components: make the firmware_memmap RAM covering all-or-nothing

firmware_memmap emits a COMPLETE RAM covering; firmware_memmap_holes and
ram_map_phys_exclude carve the gaps between extents as forbidden bands. But
kasld_load_ram_extents silently dropped entries on overflow (max=64), on a
failed parse of a System RAM entry, or on i386/PAE >4 GiB truncation
(strtoul into unsigned long) — each fabricating a false gap that becomes an
unsound C_EXCLUDE on the phys base.

Make the loader all-or-nothing: parse with strtoull + a word-fit check, and
return -1 (caller emits nothing) on any overflow / parse failure / truncation
— mirroring boot_params_e820's covering_ok guard. Bump the cap to 128.

Author: bcoles

src/components/firmware_memmap.c

@@ -21,8 +21,13 @@ KASLD_META("method:parsed\n"
            "phase:inference\n");
 
 int main(void) {
-  struct kasld_ram_extent ext[64];
-  int n = kasld_load_ram_extents(ext, 64);
+  struct kasld_ram_extent ext[128];
+  int n = kasld_load_ram_extents(ext, 128);
+  /* n < 0: the map could not be captured completely (overflow, parse failure,
+   * or word truncation). A partial covering would fabricate false gaps that
+   * gap-carving rules turn into unsound exclusions, so emit nothing. */
+  if (n < 0)
+    return 0;
   for (int i = 0; i < n; i++)
     kasld_result_extent(KASLD_TYPE_PHYS, REGION_RAM, ext[i].lo, ext[i].hi, NULL,
                         CONF_PARSED);

src/include/kasld/firmware_memmap.h

@@ -8,7 +8,9 @@
 // fields via kasld_fopen), so they honour KASLD_SYSROOT redirection.
 //
 // Read by the engine bridge, which emits these as PHYS RAM extents that the
-// firmware_memmap_holes verdict consumes.
+// firmware_memmap_holes verdict consumes. The loader is all-or-nothing: it
+// returns -1 (caller emits nothing) if the map cannot be captured completely,
+// because a partial covering would fabricate false gaps for gap-carving.
 // ---
 // <bcoles@gmail.com>
 
@@ -42,42 +44,74 @@ kasld_memmap_first_line(const char *path, char *buf, size_t len) {
   return 0;
 }
 
-/* Collect "System RAM" inclusive extents; returns count (0 if absent). */
+/* Collect "System RAM" inclusive extents into out[0..max).
+ *
+ * Returns the number of extents, or -1 if the firmware map cannot be
+ * represented COMPLETELY and faithfully: more than `max` System RAM entries,
+ * a numbered entry whose type/start/end could not be read or parsed, or an
+ * extent value that does not fit unsigned long (i386/PAE >4 GiB truncation).
+ * A covering MUST be complete — a truncated or partial map fabricates false
+ * gaps that the gap-carving rules (firmware_memmap_holes, ram_map_phys_exclude)
+ * turn into unsound C_EXCLUDEs — so callers MUST emit nothing on -1. Mirrors
+ * the all-or-nothing covering_ok guard in boot_params_e820. */
 __attribute__((unused)) static int
 kasld_load_ram_extents(struct kasld_ram_extent *out, int max) {
   DIR *d = kasld_opendir(KASLD_MEMMAP_BASE);
   if (!d)
     return 0;
-  int n = 0;
+  int n = 0, incomplete = 0;
   struct dirent *ent;
-  while ((ent = readdir(d)) != NULL && n < max) {
+  while ((ent = readdir(d)) != NULL) {
     if (ent->d_name[0] == '.')
       continue;
     char path[512], buf[256];
     snprintf(path, sizeof(path), "%s/%s/type", KASLD_MEMMAP_BASE, ent->d_name);
-    if (kasld_memmap_first_line(path, buf, sizeof(buf)) != 0)
-      continue;
+    if (kasld_memmap_first_line(path, buf, sizeof(buf)) != 0) {
+      incomplete = 1; /* numbered entry with no type: map state unknown */
+      break;
+    }
     if (strcmp(buf, "System RAM") != 0)
-      continue;
+      continue; /* a genuine non-RAM region: a real gap, correctly omitted */
+    /* From here the entry IS System RAM; any failure makes the map partial. */
+    if (n >= max) {
+      incomplete = 1; /* more RAM entries than out[]: would truncate the map */
+      break;
+    }
     snprintf(path, sizeof(path), "%s/%s/start", KASLD_MEMMAP_BASE, ent->d_name);
-    if (kasld_memmap_first_line(path, buf, sizeof(buf)) != 0)
-      continue;
+    if (kasld_memmap_first_line(path, buf, sizeof(buf)) != 0) {
+      incomplete = 1;
+      break;
+    }
     char *endp;
-    unsigned long start = strtoul(buf, &endp, 16);
-    if (endp == buf)
-      continue;
+    unsigned long long start = strtoull(buf, &endp, 16);
+    if (endp == buf) {
+      incomplete = 1;
+      break;
+    }
     snprintf(path, sizeof(path), "%s/%s/end", KASLD_MEMMAP_BASE, ent->d_name);
-    if (kasld_memmap_first_line(path, buf, sizeof(buf)) != 0)
-      continue;
-    unsigned long end = strtoul(buf, &endp, 16);
-    if (endp == buf || end < start)
-      continue;
-    out[n].lo = start;
-    out[n].hi = end;
+    if (kasld_memmap_first_line(path, buf, sizeof(buf)) != 0) {
+      incomplete = 1;
+      break;
+    }
+    unsigned long long end = strtoull(buf, &endp, 16);
+    if (endp == buf || end < start) {
+      incomplete = 1;
+      break;
+    }
+    /* On i386 unsigned long is 32-bit; a >4 GiB extent would truncate and
+     * corrupt the covering. Suppress the whole map rather than store a wrong
+     * extent. */
+    if ((unsigned long long)(unsigned long)start != start ||
+        (unsigned long long)(unsigned long)end != end) {
+      incomplete = 1;
+      break;
+    }
+    out[n].lo = (unsigned long)start;
+    out[n].hi = (unsigned long)end;
     n++;
   }
   closedir(d);
-  return n;
+  return incomplete ? -1 : n;
 }
 
 #endif /* KASLD_FIRMWARE_MEMMAP_H */