rules: floor x86_64 RANDOMIZE_MEMORY budget ceilings to the PUD grain

The page_offset and vmalloc upper bounds from the shared-entropy budget were
vaddr_start + remain/3, left un-aligned. Both bases are PUD-granular, so the
ragged remainder rendered as a garbage-looking ceiling (e.g. 0xffffa4aaaaaaaaaa)
whenever no direct-map leak tightened the window. Floor both to the PUD
boundary: sound (the true PUD-aligned base still satisfies the bound), strictly
tighter, and clean. Update the pinning test.

Author: bcoles

src/rules/x86_64_randomize_memory_budget.c

@@ -170,9 +170,13 @@ int rule_x86_64_randomize_memory_budget(const struct evidence_set *ev,
   unsigned long remain_lo = span - dm_min - vmalloc_sz;
   const enum kasld_confidence cap = kasld_conf_min(CONF_INFERRED, pfn_conf);
 
-  /* page_offset upper bound: base_0 = vaddr_start + e_0, e_0 <= remain/3. */
+  /* page_offset upper bound: base_0 = vaddr_start + e_0, e_0 <= remain/3.
+   * page_offset_base is PUD-granular, so floor the ceiling to the PUD boundary:
+   * the true base is a PUD multiple <= this value, so flooring stays sound
+   * while tightening it and dropping the ragged remain/3 remainder (cf. the
+   * alignment floor in phys_bits_ceiling). */
   if (n < out_max) {
-    unsigned long upper = lv.vaddr_start + remain_lo / 3;
+    unsigned long upper = (lv.vaddr_start + remain_lo / 3) & ~(pud - 1);
     struct constraint *c = &out[n++];
     memset(c, 0, sizeof(*c));
     c->q = Q_PAGE_OFFSET;
@@ -203,7 +207,9 @@ int rule_x86_64_randomize_memory_budget(const struct evidence_set *ev,
    * (dm_max + 2*(span - vmalloc_size)) / 3 (increasing in dm => dm_max). */
   if (n < out_max) {
     unsigned long num = dm_max + 2ul * (span - vmalloc_sz);
-    unsigned long upper = lv.vaddr_start + pud + num / 3;
+    unsigned long upper = (lv.vaddr_start + pud + num / 3) & ~(pud - 1);
+    /* vmalloc_base is PUD-granular too; floor to align + tighten (see above).
+     */
     /* Only emit when it actually sits below the region-group ceiling. */
     if (upper < lv.vaddr_end && upper > lv.vaddr_start + dm_min) {
       struct constraint *c = &out[n++];

tests/test_engine.c

@@ -4433,11 +4433,14 @@ static void test_x86_64_randomize_memory_budget(void) {
    * la57's canonical half boundary (this rule does not raise the directmap
    * floor). */
   assert(e.est[Q_PAGE_OFFSET].lo == 0xffff800000000000ul); /* from la57 */
-  assert(e.est[Q_PAGE_OFFSET].hi == vs + remain_lo / 3);
+  /* Ceilings are floored to the PUD grain (page_offset / vmalloc are
+   * PUD-granular), dropping the ragged remain/3 remainder. */
+  assert(e.est[Q_PAGE_OFFSET].hi == ((vs + remain_lo / 3) & ~(pud - 1)));
   /* vmalloc: floor + the leak-free budget ceiling (previously unbounded above
    * without a vmemmap witness). */
   assert(e.est[Q_VMALLOC_BASE].lo == vs + dm_min);
-  unsigned long va_hi = vs + pud + (dm_max + 2ul * (span - vmalloc_sz)) / 3;
+  unsigned long va_hi =
+      (vs + pud + (dm_max + 2ul * (span - vmalloc_sz)) / 3) & ~(pud - 1);
   assert(e.est[Q_VMALLOC_BASE].hi == va_hi);
   /* vmemmap: tighter floor. */
   assert(e.est[Q_VMEMMAP_BASE].lo == vs + dm_min + vmalloc_sz);