在Linux中从一个进程到另一个进程的地址映射

Question

Can this be done? Process A does x = malloc(...) . x is the virtual address from process A's address space (heap). I want a system call, which takes x and unmap's it from process A's address space, and maps it to the virtual address space of process B. Would virt_to_phys() and phys_to_virt() work? virt_to_phys() would be done in process A's context and phys_to_virt() in process B's context. Am I making any sense? I did not dive deeply into address mapping mechanisms in the Linux kernel.

Answer 1

You can do this using POSIX shared memory

Process 1

#include <sys/mman.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/types.h>
#include <stdlib.h>

int main()
{
        unsigned char *shared_byte;
        int shmfd = shm_open("/test_object", O_CREAT | O_RDWR, S_IRUSR | S_IWUSR);
        ftruncate(shmfd, 1);
        shared_byte = mmap(NULL, 1, PROT_READ | PROT_WRITE, MAP_SHARED, shmfd, 0);
        *shared_byte = 123;
        for(;;);
}

Compile and run:

$ cc proc1.c -o proc1 -lrt
$ ./proc1 &
[1] 5381

Inspect the process map:

$ pmap 5381
5381:   ./proc1
08048000      4K r-x-- proc1
08049000      4K rw--- proc1
b7540000      8K rw---   [ anon ]
b7542000    100K r-x-- libpthread-2.22.so
b755b000      4K r---- libpthread-2.22.so
b755c000      4K rw--- libpthread-2.22.so
b755d000      8K rw---   [ anon ]
b755f000   1728K r-x-- libc-2.22.so
b770f000      4K ----- libc-2.22.so
b7710000      8K r---- libc-2.22.so
b7712000      4K rw--- libc-2.22.so
b7713000     12K rw---   [ anon ]
b7716000     28K r-x-- librt-2.22.so
b771d000      4K r---- librt-2.22.so
b771e000      4K rw--- librt-2.22.so
b7724000      4K rw-s- test_object
b7725000      4K rw---   [ anon ]
b7726000      8K r----   [ anon ]
b7728000      4K r-x--   [ anon ]
b7729000    136K r-x-- ld-2.22.so
b774b000      4K r---- ld-2.22.so
b774c000      4K rw--- ld-2.22.so
bfe7f000    132K rw---   [ stack ]
 total     2220K

Notice that there is a 4k test_object mapped to the virtual address space of process 1.

Process 2

#include <sys/mman.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdlib.h>
#include <stdio.h>

int main()
{
        unsigned char *shared_byte;
        int shmfd = shm_open("/test_object", O_RDONLY, 0);
        shared_byte = mmap(NULL, 1, PROT_READ, MAP_SHARED, shmfd, 0);
        printf("%d\n", *shared_byte);
        for(;;);
}

Compile and run:

$ cc proc2.c -o proc2 -lrt
$ ./proc2 &
[2] 5397
123

Notice the "123" value is there from the first program.

Inspect the process map:

$ pmap 5397
5397:   ./proc2
08048000      4K r-x-- proc2
08049000      4K rw--- proc2
b7555000      8K rw---   [ anon ]
b7557000    100K r-x-- libpthread-2.22.so
b7570000      4K r---- libpthread-2.22.so
b7571000      4K rw--- libpthread-2.22.so
b7572000      8K rw---   [ anon ]
b7574000   1728K r-x-- libc-2.22.so
b7724000      4K ----- libc-2.22.so
b7725000      8K r---- libc-2.22.so
b7727000      4K rw--- libc-2.22.so
b7728000     12K rw---   [ anon ]
b772b000     28K r-x-- librt-2.22.so
b7732000      4K r---- librt-2.22.so
b7733000      4K rw--- librt-2.22.so
b7738000      4K rw---   [ anon ]
b7739000      4K r--s- test_object
b773a000      4K rw---   [ anon ]
b773b000      8K r----   [ anon ]
b773d000      4K r-x--   [ anon ]
b773e000    136K r-x-- ld-2.22.so
b7760000      4K r---- ld-2.22.so
b7761000      4K rw--- ld-2.22.so
bffbf000    132K rw---   [ stack ]
 total     2224K

Notice that there is a 4k test_object mapped to the virtual address space of process 2.

Cleanup

$ killall proc1
[1]-  Terminated              ./proc1
$ killall proc2
[2]+  Terminated              ./proc2
$ cat > clean.c << EOF
#include <sys/mman.h>
#include <sys/stat.h>
#include <fcntl.h>

int main()
{
        shm_unlink("/test_object");
}
EOF
$ cc clean.c -o clean -lrt
$ ./clean