arm64: support sub-48 VA_BITS (39/42/47) configs

KIMAGE_VADDR and PAGE_OFFSET on arm64 are functions of VA_BITS_MIN, but
KASLD modelled only {48,52}: sub-48 kernels (4K 3-level=39 [common on
Android], 64K 2-level=42, 16K 3-level=47) were mis-detected and mis-pinned,
while the comments wrongly claimed the pin backstop handled them.

- detection: mmap_arm64_va_bits now probes the full boundary ladder
  (52/48/47/42/39 via MAP_FIXED_NOREPLACE), emitting the exact PAGE_OFFSET
  instead of collapsing everything <=48 to the 48-bit value
- model: VA_BITS_CANDIDATES gains 39/42/47; arm64_page_offset_for/_end_for
  helpers; Q_VIRT_IMAGE_BASE honest top widened to the union
  (KASLR_VIRT_TEXT_MAX_WIDE); arm64_coupling_validate and
  arm64_va_bits_from_directmap generalised to the candidate ladder
- new rule arm64_text_base (arm64 opted out of the generic disabled pin):
  derives VA_BITS_MIN from the resolved PAGE_OFFSET, narrows Q_VIRT_IMAGE_BASE
  to that config's text band (re-tightening the 48-bit KASLR window too), and
  pins the no-KASLR base at the correct KIMAGE_VADDR(VA_BITS_MIN). Inferred —
  a real text leak overrides; no pin when PAGE_OFFSET is unresolved.

Author: bcoles

src/components/mmap_arm64_va_bits.c

@@ -2,24 +2,23 @@
 //
 // arm64 VA_BITS detection via an mmap boundary probe, emitting PAGE_OFFSET.
 //
-// PROBING-phase component. On arm64
-// TASK_SIZE = 1<<VA_BITS and PAGE_OFFSET = -(1<<VA_BITS), so an mmap(MAP_FIXED)
-// at the VA_BITS=48 boundary distinguishes the configuration:
+// PROBING-phase component. On arm64 TASK_SIZE = 1<<VA_BITS and PAGE_OFFSET =
+// -(1<<VA_BITS), both fixed (not randomized). A one-page probe at
+// (1<<c) - PAGE_SIZE is mappable iff c <= VA_BITS, so probing the candidate
+// ladder largest-first and taking the first that maps yields the exact VA_BITS,
+// hence the exact PAGE_OFFSET (= arm64_page_offset_for(VA_BITS)). The engine
+// pins Q_PAGE_OFFSET to it (page_offset_from_landmark).
 //
-//   probe at 1<<48 fails (ENOMEM): VA_BITS <= 48  -> PAGE_OFFSET
-//   0xffff000000000000 probe at 1<<48 succeeds:       VA_BITS >= 52  ->
-//   PAGE_OFFSET 0xfff0000000000000
-//
-// PAGE_OFFSET is not randomized on arm64, so the detected value is exact; the
-// engine pins Q_PAGE_OFFSET to it (page_offset_from_landmark). It is a PROBING
-// component: the engine reads component results, and an active probe belongs
-// behind the subprocess boundary.
+// MAP_FIXED_NOREPLACE distinguishes "beyond TASK_SIZE" (ENOMEM/EINVAL → probe a
+// smaller boundary) from "occupied" (EEXIST → the address is within TASK_SIZE)
+// and never clobbers a live mapping. If the kernel returns an unrequested
+// address (NOREPLACE not honoured, pre-v4.17) the probe is unreliable and emits
+// nothing rather than guessing. Likewise an unexpected errno (RLIMIT_AS,
+// seccomp) or a VA_BITS below the smallest supported candidate → no emission,
+// leaving the engine's honest window (sound but wide).
 //
 // Leak primitive: virtual (kernel direct-map base) via the mmap syscall;
 // unprivileged, no sysctl gate. arm64 only.
-//
-// Caveat: RLIMIT_AS exhaustion also returns ENOMEM. Unlikely at probe time;
-// the same risk mmap_brute_vmsplit accepts.
 // ---
 // <bcoles@gmail.com>
 
