Copy From http://lion3875.blog.51cto.com/2911026/532347
When the iret command is used to return tasks at the same protection level, the iret will pop up from the stackCodeSegment Selection Sub-and command pointer respectively to CS and IP register, and pop up the mark register content to the eflags register.
When the iret command is used to return a different protection level, the iret will not only pop up the above content from the stack, but also pop up the stack segment Selection Sub-and stack pointer to the SS and SP registers respectively.
The IA-32 instruction manual describes this very clearly, as in the original article:
The iret instruction pops the return instruction pointer, return code segment selector, and eflags image from the stack to the EIP, Cs, and eflags registers, respectively, and then resumes execution of the interrupted program or procedure. if the return is
To another privilege level, the iret instruction also pops the stack pointer and SS from the stack, before resuming Program Execution