ppc64: pin the module region base from the MMU mode and page size

64-bit PowerPC defines no MODULES_VADDR, so modules come from vmalloc,
whose base is one of three compile-time constants selected at boot. The
band spans all of them, leaving Q_MODULE_BASE at 683 billion candidates
for a value that is fully determined.

Both selectors are observable without privilege: the translation mode from
/proc/cpuinfo's "MMU" line, the page size from sysconf. Radix pins whatever
the page size; hash needs both, since H_KERN_VIRT_START differs between
hash-4k (0xc0003d0000000000) and hash-64k (0xc008000000000000).

The mode is trustworthy for this: platform code prints it from
radix_enabled(), and that same feature bit selects __vmalloc_start, so it
states the live mode rather than a CPU capability.

Positive evidence only. Book3E's base is not pinned — it is identified
solely by the ABSENCE of the MMU line, which a restricted /proc/cpuinfo
mimics exactly. An unrecognised mode or page size behaves the same way. The
band bound remains in every declining case.

Confirmed on ppc64le-alpine-6.12: the row resolves to a single candidate.

Author: bcoles

docs/usage.md

@@ -152,8 +152,9 @@ class.
 The module region exists everywhere, and is resolved from whichever directions
 the architecture affords. Where its placement is fully determined the row is a
 single address: a fixed segment base (MIPS), a base computed from the hardware
-virtual-address width (LoongArch), or one derived from a resolved `PAGE_OFFSET`
-(arm32, ppc32, riscv32). Where something is randomized or unknown it is a
+virtual-address width (LoongArch), one selected by the translation mode and
+page size (ppc64), or one derived from a resolved `PAGE_OFFSET` (arm32, ppc32,
+riscv32). Where something is randomized or unknown it is a
 window instead, narrowed by the architecture's module band, by the allocator's
 own placement window (on x86_64 the base sits within 1024 pages of
 `MODULES_VADDR`), by the resolved text base where the region is anchored to the

src/components/proc_cpuinfo.c

@@ -145,6 +145,51 @@ static int detect_riscv_mmu(void) {
 }
 #endif /* riscv64 */
 
+#if defined(__powerpc64__) || defined(__ppc64__)
+/* ppc64: "MMU : Radix" or "MMU : Hash".
+ *
+ * 64-bit PowerPC has no MODULES_VADDR — modules come from vmalloc, whose base
+ * differs by translation mode and page size across a 32 TiB spread. This field
+ * supplies the mode half; SF_PAGE_SIZE supplies the other, and a rule combines
+ * them.
+ *
+ * Trustworthy for the purpose: the platform code prints it from
+ * radix_enabled(), and that same runtime feature bit selects __vmalloc_start
+ * (radix_pgtable.c sets RADIX_VMALLOC_START, hash_utils.c sets
+ * H_VMALLOC_START). One bit drives both the report and the layout, so this is
+ * the live mode, not a capability — unlike x86_64's "57 bits virtual", which
+ * is what the CPU can do rather than what the kernel enabled.
+ *
+ * Emitted only on a POSITIVE match. The line comes from platform code
+ * (pSeries, PowerNV), so Book3E parts do not print it at all — but a
+ * restricted or absent /proc/cpuinfo looks identical, so absence is not
+ * evidence of Book3E and nothing is inferred from it. */
+static int detect_ppc64_mmu(void) {
+  char buf[256];
+  char *val = cpuinfo_get("MMU", buf, sizeof(buf));
+
+  if (!val) {
+    kasld_info("no MMU field in %s (Book3E, or a restricted /proc)",
+               CPUINFO_PATH);
+    return 0;
+  }
+
+  unsigned long mode;
+  if (strncmp(val, "Radix", 5) == 0) {
+    mode = KASLD_PPC64_MMU_RADIX;
+  } else if (strncmp(val, "Hash", 4) == 0) {
+    mode = KASLD_PPC64_MMU_HASH;
+  } else {
+    kasld_err("unrecognised MMU mode '%s'; not emitting", val);
+    return 0;
+  }
+
+  kasld_info("MMU: %s", val);
+  kasld_emit_scalar(SF_PPC64_MMU_MODE, mode, CONF_PARSED);
+  return 1;
+}
+#endif /* ppc64 */
+
 #if defined(__loongarch__) && __loongarch_grlen == 64
 /* loongarch64: "Address Sizes  : N bits physical, M bits virtual" (note the
  * capitalisation, which differs from x86_64's "address sizes").
@@ -290,6 +335,10 @@ int main(void) {
   found |= detect_loongarch_address_sizes();
 #endif
 
