engine: project candidate counts, not a second way to count them

compute_kaslr_info() reached across the engine/summary seam to count how
many candidates a quantity admits, and under -DKASLD_TESTING that reach
was replaced by hand-rolled range arithmetic read off layout. Nothing
exercised the substitute; the unit tests asserted on none of the fields
it wrote. They were exercising a summary function no shipped binary
contains.

engine_sync_authoritative() now projects six counts alongside the windows
it already wrote -- both image bases, the direct-map base, vmalloc,
vmemmap and the module base -- from the same estimates at the same
moment, at the engine-resolved alignments. Every #else substitution goes
with it: 33 KASLD_TESTING references drop to 24, and 13 blocks inside
compute_kaslr_info() to 5. The five that remain are omissions rather than
substitutions, so the testing build now runs less of the summary path
instead of a different one. quantity_top_slots() turned out to need no
engine state at all, reading only the quantity table and the sound floor,
so it and its call sites compile in every build.

Seeding layout directly is why the tests carried over unchanged, and why
they proved nothing. Counting at PAGE_SIZE rather than the resolved KASLR
granularity, dropping the constraint set so interior holes survive, or
carving at CONF_BRUTE so a heuristic claim narrows the GUARANTEED window
each left the whole suite and every replay fixture passing. The alignment
mistake reports this host at 241153 slots and 18 bits against a true 472
and 9 -- the headline number doubles its claimed entropy and nothing
objects. Replay is crash coverage by construction, so it established that
the seam runs on 13 arches, never what it says.

test_engine_sync_projects_slot_counts is a counting contract rather than
an edge contract: one fixture whose window, resolved alignment, proven
point exclude and sub-floor span exclude land all three mistakes on
different totals, so a single exact assertion separates them. It kills
all three, and deleting the phys count, and passes on every cross target,
its literals deriving from the fixture rather than the host.

Author: bcoles

src/include/kasld/internal.h

@@ -119,6 +119,28 @@ struct kasld_layout {
    * the region's origin. */
   unsigned long virt_module_base_min;
   unsigned long virt_module_base_max;
+
+  /* Candidate counts, projected beside the windows they belong to.
+   *
+   * How many placements a quantity still admits is not (hi - lo) / align: the
+   * estimate's interior C_EXCLUDE holes are carved at READ time, so only
+   * quantity_slots() over the estimate AND its constraint set can answer it. A
+   * flat division is hole-blind and over-counts.
+   *
+   * They live here because that answer needs the engine, and the summary
+   * builder is a consumer of this struct rather than of the engine. Projecting
+   * them at the same moment as the window they count keeps the two describing
+   * one resolution -- and leaves no computation for a build without an engine
+   * to substitute a second, hole-blind definition for.
+   *
+   * Zero means "no count resolved", which is also the value a caller that seeds
+   * this struct directly gets without asking. */
+  unsigned long virt_kaslr_slots;
+  unsigned long phys_kaslr_slots;
+  unsigned long virt_page_offset_slots;
+  unsigned long virt_vmalloc_slots;
+  unsigned long virt_vmemmap_slots;
+  unsigned long virt_module_slots;
 };
 
 /* =========================================================================

src/orchestrator.c

@@ -2905,23 +2905,23 @@ static int ilog2(unsigned long v) {
  * projection with no engine dependencies); engine_resolve and its engine
  * instance are engine-only (they drive the components + engine.c machinery). */
 static void engine_sync_authoritative(const struct engine *e);
-#ifndef KASLD_TESTING
-static void engine_resolve(struct engine *e);
-static struct engine
-    g_auth_engine; /* holds the GUARANTEED (primary) resolution */
 
 /* Sound floor for the guaranteed window: inputs below this are out of scope, so
  * the window is derived purely from >= floor signals. CONF_INFERRED admits
  * parsed/derived/inferred (proven); heuristic/timing/brute reach the likely
  * window only. The two-window POLICY (which floors, what they mean) lives here;
- * the engine is floor-agnostic. */
+ * the engine is floor-agnostic.
+ *
+ * Outside the engine-only block: this names a confidence level and has no
+ * engine dependency, and the projection above -- which every build compiles --
+ * counts candidates at this floor. */
 #define KASLD_SOUND_FLOOR CONF_INFERRED
 
