blob: b6a07a26b10d58ca2e0b24bcaa0739159033dbb0 [file] [log] [blame]
Mike Rapoporta5e4da92018-03-21 21:22:42 +02001==============================
2Unevictable LRU Infrastructure
3==============================
Lee Schermerhornfa07e782008-10-18 20:26:47 -07004
Mike Rapoporta5e4da92018-03-21 21:22:42 +02005.. contents:: :local:
David Howellsc24b7202009-04-13 14:40:01 -07006
7
Mike Rapoporta5e4da92018-03-21 21:22:42 +02008Introduction
David Howellsc24b7202009-04-13 14:40:01 -07009============
10
11This document describes the Linux memory manager's "Unevictable LRU"
12infrastructure and the use of this to manage several types of "unevictable"
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +000013folios.
David Howellsc24b7202009-04-13 14:40:01 -070014
15The document attempts to provide the overall rationale behind this mechanism
16and the rationale for some of the design decisions that drove the
17implementation. The latter design rationale is discussed in the context of an
18implementation description. Admittedly, one can obtain the implementation
19details - the "what does it do?" - by reading the code. One hopes that the
20descriptions below add value by provide the answer to "why does it do that?".
21
22
Mike Rapoporta5e4da92018-03-21 21:22:42 +020023
24The Unevictable LRU
David Howellsc24b7202009-04-13 14:40:01 -070025===================
26
27The Unevictable LRU facility adds an additional LRU list to track unevictable
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +000028folios and to hide these folios from vmscan. This mechanism is based on a patch
29by Larry Woodman of Red Hat to address several scalability problems with folio
Lee Schermerhornfa07e782008-10-18 20:26:47 -070030reclaim in Linux. The problems have been observed at customer sites on large
David Howellsc24b7202009-04-13 14:40:01 -070031memory x86_64 systems.
Lee Schermerhornfa07e782008-10-18 20:26:47 -070032
David Howellsc24b7202009-04-13 14:40:01 -070033To illustrate this with an example, a non-NUMA x86_64 platform with 128GB of
Hugh Dickins15b44732020-12-15 14:21:31 -080034main memory will have over 32 million 4k pages in a single node. When a large
David Howellsc24b7202009-04-13 14:40:01 -070035fraction of these pages are not evictable for any reason [see below], vmscan
36will spend a lot of time scanning the LRU lists looking for the small fraction
37of pages that are evictable. This can result in a situation where all CPUs are
38spending 100% of their time in vmscan for hours or days on end, with the system
39completely unresponsive.
Lee Schermerhornfa07e782008-10-18 20:26:47 -070040
David Howellsc24b7202009-04-13 14:40:01 -070041The unevictable list addresses the following classes of unevictable pages:
Lee Schermerhornfa07e782008-10-18 20:26:47 -070042
Mike Rapoporta5e4da92018-03-21 21:22:42 +020043 * Those owned by ramfs.
David Howellsc24b7202009-04-13 14:40:01 -070044
Luis Chamberlain2c6efe92023-03-09 15:05:45 -080045 * Those owned by tmpfs with the noswap mount option.
46
Mike Rapoporta5e4da92018-03-21 21:22:42 +020047 * Those mapped into SHM_LOCK'd shared memory regions.
David Howellsc24b7202009-04-13 14:40:01 -070048
Mike Rapoporta5e4da92018-03-21 21:22:42 +020049 * Those mapped into VM_LOCKED [mlock()ed] VMAs.
David Howellsc24b7202009-04-13 14:40:01 -070050
51The infrastructure may also be able to handle other conditions that make pages
Lee Schermerhornfa07e782008-10-18 20:26:47 -070052unevictable, either by definition or by circumstance, in the future.
53
54
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +000055The Unevictable LRU Folio List
56------------------------------
Hugh Dickins577e9842022-04-01 11:28:30 -070057
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +000058The Unevictable LRU folio list is a lie. It was never an LRU-ordered
59list, but a companion to the LRU-ordered anonymous and file, active and
60inactive folio lists; and now it is not even a folio list. But following
61familiar convention, here in this document and in the source, we often
62imagine it as a fifth LRU folio list.
Lee Schermerhornfa07e782008-10-18 20:26:47 -070063
Hugh Dickins15b44732020-12-15 14:21:31 -080064The Unevictable LRU infrastructure consists of an additional, per-node, LRU list
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +000065called the "unevictable" list and an associated folio flag, PG_unevictable, to
66indicate that the folio is being managed on the unevictable list.
David Howellsc24b7202009-04-13 14:40:01 -070067
68The PG_unevictable flag is analogous to, and mutually exclusive with, the
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +000069PG_active flag in that it indicates on which LRU list a folio resides when
Michal Hockoe6e8dd502011-03-16 15:01:37 +010070PG_lru is set.
