mlock

mlock is a system call in Unix-like operating systems that locks a portion of a process's virtual address space into physical RAM. By doing so, the locked pages are prevented from being paged out to swap, which helps protect sensitive data from being written to disk and reduce latency for critical workloads. Common use cases include handling cryptographic keys, passwords, and other secret material in memory.

On Linux, mlock takes a pointer and length. It requires appropriate privileges to lock memory, typically the CAP_IPC_LOCK capability, and the task's locked memory must not exceed the process limits defined by RLIMIT_MEMLOCK. If the limit is reached or memory allocation fails, the call fails with an error such as ENOMEM.

Programs can also lock all current and future memory using mlockall with flags such as MCL_CURRENT and MCL_FUTURE. A newer interface, mlock2, provides additional control through flags such as MLOCK_ONFAULT to fine tune when pages are locked.

Locked memory remains resident for as long as the lock is active or until it is explicitly unlocked with munlock or munlockall; failing to unlock can lead to sustained RAM usage and potential memory pressure. Locked pages are not inherently protected from being read by other processes; hardware and kernel security features still apply. Locking memory should be used judiciously, especially on systems with limited RAM, to avoid contributing to memory pressure or an out-of-memory condition.