一文搞定：Linux 共享内存原理

干货第一时间送达

在Linux系统中，每个进程都有独立的虚拟内存空间，也就是说不同的进程访问同一段虚拟内存地址所得到的数据是不一样的，这是因为不同进程相同的虚拟内存地址会映射到不同的物理内存地址上。

共享内存

共享内存使用 1. 获取共享内存

shmget()shmget()

int shmget(key_t key, size_t size, int shmflg);

keyftok()sizeshmflgshmget()IPC_CREAT

函数调用成功时返回一个新建或已经存在的的共享内存标识符，取决于shmflg的参数。失败返回-1，并设置错误码。

2. 关联共享内存

shmget()shmat()shmat()

void *shmat(int shmid, const void *shmaddr, int shmflg);

shmidshmget()shmaddrshmflgSHM_RDONLY

函数调用成功返回一个可用的指针（虚拟内存地址），出错返回-1。

3. 取消关联共享内存

shmdt()

int shmdt(const void *shmaddr);

shmaddrshmat()

函数调用成功返回0，出错返回-1。

共享内存使用例子

进程A进程B进程A进程B

进程A

#include
#include
#include
#include
#include

#define SHM_PATH "/tmp/shm"
#define SHM_SIZE 128

int main(int argc, char *argv[])
{
int shmid;
char *addr;
key_t key = ftok(SHM_PATH, 0x6666);

shmid = shmget(key, SHM_SIZE, IPC_CREAT|IPC_EXCL| 0666);
if (shmid < 0) {
printf( "failed to create share memory\n");
return -1;
}

addr = shmat(shmid, NULL, 0);
if (addr <= 0) {
printf( "failed to map share memory\n");
return -1;
}

sprintf(addr, "%s", "Hello World\n");

return 0;
}

进程B

#include
#include
#include
#include
#include
#include

#define SHM_PATH "/tmp/shm"
#define SHM_SIZE 128

int main(int argc, char *argv[])
{
int shmid;
char *addr;
key_t key = ftok(SHM_PATH, 0x6666);

char buf[ 128];

shmid = shmget(key, SHM_SIZE, IPC_CREAT);
if (shmid < 0) {
printf( "failed to get share memory\n");
return -1;
}

addr = shmat(shmid, NULL, 0);
if (addr <= 0) {
printf( "failed to map share memory\n");
return -1;
}

strcpy(buf, addr, 128);
printf( "%s", buf);

return 0;
}

测试时先运行进程A，然后再运行进程B，可以看到进程B会打印出 “Hello World”，说明共享内存已经创建成功并且读取。

共享内存实现原理

我们先通过一幅图来了解一下共享内存的大概原理，如下图：

通过上图可知，共享内存是通过将不同进程的虚拟内存地址映射到相同的物理内存地址来实现的，下面将会介绍Linux的实现方式。

struct shmid_kernelstruct shmid_kernel

struct shmid_ds {
struct ipc_perm shm_perm; /* operation perms */
int shm_segsz; /* size of segment (bytes) */
__kernel_time_t shm_atime; /* last attach time */
__kernel_time_t shm_dtime; /* last detach time */
__kernel_time_t shm_ctime; /* last change time */
__kernel_ipc_pid_t shm_cpid; /* pid of creator */
__kernel_ipc_pid_t shm_lpid; /* pid of last operator */
unsigned short shm_nattch; /* no. of current attaches */
unsigned short shm_unused; /* compatibility */
void *shm_unused2; /* ditto - used by DIPC */
void *shm_unused3; /* unused */
};

struct shmid_kernel
{
struct shmid_ds u;
/* the following are private */
unsigned long shm_npages; /* size of segment (pages) */
pte_t *shm_pages; /* array of ptrs to frames -> SHMMAX */
struct vm_area_struct *attaches; /* descriptors for attaches */
};

static struct shmid_kernel *shm_segs[SHMMNI]; // SHMMNI等于128

struct shmid_kernelshm_npagesshm_pages

struct shmid_dsshm_segs数组

shmget() 函数实现

shmget()shmget()

asmlinkage long sys_shmget (key_t key, int size, int shmflg)
{
struct shmid_kernel *shp;
int err, id = 0;

down(&current->mm->mmap_sem);
spin_lock(&shm_lock);
if (size < 0 || size > shmmax) {
err = -EINVAL;
} else if (key == IPC_PRIVATE) {
err = newseg(key, shmflg, size);
} else if ((id = findkey (key)) == -1) {
if (!(shmflg & IPC_CREAT))
err = -ENOENT;
else
err = newseg(key, shmflg, size);
} else if ((shmflg & IPC_CREAT) && (shmflg & IPC_EXCL)) {
err = -EEXIST;
} else {
shp = shm_segs[id];
if (shp->u.shm_perm.mode & SHM_DEST)
err = -EIDRM;
else if (size > shp->u.shm_segsz)
err = -EINVAL;
else if (ipcperms (&shp->u.shm_perm, shmflg))
err = -EACCES;
else
err = ( int) shp->u.shm_perm.seq * SHMMNI + id;
}
spin_unlock(&shm_lock);
up(&current->mm->mmap_sem);
return err;
}

shmget()findkey()findkey()shm_segs数组newseg()newseg()struct shmid_kernelshm_segs数组

shmat() 函数实现

shmat()shmat()

