fixtures: recover _text truth where kallsyms withholds it

mips exports only _stext, at any privilege, so a capture from a mips kernel
carries no truth for the quantity kasld solves and validate-bundle reports
N/A. The booted image carries both symbols, and the gap between them is this
build's fact: runtime _text = runtime _stext - (link _stext - link _text).
tests/vm/run records that into the capture's meta.txt, and validate-bundle
reads it when the sysroot has none, printing the stated source beside it.

The truth has to come from the image. Reconstructing _text from the physical
address in /proc/iomem needs PAGE_OFFSET, which cancels against the window the
truth is checked against, leaving a comparison that holds for any kernel ever
built — a check that cannot fail reports as coverage. STEXT_OFFSET is no good
either: a per-arch fallback constant, not this build's fact. Verified against
kbuild-mips-mainline-7.0: 0x80100000 recovered from _stext 0x80100400,
matching System.map, and nothing recorded when the image is stripped or when
kallsyms already exports _text.

Only the low word reaches shell arithmetic. /bin/sh is dash, whose $(( )) is
intmax_t and silently yields 0 for any value above INTMAX_MAX — which every
mips64 kernel address is.

A cell's variant now reaches the fixture id. It was <distro>-<release> alone,
so armv7-mainline-7.0-vmsplit2g and armv7-mainline-7.0 resolved to the same
directory, which the capture rm -rf's first: whichever cell ran last was
silently the one kept, and the same held for the aarch64 va39/va42 pair.
Default cells keep their ids, so nothing is renamed and a re-run is idempotent.

Author: bcoles

extra/validate-bundle

@@ -328,6 +328,7 @@ IM=$BUNDLE/sysroot/proc/iomem
 truth_stext=""
 truth_text=""
 truth_end=""
+truth_text_src=""
 if [ -s "$KS" ]; then
   truth_stext=$(awk '$3 == "_stext"      { print $1 }' "$KS")
   truth_text=$(awk  '$3 == "_text"       { print $1 }' "$KS")
@@ -339,6 +340,42 @@ if [ -s "$KS" ]; then
     0000000000000000|00000000|"") truth_text="" ;;
   esac
 fi
+# A capture may record the runtime _text directly, for kernels that do not
+# export it in kallsyms -- mips exports only _stext, at any privilege, so no
+# amount of root recovers it from that file. The recording harness reads it from
+# the booted kernel's own symbol table.
+#
+# It must come from the kernel's symbols and NOT be reconstructed from an
+# address KASLD reports. The window this truth is checked against is built from
+# the same arch constants a reconstruction would use -- project the physical
+# _text from iomem through PAGE_OFFSET, say, and PAGE_OFFSET cancels against a
+# window anchored on it, leaving a comparison that holds for any kernel ever
+# built. A truth that cannot fail is worse than no truth: it reports as coverage.
+#
+# So the field is trusted only as far as its stated source, which is printed
+# beside it.
+if [ -z "$truth_text" ] && [ -s "$BUNDLE/meta.txt" ]; then
+  _oob=$(awk -F: '/^truth_virt_text:/ { gsub(/[ \t]/, "", $2); print $2 }' \
+    "$BUNDLE/meta.txt" 2>/dev/null | head -1)
+  case "$_oob" in
+  0x* | 0X*) _oob=${_oob#0[xX]} ;;
+  esac
+  case "$_oob" in
+  "" | *[!0-9a-fA-F]*) : ;;
+  *)
+    case "$_oob" in
+    *[1-9a-fA-F]*)
+      truth_text=$_oob
+      truth_text_src=$(awk -F: '/^truth_virt_text_source:/ {
+                         sub(/^[^:]*:[ \t]*/, ""); print }' "$BUNDLE/meta.txt" 2>/dev/null |
+        head -1)
+      [ -n "$truth_text_src" ] || truth_text_src="source not stated"
+      ;;
+    esac
+    ;;
+  esac
+fi
+
 # _text is the quantity kasld solves and the one its windows bound. _stext is a
 # DIFFERENT symbol: it sits a per-arch head gap above _text -- 0x400 on mips,
 # 0x10000 on arm64, 0x20000 on loongarch64 -- and coincides with it only where
@@ -348,8 +385,11 @@ fi
 # against a _text answer, which reads as an off-by-head-gap mismatch on exactly
 # the arches whose kallsyms exports only _stext (mips does: every recorded boot
 # has _stext and no _text). Where the gap is zero the two genuinely are one
-# address, and that case is restored below; the rest is checked against kasld's
-# own _stext projection instead.
+# address, and that case is restored below. Where it is not, the virtual check
+# needs the recorded truth above; without it the bundle reports N/A, which is the
+# honest answer -- nothing here reconstructs _text from _stext, because the gap
+# is a per-build property and STEXT_OFFSET is a fallback constant, not this
+# build's fact.
 truth_vtext=$truth_text
 [ -n "$truth_vtext" ] && truth_vtext=$(hex16 "$truth_vtext")
 [ -n "$truth_stext" ] && truth_stext=$(hex16 "$truth_stext")
@@ -377,7 +417,9 @@ fi
 echo
 
 printf '%sGround truth:%s\n' "$BOLD" "$RESET"
-if [ -n "$truth_vtext" ]; then
+if [ -n "$truth_vtext" ] && [ -n "$truth_text_src" ]; then
+  printf '  virt _text  = 0x%s  (recorded: %s)\n' "$truth_vtext" "$truth_text_src"
+elif [ -n "$truth_vtext" ]; then
   printf '  virt _text  = 0x%s\n' "$truth_vtext"
 elif [ -n "$truth_stext" ]; then
   printf '  virt _text  = %s(kallsyms exports _stext 0x%s, not _text)%s\n' \

tests/vm/run

@@ -303,6 +303,57 @@ region_verdict() {
 # verdict <log>: prints "PASS|FAIL|N/A  <detail>" and returns 0 only on PASS/NA.
 # Gates on BOTH axes: the virtual text base AND (on decoupled arches) the physical
 # image base must lie inside their resolved windows.
+# Runtime _text truth for a kernel that does not export _text through kallsyms.
+#
+# mips exports only _stext, at any privilege, so a capture from one carries no
+# truth for the quantity kasld solves. The image that was booted carries both
+# symbols, and the gap between them is this build's fact: runtime _text =
+# runtime _stext - (link _stext - link _text).
+#
+# It has to come from the image. Reconstructing _text from the physical address
+# in /proc/iomem would need PAGE_OFFSET, which cancels against the window the
+# truth is later checked against -- leaving a comparison that holds for any
+# kernel ever built. STEXT_OFFSET is no good either: a per-arch fallback
+# constant, not this build's fact.
+#
+# Only the low word reaches the shell. Arithmetic here is intmax_t, and every
+# mips64 kernel address is above INTMAX_MAX, where dash silently yields 0 --
+# so the halves are compared as strings and only the low 32 bits are subtracted.
+hex_gap() {
+  _ga=$(printf '%s' "$1" | tr 'A-F' 'a-f')
+  _gb=$(printf '%s' "$2" | tr 'A-F' 'a-f')
+  # A 32-bit address is exactly the low word, so the high half is empty -- that
+  # is a valid case, not a missing one. Equal halves is the whole requirement.
+  _gah=${_ga%????????}; _gbh=${_gb%????????}
+  [ "$_ga" != "$_gah" ] && [ "$_gah" = "$_gbh" ] || return 1
+  _gd=$(( 0x${_gb#"$_gbh"} - 0x${_ga#"$_gah"} ))
+  [ "$_gd" -ge 0 ] || return 1
+  printf '%s' "$_gd"
+}
+
+# Echoes the runtime _text as 0x-hex, or nothing when it cannot be established:
+# no image symbols (stripped or compressed), no runtime _stext, or the image
+# already exports _text, in which case the capture needs no recorded truth.
+runtime_text_truth() {
+  _rt_img=$1; _rt_ks=$2
+  [ -f "$_rt_img" ] && [ -s "$_rt_ks" ] || return 0
+  command -v readelf >/dev/null 2>&1 || return 0
+  awk '$3 == "_text" { exit 1 }' "$_rt_ks" || return 0
