Why does iret from a page fault handler generate interrupt 13 (general protection fault) and error code 0x18?

Question

I am writing a kernel by myself, and after the first page error interrupt handler, when IRET is executed, it causes an interrupt 13(general protection), and error code is 0x18. I don't know what is wrong, the content pushed on the stack comes from the cpu.

Here is the register state when interrupt occurs, and memory where the registers were stored.In addition, IRET is returned from a page error interrupt handler.

It is sure that %ESP is the same before IRET executing and interrupt occurring.

Answer 1

If the exception is from IRET itself, then most likely IRET is failing to restore one of the saved segment registers, but the value (8 or 0x18, btw?) is somehow wrong. It can be wrong because you never (re)initialized the register in protected mode or your handler set it to a bad value before doing IRET or something happened to the GDT...

EDIT: From the picture it's apparent that the page fault handler didn't remove the exception code (value of 4 at address in ESP) before executing IRET. And so IRET interpreted 4 as the new value for EIP, 0x1000018 as the new value for CS and 0x23 as the new value for EFLAGS, whereas it should be using 0x1000018, 0x23 and 0x3206 for those three registers. Obviously, a data segment selector (which 0x1000018 is interpreted as after truncation to 0x0018) cannot be loaded into CS and this causes #GP(0x18).