sgx_ioc_enclave_add_pages(9)

💅 sgx_ioc_enclave_add_pages(9) — like, the kernel API manual, bestie ✨

okay so picture this: it's a page from the Kernel API Manual and it's all about sgx_ioc_enclave_add_pages and honestly? she's lowkey iconic. let's get into it 🫶

---

🌸 NAME 🌸

sgx_ioc_enclave_add_pages — the handler for %SGX_IOC_ENCLAVE_ADD_PAGES 💖

---

✨ SYNOPSIS ✨

long sgx_ioc_enclave_add_pages (struct sgx_encl *encl , void __user *arg
);

---

🎀 ARGUMENTS 🎀

• encl — an enclave pointer, bestie. that's the whole vibe.
• arg — a user pointer to a struct sgx_enclave_add_pages instance 🦋

---

👑 DESCRIPTION 👑

So what she does: she adds one or more pages to an uninitialized enclave, and optionally extends the measurement with the contents of the page. and the SECINFO + the measurement mask? those get applied to all the pages. periodt. 💅

Now, a SECINFO for a TCS is required to always contain zero permissions, because the CPU silently zeros them 😭. Allowing anything else would cause a mismatch in the measurement — so like, don't.

mmap's protection bits are capped by the page permissions. For each page address, the maximum protection bits are computed with the following heuristics:

1. A regular page: PROT_R, PROT_W and PROT_X match the SECINFO permissions.
2. A TCS page: PROT_R | PROT_W.

mmap is not allowed to surpass the minimum of the maximum protection bits within the given address range. no cap, fr fr 🙈

⚠️ The function deinitializes kernel data structures for enclave and returns -EIO in any of the following conditions:

• Enclave Page Cache (EPC), the physical memory holding enclaves, has been invalidated. This will cause EADD and EEXTEND to fail. 💀
• If the source address is corrupted somehow when executing EADD.

---

🔥 RETURN 🔥

• 0: Success. slay 💖
• -EACCES: The source page is located in a noexec partition.
• -ENOMEM: Out of EPC pages. 😭
• -EINTR: The call was interrupted before data was processed.
• -EIO: Either EADD or EEXTEND failed because invalid source address or power cycle.
• -errno: POSIX error.

---

🌈 SEE ALSO 🌈

Kernel file ./arch/x86/kernel/cpu/sgx/ioctl.c 💫

• sgx_ioc_enclave_create(9)
• sgx_ioc_enclave_init(9)
• sgx_ioc_enclave_provision(9)
• sgx_enclave_restrict_permissions(9)
• sgx_ioc_enclave_restrict_permissions(9)
• sgx_enclave_modify_types(9)
• sgx_ioc_enclave_modify_types(9)
• sgx_encl_remove_pages(9)
• sgx_ioc_enclave_remove_pages(9)

---

and that's the whole page, bestie 🧚 ngl she lives at ./arch/x86/kernel/cpu/sgx, stamped October 2026 — go off, king 👑💜