segment descriptor

A segment descriptor is a 64-bit data structure held in a segment table that describes a memory segment's location, size, and access permissions. The processor uses it to convert a logical address (segment selector plus offset) into a linear address that points to actual physical memory. This translation happens in microseconds during every memory access in protected mode on x86 and x86-64 architectures.

Each descriptor contains the segment's base address (32 bits in 386 and later processors), the segment limit (which defines the segment's size or upper boundary), and control bits that specify the segment type (code, data, or system), privilege level, and read/write permissions. The descriptor also includes a present bit that signals whether the segment is currently loaded in memory, and a granularity bit that determines whether the limit is measured in bytes or in 4-kilobyte pages.

Where descriptors live and how they work

Segment descriptors are stored in either the Global Descriptor Table (GDT), the Local Descriptor Table (LDT), or the Interrupt Descriptor Table (IDT), depending on their scope and purpose. When software loads a segment selector into a segment register (CS for code, DS for data, etc.), the processor automatically fetches the corresponding descriptor from the appropriate table and caches it in a hidden register. Subsequent memory operations use this cached descriptor for address translation until the segment register changes.

The privilege level field in the descriptor (2 bits, allowing 4 levels from 0 to 3) enforces memory protection by preventing lower-privileged code from accessing higher-privileged segments. A descriptor with privilege level 0 is accessible only to kernel code; one marked level 3 is accessible to user applications. If code attempts to access a segment it lacks permission for, the processor raises a general protection fault.

Common problems arise when descriptors are misconfigured: an incorrect base address or limit will cause memory access to read from or write to the wrong location, often corrupting other data or code; a missing present bit will trigger an exception. Debugging descriptor issues requires reading the GDT and LDT directly using kernel tools, since the cached values inside segment registers are not directly visible to software.