633 lines
30 KiB
Text
633 lines
30 KiB
Text
==============================
|
|
UNEVICTABLE LRU INFRASTRUCTURE
|
|
==============================
|
|
|
|
========
|
|
CONTENTS
|
|
========
|
|
|
|
(*) The Unevictable LRU
|
|
|
|
- The unevictable page list.
|
|
- Memory control group interaction.
|
|
- Marking address spaces unevictable.
|
|
- Detecting Unevictable Pages.
|
|
- vmscan's handling of unevictable pages.
|
|
|
|
(*) mlock()'d pages.
|
|
|
|
- History.
|
|
- Basic management.
|
|
- mlock()/mlockall() system call handling.
|
|
- Filtering special vmas.
|
|
- munlock()/munlockall() system call handling.
|
|
- Migrating mlocked pages.
|
|
- Compacting mlocked pages.
|
|
- mmap(MAP_LOCKED) system call handling.
|
|
- munmap()/exit()/exec() system call handling.
|
|
- try_to_unmap().
|
|
- try_to_munlock() reverse map scan.
|
|
- Page reclaim in shrink_*_list().
|
|
|
|
|
|
============
|
|
INTRODUCTION
|
|
============
|
|
|
|
This document describes the Linux memory manager's "Unevictable LRU"
|
|
infrastructure and the use of this to manage several types of "unevictable"
|
|
pages.
|
|
|
|
The document attempts to provide the overall rationale behind this mechanism
|
|
and the rationale for some of the design decisions that drove the
|
|
implementation. The latter design rationale is discussed in the context of an
|
|
implementation description. Admittedly, one can obtain the implementation
|
|
details - the "what does it do?" - by reading the code. One hopes that the
|
|
descriptions below add value by provide the answer to "why does it do that?".
|
|
|
|
|
|
===================
|
|
THE UNEVICTABLE LRU
|
|
===================
|
|
|
|
The Unevictable LRU facility adds an additional LRU list to track unevictable
|
|
pages and to hide these pages from vmscan. This mechanism is based on a patch
|
|
by Larry Woodman of Red Hat to address several scalability problems with page
|
|
reclaim in Linux. The problems have been observed at customer sites on large
|
|
memory x86_64 systems.
|
|
|
|
To illustrate this with an example, a non-NUMA x86_64 platform with 128GB of
|
|
main memory will have over 32 million 4k pages in a single zone. When a large
|
|
fraction of these pages are not evictable for any reason [see below], vmscan
|
|
will spend a lot of time scanning the LRU lists looking for the small fraction
|
|
of pages that are evictable. This can result in a situation where all CPUs are
|
|
spending 100% of their time in vmscan for hours or days on end, with the system
|
|
completely unresponsive.
|
|
|
|
The unevictable list addresses the following classes of unevictable pages:
|
|
|
|
(*) Those owned by ramfs.
|
|
|
|
(*) Those mapped into SHM_LOCK'd shared memory regions.
|
|
|
|
(*) Those mapped into VM_LOCKED [mlock()ed] VMAs.
|
|
|
|
The infrastructure may also be able to handle other conditions that make pages
|
|
unevictable, either by definition or by circumstance, in the future.
|
|
|
|
|
|
THE UNEVICTABLE PAGE LIST
|
|
-------------------------
|
|
|
|
The Unevictable LRU infrastructure consists of an additional, per-zone, LRU list
|
|
called the "unevictable" list and an associated page flag, PG_unevictable, to
|
|
indicate that the page is being managed on the unevictable list.
|
|
|
|
The PG_unevictable flag is analogous to, and mutually exclusive with, the
|
|
PG_active flag in that it indicates on which LRU list a page resides when
|
|
PG_lru is set.
|
|
|
|
The Unevictable LRU infrastructure maintains unevictable pages on an additional
|
|
LRU list for a few reasons:
|
|
|
|
(1) We get to "treat unevictable pages just like we treat other pages in the
|
|
system - which means we get to use the same code to manipulate them, the
|
|
same code to isolate them (for migrate, etc.), the same code to keep track
|
|
of the statistics, etc..." [Rik van Riel]
|
|
|
|
(2) We want to be able to migrate unevictable pages between nodes for memory
|
|
defragmentation, workload management and memory hotplug. The linux kernel
|
|
can only migrate pages that it can successfully isolate from the LRU
|
|
lists. If we were to maintain pages elsewhere than on an LRU-like list,
|
|
where they can be found by isolate_lru_page(), we would prevent their
|
|
migration, unless we reworked migration code to find the unevictable pages
|
|
itself.
