diff --git a/pvmfw/src/entry.rs b/pvmfw/src/entry.rs
index 99c67fb..1ea95bc 100644
--- a/pvmfw/src/entry.rs
+++ b/pvmfw/src/entry.rs
@@ -14,7 +14,7 @@
 
 //! Low-level entry and exit points of pvmfw.
 
-use crate::helpers::FDT_MAX_SIZE;
+use crate::helpers;
 use crate::mmio_guard;
 use core::arch::asm;
 use core::slice;
@@ -54,6 +54,7 @@
     // - only access non-pvmfw memory once (and while) it has been mapped
     logger::init(LevelFilter::Info).map_err(|_| RebootReason::InternalError)?;
 
+    const FDT_MAX_SIZE: usize = helpers::SIZE_2MB;
     // TODO: Check that the FDT is fully contained in RAM.
     // SAFETY - We trust the VMM, for now.
     let fdt = unsafe { slice::from_raw_parts_mut(fdt as *mut u8, FDT_MAX_SIZE) };
diff --git a/pvmfw/src/helpers.rs b/pvmfw/src/helpers.rs
index cade62e..adfc189 100644
--- a/pvmfw/src/helpers.rs
+++ b/pvmfw/src/helpers.rs
@@ -14,8 +14,8 @@
 
 //! Miscellaneous helper functions.
 
-pub const FDT_MAX_SIZE: usize = 2 << 20;
 pub const SIZE_4KB: usize = 4 << 10;
+pub const SIZE_2MB: usize = 2 << 20;
 
 /// Computes the address of the page containing a given address.
 pub const fn page_of(addr: usize, page_size: usize) -> usize {
diff --git a/vmbase/example/src/layout.rs b/vmbase/example/src/layout.rs
index c0c4fab..4c3af6d 100644
--- a/vmbase/example/src/layout.rs
+++ b/vmbase/example/src/layout.rs
@@ -17,72 +17,59 @@
 use aarch64_paging::paging::{MemoryRegion, VirtualAddress};
 use core::arch::asm;
 use core::ops::Range;
+use vmbase::layout;
 use vmbase::println;
+use vmbase::STACK_CHK_GUARD;
 
 /// The first 1 GiB of memory are used for MMIO.
 pub const DEVICE_REGION: MemoryRegion = MemoryRegion::new(0, 0x40000000);
 
+fn into_va_range(r: Range<usize>) -> Range<VirtualAddress> {
+    VirtualAddress(r.start)..VirtualAddress(r.end)
+}
+
 /// Memory reserved for the DTB.
 pub fn dtb_range() -> Range<VirtualAddress> {
-    unsafe {
-        VirtualAddress(&dtb_begin as *const u8 as usize)
-            ..VirtualAddress(&dtb_end as *const u8 as usize)
-    }
+    into_va_range(layout::dtb_range())
 }
 
 /// Executable code.
 pub fn text_range() -> Range<VirtualAddress> {
-    unsafe {
-        VirtualAddress(&text_begin as *const u8 as usize)
-            ..VirtualAddress(&text_end as *const u8 as usize)
-    }
+    into_va_range(layout::text_range())
 }
 
 /// Read-only data.
 pub fn rodata_range() -> Range<VirtualAddress> {
-    unsafe {
-        VirtualAddress(&rodata_begin as *const u8 as usize)
-            ..VirtualAddress(&rodata_end as *const u8 as usize)
-    }
+    into_va_range(layout::rodata_range())
 }
 
 /// Initialised writable data.
 pub fn data_range() -> Range<VirtualAddress> {
-    unsafe {
-        VirtualAddress(&data_begin as *const u8 as usize)
-            ..VirtualAddress(&data_end as *const u8 as usize)
-    }
+    into_va_range(layout::data_range())
 }
 
 /// Zero-initialised writable data.
 pub fn bss_range() -> Range<VirtualAddress> {
-    unsafe {
-        VirtualAddress(&bss_begin as *const u8 as usize)
-            ..VirtualAddress(&bss_end as *const u8 as usize)
-    }
+    into_va_range(layout::bss_range())
 }
 
 /// Writable data region for the stack.
 pub fn boot_stack_range() -> Range<VirtualAddress> {
-    unsafe {
-        VirtualAddress(&boot_stack_begin as *const u8 as usize)
-            ..VirtualAddress(&boot_stack_end as *const u8 as usize)
-    }
+    into_va_range(layout::boot_stack_range())
 }
 
 /// Writable data, including the stack.
 pub fn writable_region() -> MemoryRegion {
-    unsafe {
-        MemoryRegion::new(&data_begin as *const u8 as usize, &boot_stack_end as *const u8 as usize)
-    }
+    let r = layout::writable_region();
+    MemoryRegion::new(r.start, r.end)
 }
 
 fn data_load_address() -> VirtualAddress {
-    unsafe { VirtualAddress(&data_lma as *const u8 as usize) }
+    VirtualAddress(layout::data_load_address())
 }
 
 fn binary_end() -> VirtualAddress {
-    unsafe { VirtualAddress(&bin_end as *const u8 as usize) }
+    VirtualAddress(layout::binary_end())
 }
 
