@@ -152,7 +152,7 @@ before launching.
152
152
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
153
153
As shown in :numref: `security-bootflow-uefi `, in this boot sequence,UEFI
154
154
authenticates and starts the ACRN hypervisor firstly,and hypervisor will return
155
- to UEFI enviorment to authenticate and load SOS kernel bootloader.
155
+ to UEFI environment to authenticate and load SOS kernel bootloader.
156
156
157
157
.. figure :: images/security-image-bootflow-uefi.png
158
158
:width: 900px
@@ -204,7 +204,8 @@ systems. To minimize the attack surfaces and achieve the goal of
204
204
"defense in depth", there are many common guidelines to ensure the
205
205
security of SOS system.
206
206
207
- As shown in :numref: `security-bootflow ` above, the integrity of the UOS
207
+ As shown in :numref: `security-bootflow-sbl ` and
208
+ :numref: `security-bootflow-uefi ` above, the integrity of the UOS
208
209
depends on the integrity of the DM module and vBIOS/vOSloader in the
209
210
SOS. Hence, SOS integrity is critical to the entire UOS security. If the
210
211
SOS system is compromised, all the other guest UOS VMs may be
@@ -833,8 +834,9 @@ Hypercall - Trusty Initialization
833
834
834
835
When a UOS is created by the DM in the SOS, if this UOS supports a
835
836
secure isolated world, then this hypercall will be invoked by OSLoader
836
- (it could be Android OS loader in :numref: `security-bootflow ` above) to
837
- create / initialize the secure world (Trusty/TEE).
837
+ (it could be Android OS loader in :numref: `security-bootflow-sbl ` and
838
+ :numref: `security-bootflow-uefi ` above) to create / initialize the
839
+ secure world (Trusty/TEE).
838
840
839
841
.. figure :: images/security-image9.png
840
842
:width: 900px
0 commit comments