Vol. 3A 2-13

SYSTEM ARCHITECTURE OVERVIEW

2.4.4 

Task Register (TR)

The task register holds the 16-bit segment selector, base address (32 bits in protected mode; 64 bits in IA-32e 
mode), segment limit, and descriptor attributes for the TSS of the current task. The selector references the TSS 
descriptor in the GDT. The base address specifies the linear address of byte 0 of the TSS; the segment limit speci-
fies the number of bytes in the TSS. See also: Section 7.2.4, “Task Register.”
The LTR and STR instructions load and store the segment selector part of the task register, respectively. When the 
LTR instruction loads a segment selector in the task register, the base address, limit, and descriptor attributes from 
the TSS descriptor are automatically loaded into the task register. On power up or reset of the processor, the base 
address is set to the default value of 0 and the limit is set to 0FFFFH.
When a task switch occurs, the task register is automatically loaded with the segment selector and descriptor for 
the TSS for the new task. The contents of the task register are not automatically saved prior to writing the new TSS 
information into the register.

2.5 CONTROL 

REGISTERS

Control registers (CR0, CR1, CR2, CR3, and CR4; see Figure 2-7) determine operating mode of the processor and 
the characteristics of the currently executing task. These registers are 32 bits in all 32-bit modes and compatibility 
mode. 
In 64-bit mode, control registers are expanded to 64 bits. The MOV CRn instructions are used to manipulate the 
register bits. Operand-size prefixes for these instructions are ignored. The following is also true:

•

The control registers can be read and loaded (or modified) using the move-to-or-from-control-registers forms 
of the MOV instruction. In protected mode, the MOV instructions allow the control registers to be read or loaded 
(at privilege level 0 only). This restriction means that application programs or operating-system procedures 
(running at privilege levels 1, 2, or 3) are prevented from reading or loading the control registers.

•

Bits 63:32 of CR0 and CR4 are reserved and must be written with zeros. Writing a nonzero value to any of the 
upper 32 bits results in a general-protection exception, #GP(0). 

•

All 64 bits of CR2 are writable by software. 

•

Bits 51:40 of CR3 are reserved and must be 0. 

•

The MOV CRn instructions do not check that addresses written to CR2 and CR3 are within the linear-address or 
physical-address limitations of the implementation. 

•

Register CR8 is available in 64-bit mode only. 

The control registers are summarized below, and each architecturally defined control field in these control registers 
is described individually. In Figure 2-7, the width of the register in 64-bit mode is indicated in parenthesis (except 
for CR0).

•

CR0 — Contains system control flags that control operating mode and states of the processor. 

•

CR1 — Reserved.

•

CR2 — Contains the page-fault linear address (the linear address that caused a page fault).

•

CR3 — Contains the physical address of the base of the paging-structure hierarchy and two flags (PCD and 
PWT). Only the most-significant bits (less the lower 12 bits) of the base address are specified; the lower 12 bits 
of the address are assumed to be 0. The first paging structure must thus be aligned to a page (4-KByte) 
boundary. The PCD and PWT flags control caching of that paging structure in the processor’s internal data 
caches (they do not control TLB caching of page-directory information).
When using the physical address extension, the CR3 register contains the base address of the page-directory-
pointer table. In IA-32e mode, the CR3 register contains the base address of the PML4 table.
See also: Chapter 4, “Paging.”

•

CR4 — Contains a group of flags that enable several architectural extensions, and indicate operating system or 
executive support for specific processor capabilities.