arch: state the 32-bit module bands as the union over splits

kasld_addr_is_module_band() is enforced inside each component, before the
engine has resolved anything, so the static MODULES_START/END must be the
union the arch-header CONTRACT asks for -- not the band this binary's own
default would have. Two arches instantiated it at the compile-time split.

x86_32 stated a literal 0xf0000000. The kernel has no fixed module region:
MODULES_VADDR is VMALLOC_START, which is PAGE_OFFSET plus the runtime lowmem
span plus 8 MiB. That literal is correct only on a 3G split carrying more than
~760 MiB of lowmem; a 512 MiB VM puts the real floor at ~0xe0800000 and every
module address was discarded below it. Booted on the i686 cell at mem=512M the
band now projects to 0xc0800000, under the truth rather than over it.

arm32 had two. The floor was the 3G instance, leaving a VMSPLIT_1G kernel's
modules a full 512 MiB below the band. The ceiling was PAGE_OFFSET, which
describes only the dedicated window: CONFIG_ARM_MODULE_PLTS is default y and
spills overflow into [VMALLOC_START, VMALLOC_END] above PAGE_OFFSET, so the
ordinary configuration -- not an exotic one -- allocated modules the band
rejected. Same shape as the ppc32 platform split.

The rule is now enforced rather than described: the static macros must equal
the relation applied to KERNEL_VIRT_VAS_START, the lowest admissible split on
every arch in scope. An inequality would have passed on the code being fixed
here, since the wrong instantiation is spelled almost exactly like the right
one. ppc32 and riscv32 change spelling only -- their split cannot move, so the
two arguments coincide.

x86_32 is the first arch whose relation ADDS to PAGE_OFFSET, which the wrap
guards read as a wrapped floor and rejected. Both now test the direction the
relation actually moves, folded at compile time. test-cross caught this.

Author: bcoles

docs/kaslr.md

@@ -299,15 +299,15 @@ KASLD quantity (`Q_*`) that resolves each region annotated alongside it:
 | Architecture | Text ↔ Phys | Text ↔ Direct map | Text ↔ Modules | Notes |
 |---|---|---|---|---|
 | x86_64 | Independent | Independent | Independent | Three separate randomizations (`CONFIG_RANDOMIZE_MEMORY`) |
-| x86_32 | Coupled | Coupled | Fixed module region | Single KASLR offset |
+| x86_32 | Coupled | Coupled | Tracks lowmem, not text | Single KASLR offset; the module region starts at `VMALLOC_START`, which is `PAGE_OFFSET` plus the runtime lowmem size plus 8 MiB |
 | arm64 | Independent | Independent | Bracketed (within 2 GiB of text) | Separate phys/virt randomization; modules drawn from a window spanning the kernel image, so they move with it |
-| arm32 | — | Coupled | Fixed (PAGE_OFFSET - 16M) | No KASLR |
+| arm32 | — | Coupled | Below PAGE_OFFSET, spills to vmalloc | No KASLR; a dedicated 16 MiB window below `PAGE_OFFSET`, with `CONFIG_ARM_MODULE_PLTS` (default y) spilling overflow into vmalloc above it |
 | MIPS32/64 | Coupled | Coupled (kseg0) | Fixed module region | Hardware-defined mapping |
-| PowerPC32 | Coupled | Coupled | Fixed (PAGE_OFFSET - 256M) | |
+| PowerPC32 | Coupled | Coupled | Platform-dependent | A dedicated window below `PAGE_OFFSET` on 8xx / book3s32; every other platform, 85xx included, allocates from the shared vmalloc window |
 | PowerPC64 | — | Coupled | Shared VAS | No KASLR |
 | LoongArch64 | Coupled | Coupled | Fixed module region | Direct-mapped windows |
 | RISC-V64 | Virtual only | Decoupled | Coupled (shifts with kernel) | Module region anchored to kernel `_end`; text ↔ directmap coupled on legacy pre-v5.10 kernels (no KASLR) |
-| RISC-V32 | — | Coupled | Same as PAGE_OFFSET | No KASLR |
+| RISC-V32 | — | Coupled | Below PAGE_OFFSET (vmalloc) | No KASLR; modules share the vmalloc window, which on sv32 is the 512 MiB below `PAGE_OFFSET` |
 
