保护模式下的特权级的跳转疑问

保护模式下的特权级的跳转疑问
这个程序看了几遍，没看出问题，主要是从实现从实模式跳转到保护模式，然后在保护模式从特权级0到特权级3，最后又到特权级0，并从此返回dos。麻烦哪位大侠，看一看。。。。
%include "pm.inc"
org 0100h
jmp LABEL_BEGIN
[SECTION .gdt]
LABEL_GDT: Descriptor 0,0,0 ;空描述符
LABEL_DESC_NORMAL: Descriptor 0,0ffffh, DA_DRW ;Normal描述符
LABEL_DESC_RING0: Descriptor 0,SegRing0Len-1,DA_C+DA_32 ;非一致代码段,32位
LABEL_DESC_RING00: Descriptor 0,SegRing00Len-1,DA_C+DA_32 ;非一致代码段,32位
LABEL_DESC_RING3: Descriptor 0,SegRing3Len-1,DA_C+DA_32 ;非一致代码段,32位
LABEL_DESC_CODE16: Descriptor 0, SegCode16Len,DA_C ;非一致代码段,16
LABEL_DESC_STACK0: Descriptor 0, TopOfStack0 ,93h+DA_32 ;stack描叙符
LABEL_DESC_STACK3: Descriptor 0, TopOfStack3,93h+DA_32+DA_DPL3
LABEL_DESC_VIDEO: Descriptor 0b8000h,0ffffh,DA_DRW ;显存
;----------------
LABEL_DESC_TSS: Descriptor 0 , TSSLen - 1 ,DA_386TSS
;-------------------------------------------------
LABEL_CALL_GATE: Gate SelectorRing00 , 0 , 0 , DA_386CGate + DA_DPL3
SelectorCallGate equ LABEL_CALL_GATE - LABEL_GDT + SA_RPL3

;GDT结束
GdtLen equ $-LABEL_GDT
GdtPtr dw GdtLen-1 ;界限
dd 0 ;基地址
SelectorNormal equ LABEL_DESC_NORMAL-LABEL_GDT+SA_RPL0
SelectorCode16 equ LABEL_DESC_CODE16-LABEL_GDT+SA_RPL0
SelectorRing0 equ LABEL_DESC_RING0-LABEL_GDT+SA_RPL0
SelectorRing00 equ LABEL_DESC_RING00-LABEL_GDT+SA_RPL0
SelectorRing3 equ LABEL_DESC_RING3-LABEL_GDT+SA_RPL3
SelectorStack0 equ LABEL_DESC_STACK0-LABEL_GDT+SA_RPL0
SelectorStack3 equ LABEL_DESC_STACK3-LABEL_GDT+SA_RPL3
SelectorVideo equ LABEL_DESC_VIDEO-LABEL_GDT+SA_RPL0
SelectorTss equ LABEL_DESC_TSS-LABEL_GDT

[SECTION .stack0]
ALIGN 32
[BITS 32]
LABEL_SEG_STACK0:
times 512 db 0
TopOfStack0 equ $-LABEL_SEG_STACK0-1

[SECTION .stack3]
ALIGN 32
[BITS 32]
LABEL_SEG_STACK3:
times 512 db 0
TopOfStack3 equ $-LABEL_SEG_STACK3-1

