rules: pin x86_64 direct map under CONFIG_KASAN / nokaslr

kernel_randomize_memory() returns early when !kaslr_memory_enabled(), and
kaslr_memory_enabled() = kaslr_enabled() && !IS_ENABLED(CONFIG_KASAN) (identical
6.6..mainline). So page_offset/vmalloc/vmemmap keep their compile-time L4/L5
defaults whenever KASLR is off OR CONFIG_KASAN=y -- and on x86_64 those macros
are unconditionally the runtime variables, so the base equals the constant. The
non-obvious case is KASAN with CONFIG_RANDOMIZE_MEMORY=y (common on syzkaller /
CTF / debug kernels): the config advertises a randomised direct map but KASAN
overrides it.

directmap_kaslr_disabled_pin pins the three bases on a positive disable signal,
choosing L4/L5 from SF_VIRT_ADDR_BITS (cpuinfo, leak-free). New SF_KASAN_ENABLED
detected by proc_config / boot_config; L4/L5 base constants in x86_64.h. Reads
only scalar facts (no est[Q] -> no self-edge); the meet backstops any
out-of-window value. Kernel TEXT KASLR stays randomised.

Author: bcoles

src/components/boot_config.c

@@ -127,6 +127,16 @@ int main(void) {
     kasld_emit_scalar(SF_PHYS_KASLR_DISABLED, 1, CONF_PARSED);
   }
 
+  /* CONFIG_KASAN=y forces the direct-map randomisation off at runtime
+   * (kaslr_memory_enabled() = kaslr_enabled() && !IS_ENABLED(CONFIG_KASAN)), so
+   * page_offset / vmalloc / vmemmap stay at their compile-time defaults even
+   * with CONFIG_RANDOMIZE_MEMORY=y. Consumed by directmap_kaslr_disabled_pin.
+   */
+  if (is_kconfig_set(fp, "CONFIG_KASAN")) {
+    printf("[.] CONFIG_KASAN=y\n");
+    kasld_emit_scalar(SF_KASAN_ENABLED, 1, CONF_PARSED);
+  }
+
   fclose(fp);
 
   return 0;

src/components/proc_config.c

@@ -166,6 +166,16 @@ int main(void) {
     kasld_emit_scalar(SF_PHYS_KASLR_DISABLED, 1, CONF_PARSED);
   }
 
+  /* CONFIG_KASAN=y forces the direct-map randomisation off at runtime —
+   * kaslr_memory_enabled() = kaslr_enabled() && !IS_ENABLED(CONFIG_KASAN) —
+   * so page_offset / vmalloc / vmemmap stay at their compile-time defaults even
+   * when CONFIG_RANDOMIZE_MEMORY=y. Consumed by directmap_kaslr_disabled_pin
+   * (x86_64). The fact is arch-neutral; the rule gates on the arch. */
+  if (is_kconfig_set(fp, "CONFIG_KASAN")) {
+    printf("[.] CONFIG_KASAN=y\n");
+    kasld_emit_scalar(SF_KASAN_ENABLED, 1, CONF_PARSED);
+  }
+
   fclose(fp);
 
   return 0;

src/engine_rules.c

@@ -68,6 +68,7 @@ static const rule_fn k_rules[] = {
 
     /* KASLR-off pin */
     rule_virt_kaslr_disabled_pin,
+    rule_directmap_kaslr_disabled_pin,
     rule_phys_kaslr_disabled_pin,
     rule_physical_start_lower_bound,
 

src/include/kasld/api.h

@@ -757,6 +757,12 @@ enum kasld_scalar_fact {
   SF_PHYSICAL_START, /* CONFIG_PHYSICAL_START (kernel's LOAD_PHYSICAL_ADDR  */
                      /* / pref_address; x86). Used to raise the Q_*_TEXT   */
                      /* honest-top floors above their conservative default.*/
+  SF_KASAN_ENABLED,  /* 1 if CONFIG_KASAN=y. On x86_64 KASAN forces        */
+                     /* kaslr_memory_enabled()=false (= kaslr_enabled() && */
+                     /* !IS_ENABLED(CONFIG_KASAN)), so the direct map /    */
+                     /* vmalloc / vmemmap bases stay at their compile-time */
+                     /* defaults even when CONFIG_RANDOMIZE_MEMORY=y.      */
+                     /* Pinned by directmap_kaslr_disabled_pin.            */
   SF__COUNT,
 };
 
