Processes¶

Initially, only the root cgroup exists to which all processes belong.A child cgroup can be created by creating a sub-directory:

# mkdir $CGROUP_NAME

A given cgroup may have multiple child cgroups forming a treestructure. Each cgroup has a read-writable interface file“cgroup.procs”. When read, it lists the PIDs of all processes whichbelong to the cgroup one-per-line. The PIDs are not ordered and thesame PID may show up more than once if the process got moved toanother cgroup and then back or the PID got recycled while reading.

A process can be migrated into a cgroup by writing its PID to thetarget cgroup’s “cgroup.procs” file. Only one process can be migratedon a single write(2) call. If a process is composed of multiplethreads, writing the PID of any thread migrates all threads of theprocess.

When a process forks a child process, the new process is born into thecgroup that the forking process belongs to at the time of theoperation. After exit, a process stays associated with the cgroupthat it belonged to at the time of exit until it’s reaped; however, azombie process does not appear in “cgroup.procs” and thus can’t bemoved to another cgroup.

A cgroup which doesn’t have any children or live processes can bedestroyed by removing the directory. Note that a cgroup which doesn’thave any children and is associated only with zombie processes isconsidered empty and can be removed:

# rmdir $CGROUP_NAME

“/proc/$PID/cgroup” lists a process’s cgroup membership. If legacycgroup is in use in the system, this file may contain multiple lines,one for each hierarchy. The entry for cgroup v2 is always in theformat “0::$PATH”:

# cat /proc/842/cgroup...0::/test-cgroup/test-cgroup-nested

If the process becomes a zombie and the cgroup it was associated withis removed subsequently, “ (deleted)” is appended to the path:

# cat /proc/842/cgroup...0::/test-cgroup/test-cgroup-nested (deleted)

Threads¶

cgroup v2 supports thread granularity for a subset of controllers tosupport use cases requiring hierarchical resource distribution acrossthe threads of a group of processes. By default, all threads of aprocess belong to the same cgroup, which also serves as the resourcedomain to host resource consumptions which are not specific to aprocess or thread. The thread mode allows threads to be spread acrossa subtree while still maintaining the common resource domain for them.

Controllers which support thread mode are called threaded controllers.The ones which don’t are called domain controllers.

Marking a cgroup threaded makes it join the resource domain of itsparent as a threaded cgroup. The parent may be another threadedcgroup whose resource domain is further up in the hierarchy. The rootof a threaded subtree, that is, the nearest ancestor which is notthreaded, is called threaded domain or thread root interchangeably andserves as the resource domain for the entire subtree.

Inside a threaded subtree, threads of a process can be put indifferent cgroups and are not subject to the no internal processconstraint - threaded controllers can be enabled on non-leaf cgroupswhether they have threads in them or not.

As the threaded domain cgroup hosts all the domain resourceconsumptions of the subtree, it is considered to have internalresource consumptions whether there are processes in it or not andcan’t have populated child cgroups which aren’t threaded. Because theroot cgroup is not subject to no internal process constraint, it canserve both as a threaded domain and a parent to domain cgroups.

The current operation mode or type of the cgroup is shown in the“cgroup.type” file which indicates whether the cgroup is a normaldomain, a domain which is serving as the domain of a threaded subtree,or a threaded cgroup.

On creation, a cgroup is always a domain cgroup and can be madethreaded by writing “threaded” to the “cgroup.type” file. Theoperation is single direction:

# echo threaded > cgroup.type

Once threaded, the cgroup can’t be made a domain again. To enable thethread mode, the following conditions must be met.

• As the cgroup will join the parent’s resource domain. The parentmust either be a valid (threaded) domain or a threaded cgroup.

• When the parent is an unthreaded domain, it must not have any domaincontrollers enabled or populated domain children. The root isexempt from this requirement.

Topology-wise, a cgroup can be in an invalid state. Please considerthe following topology:

A (threaded domain) - B (threaded) - C (domain, just created)

C is created as a domain but isn’t connected to a parent which canhost child domains. C can’t be used until it is turned into athreaded cgroup. “cgroup.type” file will report “domain (invalid)” inthese cases. Operations which fail due to invalid topology useEOPNOTSUPP as the errno.

A domain cgroup is turned into a threaded domain when one of its childcgroup becomes threaded or threaded controllers are enabled in the“cgroup.subtree_control” file while there are processes in the cgroup.A threaded domain reverts to a normal domain when the conditionsclear.

When read, “cgroup.threads” contains the list of the thread IDs of allthreads in the cgroup. Except that the operations are per-threadinstead of per-process, “cgroup.threads” has the same format andbehaves the same way as “cgroup.procs”. While “cgroup.threads” can bewritten to in any cgroup, as it can only move threads inside the samethreaded domain, its operations are confined inside each threadedsubtree.

The threaded domain cgroup serves as the resource domain for the wholesubtree, and, while the threads can be scattered across the subtree,all the processes are considered to be in the threaded domain cgroup.“cgroup.procs” in a threaded domain cgroup contains the PIDs of allprocesses in the subtree and is not readable in the subtree proper.However, “cgroup.procs” can be written to from anywhere in the subtreeto migrate all threads of the matching process to the cgroup.

Only threaded controllers can be enabled in a threaded subtree. Whena threaded controller is enabled inside a threaded subtree, it onlyaccounts for and controls resource consumptions associated with thethreads in the cgroup and its descendants. All consumptions whicharen’t tied to a specific thread belong to the threaded domain cgroup.

Because a threaded subtree is exempt from no internal processconstraint, a threaded controller must be able to handle competitionbetween threads in a non-leaf cgroup and its child cgroups. Eachthreaded controller defines how such competitions are handled.

Currently, the following controllers are threaded and can be enabledin a threaded cgroup:

- cpu- cpuset- perf_event- pids

Availability¶

A controller is available in a cgroup when it is supported by the kernel (i.e.,compiled in, not disabled and not attached to a v1 hierarchy) and listed in the“cgroup.controllers” file. Availability means the controller’s interface filesare exposed in the cgroup’s directory, allowing the distribution of the targetresource to be observed or controlled within that cgroup.

Enabling and Disabling¶

Each cgroup has a “cgroup.controllers” file which lists allcontrollers available for the cgroup to enable:

# cat cgroup.controllerscpu io memory

No controller is enabled by default. Controllers can be enabled anddisabled by writing to the “cgroup.subtree_control” file:

# echo "+cpu +memory -io" > cgroup.subtree_control

Only controllers which are listed in “cgroup.controllers” can beenabled. When multiple operations are specified as above, either theyall succeed or fail. If multiple operations on the same controllerare specified, the last one is effective.

Enabling a controller in a cgroup indicates that the distribution ofthe target resource across its immediate children will be controlled.Consider the following sub-hierarchy. The enabled controllers arelisted in parentheses:

A(cpu,memory) - B(memory) - C()                          \ D()

As A has “cpu” and “memory” enabled, A will control the distributionof CPU cycles and memory to its children, in this case, B. As B has“memory” enabled but not “CPU”, C and D will compete freely on CPUcycles but their division of memory available to B will be controlled.

As a controller regulates the distribution of the target resource tothe cgroup’s children, enabling it creates the controller’s interfacefiles in the child cgroups. In the above example, enabling “cpu” on Bwould create the “cpu.” prefixed controller interface files in C andD. Likewise, disabling “memory” from B would remove the “memory.”prefixed controller interface files from C and D. This means that thecontroller interface files - anything which doesn’t start with“cgroup.” are owned by the parent rather than the cgroup itself.

Top-down Constraint¶

Resources are distributed top-down and a cgroup can further distributea resource only if the resource has been distributed to it from theparent. This means that all non-root “cgroup.subtree_control” filescan only contain controllers which are enabled in the parent’s“cgroup.subtree_control” file. A controller can be enabled only ifthe parent has the controller enabled and a controller can’t bedisabled if one or more children have it enabled.

No Internal Process Constraint¶

Non-root cgroups can distribute domain resources to their childrenonly when they don’t have any processes of their own. In other words,only domain cgroups which don’t contain any processes can have domaincontrollers enabled in their “cgroup.subtree_control” files.

This guarantees that, when a domain controller is looking at the partof the hierarchy which has it enabled, processes are always only onthe leaves. This rules out situations where child cgroups competeagainst internal processes of the parent.

