Unaccepted Memory Merged For Linux 6.5, Helping AMD SEV-SNP + Intel TDX

As was anticipated, UEFI Unaccepted Memory support was successfully merged for Linux 6.5 to support this standard that's important with the likes of Intel Trusted Domain Extensions (TDX) and AMD Secure Encrypted Virtualization Secure Nested Page (SEV-SNP) backed virtual machines.

UEFI unaccepted memory support allows for virtual machines to not "accept" the memory until it's actually needed. Up to this point with AMD and Intel secure VMs, all memory had to be accepted immediately at boot time. Needing to deal with all of the memory allocated at boot time can delay the boot process while now supporting UEFI Unaccepted Memory can lead to much faster TDX VM boot times as a result. Intel previously reported that with unaccepted memory support for Sapphire Rapids with Intel TDX, booting to a shell is around 2.5x faster for a 4G TDX VM but can be around 4x faster with 64G of memory available to the VM. Not accepting memory until it's going to actually be used by the virtual machine is also helpful in preventing various attacks on VMs like memory replay.

This code merged for Linux 6.5 allows for the on-demand acceptance of memory in VMs as needed and is wired up both for AMD SEV and Intel TDX. This Linux kernel work on unaccepted memory handling has been in the works the past two years, so it's great to see the code finally over the finish line and mainlined.

Linus Torvalds picked up the UEFI Unaccepted Memory support via the x86/cc pull of the confidential computing updates for the Linux 6.5 merge window.