-#ifndef KASLD_TESTING
 /* Candidate count over q's honest compile-time top — the entropy this
  * architecture's KASLR had before any evidence narrowed it. Counted through
  * quantity_slots() at the same alignment as the residual, so the two are
- * directly comparable. */
+ * directly comparable. Its inputs are the quantity table and the sound floor;
+ * no engine state, so every build has it. */
 static unsigned long quantity_top_slots(enum kasld_quantity q,
                                         unsigned long align) {
   if (!align || !quantities[q].init_top)
@@ -2930,7 +2930,11 @@ static unsigned long quantity_top_slots(enum kasld_quantity q,
   quantities[q].init_top(&top);
   return quantity_slots(q, &top, KASLD_SOUND_FLOOR, NULL, 0, align);
 }
-#endif
+
+#ifndef KASLD_TESTING
+static void engine_resolve(struct engine *e);
+static struct engine
+    g_auth_engine; /* holds the GUARANTEED (primary) resolution */
 
 /* Snapshot of the LIKELY resolution (floor CONF_BRUTE — all signals): the est +
  * constraints quantity_slots() needs, plus the resolver's rejected-constraint
@@ -3100,27 +3104,12 @@ void compute_kaslr_info(struct summary *s) {
   s->kaslr.has_phys = 0;
   s->kaslr.pstext = observed_stext_base(KASLD_TYPE_PHYS, ptext);
 
-  /* Hole-aware slot count: route via quantity_slots() so interior C_EXCLUDE
-   * holes and any C_STRIDE residue class are reflected in the headline entropy
-   * number. Flat (hi-lo)/align is the no-constraints fallback for KASLD_TESTING
-   * builds (the engine instance is compiled out there). */
-#ifndef KASLD_TESTING
-  s->kaslr.vslots =
-      quantity_slots(Q_VIRT_IMAGE_BASE, &g_auth_engine.est[Q_VIRT_IMAGE_BASE],
-                     KASLD_SOUND_FLOOR, g_auth_engine.constraints,
-                     g_auth_engine.n_constraints, layout.virt_kaslr_align);
-#else
-  {
-    unsigned long text_range =
-        layout.virt_kaslr_text_max - layout.virt_kaslr_text_min;
-    /* Closed window: + 1 counts the floor slot, matching quantity_slots(). */
-    s->kaslr.vslots = (layout.virt_kaslr_align && layout.virt_kaslr_text_max)
-                          ? text_range / layout.virt_kaslr_align + 1
-                          : 0;
-  }
-#endif
+  /* Hole-aware slot counts, projected beside the windows they count (see
+   * struct kasld_layout). Interior C_EXCLUDE holes and any C_STRIDE residue
+   * class are already reflected, so the headline entropy follows the estimate
+   * rather than the width of its convex hull. */
+  s->kaslr.vslots = layout.virt_kaslr_slots;
   s->kaslr.vbits = s->kaslr.vslots > 0 ? ilog2(s->kaslr.vslots) : 0;
-#ifndef KASLD_TESTING
   {
     /* The starting candidate count, from the window the kernel draws the image
      * base from -- KASLR_VIRT_TEXT_MIN..MAX, not the quantity's honest top.
@@ -3141,31 +3130,15 @@ void compute_kaslr_info(struct summary *s) {
     unsigned long top = (a && hi > lo) ? (hi - lo) / a + 1 : 0;
     s->kaslr.vtop_slots = top;
     s->kaslr.vbits_top = top > 0 ? ilog2(top) : 0;
-#ifndef KASLD_TESTING
     s->kaslr.varch_slots = quantity_top_slots(Q_VIRT_IMAGE_BASE, a);
-#endif
   }
-#endif
 
 #ifdef KASLR_PHYS_MIN
   {
-#ifndef KASLD_TESTING
-    s->kaslr.pslots =
-        quantity_slots(Q_PHYS_IMAGE_BASE, &g_auth_engine.est[Q_PHYS_IMAGE_BASE],
-                       KASLD_SOUND_FLOOR, g_auth_engine.constraints,
-                       g_auth_engine.n_constraints, layout.phys_kaslr_align);
-#else
-    unsigned long phys_range =
-        layout.phys_kaslr_text_max - layout.phys_kaslr_text_min;
-    s->kaslr.pslots = (layout.phys_kaslr_align && layout.phys_kaslr_text_max)
-                          ? phys_range / layout.phys_kaslr_align + 1
-                          : 0;
-#endif
+    s->kaslr.pslots = layout.phys_kaslr_slots;
     s->kaslr.pbits = s->kaslr.pslots > 0 ? ilog2(s->kaslr.pslots) : 0;
-#ifndef KASLD_TESTING
     s->kaslr.parch_slots =
         quantity_top_slots(Q_PHYS_IMAGE_BASE, layout.phys_kaslr_align);
-#endif
   }
 #endif
 
