Add KASLD_SECTION_BSS / KASLD_REGION_KERNEL_BSS vocabulary

Introduce two new type constants:

  KASLD_SECTION_BSS  "bss"        — kernel .bss virtual addresses
  KASLD_REGION_KERNEL_BSS  "kernel_bss" — physical addresses of .bss-resident symbols

KASLD_SECTION_DATA and KASLD_REGION_KERNEL_DATA now exclusively cover
.data/.rodata; .bss is no longer included in their definition.

Components:
- dmesg_backtrace: re-tag CR3 results KERNEL_IMAGE → KERNEL_BSS.
  swapper_pg_dir lives in .bss; correct tagging lets inference plugins
  apply the BSS-resident gap refinement without a hardcoded name list.
- dmesg_mem_init_kernel_layout: add ".bss  : 0x" entry. ARM and x86_32
  kernels print a .bss line in the same mem_init() layout block that the
  plugin already parses; it was previously silently skipped.

Inference:
- image_size_from_text_data_gap: include KASLD_SECTION_BSS in the
  max_data high-water mark. BSS addresses are inside the kernel image,
  so they give a valid (tighter) lower bound on image size.
- min_offset_from_image_size (MIPS/LoongArch): same — gap used as image
  size lower bound, so BSS inclusion is sound.
- riscv64_fdt_kaslr_seed: same — gap used as image size lower bound for
  nr_pos_max computation.

All three gap-using plugins that include BSS are distinct from
kernel_image_phys_bound.c's compute_virt_gap(), which must remain
DATA-only because it bounds data_end_offset rather than image size.

Render: add KASLD_SECTION_BSS and KASLD_REGION_KERNEL_BSS to all
display-name functions and section_order[] arrays.

Author: bcoles

src/components/dmesg_backtrace.c

@@ -213,15 +213,16 @@ int main(void) {
 
   if (ctx.phys) {
     printf("leaked physical address (CR3): %lx\n", ctx.phys);
-    /* CR3 is the page table base — physically the kernel image's
-     * top-level pgd resides at this address (modulo PCID bits). */
+    /* CR3 is the physical address of swapper_pg_dir, which lives in the
+     * kernel .bss section. Tagged KERNEL_BSS so inference plugins can
+     * apply the BSS-resident gap refinement without an allow-list. */
     kasld_result(KASLD_ADDR_PHYS, KASLD_SECTION_DRAM, ctx.phys,
-                 KASLD_REGION_KERNEL_IMAGE, "cr3");
+                 KASLD_REGION_KERNEL_BSS, "cr3");
 #if !PHYS_VIRT_DECOUPLED
     unsigned long virt = phys_to_virt(ctx.phys);
     printf("possible direct-map virtual address: %lx\n", virt);
     kasld_result(KASLD_ADDR_VIRT, KASLD_SECTION_DIRECTMAP, virt,
-                 KASLD_REGION_KERNEL_IMAGE, "cr3");
+                 KASLD_REGION_KERNEL_BSS, "cr3");
 #endif
   }
 

src/components/dmesg_mem_init_kernel_layout.c

@@ -9,6 +9,7 @@
 // Sections extracted:
 //   .text    -> V text      (kernel text virtual address)
 //   .data    -> V data      (kernel data virtual address)
+//   .bss     -> V bss       (kernel BSS virtual address; ARM and x86_32 only)
 //   lowmem   -> V directmap (lowmem / direct-mapped region, x86_32/arm)
 //   modules  -> V module    (kernel module region, arm/arm64)
 //   memory   -> V directmap (linear memory map, arm64)
@@ -93,9 +94,9 @@
 KASLD_EXPLAIN(
     "Parses the kernel virtual memory layout block printed by mem_init() "
     "during boot. This block shows virtual address ranges for .text, "
-    ".data, lowmem, modules, and other sections. Removed from most "
-    "architectures: ARM64 v4.16, ARM v5.1, x86_32 v5.7. Access is "
-    "gated by dmesg_restrict.");
+    ".data, .bss (ARM and x86_32), lowmem, modules, and other sections. "
+    "Removed from most architectures: ARM64 v4.16, ARM v5.1, x86_32 v5.7. "
+    "Access is gated by dmesg_restrict.");
 
