参考书籍：<linxu程序设计第2版>、<linux系统分析和高级编程技术>、<linux内核完全注释>
共享内存即让两个进程访问同一部分逻辑内存。是有IPC为一个进程创建的特殊的地址范围，出现在进程的地址空间中，其他进程可以把同一段共享内存段连接到它们自己的地址空间去。如果一个进程向这段共享内存写了数据，所做的改变立刻被其他进程看到。但是共享内存本身没有同步功能，需要我们自己注意同步.
1.共享内存相关结构体定义以及函数声明：
系统的共享内存段在系统内核中也有一个内部的数据结构shmid_ds。描述了共享内存的认证，字节大小，分离、改变时间，创建它的进程，最后操作的进程以及多少进程在使用等信息。这些数据结构保存在 shm_segs 向量表中，struct shmid_ds不是内核用来跟踪共享内存区域的数据结构。取而代之的是，struct shmid_ds包含这种信息的绝大部分，而剩下的信息则位于下边要介绍的struct shmid_kernel中。Shmid_ds在Linux/shm.h中有定义：
/*Obsolete, used only for backwards compatibility and libc5 compiles*/
struct shmid_ds {
struct ipc_perm shm_perm; /* operation perms */
int shm_segsz; /* size of segment (bytes) */
__kernel_time_t shm_atime; /* last attach time */
__kernel_time_t shm_dtime; /* last detach time */
__kernel_time_t shm_ctime; /* last change time */
__kernel_ipc_pid_t shm_cpid; /* pid of creator */
__kernel_ipc_pid_t shm_lpid; /* pid of last operator */
unsigned short shm_nattch; /* no. of current attaches */
unsigned short shm_unused; /* compatibility */
void *shm_unused2; /* ditto - used by DIPC */
void *shm_unused3; /* unused */
};
/*Obsolete, used only for backwards compatibility and libc5 compiles*/
struct ipc_perm
{
__kernel_key_t key;
__kernel_uid_t uid;
__kernel_gid_t gid;
__kernel_uid_t cuid;
__kernel_gid_t cgid;
__kernel_mode_t mode;
unsigned short seq;
};
相关头文件sys/shm.h sys/ipc.h sys/types.h。ipc/shm.c里有对应内核源码。这是shm.h里关于共享内存函数的声明。
2.共享内存处理函数中使用的一些宏：系统中共享内存数量是限制宏和共享内存出来函数中使用的flag
#define SHMMAX 0x2000000 /* max shared seg size (bytes) */
#define SHMMIN 1 /* min shared seg size (bytes) */
#define SHMMNI 4096 /* max num of segs system wide */
#define SHMALL (SHMMAX/PAGE_SIZE*(SHMMNI/16)) /* max shm system wide (pages) */
#define SHMSEG SHMMNI /* max shared segs per process */
/* permission flag for shmget */
#define SHM_R 0400 /* or S_IRUGO from <linux/stat.h> */
#define SHM_W 0200 /* or S_IWUGO from <linux/stat.h> */
/* mode for attach */
#define SHM_RDONLY 010000 /* read-only access */
#define SHM_RND 020000 /* round attach address to SHMLBA boundary */
#define SHM_REMAP 040000 /* take-over region on attach */
/* super user shmctl commands */
#define SHM_LOCK 11
#define SHM_UNLOCK 12
/* ipcs ctl commands */
#define SHM_STAT 13
#define SHM_INFO 14
在shm.c文件中 定义了共享内存例外的几个属性：
struct shmid_kernel /* private to the kernel */
{
struct kern_ipc_perm shm_perm;
struct file * shm_file;
int id;
unsigned long shm_nattch;
unsigned long shm_segsz;
time_t shm_atim;
time_t shm_dtim;
time_t shm_ctim;
pid_t shm_cprid;
pid_t shm_lprid;
struct mm_struct * shm_locker_mm;
pid_t shm_locker_pid;
};
#define shm_flags shm_perm.mode
