
Linux: All the testing scripts are developed for Linux (e.g., ubuntu-18.04 we used), which may be incompatible with mac or windows.

Getting started (artifact download)

We have open-sourced our project, see in the git repo:

Penglai-Enclave-TVM: https://github.com/Penglai-Enclave/Penglai-Opensbi-TVM.git

1. Penglai-Enclave-TVM

To get the source code of penglai-enclave-tvm, you can use the following scripts:

git clone https://github.com/Penglai-Enclave/Penglai-Enclave-TVM.git

Enter the penglai-enclave-tvm directory, cd Penglai-enclave-TVM, and checkout to the artifact branch:

<dir_to_Penglai-Enclave-TVM >
git checkout artifact
git pull

Update all submodules：

git submodule update --init --recursive

2. Penglai-Enclave-Gem5

~~To get the source code of Penglai-Enclave-Gem5, you can use the following scripts:~~

~~git clone https://github.com/Penglai-Enclave/Penglai-Enclave-Gem5.git~~

~~Artifact code is in the main branch! Make sure the code is up-to-date.~~

~~Now you have everything needed to run Penglai's tests and reproduce the results.~~

At present, the source code for Gem5-MMT is not openly accessible, in adherence to a request from one of our collaborating partners. However, we are actively working towards making this source code available for academic use. If you wish to reproduce the results in the interim, kindly direct your inquiries to fengerhu1@sjtu.edu.cn.

Run an example (Functionality)

Enter the <dir_to_Penglai-Enclave-TVM>

1. Run hello world in the Penglai enclave

Build the Penglai using the Docker image (need several hours e.g., 2 hours in our machines, for the first time)
```
./docker_cmd.sh build
```
Run the Penglai in the qemu
```
./docker_cmd.sh qemu
```
If the qemu boots successfully, you are required to log in the system (username: root, pwd: penglai)

Then, you can see the familiar prompt in the command line, and linux is booted successfully.
Run the first enclave in the HEIMDALLR/Penglai:
- Install the kernel module:
```
sh insmod.sh
```
  After you install the kernel module successfully, you can see the "register_chrdev succeeded!" on the screen.
- Run the hello-world as a demo:
```
 ./host/host hello-world/hello-world
```
  If the hello-world runs successfully, you can see the expected output: "hello world!" on the screen. Since then, you have successfully run the first enclave in the Penglai.

Enter the <dir_to_Penglai-Enclave-Gem5>

2. Run hello world in Gem5

Build the gem5.opt (need several hours, e.g., 3 hours in our machines), you can find the output binary in the dir:build/RISCV/gem5.opt.
```
./docker_cmd.sh build
```
If gem5.opt is build successfully, you can see the "scons: done building targets" on the screen.
Run the first demo in the gem5: hello-world
```
 ./docker_cmd.sh hello
```
Find the output file in m5out/simout-hello

The output in the m5out/simout-hello must match with the following expected content.

Main results of the paper and how to reproduce them(Reproducability)

MMT result is evaluated on Gem5, enter the <dir_to_Penglai-Enclave-Gem5>

1. MMT performance

We claim that MMT has a better performance than SIT and VAULT.

As Gem5 is much slower than the real hardware (need several days, e.g., 2 days in our machines, to finish all tests), we give the original log file in the <dir_to_mmt>/m5out/result. If you want to reproduce all results. You can type the following script.

Build the gem5.opt image, you can find the output binary in the dir: build/ARCH/*
```
./docker_cmd.sh build
```
Run the gem5 with the SPEC2k6 benchmarks (need several days)，the output is the execution cycles of each benchmark.
```
./docker_cmd.sh run 
```
How to compare the results with the claim in the paper.

After all tests are finished successfully, you can see the output results (cycles) for all benchmarks. However, in Figure11: SPECCPU, it only shows the execution time of the "None" (red number above the bar), you can estimate the execution cycles of the MMT according to the proportion of each bar.

Also, you can get the original evaluation results of MMT (used in paper) by typing the following script:
```
./docker_cmd.sh show
```