在boot.s中，內核已經移至0x0000 0000處，並且開始執行，首先執行的就是head.s，這部分代碼執行完後，也會被覆蓋，嚴格意義上來講，不是完全屬於內核代碼。
這部分代碼採用AT&T彙編編寫，下面來詳細分析下其功能：
/*
* head.s contains the 32-bit startup code.
*
* NOTE!!! Startup happens at absolute address 0x00000000, which is also where
* the page directory will exist. The startup code will be overwritten by
* the page directory.
*/
head.s中入口函數被放在0x0000 0000處，執行完後，會被page directory覆蓋掉。在boot.s中，已經開啓了分頁，即設置PE了，同時設置了中斷，GDTR，但是沒有對頁目錄表和頁表的初始化。這個也是head.s的主要任務。
.text
.globl _idt,_gdt,_pg_dir
_pg_dir:
startup_32:
//...
_pg_dir 從名字可以看出來，就是初始化分頁機制，startup_32是head.s入口
movl $0x10,%eax
mov %ax,%ds
mov %ax,%es
mov %ax,%fs
mov %ax,%gs
設置段寄存器，0x10展開後0001 0000，RPL爲00，查GDT表，index是10，也就是第二項，在boot.s中設置的內容爲：
gdt:
.word 0,0,0,0 | dummy
.word 0x07FF | 8Mb - limit=2047 (2048*4096=8Mb)
.word 0x0000 | base address=0
.word 0x9A00 | code read/exec
.word 0x00C0 | granularity=4096, 386
.word 0x07FF | 8Mb - limit=2047 (2048*4096=8Mb)
.word 0x0000 | base address=0
.word 0x9200 | data read/write
.word 0x00C0 | granularity=4096, 386
可以看到第二項目的base address 是0.接下來是設置好內核堆棧，在分頁機制還沒建立起來的時候，都要程序員自己規劃內存。
接下來是便是重新設置idt和gdt。
lss _stack_start,%esp
call setup_idt
call setup_gdt
/*
* setup_idt
*
* sets up a idt with 256 entries pointing to
* ignore_int, interrupt gates. It then loads
* idt. Everything that wants to install itself
* in the idt-table may do so themselves. Interrupts
* are enabled elsewhere, when we can be relatively
* sure everything is ok. This routine will be over-
* written by the page tables.
*/
setup_idt:
lea ignore_int,%edx
movl $0x00080000,%eax
movw %dx,%ax /* selector = 0x0008 = cs */
movw $0x8E00,%dx /* interrupt gate - dpl=0, present */
lea _idt,%edi
mov $256,%ecx
rp_sidt:
movl %eax,(%edi)
movl %edx,4(%edi)
addl $8,%edi
dec %ecx
jne rp_sidt
lidt idt_descr
ret
256箇中斷向量
接下來是相關gdt設置：
/*
* setup_gdt
*
* This routines sets up a new gdt and loads it.
* Only two entries are currently built, the same
* ones that were built in init.s. The routine
* is VERY complicated at two whole lines, so this
* rather long comment is certainly needed :-).
* This routine will beoverwritten by the page tables.
