Assembler jump in Protected Mode with GDT

Question

I am currently playing around with x86 Assember in order to sharpen my low-level programming skills. Currently, I am facing a little problem with the addressing scheme in 32-Bit Protected Mode.

The situation is the following:

I have a Program loaded at 0x7e0 which switches the CPU to Protected Mode and jumps to the according label in the code:

[...]
code to switch CPU in Protected Mode
[...]

jmp ProtectedMode


[...]

bits 32

ProtectedMode:
    .halt:
        hlt
        jmp .halt

This works absolutely fine so far. The "jmp ProtectedMode" works without a explicit far jump to clear the prefetch queue - since this program is loaded with offset 0 (org 0 at the beginning) - causing the code segment pointing to the right location.

My current problem now is, that within the "ProtectedMode" label I want to jump to an other program which is loaded at 0x8000 (I checked this with a memory dump, the loading function did work properly and the program is loaded correctly to 0x8000).

Since the CPU is now in ProtectedMode and not RealMode anymore, the addressing schema is different. ProtectedMode uses descriptor selectors to lookup a base address and a limit in a descriptor table to add the given offset and retrieve the physical address (as I understood). Therefore, it was necessary to install a GDT before entering ProtectedMode.

Mine is looking like the following:

%ifndef __GDT_INC_INCLUDED__
%define __GDT_INC_INCLUDED__

;*********************************
;* Global Descriptor Table (GDT) *
;*********************************
NULL_DESC:
    dd 0            ; null descriptor
    dd 0

CODE_DESC:
    dw 0xFFFF       ; limit low
    dw 0            ; base low
    db 0            ; base middle
    db 10011010b    ; access
    db 11001111b    ; granularity
    db 0            ; base high

DATA_DESC:
    dw 0xFFFF       ; data descriptor
    dw 0            ; limit low
    db 0            ; base low
    db 10010010b    ; access
    db 11001111b    ; granularity
    db 0            ; base high

gdtr:
    Limit dw 24         ; length of GDT
    Base dd NULL_DESC   ; base of GDT

%endif ;__GDT_INC_INCLUDED__

and is loaded to the GDT register via

lgdt [gdtr]

What I did not understand so far is, how do I now jump to the physical address 0x8000 in ProtectedMode using the GDT?

My first thoughts were to select the Code Descriptor (CODE_DESC) which should point to 0x7e00 (were the current program is loaded) and use the offset that is necessary to get to 0x8000 (512 bytes), resulting in the jump instruction:

jmp CODE_DESC:0x200

But this does not work.

jmp 0x7e0:0x200 

does not work either...

Do you have any idea what I am missing here? Maybe I did not understand something essential within the 32-Bit ProtectedMode addressing scheme and the usage of the GDT.

[EDIT] Complete code:

bits 16
org 0                       ; loaded with offset 0000 (phys addr: 0x7e00)

jmp Start

Start:
    xor ax, ax
    mov ax, cs
    mov ds, ax              ; update data segment

    cli                     ; clear interrupts

    lgdt [gdtr]             ; load GDT from GDTR (see gdt_32.inc)

    call OpenA20Gate        ; open the A20 gate 

    call EnablePMode        ; jumps to ProtectedMode

;******************
;* Opens A20 Gate *
;******************
OpenA20Gate:
    in al, 0x93         ; switch A20 gate via fast A20 port 92

    or al, 2            ; set A20 Gate bit 1
    and al, ~1          ; clear INIT_NOW bit
    out 0x92, al

    ret

;**************************
;* Enables Protected Mode *
;**************************
EnablePMode:
    mov eax, cr0
    or eax, 1
    mov cr0, eax

    jmp ProtectedMode ; this works (jumps to label and halts)
    ;jmp (CODE_DESC-NULL_DESC):ProtectedMode ; => does not work
    ;jmp 08h:ProtectedMode , => does not work

;***************
;* data fields *
;*  &includes  *
;***************
%include "gdt_32.inc"

;******************
;* Protected Mode *
;******************
bits 32

ProtectedMode:
    ;here I want to jump to physical addr 0x8000 (elf64 asm program)

    .halt:
        hlt
        jmp .halt

Leishmaniasis

Answer 1

There are multiple problems in the code.

First, your GDTR.Base contains the offset of the GDT from the beginning of the code since your code is compiled to begin at address 0 (because of org 0). The base address must be the physical address, not a relative address. IOW, if you keep this org 0, you must add CS*16 (=0x7e00) to Base.

Second, because of that same org 0, the 32-bit offsets in your code (after bits 32 and ProtectedMode:) aren't equal to physical addresses they correspond to, they're 0x7e00 less than the physical addresses. OTOH, the segments defined in your GDT start at physical address 0 (because the base portions of the GDT entries are 0's) and not at 0x7e00. This means that when you try to use these segments with your code/data, you'll be missing the addresses by 0x7e00. If you want to keep org 0, the base addresses in the GDT must be set to 0x7e00.

Or you can change org 0 to org 0x7e00 and then the bases in the GDT should be 0. And you won't need to adjust GDTR.Base by 0x7e00, 0 will do.

This should work:

bits 16
org 0x7e00                  ; loaded at phys addr 0x7e00
                            ; control must be transferred with jmp 0:0x7e00

    xor ax, ax
    mov ds, ax              ; update data segment

    cli                     ; clear interrupts

    lgdt [gdtr]             ; load GDT from GDTR (see gdt_32.inc)

    call OpenA20Gate        ; open the A20 gate 

    call EnablePMode        ; jumps to ProtectedMode

;******************
;* Opens A20 Gate *
;******************
OpenA20Gate:
    in al, 0x93         ; switch A20 gate via fast A20 port 92

    or al, 2            ; set A20 Gate bit 1
    and al, ~1          ; clear INIT_NOW bit
    out 0x92, al

    ret

;**************************
;* Enables Protected Mode *
;**************************
EnablePMode:
    mov eax, cr0
    or eax, 1
    mov cr0, eax

    jmp (CODE_DESC - NULL_DESC) : ProtectedMode

;***************
;* data fields *
;*  &includes  *
;***************
;%include "gdt_32.inc"
;*********************************
;* Global Descriptor Table (GDT) *
;*********************************
NULL_DESC:
    dd 0            ; null descriptor
    dd 0

CODE_DESC:
    dw 0xFFFF       ; limit low
    dw 0            ; base low
    db 0            ; base middle
    db 10011010b    ; access
    db 11001111b    ; granularity
    db 0            ; base high

DATA_DESC:
    dw 0xFFFF       ; limit low
    dw 0            ; base low
    db 0            ; base middle
    db 10010010b    ; access
    db 11001111b    ; granularity
    db 0            ; base high

gdtr:
    Limit dw gdtr - NULL_DESC - 1 ; length of GDT
    Base dd NULL_DESC   ; base of GDT

;******************
;* Protected Mode *
;******************
bits 32

ProtectedMode:
    mov     ax, DATA_DESC - NULL_DESC
    mov     ds, ax ; update data segment

    .halt:
        hlt
        jmp .halt

Note that a segment limit equals the segment size minus 1.

A few more points... Load all segment registers with valid selectors or 0. Also, set up the stack. If you have garbage there (or old values from real mode), when you start playing with interrupts/exceptions, you'll have more crashes.

Finally, I don't know what elf64 is, but you will have to take care of the org thing for other modules and make sure all generated addresses correspond to load addresses. And if you intend to enable 64-bit mode, there's a ton of work to do. I'd advise not to rush into 64-bit mode yet since you're tripping over relatively simple stuff.

Mycetozoan

Thanks for the explanation... This is exactly why I am doing this - and it is not that simple when you do this from scratch for the first time just by reading x86 references :)! Btw: Is there any great book that you can advice which handles exactly these type of topics? – Leishmaniasis

I don't know good books. The official documentation from Intel and AMD has all the info, it's just not a typical kind of book or textbook you'd read easily and understand everything immediately (btw, there're many typos and occasional mistakes in Intel's docs). There are many articles and tutorials online. And you can always experiment. Or see someone's code and ask questions. See these groups: alt.os.development, comp.lang.asm.x86. – Mycetozoan

Thanks for your advice !! I'll have a look at that! – Leishmaniasis

Answer 2

A couple things. First, your current code does not technically enter protected mode. You enter protected mode by loading cs with a descriptor from the GDT. Since you can't directly set the cs register, the easiest way to do this is using a far jump. Replace your current jump with:

jmp (CODE_DESC-NULL_DESC):ProtectedMode

Second, the base for your code segment is 0, not 0x7e00. If you look at the four bytes labeled with the word "base", they are all 0. You have two options. Either change your GDT to have a base of 0x7e00, or add directives to change the load address for all protected mode code for a base of 0.

Once you have done both of these things, you can jump to your program using a normal jump instruction. If you choose to leave your GDT as it is, you would use the full address:

jmp 0x8000

If you choose to change the base of your code segment, you will need to use the address relative to that.

jmp 0x200

More information about the GDT
More information about entering protected mode

Schaefer

Thanks for your answer.. OK - when using the jump instruction "jmp CODE_DESC:ProtectedMode" the CPU triple faults and resets (since this jump direction seems to jump somewhere). "jmp ProtectedMode" jumps to the correct label and halts the system though. Since this might be a correlated to the GDT base problem I'll change the GDT and try again. Thanks for your fast response !! – Leishmaniasis

@Schaefer Do you mean jmp (CODE_DESC-NULL_DESC):ProtectedMode? – Vespertine

@NayukiMinase Thanks for catching that, I assumed they were offsets already. – Schaefer

Hmm, i changed "base low" to 0x7e00 and the jump instruction is now "jmp (CODE_DESC-NULL_DESC):ProtectedMode".. But this one still crashes... Is there anything I did not get about the GDT stuff? Reading the tutorial mentioned above does not really talk about the bases ... :| – Leishmaniasis

Looking at the current implementation i would assume, that (CODE_DESC-NULL_DESC) will give a segment selector of 0. Since CODE_DESC must point to 08h (2x dd 0 in the null descriptor). If I leave the base low at 0 again and say jmp 08h:ProtectedMode (which is equivalent to your way) and jump to the program loaded at 0x8000 with "jmp 7ff8" (0x8000 - 08h) it should work ... but it doesn't :| even the jump to "ProtectedMode" crashes. "jmp ProtectedMode" itself works (but thats probably because the CS base is 0). What do you guys suggest? – Leishmaniasis