|
|
|
|
|
|
The unevictable list does not differentiate between file-backed and anonymous,
|
|
swap-backed pages. This differentiation is only important while the pages are,
|
|
in fact, evictable.
|
|
|
|
The unevictable list benefits from the "arrayification" of the per-zone LRU
|
|
lists and statistics originally proposed and posted by Christoph Lameter.
|
|
|
|
The unevictable list does not use the LRU pagevec mechanism. Rather,
|
|
unevictable pages are placed directly on the page's zone's unevictable list
|
|
under the zone lru_lock. This allows us to prevent the stranding of pages on
|
|
the unevictable list when one task has the page isolated from the LRU and other
|
|
tasks are changing the "evictability" state of the page.
|
|
|
|
|
|
MEMORY CONTROL GROUP INTERACTION
|
|
--------------------------------
|
|
|
|
The unevictable LRU facility interacts with the memory control group [aka
|
|
memory controller; see Documentation/cgroup-v1/memory.txt] by extending the
|
|
lru_list enum.
|
|
|
|
The memory controller data structure automatically gets a per-zone unevictable
|
|
list as a result of the "arrayification" of the per-zone LRU lists (one per
|
|
lru_list enum element). The memory controller tracks the movement of pages to
|
|
and from the unevictable list.
|
|
|
|
When a memory control group comes under memory pressure, the controller will
|
|
not attempt to reclaim pages on the unevictable list. This has a couple of
|
|
effects:
|
|
|
|
(1) Because the pages are "hidden" from reclaim on the unevictable list, the
|
|
reclaim process can be more efficient, dealing only with pages that have a
|
|
chance of being reclaimed.
|
|
|
|
(2) On the other hand, if too many of the pages charged to the control group
|
|
are unevictable, the evictable portion of the working set of the tasks in
|
|
the control group may not fit into the available memory. This can cause
|
|
the control group to thrash or to OOM-kill tasks.
|
|
|
|
|
|
MARKING ADDRESS SPACES UNEVICTABLE
|
|
----------------------------------
|
|
|
|
For facilities such as ramfs none of the pages attached to the address space
|
|
may be evicted. To prevent eviction of any such pages, the AS_UNEVICTABLE
|
|
address space flag is provided, and this can be manipulated by a filesystem
|
|
using a number of wrapper functions:
|
|
|
|
(*) void mapping_set_unevictable(struct address_space *mapping);
|
|
|
|
Mark the address space as being completely unevictable.
|
|
|
|
(*) void mapping_clear_unevictable(struct address_space *mapping);
|
|
|
|
Mark the address space as being evictable.
|
|
|
|
(*) int mapping_unevictable(struct address_space *mapping);
|
|
|
|
Query the address space, and return true if it is completely
|
|
unevictable.
|
|
|
|
These are currently used in two places in the kernel:
|
|
|
|
(1) By ramfs to mark the address spaces of its inodes when they are created,
|
|
and this mark remains for the life of the inode.
|
|
|
|
(2) By SYSV SHM to mark SHM_LOCK'd address spaces until SHM_UNLOCK is called.
|
|
|
|
Note that SHM_LOCK is not required to page in the locked pages if they're
|
|
swapped out; the application must touch the pages manually if it wants to
|
|
ensure they're in memory.
|
|
|
|
|
|
DETECTING UNEVICTABLE PAGES
|
|
---------------------------
|
|
|
|
The function page_evictable() in vmscan.c determines whether a page is
|
|
evictable or not using the query function outlined above [see section "Marking
|
|
address spaces unevictable"] to check the AS_UNEVICTABLE flag.
|
|
|
|
For address spaces that are so marked after being populated (as SHM regions
|
|
might be), the lock action (eg: SHM_LOCK) can be lazy, and need not populate
|
|
the page tables for the region as does, for example, mlock(), nor need it make
|
|
any special effort to push any pages in the SHM_LOCK'd area to the unevictable
|
|
list. Instead, vmscan will do this if and when it encounters the pages during
|
|
a reclamation scan.
