sgx.7: New page with overview of Software Guard eXtensions (SGX)
Jarkko Sakkinen
maintainerPATCH v10 1/1 sgx.7: New page with overview of Software Guard eXtensions (SGX)
---
v10:
* v9 was malformed, essentially a resend.
v9:
* Rename "Address Space" section as "Memory mapping", and refine the text.
* Rename "Ioctls" section as "Construction", and refine the text. v8:
* Fix errors reported for the previous version.
v7:
* Added more meat about the address space and API.
* Reorganized the text to have focus more on developer to have a big picture of kernel provided interfaces.
v6:
* Small fixes based on Dave's and Reinette's feedback.
* Extended the "Permissions" section to cover mmap()
v5:
* Taking away hardware concepts and focusing more on the interface. v4:
* Did a heavy edit trying to streamline the story a bit and focus on stuff important to the user (e.g. lighten up x86 details).
v3:
* Overhaul based on Michael's comments. Most likely needs to be refined in various places but this is at least a small step forward for sure.
v2:
* Fixed the semantic newlines convention and various style errors etc. that were reported by Alenjandro and Michael.
* SGX was merged to v5.
--- man7/sgx.7 | 147 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 147 insertions(+) create mode 100644 man7/sgx.7
man7/sgx.7 new file +147 -0
@@ -0,0 +1,147 @@ +.\" Copyright (C) 2021 Intel Corporation +.\" +.\" %%%LICENSE_START(VERBATIM) +.\" Permission is granted to make and distribute verbatim copies of this +.\" manual provided the copyright notice and this permission notice are +.\" preserved on all copies. +.\" +.\" Permission is granted to copy and distribute modified versions of this +.\" manual under the conditions for verbatim copying, provided that the +.\" entire resulting derived work is distributed under the terms of a +.\" permission notice identical to this one. +.\" +.\" Since the Linux kernel and libraries are constantly changing, this +.\" manual page may be incorrect or out-of-date. The author(s) assume no +.\" responsibility for errors or omissions, or for damages resulting from +.\" the use of the information contained herein. The author(s) may not +.\" have taken the same level of care in the production of this manual, +.\" which is licensed free of charge, as they might when working +.\" professionally. +.\" +.\" Formatted or processed versions of this manual, if unaccompanied by +.\" the source, must acknowledge the copyright and authors of this work. +.\" %%%LICENSE_END +.\" +.TH SGX 7 2021\-02\-02 "Linux" "Linux Programmer's Manual" +.PP +sgx - overview of Software Guard eXtensions +.SH SYNOPSIS +.EX +.B #include <asm/sgx.h> +.PP +.IB enclave " = open(""/dev/sgx_enclave", " O_RDWR);" +.EE +.SH DESCRIPTION +Intel Software Guard eXtensions (SGX) allow applications to host +enclaves, +protected executable objects in memory. +.PP +Enclaves are blobs of executable code, +running inside a CPU enforced container, +which is mapped to the process address space. +They are represented as the instances of +.I /dev/sgx_enclave. +They have a fixed set of entry points, +defined when the enclave is built. +.PP +SGX can be only available if the kernel is configured and built with the +.B CONFIG_X86_SGX +option. +If CPU, BIOS and kernel have SGX enabled, +.I sgx +appears in the +.I flags +field of +.IR /proc/cpuinfo . +.PP +If SGX appears not to be available, +ensure that SGX is enabled in the BIOS. +If a BIOS presents a choice between +.I Enabled +and +.I Software Enabled +modes for SGX, +choose +.I Enabled. +.PP +.SS Memory mapping +The file descriptor for an enclave can be shared among multiple processes. +An enclave is required by the CPU to be placed to an address, +which is a multiple of its size. +An address range containing a reasonable base address can be probed with an anonymous +.BR mmap(2) +call: +.PP +.EX +void *area = mmap(NULL, size * 2, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, + -1, 0); + +void *base = ((uint64_t)area + size - 1) & ~(size - 1); +.EE +.PP +The enclave file descriptor itself can be then mapped with the +.BR MAP_FIXED +flag set to the carved out