@@ -3280,64 +3253,28 @@ void compute_kaslr_info(struct summary *s) {
                                  ? layout.virt_module_base_max
                                  : 0;
 
-  /* Hole-aware residual slot counts for the memory-KASLR regions, mirroring the
-   * headline vslots/pslots: routed through quantity_slots() so interior
-   * C_EXCLUDE holes (and any stride class) are reflected in the entropy the
-   * renderer prints, rather than a hole-blind (max-min)/align. Flat division is
-   * the KASLD_TESTING fallback (the engine instance is compiled out there).
-   * Only the both-sided window displays a slot count, so gate on min && max. */
-#ifndef KASLD_TESTING
+  /* Residual slot counts for the memory-KASLR regions, mirroring the headline
+   * vslots/pslots: the projected count already reflects interior C_EXCLUDE
+   * holes and any stride class, so the entropy the renderer prints follows the
+   * estimate rather than the width of its hull. Only a both-sided window
+   * displays a count, so gate on min && max -- a presentation rule, asked here
+   * where those edges are in hand. */
   s->kaslr.virt_page_offset_slots =
       (s->kaslr.virt_page_offset_min && s->kaslr.virt_page_offset_max)
-          ? quantity_slots(Q_PAGE_OFFSET, &g_auth_engine.est[Q_PAGE_OFFSET],
-                           KASLD_SOUND_FLOOR, g_auth_engine.constraints,
-                           g_auth_engine.n_constraints, RANDOMIZE_MEMORY_ALIGN)
+          ? layout.virt_page_offset_slots
           : 0;
   s->kaslr.virt_vmalloc_slots =
       (s->kaslr.virt_vmalloc_min && s->kaslr.virt_vmalloc_max)
-          ? quantity_slots(Q_VMALLOC_BASE, &g_auth_engine.est[Q_VMALLOC_BASE],
-                           KASLD_SOUND_FLOOR, g_auth_engine.constraints,
-                           g_auth_engine.n_constraints, RANDOMIZE_MEMORY_ALIGN)
+          ? layout.virt_vmalloc_slots
           : 0;
   s->kaslr.virt_vmemmap_slots =
       (s->kaslr.virt_vmemmap_min && s->kaslr.virt_vmemmap_max)
-          ? quantity_slots(Q_VMEMMAP_BASE, &g_auth_engine.est[Q_VMEMMAP_BASE],
-                           KASLD_SOUND_FLOOR, g_auth_engine.constraints,
-                           g_auth_engine.n_constraints, RANDOMIZE_MEMORY_ALIGN)
+          ? layout.virt_vmemmap_slots
           : 0;
-  /* The module base is page-granular on every arch that randomizes it (x86_64
-   * draws a whole number of pages; the arm64 bounding box and the
-   * PAGE_OFFSET-derived bands are page-aligned), so PAGE_SIZE is the pitch
-   * rather than RANDOMIZE_MEMORY_ALIGN, which is an x86_64 memory-KASLR
-   * constant and 0 elsewhere. */
   s->kaslr.virt_module_slots =
       (s->kaslr.virt_module_min && s->kaslr.virt_module_max)
-          ? quantity_slots(Q_MODULE_BASE, &g_auth_engine.est[Q_MODULE_BASE],
-                           KASLD_SOUND_FLOOR, g_auth_engine.constraints,
-                           g_auth_engine.n_constraints, PAGE_SIZE)
+          ? layout.virt_module_slots
           : 0;
-#else
-  {
-    unsigned long a = (unsigned long)RANDOMIZE_MEMORY_ALIGN;
-    s->kaslr.virt_page_offset_slots =
-        (a && s->kaslr.virt_page_offset_max > s->kaslr.virt_page_offset_min)
-            ? (s->kaslr.virt_page_offset_max - s->kaslr.virt_page_offset_min) /
-                  a
-            : 0;
-    s->kaslr.virt_vmalloc_slots =
-        (a && s->kaslr.virt_vmalloc_max > s->kaslr.virt_vmalloc_min)
