x86 PC刚开机时CPU处于实模式，和保护模式对应，实模式的寻址CS:IP(CS左移4位+IP)，和保护模式不一样，保护模式通过GDT寻址。
开机时：cs=0xFFFF，ip=0x0000，寻址0xFFFF0(ROM BIOS映射区)(BIOS 基本输入输出系统)，检查RAM，键盘，显示器，软硬磁盘。还有BIOS在内存中加载中断向量表和中断服务程序。其内存布局如下：
构建初始化完成后，CPU接受一个int 0x19中断，CPU接受到这个中断后，会立即在中断向量表找到int 0x19中断向量。接下来，中断向量把CPU指向0x0E6F2，这个位置就是int 0x19相对应的中断服务程序的入口地址，将磁盘0磁道0扇区读入0x7c00处，设置cs=0x07c0，ip=0x0000。
bootsect.s功能执行：
!
! SYS_SIZE is the number of clicks (16 bytes) to be loaded.
! 0x3000 is 0x30000 bytes = 196kB, more than enough for current
! versions of linux
!
SYSSIZE = 0x3000
!
! bootsect.s (C) 1991 Linus Torvalds
!
! bootsect.s is loaded at 0x7c00 by the bios-startup routines, and moves
! iself out of the way to address 0x90000, and jumps there.
!
! It then loads 'setup' directly after itself (0x90200), and the system
! at 0x10000, using BIOS interrupts.
!
! NOTE! currently system is at most 8*65536 bytes long. This should be no
! problem, even in the future. I want to keep it simple. This 512 kB
! kernel size should be enough, especially as this doesn't contain the
! buffer cache as in minix
!
! The loader has been made as simple as possible, and continuos
! read errors will result in a unbreakable loop. Reboot by hand. It
! loads pretty fast by getting whole sectors at a time whenever possible.
.globl begtext, begdata, begbss, endtext, enddata, endbss
.text
begtext:
.data
begdata:
.bss
begbss:
.text
SETUPLEN = 4 ! nr of setup-sectors
BOOTSEG = 0x07c0 ! original address of boot-sector
INITSEG = 0x9000 ! we move boot here - out of the way
SETUPSEG = 0x9020 ! setup starts here
SYSSEG = 0x1000 ! system loaded at 0x10000 (65536).
ENDSEG = SYSSEG + SYSSIZE ! where to stop loading
! ROOT_DEV: 0x000 - same type of floppy as boot.
! 0x301 - first partition on first drive etc
ROOT_DEV = 0x306
entry _start
_start:
mov ax,#BOOTSEG
mov ds,ax
mov ax,#INITSEG
mov es,ax
mov cx,#256
sub si,si
sub di,di
rep
movw
jmpi go,INITSEG
go: mov ax,cs
mov ds,ax
mov es,ax
! put stack at 0x9ff00.
mov ss,ax
mov sp,#0xFF00 ! arbitrary value >>512
! load the setup-sectors directly after the bootblock.
! Note that 'es' is already set up.
load_setup:
mov dx,#0x0000 ! drive 0, head 0
mov cx,#0x0002 ! sector 2, track 0
mov bx,#0x0200 ! address = 512, in INITSEG
mov ax,#0x0200+SETUPLEN ! service 2, nr of sectors
int 0x13 ! read it
jnc ok_load_setup ! ok - continue
mov dx,#0x0000
mov ax,#0x0000 ! reset the diskette
int 0x13
j load_setup
ok_load_setup:
! Get disk drive parameters, specifically nr of sectors/track
mov dl,#0x00
mov ax,#0x0800 ! AH=8 is get drive parameters
int 0x13
mov ch,#0x00
seg cs
mov sectors,cx
mov ax,#INITSEG
mov es,ax
! Print some inane message
mov ah,#0x03 ! read cursor pos
xor bh,bh
int 0x10
mov cx,#34
mov bx,#0x0007 ! page 0, attribute 7 (normal)
mov bp,#msg1
mov ax,#0x1301 ! write string, move cursor
int 0x10
! ok, we've written the message, now
! we want to load the system (at 0x10000)
mov ax,#SYSSEG
mov es,ax ! segment of 0x010000
call read_it
call kill_motor
! After that we check which root-device to use. If the device is
! defined (!= 0), nothing is done and the given device is used.
! Otherwise, either /dev/PS0 (2,28) or /dev/at0 (2,8), depending
! on the number of sectors that the BIOS reports currently.
seg cs
mov ax,root_dev
cmp ax,#0
jne root_defined
seg cs
mov bx,sectors
mov ax,#0x0208 ! /dev/ps0 - 1.2Mb
cmp bx,#15
je root_defined
mov ax,#0x021c ! /dev/PS0 - 1.44Mb
cmp bx,#18
je root_defined
undef_root:
jmp undef_root
root_defined:
seg cs
mov root_dev,ax
! after that (everyting loaded), we jump to
! the setup-routine loaded directly after
! the bootblock:
jmpi 0,SETUPSEG
! This routine loads the system at address 0x10000, making sure
! no 64kB boundaries are crossed. We try to load it as fast as
! possible, loading whole tracks whenever we can.
