feat: kernel W^X (per-section perms, firmware unmapped, stack guard, boot check), halt on kernel faults, region W^X across processes

docs/ADAPTERS.md

@@ -13,7 +13,12 @@ This generates `crates/adapter-<arch>/` with the standard structure. Then:
 1. Add `"crates/adapter-<arch>"` to workspace `members` in `Cargo.toml`
 2. Fill in `board.rs` with device addresses for the target board
 3. Add boot assembly (`global_asm!` in `main.rs` or a `.S` file)
-4. Update `linker.ld` for the target's entry address and memory layout
+4. Update `linker.ld` for the target's entry address and memory layout.
+   Keep text, read-only data and writable data on separate pages and
+   export their page-aligned boundaries (`_text_start`, `_text_end`,
+   `_rodata_end`, `_stack_guard`, `_stack_bottom`): the kernel maps each
+   range with only the access it needs (W^X) and leaves a guard page under
+   the stack.
 5. Implement the TODOs in `hw/`, `mmu/`, `trap/`, and `platform.rs`
 
 ## Structure

docs/ipc.md

@@ -37,7 +37,11 @@ from a revocation further up.
 
 A region mapping made with `MapRegion(cap, va, perms)` lasts only as long
 as `cap`: deleting or revoking `cap` unmaps it. `perms` needs `Read`, plus
-`Write` for read-write or `Execute` for read-execute.
+`Write` for read-write or `Execute` for read-execute. W^X holds across
+processes: while a region is mapped read-write anywhere it cannot be mapped
+read-execute anywhere, and the other way round (`PermissionDenied`). To
+load code, map it writable, fill it, drop that mapping, then map it
+executable.
 
 | Object       | Permission | Allows                                     |
 |--------------|------------|--------------------------------------------|