From nobody Fri Jul 24 22:17:35 2026 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 550A5CA6F for ; Thu, 23 Jul 2026 01:31:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784770312; cv=none; b=Xw+xQUhVGFP4dDZts3OaNnnJ4CKCZ46A1XwUjaIfOm+zSuaeHW8z3yyeORUJjwWaW6IuA4rA6Ls5jt7Hg+hf7o3ahHs6uIIOzwMpC5Ixmzkj57W/qdwaX3jfSGLArFOUbCSEzeS2hX3e5XHC8a9fCs4VycQF0HfvEnPv/2mI1y8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784770312; c=relaxed/simple; bh=2duBGE7V9tF0Bv5F0cU+VfeJrucPEQu9Rtko7aAq7Pw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=DREiZkA4/jRFGwdF/gcFg6f6UJL6HFt1uW9qZKyyX1I89E+ftlUwmPsO0IfvFKunLRteueuHqwSLKhCfcvYyZcWWEt/H+XH+ScBZyZCMX1SgPl2Ne+TfDvQDbPf8/Cq9mTpmEfZ9ugArnEOnBp572qE5uGS1oQZC/h9VG26TbHg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=lAj53ttq; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="lAj53ttq" Received: by linux.microsoft.com (Postfix, from userid 1216) id 1E87620B7167; Wed, 22 Jul 2026 18:31:38 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 1E87620B7167 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1784770298; bh=qtr4KHfSEci27AtmWhjJuSHbYpVUhFqq3VTJkKecMxM=; h=From:To:Cc:Subject:Date:From; b=lAj53ttqtVVT9HRzw3Fkd9Meu3olEZyrymLzyvcNePbHDxOj2TFxemqwGo6rxGKwy 4SqwAK8hDEe1Bayq4kAGrBuk4N3d4KEQWSQFz3/2A4rOQDwockTAZ80BOg4tKLeg0Q QH7Fxll3Q4tnijn8Amw8sPKVKxa5WSjeyLSxn0UA= From: Hamza Mahfooz To: x86@kernel.org Cc: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , "H. Peter Anvin" , Andy Lutomirski , Peter Zijlstra , Ard Biesheuvel , Nathan Chancellor , Rong Xu , Kees Cook , linux-kernel@vger.kernel.org, Hamza Mahfooz Subject: [PATCH v5] x86/mm/64: free the gap between BSS_MAIN and BSS_DECRYPTED Date: Wed, 22 Jul 2026 21:31:03 -0400 Message-ID: <20260723013103.1749729-1-hamzamahfooz@linux.microsoft.com> X-Mailer: git-send-email 2.43.7 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" This region is unused and takes up, up to 2 MiB of memory if AMD_MEM_ENCRYPT is enabled. So, free it in mem_encrypt_free_decrypted_mem(). Tested on a CoCo VM running on an AMD EPYC 7763v which generated the following print: Freeing unused kernel image (bss_decrypted gap) memory: 184K Signed-off-by: Hamza Mahfooz --- arch/x86/include/asm/mem_encrypt.h | 3 ++- arch/x86/kernel/vmlinux.lds.S | 2 ++ arch/x86/mm/mem_encrypt_amd.c | 6 ++++++ 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_= encrypt.h index ea6494628cb0..c9722be2808f 100644 --- a/arch/x86/include/asm/mem_encrypt.h +++ b/arch/x86/include/asm/mem_encrypt.h @@ -112,7 +112,8 @@ void add_encrypt_protection_map(void); #define __sme_pa(x) (__pa(x) | sme_me_mask) #define __sme_pa_nodebug(x) (__pa_nodebug(x) | sme_me_mask) =20 -extern char __start_bss_decrypted[], __end_bss_decrypted[], __start_bss_de= crypted_unused[]; +extern char __start_bss_decrypted_gap[], __start_bss_decrypted[], + __end_bss_decrypted[], __start_bss_decrypted_unused[]; =20 #endif /* __ASSEMBLER__ */ =20 diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S index 4711a35e706c..179578a08da1 100644 --- a/arch/x86/kernel/vmlinux.lds.S +++ b/arch/x86/kernel/vmlinux.lds.S @@ -88,6 +88,8 @@ const_cpu_current_top_of_stack =3D cpu_current_top_of_sta= ck; * decrypted to avoid exposing more than we wish. */ #define BSS_DECRYPTED \ + . =3D ALIGN(PAGE_SIZE); \ + __start_bss_decrypted_gap =3D .; \ . =3D ALIGN(PMD_SIZE); \ __start_bss_decrypted =3D .; \ __pi___start_bss_decrypted =3D .; \ diff --git a/arch/x86/mm/mem_encrypt_amd.c b/arch/x86/mm/mem_encrypt_amd.c index 2f8c32173972..4111195910ab 100644 --- a/arch/x86/mm/mem_encrypt_amd.c +++ b/arch/x86/mm/mem_encrypt_amd.c @@ -566,4 +566,10 @@ void __init mem_encrypt_free_decrypted_mem(void) } =20 free_init_pages("unused decrypted", vaddr, vaddr_end); + + vaddr =3D (unsigned long)__start_bss_decrypted_gap; + vaddr_end =3D (unsigned long)__start_bss_decrypted; + + free_kernel_image_pages("unused kernel image (bss_decrypted gap)", + (void *)vaddr, (void *)vaddr_end); } --=20 2.55.0