|
|
|
|
On an unlock action (such as SHM_UNLOCK), the unlocker (eg: shmctl()) must scan
|
|
the pages in the region and "rescue" them from the unevictable list if no other
|
|
condition is keeping them unevictable. If an unevictable region is destroyed,
|
|
the pages are also "rescued" from the unevictable list in the process of
|
|
freeing them.
|
|
|
|
page_evictable() also checks for mlocked pages by testing an additional page
|
|
flag, PG_mlocked (as wrapped by PageMlocked()), which is set when a page is
|
|
faulted into a VM_LOCKED vma, or found in a vma being VM_LOCKED.
|
|
|
|
|
|
VMSCAN'S HANDLING OF UNEVICTABLE PAGES
|
|
--------------------------------------
|
|
|
|
If unevictable pages are culled in the fault path, or moved to the unevictable
|
|
list at mlock() or mmap() time, vmscan will not encounter the pages until they
|
|
have become evictable again (via munlock() for example) and have been "rescued"
|
|
from the unevictable list. However, there may be situations where we decide,
|
|
for the sake of expediency, to leave a unevictable page on one of the regular
|
|
active/inactive LRU lists for vmscan to deal with. vmscan checks for such
|
|
pages in all of the shrink_{active|inactive|page}_list() functions and will
|
|
"cull" such pages that it encounters: that is, it diverts those pages to the
|
|
unevictable list for the zone being scanned.
|
|
|
|
There may be situations where a page is mapped into a VM_LOCKED VMA, but the
|
|
page is not marked as PG_mlocked. Such pages will make it all the way to
|
|
shrink_page_list() where they will be detected when vmscan walks the reverse
|
|
map in try_to_unmap(). If try_to_unmap() returns SWAP_MLOCK,
|
|
shrink_page_list() will cull the page at that point.
|
|
|
|
To "cull" an unevictable page, vmscan simply puts the page back on the LRU list
|
|
using putback_lru_page() - the inverse operation to isolate_lru_page() - after
|
|
dropping the page lock. Because the condition which makes the page unevictable
|
|
may change once the page is unlocked, putback_lru_page() will recheck the
|
|
unevictable state of a page that it places on the unevictable list. If the
|
|
page has become unevictable, putback_lru_page() removes it from the list and
|
|
retries, including the page_unevictable() test. Because such a race is a rare
|
|
event and movement of pages onto the unevictable list should be rare, these
|
|
extra evictabilty checks should not occur in the majority of calls to
|
|
putback_lru_page().
|
|
|
|
|
|
=============
|
|
MLOCKED PAGES
|
|
=============
|
|
|
|
The unevictable page list is also useful for mlock(), in addition to ramfs and
|
|
SYSV SHM. Note that mlock() is only available in CONFIG_MMU=y situations; in
|
|
NOMMU situations, all mappings are effectively mlocked.
|
|
|
|
|
|
HISTORY
|
|
-------
|
|
|
|
The "Unevictable mlocked Pages" infrastructure is based on work originally
|
|
posted by Nick Piggin in an RFC patch entitled "mm: mlocked pages off LRU".
|
|
Nick posted his patch as an alternative to a patch posted by Christoph Lameter
|
|
to achieve the same objective: hiding mlocked pages from vmscan.
|
|
|
|
In Nick's patch, he used one of the struct page LRU list link fields as a count
|
|
of VM_LOCKED VMAs that map the page. This use of the link field for a count
|
|
prevented the management of the pages on an LRU list, and thus mlocked pages
|
|
were not migratable as isolate_lru_page() could not find them, and the LRU list
|
|
link field was not available to the migration subsystem.
|
|
|
|
Nick resolved this by putting mlocked pages back on the lru list before
|
|
attempting to isolate them, thus abandoning the count of VM_LOCKED VMAs. When
|
|
Nick's patch was integrated with the Unevictable LRU work, the count was
|
|
replaced by walking the reverse map to determine whether any VM_LOCKED VMAs
|
|
mapped the page. More on this below.
|
|
|
|
|
|
BASIC MANAGEMENT
|
|
----------------
|
|
|
|
mlocked pages - pages mapped into a VM_LOCKED VMA - are a class of unevictable
|
|
pages. When such a page has been "noticed" by the memory management subsystem,
|
|
the page is marked with the PG_mlocked flag. This can be manipulated using the
|
|
PageMlocked() functions.
|
|
|
|
A PG_mlocked page will be placed on the unevictable list when it is added to
|
|
the LRU. Such pages can be "noticed" by memory management in several places:
|
|
|
|
(1) in the mlock()/mlockall() system call handlers;
|
|
|
|
(2) in the mmap() system call handler when mmapping a region with the
|
|
MAP_LOCKED flag;
|
|
|
|
(3) mmapping a region in a task that has called mlockall() with the MCL_FUTURE
|
|
flag
|
|
|
|
(4) in the fault path, if mlocked pages are "culled" in the fault path,
|
|
and when a VM_LOCKED stack segment is expanded; or
|
|
|
|
(5) as mentioned above, in vmscan:shrink_page_list() when attempting to
|
|
reclaim a page in a VM_LOCKED VMA via try_to_unmap()
|
|
|
|
all of which result in the VM_LOCKED flag being set for the VMA if it doesn't
|
|
already have it set.
|
|
|
|
mlocked pages become unlocked and rescued from the unevictable list when:
|
|
|
|
(1) mapped in a range unlocked via the munlock()/munlockall() system calls;
|
|
|
|
(2) munmap()'d out of the last VM_LOCKED VMA that maps the page, including
|
|
unmapping at task exit;
|
|
|
|
(3) when the page is truncated from the last VM_LOCKED VMA of an mmapped file;
|
|
or
|
|
|
|
(4) before a page is COW'd in a VM_LOCKED VMA.
|
|
|
|
|
|
mlock()/mlockall() SYSTEM CALL HANDLING
|
|
---------------------------------------
|
|
|
|
Both [do_]mlock() and [do_]mlockall() system call handlers call mlock_fixup()
|
|
for each VMA in the range specified by the call. In the case of mlockall(),
|
|
this is the entire active address space of the task. Note that mlock_fixup()
|
|
is used for both mlocking and munlocking a range of memory. A call to mlock()
|
|
an already VM_LOCKED VMA, or to munlock() a VMA that is not VM_LOCKED is
|
|
treated as a no-op, and mlock_fixup() simply returns.
|
|
|
|
If the VMA passes some filtering as described in "Filtering Special Vmas"
|
|
below, mlock_fixup() will attempt to merge the VMA with its neighbors or split
|
|
off a subset of the VMA if the range does not cover the entire VMA. Once the
|
|
VMA has been merged or split or neither, mlock_fixup() will call
|
|
populate_vma_page_range() to fault in the pages via get_user_pages() and to
|
|
mark the pages as mlocked via mlock_vma_page().
|
|
|
|
Note that the VMA being mlocked might be mapped with PROT_NONE. In this case,
|
|
get_user_pages() will be unable to fault in the pages. That's okay. If pages
|
|
do end up getting faulted into this VM_LOCKED VMA, we'll handle them in the
|
|
fault path or in vmscan.
|
|
|
|
Also note that a page returned by get_user_pages() could be truncated or
|
|
migrated out from under us, while we're trying to mlock it. To detect this,
|
|
populate_vma_page_range() checks page_mapping() after acquiring the page lock.
|
|
If the page is still associated with its mapping, we'll go ahead and call
|
|
mlock_vma_page(). If the mapping is gone, we just unlock the page and move on.
|
|
In the worst case, this will result in a page mapped in a VM_LOCKED VMA
|
|
remaining on a normal LRU list without being PageMlocked(). Again, vmscan will
|
|
detect and cull such pages.
|
|
|
|
mlock_vma_page() will call TestSetPageMlocked() for each page returned by
|
|
get_user_pages(). We use TestSetPageMlocked() because the page might already
|
|
be mlocked by another task/VMA and we don't want to do extra work. We
|
|
especially do not want to count an mlocked page more than once in the
|
|
statistics. If the page was already mlocked, mlock_vma_page() need do nothing
|
|
more.
