inference: chain page_offset_base → vmalloc_base → vmemmap_base

Add two inference plugins that propagate page_offset_base bounds
through the fixed CONFIG_RANDOMIZE_MEMORY region ordering:

  x86_64_vmalloc_base_bound:
    vmalloc_base_min = page_offset_min + directmap_size_tb * 1 TiB + PUD_SIZE
    (directmap_size_tb derived from /proc/zoneinfo max_pfn)

  x86_64_vmemmap_base_bound:
    vmemmap_base_min = vmalloc_base_min + VMALLOC_SIZE_TB * 1 TiB + PUD_SIZE
    vmemmap_base_max = CPU_ENTRY_AREA_BASE - vmemmap_size
    (L4 vs L5 paging detected from page_offset_min)

Adds vmalloc_base_{min,max} and vmemmap_base_{min,max} to
kasld_analysis_ctx, threads them through snap_bounds / bounds_changed,
and surfaces the three bounded regions in render_kaslr_text and JSON
output under a new "Memory KASLR" section.

Also derive a ret2dir physmap alias of kernel text in
compute_derived_addrs when both PHYS/TEXT and a pinned page_offset_base
are available: page_offset_base + (P text − PHYS_OFFSET). The
subtraction is a no-op on x86_64 / arm64 (PHYS_OFFSET = 0) and
significant on riscv64 (= 0x80000000).

Author: bcoles

src/include/kasld_inference.h

@@ -71,6 +71,24 @@ struct kasld_analysis_ctx {
   /* Physical KASLR bounds (PHYS_VIRT_DECOUPLED arches only; zero otherwise). */
   unsigned long phys_base_min;
   unsigned long phys_base_max;
+  /* vmalloc region bounds (x86_64 with CONFIG_RANDOMIZE_MEMORY only).
+   * vmalloc_base_min: architectural lower bound derived from
+   *   page_offset_base + directmap_size_tb * 1TiB + PUD_SIZE.
+   * Initialised to 0 / ULONG_MAX. Only tightened by
+   * x86_64_vmalloc_base_bound.c when page_offset_base is known. */
+  unsigned long vmalloc_base_min;
+  unsigned long vmalloc_base_max;
+  /* vmemmap region bounds (x86_64 with CONFIG_RANDOMIZE_MEMORY only).
+   * vmemmap_base_min: derived from vmalloc_base_min + VMALLOC_SIZE_TB +
+   *   PUD_SIZE inter-region gap.
+   * vmemmap_base_max: derived from CPU_ENTRY_AREA_BASE − vmemmap_size.
+   * Initialised to 0 / ULONG_MAX. Only tightened by
+   * x86_64_vmemmap_base_bound.c. Per-PFN pinning via leaked struct page
+   * VAs is not feasible on modern kernels (%p hashing since v4.15
+   * closed the dump_page() source); see
+   * dev/research/phys-to-virt-bridges.md §B. */
+  unsigned long vmemmap_base_min;
+  unsigned long vmemmap_base_max;
   const struct kasld_arch_params *arch;
   /* Writable layout pointer — set by LAYOUT_ADJUST plugins only.
    * POST_COLLECTION and POST_PROBING plugins treat this as read-only. */

src/include/kasld_internal.h

@@ -168,6 +168,16 @@ struct kaslr_info {
   unsigned long pslots;
   int pbits;
   int has_phys;
+  /* Memory KASLR (x86_64 with CONFIG_RANDOMIZE_MEMORY only). Bounds on
+   * the three independently-randomised memory regions, computed by
+   * x86_64_vmalloc_base_bound.c and x86_64_vmemmap_base_bound.c via the
+   * structural placement chain. Zero when no bound was inferred. */
+  unsigned long page_offset_min;
+  unsigned long page_offset_max;
+  unsigned long vmalloc_min;
+  unsigned long vmalloc_max;
+  unsigned long vmemmap_min;
+  unsigned long vmemmap_max;
 };
 
 /* Cross-section derived address */

src/inference/x86_64_vmalloc_base_bound.c

@@ -0,0 +1,158 @@
+// This file is part of KASLD - https://github.com/bcoles/kasld
+//
+// Inference plugin: page_offset_base + directmap_size → vmalloc_base lower
+// bound (POST_COLLECTION)
+//
+// On x86_64 with CONFIG_RANDOMIZE_MEMORY, kernel_randomize_memory() places
+// the three virtual memory regions consecutively, each offset by a random
+// PUD-aligned value:
+//
+//   kaslr_regions[0]: directmap  — base = page_offset_base
+//                                  size = directmap_size_tb TiB
+//   kaslr_regions[1]: vmalloc    — base = page_offset_base + directmap_size_tb
+//   * 1TiB
+//                                        + round_up(1, PUD_SIZE) + rand_1
+//   kaslr_regions[2]: vmemmap    — base = vmalloc_base + VMALLOC_SIZE_TB * 1TiB
+//                                        + round_up(1, PUD_SIZE) + rand_2
+//
+// The minimum inter-region gap is exactly PUD_SIZE (1 GiB), because after
+// advancing vaddr past each region's size the loop does:
+//
+//   vaddr = round_up(vaddr + 1, PUD_SIZE);
+//
+// and vaddr is PUD-aligned going in (region sizes are in whole TiB = multiple
+// of PUD_SIZE). So the gap is exactly 1 * PUD_SIZE = 1 GiB.
+//
+// The directmap size is:
+//
+//   memory_tb = DIV_ROUND_UP(max_pfn * 4096, 1 TiB) +
+//               CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING (default: 10)
+//   directmap_size_tb = min(4096, memory_tb)   [when ZONE_DEVICE disabled]
+//
+// This gives a sound lower bound:
+//
+//   vmalloc_base_min = page_offset_min + directmap_size_tb * 1TiB + PUD_SIZE
+//
+// When page_offset_base is exactly pinned (page_offset_min == page_offset_max)
+// the bound is tight; otherwise it is a valid-but-loose lower bound.
+//
+// max_pfn is read from /proc/zoneinfo: max(start_pfn + spanned) across all
+// zones. /proc/zoneinfo is world-readable (0444) on all kernel versions.
+//
+// Phase: POST_COLLECTION — requires page_offset_min from prior plugins
+//        (directmap_page_offset_bounds, randomize_memory_page_offset).
+// Applicable: x86-64 only (other arches use a different memory layout model).
+// ---
+// <bcoles@gmail.com>
+
+#define _POSIX_C_SOURCE 200809L
+
+#include "../include/kasld_inference.h"
+
+#include <limits.h>
+#include <stdio.h>
+
+#define TB_SHIFT 40
+#define PUD_SHIFT 30
+#define PAGE_SHIFT 12
+
+/* CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING — added to directmap_size_tb.
+ * Hardcoded to the kernel default (10 TiB). Distro kernels virtually always
+ * use this value; there is no way to detect it from user space. If a kernel
+ * uses a larger padding, vmalloc_base_min will be under-estimated (still a
+ * valid lower bound, just slightly loose). */
+#define RANDOMIZE_MEMORY_PHYSICAL_PADDING 10ul
+
+/* Read max_pfn from /proc/zoneinfo: highest (start_pfn + spanned) seen.
+ * Returns 0 on failure. */
+static unsigned long read_max_pfn(void) {
+  FILE *f = fopen("/proc/zoneinfo", "r");
+  if (!f)
+    return 0;
+
+  char line[256];
+  unsigned long max_pfn = 0;
+  unsigned long cur_spanned = 0;
+
+  /* /proc/zoneinfo per-zone layout (relevant fields):
+   *   pages free     N
+   *         spanned  N    ← appears before start_pfn within the zone block
+   *         ...
+   *   start_pfn:     N    ← zone's base PFN; end = start_pfn + spanned
+   */
+  while (fgets(line, sizeof(line), f)) {
+    unsigned long val;
+
+    if (sscanf(line, " spanned %lu", &val) == 1) {
+      cur_spanned = val;
+      continue;
+    }
+
+    if (sscanf(line, "  start_pfn: %lu", &val) != 1)
+      continue;
+
+    unsigned long end_pfn = cur_spanned ? val + cur_spanned : val;
+    if (end_pfn > max_pfn)
+      max_pfn = end_pfn;
+
+    cur_spanned = 0;
+  }
+
+  fclose(f);
+  return max_pfn;
+}
+
+static void x86_64_vmalloc_base_bound_run(struct kasld_analysis_ctx *ctx) {
+#if defined(__x86_64__)
+  /* Only meaningful when page_offset_base is at least partially pinned. */
+  if (ctx->page_offset_min == 0)
+    return;
+
+  unsigned long max_pfn = read_max_pfn();
+  if (!max_pfn)
+    return;
+
+  /* directmap_size_tb = DIV_ROUND_UP(max_pfn * PAGE_SIZE, 1 TiB) + padding.
+   * Cap at 4096 TiB (1 << (MAX_PHYSMEM_BITS - TB_SHIFT), MAX_PHYSMEM_BITS=52).
+   * This matches kernel_randomize_memory() on kernels without ZONE_DEVICE;
+   * with ZONE_DEVICE the cap is not applied by the kernel, but 4096 TiB is
+   * an architectural ceiling regardless. */
+  unsigned long page_bytes =
+      max_pfn << PAGE_SHIFT; /* may wrap on 32-bit, but we're x86_64 */
+  unsigned long one_tb = 1ul << TB_SHIFT;
+  unsigned long memory_tb =
+      (page_bytes + one_tb - 1) / one_tb + RANDOMIZE_MEMORY_PHYSICAL_PADDING;
+  unsigned long directmap_size_tb = memory_tb < 4096ul ? memory_tb : 4096ul;
+
+  /* vmalloc_base >= page_offset_base + directmap_size_tb * 1 TiB + PUD_SIZE.
+   * Use page_offset_min as a conservative substitute for page_offset_base;
+   * result is always a valid lower bound. */
+  unsigned long pud_size = 1ul << PUD_SHIFT;
+  unsigned long candidate =
+      ctx->page_offset_min + directmap_size_tb * one_tb + pud_size;
+
+  /* Sanity: candidate must be above page_offset_min and fit in the kernel VAS.
+   */
+  if (candidate <= ctx->page_offset_min)
+    return;
+
+  if (candidate > ctx->vmalloc_base_min) {
+    if (verbose && !quiet && !json_output)
+      printf("[infer] vmalloc_base_min: %#lx  "
+             "(page_offset_min %#lx + %lu TiB directmap + 1 GiB gap;"
+             " max_pfn %lu)\n",
+             candidate, ctx->page_offset_min, directmap_size_tb, max_pfn);
+    ctx->vmalloc_base_min = candidate;
+  }
+#else
+  (void)ctx;
+#endif
+}
+
+static const struct kasld_inference x86_64_vmalloc_base_bound = {
+    .name = "x86_64_vmalloc_base_bound",
+    .phase = KASLD_INFER_PHASE_POST_COLLECTION,
+    .run = x86_64_vmalloc_base_bound_run,
+};
+
+KASLD_REGISTER_INFERENCE(x86_64_vmalloc_base_bound);