memory. +.SS Construction +An enclave instance is created by opening +.I /dev/sgx_enclave. +Its contents are populated with the +.BR ioctl (2) +interface in +.IR <asm/sgx.h>: +.TP +.IB SGX_IOC_ENCLAVE_CREATE +Create SGX Enclave Control Structure (SECS) for the enclave. +SECS is a hardware defined structure, +which contains the global properties of an enclave. +.IB SGX_IOC_ENCLAVE_CREATE +is a one-shot call that fixes enclave's address and +size for the rest of its life-cycle. +.TP +.IB SGX_IOC_ENCLAVE_ADD_PAGES +Fill a range of the enclaves pages with the caller provided data and protection bits. +Memory mappings of the enclave can only have protection bits set, +which are defined in this ioctl. +The pages added are either regular memory pages for code and data, +or thread control structures (TCS). +The latter define the entry points to the enclave, +which can be entered after the initialization. +.TP +.IB SGX_IOC_ENCLAVE_INIT +Initialize the enclave for the run-time. +After a successful initialization, +no new pages can be added to the enclave. +.SS Invocation +Thread control structure (TCS) page are the entry points to the enclave, +which further define an offset inside the enclave where the execution begins. +The entry points are invoked with +.I __vdso_sgx_enter_enclave. +The prototype for the vDSO is defined by +.BR vdso_sgx_enter_enclave_t +in +.IR <asm/sgx.h>. +.SS Permissions +.PP +During the build process each enclave page is assigned protection bits, +as part of +.BR ioctl(SGX_IOC_ENCLAVE_ADD_PAGES). +These protections are also the maximum protections to which the page can be be mapped. +If +.BR mmap (2)_ +is called with higher protections than those defined during the build, +it will return +.B -EACCES. +If +.BR ioctl(SGX_IOC_ENCLAVE_ADD_PAGES) +is called after +.BR mmap (2) +with lower protections, +the caller receives +.BR SIGBUS, +once it accesses the page for the first time. +.SH VERSIONS +The SGX feature was added in Linux 5.11. +.SH SEE ALSO +.BR ioctl (2), +.BR mmap (2), +.BR mprotect (2)
Signature · 1 line
2.32.0
Hi Jarkko,
Quoted 1 line · Jarkko Sakkinen
Signed-off-by Jarkko Sakkinen <[email protected]>
...
Quoted 3 lines
+.TH SGX 7 2021\-02\-02 "Linux" "Linux Programmer's Manual" +.PP
+sgx - overview of Software Guard eXtensions
Is the "overview of" text necessary?
Quoted 5 lines
+.SH SYNOPSIS
+.EX
+.B #include <asm/sgx.h>
+.PP
+.IB enclave " =open(""/dev/sgx_enclave", " O_RDWR);"
I view the man page output using "man -l man7/sgx.7" and when I do so the above line is unbalanced: "enclave" and (unexpectedly) the comma are underlined and the line is displayed with a single instance of a double quote: enclave = open("/dev/sgx_enclave, O_RDWR);
Quoted 5 lines
+.EE
+.SH DESCRIPTIONman7/sgx.7 new file +3
-0+Intel Software Guard eXtensions (SGX) allow applications to host +enclaves, +protected executable objects in memory.
man7/sgx.7 line 47
Quoted 10 lines
man7/sgx.7 new file +10
-0+.PP +Enclaves are blobs of executable code, +running inside a CPU enforced container, +which is mapped to the process address space. +They are represented as the instances of +.I /dev/sgx_enclave. +They have a fixed set of entry points, +defined when the enclave is built. +.PP +SGX can be only available if the kernel is configured and built with the
can be only -> can only be?
Quoted 8 lines
+.B
CONFIG_X86_SGXman7/sgx.7 new file +7
-0+option. +If CPU, BIOS and kernel have SGX enabled, +.I sgx +appears in the +.I flags +field of +.IR /proc/cpuinfo .
man7/sgx.7 line 65
Quoted 10 lines
man7/sgx.7 new file +10
-0+.PP +If SGX appears not to be available, +ensure that SGX is enabled in the BIOS. +If a BIOS presents a choice between +.I Enabled +and +.I Software Enabled +modes for SGX, +choose +.I Enabled.
Earlier there is the underlined "/proc/cpuinfo" text followed by a period and here the "Enabled" text is followed by a period. In this instance the period is also underlined while previously it is not. Looking at some other man pages it seems that the custom is that the period should not be underlined and I will continue to point out instances I noticed where this is not the case.
