NE_START_ENCLAVE(9)

💖 NAME 💖

Okay so bestie, welcome to NE_START_ENCLAVE(9) from the Kernel API Manual — and no cap, this is the “hit start on the enclave” command. 💅

Not me being obsessed with an ioctl, but here we are — it’s giving main character energy, fr fr. 🎀

NE_START_ENCLAVE is the command used to trigger enclave start after the enclave resources, such as memory and CPU, have been set. The enclave start info is an input / output parameter. It includes info provided by the caller — enclave cid and flags — and returns the cid (if input cid is 0). The ioctl can be invoked on the enclave fd, after an enclave slot is created and resources, such as memory and vCPUs, are set for an enclave. ✨

🦋 SYNOPSIS 🦋

NE_START_ENCLAVE

🌸 CONTEXT 🌸

Process context. That’s the whole vibe check — literally process context. 🫶

🔥 RETURN 🔥

Here’s the return-value tea, bestie — the way that 0 is success and -1 is the “welp” path:

• 0 — Logic successfully completed. ✅
• -1 — There was a failure in the ioctl logic. On failure, errno is set to:
  • EFAULT — copy_from_user / copy_to_user failure.
  • NE_ERR_NOT_IN_INIT_STATE — The enclave is not in init state (init = before being started).
  • NE_ERR_NO_MEM_REGIONS_ADDED — No memory regions are set.
  • NE_ERR_NO_VCPUS_ADDED — No vCPUs are set.
  • NE_ERR_FULL_CORES_NOT_USED — Full core(s) not set for the enclave.
  • NE_ERR_ENCLAVE_MEM_MIN_SIZE — Enclave memory is less than minimum memory size (64 MiB).
  • NE_ERR_INVALID_FLAG_VALUE — The value of the provided flag is invalid.
  • NE_ERR_INVALID_ENCLAVE_CID — The provided enclave CID is invalid.
  • Error codes from the NE PCI device request.

👑 SEE ALSO 👑

Your required-reading list, bestie — every single reference from the original SEE ALSO, and I am not skipping a crumb 🍓:

• Kernel file ./include/uapi/linux/nitro_enclaves.h
• Nitro Enclaves (NE) Kernel Driver Interface(9)
• NE_CREATE_VM(9)
• NE_ADD_VCPU(9)
• NE_GET_IMAGE_LOAD_INFO(9)
• NE_SET_USER_MEMORY_REGION(9)
• NE specific error codes(9)
• NE_ERR_VCPU_ALREADY_USED(9)
• NE_ERR_VCPU_NOT_IN_CPU_POOL(9)
• NE_ERR_VCPU_INVALID_CPU_CORE(9)
• NE_ERR_INVALID_MEM_REGION_SIZE(9)
• NE_ERR_INVALID_MEM_REGION_ADDR(9)
• NE_ERR_UNALIGNED_MEM_REGION_ADDR(9)
• NE_ERR_MEM_REGION_ALREADY_USED(9)
• NE_ERR_MEM_NOT_HUGE_PAGE(9)
• NE_ERR_MEM_DIFFERENT_NUMA_NODE(9)
• NE_ERR_MEM_MAX_REGIONS(9)
• NE_ERR_NO_MEM_REGIONS_ADDED(9)
• NE_ERR_NO_VCPUS_ADDED(9)
• NE_ERR_ENCLAVE_MEM_MIN_SIZE(9)
• NE_ERR_FULL_CORES_NOT_USED(9)
• NE_ERR_NOT_IN_INIT_STATE(9)
• NE_ERR_INVALID_VCPU(9)
• NE_ERR_NO_CPUS_AVAIL_IN_POOL(9)
• NE_ERR_INVALID_PAGE_SIZE(9)
• NE_ERR_INVALID_FLAG_VALUE(9)
• NE_ERR_INVALID_ENCLAVE_CID(9)
• Image load info flags(9)
• NE_EIF_IMAGE(9)
• struct ne_image_load_info(9)
• User memory region flags(9)
• NE_DEFAULT_MEMORY_REGION(9)
• struct ne_user_memory_region(9)
• Enclave start info flags(9)
• NE_ENCLAVE_PRODUCTION_MODE(9)
• NE_ENCLAVE_DEBUG_MODE(9)
• struct ne_enclave_start_info(9)

This iconic page lives at ./include/uapi/linux, is dated October 2026, and goes by NE_START_ENCLAVE(9) — periodt. This page ate and left no crumbs, ngl. Go start those enclaves, bestie, and slay responsibly. 🫶💜