diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..7558c1e
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+qemu/metaverse.img filter=lfs diff=lfs merge=lfs -text
diff --git a/qemu/metaverse.img b/qemu/metaverse.img
index 8966027..f27d4de 100644
Binary files a/qemu/metaverse.img and b/qemu/metaverse.img differ
diff --git a/src/include/asm/sysctl.h b/src/include/asm/sysctl.h
deleted file mode 100644
index 1219f6c..0000000
--- a/src/include/asm/sysctl.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef SYSCTL_H
-#define SYSCTL_H 1
-
-#define __asm_hlt__() __asm__("hlt");
-
-#endif
diff --git a/src/include/kernel/mm.h b/src/include/kernel/mm.h
deleted file mode 100644
index 5f9dc51..0000000
--- a/src/include/kernel/mm.h
+++ /dev/null
@@ -1,48 +0,0 @@
-#ifndef MM_H
-#define MM_H 1
-
-#include <types.h>
-
-#define MM_PAGE_TABLE_FLAGS_AREA ((u64)0xfff)
-
-/* 页对齐掩码 */
-
-#define MM_4K_ALIGN_MASK ((u64)0xfff)
-#define MM_2M_ALIGN_MASK ((u64)0x1fffff)
-#define MM_1G_ALIGN_MASK ((u64)0x3fffffff)
-
-/* 页表项属性FLAGS */
-
-#define MM_PML4E_KERNEL_RW_FLAG ((u64)0x3)
-#define MM_PML4E_KERNEL_RO_FLAG ((u64)0x1)
-
-#define MM_PDPTE_KERNEL_GLB_BP_RW_FLAG ((u64)0x183)
-#define MM_PDPTE_KERNEL_GLB_RW_FLAG ((u64)0x103)
-#define MM_PDPTE_KERNEL_GLB_BP_RO_FLAG ((u64)0x181)
-#define MM_PDPTE_KERNEL_GLB_RO_FLAG ((u64)0x101)
-
-#define MM_PDPTE_KERNEL_BP_RW_FLAG ((u64)0x83)
-#define MM_PDPTE_KERNEL_RW_FLAG ((u64)0x3)
-#define MM_PDPTE_KERNEL_BP_RO_FLAG ((u64)0x81)
-#define MM_PDPTE_KERNEL_RO_FLAG ((u64)0x1)
-
-#define MM_PDTE_KERNEL_GLB_BP_RW_FLAG ((u64)0x183)
-#define MM_PDTE_KERNEL_RW_FLAG ((u64)0x3)
-#define MM_PDTE_KERNEL_GLB_BP_RO_FLAG ((u64)0x181)
-#define MM_PDTE_KERNEL_RO_FLAG ((u64)0x1)
-
-#define MM_PDTE_KERNEL_BP_RW_FLAG ((u64)0x83)
-#define MM_PDTE_KERNEL_BP_RO_FLAG ((u64)0x81)
-
-#define MM_PTE_KERNEL_RW_FLAG ((u64)0x103)
-#define MM_PTE_KERNEL_RO_FLAG ((u64)0x101)
-
-/* 页表大小枚举 */
-enum mm_page_size
-{
-    MM_PAGE_SIZE_4K = 1,
-    MM_PAGE_SIZE_2M = 512,
-    MM_PAGE_SIZE_1G = 262144,
-};
-
-#endif
diff --git a/src/kernel/arch/x86_64/entry.s b/src/kernel/arch/x86_64/entry.s
index bf8e2b1..1e4fd12 100644
--- a/src/kernel/arch/x86_64/entry.s
+++ b/src/kernel/arch/x86_64/entry.s
@@ -4,12 +4,11 @@
 init64:
     endbr64
     cli
-    jmp $
     mov rax, 0x1000000
     mov rbp, rax
     mov rsp, rax
     mov rdi, rbx
-    jmp qword kmain
+    jmp kmain
 
     section .multiboot2 align=8
     MULTIBOOT2_HEADER_MAGIC    equ 0xe85250d6
@@ -24,22 +23,25 @@ multiboot2_header:
         dd bootinfo_request_tag_end - bootinfo_request_tag
         dd 4    ; basic mamory info
         dd 1    ; boot command line
-        dd 3    ; muldules
-        dd 6    ; memory map
         dd 8    ; framebuffer info
         dd 12   ; efi64 system table pointer
     bootinfo_request_tag_end:
+    framebuffer_tag:
+        dd 5
+        dd 20
+        dd 1920 ; width
+        dd 1080 ; height
+        dd 32   ; depth
+    framebuffer_tag_end:
+    dd  0
     end_tag:
         dd 0
         dd 8
 multiboot2_header_end:
 
-    section .bss
+    section .kstack
 kstack:
-    ; TODO 奇怪的问题，在这写0x1000000 - 0x400000，.bss段会超出0x47f，
-    ; 写0x1000000 - 0x400000 - 0x47f，.bss段会超出0x1f
-    ; 明明在链接脚本里.bss段的起始地址是0x400000
-    resb 0x1000000 - 0x400000 - 0x47f - 0x1f
+    resb 0x1000000 - 0x400000
 
     section .kend
     global kend
diff --git a/src/kernel/arch/x86_64/entry32.s b/src/kernel/arch/x86_64/entry32.s
index 8add63b..4042185 100644
--- a/src/kernel/arch/x86_64/entry32.s
+++ b/src/kernel/arch/x86_64/entry32.s
@@ -8,17 +8,17 @@ init32:
     cli
 
     ; 设置PML4的第0项
-    mov eax, 0x102000
+    mov eax, 0x102000   ; PDPT0
     add eax, 0x003
-    mov edi, 0x101000
+    mov edi, 0x101000   ; PML4
     mov dword [edi], eax
     add edi, 4
     mov dword [edi], 0
 
     ; 设置PDPT的第0项
-    mov eax, 0x103000
+    mov eax, 0x103000   ; PD0
     add eax, 0x003
-    mov edi, 0x102000
+    mov edi, 0x102000   ; PDPT0
     mov dword [edi], eax
     add edi, 4
     mov dword [edi], 0
@@ -26,23 +26,23 @@ init32:
     ; 设置PD0中的PDE
     mov ecx, 64
     mov eax, 0
-    mov edi, 0x103000
+    mov edi, 0x103000   ; PD0
     init32_loop0:
         mov edx, eax
         add edx, 0x183
         mov dword [edi], edx
-        add eax, 0x400000   ; 2MB
+        add eax, 0x200000   ; 2MB
         add edi, 4
         mov dword [edi], 0
         add edi, 4
     loop init32_loop0
 
     ; 设置gdt_ptr
-    mov eax, 0x10402a
-    mov dword [eax], 0x104000
+    mov eax, 0x10402a   ; gdt_ptr + 2
+    mov dword [eax], 0x104000   ; gdt
     ; 加载GDTR和段寄存器
     db 0x66
-    lgdt [0x104028]
+    lgdt [0x104028]     ; gdt_ptr
     mov ax, 0x10
     mov ds, ax
     mov ss, ax
@@ -56,7 +56,7 @@ init32:
     mov cr4, eax
 
     ; 加载cr3
-    mov eax, 0x101000
+    mov eax, 0x101000   ; PML4
     mov cr3, eax
 
     ; 切换ia32e模式
@@ -65,7 +65,7 @@ init32:
     bts eax, 8
     wrmsr
 
-    ; 打开分页机制
+    ; 打开保护模式和分页机制
     mov eax, cr0
     bts eax, 0
     bts eax, 31
diff --git a/src/kernel/main.c b/src/kernel/main.c
index 318b233..802a81f 100644
--- a/src/kernel/main.c
+++ b/src/kernel/main.c
@@ -1,5 +1,6 @@
 #include <kernel/kernel.h>
 #include <kernel/tty.h>
+#include <kernel/memm.h>
 
 #include <libk/multiboot2.h>
 
@@ -8,9 +9,23 @@ void get_frame_buffer_with_bootinfo(framebuffer *fb, bootinfo_t *bootinfo);
 
 void kmain(void *mb2_bootinfo)
 {
+    // 创建bootinfo对象
     bootinfo_t bootinfo;
     bootinfo_new(&bootinfo, mb2_bootinfo);
 
+    // 获取内存信息
+    void **tags;
+    usize tags_amount;
+    if ((tags_amount = bootinfo_get_tag(bootinfo, BOOTINFO_BASIC_MEMORY_INFO_TYPE, &tags)) == 0)
+    {
+        KERNEL_TODO();
+    }
+    bootinfo_basic_memory_info_t *meminfo = bootinfo_basic_memory_info(tags[0]);
+    usize mem_size = 1024 * 1024 + meminfo->mem_upper * 1024;
+
+    // 初始化内存管理模块
+    mem_manager_t *memm = memm_new(mem_size);
+
     tty_controller_init();
 
     framebuffer fb;
@@ -34,4 +49,16 @@ void get_frame_buffer_with_bootinfo(framebuffer *fb, bootinfo_t *bootinfo)
     {
         KERNEL_TODO();
     }
+    bootinfo_framebuffer_info_t *fbinfo = bootinfo_framebuffer_info(tags[0]);
+    fb->pointer = (void *)fbinfo->framebuffer_addr;
+    fb->width = fbinfo->framebuffer_width;
+    fb->height = fbinfo->framebuffer_height;
+    fb->pixsize = fbinfo->framebuffer_bpp / 8;
+    // TODO 对应内存空间还没有分页
+    KERNEL_TODO();
+    for (usize i = 0; i < 10000; i++)
+    {
+        ((u8 *)fb->pointer)[i] = 0xff;
+    }
+    KERNEL_TODO();
 }
diff --git a/src/libk/multiboot2/bootinfo.c b/src/libk/multiboot2/bootinfo.c
index e42135b..7a226ee 100644
--- a/src/libk/multiboot2/bootinfo.c
+++ b/src/libk/multiboot2/bootinfo.c
@@ -7,6 +7,15 @@ typedef struct __bootinfo_next_result_t
     void *addr;
 } bootinfo_next_result_t;
 
+u32 mbi_record[32];
+u32 mbirc = 0;
+
+/**
+ * @brief
+ * 
+ * @param bootinfo 
+ * @param result 
+ */
 void bootinfo_next(bootinfo_t *bootinfo, bootinfo_next_result_t *result)
 {
     if (bootinfo->iter_index >= bootinfo->size)
@@ -34,6 +43,7 @@ void bootinfo_new(bootinfo_t *bootinfo, void *bootinfo_addr)
     memset(bootinfo->map_counts, 0, sizeof(bootinfo->map_counts));
     while ((bootinfo_next(bootinfo, &res), res.type))
     {
+        mbi_record[mbirc++] = res.type;
         if (res.type == BOOTINFO_EFI_BOOTSERVICE_NOT_TERMINATED_TYPE)
         {
             bootinfo->map_counts[res.type] = true;
diff --git a/src/metaverse.lds b/src/metaverse.lds
index 4f876fa..c038e87 100644
--- a/src/metaverse.lds
+++ b/src/metaverse.lds
@@ -18,10 +18,10 @@ SECTIONS {
         *(.cpumeta)
     }
     . = 4M;
-    .bss :
+    ..kstack :
     {
         kstack = .;
-        *(.bss)
+        *(.kstack)
     }
     . = 16M;
     .text :