The root cgroup is exempt from this restriction. Root containsprocesses and anonymous resource consumption which can’t be associatedwith any other cgroups and requires special treatment from mostcontrollers. How resource consumption in the root cgroup is governedis up to each controller (for more information on this topic pleaserefer to the Non-normative information section in the Controllerschapter).

Note that the restriction doesn’t get in the way if there is noenabled controller in the cgroup’s “cgroup.subtree_control”. This isimportant as otherwise it wouldn’t be possible to create children of apopulated cgroup. To control resource distribution of a cgroup, thecgroup must create children and transfer all its processes to thechildren before enabling controllers in its “cgroup.subtree_control”file.

Model of Delegation¶

A cgroup can be delegated in two ways. First, to a less privilegeduser by granting write access of the directory and its “cgroup.procs”,“cgroup.threads” and “cgroup.subtree_control” files to the user.Second, if the “nsdelegate” mount option is set, automatically to acgroup namespace on namespace creation.

Because the resource control interface files in a given directorycontrol the distribution of the parent’s resources, the delegateeshouldn’t be allowed to write to them. For the first method, this isachieved by not granting access to these files. For the second, filesoutside the namespace should be hidden from the delegatee by the meansof at least mount namespacing, and the kernel rejects writes to allfiles on a namespace root from inside the cgroup namespace, except forthose files listed in “/sys/kernel/cgroup/delegate” (including“cgroup.procs”, “cgroup.threads”, “cgroup.subtree_control”, etc.).

The end results are equivalent for both delegation types. Oncedelegated, the user can build sub-hierarchy under the directory,organize processes inside it as it sees fit and further distribute theresources it received from the parent. The limits and other settingsof all resource controllers are hierarchical and regardless of whathappens in the delegated sub-hierarchy, nothing can escape theresource restrictions imposed by the parent.

Currently, cgroup doesn’t impose any restrictions on the number ofcgroups in or nesting depth of a delegated sub-hierarchy; however,this may be limited explicitly in the future.

Delegation Containment¶

A delegated sub-hierarchy is contained in the sense that processescan’t be moved into or out of the sub-hierarchy by the delegatee.

For delegations to a less privileged user, this is achieved byrequiring the following conditions for a process with a non-root euidto migrate a target process into a cgroup by writing its PID to the“cgroup.procs” file.

• The writer must have write access to the “cgroup.procs” file.

• The writer must have write access to the “cgroup.procs” file of thecommon ancestor of the source and destination cgroups.

The above two constraints ensure that while a delegatee may migrateprocesses around freely in the delegated sub-hierarchy it can’t pullin from or push out to outside the sub-hierarchy.

