diff --git a/kernel/src/arch/aarch64/boot/boot.S b/kernel/src/arch/aarch64/boot/boot.S
index 57a4239..e525340 100644
--- a/kernel/src/arch/aarch64/boot/boot.S
+++ b/kernel/src/arch/aarch64/boot/boot.S
@@ -2,8 +2,7 @@
 
 .section .text.boot
 
-.global _start
-_start:
+boot:
     # read cpu affinity, start core 0, halt rest
     mrs     x1, mpidr_el1
     and     x1, x1, #3
@@ -16,9 +15,7 @@ halt:
 
 setup:
     # store the desired EL1 stack pointer in x1
-    adr     x1, _start
-    # FIXME
-    lsl     x1, x1, #2
+    ldr     x1, =_start
 
     # use SP_ELx for Exception level ELx
     msr     SPsel, #1
@@ -101,12 +98,17 @@ zero_bss:
 
 zero_bss_loop:
     # zero out the BSS section, 64-bits at a time
-    cbz     x2, go_kmain
+    cbz     x2, zero_bss_loop_end
     str     xzr, [x1], #8
     sub     x2, x2, #8
     cbnz    x2, zero_bss_loop
 
-go_kmain:
+zero_bss_loop_end:
+    b       _start
+
+.section .text.entry
+.globl _start
+_start:
     # jump to rust_main, which shouldn't return. halt if it does
     bl      rust_main
     b       halt
diff --git a/kernel/src/arch/aarch64/boot/linker.ld b/kernel/src/arch/aarch64/boot/linker.ld
index ce4c0c2..34858e3 100644
--- a/kernel/src/arch/aarch64/boot/linker.ld
+++ b/kernel/src/arch/aarch64/boot/linker.ld
@@ -3,11 +3,14 @@ ENTRY(_start)
 SECTIONS {
   . = 0x80000; /* Raspbery Pi 3 Aarch64 (kernel8.img) load address */
 
-  /* start of the binary */
-  _start = .;
+  .boot : {
+    KEEP(*(.text.boot)) /* from boot.S */
+  }
+
+  . = 0x100000; /* Load the kernel at this address. It's also kernel stack top address */
 
   .text : {
-    KEEP(*(.text.boot)) /* from boot.S */
+    *(.text.entry)
     *(.text .text.* .gnu.linkonce.t*)
   }
 
diff --git a/kernel/src/fs.rs b/kernel/src/fs.rs
index 6e4e0a3..6810916 100644
--- a/kernel/src/fs.rs
+++ b/kernel/src/fs.rs
@@ -9,9 +9,23 @@ use spin::Mutex;
 global_asm!(r#"
     .section .rodata
     .align 12
-_binary_user_riscv_img_start:
+    .global _user_img_start
+    .global _user_img_end
+_user_img_start:
     .incbin "../user/user-riscv.img"
-_binary_user_riscv_img_end:
+_user_img_end:
+"#);
+
+// Hard link user program
+#[cfg(target_arch = "aarch64")]
+global_asm!(r#"
+    .section .rodata
+    .align 12
+    .global _user_img_start
+    .global _user_img_end
+_user_img_start:
+    .incbin "../user/user-riscv.img"
+_user_img_end:
 "#);
 
 const LOGO: &str = r#"
@@ -85,22 +99,18 @@ pub fn test_shell(prefix: &str) -> ! {
 pub fn shell() {
     show_logo();
 
-    #[cfg(target_arch = "riscv32")]
+    #[cfg(any(target_arch = "riscv32", target_arch = "aarch64"))]
     let device = {
         extern {
-            fn _binary_user_riscv_img_start();
-            fn _binary_user_riscv_img_end();
+            fn _user_img_start();
+            fn _user_img_end();
         }
-        Box::new(unsafe { MemBuf::new(_binary_user_riscv_img_start, _binary_user_riscv_img_end) })
+        Box::new(unsafe { MemBuf::new(_user_img_start, _user_img_end) })
     };
 
     #[cfg(target_arch = "x86_64")]
     let device = Box::new(&ide::DISK1);
 
-    #[cfg(target_arch = "aarch64")]
-    // TODO
-    let device: Box<dyn Device> = unimplemented!();
-
     let sfs = SimpleFileSystem::open(device).expect("failed to open SFS");
     let root = sfs.root_inode();
     let files = root.borrow().list().unwrap();