diff --git a/artiq/gateware/amp/kernel_cpu.py b/artiq/gateware/amp/kernel_cpu.py
index e85565306..8d2e37de2 100644
--- a/artiq/gateware/amp/kernel_cpu.py
+++ b/artiq/gateware/amp/kernel_cpu.py
@@ -9,7 +9,7 @@ from misoclib.soc import mem_decoder
 
 class KernelCPU(Module):
     def __init__(self, platform, lasmim,
-                 exec_address=0x41000000,
+                 exec_address=0x40020000,
                  main_mem_origin=0x40000000,
                  l2_size=8192):
         self._reset = CSRStorage(reset=1)
diff --git a/soc/runtime/Makefile b/soc/runtime/Makefile
index 09c1fe56b..03b096b8e 100644
--- a/soc/runtime/Makefile
+++ b/soc/runtime/Makefile
@@ -21,7 +21,7 @@ runtime.elf: $(OBJECTS) libs
 
 %.elf:
 	$(LD) $(LDFLAGS) \
-		-T $(MSCDIR)/software/libbase/linker-sdram.ld \
+		-T linker.ld \
 		-N -o $@ \
 		$(MSCDIR)/software/libbase/crt0-$(CPU).o \
 		$(OBJECTS) \
diff --git a/soc/runtime/linker.ld b/soc/runtime/linker.ld
new file mode 100644
index 000000000..89bb133dc
--- /dev/null
+++ b/soc/runtime/linker.ld
@@ -0,0 +1,67 @@
+INCLUDE generated/output_format.ld
+ENTRY(_start)
+
+INCLUDE generated/regions.ld
+
+/* Assume ORIGIN(main_ram) = 0x40000000. Unfortunately,
+ * ld does not allow this expression here.
+ */
+MEMORY {
+	runtime : ORIGIN = 0x40000000, LENGTH = 0x20000 /* 128K */
+}
+
+/* Kernel memory space start right after the runtime,
+ * and ends before the runtime stack.
+ */
+PROVIDE(_kmem = 0x40020000);
+
+/* Runtime stack is always at the end of main_ram.
+ * This stack is shared with the kernel on uniprocessor systems.
+ */
+PROVIDE(_fstack = 0x40000000 + LENGTH(main_ram) - 4);
+
+SECTIONS
+{
+	.text :
+	{
+		_ftext = .;
+		*(.text .stub .text.* .gnu.linkonce.t.*)
+		_etext = .;
+	} > runtime
+
+	.rodata :
+	{
+		. = ALIGN(4);
+		_frodata = .;
+		*(.rodata .rodata.* .gnu.linkonce.r.*)
+		*(.rodata1)
+		_erodata = .;
+	} > runtime
+
+	.data :
+	{
+		. = ALIGN(4);
+		_fdata = .;
+		*(.data .data.* .gnu.linkonce.d.*)
+		*(.data1)
+		_gp = ALIGN(16);
+		*(.sdata .sdata.* .gnu.linkonce.s.*)
+		_edata = .;
+	} > runtime
+
+	.bss :
+	{
+		. = ALIGN(4);
+		_fbss = .;
+		*(.dynsbss)
+		*(.sbss .sbss.* .gnu.linkonce.sb.*)
+		*(.scommon)
+		*(.dynbss)
+		*(.bss .bss.* .gnu.linkonce.b.*)
+		*(COMMON)
+		. = ALIGN(4);
+		_ebss = .;
+		. = ALIGN(8);
+		_heapstart = .;
+	} > runtime
+}
diff --git a/soc/runtime/main.c b/soc/runtime/main.c
index a77d074ed..587e3e453 100644
--- a/soc/runtime/main.c
+++ b/soc/runtime/main.c
@@ -15,7 +15,6 @@
 #include "rtio.h"
 #include "dds.h"
 
-static unsigned char kcode[256*1024];
 
 static struct symbol symtab[128];
 static int _symtab_count;
@@ -57,12 +56,14 @@ static int symtab_add(const char *name, void *target)
     return 1;
 }
 
+extern int _kmem;
+
 static int load_object(void *buffer, int length)
 {
     symtab_init();
     return load_elf(
         resolve_service_symbol, symtab_add,
-        buffer, length, kcode, sizeof(kcode));
+        buffer, length, &_kmem, 2*1024*1024);
 }
 
 typedef void (*kernel_function)(void);