static struct file_operations shm_file_operations;
static struct vm_operations_struct shm_vm_ops;
static struct ipc_ids shm_ids;
struct shmid_kernel用于分离“私有（private）”的共享内存相关信息和“公有（public）”的信息。struct shmid_ds里那些对用户应用程序可见的部分还保留在struct shmid _ds之内，而关系到内核的私有信息则位于struct shmid_kernel之内。用户应用程序需要能够通过struct shmid_ds来进行shmctl系统调用，所以它的定义必须对它们是可见的，但是内核私有实现的细节就不应该出现在struct的定义之中。否则，改变内核的执行可能会中断应用程序。
3.共享内存函数解析:shmget()：创建共享内存。程序需要一个键字参数key也就是共享内存段的名字，shmget返回一个供后续共享内存函数使用的共享内存标识码。首先系统是调用sys_ipc（ipc.c内）call值为SHMGET创建一个键值为key的共享内存对象，或者获得已经存在的键值为key的某共享内存对象的引用标识符。Size表需要共享的内存量，字节为单位。Shmflg有9个权限标志。IPC_CREAT和其他标志或在一起才能创建新的共享内存段。使用方法和open函数的mode参数类似。
Sys_ipc函数：
asmlinkage int sys_ipc (uint call, int first, int second,
int third, void *ptr, long fifth)
{
int version, ret;
version = call >> 16; /* hack for backward compatibility */
call &= 0xffff;
switch (call) {
case SEMOP:
return sys_semop (first, (struct sembuf *)ptr, second);
case SEMGET:
return sys_semget (first, second, third);
case SEMCTL: {
union semun fourth;
if (!ptr)
return -EINVAL;
if (get_user(fourth.__pad, (void **) ptr))
return -EFAULT;
return sys_semctl (first, second, third, fourth);
}
case MSGSND:
return sys_msgsnd (first, (struct msgbuf *) ptr,
second, third);
case MSGRCV:
switch (version) {
case 0: {
struct ipc_kludge tmp;
if (!ptr)
return -EINVAL;
if (copy_from_user(&tmp,
(struct ipc_kludge *) ptr,
sizeof (tmp)))
return -EFAULT;
return sys_msgrcv (first, tmp.msgp, second,
tmp.msgtyp, third);
}
default:
return sys_msgrcv (first,
(struct msgbuf *) ptr,
second, fifth, third);
}
case MSGGET:
return sys_msgget ((key_t) first, second);
case MSGCTL:
return sys_msgctl (first, second, (struct msqid_ds *) ptr);
case SHMAT:
switch (version) {
default: {
ulong raddr;
ret = sys_shmat (first, (char *) ptr, second, &raddr);
if (ret)
return ret;
return put_user (raddr, (ulong *) third);
}
case 1: /* iBCS2 emulator entry point */
if (!segment_eq(get_fs(), get_ds()))
return -EINVAL;
return sys_shmat (first, (char *) ptr, second, (ulong *) third);
}
case SHMDT:
return sys_shmdt ((char *)ptr);
case SHMGET:
return sys_shmget (first, second, third);
case SHMCTL:
return sys_shmctl (first, second,
(struct shmid_ds *) ptr);
default:
return -EINVAL;
}
}
Sys_semget函数：
asmlinkage long sys_shmget (key_t key, size_t size, int shmflg)
{
struct shmid_kernel *shp;
int err, id = 0;
down(&shm_ids.sem);
if (key == IPC_PRIVATE) {
err = newseg(key, shmflg, size);
} else if ((id = ipc_findkey(&shm_ids, key)) == -1) {
if (!(shmflg & IPC_CREAT))
err = -ENOENT;
else
err = newseg(key, shmflg, size);