Lee Schermerhornfa07e782008-10-18 20:26:47 -070071
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +000072The Unevictable LRU infrastructure maintains unevictable folios as if they were
Hugh Dickins577e9842022-04-01 11:28:30 -070073on an additional LRU list for a few reasons:
Lee Schermerhornfa07e782008-10-18 20:26:47 -070074
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +000075 (1) We get to "treat unevictable folios just like we treat other folios in the
David Howellsc24b7202009-04-13 14:40:01 -070076 system - which means we get to use the same code to manipulate them, the
77 same code to isolate them (for migrate, etc.), the same code to keep track
78 of the statistics, etc..." [Rik van Riel]
Lee Schermerhornfa07e782008-10-18 20:26:47 -070079
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +000080 (2) We want to be able to migrate unevictable folios between nodes for memory
Hugh Dickins577e9842022-04-01 11:28:30 -070081 defragmentation, workload management and memory hotplug. The Linux kernel
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +000082 can only migrate folios that it can successfully isolate from the LRU
Hugh Dickins577e9842022-04-01 11:28:30 -070083 lists (or "Movable" pages: outside of consideration here). If we were to
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +000084 maintain folios elsewhere than on an LRU-like list, where they can be
85 detected by folio_isolate_lru(), we would prevent their migration.
Lee Schermerhornfa07e782008-10-18 20:26:47 -070086
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +000087The unevictable list does not differentiate between file-backed and
88anonymous, swap-backed folios. This differentiation is only important
89while the folios are, in fact, evictable.
Lee Schermerhornfa07e782008-10-18 20:26:47 -070090
Hugh Dickins15b44732020-12-15 14:21:31 -080091The unevictable list benefits from the "arrayification" of the per-node LRU
David Howellsc24b7202009-04-13 14:40:01 -070092lists and statistics originally proposed and posted by Christoph Lameter.
Lee Schermerhornfa07e782008-10-18 20:26:47 -070093
Lee Schermerhornfa07e782008-10-18 20:26:47 -070094
Mike Rapoporta5e4da92018-03-21 21:22:42 +020095Memory Control Group Interaction
David Howellsc24b7202009-04-13 14:40:01 -070096--------------------------------
Lee Schermerhornfa07e782008-10-18 20:26:47 -070097
David Howellsc24b7202009-04-13 14:40:01 -070098The unevictable LRU facility interacts with the memory control group [aka
Hugh Dickins577e9842022-04-01 11:28:30 -070099memory controller; see Documentation/admin-guide/cgroup-v1/memory.rst] by
100extending the lru_list enum.
David Howellsc24b7202009-04-13 14:40:01 -0700101
Hugh Dickins15b44732020-12-15 14:21:31 -0800102The memory controller data structure automatically gets a per-node unevictable
103list as a result of the "arrayification" of the per-node LRU lists (one per
David Howellsc24b7202009-04-13 14:40:01 -0700104lru_list enum element). The memory controller tracks the movement of pages to
105and from the unevictable list.
106
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700107When a memory control group comes under memory pressure, the controller will
108not attempt to reclaim pages on the unevictable list. This has a couple of
David Howellsc24b7202009-04-13 14:40:01 -0700109effects:
110
111 (1) Because the pages are "hidden" from reclaim on the unevictable list, the
112 reclaim process can be more efficient, dealing only with pages that have a
113 chance of being reclaimed.
114
115 (2) On the other hand, if too many of the pages charged to the control group
116 are unevictable, the evictable portion of the working set of the tasks in
117 the control group may not fit into the available memory. This can cause
118 the control group to thrash or to OOM-kill tasks.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700119
120
Mike Rapoporta5e4da92018-03-21 21:22:42 +0200121.. _mark_addr_space_unevict:
122
123Marking Address Spaces Unevictable
David Howellsc24b7202009-04-13 14:40:01 -0700124----------------------------------
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700125
David Howellsc24b7202009-04-13 14:40:01 -0700126For facilities such as ramfs none of the pages attached to the address space
127may be evicted. To prevent eviction of any such pages, the AS_UNEVICTABLE
128address space flag is provided, and this can be manipulated by a filesystem
129using a number of wrapper functions:
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700130
Mike Rapoporta5e4da92018-03-21 21:22:42 +0200131 * ``void mapping_set_unevictable(struct address_space *mapping);``
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700132
David Howellsc24b7202009-04-13 14:40:01 -0700133 Mark the address space as being completely unevictable.
134
Mike Rapoporta5e4da92018-03-21 21:22:42 +0200135 * ``void mapping_clear_unevictable(struct address_space *mapping);``
David Howellsc24b7202009-04-13 14:40:01 -0700136
137 Mark the address space as being evictable.
138
Mike Rapoporta5e4da92018-03-21 21:22:42 +0200139 * ``int mapping_unevictable(struct address_space *mapping);``
David Howellsc24b7202009-04-13 14:40:01 -0700140
141 Query the address space, and return true if it is completely
142 unevictable.
143
Kuo-Hsin Yang64e3d122018-11-06 13:23:24 +0000144These are currently used in three places in the kernel:
David Howellsc24b7202009-04-13 14:40:01 -0700145
146 (1) By ramfs to mark the address spaces of its inodes when they are created,
147 and this mark remains for the life of the inode.
148
149 (2) By SYSV SHM to mark SHM_LOCK'd address spaces until SHM_UNLOCK is called.
David Howellsc24b7202009-04-13 14:40:01 -0700150 Note that SHM_LOCK is not required to page in the locked pages if they're
151 swapped out; the application must touch the pages manually if it wants to
152 ensure they're in memory.
