问题
How do I perform an indirect far jump/call in protected mode? First I was thinking that doing this is allowable:
jmp 0x10:eax;
(Don't worry about the segment selector..the 2nd entry of my GDT is a valid code segment)
But when nasm assembled it, it was a syntax error. Looking at the Book 2a of the Intel (instruction set reference) manual, it can only be done using jmp ptr16:32, where the ptr16:32 is an immediate value, or using jmp m16:32, where the m16:32 is a memory location containing the 48-bit jump address (the 16:32).
Now I tried to encode it this way:
mov dword[ds:jumpaddress_offset],eax
; or just dword[jumpaddress_offset],eax
mov word[ds:jumpaddress_sel],0x10;
; or just mov word[ds:jumpaddress_sel],0x10;
jmp dword far [dword ds:jumpaddress];
...
jumpaddress:
jumpaddress_sel dw 0
jumpaddress_offset dd 0
It assembled successfully, but when I tried to run it the processor gets a general protection fault and restarts. I don't know what happened.
I assumed the encoding is like this:
(for example I want to jump to 0x10:0x8010 using indirect jump)
dw 0x10
dd 0x8010
What could be the wrong with this? Is it that the 48-bit memory value should be coded in little endian? And should it be coded like this?
;0010 0000 8010
dd 0x10,0x80,0,0,0x10,0
I haven't tried doing the last one.
回答1:
A frequently used trick is to emulate the jump using a far ret, such as:
push 0x10
push eax
retf
回答2:
The x86 processors use little-endian mode. In keeping with that, the offset of a target precedes the segment in memory. For your example you should use:
dd 0x8010 ;offset of far jump
dd 0x10 ;segment of far jump, expanded to double-word for alignment reasons
;------------------
db 0x10, 0x80, 0, 0, 0x10, 0, 0, 0 ;will also work.
You might still get a privilege exception. For the code to work the target code segment must have the same privilege level as the source segment.
Primary source: The Processor and Coprocessor by Robert L. Hummel
来源：https://stackoverflow.com/questions/4812797/doing-a-indirect-far-jump-call-in-protected-mode