Page 1 of 1

How do I know if I changed privilege level on IRQ in X86?

Posted: Tue Aug 05, 2025 4:36 pm
by ffexl
When an IRQ fires, it conditionally pushes an error code. It also pushes RIP, CS, and RFLAGS, and it pushes RSP and SS if a privilege level change occurred. In order to know if a privilege level change occurred, I need the contents of the pushed CS (because it contains the previous CPL), but the pushed CS is in different places in the stack if a privilege change occurred (which pushes RSP and SS as well).

How do I know if I changed privilege level in an IRQ? I need to know so I can properly get the saved registers from the stack and also to know if I need to do a "swapgs" to load my cpu-specific info. I obviously can't do it through the saved CS. The CPU must know this information in order to determine how to handle the stack args on return, but how would I know it?

Re: How do I know if I changed privilege level on IRQ in X86?

Posted: Tue Aug 05, 2025 4:42 pm
by Octocontrabass
ffexl wrote: ↑Tue Aug 05, 2025 4:36 pmand it pushes RSP and SS if a privilege level change occurred
No, it always pushes RSP and SS.

Re: How do I know if I changed privilege level on IRQ in X86?

Posted: Tue Aug 05, 2025 4:44 pm
by ffexl
Intel SDM, Volume 3A, Figure 7-4. It only pushes SS and RSP on privilege-level switch. Nevermind, I figured out that RIP, CS, and RFLAGS are pushed last, so they always have a defined stack position.

Re: How do I know if I changed privilege level on IRQ in X86?

Posted: Tue Aug 05, 2025 4:48 pm
by ffexl
ffexl wrote: ↑Tue Aug 05, 2025 4:44 pm Intel SDM, Volume 3A, Figure 7-4. It only pushes SS and RSP on privilege-level switch. Nevermind, I figured out that RIP, CS, and RFLAGS are pushed last, so they always have a defined stack position.
Apparently that is just for 16-bit and 32-bit modes. SS and RSP are always pushed to the stack in 64-bit modes. You were right