Intel 64 and IA-32 Architectures Software Developers Manual Volume 3A, System Programming Guide, Part 1

5-26 Vol. 3A
INTERRUPT AND EXCEPTION HANDLING
that exit with an IRET unconditionally pop SS:RSP off of the interrupt stack frame,
even if the target code segment is running in 64-bit mode or at CPL = 0. This is
because the original interrupt always pushes SS:RSP.
In IA-32e mode, IRET is allowed to load a NULL SS under certain conditions. If the
target mode is 64-bit mode and the target CPL <> 3, IRET allows SS to be loaded
with a NULL selector. As part of the stack switch mechanism, an interrupt or excep-
tion sets the new SS to NULL, instead of fetching a new SS selector from the TSS and
loading the corresponding descriptor from the GDT or LDT. The new SS selector is set
to NULL in order to properly handle returns from subsequent nested far transfers. If
the called procedure itself is interrupted, the NULL SS is pushed on the stack frame.
On the subsequent IRET, the NULL SS on the stack acts as a flag to tell the processor
not to load a new SS descriptor.
5.14.4 Stack Switching in IA-32e Mode
The IA-32 architecture provides a mechanism to automatically switch stack frames in
response to an interrupt. The 64-bit extensions of Intel 64 architecture implement a
modified version of the legacy stack-switching mechanism and an alternative stack-
switching mechanism called the interrupt stack table (IST).
In IA-32 modes, the legacy IA-32 stack-switch mechanism is unchanged. In IA-32e
mode, the legacy stack-switch mechanism is modified. When stacks are switched as
part of a 64-bit mode privilege-level change (resulting from an interrupt), a new SS
descriptor is not loaded. IA-32e mode loads only an inner-level RSP from the TSS.
The new SS selector is forced to NULL and the SS selector’s RPL field is set to the new
CPL. The new SS is set to NULL in order to handle nested far transfers (CALLF, INT,
interrupts and exceptions). The old SS and RSP are saved on the new stack
(Figure 5-8). On the subsequent IRET, the old SS is popped from the stack and
loaded into the SS register.
In summary, a stack switch in IA-32e mode works like the legacy stack switch,
except that a new SS selector is not loaded from the TSS. Instead, the new SS is
forced to NULL.