@@ -31,37 +30,63 @@
 #include <sys/mman.h>
 #include <unistd.h>
 
+#ifndef MAP_FIXED_NOREPLACE
+#define MAP_FIXED_NOREPLACE 0x100000
+#endif
+
 KASLD_EXPLAIN(
-    "Probes mmap(MAP_FIXED) at 1<<48 on arm64: ENOMEM means VA_BITS<=48 "
-    "(PAGE_OFFSET 0xffff000000000000), success means VA_BITS>=52 "
-    "(PAGE_OFFSET 0xfff0000000000000). PAGE_OFFSET is not randomized "
-    "on arm64, so the value is exact. arm64 only; unprivileged.");
+    "Probes mmap(MAP_FIXED_NOREPLACE) at the 1<<VA_BITS boundaries on arm64 "
+    "(52/48/47/42/39): the largest that maps is VA_BITS, giving the exact "
+    "PAGE_OFFSET = -(1<<VA_BITS) (not randomized on arm64). arm64 only; "
+    "unprivileged.");
 
 KASLD_META("method:heuristic\n"
            "phase:probing\n"
            "addr:virtual\n");
 
 int main(void) {
 #if defined(__aarch64__)
-#define ARM64_VA48_PAGE_OFFSET 0xffff000000000000ul
-#define ARM64_VA52_PAGE_OFFSET 0xfff0000000000000ul
-#define ARM64_VA_PROBE_ADDR ((void *)(1UL << 48))
-#define ARM64_VA_PROBE_LEN 0x1000ul
+  /* VA_BITS candidates, largest first (must match VA_BITS_CANDIDATES). */
+  static const unsigned long cands[] = {52ul, 48ul, 47ul, 42ul, 39ul};
+  const int ncands = (int)(sizeof(cands) / sizeof(cands[0]));
 
-  void *p = mmap(ARM64_VA_PROBE_ADDR, ARM64_VA_PROBE_LEN, PROT_READ,
-                 MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
-  unsigned long virt_page_offset;
-  if (p == MAP_FAILED) {
-    if (errno != ENOMEM)
-      return 0; /* a different failure: don't infer */
-    virt_page_offset = ARM64_VA48_PAGE_OFFSET; /* VA_BITS <= 48 */
-    kasld_info("mmap(1<<48) failed (ENOMEM): VA_BITS<=48");
-  } else {
-    munmap(p, ARM64_VA_PROBE_LEN);
-    virt_page_offset = ARM64_VA52_PAGE_OFFSET; /* VA_BITS >= 52 */
-    kasld_info("mmap(1<<48) succeeded: VA_BITS>=52");
+  long pg = sysconf(_SC_PAGESIZE);
+  unsigned long page = (pg > 0) ? (unsigned long)pg : 0x1000ul;
+
+  unsigned long va_bits = 0;
+  for (int i = 0; i < ncands; i++) {
+    unsigned long c = cands[i];
+    void *want = (void *)((1UL << c) - page);
+    void *p = mmap(want, (size_t)page, PROT_NONE,
+                   MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED_NOREPLACE, -1, 0);
+    if (p == want) { /* mapped exactly here -> within TASK_SIZE */
+      munmap(p, (size_t)page);
+      va_bits = c;
+      break;
+    }
+    if (p !=
+        MAP_FAILED) { /* NOREPLACE not honoured (old kernel) -> unreliable */
+      munmap(p, (size_t)page);
+      kasld_info("mmap returned an unrequested address; probe unreliable");
+      return 0;
+    }
+    if (errno == EEXIST) { /* occupied -> addressable -> within TASK_SIZE */
+      va_bits = c;
+      break;
+    }
+    if (errno == ENOMEM || errno == EINVAL)
+      continue; /* beyond this boundary; try a smaller VA_BITS */
+    kasld_info("mmap(1<<%lu): unexpected errno %d; not inferring", c, errno);
+    return 0; /* RLIMIT_AS / seccomp / etc. — don't guess */
+  }
+
+  if (va_bits == 0) {
+    kasld_info("VA_BITS below smallest supported candidate; not inferring");
+    return 0;
   }
-  kasld_info("PAGE_OFFSET: %#lx", virt_page_offset);
+
+  unsigned long virt_page_offset = arm64_page_offset_for(va_bits);
+  kasld_info("VA_BITS=%lu PAGE_OFFSET=%#lx", va_bits, virt_page_offset);
   kasld_result_base(KASLD_TYPE_VIRT, REGION_PAGE_OFFSET, virt_page_offset, NULL,
                     CONF_INFERRED);
   return 0;

src/engine_rules.c

@@ -89,6 +89,7 @@ static const rule_fn k_rules[] = {
     rule_phys_virt_synth,
 
     /* arm64-specific */
+    rule_arm64_text_base,
     rule_arm64_memstart_align,
     rule_arm64_va_bits_from_directmap,
     rule_arm64_va_bits_from_vmemmap,