|
|
|
|
If the page was NOT already mlocked, mlock_vma_page() attempts to isolate the
|
|
page from the LRU, as it is likely on the appropriate active or inactive list
|
|
at that time. If the isolate_lru_page() succeeds, mlock_vma_page() will put
|
|
back the page - by calling putback_lru_page() - which will notice that the page
|
|
is now mlocked and divert the page to the zone's unevictable list. If
|
|
mlock_vma_page() is unable to isolate the page from the LRU, vmscan will handle
|
|
it later if and when it attempts to reclaim the page.
|
|
|
|
|
|
FILTERING SPECIAL VMAS
|
|
----------------------
|
|
|
|
mlock_fixup() filters several classes of "special" VMAs:
|
|
|
|
1) VMAs with VM_IO or VM_PFNMAP set are skipped entirely. The pages behind
|
|
these mappings are inherently pinned, so we don't need to mark them as
|
|
mlocked. In any case, most of the pages have no struct page in which to so
|
|
mark the page. Because of this, get_user_pages() will fail for these VMAs,
|
|
so there is no sense in attempting to visit them.
|
|
|
|
2) VMAs mapping hugetlbfs page are already effectively pinned into memory. We
|
|
neither need nor want to mlock() these pages. However, to preserve the
|
|
prior behavior of mlock() - before the unevictable/mlock changes -
|
|
mlock_fixup() will call make_pages_present() in the hugetlbfs VMA range to
|
|
allocate the huge pages and populate the ptes.
|
|
|
|
3) VMAs with VM_DONTEXPAND are generally userspace mappings of kernel pages,
|
|
such as the VDSO page, relay channel pages, etc. These pages
|
|
are inherently unevictable and are not managed on the LRU lists.
|
|
mlock_fixup() treats these VMAs the same as hugetlbfs VMAs. It calls
|
|
make_pages_present() to populate the ptes.
|
|
|
|
Note that for all of these special VMAs, mlock_fixup() does not set the
|
|
VM_LOCKED flag. Therefore, we won't have to deal with them later during
|
|
munlock(), munmap() or task exit. Neither does mlock_fixup() account these
|
|
VMAs against the task's "locked_vm".
|
|
|
|
|
|
munlock()/munlockall() SYSTEM CALL HANDLING
|
|
-------------------------------------------
|
|
|
|
The munlock() and munlockall() system calls are handled by the same functions -
|
|
do_mlock[all]() - as the mlock() and mlockall() system calls with the unlock vs
|
|
lock operation indicated by an argument. So, these system calls are also
|
|
handled by mlock_fixup(). Again, if called for an already munlocked VMA,
|
|
mlock_fixup() simply returns. Because of the VMA filtering discussed above,
|
|
VM_LOCKED will not be set in any "special" VMAs. So, these VMAs will be
|
|
ignored for munlock.
|
|
|
|
If the VMA is VM_LOCKED, mlock_fixup() again attempts to merge or split off the
|
|
specified range. The range is then munlocked via the function
|
|
populate_vma_page_range() - the same function used to mlock a VMA range -
|
|
passing a flag to indicate that munlock() is being performed.
|
|
|
|
Because the VMA access protections could have been changed to PROT_NONE after
|
|
faulting in and mlocking pages, get_user_pages() was unreliable for visiting
|
|
these pages for munlocking. Because we don't want to leave pages mlocked,
|
|
get_user_pages() was enhanced to accept a flag to ignore the permissions when
|
|
fetching the pages - all of which should be resident as a result of previous
|
|
mlocking.
|
|
|
|
For munlock(), populate_vma_page_range() unlocks individual pages by calling
|
|
munlock_vma_page(). munlock_vma_page() unconditionally clears the PG_mlocked
|
|
flag using TestClearPageMlocked(). As with mlock_vma_page(),
|
|
munlock_vma_page() use the Test*PageMlocked() function to handle the case where
|
|
the page might have already been unlocked by another task. If the page was
|
|
mlocked, munlock_vma_page() updates that zone statistics for the number of
|
|
mlocked pages. Note, however, that at this point we haven't checked whether
|
|
the page is mapped by other VM_LOCKED VMAs.
