arch: make the page size an axis, so a PFN is never converted with a guess

A page-frame number counts the pages of the kernel that published it. Two
sites converted one to a byte address by multiplying by api.h's
compile-time PAGE_SIZE, which is 4 KiB. Four of the eight supported
architecture families admit several page sizes — arm64 and loongarch64
4/16/64 KiB, mips 4/8/16/32/64 KiB, powerpc 4/16/64/256 KiB — so on those
the product understates a physical address by up to 64x.

That mattered most in directmap_page_offset_bounds, where the span bounds
PAGE_OFFSET from below at CONF_INFERRED: understating it lifts the bound
above the true base and the guaranteed window stops containing it.
proc_zoneinfo emitted RAM bounds from the same conversion at CONF_PARSED.

Declare PAGE_SIZE_MIN / PAGE_SIZE_MAX per architecture, each citing the
HAVE_PAGE_SIZE_* selectors its answer comes from, and derive
PAGE_SIZE_KNOWN_AT_BUILD from the pair the way PAGE_OFFSET_KNOWN_AT_BUILD
is derived. pfn_to_phys() exists only under it, with the same
self-enforcing #error the directmap projection carries, so a conversion
that needs the target's runtime size cannot reach a constant instead — it
does not compile. Where the size is not knowable the multiplier comes from
the observed SF_PAGE_SIZE, the bound inherits its confidence, and absent
both the rule emits nothing: declining costs a bound, guessing costs the
guarantee.

page_size gains live:1. sysconf answers for the kernel executing the
process, so replaying an arm64 capture on an x86_64 host would otherwise
have reported the host's 4 KiB as the target's page size — the same wrong
answer by a different route.

Rename PAGE_SIZE to KASLD_LAYOUT_GRANULE. It is the granule kernel layout
arithmetic is written in, not a machine property, and the old name is one
the C library also defines: musl declares PAGE_SIZE under _GNU_SOURCE on
the targets whose ABI fixes one, so including <limits.h> anywhere near
api.h redefined it. A macro named for a machine property also invites
exactly the substitution above, which is how both sites came to be written.
Kernel-source citations keep spelling it PAGE_SIZE, since they quote the
kernel.

The module band's slot pitch still uses the granule. A pitch smaller than
the target's page overstates the slot count and so the residual entropy,
which is documented as an upper bound on what KASLR retains — the
conservative direction. Correcting it moves published figures on four
architecture families and belongs with a regenerated matrix.

Author: bcoles

CONTRIBUTING.md

@@ -690,7 +690,7 @@ and [Cross-region derivation](docs/architecture.md#cross-region-derivation).
 A new architecture is one header under `src/include/kasld/arch/`. It answers a
 fixed set of questions about how that architecture lays memory out, and `api.h`
 refuses to compile a header that leaves any of the mandatory ones unanswered —
-the seven listed under [Mandatory axes](#api-reference) below. Nothing here is
+the eight listed under [Mandatory axes](#api-reference) below. Nothing here is
 inferred from a neighbouring header: an answer copied from the closest-looking
 architecture is the failure this section exists to prevent.
 
@@ -725,6 +725,19 @@ typical distro ships. Equal values mean the analysing binary knows the target's
 base, which is what gates the compile-time projection macros; a bracket that is
 too narrow excludes a legitimate kernel from its own window.
 
