6-42 Vol. 3A

INTERRUPT AND EXCEPTION HANDLING

Saved Instruction Pointer

The saved contents of CS and EIP registers generally point to the instruction that generated the exception. If the 
page-fault exception occurred during a task switch, the CS and EIP registers may point to the first instruction of the 
new task (as described in the following “Program State Change” section).

Program State Change

A program-state change does not normally accompany a page-fault exception, because the instruction that causes 
the exception to be generated is not executed. After the page-fault exception handler has corrected the violation 
(for example, loaded the missing page into memory), execution of the program or task can be resumed.
When a page-fault exception is generated during a task switch, the program-state may change, as follows. During 
a task switch, a page-fault exception can occur during any of following operations:

•

While writing the state of the original task into the TSS of that task.

•

While reading the GDT to locate the TSS descriptor of the new task.

•

While reading the TSS of the new task.

•

While reading segment descriptors associated with segment selectors from the new task.

•

While reading the LDT of the new task to verify the segment registers stored in the new TSS.

In the last two cases the exception occurs in the context of the new task. The instruction pointer refers to the first 
instruction of the new task, not to the instruction which caused the task switch (or the last instruction to be 
executed, in the case of an interrupt). If the design of the operating system permits page faults to occur during 
task-switches, the page-fault handler should be called through a task gate.
If a page fault occurs during a task switch, the processor will load all the state information from the new TSS 
(without performing any additional limit, present, or type checks) before it generates the exception. The page-fault 
handler should thus not rely on being able to use the segment selectors found in the CS, SS, DS, ES, FS, and GS 
registers without causing another exception. (See the Program State Change description for “Interrupt 10—Invalid 
TSS Exception (#TS)” in this chapter for additional information on how to handle this situation.) 

Additional Exception-Handling Information

Special care should be taken to ensure that an exception that occurs during an explicit stack switch does not cause 
the processor to use an invalid stack pointer (SS:ESP). Software written for 16-bit IA-32 processors often use a 
pair of instructions to change to a new stack, for example:

MOV SS, AX
MOV SP, StackTop

When executing this code on one of the 32-bit IA-32 processors, it is possible to get a page fault, general-protec-
tion fault (#GP), or alignment check fault (#AC) after the segment selector has been loaded into the SS register 
but before the ESP register has been loaded. At this point, the two parts of the stack pointer (SS and ESP) are 
inconsistent. The new stack segment is being used with the old stack pointer.
The processor does not use the inconsistent stack pointer if the exception handler switches to a well defined stack 
(that is, the handler is a task or a more privileged procedure). However, if the exception handler is called at the 
same privilege level and from the same task, the processor will attempt to use the inconsistent stack pointer.
In systems that handle page-fault, general-protection, or alignment check exceptions within the faulting task (with 
trap or interrupt gates), software executing at the same privilege level as the exception handler should initialize a 
new stack by using the LSS instruction rather than a pair of MOV instructions, as described earlier in this note. 
When the exception handler is running at privilege level 0 (the normal case), the problem is limited to procedures 
or tasks that run at privilege level 0, typically the kernel of the operating system.