[SECTION .tss]
ALIGN 32
[BITS 32]
LABEL_SEG_TSS:
DD 0 ; Back
DD TopOfStack0 ; 0 级堆栈
DD SelectorStack0 ;
times 23 dd 0
DW 0
DW $ - LABEL_SEG_TSS+2 ; I/O位图基址
DW 0ffh ; I/O位图结束标志
TSSLen equ $ - LABEL_SEG_TSS
; TSS ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
;从保护模式跳回实模式到这里
[SECTION .s16]
[BITS 16]
LABEL_BEGIN:
mov ax, cs
mov ds, ax
mov ss, ax
mov es, ax
mov gs, ax
mov sp, 0100h
mov [LABEL_GO_BACK_TO_REAL+3],ax
;初始化段描叙符
;---------------------------
xor eax, eax
mov ax, cs
shl eax, 4
add eax, LABEL_SEG_RING0
mov word [LABEL_DESC_RING0+2], ax
shr eax, 16
mov byte [LABEL_DESC_RING0+4], al
mov byte [LABEL_DESC_RING0+7], ah
;---------------------------
xor eax, eax
mov ax, cs
shl eax, 4
add eax, LABEL_SEG_RING00
mov word [LABEL_DESC_RING00+2], ax
shr eax, 16
mov byte [LABEL_DESC_RING00+4], al
mov byte [LABEL_DESC_RING00+7], ah
;---------------------------
xor eax, eax
mov ax, cs
shl eax, 4
add eax, LABEL_SEG_RING3
mov word [LABEL_DESC_RING3+2], ax
shr eax, 16
mov byte [LABEL_DESC_RING3+4], al
mov byte [LABEL_DESC_RING3+7], ah
;---------------------------
xor eax, eax
mov ax, cs
shl eax, 4
add eax, LABEL_SEG_STACK0
mov word [LABEL_DESC_STACK0+2], ax
shr eax, 16
mov byte [LABEL_DESC_STACK0+4], al
mov byte [LABEL_DESC_STACK0+7], ah
;----------------------------
xor eax, eax
mov ax, cs
shl eax, 4
add eax, LABEL_SEG_STACK3
mov word [LABEL_DESC_STACK3+2], ax
shr eax, 16
mov byte [LABEL_DESC_STACK3+4], al
mov byte [LABEL_DESC_STACK3+7], ah
;-----------------------------
xor eax, eax
mov ax, cs
shl eax, 4
add eax, LABEL_SEG_CODE16
mov word [LABEL_DESC_CODE16+2], ax
shr eax, 16
mov byte [LABEL_DESC_CODE16+4], al
mov byte [LABEL_DESC_CODE16+7], ah
;---------------------------------
xor eax, eax
mov ax, cs
shl eax, 4
add eax, LABEL_SEG_TSS
mov word [LABEL_DESC_TSS+2], ax
shr eax, 16
mov byte [LABEL_DESC_TSS+4], al
mov byte [LABEL_DESC_TSS+7], ah
;---------------------------------
xor eax, eax
mov ax, ds
shl eax, 4
add eax, LABEL_GDT
mov [GdtPtr+2],eax
lgdt [GdtPtr]
cli ;关中断
in al,92h ;打开地址线20
or al, 00000010b
out 92h, al
;准备切换到保护模式
mov eax, cr0
or eax, 1
mov cr0, eax
jmp dword SelectorRing0:0
;跳回实模式
LABEL_REAL_ENTRY:
mov ax, cs
mov ds, ax
mov es, ax
mov ss, ax
;mov sp, [SPValueInRealMode]
;关闭A20地址线
in al, 92h
and al, 11111101b
out 92h, al
sti ;开中断
mov ax, 4c00h
int 21h

[SECTION .ring0]
[BITS 32]
LABEL_SEG_RING0:
mov ax, SelectorVideo
mov gs, ax
mov ax, SelectorStack0
mov ss, ax
mov esp, TopOfStack0
;load TSS
mov ax, SelectorTss
ltr ax
mov ah, 0ch
mov al, 'P'
mov [gs:0], ax
push SelectorStack3
push TopOfStack3
push LABEL_SEG_RING3
push 0
retf
SegRing0Len equ $-LABEL_SEG_RING0


[SECTION .ring3]
[BITS 32]
LABEL_SEG_RING3:
jmp $
mov ah, 0ch
mov al, '3'
mov [gs:2],ax
call SelectorCallGate:0
SegRing3Len equ $-LABEL_SEG_RING3


[SECTION .ring00]
[BITS 32]
LABEL_SEG_RING00:
;from here to return dos system
mov ah, 0ch
mov al, '0'
mov [gs:4], ax
jmp SelectorCode16:0
SegRing00Len equ $-LABEL_SEG_RING00


[SECTION .code16]
ALIGN 32
[BITS 16]
LABEL_SEG_CODE16:
mov ax, SelectorNormal
mov ds, ax
mov es, ax
mov fs, ax
mov gs, ax
mov ss, ax
mov eax, cr0
and al, 11111110b ;置位0
mov cr0, eax
LABEL_GO_BACK_TO_REAL:
jmp 0:LABEL_REAL_ENTRY ;开始时设定
SegCode16Len equ $-LABEL_SEG_CODE16