Re: [PATCH 1/5] x86/sme: Clear decrypted BSS separately

[Tom Lendacky]

On 7/23/26 22:02, Brian Gerst wrote:
> The decrypted BSS section needs to be cleared after it is remapped as
> decrypted memory.  Separate it so that the normal BSS section can be
> cleared earlier.
> 
> Signed-off-by: Brian Gerst <brgerst@xxxxxxxxx>
> ---
>  arch/x86/kernel/vmlinux.lds.S | 2 +-
>  arch/x86/mm/mem_encrypt_amd.c | 3 +++
>  2 files changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
> index 2438b89a4620..e64c797e06c7 100644
> --- a/arch/x86/kernel/vmlinux.lds.S
> +++ b/arch/x86/kernel/vmlinux.lds.S
> @@ -365,9 +365,9 @@ SECTIONS
>  		*(.bss..page_aligned)
>  		. = ALIGN(PAGE_SIZE);
>  		*(BSS_MAIN)
> -		BSS_DECRYPTED
>  		. = ALIGN(PAGE_SIZE);
>  		__bss_stop = .;
> +		BSS_DECRYPTED
>  	}
>  
>  	/*
> diff --git a/arch/x86/mm/mem_encrypt_amd.c b/arch/x86/mm/mem_encrypt_amd.c
> index 2f8c32173972..d39e1e29bcb9 100644
> --- a/arch/x86/mm/mem_encrypt_amd.c
> +++ b/arch/x86/mm/mem_encrypt_amd.c
> @@ -479,6 +479,9 @@ void __init sme_early_init(void)
>  	if (!sme_me_mask)
>  		return;
>  
> +	memset(__start_bss_decrypted, 0,
> +	       (unsigned long) __end_bss_decrypted - (unsigned long) __start_bss_decrypted);
> +

I think this section needs to be cleared to zero regardless of whether SME
or SEV (this section is mainly used for SEV) is active. For example KVM
clock makes use of this section even if SEV is not active. So this should
probably live in clear_bss(), no?

Thanks,
Tom

>  	early_pmd_flags = __sme_set(early_pmd_flags);
>  
>  	__supported_pte_mask = __sme_set(__supported_pte_mask);