loongarch64: pin the module region base from the hardware VA width

vm_map_base is 0 - (1 << cpu_vabits) and MODULES_VADDR is that plus
PCI_IOSIZE + 2 pages, with nothing randomized in between — so a known width
fixes the base exactly. Until now the quantity fell back to the validation
band: 7e13 candidates for a value that is fully determined.

The width comes from /proc/cpuinfo "Address Sizes ... bits virtual", which
is cpu_vabits + 1 read from CPUCFG1.VALEN — the same field vm_map_base is
computed from. Published unconditionally, unlike the x86_64 branch beside
it which publishes only a width of 48: there a reported 57 is the CPU
capability and the kernel may still run 4-level, so the width does not
state the active layout. LoongArch has no such split.

An mmap boundary probe cannot substitute. TASK_SIZE64 is
1 << min(cpu_vabits, VA_BITS), clamped to the kernel's page-table width,
while vm_map_base uses cpu_vabits unclamped; a 16K/3-level kernel on
cpu_vabits=48 hardware would probe 47 and place the region 128 TiB high.
Recorded in the rule and the component so the asymmetry is not "corrected".

Confirmed on loongarch64-alpine-6.18: the row resolves to a single
candidate, 0xffff000002002000.

Author: bcoles

src/components/proc_cpuinfo.c

@@ -145,6 +145,58 @@ static int detect_riscv_mmu(void) {
 }
 #endif /* riscv64 */
 
+#if defined(__loongarch__) && __loongarch_grlen == 64
+/* loongarch64: "Address Sizes  : N bits physical, M bits virtual" (note the
+ * capitalisation, which differs from x86_64's "address sizes").
+ *
+ * M is cpu_vabits + 1, read from CPUCFG1.VALEN by cpu_probe_addrbits(). This
+ * is the value that determines the whole upper VA layout:
+ *
+ *   vm_map_base   = 0 - (1 << cpu_vabits)
+ *   MODULES_VADDR = vm_map_base + PCI_IOSIZE + 2 * PAGE_SIZE
+ *
+ * Published UNCONDITIONALLY, unlike the x86_64 case below which publishes only
+ * a width of 48. That asymmetry is deliberate and must not be "fixed": on
+ * x86_64 a reported 57 is the CPU *capability* and the kernel may still run
+ * 4-level, so the width there does not state the active layout. LoongArch has
+ * no such split — one CPUCFG field feeds both vm_map_base and this line, so
+ * whatever it reports IS what the kernel used.
+ *
+ * Note also that an mmap boundary probe CANNOT substitute for this read.
+ * TASK_SIZE64 is `1 << min(cpu_vabits, VA_BITS)`, clamped to the kernel's
+ * page-table width, while vm_map_base uses cpu_vabits unclamped. A 16K/3-level
+ * kernel on cpu_vabits=48 hardware has VA_BITS=47, so a probe would under-read
+ * by a bit and place the module region 128 TiB too high. */
+static int detect_loongarch_address_sizes(void) {
+  char buf[256];
+  char *val = cpuinfo_get("Address Sizes", buf, sizeof(buf));
+
+  if (!val) {
+    kasld_err("Could not read Address Sizes from %s", CPUINFO_PATH);
+    return 0;
+  }
+
+  unsigned int phys_bits = 0, virt_bits = 0;
+  if (sscanf(val, "%u bits physical, %u bits virtual", &phys_bits,
+             &virt_bits) != 2) {
+    kasld_err("Could not parse Address Sizes: %s", val);
+    return 0;
+  }
+
+  kasld_info("Address sizes: %u bits physical, %u bits virtual", phys_bits,
+             virt_bits);
+
+  /* Sanity-bound before publishing: a width outside what the architecture can
+   * express is a parse artefact, not a measurement. */
+  if (virt_bits < 32 || virt_bits > 64) {
+    kasld_err("implausible virtual width %u; not emitting", virt_bits);
+    return 0;
+  }
+  kasld_emit_scalar(SF_VIRT_ADDR_BITS, virt_bits, CONF_PARSED);
+  return 1;
+}
+#endif /* loongarch64 */
+
 #if defined(__x86_64__) || defined(__amd64__)
 /* x86_64: "address sizes : N bits physical, M bits virtual"
  * Virtual address width determines paging level:
@@ -234,6 +286,10 @@ int main(void) {
   found |= detect_x86_address_sizes();
 #endif
 
