diff --git a/VKernel/Kernel/intr/idt.vp b/VKernel/Kernel/intr/idt.vp
index ba571f0..7cf5911 100644
--- a/VKernel/Kernel/intr/idt.vp
+++ b/VKernel/Kernel/intr/idt.vp
@@ -116,20 +116,24 @@ def isrCommonhandler(interrupt: t.CInt):
               op=[t.ASM_DESCR.CLOBBER_RAX])
         fault_rip: t.CUInt64T = 0
         fault_err: t.CUInt64T = 0
+        fault_rsp: t.CUInt64T = 0
         c.Asm(f"""mov {c.AsmOut(fault_rip, t.ASM_DESCR.OUTPUT_REG)}, [_fault_rip]
-                mov {c.AsmOut(fault_err, t.ASM_DESCR.OUTPUT_REG)}, [_fault_err]""",
+                mov {c.AsmOut(fault_err, t.ASM_DESCR.OUTPUT_REG)}, [_fault_err]
+                mov {c.AsmOut(fault_rsp, t.ASM_DESCR.OUTPUT_REG)}, [_fault_rsp]""",
               op=[t.ASM_DESCR.CLOBBER_RAX])
-        buf: t.CArray[t.CChar, 80]
-        viperlib.snprintf(c.Addr(buf), 80, "[PF] cr2=0x%lx rip=0x%lx err=0x%lx\n", cr2, fault_rip, fault_err)
+        buf: t.CArray[t.CChar, 100]
+        viperlib.snprintf(c.Addr(buf), 100, "[PF] cr2=0x%lx rip=0x%lx err=0x%lx rsp=0x%lx\n", cr2, fault_rip, fault_err, fault_rsp)
         serial.puts(buf)
     elif interrupt == 13:
         gp_rip: t.CUInt64T = 0
         gp_err: t.CUInt64T = 0
+        gp_rsp: t.CUInt64T = 0
         c.Asm(f"""mov {c.AsmOut(gp_rip, t.ASM_DESCR.OUTPUT_REG)}, [_fault_rip]
-                mov {c.AsmOut(gp_err, t.ASM_DESCR.OUTPUT_REG)}, [_fault_err]""",
+                mov {c.AsmOut(gp_err, t.ASM_DESCR.OUTPUT_REG)}, [_fault_err]
+                mov {c.AsmOut(gp_rsp, t.ASM_DESCR.OUTPUT_REG)}, [_fault_rsp]""",
               op=[t.ASM_DESCR.CLOBBER_RAX])
-        gp_buf: t.CArray[t.CChar, 80]
-        viperlib.snprintf(c.Addr(gp_buf), 80, "[GP] rip=0x%lx err=0x%lx\n", gp_rip, gp_err)
+        gp_buf: t.CArray[t.CChar, 100]
+        viperlib.snprintf(c.Addr(gp_buf), 100, "[GP] rip=0x%lx err=0x%lx rsp=0x%lx\n", gp_rip, gp_err, gp_rsp)
         serial.puts(gp_buf)
     s: sched.Scheduler | t.CPtr = sched._sched_ptr
     # 如果调度器未初始化，直接进入安全停机状态
diff --git a/VKernel/Kernel/intr/isr.s b/VKernel/Kernel/intr/isr.s
index c03757f..5ddfb5d 100644
--- a/VKernel/Kernel/intr/isr.s
+++ b/VKernel/Kernel/intr/isr.s
@@ -8,6 +8,7 @@
 .comm _fs_lock, 4, 4
 .comm _fault_rip, 8, 8
 .comm _fault_err, 8, 8
+.comm _fault_rsp, 8, 8
 
 .section .text
 .intel_syntax noprefix
@@ -238,6 +239,8 @@ isr\num\()_from_kernel:
     mov r10, [rsp + 24]      # RFLAGS
     xor r11, r11             # SS = 0
     xor rax, rax             # RSP = 0
+    lea rcx, [rsp + 32]      # faulting RSP = entry_rsp + 32 (err + RIP + CS + RFLAGS)
+    mov [_fault_rsp], rcx
     add rsp, 32              # remove 4 CPU-pushed qwords (error + 3 frame)
     jmp isr\num\()_frame_ready
 
@@ -250,6 +253,7 @@ isr\num\()_from_user:
     mov r10, [rsp + 24]      # RFLAGS
     mov rax, [rsp + 32]      # RSP (user)
     mov r11, [rsp + 40]      # SS (user)
+    mov [_fault_rsp], rax    # faulting RSP = user RSP
     mov gs:[0x0], rax        # save user RSP
     add rsp, 48              # remove 6 CPU-pushed qwords (error + 5 frame)