 On coupled architectures, all sections are at fixed offsets from each other:
 a physical address reveals the virtual text base via

src/include/kasld/api.h

@@ -271,13 +271,25 @@ __extension__ _Static_assert((unsigned long)KERNEL_PHYS_MAX >
 
 /* MODULES_RELATIVE_TO_PAGE_OFFSET is opt-in: an arch declares it 1 when its
  * module band is defined as a DELTA FROM PAGE_OFFSET rather than at fixed
- * addresses. The compile-time MODULES_START/END then encode nothing but the
- * band's position under the compile-time PAGE_OFFSET, and an arch whose
- * PAGE_OFFSET moves at runtime (arm32 VMSPLIT) leaves them pointing at a place
- * the modules are not. Such an arch also supplies MODULES_START_FOR(po) /
- * MODULES_END_FOR(po) -- the same arithmetic parameterised on PAGE_OFFSET -- so
- * the orchestrator can re-derive the band once the engine resolves it, and so
- * the static macros cannot drift from the relation they are an instance of.
+ * addresses. Such an arch supplies MODULES_START_FOR(po) / MODULES_END_FOR(po)
+ * -- the same arithmetic parameterised on PAGE_OFFSET -- so the orchestrator
+ * can re-derive the band once the engine resolves it, and so the static macros
+ * cannot drift from the relation they are an instance of.
+ *
+ * WHICH INSTANCE: the static MODULES_START/END must apply the relation at the
+ * LOWEST PAGE_OFFSET the arch admits, not at the compile-time one. The two
+ * differ wherever the split is a build choice the analysing binary cannot see
+ * (arm32 and x86_32 VMSPLIT), and there the compile-time instance is a band
+ * this binary's own default would have -- not the union the CONTRACT above
+ * requires. It matters because the static macros are what
+ * kasld_addr_is_module_band() enforces INSIDE each component, which runs
+ * before the engine has resolved anything: a band drawn at the wrong split
+ * discards every genuine module address at the source, and the orchestrator's
+ * re-derivation comes too late to recover it. On every arch in scope the
+ * lowest admissible split is KERNEL_VIRT_VAS_START, so that is the argument to
+ * instantiate with; where PAGE_OFFSET cannot move the two coincide and the
+ * choice is a no-op. The assertions below hold the property rather than the
+ * spelling.
  *
  * Both accessors must stay integer CONSTANT EXPRESSIONS when applied to the
  * compile-time PAGE_OFFSET: MODULES_START/END appear in static initialisers and
@@ -296,6 +308,20 @@ __extension__ _Static_assert((unsigned long)KERNEL_PHYS_MAX >
 #if MODULES_RELATIVE_TO_TEXT
 #error "module band cannot follow both PAGE_OFFSET and the text base"
 #endif
+/* The union-vs-instance rule, enforced rather than merely documented: writing
+ * the floor as the relation applied to the compile-time PAGE_OFFSET is the
+ * mistake, and it is spelled almost identically to the correct form, so the
+ * check has to be equality against the right argument. Both accessors are
+ * monotone in PAGE_OFFSET, so this also fixes the floor as the widest the
+ * relation can produce, whether it adds to PAGE_OFFSET or subtracts from it.
+ * An arch needing a wider band widens the RELATION, which keeps the static
+ * macros and the runtime projection describing the same geometry. */
+#if MODULES_START != MODULES_START_FOR(KERNEL_VIRT_VAS_START)
+#error "MODULES_START must instantiate the relation at the lowest split"
+#endif
+#if MODULES_END < MODULES_END_FOR(PAGE_OFFSET)
+#error "MODULES_END is below the band's own ceiling at the compile-time split"
+#endif
 #endif
 
 /* MODULES_BRACKET_TEXT is opt-in: an arch declares it as a byte size W when
@@ -698,6 +724,30 @@ static inline int kasld_addr_in_range(unsigned long long addr,
   return addr >= lo && addr <= hi;
 }
 
+#if MODULES_RELATIVE_TO_PAGE_OFFSET
+/* Guard for projecting the module band onto a resolved PAGE_OFFSET.
+ *
+ * MODULES_START_FOR either adds to PAGE_OFFSET or subtracts from it, so the
+ * arithmetic can wrap at whichever end of the address space it moves toward: a
+ * subtracting relation underflows past 0 when the split reaches the lowest one
+ * admissible, an adding relation overflows past ULONG_MAX. Both present the
+ * same way -- the projected floor lands on the far side of the PAGE_OFFSET it
+ * was derived from. Which side that is depends only on the relation, so the
+ * test is a compile-time constant and folds away.
+ *
+ * A wrapped floor is rejected, never clamped: on an arch that carves the band
+ * out of the address space below PAGE_OFFSET, clamping to the bottom of the
+ * kernel VAS collapses the band onto a point and rejects every genuine module
+ * leak. */
+static inline int kasld_module_band_floor_sane(unsigned long po,
+                                               unsigned long floor) {
+  return ((unsigned long)MODULES_START_FOR((unsigned long)PAGE_OFFSET) <=
+          (unsigned long)PAGE_OFFSET)
+             ? floor <= po
+             : floor >= po;
+}
+#endif
+
 /* Predicate: is `va` plausibly inside the kernel module BAND on this arch?
  *
  * Wraps the MODULES_START/END validation union (see the CONTRACT in the

src/include/kasld/arch/arm32.h

@@ -65,17 +65,33 @@
 // Above this, addresses fall in the vectors/fixmap region.
 #define KERNEL_VIRT_TEXT_MAX 0xf0000000ul
 
-// Modules are located below kernel: PAGE_OFFSET - 16MiB (0x01000000)
-// https://elixir.bootlin.com/linux/v6.1.1/source/arch/arm/include/asm/memory.h#L51
-// Stated as a relation to PAGE_OFFSET, not as fixed addresses: VMSPLIT chooses
-// PAGE_OFFSET at build time and the band moves with it, so the compile-time
-// instance below is only where the modules sit under THIS binary's default.
-// MODULES_RELATIVE_TO_PAGE_OFFSET lets the orchestrator re-derive the band once
-// the engine resolves the running kernel's PAGE_OFFSET.
+// arm32 gives modules a dedicated window immediately below the linear map:
+// MODULES_VADDR is PAGE_OFFSET - 16 MiB (8 MiB on a Thumb-2 kernel, whose
+// relocations reach less far, so the 16 MiB floor covers both), and
+// MODULES_END is PAGE_OFFSET, or one PMD below it under CONFIG_HIGHMEM.
+//
+// That window is not the whole story. CONFIG_ARM_MODULE_PLTS -- `default y`,
+// so this is the ordinary case rather than an exotic one -- gives the
+// allocator a fallback of [VMALLOC_START, VMALLOC_END] for modules that no
+// longer fit, reached via PLT veneers (arch/arm/mm/init.c execmem_arch_setup).
+// VMALLOC_START derives from runtime high_memory and therefore lies ABOVE
+// PAGE_OFFSET, so a band that stops at PAGE_OFFSET describes only the first
+// window and rejects every module that spilled into the second. VMALLOC_END is
+// 0xff800000, but a band is the union over what a kernel MIGHT do, and
+// CONFIG_XIP_KERNEL re-points MODULES_VADDR at the execute-in-place ROM
+// entirely -- so the ceiling is the top of the address space.
+//
+// The floor is the only PAGE_OFFSET relation of the two, and it is
+// instantiated at the lowest admissible split rather than this binary's:
+// VMSPLIT is a build choice of the kernel under analysis, and
+// kasld_addr_is_module_band() runs inside components, before the engine has
+// resolved which split that kernel used.
+// https://elixir.bootlin.com/linux/v7.2/source/arch/arm/include/asm/memory.h
+// https://elixir.bootlin.com/linux/v7.2/source/arch/arm/mm/init.c
 #define MODULES_RELATIVE_TO_PAGE_OFFSET 1
 #define MODULES_START_FOR(po) ((po) - 0x01000000ul)
-#define MODULES_END_FOR(po) (po)
-#define MODULES_START MODULES_START_FOR(PAGE_OFFSET) // 0xbf000000ul
+#define MODULES_END_FOR(po) (KERNEL_VIRT_VAS_END)
+#define MODULES_START MODULES_START_FOR(KERNEL_VIRT_VAS_START) // 0x3f000000ul
 #define MODULES_END MODULES_END_FOR(PAGE_OFFSET)
 // Module region is fixed below PAGE_OFFSET; does not shift with KASLR.
 #define MODULES_RELATIVE_TO_TEXT 0

src/include/kasld/arch/ppc32.h

@@ -66,7 +66,9 @@
 #define MODULES_RELATIVE_TO_PAGE_OFFSET 1
 #define MODULES_START_FOR(po) ((po) - 0x10000000ul)
 #define MODULES_END_FOR(po) (KERNEL_VIRT_VAS_END)
-#define MODULES_START MODULES_START_FOR(PAGE_OFFSET) // 0xb0000000ul
+// Instantiated at the lowest admissible split, per the union rule in api.h;
+// ppc32 has only one, so this is PAGE_OFFSET spelled as the rule requires.
+#define MODULES_START MODULES_START_FOR(KERNEL_VIRT_VAS_START) // 0xb0000000ul
 #define MODULES_END MODULES_END_FOR(PAGE_OFFSET)
 #define MODULES_RELATIVE_TO_TEXT 0
 

src/include/kasld/arch/riscv32.h

@@ -57,7 +57,9 @@
 #define MODULES_RELATIVE_TO_PAGE_OFFSET 1
 #define MODULES_START_FOR(po) ((po) - 0x20000000ul)
 #define MODULES_END_FOR(po) (po)
-#define MODULES_START MODULES_START_FOR(PAGE_OFFSET)
+// Instantiated at the lowest admissible split, per the union rule in api.h;
+// riscv32 has only one, so this is PAGE_OFFSET spelled as the rule requires.
+#define MODULES_START MODULES_START_FOR(KERNEL_VIRT_VAS_START)
 #define MODULES_END MODULES_END_FOR(PAGE_OFFSET)
 #define MODULES_RELATIVE_TO_TEXT 0
 

src/include/kasld/arch/x86_32.h

@@ -56,13 +56,40 @@
 // configurations. The orchestrator adjusts at runtime once vmsplit is detected.
 #define KERNEL_VIRT_VAS_START KERNEL_VIRT_TEXT_MIN
 #define KERNEL_VIRT_VAS_END 0xfffffffful
-// Above this, addresses fall in the module/fixmap region.
+// Kernel text ceiling, and a deliberate over-estimate rather than a region
+// boundary: the image sits within KERNEL_IMAGE_SIZE (512 MiB) of PAGE_OFFSET,
+// so even the highest split puts it no higher than 0xe0000000. What lies above
+// the image is the rest of the linear map, whose top is the runtime lowmem
+// size -- there is no fixed address at which the module region begins.
 #define KERNEL_VIRT_TEXT_MAX 0xf0000000ul
 
-// Modules placed in high memory above kernel text.
-// https://elixir.bootlin.com/linux/v6.1.1/source/arch/x86/kernel/module.c
-#define MODULES_START 0xf0000000ul
-#define MODULES_END 0xfffffffful
+// x86_32 has no module region at a fixed address. MODULES_VADDR is
+// VMALLOC_START, which is `high_memory + VMALLOC_OFFSET` (8 MiB), and
+// high_memory is PAGE_OFFSET plus the span of lowmem:
+//
+//   MODULES_VADDR = PAGE_OFFSET + lowmem_span + 8 MiB
+//
+// Two runtime terms, and only the first is a PAGE_OFFSET relation. The lowmem
+// span is a property of how much RAM the machine has (capped by MAXMEM), which
+// nothing here observes, so the floor states the limit it approaches as that
+// span goes to zero: PAGE_OFFSET + 8 MiB. Sound under the older definition
+// too, which rounded down to an 8 MiB boundary -- every admissible PAGE_OFFSET
+// is already 8 MiB-aligned, so the rounding cannot land below.
+//
+// The ceiling is VMALLOC_END, which moves with NR_CPUS through
+// CPU_ENTRY_AREA_PAGES and is no more a compile-time constant than the floor,
+// so it is the top of the address space.
+//
+// A band stated as a literal cannot hold here: the floor is correct only for a
+// 3G split carrying more than ~760 MiB of lowmem, and drops below any fixed
+// value on a smaller machine or a lower split.
+// https://elixir.bootlin.com/linux/v7.2/source/arch/x86/include/asm/pgtable_32_areas.h
+// https://elixir.bootlin.com/linux/v7.2/source/arch/x86/mm/init_32.c
+#define MODULES_RELATIVE_TO_PAGE_OFFSET 1
+#define MODULES_START_FOR(po) ((po) + 0x00800000ul)
+#define MODULES_END_FOR(po) (KERNEL_VIRT_VAS_END)
+#define MODULES_START MODULES_START_FOR(KERNEL_VIRT_VAS_START) // 0x40800000ul
+#define MODULES_END MODULES_END_FOR(PAGE_OFFSET)
 // Module region is fixed; does not shift with KASLR.
 #define MODULES_RELATIVE_TO_TEXT 0
 

