Subject: Re: Disallowing mmapping of NULL
To: Steven M. Bellovin <smb@cs.columbia.edu>
From: John F. Woods <jfw@jfwhome.funhouse.com>
List: tech-kern
Date: 01/29/2007 20:30:32
> > Historically a byte read from address 0 returned the value 0, so that
> > code could do 'if (*ptr)' instead of 'if (ptr && *ptr)' in order to
> > save code bytes.
> That depends on how historical you want to get.  On PDP-11s, 0 was the
> start of the text segment, and was where the kernel branched after an
> exec.  From a.out(5) from 7th Edition Unix:
> 	The text segment begins at 0 in the core image; the  header
> 	is not loaded.

[Ah, the good old days...]
If you compiled for split I&D, the data segment would also begin at 0.
Although I'm pretty sure the shim that got inserted was a 0 word, I don't
recall anyone taking advantage of that with a straight face.

I also recall that the very first release of the System V Verification Suite
had a very curious test:

	if (strcmp(0, "%$!") != 0)
		fail();

I don't recall exactly what the three-character string of trash it was
comparing against was, but it turned out to be whatever the SVr2 linker
routinely put at address 0 on a 3B2 (and which, obviously, didn't have a
NUL byte at address 0, nor a 0 word at address 0).  They were pretty
apologetic when I reported that as a test bug...

> I confess I do not remember the optimization you refer to.

I believe this would be one of those cases of optimizing for "minimum time
to mysterious program failure"...