LKGS

LKGS — Load Kernel GS Base

Opcode	Instruction	Op/ En	64-Bit Mode	Compat/ Leg Mode	Description
F2 0F 00 /6	LKGS r/m16	A	Valid	N.E.	Load GS using r/m16, placing the base address instead in the IA32_KERNEL_GS_BASE MSR.

Instruction Operand Encoding

Op/En	Operand 1	Operand 2	Operand 3	Operand 4
A	16-bit selector	N/A	N/A	N/A

Description

LKGS operates in the same way as MOV to GS except that the descriptor’s base address is loaded into the IA32_KERNEL_GS_BASE MSR instead of the GS segment’s descriptor cache.

LKGS takes a single (source) operand, which can be a general-purpose register or a memory location. The operand must be a valid segment selector. The instruction loads the segment descriptor referenced by that segment selector into the GS descriptor cache, with the exception of the base address. The base address in the GS descriptor cache is not modified; the base address from the segment descriptor is loaded into the IA32_KERNEL_GS_BASE MSR. (Since the base address in the descriptor is only 32 bits, the upper 32 bits of the MSR are cleared.)

A null segment selector (values 0000-0003) can be loaded without causing an exception. However, any subsequent attempt to reference GS outside 64-bit mode causes a general protection exception (#GP) and no memory reference occurs. LKGS with a null segment selector loads zero into IA32_KERNEL_GS_BASE.

Operation

IF CPL > 0 OR logical processor not in 64-bit mode
    THEN #UD; FI;
IF SRC is null
    THEN
        GS.selector ← SRC;
        mark GS as null;
        IA32_KERNEL_GS_BASE ← 0;
    ELSE
        IF SRC.index is outside descriptor table limits
            THEN #GP(selector); FI;
        read referenced descriptor for descriptor table;
        IF the descriptor is not for a data or readable code segment OR SRC.RPL > descriptor.DPL
            THEN #GP(selector); FI;
        IF the descriptor is not marked present
            THEN #NP(selector);
            ELSE
                GS.selector ← SRC;
                GS.attributes ← descriptor.attributes;
                IA32_KERNEL_GS_BASE ← descriptor.base; // bits 63:32 cleared
        FI;
FI;

Flags Affected

None.

Protected Mode Exceptions

#UD The LKGS instruction is not recognized in protected mode.

Real-Address Mode Exceptions

#UD The LKGS instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD The LKGS instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

#UD The LKGS instruction is not recognized in compatibility mode.

64-Bit Mode Exceptions

#UD If CPL > 0. If CPUID.07H.01H:EAX.LKGS[18] is not 1. If the LOCK prefix is used.

#GP(0) If the memory address is in a non-canonical form.

#GP(selector) If segment selector index is outside descriptor table limits. If the memory access to the descriptor table is non-canonical. If the referenced descriptor is not for a data or readable code segment or the selector RPL is greater than the descriptor DPL.

#SS(0) If the memory address is in a non-canonical form.

#PF(fault-code) If a page fault occurs.

---

Source: Intel® 64 and IA-32 Architectures Software Developer's Manual, Combined Volumes (Order Number 325462-091US, March 2026)
Generated: 7-6-2026