Blob loading feature #5
Conversation
jhand2
left a comment
jhand2
left a comment
There was a problem hiding this comment.
Looks good from a technical perspective. I just have some questions about interfacing with this feature externally.
If we do intend for this feature to be used by callers other than OE internal code, we should add some documentation about what its for.
| @@ -0,0 +1,88 @@ | |||
| # Copyright (c) Microsoft Corporation. All rights reserved. | |||
There was a problem hiding this comment.
What are the constaints about what the blob can/should contain? It seems like comments are legal. Is it just up to enclave writer to throw whatever they want in here and use it as they wish or should OE expect some format?
| unsigned char* data; | ||
| size_t size; | ||
|
|
||
| if (elf64_find_section(elf, ".oeblob", &data, &size) == 0) |
There was a problem hiding this comment.
should there be tooling in OE to add the oeblob section? Seems like an odd developer experience to tell people to add a section to their binary as they wish.
| **============================================================================== | ||
| */ | ||
|
|
||
| const void* __oe_get_blob_base() |
There was a problem hiding this comment.
Are these intended to be public functions called by enclave developers (it seems no because its in an internal header)? If enclave writers are expected to be able to use this feature it probably makes sense to provide a public API and a reasoning for why one would use it.
This PR extends Open Enclave to load and measure .oeblob ELF sections if present. Once loaded, enclaves can access the blob with the following functions:
Blob sections can be added to enclave image files with the objcopy command as shown in the following example.
The blob test (tests/blob) shows how to use the feature end-to-end.