SAMPLE FLOW OF USING THE IOCTL INTERFACE PROVIDED BY THE NITRO ENCLAVES (NE)(9)

🧚 SAMPLE FLOW OF USING THE IOCTL INTERFACE PROVIDED BY THE NITRO ENCLAVES (NE)(9) 🧚

okay so bestie, this is the Kernel API Manual page for Sample flow of using the ioctl interface provided by the Nitro Enclaves (NE) — yes, the (9) section, and yes, it’s giving “niche kernel lore” and we’re obsessed. It walks through the sample flow of using the ioctl interface provided by the Nitro Enclaves (NE) kernel driver. 💅✨

---

💻 USAGE 💻

🌱 Load the module + set the enclave CPU pool

Load the nitro_enclaves module, setting also the enclave CPU pool. The enclave CPUs need to be full cores from the same NUMA node. CPU 0 and its siblings have to remain available for the primary / parent VM, so they cannot be included in the enclave CPU pool.

See the cpu list section from the kernel documentation: https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html#cpu-lists

insmod drivers/virt/nitro_enclaves/nitro_enclaves.ko
lsmod

🌀 Set the CPU pool at runtime

The CPU pool can be set at runtime, after the kernel module is loaded.

echo <cpu-list> > /sys/module/nitro_enclaves/parameters/ne_cpus

🔍 NUMA + CPU siblings + online/offline check

NUMA and CPU siblings information can be found using lscpu / /proc/cpuinfo.

Check the online / offline CPU list. The CPUs from the pool should be offlined.

lscpu

🧾 dmesg check

Check dmesg for any warnings / errors through the NE driver lifetime / usage. The NE logs contain the "nitro_enclaves" or "pci 0000:00:02.0" pattern.

dmesg

🐘 hugetlbfs huge pages

Setup hugetlbfs huge pages. The memory needs to be from the same NUMA node as the enclave CPUs.

https://www.kernel.org/doc/html/latest/admin-guide/mm/hugetlbpage.html

By default, the allocation of hugetlb pages are distributed on all possible NUMA nodes. Use the following configuration files to set the number of huge pages from a NUMA node:

/sys/devices/system/node/node<X>/hugepages/hugepages-2048kB/nr_hugepages
/sys/devices/system/node/node<X>/hugepages/hugepages-1048576kB/nr_hugepages

or, if not on a system with multiple NUMA nodes, can also set the number of 2 MiB / 1 GiB huge pages using

/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages
/sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages

In this example 256 hugepages of 2 MiB are used.

🛠️ Build and run the NE sample

Build and run the NE sample.

make -C samples/nitro_enclaves clean
make -C samples/nitro_enclaves
./samples/nitro_enclaves/ne_ioctl_sample <path_to_enclave_image>

📤 Unload the module

Unload the nitro_enclaves module.

rmmod nitro_enclaves
lsmod

---

👀 SEE ALSO 👀

Kernel file: ./samples/nitro_enclaves/ne_ioctl_sample.c

• NE_DEV_NAME(9)
• NE_POLL_WAIT_TIME(9)
• NE_POLL_WAIT_TIME_MS(9)
• NE_SLEEP_TIME(9)
• NE_DEFAULT_NR_VCPUS(9)
• NE_MIN_MEM_REGION_SIZE(9)
• NE_DEFAULT_NR_MEM_REGIONS(9)
• NE_IMAGE_LOAD_HEARTBEAT_CID(9)
• NE_IMAGE_LOAD_HEARTBEAT_PORT(9)
• NE_IMAGE_LOAD_HEARTBEAT_VALUE(9)
• struct ne_user_mem_region(9)
• ne_create_vm(9)
• ne_poll_enclave_fd(9)
• ne_alloc_user_mem_region(9)
• ne_load_enclave_image(9)
• ne_set_user_mem_region(9)
• ne_free_mem_regions(9)
• ne_add_vcpu(9)
• ne_start_enclave(9)
• ne_start_enclave_check_booted(9)

---

okay that’s the whole page bestie 💖 source/version: ./samples/nitro_enclaves; date: October 2026; page: Sample flow ...nclaves (NE)(9). slay, go be iconic with your enclave CPU pool 🌸🦋