src/orchestrator.c

@@ -3960,16 +3960,14 @@ static void engine_sync_authoritative(const struct engine *e) {
     if (po->lo && po->lo <= po->hi && (pinned || default_excluded)) {
       unsigned long lo = MODULES_START_FOR(po->lo);
       unsigned long hi = MODULES_END_FOR(po->hi);
-      /* MODULES_START_FOR subtracts, so a PAGE_OFFSET window reaching down to
-       * the lowest admissible split can wrap the floor past 0 and leave it
-       * near ULONG_MAX. Reject a wrapped floor; do NOT clamp it to
-       * KERNEL_VIRT_VAS_START. On every arch that carves the module band out
-       * of vmalloc the band legitimately sits BELOW PAGE_OFFSET, and on those
-       * KERNEL_VIRT_VAS_START *is* PAGE_OFFSET -- clamping there would discard
-       * the whole band and reject every genuine module leak, the exact failure
-       * the union contract above exists to prevent. Same wrap test that
+      /* Reject a wrapped floor; do NOT clamp it to KERNEL_VIRT_VAS_START. On
+       * every arch that carves the module band out of vmalloc the band
+       * legitimately sits BELOW PAGE_OFFSET, and on those KERNEL_VIRT_VAS_START
+       * *is* PAGE_OFFSET -- clamping there would discard the whole band and
+       * reject every genuine module leak, the exact failure the union contract
+       * above exists to prevent. Same wrap test that
        * rules/module_base_bounds.c applies to these edges. */
-      if (lo <= po->lo && hi > lo) {
+      if (kasld_module_band_floor_sane(po->lo, lo) && hi > lo) {
         mod_union_lo = lo;
         mod_union_hi = hi;
         layout.modules_start = lo;

src/rules/module_base_bounds.c

@@ -127,9 +127,9 @@ int rule_module_base_bounds(const struct evidence_set *ev,
     if (po->lo && po->hi && po->lo <= po->hi) {
       unsigned long band_lo = (unsigned long)MODULES_START_FOR(po->lo);
       unsigned long band_hi = (unsigned long)MODULES_END_FOR(po->hi);
-      /* MODULES_START_FOR subtracts, so guard the wrap a low PAGE_OFFSET
-       * would produce rather than emitting a floor near ULONG_MAX. */
-      if (band_lo <= po->lo && n < out_max)
+      /* Guard the wrap an extreme PAGE_OFFSET would produce rather than
+       * emitting a floor at the wrong end of the address space. */
+      if (kasld_module_band_floor_sane(po->lo, band_lo) && n < out_max)
         mbb_emit(&out[n++], C_LOWER_BOUND, band_lo, 0);
       if (band_hi >= po->hi && n < out_max)
         mbb_emit(&out[n++], C_UPPER_BOUND, band_hi, 0);

tests/test_kasld.c

@@ -1920,12 +1920,12 @@ static void test_engine_sync_module_band_follows_page_offset(void) {
    * KERNEL_VIRT_VAS_START. Arches that carve the module band out of vmalloc
    * put it below PAGE_OFFSET, and on those KERNEL_VIRT_VAS_START *is*
    * PAGE_OFFSET -- clamping there would collapse the band and reject every
-   * genuine module leak. Only a wrapped floor (a PAGE_OFFSET window reaching
-   * below the band's own width) is rejected, and `moved` is above the
-   * compile-time PAGE_OFFSET so it cannot wrap here. */
+   * genuine module leak. Only a wrapped floor is rejected, and `moved` sits
+   * well inside the address space, so the relation cannot wrap here whether it
+   * adds to PAGE_OFFSET or subtracts from it. */
   unsigned long want_lo = MODULES_START_FOR(moved);
   unsigned long want_hi = MODULES_END_FOR(moved);
-  assert(want_lo <= moved); /* no wrap in this fixture */
+  assert(kasld_module_band_floor_sane(moved, want_lo)); /* no wrap here */
   assert(want_hi > want_lo);
   assert(layout.modules_start == want_lo);
   assert(layout.modules_end == want_hi);