} else if ((shmflg & IPC_CREAT) && (shmflg & IPC_EXCL)) {
err = -EEXIST;
} else {
shp = shm_lock(id);
if(shp==NULL)
BUG();
if (shp->shm_segsz < size)
err = -EINVAL;
else if (ipcperms(&shp->shm_perm, shmflg))
err = -EACCES;
else
err = shm_buildid(id, shp->shm_perm.seq);
shm_unlock(id);
}
up(&shm_ids.sem);
return err;
}
Sys_semget函数流程：Key=IPC_PRIVATE时穿件本进程的私有共享内存。Sys_shmget中newseg函数与newque和newary相对应的函数，主要工作是计算size大小，申请shmid_kernel数据结构，申请一块用于建立页表的空间并清零，填写shmid_kernel数据结构并加入到shm_segs中，返回共享内存对象的引用标识符，struct shmid_kernel是由kmalloc分配的（在不可交换的内核内存里）。Key有值的时候，如果在没有在shm_segs中找到键值为key的共享内存对象，检测传入的shmflg，如果shmflg需要创建则创建，否则返回错误。如果找到，根据shmflg判断是否要求创建，要求创建返回错误，不要求创建并且检测shm_lock()返回的shmid_kernel结构体是否合法，合法返回对象的标识符。
键：在IPC的通信模式下，不管是使用消息队列还是共享内存，甚至是信号量，每个IPC的对象(object)都有唯一的名字，称为“键”(key)。通过“键”，进程能够识别所用的对象。“键”与IPC对象的关系就如同文件名称之于文件，通过文件名，进程能够读写文件内的数据，甚至多个进程能够共用一个文件。而在IPC的通讯模式下，通过“键”的使用也使得一个IPC对象能为多个进程所共用。 Linux系统中的所有表示SystemV中IPC对象的数据结构都包括一个ipc_perm结构，其中包含有IPC对象的键值，该键用于查找SystemV中IPC对象的引用标识符。如果不使用“键”，进程将无法存取IPC对象，因为IPC对象并不存在于进程本身使用的内存中。
Shmat()把建立的共享内存段连接到某个进程的地址空间以便访问。第一个参数shm_id是shmget返回的标识码，shm_addr是共享内存连接到当前进程时准备放置的地址，如果是空指针表把该工作交给系统完成。Shmflg处理标识，SHM_RND，SHM_RDONLY。返回的是进程中虚拟地址。
Shmat()函数：
asmlinkage long sys_shmat (int shmid, char *shmaddr, int shmflg, ulong *raddr)
{
struct shmid_kernel *shp;
unsigned long addr;
unsigned long size;
struct file * file;
int err;
unsigned long flags;
unsigned long prot;
unsigned long o_flags;
int acc_mode;
void *user_addr;
if (shmid < 0)
return -EINVAL;
if ((addr = (ulong)shmaddr)) {
if (addr & (SHMLBA-1)) {
if (shmflg & SHM_RND)
addr &= ~(SHMLBA-1); /* round down */
else
return -EINVAL;
}
flags = MAP_SHARED | MAP_FIXED;
} else {
if ((shmflg & SHM_REMAP))
return -EINVAL;
flags = MAP_SHARED;
}
if (shmflg & SHM_RDONLY) {
prot = PROT_READ;
o_flags = O_RDONLY;
acc_mode = S_IRUGO;
} else {
prot = PROT_READ | PROT_WRITE;
o_flags = O_RDWR;
acc_mode = S_IRUGO | S_IWUGO;
}
/*
* We cannot rely on the fs check since SYSV IPC does have an
* additional creator id...
*/
shp = shm_lock(shmid);
if(shp == NULL)
return -EINVAL;
err = shm_checkid(shp,shmid);
if (err) {
shm_unlock(shmid);
return err;
}
if (ipcperms(&shp->shm_perm, acc_mode)) {
shm_unlock(shmid);
return -EACCES;
}
file = shp->shm_file;
size = file->f_dentry->d_inode->i_size;
shp->shm_nattch++;
shm_unlock(shmid);
down_write(¤t->mm->mmap_sem);
if (addr && !(shmflg & SHM_REMAP)) {
user_addr = ERR_PTR(-EINVAL);
if (find_vma_intersection(current->mm, addr, addr + size))
goto invalid;
/*
* If shm segment goes below stack, make sure there is some
* space left for the stack to grow (at least 4 pages).