+#if defined(__powerpc64__) || defined(__ppc64__)
+  found |= detect_ppc64_mmu();
+#endif
+
   if (!found) {
     kasld_err("No actionable cpuinfo data found for this architecture.");
     return 0;

src/engine_rules.c

@@ -84,6 +84,7 @@ static const rule_fn k_rules[] = {
     rule_module_base_execmem_window,
     rule_module_base_from_text,
     rule_module_base_from_va_bits,
+    rule_module_base_ppc64_vmalloc,
 
     /* Multi-entry EFI_LOADER_CODE → Q_PHYS_IMAGE_BASE pin */
     rule_efi_loader_kernel_pick,

src/include/kasld/api.h

@@ -1068,6 +1068,12 @@ enum kasld_text_order {
  * records via kasld_emit_scalar(); the engine consumes them as OBS_SCALAR.
  * Closed vocabulary — add an entry, a wire token below, and a rule.
  * ========================================================================= */
+/* SF_PPC64_MMU_MODE values. The kernel prints this from radix_enabled(), the
+ * same runtime feature bit that selects __vmalloc_start, so it states the LIVE
+ * translation mode rather than a CPU capability. */
+#define KASLD_PPC64_MMU_RADIX 1ul
+#define KASLD_PPC64_MMU_HASH 2ul
+
 enum kasld_scalar_fact {
   SF_NONE = 0,
   SF_PHYS_MEMTOTAL,  /* total RAM bytes (/proc/meminfo)                  */
@@ -1116,6 +1122,11 @@ enum kasld_scalar_fact {
                           /* phys is off (e.g. EFI_RNG_PROTOCOL unavailable   */
                           /* with virt randomization intact via DTB) emits    */
                           /* this fact alone.                                 */
+  /* 64-bit PowerPC translation mode, as KASLD_PPC64_MMU_* below. Which of the
+   * three module-region bases is live follows from this plus SF_PAGE_SIZE, so
+   * it is emitted as a raw measurement and interpreted by a rule. Values are
+   * non-zero because a scalar fact of 0 reads as absent. */
+  SF_PPC64_MMU_MODE,
   SF_VIRT_KASLR_RANDOMIZATION_FAILED, /* 1 if the boot stub attempted    */
   /* virtual KASLR but could not produce a random virt offset (current   */
   /* emitters: arm64/riscv64 "lack of seed", arm64 "FDT remapping        */
@@ -1207,6 +1218,7 @@ static const char *const kasld_scalar_fact_wire_table[SF__COUNT] = {
     [SF_STRUCT_PAGE_BYTES] = "struct_page_bytes",
     [SF_TEXT_ORDER] = "text_order",
     [SF_VIRT_KERNEL_IMAGE_BASE] = "virt_kernel_image_base",
+    [SF_PPC64_MMU_MODE] = "ppc64_mmu_mode",
 };
 /* Adding an SF_* without a wire token shrinks this below SF__COUNT -> error. */
 typedef char kasld_sf_wire_table_complete

src/include/kasld/arch/ppc64.h

@@ -64,6 +64,24 @@
 // Usable as a BOUND: the floor is the lowest vmalloc base of any 64-bit
 // PowerPC MMU configuration, and the ceiling the highest vmalloc end.
 #define MODULES_BAND_EXACT 1
+
+// The live vmalloc base -- and so the module region's base -- is decided by the
+// translation mode and, for hash, the page size. All three values are
+// compile-time constants in the kernel; only the SELECTION is runtime, and both
+// selectors are observable unprivileged (SF_PPC64_MMU_MODE from /proc/cpuinfo,
+// SF_PAGE_SIZE from sysconf). module_base_ppc64_vmalloc turns the pair into a
+// pin.
+//
+// Book3E (KERN_VIRT_START = 0xc000100000000000) is deliberately absent: it is
+// identified only by the ABSENCE of the MMU line, which a restricted /proc
+// mimics exactly, so it stays unpinned rather than inferred from a missing
+// signal. The band floor above still covers it.
+// https://elixir.bootlin.com/linux/v7.2/source/arch/powerpc/include/asm/book3s/64/radix.h
+// https://elixir.bootlin.com/linux/v7.2/source/arch/powerpc/include/asm/book3s/64/hash-64k.h
+// https://elixir.bootlin.com/linux/v7.2/source/arch/powerpc/include/asm/book3s/64/hash-4k.h
+#define MODULES_BASE_PPC64_RADIX 0xc008000000000000ul
+#define MODULES_BASE_PPC64_HASH_64K 0xc008000000000000ul
+#define MODULES_BASE_PPC64_HASH_4K 0xc0003d0000000000ul
 #define MODULES_RELATIVE_TO_TEXT 0
 
