GAS/x86 disassembled a bare gs register as an instruction, is it a bug?

Question

I encountered a strange x86-32 instruction (opcode 0x65) decoded by objdump as gs (not %gs but gs). I found it while a full linear sweep of a binary (objdump -D), so the decoding was surely incorrect. But, still, objdump didn't decode it as a (bad) instruction, so it means that it can be encountered and I would like to know what does it means.

Here is an example of this instruction:

080484fc <_IO_stdin_used>:
 80484fc:       01 00                   add    %eax,(%eax)
 80484fe:       02 00                   add    (%eax),%al
 8048500:       48                      dec    %eax
 8048501:       65                      gs     <======================= Here!!!
 8048502:       6c                      insb   (%dx),%es:(%edi)
 8048503:       6c                      insb   (%dx),%es:(%edi)
 8048504:       6f                      outsl  %ds:(%esi),(%dx)
 8048505:       20 57 6f                and    %dl,0x6f(%edi)
 8048508:       72 6c                   jb     8048576 <_IO_stdin_used+0x7a>
 804850a:       64 21 0a                and    %ecx,%fs:(%edx)
 804850d:       00 44 6f 64             add    %al,0x64(%edi,%ebp,2)
 8048511:       67 65 20 54 68          and    %dl,%gs:0x68(%si)
 8048516:       69                      .byte 0x69
 8048517:       73 21                   jae    804853a <_IO_stdin_used+0x3e>

Note that searching for this instruction on the Web is quite difficult because of the %gs register which mask all other possible hit.

So, is it a real "instruction" or is it glitch produced by gas ?

Answer 1

Strictly speaking it's not an instruction. It's the segment override prefix (prefixes are considered to be part of the instruction).

Most memory accesses use DS segment selector by default except those involving ESP or EBP register (they default to SS) and some "string" instructions (movs, scas etc). Segment override prefixes allow you to use another segment selector to access your data. E.g. in DOS times the CS override was commonly used to access data stored in the code segment (such as jump tables):

seg001:00EA shl bx, 1 ; SWITCH
seg001:00EC jmp cs:off_13158[bx] ; switch jump
...
seg001:0588 off_13158  dw offset loc_12DD7 ; DATA XREF: _main+E6r
seg001:0588            dw offset loc_12DE5 ; jump table for switch statement
seg001:0588            dw offset loc_12DE5
seg001:0588            dw offset loc_12DE5

The 80386 added two extra segment registers (GS and FS) and the corresponding prefixes.

Since the GS prefix does not actually affect the following instruction (insb) in the code snipped above, GAS opted out for printing it on a separate line.

In some of the following instructions you can see how it affects the disassembly:

64 21 0a       ->  and %ecx, %fs:(%edx)
^^                           ^^^
67 65 20 54 68 -> and %dl, %gs:0x68(%si)
   ^^                      ^^^

BTW, 67 is another prefix, this time the address size override. It is why the instruction uses the 16-bit SI register and not the full ESI.