|
|
|
|
We can't call try_to_munlock(), the function that walks the reverse map to
|
|
check for other VM_LOCKED VMAs, without first isolating the page from the LRU.
|
|
try_to_munlock() is a variant of try_to_unmap() and thus requires that the page
|
|
not be on an LRU list [more on these below]. However, the call to
|
|
isolate_lru_page() could fail, in which case we couldn't try_to_munlock(). So,
|
|
we go ahead and clear PG_mlocked up front, as this might be the only chance we
|
|
have. If we can successfully isolate the page, we go ahead and
|
|
try_to_munlock(), which will restore the PG_mlocked flag and update the zone
|
|
page statistics if it finds another VMA holding the page mlocked. If we fail
|
|
to isolate the page, we'll have left a potentially mlocked page on the LRU.
|
|
This is fine, because we'll catch it later if and if vmscan tries to reclaim
|
|
the page. This should be relatively rare.
|
|
|
|
|
|
MIGRATING MLOCKED PAGES
|
|
-----------------------
|
|
|
|
A page that is being migrated has been isolated from the LRU lists and is held
|
|
locked across unmapping of the page, updating the page's address space entry
|
|
and copying the contents and state, until the page table entry has been
|
|
replaced with an entry that refers to the new page. Linux supports migration
|
|
of mlocked pages and other unevictable pages. This involves simply moving the
|
|
PG_mlocked and PG_unevictable states from the old page to the new page.
|
|
|
|
Note that page migration can race with mlocking or munlocking of the same page.
|
|
This has been discussed from the mlock/munlock perspective in the respective
|
|
sections above. Both processes (migration and m[un]locking) hold the page
|
|
locked. This provides the first level of synchronization. Page migration
|
|
zeros out the page_mapping of the old page before unlocking it, so m[un]lock
|
|
can skip these pages by testing the page mapping under page lock.
|
|
|
|
To complete page migration, we place the new and old pages back onto the LRU
|
|
after dropping the page lock. The "unneeded" page - old page on success, new
|
|
page on failure - will be freed when the reference count held by the migration
|
|
process is released. To ensure that we don't strand pages on the unevictable
|
|
list because of a race between munlock and migration, page migration uses the
|
|
putback_lru_page() function to add migrated pages back to the LRU.
|
|
|
|
|
|
COMPACTING MLOCKED PAGES
|
|
------------------------
|
|
|
|
The unevictable LRU can be scanned for compactable regions and the default
|
|
behavior is to do so. /proc/sys/vm/compact_unevictable_allowed controls
|
|
this behavior (see Documentation/sysctl/vm.txt). Once scanning of the
|
|
unevictable LRU is enabled, the work of compaction is mostly handled by
|
|
the page migration code and the same work flow as described in MIGRATING
|
|
MLOCKED PAGES will apply.
|
|
|
|
MLOCKING TRANSPARENT HUGE PAGES
|
|
-------------------------------
|
|
|
|
A transparent huge page is represented by a single entry on an LRU list.
|
|
Therefore, we can only make unevictable an entire compound page, not
|
|
individual subpages.
|
|
|
|
If a user tries to mlock() part of a huge page, we want the rest of the
|
|
page to be reclaimable.
|
|
|
|
We cannot just split the page on partial mlock() as split_huge_page() can
|
|
fail and new intermittent failure mode for the syscall is undesirable.
|
|
|
|
We handle this by keeping PTE-mapped huge pages on normal LRU lists: the
|
|
PMD on border of VM_LOCKED VMA will be split into PTE table.
|
|
|
|
This way the huge page is accessible for vmscan. Under memory pressure the
|
|
page will be split, subpages which belong to VM_LOCKED VMAs will be moved
|
|
to unevictable LRU and the rest can be reclaimed.
|
|
|
|
See also comment in follow_trans_huge_pmd().
|
|
|
|
mmap(MAP_LOCKED) SYSTEM CALL HANDLING
|
|
-------------------------------------
|
|
|
|
In addition the mlock()/mlockall() system calls, an application can request
|
|
that a region of memory be mlocked supplying the MAP_LOCKED flag to the mmap()
|
|
call. There is one important and subtle difference here, though. mmap() + mlock()
|
|
will fail if the range cannot be faulted in (e.g. because mm_populate fails)
|
|
and returns with ENOMEM while mmap(MAP_LOCKED) will not fail. The mmaped
|
|
area will still have properties of the locked area - aka. pages will not get
|
|
swapped out - but major page faults to fault memory in might still happen.
