Could not switch back to Real-Address mode from Protected Mode. Help?

I am writing a function to switch from Protected Mode to Real Mode, but
the code does't work. The program crashes when doing the second far
jump.
I followed the steps of section 9.9.2 of Intel IA32 Manual Vol3 (June
2005 version),
and checked the relevant threads in this forum. But still can't figure
out where is my error. The following is my codes.

Any helps, thanks a lot.
jfguo

/* Segment Descriptor table. */
SEGMENT_DESCRIPTOR RealGdt[] = {
{0, 0, 0, 0, 0, 0}, //First Descriptor in GDT is not used
{0xffff, 0x0000, 0x09, 0x9b, 0x00, 0x00}, //Protected/Real 16bit
code, 0x08
{0xffff, 0x0000, 0x00, 0x9f, 0xcf, 0x00} //protected flat mode
code, 0x10
};

;At this point, the CPU operates at Protected mode with flat memory
model.
;

;Step 1. Disable interrupts.
cli

;Step 2 of IA32 Manual. If paging is enabled, ...
;Because the paging is not enabled, I omited this step.

lgdt fword ptr [RealGdtr]

;Step 3 of IA32 Manual.
;Because I loaded my code at 90000h, so I subtract 90000h from the
PMode16bit.
DB 0EAh
DD PMode16bit-90000h
DW 08h
PMode16bit:

;92h is outputed at port 80h correct.
mov al, 92h
out 80h, al

;Step 4 of IA32 Manual. Load segment registers.
;Omit. I want using the descriptor attributes loaded during protected
mode.

;Step 5 of IA32 Manual. Execute LIDT.
;Omit.

;Step 6 of IA32 Manual. Clear the PE flag.
mov eax, cr0
and al, 0feh
mov cr0, eax

;Step7 of IA32 Manual.
;Far jump to the real-address mode code.
DB 66h
DB 0EAh
DD RealMode16bit-90000h
DW 08h
RealMode16bit:
;93h is not outputed in port 80.
mov al, 93h
out 80h, al

...

.

Relevant Pages

  • Re: compiler generated output
    ... compiler to generate code which only uses 386 instruction). ... Thus, while replacing mov/and with movzx, the jump is still there. ... 00000001`00001c65 66894c2408 mov,cx ...
    (comp.lang.asm.x86)
  • wasm generating bad code for 16/32 bit
    ... to protected mode routine. ... push esi ... mov qseg,ax ... get correction required for code offsets into eax ...
    (alt.lang.asm)
  • Expand Down Stack in Protected Mode
    ... I have been reading everything I can on an Expand Down stack in ... However, no matter what I try, when I change my code to an Expand Down ... 32-bit, 4KB Granular, Protected mode Stack? ... mov word dx,0x0070 ...
    (comp.lang.asm.x86)
  • Re: raghu protected mode
    ... jmp short begin_boot; Jump to start of boot routine & skip other ... pm_mesg db "Switching to protected mode ...." ... mov bp,bootmesg; Set the string ptr to message location ... mov word [jumpsel],codesel ...
    (alt.lang.asm)
  • Re: raghu protected mode
    ... jmp short begin_boot; Jump to start of boot routine & skip other ... pm_mesg db "Switching to protected mode ...." ... mov bp,bootmesg; Set the string ptr to message location ... mov word [jumpsel],codesel ...
    (alt.lang.asm)