OSDev.org

The AMD manual says:

RSPn—Bytes 1Bh–04h. The full 64-bit canonical forms of the stack pointers (RSP) for privilege levels 0 through 2.

but I haven't (yet) found anywhere that these values are actually used for anything. What are the RSPn for?

The SPx values in the TSS hold the stack pointer for when a higher privilege is entered. (userspace should not be able to dictate where the kernel stack is)

Aaaah, I have found my misunderstanding of the AMD manual: I had only read the information about 64-bit interrupt stack switching, not the 32-bit, and when it said legacy stack switching mechanism was used for IST=0, I assumed that was 'leave stack as it is' for some reason...looking now at the 32-bit interrupt stack switching it *does* explain how the ESPn are used in 32-bit mode, and hence RSPn in 64-bit mode! Thanks!