|
|
|
|
Furthermore, any mmap() call or brk() call that expands the heap by a
|
|
task that has previously called mlockall() with the MCL_FUTURE flag will result
|
|
in the newly mapped memory being mlocked. Before the unevictable/mlock
|
|
changes, the kernel simply called make_pages_present() to allocate pages and
|
|
populate the page table.
|
|
|
|
To mlock a range of memory under the unevictable/mlock infrastructure, the
|
|
mmap() handler and task address space expansion functions call
|
|
populate_vma_page_range() specifying the vma and the address range to mlock.
|
|
|
|
The callers of populate_vma_page_range() will have already added the memory range
|
|
to be mlocked to the task's "locked_vm". To account for filtered VMAs,
|
|
populate_vma_page_range() returns the number of pages NOT mlocked. All of the
|
|
callers then subtract a non-negative return value from the task's locked_vm. A
|
|
negative return value represent an error - for example, from get_user_pages()
|
|
attempting to fault in a VMA with PROT_NONE access. In this case, we leave the
|
|
memory range accounted as locked_vm, as the protections could be changed later
|
|
and pages allocated into that region.
|
|
|
|
|
|
munmap()/exit()/exec() SYSTEM CALL HANDLING
|
|
-------------------------------------------
|
|
|
|
When unmapping an mlocked region of memory, whether by an explicit call to
|
|
munmap() or via an internal unmap from exit() or exec() processing, we must
|
|
munlock the pages if we're removing the last VM_LOCKED VMA that maps the pages.
|
|
Before the unevictable/mlock changes, mlocking did not mark the pages in any
|
|
way, so unmapping them required no processing.
|
|
|
|
To munlock a range of memory under the unevictable/mlock infrastructure, the
|
|
munmap() handler and task address space call tear down function
|
|
munlock_vma_pages_all(). The name reflects the observation that one always
|
|
specifies the entire VMA range when munlock()ing during unmap of a region.
|
|
Because of the VMA filtering when mlocking() regions, only "normal" VMAs that
|
|
actually contain mlocked pages will be passed to munlock_vma_pages_all().
|
|
|
|
munlock_vma_pages_all() clears the VM_LOCKED VMA flag and, like mlock_fixup()
|
|
for the munlock case, calls __munlock_vma_pages_range() to walk the page table
|
|
for the VMA's memory range and munlock_vma_page() each resident page mapped by
|
|
the VMA. This effectively munlocks the page, only if this is the last
|
|
VM_LOCKED VMA that maps the page.
|
|
|
|
|
|
try_to_unmap()
|
|
--------------
|
|
|
|
Pages can, of course, be mapped into multiple VMAs. Some of these VMAs may
|
|
have VM_LOCKED flag set. It is possible for a page mapped into one or more
|
|
VM_LOCKED VMAs not to have the PG_mlocked flag set and therefore reside on one
|
|
of the active or inactive LRU lists. This could happen if, for example, a task
|
|
in the process of munlocking the page could not isolate the page from the LRU.
|
|
As a result, vmscan/shrink_page_list() might encounter such a page as described
|
|
in section "vmscan's handling of unevictable pages". To handle this situation,
|
|
try_to_unmap() checks for VM_LOCKED VMAs while it is walking a page's reverse
|
|
map.
|
|
|
|
try_to_unmap() is always called, by either vmscan for reclaim or for page
|
|
migration, with the argument page locked and isolated from the LRU. Separate
|
|
functions handle anonymous and mapped file and KSM pages, as these types of
|
|
pages have different reverse map lookup mechanisms, with different locking.
|
|
In each case, whether rmap_walk_anon() or rmap_walk_file() or rmap_walk_ksm(),
|
|
it will call try_to_unmap_one() for every VMA which might contain the page.
|
|
|
|
When trying to reclaim, if try_to_unmap_one() finds the page in a VM_LOCKED
|
|
VMA, it will then mlock the page via mlock_vma_page() instead of unmapping it,
|
|
and return SWAP_MLOCK to indicate that the page is unevictable: and the scan
|
|
stops there.