+**`PAGE_SIZE_MIN` / `PAGE_SIZE_MAX`** — the bracket containing every page size
+the architecture admits, taken from the `HAVE_PAGE_SIZE_*` selectors in the
+kernel's own `arch/<arch>/Kconfig` rather than from what a distro ships. Six of
+the twelve supported architectures fix one size and six do not: arm64,
+loongarch64 and mips reach 64 KiB, and 32-bit powerpc reaches 256 KiB. Equal
+values mean the analysing binary knows the target's page size, which is what
+gates `pfn_to_phys()` — a page-frame number counts the *target* kernel's pages,
+so converting one to a byte address with this build's constant is wrong by up to
+64x where the two differ. Where they differ the multiplier must come from the
+`SF_PAGE_SIZE` observation, and a rule with neither declines rather than
+guessing: the quantities built on such a span are bounds, and an understated
+span moves a bound past the truth it is supposed to contain.
+
 **`LINEAR_MAP_ANCHOR`** — where the physical address the kernel maps at
 `PAGE_OFFSET` comes from, since a rule pairing a direct-map virtual with a
 physical reconstructs the base as `virt - phys + anchor`. `LM_ANCHOR_PHYS_OFFSET`
@@ -854,6 +867,7 @@ separate question: a permissive answer to one does not license the others.
 | Symbol | Values | Answers |
 |---|---|---|
 | `PAGE_OFFSET_MIN` / `PAGE_OFFSET_MAX` | literal addresses | Which linear-map bases the architecture admits — equal values mean this build knows the target's base |
+| `PAGE_SIZE_MIN` / `PAGE_SIZE_MAX` | literal sizes | Which page sizes the architecture admits — equal values mean this build knows the target's page size, and only then may a page-frame number be converted with a constant |
 | `LINEAR_MAP_ANCHOR` | `LM_ANCHOR_PHYS_OFFSET` / `LM_ANCHOR_DRAM_BASE` / `LM_ANCHOR_UNKNOWABLE` | Where the physical address that maps to `PAGE_OFFSET` comes from |
 | `MODULES_ANCHOR` | `MOD_ANCHOR_FIXED` / `MOD_ANCHOR_PAGE_OFFSET` / `MOD_ANCHOR_TEXT` / `MOD_ANCHOR_BRACKETS_TEXT` | What the module band's position is fixed to |
 | `TEXT_TRACKS_DIRECTMAP` | 0 / 1 | Whether kernel text slides with the linear map |

src/components/dmesg_backtrace.c

@@ -315,7 +315,8 @@ static void on_line(char *line, void *vctx) {
     const char *p = cr3 + 4;
     unsigned long v;
     if (next_addr_token(&p, &v) && v) {
-      v &= ~(unsigned long)(PAGE_SIZE - 1); /* strip PCID/ASID low bits */
+      v &= ~(unsigned long)(KASLD_LAYOUT_GRANULE -
+                            1); /* strip PCID/ASID low bits */
       if (!c->cr3 || v < c->cr3) {
         c->cr3 = v;
         c->cr3_swapper = c->ctx_known ? c->ctx_swapper : 0;

src/components/dmesg_last_pfn.c

@@ -10,14 +10,15 @@
 // The second is the ceiling below 4 GiB (e820__end_of_low_ram_pfn).
 // Both are always printed on x86 / x86_64.
 //
-// Multiplying last_pfn by PAGE_SIZE (0x1000) gives the physical end of RAM:
+// Multiplying last_pfn by KASLD_LAYOUT_GRANULE (0x1000) gives the physical end
+// of RAM:
 //   0x340000 * 0x1000 = 0x340000000 (~13 GiB)
 //
 // Leak primitive:
 //   Data leaked:      physical RAM ceiling (last page frame number)
 //   Kernel subsystem: arch/x86/kernel/e820 — e820__end_of_ram_pfn()
 //   Data structure:   last_pfn, max_arch_pfn (page frame numbers)
-//   Address type:     physical (DRAM, as PFN × PAGE_SIZE)
+//   Address type:     physical (DRAM, as PFN × 4 KiB)
 //   Method:           parsed (dmesg string)
 //   Status:           unfixed (printed unconditionally during boot)
 //   Access check:     do_syslog() → check_syslog_permissions(); gated by
@@ -56,7 +57,7 @@
 KASLD_EXPLAIN(
     "Searches dmesg for x86 last_pfn and max_arch_pfn values from "
     "e820__end_of_ram_pfn(). Multiplying the page frame number by "
-    "PAGE_SIZE (4096) gives the physical RAM ceiling. x86 only. Access "
+    "the 4 KiB page size gives the physical RAM ceiling. x86 only. Access "
     "is gated by dmesg_restrict.");
 
 KASLD_META("method:parsed\n"
@@ -82,9 +83,11 @@ static int on_match(const char *line, void *ctx) {
     return 1;
 
   /* last_pfn is the first invalid PFN (one past the end of RAM); subtract 1 for
-   * the last valid byte. Compute in 64-bit: on i386 (PAE) pfn * PAGE_SIZE can
+   * the last valid byte. Compute in 64-bit: on i386 (PAE) pfn * the granule
+   * can
    * exceed 32 bits. */
-  unsigned long long last_byte = pfn * (unsigned long long)PAGE_SIZE - 1;
+  unsigned long long last_byte =
+      pfn * (unsigned long long)KASLD_LAYOUT_GRANULE - 1;
 
   match_count++;
   /* The kernel prints two "last_pfn = ..." lines at boot:

src/components/kernelsnitch.c

@@ -61,6 +61,11 @@
 #error "Architecture is not supported"
 #endif
 
+/* The comments below describe the kernel's futex and slab arithmetic in the
+ * kernel's own terms, where the unit is PAGE_SIZE. The code spells that unit
+ * KASLD_LAYOUT_GRANULE, and the two are the same number here: x86_64 admits
+ * one page size, 4 KiB, which is why this component is gated to it above. */
+
 #define _GNU_SOURCE
 #include "include/kasld/api.h"
 #include "include/kasld/cli.h"
@@ -230,8 +235,8 @@ static inline uint32_t jhash2_4(const uint32_t *k, uint32_t initval) {
 static inline uint32_t futex_bucket(unsigned long mm, unsigned long uaddr,
                                     unsigned int hashsize) {
   uint32_t k[4];
-  unsigned long page_addr = uaddr & ~(PAGE_SIZE - 1);
-  unsigned int offset = (unsigned int)(uaddr & (PAGE_SIZE - 1));
+  unsigned long page_addr = uaddr & ~(KASLD_LAYOUT_GRANULE - 1);
+  unsigned int offset = (unsigned int)(uaddr & (KASLD_LAYOUT_GRANULE - 1));
   k[0] = (uint32_t)(mm & 0xffffffff);
   k[1] = (uint32_t)((uint64_t)mm >> 32);
   k[2] = (uint32_t)(page_addr & 0xffffffff);
@@ -415,7 +420,7 @@ static int find_collisions(unsigned long *collisions, int *num_collisions,
   unsigned long num_probes = (unsigned long)hashsize * MAX_COLLISIONS * 4;
   if (num_probes < 65536)
     num_probes = 65536;
-  unsigned long max_probes = FUTEX_REGION_SZ / PAGE_SIZE;
+  unsigned long max_probes = FUTEX_REGION_SZ / KASLD_LAYOUT_GRANULE;
   if (num_probes > max_probes)
     num_probes = max_probes;
 
@@ -434,9 +439,9 @@ static int find_collisions(unsigned long *collisions, int *num_collisions,
   uint64_t confirm_threshold = baseline * COLLISION_MULT;
 
   unsigned long stride = FUTEX_REGION_SZ / num_probes;
-  stride = (stride + PAGE_SIZE - 1) & ~(PAGE_SIZE - 1);
-  if (stride < PAGE_SIZE)
-    stride = PAGE_SIZE;
+  stride = (stride + KASLD_LAYOUT_GRANULE - 1) & ~(KASLD_LAYOUT_GRANULE - 1);
+  if (stride < KASLD_LAYOUT_GRANULE)
+    stride = KASLD_LAYOUT_GRANULE;
 
   fprintf(stderr,
           "[.] probe: baseline=%lu cycles, num_probes=%lu, "
@@ -543,15 +548,17 @@ static void *search_fn(void *arg) {
   unsigned long local_count = 0;
 
   /* Precompute loop-invariant hash inputs for pile_addr. */
-  unsigned long p_page = ctx->pile_addr & ~(unsigned long)(PAGE_SIZE - 1);
-  uint32_t p_off = (uint32_t)(ctx->pile_addr & (PAGE_SIZE - 1));
+  unsigned long p_page =
+      ctx->pile_addr & ~(unsigned long)(KASLD_LAYOUT_GRANULE - 1);
+  uint32_t p_off = (uint32_t)(ctx->pile_addr & (KASLD_LAYOUT_GRANULE - 1));
   uint32_t p_plo = (uint32_t)(p_page & 0xffffffffUL);
   uint32_t p_phi = (uint32_t)((uint64_t)p_page >> 32);
   uint32_t p_base = JHASH_INITVAL + 16u + p_off;
 