For an example, let’s assume cgroups C0 and C1 have been delegated touser U0 who created C00, C01 under C0 and C10 under C1 as follows andall processes under C0 and C1 belong to U0:

~~~~~~~~~~~~~ - C0 - C00~ cgroup    ~      \ C01~ hierarchy ~~~~~~~~~~~~~~ - C1 - C10

Let’s also say U0 wants to write the PID of a process which iscurrently in C10 into “C00/cgroup.procs”. U0 has write access to thefile; however, the common ancestor of the source cgroup C10 and thedestination cgroup C00 is above the points of delegation and U0 wouldnot have write access to its “cgroup.procs” files and thus the writewill be denied with -EACCES.

For delegations to namespaces, containment is achieved by requiringthat both the source and destination cgroups are reachable from thenamespace of the process which is attempting the migration. If eitheris not reachable, the migration is rejected with -ENOENT.

Organize Once and Control¶

Migrating a process across cgroups is a relatively expensive operationand stateful resources such as memory are not moved together with theprocess. This is an explicit design decision as there often existinherent trade-offs between migration and various hot paths in termsof synchronization cost.

As such, migrating processes across cgroups frequently as a means toapply different resource restrictions is discouraged. A workloadshould be assigned to a cgroup according to the system’s logical andresource structure once on start-up. Dynamic adjustments to resourcedistribution can be made by changing controller configuration throughthe interface files.

Avoid Name Collisions¶

Interface files for a cgroup and its children cgroups occupy the samedirectory and it is possible to create children cgroups which collidewith interface files.

All cgroup core interface files are prefixed with “cgroup.” and eachcontroller’s interface files are prefixed with the controller name anda dot. A controller’s name is composed of lower case alphabets and‘_’s but never begins with an ‘_’ so it can be used as the prefixcharacter for collision avoidance. Also, interface file names won’tstart or end with terms which are often used in categorizing workloadssuch as job, service, slice, unit or workload.

cgroup doesn’t do anything to prevent name collisions and it’s theuser’s responsibility to avoid them.

CPU Interface Files¶

The interaction of a process with the cpu controller depends on its schedulingpolicy and the underlying scheduler. From the point of view of the cpu controller,processes can be categorized as follows:

• Processes under the fair-class scheduler

• Processes under a BPF scheduler with thecgroup_set_weight callback

• Everything else:SCHED_{FIFO,RR,DEADLINE} and processes under a BPF schedulerwithout thecgroup_set_weight callback

For details on when a process is under the fair-class scheduler or a BPF scheduler,check outDocumentation/scheduler/sched-ext.rst.

For each of the following interface files, the above categorieswill be referred to. All time durations are in microseconds.

cpu.stat

A read-only flat-keyed file.This file exists whether the controller is enabled or not.

It always reports the following three stats, which account for all theprocesses in the cgroup:

• usage_usec

• user_usec

• system_usec

and the following five when the controller is enabled, which account foronly the processes under the fair-class scheduler:

• nr_periods

• nr_throttled

• throttled_usec

• nr_bursts

• burst_usec

cpu.weight

A read-write single value file which exists on non-rootcgroups. The default is “100”.

For non idle groups (cpu.idle = 0), the weight is in therange [1, 10000].

If the cgroup has been configured to be SCHED_IDLE (cpu.idle = 1),then the weight will show as a 0.

This file affects only processes under the fair-class scheduler and a BPFscheduler with thecgroup_set_weight callback depending on what thecallback actually does.

cpu.weight.nice

A read-write single value file which exists on non-rootcgroups. The default is “0”.

The nice value is in the range [-20, 19].

This interface file is an alternative interface for“cpu.weight” and allows reading and setting weight using thesame values used by nice(2). Because the range is smaller andgranularity is coarser for the nice values, the read value isthe closest approximation of the current weight.

This file affects only processes under the fair-class scheduler and a BPFscheduler with thecgroup_set_weight callback depending on what thecallback actually does.

cpu.max

A read-write two value file which exists on non-root cgroups.The default is “max 100000”.

The maximum bandwidth limit. It’s in the following format:

$MAX $PERIOD

which indicates that the group may consume up to $MAX in each$PERIOD duration. “max” for $MAX indicates no limit. If onlyone number is written, $MAX is updated.

This file affects only processes under the fair-class scheduler.

cpu.max.burst

A read-write single value file which exists on non-rootcgroups. The default is “0”.

The burst in the range [0, $MAX].

This file affects only processes under the fair-class scheduler.

cpu.pressure

A read-write nested-keyed file.

Shows pressure stall information for CPU. SeeDocumentation/accounting/psi.rst for details.

This file accounts for all the processes in the cgroup.

cpu.uclamp.min

A read-write single value file which exists on non-root cgroups.The default is “0”, i.e. no utilization boosting.

The requested minimum utilization (protection) as a percentagerational number, e.g. 12.34 for 12.34%.

This interface allows reading and setting minimum utilization clampvalues similar to the sched_setattr(2). This minimum utilizationvalue is used to clamp the task specific minimum utilization clamp,including those of realtime processes.

The requested minimum utilization (protection) is always capped bythe current value for the maximum utilization (limit), i.e.cpu.uclamp.max.

This file affects all the processes in the cgroup.

cpu.uclamp.max

A read-write single value file which exists on non-root cgroups.The default is “max”. i.e. no utilization capping

The requested maximum utilization (limit) as a percentage rationalnumber, e.g. 98.76 for 98.76%.

This interface allows reading and setting maximum utilization clampvalues similar to the sched_setattr(2). This maximum utilizationvalue is used to clamp the task specific maximum utilization clamp,including those of realtime processes.

This file affects all the processes in the cgroup.

cpu.idle

A read-write single value file which exists on non-root cgroups.The default is 0.

This is the cgroup analog of the per-task SCHED_IDLE sched policy.Setting this value to a 1 will make the scheduling policy of thecgroup SCHED_IDLE. The threads inside the cgroup will retain theirown relative priorities, but the cgroup itself will be treated asvery low priority relative to its peers.

This file affects only processes under the fair-class scheduler.

Memory Interface Files¶

All memory amounts are in bytes. If a value which is not aligned toPAGE_SIZE is written, the value may be rounded up to the closestPAGE_SIZE multiple when read back.

memory.current

A read-only single value file which exists on non-rootcgroups.

The total amount of memory currently being used by the cgroupand its descendants.

memory.min

A read-write single value file which exists on non-rootcgroups. The default is “0”.

Hard memory protection. If the memory usage of a cgroupis within its effective min boundary, the cgroup’s memorywon’t be reclaimed under any conditions. If there is nounprotected reclaimable memory available, OOM killeris invoked. Above the effective min boundary (oreffective low boundary if it is higher), pages are reclaimedproportionally to the overage, reducing reclaim pressure forsmaller overages.

Effective min boundary is limited by memory.min values ofall ancestor cgroups. If there is memory.min overcommitment(child cgroup or cgroups are requiring more protected memorythan parent will allow), then each child cgroup will getthe part of parent’s protection proportional to itsactual memory usage below memory.min.

Putting more memory than generally available under thisprotection is discouraged and may lead to constant OOMs.

If a memory cgroup is not populated with processes,its memory.min is ignored.

memory.low

A read-write single value file which exists on non-rootcgroups. The default is “0”.

Best-effort memory protection. If the memory usage of acgroup is within its effective low boundary, the cgroup’smemory won’t be reclaimed unless there is no reclaimablememory available in unprotected cgroups.Above the effective low boundary (oreffective min boundary if it is higher), pages are reclaimedproportionally to the overage, reducing reclaim pressure forsmaller overages.

Effective low boundary is limited by memory.low values ofall ancestor cgroups. If there is memory.low overcommitment(child cgroup or cgroups are requiring more protected memorythan parent will allow), then each child cgroup will getthe part of parent’s protection proportional to itsactual memory usage below memory.low.

Putting more memory than generally available under thisprotection is discouraged.

memory.high

A read-write single value file which exists on non-rootcgroups. The default is “max”.

Memory usage throttle limit. If a cgroup’s usage goesover the high boundary, the processes of the cgroup arethrottled and put under heavy reclaim pressure.

Going over the high limit never invokes the OOM killer andunder extreme conditions the limit may be breached. The highlimit should be used in scenarios where an external processmonitors the limited cgroup to alleviate heavy reclaimpressure.

If memory.high is opened with O_NONBLOCK then the synchronousreclaim is bypassed. This is useful for admin processes thatneed to dynamically adjust the job’s memory limits withoutexpending their own CPU resources on memory reclamation. Thejob will trigger the reclaim and/or get throttled on itsnext charge request.

Please note that with O_NONBLOCK, there is a chance that thetarget memory cgroup may take indefinite amount of time toreduce usage below the limit due to delayed charge request orbusy-hitting its memory to slow down reclaim.

memory.max

A read-write single value file which exists on non-rootcgroups. The default is “max”.

