inference: audit fixes for soundness and clean-up

Tighten unsound formulas in meminfo_phys_ceiling (coupled-arch
phys_floor), directmap_page_offset_bounds (anchor lower bound on
observed dram_floor), randomize_memory_page_offset (require
RAM_BASE-tagged witness), and text_cluster_filter (raise CLUSTER_MIN
to 5). Move boot_params_align to LAYOUT_ADJUST. Fix layout_adjust
conflict warning, harden alignment masks against kaslr_align==0,
correct LoongArch behaviour claim and riscv64 image-size docs.

Author: bcoles

src/inference/arm64_memstart_align.c

@@ -26,7 +26,8 @@
 //
 // The minimum DIRECTMAP result V_min therefore provides a tight upper bound:
 //
-//   page_offset_max = min(page_offset_max, round_down(V_min, ARM64_MEMSTART_ALIGN))
+//   page_offset_max = min(page_offset_max, round_down(V_min,
+//   ARM64_MEMSTART_ALIGN))
 //
 // This is strictly tighter than the V_min bound already set by
 // directmap_page_offset_bounds.c whenever the physical address corresponding

src/inference/arm64_phys_kaslr_align.c

@@ -50,7 +50,8 @@ static void arm64_phys_kaslr_align_run(struct kasld_analysis_ctx *ctx) {
 
   /* Derive EFI_KIMG_ALIGN = max(THREAD_ALIGN, SEGMENT_ALIGN=64KiB).
    * 64K pages: THREAD_ALIGN = 2*(1<<16) = 128KiB → EFI_KIMG_ALIGN = 128KiB.
-   * 4K/16K:    THREAD_ALIGN ≤ 32KiB → EFI_KIMG_ALIGN = 64KiB (SEGMENT_ALIGN). */
+   * 4K/16K:    THREAD_ALIGN ≤ 32KiB → EFI_KIMG_ALIGN = 64KiB (SEGMENT_ALIGN).
+   */
   if (pagesize == 65536)
     efi_kimg_align = 131072ul; /* 128 KiB */
   else if (pagesize == 4096 || pagesize == 16384)

src/inference/boot_params_align.c

@@ -33,9 +33,13 @@
 //     The ceiling from init_size is applied after the alignment snap so a
 //     single pass handles both constraints.
 //
-// Phase: PRE_COLLECTION — boot_params is a static file (set at boot); no
-// component results are needed. Reading before components also means the
-// corrected alignment can contribute to kaslr_ceiling's bound via convergence.
+// Phase: LAYOUT_ADJUST — must be LAYOUT_ADJUST (not PRE_COLLECTION) because
+// the plugin writes ctx->layout->kaslr_align and ctx->layout->phys_kaslr_align;
+// per kasld_inference.h, layout is writable only in LAYOUT_ADJUST. Reading
+// boot_params requires no component results, so any phase from LAYOUT_ADJUST
+// onward is correct; LAYOUT_ADJUST is chosen so that subsequent
+// POST_COLLECTION plugins see the corrected alignment via the orchestrator's
+// per-phase refresh of ctx->arch->{kaslr_align, phys_kaslr_align}.
 //
 // Applicable: x86-64 only.
 // ---
@@ -123,7 +127,7 @@ static void boot_params_align_run(struct kasld_analysis_ctx *ctx) {
   if (kernel_alignment > ctx->layout->kaslr_align) {
     if (verbose && !quiet)
       fprintf(stdout,
-              "[infer] boot_params_align: virt_kaslr_align updated"
+              "[infer] virt_kaslr_align tightened by boot_params_align:"
               " %#lx -> %#lx\n",
               ctx->layout->kaslr_align, kernel_alignment);
     ctx->layout->kaslr_align = kernel_alignment;
@@ -132,7 +136,7 @@ static void boot_params_align_run(struct kasld_analysis_ctx *ctx) {
       kernel_alignment > ctx->layout->phys_kaslr_align) {
     if (verbose && !quiet)
       fprintf(stdout,
-              "[infer] boot_params_align: phys_kaslr_align updated"
+              "[infer] phys_kaslr_align tightened by boot_params_align:"
               " %#lx -> %#lx\n",
               ctx->layout->phys_kaslr_align, kernel_alignment);
     ctx->layout->phys_kaslr_align = kernel_alignment;
@@ -205,7 +209,7 @@ static void boot_params_align_run(struct kasld_analysis_ctx *ctx) {
 
 static const struct kasld_inference boot_params_align = {
     .name = "boot_params_align",
-    .phase = KASLD_INFER_PHASE_PRE_COLLECTION,
+    .phase = KASLD_INFER_PHASE_LAYOUT_ADJUST,
     .run = boot_params_align_run,
 };
 

src/inference/directmap_page_offset_bounds.c

@@ -101,41 +101,81 @@ static void directmap_page_offset_bounds_run(struct kasld_analysis_ctx *ctx) {
     ctx->page_offset_max = vdmap_min;
   }
 
