address mapping from one process to another in Linux - linux

Question

Can this be done? Process A does x = malloc(...). x is the virtual address from process A's address space (heap). I want a system call, which takes x and unmap's it from process A's address space, and maps it to the virtual address space of process B.
Would virt_to_phys() and phys_to_virt() work? virt_to_phys() would be done in process A's context and phys_to_virt() in process B's context. Am I making any sense? I did not dive deeply into address mapping mechanisms in the Linux kernel.

Answer 1

You can do this using POSIX shared memory
Process 1
#include <sys/mman.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/types.h>
#include <stdlib.h>
int main()
{
unsigned char *shared_byte;
int shmfd = shm_open("/test_object", O_CREAT | O_RDWR, S_IRUSR | S_IWUSR);
ftruncate(shmfd, 1);
shared_byte = mmap(NULL, 1, PROT_READ | PROT_WRITE, MAP_SHARED, shmfd, 0);
*shared_byte = 123;
for(;;);
}
Compile and run:
$ cc proc1.c -o proc1 -lrt
$ ./proc1 &
[1] 5381
Inspect the process map:
$ pmap 5381
5381: ./proc1
08048000 4K r-x-- proc1
08049000 4K rw--- proc1
b7540000 8K rw--- [ anon ]
b7542000 100K r-x-- libpthread-2.22.so
b755b000 4K r---- libpthread-2.22.so
b755c000 4K rw--- libpthread-2.22.so
b755d000 8K rw--- [ anon ]
b755f000 1728K r-x-- libc-2.22.so
b770f000 4K ----- libc-2.22.so
b7710000 8K r---- libc-2.22.so
b7712000 4K rw--- libc-2.22.so
b7713000 12K rw--- [ anon ]
b7716000 28K r-x-- librt-2.22.so
b771d000 4K r---- librt-2.22.so
b771e000 4K rw--- librt-2.22.so
b7724000 4K rw-s- test_object
b7725000 4K rw--- [ anon ]
b7726000 8K r---- [ anon ]
b7728000 4K r-x-- [ anon ]
b7729000 136K r-x-- ld-2.22.so
b774b000 4K r---- ld-2.22.so
b774c000 4K rw--- ld-2.22.so
bfe7f000 132K rw--- [ stack ]
total 2220K
Notice that there is a 4k test_object mapped to the virtual address space of process 1.
Process 2
#include <sys/mman.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdlib.h>
#include <stdio.h>
int main()
{
unsigned char *shared_byte;
int shmfd = shm_open("/test_object", O_RDONLY, 0);
shared_byte = mmap(NULL, 1, PROT_READ, MAP_SHARED, shmfd, 0);
printf("%d\n", *shared_byte);
for(;;);
}
Compile and run:
$ cc proc2.c -o proc2 -lrt
$ ./proc2 &
[2] 5397
123
Notice the "123" value is there from the first program.
Inspect the process map:
$ pmap 5397
5397: ./proc2
08048000 4K r-x-- proc2
08049000 4K rw--- proc2
b7555000 8K rw--- [ anon ]
b7557000 100K r-x-- libpthread-2.22.so
b7570000 4K r---- libpthread-2.22.so
b7571000 4K rw--- libpthread-2.22.so
b7572000 8K rw--- [ anon ]
b7574000 1728K r-x-- libc-2.22.so
b7724000 4K ----- libc-2.22.so
b7725000 8K r---- libc-2.22.so
b7727000 4K rw--- libc-2.22.so
b7728000 12K rw--- [ anon ]
b772b000 28K r-x-- librt-2.22.so
b7732000 4K r---- librt-2.22.so
b7733000 4K rw--- librt-2.22.so
b7738000 4K rw--- [ anon ]
b7739000 4K r--s- test_object
b773a000 4K rw--- [ anon ]
b773b000 8K r---- [ anon ]
b773d000 4K r-x-- [ anon ]
b773e000 136K r-x-- ld-2.22.so
b7760000 4K r---- ld-2.22.so
b7761000 4K rw--- ld-2.22.so
bffbf000 132K rw--- [ stack ]
total 2224K
Notice that there is a 4k test_object mapped to the virtual address space of process 2.
Cleanup
$ killall proc1
[1]- Terminated ./proc1
$ killall proc2
[2]+ Terminated ./proc2
$ cat > clean.c << EOF
#include <sys/mman.h>
#include <sys/stat.h>
#include <fcntl.h>
int main()
{
shm_unlink("/test_object");
}
EOF
$ cc clean.c -o clean -lrt
$ ./clean