Lines Matching refs:enclave

18 These memory regions are called enclaves. An enclave can be only entered at a
20 at a time.  While the enclave is loaded from a regular binary file by using
21 ENCLS functions, only the threads inside the enclave can access its memory. The
38 with an enclave. It is contained in a BIOS-reserved region of physical memory.
40 the enclave during enclave construction with special, limited SGX instructions.
42 Only a CPU executing inside an enclave can directly access enclave memory.
43 However, a CPU executing inside an enclave may access normal memory outside the
44 enclave.
46 The kernel manages enclave memory similar to how it treats device memory.
56    Regular EPC pages contain the code and data of an enclave.
59    Thread Control Structure pages define the entry points to an enclave and
60    track the execution state of an enclave thread.
71 which describes the owning enclave, access rights and page type among the other
75 kernel from, for instance, allowing writes to data which an enclave wishes to
82 power transitions when the ephemeral key that encrypts enclave memory is lost.
91 separate enclave “build” process.  Enclaves must be built before they can be
92 executed (entered). The first step in building an enclave is opening the
93 **/dev/sgx_enclave** device.  Since enclave memory is protected from direct
94 access, special privileged instructions are Then used to copy data into enclave
95 pages and establish enclave page permissions.
106 Entering an enclave can only be done through SGX-specific EENTER and ERESUME
108 transitioning to and from an enclave, enclaves typically utilize a library to
113 as part of their normal operation that need to be handled in the enclave or are
118 vDSO function wraps low-level transitions to/from the enclave like EENTER and
136 use since the reset, enclave pages may be in an inconsistent state.  This might
138 reinitializes all enclave pages so that they can be allocated and re-used.
141 EREMOVE function to each physical page. Some enclave pages like SECS pages have
149 overcommitment of enclave memory.  If the system runs out of enclave memory,
150 *ksgxwapd* “swaps” enclave memory to normal memory.
155 SGX provides a launch control mechanism. After all enclave pages have been
156 copied, kernel executes EINIT function, which initializes the enclave. Only after
157 this the CPU can execute inside the enclave.
159 ENIT function takes an RSA-3072 signature of the enclave measurement.  The function
167 the MSRs to match the enclave's signing key.
172 In order to conceal the enclave data while it is out of the CPU package, the
174 enclave memory.
189 DMA to enclave memory is blocked by range registers on both MEE and TME systems
200 into an enclave. The application can then make individual function calls into
201 the enclave through special SGX instructions. A run-time within the enclave is
202 configured to marshal function parameters into and out of the enclave and to
208 An application may be loaded into a container enclave which is specially
210 The enclave run-time and library OS work together to execute the application
211 when a thread enters the enclave.
244 EPC driver doesn't have a specific enclave associated with it. This is