Quoted 12 lines
+.PP
+.SS Memory mappingman7/sgx.7 new file +10
-0+The file descriptor for an enclave can be shared among multiple processes. +An enclave is required by the CPU to be placed to an address, +which is a multiple of its size. +An address range containing a reasonable base address can be probed with an anonymous +.BR mmap(2) +call: +.PP +.EX +void *area = mmap(NULL, size * 2, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, + -1, 0);
man7/sgx.7 line 87
Quoted 10 lines
man7/sgx.7 new file +10
-0+ +void *base = ((uint64_t)area + size - 1) & ~(size - 1); +.EE +.PP +The enclave file descriptor itself can be then mapped with the +.BR MAP_FIXED +flag set to the carved out memory. +.SS Construction +An enclave instance is created by opening +.I /dev/sgx_enclave.
Underlined period above.
man7/sgx.7 line 91
Quoted 4 lines
man7/sgx.7 new file +4
-0+Its contents are populated with the +.BR ioctl (2) +interface in +.IR <asm/sgx.h>:
Here also, should the above colon perhaps not be underlined?
man7/sgx.7 line 98
Quoted 7 lines
+.TP
+.IBSGX_IOC_ENCLAVE_CREATEman7/sgx.7 new file +5
-0+Create SGX Enclave Control Structure (SECS) for the enclave. +SECS is a hardware defined structure, +which contains the global properties of an enclave. +.IB SGX_IOC_ENCLAVE_CREATE +is a one-shot call that fixes enclave's address and
fixes enclave's -> fixes the enclave's ?
man7/sgx.7 line 102
Quoted 4 lines
man7/sgx.7 new file +4
-0+size for the rest of its life-cycle. +.TP +.IB SGX_IOC_ENCLAVE_ADD_PAGES +Fill a range of the enclaves pages with the caller provided data and protection bits.
Should this be "the enclave's pages"?
man7/sgx.7 line 104
Quoted 2 lines
man7/sgx.7 new file +2
-0+Memory mappings of the enclave can only have protection bits set, +which are defined in this ioctl.
This is a bit hard to understand. How about "Memory mappings of the enclave can only set protection bits that are defined in this ioctl."
Quoted 1 line
+The pages added are either regular memory pages for code and data
regular memory pages -> regular pages?
,
man7/sgx.7 line 115
Quoted 10 lines
man7/sgx.7 new file +10
-0+or thread control structures (TCS). +The latter define the entry points to the enclave, +which can be entered after the initialization. +.TP +.IB SGX_IOC_ENCLAVE_INIT +Initialize the enclave for the run-time. +After a successful initialization, +no new pages can be added to the enclave. +.SS Invocation +Thread control structure (TCS) page are the entry points to the enclave,
page are -> pages are ?
man7/sgx.7 line 118
Quoted 3 lines
man7/sgx.7 new file +3
-0+which further define an offset inside the enclave where the execution begins. +The entry points are invoked with +.I __vdso_sgx_enter_enclave.
Underlined period above.
man7/sgx.7 line 122
Quoted 4 lines
man7/sgx.7 new file +4
-0+The prototype for the vDSO is defined by +.BR vdso_sgx_enter_enclave_t +in +.IR <asm/sgx.h>.
Same above with the underlining of "."
man7/sgx.7 line 128
Quoted 6 lines
+.SS Permissions
+.PPman7/sgx.7 new file +4
-0+During the build process each enclave page is assigned protection bits, +as part of +.BR ioctl(SGX_IOC_ENCLAVE_ADD_PAGES). +These protections are also the maximum protections to which the page can be be mapped.
to which -> with which ?
Quoted 2 lines
+If
+.BR mmap (2)_
Unexpected "_" above
man7/sgx.7 line 143
Quoted 13 lines
man7/sgx.7 new file +13
-0+is called with higher protections than those defined during the build, +it will return +.B -EACCES. +If +.BR ioctl(SGX_IOC_ENCLAVE_ADD_PAGES) +is called after +.BR mmap (2) +with lower protections, +the caller receives +.BR SIGBUS, +once it accesses the page for the first time. +.SH VERSIONS +The SGX feature was added in Linux 5.11.
This does not document the SGX_IOC_VEPC_REMOVE ioctl that was added in v5.16. How do you envision additions to this page as new features are added to the Linux support of SGX?
Quoted 6 lines
+.SH SEE ALSO
+.BR ioctl (2),
+.BR mmap (2),
+.BR mprotect (2)
\ No newline at end of file
Reinette
Jarkko Sakkinen
maintainerQuoted 5 lines · Reinette Chatre
Hi Jarkko,
Quoted 1 line · Jarkko Sakkinen
Signed-off-by Jarkko Sakkinen <[email protected]>
Quoted 7 lines
...
