--- name: "memfd_create" section: "3" platform: "freebsd" package: "base" version: "16.0-CURRENT-20261027-61c70dc16a79" release: "FreeBSD 16.0-CURRENT (2026-10-27)" platforms: ["freebsd"] url: "https://new.carta.tech/shm_open" --- # memfd\_create(3) shared memory object operations Part of [shm\_open(2)](/shm_open/2.md). ## NAME **memfd\_create**, **shm\_create\_largepage**, **shm\_open**, **shm\_rename,** **shm\_unlink** – shared memory object operations ## LIBRARY Standard C Library (libc, -lc) ## SYNOPSIS **#include \** **#include \** **#include \** *int*\ **memfd\_create**(*const char \*name*, *unsigned int flags*); *int*\ **shm\_create\_largepage**(*const char \*path*, *int flags*, *int psind*, *int alloc\_policy*, *mode\_t mode*); *int*\ **shm\_open**(*const char \*path*, *int flags*, *mode\_t mode*); *int*\ **shm\_rename**(*const char \*path\_from*, *const char \*path\_to*, *int flags*); *int*\ **shm\_unlink**(*const char \*path*); ## DESCRIPTION The **shm\_open**() function opens (or optionally creates) a POSIX shared memory object named *path*. The *flags* argument contains a subset of the flags used by [open(2)](/open/2.md). An access mode of either O\_RDONLY or O\_RDWR must be included in *flags*. The optional flags O\_CREAT, O\_EXCL, O\_TRUNC, and O\_CLOFORK may also be specified. If O\_CREAT is specified, then a new shared memory object named *path* will be created if it does not exist. In this case, the shared memory object is created with mode *mode* subject to the process' umask value. If both the O\_CREAT and O\_EXCL flags are specified and a shared memory object named *path* already exists, then **shm\_open**() will fail with EEXIST. Newly created objects start off with a size of zero. If an existing shared memory object is opened with O\_RDWR and the O\_TRUNC flag is specified, then the shared memory object will be truncated to a size of zero. The size of the object can be adjusted via [ftruncate(2)](/ftruncate/2.md) and queried via [fstat(2)](/fstat/2.md). The new descriptor is set to close during [execve(2)](/execve/2.md) system calls; see [close(2)](/close/2.md) and [fcntl(2)](/fcntl/2.md). The constant SHM\_ANON may be used for the *path* argument to **shm\_open**(). In this case, an anonymous, unnamed shared memory object is created. Since the object has no name, it cannot be removed via a subsequent call to **shm\_unlink**(), or moved with a call to **shm\_rename**(). Instead, the shared memory object will be garbage collected when the last reference to the shared memory object is removed. The shared memory object may be shared with other processes by sharing the file descriptor via [fork(2)](/fork/2.md) or [sendmsg(2)](/sendmsg/2.md). Attempting to open an anonymous shared memory object with O\_RDONLY will fail with EINVAL. All other flags are ignored. The **shm\_create\_largepage**() function behaves similarly to **shm\_open**(), except that the O\_CREAT flag is implicitly specified, and the returned “largepage” object is always backed by aligned, physically contiguous chunks of memory. This ensures that the object can be mapped using so-called “superpages”, which can improve application performance in some workloads by reducing the number of translation lookaside buffer (TLB) entries required to access a mapping of the object, and by reducing the number of page faults performed when accessing a mapping. This happens automatically for all largepage objects. An existing largepage object can be opened using the **shm\_open**() function. Largepage shared memory objects behave slightly differently from non-largepage objects: - Memory for a largepage object is allocated when the object is extended using the [ftruncate(2)](/ftruncate/2.md) system call, whereas memory for regular shared memory objects is allocated lazily and may be paged out to a swap device when not in use. - The size of a mapping of a largepage object must be a multiple of the underlying large page size. Most attributes of such a mapping can only be modified at the granularity of the large page size. For example, when using [munmap(2)](/munmap/2.md) to unmap a portion of a largepage object mapping, or when using [mprotect(2)](/mprotect/2.md) to adjust protections of a mapping of a largepage object, the starting address must be large page size-aligned, and the length of the operation must be a multiple of the large page size. If not, the corresponding system call will fail and set *errno* to EINVAL. The *psind* argument to **shm\_create\_largepage**() specifies the size of large pages used to back the object. This argument is an index into the page sizes array returned by [getpagesizes(3)](/getpagesizes/3.md). In particular, all large pages backing a largepage object must be