-            ? (s->kaslr.virt_vmalloc_max - s->kaslr.virt_vmalloc_min) / a
-            : 0;
-    s->kaslr.virt_vmemmap_slots =
-        (a && s->kaslr.virt_vmemmap_max > s->kaslr.virt_vmemmap_min)
-            ? (s->kaslr.virt_vmemmap_max - s->kaslr.virt_vmemmap_min) / a
-            : 0;
-    s->kaslr.virt_module_slots =
-        (s->kaslr.virt_module_max > s->kaslr.virt_module_min)
-            ? (s->kaslr.virt_module_max - s->kaslr.virt_module_min) / PAGE_SIZE
-            : 0;
-  }
-#endif
   s->kaslr.virt_page_offset_bits = s->kaslr.virt_page_offset_slots > 0
                                        ? ilog2(s->kaslr.virt_page_offset_slots)
                                        : 0;
@@ -4358,6 +4295,45 @@ static void engine_sync_authoritative(const struct engine *e) {
       layout.modules_end = obs_hi;
     }
   }
+
+  /* Candidate counts, last: every window and alignment this reads is final by
+   * here, and the count must be taken from the same resolution as the window it
+   * counts. quantity_slots() is the only answer that carves the estimate's
+   * interior C_EXCLUDE holes; the alignments are the engine-resolved ones
+   * projected above, not the compile-time defaults.
+   *
+   * Counted unconditionally. Whether a count is worth PRESENTING is a question
+   * about the window's shape -- both edges known, and so on -- which the
+   * summary builder asks where those edges are in hand. Gating here instead
+   * would put a presentation rule in the projection and answer it from fields
+   * that do not exist yet. */
+  layout.virt_kaslr_slots = quantity_slots(
+      Q_VIRT_IMAGE_BASE, &e->est[Q_VIRT_IMAGE_BASE], KASLD_SOUND_FLOOR,
+      e->constraints, e->n_constraints, layout.virt_kaslr_align);
+  /* Both image-base counts are taken here, on every arch. The phys window is
+   * projected under !TEXT_TRACKS_DIRECTMAP above because only a decoupled arch
+   * resolves it separately; the count is still meaningful on a coupled arch,
+   * where the estimate carries the locked-to-virt window. */
+  layout.phys_kaslr_slots = quantity_slots(
+      Q_PHYS_IMAGE_BASE, &e->est[Q_PHYS_IMAGE_BASE], KASLD_SOUND_FLOOR,
+      e->constraints, e->n_constraints, layout.phys_kaslr_align);
+  layout.virt_page_offset_slots =
+      quantity_slots(Q_PAGE_OFFSET, &e->est[Q_PAGE_OFFSET], KASLD_SOUND_FLOOR,
+                     e->constraints, e->n_constraints, RANDOMIZE_MEMORY_ALIGN);
+  layout.virt_vmalloc_slots =
+      quantity_slots(Q_VMALLOC_BASE, &e->est[Q_VMALLOC_BASE], KASLD_SOUND_FLOOR,
+                     e->constraints, e->n_constraints, RANDOMIZE_MEMORY_ALIGN);
+  layout.virt_vmemmap_slots =
+      quantity_slots(Q_VMEMMAP_BASE, &e->est[Q_VMEMMAP_BASE], KASLD_SOUND_FLOOR,
+                     e->constraints, e->n_constraints, RANDOMIZE_MEMORY_ALIGN);
+  /* The module base is page-granular on every arch that randomizes it (x86_64
+   * draws a whole number of pages; the arm64 bounding box and the
+   * PAGE_OFFSET-derived bands are page-aligned), so PAGE_SIZE is the pitch
+   * rather than RANDOMIZE_MEMORY_ALIGN, which is an x86_64 memory-KASLR
+   * constant and 0 elsewhere. */
+  layout.virt_module_slots =
+      quantity_slots(Q_MODULE_BASE, &e->est[Q_MODULE_BASE], KASLD_SOUND_FLOOR,
+                     e->constraints, e->n_constraints, PAGE_SIZE);
 }
 #ifndef KASLD_TESTING
 