@@ -785,6 +791,7 @@ static const char *const kasld_scalar_fact_wire_table[SF__COUNT] = {
     [SF_CMDLINE_HUGEPAGES] = "cmdline_hugepages",
     [SF_CMDLINE_MEMMAP_COUNT] = "cmdline_memmap_count",
     [SF_PHYSICAL_START] = "physical_start",
+    [SF_KASAN_ENABLED] = "kasan_enabled",
 };
 /* Adding an SF_* without a wire token shrinks this below SF__COUNT -> error. */
 typedef char kasld_sf_wire_table_complete

src/include/kasld/arch/x86_64.h

@@ -51,6 +51,21 @@
 // value.
 #define PAGE_OFFSET_RANDOMIZED 1
 
+// Compile-time default region bases — the values page_offset_base /
+// vmalloc_base / vmemmap_base are initialised to (head64.c) and KEEP whenever
+// kernel_randomize_memory() returns early, i.e. when KASLR is off OR
+// CONFIG_KASAN=y (kaslr_memory_enabled() = kaslr_enabled() && !KASAN). On
+// x86_64 __PAGE_OFFSET / VMALLOC_START / VMEMMAP_START are unconditionally
+// these variables (page_64_types.h, pgtable_64_types.h), so under the disabled
+// gate the runtime base IS the constant. Selected by paging level: L4 = 4-level
+// (VA 48), L5 = 5-level (VA 57). Consumed by directmap_kaslr_disabled_pin.
+#define PAGE_OFFSET_BASE_L4 0xffff888000000000ul
+#define PAGE_OFFSET_BASE_L5 0xff11000000000000ul
+#define VMALLOC_BASE_L4 0xffffc90000000000ul
+#define VMALLOC_BASE_L5 0xffa0000000000000ul
+#define VMEMMAP_BASE_L4 0xffffea0000000000ul
+#define VMEMMAP_BASE_L5 0xffd4000000000000ul
+
 #define KERNEL_VIRT_VAS_START PAGE_OFFSET
 #define KERNEL_VIRT_VAS_END 0xfffffffffffffffful
 

src/include/kasld/engine_rules.h

@@ -79,6 +79,7 @@ R(base_align_cross_validate);
 
 /* KASLR-off pin + learned floor */
 R(virt_kaslr_disabled_pin);
+R(directmap_kaslr_disabled_pin);
 R(phys_kaslr_disabled_pin);
 R(physical_start_lower_bound);
 