of the same size. For example, on a system with large page sizes of 2MB and 1GB, a 2GB largepage object will consist of either 1024 2MB pages, or 2 1GB pages, depending on the value specified for the *psind* argument. The *alloc\_policy* parameter specifies what happens when an attempt to use [ftruncate(2)](/ftruncate/2.md) to allocate memory for the object fails. The following values are accepted: - SHM\_LARGEPAGE\_ALLOC\_DEFAULT If the (non-blocking) memory allocation fails because there is insufficient free contiguous memory, the kernel will attempt to defragment physical memory and try another allocation. The subsequent allocation may or may not succeed. If this subsequent allocation also fails, [ftruncate(2)](/ftruncate/2.md) will fail and set *errno* to ENOMEM. - SHM\_LARGEPAGE\_ALLOC\_NOWAIT If the memory allocation fails, [ftruncate(2)](/ftruncate/2.md) will fail and set *errno* to ENOMEM. - SHM\_LARGEPAGE\_ALLOC\_HARD The kernel will attempt defragmentation until the allocation succeeds, or an unblocked signal is delivered to the thread. However, it is possible for physical memory to be fragmented such that the allocation will never succeed. The FIOSSHMLPGCNF and FIOGSHMLPGCNF [ioctl(2)](/ioctl/2.md) commands can be used with a largepage shared memory object to get and set largepage object parameters. Both commands operate on the following structure: ``` struct shm_largepage_conf { int psind; int alloc_policy; }; ``` The FIOGSHMLPGCNF command populates this structure with the current values of these parameters, while the FIOSSHMLPGCNF command modifies the largepage object. Currently only the *alloc\_policy* parameter may be modified. Internally, **shm\_create\_largepage**() works by creating a regular shared memory object using **shm\_open**(), and then converting it into a largepage object using the FIOSSHMLPGCNF ioctl command. The **shm\_rename**() system call atomically removes a shared memory object named *path\_from* and relinks it at *path\_to*. If another object is already linked at *path\_to*, that object will be unlinked, unless one of the following flags are provided: - SHM\_RENAME\_EXCHANGE Atomically exchange the shms at *path\_from* and *path\_to*. - SHM\_RENAME\_NOREPLACE Return an error if an shm exists at *path\_to*, rather than unlinking it. The **shm\_unlink**() system call removes a shared memory object named *path*. The **memfd\_create**() function creates an anonymous shared memory object, identical to that created by **shm\_open**() when SHM\_ANON is specified. Newly created objects start off with a size of zero. The size of the new object must be adjusted via [ftruncate(2)](/ftruncate/2.md). The *name* argument must not be NULL, but it may be an empty string. The length of the *name* argument may not exceed NAME\_MAX minus six characters for the prefix “memfd:”, which will be prepended. The *name* argument is intended solely for debugging purposes and will never be used by the kernel to identify a memfd. Names are therefore not required to be unique. The following *flags* may be specified to **memfd\_create**(): - MFD\_CLOEXEC Set FD\_CLOEXEC on the resulting file descriptor. - MFD\_ALLOW\_SEALING Allow adding seals to the resulting file descriptor using the F\_ADD\_SEALS [fcntl(2)](/fcntl/2.md) command. - MFD\_HUGETLB Create a memfd backed by a “largepage” object. One of the MFD\_HUGE\_\* flags defined in ⟨sys/mman.h⟩ may be included to specify a fixed size. If a specific size is not requested, the smallest supported large page size is selected. The behavior documented above for the **shm\_create\_largepage**() *psind* argument also applies to largepage objects created by **memfd\_create**(), and the SHM\_LARGEPAGE\_ALLOC\_DEFAULT policy will always be used. ## RETURN VALUES If successful, **memfd\_create**() and **shm\_open**() both return a non-negative integer, and **shm\_rename**() and **shm\_unlink**() return zero. All functions return -1 on failure, and set *errno* to indicate the error. ## COMPATIBILITY The **shm\_create\_largepage**() and **shm\_rename**() functions are FreeBSD extensions, as is support for the SHM\_ANON value in **shm\_open**(). The *path*, *path\_from*, and *path\_to* arguments do not necessarily represent a pathname (although they do in most other implementations). Two processes opening the same *path* are guaranteed to access the same shared memory object if and only if *path* begins with a slash (‘/’) character. Only the O\_RDONLY, O\_RDWR, O\_CREAT, O\_EXCL, and O\_TRUNC flags may be used in portable programs. POSIX specifications state that the result of using [open(2)](/open/2.md), [read(2)](/read/2.md), or [write(2)](/write/2.md) on a shared memory object, or on the descriptor returned by **shm\_open**(), is undefined. However, the FreeBSD kernel implementation explicitly includes support for [read(2)](/read/2.md) and [write(2)](/write/2.md). FreeBSD also supports zero-copy transmission of data from shared memory objects with [sendfile(2)](/sendfile/2.md). Neither shared memory objects nor their contents persist across reboots. Writes do not extend shared memory objects, so [ftruncate(2)](/ftruncate/2.md) must be called before any data can be written. See EXAMPLES. ## EXAMPLES This example fails without the call to [ftruncate(2)](/ftruncate/2.md): ``` uint8_t buffer[getpagesize()]; ssize_t len; int fd; fd = shm_open(SHM_ANON, O_RDWR | O_CREAT, 0600); if (fd < 0) err(EX_OSERR, "%s: shm_open", __func__); if (ftruncate(fd, getpagesize()) < 0) err(EX_IOERR, "%s: ftruncate", __func__); len = pwrite(fd, buffer, getpagesize(), 0); if (len < 0) err(EX_IOERR, "%s: pwrite", __func__); if (len != getpagesize()) errx(EX_IOERR, "%s: pwrite length mismatch", __func__); ``` ## ERRORS **memfd\_create**() fails with these error codes for these conditions: - \[EBADF\] The *name* argument was NULL. - \[EINVAL\] The *name* argument was too long. An invalid or unsupported flag was included in *flags*. - \[EINVAL\] A hugetlb mapping was requested, but MFD\_HUGETLB was not specified in *flags*. - \[EMFILE\] The process has already reached its limit for open file descriptors. - \[ENFILE\] The system file table is full. - \[ENOSYS\] MFD\_HUGETLB was specified in *flags*, and this system does not support forced hugetlb mappings. - \[EOPNOTSUPP\] This system does not support the requested hugetlb page size. **shm\_open**() fails with these error codes for these conditions: - \[EINVAL\] A flag other than O\_RDONLY, O\_RDWR, O\_CREAT, O\_EXCL, or O\_TRUNC was included in *flags*. - \[EMFILE\] The process has already reached its limit for open file descriptors. - \[ENFILE\] The system file table is full. - \[EINVAL\] O\_RDONLY was specified while creating an anonymous shared memory object via SHM\_ANON. - \[EFAULT\] The *path* argument points outside the process' allocated address space. - \[ENAMETOOLONG\] The entire pathname exceeds 1023 characters. - \[EINVAL\] The *path* does not begin with a slash (‘/’) character. - \[ENOENT\] O\_CREAT is not specified and the named shared memory object does not exist. - \[EEXIST\] O\_CREAT and O\_EXCL are specified and the named shared memory object does exist. - \[EACCES\] The required permissions (for reading or reading and writing) are denied. - \[ECAPMODE\] The process is running in capability mode (see [capsicum(4)](/capsicum/4.md)) and attempted to create a named shared memory object. **shm\_create\_largepage**() can fail for the reasons listed above. It also fails with these error codes for the following conditions: - \[ENOTTY\] The kernel does not support large pages on the current platform. The following errors are defined for **shm\_rename**(): - \[EFAULT\] The *path\_from* or *path\_to* argument points outside the process' allocated address space. - \[ENAMETOOLONG\] The entire pathname exceeds 1023 characters. - \[ENOENT\] The shared memory object at *path\_from* does not exist. - \[EACCES\] The required permissions are denied. - \[EEXIST\] An shm exists at *path\_to*, and the SHM\_RENAME\_NOREPLACE flag was provided. **shm\_unlink**() fails with these error codes for these conditions: - \[EFAULT\] The *path* argument points outside the process' allocated address space. - \[ENAMETOOLONG\] The entire pathname exceeds 1023 characters. - \[ENOENT\] The named shared memory object does not exist. - \[EACCES\] The required permissions are denied. **shm\_unlink**() requires write permission to the shared memory object. ## SEE ALSO [posixshmcontrol(1)](/posixshmcontrol/1.md), [close(2)](/close/2.md), [fstat(2)](/fstat/2.md), [ftruncate(2)](/ftruncate/2.md), [ioctl(2)](/ioctl/2.md), [mmap(2)](/mmap/2.md), [munmap(2)](/munmap/2.md), [sendfile(2)](/sendfile/2.md) ## STANDARDS The **memfd\_create**() function is expected to be compatible with the Linux system call of the same name. The **shm\_open**() and **shm\_unlink**() functions are believed to conform to IEEE Std 1003.1b-1993 (“POSIX.1b”). ## HISTORY The **memfd\_create**() function appeared in FreeBSD 13.0. The **shm\_open**() and **shm\_unlink**() functions first appeared in FreeBSD 4.3. The functions were reimplemented as system calls using shared memory objects directly rather than files in FreeBSD 8.0. **shm\_rename**() first appeared in FreeBSD 13.0 as a FreeBSD extension. ## AUTHORS Garrett A. Wollman ⟨*wollman@FreeBSD.org*⟩ (C library support and this manual page) Matthew Dillon ⟨*dillon@FreeBSD.org*⟩ (MAP\_NOSYNC) Matthew Bryan ⟨*matthew.bryan@isilon.com*⟩ (shm\_rename implementation)