[PATCH v3] x86/mm/64: free the gap between BSS_MAIN and BSS_DECRYPTED

[PATCH v3] x86/mm/64: free the gap between BSS_MAIN and BSS_DECRYPTED

[Hamza Mahfooz]

This region is unused after mark_rodata_ro() and takes up, up to 2 MiB
of memory. So, free it in mark_rodata_ro().

Co-developed-by: Jared White <jaredwhite@microsoft.com>
Signed-off-by: Jared White <jaredwhite@microsoft.com>
Signed-off-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
---
v3: guard __start_bss_decrypted{,_gap} with CONFIG_AMD_MEM_ENCRYPT.
---
 arch/x86/include/asm/sections.h | 1 +
 arch/x86/kernel/vmlinux.lds.S   | 2 ++
 arch/x86/mm/init_64.c           | 8 ++++++++
 3 files changed, 11 insertions(+)

diff --git a/arch/x86/include/asm/sections.h b/arch/x86/include/asm/sections.h
index 30e8ee7006f9..1d6589bc0f68 100644
--- a/arch/x86/include/asm/sections.h
+++ b/arch/x86/include/asm/sections.h
@@ -8,6 +8,7 @@
 extern char __relocate_kernel_start[], __relocate_kernel_end[];
 extern char __brk_base[], __brk_limit[];
 extern char __end_rodata_aligned[];
+extern char __start_bss_decrypted_gap[];
 
 #if defined(CONFIG_X86_64)
 extern char __end_rodata_hpage_align[];
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 74e336d7f9dd..e9856d947370 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -88,6 +88,8 @@ const_cpu_current_top_of_stack = cpu_current_top_of_stack;
  * decrypted to avoid exposing more than we wish.
  */
 #define BSS_DECRYPTED						\
+	. = ALIGN(PAGE_SIZE);					\
+	__start_bss_decrypted_gap = .;				\
 	. = ALIGN(PMD_SIZE);					\
 	__start_bss_decrypted = .;				\
 	__pi___start_bss_decrypted = .;				\
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index d57f29ca23a5..c34973ac3656 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -1409,6 +1409,10 @@ void mark_rodata_ro(void)
 	unsigned long end = (unsigned long)__end_rodata_hpage_align;
 	unsigned long text_end = PFN_ALIGN(_etext);
 	unsigned long rodata_end = PFN_ALIGN(__end_rodata);
+#ifdef CONFIG_AMD_MEM_ENCRYPT
+	unsigned long bss_decrypted_gap_start = PFN_ALIGN(__start_bss_decrypted_gap);
+	unsigned long bss_decrypted_gap_stop = PFN_ALIGN(__start_bss_decrypted);
+#endif
 	unsigned long all_end;
 
 	printk(KERN_INFO "Write protecting the kernel read-only data: %luk\n",
@@ -1446,6 +1450,10 @@ void mark_rodata_ro(void)
 				(void *)text_end, (void *)rodata_start);
 	free_kernel_image_pages("unused kernel image (rodata/data gap)",
 				(void *)rodata_end, (void *)_sdata);
+#ifdef CONFIG_AMD_MEM_ENCRYPT
+	free_kernel_image_pages("unused kernel image (bss_decrypted gap)",
+				(void *)bss_decrypted_gap_start, (void *)bss_decrypted_gap_stop);
+#endif
 }
 
 /*
-- 
2.55.0

Re: [PATCH v3] x86/mm/64: free the gap between BSS_MAIN and BSS_DECRYPTED

[Borislav Petkov]

On Fri, Jul 10, 2026 at 07:50:13AM -0400, Hamza Mahfooz wrote:
> @@ -1446,6 +1450,10 @@ void mark_rodata_ro(void)
>  				(void *)text_end, (void *)rodata_start);
>  	free_kernel_image_pages("unused kernel image (rodata/data gap)",
>  				(void *)rodata_end, (void *)_sdata);
> +#ifdef CONFIG_AMD_MEM_ENCRYPT
> +	free_kernel_image_pages("unused kernel image (bss_decrypted gap)",
> +				(void *)bss_decrypted_gap_start, (void *)bss_decrypted_gap_stop);
> +#endif

If you're going to add the ugly ifdeffery gunk, why don't you push it into the

#define BSS_DECRYPTED

place so that you don't need to do any of that freeing when
CONFIG_AMD_MEM_ENCRYPT is not enabled?

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette