Reason for the Linker Error
This error you received:
relocation truncated to fit: R_386_16 against `.text'
is effectively telling you that when the linker attempted to resolve these relocations within the .text section that it was unable to do so because the Virtual Memory Addresses (VMA) it computed could not fit in a 16-bit pointer (_16).
If you use -g -Fdwarf when assembling with NASM you can produce more usable output from OBJDUMP using a command like i686-elf-objdump -SDr -Mi8086 vesa.o.
-S outputs source-D is for disassembly, -r shows the relocation information.
The following is the output I get (it differs slightly but the ideas presented here still apply):
0000004a <realmode1>:
[bits 16]
realmode1:
...
mov ax,[vid_mode] ; Linker error
63: a1 0a 00 mov ax,ds:0xa
64: R_386_16 .text
...
mov cx,[vid_mode] ; Linker error
9a: 8b 0e 0a 00 mov cx,WORD PTR ds:0xa
9c: R_386_16 .text
...
mov bx,[vid_mode] ; ; Linker error
b2: 8b 1e 0a 00 mov bx,WORD PTR ds:0xa
b4: R_386_16 .text
...
jmp 0x8:pm1 ; Linker error
c5: ea ca 00 08 00 jmp 0x8:0xca
c6: R_386_16 .text
I have removed the information that wasn't of any consequence for brevity and replaced it with ... in the output. There is a [bits 16] directive that forces all memory addresses to be 16-bit unless overridden. As an example c6: R_386_16 .text means there is a relocation at offset (0xc6) that is a 16-bit pointer appearing in the .text section. Keep this in mind. Now review the linker script:
. = 100000;
.text : { *(.text) }
.data : { *(.data) }
.bss : { *(.bss) }
The VMA (origin) is 0x100000. This is effectively the origin point for all the code and data in this case. All the addresses generated in the final executable will be over 0xFFFF which is the maximum value that can fit in a 16-bit pointer. This is the reason the linker is complaining.
You can override the default address and operand sizes by specifying DWORD before the label name between the brackets [ and ]. An absolute 32-bit FAR JMP can be encoded by specifying DWORD before the operand. These lines:
mov ax,[vid_mode]
mov cx,[vid_mode]
mov bx,[vid_mode]
jmp 0x8:pm1
Would become:
mov ax,[dword vid_mode]
mov cx,[dword vid_mode]
mov bx,[dword vid_mode]
jmp dword 0x8:pm1
If you assemble the revised code and use OBJDUMP as discussed above you get this output (cut for brevity):
mov ax,[dword vid_mode] ; Linker error
63: 67 a1 0a 00 00 00 addr32 mov ax,ds:0xa
65: R_386_32 .text
...
mov cx,[dword vid_mode] ; Linker error
9d: 67 8b 0d 0a 00 00 00 addr32 mov cx,WORD PTR ds:0xa
a0: R_386_32 .text
...
mov bx,[dword vid_mode] ; ; Linker error
b8: 67 8b 1d 0a 00 00 00 addr32 mov bx,WORD PTR ds:0xa
bb: R_386_32 .text
...
jmp dword 0x8:pm1 ; Linker error
ce: 66 ea d6 00 00 00 08 jmp 0x8:0xd6
d5: 00
d0: R_386_32 .text
The instructions now have a 0x66 and 0x67 prefix added to them and the addresses take 4 bytes in the instruction. Each of the relocations are of type R_386_32 which tells the linker that the addresses to relocate are 32-bits wide.
Although the changes in the previous section will eliminate the warnings during linking, when run things may not work as expected (including crashes). On an 80386+ you can generate 16-bit real mode code that uses 32-bit addresses for the data but the CPU has to be put into a mode that allows such access. The mode that allows 32-bit pointers accessed via the DS segment with values above 0xFFFF is called Unreal Mode. OSDev Wiki has some code that could be used as a basis for such support. Assuming the PICs haven't been remapped and are in their initial configuration then the usual way to implement on demand Unreal Mode is to replace the 0x0d Interrupt handler with something that does:
- Query PIC1 OCW3 to see if IRQ5 is being serviced or whether there was a General Protection fault. Without PIC remapping #GP fault and IRQ5 point at the same interrupt vector so one has to distinguish between them.
- If the IRQ5 ISR is set then call the previously saved interrupt handler (chaining). At this point we are all done.
- If IRQ5 ISR is not set then 0x0d interrupt was called because of a general protection fault. Assume the fault was because of an invalid data access.
- Switch into protected mode and use a GDT containing a 16-bit data descriptor that has a base of 0 and a limit of 0xffffffff. Set ES and DS using the corresponding selector.
- Leave protected mode
- Return from interrupt handler.
