[PATCH v5] x86/mm/64: free the gap between BSS_MAIN and BSS_DECRYPTED

[PATCH v5] x86/mm/64: free the gap between BSS_MAIN and BSS_DECRYPTED

[Hamza Mahfooz]

This region is unused and takes up, up to 2 MiB
of memory if AMD_MEM_ENCRYPT is enabled. So, free it in
mem_encrypt_free_decrypted_mem().

Tested on a CoCo VM running on an AMD EPYC 7763v which generated the
following print:

Freeing unused kernel image (bss_decrypted gap) memory: 184K

Signed-off-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
---
 arch/x86/include/asm/mem_encrypt.h | 3 ++-
 arch/x86/kernel/vmlinux.lds.S      | 2 ++
 arch/x86/mm/mem_encrypt_amd.c      | 6 ++++++
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h
index ea6494628cb0..c9722be2808f 100644
--- a/arch/x86/include/asm/mem_encrypt.h
+++ b/arch/x86/include/asm/mem_encrypt.h
@@ -112,7 +112,8 @@ void add_encrypt_protection_map(void);
 #define __sme_pa(x)		(__pa(x) | sme_me_mask)
 #define __sme_pa_nodebug(x)	(__pa_nodebug(x) | sme_me_mask)
 
-extern char __start_bss_decrypted[], __end_bss_decrypted[], __start_bss_decrypted_unused[];
+extern char __start_bss_decrypted_gap[], __start_bss_decrypted[],
+	__end_bss_decrypted[], __start_bss_decrypted_unused[];
 
 #endif	/* __ASSEMBLER__ */
 
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 4711a35e706c..179578a08da1 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -88,6 +88,8 @@ const_cpu_current_top_of_stack = cpu_current_top_of_stack;
  * decrypted to avoid exposing more than we wish.
  */
 #define BSS_DECRYPTED						\
+	. = ALIGN(PAGE_SIZE);					\
+	__start_bss_decrypted_gap = .;				\
 	. = ALIGN(PMD_SIZE);					\
 	__start_bss_decrypted = .;				\
 	__pi___start_bss_decrypted = .;				\
diff --git a/arch/x86/mm/mem_encrypt_amd.c b/arch/x86/mm/mem_encrypt_amd.c
index 2f8c32173972..4111195910ab 100644
--- a/arch/x86/mm/mem_encrypt_amd.c
+++ b/arch/x86/mm/mem_encrypt_amd.c
@@ -566,4 +566,10 @@ void __init mem_encrypt_free_decrypted_mem(void)
 	}
 
 	free_init_pages("unused decrypted", vaddr, vaddr_end);
+
+	vaddr = (unsigned long)__start_bss_decrypted_gap;
+	vaddr_end = (unsigned long)__start_bss_decrypted;
+
+	free_kernel_image_pages("unused kernel image (bss_decrypted gap)",
+				(void *)vaddr, (void *)vaddr_end);
 }
-- 
2.55.0

Re: [PATCH v5] x86/mm/64: free the gap between BSS_MAIN and BSS_DECRYPTED

[Hamza Mahfooz]

ping?

On Wed, Jul 22, 2026 at 09:31:03PM -0400, Hamza Mahfooz wrote:
> This region is unused and takes up, up to 2 MiB
> of memory if AMD_MEM_ENCRYPT is enabled. So, free it in
> mem_encrypt_free_decrypted_mem().
> 
> Tested on a CoCo VM running on an AMD EPYC 7763v which generated the
> following print:
> 
> Freeing unused kernel image (bss_decrypted gap) memory: 184K
> 
> Signed-off-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
> ---
>  arch/x86/include/asm/mem_encrypt.h | 3 ++-
>  arch/x86/kernel/vmlinux.lds.S      | 2 ++
>  arch/x86/mm/mem_encrypt_amd.c      | 6 ++++++
>  3 files changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h
> index ea6494628cb0..c9722be2808f 100644
> --- a/arch/x86/include/asm/mem_encrypt.h
> +++ b/arch/x86/include/asm/mem_encrypt.h
> @@ -112,7 +112,8 @@ void add_encrypt_protection_map(void);
>  #define __sme_pa(x)		(__pa(x) | sme_me_mask)
>  #define __sme_pa_nodebug(x)	(__pa_nodebug(x) | sme_me_mask)
>  
> -extern char __start_bss_decrypted[], __end_bss_decrypted[], __start_bss_decrypted_unused[];
> +extern char __start_bss_decrypted_gap[], __start_bss_decrypted[],
> +	__end_bss_decrypted[], __start_bss_decrypted_unused[];
>  
>  #endif	/* __ASSEMBLER__ */
>  
> diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
> index 4711a35e706c..179578a08da1 100644
> --- a/arch/x86/kernel/vmlinux.lds.S
> +++ b/arch/x86/kernel/vmlinux.lds.S
> @@ -88,6 +88,8 @@ const_cpu_current_top_of_stack = cpu_current_top_of_stack;
>   * decrypted to avoid exposing more than we wish.
>   */
>  #define BSS_DECRYPTED						\
> +	. = ALIGN(PAGE_SIZE);					\
> +	__start_bss_decrypted_gap = .;				\
>  	. = ALIGN(PMD_SIZE);					\
>  	__start_bss_decrypted = .;				\
>  	__pi___start_bss_decrypted = .;				\
> diff --git a/arch/x86/mm/mem_encrypt_amd.c b/arch/x86/mm/mem_encrypt_amd.c
> index 2f8c32173972..4111195910ab 100644
> --- a/arch/x86/mm/mem_encrypt_amd.c
> +++ b/arch/x86/mm/mem_encrypt_amd.c
> @@ -566,4 +566,10 @@ void __init mem_encrypt_free_decrypted_mem(void)
>  	}
>  
>  	free_init_pages("unused decrypted", vaddr, vaddr_end);
> +
> +	vaddr = (unsigned long)__start_bss_decrypted_gap;
> +	vaddr_end = (unsigned long)__start_bss_decrypted;
> +
> +	free_kernel_image_pages("unused kernel image (bss_decrypted gap)",
> +				(void *)vaddr, (void *)vaddr_end);
>  }
> -- 
> 2.55.0

Re: [PATCH v5] x86/mm/64: free the gap between BSS_MAIN and BSS_DECRYPTED

[Borislav Petkov]

On Wed, Aug 05, 2026 at 10:04:58AM -0400, Hamza Mahfooz wrote:
> ping?

https://sashiko.dev/#/patchset/20260723013103.1749729-1-hamzamahfooz%40linux.microsoft.com

Please address those issues.

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette