arch: give the linear-map base one axis

PAGE_OFFSET was described by seven overlapping macros, and the one question
that matters to a component -- can THIS binary know the target's base? -- was
asked by none of them. DIRECTMAP_STATIC answers whether the base moves at
runtime, a property of the target kernel; a base can be perfectly static there
and still unknown here, which is the whole x86_32 / arm32 VMSPLIT case.

PAGE_OFFSET_CANDIDATES now states the set an architecture admits, with
PAGE_OFFSET_MIN / _MAX bracketing it and PAGE_OFFSET_KNOWN_AT_BUILD derived
from the two. VMSPLIT_PAGE_OFFSETS and HAVE_VMSPLIT_PAGE_OFFSET are retired;
vmsplit_text_base reads the one list and its gate resolves to the same
architecture as before.

The window is stated explicitly rather than reusing KERNEL_VIRT_VAS_START,
which had quietly acquired the job of naming the lowest split. It is not that
quantity: mips64 starts the kernel address space at 0x8000000000000000 with a
PAGE_OFFSET of 0xffffffff80000000, and loongarch64 and riscv64 are the same
shape. Reading it as the lowest split is right only on the arches that happen
to use it that way, this one included as of the module-band change.

No list on arm64 or riscv64. Their base is arm64_page_offset_for(va_bits), a
function of Q_VA_BITS, which is already a finite set -- a second list would be
two declarations obliged to agree, and riscv64's would have to track kernel
version as well, since SV39 alone has had two bases. The coupling rule stays
the single source of truth.

MIN / _MAX must be literals (they appear in #if arithmetic and static
initialisers, where an array cannot be indexed), so compile time can only
check that they bracket PAGE_OFFSET. The rest is a test that runs per-arch
under test-cross: the window is exactly the set's extremes, the compile-time
default is admissible, the list is descending and duplicate-free, and one
candidate is what KNOWN_AT_BUILD means.

Declarations only -- no behaviour change.

Author: bcoles

src/include/kasld/api.h

@@ -269,6 +269,63 @@ __extension__ _Static_assert((unsigned long)KERNEL_PHYS_MAX >
 #error "arch header must define TEXT_TRACKS_DIRECTMAP (0 or 1)"
 #endif
 
+/* ---- The linear-map base, as one axis ----------------------------------
+ *
+ * PAGE_OFFSET_MIN / PAGE_OFFSET_MAX bracket every linear-map base the
+ * architecture admits. Required of every arch, and stated as literals rather
+ * than derived: they appear in #if arithmetic and in static initialisers,
+ * where a candidate array cannot be indexed.
+ *
+ * They exist because KERNEL_VIRT_VAS_START had quietly acquired this second
+ * job, and it is not the same quantity. On mips64, loongarch64 and riscv64 the
+ * kernel address space STARTS far below the linear map — VAS_START
+ * 0x8000000000000000 against a PAGE_OFFSET of 0xffffffff80000000 on mips64 —
+ * so reading it as "the lowest split" is wrong there, and right elsewhere only
+ * by coincidence of which arches use it.
+ *
+ * PAGE_OFFSET_CANDIDATES is the complete set, highest first, declared ONLY
+ * where the base is a PRIMITIVE property of the build: a VMSPLIT choice, or an
+ * architectural constant. Deliberately absent where it is
+ *
+ *   DERIVED — arm64 and riscv64 compute it from the paging mode, which
+ *     Q_VA_BITS already models as a finite set. A second list there would be
+ *     two declarations obliged to agree, and riscv64's would additionally have
+ *     to track kernel version (SV39 alone has had two bases). The coupling
+ *     rule that maps one to the other is the single source of truth instead.
+ *
+ *   CONTINUOUS — x86_64 randomizes it (RANDOMIZE_MEMORY) and s390 shifts it;
+ *     there is no set to enumerate.
+ *
+ * PAGE_OFFSET_KNOWN_AT_BUILD answers the question none of the older axes did:
+ * can the ANALYSING BINARY know the target's linear-map base? That is distinct
+ * from DIRECTMAP_STATIC, which asks whether the base moves at RUNTIME — a
+ * property of the target kernel. A base can be perfectly static there and
+ * still unknown here, which is exactly the x86_32 / arm32 VMSPLIT case. */
+#ifndef PAGE_OFFSET_MIN
+#error                                                                         \
+    "arch header must define PAGE_OFFSET_MIN (lowest admissible linear-map base)"
+#endif
+#ifndef PAGE_OFFSET_MAX
+#error "arch header must define PAGE_OFFSET_MAX (highest admissible base)"
+#endif
+#if PAGE_OFFSET_MIN > PAGE_OFFSET_MAX
+#error "PAGE_OFFSET_MIN is above PAGE_OFFSET_MAX"
+#endif
+#if PAGE_OFFSET < PAGE_OFFSET_MIN || PAGE_OFFSET > PAGE_OFFSET_MAX
+#error "the compile-time PAGE_OFFSET falls outside [PAGE_OFFSET_MIN, _MAX]"
+#endif
+
+#ifdef PAGE_OFFSET_CANDIDATES
+#define PAGE_OFFSET_IS_FINITE 1
+#else
+#define PAGE_OFFSET_IS_FINITE 0
+#endif
+
+/* One admissible value means this binary knows the target's base. A finite set
+ * with more than one, or no set at all, means it does not. */
+#define PAGE_OFFSET_KNOWN_AT_BUILD                                             \
+  (PAGE_OFFSET_IS_FINITE && PAGE_OFFSET_MIN == PAGE_OFFSET_MAX)
+
 /* MODULES_RELATIVE_TO_PAGE_OFFSET is opt-in: an arch declares it 1 when its
  * module band is defined as a DELTA FROM PAGE_OFFSET rather than at fixed
  * addresses. Such an arch supplies MODULES_START_FOR(po) / MODULES_END_FOR(po)

src/include/kasld/arch/arm32.h

@@ -26,6 +26,12 @@
 #define PAGE_OFFSET 0xc0000000ul
 // VMSPLIT (CONFIG_PAGE_OFFSET) is a compile-time constant, fixed at boot.
 #define PAGE_OFFSET_FROM_CONFIG 1
+// Every linear-map base an arm32 kernel can be built with, highest first
+// (arch/arm/Kconfig: VMSPLIT_3G / 3G_OPT / 2G / 1G). arm32 has no 2G_OPT.
+#define PAGE_OFFSET_CANDIDATES                                                 \
+  {0xc0000000ul, 0xb0000000ul, 0x80000000ul, 0x40000000ul}
+#define PAGE_OFFSET_MIN 0x40000000ul
+#define PAGE_OFFSET_MAX 0xc0000000ul
 
 // The runtime PAGE_OFFSET is one of the VMSPLIT boundaries (arch/arm/Kconfig:
 // VMSPLIT_3G / 3G_OPT / 2G / 1G), listed high→low for snap-down. arm32 has no
@@ -35,9 +41,6 @@
 // vmsplit_text_base engine rule. The 0xc0000000 default above is only the
 // render fallback when no virtual text address is observed.
 // https://elixir.bootlin.com/linux/v6.1.1/source/arch/arm/Kconfig#L1116
-#define HAVE_VMSPLIT_PAGE_OFFSET 1
-#define VMSPLIT_PAGE_OFFSETS                                                   \
-  {0xc0000000ul, 0xb0000000ul, 0x80000000ul, 0x40000000ul}
 
 // https://elixir.bootlin.com/linux/v6.1.1/source/arch/arm/Kconfig#L276
 #define PHYS_OFFSET 0ul

src/include/kasld/arch/arm64.h

@@ -44,6 +44,12 @@
 // https://elixir.bootlin.com/linux/v6.12/source/arch/arm64/include/asm/memory.h#L44
 // We assume 52 va bits (broadest, covers all configs):
 #define PAGE_OFFSET 0xfff0000000000000ul
+
+// Derived from the paging mode: PAGE_OFFSET is -(1 << VA_BITS), so the
+// window spans VA_BITS 52 (lowest base) to 39 (highest). Q_VA_BITS carries
+// the finite set; arm64_page_offset_from_va_bits maps one to the other.
+#define PAGE_OFFSET_MIN PAGE_OFFSET
+#define PAGE_OFFSET_MAX 0xffffff8000000000ul
 #define PHYS_OFFSET 0ul
 
 // VA_BITS candidates for Q_VA_BITS (finite-set lattice), smallest first. Each

src/include/kasld/arch/loongarch64.h

@@ -41,6 +41,11 @@
 // Unlocks text_base_coupling_synth (it needs Q_PAGE_OFFSET pinned to
 // propagate Q_VIRT_IMAGE_BASE ↔ Q_PHYS_IMAGE_BASE).
 #define PAGE_OFFSET_INVARIANT 1
+// The DMW1 direct-mapped window base, fixed by the architecture. Above
+// KERNEL_VIRT_VAS_START (0x8000000000000000), as on mips64.
+#define PAGE_OFFSET_CANDIDATES {0x9000000000000000ul}
+#define PAGE_OFFSET_MIN 0x9000000000000000ul
+#define PAGE_OFFSET_MAX 0x9000000000000000ul
 
 // XKPRANGE starts at 0x8000000000000000 (hardware direct map windows DMW0/1/2).
 // XKVRANGE starts at 0xc000000000000000 (vmalloc, modules, vmemmap).

src/include/kasld/arch/mips32.h

@@ -27,6 +27,10 @@
 #define PAGE_OFFSET 0x80000000ul
 // CKSEG0 is fixed by the MIPS32 ISA — virt_page_offset cannot vary at runtime.
 #define PAGE_OFFSET_INVARIANT 1
+// KSEG0, fixed by the MIPS ISA.
+#define PAGE_OFFSET_CANDIDATES {0x80000000ul}
+#define PAGE_OFFSET_MIN 0x80000000ul
+#define PAGE_OFFSET_MAX 0x80000000ul
 
