opensource/cocos
1
0
Fork 0
mirror of https://github.com/ultravioletrs/cocos.git synced 2026-08-07 07:14:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

NOISSUE - Update documentation for vTPM changes (#408)

Browse Source 
* change readme according to vTPM changes

* rebase
This commit is contained in:
Danko Miladinovic
2025-03-19 09:38:48 +01:00
committed by GitHub
parent 293c65a3aa
commit ebc8f1bba4
3 changed files with 334 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/manual/algo/README.md
+213 -31
View File
@@ -38,31 +38,121 @@ python3 test/manual/algo/lin_reg.py predict results.zip test/manual/data
This will make inference on the results of the linear regression model.
To run the examples in the secure VM (SVM) by the Agent, you can use the following command:
To run the examples in the confidential VM (CVM) or a regular VM by the Agent, you can use the following command:
```bash
go run ./test/computations/main.go ./test/manual/algo/lin_reg.py public.pem false ./test/manual/data/iris.csv
go run ./test/cvms/main.go ./test/manual/algo/lin_reg.py public.pem false ./test/manual/data/iris.csv
```
This command is run from the root directory of the project. This will start the computation server.
This command is run from the root directory of the project. This will start the CVM server.
In another window, you can run the following command:
For a regular VM, in another window, run the following command:
```bash
sudo find / -name OVMF_CODE.fd
# => /usr/share/OVMF/OVMF_CODE.fd
OVMF_CODE=/usr/share/OVMF/OVMF_CODE.fd
sudo find / -name OVMF_VARS.fd
# => /usr/share/OVMF/OVMF_VARS.fd
# Create a local copy of OVMF_VARS.
cp /usr/share/OVMF/OVMF_VARS.fd .
OVMF_VARS=./OVMF_VARS.fd
# Create a directory for the environment file and the certificates for cloud certificates.
mkdir env
mkdir certs
# Enter the env directory and create the environemnt file.
cd env
touch environment
# Define Computations endpoint URL for agent.
# Make sure the Computation endpoint is running (like Cocos Prism).
echo AGENT_CVM_GRPC_URL=localhost:7001 >> ./environment
# Define log level for the agent.
echo AGENT_LOG_LEVEL=debug >> ./environment
cd ..
KERNEL=<path to kernel built with HAL>
INITRD=<path to initial RAM file system built with HAL>
APPEND="earlyprintk=serial console=ttyS0"
QEMU_BIN=<path to QEMU binary>
ENV_PATH=./env
CERTH_PATH=./certs
$QEMU_BIN -enable-kvm \
-smp 4 \
-m 8G,slots=5,maxmem=10G \
-cpu EPYC-v4 \
-machine q35 \
-no-reboot \
-drive if=pflash,format=raw,unit=0,file=$OVMF_CODE,readonly=on \
-drive if=pflash,format=raw,unit=1,file=$OVMF_VARS \
-netdev user,id=vmnic,hostfwd=tcp::7020-:7002 \
-device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vmnic \
-initrd $INITRD \
-kernel $KERNEL -append $APPEND \
-nographic \
-monitor pty \
-monitor unix:monitor,server,nowait \
-fsdev local,id=env_fs,path=$ENV_PATH,security_model=mapped \
-device virtio-9p-pci,fsdev=env_fs,mount_tag=env_share \
-fsdev local,id=cert_fs,path=$CERTH_PATH,security_model=mapped \
-device virtio-9p-pci,fsdev=cert_fs,mount_tag=certs_share
```
For a CVM, in another window, run the following command:
```bash
sudo \
MANAGER_QEMU_SMP_MAXCPUS=4 \
MANAGER_GRPC_URL=localhost:7001 \
MANAGER_LOG_LEVEL=debug \
MANAGER_QEMU_USE_SUDO=false \
MANAGER_QEMU_ENABLE_SEV=false \
MANAGER_QEMU_SEV_CBITPOS=51 \
MANAGER_QEMU_ENABLE_SEV_SNP=false \
MANAGER_QEMU_OVMF_CODE_FILE=/usr/share/edk2/x64/OVMF_CODE.fd \
MANAGER_QEMU_OVMF_VARS_FILE=/usr/share/edk2/x64/OVMF_VARS.fd \
go run main.go
# Create a directory for the environment file and the certificates for cloud certificates.
mkdir env
mkdir certs
# Enter the env directory and create the environemnt file.
cd env
touch environment
# Define Computations endpoint URL for agent.
# Make sure the Computation endpoint is running (like Cocos Prism).
echo AGENT_CVM_GRPC_URL=localhost:7001 >> ./environment
# Define log level for the agent.
echo AGENT_LOG_LEVEL=debug >> ./environment
cd ..
