Iso-UniK: lightweight multi-process unikernel through memory protection keys

Cybersecurity

Table 2 Some of the privileged instructions

Privileged Instructions	Influences
wrpkru	Modify PKRU for A/W permissions
mov %REG, %CR0	Modify flags such as WP or PG
mov %REG, %CR3	Modify the base of page table
mov %REG, %CR4	Modify flags like PKE
sidt	Modify interrupt descriptor handler
wrmsr	Modify model specific bit like NX

And it is easy to configure other instructions. Except wepkru is used by MPK Gate, other instructions should be protected by the Privilege Gate and unmapped in most of the time