tests/test_kasld.c

@@ -1877,6 +1877,84 @@ static void test_engine_sync_projects_all_fields(void) {
   assert(layout.virt_kernel_vas_start == vas_floor_before);
 }
 
+/* Contract test for the candidate COUNTS engine_sync_authoritative() projects.
+ * Separate from the edge test above because a count answers a different
+ * question than a window edge: not "did the field get written" but "was it
+ * counted at the resolved alignment, over evidence at the sound floor, with
+ * interior holes removed".
+ *
+ * Those three are independent, and each has a wrong answer that a window
+ * assertion cannot see -- counting at PAGE_SIZE rather than the resolved
+ * KASLR granularity, ignoring the constraint set so interior holes survive, or
+ * carving at CONF_BRUTE so a heuristic claim narrows the GUARANTEED window.
+ * The fixture is built so all three land on different totals and one exact
+ * assertion separates them. */
+static void test_engine_sync_projects_slot_counts(void) {
+  struct engine e;
+  memset(&e, 0, sizeof(e));
+
+  e.est[Q_VIRT_IMAGE_BASE].lo = FX_TEXT;
+  e.est[Q_VIRT_IMAGE_BASE].hi = FX_TEXT + 0x0e000000ul;
+  e.est[Q_VIRT_KASLR_ALIGN].lo = 0x200000ul;
+  e.est[Q_PHYS_IMAGE_BASE].lo = 0x4000000ul;
+  e.est[Q_PHYS_IMAGE_BASE].hi = 0x3c000000ul;
+  e.est[Q_PHYS_KASLR_ALIGN].lo = 0x200000ul;
+  e.est[Q_VMALLOC_BASE].lo = (unsigned long)PAGE_OFFSET + 0x11000000ul;
+  e.est[Q_VMALLOC_BASE].lo_binding = 1;
+  e.est[Q_VMALLOC_BASE].hi = (unsigned long)PAGE_OFFSET + 0x12000000ul;
+  e.est[Q_VMALLOC_BASE].hi_binding = 1;
+
+  /* A proven hole over one aligned candidate. Excluding a single point rather
+   * than a span is what shows up in the total: splitting a range removes the
+   * excluded candidate but the new range contributes its own floor, so a
+   * point exclude nets exactly -1 while a span nets its own width. */
+  e.constraints[0].q = Q_VIRT_IMAGE_BASE;
+  e.constraints[0].op = C_EXCLUDE;
+  e.constraints[0].value = FX_TEXT + 0x02000000ul;
+  e.constraints[0].value2 = FX_TEXT + 0x02000000ul;
+  e.constraints[0].conf = CONF_PARSED;
+  e.constraints[0].id = 1;
+
+  /* A heuristic hole below the sound floor: the guaranteed count must ignore
+   * it. Deliberately wide -- a below-floor hole that happened to leave the
+   * total unchanged would make the assertion pass for the wrong reason. */
+  e.constraints[1].q = Q_VIRT_IMAGE_BASE;
+  e.constraints[1].op = C_EXCLUDE;
+  e.constraints[1].value = FX_TEXT + 0x04000000ul;
+  e.constraints[1].value2 = FX_TEXT + 0x06000000ul - 1;
+  e.constraints[1].conf = CONF_HEURISTIC;
+  e.constraints[1].id = 2;
+  e.n_constraints = 2;
+
+  layout.virt_kaslr_align = 0;
+  layout.virt_kaslr_slots = 0;
+  layout.phys_kaslr_slots = 0;
+  layout.virt_vmalloc_slots = 0;
+
+  engine_sync_authoritative(&e);
+
+  /* 0x0e000000 of window at 2 MiB granularity is 112 whole strides plus the
+   * floor itself, less the one proven hole. Counting at PAGE_SIZE, dropping
+   * the constraint set, or carving at CONF_BRUTE each lands elsewhere. */
+  assert(layout.virt_kaslr_align == 0x200000ul);
+  assert(layout.virt_kaslr_slots == 112);
+
+  /* Taken on every arch, not only the decoupled ones that resolve a separate
+   * phys window: 0x38000000 at the same granularity, no holes. The align a
+   * coupled arch mirrors from the virt side is the same 2 MiB. */
+  assert(layout.phys_kaslr_slots == 449);
+
+#if RANDOMIZE_MEMORY_ALIGN
+  /* Memory KASLR moves the direct map, vmalloc and vmemmap bases on a coarser
+   * pitch than the image base: 16 MiB of window at that pitch is the floor and
+   * nothing above it. */
+  assert(layout.virt_vmalloc_slots == 0x1000000ul / RANDOMIZE_MEMORY_ALIGN + 1);
+#else
+  /* No memory KASLR here, so no pitch to count on. */
+  assert(layout.virt_vmalloc_slots == 0);
+#endif
+}
+
 /* engine_sync_authoritative tightens layout.modules_start/end from observed
  * VIRT/REGION_MODULE_BAND addresses (when inside the validation union),
  * so the rendered band reflects the actual runtime module range rather than
@@ -2337,6 +2415,7 @@ int main(void) {
 
   BEGIN_CATEGORY("engine_sync_authoritative");
   RUN(test_engine_sync_projects_all_fields);
+  RUN(test_engine_sync_projects_slot_counts);
   RUN(test_engine_sync_anchors_module_band_to_observations);
   RUN(test_engine_sync_module_band_rejects_out_of_union);
   RUN(test_engine_sync_module_band_never_degenerate);