 KASLD_META("method:parsed\n"
            "phase:inference\n"
@@ -128,6 +129,8 @@ static const struct layout_entry entries[] = {
      KASLD_REGION_KERNEL_TEXT, KERNEL_BASE_MIN, KERNEL_BASE_MAX},
     {".data : 0x", KASLD_ADDR_VIRT, KASLD_SECTION_DATA, "kernel .data start",
      KASLD_REGION_KERNEL_DATA, KERNEL_VAS_START, KERNEL_VAS_END},
+    {".bss  : 0x", KASLD_ADDR_VIRT, KASLD_SECTION_BSS, "kernel .bss start",
+     KASLD_REGION_KERNEL_BSS, KERNEL_BASE_MIN, KERNEL_BASE_MAX},
     {"lowmem  : 0x", KASLD_ADDR_VIRT, KASLD_SECTION_DIRECTMAP,
      "kernel lowmem start", KASLD_REGION_DIRECTMAP, KERNEL_VAS_START,
      KERNEL_VAS_END},

src/include/kasld.h

@@ -239,7 +239,8 @@
 #define KASLD_SECTION_TEXT "text"
 #define KASLD_SECTION_MODULE "module"
 #define KASLD_SECTION_DIRECTMAP "directmap"
-#define KASLD_SECTION_DATA "data"
+#define KASLD_SECTION_DATA "data" /* kernel .data and .rodata; never .bss */
+#define KASLD_SECTION_BSS "bss"   /* kernel .bss (zero-initialised data) */
 #define KASLD_SECTION_DRAM "dram"
 #define KASLD_SECTION_MMIO "mmio"
 #define KASLD_SECTION_PAGEOFFSET "pageoffset"
@@ -290,7 +291,8 @@
 
 /* Kernel virtual memory regions. */
 #define KASLD_REGION_KERNEL_TEXT "kernel_text" /* kernel .text */
-#define KASLD_REGION_KERNEL_DATA "kernel_data" /* .data / .rodata / .bss */
+#define KASLD_REGION_KERNEL_DATA "kernel_data" /* kernel .data / .rodata */
+#define KASLD_REGION_KERNEL_BSS "kernel_bss"   /* kernel .bss */
 #define KASLD_REGION_MODULE                                                    \
   "module" /* loaded LKM (instance: "module:<name>") */
 #define KASLD_REGION_MODULE_REGION                                             \

src/inference/image_size_from_text_data_gap.c

@@ -4,18 +4,18 @@
 // (POST_COLLECTION)
 //
 // If the collected results contain at least one virtual TEXT address and at
-// least one virtual DATA address, their gap is a lower bound on the kernel
-// image size:
+// least one virtual DATA or BSS address, their gap is a lower bound on the
+// kernel image size:
 //
-//   image_size >= max(DATA results) - min(TEXT results)
+//   image_size >= max(DATA or BSS results) - min(TEXT results)
 //
 // Soundness argument:
 //   Let B = _stext (true kernel text base, unknown).
 //   Any TEXT result T satisfies T >= B (kernel text is above _stext).
-//   Any DATA result D satisfies D <= B + image_size (_end >= D).
-//   Therefore: D - T <= (B + image_size) - B = image_size.
-//   Equivalently: image_size >= D - T for any valid (T, D) pair.
-//   Using max(DATA) - min(TEXT) maximises the lower bound from collected data.
+//   Any DATA result D satisfies D <= B + image_size (_edata >= D).
+//   Any BSS result X satisfies X <= B + image_size (_end >= X).
+//   Therefore: max(D or X) - T <= image_size for any valid T.
+//   Using max(DATA or BSS) - min(TEXT) maximises the lower bound.
 //
 // The kernel image must fit within the KASLR randomisation window:
 //   text_base + image_size <= KASLR_BASE_MAX
@@ -30,11 +30,10 @@
 // the identical image size lower bound also tightens phys_base_max.
 //
 // Reliability notes:
-// - TEXT and DATA results are emitted by different components (backtrace,
-//   dmesg_mem_init_kernel_layout, sysfs_iscsi_transport_handle, etc.) and
+// - TEXT, DATA, and BSS results are emitted by different components and
 //   are always from the running kernel image, so they come from the same
 //   single KASLR slot. The gap is always a sound lower bound within one run.
-// - If only TEXT or only DATA results are present, the plugin is a no-op.
+// - If only TEXT or only DATA/BSS results are present, the plugin is a no-op.
 // - Default ('D'-type) results are excluded implicitly: they carry type 'D',
 //   not 'V', so they are skipped by the KASLD_ADDR_VIRT filter.
 //
@@ -65,7 +64,8 @@ static void image_size_from_text_data_gap_run(struct kasld_analysis_ctx *ctx) {
     if (strcmp(r->section, KASLD_SECTION_TEXT) == 0) {
       if (r->raw < min_text)
         min_text = r->raw;
-    } else if (strcmp(r->section, KASLD_SECTION_DATA) == 0) {
+    } else if (strcmp(r->section, KASLD_SECTION_DATA) == 0 ||
+               strcmp(r->section, KASLD_SECTION_BSS) == 0) {
       if (r->raw > max_data)
         max_data = r->raw;
     }

src/inference/min_offset_from_image_size.c

@@ -63,8 +63,13 @@
 
 #if defined(__mips__) || defined(__loongarch__)
 