!
! in: es - starting address segment (normally 0x1000)
!
sread: .word 1+SETUPLEN ! sectors read of current track
head: .word 0 ! current head
track: .word 0 ! current track
read_it:
mov ax,es
test ax,#0x0fff
die: jne die ! es must be at 64kB boundary
xor bx,bx ! bx is starting address within segment
rp_read:
mov ax,es
cmp ax,#ENDSEG ! have we loaded all yet?
jb ok1_read
ret
ok1_read:
seg cs
mov ax,sectors
sub ax,sread
mov cx,ax
shl cx,#9
add cx,bx
jnc ok2_read
je ok2_read
xor ax,ax
sub ax,bx
shr ax,#9
ok2_read:
call read_track
mov cx,ax
add ax,sread
seg cs
cmp ax,sectors
jne ok3_read
mov ax,#1
sub ax,head
jne ok4_read
inc track
ok4_read:
mov head,ax
xor ax,ax
ok3_read:
mov sread,ax
shl cx,#9
add bx,cx
jnc rp_read
mov ax,es
add ax,#0x1000
mov es,ax
xor bx,bx
jmp rp_read
read_track:
push ax
push bx
push cx
push dx
mov dx,track
mov cx,sread
inc cx
mov ch,dl
mov dx,head
mov dh,dl
mov dl,#0
and dx,#0x0100
mov ah,#2
int 0x13
jc bad_rt
pop dx
pop cx
pop bx
pop ax
ret
bad_rt: mov ax,#0
mov dx,#0
int 0x13
pop dx
pop cx
pop bx
pop ax
jmp read_track
!/*
! * This procedure turns off the floppy drive motor, so
! * that we enter the kernel in a known state, and
! * don't have to worry about it later.
! */
kill_motor:
push dx
mov dx,#0x3f2
mov al,#0
outb
pop dx
ret
sectors:
.word 0
msg1:
.byte 13,10
.ascii "Linux system ..."
.byte 13,10,13,10,13,10
.org 508
root_dev:
.word ROOT_DEV
boot_flag:
.word 0xAA55
.text
endtext:
.data
enddata:
.bss
endbss:
bootsect启动程序将它自身从内容0x07c00(BOOTSEG)处复制至内存0x9000(INITSEG)处。
0x13是BIOS读磁盘扇区的中断。参数传递完毕后，产生0x13中断，将第2个扇区开始的4个扇区，即setup.s对应程序加载至内存的SETUPSEG（0x90200）处。
接下来bootsect程序就要执行第三批程序的载入工作，即将系统模块载入内存。
从底层技术上看，这次载入与前面的setup程序的载入没有本质的区别。比较突出的是这次加载的扇区数是240，是之前4个扇区的60倍，且所需时间也是之前的几十倍。为了防止加载期间用户误认为是机器故障，而执行不适当的操作，Linux再次设计了显示一行屏幕信息“Linux System ....”以提示用户计算机正在加载系统。加载工作是通过read_it子程序完成的。
bootsect任务完成后，通过执行"jmpi 0, SETUPSEG"，这行语句跳转值0x90200处，setup程序加载的位置。开始setup程序的执行。
setup.s功能：
读取系统数据加载到内存0x90000~0x901FC位置，这些数据将在以后main函数执行是发挥重要作用。
关闭中断，将位于0x10000的内核程序拷贝至内存地址起始位置0x00000处。
重新设置中断描述符表和全局描述符表。打开32位寻址方式。
system模块功能：
head.s汇编成目标代码，将用C语言编写的内存程序编译成目标代码，然后链接成system模块。也就是说，system模块里面，既有内核程序，又有head程序，两者是紧挨着的。要点是，head程序在程序前面，内核程序在后面，所以head程序名字叫“head”，head程序在内存中占用25KB+184B的空间。
head程序除了做一些调用main的准备工作之外，还做了一件对内核程序在内存中的布局及内核程序的正常运行有重大意义的事，即用程序自身的代码在程序自身所在内存空间创建了内核分页机制，即在0x000000的位置创建了页目录表，页表，缓冲区，GDT，IDT，并将head程序已经执行过的代码所占的内存空间覆盖，这意味着head程序自己将自己废弃，main函数即将开始执行。
head程序将L6标号和main函数入口地址压栈，栈顶为main函数地址，目的是使head程序执行完后通过ret指令就可以直接执行main函数。
如果main函数退出，就会返回这里的标号L6处继续执行下去，并产生死循环。