Memory usage hard limit. This is the main mechanism to limitmemory usage of a cgroup. If a cgroup’s memory usage reachesthis limit and can’t be reduced, the OOM killer is invoked inthe cgroup. Under certain circumstances, the usage may goover the limit temporarily.

In default configuration regular 0-order allocations alwayssucceed unless OOM killer chooses current task as a victim.

Some kinds of allocations don’t invoke the OOM killer.Caller could retry them differently, return into userspaceas -ENOMEM or silently ignore in cases like disk readahead.

If memory.max is opened with O_NONBLOCK, then the synchronousreclaim and oom-kill are bypassed. This is useful for adminprocesses that need to dynamically adjust the job’s memory limitswithout expending their own CPU resources on memory reclamation.The job will trigger the reclaim and/or oom-kill on its nextcharge request.

Please note that with O_NONBLOCK, there is a chance that thetarget memory cgroup may take indefinite amount of time toreduce usage below the limit due to delayed charge request orbusy-hitting its memory to slow down reclaim.

memory.reclaim

A write-only nested-keyed file which exists for all cgroups.

This is a simple interface to trigger memory reclaim in thetarget cgroup.

Example:

echo "1G" > memory.reclaim

Please note that the kernel can over or under reclaim fromthe target cgroup. If less bytes are reclaimed than thespecified amount, -EAGAIN is returned.

Please note that the proactive reclaim (triggered by thisinterface) is not meant to indicate memory pressure on thememory cgroup. Therefore socket memory balancing triggered bythe memory reclaim normally is not exercised in this case.This means that the networking layer will not adapt based onreclaim induced by memory.reclaim.

The following nested keys are defined.

swappiness

Swappiness value to reclaim with

Specifying a swappiness value instructs the kernel to performthe reclaim with that swappiness value. Note that this has thesame semantics as vm.swappiness applied to memcg reclaim withall the existing limitations and potential future extensions.

The valid range for swappiness is [0-200, max], settingswappiness=max exclusively reclaims anonymous memory.

memory.peak

A read-write single value file which exists on non-root cgroups.

The max memory usage recorded for the cgroup and its descendants sinceeither the creation of the cgroup or the most recent reset for that FD.

A write of any non-empty string to this file resets it to thecurrent memory usage for subsequent reads through the samefile descriptor.

memory.oom.group

A read-write single value file which exists on non-rootcgroups. The default value is “0”.

Determines whether the cgroup should be treated asan indivisible workload by the OOM killer. If set,all tasks belonging to the cgroup or to its descendants(if the memory cgroup is not a leaf cgroup) are killedtogether or not at all. This can be used to avoidpartial kills to guarantee workload integrity.

Tasks with the OOM protection (oom_score_adj set to -1000)are treated as an exception and are never killed.

If the OOM killer is invoked in a cgroup, it’s not goingto kill any tasks outside of this cgroup, regardlessmemory.oom.group values of ancestor cgroups.

memory.events

A read-only flat-keyed file which exists on non-root cgroups.The following entries are defined. Unless specifiedotherwise, a value change in this file generates a filemodified event.

Note that all fields in this file are hierarchical and thefile modified event can be generated due to an event down thehierarchy. For the local events at the cgroup level seememory.events.local.

low

The number of times the cgroup is reclaimed due tohigh memory pressure even though its usage is underthe low boundary. This usually indicates that the lowboundary is over-committed.

high

The number of times processes of the cgroup arethrottled and routed to perform direct memory reclaimbecause the high memory boundary was exceeded. For acgroup whose memory usage is capped by the high limitrather than global memory pressure, this event’soccurrences are expected.

max

The number of times the cgroup’s memory usage wasabout to go over the max boundary. If direct reclaimfails to bring it down, the cgroup goes to OOM state.

oom

The number of time the cgroup’s memory usage wasreached the limit and allocation was about to fail.

This event is not raised if the OOM killer is notconsidered as an option, e.g. for failed high-orderallocations or if caller asked to not retry attempts.

oom_kill

The number of processes belonging to this cgroupkilled by any kind of OOM killer.

oom_group_kill

The number of times a group OOM has occurred.

memory.events.local

Similar to memory.events but the fields in the file are localto the cgroup i.e. not hierarchical. The file modified eventgenerated on this file reflects only the local events.

memory.stat

A read-only flat-keyed file which exists on non-root cgroups.

This breaks down the cgroup’s memory footprint into differenttypes of memory, type-specific details, and other informationon the state and past events of the memory management system.

All memory amounts are in bytes.

The entries are ordered to be human readable, and new entriescan show up in the middle. Don’t rely on items remaining in afixed position; use the keys to look up specific values!

If the entry has no per-node counter (or not show in thememory.numa_stat). We use ‘npn’ (non-per-node) as the tagto indicate that it will not show in the memory.numa_stat.

anon

Amount of memory used in anonymous mappings such asbrk(),sbrk(), and mmap(MAP_ANONYMOUS). Note thatsome kernel configurations might account complete largerallocations (e.g., THP) if only some, but not all thememory of such an allocation is mapped anymore.

file

Amount of memory used to cache filesystem data,including tmpfs and shared memory.

kernel (npn)

Amount of total kernel memory, including(kernel_stack, pagetables, percpu, vmalloc, slab) inaddition to other kernel memory use cases.

kernel_stack

Amount of memory allocated to kernel stacks.

pagetables

Amount of memory allocated for page tables.

sec_pagetables

Amount of memory allocated for secondary page tables,this currently includes KVM mmu allocations on x86and arm64 and IOMMU page tables.

percpu (npn)

Amount of memory used for storing per-cpu kerneldata structures.

sock (npn)

Amount of memory used in network transmission buffers

vmalloc (npn)

Amount of memory used for vmap backed memory.

shmem

Amount of cached filesystem data that is swap-backed,such as tmpfs, shm segments, shared anonymous mmap()s

zswap

Amount of memory consumed by the zswap compression backend.

zswapped

Amount of application memory swapped out to zswap.

file_mapped

Amount of cached filesystem data mapped with mmap(). Notethat some kernel configurations might account completelarger allocations (e.g., THP) if only some, but notnot all the memory of such an allocation is mapped.

file_dirty

Amount of cached filesystem data that was modified butnot yet written back to disk

file_writeback

Amount of cached filesystem data that was modified andis currently being written back to disk

swapcached

Amount of swap cached in memory. The swapcache is accountedagainst both memory and swap usage.

anon_thp

Amount of memory used in anonymous mappings backed bytransparent hugepages

file_thp

Amount of cached filesystem data backed by transparenthugepages

shmem_thp

Amount of shm, tmpfs, shared anonymous mmap()s backed bytransparent hugepages

inactive_anon, active_anon, inactive_file, active_file, unevictable

Amount of memory, swap-backed and filesystem-backed,on the internal memory management lists used by thepage reclaim algorithm.

As these represent internal list state (eg. shmem pages are on anonmemory management lists), inactive_foo + active_foo may not be equal tothe value for the foo counter, since the foo counter is type-based, notlist-based.

slab_reclaimable

Part of “slab” that might be reclaimed, such asdentries and inodes.

slab_unreclaimable

Part of “slab” that cannot be reclaimed on memorypressure.

slab (npn)

Amount of memory used for storing in-kernel datastructures.

workingset_refault_anon

Number of refaults of previously evicted anonymous pages.

workingset_refault_file

Number of refaults of previously evicted file pages.

workingset_activate_anon

Number of refaulted anonymous pages that were immediatelyactivated.

workingset_activate_file

Number of refaulted file pages that were immediately activated.

workingset_restore_anon

Number of restored anonymous pages which have been detected asan active workingset before they got reclaimed.

workingset_restore_file

Number of restored file pages which have been detected as anactive workingset before they got reclaimed.

workingset_nodereclaim

Number of times a shadow node has been reclaimed

pswpin (npn)

Number of pages swapped into memory

pswpout (npn)

Number of pages swapped out of memory

pgscan (npn)

Amount of scanned pages (in an inactive LRU list)

pgsteal (npn)

Amount of reclaimed pages

pgscan_kswapd (npn)

Amount of scanned pages by kswapd (in an inactive LRU list)

pgscan_direct (npn)

Amount of scanned pages directly (in an inactive LRU list)

pgscan_khugepaged (npn)

Amount of scanned pages by khugepaged (in an inactive LRU list)

pgscan_proactive (npn)

Amount of scanned pages proactively (in an inactive LRU list)

pgsteal_kswapd (npn)

Amount of reclaimed pages by kswapd

pgsteal_direct (npn)

Amount of reclaimed pages directly

pgsteal_khugepaged (npn)

Amount of reclaimed pages by khugepaged

pgsteal_proactive (npn)

Amount of reclaimed pages proactively

pgfault (npn)

Total number of page faults incurred

pgmajfault (npn)

Number of major page faults incurred

pgrefill (npn)

Amount of scanned pages (in an active LRU list)

pgactivate (npn)

Amount of pages moved to the active LRU list

pgdeactivate (npn)

Amount of pages moved to the inactive LRU list

pglazyfree (npn)

Amount of pages postponed to be freed under memory pressure

pglazyfreed (npn)

Amount of reclaimed lazyfree pages

swpin_zero

Number of pages swapped into memory and filled with zero, where I/Owas optimized out because the page content was detected to be zeroduring swapout.

swpout_zero

Number of zero-filled pages swapped out with I/O skipped due to thecontent being detected as zero.

zswpin

Number of pages moved in to memory from zswap.

zswpout

Number of pages moved out of memory to zswap.