 // Plausible physical address range for kernel image

src/include/kasld/engine_rules.h

@@ -324,6 +324,7 @@ R(module_base_bounds);
 R(module_base_execmem_window);
 R(module_base_from_text);
 R(module_base_from_va_bits);
+R(module_base_ppc64_vmalloc);
 
 /* Multi-entry EFI_LOADER_CODE → Q_PHYS_IMAGE_BASE pin (arm64/riscv64/x86_64) */
 R(efi_loader_kernel_pick);

src/rules/module_base_ppc64_vmalloc.c

@@ -0,0 +1,94 @@
+// This file is part of KASLD - https://github.com/bcoles/kasld
+//
+// Rule: pin Q_MODULE_BASE on 64-bit PowerPC from the live translation mode and
+// the page size.
+//
+// ppc64 defines no MODULES_VADDR, so modules are allocated from vmalloc, and
+// VMALLOC_START is a runtime variable set to one of three compile-time
+// constants depending on how the kernel booted:
+//
+//   Radix              RADIX_VMALLOC_START  = 0xc008000000000000
+//   Hash, 64K pages    H_VMALLOC_START      = 0xc008000000000000
+//   Hash, 4K pages     H_VMALLOC_START      = 0xc0003d0000000000
+//
+// Both selectors are observable without privilege: the mode from
+// /proc/cpuinfo's "MMU" line (SF_PPC64_MMU_MODE), the page size from sysconf
+// (SF_PAGE_SIZE). Knowing both fixes the base exactly, collapsing a band that
+// otherwise spans 32 TiB.
+//
+// POSITIVE EVIDENCE ONLY. Every branch requires a fact to be present and to
+// match a value this rule understands; nothing is concluded from a fact being
+// absent. That matters most for Book3E, whose base (0xc000100000000000) is NOT
+// listed above: Book3E is distinguished only by printing no "MMU" line, and a
+// restricted or unreadable /proc/cpuinfo is indistinguishable from that. An
+// unfamiliar page size is treated the same way — no pin, rather than a guess.
+// The band bound from module_base_bounds remains in either case.
+// ---
+// <bcoles@gmail.com>
+
+#include "include/kasld/engine_rules.h"
+#include "include/kasld/regions.h"
+
+#include <string.h>
+
+int rule_module_base_ppc64_vmalloc(const struct evidence_set *ev,
+                                   const struct estimate *est,
+                                   struct constraint *out, int out_max) {
+#if defined(MODULES_BASE_PPC64_RADIX)
+  (void)est;
+  if (out_max < 1)
+    return 0;
+
+  enum kasld_confidence mconf = CONF_UNKNOWN;
+  uint32_t msrc = 0;
+  unsigned long mode =
+      kasld_scalar_fact_value(ev, SF_PPC64_MMU_MODE, &mconf, &msrc);
+  if (!mode)
+    return 0;
+
+  unsigned long base;
+  enum kasld_confidence conf = mconf;
+  uint32_t src = msrc;
+
+  if (mode == KASLD_PPC64_MMU_RADIX) {
+    /* Radix places vmalloc at one address whatever the page size. */
+    base = (unsigned long)MODULES_BASE_PPC64_RADIX;
+  } else if (mode == KASLD_PPC64_MMU_HASH) {
+    enum kasld_confidence pconf = CONF_UNKNOWN;
+    uint32_t psrc = 0;
+    unsigned long pagesz =
+        kasld_scalar_fact_value(ev, SF_PAGE_SIZE, &pconf, &psrc);
+    if (pagesz == 65536ul) {
+      base = (unsigned long)MODULES_BASE_PPC64_HASH_64K;
+    } else if (pagesz == 4096ul) {
+      base = (unsigned long)MODULES_BASE_PPC64_HASH_4K;
+    } else {
+      return 0; /* no page size, or one this rule does not model */
+    }
+    /* Two facts, so the pin is only as good as the weaker of them. */
+    conf = kasld_conf_min(mconf, pconf);
+    src = psrc ? psrc : msrc;
+  } else {
+    return 0; /* a mode this rule does not model */
+  }
+
+  struct constraint *c = &out[0];
+  memset(c, 0, sizeof(*c));
+  c->q = Q_MODULE_BASE;
+  c->op = C_EQUALS;
+  c->value = base;
+  c->conf = conf;
+  if (src) {
+    c->derived_from[0] = src;
+    c->lineage_count = 1;
+  }
+  snprintf(c->origin, ORIGIN_LEN, "module_base_ppc64_vmalloc");
+  return 1;
+#else
+  (void)ev;
+  (void)est;
+  (void)out;
+  (void)out_max;
+  return 0;
+#endif
+}

