Linux 7.4 merges Dynamic PAMT to cut Intel TDX memory overhead

Intel's Dynamic PAMT feature has been merged for Linux 7.4, targeting servers running Intel Trust Domain Extensions (TDX). Previously, TDX required reserving roughly 0.4% of total system RAM upfront for Physical Address Metadata Table (PAMT) structures regardless of actual VM load. The new implementation allocates metadata in 2 MB chunks as needed. The same TDX module update also adds quote buffer size enumeration to accommodate larger post-quantum cryptography attestation quotes.

How Dynamic PAMT changes TDX memory allocation

• Before: TDX host systems statically reserved ~0.4% of physical memory for PAMT metadata; this was all-or-nothing
• After: Dynamic PAMT allocates metadata in 2 MB increments of host memory as TDX VMs are created
• Benefit: Unused metadata memory remains available to the host when TDX utilization is low
• Secondary change: TDX module now enumerates quote buffer sizes, replacing fixed 128 KB buffers too small for post-quantum cryptography
• Scope: Affects Intel Xeon servers with TDX enabled; no change for non-TDX workloads

Why it matters

For data centers running Intel TDX, this removes a significant memory tax on hosts that are not fully saturated with confidential VMs. Given current DRAM pricing and supply constraints, reclaiming hundreds of gigabytes on large-memory Xeon systems is operationally meaningful.