Quoted 3 lines
+.TH SGX 7 2021\-02\-02 "Linux" "Linux Programmer's Manual" +.PP
+sgx - overview of Software Guard eXtensionsIs the "overview of" text necessary?
It's more or less a convention:
$ git grep "overview of" man7 | wc -l 29
Quoted 10 lines
Quoted 5 lines
+.SH SYNOPSIS
+.EX
+.B #include <asm/sgx.h>
+.PP
+.IB enclave " =open(""/dev/sgx_enclave", " O_RDWR);"I view the man page output using "man -l man7/sgx.7" and when I do so the above line is unbalanced: "enclave" and (unexpectedly) the comma are underlined and the line is displayed with a single instance of a double
quote: enclave =open("/dev/sgx_enclave, O_RDWR);
After some trial and error, and looking at symlink.7, this seems to fix it:
-.IB enclave " = open(""/dev/sgx_enclave", " O_RDWR);" +.IB enclave " = open(""/dev/sgx_enclave"", O_RDWR);"
Does this fix for you?
Quoted 11 lines
man7/sgx.7 line 43
Quoted 11 lines
+.EE
+.SH DESCRIPTIONman7/sgx.7 new file +9
-0+Intel Software Guard eXtensions (SGX) allow applications to host +enclaves, +protected executable objects in memory. +.PP +Enclaves are blobs of executable code, +running inside a CPU enforced container, +which is mapped to the process address space. +They are represented as the instances of +.I /dev/sgx_enclave.
.IR /dev/sgx_enclave .
Quoted 6 lines
man7/sgx.7 line 47
Quoted 4 lines
man7/sgx.7 new file +4
-0+They have a fixed set of entry points, +defined when the enclave is built. +.PP +SGX can be only available if the kernel is configured and built with thecan be only -> can only be?
Agreed, I'll fix this.
Quoted 17 lines
Quoted 17 lines
+.B
CONFIG_X86_SGXman7/sgx.7 new file +16
-0+option. +If CPU, BIOS and kernel have SGX enabled, +.I sgx +appears in the +.I flags +field of +.IR /proc/cpuinfo . +.PP +If SGX appears not to be available, +ensure that SGX is enabled in the BIOS. +If a BIOS presents a choice between +.I Enabled +and +.I Software Enabled +modes for SGX, +choose
Quoted 8 lines
Quoted 1 line
+.I Enabled.
Earlier there is the underlined "
/proc/cpuinfo" text followed by a period and here the "Enabled" text is followed by a period. In this instance the period is also underlined while previously it is not. Looking at some other man pages it seems that the custom is that the period should not be underlined and I will continue to point out instances I noticed where this is not the case.
This most related to my very weak understanding of troff syntax.
I changed it to:
-.I Enabled.
+.IR Enabled .
This does seem to fix the issue, and aligns with this:
https://www.gnu.org/software/groff/manual/html_node/Man-font-macros.html
Quoted 16 lines
Quoted 16 lines
+.PP
+.SS Memory mappingman7/sgx.7 new file +14
-0+The file descriptor for an enclave can be shared among multiple processes. +An enclave is required by the CPU to be placed to an address, +which is a multiple of its size. +An address range containing a reasonable base address can be probed with an anonymous +.BR mmap(2) +call: +.PP +.EX +void *area = mmap(NULL, size * 2, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, + -1, 0); + +void *base = ((uint64_t)area + size - 1) & ~(size - 1); +.EE +.PP
Quoted 8 lines
man7/sgx.7 line 87
Quoted 6 lines
man7/sgx.7 new file +6
-0+The enclave file descriptor itself can be then mapped with the +.BR MAP_FIXED +flag set to the carved out memory. +.SS Construction +An enclave instance is created by opening +.I /dev/sgx_enclave.Underlined period above.
Thanks. I spotted similar error also early in the text.
Quoted 6 lines
man7/sgx.7 line 91
Quoted 4 lines
man7/sgx.7 new file +4
-0+Its contents are populated with the +.BR ioctl (2) +interface in +.IR <asm/sgx.h>:Here also, should the above colon perhaps not be underlined?
