WRGSBASE

WRGSBASE loads the base address of the GS segment from a general register; later GS-relative accesses add the new base. It is the GS counterpart of WRFSBASE, whose page covers the shared rules: #UD unless the processor has FSGSBASE and the kernel has set CR4.FSGSBASE, #GP(0) for a base that is not canonical, and a 32-bit form that clears the upper half. Zen 5 did the same for GS: a write of 8000000000000000H raised #GP and kept the old base, and ECX = 80001234H made the base 0000000080001234H, with FS untouched in every case. RDGSBASE reads the base back.

Without a system call#

Linux’s documentation leaves GS free for programs, and WRGSBASE moves it in one unprivileged instruction where arch_prctl(ARCH_SET_GS, ...) needs a system call, which the same documentation says the kernel’s configuration may disable. A runtime can thus give each thread, or each task it schedules, its own block of data at gs:0 and switch between them without entering the kernel.

The compiler does not see the dependency#

GCC and Clang accept __seg_gs for GS-relative accesses, but nothing ties those accesses to the WRGSBASE that sets their base. In our build of a function that saves the base with _readgsbase_u64(), installs another with _writegsbase_u64(p), reads *(long __seg_gs *)8 and restores the old base, GCC 14 at -O2 emitted both WRGSBASEs first and the load after them, so it read through the old base; Clang 23 kept the load between them. A compiler barrier, asm volatile("" ::: "memory"), after the first write and before the second, or a volatile access, kept the order with GCC too. Code that switches GS around an access should not rely on the compiler to keep the two apart.

Where the kernel stands#

The base a program writes is the one that a kernel entered through SWAPGS finds in IA32_KERNEL_GS_BASE, swapped out of the way, and puts back on the return. GCC 14 and Clang 23 expose WRGSBASE as _writegsbase_u64() and _writegsbase_u32() with -mfsgsbase. AMD’s Zen 5 guide lists WRGSBASE as microcoded.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

v = src.read()                       # r32: zero-extended
if not canonical(v):
    fault(GP, 0)
gsbase = v

Operands

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms

may abort a TSX transaction

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to WRGSBASE, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More FSGSBASE instructions

• RDFSBASE
• RDGSBASE
• WRFSBASE