title: Use jmp instruction to a non-constant TSS segment
body: <p><a href="http://x86.renejeschke.de/html/file_module_x86_id_147.html" rel="nofollow noreferrer">JMP instruction referece.</a></p>
  
  <p>According to the documentation, we can perform <code>jmp</code> to a constant far segment:</p>
  
  <pre><code>jmp 0x18:00
  </code></pre>
  
  <p>Here, <code>0x18</code> is a valid segment selector in a GDT, Global Descriptor Table.</p>
  
  <p><code>jmp</code> can be used with a segment register that contains a valid GDT entry, that is a code/data segment descriptor:</p>
  
  <pre><code>mov es, 0x18
  jmp es:0x0
  </code></pre>
  
  <p>Here, <code>0x18</code> is a TSS (Task State Segment) descriptor that when jumping to, CPU performs a task switch that automatically saves its state into the current TSS, and then populate with the state saved in the new TSS.</p>
  
  <p>However, TSS is a system segment descriptor, and therefore cannot be loaded into any of the segment register (as suggested by Intel document). Then how, can I jump to a task at runtime with dynamically allocated TSS?</p>
  
  <p>The only way I can think of is to use the <code>iret</code> instruction, but I feel it like a hack, as I need to modify the link field, and then set the NT bit in EFLAGS to perform back link task switching.</p>