Yeah, similarly:
.IR <asm/sgx.h>:
+.IR <asm/sgx.h> :
Quoted 9 lines
man7/sgx.7 line 98
Quoted 7 lines
+.TP
+.IBSGX_IOC_ENCLAVE_CREATEman7/sgx.7 new file +5
-0+Create SGX Enclave Control Structure (SECS) for the enclave. +SECS is a hardware defined structure, +which contains the global properties of an enclave. +.IB SGX_IOC_ENCLAVE_CREATE +is a one-shot call that fixes enclave's address andfixes enclave's -> fixes the enclave's ?
Ack.
Quoted 6 lines
man7/sgx.7 line 102
Quoted 4 lines
man7/sgx.7 new file +4
-0+size for the rest of its life-cycle. +.TP +.IB SGX_IOC_ENCLAVE_ADD_PAGES +Fill a range of the enclaves pages with the caller provided data and protection bits.Should this be "the enclave's pages"?
I think so.
Quoted 5 lines
man7/sgx.7 line 104
Quoted 2 lines
man7/sgx.7 new file +2
-0+Memory mappings of the enclave can only have protection bits set, +which are defined in this ioctl.This is a bit hard to understand. How about "Memory mappings of the enclave can only set protection bits that are defined in this ioctl."
Changed, thanks.
Quoted 3 lines
Quoted 1 line
+The pages added are either regular memory pages for code and data
regular memory pages -> regular pages?
Changed.
Quoted 14 lines
,
man7/sgx.7 line 115
Quoted 10 lines
man7/sgx.7 new file +10
-0+or thread control structures (TCS). +The latter define the entry points to the enclave, +which can be entered after the initialization. +.TP +.IB SGX_IOC_ENCLAVE_INIT +Initialize the enclave for the run-time. +After a successful initialization, +no new pages can be added to the enclave. +.SS Invocation +Thread control structure (TCS) page are the entry points to the enclave,page are -> pages are ?
Thanks, good catch.
Quoted 5 lines
man7/sgx.7 line 118
Quoted 3 lines
man7/sgx.7 new file +3
-0+which further define an offset inside the enclave where the execution begins. +The entry points are invoked with +.I __vdso_sgx_enter_enclave.Underlined period above.
.I __vdso_sgx_enter_enclave.
+.IR __vdso_sgx_enter_enclave .
Quoted 7 lines
man7/sgx.7 line 122
Quoted 4 lines
man7/sgx.7 new file +4
-0+The prototype for the vDSO is defined by +.BR vdso_sgx_enter_enclave_t +in +.IR <asm/sgx.h>.Same above with the underlining of "."
Quoted 8 lines
man7/sgx.7 line 128
Quoted 6 lines
+.SS Permissions
+.PPman7/sgx.7 new file +4
-0+During the build process each enclave page is assigned protection bits, +as part of +.BR ioctl(SGX_IOC_ENCLAVE_ADD_PAGES). +These protections are also the maximum protections to which the page can be be mapped.to which -> with which ?
Ack.
Quoted 5 lines
Quoted 3 lines
+If
+.BR mmap (2)_Unexpected "_" above
Thanks.
Quoted 10 lines
Quoted 10 lines
man7/sgx.7 new file +9
-0+is called with higher protections than those defined during the build, +it will return +.B -EACCES. +If +.BR ioctl(SGX_IOC_ENCLAVE_ADD_PAGES) +is called after +.BR mmap (2) +with lower protections, +the caller receives
Quoted 8 lines
man7/sgx.7 line 143
Quoted 4 lines
+.BR SIGBUS,
man7/sgx.7 new file +3
-0+once it accesses the page for the first time. +.SH VERSIONS +The SGX feature was added in Linux 5.11.This does not document the
SGX_IOC_VEPC_REMOVEioctl that was added in v5.16. How do you envision additions to this page as new features are added to the Linux support of SGX?
I started this before any of KVM stuff was in upstream. It'd be better to get the basic ioctl's done first. I cannot really give estimate for vepc at this point.
For future features (e.g. SGX2), the expectation is that the feature is supported by an associated man page update.
Quoted 8 lines
Quoted 6 lines
+.SH SEE ALSO
+.BR ioctl (2),
+.BR mmap (2),
+.BR mprotect (2)
\ No newline at end of fileReinette
Thanks for valuable feedback.
/Jarkko
Hi Jarkko,
Quoted 2 lines · Jarkko Sakkinen
Quoted 1 line · Reinette Chatre
On 11/30/2021 9:50 AM, Jarkko Sakkinen wrote:
...