-  /* Lower bound: PAGE_OFFSET > V_min - MemTotal.
-   * Only sound when all physical RAM lies within [PHYS_OFFSET,
-   * PHYS_OFFSET + MemTotal). On NUMA systems with memory holes the highest
-   * DRAM address can exceed this range: a directmap leak from a high-address
-   * node would then give V_min > PAGE_OFFSET + MemTotal, making the lower
-   * bound unsound. Detect this by scanning PHYS/DRAM results and skip. */
+  /* Lower bound: PAGE_OFFSET > V_min - phys_span,
+   * where phys_span is the highest physical address mapped in the directmap.
+   *
+   * Anchored at PHYS_OFFSET, phys_span = (P_floor - phys_offset) + mem_bytes.
+   * On systems where the firmware reports DRAM starting at phys_offset,
+   * P_floor == phys_offset and phys_span == mem_bytes. On systems with a
+   * low-memory hole — e.g. arm64/MIPS boards where PHYS_OFFSET=0 but DRAM
+   * begins at 1 GiB — P_floor > phys_offset and phys_span > mem_bytes. The
+   * earlier formulation `lower = V_min - mem_bytes` (which assumed
+   * P_floor == phys_offset) could push page_offset_min above the true
+   * PAGE_OFFSET when V_min came from a high-physical-address leak.
+   *
+   * To stay sound we use the *observed* DRAM floor from PHYS/DRAM results.
+   * If no PHYS/DRAM evidence exists we cannot bound P_floor and must skip
+   * the lower-bound update.
+   *
+   * On NUMA systems with memory holes the highest physical DRAM address can
+   * exceed P_floor + mem_bytes: detect via PHYS/DRAM scan and skip rather
+   * than risk excluding the true PAGE_OFFSET. */
   unsigned long mem_bytes = read_memtotal_bytes();
   if (mem_bytes == 0)
     return;
 
-  if (ctx->arch->phys_offset <= ULONG_MAX - mem_bytes) {
-    unsigned long phys_limit = ctx->arch->phys_offset + mem_bytes;
-    for (size_t i = 0; i < ctx->result_count; i++) {
-      const struct result *r = &ctx->results[i];
-      if (!r->valid)
-        continue;
-      if (r->type == KASLD_ADDR_PHYS &&
-          strcmp(r->section, KASLD_SECTION_DRAM) == 0 && r->raw >= phys_limit)
-        return; /* NUMA hole detected; lower bound would be unsound */
-    }
+  unsigned long phys_floor = ULONG_MAX;
+  for (size_t i = 0; i < ctx->result_count; i++) {
+    const struct result *r = &ctx->results[i];
+    if (!r->valid)
+      continue;
+    if (r->type != KASLD_ADDR_PHYS)
+      continue;
+    if (strcmp(r->section, KASLD_SECTION_DRAM) != 0)
+      continue;
+    if (r->raw < phys_floor)
+      phys_floor = r->raw;
+  }
+
+  if (phys_floor == ULONG_MAX)
+    return; /* No PHYS/DRAM witness — cannot bound P_floor soundly. */
+
+  if (phys_floor < ctx->arch->phys_offset)
+    return; /* Inconsistent: a leak below PHYS_OFFSET indicates misclassified
+             * results. Skip rather than produce a wrong bound. */
+
+  unsigned long phys_floor_offset = phys_floor - ctx->arch->phys_offset;
+
+  if (phys_floor_offset > ULONG_MAX - mem_bytes)
+    return; /* Overflow guard. */
+
+  unsigned long phys_span = phys_floor_offset + mem_bytes;
+
+  /* NUMA-hole guard: any PHYS/DRAM result above phys_floor + mem_bytes
+   * indicates a hole that exceeds our phys_span estimate. Skip in that case. */
+  unsigned long phys_limit = phys_floor + mem_bytes;
+  for (size_t i = 0; i < ctx->result_count; i++) {
+    const struct result *r = &ctx->results[i];
+    if (!r->valid)
+      continue;
+    if (r->type == KASLD_ADDR_PHYS &&
+        strcmp(r->section, KASLD_SECTION_DRAM) == 0 && r->raw >= phys_limit)
+      return;
   }
 