153
Kuo-Hsin Yang64e3d122018-11-06 13:23:24 +0000154 (3) By the i915 driver to mark pinned address space until it's unpinned. The
155 amount of unevictable memory marked by i915 driver is roughly the bounded
156 object size in debugfs/dri/0/i915_gem_objects.
157
David Howellsc24b7202009-04-13 14:40:01 -0700158
Mike Rapoporta5e4da92018-03-21 21:22:42 +0200159Detecting Unevictable Pages
David Howellsc24b7202009-04-13 14:40:01 -0700160---------------------------
161
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +0000162The function folio_evictable() in mm/internal.h determines whether a folio is
Mike Rapoporta5e4da92018-03-21 21:22:42 +0200163evictable or not using the query function outlined above [see section
164:ref:`Marking address spaces unevictable <mark_addr_space_unevict>`]
165to check the AS_UNEVICTABLE flag.
David Howellsc24b7202009-04-13 14:40:01 -0700166
167For address spaces that are so marked after being populated (as SHM regions
Hugh Dickins577e9842022-04-01 11:28:30 -0700168might be), the lock action (e.g. SHM_LOCK) can be lazy, and need not populate
David Howellsc24b7202009-04-13 14:40:01 -0700169the page tables for the region as does, for example, mlock(), nor need it make
170any special effort to push any pages in the SHM_LOCK'd area to the unevictable
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +0000171list. Instead, vmscan will do this if and when it encounters the folios during
David Howellsc24b7202009-04-13 14:40:01 -0700172a reclamation scan.
173
Hugh Dickins577e9842022-04-01 11:28:30 -0700174On an unlock action (such as SHM_UNLOCK), the unlocker (e.g. shmctl()) must scan
David Howellsc24b7202009-04-13 14:40:01 -0700175the pages in the region and "rescue" them from the unevictable list if no other
176condition is keeping them unevictable. If an unevictable region is destroyed,
177the pages are also "rescued" from the unevictable list in the process of
178freeing them.
179
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +0000180folio_evictable() also checks for mlocked folios by calling
181folio_test_mlocked(), which is set when a folio is faulted into a
182VM_LOCKED VMA, or found in a VMA being VM_LOCKED.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700183
184
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +0000185Vmscan's Handling of Unevictable Folios
186---------------------------------------
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700187
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +0000188If unevictable folios are culled in the fault path, or moved to the unevictable
189list at mlock() or mmap() time, vmscan will not encounter the folios until they
David Howellsc24b7202009-04-13 14:40:01 -0700190have become evictable again (via munlock() for example) and have been "rescued"
191from the unevictable list. However, there may be situations where we decide,
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +0000192for the sake of expediency, to leave an unevictable folio on one of the regular
David Howellsc24b7202009-04-13 14:40:01 -0700193active/inactive LRU lists for vmscan to deal with. vmscan checks for such
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +0000194folios in all of the shrink_{active|inactive|page}_list() functions and will
195"cull" such folios that it encounters: that is, it diverts those folios to the
Hugh Dickins577e9842022-04-01 11:28:30 -0700196unevictable list for the memory cgroup and node being scanned.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700197
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +0000198There may be situations where a folio is mapped into a VM_LOCKED VMA,
199but the folio does not have the mlocked flag set. Such folios will make
200it all the way to shrink_active_list() or shrink_page_list() where they
201will be detected when vmscan walks the reverse map in folio_referenced()
202or try_to_unmap(). The folio is culled to the unevictable list when it
203is released by the shrinker.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700204
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +0000205To "cull" an unevictable folio, vmscan simply puts the folio back on
206the LRU list using folio_putback_lru() - the inverse operation to
207folio_isolate_lru() - after dropping the folio lock. Because the
208condition which makes the folio unevictable may change once the folio
209is unlocked, __pagevec_lru_add_fn() will recheck the unevictable state
210of a folio before placing it on the unevictable list.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700211
212
Mike Rapoporta5e4da92018-03-21 21:22:42 +0200213MLOCKED Pages
David Howellsc24b7202009-04-13 14:40:01 -0700214=============
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700215
Matthew Wilcox (Oracle)90c9d132023-01-16 19:28:24 +0000216The unevictable folio list is also useful for mlock(), in addition to ramfs and
David Howellsc24b7202009-04-13 14:40:01 -0700217SYSV SHM. Note that mlock() is only available in CONFIG_MMU=y situations; in
218NOMMU situations, all mappings are effectively mlocked.
219
220
Mike Rapoporta5e4da92018-03-21 21:22:42 +0200221History
David Howellsc24b7202009-04-13 14:40:01 -0700222-------
223
224The "Unevictable mlocked Pages" infrastructure is based on work originally
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700225posted by Nick Piggin in an RFC patch entitled "mm: mlocked pages off LRU".
David Howellsc24b7202009-04-13 14:40:01 -0700226Nick posted his patch as an alternative to a patch posted by Christoph Lameter
227to achieve the same objective: hiding mlocked pages from vmscan.
228
229In Nick's patch, he used one of the struct page LRU list link fields as a count
Hugh Dickins577e9842022-04-01 11:28:30 -0700230of VM_LOCKED VMAs that map the page (Rik van Riel had the same idea three years
231earlier). But this use of the link field for a count prevented the management
232of the pages on an LRU list, and thus mlocked pages were not migratable as
233isolate_lru_page() could not detect them, and the LRU list link field was not
234available to the migration subsystem.
