从 DOS 程序进入保护模式

Question

我想我已经阅读了十几个基本上与这个问题重复的问题，但我仍然没有找到解决方案。

期望的结果是进入保护模式并停止而没有故障。我遇到的问题是使用 6 字节立即值执行段间jmp 后出现三重错误。

这是我在 DOSBox 和运行 MS-DOS 7 的 Pentium II PC 中产生错误的代码。 汇编器是 MASM 5.10

single segment stack                                                      
assume cs:single,ds:single 

gdt        dq 0

c_limit_lo dw 0ffffh     
c_base_lo  dw 0
c_base_mid db 0
c_priv     db 10011110b ;present set, highest priv, type set, conforming, read      
c_limit_hi db 11001111b ;granularity set, operand size 32  
c_base_hi  db 0

d_limit_lo dw 0ffffh
d_base_lo  dw 0
d_base_mid db 0
d_priv     db 10010010b ;present set, highest priv, type clr, expand dn, write  
d_limit_hi db 11001111b ;granularity set, big set 
d_base_hi  db 0
gdt_end:

gdt_limit  dw gdt_end-offset gdt-1
gdt_addr   dd ?

start:
     mov ax, cs
     mov ds, ax
                                   ;calc phys address of current code segment and
                                   ;insert it into code and data descriptors 
     .386p                         
     xor eax, eax
     mov ax, cs                    
     mov cl, 4              
     shl eax, cl                   ;multiply cs by 16 to get phys address of seg
     mov edx, eax
     mov c_base_lo, ax
     mov d_base_lo, ax             ;low word
     mov cl, 16
     shr eax, cl
     mov c_base_mid, al
     mov d_base_mid, al            ;middle byte
     mov c_base_hi, ah
     mov d_base_hi, ah             ;high byte
     add edx, offset gdt           ;add offset of gdt 
     mov gdt_addr, edx             ;gdt address set 

                                   ;attempt to enter protected mode
     cli                           ;disable interrupts
     in al, 70h
     or al, 80h
     out 70h, al                   ;turn off nonmasked interrupts
     in al, 92h
     or al, 2
     out 92h, al                   ;enable A20 line
     lgdt [gdt_limit]
     mov eax, cr0         
     or eax, 1
     mov cr0, eax                  ;enter protected mode
     db 66h                        ;specify 32-bit operand
     jmp_op  db 0eah               ;manually encoded "jmp 8h:enter_32" TRIPLE FAULT
     jmp_loc_lo dw offset enter_32
     jmp_loc_hi dw 0
     jmp_sel dw 8
enter_32:  
     mov eax, 0ffffffffh           ;sometimes doesn't triple fault on infinite jump or hlt instruction
back:jmp back                      ;but always triple faults on mov



the_stack db 64 dup (0ffh)          ;64 byte stack

single ends                                                                  
end start       

三重错误在某种程度上似乎是“运气”。远跳转后 0x67 前缀和 nops 的某些配置会导致 cpu 表现得好像它已停止。不是很懂。

我认为我生成了错误的跳转目标。

更新：单字节指令（无论 cpu 模式如何，单编码指令）都不会出错。我想我会尝试跳入 USE32 定义的细分市场。

此代码没有错误：

     jmp_op  db 0eah               
     jmp_loc_lo dw offset enter_32
     jmp_loc_hi dw 0
     jmp_sel dw 8
enter_32:  
     aaa
     daa
     cmc
     cld
     cli
     stc
     nop
     aaa
     daa
     cmc
     cld
     cli
     stc
     nop
     hlt

Answer 1

由 fuz 回答，我只需要跳转到为 32 位模式汇编的代码。您通过使用 USE32 关键字定义一个段来告诉汇编器生成 32 位代码。

带有 VGA 演示和模式切换回实模式的完整保护模式程序：

single segment stack                                                      
assume cs:single,ds:single 

gdt        dq 0                             ;global descriptor table
p_code     dq 00cf9e000000ffffh             ;protected mode code descriptor
p_data     dq 00cf92000000ffffh             ;protected mode data descriptor
r_code     dq 008f9a000000ffffh             ;real mode code descriptor
r_data     dq 008f92000000ffffh             ;real mode data descriptor
v_buff     dq 00cf920a0000ffffh             ;vga buffer descriptor

gdt_limit  dw offset gdt_limit-offset gdt-1 ;gdt_limit <- gdt byte size -1
gdt_addr   dd offset gdt                    ;gdt_addr <- offset of gdt, phys address of
                                            ;code segment will be added
start:
    mov ax, cs 
    mov ds, ax                   ;ds = cs, single segment
    mov ax, 13h
    int 10h                      ;enter vga 320x200x256