*/
if (addr < current->mm->start_stack &&
addr > current->mm->start_stack - size - PAGE_SIZE * 5)
goto invalid;
}
user_addr = (void*) do_mmap (file, addr, size, prot, flags, 0);
invalid:
up_write(¤t->mm->mmap_sem);
down (&shm_ids.sem);
if(!(shp = shm_lock(shmid)))
BUG();
shp->shm_nattch--;
if(shp->shm_nattch == 0 &&
shp->shm_flags & SHM_DEST)
shm_destroy (shp);
else
shm_unlock(shmid);
up (&shm_ids.sem);
*raddr = (unsigned long) user_addr;
err = 0;
if (IS_ERR(user_addr))
err = PTR_ERR(user_addr);
return err;
}
Kernel中sys_shmat()函数首先是根据shmid找到共享内存对象。根据shmaddr的地址座位映射的虚拟地址，当shmaddr为0时，随机分配一个。检查虚拟地址合法性，申请一块用来建vm_area_struct结构内存，并填写，加入到进程的mm结构和该共享内存对象的vm_area_struct队列中。
Shmdt函数时把共享内存与当前进程脱离开。参数是shmget返回的地址指针。不影响其他进程和该共享内存对象的交互。当前进程的vm_area_struct结构被从shmid_ds中删除释放，进程的页表也被更新，当该共享内存和最后一个进程也分离，则共享内存页和kemid_kernel结构也都被释放。
Sys_shmdt函数：
asmlinkage long sys_shmdt (char *shmaddr)
{
struct mm_struct *mm = current->mm;
struct vm_area_struct *shmd, *shmdnext;
int retval = -EINVAL;
down_write(&mm->mmap_sem);
for (shmd = mm->mmap; shmd; shmd = shmdnext) {
shmdnext = shmd->vm_next;
if ((shmd->vm_ops == &shm_vm_ops || is_vm_hugetlb_page(shmd))
&& shmd->vm_start - (shmd->vm_pgoff << PAGE_SHIFT) == (ulong) shmaddr) {
do_munmap(mm, shmd->vm_start, shmd->vm_end - shmd->vm_start, 1);
retval = 0;
}
}
up_write(&mm->mmap_sem);
return retval;
}
Shmctl函数，共享内存的控制函数。参数command表将要采取的动作：IPC_STAT,SHM_STAT 把shmid_ds结构中的数据设置为共享内存的当前关联值,IPC_SET在进程有权限下把共享内存的当前关联值设为shmid_ds给的值,IPC_RMID删除共享内存段，获得共享内存状态(SHM_INFO IPC_INFO)，锁定和释放（SHM_LOCKED）等。参数buf是指向shmid_ds结构体的指针。
shmctl函数：
asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds *buf)
{
struct shm_setbuf setbuf;
struct shmid_kernel *shp;
int err, version;
if (cmd < 0 || shmid < 0)
return -EINVAL;
version = ipc_parse_version(&cmd);
switch (cmd) { /* replace with proc interface ? */
case IPC_INFO:
{
struct shminfo64 shminfo;
memset(&shminfo,0,sizeof(shminfo));
shminfo.shmmni = shminfo.shmseg = shm_ctlmni;
shminfo.shmmax = shm_ctlmax;
shminfo.shmall = shm_ctlall;
shminfo.shmmin = SHMMIN;
if(copy_shminfo_to_user (buf, &shminfo, version))
return -EFAULT;
/* reading a integer is always atomic */
err= shm_ids.max_id;
if(err<0)
err = 0;
return err;
}
case SHM_INFO:
{
struct shm_info shm_info;
memset(&shm_info,0,sizeof(shm_info));
down(&shm_ids.sem);
shm_info.used_ids = shm_ids.in_use;
shm_get_stat (&shm_info.shm_rss, &shm_info.shm_swp);
shm_info.shm_tot = shm_tot;
shm_info.swap_attempts = 0;
shm_info.swap_successes = 0;
err = shm_ids.max_id;
up(&shm_ids.sem);
if(copy_to_user (buf, &shm_info, sizeof(shm_info)))
return -EFAULT;
return err < 0 ? 0 : err;
}
case SHM_STAT:
case IPC_STAT:
{
struct shmid64_ds tbuf;
int result;
memset(&tbuf, 0, sizeof(tbuf));
shp = shm_lock(shmid);
if(shp==NULL)
return -EINVAL;
if(cmd==SHM_STAT) {
err = -EINVAL;
if (shmid > shm_ids.max_id)
goto out_unlock;
result = shm_buildid(shmid, shp->shm_perm.seq);
} else {
err = shm_checkid(shp,shmid);
if(err)
goto out_unlock;
result = 0;
}
err=-EACCES;
if (ipcperms (&shp->shm_perm, S_IRUGO))
goto out_unlock;
kernel_to_ipc64_perm(&shp->shm_perm, &tbuf.shm_perm);
