Linux 7.4 merges Intel TDX Dynamic PAMT to save server RAM

Linux 7.4 has merged Dynamic PAMT, Phoronix reported on October 20, 2026. The Intel feature lets servers running confidential virtual machines stop reserving a fixed slice of memory at boot. Today that slice is about 0.4% of system RAM, paid whether the machine runs one protected VM or none. With memory prices high, giving that RAM back to ordinary work matters to anyone running large Intel servers.

What TDX and PAMT are

TDX, short for Trust Domain Extensions, is Intel's way of running confidential virtual machines. A confidential VM keeps its memory encrypted and hidden even from the host system that runs it. The idea is that a customer's data stays private even from whoever runs the hardware.

To keep that promise, the TDX module tracks every page of memory on the machine. A page is the small block, usually 4KB, that the system manages memory in. The tracking data lives in the Physical Address Metadata Table, or PAMT.

Until now, Linux allocated the whole PAMT when TDX started. "These static allocations take roughly 0.4% of system memory," Rick Edgecombe wrote in the patch series cover letter. Dave Hansen put it more bluntly in the pull request quoted by Phoronix: "This is all-or-nothing; you either pay the 0.4% or can not use TDX."

How Dynamic PAMT changes it

Dynamic PAMT allocates the most detailed part of the table only when it is needed. The PAMT has three levels, matching memory blocks of 1GB, 2MB and 4KB. The 1GB and 2MB levels are still set up at start. The 4KB level, which tracks the smallest pages, is now filled in at runtime, according to the patch notes.

Detail	Before Linux 7.4	With Dynamic PAMT
When the 4KB-level table is allocated	All at once, when TDX starts	On demand, 2MB of host memory at a time
Memory reserved	About 0.4% of RAM, always	Grows with actual TDX use
Default	Not applicable	On whenever the TDX module reports support
Kernel size cost	None	2KB when TDX is built in

The savings are largest when few confidential VMs are running. "The savings are variable depending on system and TDX usage, but could be up to 100x," Edgecombe wrote.

There is a catch on some machines. Dynamic PAMT needs reference counts, small counters that track how much each region is in use. Those cost 2MB per 1TB of address space, with a worst case of 8GB on systems with a 52-bit address space. On sparse platforms with little memory, the patch notes warn, the overhead could even exceed the savings.

How it reached the kernel

The series went through 11 versions. Version 11, posted on September 4, 2026, mainly removed a kernel parameter. Kiryl Shutsemau co-wrote two of its patches. By September 7 the work was queued in the x86/tdx branch of the tip tree, a staging area for x86 changes, Phoronix reported at the time.

The enabling commit explains the default plainly: "DPAMT's memory savings are significant enough to make it a good default configuration."

The same TDX pull request fixes a second limit. Quotes, the signed reports a confidential VM uses to prove what it is running, have been stuck in 128KB buffers. "These 128k buffers are far too small for post-quantum cryptography where the quotes grow substantially," Hansen wrote. The TDX module can now report the buffer size it needs, and Linux 7.4 supports that.

Linux 7.4 is collecting other changes this cycle too, including a new TAINT_FORCED_BIND flag for forced driver binds.

What this means for developers

Most of this lands without any action, but operators of TDX hosts should plan for it.

• Re-measure host memory after upgrading. On lightly used TDX hosts, Linux 7.4 should free memory that was reserved before. Check what your monitoring reports, then decide whether to raise VM density.
• Check your TDX module version. Dynamic PAMT turns on only when the TDX module, Intel's firmware component, reports support for it. An older module keeps the static 0.4% cost.
• Test small or sparse machines. The patch notes say reference-count overhead can outweigh the savings there. Compare memory use before and after on that hardware.
• Watch post-quantum attestation. The larger quote buffers prepare TDX for post-quantum signatures. Teams that verify attestation reports should confirm their tools accept bigger quotes.