From nobody Fri Oct 2 02:31:13 2026 Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9EE4447D937 for ; Wed, 5 Aug 2026 15:28:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785943712; cv=none; b=PGuVB8cVy8VgG+qdMwRmHL55RX6MA+RwQK8iYkkjnUzfCjbyEQVK3B+IxHvTuuNL3HKGwz+ayWKhS6t2mdG0b2Ec37xx0L/4ase1APnUZTp9SCIT4PiEQlSQwi0cD41nTlYCx0qO2RuzsX0jDU4M0QmpUIj2ehq6IGc9U746ydc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785943712; c=relaxed/simple; bh=e5TaypcDZGoKtjzw7J398Slabwijc1jx4PZ1Qj+8Vfc=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=DUQh4UHjQfFg3SYb/s6pXUwZ9migk2LTvVbpmu98HdA/MuOplOQ8ASJF5BwULAbEIE6+83U0QtqZnN09UwGnv95z0Ghx1o0Yhb5bS9ko7p7h5wW9rzhXfV/Yj4SaG/FIUZ7Qb9LgjYIIUUz2ELd9gP5yNjJ6tNw/B4XdsOO/LO8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Q88GzCvT; arc=none smtp.client-ip=209.85.214.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Q88GzCvT" Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2cf52d15d88so11337835ad.2 for ; Wed, 05 Aug 2026 08:28:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785943691; x=1786548491; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=88ycvHzA5bLdolcFklKaKBNgDY+xCirEciwG1J4iSFk=; b=Q88GzCvTFJnI+7rOY67R4oovYWZzpw5TWN8CVu0zWWWB+Mr1yxgm4XRa9/wbXHVvDQ IvWI4T1sUe6Bk25MScMzIhqsBIuUcGY5SSmXU21dmSmFJbYvmNxzQZuRGAs349JbePI9 0yEcx2SGthQYDdXkaKSPVrCXOpxbubz5900d9JjMXiRqxkPqGsu3KGoikLmSozlb75HE loylLnDJvuptOw6Db9FfTGGNpuJF9ENNbiw/3Lpy6VlPTnuj/UEQwPO+faemKGxlPebr Xzr3PxPC6xg39XDwc/YWFqZyhOKdhl72zGjMnEGqOEUp0lKe0VUhit1KDn7uxa8AwWio iDZg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785943691; x=1786548491; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=88ycvHzA5bLdolcFklKaKBNgDY+xCirEciwG1J4iSFk=; b=JILZW+3g2ni1jWgonHVgC2SGnv8gV2NHd8D0QhIYhm0HGb1JFj2XCWnal5WICSgtRI J30Jfa32SuyJD3NiGyXpybFlIKaRldkwOOuaPkhNIEtu/5fYVEbX6Lxp6GmE2T4cS6Fs UML8RPXHuFvBG+D+3uqq2kMy/yZaKVacDHyT3l+2KThxEPzS9lAi3rdCloJhBmzBXgAH 66SQxUCKsJOej1VDPAlViIWa5Ujd6vd9KIEz+CmUjpnnyRoNQN85824ZWTaqgIgZkJG9 b6OD1XFmit4wjJfLvv4aJSYdUTdWhkMtcheNqLixOnUB12FLP0G1mQ/B3KeV28MhJxRM T+Hg== X-Forwarded-Encrypted: i=1; AHgh+RrS6z/svFdZvfBTaZDMUcc+Lky6ooGg5en3ACzbE550TgxV8fHxhh828+KpZn1wyTv51FL1FubDU+DJK6Q=@vger.kernel.org X-Gm-Message-State: AOJu0YzA0mbwtUqZ5Bpi8AzEA7i301s5WHMRIOxloEgrtGII5ofxT08H eL4xFNkqn7Cvpd1BUfhfgKng0y/h3fqWsP0ad1AgTEtMeDCf9M6b0n3q X-Gm-Gg: AR+sD106sM5xeWWqAgrMpIgCUt+1uTMHiq5qeDyNcb8n0WvHzM55I4PIV2zoCJXN8p4 dWj81/+z4sFukoWF+ExoM8b4sG7hDV8QG9kX7EGBUPPpTF9F8Tw5od34zuzzziZAP+XXxTYkL0x Pa9IFHMveWCYcXFQb2WWkSygKsZZ8+DMJxdRElpIHHKd4d/zc8ARjiLb7nv4ZiZfGPHusPVq3gD dELn6erM8rnkQbjJIePZMnKOuylepFTqKeURVaUTMnYAUSmfr1MMIRFGzVY8twTgvanLj0tWst6 JyhXbdYxtzSgC1EN1CJLZyweP1bLLYYP7eKpmVSZDmv2EVaWVXrhMoiUxvc8Qft9q5/6tmRgxcW BRGnOkyoaLUXoJ9gLNoOfBdHHzM4rkHVeQVSeY9bhrCdH52chmmG1uyGTEssJ7/xLlJBvKiC1qb E+qUxRK1q+XhD/pwIMiN9EV3V+hIh0hyhNagNjXuXtBSKf5CL7/STEI/G+gfLbSlUD4IKnHmshS hLvWQ== X-Received: by 2002:a17:902:e542:b0:2c9:c991:6ed3 with SMTP id d9443c01a7336-2d0ca7fbb60mr79342805ad.12.1785943691385; Wed, 05 Aug 2026 08:28:11 -0700 (PDT) Received: from zhangbo56-PC.mioffice.cn ([43.224.245.235]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d0aa49726csm18155625ad.51.2026.08.05.08.28.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 05 Aug 2026 08:28:10 -0700 (PDT) From: Bo Zhang X-Google-Original-From: Bo Zhang To: gregkh@linuxfoundation.org, cmllamas@google.com, aliceryhl@google.com Cc: arve@android.com, tkjos@android.com, christian@brauner.io, surenb@google.com, baohua@kernel.org, zhanghongru06@gmail.com, linux-kernel@vger.kernel.org, Bo Zhang Subject: [RFC PATCH 1/1] binder: switch alloc->mutex back to spinlock Date: Wed, 5 Aug 2026 23:27:52 +0800 Message-Id: <20260805152752.1924434-2-zhangbo56@xiaomi.