x86 - changing privilege level from CPL0 to CPL3
===

I'm working on some low level os code (64-bit) and I'm trying to figure out how to switch from CPL0 to CPL3. The problem is this little sentence in the Intel developer manual I ran across: ''...the processor does not allow a transfer of program control from a procedure running at a CPL of 0,1, or 2 to a procedure running at a CPL or 3, except on return. " 

The TSS (Task State Segment) doesn't even have a stack pointer so what will CPL3 code use for a stack? I know this is possible (else how else would the OS launch any application code) but I can't find any documentation on it. It seems like you'll have to push the address of some CPL3 code on to the stack to trick the processor into running CPL3 code, but that sounds kind of hacy. Do you guys know of a better way to do this? Any help is much appreciated.