arch: make every arch declare its image-base residue

image_base_grid_align snaps a resolved _text window to the KASLR grid,
which is sound only where _text's offset within its alignment granule is a
constant. Get that offset wrong and raising a floor lands past the true
base, dropping the truth out of the GUARANTEED window — the one thing that
window promises.

IMAGE_BASE_RESIDUE_FIXED gated it, and defaulted to "the residue is fixed".
Sixteen of seventeen headers took that by silence: a claim about a kernel's
linker layout that nobody had made. Only arm32 had ever answered, and only
because someone hit the case where it is false.

There is no defensible default here, so there is no longer one. The macro
joins the mandatory-macro block beside LINEAR_MAP_ANCHOR and
TEXT_TRACKS_DIRECTMAP, and a header that omits it fails to compile.

The contract now also asks WHICH basis the answer rests on, because two
very different claims were collapsed into one boolean. By construction: the
residue is zero, or the arch models no KASLR, so nothing can drift.
Observed: the residue is non-zero and emerges from something the kernel is
free to change, where agreeing builds are evidence and not a guarantee.

riscv is the second case and is now 0. Its _text is not the load address —
the linker emits _start, then HEAD_TEXT_SECTION, then ALIGN(PAGE_SIZE) —
so the residue is roundup(sizeof .head.text, PAGE_SIZE), and that section
is #ifdef CONFIG_EFI / RISCV_M_MODE / MMU code whose size is not fixed.
Three captures agree at 0x2000 (alpine 6.18, debian 6.12, riscv32 mainline
6.15); that is not the bar this switch asks for.

No output changes, measured rather than assumed: toggling riscv64 between 1
and 0 and diffing full JSON across every riscv64 fixture gives identical
results, because image_base_grid_align emits no constraint on any fixture
in the corpus. The rule's own unit tests are what cover it.

Author: bcoles

src/include/kasld/api.h

@@ -393,6 +393,10 @@ __extension__ _Static_assert((unsigned long)KERNEL_PHYS_MAX >
 #error                                                                         \
     "arch header must define LINEAR_MAP_ANCHOR (LM_ANCHOR_PHYS_OFFSET / _DRAM_BASE / _UNKNOWABLE)"
 #endif
+#ifndef IMAGE_BASE_RESIDUE_FIXED
+#error                                                                         \
+    "arch header must define IMAGE_BASE_RESIDUE_FIXED (0 or 1) -- see its contract later in this header"
+#endif
 
 /* Is an address inside [KERNEL_VIRT_TEXT_MIN, KERNEL_VIRT_TEXT_MAX] necessarily
  * part of the kernel image or a module, so that ruling out the module band
@@ -841,11 +845,27 @@ static inline unsigned long kasld_page_offset_if_known(void) {
  * true where KASLR places the base on the grid, or a fixed linker offset
  * guarantees it. 0 where the offset is config-dependent (arm32: TEXT_OFFSET
  * varies by config and _stext is padded to the section boundary), so snapping
- * could floor a bound below the true base. Default 1 (the residue is fixed);
- * arches whose residue is not fixed set 0. */
-#ifndef IMAGE_BASE_RESIDUE_FIXED
-#define IMAGE_BASE_RESIDUE_FIXED 1
-#endif
+ * could floor a bound below the true base.
+ *
+ * DECLARED BY EVERY ARCH HEADER; there is no default. A permissive one is the
+ * wrong way round: the failure it admits is a bound raised PAST the true base,
+ * which drops the truth out of the guaranteed window -- the one thing that
+ * window promises. Sixteen of seventeen headers once took "the residue is
+ * fixed" by silence, which is a claim about a kernel's linker layout that
+ * nobody had made.
+ *
+ * State WHICH basis the answer rests on, because they are not equally strong:
+ *
+ *   by construction -- the residue is zero (the image starts on the granule),
+ *     or the arch models no KASLR so the base is the compile-time default and
+ *     the residue is right by definition. Nothing can drift.
+ *   observed        -- the residue is non-zero and emerges from something the
+ *     kernel is free to change, such as the size of a boot-code section. Real
+ *     builds agreeing is evidence, not a guarantee, and 0 is the answer unless
+ *     the sharpening is worth the risk.
+ *
+ * Enforced by the mandatory-macro block near the top of this header; there is
+ * deliberately no #define here to fall back to. */
 
 /* Physical firmware load offset (DRAM base -> phys image base). 0 where
  * firmware loads the image at the DRAM base; riscv64 overrides to 2 MiB

src/include/kasld/arch/arm64.h

@@ -402,4 +402,8 @@ static inline unsigned long arm64_page_end_for(unsigned long va_bits) {
 
