feat(adapter): higher-half kernel (linked at PHYS_OFFSET, boot trampoline, no low mappings), fix SBI ecall clobbers

crates/adapter-riscv/linker.ld

@@ -1,13 +1,20 @@
 OUTPUT_ARCH(riscv)
-ENTRY(_start)
+
+/* The kernel runs in the upper half: linked at its physical load address
+   plus PHYS_OFFSET (mmu::PHYS_OFFSET), loaded at the physical address.
+   Firmware jumps to the physical entry with the MMU off; _start switches
+   to the high mapping before any Rust code runs. */
+PHYS_OFFSET = 0xFFFFFFC000000000;
+LOAD_ADDRESS = 0x80200000;
+ENTRY(_start_phys)
 
 /* Every boundary below is page aligned: the kernel maps each range with
    its own permissions (W^X), see mmu::init_kernel_page_table. */
 SECTIONS {
-    . = 0x80200000;
+    . = PHYS_OFFSET + LOAD_ADDRESS;
     _text_start = .;
 
-    .text : {
+    .text : AT(ADDR(.text) - PHYS_OFFSET) {
         *(.text.entry)
         *(.text .text.*)
     }
@@ -15,24 +22,24 @@ SECTIONS {
     . = ALIGN(4096);
     _text_end = .;
 
-    .rodata : {
+    .rodata : AT(ADDR(.rodata) - PHYS_OFFSET) {
         *(.rodata .rodata.*)
         *(.srodata .srodata.*)
     }
-    .eh_frame : {
+    .eh_frame : AT(ADDR(.eh_frame) - PHYS_OFFSET) {
         *(.eh_frame)
     }
 
     . = ALIGN(4096);
     _rodata_end = .;
 
-    .data : {
+    .data : AT(ADDR(.data) - PHYS_OFFSET) {
         *(.data .data.*)
         *(.sdata .sdata.*)
     }
 
     . = ALIGN(4096);
-    .bss : {
+    .bss : AT(ADDR(.bss) - PHYS_OFFSET) {
         _bss_start = .;
         *(.bss .bss.*)
         *(.sbss .sbss.*)
@@ -51,3 +58,5 @@ SECTIONS {
 
     _heap_start = .;
 }
+
+_start_phys = _start - PHYS_OFFSET;