Throws a #GP when it should throw a #SS

Host environment

• Operating system: Ubuntu 20.04.3 LTS
• OS/kernel version: Linux vvgcfd 5.4.0-94-generic Ubuntu SMP
• Architecture: x86
• QEMU flavor: qemu-system-x86_64
• QEMU version: QEMU emulator version 6.2.0
• QEMU command line:

  ./qemu-system-x86_64 -M q35 -m 4G -cpu Nehalem-v2 -smp 1 -accel tcg disk.img

Emulated/Virtualized environment

• Operating system: Custom
• OS/kernel version: Custom
• Architecture: x86

Description of problem

When stacks are switched as part of a 64-bit mode privilege-level change (resulting from an interrupt), IA-32e mode loads only an inner-level RSP from the TSS. If the value of rsp from tss is a non-canonical form. It will trigger #SS. But when I test it in qemu it throws #GP instead of #SS

Steps to reproduce

In order to confirm that it is the #SS triggered by the non-canonical address, We can verify on a real machine.

1. Set the value of the current core's TSS.IST7 to the the non-canonical address.
2. Set the ist field of the interrupt 4 (Overflow Exception) descriptor to 7.
3. Execute the INT 4 instruction in Ring 3 and it will be taken over by the #SS handler.

Repeat the above steps in qemu this exception will be taken over by #GP

Additional information