src/rules/directmap_kaslr_disabled_pin.c

@@ -0,0 +1,108 @@
+// This file is part of KASLD - https://github.com/bcoles/kasld
+//
+// Rule: x86_64 direct-map KASLR-disabled pin (page_offset / vmalloc / vmemmap).
+//
+// arch/x86/mm/kaslr.c:kernel_randomize_memory() returns BEFORE touching any
+// base when !kaslr_memory_enabled(), and
+//
+//   kaslr_memory_enabled() = kaslr_enabled() && !IS_ENABLED(CONFIG_KASAN)
+//
+// (identical in linux-6.6 … 7.0 and mainline). So page_offset_base /
+// vmalloc_base / vmemmap_base keep their compile-time defaults whenever KASLR
+// is off (SF_VIRT_KASLR_DISABLED) OR CONFIG_KASAN=y (SF_KASAN_ENABLED) — and on
+// x86_64 __PAGE_OFFSET / VMALLOC_START / VMEMMAP_START ARE those variables
+// unconditionally (page_64_types.h, pgtable_64_types.h), so the runtime base
+// equals the constant. The non-obvious case is KASAN with
+// CONFIG_RANDOMIZE_MEMORY=y: the config advertises a randomised direct map but
+// KASAN overrides it at runtime — common on syzkaller / CTF / debug kernels.
+//
+// On a positive disable signal, pin all three bases to the paging-level default
+// (L4 = VA 48, L5 = VA 57), chosen by SF_VIRT_ADDR_BITS (proc_cpuinfo's "bits
+// virtual", which tracks the active level — leak-free, so the pin fires without
+// any direct-map leak). CONFIG_RANDOMIZE_BASE is independent of the memory
+// randomisation, so kernel TEXT stays randomised; this pins only the
+// direct-map side.
+//
+// Soundness:
+//   * Fires only on a positive disable signal AND a resolved VA width.
+//   * The pinned values are exact, non-config-tunable kernel constants for the
+//     resolved level, so no window-containment read is needed — and an
+//     out-of-window C_EQUALS is dropped by the engine's meet as a conflict
+//     anyway (so no est[Q] read, no self-edge).
+//   * A higher-confidence real direct-map leak still wins via the resolver's
+//     conflict handling.
+// ---
+// <bcoles@gmail.com>
+
+#include "../include/kasld/engine_rules.h"
+
+#include <string.h>
+
+int rule_directmap_kaslr_disabled_pin(const struct evidence_set *ev,
+                                      const struct estimate *est,
+                                      struct constraint *out, int out_max) {
+  (void)est;
+#if defined(__x86_64__) || defined(__amd64__)
+  uint32_t sig_id = 0, va_id = 0;
+  enum kasld_confidence sig_conf = CONF_UNKNOWN, va_conf = CONF_UNKNOWN;
+  unsigned long va_bits = 0;
+  for (int i = 0; i < ev->n_obs; i++) {
+    const struct observation *o = &ev->obs[i];
+    if (!o->valid || o->value_kind != OBS_SCALAR)
+      continue;
+    if ((o->scalar_fact == SF_KASAN_ENABLED ||
+         o->scalar_fact == SF_VIRT_KASLR_DISABLED) &&
+        o->scalar_value != 0) {
+      if (sig_id == 0) {
+        sig_id = o->id;
+        sig_conf = o->conf;
+      }
+    } else if (o->scalar_fact == SF_VIRT_ADDR_BITS && o->scalar_value != 0) {
+      va_bits = o->scalar_value;
+      va_id = o->id;
+      va_conf = o->conf;
+    }
+  }
+  if (sig_id == 0 || va_bits == 0)
+    return 0;
+
+  /* Active paging level: 48-bit VA -> 4-level (L4), 57-bit -> 5-level (L5). */
+  int l5;
+  if (va_bits <= 48)
+    l5 = 0;
+  else if (va_bits <= 57)
+    l5 = 1;
+  else
+    return 0; /* unexpected width — don't pin. */
+
+  struct {
+    enum kasld_quantity q;
+    unsigned long value;
+  } pins[3] = {
+      {Q_PAGE_OFFSET, l5 ? PAGE_OFFSET_BASE_L5 : PAGE_OFFSET_BASE_L4},
+      {Q_VMALLOC_BASE, l5 ? VMALLOC_BASE_L5 : VMALLOC_BASE_L4},
+      {Q_VMEMMAP_BASE, l5 ? VMEMMAP_BASE_L5 : VMEMMAP_BASE_L4},
+  };
+
+  enum kasld_confidence conf = (sig_conf < va_conf) ? sig_conf : va_conf;
+  int n = 0;
+  for (int k = 0; k < 3 && n < out_max; k++) {
+    struct constraint *c = &out[n++];
+    memset(c, 0, sizeof(*c));
+    c->q = pins[k].q;
+    c->op = C_EQUALS;
+    c->value = pins[k].value;
+    c->conf = conf;
+    c->derived_from[0] = sig_id;
+    c->derived_from[1] = va_id;
+    c->lineage_count = 2;
+    snprintf(c->origin, ORIGIN_LEN, "directmap_kaslr_disabled_pin");
+  }
+  return n;
+#else
+  (void)ev;
+  (void)out;
+  (void)out_max;
+  return 0;
+#endif
+}

tests/test_engine.c

@@ -3134,6 +3134,65 @@ static void test_virt_kaslr_disabled_pin_no_signal_no_pin(void) {
   assert(e.est[Q_VIRT_TEXT_BASE].hi == top.hi);
 }
 
