title: What address regions are protected/forbidden by the linux kernel?
body: <p>I'm experimenting with the ELF file format, and I haven't yet figured out the pattern here. Here is a minimal ELF file:</p>
  
  <pre><code>$ cat zero.asm
  .text
     .global _start
  _start:
      movl    $0,%ebx         # first argument: exit code.
      movl    $1,%eax         # system call number (sys_exit).
      int     $0x80           # call kernel.
  
  $ as zero.asm -o zero.o &amp;&amp; ld zero.o -s &amp;&amp; readelf -h -l a.out
  ELF Header:
    Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 
    Class:                             ELF64
    ...
    Type:                              EXEC (Executable file)
    ...
    Entry point address:               0x400078
  
  Program Headers:
    Type           Offset             VirtAddr           PhysAddr
                   FileSiz            MemSiz              Flags  Align
    LOAD           0x0000000000000000 0x0000000000400000 0x0000000000400000
                   0x0000000000000084 0x0000000000000084  R E    0x200000
  </code></pre>
  
  <p>There is only one load region, which is loaded into  LMA = VMA = <code>0x400000</code> with alignment <code>0x200000</code>. I'm not sure why <code>0x200000</code> is the default or how to change it in ld, but with some hex editing I can decrease the alignment to its minimum value <code>0x1000</code> (according to the ELF spec), and then I can also decrease the page load address. By experimentation, if I have it set to <code>.text = 0x10000</code> or above then it loads and runs successfully, and if I try to load it less than this then the program segfaults. Where is this number coming from? I checked <code>/proc/ID/maps</code> and I don't see any evidence of a protected page at 0-0x10000, but I know that this is where the kernel stores its interrupt handler stuff... but the whole process is in virtual memory anyway so it can't see kernel memory... what going on here? How does the kernel determine which address regions are accessible to my process?</p>