sgdt/sidt/sldt are some of these instructions. Don't know if there are others. They give linear adresses of the processor's descriptor tables. Code running w

sgdt/sidt/sldt are some of these instructions. Don't know if there are others. They give linear adresses of the processor's descriptor tables. Code running with paging enabled can't even read these locations, so they are pretty useless for user mode. But they allow user mode to get forbidden info from the kernel, and virtualizing lgdt/lidt/lldt becomes impossible because non-privileged code can see the values given to the cpu changed, and a save state/restore state is impossible under virtualization. Under newer processors, flag CR4.umip makes them trap, so virtualization becomes possible.