LTR

LTR loads the task register, TR, with a selector of the GDT that names a task state segment, and caches that descriptor’s base and limit. It does not switch tasks: it tells the processor which TSS is current. STR stores the selector back.

Why 64-bit mode still needs a TSS#

Long mode has no hardware task switch, but the processor still reads the TSS that TR points to. A 64-bit TSS holds the stack pointers RSP0 to RSP2, which an interrupt or call gate loads when it moves to a more privileged level, the seven pointers of the interrupt stack table, which a gate can name to run its handler on a known good stack, and the offset of the I/O permission bit map that IN and OUT consult. Intel’s Volume 3 requires an operating system to create a 64-bit TSS and run LTR in 64-bit mode once long mode is on.

The descriptor#

In 64-bit mode the selector must name a 16-byte TSS descriptor in the GDT (type 9, available; the upper 8 bytes hold bits 63:32 of the base), which is why LTR needs LGDT first. LTR raises #GP(0) for a null selector; #GP with the selector for one that points into the LDT, past the GDT’s limit, or at a descriptor of another type (AMD’s manual adds a non-canonical base, Intel’s does not); and #NP if the descriptor is not present. The operand is 16 bits from a register or memory, whatever the operand size.

Busy#

LTR marks the descriptor busy (type 11) with a locked write to the GDT, so the table must be writable at that moment. An already busy TSS does not pass the type check, so loading the same selector a second time needs its busy bit cleared in the GDT first.

Running it#

LTR runs only at CPL 0, in protected or long mode; real and virtual-8086 mode raise #UD. At CPL 3, Zen 5 raised #GP in all four recorded cases, with the selector in memory or in CX and R9W, null or 40H. Both vendors list LTR as serializing, and AMD’s Zen 5 guide lists it as microcoded.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if CPL > 0:
    fault(GP, 0)
s = src.read()                   # 16 bits at any operand size
if s & ~3 == 0:
    fault(GP, 0)                 # null
if s & 4:
    fault(GP, s & ~3)            # TI set: not a selector of the GDT
d = descriptor(s)                # #GP(sel) past the GDT's limit
h = descriptor(s + 8)            # the second 8 bytes
if d >> 40 & 0x1F != 9:
    fault(GP, s & ~3)            # S clear and type 9: a 64-bit TSS
                                 # that is not busy
if h >> 40 & 0x1F:
    fault(GP, s & ~3)
b = d >> 16 & 0xFFFFFF | d >> 56 << 24
b |= (h & 0xFFFFFFFF) << 32      # bits 63:32 of the base
if not canonical(b):
    fault(GP, s & ~3)
if not d >> 47 & 1:
    fault(NP, s & ~3)
set_descriptor(s, d | 1 << 41)   # busy, type 11: a locked write to
                                 # the GDT
tr = s                           # with the TSS's base and limit; no
                                 # task switch happens

Operands

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms

privileged: CPL 0 only; not in real-address mode; may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More System instructions

• ARPL
• CLTS
• HLT
• INVD
• INVLPG
• LAR
• LGDT
• LIDT
• LLDT
• LMSW
• LSL
• RDMSR
• RDPMC
• RDTSC
• RSM
• SGDT
• SIDT
• SLDT
• SMSW
• STR
• SWAPGS
• VERR
• VERW
• WBINVD
• WRMSR