NE_CREATE_VM(9)

💖 NE_CREATE_VM(9) 💖

okay bestie, so we're in the Kernel API Manual today and this page is lowkey the moment an enclave VM gets its whole identity ✨ like it's the "you get a slot, you get a slot" of the Nitro Enclaves world 🎀

---

💅 NAME 💅

NE_CREATE_VM — the command that creates a slot associated with an enclave VM, and hands you back a generated unique slot id as an output parameter 🫶

so how does this work, exactly? the ioctl can be invoked on the /dev/nitro_enclaves fd before you set any resources for an enclave — you know, stuff like memory and vCPUs. memory and vCPUs get set for the slot that's mapped to an enclave. and here's the tea: a NE CPU pool has to be set before calling this function ☝️ you can set that pool after the NE driver loads, using /sys/module/nitro_enclaves/parameters/ne_cpus. its format is the detailed one in the cpu-lists section right here:

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html

and not me reminding you but: CPU 0 and its siblings have to remain available for the primary / parent VM, so they cannot be set for enclaves 🙈 also, full CPU core(s), from the same NUMA node, need(s) to be included in the CPU pool. no halfsies, no cap 🧚

---

✨ SYNOPSIS ✨

NE_CREATE_VM

---

🦋 CONTEXT 🦋

Process context. that's it, that's the vibe 💜

---

👑 RETURN 👑

• Enclave file descriptor — the enclave file descriptor used with ioctl calls to set vCPUs and memory regions, then start the enclave 🔥
• -1 — there was a failure in the ioctl logic. on failure, errno is set to:
  • EFAULT — copy_to_user failure.
  • ENOMEM — memory allocation failure for internal bookkeeping variables.
  • NE_ERR_NO_CPUS_AVAIL_IN_POOL — no NE CPU pool set / no CPUs available in the pool.
  • Error codes from get_unused_fd_flags and anon_inode_getfile.
  • Error codes from the NE PCI device request.

---

🌈 SEE ALSO 🌈

Kernel file ./include/uapi/linux/nitro_enclaves.h, Nitro Enclaves (NE) Kernel Driver Interface(9), NE_ADD_VCPU(9), NE_GET_IMAGE_LOAD_INFO(9), NE_SET_USER_MEMORY_REGION(9), NE_START_ENCLAVE(9), NE specific error codes(9), NE_ERR_VCPU_ALREADY_USED(9), NE_ERR_VCPU_NOT_IN_CPU_POOL(9), NE_ERR_VCPU_INVALID_CPU_CORE(9), NE_ERR_INVALID_MEM_REGION_SIZE(9), NE_ERR_INVALID_MEM_REGION_ADDR(9), NE_ERR_UNALIGNED_MEM_REGION_ADDR(9), NE_ERR_MEM_REGION_ALREADY_USED(9), NE_ERR_MEM_NOT_HUGE_PAGE(9), NE_ERR_MEM_DIFFERENT_NUMA_NODE(9), NE_ERR_MEM_MAX_REGIONS(9), NE_ERR_NO_MEM_REGIONS_ADDED(9), NE_ERR_NO_VCPUS_ADDED(9), NE_ERR_ENCLAVE_MEM_MIN_SIZE(9), NE_ERR_FULL_CORES_NOT_USED(9), NE_ERR_NOT_IN_INIT_STATE(9), NE_ERR_INVALID_VCPU(9), NE_ERR_NO_CPUS_AVAIL_IN_POOL(9), NE_ERR_INVALID_PAGE_SIZE(9), NE_ERR_INVALID_FLAG_VALUE(9), NE_ERR_INVALID_ENCLAVE_CID(9), Image load info flags(9), NE_EIF_IMAGE(9), struct ne_image_load_info(9), User memory region flags(9), NE_DEFAULT_MEMORY_REGION(9), struct ne_user_memory_region(9), Enclave start info flags(9), NE_ENCLAVE_PRODUCTION_MODE(9), NE_ENCLAVE_DEBUG_MODE(9), struct ne_enclave_start_info(9)

---

and that's the whole page, bestie 💖 this one lives at ./include/uapi/linux, dated October 2026, and it goes by NE_CREATE_VM(9) — slay, go create some enclaves 🧚‍♀️✨