feat: kernel W^X (per-section perms, firmware unmapped, stack guard, boot check), halt on kernel faults, region W^X across processes

crates/adapter-riscv/linker.ld

@@ -1,8 +1,11 @@
 OUTPUT_ARCH(riscv)
 ENTRY(_start)
 
+/* Every boundary below is page aligned: the kernel maps each range with
+   its own permissions (W^X), see mmu::init_kernel_page_table. */
 SECTIONS {
     . = 0x80200000;
+    _text_start = .;
 
     .text : {
         *(.text.entry)
@@ -10,13 +13,22 @@ SECTIONS {
     }
 
     . = ALIGN(4096);
+    _text_end = .;
+
     .rodata : {
         *(.rodata .rodata.*)
+        *(.srodata .srodata.*)
+    }
+    .eh_frame : {
+        *(.eh_frame)
     }
 
     . = ALIGN(4096);
+    _rodata_end = .;
+
     .data : {
         *(.data .data.*)
+        *(.sdata .sdata.*)
     }
 
     . = ALIGN(4096);
@@ -27,7 +39,12 @@ SECTIONS {
         _bss_end = .;
     }
 
+    /* Left unmapped, so overflowing the kernel stack faults instead of
+       silently overwriting .bss. */
     . = ALIGN(4096);
+    _stack_guard = .;
+    . += 4096;
+
     _stack_bottom = .;
     . += 0x80000;
     _stack_top = .;