zswpwb

Number of pages written from zswap to swap.

thp_fault_alloc (npn)

Number of transparent hugepages which were allocated to satisfya page fault. This counter is not present when CONFIG_TRANSPARENT_HUGEPAGEis not set.

thp_collapse_alloc (npn)

Number of transparent hugepages which were allocated to allowcollapsing an existing range of pages. This counter is notpresent when CONFIG_TRANSPARENT_HUGEPAGE is not set.

thp_swpout (npn)

Number of transparent hugepages which are swapout in one piecewithout splitting.

thp_swpout_fallback (npn)

Number of transparent hugepages which were split before swapout.Usually because failed to allocate some continuous swap spacefor the huge page.

numa_pages_migrated (npn)

Number of pages migrated by NUMA balancing.

numa_pte_updates (npn)

Number of pages whose page table entries are modified byNUMA balancing to produce NUMA hinting faults on access.

numa_hint_faults (npn)

Number of NUMA hinting faults.

pgdemote_kswapd

Number of pages demoted by kswapd.

pgdemote_direct

Number of pages demoted directly.

pgdemote_khugepaged

Number of pages demoted by khugepaged.

pgdemote_proactive

Number of pages demoted by proactively.

hugetlb

Amount of memory used by hugetlb pages. This metric only showsup if hugetlb usage is accounted for in memory.current (i.e.cgroup is mounted with the memory_hugetlb_accounting option).

memory.numa_stat

A read-only nested-keyed file which exists on non-root cgroups.

This breaks down the cgroup’s memory footprint into differenttypes of memory, type-specific details, and other informationper node on the state of the memory management system.

This is useful for providing visibility into the NUMA localityinformation within an memcg since the pages are allowed to beallocated from any physical node. One of the use case is evaluatingapplication performance by combining this information with theapplication’s CPU allocation.

All memory amounts are in bytes.

The output format of memory.numa_stat is:

type N0=<bytes in node 0> N1=<bytes in node 1> ...

The entries are ordered to be human readable, and new entriescan show up in the middle. Don’t rely on items remaining in afixed position; use the keys to look up specific values!

The entries can refer to the memory.stat.

memory.swap.current

A read-only single value file which exists on non-rootcgroups.

The total amount of swap currently being used by the cgroupand its descendants.

memory.swap.high

A read-write single value file which exists on non-rootcgroups. The default is “max”.

Swap usage throttle limit. If a cgroup’s swap usage exceedsthis limit, all its further allocations will be throttled toallow userspace to implement custom out-of-memory procedures.

This limit marks a point of no return for the cgroup. It is NOTdesigned to manage the amount of swapping a workload doesduring regular operation. Compare to memory.swap.max, whichprohibits swapping past a set amount, but lets the cgroupcontinue unimpeded as long as other memory can be reclaimed.

Healthy workloads are not expected to reach this limit.

memory.swap.peak

A read-write single value file which exists on non-root cgroups.

The max swap usage recorded for the cgroup and its descendants sincethe creation of the cgroup or the most recent reset for that FD.

A write of any non-empty string to this file resets it to thecurrent memory usage for subsequent reads through the samefile descriptor.

memory.swap.max

A read-write single value file which exists on non-rootcgroups. The default is “max”.

Swap usage hard limit. If a cgroup’s swap usage reaches thislimit, anonymous memory of the cgroup will not be swapped out.

memory.swap.events

A read-only flat-keyed file which exists on non-root cgroups.The following entries are defined. Unless specifiedotherwise, a value change in this file generates a filemodified event.

high

The number of times the cgroup’s swap usage was overthe high threshold.

max

The number of times the cgroup’s swap usage was aboutto go over the max boundary and swap allocationfailed.

fail

The number of times swap allocation failed eitherbecause of running out of swap system-wide or maxlimit.

When reduced under the current usage, the existing swapentries are reclaimed gradually and the swap usage may stayhigher than the limit for an extended period of time. Thisreduces the impact on the workload and memory management.

memory.zswap.current

A read-only single value file which exists on non-rootcgroups.

The total amount of memory consumed by the zswap compressionbackend.

memory.zswap.max

A read-write single value file which exists on non-rootcgroups. The default is “max”.

Zswap usage hard limit. If a cgroup’s zswap pool reaches thislimit, it will refuse to take any more stores before existingentries fault back in or are written out to disk.

memory.zswap.writeback

A read-write single value file. The default value is “1”.Note that this setting is hierarchical, i.e. the writeback would beimplicitly disabled for child cgroups if the upper hierarchydoes so.

When this is set to 0, all swapping attempts to swapping devicesare disabled. This included both zswap writebacks, and swapping dueto zswap store failures. If the zswap store failures are recurring(for e.g if the pages are incompressible), users can observereclaim inefficiency after disabling writeback (because the samepages might be rejected again and again).

Note that this is subtly different from setting memory.swap.max to0, as it still allows for pages to be written to the zswap pool.This setting has no effect if zswap is disabled, and swappingis allowed unless memory.swap.max is set to 0.

memory.pressure

A read-only nested-keyed file.

Shows pressure stall information for memory. SeeDocumentation/accounting/psi.rst for details.

Usage Guidelines¶

“memory.high” is the main mechanism to control memory usage.Over-committing on high limit (sum of high limits > available memory)and letting global memory pressure to distribute memory according tousage is a viable strategy.

Because breach of the high limit doesn’t trigger the OOM killer butthrottles the offending cgroup, a management agent has ampleopportunities to monitor and take appropriate actions such as grantingmore memory or terminating the workload.

Determining whether a cgroup has enough memory is not trivial asmemory usage doesn’t indicate whether the workload can benefit frommore memory. For example, a workload which writes data received fromnetwork to a file can use all available memory but can also operate asperformant with a small amount of memory. A measure of memorypressure - how much the workload is being impacted due to lack ofmemory - is necessary to determine whether a workload needs morememory; unfortunately, memory pressure monitoring mechanism isn’timplemented yet.

Memory Ownership¶

A memory area is charged to the cgroup which instantiated it and stayscharged to the cgroup until the area is released. Migrating a processto a different cgroup doesn’t move the memory usages that itinstantiated while in the previous cgroup to the new cgroup.

A memory area may be used by processes belonging to different cgroups.To which cgroup the area will be charged is in-deterministic; however,over time, the memory area is likely to end up in a cgroup which hasenough memory allowance to avoid high reclaim pressure.

If a cgroup sweeps a considerable amount of memory which is expectedto be accessed repeatedly by other cgroups, it may make sense to usePOSIX_FADV_DONTNEED to relinquish the ownership of memory areasbelonging to the affected files to ensure correct memory ownership.

IO Interface Files¶

io.stat

A read-only nested-keyed file.

Lines are keyed by $MAJ:$MIN device numbers and not ordered.The following nested keys are defined.

rbytes	Bytes read
wbytes	Bytes written
rios	Number of read IOs
wios	Number of write IOs
dbytes	Bytes discarded
dios	Number of discard IOs

An example read output follows:

8:16 rbytes=1459200 wbytes=314773504 rios=192 wios=353 dbytes=0 dios=08:0 rbytes=90430464 wbytes=299008000 rios=8950 wios=1252 dbytes=50331648 dios=3021

io.cost.qos

A read-write nested-keyed file which exists only on the rootcgroup.

This file configures the Quality of Service of the IO costmodel based controller (CONFIG_BLK_CGROUP_IOCOST) whichcurrently implements “io.weight” proportional control. Linesare keyed by $MAJ:$MIN device numbers and not ordered. Theline for a given device is populated on the first write forthe device on “io.cost.qos” or “io.cost.model”. The followingnested keys are defined.

enable	Weight-based control enable
ctrl	“auto” or “user”
rpct	Read latency percentile [0, 100]
rlat	Read latency threshold
wpct	Write latency percentile [0, 100]
wlat	Write latency threshold
min	Minimum scaling percentage [1, 10000]
max	Maximum scaling percentage [1, 10000]

The controller is disabled by default and can be enabled bysetting “enable” to 1. “rpct” and “wpct” parameters defaultto zero and the controller uses internal device saturationstate to adjust the overall IO rate between “min” and “max”.

When a better control quality is needed, latency QoSparameters can be configured. For example:

8:16 enable=1 ctrl=auto rpct=95.00 rlat=75000 wpct=95.00 wlat=150000 min=50.00 max=150.0

shows that on sdb, the controller is enabled, will considerthe device saturated if the 95th percentile of read completionlatencies is above 75ms or write 150ms, and adjust the overallIO issue rate between 50% and 150% accordingly.

The lower the saturation point, the better the latency QoS atthe cost of aggregate bandwidth. The narrower the allowedadjustment range between “min” and “max”, the more conformantto the cost model the IO behavior. Note that the IO issuebase rate may be far off from 100% and setting “min” and “max”blindly can lead to a significant loss of device capacity orcontrol quality. “min” and “max” are useful for regulatingdevices which show wide temporary behavior changes - e.g. assd which accepts writes at the line speed for a while andthen completely stalls for multiple seconds.

When “ctrl” is “auto”, the parameters are controlled by thekernel and may change automatically. Setting “ctrl” to “user”or setting any of the percentile and latency parameters putsit into “user” mode and disables the automatic changes. Theautomatic mode can be restored by setting “ctrl” to “auto”.

io.cost.model

