AWS Nitro Enclaves guest driver
Guest-side Linux support for AWS Nitro Enclaves, a feature of EC2 Nitro instances that lets a running VM spawn an isolated, hardened child VM with no networking or persistent storage for handling secrets and confidential workloads. It only does anything useful when Linux is running as an EC2 guest on Nitro hardware (Intel, AMD, or Graviton), and has been a current AWS offering since 2020.
recommendation
Worth keeping but documenting its niche, because it only has a purpose inside AWS EC2 instances built on the Nitro hypervisor, where it lets a parent VM carve off an isolated child enclave for confidential computing. AWS still actively sells and expands the feature (Graviton support, EKS integration, multiple enclaves per instance through 2023), but upstream Linux activity has been light since the initial 2020 merge, with only occasional fixes in 2021-2022. A short note in the tree clarifying that this is AWS-cloud-only would help future maintainers.
repository signals
sources
- lore.kernel.org
Upstream lore shows substantive device-specific maintenance in 2021 ('Set Bus Master for the NE PCI device').
- lore.kernel.org
Upstream lore shows 2022 maintenance for the nitro_enclaves tests/KUnit coverage, indicating the code was still being tended after initial merge.
- docs.aws.amazon.com
AWS documents Nitro Enclaves as a current EC2 feature supported on most Intel, AMD, and Graviton Nitro-based instance types.
- docs.aws.amazon.com
AWS Nitro Enclaves documentation history records post-launch feature work such as EKS support, Graviton support, and multiple enclaves per instance through 2023.
- docs.aws.amazon.com
AWS continues to publish current Nitro System instance-family documentation, indicating the underlying platform remains in active new deployment.
codex reasoning notes (technical)
Lore evidence came from `lore_file_timeline` on `drivers/virt/nitro_enclaves/ne_pci_dev.c` and `drivers/virt/nitro_enclaves/ne_misc_dev.c`; it shows no obvious removal/deprecation thread, only limited driver-specific activity in 2021-2022 plus later treewide churn. Deployment evidence came from `web.search_query` on official AWS docs, which still describe Nitro Enclaves as a current EC2 feature on most Nitro instance types. This is a cloud-niche driver with real current platform relevance but sparse upstream attention, so `keep-annotate` fits better than deprecate/remove.