tbuf.shm_segsz = shp->shm_segsz;
tbuf.shm_atime = shp->shm_atim;
tbuf.shm_dtime = shp->shm_dtim;
tbuf.shm_ctime = shp->shm_ctim;
tbuf.shm_cpid = shp->shm_cprid;
tbuf.shm_lpid = shp->shm_lprid;
tbuf.shm_nattch = shp->shm_nattch;
shm_unlock(shmid);
if(copy_shmid_to_user (buf, &tbuf, version))
return -EFAULT;
return result;
}
case SHM_LOCK:
case SHM_UNLOCK:
{
/* Allow superuser to lock segment in memory */
if (!can_do_mlock())
return -EPERM;
shp = shm_lock(shmid);
if(shp==NULL)
return -EINVAL;
err = shm_checkid(shp,shmid);
if(err)
goto out_unlock;
if (current->euid != shp->shm_perm.uid &&
current->euid != shp->shm_perm.cuid &&
!capable(CAP_IPC_LOCK)) {
err = -EPERM;
goto out_unlock;
}
if(cmd==SHM_LOCK) {
err = 0;
if (!is_file_hugepages(shp->shm_file))
err = shmem_lock(shp->shm_file, 1,
&shp->shm_locker_mm,
&shp->shm_locker_pid);
if (!err)
shp->shm_flags |= SHM_LOCKED;
} else {
if (!is_file_hugepages(shp->shm_file))
shmem_lock(shp->shm_file, 0,
&shp->shm_locker_mm,
&shp->shm_locker_pid);
shp->shm_flags &= ~SHM_LOCKED;
}
shm_unlock(shmid);
return err;
}
case IPC_RMID:
{
/*
* We cannot simply remove the file. The SVID states
* that the block remains until the last person
* detaches from it, then is deleted. A shmat() on
* an RMID segment is legal in older Linux and if
* we change it apps break...
*
* Instead we set a destroyed flag, and then blow
* the name away when the usage hits zero.
*/
down(&shm_ids.sem);
shp = shm_lock(shmid);
err = -EINVAL;
if (shp == NULL)
goto out_up;
err = shm_checkid(shp, shmid);
if(err)
goto out_unlock_up;
if (current->euid != shp->shm_perm.uid &&
current->euid != shp->shm_perm.cuid &&
!capable(CAP_SYS_ADMIN)) {
err=-EPERM;
goto out_unlock_up;
}
if (shp->shm_nattch){
shp->shm_flags |= SHM_DEST;
/* Do not find it any more */
shp->shm_perm.key = IPC_PRIVATE;
shm_unlock(shmid);
} else
shm_destroy (shp);
up(&shm_ids.sem);
return err;
}
case IPC_SET:
{
if(copy_shmid_from_user (&setbuf, buf, version))
return -EFAULT;
down(&shm_ids.sem);
shp = shm_lock(shmid);
err=-EINVAL;
if(shp==NULL)
goto out_up;
err = shm_checkid(shp,shmid);
if(err)
goto out_unlock_up;
err=-EPERM;
if (current->euid != shp->shm_perm.uid &&
current->euid != shp->shm_perm.cuid &&
!capable(CAP_SYS_ADMIN)) {
goto out_unlock_up;
}
shp->shm_perm.uid = setbuf.uid;
shp->shm_perm.gid = setbuf.gid;
shp->shm_flags = (shp->shm_flags & ~S_IRWXUGO)
| (setbuf.mode & S_IRWXUGO);
shp->shm_ctim = CURRENT_TIME;
break;
}
default:
return -EINVAL;
}
err = 0;
out_unlock_up:
shm_unlock(shmid);
out_up:
up(&shm_ids.sem);
return err;
out_unlock:
shm_unlock(shmid);
return err;
}
实例（linux程序设计源码）：
shm_com.h
/* A common header file to describe the shared memory we wish to pass about. */
#define TEXT_SZ 2048
struct shared_use_st {
int written_by_you;
char some_text[TEXT_SZ];
};
shm1.c
/* Our first program is a consumer. After the headers the shared memory segment
(the size of our shared memory structure) is created with a call to shmget,
with the IPC_CREAT bit specified. */
#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/ipc.h>