-  /* Guard against unsigned underflow when MemTotal > V_min. */
-  if (vdmap_min < mem_bytes)
+  /* Guard against unsigned underflow when phys_span > V_min. */
+  if (vdmap_min < phys_span)
     return;
 
-  unsigned long lower = vdmap_min - mem_bytes;
+  unsigned long lower = vdmap_min - phys_span;
 
   if (lower > ctx->page_offset_min && lower < ctx->page_offset_max) {
     if (verbose && !quiet)
       fprintf(stdout,
               "[infer] virt_page_offset_min tightened by"
               " directmap_page_offset_bounds: %#lx -> %#lx"
-              " (MemTotal=%lu bytes)\n",
-              ctx->page_offset_min, lower, mem_bytes);
+              " (phys_floor=%#lx phys_span=%#lx)\n",
+              ctx->page_offset_min, lower, phys_floor, phys_span);
     ctx->page_offset_min = lower;
   }
 }

src/inference/dram_bound.c

@@ -89,10 +89,12 @@ static void dram_bound_run(struct kasld_analysis_ctx *ctx) {
     if (pdram_lo < phys_offset)
       return;
 
-    /* Align down to the nearest slot boundary to stay conservative. */
-    unsigned long virt_lo =
-        (pdram_lo - phys_offset + page_offset + text_offset) &
-        ~(kaslr_align - 1);
+    /* Align down to the nearest slot boundary to stay conservative. Skip the
+     * mask when kaslr_align is zero (KASLR-disabled config) — masking with
+     * ~(0 - 1) == 0 would zero the address. */
+    unsigned long virt_lo = pdram_lo - phys_offset + page_offset + text_offset;
+    if (kaslr_align > 0)
+      virt_lo &= ~(kaslr_align - 1);
 
     if (virt_lo > kaslr_min && virt_lo > ctx->text_base_min &&
         virt_lo < ctx->text_base_max) {

src/inference/dram_ceiling.c

@@ -138,8 +138,9 @@ static void dram_ceiling_run(struct kasld_analysis_ctx *ctx) {
    * that fits entirely within RAM; rounding down keeps the bound sound. */
   unsigned long phys_ceiling = dram_top - kernel_size;
   unsigned long virt_ceiling =
-      (phys_ceiling - phys_offset + page_offset + text_offset) &
-      ~(kaslr_align - 1);
+      phys_ceiling - phys_offset + page_offset + text_offset;
+  if (kaslr_align > 0)
+    virt_ceiling &= ~(kaslr_align - 1);
 
   if (virt_ceiling > kaslr_min && virt_ceiling < ctx->text_base_max) {
     if (verbose && !quiet)

src/inference/layout_adjust.c

@@ -79,23 +79,28 @@ static void layout_adjust_run(struct kasld_analysis_ctx *ctx) {
       po_vals[po_n++] = r->aligned;
   }
 
+  /* 2. Apply consensus PAGE_OFFSET when it differs from compile-time default.
+   *    adjust_for_page_offset() shifts all dependent layout fields atomically.
+   *    Compute first so the conflict warning below can report the value
+   *    actually being applied rather than a separately-derived "min of first
+   *    two values" approximation. */
+  unsigned long detected_po =
+      group_consensus(KASLD_ADDR_VIRT, KASLD_SECTION_PAGEOFFSET);
+
   if (po_n > 1 && !po_conflict_warned) {
     po_conflict_warned = 1;
     if (!quiet) {
       fprintf(stdout, "[infer] layout_adjust: conflicting PAGE_OFFSET sources"
                       " (possible legacy kernel layout):");
       for (int i = 0; i < po_n; i++)
         fprintf(stdout, " 0x%016lx", po_vals[i]);
-      fprintf(stdout, "; using 0x%016lx (modern layout assumed)\n",
-              po_vals[0] < po_vals[1] ? po_vals[0] : po_vals[1]);
+      if (detected_po)
+        fprintf(stdout, "; using 0x%016lx (group_consensus)\n", detected_po);
+      else
+        fprintf(stdout, "; no consensus, retaining compile-time default\n");
     }
   }
 