Quoted 11 lines
Quoted 10 lines
Quoted 5 lines
+.SH SYNOPSIS
+.EX
+.B #include <asm/sgx.h>
+.PP
+.IB enclave " =open(""/dev/sgx_enclave", " O_RDWR);"I view the man page output using "man -l man7/sgx.7" and when I do so the above line is unbalanced: "enclave" and (unexpectedly) the comma are underlined and the line is displayed with a single instance of a double
quote: enclave =open("/dev/sgx_enclave, O_RDWR);
Quoted 7 lines
After some trial and error, and looking at symlink.7, this seems to fix it:
-.IB enclave " =
open(""/dev/sgx_enclave", " O_RDWR);" +.IB enclave " =open(""/dev/sgx_enclave"", O_RDWR);"Does this fix for you?
Yes, thank you. When looking at your updated patch I see that only enclave is underlined and the quotes are matching.
...
Quoted 18 lines
Quoted 9 lines
Quoted 9 lines
man7/sgx.7 new file +9
-0+is called with higher protections than those defined during the build, +it will return +.B -EACCES. +If +.BR ioctl(SGX_IOC_ENCLAVE_ADD_PAGES) +is called after +.BR mmap (2) +with lower protections, +the caller receivesQuoted 8 lines
man7/sgx.7 line 143
Quoted 4 lines
+.BR SIGBUS,
man7/sgx.7 new file +3
-0+once it accesses the page for the first time. +.SH VERSIONS +The SGX feature was added in Linux 5.11.This does not document the
SGX_IOC_VEPC_REMOVEioctl that was added in v5.16. How do you envision additions to this page as new features are added to the Linux support of SGX?
Quoted 3 lines
I started this before any of KVM stuff was in upstream. It'd be better to get the basic ioctl's done first. I cannot really give estimate for vepc at this point.
SGX_IOC_VEPC_REMOVE_ALL can be found in v5.16.
Quoted 3 lines
For future features (e.g. SGX2), the expectation is that the feature is supported by an associated man page update.
ok, thank you.
Reinette
Jarkko Sakkinen
maintainerQuoted 50 lines · Reinette Chatre
Hi Jarkko,
Quoted 2 lines · Jarkko Sakkinen
Quoted 1 line · Reinette Chatre
On 11/30/2021 9:50 AM, Jarkko Sakkinen wrote:
...
Quoted 11 lines
Quoted 10 lines
Quoted 5 lines
+.SH SYNOPSIS
+.EX
+.B #include <asm/sgx.h>
+.PP
+.IB enclave " =open(""/dev/sgx_enclave", " O_RDWR);"I view the man page output using "man -l man7/sgx.7" and when I do so the above line is unbalanced: "enclave" and (unexpectedly) the comma are underlined and the line is displayed with a single instance of a double
quote: enclave =open("/dev/sgx_enclave, O_RDWR);Quoted 7 lines
After some trial and error, and looking at symlink.7, this seems to fix it:
-.IB enclave " =
open(""/dev/sgx_enclave", " O_RDWR);" +.IB enclave " =open(""/dev/sgx_enclave"", O_RDWR);"Does this fix for you?
Yes, thank you. When looking at your updated patch I see that only enclave is underlined and the quotes are matching.
...
Quoted 18 lines
Quoted 17 lines
man7/sgx.7 line 143
Quoted 13 lines
man7/sgx.7 new file +13
-0+is called with higher protections than those defined during the build, +it will return +.B -EACCES. +If +.BR ioctl(SGX_IOC_ENCLAVE_ADD_PAGES) +is called after +.BR mmap (2) +with lower protections, +the caller receives +.BR SIGBUS, +once it accesses the page for the first time. +.SH VERSIONS +The SGX feature was added in Linux 5.11.This does not document the
SGX_IOC_VEPC_REMOVEioctl that was added in v5.16. How do you envision additions to this page as new features are added to the Linux support of SGX?
Quoted 5 lines
Quoted 3 lines
I started this before any of KVM stuff was in upstream. It'd be better to get the basic ioctl's done first. I cannot really give estimate for vepc at this point.
SGX_IOC_VEPC_REMOVE_ALLcan be found in v5.16.
I'd get the basic API documentation ready first and continue to that after it is final.
Quoted 7 lines
Quoted 3 lines
For future features (e.g. SGX2), the expectation is that the feature is supported by an associated man page update.
ok, thank you.
Reinette
/Jarkko