bootloader ld 0x10000 relocation truncated to fit: R_X86_64_16

Question

.intel_syntax noprefix
.code16
.text
.globl _start
_start:
    mov    ax,    cs
    mov    ds,    ax
    mov    es,    ax
    mov    ax,    0x00
    mov    ss,    ax
    mov    sp,    0x7c00

    mov    ax,    0x1301
    mov    bx,    0x000f
    mov    dx,    0x0200        # row 2
    mov    cx,    12
    push    ax
    mov    ax,    ds
    mov    es,    ax
    pop    ax
    lea    bp,    StartLoaderMessage
    int    0x10

    jmp    $

StartLoaderMessage:    .ascii    "Start Loader"

操作:

$ as -o loader.o loader.s
$ ld -Ttext 0x10000 --oformat=binary loader.o -o loader.bin # 0x10000刚好1M // 报错
loader.o: In function `_start':
(.text+0x22): relocation truncated to fit: R_X86_64_16 against `.text'+28
$ ld -Ttext 0x7c00 --oformat=binary loader.o -o loader.bin2 # 正常

将loader.bin2文件反编译后发现StartLoaderMessage是绝对定位, 使用0x10000时超过了real mode 16-bit寻址规定的1M空间, 请问这种情况要怎么解决?