PREV_LEC | NEXT_LEC

What You Will Learn

Prerequisites

Why Not Just Use a Pipe or a File?

Pipes and regular files both work for passing data between processes, but they go through the kernel’s read/write path on every access — data gets copied from user space into a kernel buffer and back out again. For something that changes constantly, like a sensor reading updated hundreds of times a second, or a video frame buffer being written by one process and displayed by another, that copying overhead adds up fast.

Shared memory removes the copy entirely. Once two processes have mapped the same segment, writing to it in one process is instantly visible to a read in the other — there’s no read()/write() call at all, just ordinary pointer access. The trade-off is that the kernel is no longer serializing access for you the way it does with a pipe, so the processes have to coordinate access themselves. That’s the semaphore’s job.

Creating and Mapping a Shared Segment

On modern Linux, POSIX shared memory objects are exposed through a tmpfs filesystem, conventionally mounted at /dev/shm. Under the hood, shm_open() is just a thin wrapper that creates or opens a file in that filesystem — that’s genuinely all a “shared memory object” is on Linux. The sequence to set one up is:

1. Call shm_open() with a name starting with a slash, e.g. "/ep-msg", to get a file descriptor.
2. Call ftruncate() on that descriptor to size the segment — a freshly created object is zero bytes long.
3. Call mmap() on the descriptor to get a pointer your process can actually read and write.

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <unistd.h>
#include <semaphore.h>
#include <errno.h>

#define EP_SHM_NAME  "/ep-msg"
#define EP_SEM_NAME  "/ep-msg-sem"
#define EP_SHM_SIZE  256

struct ep_shared_msg {
    unsigned int counter;
    char         text[240];
};

static struct ep_shared_msg *ep_map_shared_segment(int *out_fd, sem_t **out_sem)
{
    int created = 1;
    int fd = shm_open(EP_SHM_NAME, O_CREAT | O_EXCL | O_RDWR, 0666);

    if (fd == -1 && errno == EEXIST) {
        created = 0;
        fd = shm_open(EP_SHM_NAME, O_RDWR, 0666);
    }
    if (fd == -1) {
        perror("shm_open");
        exit(EXIT_FAILURE);
    }

    if (created && ftruncate(fd, EP_SHM_SIZE) == -1) {
        perror("ftruncate");
        exit(EXIT_FAILURE);
    }

    struct ep_shared_msg *msg = mmap(NULL, EP_SHM_SIZE,
                                      PROT_READ | PROT_WRITE,
                                      MAP_SHARED, fd, 0);
    if (msg == MAP_FAILED) {
        perror("mmap");
        exit(EXIT_FAILURE);
    }

    sem_t *sem = sem_open(EP_SEM_NAME, O_CREAT, 0666, 1);
    if (sem == SEM_FAILED) {
        perror("sem_open");
        exit(EXIT_FAILURE);
    }

    *out_fd  = fd;
    *out_sem = sem;
    return msg;
}

Two small but important differences from an older-style implementation worth calling out: mmap() failure is checked against MAP_FAILED, not NULL — on Linux, NULL is technically a valid (if unusual) mapping address, and comparing against it is a latent bug. Second, ftruncate() is only called by whichever process actually created the segment; calling it again on an already-sized segment from a second process is harmless here but unnecessary, and in general re-truncating a live segment zero-fills it and would blow away real data.

The Race Condition — and the Fix

If process A writes msg->counter and msg->text as two separate field assignments, and process B happens to read the struct in between those two assignments, B sees a half-updated, inconsistent message. This isn’t a hypothetical — with two independent processes running on a multi-core machine, it happens routinely. The fix is a POSIX named semaphore: a counting lock that lives outside either process (also backed by a tmpfs-style object) so unrelated processes can share it by name, exactly like the shared memory segment itself.

static void ep_write_message(struct ep_shared_msg *msg, sem_t *sem, const char *text)
{
    sem_wait(sem);
    msg->counter++;
    snprintf(msg->text, sizeof(msg->text), "%s", text);
    sem_post(sem);
}

static void ep_read_message(struct ep_shared_msg *msg, sem_t *sem)
{
    sem_wait(sem);
    printf("counter=%u text=\"%s\"\n", msg->counter, msg->text);
    sem_post(sem);
}

Both the read and the write take the same semaphore before touching the struct, so the two field updates in ep_write_message() are now atomic from the reader’s point of view — ep_read_message() can never observe a half-written message.

Building and Running the Demo

Compile the writer and a matching reader (same struct, same names, just calling ep_read_message() in a loop instead) and link with -lrt -pthread — -lrt pulls in the shared-memory and semaphore symbols on older glibc; on current glibc (2.34+) these symbols live directly in libc, but keeping the flag is harmless and keeps the build portable to older systems.

$ gcc -O2 -Wall -o ep_shm_writer ep_shm_writer.c -lrt -pthread
$ gcc -O2 -Wall -o ep_shm_reader ep_shm_reader.c -lrt -pthread

# terminal 1
$ ./ep_shm_writer "hello from writer"
counter=1 text="hello from writer"

# terminal 2, run afterwards
$ ./ep_shm_reader
counter=1 text="hello from writer"

# confirm the backing object exists as an ordinary tmpfs file
$ ls -la /dev/shm/
-rw-r--r-- 1 ravi ravi 256 Aug 26 10:02 ep-msg

That last command is worth running yourself — it makes concrete that a POSIX shared memory object really is just a file in a RAM-backed filesystem, sized exactly as your ftruncate() call requested.

Common Mistakes and Troubleshooting

Best Practices

• Keep the critical section (time spent between sem_wait/sem_post) as short as possible
• Prefer O_EXCL when one specific process should own creation, falling back to attach-only otherwise
• Always unlink named objects during orderly shutdown
• Never assume a shared struct’s exact byte layout across compilers without control over alignment

Summary

POSIX shared memory gives unrelated processes a way to exchange data without a copy through the kernel, by mapping the same tmpfs-backed pages into each process’s address space with shm_open(), ftruncate(), and mmap(). Because the kernel no longer serializes access for you once memory is shared, a named POSIX semaphore — created with sem_open() and used via sem_wait()/sem_post() — is the standard way to protect the shared data from concurrent, torn writes.

FAQ

PREV_LEC | NEXT_LEC