 pub fn print_addresses() {
@@ -124,23 +111,5 @@
 
 /// Value of __stack_chk_guard.
 pub fn stack_chk_guard() -> u64 {
-    unsafe { __stack_chk_guard }
-}
-
-extern "C" {
-    static dtb_begin: u8;
-    static dtb_end: u8;
-    static text_begin: u8;
-    static text_end: u8;
-    static rodata_begin: u8;
-    static rodata_end: u8;
-    static data_begin: u8;
-    static data_end: u8;
-    static data_lma: u8;
-    static bin_end: u8;
-    static bss_begin: u8;
-    static bss_end: u8;
-    static boot_stack_begin: u8;
-    static boot_stack_end: u8;
-    static __stack_chk_guard: u64;
+    *STACK_CHK_GUARD
 }
diff --git a/vmbase/src/layout.rs b/vmbase/src/layout.rs
new file mode 100644
index 0000000..b0a5173
--- /dev/null
+++ b/vmbase/src/layout.rs
@@ -0,0 +1,66 @@
+// Copyright 2022, The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Memory layout.
+
+use crate::linker;
+use core::ops::Range;
+use core::ptr::addr_of;
+
+/// Memory reserved for the DTB.
+pub fn dtb_range() -> Range<usize> {
+    unsafe { (addr_of!(linker::dtb_begin) as usize)..(addr_of!(linker::dtb_end) as usize) }
+}
+
+/// Executable code.
+pub fn text_range() -> Range<usize> {
+    unsafe { (addr_of!(linker::text_begin) as usize)..(addr_of!(linker::text_end) as usize) }
+}
+
+/// Read-only data.
+pub fn rodata_range() -> Range<usize> {
+    unsafe { (addr_of!(linker::rodata_begin) as usize)..(addr_of!(linker::rodata_end) as usize) }
+}
+
+/// Initialised writable data.
+pub fn data_range() -> Range<usize> {
+    unsafe { (addr_of!(linker::data_begin) as usize)..(addr_of!(linker::data_end) as usize) }
+}
+
+/// Zero-initialised writable data.
+pub fn bss_range() -> Range<usize> {
+    unsafe { (addr_of!(linker::bss_begin) as usize)..(addr_of!(linker::bss_end) as usize) }
+}
+
+/// Writable data region for the stack.
+pub fn boot_stack_range() -> Range<usize> {
+    unsafe {
+        (addr_of!(linker::boot_stack_begin) as usize)..(addr_of!(linker::boot_stack_end) as usize)
+    }
+}
+
+/// Writable data, including the stack.
+pub fn writable_region() -> Range<usize> {
+    data_range().start..boot_stack_range().end
+}
+
+/// Read-write data (original).
+pub fn data_load_address() -> usize {
+    unsafe { addr_of!(linker::data_lma) as usize }
+}
+
+/// End of the binary image.
+pub fn binary_end() -> usize {
+    unsafe { addr_of!(linker::bin_end) as usize }
+}
diff --git a/vmbase/src/lib.rs b/vmbase/src/lib.rs
index 9c9417a..a012442 100644
--- a/vmbase/src/lib.rs
+++ b/vmbase/src/lib.rs
@@ -18,6 +18,8 @@
 
 pub mod console;
 mod entry;
+pub mod layout;
+mod linker;
 pub mod logger;
 pub mod power;
 pub mod uart;
@@ -31,6 +33,9 @@
     reboot()
 }
 
+/// Reference to __stack_chk_guard.
+pub static STACK_CHK_GUARD: &u64 = unsafe { &linker::__stack_chk_guard };
+
 #[no_mangle]
 extern "C" fn __stack_chk_fail() -> ! {
     panic!("stack guard check failed");
diff --git a/vmbase/src/linker.rs b/vmbase/src/linker.rs
new file mode 100644
index 0000000..f4baae8
--- /dev/null
+++ b/vmbase/src/linker.rs
@@ -0,0 +1,48 @@
+// Copyright 2022, The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Linker-defined symbols.
+
+extern "C" {
+    /// Stack canary value
+    pub static __stack_chk_guard: u64;
+    /// First byte beyond the pre-loaded binary.
+    pub static bin_end: u8;
+    /// First byte of the `.stack` section.
+    pub static boot_stack_begin: u8;
+    /// First byte beyond the `.stack` section.
+    pub static boot_stack_end: u8;
+    /// First byte of the `.bss` section.
+    pub static bss_begin: u8;
+    /// First byte beyond the `.bss` section.
+    pub static bss_end: u8;
+    /// First byte of the (loaded) `.data` section.
+    pub static data_begin: u8;
+    /// First byte beyond the (loaded) `.data` section.
+    pub static data_end: u8;
+    /// First byte of the pre-loaded `.data` section.
+    pub static data_lma: u8;
+    /// First byte of the `.dtb` section.
+    pub static dtb_begin: u8;
+    /// First byte beyond the `.dtb` section.
+    pub static dtb_end: u8;
+    /// First byte of the `.rodata` section.
+    pub static rodata_begin: u8;
+    /// First byte beyond the `.rodata` section.
+    pub static rodata_end: u8;
+    /// First byte of the `.text` section.
+    pub static text_begin: u8;
+    /// First byte beyond the `.text` section.
+    pub static text_end: u8;
+}