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260805152752.1924434-1-zhangbo56@xiaomi.com> References: <20260805152752.1924434-1-zhangbo56@xiaomi.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The alloc->mutex was restored by commit 8b52c7261e04 ("Revert binder: switch alloc->mutex to spinlock_t") to allow zap_vma_range() to be called under the lock in the shrinker path. However, holding the lock across zap_vma_range() is unnecessary because synchronization between page installation and zap is already guaranteed by the PTE lock. Move spin_unlock() before zap_vma_range() and convert the mutex back to a spinlock. This eliminates priority inversion where a low-priority task holding the mutex sleeps, blocking high-priority binder transactions. Performance (binderThroughputTest, SM8850, 2 workers, 10 runs): mutex spinlock throughput: 27k-59k iter/s 79k-84k iter/s average: 0.031-0.068ms 0.022-0.023ms P99: 0.088-0.148ms 0.050-0.062ms Signed-off-by: Bo Zhang --- drivers/android/binder_alloc.c | 36 +++++++++++++++++----------------- drivers/android/binder_alloc.h | 8 ++++---- 2 files changed, 22 insertions(+), 22 deletions(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index e4488ad86a65..9775df3616aa 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -169,7 +169,7 @@ static struct binder_buffer *binder_alloc_prepare_to_fr= ee_locked( struct binder_buffer *binder_alloc_prepare_to_free(struct binder_alloc *al= loc, unsigned long user_ptr) { - guard(mutex)(&alloc->mutex); + guard(spinlock)(&alloc->lock); return binder_alloc_prepare_to_free_locked(alloc, user_ptr); } =20 @@ -676,10 +676,10 @@ struct binder_buffer *binder_alloc_new_buf(struct bin= der_alloc *alloc, if (!next) return ERR_PTR(-ENOMEM); =20 - mutex_lock(&alloc->mutex); + spin_lock(&alloc->lock); buffer =3D binder_alloc_new_buf_locked(alloc, next, size, is_async); if (IS_ERR(buffer)) { - mutex_unlock(&alloc->mutex); + spin_unlock(&alloc->lock); goto out; } =20 @@ -687,7 +687,7 @@ struct binder_buffer *binder_alloc_new_buf(struct binde= r_alloc *alloc, buffer->offsets_size =3D offsets_size; buffer->extra_buffers_size =3D extra_buffers_size; buffer->pid =3D current->tgid; - mutex_unlock(&alloc->mutex); + spin_unlock(&alloc->lock); =20 ret =3D binder_install_buffer_pages(alloc, buffer, size); if (ret) { @@ -872,9 +872,9 @@ void binder_alloc_free_buf(struct binder_alloc *alloc, binder_alloc_clear_buf(alloc, buffer); buffer->clear_on_free =3D false; } - mutex_lock(&alloc->mutex); + spin_lock(&alloc->lock); binder_free_buf_locked(alloc, buffer); - mutex_unlock(&alloc->mutex); + spin_unlock(&alloc->lock); } EXPORT_SYMBOL_IF_KUNIT(binder_alloc_free_buf); =20 @@ -967,7 +967,7 @@ void binder_alloc_deferred_release(struct binder_alloc = *alloc) struct binder_buffer *buffer; =20 buffers =3D 0; - mutex_lock(&alloc->mutex); + spin_lock(&alloc->lock); BUG_ON(alloc->mapped); =20 while ((n =3D rb_first(&alloc->allocated_buffers))) { @@ -1018,7 +1018,7 @@ void binder_alloc_deferred_release(struct binder_allo= c *alloc) page_count++; } } - mutex_unlock(&alloc->mutex); + spin_unlock(&alloc->lock); kvfree(alloc->pages); if (alloc->mm) mmdrop(alloc->mm); @@ -1043,7 +1043,7 @@ void binder_alloc_print_allocated(struct seq_file *m, struct binder_buffer *buffer; struct rb_node *n; =20 - guard(mutex)(&alloc->mutex); + guard(spinlock)(&alloc->lock); for (n =3D