WRFSBASE

WRFSBASE loads the base address of the FS segment from a general register, so that later FS-relative accesses add the new base. It is the user-mode counterpart of arch_prctl(ARCH_SET_FS, ...), without the system call: one instruction moves a thread’s thread-local storage to another block. It changes no flag and leaves the FS selector alone. RDFSBASE reads the base back, and WRGSBASE writes GS the same way. Like RDFSBASE, it raises #UD unless the processor has FSGSBASE and the kernel has set CR4.FSGSBASE, which Linux reports as HWCAP2_FSGSBASE in the auxiliary vector.

Canonical bases only#

The value must be a canonical address, or WRFSBASE raises #GP(0) and the base keeps its old value: Zen 5 did so for 8000000000000000H, and accepted FFFF800012345000H and 00007FFFFFFFF000H. The check is on the value written, not on any access made later.

The 32-bit form#

Without REX.W, the source is a 32-bit register. Intel’s manual clears bits 63:32 of the base; AMD’s says only that the register goes to the lower 32 bits of FS.base. Zen 5 cleared them: with ECX = 80001234H under random upper bits of RCX, the base became 0000000080001234H, not a merge with the old one.

FS belongs to the C library#

Linux’s documentation describes FS as the thread pointer that runtimes and threading libraries manage, and asks programs that use such libraries not to repurpose it; GS has no common use in user space and can serve the program instead. A program that writes FS under glibc moves every __thread variable and the stack protector’s canary along with it. Linux promises to preserve the full base of each thread along with its selector, so a base written this way stays with the thread.

GCC 14 and Clang 23 expose it as _writefsbase_u64() and _writefsbase_u32() with -mfsgsbase; at -O2 a call is a single wrfsbase rdi. AMD’s Zen 5 guide lists WRFSBASE as microcoded.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

v = src.read()                       # r32: zero-extended
if not canonical(v):
    fault(GP, 0)
fsbase = v

Operands

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms

may abort a TSX transaction

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to WRFSBASE, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More FSGSBASE instructions

• RDFSBASE
• RDGSBASE
• WRGSBASE