From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 9B56A423152 for ; Fri, 10 Jul 2026 11:50:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783684254; cv=none; b=WA5jyFh7AJEQW0+YcJEr6YOyqFb2qtu3+wFZ5DEXCD1uY+bsvBj9n1KYADZ9E8iSZ0VBMUhzlLOA09EusNiuL0rW8kmNgy+cTsJeMqYe7fJPDF3i+rA91Tuc3JT6LnQimTUyRSWlZX7B3Ikg5ro2uNSYRHfpH3R9KxovqwMTWqQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783684254; c=relaxed/simple; bh=vHxNzSitlBSMGh+NPYeJN18FlPrCj7d8L9zjsHieOmc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=bziR707ttTMEH7SAg2s3Eezg+/DuT/2vljRBcRQCecWkwXgDSJfNtUR9oQ0OvpvPOXFWBxzT0aGv96I1FqNSGUMocLqIhPzWUYGQR9QLvSsgQQg8iRNBLcExDl0e7DaDxKC3gg2al3dI/IrnSPBTxNPmJYXtsG01T544TWFqHjM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=I2EaaJMd; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="I2EaaJMd" Received: by linux.microsoft.com (Postfix, from userid 1216) id 8F0B920B716E; Fri, 10 Jul 2026 04:50:33 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 8F0B920B716E DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1783684233; bh=LskEsle6t0GlD5NiVDiPLVt+8nbwddiHWTdtTe8nowk=; h=From:To:Cc:Subject:Date:From; b=I2EaaJMdOlRGnPczXmJZKkS75dc+mbteJX0nB9tFKoc6UREVmPQwtCNWkSc3IjdSV PR1NZyCpPDc1v6UtpKMpFLfTUwottNqr0NhVSYZlHF3n6phHAU9fo6EowFqCDCB/1T L1wfK4k4DqfLbxL1y5p/OLUOZ2KBU2vrJkzKKvow= From: Hamza Mahfooz To: x86@kernel.org Cc: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , "H. Peter Anvin" , Andy Lutomirski , Peter Zijlstra , Ard Biesheuvel , Nathan Chancellor , Kees Cook , Rong Xu , linux-kernel@vger.kernel.org, Hamza Mahfooz , Jared White Subject: [PATCH v3] x86/mm/64: free the gap between BSS_MAIN and BSS_DECRYPTED Date: Fri, 10 Jul 2026 07:50:13 -0400 Message-ID: <20260710115013.2833626-1-hamzamahfooz@linux.microsoft.com> X-Mailer: git-send-email 2.43.7 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit This region is unused after mark_rodata_ro() and takes up, up to 2 MiB of memory. So, free it in mark_rodata_ro(). Co-developed-by: Jared White Signed-off-by: Jared White Signed-off-by: Hamza Mahfooz --- v3: guard __start_bss_decrypted{,_gap} with CONFIG_AMD_MEM_ENCRYPT. --- arch/x86/include/asm/sections.h | 1 + arch/x86/kernel/vmlinux.lds.S | 2 ++ arch/x86/mm/init_64.c | 8 ++++++++ 3 files changed, 11 insertions(+) diff --git a/arch/x86/include/asm/sections.h b/arch/x86/include/asm/sections.h index 30e8ee7006f9..1d6589bc0f68 100644 --- a/arch/x86/include/asm/sections.h +++ b/arch/x86/include/asm/sections.h @@ -8,6 +8,7 @@ extern char __relocate_kernel_start[], __relocate_kernel_end[]; extern char __brk_base[], __brk_limit[]; extern char __end_rodata_aligned[]; +extern char __start_bss_decrypted_gap[]; #if defined(CONFIG_X86_64) extern char __end_rodata_hpage_align[]; diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S index 74e336d7f9dd..e9856d947370 100644 --- a/arch/x86/kernel/vmlinux.lds.S +++ b/arch/x86/kernel/vmlinux.lds.S @@ -88,6 +88,8 @@ const_cpu_current_top_of_stack = cpu_current_top_of_stack; * decrypted to avoid exposing more than we wish. */ #define BSS_DECRYPTED \ + . = ALIGN(PAGE_SIZE); \ + __start_bss_decrypted_gap = .; \ . = ALIGN(PMD_SIZE); \ __start_bss_decrypted = .; \ __pi___start_bss_decrypted = .; \ diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c index d57f29ca23a5..c34973ac3656 100644 --- a/arch/x86/mm/init_64.c +++ b/arch/x86/mm/init_64.c @@ -1409,6 +1409,10 @@ void mark_rodata_ro(void) unsigned long end = (unsigned long)__end_rodata_hpage_align; unsigned long text_end = PFN_ALIGN(_etext); unsigned long rodata_end = PFN_ALIGN(__end_rodata); +#ifdef CONFIG_AMD_MEM_ENCRYPT + unsigned long bss_decrypted_gap_start = PFN_ALIGN(__start_bss_decrypted_gap); + unsigned long bss_decrypted_gap_stop = PFN_ALIGN(__start_bss_decrypted); +#endif unsigned long all_end; printk(KERN_INFO "Write protecting the kernel read-only data: %luk\n", @@ -1446,6 +1450,10 @@ void mark_rodata_ro(void) (void *)text_end, (void *)rodata_start); free_kernel_image_pages("unused kernel image (rodata/data gap)", (void *)rodata_end, (void *)_sdata); +#ifdef CONFIG_AMD_MEM_ENCRYPT + free_kernel_image_pages("unused kernel image (bss_decrypted gap)", + (void *)bss_decrypted_gap_start, (void *)bss_decrypted_gap_stop); +#endif } /* -- 2.55.0