   /* Precompute loop-invariant hash inputs for collisions[0]. */
-  unsigned long c0_page = ctx->collisions[0] & ~(unsigned long)(PAGE_SIZE - 1);
-  uint32_t c0_off = (uint32_t)(ctx->collisions[0] & (PAGE_SIZE - 1));
+  unsigned long c0_page =
+      ctx->collisions[0] & ~(unsigned long)(KASLD_LAYOUT_GRANULE - 1);
+  uint32_t c0_off = (uint32_t)(ctx->collisions[0] & (KASLD_LAYOUT_GRANULE - 1));
   uint32_t c0_plo = (uint32_t)(c0_page & 0xffffffffUL);
   uint32_t c0_phi = (uint32_t)((uint64_t)c0_page >> 32);
   uint32_t c0_base = JHASH_INITVAL + 16u + c0_off;
@@ -644,7 +651,7 @@ static unsigned long brute_force_mm(unsigned long *collisions,
    * so valid mm offsets (mod PAGE_SIZE) cycle through
    * {k*slab_size mod PAGE_SIZE}. Stepping by gcd(slab_size, PAGE_SIZE)
    * hits every such residue. */
-  unsigned long step = gcd_ul(mm_step, (unsigned long)PAGE_SIZE);
+  unsigned long step = gcd_ul(mm_step, (unsigned long)KASLD_LAYOUT_GRANULE);
   unsigned long mm_start = POB_MIN;
   unsigned long mm_end = POB_MAX + phys_mem;
   unsigned long total_iters = (mm_end - mm_start) / step;

src/components/page_size.c

@@ -5,15 +5,26 @@
 // ---
 // <bcoles@gmail.com>
 #include "include/kasld/api.h"
+#include "include/kasld/cli.h"
 #include <unistd.h>
 
 KASLD_EXPLAIN("Emits the kernel page size (sysconf _SC_PAGESIZE) as a scalar "
               "fact; the arm64 physical-alignment rule consumes it.");
+/* live:1 — sysconf answers for the kernel executing this process. A captured
+ * tree carries no page size, and the analysing host's is not the captured
+ * target's: replaying an arm64 bundle on an x86_64 host would otherwise report
+ * 4 KiB as though it were the target's page size, and the rules that multiply a
+ * page-frame number by it would silently compute the wrong physical address.
+ * Skipped under KASLD_SYSROOT, leaving those rules to decline instead. */
 KASLD_META("method:parsed\n"
            "phase:inference\n"
-           "discloses:facts\n");
+           "discloses:facts\n"
+           "live:1\n");
 
-int main(void) {
+int main(int argc, char *argv[]) {
+  kasld_cli(argc, argv);
+  if (kasld_skip_live_probe("page size"))
+    return 0;
   long p = sysconf(_SC_PAGESIZE);
   if (p > 0)
     kasld_emit_scalar(SF_PAGE_SIZE, (unsigned long)p, CONF_PARSED);

src/components/proc_zoneinfo.c

@@ -77,6 +77,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <unistd.h>
 
 KASLD_EXPLAIN(
     "Reads /proc/zoneinfo to extract the start_pfn and spanned page "
@@ -140,16 +141,52 @@ int main(void) {
     return 0;
   }
 
-  /* Clamp PFNs before the byte conversion: on a 32-bit (PAE) kernel a PFN
-   * above ULONG_MAX / PAGE_SIZE wraps unsigned long and would yield a bogus
-   * too-low RAM bound (and a wrapped direct-map projection below). */
   unsigned long hi_use = hi_end_pfn > hi_pfn ? hi_end_pfn : hi_pfn;
-  if (lo_pfn > ULONG_MAX / PAGE_SIZE)
-    lo_pfn = ULONG_MAX / PAGE_SIZE;
-  if (hi_use > ULONG_MAX / PAGE_SIZE)
-    hi_use = ULONG_MAX / PAGE_SIZE;
-  unsigned long lo = lo_pfn * PAGE_SIZE;
-  unsigned long hi = hi_use * PAGE_SIZE - 1;
+
+  /* A zoneinfo PFN counts the pages of the kernel that published the file, so
+   * the multiplier must be that kernel's page size.
+   *
+   * Where the architecture admits exactly one size that constant is it. Where
+   * it admits several -- arm64, mips, powerpc, loongarch64 -- a compile-time
+   * constant would be wrong by up to 64x, so the size is asked of the running
+   * kernel. That answer describes the running kernel and nothing else: under
+   * KASLD_SYSROOT the file came from a captured tree whose page size nothing
+   * here knows, so the conversion is declined rather than made with the
+   * analysing host's.
+   *
+   * The multiply is written out rather than routed through pfn_to_phys()
+   * because the two want different answers at the top of the range: this site
+   * CLAMPS an out-of-range PFN to keep a bound, where pfn_to_phys() returns 0
+   * and declines. Clamping is what keeps a 32-bit (PAE) kernel's high PFNs
+   * from wrapping unsigned long into a bogus too-low RAM bound. */
+#if PAGE_SIZE_KNOWN_AT_BUILD
+  unsigned long page_size = (unsigned long)PAGE_SIZE_MIN;
+#else
+  unsigned long page_size = 0;
+  if (!kasld_sysroot()) {
+    long p = sysconf(_SC_PAGESIZE);
+    if (p > 0)
+      page_size = (unsigned long)p;
+  }
+  /* Taken as reported, without a plausibility bracket: sysconf answers for the
+   * kernel running this process, which is more authoritative about that
+   * kernel's page size than this build's PAGE_SIZE_MIN / PAGE_SIZE_MAX axis
+   * is. A value outside that bracket would mean the axis is wrong, and
+   * rejecting it here would hide that rather than surface it. The engine rules
+   * that read the same quantity off the wire do check it, because there it has
+   * been through the tagged-line protocol and can be an artefact. */
+  if (!page_size)
+    return kasld_disp_absent("page size unknown for a captured tree on an "
+                             "architecture that admits several; zone PFNs "
+                             "cannot be converted to addresses");
+#endif
+
+  if (lo_pfn > ULONG_MAX / page_size)
+    lo_pfn = ULONG_MAX / page_size;
+  if (hi_use > ULONG_MAX / page_size)
+    hi_use = ULONG_MAX / page_size;
+  unsigned long lo = lo_pfn * page_size;
+  unsigned long hi = hi_use * page_size - 1;
 