David Howellsc24b7202009-04-13 14:40:01 -0700235
Hugh Dickins577e9842022-04-01 11:28:30 -0700236Nick resolved this by putting mlocked pages back on the LRU list before
David Howellsc24b7202009-04-13 14:40:01 -0700237attempting to isolate them, thus abandoning the count of VM_LOCKED VMAs. When
238Nick's patch was integrated with the Unevictable LRU work, the count was
Hugh Dickins577e9842022-04-01 11:28:30 -0700239replaced by walking the reverse map when munlocking, to determine whether any
240other VM_LOCKED VMAs still mapped the page.
241
242However, walking the reverse map for each page when munlocking was ugly and
243inefficient, and could lead to catastrophic contention on a file's rmap lock,
244when many processes which had it mlocked were trying to exit. In 5.18, the
245idea of keeping mlock_count in Unevictable LRU list link field was revived and
246put to work, without preventing the migration of mlocked pages. This is why
247the "Unevictable LRU list" cannot be a linked list of pages now; but there was
248no use for that linked list anyway - though its size is maintained for meminfo.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700249
250
Mike Rapoporta5e4da92018-03-21 21:22:42 +0200251Basic Management
David Howellsc24b7202009-04-13 14:40:01 -0700252----------------
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700253
David Howellsc24b7202009-04-13 14:40:01 -0700254mlocked pages - pages mapped into a VM_LOCKED VMA - are a class of unevictable
255pages. When such a page has been "noticed" by the memory management subsystem,
256the page is marked with the PG_mlocked flag. This can be manipulated using the
257PageMlocked() functions.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700258
David Howellsc24b7202009-04-13 14:40:01 -0700259A PG_mlocked page will be placed on the unevictable list when it is added to
260the LRU. Such pages can be "noticed" by memory management in several places:
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700261
Hugh Dickins577e9842022-04-01 11:28:30 -0700262 (1) in the mlock()/mlock2()/mlockall() system call handlers;
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700263
David Howellsc24b7202009-04-13 14:40:01 -0700264 (2) in the mmap() system call handler when mmapping a region with the
265 MAP_LOCKED flag;
266
267 (3) mmapping a region in a task that has called mlockall() with the MCL_FUTURE
Hugh Dickins577e9842022-04-01 11:28:30 -0700268 flag;
David Howellsc24b7202009-04-13 14:40:01 -0700269
Hugh Dickins577e9842022-04-01 11:28:30 -0700270 (4) in the fault path and when a VM_LOCKED stack segment is expanded; or
David Howellsc24b7202009-04-13 14:40:01 -0700271
272 (5) as mentioned above, in vmscan:shrink_page_list() when attempting to
Vernon Yang9a7d7a82022-09-26 23:20:32 +0800273 reclaim a page in a VM_LOCKED VMA by folio_referenced() or try_to_unmap().
David Howellsc24b7202009-04-13 14:40:01 -0700274
275mlocked pages become unlocked and rescued from the unevictable list when:
276
277 (1) mapped in a range unlocked via the munlock()/munlockall() system calls;
278
279 (2) munmap()'d out of the last VM_LOCKED VMA that maps the page, including
280 unmapping at task exit;
281
282 (3) when the page is truncated from the last VM_LOCKED VMA of an mmapped file;
283 or
284
285 (4) before a page is COW'd in a VM_LOCKED VMA.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700286
287
Hugh Dickins577e9842022-04-01 11:28:30 -0700288mlock()/mlock2()/mlockall() System Call Handling
289------------------------------------------------
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700290
Hugh Dickins577e9842022-04-01 11:28:30 -0700291mlock(), mlock2() and mlockall() system call handlers proceed to mlock_fixup()
David Howellsc24b7202009-04-13 14:40:01 -0700292for each VMA in the range specified by the call. In the case of mlockall(),
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700293this is the entire active address space of the task. Note that mlock_fixup()
David Howellsc24b7202009-04-13 14:40:01 -0700294is used for both mlocking and munlocking a range of memory. A call to mlock()
Hugh Dickins577e9842022-04-01 11:28:30 -0700295an already VM_LOCKED VMA, or to munlock() a VMA that is not VM_LOCKED, is
296treated as a no-op and mlock_fixup() simply returns.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700297
Hugh Dickins577e9842022-04-01 11:28:30 -0700298If the VMA passes some filtering as described in "Filtering Special VMAs"
David Howellsc24b7202009-04-13 14:40:01 -0700299below, mlock_fixup() will attempt to merge the VMA with its neighbors or split
Hugh Dickins577e9842022-04-01 11:28:30 -0700300off a subset of the VMA if the range does not cover the entire VMA. Any pages
Matthew Wilcox (Oracle)e0650a42023-01-16 19:28:27 +0000301already present in the VMA are then marked as mlocked by mlock_folio() via
Hugh Dickins577e9842022-04-01 11:28:30 -0700302mlock_pte_range() via walk_page_range() via mlock_vma_pages_range().
