rules: require structural provenance for module-derived text bounds

module_text_bound moves Q_VIRT_IMAGE_BASE at the sound floor but accepted
REGION_MODULE_REGION, which means "assumed to be a module because it fell
inside the band". On both architectures it runs on, that band contains the
whole kernel-text range — riscv64 [ffffffde.., ffffffffc0000000] over text
[ffffffe0.., ffffffffc0000000], s390 [0, 20000000000000] over text
[100000, 20000000000000] — so a range-classified kernel address is
indistinguishable from a module one and arrives as a text-base bound.

sysfs_iscsi_transport_handle reaches that state: it tests the band before
text, so on those arches its kernel-image branch is unreachable and a
built-in transport's .data pointer is tagged as module region. On s390
modules sit below the image, so such an address raises the C_LOWER_BOUND
above the true _text and carves truth out of the guaranteed window.

Read REGION_MODULE only, as module_text_bracket and module_base_bounds
already do, removing the class rather than relying on every emitter to
filter. The iscsi ordering is left alone and documented: reversing it would
tag genuine riscv64 module addresses KERNEL_DATA and feed
image_size_text_data_gap the bogus gap that ordering exists to prevent.
Where the two ranges overlap, no ordering is correct; what makes the
ambiguity harmless is that the weak tag no longer reaches a text base.

Separately, module_base_bounds discarded the best answer it had. The
mem_init() layout block prints "modules : 0x..." and the landmark parser
emits it as POS_BASE on the region — the region's start stated by the
kernel itself. Consume it as a pin. This is the one place the weak tag is
the right thing to read: with POS_BASE it means "this IS where the band
starts", and only the landmark parser emits that pair.

The two riscv64 tests that fed module-region leaks now feed REGION_MODULE,
which is what proc_modules and sysfs_module_sections emit; they were
written before those components were reclassified, and the tag was
incidental to what they assert.

Author: bcoles

src/components/sysfs_iscsi_transport_handle.c

@@ -207,7 +207,18 @@ static enum handle_read read_transport_handle(const char *transport,
  * in. Classify by range so a module pointer is tagged REGION_MODULE_REGION, not
  * an image region: a KERNEL_DATA tag on a module pointer feeds
  * image_size_text_data_gap a bogus (>1 GiB) text..data gap, which pushes the
- * Q_VIRT_IMAGE_BASE ceiling below the true base and excludes it. */
+ * Q_VIRT_IMAGE_BASE ceiling below the true base and excludes it.
+ *
+ * The module test comes FIRST deliberately, and must stay that way. Reversing
+ * it looks tempting on riscv64 and s390, where the module band contains the
+ * whole kernel-text range and so the second branch below is unreachable -- but
+ * on those same arches a genuine module address also falls inside that text
+ * range, so a text-first order would tag real module pointers KERNEL_DATA and
+ * reproduce exactly the ceiling bug described above. Range classification
+ * cannot separate the two where the ranges overlap; what makes the ambiguity
+ * harmless is that REGION_MODULE_REGION no longer reaches any rule that moves
+ * a text base (module_text_bound and module_text_bracket both require
+ * REGION_MODULE), so a mis-tag here is presentational. */
 static void emit_iscsi_transport(unsigned long addr, const char *name) {
   if (kasld_addr_is_module_region(addr))
     kasld_result_sample(KASLD_TYPE_VIRT, REGION_MODULE_REGION, addr, name,

src/rules/module_base_bounds.c

@@ -3,7 +3,11 @@
 // Rule: bound Q_MODULE_BASE — the lowest address the module allocator can hand
 // out — from module observations and from the architecture's module band.
 //
-// Two independent bounds, either of which may be absent:
+// Three independent sources, any of which may be absent:
+//
+//   PIN, from the kernel's own layout block: a POS_BASE observation of the
+//   module region states where the region starts, so it fixes the quantity
+//   outright rather than bounding it.
 //
 //   UPPER, from evidence: the allocator cannot have returned an address below
 //   its own region, so the lowest observed module address is an upper bound on
@@ -19,13 +23,16 @@
 //   the compile-time split only, and on a moved VMSPLIT they name a place the
 //   modules are not.
 //
-// PROVENANCE: reads VIRT REGION_MODULE only, never REGION_MODULE_REGION. A
-// range-classified address is inside the band by construction, so bounding the
-// base with it looks safe — but that safety is inherited from the band, and on
-// an arch whose band spans most of the address space (arm64) it is worth
-// nothing. Requiring structural provenance keeps the rule sound on its own
-// terms rather than on a per-arch argument, and keeps it sound if the module
-// base is ever coupled to another quantity. See the region note in api.h.
+// PROVENANCE: module ADDRESSES are read as REGION_MODULE only, never
+// REGION_MODULE_REGION. A range-classified address is inside the band by
+// construction, so bounding the base with it looks safe — but that safety is
+// inherited from the band, and on an arch whose band spans most of the address
+// space (arm64) it is worth nothing. Requiring structural provenance keeps the
+// rule sound on its own terms rather than on a per-arch argument.
+//
+// The one exception is a POS_BASE observation OF THE REGION, which is not an
+// address that might be a module but the region's own start — see the pin
+// below. See the region note in api.h.
 // ---
 // <bcoles@gmail.com>
 