   /* lo: the start of the lowest published zone — a sound RAM witness but
    * NOT a floor pin (reserved low memory below the lowest zone is

src/components/qemu_tcg_iret.c

@@ -324,7 +324,7 @@ static uint64_t get_kernel_text_addr_using_qemu_tcg_iret(void) {
   // a fallback stack for the path where iretq pops the landmark frame and
   // jumps to 0x133a000 instead of leaking; this growsdown mapping at
   // 0x1338000 is adjacent to that target.
-  mmap((void *)0x1338000, PAGE_SIZE * 2, PROT_READ | PROT_WRITE,
+  mmap((void *)0x1338000, KASLD_LAYOUT_GRANULE * 2, PROT_READ | PROT_WRITE,
        MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS | MAP_GROWSDOWN | MAP_POPULATE,
        -1, 0);
 

src/include/kasld/api.h

@@ -13,7 +13,25 @@
 #ifndef KASLD_API_H
 #define KASLD_API_H
 
-#define PAGE_SIZE 0x1000ul
+/* The 4 KiB granule the kernel's own layout arithmetic is written in: the unit
+ * behind expressions lifted from kernel source, such as x86_64's module
+ * randomization span of `1024 * PAGE_SIZE`. It is a fixed number that stays 4
+ * KiB whatever the analysed machine runs.
+ *
+ * It is NOT the target's page size, and must never stand in for one. Four of
+ * the eight supported architecture families admit several page sizes -- arm64
+ * and loongarch64 4/16/64 KiB, mips 4/8/16/32/64 KiB, powerpc 4/16/64/256 KiB
+ * -- so on those a page-frame number converted with this constant is wrong by
+ * up to 64x. Where the target's page size is genuinely needed, it comes from
+ * the SF_PAGE_SIZE observation at runtime; pfn_to_phys() below exists only on
+ * the architectures where the two coincide, so a conversion that needs the
+ * runtime value cannot reach this constant by accident.
+ *
+ * Deliberately not spelled PAGE_SIZE: that name belongs to the C library on
+ * some targets (musl defines it under _GNU_SOURCE wherever the ABI fixes a
+ * page size), and a macro named for a machine property invites exactly the
+ * substitution the paragraph above forbids. */
+#define KASLD_LAYOUT_GRANULE 0x1000ul
 #define KB 0x400ul
 #define MB 0x100000ul
 #define GB 0x40000000ul
@@ -383,6 +401,14 @@ __extension__ _Static_assert((unsigned long)KERNEL_PHYS_MAX >
  *
  * Treating them as one flag would silently pick a side on whichever arch
  * arrives first. */
+#ifndef PAGE_SIZE_MIN
+#error                                                                         \
+    "arch header must define PAGE_SIZE_MIN / PAGE_SIZE_MAX (the page sizes the arch admits)"
+#endif
+#ifndef PAGE_SIZE_MAX
+#error                                                                         \
+    "arch header must define PAGE_SIZE_MIN / PAGE_SIZE_MAX (the page sizes the arch admits)"
+#endif
 #ifndef DIRECTMAP_STATIC
 #error "arch header must define DIRECTMAP_STATIC (0 or 1)"
 #endif
@@ -778,6 +804,55 @@ static inline unsigned long kasld__directmap_virt_to_phys(unsigned long v) {
     "the compile-time directmap projection requires PAGE_OFFSET_KNOWN_AT_BUILD"
 #endif
 
