arch: make every module band cover its configurations

The band is a validation union: its floor must sit at or below the module
region under every configuration the header models, or module addresses
are discarded before they become observations — silently, since
proc_modules then reports "no kernel address found", the same as an empty
file. Auditing all seven candidate arches found two floors that did not.

x86_64: MODULES_VADDR is __START_KERNEL_map + KERNEL_IMAGE_SIZE, and that
size is 1 GiB only with CONFIG_RANDOMIZE_BASE; a kernel built without it
puts modules at 0xffffffffa0000000, half a gigabyte below the old floor.
Build-time, so booting nokaslr does not reproduce it and the nokaslr VM
cells never caught it. sidt.c had to stop reading MODULES_START as its
kernel-text ceiling, which it could while the two coincided.

ppc64: 64-bit PowerPC has no MODULES_VADDR, so modules come from vmalloc,
whose base spans 32 TiB across MMU configurations — 0xc008000000000000 for
radix and 64k-page hash, but 0xc0003d0000000000 for 4k-page hash and
0xc000100000000000 for Book3E. The floor is now the lowest.

loongarch64: vm_map_base is 0 - (1 << cpu_vabits), read from CPUCFG1, so a
wider VA moves the region down. Shipping parts report 39 and 48, but the
kernel's page tables reach 58 bits, so the floor is anchored there rather
than on the widest part that happens to exist.

riscv64, s390, mips32 and mips64 already held and are declared as-is.

With the bands exact, module_base_execmem_window confines Q_MODULE_BASE to
execmem_arch_setup()'s own window: start = MODULES_VADDR + rand(1,1024) *
PAGE_SIZE, about 10 bits drawn independently of the text slide. It is gated
on evidence the image moved, which proves RANDOMIZE_BASE=y and so fixes
which MODULES_VADDR is live; without that the window could be in the wrong
place entirely, so the rule stays silent. Offset 0 stays in range because
RANDOMIZE_MEMORY depends on RANDOMIZE_BASE.

x86_64 Module Region Base goes from unbounded to 1025 candidates. Doc
samples re-captured from the same mainline 7.0 boot under KVM.

Author: bcoles

README.md

@@ -76,24 +76,25 @@ KASLD 0.3.1-dev  --  Kernel ASLR derandomization
 Target: x86_64 / 7.0.0
 
 Running 101 of 104 components (3 experimental skipped; use -x to enable)...
-[####################] 100%  101/101  38.4s
+[####################] 100%  101/101  39.1s
 1 component timed out after 30s and was killed (prefetch_directmap)
 
   Quantity             Basis       Range                                    Search space  Align
   -------------------  ----------  ---------------------------------------  ------------  -----
-  Virtual Image Base   guaranteed  0xffffffffa5e00000 slide +0x24e00000         1 of 505  2 MiB
+  Virtual Image Base   guaranteed  0xffffffffa2e00000 slide +0x21e00000         1 of 505  2 MiB
   Physical Image Base  guaranteed            0x200000 -         0x3d400000           481  2 MiB
-  Physical Image Base  likely               0x1000000 -         0x3c346000    474 of 481  2 MiB
+  Physical Image Base  likely               0x1000000 -         0x3c345000    474 of 481  2 MiB
   Direct Map Base      guaranteed  0xffff800000000000 - 0xffffa4aa80000000         37547  1 GiB
   Vmalloc Base         guaranteed  0xffff898000000000 - 0xffffd6d580000000         79191  1 GiB
   Vmemmap Base         guaranteed  0xffffa98040000000 - 0xfffffd0000000000         85504  1 GiB
+  Module Region Base   guaranteed  0xffffffffc0000000 - 0xffffffffc0400000          1025  4 KiB
 
