Vesta
English
Source code

LKGS

Load Kernel GS Base

stableVMJITAOTinstruction

Encodings

OpcodeInstructionOp/En64-bitCompat/LegacyDescription
F2 0F 00 /6LKGS r/m16AValidNot encodableLoad GS using r/m16, placing the base address instead in the IA32_KERNEL_GS_BASE MSR.

Operand encoding

Each mode is a value of the Op/En column above. It says which field of the encoded instruction carries each operand, in the order they are written, and whether the instruction reads it, writes it or both.

A

  1. 16-bit selector

Measured cost

Loading measurements from arch-data...

Description

LKGS operates in the same way as MOV to GS except that the descriptor's base address is loaded into the IA32_KERNEL_GS_BASE MSR instead of the GS segment's descriptor cache.

LKGS takes a single (source) operand, which can be a general-purpose register or a memory location. The operand must be a valid segment selector. The instruction loads the segment descriptor referenced by that segment selector into the GS descriptor cache, with the exception of the base address. The base address in the GS descriptor cache is not modified; the base address from the segment descriptor is loaded into the IA32_KERNEL_GS_BASE MSR. (Since the base address in the descriptor is only 32 bits, the upper 32 bits of the MSR are cleared.)

A null segment selector (values 0000-0003) can be loaded without causing an exception. However, any subsequent attempt to reference GS outside 64-bit mode causes a general protection exception (#GP) and no memory reference occurs. LKGS with a null segment selector loads zero into IA32_KERNEL_GS_BASE.

Operation

IF CPL > 0 OR logical processor not in 64-bit mode
    THEN #UD; FI;

IF SRC is null
    THEN
          GS.selector := SRC;
          mark GS as null;
          IA32_KERNEL_GS_BASE := 0;
    ELSE
          IF SRC.index is outside descriptor table limits
                THEN #GP(selector); FI;
          read referenced descriptor for descriptor table;
          IF the descriptor is not for a data or readable code segment OR SRC.RPL > descriptor.DPL
                THEN #GP(selector); FI;
          IF the descriptor is not marked present
                THEN #NP(selector);
                ELSE
                      GS.selector := SRC;
                      GS.attributes := descriptor.attributes;
                      IA32_KERNEL_GS_BASE := descriptor.base; // bits 63:32 cleared
          FI;

FI;

Flags affected

None.

Exceptions

Protected mode
#UDThe LKGS instruction is not recognized in protected mode.
Real address mode
#UDThe LKGS instruction is not recognized in real-address mode.
Virtual-8086 mode
#UDThe LKGS instruction is not recognized in virtual-8086 mode.
Compatibility mode
#UDThe LKGS instruction is not recognized in compatibility mode.
64-bit mode
#UDIf CPL > 0. If CPUID.07H.01H:EAX.LKGS[18] is not 1. If the LOCK prefix is used.
#GP(0)If the memory address is in a non-canonical form.
#GP(selector)If segment selector index is outside descriptor table limits. If the memory access to the descriptor table is non-canonical. If the referenced descriptor is not for a data or readable code segment or the selector RPL is greater than the descriptor DPL.
#SS(0)If the memory address is in a non-canonical form. #PF(fault-code) If a page fault occurs.

Sources