src/inference/x86_64_vmemmap_base_bound.c

@@ -0,0 +1,189 @@
+// This file is part of KASLD - https://github.com/bcoles/kasld
+//
+// Inference plugin: vmalloc_base + VMALLOC_SIZE_TB → vmemmap_base bounds
+// (POST_COLLECTION)
+//
+// On x86_64 with CONFIG_RANDOMIZE_MEMORY, kernel_randomize_memory() places
+// the three memory KASLR regions consecutively, each separated by a random
+// PUD-aligned gap of at least PUD_SIZE (1 GiB):
+//
+//   kaslr_regions[0]: directmap  — base = page_offset_base
+//                                  size = directmap_size_tb * 1 TiB
+//   kaslr_regions[1]: vmalloc    — base = page_offset_base + directmap_size_tb
+//                                         * 1 TiB + (>= PUD_SIZE)
+//                                  size = VMALLOC_SIZE_TB * 1 TiB
+//   kaslr_regions[2]: vmemmap    — base = vmalloc_base + VMALLOC_SIZE_TB
+//                                         * 1 TiB + (>= PUD_SIZE)
+//                                  size = directmap_size_tb * 64 / PAGE_SIZE
+//                                  TiB
+//
+// Therefore:
+//
+//   vmemmap_base_min = vmalloc_base_min + VMALLOC_SIZE_TB * 1 TiB + PUD_SIZE
+//   vmemmap_base_max = CPU_ENTRY_AREA_BASE − vmemmap_size
+//
+// This is a continuation of x86_64_vmalloc_base_bound.c — together the two
+// plugins chain page_offset_base → vmalloc_base → vmemmap_base via the
+// fixed inter-region ordering.
+//
+// VMALLOC_SIZE_TB:
+//   L4 paging: 32 TiB  (kernel constant VMALLOC_SIZE_TB_L4)
+//   L5 paging: 12800 TiB
+//   Detected via page_offset_min: < L4 VAS floor (0xffff800000000000) → L5,
+//   else L4.
+//
+// CPU_ENTRY_AREA_BASE: 0xfffffe0000000000 on both L4 and L5 (computed as
+// -4 << P4D_SHIFT where P4D_SHIFT = 39).
+//
+// vmemmap_size: derived from max_pfn read from /proc/zoneinfo:
+//   vmemmap_size = directmap_size_tb * 64 / 4096 TiB
+//   (each PAGE_SIZE page maps to a 64-byte struct page in vmemmap)
+//   Rounded up to whole TiB to match kernel_randomize_memory's vmemmap_size
+//   alignment.
+//
+// Source data: shared with x86_64_vmalloc_base_bound.c (max_pfn from
+// /proc/zoneinfo). Duplicate parse rather than introduce a shared helper —
+// keeps each plugin self-contained.
+//
+// Phase: POST_COLLECTION — requires vmalloc_base_min from
+//        x86_64_vmalloc_base_bound.c (which itself requires page_offset_min
+//        from directmap_page_offset_bounds / randomize_memory_page_offset /
+//        phys_virt_synth).
+// Applicable: x86-64 only.
+// ---
+// <bcoles@gmail.com>
+
+#define _POSIX_C_SOURCE 200809L
+
+#include "../include/kasld_inference.h"
+
+#include <limits.h>
+#include <stdio.h>
+
+#define TB_SHIFT 40
+#define PUD_SHIFT 30
+#define PAGE_SHIFT 12
+
+/* See x86_64_vmalloc_base_bound.c for the padding rationale. */
+#define RANDOMIZE_MEMORY_PHYSICAL_PADDING 10ul
+
+/* CPU_ENTRY_AREA_BASE = -4 << P4D_SHIFT = 0xfffffe0000000000 on x86-64
+ * (L4 and L5). Same value on both paging modes — the CPU_ENTRY_AREA_PGD
+ * slot is anchored relative to the top of canonical-high. */
+#define CPU_ENTRY_AREA_BASE 0xfffffe0000000000ul
+
+/* VMALLOC_SIZE_TB from arch/x86/include/asm/pgtable_64_types.h. */
+#define VMALLOC_SIZE_TB_L4 32ul
+#define VMALLOC_SIZE_TB_L5 12800ul
+
+/* The L4 vs L5 boundary: __PAGE_OFFSET_BASE_L4 is at 0xffff888000000000.
+ * Any page_offset below the L4 VAS start (0xffff800000000000) is L5. */
+#define X86_64_L4_VAS_START 0xffff800000000000ul
+
+/* Read max_pfn from /proc/zoneinfo (same logic as
+ * x86_64_vmalloc_base_bound.c — kept inline to avoid a shared helper). */
+static unsigned long read_max_pfn(void) {
+  FILE *f = fopen("/proc/zoneinfo", "r");
+  if (!f)
+    return 0;
+
+  char line[256];
+  unsigned long max_pfn = 0;
+  unsigned long cur_spanned = 0;
+
+  while (fgets(line, sizeof(line), f)) {