rb_first(&alloc->allocated_buffers); n; n =3D rb_next(n)) { buffer =3D rb_entry(n, struct binder_buffer, rb_node); seq_printf(m, " buffer %d: %lx size %zd:%zd:%zd %s\n", @@ -1069,7 +1069,7 @@ void binder_alloc_print_pages(struct seq_file *m, int lru =3D 0; int free =3D 0; =20 - mutex_lock(&alloc->mutex); + spin_lock(&alloc->lock); /* * Make sure the binder_alloc is fully initialized, otherwise we might * read inconsistent state. @@ -1085,7 +1085,7 @@ void binder_alloc_print_pages(struct seq_file *m, lru++; } } - mutex_unlock(&alloc->mutex); + spin_unlock(&alloc->lock); seq_printf(m, " pages: %d:%d:%d\n", active, lru, free); seq_printf(m, " pages high watermark: %zu\n", alloc->pages_high); } @@ -1101,7 +1101,7 @@ int binder_alloc_get_allocated_count(struct binder_al= loc *alloc) struct rb_node *n; int count =3D 0; =20 - guard(mutex)(&alloc->mutex); + guard(spinlock)(&alloc->lock); for (n =3D rb_first(&alloc->allocated_buffers); n !=3D NULL; n =3D rb_nex= t(n)) count++; return count; @@ -1161,8 +1161,8 @@ enum lru_status binder_alloc_free_page(struct list_he= ad *item, vma =3D vma_lookup(mm, page_addr); } =20 - if (!mutex_trylock(&alloc->mutex)) - goto err_get_alloc_mutex_failed; + if (!spin_trylock(&alloc->lock)) + goto err_get_alloc_lock_failed; =20 /* * Since a binder_alloc can only be mapped once, we ensure @@ -1180,6 +1180,7 @@ enum lru_status binder_alloc_free_page(struct list_he= ad *item, trace_binder_unmap_kernel_end(alloc, index); =20 list_lru_isolate(lru, item); + spin_unlock(&alloc->lock); spin_unlock(&lru->lock); =20 if (vma) { @@ -1190,7 +1191,6 @@ enum lru_status binder_alloc_free_page(struct list_he= ad *item, trace_binder_unmap_user_end(alloc, index); } =20 - mutex_unlock(&alloc->mutex); if (mm_locked) mmap_read_unlock(mm); else @@ -1201,8 +1201,8 @@ enum lru_status binder_alloc_free_page(struct list_he= ad *item, return LRU_REMOVED_RETRY; =20 err_invalid_vma: - mutex_unlock(&alloc->mutex); -err_get_alloc_mutex_failed: + spin_unlock(&alloc->lock); +err_get_alloc_lock_failed: if (mm_locked) mmap_read_unlock(mm); else @@ -1235,7 +1235,7 @@ VISIBLE_IF_KUNIT void __binder_alloc_init(struct bind= er_alloc *alloc, alloc->pid =3D current->tgid; alloc->mm =3D current->mm; mmgrab(alloc->mm); - mutex_init(&alloc->mutex); + spin_lock_init(&alloc->lock); INIT_LIST_HEAD(&alloc->buffers); alloc->freelist =3D freelist; } diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h index d6f1f6f2d00e..bea5a77bb6da 100644 --- a/drivers/android/binder_alloc.h +++ b/drivers/android/binder_alloc.h @@ -9,7 +9,7 @@ #include #include #include -#include +#include #include #include #include @@ -80,7 +80,7 @@ static inline struct list_head *page_to_lru(struct page *= p) =20 /** * struct binder_alloc - per-binder proc state for binder allocator - * @mutex: protects binder_alloc fields + * @lock: protects binder_alloc fields * @mm: copy of task->mm (invariant after open) * @vm_start: base of per-proc address space mapped via mmap * @buffers: list of all buffers for this proc @@ -105,7 +105,7 @@ static inline struct list_head *page_to_lru(struct page= *p) * struct binder_buffer objects used to track the user buffers */ struct binder_alloc { - struct mutex mutex; + spinlock_t lock; struct mm_struct *mm; unsigned long vm_start; struct list_head buffers; @@ -156,7 +156,7 @@ void binder_alloc_print_pages(struct seq_file *m, static inline size_t binder_alloc_get_free_async_space(struct binder_alloc *alloc) { - guard(mutex)(&alloc->mutex); + guard(spinlock)(&alloc->lock); return alloc->free_async_space; } =20 --=20 2.34.1