-  /* 2. Apply consensus PAGE_OFFSET when it differs from compile-time default.
-   *    adjust_for_page_offset() shifts all dependent layout fields atomically.
-   */
-  unsigned long detected_po =
-      group_consensus(KASLD_ADDR_VIRT, KASLD_SECTION_PAGEOFFSET);
   if (detected_po && detected_po != ctx->layout->page_offset)
     adjust_for_page_offset(detected_po);
 

src/inference/meminfo_phys_ceiling.c

@@ -113,14 +113,25 @@ static void meminfo_phys_ceiling_run(struct kasld_analysis_ctx *ctx) {
       ctx->phys_base_max = ceiling;
     }
   } else {
-    /* Coupled: phys_to_virt(ceiling) = page_offset + (ceiling - phys_offset)
-     *        = page_offset + mem_bytes - MIN_IMAGE_SIZE.
-     * text_base = phys_to_virt(phys_base) + TEXT_OFFSET, so add text_offset.
+    /* Coupled: phys_to_virt(P) = page_offset + (P - phys_offset). The phys
+     * ceiling is phys_floor + mem_bytes - MIN_IMAGE_SIZE, where phys_floor
+     * is the *observed* DRAM start (which may be ≥ arch->phys_offset on
+     * systems with a low-memory hole, e.g. arm/MIPS boards where DRAM
+     * begins at 0x40000000 but PHYS_OFFSET=0). So:
+     *   virt_ceiling = page_offset + (phys_floor - phys_offset) + mem_bytes
+     *                  - MIN_IMAGE_SIZE + text_offset.
+     * Using only `mem_bytes - MIN_IMAGE_SIZE` (the previous formulation,
+     * which assumed phys_floor == phys_offset) understated the ceiling on
+     * such systems and could exclude the true text base.
      * Use the runtime page_offset from layout (set by layout_adjust). */
     unsigned long page_offset = ctx->layout->page_offset;
     unsigned long text_offset = ctx->arch->text_offset;
-    unsigned long virt_ceiling =
-        page_offset + mem_bytes - MIN_IMAGE_SIZE + text_offset;
+    unsigned long phys_offset = ctx->arch->phys_offset;
+    unsigned long phys_floor = dram_floor(ctx, phys_offset);
+    unsigned long phys_floor_offset =
+        (phys_floor > phys_offset) ? (phys_floor - phys_offset) : 0;
+    unsigned long virt_ceiling = page_offset + phys_floor_offset + mem_bytes -
+                                 MIN_IMAGE_SIZE + text_offset;
 
     unsigned long kaslr_min = ctx->arch->kaslr_base_min;
     unsigned long kaslr_align = ctx->arch->kaslr_align;

