Lawrence "The Dreamer" Chen's Blog

Keep seeing this annoying message on FreeBSD, even though back on December 20th, 2013....I had set "security.bsd.unprivileged_mlock=1" in /etc/sysctl.conf to try to finally address this problem.

The default RLIMIT_MEMLOCK resource limit is 64k, which I would think is more than sufficient.

So, it was time to research this problem in more depth.

Found that there's a DEBUG_SECURE_MEMORY define to see how much memory its trying to allocate. Which its trying to allocate some multiple of 16k blocks, which it later refers as pages. Which I seem to recall is Windows?, Solaris is 8k and most other systems are 4k (my FreeBSD system, its 4k). Well, its only trying (and failing) to mlock 16k. So, I tried overriding the constant to 4k. But, this also failed.

I had skimmed the man page, where it says:

Since physical memory is a potentially scarce resource, processes are limited in how much they can lock down. A single process can mlock() the minimum of a system-wide ``wired pages'' limit vm.max_wired and the per-process RLIMIT_MEMLOCK resource limit.

If security.bsd.unprivileged_mlock is set to 0 these calls are only available to the super-user.

Well, on my system vm.max_wired defaults to 1323555 and RLIMIT_MEMLOCK (ulimit -l) is 64.....so limit is 64k, right?

Wrong...delving into the Kernel source...I found that it first checks that the requested amount + the amount it already has doesn't exceed RLIMIT_MEMLOCK, and then that the requested amount + the amount wired system wide ("vm.stats.vm.v_wire_count") is not greater than "vm.max_wired".

Well, when I looked at vm.stats.vm.v_wire_count it was 2020311....its already got more than vm.max_wired, wired!

I feel a PR coming on....

1323555 (which is about 5GB) is said to be 1/3 of some maximum. I have a 16GB system, probably not contiguous...and there's probably some amount reserved....but 2020311 is about 7.7GB.

I did a "sysctl vm.max_wired=2097152", and it took it (so put that into /etc/sysctl.conf, too.) and now gnome-keyring-daemon can start without that message.