+/* =========================================================================
+ * Page-frame number conversion
+ *
+ * 1 iff this architecture admits exactly one page size, so a page-frame number
+ * -- which counts the TARGET kernel's pages -- can be converted to a byte
+ * address with a compile-time constant. Derived from the arch header's pair,
+ * never declared: an arch cannot then claim a page size it does not admit, and
+ * a mistyped axis value fails to compile instead of expanding to 0.
+ *
+ * Where the edges differ the multiplier is not knowable at build time, and the
+ * error is not small: mips and loongarch64 reach 64 KiB and 32-bit powerpc
+ * reaches 256 KiB, so a PFN converted at 4 KiB understates a physical address
+ * by up to 64x. Understating the top of physical memory is precisely how a
+ * bound derived from it lands past truth, which is why this is a gate rather
+ * than a comment.
+ * ========================================================================= */
+#define PAGE_SIZE_KNOWN_AT_BUILD (PAGE_SIZE_MIN == PAGE_SIZE_MAX)
+
+#if PAGE_SIZE_KNOWN_AT_BUILD
+/* pfn_to_phys(pfn): first byte of the frame. phys_to_pfn(p): the frame holding
+ * `p`. Defined ONLY where the page size is single-valued, so a conversion that
+ * needs the target's runtime size cannot silently reach a constant instead:
+ * the call does not compile on the arches where the constant would be wrong.
+ * Callers must #ifdef and take SF_PAGE_SIZE on the other path.
+ *
+ * pfn_to_phys returns 0 on overflow rather than a wrapped address, so a caller
+ * bounding a window from it cannot be handed a small number for a huge frame.
+ */
+static inline unsigned long kasld__pfn_to_phys(unsigned long pfn) {
+  if (pfn > (unsigned long)-1 / (unsigned long)PAGE_SIZE_MIN)
+    return 0;
+  return pfn * (unsigned long)PAGE_SIZE_MIN;
+}
+static inline unsigned long kasld__phys_to_pfn(unsigned long p) {
+  return p / (unsigned long)PAGE_SIZE_MIN;
+}
+#define pfn_to_phys(pfn) kasld__pfn_to_phys((unsigned long)(pfn))
+#define phys_to_pfn(p) kasld__phys_to_pfn((unsigned long)(p))
+#endif
+
+/* Self-enforcing restatement of the gate above, in the same shape as the
+ * directmap projection's. Trivially satisfied as written; widening the
+ * condition to a predicate that does not imply PAGE_SIZE_KNOWN_AT_BUILD breaks
+ * the build on the arches where the multiplier would be a guess, rather than
+ * quietly producing physical addresses computed from the wrong page size. */
+#if defined(pfn_to_phys) && !PAGE_SIZE_KNOWN_AT_BUILD
+#error "pfn_to_phys requires PAGE_SIZE_KNOWN_AT_BUILD"
+#endif
+
 /* The linear-map base where this build genuinely knows it, 0 where it does not.
  *
  * For presentation. A renderer stating an address is asserting it, so it may

src/include/kasld/arch/arm32.h

@@ -30,6 +30,16 @@
 // (arch/arm/Kconfig: VMSPLIT_3G / 3G_OPT / 2G / 1G). arm32 has no 2G_OPT.
 #define PAGE_OFFSET_CANDIDATES                                                 \
   {0xc0000000ul, 0xb0000000ul, 0x80000000ul, 0x40000000ul}
+// Admissible kernel page sizes on this architecture. PAGE_SIZE_KNOWN_AT_BUILD
+// is derived from the pair in api.h and gates pfn_to_phys(); a page-frame
+// number may only be converted with a compile-time constant where the two
+// edges coincide. Where they differ the runtime SF_PAGE_SIZE observation is
+// the only sound multiplier.
+// arm32 fixes the base page at 4 KiB; arch/arm selects
+// HAVE_PAGE_SIZE_4KB and offers no alternative.
+#define PAGE_SIZE_MIN 0x1000ul
+#define PAGE_SIZE_MAX 0x1000ul
+
 #define PAGE_OFFSET_MIN 0x40000000ul
 #define PAGE_OFFSET_MAX 0xc0000000ul