 #define KASLR_SUPPORTED 1
 
+// Residue 0: KIMAGE_VADDR plus a MIN_KIMG_ALIGN-aligned slide, so _text sits on
+// the granule. The 0x10000 head gap is _stext's (STEXT_OFFSET), not the base's.
+#define IMAGE_BASE_RESIDUE_FIXED 1
+
 #endif /* KASLD_ARM64_H */

src/include/kasld/arch/loongarch64.h

@@ -168,4 +168,8 @@ static inline unsigned long arch_default_phys_text_base(void) {
 
 #define KASLR_SUPPORTED 1
 
+// Residue 0: the 2 MiB image offset is a whole number of 64 KiB granules. The
+// 0x20000 head gap is _stext's (STEXT_OFFSET), not the base's.
+#define IMAGE_BASE_RESIDUE_FIXED 1
+
 #endif /* KASLD_LOONGARCH64_H */

src/include/kasld/arch/mips32.h

@@ -126,4 +126,8 @@
 
 #define KASLR_SUPPORTED 1
 
+// Residue 0: _text IS the linker load address (see IMAGE_BASE_OFFSET above),
+// and KASLR relocates by whole 64 KiB granules, so it stays on the grid.
+#define IMAGE_BASE_RESIDUE_FIXED 1
+
 #endif /* KASLD_MIPS32_H */

src/include/kasld/arch/mips64.h

@@ -112,4 +112,8 @@
 
 #define KASLR_SUPPORTED 1
 
+// Residue 0: _text IS the linker load address (see IMAGE_BASE_OFFSET above),
+// and KASLR relocates by whole 64 KiB granules, so it stays on the grid.
+#define IMAGE_BASE_RESIDUE_FIXED 1
+
 #endif /* KASLD_MIPS64_H */

src/include/kasld/arch/ppc32.h

@@ -137,4 +137,7 @@
 
 #define KASLR_SUPPORTED 1
 
+// Residue 0: _text is on the granule; the grid is plain alignment.
+#define IMAGE_BASE_RESIDUE_FIXED 1
+
 #endif /* KASLD_PPC32_H */

src/include/kasld/arch/ppc64.h

@@ -114,4 +114,8 @@
 // PPC64 does not have mainline KASLR.
 #define KASLR_SUPPORTED 0
 
+// Residue 0, and no KASLR modelled here -- the base is the compile-time
+// default, so the residue is right by definition either way.
+#define IMAGE_BASE_RESIDUE_FIXED 1
+
 #endif /* KASLD_PPC64_H */

src/include/kasld/arch/riscv32.h

@@ -103,4 +103,10 @@
 // RISC-V 32-bit does not have mainline KASLR.
 #define KASLR_SUPPORTED 0
 
+// Same basis as riscv64: the residue is roundup(sizeof .head.text, PAGE_SIZE),
+// not a constructed constant. No KASLR is modelled here, so nothing turns on
+// it today -- declared 0 so the answer matches the reason rather than the
+// consequence.
+#define IMAGE_BASE_RESIDUE_FIXED 0
+
 #endif /* KASLD_RISCV32_H */

src/include/kasld/arch/riscv64.h

@@ -293,4 +293,19 @@ static inline unsigned long arch_default_text_base(void) {
 
 #define KASLR_SUPPORTED 1
 
+// OBSERVED, not constructed -- so 0.
+//
+// _text is not the load address here: the linker emits _start, then
+// HEAD_TEXT_SECTION, then ALIGN(PAGE_SIZE), then _text. The residue is
+// therefore roundup(sizeof .head.text, PAGE_SIZE), and that section is built
+// from #ifdef CONFIG_EFI / RISCV_M_MODE / MMU code whose size the kernel is
+// free to change. Three captures agree at 0x2000 (alpine 6.18, debian 6.12,
+// riscv32 mainline 6.15), which is evidence and not a guarantee.
+//
+// Snapping on a residue that is one page out raises a floor past the true
+// base, dropping the truth from the GUARANTEED window. Measured cost of
+// declining: nil -- image_base_grid_align emits no constraint on any fixture.
+// arch/riscv/kernel/vmlinux.lds.S, arch/riscv/kernel/head.S
+#define IMAGE_BASE_RESIDUE_FIXED 0
+
 #endif /* KASLD_RISCV64_H */

src/include/kasld/arch/s390.h

@@ -227,6 +227,10 @@
 
 #define KASLR_SUPPORTED 1
 
+// Residue 0: the 1 MiB image offset is a whole number of 16 KiB granules, so
+// _text still lands on the grid.
+#define IMAGE_BASE_RESIDUE_FIXED 1
+
 /* s390 opts OUT of the generic compile-time-default disabled-pin: the no-KASLR
  * image base is LAYOUT-DEPENDENT (modern high CONFIG_KERNEL_IMAGE_BASE vs
  * pre-v6.8 low identity-mapped, ~4 TiB apart) and CONFIG_KERNEL_IMAGE_BASE is