https://tech.nextroll.com/blog/data/2016/11/29/traildb-mmap-...
https://github.com/whitequark/unfork
Past discussions of unfork:
https://lwn.net/Articles/819834/ "Blocking userfaultfd() kernel-fault handling" (patches to fix a security issue, more detail in https://duasynt.com/blog/linux-kernel-heap-spray)
https://lwn.net/Articles/849876/ "Patching until the COWs come home" (complicated interaction with copy-on-write)
To map memory at a specific address, you use mmap() with the MAP_FIXED flag. This lets you tell the kernel: "Please put these pages at this virtual address, replacing what's already there."
Note that userfaultfd is not the only way to detect and handle faults. You can also register a signal handler for SIGSEGV. The signal handler function receives information from the kernel specifying what address caused the fault. If, in the signal handler, you use mmap() to map memory at that address, and then return, the program will continue as if nothing happened.
userfaultfd allows you to do the same but from a different thread or process. The SIGSEGV signal handler would actually run inside the thread that faulted, but with userfaultfd the faulting thread pauses and some other thread or process receives the notification.
int mem_fd = memfd_create("", 0);
ftruncate(fd, 4096);
void* mem = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_SHARED, mem_fd, 0);
void* alias = mmap((void*) 0x4000, 4096, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_SHARED, mem_fd, 0);
close(mem_fd);
// alias now points to the same physical memory as mem
This is commonly used to create ring buffers that wrap around transparently.