Question about the limit and base address in x86-64 segmentation model?

Question

I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it.

So I was reviewing the structure of the segment descriptor in Windows 7 x64 kernel using WinDbg. Also so that not to crash the OS right away, I decided to play with a segment that doesn't use segmentation. Say SS register:

I then decided to modify it in raw memory and reload it via lgdt instruction. So I changed its lower 16 bits to 0x1234, as such (view in memory):

Or so I thought. When I ran the dg command, it showed the limit as 01234fff.

So I have two questions:

1. Where does that fff come from in the limit reported by WinDbg? (shown in red in the first screenshot.)

2. How can a 32-bit base in the segment descriptor encompass the entire 64-bit flat addressing range?

Answer 1

Q1: In its manual "Intel® 64 and IA-32 Architectures Software Developer’s Manual Volume 3A: System Programming Guide, Part 1"

Intel writes in the chapter "3.5.1 Segment Descriptor Tables":

"As with segments, the limit value is added to the base address to get the address of the last valid byte. A limit value of 0 results in exactly one valid byte. Because segment descriptors are always 8 bytes long, the GDT limit should always be one less than an integral multiple of eight (that is, 8N – 1)."

This could explain why the limit of 01234 is filled with fff, to satisfy that condition.

Q2: Same manual, chapter 3.4.1 "Logical Address Translation in IA-32e Mode":

"In 64-bit mode, the offset and base address of the segment are 64-bits instead of 32 bits. The linear address format is also 64 bits wide and is subject to the canonical form requirement. Each code segment descriptor provides an L bit. This bit allows a code segment to execute 64-bit code or legacy 32-bit code by code segment."

Although this answers the question in so far as in 64-bit mode there are no 32-bit base addresses in code segments (if I understands their manual correctly), I could nowhere find a picture corresponding to the Fig.3-8 on p.3-10 with 64-bit base addresses instead of 32-bit ones. The L-bit can be retrieved from that picture. It is not decoded in kd, however, in contrast to the other bits. The Flags value of 02xx of the first (Privilege Level 0, highest) and last (Privilege Level 3) code segments indicate the L-bit, and mark these code segments as 64 bit segments.

In the OP's upper screenshot the Base and Limit are indeed 64 bits, if I get this right. However, the mapping to the lower output is not clear to me. My knowledge of kd is limited, however.

Edit

A limit of 0x1234 was requested. The segment is paged, as indicated by the G (granularity) bit, and decoded by kd. The intel manual is not so very clear, IMO. If one goes into the manual "AMD64 Architecture Programmer’s Manual Volume 2: System Programming" , it writes on p.81:

"Setting the G bit to 1 indicates that the limit field is scaled by 4 Kbytes (4096 bytes)", also having mentioned in a comment.

This means the limit in bytes translates to 0x01234000. About the 0xfff I assume that the system acts in the same way as if entering 0 in the limit field. Quote AMD, p.81: "Setting the limit of 0 when G=1 [i.e. paging] inidcates a segment limit of 4095 [=0xfff]. In case the system acts in the same way with the request made here this would result in a limit value of 0x01234fff.

Another uncertainty remains, however. The given explanation assumes that WinDbg displays the limit in bytes and not in 4K pages.