@@ -61,6 +68,34 @@ int rule_module_base_bounds(const struct evidence_set *ev,
   if (out_max < 1)
     return 0;
 
+  /* --- The region base, stated outright ---------------------------------
+   * A POS_BASE observation of the module REGION is not a module address at
+   * all: it is the region's own start, which the kernel prints in its
+   * mem_init() layout block ("modules : 0x..."). That is the most direct
+   * possible answer to this quantity, so it pins rather than bounds.
+   *
+   * This is the one place REGION_MODULE_REGION is the RIGHT tag to read.
+   * Elsewhere the weak tag means "assumed to be a module because it fell in
+   * the band"; combined with POS_BASE it means "this IS where the band
+   * starts", and only the landmark parser emits that pair -- every other
+   * band emitter reports interior samples. */
+  for (int i = 0; i < ev->n_obs; i++) {
+    const struct observation *o = &ev->obs[i];
+    if (!o->valid || o->value_kind != OBS_ADDRESS ||
+        o->eff_type != KASLD_TYPE_VIRT || o->pos != POS_BASE)
+      continue;
+    if (o->eff_region != REGION_MODULE_REGION)
+      continue;
+    unsigned long a = obs_anchor(o);
+    if (!a)
+      continue;
+    if (n < out_max)
+      mbb_emit(&out[n++], C_LOWER_BOUND, a, o->id);
+    if (n < out_max)
+      mbb_emit(&out[n++], C_UPPER_BOUND, a, o->id);
+    break;
+  }
+
   /* --- Upper bound from the lowest structurally-known module address ----- */
   unsigned long vmod_lo = ULONG_MAX;
   uint32_t lo_src = 0;

src/rules/module_text_bound.c

@@ -16,9 +16,10 @@
 //     virt_kaslr_align
 //     + IMAGE_BASE_OFFSET
 //
-// Reads VIRT REGION_MODULE / REGION_MODULE_REGION leaks; aligns to the
-// resolved Q_VIRT_KASLR_ALIGN. Inert where MODULES_RELATIVE_TO_TEXT==0, and
-// inert when no module-region observation is present.
+// Reads VIRT REGION_MODULE leaks ONLY -- never REGION_MODULE_REGION; see the
+// provenance note at the filter below. Aligns to the resolved
+// Q_VIRT_KASLR_ALIGN. Inert where MODULES_RELATIVE_TO_TEXT==0, and inert when
+// no structurally-known module observation is present.
 // ---
 // <bcoles@gmail.com>
 
@@ -50,7 +51,21 @@ int rule_module_text_bound(const struct evidence_set *ev,
     if (!o->valid || o->value_kind != OBS_ADDRESS ||
         o->eff_type != KASLD_TYPE_VIRT)
       continue;
-    if (o->eff_region != REGION_MODULE && o->eff_region != REGION_MODULE_REGION)
+    /* REGION_MODULE only, never REGION_MODULE_REGION. This rule moves
+     * Q_VIRT_IMAGE_BASE at the sound floor, so it may consume only addresses
+     * whose source KNOWS they belong to a module -- not ones classified as
+     * module because they fell inside the band. On both arches this rule runs
+     * on, the band CONTAINS the whole kernel-text range (riscv64
+     * [ffffffde.., ffffffffc0000000] over text [ffffffe0.., ffffffffc0000000];
+     * s390 [0, 20000000000000] over text [100000, 20000000000000]), so a
+     * range-classified kernel address is indistinguishable from a module one
+     * and reaches here as a text-base bound. On s390 that is unsound in the
+     * dangerous direction: modules sit BELOW the image, so a kernel .data
+     * address raises the C_LOWER_BOUND above the true _text and carves truth
+     * out of the guaranteed window. Requiring structural provenance removes
+     * the whole class, rather than relying on every emitter to filter -- see
+     * the region note in api.h. */
+    if (o->eff_region != REGION_MODULE)
       continue;
     unsigned long a = obs_anchor(o);
     if (a < vmod_lo) {

tests/test_engine.c

@@ -6962,6 +6962,51 @@ static void test_module_text_bracket_real_arm64_witness(void) {
 #endif
 }
 
