arch: model the module band where the kernel actually puts it (ppc32, riscv32)

module_base_bounds emits the band edges at CONF_INFERRED, so a band that
does not cover the real module region puts a guaranteed bound on
Q_MODULE_BASE that excludes the truth -- and the region check rejects
every genuine module leak on top of that. Two arches had one.

riscv32 declared the band as the upper VAS, floor at PAGE_OFFSET. The
kernel puts it below: MODULES_VADDR is VMALLOC_START, which is
PAGE_OFFSET - VMALLOC_SIZE, and VMALLOC_SIZE is KERN_VIRT_SIZE >> 1. rv32
is sv32 only, so PGDIR_SHIFT 22 and PTRS_PER_PGD 1024 fix that at 512 MiB
exactly, with no configuration to take a union over. The declared band and
the real one were disjoint.

ppc32 declared the 8xx / book3s32 window, PAGE_OFFSET - 256 MiB upward.
Only those two platforms define MODULES_VADDR; every other one, PPC_85xx
among them -- the only ppc32 platform that randomizes -- allocates from
the shared vmalloc window instead, whose edges are runtime values above
PAGE_OFFSET. Nothing at compile time distinguishes the two kernels, so
the band is now the union of both.

The projection clamped its floor to KERNEL_VIRT_VAS_START, which on both
of these arches IS PAGE_OFFSET -- so a band below it collapsed to a point
the moment PAGE_OFFSET was pinned, discarding what the arch headers had
just been corrected to say. The floor only ever needed protecting against
the wrap a subtracting relation produces on a low split, which is the test
module_base_bounds already applies to the same edges. arm32 is untouched
either way: its VAS floor is the lowest admissible split, not PAGE_OFFSET.

The band test mirrored the clamp rather than asserting the relation, so it
would have agreed with either behaviour. It now asserts the projected
floor is the relation's own value, and fails on ppc32 and riscv32 -- not
arm32 -- if the clamp returns.

Author: bcoles

src/include/kasld/arch/ppc32.h

@@ -39,16 +39,33 @@
 // Above this, addresses fall in the I/O or fixmap region.
 #define KERNEL_VIRT_TEXT_MAX 0xf0000000ul
 
-// Modules are located below kernel: PAGE_OFFSET - 256MiB (0x10000000)
-// https://elixir.bootlin.com/linux/v6.1.1/source/arch/powerpc/include/asm/book3s/32/pgtable.h#L214
-// https://elixir.bootlin.com/linux/v6.1.1/source/arch/powerpc/include/asm/nohash/32/mmu-8xx.h#L173
-// Stated as a relation to PAGE_OFFSET rather than as fixed addresses, so the
-// band cannot drift from the definition it instantiates. ppc32 is
-// PAGE_OFFSET_INVARIANT, so the re-derivation the flag enables is a no-op here
-// -- it declares the relation, it does not predict movement.
+// ppc32 places modules in one of two entirely different regions, decided by
+// the platform, and the analysing binary cannot tell which kernel it faces --
+// so the band is the union of both.
+//
+// 8xx and BOOK3S_32 carve a dedicated window immediately below the linear map
+// (task_size_32.h): MODULES_END is PAGE_OFFSET (8xx) or PAGE_OFFSET rounded
+// down to 256 MiB (book3s32), with MODULES_VADDR = MODULES_END -
+// CONFIG_MODULES_SIZE * 1 MiB. That Kconfig is `range 1 256`, so 256 MiB below
+// PAGE_OFFSET is the lowest floor any such kernel can have.
+//
+// EVERY OTHER ppc32 platform -- including PPC_85xx/e500, the only one with
+// CONFIG_RANDOMIZE_BASE -- leaves MODULES_VADDR undefined and allocates from
+// the shared vmalloc window instead (mm/mem.c execmem_arch_setup: `#else start
+// = VMALLOC_START; end = VMALLOC_END;`). On nohash/32 VMALLOC_START derives
+// from runtime high_memory and so lies ABOVE PAGE_OFFSET, and VMALLOC_END is
+// ioremap_bot, which moves down from IOREMAP_TOP at runtime. Neither edge is a
+// compile-time constant, so the ceiling is the top of the address space.
+//
+// The union is therefore [PAGE_OFFSET - 256 MiB, top of VAS]. Only the floor
+// is a PAGE_OFFSET relation. ppc32 is PAGE_OFFSET_INVARIANT, so the
+// re-derivation the flag enables is a no-op here -- it declares the relation,
+// it does not predict movement.
+// https://elixir.bootlin.com/linux/v7.2/source/arch/powerpc/include/asm/task_size_32.h
+// https://elixir.bootlin.com/linux/v7.2/source/arch/powerpc/mm/mem.c
 #define MODULES_RELATIVE_TO_PAGE_OFFSET 1
 #define MODULES_START_FOR(po) ((po) - 0x10000000ul)
-#define MODULES_END_FOR(po) (po)
+#define MODULES_END_FOR(po) (KERNEL_VIRT_VAS_END)
 #define MODULES_START MODULES_START_FOR(PAGE_OFFSET) // 0xb0000000ul
 #define MODULES_END MODULES_END_FOR(PAGE_OFFSET)
 #define MODULES_RELATIVE_TO_TEXT 0

src/include/kasld/arch/riscv32.h

@@ -37,13 +37,26 @@
 // Above this, addresses fall in the fixmap/vmalloc region.
 #define KERNEL_VIRT_TEXT_MAX 0xf0000000ul
 
