This thread may be ARM specific, but it sounds like a similar problem.
if it's of no use, please ignore.
> Have you verified that the UX bit is set correctly by your kernel?
> also plays a role but since you survive BogoMIPS it should be right.
From what I remember, the UX bit is fixed set. I have made the machine
print a '*' (no, I didn't use printk, but since it's my own console
driver I'm pretty sure it can work in interrupts - all it does is
hardware writes) whenever it gets a TLB refill and flushed the TLB
entering usermode. Guess what, I didn't get a single '*' after ERET. To
verify my method, I've made a single read from the usermode PC from the
kernel, and the '*' appeared. I don't know what's up.
Do you Yahoo!?
Win a $20,000 Career Makeover at Yahoo! HotJobs