303
304Before returning from the system call, do_mlock() or mlockall() will call
305__mm_populate() to fault in the remaining pages via get_user_pages() and to
306mark those pages as mlocked as they are faulted.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700307
David Howellsc24b7202009-04-13 14:40:01 -0700308Note that the VMA being mlocked might be mapped with PROT_NONE. In this case,
309get_user_pages() will be unable to fault in the pages. That's okay. If pages
Hugh Dickins577e9842022-04-01 11:28:30 -0700310do end up getting faulted into this VM_LOCKED VMA, they will be handled in the
311fault path - which is also how mlock2()'s MLOCK_ONFAULT areas are handled.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700312
Hugh Dickins577e9842022-04-01 11:28:30 -0700313For each PTE (or PMD) being faulted into a VMA, the page add rmap function
Matthew Wilcox (Oracle)7efecff2023-01-16 19:28:25 +0000314calls mlock_vma_folio(), which calls mlock_folio() when the VMA is VM_LOCKED
Hugh Dickins577e9842022-04-01 11:28:30 -0700315(unless it is a PTE mapping of a part of a transparent huge page). Or when
Lorenzo Stoakesa8265cd2023-01-12 12:39:32 +0000316it is a newly allocated anonymous page, folio_add_lru_vma() calls
317mlock_new_folio() instead: similar to mlock_folio(), but can make better
Hugh Dickins577e9842022-04-01 11:28:30 -0700318judgments, since this page is held exclusively and known not to be on LRU yet.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700319
Lorenzo Stoakesa8265cd2023-01-12 12:39:32 +0000320mlock_folio() sets PG_mlocked immediately, then places the page on the CPU's
321mlock folio batch, to batch up the rest of the work to be done under lru_lock by
322__mlock_folio(). __mlock_folio() sets PG_unevictable, initializes mlock_count
Hugh Dickins577e9842022-04-01 11:28:30 -0700323and moves the page to unevictable state ("the unevictable LRU", but with
Lorenzo Stoakesa8265cd2023-01-12 12:39:32 +0000324mlock_count in place of LRU threading). Or if the page was already PG_lru
325and PG_unevictable and PG_mlocked, it simply increments the mlock_count.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700326
Hugh Dickins577e9842022-04-01 11:28:30 -0700327But in practice that may not work ideally: the page may not yet be on an LRU, or
328it may have been temporarily isolated from LRU. In such cases the mlock_count
Lorenzo Stoakesa8265cd2023-01-12 12:39:32 +0000329field cannot be touched, but will be set to 0 later when __munlock_folio()
Hugh Dickins577e9842022-04-01 11:28:30 -0700330returns the page to "LRU". Races prohibit mlock_count from being set to 1 then:
331rather than risk stranding a page indefinitely as unevictable, always err with
332mlock_count on the low side, so that when munlocked the page will be rescued to
333an evictable LRU, then perhaps be mlocked again later if vmscan finds it in a
334VM_LOCKED VMA.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700335
336
Mike Rapoporta5e4da92018-03-21 21:22:42 +0200337Filtering Special VMAs
David Howellsc24b7202009-04-13 14:40:01 -0700338----------------------
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700339
David Howellsc24b7202009-04-13 14:40:01 -0700340mlock_fixup() filters several classes of "special" VMAs:
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700341
David Howellsc24b7202009-04-13 14:40:01 -07003421) VMAs with VM_IO or VM_PFNMAP set are skipped entirely. The pages behind
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700343 these mappings are inherently pinned, so we don't need to mark them as
David Howellsc24b7202009-04-13 14:40:01 -0700344 mlocked. In any case, most of the pages have no struct page in which to so
345 mark the page. Because of this, get_user_pages() will fail for these VMAs,
346 so there is no sense in attempting to visit them.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700347
David Howellsc24b7202009-04-13 14:40:01 -07003482) VMAs mapping hugetlbfs page are already effectively pinned into memory. We
Hugh Dickins577e9842022-04-01 11:28:30 -0700349 neither need nor want to mlock() these pages. But __mm_populate() includes
350 hugetlbfs ranges, allocating the huge pages and populating the PTEs.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700351
Konstantin Khlebnikov314e51b2012-10-08 16:29:02 -07003523) VMAs with VM_DONTEXPAND are generally userspace mappings of kernel pages,
Hugh Dickins577e9842022-04-01 11:28:30 -0700353 such as the VDSO page, relay channel pages, etc. These pages are inherently
354 unevictable and are not managed on the LRU lists. __mm_populate() includes
355 these ranges, populating the PTEs if not already populated.
356
3574) VMAs with VM_MIXEDMAP set are not marked VM_LOCKED, but __mm_populate()
358 includes these ranges, populating the PTEs if not already populated.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700359
David Howellsc24b7202009-04-13 14:40:01 -0700360Note that for all of these special VMAs, mlock_fixup() does not set the
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700361VM_LOCKED flag. Therefore, we won't have to deal with them later during
David Howellsc24b7202009-04-13 14:40:01 -0700362munlock(), munmap() or task exit. Neither does mlock_fixup() account these
363VMAs against the task's "locked_vm".
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700364
365
Mike Rapoporta5e4da92018-03-21 21:22:42 +0200366munlock()/munlockall() System Call Handling
David Howellsc24b7202009-04-13 14:40:01 -0700367-------------------------------------------
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700368
Hugh Dickins577e9842022-04-01 11:28:30 -0700369The munlock() and munlockall() system calls are handled by the same
370mlock_fixup() function as mlock(), mlock2() and mlockall() system calls are.
