RDGSBASE

RDGSBASE copies the base address of the GS segment into a general register. It is RDFSBASE for the other segment whose base still counts in 64-bit mode, with the same conditions: the processor must have FSGSBASE and the kernel must have set CR4.FSGSBASE, which Linux reports as HWCAP2_FSGSBASE in the auxiliary vector, or it raises #UD. With REX.W it reads the whole base; without, the low 32 bits, zero-extended: on Zen 5, a base of 30DCFF540EE2H gave ECX = FF540EE2H with bits 63:32 of RCX cleared. It changes no flag.

GS is the program’s#

FS holds the thread pointer of the C library, but Linux’s documentation says GS has no common use in user space, so a program may point it at data of its own, such as a per-thread block of an interpreter or a runtime. Code then reaches that data with GS-relative addresses: GCC 14 and Clang 23 both accept the __seg_gs qualifier, and at -O2 compile ((long __seg_gs *)0)[i] to a single mov rax, qword ptr gs:[8*rdi]. RDGSBASE is for saving the current base before installing another with WRGSBASE, or for turning a GS-relative address into an ordinary pointer, which other code and system calls can use. Without FSGSBASE, arch_prctl(ARCH_GET_GS, ...) returns the same value through a system call.

Whose GS#

At CPL 3 RDGSBASE reads the program’s base. A kernel that enters through SYSCALL and swaps with SWAPGS has the two bases the other way round, the program’s in IA32_KERNEL_GS_BASE and its own in GS, so RDGSBASE there reads the kernel’s, and the program’s is reached with RDMSR instead.

GCC 14 and Clang 23 provide _readgsbase_u64() and _readgsbase_u32() with -mfsgsbase or an -march that includes it; at -O2 each is a single rdgsbase rax (or eax). The instruction table of AMD’s Zen 5 guide lists RDGSBASE as microcoded, while a load through gs: is an ordinary MOV.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

dest.write(gsbase)                   # r32: bits 63:32 of the register
                                     # cleared

Operands

Flags

None: XED records no flag that the forms test or change.

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to RDGSBASE, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More FSGSBASE instructions

• RDFSBASE
• WRFSBASE
• WRGSBASE