+#if defined(__loongarch__) && __loongarch_grlen == 64
+  found |= detect_loongarch_address_sizes();
+#endif
+
   if (!found) {
     kasld_err("No actionable cpuinfo data found for this architecture.");
     return 0;

src/engine_rules.c

@@ -83,6 +83,7 @@ static const rule_fn k_rules[] = {
     rule_module_base_bounds,
     rule_module_base_execmem_window,
     rule_module_base_from_text,
+    rule_module_base_from_va_bits,
 
     /* Multi-entry EFI_LOADER_CODE → Q_PHYS_IMAGE_BASE pin */
     rule_efi_loader_kernel_pick,

src/include/kasld/arch/loongarch64.h

@@ -79,6 +79,16 @@
 // derived from the widest VA the kernel's page tables can describe, so it sits
 // at or below vm_map_base for every VALEN a running kernel could report.
 #define MODULES_BAND_EXACT 1
+
+// The module region's placement is a pure function of the hardware VA width:
+//   vm_map_base   = 0 - (1 << cpu_vabits)
+//   MODULES_VADDR = vm_map_base + PCI_IOSIZE + 2 * PAGE_SIZE   (PCI_IOSIZE=32M)
+// Nothing randomizes it, so a resolved width pins the quantity exactly rather
+// than bounding it. Declared as an addend so the rule needs no loongarch
+// literals of its own; the width comes from SF_VIRT_ADDR_BITS.
+// https://elixir.bootlin.com/linux/v7.2/source/arch/loongarch/include/asm/pgtable.h#L98
+// https://elixir.bootlin.com/linux/v7.2/source/arch/loongarch/include/asm/addrspace.h#L141
+#define MODULES_BASE_FROM_VA_BITS_ADDEND (0x2000000ul + 2ul * PAGE_SIZE)
 #define MODULES_RELATIVE_TO_TEXT 0
 
 // EFI_KIMG_ALIGN is SZ_2M, but KASLR offset uses << 16 = 64 KiB granularity.

src/include/kasld/engine_rules.h

@@ -323,6 +323,7 @@ R(module_text_bracket);
 R(module_base_bounds);
 R(module_base_execmem_window);
 R(module_base_from_text);
+R(module_base_from_va_bits);
 
 /* Multi-entry EFI_LOADER_CODE → Q_PHYS_IMAGE_BASE pin (arm64/riscv64/x86_64) */
 R(efi_loader_kernel_pick);