+/* module_text_bound must not take a range-classified address. This rule moves
+ * Q_VIRT_IMAGE_BASE at the sound floor, and on BOTH arches it runs on the
+ * module band contains the whole kernel-text range — so a kernel address that
+ * some component classified by range is indistinguishable from a module one.
+ * On s390 that direction is unsound: modules sit below the image, so such an
+ * address raises the lower bound above the true _text. Asserted against a run
+ * with no observation at all, so it holds on every arch. */
+static void test_module_text_bound_ignores_range_classified(void) {
+  struct engine e;
+  const rule_fn rules[] = {rule_kaslr_align_arch_default,
+                           rule_module_text_bound};
+  engine_init(&e);
+  engine_run(&e, rules, 2);
+  unsigned long bare_lo = e.est[Q_VIRT_IMAGE_BASE].lo;
+  unsigned long bare_hi = e.est[Q_VIRT_IMAGE_BASE].hi;
+
+  engine_init(&e);
+  struct estimate top;
+  quantities[Q_VIRT_IMAGE_BASE].init_top(&top);
+  struct observation m =
+      mk_obs(KASLD_TYPE_VIRT, REGION_MODULE_REGION, top.lo + 0x100000ul,
+             LO_SET | SAMPLE_SET, POS_INTERIOR, CONF_PARSED);
+  evidence_add(&e.ev, &m);
+  engine_run(&e, rules, 2);
+  assert(e.est[Q_VIRT_IMAGE_BASE].lo == bare_lo);
+  assert(e.est[Q_VIRT_IMAGE_BASE].hi == bare_hi);
+}
+
+/* The kernel prints its own module-region start in the mem_init() layout block,
+ * which the landmark parser emits as POS_BASE on the REGION. That is the region
+ * itself, not an address that might be a module, so it pins the quantity. The
+ * one place the weak tag is the correct thing to read. */
+static void test_module_base_pinned_by_region_landmark(void) {
+  struct engine e;
+  engine_init(&e);
+  unsigned long band_base = (unsigned long)MODULES_START + 0x200000ul;
+  struct observation o = mk_obs(KASLD_TYPE_VIRT, REGION_MODULE_REGION,
+                                band_base, LO_SET, POS_BASE, CONF_PARSED);
+  evidence_add(&e.ev, &o);
+  const rule_fn rules[] = {rule_module_base_bounds};
+  engine_run(&e, rules, 1);
+  assert(e.est[Q_MODULE_BASE].lo == band_base);
+  assert(e.est[Q_MODULE_BASE].hi == band_base);
+}
+
 /* module_base_bounds. MODULES_START + 1 MiB is inside the module band on every
  * supported arch, so one address exercises the rule everywhere without a
  * per-arch table. */
@@ -7450,7 +7495,10 @@ static void test_riscv64_text_base_legacy(void) {
    * legacy-region bound (the WIDE min), or the window stays uselessly wide. */
   unsigned long vmod = legacy_po - 0x7f6de000ul; /* ~just under 2 GiB below */
   struct observation mod =
-      mk_obs(KASLD_TYPE_VIRT, REGION_MODULE_REGION, vmod, LO_SET | SAMPLE_SET,
+      /* REGION_MODULE: a real module leak, which is what proc_modules and
+         sysfs_module_sections emit. module_text_bound requires structural
+         provenance -- a range-classified address must not move a text base. */
+      mk_obs(KASLD_TYPE_VIRT, REGION_MODULE, vmod, LO_SET | SAMPLE_SET,
              POS_INTERIOR, CONF_PARSED);
   evidence_add(&e.ev, &mod);
   const rule_fn rules[] = {rule_lobound_page_offset, rule_riscv64_text_base,
@@ -7763,6 +7811,8 @@ int main(void) {
   RUN(test_module_text_bracket_contains_truth);
   RUN(test_module_text_bracket_ignores_range_classified);
   RUN(test_module_text_bracket_real_arm64_witness);
+  RUN(test_module_text_bound_ignores_range_classified);
+  RUN(test_module_base_pinned_by_region_landmark);
   RUN(test_module_base_upper_from_observation);
   RUN(test_module_base_ignores_range_classified);
   RUN(test_module_base_band_bounds);

tests/test_engine_integration.c

@@ -1096,11 +1096,12 @@ static void test_full_engine_riscv64_legacy_no_kaslr(void) {
                 0xffffffd800000000ul, CONF_INFERRED, NULL);
   add_addr(&e, KASLD_TYPE_VIRT, REGION_PAGE_OFFSET, 0xffffffe000000000ul, 0,
            NULL);
-  /* module-region leaks (~2 GiB below text). */
-  add_addr(&e, KASLD_TYPE_VIRT, REGION_MODULE_REGION, 0xffffffdf80922000ul, 0,
-           NULL);
-  add_addr(&e, KASLD_TYPE_VIRT, REGION_MODULE_REGION, 0xffffffdf80d99000ul, 0,
-           NULL);
+  /* Module leaks (~2 GiB below text), REGION_MODULE as proc_modules and
+   * sysfs_module_sections emit them: module_text_bound requires structural
+   * provenance, since on this arch the module band contains the whole text
+   * range and a range-classified address is indistinguishable from a module. */
+  add_addr(&e, KASLD_TYPE_VIRT, REGION_MODULE, 0xffffffdf80922000ul, 0, NULL);
+  add_addr(&e, KASLD_TYPE_VIRT, REGION_MODULE, 0xffffffdf80d99000ul, 0, NULL);
   /* DRAM. */
   add_addr(&e, KASLD_TYPE_PHYS, REGION_RAM, 0x80000000ul, 0, NULL);
   add_addr_top(&e, KASLD_TYPE_PHYS, REGION_RAM, 0x9fe00000ul);