If PIC1 has been remapped so as to not conflict with the x86 exception handling interrupts (int 0x08 to int 0x0f) then steps 1,2,3 no longer apply. Remapping the PICs to avoid this conflict is common place in x86 OS design. The code in the question doesn't do any PIC remapping.
This mechanism won't work if you want to ever use the code in a VM8086 task rather than entering real mode.
DOS's HIMEM.SYS did something similar in the 1980s and you can find a discussion about that in this article if you are interested.
Note : Although I give a general description of using Unreal Mode, I don't recommend this method. It requires more extensive knowledge of real mode, protected mode, interrupt handling.
More Preferred Solution
Rather than using 32-bit data pointers greater than 0xFFFF, and ensuring that the processor is in unreal mode there is a solution that may be easier to understand. One such solution is to copy the real mode code and data from where the Multiboot loader physically loaded into RAM above 0x100000 to the first 64KB of memory memory just above the real mode interrupt vector table (IVT). This allows you to continue using 16-bit pointers because the first 64KB of memory is addressable with a 16-bit pointer (0x0000 to 0xFFFF). The 32-bit code will still be able to access the real mode data if needed.
To do this you will have to create a more complex GNU LD linker script (link.ld) that uses a Virtual Memory Address (origin point) in lower memory. Address 0x01000 is a good choice. The Multiboot header will still have to be present at the beginning of the ELF executable.
One problem that has to be overcome is that the Multiboot loader will read the code and data into memory above 0x100000. One has to manually copy the 16-bit real mode code and data to address 0x01000 before the real mode code can be used. The linker script can help generate symbols to compute the start and end addresses for such a copy.
See the code in the last section for a linker script link.ld that does just that, and a kernel.c file that does the copy.
With properly adjusted VESA code what you are trying to do should work.
Problems with VESA Code You Found
- The VESA code relies on hard coded addresses
- Was not designed with Multiboot in mind as it was assumed the kernel would be manually loaded into memory (<64KB) at a specific place and that certain addresses already contained specific data before being called.
- The code doesn't follow the CDECL calling convention thus it isn't callable from C code directly.
- There is a bug that placed 32-bit code under a
[bits 16] directive.
- The code doesn't show the GDT table that was needed but it can be inferred from the code that there needed to be at least 5 descriptors in a GDT in a specific order.
- Null Descriptor
- 32-bit Code Segment (Base 0, Limit 0xffffffff). Selector 0x08
- 32-bit Data Segment (Base 0, Limit 0xffffffff). Selector 0x10
- 16-bit Code Segment (Base 0, Limit at least 0xffff). Selector 0x18
- 16-bit Data Segment (Base 0, Limit at least 0xffff). Selector 0x20
The author had these comments:
On boot up save the real mode IDT at a known place (mine was at 0x9000) using the sidt instruction, and dont overwrite address 0-0x500 in memory. It also assumes that you are using 8 and 16 as segment registers for code and data in PMode. It stores the result of function 4f01 at 0x5000, and automatically sets bit 13 (use framebuffer)
A Complete Example
The following code is a complete implementation of what has been suggested above. Use a linker script and generate real mode code and data and place it starting at 0x1000. The code uses C to set up a proper GDT with 32 and 16-bit Code and Data segments, copies the real mode code from above 0x100000 down to 0x1000. It also fixes the other issues previously identified in the VESA driver code. To test it switches in to video mode 0x13 (320x200x256) and paints part of the VGA color palette to the display 32 bits at a time.
link.ld:
OUTPUT_FORMAT("elf32-i386");
ENTRY(mbentry);
/* Multiboot spec uses 0x00100000 as a base */
PHYS_BASE = 0x00100000;
REAL_BASE = 0x00001000;
SECTIONS
{
. = PHYS_BASE;
/* Place the multiboot record first */
.multiboot : {
*(.multiboot);
}
/* This is the tricky part. The LMA (load memory address) is the
* memory location the code/data is read into memory by the
* multiboot loader. The LMA is after the colon. We want to tell
* the linker that the code/data in this section was loaded into
* RAM in the memory area above 0x100000. On the other hand the
* VMA (virtual memory address) specified before the colon acts
* like an ORG directive. The VMA tells the linker to resolve all
* subsequent code starting relative to the specified VMA. The
* VMA in this case is REAL_BASE which we defined as 0x1000.
* 0x1000 is 4KB page aligned (useful if you ever use paging) and
* resides above the end of the interrupt table and the
* BIOS Data Area (BDA)
*/
__physreal_diff = . - REAL_BASE;
.realmode REAL_BASE : AT(ADDR(.realmode) + __physreal_diff) {
/* The __realmode* values can be used by code to copy
* the code/dat