|
|
|
|
mlock_vma_page() is called while holding the page table's lock (in addition
|
|
to the page lock, and the rmap lock): to serialize against concurrent mlock or
|
|
munlock or munmap system calls, mm teardown (munlock_vma_pages_all), reclaim,
|
|
holepunching, and truncation of file pages and their anonymous COWed pages.
|
|
|
|
|
|
try_to_munlock() REVERSE MAP SCAN
|
|
---------------------------------
|
|
|
|
[!] TODO/FIXME: a better name might be page_mlocked() - analogous to the
|
|
page_referenced() reverse map walker.
|
|
|
|
When munlock_vma_page() [see section "munlock()/munlockall() System Call
|
|
Handling" above] tries to munlock a page, it needs to determine whether or not
|
|
the page is mapped by any VM_LOCKED VMA without actually attempting to unmap
|
|
all PTEs from the page. For this purpose, the unevictable/mlock infrastructure
|
|
introduced a variant of try_to_unmap() called try_to_munlock().
|
|
|
|
try_to_munlock() calls the same functions as try_to_unmap() for anonymous and
|
|
mapped file and KSM pages with a flag argument specifying unlock versus unmap
|
|
processing. Again, these functions walk the respective reverse maps looking
|
|
for VM_LOCKED VMAs. When such a VMA is found, as in the try_to_unmap() case,
|
|
the functions mlock the page via mlock_vma_page() and return SWAP_MLOCK. This
|
|
undoes the pre-clearing of the page's PG_mlocked done by munlock_vma_page.
|
|
|
|
Note that try_to_munlock()'s reverse map walk must visit every VMA in a page's
|
|
reverse map to determine that a page is NOT mapped into any VM_LOCKED VMA.
|
|
However, the scan can terminate when it encounters a VM_LOCKED VMA.
|
|
Although try_to_munlock() might be called a great many times when munlocking a
|
|
large region or tearing down a large address space that has been mlocked via
|
|
mlockall(), overall this is a fairly rare event.
|
|
|
|
|
|
PAGE RECLAIM IN shrink_*_list()
|
|
-------------------------------
|
|
|
|
shrink_active_list() culls any obviously unevictable pages - i.e.
|
|
!page_evictable(page) - diverting these to the unevictable list.
|
|
However, shrink_active_list() only sees unevictable pages that made it onto the
|
|
active/inactive lru lists. Note that these pages do not have PageUnevictable
|
|
set - otherwise they would be on the unevictable list and shrink_active_list
|
|
would never see them.
|
|
|
|
Some examples of these unevictable pages on the LRU lists are:
|
|
|
|
(1) ramfs pages that have been placed on the LRU lists when first allocated.
|
|
|
|
(2) SHM_LOCK'd shared memory pages. shmctl(SHM_LOCK) does not attempt to
|
|
allocate or fault in the pages in the shared memory region. This happens
|
|
when an application accesses the page the first time after SHM_LOCK'ing
|
|
the segment.
|
|
|
|
(3) mlocked pages that could not be isolated from the LRU and moved to the
|
|
unevictable list in mlock_vma_page().
|
|
|
|
shrink_inactive_list() also diverts any unevictable pages that it finds on the
|
|
inactive lists to the appropriate zone's unevictable list.
|
|
|
|
shrink_inactive_list() should only see SHM_LOCK'd pages that became SHM_LOCK'd
|
|
after shrink_active_list() had moved them to the inactive list, or pages mapped
|
|
into VM_LOCKED VMAs that munlock_vma_page() couldn't isolate from the LRU to
|
|
recheck via try_to_munlock(). shrink_inactive_list() won't notice the latter,
|
|
but will pass on to shrink_page_list().
|
|
|
|
shrink_page_list() again culls obviously unevictable pages that it could
|
|
encounter for similar reason to shrink_inactive_list(). Pages mapped into
|
|
VM_LOCKED VMAs but without PG_mlocked set will make it all the way to
|
|
try_to_unmap(). shrink_page_list() will divert them to the unevictable list
|
|
when try_to_unmap() returns SWAP_MLOCK, as discussed above.
|