A read-write nested-keyed file which exists only on the rootcgroup.

This file configures the cost model of the IO cost model basedcontroller (CONFIG_BLK_CGROUP_IOCOST) which currentlyimplements “io.weight” proportional control. Lines are keyedby $MAJ:$MIN device numbers and not ordered. The line for agiven device is populated on the first write for the device on“io.cost.qos” or “io.cost.model”. The following nested keysare defined.

ctrl	“auto” or “user”
model	The cost model in use - “linear”

When “ctrl” is “auto”, the kernel may change all parametersdynamically. When “ctrl” is set to “user” or any otherparameters are written to, “ctrl” become “user” and theautomatic changes are disabled.

When “model” is “linear”, the following model parameters aredefined.

[r|w]bps	The maximum sequential IO throughput
[r|w]seqiops	The maximum 4k sequential IOs per second
[r|w]randiops	The maximum 4k random IOs per second

From the above, the builtin linear model determines the basecosts of a sequential and random IO and the cost coefficientfor the IO size. While simple, this model can cover mostcommon device classes acceptably.

The IO cost model isn’t expected to be accurate in absolutesense and is scaled to the device behavior dynamically.

If needed, tools/cgroup/iocost_coef_gen.py can be used togenerate device-specific coefficients.

io.weight

A read-write flat-keyed file which exists on non-root cgroups.The default is “default 100”.

The first line is the default weight applied to deviceswithout specific override. The rest are overrides keyed by$MAJ:$MIN device numbers and not ordered. The weights are inthe range [1, 10000] and specifies the relative amount IO timethe cgroup can use in relation to its siblings.

The default weight can be updated by writing either “default$WEIGHT” or simply “$WEIGHT”. Overrides can be set by writing“$MAJ:$MIN $WEIGHT” and unset by writing “$MAJ:$MIN default”.

An example read output follows:

default 1008:16 2008:0 50

io.max

A read-write nested-keyed file which exists on non-rootcgroups.

BPS and IOPS based IO limit. Lines are keyed by $MAJ:$MINdevice numbers and not ordered. The following nested keys aredefined.

rbps	Max read bytes per second
wbps	Max write bytes per second
riops	Max read IO operations per second
wiops	Max write IO operations per second

When writing, any number of nested key-value pairs can bespecified in any order. “max” can be specified as the valueto remove a specific limit. If the same key is specifiedmultiple times, the outcome is undefined.

BPS and IOPS are measured in each IO direction and IOs aredelayed if limit is reached. Temporary bursts are allowed.

Setting read limit at 2M BPS and write at 120 IOPS for 8:16:

echo "8:16 rbps=2097152 wiops=120" > io.max

Reading returns the following:

8:16 rbps=2097152 wbps=max riops=max wiops=120

Write IOPS limit can be removed by writing the following:

echo "8:16 wiops=max" > io.max

Reading now returns the following:

8:16 rbps=2097152 wbps=max riops=max wiops=max

io.pressure

A read-only nested-keyed file.

Shows pressure stall information for IO. SeeDocumentation/accounting/psi.rst for details.

Writeback¶

Page cache is dirtied through buffered writes and shared mmaps andwritten asynchronously to the backing filesystem by the writebackmechanism. Writeback sits between the memory and IO domains andregulates the proportion of dirty memory by balancing dirtying andwrite IOs.

The io controller, in conjunction with the memory controller,implements control of page cache writeback IOs. The memory controllerdefines the memory domain that dirty memory ratio is calculated andmaintained for and the io controller defines the io domain whichwrites out dirty pages for the memory domain. Both system-wide andper-cgroup dirty memory states are examined and the more restrictiveof the two is enforced.

cgroup writeback requires explicit support from the underlyingfilesystem. Currently, cgroup writeback is implemented on ext2, ext4,btrfs, f2fs, and xfs. On other filesystems, all writeback IOs areattributed to the root cgroup.

There are inherent differences in memory and writeback managementwhich affects how cgroup ownership is tracked. Memory is tracked perpage while writeback per inode. For the purpose of writeback, aninode is assigned to a cgroup and all IO requests to write dirty pagesfrom the inode are attributed to that cgroup.

As cgroup ownership for memory is tracked per page, there can be pageswhich are associated with different cgroups than the one the inode isassociated with. These are called foreign pages. The writebackconstantly keeps track of foreign pages and, if a particular foreigncgroup becomes the majority over a certain period of time, switchesthe ownership of the inode to that cgroup.

While this model is enough for most use cases where a given inode ismostly dirtied by a single cgroup even when the main writing cgroupchanges over time, use cases where multiple cgroups write to a singleinode simultaneously are not supported well. In such circumstances, asignificant portion of IOs are likely to be attributed incorrectly.As memory controller assigns page ownership on the first use anddoesn’t update it until the page is released, even if writebackstrictly follows page ownership, multiple cgroups dirtying overlappingareas wouldn’t work as expected. It’s recommended to avoid such usagepatterns.

The sysctl knobs which affect writeback behavior are applied to cgroupwriteback as follows.

vm.dirty_background_ratio, vm.dirty_ratio

These ratios apply the same to cgroup writeback with theamount of available memory capped by limits imposed by thememory controller and system-wide clean memory.

vm.dirty_background_bytes, vm.dirty_bytes

For cgroup writeback, this is calculated into ratio againsttotal available memory and applied the same way asvm.dirty[_background]_ratio.

IO Latency¶

This is a cgroup v2 controller for IO workload protection. You provide a groupwith a latency target, and if the average latency exceeds that target thecontroller will throttle any peers that have a lower latency target than theprotected workload.

The limits are only applied at the peer level in the hierarchy. This means thatin the diagram below, only groups A, B, and C will influence each other, andgroups D and F will influence each other. Group G will influence nobody:

          [root]  /          |            \  A          B            C /  \        |D    F       G

So the ideal way to configure this is to set io.latency in groups A, B, and C.Generally you do not want to set a value lower than the latency your devicesupports. Experiment to find the value that works best for your workload.Start at higher than the expected latency for your device and watch theavg_lat value in io.stat for your workload group to get an idea of thelatency you see during normal operation. Use the avg_lat value as a basis foryour real setting, setting at 10-15% higher than the value in io.stat.

How IO Latency Throttling Works¶

io.latency is work conserving; so as long as everybody is meeting their latencytarget the controller doesn’t do anything. Once a group starts missing itstarget it begins throttling any peer group that has a higher target than itself.This throttling takes 2 forms:

• Queue depth throttling. This is the number of outstanding IO’s a group isallowed to have. We will clamp down relatively quickly, starting at no limitand going all the way down to 1 IO at a time.

• Artificial delay induction. There are certain types of IO that cannot bethrottled without possibly adversely affecting higher priority groups. Thisincludes swapping and metadata IO. These types of IO are allowed to occurnormally, however they are “charged” to the originating group. If theoriginating group is being throttled you will see the use_delay and delayfields in io.stat increase. The delay value is how many microseconds that arebeing added to any process that runs in this group. Because this number cangrow quite large if there is a lot of swapping or metadata IO occurring welimit the individual delay events to 1 second at a time.

Once the victimized group starts meeting its latency target again it will startunthrottling any peer groups that were throttled previously. If the victimizedgroup simply stops doing IO the global counter will unthrottle appropriately.

IO Latency Interface Files¶

io.latency

This takes a similar format as the other controllers.

“MAJOR:MINOR target=<target time in microseconds>”

io.stat

If the controller is enabled you will see extra stats in io.stat inaddition to the normal ones.

depth

This is the current queue depth for the group.

avg_lat

This is an exponential moving average with a decay rate of 1/expbound by the sampling interval. The decay rate interval can becalculated by multiplying the win value in io.stat by thecorresponding number of samples based on the win value.

win

The sampling window size in milliseconds. This is the minimumduration of time between evaluation events. Windows only elapsewith IO activity. Idle periods extend the most recent window.

IO Priority¶

A single attribute controls the behavior of the I/O priority cgroup policy,namely the io.prio.class attribute. The following values are accepted forthat attribute:

no-change

Do not modify the I/O priority class.

promote-to-rt

For requests that have a non-RT I/O priority class, change it into RT.Also change the priority level of these requests to 4. Do not modifythe I/O priority of requests that have priority class RT.

restrict-to-be

For requests that do not have an I/O priority class or that have I/Opriority class RT, change it into BE. Also change the priority levelof these requests to 0. Do not modify the I/O priority class ofrequests that have priority class IDLE.

idle

Change the I/O priority class of all requests into IDLE, the lowestI/O priority class.

none-to-rt

Deprecated. Just an alias for promote-to-rt.

The following numerical values are associated with the I/O priority policies:

The numerical value that corresponds to each I/O priority class is as follows:

The algorithm to set the I/O priority class for a request is as follows:

• If I/O priority class policy is promote-to-rt, change the request I/Opriority class to IOPRIO_CLASS_RT and change the request I/O prioritylevel to 4.

• If I/O priority class policy is not promote-to-rt, translate the I/O priorityclass policy into a number, then change the request I/O priority classinto the maximum of the I/O priority class policy number and the numericalI/O priority class.