   Note: physical and virtual text randomize independently
 
 Evidence  (2 findings, 4 components)
-  virt kernel text    [interior] 0xffffffffa5f04109
+  virt kernel text    [interior] 0xffffffffa309cab5
                                  from perf_event_open, perf_text_poke_leak, proc_kallsyms
-  virt kernel image   [base]     0xffffffffa5e00000
+  virt kernel image   [base]     0xffffffffa2e00000
                                  from perf_event_open, prefetch, proc_kallsyms
 
 [-v: detailed results, memory map, system info]  [-H: hardening assessment]

docs/usage.md

@@ -164,24 +164,26 @@ KASLD 0.3.1-dev  --  Kernel ASLR derandomization
 Target: x86_64 / 7.0.0
 
 Running 101 of 104 components (3 experimental skipped; use -x to enable)...
-[####################] 100%  101/101  12.1s
+[####################] 100%  101/101  39.1s
+1 component timed out after 30s and was killed (prefetch_directmap)
 
   Quantity             Basis       Range                                    Search space  Align
   -------------------  ----------  ---------------------------------------  ------------  -----
-  Virtual Image Base   guaranteed  0xffffffffb7000000 slide +0x36000000         1 of 505  2 MiB
+  Virtual Image Base   guaranteed  0xffffffffa2e00000 slide +0x21e00000         1 of 505  2 MiB
   Physical Image Base  guaranteed            0x200000 -         0x3d400000           481  2 MiB
-  Physical Image Base  likely               0x1000000 -         0x3c346000    474 of 481  2 MiB
+  Physical Image Base  likely               0x1000000 -         0x3c345000    474 of 481  2 MiB
   Direct Map Base      guaranteed  0xffff800000000000 - 0xffffa4aa80000000         37547  1 GiB
   Vmalloc Base         guaranteed  0xffff898000000000 - 0xffffd6d580000000         79191  1 GiB
   Vmemmap Base         guaranteed  0xffffa98040000000 - 0xfffffd0000000000         85504  1 GiB
+  Module Region Base   guaranteed  0xffffffffc0000000 - 0xffffffffc0400000          1025  4 KiB
 
   Note: physical and virtual text randomize independently
 
-Evidence  (2 findings, 3 components)
-  virt kernel text    [interior] 0xffffffffb7298cb2
+Evidence  (2 findings, 4 components)
+  virt kernel text    [interior] 0xffffffffa309cab5
                                  from perf_event_open, perf_text_poke_leak, proc_kallsyms
-  virt kernel image   [base]     0xffffffffb7000000
-                                 from perf_event_open, proc_kallsyms
+  virt kernel image   [base]     0xffffffffa2e00000
+                                 from perf_event_open, prefetch, proc_kallsyms
 
 [-v: detailed results, memory map, system info]  [-H: hardening assessment]
 ```
@@ -412,7 +414,7 @@ or not applicable to the arch/run renders the sentinel `na` (never a
 fabricated, defaulted, or leaked value):
 