371If called to munlock an already munlocked VMA, mlock_fixup() simply returns.
372Because of the VMA filtering discussed above, VM_LOCKED will not be set in
373any "special" VMAs. So, those VMAs will be ignored for munlock.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700374
David Howellsc24b7202009-04-13 14:40:01 -0700375If the VMA is VM_LOCKED, mlock_fixup() again attempts to merge or split off the
Matthew Wilcox (Oracle)e0650a42023-01-16 19:28:27 +0000376specified range. All pages in the VMA are then munlocked by munlock_folio() via
Hugh Dickins577e9842022-04-01 11:28:30 -0700377mlock_pte_range() via walk_page_range() via mlock_vma_pages_range() - the same
378function used when mlocking a VMA range, with new flags for the VMA indicating
379that it is munlock() being performed.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700380
Matthew Wilcox (Oracle)e0650a42023-01-16 19:28:27 +0000381munlock_folio() uses the mlock pagevec to batch up work to be done
382under lru_lock by __munlock_folio(). __munlock_folio() decrements the
383folio's mlock_count, and when that reaches 0 it clears the mlocked flag
384and clears the unevictable flag, moving the folio from unevictable state
385to the inactive LRU.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700386
Matthew Wilcox (Oracle)e0650a42023-01-16 19:28:27 +0000387But in practice that may not work ideally: the folio may not yet have reached
Hugh Dickins577e9842022-04-01 11:28:30 -0700388"the unevictable LRU", or it may have been temporarily isolated from it. In
389those cases its mlock_count field is unusable and must be assumed to be 0: so
Matthew Wilcox (Oracle)e0650a42023-01-16 19:28:27 +0000390that the folio will be rescued to an evictable LRU, then perhaps be mlocked
Hugh Dickins577e9842022-04-01 11:28:30 -0700391again later if vmscan finds it in a VM_LOCKED VMA.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700392
393
Mike Rapoporta5e4da92018-03-21 21:22:42 +0200394Migrating MLOCKED Pages
David Howellsc24b7202009-04-13 14:40:01 -0700395-----------------------
396
397A page that is being migrated has been isolated from the LRU lists and is held
398locked across unmapping of the page, updating the page's address space entry
399and copying the contents and state, until the page table entry has been
400replaced with an entry that refers to the new page. Linux supports migration
Hugh Dickins577e9842022-04-01 11:28:30 -0700401of mlocked pages and other unevictable pages. PG_mlocked is cleared from the
402the old page when it is unmapped from the last VM_LOCKED VMA, and set when the
403new page is mapped in place of migration entry in a VM_LOCKED VMA. If the page
404was unevictable because mlocked, PG_unevictable follows PG_mlocked; but if the
405page was unevictable for other reasons, PG_unevictable is copied explicitly.
David Howellsc24b7202009-04-13 14:40:01 -0700406
407Note that page migration can race with mlocking or munlocking of the same page.
Hugh Dickins577e9842022-04-01 11:28:30 -0700408There is mostly no problem since page migration requires unmapping all PTEs of
409the old page (including munlock where VM_LOCKED), then mapping in the new page
410(including mlock where VM_LOCKED). The page table locks provide sufficient
411synchronization.
David Howellsc24b7202009-04-13 14:40:01 -0700412
Hugh Dickins577e9842022-04-01 11:28:30 -0700413However, since mlock_vma_pages_range() starts by setting VM_LOCKED on a VMA,
414before mlocking any pages already present, if one of those pages were migrated
415before mlock_pte_range() reached it, it would get counted twice in mlock_count.
416To prevent that, mlock_vma_pages_range() temporarily marks the VMA as VM_IO,
Matthew Wilcox (Oracle)7efecff2023-01-16 19:28:25 +0000417so that mlock_vma_folio() will skip it.
Hugh Dickins577e9842022-04-01 11:28:30 -0700418
419To complete page migration, we place the old and new pages back onto the LRU
420afterwards. The "unneeded" page - old page on success, new page on failure -
421is freed when the reference count held by the migration process is released.
David Howellsc24b7202009-04-13 14:40:01 -0700422
423
Mike Rapoporta5e4da92018-03-21 21:22:42 +0200424Compacting MLOCKED Pages
Eric B Munson922c0552015-04-15 16:13:23 -0700425------------------------
426
Hugh Dickins577e9842022-04-01 11:28:30 -0700427The memory map can be scanned for compactable regions and the default behavior
428is to let unevictable pages be moved. /proc/sys/vm/compact_unevictable_allowed
429controls this behavior (see Documentation/admin-guide/sysctl/vm.rst). The work
430of compaction is mostly handled by the page migration code and the same work
431flow as described in Migrating MLOCKED Pages will apply.
432
Eric B Munson922c0552015-04-15 16:13:23 -0700433
Mike Rapoporta5e4da92018-03-21 21:22:42 +0200434MLOCKING Transparent Huge Pages
Kirill A. Shutemov6fb8ddf2016-07-26 15:25:15 -0700435-------------------------------
436
437A transparent huge page is represented by a single entry on an LRU list.
438Therefore, we can only make unevictable an entire compound page, not
439individual subpages.
