On Wed, Apr 27, 2022, SU Hang wrote: > > It doesn't matter at this time because this framework doesn't ses SYSRET, but > > this should be USER_CS or USER_CS64. > Oops, intel SDM vol.3 <chap 5.8.8> says: > """ > When SYSRET transfers control to 64-bit mode user code using REX.W, the > processor gets the privilege level 3 target code segment, instruction pointer, > stack segment, and flags as follows: > • Target code segment — Reads a non-NULL selector from IA32_STAR[63:48] + 16. Ugh, missed that detail. > • Stack segment — IA32_STAR[63:48] + 8. > """