*/
setup_gdt:
lgdt gdt_descr
ret
lgdt也就是向gdtr中存放gdt的地址:
gdt_descr:
.word 256*8-1 # so does gdt (not that that's any
.long _gdt # magic number, but it works for me :^)
.align 3
_gdt: .quad 0x0000000000000000 /* NULL descriptor */
.quad 0x00c09a00000007ff /* 8Mb */
.quad 0x00c09200000007ff /* 8Mb */
.quad 0x0000000000000000 /* TEMPORARY - don't use */
.fill 252,8,0 /* space for LDT's and TSS's etc */
gdt表項的長爲quad，也就是64bit，一共設置了四項。按照intel的意圖，是每個進程，都要有自己的gdt表項，實現分段機制。但linux沒有這麼做，這四項中只有第二和第三項有意義。我們對照下gdt表項結構，來看下其用意：
段限長limit從【0，15】（47，50】共20位，在G=0,時尋址空間1m，G=1時，爲4G。
段基址【16，31】，【32，39】，（55，64】，共32位，尋址空間爲4G。
0x00c0 9a00 0000 07ff，與上圖對照可知，其段基址是：0x00 00 00 00 也就是3G，而段限長爲：0x0 07ff
即82564k,也就是8m。C即是1100，對應用的G=1，打開分頁狀態。9是1001，對應DPL爲00，也就是內核特權級。a是1010，type爲a,表示這段可讀可執行。
同樣的分析，可以0x00c09200000007ff，僅僅是type不一樣，type爲2，表示此段可讀可寫。
在設置完中斷和描述符後，要重新設置段寄存器：
movl $0x10,%eax # reload all the segment registers
mov %ax,%ds # after changing gdt. CS was already
mov %ax,%es # reloaded in 'setup_gdt'
mov %ax,%fs
mov %ax,%gs
lss _stack_start,%esp
接着爲執行main.c作準備：
xorl %eax,%eax
1: incl %eax # check that A20 really IS enabled
movl %eax,0x000000
cmpl %eax,0x100000
je 1b
movl %cr0,%eax # check math chip
andl $0x80000011,%eax # Save PG,ET,PE
testl $0x10,%eax
jne 1f # ET is set - 387 is present
orl $4,%eax # else set emulate bit
1: movl %eax,%cr0
jmp after_page_tables
先判斷a20是否開啓，如果開啓，則0x00 00 00與0x10 00 00處的值不一樣，跳出循環。再設置cr0，完成後，跳轉到after_pamge_tables執行：
.org 0x4000
after_page_tables:
pushl $0 # These are the parameters to main :-)
pushl $0
pushl $0
pushl $L6 # return address for main, if it decides to.
pushl $_main
jmp setup_paging
L6:
jmp L6 # main should never return here, but
# just in case, we know what happens.
L6處是個死循環，main函數返回後纔會執行，但是，一般情況下不會發生,setup_paging返回後，將執行main函數，下面我們來看看setup_paging
/*
* Setup_paging
*
* This routine sets up paging by setting the page bit
* in cr0. The page tables are set up, identity-mapping
* the first 8MB. The pager assumes that no illegal
* addresses are produced (ie >4Mb on a 4Mb machine).
*
* NOTE! Although all physical memory should be identity
* mapped by this routine, only the kernel page functions
* use the >1Mb addresses directly. All "normal" functions
* use just the lower 1Mb, or the local data space, which
* will be mapped to some other place - mm keeps track of
* that.
*
* For those with more memory than 8 Mb - tough luck. I've
* not got it, why should you :-) The source is here. Change
* it. (Seriously - it shouldn't be too difficult. Mostly
* change some constants etc. I left it at 8Mb, as my machine
* even cannot be extended past that (ok, but it was cheap :-)
* I've tried to show which constants to change by having
* some kind of marker at them (search for "8Mb"), but I
* won't guarantee that's all :-( )
*/
.align 2
setup_paging:
movl $1024*3,%ecx
xorl %eax,%eax
xorl %edi,%edi /* pg_dir is at 0x000 */
cld;rep;stosl
movl $pg0+7,_pg_dir /* set present bit/user r/w */
movl $pg1+7,_pg_dir+4 /* --------- " " --------- */
movl $pg1+4092,%edi
movl $0x7ff007,%eax /* 8Mb - 4096 + 7 (r/w user,p) */
std
1: stosl /* fill pages backwards - more efficient :-) */
subl $0x1000,%eax
jge 1b
xorl %eax,%eax /* pg_dir is at 0x0000 */
movl %eax,%cr3 /* cr3 - page directory start */
movl %cr0,%eax
orl $0x80000000,%eax
movl %eax,%cr0 /* set paging (PG) bit */
ret /* this also flushes prefetch-queue */
.align 2
.word 0
idt_descr:
.word 256*8-1 # idt contains 256 entries
.long _idt
.align 2
.word 0