+/* directmap_kaslr_disabled_pin: KASAN (or nokaslr) leaves page_offset / vmalloc
+ * / vmemmap at their compile-time L4/L5 defaults; the level comes from
+ * SF_VIRT_ADDR_BITS. x86_64 only. */
+int rule_directmap_kaslr_disabled_pin(const struct evidence_set *ev,
+                                      const struct estimate *est,
+                                      struct constraint *out, int out_max);
+
+static void test_directmap_kaslr_disabled_pin(void) {
+#if defined(__x86_64__)
+  const rule_fn rules[] = {rule_directmap_kaslr_disabled_pin};
+  struct estimate top;
+  quantities[Q_PAGE_OFFSET].init_top(&top);
+
+  /* KASAN + 4-level (VA 48): all three bases pinned to the L4 defaults. */
+  struct engine e;
+  engine_init(&e);
+  struct observation k = mk_scalar(SF_KASAN_ENABLED, 1, CONF_PARSED);
+  struct observation vb = mk_scalar(SF_VIRT_ADDR_BITS, 48, CONF_PARSED);
+  evidence_add(&e.ev, &k);
+  evidence_add(&e.ev, &vb);
+  engine_run(&e, rules, 1);
+  assert(e.est[Q_PAGE_OFFSET].lo == PAGE_OFFSET_BASE_L4 &&
+         e.est[Q_PAGE_OFFSET].hi == PAGE_OFFSET_BASE_L4);
+  assert(e.est[Q_VMALLOC_BASE].lo == VMALLOC_BASE_L4 &&
+         e.est[Q_VMALLOC_BASE].hi == VMALLOC_BASE_L4);
+  assert(e.est[Q_VMEMMAP_BASE].lo == VMEMMAP_BASE_L4 &&
+         e.est[Q_VMEMMAP_BASE].hi == VMEMMAP_BASE_L4);
+
+  /* nokaslr + 5-level (VA 57): page_offset pinned to the L5 default. */
+  struct engine e2;
+  engine_init(&e2);
+  struct observation d = mk_scalar(SF_VIRT_KASLR_DISABLED, 1, CONF_PARSED);
+  struct observation vb2 = mk_scalar(SF_VIRT_ADDR_BITS, 57, CONF_PARSED);
+  evidence_add(&e2.ev, &d);
+  evidence_add(&e2.ev, &vb2);
+  engine_run(&e2, rules, 1);
+  assert(e2.est[Q_PAGE_OFFSET].lo == PAGE_OFFSET_BASE_L5 &&
+         e2.est[Q_PAGE_OFFSET].hi == PAGE_OFFSET_BASE_L5);
+
+  /* Negative: VA width but no disable signal — no pin. */
+  struct engine e3;
+  engine_init(&e3);
+  struct observation vb3 = mk_scalar(SF_VIRT_ADDR_BITS, 48, CONF_PARSED);
+  evidence_add(&e3.ev, &vb3);
+  engine_run(&e3, rules, 1);
+  assert(e3.est[Q_PAGE_OFFSET].lo == top.lo &&
+         e3.est[Q_PAGE_OFFSET].hi == top.hi);
+
+  /* Negative: disable signal but no VA width — no pin (can't pick L4/L5). */
+  struct engine e4;
+  engine_init(&e4);
+  struct observation k4 = mk_scalar(SF_KASAN_ENABLED, 1, CONF_PARSED);
+  evidence_add(&e4.ev, &k4);
+  engine_run(&e4, rules, 1);
+  assert(e4.est[Q_PAGE_OFFSET].lo == top.lo &&
+         e4.est[Q_PAGE_OFFSET].hi == top.hi);
+#endif
+}
+
 /* SF_PHYS_KASLR_DISABLED pins Q_PHYS_TEXT_BASE on arches where the kernel's
  * decompressor/relocator keeps the image at its compile-time physical default
  * under nokaslr (KASLR_DISABLED_PINS_PHYS=1). Per-quantity window-containment
@@ -4485,6 +4544,7 @@ int main(void) {
   BEGIN_CATEGORY("KASLR-off pin");
   RUN(test_virt_kaslr_disabled_pin);
   RUN(test_virt_kaslr_disabled_pin_no_signal_no_pin);
+  RUN(test_directmap_kaslr_disabled_pin);
   RUN(test_phys_kaslr_disabled_pin);
   RUN(test_phys_kaslr_disabled_pin_defers_to_real_leak);
   RUN(test_phys_kaslr_disabled_pin_inert_on_decoupled);

tests/test_orch_common.h

@@ -17,7 +17,8 @@
 /* Seed the engine-bounds carrier the same way orchestrator's main() does.
  * Under KASLD_TESTING the orchestrator's main() is excluded, so suites that
  * read layout (compute_kaslr_info coverage, the renderer's derived paths) must
- * start it from the honest window themselves. Call once at the top of main(). */
+ * start it from the honest window themselves. Call once at the top of main().
+ */
 static void test_init_layout_engine_bounds(void) {
   layout.virt_page_offset_min = layout.virt_kernel_vas_start;
   layout.virt_page_offset_max = layout.virt_kernel_vas_end;

tests/test_render.c

@@ -30,7 +30,6 @@
 #include <string.h>
 #include <unistd.h>
 
-
 /* =========================================================================
  * Renderer unit tests.
  *
@@ -1025,7 +1024,6 @@ static void test_render_hardening_text_no_rand_failed_silent(void) {
   assert(strstr(render_cap, "KASLR posture") == NULL);
 }
 
-
 int main(void) {
   TEST_SUITE("render — renderer unit suite");
   test_init_layout_engine_bounds();