440
Hugh Dickins577e9842022-04-01 11:28:30 -0700441If a user tries to mlock() part of a huge page, and no user mlock()s the
442whole of the huge page, we want the rest of the page to be reclaimable.
Kirill A. Shutemov6fb8ddf2016-07-26 15:25:15 -0700443
444We cannot just split the page on partial mlock() as split_huge_page() can
Hugh Dickins577e9842022-04-01 11:28:30 -0700445fail and a new intermittent failure mode for the syscall is undesirable.
Kirill A. Shutemov6fb8ddf2016-07-26 15:25:15 -0700446
Hugh Dickins577e9842022-04-01 11:28:30 -0700447We handle this by keeping PTE-mlocked huge pages on evictable LRU lists:
448the PMD on the border of a VM_LOCKED VMA will be split into a PTE table.
Kirill A. Shutemov6fb8ddf2016-07-26 15:25:15 -0700449
Hugh Dickins577e9842022-04-01 11:28:30 -0700450This way the huge page is accessible for vmscan. Under memory pressure the
Kirill A. Shutemov6fb8ddf2016-07-26 15:25:15 -0700451page will be split, subpages which belong to VM_LOCKED VMAs will be moved
Hugh Dickins577e9842022-04-01 11:28:30 -0700452to the unevictable LRU and the rest can be reclaimed.
Kirill A. Shutemov6fb8ddf2016-07-26 15:25:15 -0700453
Hugh Dickins577e9842022-04-01 11:28:30 -0700454/proc/meminfo's Unevictable and Mlocked amounts do not include those parts
455of a transparent huge page which are mapped only by PTEs in VM_LOCKED VMAs.
456
Eric B Munson922c0552015-04-15 16:13:23 -0700457
Mike Rapoporta5e4da92018-03-21 21:22:42 +0200458mmap(MAP_LOCKED) System Call Handling
David Howellsc24b7202009-04-13 14:40:01 -0700459-------------------------------------
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700460
Hugh Dickins577e9842022-04-01 11:28:30 -0700461In addition to the mlock(), mlock2() and mlockall() system calls, an application
462can request that a region of memory be mlocked by supplying the MAP_LOCKED flag
463to the mmap() call. There is one important and subtle difference here, though.
464mmap() + mlock() will fail if the range cannot be faulted in (e.g. because
465mm_populate fails) and returns with ENOMEM while mmap(MAP_LOCKED) will not fail.
Bjorn Helgaasd56b6992023-08-14 16:28:22 -0500466The mmapped area will still have properties of the locked area - pages will not
Hugh Dickins577e9842022-04-01 11:28:30 -0700467get swapped out - but major page faults to fault memory in might still happen.
Michal Hocko9b012a22015-06-24 16:57:50 -0700468
Hugh Dickins577e9842022-04-01 11:28:30 -0700469Furthermore, any mmap() call or brk() call that expands the heap by a task
470that has previously called mlockall() with the MCL_FUTURE flag will result
David Howellsc24b7202009-04-13 14:40:01 -0700471in the newly mapped memory being mlocked. Before the unevictable/mlock
Hugh Dickins577e9842022-04-01 11:28:30 -0700472changes, the kernel simply called make_pages_present() to allocate pages
473and populate the page table.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700474
Hugh Dickins577e9842022-04-01 11:28:30 -0700475To mlock a range of memory under the unevictable/mlock infrastructure,
476the mmap() handler and task address space expansion functions call
Kirill A. Shutemovfc05f562015-04-14 15:44:39 -0700477populate_vma_page_range() specifying the vma and the address range to mlock.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700478
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700479
Mike Rapoporta5e4da92018-03-21 21:22:42 +0200480munmap()/exit()/exec() System Call Handling
David Howellsc24b7202009-04-13 14:40:01 -0700481-------------------------------------------
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700482
483When unmapping an mlocked region of memory, whether by an explicit call to
484munmap() or via an internal unmap from exit() or exec() processing, we must
David Howellsc24b7202009-04-13 14:40:01 -0700485munlock the pages if we're removing the last VM_LOCKED VMA that maps the pages.
Hugh Dickins63d6c5a2009-01-06 14:39:38 -0800486Before the unevictable/mlock changes, mlocking did not mark the pages in any
487way, so unmapping them required no processing.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700488
David Hildenbrand5a0033f2023-12-20 23:44:55 +0100489For each PTE (or PMD) being unmapped from a VMA, folio_remove_rmap_*() calls
Matthew Wilcox (Oracle)672aa272023-01-16 19:28:26 +0000490munlock_vma_folio(), which calls munlock_folio() when the VMA is VM_LOCKED
Hugh Dickins577e9842022-04-01 11:28:30 -0700491(unless it was a PTE mapping of a part of a transparent huge page).
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700492
Matthew Wilcox (Oracle)e0650a42023-01-16 19:28:27 +0000493munlock_folio() uses the mlock pagevec to batch up work to be done
494under lru_lock by __munlock_folio(). __munlock_folio() decrements the
495folio's mlock_count, and when that reaches 0 it clears the mlocked flag
496and clears the unevictable flag, moving the folio from unevictable state
497to the inactive LRU.