    .386p                        ;enable 32-bit extensions
    xor eax, eax                 ;clear high word of eax
    mov ax, cs                   ;eax <- cs 
    shl eax, 4                   ;eax <- physical address of cs 
    add [gdt_addr], eax          ;gdt_addr <- physical address of gdt
    mov word ptr [r_code+2], ax  
    mov word ptr [r_data+2], ax  ;insert low word of cs phys address
    shr eax, 16
    mov byte ptr [r_code+4], al
    mov byte ptr [r_data+4], al  ;insert middle byte of cs address
    mov byte ptr [r_code+7], ah
    mov byte ptr [r_data+7], ah  ;insert high byte of cs address

    xor eax, eax                 ;clear high word of eax
    mov ax, seg32                ;eax <- seg32 segment address
    shl eax, 4                   ;eax <- physical address of seg32 
    mov word ptr [p_code+2], ax   
    mov word ptr [p_data+2], ax  ;insert low word of seg32 phys address
    shr eax, 16
    mov byte ptr [p_code+4], al
    mov byte ptr [p_data+4], al  ;insert middle byte of seg32 address
    mov byte ptr [p_code+7], ah
    mov byte ptr [p_data+7], ah  ;insert high byte of seg32 address

    cli                          ;disable interrupts
    in al, 70h                   ;al <- cmos ram index register port
    or al, 80h                   ;set bit 7 to disable nmi 
    out 70h, al                  ;nmi disabled
    in al, 92h                   ;al <- ps/2 system control port
    or al, 2                     ;set bit 1 to enable a20
    out 92h, al                  ;a20 enabled

    lgdt [gdt_limit]             ;load gdt 
    mov eax, cr0                  
    or eax, 1                    ;set pe bit
    mov cr0, eax                 ;enter protected mode
    db 66h                       ;specify 32-bit operand
    db 0eah                      ;manually encoded jmp 8h:0, jump to offset 0 of seg32
    dd offset enter_32                  
    dw 8 

ret_real:
    mov eax, cr0
    and al, 11111110b            ;clear pe bit
    mov cr0, eax                 ;real mode enabled     
    db 0eah                      ;jmp single:real_cs to load cs:ip
    dw offset real_cs
    dw seg single  

real_cs:
    mov ax, cs                      
    mov ds, ax                   ;ds = cs
    mov ss, ax                   ;ss = cs
    mov sp, offset s16_end       ;top of stack is end of stack
    in al, 70h                   ;al <- cmos ram index register port
    and al, 01111111b            ;clear bit 7 to enable nmi 
    out 70h, al                  ;nmi enabled
    sti                          ;enable interrupts

    mov ax, 40h
    mov es, ax                   ;access kbd data area via segment 40h
    mov word ptr es:[1ah], 1eh   ;set the kbd buff head to start of buff
    mov word ptr es:[1ch], 1eh   ;set kbd buff tail to same as buff head
                                 ;now the keyboard buffer is cleared.
    xor ah, ah                   ;select video mode function
    mov al, 3                    ;select 80x25 16 colors
    int 10h                      ;restore vga compatible text mode
    mov ax, 4c00h                ;Terminate process function selected
    int 21h                      ;return to ms-dos

s16 db 256 dup (0ffh)            ;needed 256 bytes to call int 10h on fx5200 vga bios
s16_end: 
single ends   


seg32 segment use32
assume cs:seg32,ds:seg32

enter_32:
    mov ax, 10h                  ;protected mode data segment selector
    mov ds, ax                   ;ds references main data segment
    mov ss, ax                   ;stack is in main data segment 
    mov esp, offset s32_end      ;initial top of stack is end of stack
    mov ax, 28h                  ;vga buffer selector
    mov es, ax                   ;es references vga buffer  
    mov eax, 0ffffffffh          ;initialize eax
write_scr:
    inc al
    inc ah
    rol eax, 16
    inc al
    inc ah                       ;increment each byte of eax
    xor edi, edi                 ;init index
    mov ecx, 320*200/4           ;vga buffer length in bytes

    push eax
    mov dx, 3dah                 ;dx <- vga status register
vrb_set:
    in al, dx                    ;al <- status byte
    test al, 8                   ;is bit vertical retrace bit set
    jnz vrb_set                  ;if so, wait for it to clear
vrb_clr:                         ;when clear, wait for it to be set
    in al, dx
    test al, 8
    jz vrb_clr                   ;loop back until vertical retrace bit has been set
    pop eax
    rep stosd                    ;fill vga buffer

    push eax
    in al, 60h                   ;al <- keyboard data port
    mov ebx, eax                 
    pop eax                     
    cmp bl, 1                    ;escape key scancode? 
    jne write_scr                ;if not, update screen
    mov ax, 20h                  ;real mode data selector
    mov ds, ax                   
    mov es, ax                   ;setup ds and es for real mode
    db 0eah                      ;jmp 18h:ret_real to load real mode code descriptor 
    dd offset ret_real
    dw 18h

s32 db 128 dup (0ffh)            ;128 byte stack
s32_end:
seg32 ends

end start

---

为 16 位实模式汇编代码并在 32 位保护模式下运行它可能会产生意外行为和崩溃。这个 16 位代码：

    mov eax, 0ffffffffh
back:jmp back

编码为：

66B8FFFFFFFF      mov eax,0xffffffff
EBFE              jmp short 0x6

但是，如果将此字节序列解码为 32 位保护模式指令，它们将被解释为：

66B8FFFF          mov ax,0xffff
FF                db 0xff
FF                db 0xff
EBFE              jmp short 0x6

在将 0xffff 移动到寄存器 AX 后，处理器会在发现无效指令（字节 0xff）时引发一般保护错误 (#GP)。如果没有正确的中断描述符表 (IDT) 和 #GP 的异常处理程序，则会发生三重故障。