SchOS/kernel/kernel.ld
Nexoniarz 5ed8f1b0d5 kernel: load at 16 MB, clear of what firmware keeps low
From 1 MB the 34 MB kernel ran across 8 MB, where OVMF keeps ACPI NVS
memory that outlives the firmware -- so it was overwritten on every
boot, after ExitBootServices. Firmware leaves its leftovers low; above
16 MB is where a machine is most reliably empty.

KERNPHYS in memlayout.h, and kernel.ld agreeing with it. Nothing else
named the old address. Under OVMF the range is now only boot-services
memory: staged, copied home after the firmware exits, no warning. Boots
as a CD and as a USB disk, 1 and 4 CPUs.

The 15 MB below the kernel is not given to the page allocator yet.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S1giNvrHTrPMPw7V6x1kQ4
2026-10-24 00:13:53 +02:00

123 lines
4.4 KiB
Text

/* Simple linker script for the JOS kernel.
See the GNU ld 'info' manual ("info ld") to learn the syntax. */
/* OUTPUT_FORMAT("elf32-i386", "elf32-i386", "elf32-i386") */
/* OUTPUT_FORMAT("elf64-x86-64", "elf64-x86-64", "elf64-x86-64") */
OUTPUT_FORMAT("elf64-x86-64")
OUTPUT_ARCH(i386:x86-64)
ENTRY(_start)
mboot_load_addr = 0x01000000; /* KERNPHYS in include/arch/memlayout.h */
SECTIONS
{
/* Link the kernel at this address: "." means the current address */
/* Must be equal to KERNLINK */
. = 0xFFFF800001000000;
PROVIDE(begin = .);
/* The .l* section names are the x86-64 psABI's "large" sections, and they
* are not optional decoration: with -mcmodel=large both LLVM and GCC 13+
* put nearly all code and data into .ltext/.lrodata/.ldata/.lbss rather
* than the classic names.
*
* A script that does not name them still links. The large sections become
* orphans placed after everything the script did name, which puts them past
* PROVIDE(end = .) -- so kinit1(end, ...) hands the page allocator a megabyte
* of live .lbss and the kernel destroys itself within a few instructions of
* its first printf. That is exactly how this was found: the boot printed one
* line and triple-faulted in a loop.
*
* Matched alongside their small counterparts so the layout is unchanged for
* a toolchain that does not use them. */
.text : AT(mboot_load_addr) {
*(.text .rela.text .stub .text.* .gnu.linkonce.t.*)
*(.ltext .ltext.*)
}
PROVIDE(etext = .); /* Define the 'etext' symbol to this value */
.rodata : {
*(.rodata .rodata.* .gnu.linkonce.r.*)
*(.lrodata .lrodata.*)
}
/* Thread-local storage.
*
* The kernel really does use TLS: `__thread struct cpu *cpu` and
* `__thread struct proc *proc` (kernel/arch/x86_64/vm.c), reached through
* FS_BASE, which seginit() points at kernel_fs_base.
*
* These output sections are what make the linker emit a PT_TLS segment, and
* without a PT_TLS the local-exec relocations have nothing to resolve
* against: lld left every access as a bare `movq %fs:0x0`, so `cpu` and
* `proc` both aliased the thread pointer itself and the kernel died a few
* instructions into seginit. GNU ld happened to place an orphan .tbss well
* enough to work; that was luck, not correctness.
*
* Order matters and is checked by more than C: trapasm.S hardcodes `proc` at
* %fs:(-8). With cpu at TLS offset 0 and proc at 8 in a 16-byte block, the
* local-exec offsets come out as -16 and -8, which is the layout that file
* assumes. */
.tdata : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
.tbss : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
/* Adjust the address for the data segment to the next page */
. = ALIGN(0x1000);
/* Conventionally, Unix linkers provide pseudo-symbols
* etext, edata, and end, at the end of the text, data, and bss.
* For the kernel mapping, we need the address at the beginning
* of the data section, but that's not one of the conventional
* symbols, because the convention started before there was a
* read-only rodata section between text and data. */
PROVIDE(data = .);
/* The data segment */
.data : {
*(.data .data.*)
*(.ldata .ldata.*)
}
/* The kernel symbol table, generated by tools/ksyms.pl between the two link
* passes. See kernel/core/ksym.c.
*
* The position is the whole trick and it is not cosmetic: everything the
* table records is a *text* address, and .ksym sits after .text and .rodata,
* so adding several tens of kilobytes here cannot move a single entry in it.
* That is what makes two passes enough -- pass one is read to build the
* table, pass two carries it, and pass two's text is identical to pass one's.
* Put this before .text and the table describes a kernel that no longer
* exists, subtly, with every address off by the size of the table.
*
* It is inside the loaded image (before edata), not in .bss, because it has
* contents. mboot_load_end is computed from edata and would otherwise not
* cover it. */
. = ALIGN(8);
.ksym : {
*(.ksym .ksym.*)
}
. = ALIGN(0x1000);
PROVIDE(edata = .);
.bss : {
*(.bss .bss.*)
*(.lbss .lbss.*)
*(COMMON)
}
. = ALIGN(0x1000);
PROVIDE(end = .);
/DISCARD/ : {
*(.eh_frame .rela.eh_frame .note.GNU-stack)
}
}
mboot_load_end = mboot_load_addr + (edata - begin);
mboot_bss_end = mboot_load_addr + (end - begin);
mboot_entry_addr = mboot_load_addr + (mboot_entry - begin);