- When mlockall() is invoked with the MCL_FUTURE flag, the VM_LOCKED flag is set in the task's mm_struct (current->mm->def_flags) - In the brk() system call, if current->mm->def_flags & VM_LOCKED then mm_populate() is invoked + mm_populate() -> mm/gup.c::__mm_populate() ("gup" stands for get user pages) + __mm_populate() finds the vma (virtual memory region) for each address to populate, and then invokes populate_vma_page_range() + populate_vma_page_range() -> __get_user_pages() + __get_user_pages() ends up doing "page = follow_page_mask()" to search for a physical page in the (hierarchical!) page table + If the page is not mapped yet, follow_page_mask() will return NULL and faultin_page() is invoked + If faultin_page() does not fail (if it returns 0), then follow_page_mask() is tried again, and this time it will return a physical page! - faultin_page() -> handle_mm_fault() which allocates a page (see the page fault callchain)