-/* Compute kernel_length_estimate = max(DATA results) - min(TEXT results).
- * Returns 0 if insufficient results are present or the pair is inconsistent. */
+/* Compute kernel_length_estimate = max(DATA or BSS results) - min(TEXT
+ * results). Returns 0 if insufficient results are present or the pair is
+ * inconsistent. BSS addresses are included because they are inside the image
+ * (BSS is past .rodata), making the estimate tighter. This is valid here
+ * because the gap is used as a lower bound on kernel_length (image size), not
+ * on data_end_offset — the distinction that makes kernel_image_phys_bound.c's
+ * compute_virt_gap() intentionally DATA-only. */
 static unsigned long get_text_data_gap(const struct kasld_analysis_ctx *ctx) {
   unsigned long min_text = ULONG_MAX;
   unsigned long max_data = 0;
@@ -76,7 +81,8 @@ static unsigned long get_text_data_gap(const struct kasld_analysis_ctx *ctx) {
     if (strcmp(r->section, KASLD_SECTION_TEXT) == 0) {
       if (r->raw < min_text)
         min_text = r->raw;
-    } else if (strcmp(r->section, KASLD_SECTION_DATA) == 0) {
+    } else if (strcmp(r->section, KASLD_SECTION_DATA) == 0 ||
+               strcmp(r->section, KASLD_SECTION_BSS) == 0) {
       if (r->raw > max_data)
         max_data = r->raw;
     }

src/inference/riscv64_fdt_kaslr_seed.c

@@ -150,6 +150,12 @@ static unsigned long read_image_size(const char *release) {
 
 /* Returns gap = max(DATA results) - min(TEXT results), a lower bound on
  * kernel_size.  Returns 0 if insufficient results or inconsistent pair. */
+/* Compute image_size_lower_bound = max(DATA or BSS results) - min(TEXT
+ * results). BSS is included because BSS addresses are inside the image; a
+ * larger gap gives a tighter nr_pos_max and fewer valid candidate positions.
+ * This is intentionally DATA+BSS (image size lower bound), unlike
+ * kernel_image_phys_bound.c's compute_virt_gap() which is DATA-only because
+ * it bounds data_end_offset rather than image size. */
 static unsigned long get_text_data_gap(const struct kasld_analysis_ctx *ctx) {
   unsigned long min_text = ULONG_MAX;
   unsigned long max_data = 0;
@@ -161,7 +167,8 @@ static unsigned long get_text_data_gap(const struct kasld_analysis_ctx *ctx) {
     if (strcmp(r->section, KASLD_SECTION_TEXT) == 0) {
       if (r->raw < min_text)
         min_text = r->raw;
-    } else if (strcmp(r->section, KASLD_SECTION_DATA) == 0) {
+    } else if (strcmp(r->section, KASLD_SECTION_DATA) == 0 ||
+               strcmp(r->section, KASLD_SECTION_BSS) == 0) {
       if (r->raw > max_data)
         max_data = r->raw;
     }

src/render.c

@@ -48,6 +48,8 @@ static const char *section_display_name(char type, const char *section) {
     return "Direct map (virtual)";
   if (strcmp(section, KASLD_SECTION_DATA) == 0)
     return "Kernel data (virtual)";
+  if (strcmp(section, KASLD_SECTION_BSS) == 0)
+    return "Kernel BSS (virtual)";
   if (strcmp(section, KASLD_SECTION_DRAM) == 0)
     return "Physical DRAM";
   if (strcmp(section, KASLD_SECTION_MMIO) == 0)
@@ -68,7 +70,8 @@ static int is_kernel_locating_region(const char *region) {
     return 0;
   return strcmp(region, KASLD_REGION_KERNEL_IMAGE) == 0 ||
          strcmp(region, KASLD_REGION_KERNEL_TEXT) == 0 ||
-         strcmp(region, KASLD_REGION_KERNEL_DATA) == 0;
+         strcmp(region, KASLD_REGION_KERNEL_DATA) == 0 ||
+         strcmp(region, KASLD_REGION_KERNEL_BSS) == 0;
 }
 
