@@ -10,7 +10,7 @@ Overview
10
10
Software Guard eXtensions (SGX) hardware enables for user space applications
11
11
to set aside private memory regions of code and data:
12
12
13
- * Privileged (ring-0) ENCLS functions orchestrate the construction of the.
13
+ * Privileged (ring-0) ENCLS functions orchestrate the construction of the
14
14
regions.
15
15
* Unprivileged (ring-3) ENCLU functions allow an application to enter and
16
16
execute inside the regions.
@@ -91,7 +91,7 @@ In addition to the traditional compiler and linker build process, SGX has a
91
91
separate enclave “build” process. Enclaves must be built before they can be
92
92
executed (entered). The first step in building an enclave is opening the
93
93
**/dev/sgx_enclave ** device. Since enclave memory is protected from direct
94
- access, special privileged instructions are Then used to copy data into enclave
94
+ access, special privileged instructions are then used to copy data into enclave
95
95
pages and establish enclave page permissions.
96
96
97
97
.. kernel-doc :: arch/x86/kernel/cpu/sgx/ioctl.c
@@ -126,13 +126,13 @@ the need to juggle signal handlers.
126
126
ksgxd
127
127
=====
128
128
129
- SGX support includes a kernel thread called *ksgxwapd *.
129
+ SGX support includes a kernel thread called *ksgxd *.
130
130
131
131
EPC sanitization
132
132
----------------
133
133
134
134
ksgxd is started when SGX initializes. Enclave memory is typically ready
135
- For use when the processor powers on or resets. However, if SGX has been in
135
+ for use when the processor powers on or resets. However, if SGX has been in
136
136
use since the reset, enclave pages may be in an inconsistent state. This might
137
137
occur after a crash and kexec() cycle, for instance. At boot, ksgxd
138
138
reinitializes all enclave pages so that they can be allocated and re-used.
@@ -147,7 +147,7 @@ Page reclaimer
147
147
148
148
Similar to the core kswapd, ksgxd, is responsible for managing the
149
149
overcommitment of enclave memory. If the system runs out of enclave memory,
150
- *ksgxwapd * “swaps” enclave memory to normal memory.
150
+ *ksgxd * “swaps” enclave memory to normal memory.
151
151
152
152
Launch Control
153
153
==============
@@ -156,7 +156,7 @@ SGX provides a launch control mechanism. After all enclave pages have been
156
156
copied, kernel executes EINIT function, which initializes the enclave. Only after
157
157
this the CPU can execute inside the enclave.
158
158
159
- ENIT function takes an RSA-3072 signature of the enclave measurement. The function
159
+ EINIT function takes an RSA-3072 signature of the enclave measurement. The function
160
160
checks that the measurement is correct and signature is signed with the key
161
161
hashed to the four **IA32_SGXLEPUBKEYHASH{0, 1, 2, 3} ** MSRs representing the
162
162
SHA256 of a public key.
@@ -184,7 +184,7 @@ CPUs starting from Icelake use Total Memory Encryption (TME) in the place of
184
184
MEE. TME-based SGX implementations do not have an integrity Merkle tree, which
185
185
means integrity and replay-attacks are not mitigated. B, it includes
186
186
additional changes to prevent cipher text from being returned and SW memory
187
- aliases from being Created .
187
+ aliases from being created .
188
188
189
189
DMA to enclave memory is blocked by range registers on both MEE and TME systems
190
190
(SDM section 41.10).
0 commit comments