src/rules/module_base_from_va_bits.c

@@ -0,0 +1,67 @@
+// This file is part of KASLD - https://github.com/bcoles/kasld
+//
+// Rule: pin Q_MODULE_BASE from a resolved virtual-address width, on arches
+// whose module region is placed by arithmetic on that width alone.
+//
+// Where MODULES_BASE_FROM_VA_BITS_ADDEND is declared, the kernel computes
+//
+//   vm_map_base   = 0 - (1 << va_bits)
+//   MODULES_VADDR = vm_map_base + <addend>
+//
+// with nothing randomized in between, so a known width fixes the base
+// exactly -- an equality, not a window.
+//
+// The width must be the HARDWARE one (loongarch cpu_vabits, published by
+// proc_cpuinfo from "Address Sizes ... bits virtual"). An mmap boundary probe
+// measures TASK_SIZE = 1 << min(cpu_vabits, VA_BITS), clamped to the kernel's
+// page-table width, and feeding that here would place the region too high --
+// by a factor of two per clamped bit. SF_VIRT_ADDR_BITS is the contract that
+// says "the active virtual width", which is what this needs.
+// ---
+// <bcoles@gmail.com>
+
+#include "include/kasld/engine_rules.h"
+#include "include/kasld/regions.h"
+
+#include <string.h>
+
+int rule_module_base_from_va_bits(const struct evidence_set *ev,
+                                  const struct estimate *est,
+                                  struct constraint *out, int out_max) {
+#if defined(MODULES_BASE_FROM_VA_BITS_ADDEND)
+  (void)est;
+  if (out_max < 1)
+    return 0;
+
+  enum kasld_confidence conf = CONF_UNKNOWN;
+  uint32_t src = 0;
+  unsigned long bits =
+      kasld_scalar_fact_value(ev, SF_VIRT_ADDR_BITS, &conf, &src);
+  /* A width outside the addressable range would shift by an undefined amount;
+   * treat it as no evidence rather than compute on it. */
+  if (!bits || bits >= (sizeof(unsigned long) * 8))
+    return 0;
+
+  unsigned long base =
+      (0ul - (1ul << bits)) + (unsigned long)MODULES_BASE_FROM_VA_BITS_ADDEND;
+
+  struct constraint *c = &out[0];
+  memset(c, 0, sizeof(*c));
+  c->q = Q_MODULE_BASE;
+  c->op = C_EQUALS;
+  c->value = base;
+  c->conf = conf;
+  if (src) {
+    c->derived_from[0] = src;
+    c->lineage_count = 1;
+  }
+  snprintf(c->origin, ORIGIN_LEN, "module_base_from_va_bits");
+  return 1;
+#else
+  (void)ev;
+  (void)est;
+  (void)out;
+  (void)out_max;
+  return 0;
+#endif
+}

tests/test_engine.c

@@ -7140,6 +7140,30 @@ static void test_module_base_from_text(void) {
 #endif
 }
 
+/* Where the module region is placed by arithmetic on the VA width alone, a
+ * resolved width pins the quantity outright. The width must be the hardware
+ * one: an mmap probe measures TASK_SIZE = 1 << min(cpu_vabits, VA_BITS), and
+ * feeding a clamped width here would place the region a factor of two too high
+ * per clamped bit. */
+static void test_module_base_from_va_bits(void) {
+  struct engine e;
+  engine_init(&e);
+  const rule_fn rules[] = {rule_module_base_from_va_bits};
+  struct observation vb = mk_scalar(SF_VIRT_ADDR_BITS, 48, CONF_PARSED);
+  evidence_add(&e.ev, &vb);
+  engine_run(&e, rules, 1);
+#if defined(MODULES_BASE_FROM_VA_BITS_ADDEND)
+  unsigned long want =
+      (0ul - (1ul << 48)) + (unsigned long)MODULES_BASE_FROM_VA_BITS_ADDEND;
+  assert(e.est[Q_MODULE_BASE].lo == want && e.est[Q_MODULE_BASE].hi == want);
+#else
+  struct estimate top;
+  quantities[Q_MODULE_BASE].init_top(&top);
+  assert(e.est[Q_MODULE_BASE].lo == top.lo &&
+         e.est[Q_MODULE_BASE].hi == top.hi);
+#endif
+}
+
 /* text_pin_from_observation (declared above): a POS_BASE VIRT/KERNEL_TEXT
  * observation pins Q_VIRT_IMAGE_BASE; a POS_BASE PHYS/KERNEL_TEXT observation
  * pins Q_PHYS_IMAGE_BASE. Arch-independent. */
@@ -7882,6 +7906,7 @@ int main(void) {
   RUN(test_module_base_band_bounds);
   RUN(test_module_base_execmem_window);
   RUN(test_module_base_from_text);
+  RUN(test_module_base_from_va_bits);
 
   BEGIN_CATEGORY("EFI Loader Code disambiguation");
   RUN(test_efi_loader_kernel_pick_single_aligned);