 /* Display label for a kernel-locating region presented inline as its own
@@ -83,6 +86,8 @@ static const char *kernel_region_display_name(char type, const char *region) {
     return phys ? "Kernel text (physical)" : "Kernel text (virtual)";
   if (strcmp(region, KASLD_REGION_KERNEL_DATA) == 0)
     return phys ? "Kernel data (physical)" : "Kernel data (virtual)";
+  if (strcmp(region, KASLD_REGION_KERNEL_BSS) == 0)
+    return phys ? "Kernel BSS (physical)" : "Kernel BSS (virtual)";
   return NULL;
 }
 
@@ -1651,13 +1656,10 @@ static void render_json(const struct summary *s) {
   printf("\n  },\n");
 
   /* groups — build ordered list of unique (type, section) keys */
-  const char *section_order[] = {KASLD_SECTION_TEXT,
-                                 KASLD_SECTION_MODULE,
-                                 KASLD_SECTION_DIRECTMAP,
-                                 KASLD_SECTION_DATA,
-                                 KASLD_SECTION_DRAM,
-                                 KASLD_SECTION_MMIO,
-                                 NULL};
+  const char *section_order[] = {KASLD_SECTION_TEXT,      KASLD_SECTION_MODULE,
+                                 KASLD_SECTION_DIRECTMAP, KASLD_SECTION_DATA,
+                                 KASLD_SECTION_BSS,       KASLD_SECTION_DRAM,
+                                 KASLD_SECTION_MMIO,      NULL};
   char type_order[] = {KASLD_ADDR_VIRT, KASLD_ADDR_PHYS, 0};
 
   struct group_key gkeys[64];
@@ -1899,13 +1901,10 @@ static void render_text(const struct summary *s) {
   }
 
   /* Print each (type, section) group in a defined order */
-  const char *section_order[] = {KASLD_SECTION_TEXT,
-                                 KASLD_SECTION_MODULE,
-                                 KASLD_SECTION_DIRECTMAP,
-                                 KASLD_SECTION_DATA,
-                                 KASLD_SECTION_DRAM,
-                                 KASLD_SECTION_MMIO,
-                                 NULL};
+  const char *section_order[] = {KASLD_SECTION_TEXT,      KASLD_SECTION_MODULE,
+                                 KASLD_SECTION_DIRECTMAP, KASLD_SECTION_DATA,
+                                 KASLD_SECTION_BSS,       KASLD_SECTION_DRAM,
+                                 KASLD_SECTION_MMIO,      NULL};
   char type_order[] = {KASLD_ADDR_VIRT, KASLD_ADDR_PHYS, 0};
 
   if (verbose) {
@@ -1971,8 +1970,9 @@ static void render_text(const struct summary *s) {
   } else {
     /* Compact: one line per (type, section) for non-kernel-locating
      * regions, plus one line per kernel-locating region (kernel_image,
-     * kernel_text, kernel_data) so direct kernel-base disclosures are not
-     * buried inside a generic "Physical DRAM" / "Physical MMIO" range. */
+     * kernel_text, kernel_data, kernel_bss) so direct kernel-base
+     * disclosures are not buried inside a generic "Physical DRAM" /
+     * "Physical MMIO" range. */
     for (int t = 0; type_order[t]; t++) {
       for (int si = 0; section_order[si]; si++) {
         if (group_already_printed(type_order[t], section_order[si]))
@@ -2173,13 +2173,10 @@ static void render_markdown(const struct summary *s) {
   }
 
   /* Result groups */
-  const char *section_order[] = {KASLD_SECTION_TEXT,
-                                 KASLD_SECTION_MODULE,
-                                 KASLD_SECTION_DIRECTMAP,
-                                 KASLD_SECTION_DATA,
-                                 KASLD_SECTION_DRAM,
-                                 KASLD_SECTION_MMIO,
-                                 NULL};
+  const char *section_order[] = {KASLD_SECTION_TEXT,      KASLD_SECTION_MODULE,
+                                 KASLD_SECTION_DIRECTMAP, KASLD_SECTION_DATA,
+                                 KASLD_SECTION_BSS,       KASLD_SECTION_DRAM,
+                                 KASLD_SECTION_MMIO,      NULL};
   char type_order[] = {KASLD_ADDR_PHYS, KASLD_ADDR_VIRT, 0};
 
   printf("## Leak Results\n\n");