 ```
-arch=x86_64 kaslr=on text=0xffffffffb7000000 stext=na slide=+0x36000000(905969664) entropy=0bits ptext=na pstext=na pslide=na pentropy=9bits dmap=0xffff800000000000 dram=[0x0..0x3ffdefff](1023.9 MiB) results=25
+arch=x86_64 kaslr=on text=0xffffffffa2e00000 stext=na slide=+0x21e00000(568328192) entropy=0bits ptext=na pstext=na pslide=na pentropy=9bits dmap=0xffff800000000000 dram=[0x0..0x3ffdefff](1023.9 MiB) results=27
 ```
 
 | Key | Meaning |

src/components/sidt.c

@@ -141,7 +141,12 @@ static int is_fixmap_region(unsigned long addr) {
 }
 
 static int is_kernel_text_region(unsigned long addr) {
-  return addr >= KERNEL_VIRT_TEXT_MIN && addr < MODULES_START;
+  /* Bounded by KERNEL_VIRT_TEXT_MAX, not MODULES_START. The two coincided while
+   * the module band began where the text window ends, but the band's floor is
+   * the non-randomized MODULES_VADDR (512 MiB lower), and text does extend
+   * above it -- reading the band's floor as a text ceiling would reject
+   * legitimate text on a KASLR kernel. */
+  return addr >= KERNEL_VIRT_TEXT_MIN && addr < KERNEL_VIRT_TEXT_MAX;
 }
 
 #else /* __i386__ */

src/engine_rules.c

@@ -81,6 +81,7 @@ static const rule_fn k_rules[] = {
     rule_module_text_bound,
     rule_module_text_bracket,
     rule_module_base_bounds,
+    rule_module_base_execmem_window,
 
     /* Multi-entry EFI_LOADER_CODE → Q_PHYS_IMAGE_BASE pin */
     rule_efi_loader_kernel_pick,

src/include/kasld/arch/loongarch64.h

@@ -61,8 +61,24 @@
 // Module region size: SZ_256M.
 // Use conservative floor (48-bit VA) and wide ceiling to cover all VA configs.
 // https://elixir.bootlin.com/linux/v6.12/source/arch/loongarch/include/asm/pgtable.h#L82
-#define MODULES_START 0xffff000000000000ul
+// The floor covers any VALEN the kernel can describe, not just today's parts.
+// vm_map_base = 0 - (1 << cpu_vabits), read from CPUCFG1 at boot, so a wider
+// VA moves the module region DOWN. Shipping parts report 39 (Loongson-2K) and
+// 48 (LA464/LA664) -- both land above 0xffff000000000000 -- but the kernel's
+// own page tables reach VA_BITS = PGDIR_SHIFT + (PAGE_SHIFT - PTRLOG) = 58 at
+// 4 levels with 16K pages, so a future VALEN in 49..58 would sit below it.
+// Anchor on that geometric bound (0 - (1 << 58)) rather than on the widest
+// part that happens to exist: the failure mode of guessing is a silently
+// dropped module address, and the cost of the wider band is only
+// classify-by-range, which the REGION_MODULE provenance split already made
+// non-load-bearing.
+#define MODULES_START 0xfc00000000000000ul // 0 - (1 << 58)
 #define MODULES_END 0xffffffffffff0000ul
+
+// Usable as a BOUND, not only as an admission filter: the floor above is
+// derived from the widest VA the kernel's page tables can describe, so it sits
+// at or below vm_map_base for every VALEN a running kernel could report.
+#define MODULES_BAND_EXACT 1
 #define MODULES_RELATIVE_TO_TEXT 0
 
 // EFI_KIMG_ALIGN is SZ_2M, but KASLR offset uses << 16 = 64 KiB granularity.

src/include/kasld/arch/mips32.h

@@ -49,6 +49,11 @@
 
 #define MODULES_START 0xc0000000ul
 #define MODULES_END 0xfffffffful
+
+// Usable as a BOUND: 32-bit MIPS has no MODULES_VADDR, so modules come from
+// vmalloc at MAP_BASE (kseg2, 0xc0000000) -- this floor exactly. The
+// machine-specific MAP_BASE override (Loongson) is 64-bit only.
+#define MODULES_BAND_EXACT 1
 #define MODULES_RELATIVE_TO_TEXT 0
 
 // KASLR offset is shifted left 16 bits (64 KiB granularity).

src/include/kasld/arch/mips64.h