KERNEL=<path to kernel built with HAL>
INITRD=<path to initial RAM file system built with HAL>
APPEND="earlyprintk=serial console=ttyS0"
IGVM=<path to IGVM file>
QEMU_BIN=<path to QEMU binary>
ENV_PATH=./env
CERTH_PATH=./certs
$QEMU_BIN -enable-kvm \
-enable-kvm \
-cpu EPYC-v4 \
-machine q35 \
-smp 4,maxcpus=16 \
-m 8G,slots=5,maxmem=30G \
-netdev user,id=vmnic,hostfwd=tcp::7020-:7002 \
-device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vmnic,romfile= \
-machine confidential-guest-support=sev0,memory-backend=ram1,igvm-cfg=igvm0 \
-object memory-backend-memfd,id=ram1,size=8G,share=true,prealloc=false,reserve=false \
-object sev-snp-guest,id=sev0,cbitpos=51,reduced-phys-bits=1 \
-object igvm-cfg,id=igvm0,file=$IGVM \
-initrd $INITRD \
-kernel $KERNEL -append $APPEND \
-nographic \
-monitor pty \
-monitor unix:monitor,server,nowait \
-fsdev local,id=env_fs,path=$ENV_PATH,security_model=mapped \
-device virtio-9p-pci,fsdev=env_fs,mount_tag=env_share \
-fsdev local,id=cert_fs,path=$CERTH_PATH,security_model=mapped \
-device virtio-9p-pci,fsdev=cert_fs,mount_tag=certs_share
```
This command is run from the [manager main directory](../../../cmd/manager/). This will start the manager. Make sure you have already built the [qemu image](../../../hal/linux/README.md).
Make sure you have already built the [qemu image](../../../hal/linux/README.md) and the IGVM file from the COCONUT-SVSM [repository](https://github.com/coconut-svsm/svsm/blob/main/Documentation/docs/installation/INSTALL.md).
In another window, you can run the following command:
@@ -125,29 +215,121 @@ docker build -t linreg .
docker save linreg > linreg.tar
```
To run the examples in the secure VM (SVM) by the Agent, you can use the following command in cocos root directory `/cocos`:
To run the examples in the confidential VM (CVM) or a regular VM by the Agent, you can use the following command:
```bash
go run ./test/computations/main.go ./test/manual/algo/linreg.tar public.pem false ./test/manual/data/iris.csv
go run ./test/cvms/main.go ./test/manual/algo/lin_reg.py public.pem false ./test/manual/data/iris.csv
```
In another window, you can run the following command in the `cmd/manager` directory:
This command is run from the root directory of the project. This will start the CVM server.
For a regular VM, in another window, run the following command:
```bash
sudo find / -name OVMF_CODE.fd
# => /usr/share/OVMF/OVMF_CODE.fd
OVMF_CODE=/usr/share/OVMF/OVMF_CODE.fd
sudo find / -name OVMF_VARS.fd
# => /usr/share/OVMF/OVMF_VARS.fd
# Create a local copy of OVMF_VARS.
cp /usr/share/OVMF/OVMF_VARS.fd .
OVMF_VARS=./OVMF_VARS.fd
# Create a directory for the environment file and the certificates for cloud certificates.
mkdir env
mkdir certs
# Enter the env directory and create the environemnt file.
cd env
touch environment
# Define Computations endpoint URL for agent.
# Make sure the Computation endpoint is running (like Cocos Prism).
echo AGENT_CVM_GRPC_URL=localhost:7001 >> ./environment
# Define log level for the agent.
echo AGENT_LOG_LEVEL=debug >> ./environment
cd ..