+    unsigned long val;
+    if (sscanf(line, " spanned %lu", &val) == 1) {
+      cur_spanned = val;
+      continue;
+    }
+    if (sscanf(line, "  start_pfn: %lu", &val) != 1)
+      continue;
+    unsigned long end_pfn = cur_spanned ? val + cur_spanned : val;
+    if (end_pfn > max_pfn)
+      max_pfn = end_pfn;
+    cur_spanned = 0;
+  }
+  fclose(f);
+  return max_pfn;
+}
+
+static void x86_64_vmemmap_base_bound_run(struct kasld_analysis_ctx *ctx) {
+#if defined(__x86_64__)
+  /* Needs vmalloc_base_min already pinned by x86_64_vmalloc_base_bound. */
+  if (ctx->vmalloc_base_min == 0)
+    return;
+
+  unsigned long pud_size = 1ul << PUD_SHIFT;
+  unsigned long one_tb = 1ul << TB_SHIFT;
+
+  /* Detect paging mode from page_offset_min: L5 if below L4 VAS floor. */
+  unsigned long vmalloc_size_tb =
+      (ctx->page_offset_min != 0 && ctx->page_offset_min < X86_64_L4_VAS_START)
+          ? VMALLOC_SIZE_TB_L5
+          : VMALLOC_SIZE_TB_L4;
+
+  /* ---- Lower bound on vmemmap_base ----
+   * vmemmap_base >= vmalloc_base + VMALLOC_SIZE_TB * 1 TiB + PUD_SIZE.
+   * Use vmalloc_base_min (the tightest lower bound we have). */
+  unsigned long lower =
+      ctx->vmalloc_base_min + vmalloc_size_tb * one_tb + pud_size;
+
+  /* Overflow / sanity: result must fit below CPU_ENTRY_AREA_BASE. */
+  if (lower <= ctx->vmalloc_base_min || lower >= CPU_ENTRY_AREA_BASE)
+    return;
+
+  if (lower > ctx->vmemmap_base_min) {
+    if (verbose && !quiet && !json_output)
+      printf("[infer] vmemmap_base_min: %#lx  "
+             "(vmalloc_base_min %#lx + %lu TiB vmalloc + 1 GiB gap)\n",
+             lower, ctx->vmalloc_base_min, vmalloc_size_tb);
+    ctx->vmemmap_base_min = lower;
+  }
+
+  /* ---- Upper bound on vmemmap_base ----
+   * vmemmap_base <= CPU_ENTRY_AREA_BASE − vmemmap_size.
+   * vmemmap_size matches the kernel's derivation:
+   *   vmemmap_size = round_up(directmap_size_tb * 64 / 4096, 1 TiB)
+   * Hardcoding the 64-byte struct page size — verifiable via vmlinux's
+   * CONFIG_MEMCG and tunable group config but defaulting reliably to 64
+   * on mainline since ~v6.0. */
+  unsigned long max_pfn = read_max_pfn();
+  if (max_pfn) {
+    unsigned long page_bytes = max_pfn << PAGE_SHIFT;
+    unsigned long memory_tb =
+        (page_bytes + one_tb - 1) / one_tb + RANDOMIZE_MEMORY_PHYSICAL_PADDING;
+    unsigned long directmap_size_tb = memory_tb < 4096ul ? memory_tb : 4096ul;
+
+    /* vmemmap_size_bytes = directmap_size_tb * 1 TiB * 64 / PAGE_SIZE
+     *                    = directmap_size_tb * (1 << 40) * 64 / (1 << 12)
+     *                    = directmap_size_tb * (1 << 34)  bytes
+     *                    = directmap_size_tb * 16 GiB.
+     * Round up to TiB granularity (kernel uses TB alignment). */
+    unsigned long vmemmap_size_bytes = directmap_size_tb * (1ul << 34);
+    unsigned long vmemmap_size_tb = (vmemmap_size_bytes + one_tb - 1) / one_tb;
+    /* At least 1 TiB to match the kernel's minimum alignment. */
+    if (vmemmap_size_tb == 0)
+      vmemmap_size_tb = 1;
+
+    unsigned long upper = CPU_ENTRY_AREA_BASE - vmemmap_size_tb * one_tb;
+    if (upper < ctx->vmemmap_base_max && upper > ctx->vmemmap_base_min) {
+      if (verbose && !quiet && !json_output)
+        printf("[infer] vmemmap_base_max: %#lx  "
+               "(CPU_ENTRY_AREA_BASE − %lu TiB vmemmap; max_pfn %lu)\n",
+               upper, vmemmap_size_tb, max_pfn);
+      ctx->vmemmap_base_max = upper;
+    }
+  }
+#else
+  (void)ctx;
+#endif
+}
+
+static const struct kasld_inference x86_64_vmemmap_base_bound = {
+    .name = "x86_64_vmemmap_base_bound",
+    .phase = KASLD_INFER_PHASE_POST_COLLECTION,
+    .run = x86_64_vmemmap_base_bound_run,
+};
+
+KASLD_REGISTER_INFERENCE(x86_64_vmemmap_base_bound);