google / safeside

Understand and mitigate software-observable side-channels
BSD 3-Clause "New" or "Revised" License
493 stars 53 forks source link

Add a CI task for Intel C++ Compiler (ICC) #106

Open mmdriley opened 4 years ago

mmdriley commented 4 years ago

This is a low priority, but I spent a moment looking into it today and wanted to write down what I found.

Starting at https://software.intel.com/en-us/system-studio/choose-download

Use Intel® System Studio with a free license backed by community forum support. This license allows you to use the software for one year. You can refresh the license an unlimited number of times, allowing you to use the latest version.

Choosing the Linux host+target, you end up "downloading" a .zip file (it's actually created as a blob by the webpage) that contains:

The installation guide says to untar that installer and, for silent (unattended) install, change some values in silent.cfg.

In an Ubuntu 18.04 Docker container, I unzipped the download, untar'd the installer, changed the ACCEPT_EULA value in silent.cfg, and ran ./install.sh -s silent.cfg. The installer took a surprisingly long time, but I ended up with ICC in /opt/intel/system_studio_2019/bin/icc. I had to copy the license file into /opt/intel/licenses/, though I probably could have fixed that by setting other variables in silent.cfg.

OS prerequisites: apt install unzip cpio g++

asteinha commented 4 years ago

That looks very good. Making that work would be a significant improvement, because ICC has a relatively distinctive behavior.

rscohn2 commented 4 years ago

You can install intel compilers via yum and apt: https://software.intel.com/en-us/articles/oneapi-repo-instructions. This is a beta for oneapi and there is no license file required.

You can also use the HPC toolkit container: https://github.com/intel/oneapi-containers The container image is large, and some of the public CI systems don't have enough disk space. You could build your own container image with the components you need via apt.

junghans commented 4 years ago

@mmdriley thanks for the details, here is what we use in our docker container to setup icc:

RUN if [ -n "${INTEL}" ]; then \
  mkdir -p /var/lib/yum/intel-icc && \
  pushd /var/lib/yum/intel-icc && \
  wget --no-verbose http://registrationcenter-download.intel.com/akdlm/irc_nas/tec/16527/parallel_studio_xe_2020_update1_professional_edition.tgz && \
  tar -xf parallel_studio_xe_*.tgz && \
  rm parallel_studio_xe_*.tgz && \
  cd parallel_studio_xe_*/rpm && \
  printf "[icc]\nname=icc\nbaseurl=$PWD\nenabled=1" > /etc/yum.repos.d/icc.repo && \
  dnf -y update && \
  dnf --nogpgcheck -y install intel-parallel-studio-xe-icc intel-parallel-studio-xe-mkl && \
  dnf clean all && \
  mkdir /opt/intel/licenses; \
fi
ENV PATH=${INTEL:+/opt/intel/bin/:}${PATH}
ENV LD_LIBRARY_PATH=${INTEL:+/opt/intel/lib/intel64:}${LD_LIBRARY_PATH}
rscohn2 commented 3 years ago

We have published samples for all the public CI systems: https://github.com/oneapi-src/oneapi-ci