asmlinkage long sys_shmat (int shmid, char *shmaddr, int shmflg, ulong *raddr)
{
struct shmid_kernel *shp;
struct vm_area_struct *shmd;
int err = -EINVAL;
unsigned int id;
unsigned long addr;
unsigned long len;

down(&current->mm->mmap_sem);
spin_lock(&shm_lock);
if (shmid < 0)
goto out;

shp = shm_segs[id = ( unsigned int) shmid % SHMMNI];
if (shp == IPC_UNUSED || shp == IPC_NOID)
goto out;

shmidshm_segs

if (!(addr = (ulong) shmaddr)) {
if (shmflg & SHM_REMAP)
goto out;
err = -ENOMEM;
addr = 0;
again:
if (!(addr = get_unmapped_area(addr, shp->u.shm_segsz))) // 获取一个空闲的虚拟内存空间
goto out;
if(addr & (SHMLBA - 1)) {
addr = (addr + (SHMLBA - 1)) & ~(SHMLBA - 1);
goto again;
}
} else if (addr & (SHMLBA -1)) {
if (shmflg & SHM_RND)
addr &= ~(SHMLBA -1); /* round down */
else
goto out;
}

shmat()get_unmapped_area()

spin_unlock(&shm_lock);
err = -ENOMEM;
shmd = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
spin_lock(&shm_lock);
if (!shmd)
goto out;
if ((shp != shm_segs[id]) || (shp->u.shm_perm.seq != ( unsigned int) shmid / SHMMNI)) {
kmem_cache_free(vm_area_cachep, shmd);
err = -EIDRM;
goto out;
}

kmem_cache_alloc()vm_area_structvm_area_struct

shmd->vm_private_data = shm_segs + id;
shmd->vm_start = addr;
shmd->vm_end = addr + shp->shm_npages * PAGE_SIZE;
shmd->vm_mm = current->mm;
shmd->vm_page_prot = (shmflg & SHM_RDONLY) ? PAGE_READONLY : PAGE_SHARED;
shmd->vm_flags = VM_SHM | VM_MAYSHARE | VM_SHARED
| VM_MAYREAD | VM_MAYEXEC | VM_READ | VM_EXEC
| ((shmflg & SHM_RDONLY) ? 0 : VM_MAYWRITE | VM_WRITE);
shmd->vm_file = NULL;
shmd->vm_offset = 0;
shmd->vm_ops = &shm_vm_ops;

shp->u.shm_nattch++; /* prevent destruction */
spin_unlock(&shm_lock);
err = shm_map(shmd);
spin_lock(&shm_lock);
if (err)
goto failed_shm_map;

insert_attach(shp,shmd); /* insert shmd into shp->attaches */

shp->u.shm_lpid = current->pid;
shp->u.shm_atime = CURRENT_TIME;

*raddr = addr;
err = 0;
out:
spin_unlock(&shm_lock);
up(&current->mm->mmap_sem);
return err;
...
}

vm_area_structvm_opsshm_vm_opsshm_vm_ops

static struct vm_operations_struct shm_vm_ops = {
shm_open, /* open - callback for a new vm-area open */
shm_close, /* close - callback for when the vm-area is released */
NULL, /* no need to sync pages at unmap */
NULL, /* protect */
NULL, /* sync */
NULL, /* advise */
shm_nopage, /* nopage */
NULL, /* wppage */
shm_swapout /* swapout */
};

shm_vm_opsnopageshm_nopage()

shmat()shm_nopage()

shm_nopage() 函数实现

shm_nopage() 函数是当发生内存缺页异常时被调用的，代码如下：

static struct page * shm_nopage(struct vm_area_struct * shmd, unsigned long address, int no_share)
{
pte_t pte;
struct shmid_kernel *shp;
unsigned int idx;
struct page * page;

shp = *(struct shmid_kernel **) shmd->vm_private_data;
idx = (address - shmd->vm_start + shmd->vm_offset) >> PAGE_SHIFT;

spin_lock(&shm_lock);
again:
pte = shp->shm_pages[idx]; // 共享内存的页表项
if (!pte_present(pte)) { // 如果内存页不存在
if (pte_none(pte)) {
spin_unlock(&shm_lock);
page = get_free_highpage(GFP_HIGHUSER); // 申请一个新的物理内存页
if (!page)
goto oom;
clear_highpage(page);
spin_lock(&shm_lock);
if (pte_val(pte) != pte_val(shp->shm_pages[idx]))
goto changed;
} else {
...
}
shm_rss++;
pte = pte_mkdirty(mk_pte(page, PAGE_SHARED)); // 创建页表项
shp->shm_pages[idx] = pte; // 保存共享内存的页表项
} else
--current->maj_flt; /* was incremented in do_no_page */

done:
get_page(pte_page(pte));
spin_unlock(&shm_lock);
current->min_flt++;
return pte_page(pte);
...
}

shm_nopage() 函数的主要功能是当发生内存缺页时，申请新的物理内存页，并映射到共享内存中。由于使用共享内存时会映射到相同的物理内存页上，从而不同进程可以共用此块内存。

逆锋起笔是一个专注于程序员圈子的技术平台，你可以收获最新技术动态、最新内测资格、BAT等大厂的经验、精品学习资料、职业路线、副业思维，微信搜索逆锋起笔关注！

声明：本文部分素材转载自互联网，如有侵权立即删除 。

--END--

往日精彩：