PID Interface Files¶

pids.max

A read-write single value file which exists on non-rootcgroups. The default is “max”.

Hard limit of number of processes.

pids.current

A read-only single value file which exists on non-root cgroups.

The number of processes currently in the cgroup and itsdescendants.

pids.peak

A read-only single value file which exists on non-root cgroups.

The maximum value that the number of processes in the cgroup and itsdescendants has ever reached.

pids.events

A read-only flat-keyed file which exists on non-root cgroups. Unlessspecified otherwise, a value change in this file generates a filemodified event. The following entries are defined.

max

The number of times the cgroup’s total number of processes hit the pids.maxlimit (see also pids_localevents).

pids.events.local

Similar to pids.events but the fields in the file are localto the cgroup i.e. not hierarchical. The file modified eventgenerated on this file reflects only the local events.

Organisational operations are not blocked by cgroup policies, so it ispossible to have pids.current > pids.max. This can be done by eithersetting the limit to be smaller than pids.current, or attaching enoughprocesses to the cgroup such that pids.current is larger thanpids.max. However, it is not possible to violate a cgroup PID policythrough fork() or clone(). These will return -EAGAIN if the creationof a new process would cause a cgroup policy to be violated.

Cpuset Interface Files¶

cpuset.cpus

A read-write multiple values file which exists on non-rootcpuset-enabled cgroups.

It lists the requested CPUs to be used by tasks within thiscgroup. The actual list of CPUs to be granted, however, issubjected to constraints imposed by its parent and can differfrom the requested CPUs.

The CPU numbers are comma-separated numbers or ranges.For example:

# cat cpuset.cpus0-4,6,8-10

An empty value indicates that the cgroup is using the samesetting as the nearest cgroup ancestor with a non-empty“cpuset.cpus” or all the available CPUs if none is found.

The value of “cpuset.cpus” stays constant until the next updateand won’t be affected by any CPU hotplug events.

cpuset.cpus.effective

A read-only multiple values file which exists on allcpuset-enabled cgroups.

It lists the onlined CPUs that are actually granted to thiscgroup by its parent. These CPUs are allowed to be used bytasks within the current cgroup.

If “cpuset.cpus” is empty, the “cpuset.cpus.effective” file showsall the CPUs from the parent cgroup that can be available tobe used by this cgroup. Otherwise, it should be a subset of“cpuset.cpus” unless none of the CPUs listed in “cpuset.cpus”can be granted. In this case, it will be treated just like anempty “cpuset.cpus”.

Its value will be affected by CPU hotplug events.

cpuset.mems

A read-write multiple values file which exists on non-rootcpuset-enabled cgroups.

It lists the requested memory nodes to be used by tasks withinthis cgroup. The actual list of memory nodes granted, however,is subjected to constraints imposed by its parent and can differfrom the requested memory nodes.

The memory node numbers are comma-separated numbers or ranges.For example:

# cat cpuset.mems0-1,3

An empty value indicates that the cgroup is using the samesetting as the nearest cgroup ancestor with a non-empty“cpuset.mems” or all the available memory nodes if noneis found.

The value of “cpuset.mems” stays constant until the next updateand won’t be affected by any memory nodes hotplug events.

Setting a non-empty value to “cpuset.mems” causes memory oftasks within the cgroup to be migrated to the designated nodes ifthey are currently using memory outside of the designated nodes.

There is a cost for this memory migration. The migrationmay not be complete and some memory pages may be left behind.So it is recommended that “cpuset.mems” should be set properlybefore spawning new tasks into the cpuset. Even if there isa need to change “cpuset.mems” with active tasks, it shouldn’tbe done frequently.

cpuset.mems.effective

A read-only multiple values file which exists on allcpuset-enabled cgroups.

It lists the onlined memory nodes that are actually granted tothis cgroup by its parent. These memory nodes are allowed tobe used by tasks within the current cgroup.

If “cpuset.mems” is empty, it shows all the memory nodes from theparent cgroup that will be available to be used by this cgroup.Otherwise, it should be a subset of “cpuset.mems” unless none ofthe memory nodes listed in “cpuset.mems” can be granted. In thiscase, it will be treated just like an empty “cpuset.mems”.

Its value will be affected by memory nodes hotplug events.

cpuset.cpus.exclusive

A read-write multiple values file which exists on non-rootcpuset-enabled cgroups.

It lists all the exclusive CPUs that are allowed to be usedto create a new cpuset partition. Its value is not usedunless the cgroup becomes a valid partition root. See the“cpuset.cpus.partition” section below for a description of whata cpuset partition is.

When the cgroup becomes a partition root, the actual exclusiveCPUs that are allocated to that partition are listed in“cpuset.cpus.exclusive.effective” which may be differentfrom “cpuset.cpus.exclusive”. If “cpuset.cpus.exclusive”has previously been set, “cpuset.cpus.exclusive.effective”is always a subset of it.

Users can manually set it to a value that is different from“cpuset.cpus”. One constraint in setting it is that the list ofCPUs must be exclusive with respect to “cpuset.cpus.exclusive”of its sibling. If “cpuset.cpus.exclusive” of a sibling cgroupisn’t set, its “cpuset.cpus” value, if set, cannot be a subsetof it to leave at least one CPU available when the exclusiveCPUs are taken away.

For a parent cgroup, any one of its exclusive CPUs can onlybe distributed to at most one of its child cgroups. Having anexclusive CPU appearing in two or more of its child cgroups isnot allowed (the exclusivity rule). A value that violates theexclusivity rule will be rejected with a write error.

The root cgroup is a partition root and all its available CPUsare in its exclusive CPU set.

cpuset.cpus.exclusive.effective

A read-only multiple values file which exists on all non-rootcpuset-enabled cgroups.

This file shows the effective set of exclusive CPUs thatcan be used to create a partition root. The contentof this file will always be a subset of its parent’s“cpuset.cpus.exclusive.effective” if its parent is not the rootcgroup. It will also be a subset of “cpuset.cpus.exclusive”if it is set. If “cpuset.cpus.exclusive” is not set, it istreated to have an implicit value of “cpuset.cpus” in theformation of local partition.

cpuset.cpus.isolated

A read-only and root cgroup only multiple values file.

This file shows the set of all isolated CPUs used in existingisolated partitions. It will be empty if no isolated partitionis created.

cpuset.cpus.partition

A read-write single value file which exists on non-rootcpuset-enabled cgroups. This flag is owned by the parent cgroupand is not delegatable.

It accepts only the following input values when written to.

“member”	Non-root member of a partition
“root”	Partition root
“isolated”	Partition root without load balancing

A cpuset partition is a collection of cpuset-enabled cgroups witha partition root at the top of the hierarchy and its descendantsexcept those that are separate partition roots themselves andtheir descendants. A partition has exclusive access to theset of exclusive CPUs allocated to it. Other cgroups outsideof that partition cannot use any CPUs in that set.

There are two types of partitions - local and remote. A localpartition is one whose parent cgroup is also a valid partitionroot. A remote partition is one whose parent cgroup is not avalid partition root itself. Writing to “cpuset.cpus.exclusive”is optional for the creation of a local partition as its“cpuset.cpus.exclusive” file will assume an implicit value thatis the same as “cpuset.cpus” if it is not set. Writing theproper “cpuset.cpus.exclusive” values down the cgroup hierarchybefore the target partition root is mandatory for the creationof a remote partition.

Currently, a remote partition cannot be created under a localpartition. All the ancestors of a remote partition root exceptthe root cgroup cannot be a partition root.

The root cgroup is always a partition root and its state cannotbe changed. All other non-root cgroups start out as “member”.

When set to “root”, the current cgroup is the root of a newpartition or scheduling domain. The set of exclusive CPUs isdetermined by the value of its “cpuset.cpus.exclusive.effective”.

When set to “isolated”, the CPUs in that partition will be inan isolated state without any load balancing from the schedulerand excluded from the unbound workqueues. Tasks placed in sucha partition with multiple CPUs should be carefully distributedand bound to each of the individual CPUs for optimal performance.

A partition root (“root” or “isolated”) can be in one of thetwo possible states - valid or invalid. An invalid partitionroot is in a degraded state where some state information maybe retained, but behaves more like a “member”.

All possible state transitions among “member”, “root” and“isolated” are allowed.

On read, the “cpuset.cpus.partition” file can show the followingvalues.

“member”	Non-root member of a partition
“root”	Partition root
“isolated”	Partition root without load balancing
“root invalid (<reason>)”	Invalid partition root
“isolated invalid (<reason>)”	Invalid isolated partition root

In the case of an invalid partition root, a descriptive string onwhy the partition is invalid is included within parentheses.

For a local partition root to be valid, the following conditionsmust be met.

1. The parent cgroup is a valid partition root.

2. The “cpuset.cpus.exclusive.effective” file cannot be empty,though it may contain offline CPUs.

3. The “cpuset.cpus.effective” cannot be empty unless there isno task associated with this partition.

For a remote partition root to be valid, all the above conditionsexcept the first one must be met.

External events like hotplug or changes to “cpuset.cpus” or“cpuset.cpus.exclusive” can cause a valid partition root tobecome invalid and vice versa. Note that a task cannot bemoved to a cgroup with empty “cpuset.cpus.effective”.

