SGDT

SGDT stores the global descriptor table register, GDTR, to memory: first its 16-bit limit, the size of the table in bytes minus one, then its base address. In 64-bit mode the operand is 10 bytes, 2 of limit and 8 of base, whatever the operand size; outside 64-bit mode it is 6 bytes with a 32-bit base. AMD’s manual says that operand-size prefixes are ignored in every mode, and Intel’s stores the full 32-bit base with a 16-bit operand size too, noting only that the 286 had set the top byte of the 24-bit base to ones. LGDT loads the register; SIDT is the same store for the interrupt descriptor table, and SLDT and STR store the selectors of the LDT and the task register.

Memory only#

The operand must be in memory. The bytes 0F 01 with a ModR/M byte that names a register belong to other instructions, such as VMCALL (0F 01 C1), VMLAUNCH, VMRESUME, VMXOFF, PCONFIG and WRMSRNS; AMD’s manual lists a register operand as a cause of #UD. The headers of GCC 14 and Clang 23 have no intrinsic for SGDT, so C code reaches it with inline assembly, storing into a packed structure of a 16-bit limit followed by the base.

User-mode instruction prevention#

Both manuals allow SGDT at any privilege level, so before UMIP any program could learn where the kernel keeps its GDT, and SIDT the IDT, which are addresses in kernel memory. UMIP (CPUID leaf 7, ECX bit 2), enabled by CR4 bit 11, makes SGDT, SIDT, SLDT, SMSW and STR raise #GP(0) at CPL above 0; at CPL 0 they work as before. Intel’s and AMD’s manuals agree on this, though AMD’s description of SGDT itself does not list the fault: it appears in its description of CR4 and of system instructions in Volume 2. The Zen 5 behind this site’s recorded cases reports UMIP in CPUID leaf 7.

The probe does not run SGDT, for the reasons its Operation section gives.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if CPL > 0 and cr4 >> 11 & 1:    # CR4.UMIP
    fault(GP, 0)                 # Linux 7.2 emulates it: limit 0,
                                 # base FFFFFFFFFFFE0000H
dest.write(gdtr)                 # the limit, 2 bytes, then the base:
                                 # 8 bytes in 64-bit mode, whatever
                                 # the operand size; 4 outside it
# a register operand: #UD

Operands

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms

may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More System instructions

• ARPL
• CLTS
• HLT
• INVD
• INVLPG
• LAR
• LGDT
• LIDT
• LLDT
• LMSW
• LSL
• LTR
• RDMSR
• RDPMC
• RDTSC
• RSM
• SIDT
• SLDT
• SMSW
• STR
• SWAPGS
• VERR
• VERW
• WBINVD
• WRMSR