This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/master by this push:
new 5d16925a246 arch/x86_64/intel64: Give the SYSRET selector base the
user RPL.
5d16925a246 is described below
commit 5d16925a24640ad0c045d5b074a0a06bd68c79ff
Author: raiden00pl <[email protected]>
AuthorDate: Thu Nov 5 11:27:18 2026 +0100
arch/x86_64/intel64: Give the SYSRET selector base the user RPL.
SYSRET loads SS from the STAR base plus 8. Intel CPUs force its RPL
to 3, AMD CPUs do not: with the base 0x28 user code runs with SS 0x30,
and the iretq after the next interrupt from user mode fails with
#GP(0x30). Add the user RPL to the base.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: raiden00pl <[email protected]>
---
arch/x86_64/src/intel64/intel64_cpu.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/arch/x86_64/src/intel64/intel64_cpu.c
b/arch/x86_64/src/intel64/intel64_cpu.c
index 2f91da3f15b..061839f7c49 100644
--- a/arch/x86_64/src/intel64/intel64_cpu.c
+++ b/arch/x86_64/src/intel64/intel64_cpu.c
@@ -409,10 +409,16 @@ void x86_64_cpu_priv_set(uint8_t cpu)
* than for kernel segments). Then this instruction needs to
* set CS segment for SYSRET at (USERDATA_SEL - 8) to work
* correctly.
+ *
+ * The base must also carry the user RPL. Intel CPUs force the
+ * RPL of SS to 3, AMD CPUs load SS as computed: with RPL 0 the
+ * next interrupt from user mode saves that SS, and the iretq
+ * back to user mode fails with #GP.
*/
write_msr(MSR_STAR, MSR_STAR_CSSYSCALL(X86_GDT_CODE_SEL) |
- MSR_STAR_CSSYSRET(X86_GDT_USERDATA_SEL - 8));
+ MSR_STAR_CSSYSRET((X86_GDT_USERDATA_SEL - 8) |
+ X86_GDT_RPL_USER));
/* Mask applied to RFLAGS when making a syscall */
