RDFSBASE

RDFSBASE copies the base address of the FS segment into a general register. In 64-bit mode FS and GS are the two segments whose base still counts, and on x86-64 Linux FS holds the thread pointer, the address of the running thread’s thread-local storage. With REX.W the whole 64-bit base is read; without it, the low 32 bits, with bits 63:32 of the destination cleared, as Zen 5 recorded. It changes no flag. RDGSBASE reads GS the same way.

When it works#

FSGSBASE has its own CPUID bit (leaf 7, EBX bit 0), but support alone is not enough: the kernel must also set CR4.FSGSBASE, or all four instructions raise #UD, at every privilege level. Linux’s documentation tells programs to check HWCAP2_FSGSBASE in the auxiliary vector before using them, as a CPU that has them may run a kernel that has not enabled them. Without them, arch_prctl(ARCH_GET_FS, ...), a system call, returns the same value. They exist only in 64-bit mode.

From C#

GCC 14 and Clang 23 provide _readfsbase_u64() and _readfsbase_u32() only with -mfsgsbase or an -march that includes it, such as ivybridge or znver1; none of the x86-64 levels does. At -O2 each call becomes rdfsbase rax (or eax), and two calls stay two instructions: the compilers never merge them, since the base can change in between.

They do not need it for the thread pointer. On Linux the thread’s control block starts with its own address, as the TLS page explains, so __builtin_thread_pointer() compiles to mov rax, qword ptr fs:0 with both compilers, with or without -mfsgsbase, and thread-local variables are reached through FS-relative addresses directly. RDFSBASE is for code that needs the base itself, such as a runtime that saves the old base before it installs another with WRFSBASE.

The instruction table of AMD’s Zen 5 guide lists RDFSBASE as microcoded; a load through fs:0 is an ordinary MOV.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

dest.write(fsbase)                   # r32: bits 63:32 of the register
                                     # cleared

Operands

Flags

None: XED records no flag that the forms test or change.

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to RDFSBASE, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More FSGSBASE instructions

• RDGSBASE
• WRFSBASE
• WRGSBASE