src/include/kasld/api.h

@@ -253,6 +253,12 @@ __extension__ _Static_assert((unsigned long)KERNEL_PHYS_MAX >
 #ifndef KASLR_VIRT_TEXT_MIN_WIDE
 #define KASLR_VIRT_TEXT_MIN_WIDE KASLR_VIRT_TEXT_MIN
 #endif
+/* Honest-top ceiling counterpart: defaults to the KASLR window top; an arch
+ * whose honest top must span more than one text-base layout (arm64 sub-48
+ * VA_BITS) widens it. Widen-only — never below KASLR_VIRT_TEXT_MAX. */
+#ifndef KASLR_VIRT_TEXT_MAX_WIDE
+#define KASLR_VIRT_TEXT_MAX_WIDE KASLR_VIRT_TEXT_MAX
+#endif
 #if defined(KASLR_PHYS_MIN) && !defined(KASLR_PHYS_MIN_WIDE)
 #define KASLR_PHYS_MIN_WIDE KASLR_PHYS_MIN
 #endif

src/include/kasld/arch/arm64.h

@@ -46,9 +46,26 @@
 #define PAGE_OFFSET 0xfff0000000000000ul
 #define PHYS_OFFSET 0ul
 
-// VA_BITS candidates for Q_VA_BITS (finite-set lattice). 48 and 52 are the two
-// configurations whose PAGE_OFFSET the directmap-range rule discriminates.
-#define VA_BITS_CANDIDATES {48ul, 52ul}
+// VA_BITS candidates for Q_VA_BITS (finite-set lattice), smallest first. Each
+// arm64 paging config has its own VA_BITS (hence its own PAGE_OFFSET /
+// KIMAGE_VADDR geometry): 4K 3-level=39 (common on Android), 64K 2-level=42,
+// 16K 3-level=47, 4K/16K 4-level=48, and 52-bit LVA (VA_BITS_MIN still 48).
+#define VA_BITS_CANDIDATES {39ul, 42ul, 47ul, 48ul, 52ul}
+// Smallest supported VA_BITS — gives the highest (widest-accepting) linear-map
+// ceiling for region validation.
+#define ARM64_VA_BITS_MIN_SUPPORTED 39ul
+
+// VA_BITS-derived geometry, kept in one place so the layout math is not
+// duplicated across mmap_arm64_va_bits, arm64_coupling_validate, and
+// arm64_va_bits_from_directmap. arm64 PAGE_OFFSET = -(1<<VA_BITS); the linear
+// map occupies [PAGE_OFFSET, _PAGE_END), _PAGE_END = -(1<<(VA_BITS-1)). Pure
+// functions of VA_BITS, not randomized.
+static inline unsigned long arm64_page_offset_for(unsigned long va_bits) {
+  return -(1UL << va_bits);
+}
+static inline unsigned long arm64_page_end_for(unsigned long va_bits) {
+  return -(1UL << (va_bits - 1));
+}
 
 // On arm64, PHYS_OFFSET is runtime (= memstart_addr, randomized at boot), so
 // the compile-time formula is NOT a sound runtime directmap projection;
@@ -151,32 +168,29 @@
 // https://elixir.bootlin.com/linux/v6.12/source/arch/arm64/include/asm/memory.h#L46
 // Use v6.2+ value (2G module region, current default).
 #define KIMAGE_VADDR 0xffff800080000000ul
+// Module-region size (KIMAGE_VADDR = _PAGE_END(VA_BITS_MIN) + this). v6.2+ uses
+// SZ_2G; older kernels used 128M/256M. rule_arm64_text_base derives
+// KIMAGE_VADDR for the resolved VA_BITS_MIN as arm64_page_end_for(VA_BITS_MIN)
+// + this — for VA_BITS_MIN=48 that reproduces KIMAGE_VADDR above. The version
+// spread is the pin's residual imprecision (inferred confidence; a real leak
+// overrides).
+#define ARM64_MODULE_REGION_SIZE (2ul * GB)
 
 // See docs/kaslr.md "Default text base and KASLR alignment" for all
 // architectures. Kernel source: arch/arm64/kernel/vmlinux.lds.S,
 // arch/arm64/include/asm/memory.h
 #define KERNEL_VIRT_TEXT_DEFAULT (KIMAGE_VADDR + IMAGE_BASE_OFFSET)
 
