x86-64 Segment Registers, interactive

Formula: loading a selector makes the CPU index the GDT, check the descriptor and privilege, and copy base/limit into the hidden cache. Every access then computes linear = cache.base + offset after checking offset ≤ limit. The bar shows the first 16 MiB of the 4 GiB linear space.

Rule in 64-bit mode: CS/DS/ES/SS bases are treated as 0 and limits are not checked. FS and GS keep a real 64-bit base, stored in the MSRs IA32_FS_BASE and IA32_GS_BASE, not in the GDT. "Loading and unloading" now happens per thread, at every context switch.

// seg.c — gcc -O0 seg.c -o seg && ./seg      (run it twice: fs_base changes → ASLR)
#include <stdio.h>
#include <stdint.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <sys/auxv.h>
#include <asm/prctl.h>
#include <pthread.h>
#ifndef HWCAP2_FSGSBASE
#define HWCAP2_FSGSBASE (1 << 1)
#endif

static void dump(const char *who){
    uint16_t cs, ds, es, ss, fs, gs;            // 1) selectors: plain unprivileged MOV
    __asm__ volatile("mov %%cs,%0" : "=r"(cs));  __asm__ volatile("mov %%ds,%0" : "=r"(ds));
    __asm__ volatile("mov %%es,%0" : "=r"(es));  __asm__ volatile("mov %%ss,%0" : "=r"(ss));
    __asm__ volatile("mov %%fs,%0" : "=r"(fs));  __asm__ volatile("mov %%gs,%0" : "=r"(gs));

    unsigned long fsb = 0, gsb = 0;             // 2) bases via syscall (always works)
    syscall(SYS_arch_prctl, ARCH_GET_FS, &fsb);
    syscall(SYS_arch_prctl, ARCH_GET_GS, &gsb);

    unsigned long self, canary;                  // 3) use FS like the compiler does
    __asm__("mov %%fs:0,%0"    : "=r"(self));      // TCB self-pointer (== pthread_self())
    __asm__("mov %%fs:0x28,%0" : "=r"(canary));    // stack-protector canary

    printf("[%s] cs=%#x ds=%#x es=%#x ss=%#x fs=%#x gs=%#x\n", who, cs, ds, es, ss, fs, gs);
    printf("      CPL=%d  fs_base=%#lx  gs_base=%#lx  fs:0=%#lx  canary=%#lx\n",
           cs & 3, fsb, gsb, self, canary);

    if (getauxval(AT_HWCAP2) & HWCAP2_FSGSBASE) {   // 4) rdfsbase: kernel ≥5.9 + CPU support
        unsigned long r;
        __asm__ volatile("rdfsbase %0" : "=r"(r));
        printf("      rdfsbase=%#lx\n", r);
    }
}

static void *thr(void *a){ dump("thread"); return 0; }

int main(void){
    dump("main  ");
    pthread_t t; pthread_create(&t, 0, thr, 0); pthread_join(t, 0);  // different fs_base, same canary!

    unsigned p;                                   // 5) bonus: CPU/node via segment limit
    __asm__ volatile("lsl %1,%0" : "=r"(p) : "r"(0x7bu));
    printf("running on cpu %u node %u\n", p & 0xfff, p >> 12);
}

; segs.asm — nasm -f elf64 segs.asm && ld segs.o -o segs && gdb -q ./segs
section .text
global _start
_start:
    mov  ax, cs          ; ax = 0x33   (reading is allowed!)
    mov  bx, ss          ; bx = 0x2b
    mov  cx, ds          ; cx = 0
    and  ax, 3           ; ax = CPL = 3

    mov  dx, 0x2b
    mov  ds, dx          ; legal: valid DPL-3 data selector, base still 0 → no effect
    ;mov cs, dx         ; ← nasm refuses; hand-encoded 8E CA → #UD (SIGILL)
    ;mov ds, 0x2b       ; ← no such instruction: sreg ← imm doesn't exist
    ;mov dx, 0x50       ; GDT index 10 (LDT descriptor, not data)
    ;mov ds, dx         ; ← #GP → SIGSEGV   (dmesg: "general protection fault")

    mov  rax, [fs:0]     ; static binary without libc: fs_base = 0 → SIGSEGV reading address 0
                          ; (comment this out, or set fs_base first with arch_prctl = syscall 158)
    mov  eax, 60
    xor  edi, edi
    syscall

pid=$(pgrep -n seg); cat /proc/$pid/maps; cat /proc/$pid/syscall
grep -o -w -E 'fsgsbase|umip|la57|pae|lm' /proc/cpuinfo | sort | uniq -c
LD_SHOW_AUXV=1 /bin/true | grep HWCAP2

Binary Ninja, IDA, Ghidra and objdump are static: they show you which segment an instruction uses, not its value. The patterns to recognize:

; objdump -d -M intel ./a.out   (Binary Ninja shows the same)
64 48 8b 04 25 28 00 00 00   mov  rax, QWORD PTR fs:0x28     ; stack canary load (prologue)
64 48 2b 04 25 28 00 00 00   sub  rax, QWORD PTR fs:0x28     ; canary check (epilogue) → __stack_chk_fail
64 48 8b 04 25 00 00 00 00   mov  rax, QWORD PTR fs:0x0      ; TLS self pointer / pthread_self
64 8b 04 25 f8 ff ff ff      mov  eax, DWORD PTR fs:0xfffffffffffffff8 ; __thread var (local-exec TLS, negative offset)
48 8b 05 c0 2e 00 00         mov  rax, QWORD PTR [rip+0x2ec0]  ; global in .data (PIE) — no segment at all
2e 0f 1f 84 00 00 00 00 00   cs nop WORD PTR [rax+rax*1]    ; padding! 2E prefix is meaningless here
3e ff e0                     notrack jmp rax                 ; 3E (DS prefix) reused as CET "notrack"