Intel's Unaccepted Memory Support Updated For Substantially Faster Booting Of TDX VMs

Way back in August Intel posted a set of Linux kernel patches for supporting "unaccepted memory" by the Linux kernel in preparation for next-generation Xeon processors and speeding up the boot time for guest virtual machines making use of Intel's Trust Domain Extensions (TDX) security feature. Unaccepted memory support hasn't yet made it to the mainline kernel but now a second iteration of the patches have been posted.

UEFI 2.9 introduces the concept of memory acceptance and unaccepted memory. This makes it so guests need to "accept" memory before it can be allocated/used within the guest's environment while the actual acceptance handling is depending upon the VM hypervisor. This memory acceptance is important for Intel TDX and AMD SEV-SNP to avoid the expensive memory acceptance at boot time for new VMs and to instead make it on-demand / as-needed. It's also possible to be a security benefit in its own right by keeping the memory unaccepted until it's actually going to be used.

AMD with their SEV-SNP patches to date have relied on pre-validating the memory at boot time just as Intel is for the moment, but this forthcoming patch series is at least changing that on the Intel side. Some of this work by Intel can also be re-used by AMD developers for benefiting on their side as well.

Quite the win...

The benefit of EFI Unaccepted Memory to postponing its acceptance until later on is substantial: booting a VM with 4GB of TDX-protected memory is 2.5x faster with this patch series while a VM with 64GB of RAM and using TDX was 4x faster at booting.

The v2 unaccepted memory patches are undergoing review on the kernel mailing list. Due to the ongoing v5.17 merge window, the earliest we will now see this work land would be v5.18 that could be paired with more of their TDX work.