boot: one hand-off contract, defined once

Groundwork for the unified loader: before the two paths can share code,
they have to agree on what they are producing, and until now they only
agreed by coincidence.

Every field of the loader/kernel hand-off was #defined in whichever file
happened to need it -- kernel/core/main.c, kernel/dev/vga.c,
kernel/arch/x86_64/e820.c, boot/bios/cdboot.S, boot/bios/stage2main.c and
boot/uefi/main.c, six copies of the same addresses. schboot.h existed for
exactly this and held only the entry magic and the RSDP slot, with a
comment describing the rest of the block it did not define.

The whole block lives there now: the VBE info fields, the verbose and
media flags (with the real-mode segment:offset spelling cdboot.S needs),
the e820 count, map and cap, and the RSDP. Every one of those files
includes it instead of restating it.

This is not a tidy-up. It is the same hazard as defining the entry magic
twice, only quieter -- nothing breaks until one copy moves, and the two
loaders diverging is precisely what produced the EFER.SCE and RSDP bugs,
where a fix on one path silently did not exist on the other.

Verified on both firmwares: BIOS boots to schinit with the same e820,
ACPI and VGA lines as before; UEFI reaches cpu0 with 1018 MB in 7 regions
and its own 1280x800 mode. `make iso` still builds. bootcheck 108 [ok].

Next: the loaders become starters that gather firmware-specific facts and
hand to one common stage. That needs the BIOS side to climb to long mode
first, since common code can only be compiled for one CPU mode -- which
is the risky part, and is why the contract went first.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

include/schboot.h

@@ -23,6 +23,56 @@
 #define SCH64_MAGIC0 0x36484353   /* "SCH6" */
 #define SCH64_MAGIC1 0x4f4f4234   /* "4BOO" */
 
+// ---------------------------------------------------------------------------
+// The hand-off block.
+//
+// One page of low memory that a loader fills in and the kernel reads. Every
+// field below was previously #defined in whichever file happened to need it --
+// five of them, across two loaders and two kernel files -- which is the same
+// hazard as defining the magic twice, only quieter: nothing breaks until one
+// copy moves.
+//
+// 0x30000 is clear of stage2 (loaded at 0x7E00 and well under 0xA000), the
+// multiboot kernel-search buffer at 0x10000-0x14000, and the kernel's own load
+// address at 0x100000.
+//
+// Both loaders write it, so a field's meaning must not depend on which one did.
+// Where they genuinely differ -- the BIOS path knows what medium it booted
+// from, UEFI does not -- the field is defined as "0 when unknown" rather than
+// left for the reader to guess.
+#define SCHBOOT_BASE          0x30000
+
+// A VBE mode info block, 256 bytes. The UEFI loader fills the same four fields
+// out of GOP rather than translating a structure it never saw, so the kernel
+// cannot tell which firmware booted it.
+#define SCHBOOT_VBE_INFO      (SCHBOOT_BASE + 0x000)
+#define SCHBOOT_VBE_STRIDE    (SCHBOOT_VBE_INFO + 16)   /* uint16, bytes/line */
+#define SCHBOOT_VBE_WIDTH     (SCHBOOT_VBE_INFO + 18)   /* uint16 */
+#define SCHBOOT_VBE_HEIGHT    (SCHBOOT_VBE_INFO + 20)   /* uint16 */
+#define SCHBOOT_VBE_BPP       (SCHBOOT_VBE_INFO + 25)   /* uint8  */
+#define SCHBOOT_VBE_LFB       (SCHBOOT_VBE_INFO + 40)   /* uint32, physical */
+
+// Non-zero if the loader was asked for a verbose boot.
+#define SCHBOOT_VERBOSE_FLAG  (SCHBOOT_BASE + 0x100)
+
+// What the system booted from. SCHBOOT_MEDIA_CD matters because the ISO path
+// reads through ATAPI rather than ATA; 0 means "not stated", which is what the
+// UEFI loader leaves, since it does not read the kernel through either.
+#define SCHBOOT_MEDIA_FLAG    (SCHBOOT_BASE + 0x101)
+#define SCHBOOT_MEDIA_CD      1
+
+// Real-mode spelling of the same byte, for cdboot.S which has no 32-bit
+// addressing yet. Segment and offset, not a flat address.
+#define SCHBOOT_MEDIA_SEG     0x3000
+#define SCHBOOT_MEDIA_OFF     0x101
+
+// The E820 memory map: a uint32 count, then that many 24-byte entries. Capped
+// at 32 so a pathological firmware cannot run past the buffer; the map ends at
+// 0x508, which is what leaves 0x600 free below.
+#define SCHBOOT_E820_COUNT    (SCHBOOT_BASE + 0x200)
+#define SCHBOOT_E820_MAP      (SCHBOOT_BASE + 0x208)
+#define SCHBOOT_E820_MAX      32
+
 // Where the loader leaves the ACPI RSDP, as a little-endian 64-bit physical
 // address. Zero means "not provided, go and look for it yourself".
 //
@@ -33,10 +83,7 @@
 // the machine boots to a prompt on polled serial output and then ignores every
 // key, which looks like a broken console rather than a missing table.
 //
-// 0x30000 is the same low-memory hand-off block the BIOS loader uses:
-// +0x100 verbose flag, +0x200 e820 count, +0x208 the e820 map (32 entries of
-// 24 bytes, ending at 0x508). 0x600 is clear of all of it.
-#define SCHBOOT_RSDP_ADDR (0x30000 + 0x600)
+#define SCHBOOT_RSDP_ADDR     (SCHBOOT_BASE + 0x600)
 
 #ifndef __ASSEMBLER__