selftests/sgx: Make data measurement for an enclave segment optional
authorJarkko Sakkinen <jarkko@kernel.org>
Mon, 15 Nov 2021 18:35:16 +0000 (10:35 -0800)
committerDave Hansen <dave.hansen@linux.intel.com>
Mon, 15 Nov 2021 19:34:01 +0000 (11:34 -0800)
commit5f0ce664d8c6c160ce4333e809545a8a57fe2baf
tree37bc1877185833d5c02a39d5509317c8818004f3
parent39f62536be2f6160bba7294b5208e240d34703c3
selftests/sgx: Make data measurement for an enclave segment optional

For a heap makes sense to leave its contents "unmeasured" in the SGX
enclave build process, meaning that they won't contribute to the
cryptographic signature (a RSA-3072 signed SHA56 hash) of the enclave.

Enclaves are signed blobs where the signature is calculated both from
page data and also from "structural properties" of the pages.  For
instance a page offset of *every* page added to the enclave is hashed.

For data, this is optional, not least because hashing a page has a
significant contribution to the enclave load time. Thus, where there is
no reason to hash, do not. The SGX ioctl interface supports this with
SGX_PAGE_MEASURE flag. Only when the flag is *set*, data is measured.

Add seg->measure boolean flag to struct encl_segment. Only when the
flag is set, include the segment data to the signature (represented
by SIGSTRUCT architectural structure).

Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
Link: https://lkml.kernel.org/r/625b6fe28fed76275e9238ec4e15ec3c0d87de81.1636997631.git.reinette.chatre@intel.com
tools/testing/selftests/sgx/load.c
tools/testing/selftests/sgx/main.h
tools/testing/selftests/sgx/sigstruct.c