Better late than never, although in this instance, it’s really really late—about thirty years late. In the world of computing, that is eternity.
The talk is about the new CR4.UMIP control bit documented in the latest (revision 58) Intel SDM, and the corresponding CPUID feature bit. When set, the CR4.UMIP (User Mode Instruction Prevention) bit prevents the SGDT, SIDT, SLDT, SMSW, and STR instructions from being executed outside of the highest-privileged code (ring 0).
The question is of course why it was ever possible to execute these instructions from unprivileged code. Setting the critical registers (GDTR, IDTR, LDTR, MSW, TR) was never possible from user code, but they could be freely read. The excuse Intel had back in 1982 (when these instructions became part of the 80286) was that they didn’t know what they were doing. That was much less of an excuse with the 386 and by the early 1990, it was well known to be a problem. Continue reading →