+  _rt_st=$(awk '$3 == "_stext" { print $1; exit }' "$_rt_ks")
+  [ -n "$_rt_st" ] || return 0
+  _rt_syms=$(readelf -sW "$_rt_img" 2>/dev/null) || return 0
+  _rt_lt=$(printf '%s\n' "$_rt_syms" | awk '$8 == "_text"  { print $2; exit }')
+  _rt_ls=$(printf '%s\n' "$_rt_syms" | awk '$8 == "_stext" { print $2; exit }')
+  [ -n "$_rt_lt" ] && [ -n "$_rt_ls" ] || return 0
+  _rt_gap=$(hex_gap "$_rt_lt" "$_rt_ls") || return 0
+  _rt_lo=$(printf '%s' "$_rt_st" | tr 'A-F' 'a-f')
+  _rt_hi=${_rt_lo%????????}
+  [ "$_rt_lo" != "$_rt_hi" ] || return 0
+  _rt_d=$(( 0x${_rt_lo#"$_rt_hi"} - _rt_gap ))
+  [ "$_rt_d" -ge 0 ] || return 0
+  printf '0x%s%08x' "$_rt_hi" "$_rt_d"
+}
+
 verdict() {
   _log=$1
   grep -aq 'KASLD VM DONE' "$_log" || { echo "INCOMPLETE  (boot did not finish; see $_log)"; return 1; }
@@ -463,7 +514,14 @@ reconstruct_fixture() {
   # flavor=local => a mainline kernel.org build; else an Alpine distro kernel.
   _canon=$(fixture_arch "$_prefix")
   if [ "$_flavor" = local ]; then _distro="mainline"; else _distro="alpine-$ALPINE_VER"; fi
-  _fid=$(printf '%s-%s' "$_distro" "$_rel" | sed 's/[^A-Za-z0-9._-]/-/g')
+  # A cell name is <prefix>-<flavor>-<version>[-<variant>]; the variant is what
+  # makes the boot non-default (a VA size, a VMSPLIT). It has to reach the
+  # fixture id: without it a variant cell and its default sibling resolve to the
+  # same directory, and the capture rm -rf's the destination first, so whichever
+  # ran last would silently be the one kept.
+  _variant=$(printf '%s' "$_name" | cut -s -d- -f4-)
+  _fid=$(printf '%s-%s%s' "$_distro" "$_rel" "${_variant:+-$_variant}" |
+    sed 's/[^A-Za-z0-9._-]/-/g')
 
   # Boot image: size (sizes.txt) + 4 KiB header prefix, taken host-side from the
   # kernel we booted — mirrors extra/collect's boot_image "hdr" mode.
@@ -476,6 +534,8 @@ reconstruct_fixture() {
     : > "$_tmp/sizes.txt"
   fi
 
+  _tvt=$(runtime_text_truth "$_kimg" "$_sr/proc/kallsyms")
+
   _kbin=""
   for _c in "$BUILD_DIR/$_prefix"-*/kasld; do [ -x "$_c" ] && { _kbin=$_c; break; }; done
   _kid=unknown
@@ -493,6 +553,12 @@ reconstruct_fixture() {
     echo "host_scrubbed:    1"
     echo "kallsyms:         1"
     echo "source:           vm ($_name)"
+    # Only where the kernel withholds _text from kallsyms; elsewhere the sysroot
+    # already carries it, and a second copy is a second thing to keep true.
+    if [ -n "$_tvt" ]; then
+      echo "truth_virt_text:  $_tvt"
+      echo "truth_virt_text_source: booted vmlinux symtab (_stext - head gap)"
+    fi
   } > "$_tmp/meta.txt"
 
   dest="$ROOT/tests/fixtures/$_canon/$_fid"