@@ -44,6 +44,11 @@
 
 #define MODULES_START 0xffffffffc0000000ul
 #define MODULES_END 0xfffffffffffffffful
+
+// Usable as a BOUND: MODULES_VADDR is CKSSEG (0xffffffffc0000000), a fixed
+// MIPS segment address, and MODULES_END is FIXADDR_START - 2 pages, below the
+// ceiling here. Neither varies with config.
+#define MODULES_BAND_EXACT 1
 #define MODULES_RELATIVE_TO_TEXT 0
 
 // KASLR offset is shifted left 16 bits (64 KiB granularity).

src/include/kasld/arch/ppc64.h

@@ -43,12 +43,27 @@
 #define KERNEL_VIRT_TEXT_MIN PAGE_OFFSET
 #define KERNEL_VIRT_TEXT_MAX 0xffffffffff000000ul
 
-// Modules are loaded in the vmalloc region, which starts at
-// PAGE_OFFSET + KERN_VIRT_SIZE (0xc008000000000000 on Book3S).
-// https://elixir.bootlin.com/linux/v6.1.1/source/arch/powerpc/include/asm/book3s/64/pgtable.h#L324
-// https://elixir.bootlin.com/linux/v6.1.1/source/arch/powerpc/mm/book3s64/hash_utils.c
-#define MODULES_START 0xc008000000000000ul
+// 64-bit PowerPC defines no MODULES_VADDR, so modules come from the vmalloc
+// region -- whose base differs by MMU and page size, across a 32 TiB spread:
+//
+//   radix     RADIX_KERN_VIRT_START = 0xc008000000000000  (+ 1<<49)
+//   hash-64k  H_KERN_VIRT_START     = 0xc008000000000000
+//   hash-4k   H_KERN_VIRT_START     = 0xc0003d0000000000
+//   Book3E    KERN_VIRT_START       = 0xc000100000000000  (+ 0x100000000000)
+//
+// The floor is the lowest of those (Book3E), not the Book3S one: a floor at
+// 0xc008000000000000 admits radix and 64k-page hash but rejects every module
+// address on a 4K-page hash kernel or a Book3E part (e5500/e6500), which is a
+// silent drop -- proc_modules reports "no kernel address found", the same as
+// an empty file. The ceiling is the radix vmalloc end, the highest of the four.
+// https://elixir.bootlin.com/linux/v7.2/source/arch/powerpc/include/asm/book3s/64/radix.h
+// https://elixir.bootlin.com/linux/v7.2/source/arch/powerpc/include/asm/nohash/64/pgtable.h
+#define MODULES_START 0xc000100000000000ul
 #define MODULES_END 0xc009fffffffffffful
+
+// Usable as a BOUND: the floor is the lowest vmalloc base of any 64-bit
+// PowerPC MMU configuration, and the ceiling the highest vmalloc end.
+#define MODULES_BAND_EXACT 1
 #define MODULES_RELATIVE_TO_TEXT 0
 
 // Plausible physical address range for kernel image

src/include/kasld/arch/riscv64.h

@@ -89,6 +89,11 @@
 #define MODULES_START 0xffffffde00000000ul
 #define MODULES_END 0xffffffffc0000000ul
 
+// Usable as a BOUND: modules occupy [_end - 2 GiB, _start], so the lowest
+// possible base is (lowest text) - 2 GiB = 0xffffffdf80000000, ~6 GiB above
+// this floor, and the ceiling is exactly the highest _start the arch admits.
+#define MODULES_BAND_EXACT 1
+
 // Module region is anchored to kernel _end (shifts with KASLR)
 #define MODULES_RELATIVE_TO_TEXT 1
 // MODULES_BELOW_TEXT_START selects the s390-style "Case B" placement

src/include/kasld/arch/s390.h

@@ -114,6 +114,12 @@
 // Runtime-determined; use wide bounds for validation.
 #define MODULES_START 0ul
 #define MODULES_END 0x20000000000000ul
+
+// Usable as a BOUND: the boot decompressor sets MODULES_END =
+// round_down(kernel_start, _SEGMENT_SIZE) and MODULES_VADDR = MODULES_END -
+// 2 GiB, so both stay within this window for any image placement, and a floor
+// of 0 cannot be too high whatever the layout.
+#define MODULES_BAND_EXACT 1
 #define MODULES_RELATIVE_TO_TEXT 1
 #define MODULES_BELOW_TEXT_START 1
 #define MODULES_END_TO_TEXT_OFFSET                                             \