components: declare what the technique discloses, on every component

`addr:` was optional, unvalidated free text that the hardening report
interpolated into prose. 98 components declared it, 15 did not, and the
values had drifted to four spellings -- including phys-extent, which names
a shape `pos` already carries on the wire, and none, which meant "no
address" but rendered as though it meant "system facts".

The field is renamed to discloses: and required of every component, with
each value set from what that component's emitters actually produce. Four
declarations disagreed with their own source: proc_config, boot_config and
proc_cpuinfo each claimed `none` while emitting an address.

Mandatory rather than optional because the JSON publishes each component's
whole KASLD_META block, so this is a per-component field external
consumers read. Present on some components and absent on others, its
absence would encode nothing but which part of the hardening renderer
happens to consult it -- and an absent value cannot be told apart from an
unconsidered omission, which is how the drift went unnoticed. The
vocabulary closes to virtual/physical/both/facts, checked by
check-component-meta. `both` now has users; it was documented and claimed
by nothing.

The report still prefers what a component actually disclosed. The
compile-time surface section reads only that: it already skips everything
but OUTCOME_SUCCESS, so a record attributed to the component always
exists and the declaration could never be reached there. Only the hardware
side-channel section consults it, being the one that lists a component
whether or not it produced anything.

The render tests seeded the old key, so they passed without touching any
of this. They now seed discloses:, and two tests cover the behaviour
itself: observation overrides a contrary declaration, and a component that
produced nothing and declares nothing yields no kind at all.

Author: bcoles

src/components/acpi_mrrm.c

@@ -65,7 +65,7 @@ KASLD_EXPLAIN(
 // Untested: no hardware with an ACPI MRRM table available for testing.
 KASLD_META("method:parsed\n"
            "phase:inference\n"
-           "addr:physical\n"
+           "discloses:physical\n"
            "config:CONFIG_ACPI_MRRM\n");
 
 int main(void) {

src/components/alsa_seq_ext_ptr.c

@@ -213,7 +213,7 @@ KASLD_EXPLAIN(
 KASLD_META("method:parsed\n"
            "phase:inference\n"
            "live:1\n"
-           "addr:virtual\n"
+           "discloses:virtual\n"
            "patch:v7.2\n");
 
 /* Perform one self-addressed variable-event round trip on an already-open

src/components/arm64_no_seed.c

@@ -39,7 +39,8 @@ KASLD_EXPLAIN("On non-EFI device-tree arm64 with no FDT /chosen/kaslr-seed and "
               "the compile-time default; emits SF_VIRT_KASLR_DISABLED for the "
               "engine pin rule. arm64 only.");
 KASLD_META("method:parsed\n"
-           "phase:inference\n");
+           "phase:inference\n"
+           "discloses:facts\n");
 
 int main(void) {
   if (kasld_kaslr_disabled_text_default())

src/components/bcm_msg_head_struct.c

@@ -58,7 +58,7 @@ KASLD_EXPLAIN(
 KASLD_META("method:heuristic\n"
            "phase:probing\n"
            "live:1\n"
-           "addr:virtual\n"
+           "discloses:virtual\n"
            "cve:CVE-2021-34693\n"
            "patch:v5.12\n"
            "config:CONFIG_CAN\n"

src/components/boot_config.c

@@ -33,7 +33,7 @@ KASLD_EXPLAIN(
 
 KASLD_META("method:detection\n"
            "phase:inference\n"
-           "addr:none\n");
+           "discloses:virtual\n");
 
 static unsigned long get_kernel_addr_boot_config(FILE *fp) {
   if (kconfig_has_kaslr(fp))

src/components/boot_params_e820.c

@@ -82,7 +82,7 @@ KASLD_EXPLAIN(
 
 KASLD_META("method:parsed\n"
            "phase:inference\n"
-           "addr:physical\n");
+           "discloses:physical\n");
 
 /* Path and size of the boot_params sysfs binary attribute. */
 #define BOOT_PARAMS_PATH "/sys/kernel/boot_params/data"

src/components/boot_params_facts.c

@@ -14,7 +14,8 @@ KASLD_EXPLAIN("Reads /sys/kernel/boot_params/data for the exact kernel "
               "init_size and CONFIG_PHYSICAL_ALIGN, emitted as scalar facts "
               "tightening the KASLR ceiling and slot granularity. x86 only.");
 KASLD_META("method:parsed\n"
-           "phase:inference\n");
+           "phase:inference\n"
+           "discloses:facts\n");
 
 int main(void) {
   unsigned long v;

src/components/bootconfig_facts.c

@@ -13,7 +13,8 @@ KASLD_EXPLAIN("Reads the kernel boot config (/boot/config-*, /lib/modules/...) "
               "for CONFIG_RANDOMIZE_BASE_MAX_OFFSET and CONFIG_PAGE_OFFSET, "
               "emitted as scalar facts. No privileges.");
 KASLD_META("method:parsed\n"
-           "phase:inference\n");
+           "phase:inference\n"
+           "discloses:facts\n");
 
 int main(void) {
   unsigned long v;

src/components/bpf_verifier_ksym.c

@@ -197,7 +197,7 @@ KASLD_EXPLAIN(
 KASLD_META("method:parsed\n"
            "phase:inference\n"
            "live:1\n"
-           "addr:virtual\n"
+           "discloses:virtual\n"
            "sysctl:unprivileged_bpf_disabled>=1\n"
            "bypass:CAP_BPF\n"
            "config:CONFIG_DEBUG_INFO_BTF\n"

src/components/bpf_verifier_log.c

@@ -121,7 +121,7 @@ KASLD_EXPLAIN(
 KASLD_META("method:parsed\n"
            "phase:inference\n"
            "live:1\n"
-           "addr:virtual\n"
+           "discloses:virtual\n"
            "sysctl:unprivileged_bpf_disabled>=1\n"
            "bypass:CAP_BPF\n"
            "patch:v7.2\n");