Hugh Dickins577e9842022-04-01 11:28:30 -0700498
Matthew Wilcox (Oracle)e0650a42023-01-16 19:28:27 +0000499But in practice that may not work ideally: the folio may not yet have reached
Hugh Dickins577e9842022-04-01 11:28:30 -0700500"the unevictable LRU", or it may have been temporarily isolated from it. In
501those cases its mlock_count field is unusable and must be assumed to be 0: so
Matthew Wilcox (Oracle)e0650a42023-01-16 19:28:27 +0000502that the folio will be rescued to an evictable LRU, then perhaps be mlocked
Hugh Dickins577e9842022-04-01 11:28:30 -0700503again later if vmscan finds it in a VM_LOCKED VMA.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700504
505
Hugh Dickins577e9842022-04-01 11:28:30 -0700506Truncating MLOCKED Pages
507------------------------
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700508
Hugh Dickins577e9842022-04-01 11:28:30 -0700509File truncation or hole punching forcibly unmaps the deleted pages from
510userspace; truncation even unmaps and deletes any private anonymous pages
511which had been Copied-On-Write from the file pages now being truncated.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700512
Hugh Dickins577e9842022-04-01 11:28:30 -0700513Mlocked pages can be munlocked and deleted in this way: like with munmap(),
David Hildenbrand5a0033f2023-12-20 23:44:55 +0100514for each PTE (or PMD) being unmapped from a VMA, folio_remove_rmap_*() calls
Matthew Wilcox (Oracle)672aa272023-01-16 19:28:26 +0000515munlock_vma_folio(), which calls munlock_folio() when the VMA is VM_LOCKED
Hugh Dickins577e9842022-04-01 11:28:30 -0700516(unless it was a PTE mapping of a part of a transparent huge page).
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700517
Hugh Dickins577e9842022-04-01 11:28:30 -0700518However, if there is a racing munlock(), since mlock_vma_pages_range() starts
519munlocking by clearing VM_LOCKED from a VMA, before munlocking all the pages
520present, if one of those pages were unmapped by truncation or hole punch before
521mlock_pte_range() reached it, it would not be recognized as mlocked by this VMA,
522and would not be counted out of mlock_count. In this rare case, a page may
Lorenzo Stoakesa8265cd2023-01-12 12:39:32 +0000523still appear as PG_mlocked after it has been fully unmapped: and it is left to
Hugh Dickins577e9842022-04-01 11:28:30 -0700524release_pages() (or __page_cache_release()) to clear it and update statistics
525before freeing (this event is counted in /proc/vmstat unevictable_pgs_cleared,
526which is usually 0).
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700527
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700528
Mike Rapoporta5e4da92018-03-21 21:22:42 +0200529Page Reclaim in shrink_*_list()
David Howellsc24b7202009-04-13 14:40:01 -0700530-------------------------------
531
Hugh Dickins577e9842022-04-01 11:28:30 -0700532vmscan's shrink_active_list() culls any obviously unevictable pages -
533i.e. !page_evictable(page) pages - diverting those to the unevictable list.
David Howellsc24b7202009-04-13 14:40:01 -0700534However, shrink_active_list() only sees unevictable pages that made it onto the
Lorenzo Stoakesa8265cd2023-01-12 12:39:32 +0000535active/inactive LRU lists. Note that these pages do not have PG_unevictable
Hugh Dickins577e9842022-04-01 11:28:30 -0700536set - otherwise they would be on the unevictable list and shrink_active_list()
David Howellsc24b7202009-04-13 14:40:01 -0700537would never see them.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700538
539Some examples of these unevictable pages on the LRU lists are:
540
David Howellsc24b7202009-04-13 14:40:01 -0700541 (1) ramfs pages that have been placed on the LRU lists when first allocated.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700542
David Howellsc24b7202009-04-13 14:40:01 -0700543 (2) SHM_LOCK'd shared memory pages. shmctl(SHM_LOCK) does not attempt to
544 allocate or fault in the pages in the shared memory region. This happens
545 when an application accesses the page the first time after SHM_LOCK'ing
546 the segment.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700547
Hugh Dickins577e9842022-04-01 11:28:30 -0700548 (3) pages still mapped into VM_LOCKED VMAs, which should be marked mlocked,
549 but events left mlock_count too low, so they were munlocked too early.
Lee Schermerhornfa07e782008-10-18 20:26:47 -0700550
Hugh Dickins577e9842022-04-01 11:28:30 -0700551vmscan's shrink_inactive_list() and shrink_page_list() also divert obviously
552unevictable pages found on the inactive lists to the appropriate memory cgroup
553and node unevictable list.
David Howellsc24b7202009-04-13 14:40:01 -0700554
Vernon Yang9a7d7a82022-09-26 23:20:32 +0800555rmap's folio_referenced_one(), called via vmscan's shrink_active_list() or
Hugh Dickins577e9842022-04-01 11:28:30 -0700556shrink_page_list(), and rmap's try_to_unmap_one() called via shrink_page_list(),
Matthew Wilcox (Oracle)7efecff2023-01-16 19:28:25 +0000557check for (3) pages still mapped into VM_LOCKED VMAs, and call mlock_vma_folio()
Hugh Dickins577e9842022-04-01 11:28:30 -0700558to correct them. Such pages are culled to the unevictable list when released
559by the shrinker.