KERNEL=<path to kernel built with HAL>
INITRD=<path to initial RAM file system built with HAL>
APPEND="earlyprintk=serial console=ttyS0"
QEMU_BIN=<path to QEMU binary>
ENV_PATH=./env
CERTH_PATH=./certs
$QEMU_BIN -enable-kvm \
-smp 4 \
-m 8G,slots=5,maxmem=10G \
-cpu EPYC-v4 \
-machine q35 \
-no-reboot \
-drive if=pflash,format=raw,unit=0,file=$OVMF_CODE,readonly=on \
-drive if=pflash,format=raw,unit=1,file=$OVMF_VARS \
-netdev user,id=vmnic,hostfwd=tcp::7020-:7002 \
-device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vmnic \
-initrd $INITRD \
-kernel $KERNEL -append $APPEND \
-nographic \
-monitor pty \
-monitor unix:monitor,server,nowait \
-fsdev local,id=env_fs,path=$ENV_PATH,security_model=mapped \
-device virtio-9p-pci,fsdev=env_fs,mount_tag=env_share \
-fsdev local,id=cert_fs,path=$CERTH_PATH,security_model=mapped \
-device virtio-9p-pci,fsdev=cert_fs,mount_tag=certs_share
```
For a CVM, in another window, run the following command:
```bash
sudo \
MANAGER_QEMU_SMP_MAXCPUS=4 \
MANAGER_GRPC_URL=localhost:7001 \
MANAGER_LOG_LEVEL=debug \
MANAGER_QEMU_USE_SUDO=false \
MANAGER_QEMU_ENABLE_SEV=false \
MANAGER_QEMU_SEV_CBITPOS=51 \
MANAGER_QEMU_ENABLE_SEV_SNP=false \
MANAGER_QEMU_OVMF_CODE_FILE=/usr/share/edk2/x64/OVMF_CODE.fd \
MANAGER_QEMU_OVMF_VARS_FILE=/usr/share/edk2/x64/OVMF_VARS.fd \
go run main.go
# Create a directory for the environment file and the certificates for cloud certificates.
mkdir env
mkdir certs
# Enter the env directory and create the environemnt file.
cd env
touch environment
# Define Computations endpoint URL for agent.
# Make sure the Computation endpoint is running (like Cocos Prism).
echo AGENT_CVM_GRPC_URL=localhost:7001 >> ./environment
# Define log level for the agent.
echo AGENT_LOG_LEVEL=debug >> ./environment
cd ..
KERNEL=<path to kernel built with HAL>
INITRD=<path to initial RAM file system built with HAL>
APPEND="earlyprintk=serial console=ttyS0"
IGVM=<path to IGVM file>
QEMU_BIN=<path to QEMU binary>
ENV_PATH=./env
CERTH_PATH=./certs
$QEMU_BIN -enable-kvm \
-enable-kvm \
-cpu EPYC-v4 \
-machine q35 \
-smp 4,maxcpus=16 \
-m 8G,slots=5,maxmem=30G \
-netdev user,id=vmnic,hostfwd=tcp::7020-:7002 \
-device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vmnic,romfile= \
-machine confidential-guest-support=sev0,memory-backend=ram1,igvm-cfg=igvm0 \
-object memory-backend-memfd,id=ram1,size=8G,share=true,prealloc=false,reserve=false \
-object sev-snp-guest,id=sev0,cbitpos=51,reduced-phys-bits=1 \
-object igvm-cfg,id=igvm0,file=$IGVM \
-initrd $INITRD \
-kernel $KERNEL -append $APPEND \
-nographic \
-monitor pty \
-monitor unix:monitor,server,nowait \
-fsdev local,id=env_fs,path=$ENV_PATH,security_model=mapped \
-device virtio-9p-pci,fsdev=env_fs,mount_tag=env_share \
-fsdev local,id=cert_fs,path=$CERTH_PATH,security_model=mapped \
-device virtio-9p-pci,fsdev=cert_fs,mount_tag=certs_share
```
This command is run from the [manager main directory](../../../cmd/manager/). This will start the manager. Make sure you have already built the [qemu image](../../../hal/linux/README.md).
Make sure you have already built the [qemu image](../../../hal/linux/README.md) and the IGVM file from the COCONUT-SVSM [repository](https://github.com/coconut-svsm/svsm/blob/main/Documentation/docs/installation/INSTALL.md).
In another window, specify what kind of algorithm you want the Agent to run (docker):