tests/test_engine.c

@@ -7169,6 +7169,59 @@ static void test_module_base_from_va_bits(void) {
 #endif
 }
 
+/* ppc64 has no MODULES_VADDR: modules come from vmalloc, whose base is one of
+ * three constants selected at boot by the translation mode and page size. Both
+ * selectors are observable, so knowing them pins the quantity. Every branch
+ * requires POSITIVE evidence -- Book3E is identified only by printing no MMU
+ * line, which a restricted /proc mimics, so it must not be inferred. */
+static void test_module_base_ppc64_vmalloc(void) {
+  struct engine e;
+  const rule_fn rules[] = {rule_module_base_ppc64_vmalloc};
+  struct estimate top;
+  quantities[Q_MODULE_BASE].init_top(&top);
+
+  /* No MMU fact at all: silent, not a Book3E guess. */
+  engine_init(&e);
+  struct observation ps = mk_scalar(SF_PAGE_SIZE, 4096, CONF_PARSED);
+  evidence_add(&e.ev, &ps);
+  engine_run(&e, rules, 1);
+  assert(e.est[Q_MODULE_BASE].lo == top.lo &&
+         e.est[Q_MODULE_BASE].hi == top.hi);
+
+#if defined(MODULES_BASE_PPC64_RADIX)
+  /* Radix pins regardless of page size. */
+  engine_init(&e);
+  struct observation rx =
+      mk_scalar(SF_PPC64_MMU_MODE, KASLD_PPC64_MMU_RADIX, CONF_PARSED);
+  evidence_add(&e.ev, &rx);
+  engine_run(&e, rules, 1);
+  assert(e.est[Q_MODULE_BASE].lo == (unsigned long)MODULES_BASE_PPC64_RADIX &&
+         e.est[Q_MODULE_BASE].hi == (unsigned long)MODULES_BASE_PPC64_RADIX);
+
+  /* Hash needs the page size too; 4K and 64K select different bases. */
+  engine_init(&e);
+  struct observation hs =
+      mk_scalar(SF_PPC64_MMU_MODE, KASLD_PPC64_MMU_HASH, CONF_PARSED);
+  evidence_add(&e.ev, &hs);
+  engine_run(&e, rules, 1);
+  assert(e.est[Q_MODULE_BASE].lo == top.lo); /* mode alone is not enough */
+
+  engine_init(&e);
+  evidence_add(&e.ev, &hs);
+  struct observation p4 = mk_scalar(SF_PAGE_SIZE, 4096, CONF_PARSED);
+  evidence_add(&e.ev, &p4);
+  engine_run(&e, rules, 1);
+  assert(e.est[Q_MODULE_BASE].lo == (unsigned long)MODULES_BASE_PPC64_HASH_4K);
+
+  engine_init(&e);
+  evidence_add(&e.ev, &hs);
+  struct observation p64 = mk_scalar(SF_PAGE_SIZE, 65536, CONF_PARSED);
+  evidence_add(&e.ev, &p64);
+  engine_run(&e, rules, 1);
+  assert(e.est[Q_MODULE_BASE].lo == (unsigned long)MODULES_BASE_PPC64_HASH_64K);
+#endif
+}
+
 /* text_pin_from_observation (declared above): a POS_BASE VIRT/KERNEL_TEXT
  * observation pins Q_VIRT_IMAGE_BASE; a POS_BASE PHYS/KERNEL_TEXT observation
  * pins Q_PHYS_IMAGE_BASE. Arch-independent. */
@@ -7912,6 +7965,7 @@ int main(void) {
   RUN(test_module_base_execmem_window);
   RUN(test_module_base_from_text);
   RUN(test_module_base_from_va_bits);
+  RUN(test_module_base_ppc64_vmalloc);
 
   BEGIN_CATEGORY("EFI Loader Code disambiguation");
   RUN(test_efi_loader_kernel_pick_single_aligned);