#include <sys/shm.h>
#include "shm_com.h"
int main()
{
int running = 1;
void *shared_memory = (void *)0;
struct shared_use_st *shared_stuff;
int shmid;
srand((unsigned int)getpid());
shmid = shmget((key_t)1234, sizeof(struct shared_use_st), 0666 | IPC_CREAT);
if (shmid == -1) {
fprintf(stderr, "shmget failed\n");
exit(EXIT_FAILURE);
}
/* We now make the shared memory accessible to the program. */
shared_memory = shmat(shmid, (void *)0, 0);
if (shared_memory == (void *)-1) {
fprintf(stderr, "shmat failed\n");
exit(EXIT_FAILURE);
}
printf("Memory attached at %X\n", (int)shared_memory);
/* The next portion of the program assigns the shared_memory segment to shared_stuff,
which then prints out any text in written_by_you. The loop continues until end is found
in written_by_you. The call to sleep forces the consumer to sit in its critical section,
which makes the producer wait. */
shared_stuff = (struct shared_use_st *)shared_memory;
shared_stuff->written_by_you = 0;
while(running) {
if (shared_stuff->written_by_you) {
printf("You wrote: %s", shared_stuff->some_text);
sleep( rand() % 4 ); /* make the other process wait for us ! */
shared_stuff->written_by_you = 0;
if (strncmp(shared_stuff->some_text, "end", 3) == 0) {
running = 0;
}
}
}
/* Lastly, the shared memory is detached and then deleted. */
if (shmdt(shared_memory) == -1) {
fprintf(stderr, "shmdt failed\n");
exit(EXIT_FAILURE);
}
if (shmctl(shmid, IPC_RMID, 0) == -1) {
fprintf(stderr, "shmctl(IPC_RMID) failed\n");
exit(EXIT_FAILURE);
}
exit(EXIT_SUCCESS);
}
shm2.c
/* The second program is the producer and allows us to enter data for consumers.
It's very similar to shm1.c and looks like this. */
#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/ipc.h>
#include <sys/shm.h>
#include "shm_com.h"
int main()
{
int running = 1;
void *shared_memory = (void *)0;
struct shared_use_st *shared_stuff;
char buffer[BUFSIZ];
int shmid;
shmid = shmget((key_t)1234, sizeof(struct shared_use_st), 0666 | IPC_CREAT);
if (shmid == -1) {
fprintf(stderr, "shmget failed\n");
exit(EXIT_FAILURE);
}
shared_memory = shmat(shmid, (void *)0, 0);
if (shared_memory == (void *)-1) {
fprintf(stderr, "shmat failed\n");
exit(EXIT_FAILURE);
}
printf("Memory attached at %X\n", (int)shared_memory);
shared_stuff = (struct shared_use_st *)shared_memory;
while(running) {
while(shared_stuff->written_by_you == 1) {
sleep(1);
printf("waiting for client...\n");
}
printf("Enter some text: ");
fgets(buffer, BUFSIZ, stdin);
strncpy(shared_stuff->some_text, buffer, TEXT_SZ);
shared_stuff->written_by_you = 1;
if (strncmp(buffer, "end", 3) == 0) {
running = 0;
}
}
if (shmdt(shared_memory) == -1) {
fprintf(stderr, "shmdt failed\n");
exit(EXIT_FAILURE);
}
exit(EXIT_SUCCESS);
}
实例的共享内存大小为shared_use_st结构体大小，shm1.c shm2.c 通过结构体第一个变量wtiteen_by_you实现两个进程对共享内存区域的同步操作。读写的内容保存到buffer中。首先创建共享内存段，连接。然后shm1.c持续读共享内存中内容，shm2.c持续写共享到共享内存中，以字符串end结束。共享内存从进程分离并删除。
用两个shh登陆分别运行1和2程序：
Ipcs –m和ipcrm shm <id>命令:
ipcs -m 可以看我们的系统共享内存情况，ipcrm shm <id>可以删除共享内存。运行1程序后直接ctrl c中止进程，我们就没有释放申请的共享内存段，我们用ipcrm shm释放共享内存。