-/* KASLR-off ⇒ pin contract.
- *
- * SCOPE: KASLD models arm64 only for VA_BITS_MIN == 48 — the {48, 52} configs
- * (4K/16K 4-level, plus 52-bit LVA, whose VA_BITS_MIN is still 48). On those,
- * no-KASLR text sits at KIMAGE_VADDR + IMAGE_BASE_OFFSET = the 48-bit default
- * below, independent of the runtime VA_BITS (which only moves PAGE_OFFSET / the
- * linear map), so this pin is correct.
- *
- * Sub-48 builds land at a DIFFERENT KIMAGE_VADDR and are NOT supported:
- *   4K  3-level → VA_BITS 39 (common on Android), KIMAGE_VADDR
- * 0xffffffc080000000 64K 2-level → VA_BITS 42 16K 3-level → VA_BITS 47,
- * KIMAGE_VADDR 0xffffc00080000000 KASLD cannot even detect them:
- * mmap_arm64_va_bits probes only 1<<48 (so every VA_BITS <= 48 reads as 48) and
- * Q_VA_BITS models only {48, 52}. And the pin's window-containment backstop
- * does NOT catch the mismatch — the 48-bit default coincides with the
- * honest-top floor (KASLR_VIRT_TEXT_MIN_WIDE == KIMAGE_VADDR), so it is always
- * "in window." A sub-48 no-KASLR kernel therefore mis-pins (and its window is
- * wrong regardless of KASLR). Real support is a VA_BITS overhaul: see
- * dev/research/arm64-va-bits-min.md. */
-#define KASLR_DISABLED_PINS_VIRT_TEXT 1
+/* KASLR-off pin is LAYOUT-DEPENDENT on arm64: KIMAGE_VADDR varies with
+ * VA_BITS_MIN (= min(VA_BITS, 48)), so the no-KASLR text base is not a single
+ * compile-time constant. The generic virt_kaslr_disabled_pin (one fixed
+ * default) is therefore opted OUT; rule_arm64_text_base owns the text base,
+ * deriving VA_BITS_MIN from the resolved PAGE_OFFSET and narrowing/pinning to
+ * KIMAGE_VADDR(VA_BITS_MIN) — correct for VA_BITS 39/42/47/48/52, not just 48.
+ * Same shape as rule_riscv64_text_base. When PAGE_OFFSET is unresolved (no
+ * probe result, no leak) it does not pin — the honest window stays wide
+ * (sound). */
+#define KASLR_DISABLED_PINS_VIRT_TEXT 0
 #define KASLD_ARCH_DEFAULT_TEXT_BASE_DEFINED 1
 static inline unsigned long arch_default_text_base(void) {
   return KERNEL_VIRT_TEXT_DEFAULT;
@@ -219,6 +233,14 @@ static inline unsigned long arch_default_text_base(void) {
  * the v6.6 upper edge (96 TiB) and the v6.12+ upper edge (~94.5 TiB). */
 #define KASLR_VIRT_TEXT_MIN_WIDE KIMAGE_VADDR
 
+/* Honest-top CEILING for Q_VIRT_IMAGE_BASE. KASLR_VIRT_TEXT_MAX is the 48-bit
+ * formula's window top (kept for entropy/slot reporting); it is too low for
+ * sub-48 configs, whose KIMAGE_VADDR is HIGHER (39-bit → 0xffffffc080000000).
+ * Widen the honest top to the validation ceiling KERNEL_VIRT_TEXT_MAX, which
+ * admits every supported VA_BITS_MIN's text base, so a sub-48 text leak is not
+ * falsely excluded. Widen-only, never-narrow — same discipline as the floor. */
+#define KASLR_VIRT_TEXT_MAX_WIDE KERNEL_VIRT_TEXT_MAX
+
 #define KASLR_SUPPORTED 1
 
 #endif /* KASLD_ARM64_H */

src/include/kasld/engine_rules.h

@@ -100,6 +100,7 @@ R(text_base_coupling_synth);
 R(phys_virt_synth);
 