src/inference/min_offset_from_image_size.c

@@ -3,12 +3,15 @@
 // Inference plugin: forbidden lower slots from kernel image size
 // (POST_COLLECTION)
 //
-// Both MIPS and LoongArch enforce a minimum KASLR offset:
+// Both MIPS and LoongArch enforce a minimum KASLR offset using identical
+// arithmetic in their respective `relocate_kernel.c`:
 //
 //   offset &= (CONFIG_RANDOMIZE_BASE_MAX_OFFSET - 1);
 //   if (offset < kernel_length)
-//       offset += ALIGN(kernel_length, KERNEL_ALIGN);   // MIPS
-//       // or, on LoongArch: offset = ALIGN(kernel_length, KERNEL_ALIGN)
+//       offset += ALIGN(kernel_length, KERNEL_ALIGN);
+//
+// (Verified against arch/mips/kernel/relocate.c and
+//  arch/loongarch/kernel/relocate.c on Linux 6.17.)
 //
 // Any randomly-drawn offset in [0, kernel_length) is bumped upward. The
 // range [0, kernel_length) is a forbidden zone: no valid text base falls
@@ -23,22 +26,19 @@
 // sound: the kernel cannot load within the forbidden zone, and the zone
 // extends at least gap bytes from KASLR_BASE_MIN.
 //
-// LoongArch extension:
+// LoongArch diagnostic:
 //   When kernel_length ≥ CONFIG_RANDOMIZE_BASE_MAX_OFFSET, every offset
-//   drawn from [0, max_offset) satisfies offset < kernel_length, so the
-//   bump always fires. On LoongArch the bump is an assignment (not an
-//   addition), making the result a single fixed value:
-//
-//     text_base = KASLR_BASE_MIN + ALIGN(kernel_length, KERNEL_ALIGN)
-//
-//   When kernel_length_estimate ≥ max_offset this plugin emits a verbose
-//   diagnostic. A bilateral pin is not applied: the gap is a lower bound
-//   (gap ≤ true kernel_length), so ALIGN(gap) ≤ ALIGN(true_kernel_length),
-//   and setting text_base_max = KASLR_BASE_MIN + ALIGN(gap) could exclude
-//   the true text base if gap underestimates by more than one KERNEL_ALIGN
-//   step. Implementing the bilateral pin soundly requires exact kernel_length
-//   (e.g. from /boot/Image header — see riscv64_fdt_kaslr_seed inference for
-//   the Image-header approach; a LoongArch variant is a future enhancement).
+//   drawn from [0, max_offset) satisfies `offset < kernel_length`, so the
+//   bump always fires. The post-bump offset lands in
+//   [ALIGN(kernel_length, KERNEL_ALIGN),
+//    max_offset + ALIGN(kernel_length, KERNEL_ALIGN)) — *not* a single
+//   deterministic value. We emit a verbose diagnostic noting that the
+//   randomization range has been shifted into a higher window. No further
+//   bound tightening is applied because the gap is only a lower bound on
+//   kernel_length; soundly pinning text_base_max requires the exact
+//   kernel_length (e.g. from /boot/Image header — see
+//   riscv64_fdt_kaslr_seed for the Image-header approach; a LoongArch
+//   variant is a future enhancement).
 //
 // Note: config_max_offset_bound (PRE_COLLECTION) sets
 //   text_base_max = KASLR_BASE_MIN + max_offset.
@@ -162,10 +162,12 @@ static void min_offset_from_image_size_run(struct kasld_analysis_ctx *ctx) {
   }
 
 #if defined(__loongarch__)
-  /* LoongArch extension: when kernel_length >= max_offset the bump always
-   * fires (assignment semantics), making KASLR deterministic. Log this
-   * condition for awareness; a bilateral pin is not applied because gap is
-   * a lower bound on the true kernel_length (see file header). */
+  /* LoongArch diagnostic: when kernel_length >= max_offset, every random
+   * draw triggers the bump branch, shifting the slot window from
+   * [0, max_offset) to [ALIGN(kernel_length), max_offset +
+   * ALIGN(kernel_length)). The kernel is still randomized within this shifted
+   * window — not a single deterministic point. Log for awareness; no bound pin
+   * (see file header for why). */
   struct utsname uts;
   if (uname(&uts) == 0) {
     FILE *fp = open_boot_config(uts.release);
@@ -179,13 +181,11 @@ static void min_offset_from_image_size_run(struct kasld_analysis_ctx *ctx) {
                             : gap;
 
         if (verbose && !quiet)
-          fprintf(
-              stdout,
-              "[infer] min_offset_from_image_size: LoongArch KASLR"
-              " deterministic (kernel_length_estimate=%#lx >= max_offset=%#lx);"
-              " deterministic virt_text_base >= %#lx;"
-              " bilateral pin requires exact kernel_length\n",
-              gap, max_offset, kaslr_min + aligned_gap);
+          fprintf(stdout,
+                  "[infer] min_offset_from_image_size: LoongArch KASLR window"
+                  " shifted (kernel_length_estimate=%#lx >= max_offset=%#lx);"
+                  " virt_text_base >= %#lx; range shifted, not pinned\n",
+                  gap, max_offset, kaslr_min + aligned_gap);
       }
     }
   }

src/inference/module_text_bound.c

@@ -59,6 +59,12 @@ static void module_text_bound_run(struct kasld_analysis_ctx *ctx) {
   unsigned long kaslr_align = ctx->arch->kaslr_align;
   unsigned long kaslr_min = ctx->arch->kaslr_base_min;
 
+  /* Refuse to operate on a zero alignment — every formula below uses
+   * `~(kaslr_align - 1)` which would be 0 (i.e., zero-out the address).
+   * This guards against KASLR-disabled or otherwise-zero arch configs. */
+  if (kaslr_align == 0)
+    return;
+
   /* Find minimum and maximum valid aligned virtual module addresses. */
   unsigned long vmod_lo = ULONG_MAX;
   unsigned long vmod_hi = 0;