It Turns Out Intel TDX Doesn t Need So Much Cache Flushing
Curated from Phoronix
Intel TDX was designed with a conservative security posture, mandating aggressive cache flushing whenever memory transitioned between different encryption keys. This approach treated potential side-channel risks as absolute certainties, regardless of actual hardware behavior. Recent findings suggest this overhead was unnecessary, revealing that the strict flushing requirements imposed a significant performance tax on confidential computing workloads. For SREs, this distinction matters because it directly impacts the latency and throughput of VMs running sensitive workloads. If you are deploying TDX-enabled environments, monitor for the kernel patches that relax these constraints. The concrete takeaway is that you should re-benchmark your confidential VM performance now, as removing redundant cache flushes could yield immediate, measurable improvements in I/O and memory access speeds without compromising the underlying encryption guarantees.
Intel Trust Domain Extensions (TDX) for confidential computing with VMs has assumed the need to perform cache flushing when transitioning memory between KeyIDs used by the total memory encryption (MKTME) for unique AES encryption keys. But it's turned out to be unneeded and the Linux kernel is working now to reduce the excessive cache flushing...
— Phoronix