 // https://elixir.bootlin.com/linux/v6.1.1/source/arch/mips/include/asm/mach-generic/spaces.h#L28
 #define PHYS_OFFSET 0ul

src/include/kasld/arch/mips64.h

@@ -18,6 +18,12 @@
 #define PAGE_OFFSET 0xffffffff80000000ul
 // CKSEG0 is fixed by the MIPS ISA — virt_page_offset cannot vary at runtime.
 #define PAGE_OFFSET_INVARIANT 1
+// CKSEG0, fixed by the MIPS ISA. Note this sits far ABOVE
+// KERNEL_VIRT_VAS_START (0x8000000000000000) -- the kernel address space
+// begins well below the linear map here.
+#define PAGE_OFFSET_CANDIDATES {0xffffffff80000000ul}
+#define PAGE_OFFSET_MIN 0xffffffff80000000ul
+#define PAGE_OFFSET_MAX 0xffffffff80000000ul
 
 // https://elixir.bootlin.com/linux/v6.1.1/source/arch/mips/include/asm/mach-generic/spaces.h#L28
 #define PHYS_OFFSET 0ul

src/include/kasld/arch/ppc32.h

@@ -31,6 +31,13 @@
 #define DIRECTMAP_STATIC 1
 #define TEXT_TRACKS_DIRECTMAP 1
 #define PAGE_OFFSET_INVARIANT 1
+// One value in practice. arch/powerpc/Kconfig does expose a prompt for it
+// (PAGE_OFFSET_BOOL, under ADVANCED_OPTIONS) and two in-tree 85xx defconfigs
+// use it, so this set is narrower than the architecture strictly allows --
+// see the PAGE_OFFSET_INVARIANT entry in dev/TODO.md.
+#define PAGE_OFFSET_CANDIDATES {0xc0000000ul}
+#define PAGE_OFFSET_MIN 0xc0000000ul
+#define PAGE_OFFSET_MAX 0xc0000000ul
 
 #define KERNEL_VIRT_VAS_START PAGE_OFFSET
 #define KERNEL_VIRT_VAS_END 0xfffffffful

src/include/kasld/arch/ppc64.h

@@ -25,6 +25,11 @@
 // book3s64 linear-mapping base is architecturally fixed (not
 // user-configurable).
 #define PAGE_OFFSET_INVARIANT 1
+// book3s64 linear-mapping base. arch/powerpc/Kconfig declares it under
+// `if PPC64` as a hex with no prompt, so it cannot be configured.
+#define PAGE_OFFSET_CANDIDATES {0xc000000000000000ul}
+#define PAGE_OFFSET_MIN 0xc000000000000000ul
+#define PAGE_OFFSET_MAX 0xc000000000000000ul
 
 // https://elixir.bootlin.com/linux/v6.1.1/source/arch/powerpc/include/asm/page.h#L227
 #define PHYS_OFFSET 0ul

src/include/kasld/arch/riscv32.h

@@ -29,6 +29,11 @@
 #define DIRECTMAP_STATIC 1
 #define TEXT_TRACKS_DIRECTMAP 1
 #define PAGE_OFFSET_INVARIANT 1
+// Hard-coded in arch/riscv/include/asm/page.h for 32-bit MMU builds; riscv
+// has no CONFIG_PAGE_OFFSET for rv32, so there is nothing to vary.
+#define PAGE_OFFSET_CANDIDATES {0xc0000000ul}
+#define PAGE_OFFSET_MIN 0xc0000000ul
+#define PAGE_OFFSET_MAX 0xc0000000ul
 
 #define KERNEL_VIRT_VAS_START PAGE_OFFSET
 #define KERNEL_VIRT_VAS_END 0xfffffffful

src/include/kasld/arch/riscv64.h

@@ -42,6 +42,13 @@
 // https://elixir.bootlin.com/linux/v6.12/source/arch/riscv/include/asm/page.h
 #define PAGE_OFFSET 0xff60000000000000ul
 
+// Derived from the paging mode AND the kernel version: SV57/SV48/SV39 each
+// have a base, SV39 has had two across releases, and the pre-v5.10 layout
+// adds RISCV_LEGACY_PAGE_OFFSET at the top. Q_VA_BITS carries the mode; no
+// second list is declared here for the same reason as arm64.
+#define PAGE_OFFSET_MIN 0xff60000000000000ul
+#define PAGE_OFFSET_MAX RISCV_LEGACY_PAGE_OFFSET
+
 // Physical RAM base (platform-dependent; 0x80000000 for QEMU virt, SiFive,
 // etc.)
 #define PHYS_OFFSET 0x80000000ul