A valid non-root parent partition may distribute out all its CPUsto its child local partitions when there is no task associatedwith it.

Care must be taken to change a valid partition root to “member”as all its child local partitions, if present, will becomeinvalid causing disruption to tasks running in those childpartitions. These inactivated partitions could be recovered iftheir parent is switched back to a partition root with a propervalue in “cpuset.cpus” or “cpuset.cpus.exclusive”.

Poll and inotify events are triggered whenever the state of“cpuset.cpus.partition” changes. That includes changes causedby write to “cpuset.cpus.partition”, cpu hotplug or otherchanges that modify the validity status of the partition.This will allow user space agents to monitor unexpected changesto “cpuset.cpus.partition” without the need to do continuouspolling.

A user can pre-configure certain CPUs to an isolated statewith load balancing disabled at boot time with the “isolcpus”kernel boot command line option. If those CPUs are to be putinto a partition, they have to be used in an isolated partition.

RDMA Interface Files¶

rdma.max

A readwrite nested-keyed file that exists for all the cgroupsexcept root that describes current configured resource limitfor a RDMA/IB device.

Lines are keyed by device name and are not ordered.Each line contains space separated resource name and its configuredlimit that can be distributed.

The following nested keys are defined.

hca_handle	Maximum number of HCA Handles
hca_object	Maximum number of HCA Objects

An example for mlx4 and ocrdma device follows:

mlx4_0 hca_handle=2 hca_object=2000ocrdma1 hca_handle=3 hca_object=max

rdma.current

A read-only file that describes current resource usage.It exists for all the cgroup except root.

An example for mlx4 and ocrdma device follows:

mlx4_0 hca_handle=1 hca_object=20ocrdma1 hca_handle=1 hca_object=23

DMEM Interface Files¶

dmem.max, dmem.min, dmem.low

A readwrite nested-keyed file that exists for all the cgroupsexcept root that describes current configured resource limitfor a region.

An example for xe follows:

drm/0000:03:00.0/vram0 1073741824drm/0000:03:00.0/stolen max

The semantics are the same as for the memory cgroup controller, and arecalculated in the same way.

dmem.capacity

A read-only file that describes maximum region capacity.It only exists on the root cgroup. Not all memory can beallocated by cgroups, as the kernel reserves some forinternal use.

An example for xe follows:

drm/0000:03:00.0/vram0 8514437120drm/0000:03:00.0/stolen 67108864

dmem.current

A read-only file that describes current resource usage.It exists for all the cgroup except root.

An example for xe follows:

drm/0000:03:00.0/vram0 12550144drm/0000:03:00.0/stolen 8650752

HugeTLB Interface Files¶

hugetlb.<hugepagesize>.current

Show current usage for “hugepagesize” hugetlb. It exists for allthe cgroup except root.

hugetlb.<hugepagesize>.max

Set/show the hard limit of “hugepagesize” hugetlb usage.The default value is “max”. It exists for all the cgroup except root.

hugetlb.<hugepagesize>.events

A read-only flat-keyed file which exists on non-root cgroups.

max

The number of allocation failure due to HugeTLB limit

hugetlb.<hugepagesize>.events.local

Similar to hugetlb.<hugepagesize>.events but the fields in the fileare local to the cgroup i.e. not hierarchical. The file modified eventgenerated on this file reflects only the local events.

hugetlb.<hugepagesize>.numa_stat

Similar to memory.numa_stat, it shows the numa information of thehugetlb pages of <hugepagesize> in this cgroup. Only active inuse hugetlb pages are included. The per-node values are in bytes.

Misc Interface Files¶

Miscellaneous controller provides 3 interface files. If two misc resources (res_a and res_b) are registered then:

misc.capacity

A read-only flat-keyed file shown only in the root cgroup. It showsmiscellaneous scalar resources available on the platform along withtheir quantities:

$ cat misc.capacityres_a 50res_b 10

misc.current

A read-only flat-keyed file shown in the all cgroups. It showsthe current usage of the resources in the cgroup and its children.:

$ cat misc.currentres_a 3res_b 0

misc.peak

A read-only flat-keyed file shown in all cgroups. It shows thehistorical maximum usage of the resources in the cgroup and itschildren.:

$ cat misc.peakres_a 10res_b 8

misc.max

A read-write flat-keyed file shown in the non root cgroups. Allowedmaximum usage of the resources in the cgroup and its children.:

$ cat misc.maxres_a maxres_b 4

Limit can be set by:

# echo res_a 1 > misc.max

Limit can be set to max by:

# echo res_a max > misc.max

Limits can be set higher than the capacity value in the misc.capacityfile.

misc.events

A read-only flat-keyed file which exists on non-root cgroups. Thefollowing entries are defined. Unless specified otherwise, a valuechange in this file generates a file modified event. All fields inthis file are hierarchical.

max

The number of times the cgroup’s resource usage wasabout to go over the max boundary.

misc.events.local

Similar to misc.events but the fields in the file are local to thecgroup i.e. not hierarchical. The file modified event generated onthis file reflects only the local events.

Migration and Ownership¶

A miscellaneous scalar resource is charged to the cgroup in which it is usedfirst, and stays charged to that cgroup until that resource is freed. Migratinga process to a different cgroup does not move the charge to the destinationcgroup where the process has moved.

perf_event¶

perf_event controller, if not mounted on a legacy hierarchy, isautomatically enabled on the v2 hierarchy so that perf events canalways be filtered by cgroup v2 path. The controller can still bemoved to a legacy hierarchy after v2 hierarchy is populated.

CPU controller root cgroup process behaviour¶

When distributing CPU cycles in the root cgroup each thread in thiscgroup is treated as if it was hosted in a separate child cgroup of theroot cgroup. This child cgroup weight is dependent on its thread nicelevel.

For details of this mapping see sched_prio_to_weight array inkernel/sched/core.c file (values from this array should be scaledappropriately so the neutral - nice 0 - value is 100 instead of 1024).

IO controller root cgroup process behaviour¶

Root cgroup processes are hosted in an implicit leaf child node.When distributing IO resources this implicit child node is taken intoaccount as if it was a normal child cgroup of the root cgroup with aweight value of 200.

Memory¶

The original lower boundary, the soft limit, is defined as a limitthat is per default unset. As a result, the set of cgroups thatglobal reclaim prefers is opt-in, rather than opt-out. The costs foroptimizing these mostly negative lookups are so high that theimplementation, despite its enormous size, does not even provide thebasic desirable behavior. First off, the soft limit has nohierarchical meaning. All configured groups are organized in a globalrbtree and treated like equal peers, regardless where they are locatedin the hierarchy. This makes subtree delegation impossible. Second,the soft limit reclaim pass is so aggressive that it not justintroduces high allocation latencies into the system, but also impactssystem performance due to overreclaim, to the point where the featurebecomes self-defeating.

The memory.low boundary on the other hand is a top-down allocatedreserve. A cgroup enjoys reclaim protection when it’s within itseffective low, which makes delegation of subtrees possible. It alsoenjoys having reclaim pressure proportional to its overage whenabove its effective low.

The original high boundary, the hard limit, is defined as a strictlimit that can not budge, even if the OOM killer has to be called.But this generally goes against the goal of making the most out of theavailable memory. The memory consumption of workloads varies duringruntime, and that requires users to overcommit. But doing that with astrict upper limit requires either a fairly accurate prediction of theworking set size or adding slack to the limit. Since working set sizeestimation is hard and error prone, and getting it wrong results inOOM kills, most users tend to err on the side of a looser limit andend up wasting precious resources.

The memory.high boundary on the other hand can be set much moreconservatively. When hit, it throttles allocations by forcing theminto direct reclaim to work off the excess, but it never invokes theOOM killer. As a result, a high boundary that is chosen tooaggressively will not terminate the processes, but instead it willlead to gradual performance degradation. The user can monitor thisand make corrections until the minimal memory footprint that stillgives acceptable performance is found.

In extreme cases, with many concurrent allocations and a completebreakdown of reclaim progress within the group, the high boundary canbe exceeded. But even then it’s mostly better to satisfy theallocation from the slack available in other groups or the rest of thesystem than killing the group. Otherwise, memory.max is there tolimit this type of spillover and ultimately contain buggy or evenmalicious applications.

Setting the original memory.limit_in_bytes below the current usage wassubject to a race condition, where concurrent charges could cause thelimit setting to fail. memory.max on the other hand will first set thelimit to prevent new charges, and then reclaim and OOM kill until thenew limit is met - or the task writing to memory.max is killed.

The combined memory+swap accounting and limiting is replaced by realcontrol over swap space.

The main argument for a combined memory+swap facility in the originalcgroup design was that global or parental pressure would always beable to swap all anonymous memory of a child group, regardless of thechild’s own (possibly untrusted) configuration. However, untrustedgroups can sabotage swapping by other means - such as referencing itsanonymous memory in a tight loop - and an admin can not assume fullswappability when overcommitting untrusted jobs.

For trusted jobs, on the other hand, a combined counter is not anintuitive userspace interface, and it flies in the face of the ideathat cgroup controllers should account and limit specific physicalresources. Swap space is a resource like all others in the system,and that’s why unified hierarchy allows distributing it separately.