-// riscv32 has no separate module window: modules share the upper VAS, whose
-// floor is the linear-map base and whose ceiling is the top of the address
-// space regardless of where that base sits. Only the floor is a PAGE_OFFSET
-// relation; riscv32 is PAGE_OFFSET_INVARIANT, so nothing moves in practice.
+// Modules share the vmalloc window, which on rv32 sits immediately BELOW the
+// linear map, not above it:
+//
+//   MODULES_VADDR = VMALLOC_START = PAGE_OFFSET - VMALLOC_SIZE
+//   MODULES_END   = VMALLOC_END   = PAGE_OFFSET
+//
+// VMALLOC_SIZE is KERN_VIRT_SIZE >> 1, and KERN_VIRT_SIZE is
+// (PTRS_PER_PGD / 2 * PGDIR_SIZE) / 2. rv32 is sv32 only, so PGDIR_SHIFT is
+// 22 (PGDIR_SIZE 4 MiB) and PTRS_PER_PGD is 4096/4 = 1024, giving
+// KERN_VIRT_SIZE = 1 GiB and VMALLOC_SIZE = 512 MiB. Exact, with no
+// configuration variance to take a union over.
+//
+// Stated as a relation to PAGE_OFFSET rather than as fixed addresses so the
+// band cannot drift from the definition it instantiates. riscv32 is
+// PAGE_OFFSET_INVARIANT, so the re-derivation the flag enables is a no-op
+// here -- it declares the relation, it does not predict movement.
+// https://elixir.bootlin.com/linux/v7.2/source/arch/riscv/include/asm/pgtable.h
 #define MODULES_RELATIVE_TO_PAGE_OFFSET 1
-#define MODULES_START_FOR(po) (po)
-#define MODULES_END_FOR(po) (0xfffffffful)
+#define MODULES_START_FOR(po) ((po) - 0x20000000ul)
+#define MODULES_END_FOR(po) (po)
 #define MODULES_START MODULES_START_FOR(PAGE_OFFSET)
 #define MODULES_END MODULES_END_FOR(PAGE_OFFSET)
 #define MODULES_RELATIVE_TO_TEXT 0

src/orchestrator.c

@@ -3960,12 +3960,16 @@ static void engine_sync_authoritative(const struct engine *e) {
     if (po->lo && po->lo <= po->hi && (pinned || default_excluded)) {
       unsigned long lo = MODULES_START_FOR(po->lo);
       unsigned long hi = MODULES_END_FOR(po->hi);
-      /* The floor can underflow past the bottom of the kernel VAS when the
-       * window reaches down to the lowest admissible split; clamp rather than
-       * draw a band below the address space the map covers. */
-      if (lo < (unsigned long)KERNEL_VIRT_VAS_START)
-        lo = (unsigned long)KERNEL_VIRT_VAS_START;
-      if (hi > lo) {
+      /* MODULES_START_FOR subtracts, so a PAGE_OFFSET window reaching down to
+       * the lowest admissible split can wrap the floor past 0 and leave it
+       * near ULONG_MAX. Reject a wrapped floor; do NOT clamp it to
+       * KERNEL_VIRT_VAS_START. On every arch that carves the module band out
+       * of vmalloc the band legitimately sits BELOW PAGE_OFFSET, and on those
+       * KERNEL_VIRT_VAS_START *is* PAGE_OFFSET -- clamping there would discard
+       * the whole band and reject every genuine module leak, the exact failure
+       * the union contract above exists to prevent. Same wrap test that
+       * rules/module_base_bounds.c applies to these edges. */
+      if (lo <= po->lo && hi > lo) {
         mod_union_lo = lo;
         mod_union_hi = hi;
         layout.modules_start = lo;

tests/test_kasld.c

@@ -1916,10 +1916,16 @@ static void test_engine_sync_module_band_follows_page_offset(void) {
   engine_sync_authoritative(&e);
 
 #if MODULES_RELATIVE_TO_PAGE_OFFSET
+  /* The projected floor is the relation's own value, NOT clamped up to
+   * KERNEL_VIRT_VAS_START. Arches that carve the module band out of vmalloc
+   * put it below PAGE_OFFSET, and on those KERNEL_VIRT_VAS_START *is*
+   * PAGE_OFFSET -- clamping there would collapse the band and reject every
+   * genuine module leak. Only a wrapped floor (a PAGE_OFFSET window reaching
+   * below the band's own width) is rejected, and `moved` is above the
+   * compile-time PAGE_OFFSET so it cannot wrap here. */
   unsigned long want_lo = MODULES_START_FOR(moved);
   unsigned long want_hi = MODULES_END_FOR(moved);
-  if (want_lo < (unsigned long)KERNEL_VIRT_VAS_START)
-    want_lo = (unsigned long)KERNEL_VIRT_VAS_START;
+  assert(want_lo <= moved); /* no wrap in this fixture */
   assert(want_hi > want_lo);
   assert(layout.modules_start == want_lo);
   assert(layout.modules_end == want_hi);