 /* arm64-specific rules */
+R(arm64_text_base);
 R(arm64_memstart_align);
 R(arm64_va_bits_from_directmap);
 R(arm64_va_bits_from_vmemmap);

src/quantities.c

@@ -46,11 +46,16 @@ static void top_interval(struct estimate *e, unsigned long lo,
 
 static void top_virt_image_base(struct estimate *e) {
   /* The virtual kernel-text base lives in the virtual KASLR window
-   * [KASLR_VIRT_TEXT_MIN_WIDE, KASLR_VIRT_TEXT_MAX] — fixed per-arch by the
-   * kernel's VA layout (unlike the physical base, this does not depend on DRAM
-   * placement), so it is a sound and tighter honest top than the raw
+   * [KASLR_VIRT_TEXT_MIN_WIDE, KASLR_VIRT_TEXT_MAX_WIDE] — fixed per-arch by
+   * the kernel's VA layout (unlike the physical base, this does not depend on
+   * DRAM placement), so it is a sound and tighter honest top than the raw
    * mapping-region bounds KERNEL_VIRT_TEXT_MIN/MAX.
    *
+   * Both edges are the conservative (_WIDE) variants: same value as
+   * KASLR_VIRT_TEXT_MIN/MAX where the arch's KASLR window already spans every
+   * layout, wider where it does not (x86_64 CONFIG_PHYSICAL_START at the floor;
+   * arm64 sub-48 VA_BITS at the ceiling).
+   *
    * The _WIDE floor is the conservative variant of KASLR_VIRT_TEXT_MIN — same
    * value where the arch's KASLR_VIRT_TEXT_MIN does not bake in a configurable
    * Kconfig knob; *wider* on arches like x86_64 where KASLR_VIRT_TEXT_MIN
@@ -60,7 +65,7 @@ static void top_virt_image_base(struct estimate *e) {
    * CONF_HEURISTIC from the compile-time default — overridable by any
    * real evidence). */
   top_interval(e, (unsigned long)KASLR_VIRT_TEXT_MIN_WIDE,
-               (unsigned long)KASLR_VIRT_TEXT_MAX);
+               (unsigned long)KASLR_VIRT_TEXT_MAX_WIDE);
 }
 
 static void top_phys_image_base(struct estimate *e) {

src/rules/arm64_coupling_validate.c

@@ -50,9 +50,15 @@
 
 #include <string.h>
 
-/* VA_BITS_MIN=48 anchored constants — see arm64.h for derivations. */
-#define ARM64_PAGE_END_VAMIN 0xffff800000000000ul /* _PAGE_END(48) */
-#define ARM64_VMEMMAP_END 0xffffffffc0000000ul    /* −SZ_1G */
+/* The linear map sits in [PAGE_OFFSET, _PAGE_END), both functions of VA_BITS.
+ * The widest accepting ceiling is _PAGE_END of the SMALLEST supported VA_BITS
+ * (highest _PAGE_END) — arm64_page_end_for(ARM64_VA_BITS_MIN_SUPPORTED) — so a
+ * sub-48 PAGE_OFFSET (e.g. 39-bit 0xffffff8000000000) is admitted, not flagged
+ * as out-of-band. Trade-off: the gap between the 48-bit and smallest-VA_BITS
+ * _PAGE_END values is no longer policed pre-resolution (a 48-bit heap pointer
+ * mistagged DIRECTMAP there is admitted); the directmap consumers narrow once
+ * PAGE_OFFSET resolves. */
+#define ARM64_VMEMMAP_END 0xffffffffc0000000ul /* −SZ_1G */
 /* VA_BITS=48 VMEMMAP floor; conservative for both VA48 and VA52 (VA52's
  * VMEMMAP extends further down, so any address < VA48 floor is consistent
  * with VA52 vmemmap — we don't invalidate it). Matches the threshold the
@@ -77,10 +83,11 @@ int rule_arm64_coupling_validate(const struct evidence_set *ev,
     switch (o->eff_region) {
     case REGION_DIRECTMAP:
     case REGION_PAGE_OFFSET:
-      /* Must be below _PAGE_END(48). The lower edge varies with VA_BITS
-       * (PAGE_OFFSET = −(1<<VA_BITS)); use the widest plausible floor
-       * (VA52's, KERNEL_VIRT_VAS_START) as the lower bound. */
-      bad = (a >= ARM64_PAGE_END_VAMIN) ||
+      /* Linear map lives in [PAGE_OFFSET, _PAGE_END), both VA_BITS-dependent.
+       * Widest accepting bounds: floor at the lowest PAGE_OFFSET (VA52's,
+       * KERNEL_VIRT_VAS_START); ceiling at the highest _PAGE_END (smallest
+       * supported VA_BITS). */
+      bad = (a >= arm64_page_end_for(ARM64_VA_BITS_MIN_SUPPORTED)) ||
             (a < (unsigned long)KERNEL_VIRT_VAS_START);
       break;
     case REGION_MODULE: