From nobody Fri Sep 25 23:09:14 2026 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 72731427FBE for ; Mon, 7 Sep 2026 13:01:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788786075; cv=none; b=lR6/8ohTHd0/U0Xi/NxlqHHm5l0sstGunSx4+D7JW744FfIJiEDCxPv4BCLqS9bTr6swAl/RoYWuky3W+E8Hj2+LDJT/vOH677LqY1xWm4e+r5BDo9/Jo2B0g6xOrjDpz4BitJusNcLi0WdEcnIfmp1OoVKQ4IXxGxWYsn/T0qg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788786075; c=relaxed/simple; bh=5VmFGXO2THIC1ElKsZHCyDs0LOvF/2GZA7e4bXBxIwM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=i/hxCkNl3LYhDv5edfTuc43kQFxEqeLqH+2ZnxQvaWaRQ9NqB1GurYYOvfwd4EobwLjZHa/W0CpP+6ZyFTR8rHOer7oTtZro4chgWGUsUQ5/0xmAfPW7agtJSsbJFDWtO2IEjIE8OCTGoO4/zxUqiLayBJyHENbTON6txSoVkNE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=eMqVJpf2; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="eMqVJpf2" Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-39682983a0fso3782948a91.3 for ; Mon, 07 Sep 2026 06:01:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788786059; x=1789390859; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ki0AfBSXcv6Q8Gg3qCdHGcmsARPRfMTEXg0rBtuB2Ag=; b=eMqVJpf2YoF0ecBO86VWd2NXOVwEmV2HS8M4bWQrLwWKkB/V/VMiYghItLjKgHILoH pOlwVvRVeUII+oLp1eWz3brsUVHNRbrbHgt45BrzggIEqYSGYahDhrU3pC4A8qHZMJYu f0y5V8YTgYOm3XCiFsqnYP0G2aAD+e8XhlnOiChObB+zW54XQGIIRu2R6L0RHKXpeS3C 8VfSVmUwOZjICDZ2ZGhQalj8stS7RuUp2yZa2FAwinefR5sWaWbE2H7CE8+G0HRCJ9B9 hD4KquE6vGF2vafghhjLOq8ugUlHjhImyKdDwuDHtFCUA6E5b/WQKfUw8C11UxLfwJMy tXeg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788786059; x=1789390859; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ki0AfBSXcv6Q8Gg3qCdHGcmsARPRfMTEXg0rBtuB2Ag=; b=Hwd8f9rAyU9ZhYf0RQMs06yi2vY1QpAqtcTCG0voRh6F8FiHZdzMK5AqDSIgS6ILFV u16ErY3ePGXY5N9ba/dU3hLOCOewtMA7oHltIem9AVra9Y9nSpE4Lcz143vkdt5iE0jb vVtoYIY7FN/1yJFqOjeRlVVojz0ZVOaLErMRSfDoKb109Y0kvcU4yz2hLhWYLpaTwkYY 8jGt7Ajz8k8f+j28U66uRE4Oy8Omla8uKPpwhv5v812PVBZTZmhp5XX9gAV6I2rPGMBf ZZsip19b5ek7n2fRL2D+ZbfT4kEon7+PJTDZiwivJjz5z2B4L3EhkLf9pmHEA1rSe+cf 0XQg== X-Forwarded-Encrypted: i=1; AKwUvBwpUYAG7xzVj8dRiGB74MWgo93bwiOgdzjDg04dmSUwk1iVHHQH6mmrBINd7kanqkBlQHeQKQfqQQ4l9xY=@vger.kernel.org X-Gm-Message-State: AFuF++nAilHCEVi8rsVD0c/MhmFAjWLlTLr7Q4ZLw2BZDuz6ysqYeLcG fSLck40TxJvedI0kU/Cu6VlTVIKNhaP2RJtWN3enrqnJQG2ZWdiNRSav X-Gm-Gg: AYBFou3YD8NmI6eogHEHYoFghnqrmOxLvZlTn7bbIsxf7a3pg1lMViOUEI/bjSvbn5G BOTKNjr5aJzuLmKL7Ix87EReLJ4r8b4+O7QOKlInG4VYlDqJES6/GOyBHZTY0M8eyixor7JlIpj VwE1XsIYRJV7USQPpoAM+deTbk5NLZwJblv6RvaVJUvQiVWaxN4OnFr7eI5sADdQ2Xdlo4pnWOR +f4bQUeI6Ox4AeMrlmMWjN6WiYQdkHsYeEiG4RMv7Iz11/ryJ2c/CioDBuHrqEzPfPn5DCQUnLa cQxakqGLFhhGkk4R1T5vUqvKsiMKWyvVfq/qjYpU+K0GCnyMZIFwcqNx0UAf9XM6fPAzxwp0SrZ ryAgdSRjcwI45MJKTi5xcefby0g5RgpI58+P243HV6+yBk4T1ak2JhXhkEYDohrkJOfxUmTgACb WJI2mvXN9a76OVhIz/paKQc0Y4ExAoJ6U9B0tjNYe/przbUxgX8VfbxLOvidButdKiABKdqZqS4 tZPgHSzGojjChdWIg== X-Received: by 2002:a17:90b:538b:b0:392:e5b1:d833 with SMTP id 98e67ed59e1d1-39b261d5148mr33552829a91.13.1788786059283; Mon, 07 Sep 2026 06:00:59 -0700 (PDT) Received: from zhangbo56-PC.mioffice.cn ([43.224.245.235]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39ae62a54f6sm10916296a91.1.2026.09.07.06.00.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 07 Sep 2026 06:00:58 -0700 (PDT) From: Bo Zhang To: aliceryhl@google.com, gregkh@linuxfoundation.org, cmllamas@google.com Cc: arve@android.com, tkjos@android.com, christian@brauner.io, surenb@google.com, baohua@kernel.org, zhanghongru06@gmail.com, linux-kernel@vger.kernel.org, Bo Zhang , Bo Zhang Subject: [RFC PATCH v4 1/2] binder: switch alloc->mutex to spinlock for buffer metadata Date: Mon, 7 Sep 2026 21:00:27 +0800 Message-Id: <20260907130028.807366-2-zhangbo0325@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260907130028.807366-1-zhangbo0325@gmail.com> References: <20260907130028.807366-1-zhangbo0325@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The alloc->mutex is a highly contended lock on Android devices. When a low-priority task holds this mutex and sleeps, high-priority binder transactions are blocked, causing priority inversion and latency spikes. Split the lock by converting alloc->mutex to a spinlock that only protects buffer metadata. This eliminates the sleeping and priority inversion on the hot path. Page installation and shrinker zap serialization is handled separately by a dedicated install_mutex introduced in the next patch. Performance (binderThroughputTest, SM8850, 2 workers, 10 runs): mutex spinlock throughput: 27k-59k iter/s 79k-84k iter/s average: 0.031-0.068ms 0.022-0.023ms P99: 0.088-0.148ms 0.050-0.062ms Signed-off-by: Bo Zhang --- drivers/android/binder_alloc.c | 36 +++++++++++++++++----------------- drivers/android/binder_alloc.h | 8 ++++---- 2 files changed, 22 insertions(+), 22 deletions(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index e4488ad86a65..9775df3616aa 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -169,7 +169,7 @@ static struct binder_buffer *binder_alloc_prepare_to_fr= ee_locked( struct binder_buffer *binder_alloc_prepare_to_free(struct binder_alloc *al= loc, unsigned long user_ptr) { - guard(mutex)(&alloc->mutex); + guard(spinlock)(&alloc->lock); return binder_alloc_prepare_to_free_locked(alloc, user_ptr); } =20 @@ -676,10 +676,10 @@ struct binder_buffer *binder_alloc_new_buf(struct bin= der_alloc *alloc, if (!next) return ERR_PTR(-ENOMEM); =20 - mutex_lock(&alloc->mutex); + spin_lock(&alloc->lock); buffer =3D binder_alloc_new_buf_locked(alloc, next, size, is_async); if (IS_ERR(buffer)) { - mutex_unlock(&alloc->mutex); + spin_unlock(&alloc->lock); goto out; } =20 @@ -687,7 +687,7 @@ struct binder_buffer *binder_alloc_new_buf(struct binde= r_alloc *alloc, buffer->offsets_size =3D offsets_size; buffer->extra_buffers_size =3D extra_buffers_size; buffer->pid =3D current->tgid; - mutex_unlock(&alloc->mutex); + spin_unlock(&alloc->lock); =20 ret =3D binder_install_buffer_pages(alloc, buffer, size); if (ret) { @@ -872,9 +872,9 @@ void binder_alloc_free_buf(struct binder_alloc *alloc, binder_alloc_clear_buf(alloc, buffer); buffer->clear_on_free =3D false; } - mutex_lock(&alloc->mutex); + spin_lock(&alloc->lock); binder_free_buf_locked(alloc, buffer); - mutex_unlock(&alloc->mutex); + spin_unlock(&alloc->lock); } EXPORT_SYMBOL_IF_KUNIT(binder_alloc_free_buf); =20 @@ -967,7 +967,7 @@ void binder_alloc_deferred_release(struct binder_alloc = *alloc) struct binder_buffer *buffer; =20 buffers =3D 0; - mutex_lock(&alloc->mutex); + spin_lock(&alloc->lock); BUG_ON(alloc->mapped); =20 while ((n =3D rb_first(&alloc->allocated_buffers))) { @@ -1018,7 +1018,7 @@ void binder_alloc_deferred_release(struct binder_allo= c *alloc) page_count++; } } - mutex_unlock(&alloc->mutex); + spin_unlock(&alloc->lock); kvfree(alloc->pages); if (alloc->mm) mmdrop(alloc->mm); @@ -1043,7 +1043,7 @@ void binder_alloc_print_allocated(struct seq_file *m, struct binder_buffer *buffer; struct rb_node *n; =20 - guard(mutex)(&alloc->mutex); + guard(spinlock)(&alloc->lock); for (n =3D rb_first(&alloc->allocated_buffers); n; n =3D rb_next(n)) { buffer =3D rb_entry(n, struct binder_buffer, rb_node); seq_printf(m, " buffer %d: %lx size %zd:%zd:%zd %s\n", @@ -1069,7 +1069,7 @@ void binder_alloc_print_pages(struct seq_file *m, int lru =3D 0; int free =3D 0; =20 - mutex_lock(&alloc->mutex); + spin_lock(&alloc->lock); /* * Make sure the binder_alloc is fully initialized, otherwise we might * read inconsistent state. @@ -1085,7 +1085,7 @@ void binder_alloc_print_pages(struct seq_file *m, lru++; } } - mutex_unlock(&alloc->mutex); + spin_unlock(&alloc->lock); seq_printf(m, " pages: %d:%d:%d\n", active, lru, free); seq_printf(m, " pages high watermark: %zu\n", alloc->pages_high); } @@ -1101,7 +1101,7 @@ int binder_alloc_get_allocated_count(struct binder_al= loc *alloc) struct rb_node *n; int count =3D 0; =20 - guard(mutex)(&alloc->mutex); + guard(spinlock)(&alloc->lock); for (n =3D rb_first(&alloc->allocated_buffers); n !=3D NULL; n =3D rb_nex= t(n)) count++; return count; @@ -1161,8 +1161,8 @@ enum lru_status binder_alloc_free_page(struct list_he= ad *item, vma =3D vma_lookup(mm, page_addr); } =20 - if (!mutex_trylock(&alloc->mutex)) - goto err_get_alloc_mutex_failed; + if (!spin_trylock(&alloc->lock)) + goto err_get_alloc_lock_failed; =20 /* * Since a binder_alloc can only be mapped once, we ensure @@ -1180,6 +1180,7 @@ enum lru_status binder_alloc_free_page(struct list_he= ad *item, trace_binder_unmap_kernel_end(alloc, index); =20 list_lru_isolate(lru, item); + spin_unlock(&alloc->lock); spin_unlock(&lru->lock); =20 if (vma) { @@ -1190,7 +1191,6 @@ enum lru_status binder_alloc_free_page(struct list_he= ad *item, trace_binder_unmap_user_end(alloc, index); } =20 - mutex_unlock(&alloc->mutex); if (mm_locked) mmap_read_unlock(mm); else @@ -1201,8 +1201,8 @@ enum lru_status binder_alloc_free_page(struct list_he= ad *item, return LRU_REMOVED_RETRY; =20 err_invalid_vma: - mutex_unlock(&alloc->mutex); -err_get_alloc_mutex_failed: + spin_unlock(&alloc->lock); +err_get_alloc_lock_failed: if (mm_locked) mmap_read_unlock(mm); else @@ -1235,7 +1235,7 @@ VISIBLE_IF_KUNIT void __binder_alloc_init(struct bind= er_alloc *alloc, alloc->pid =3D current->tgid; alloc->mm =3D current->mm; mmgrab(alloc->mm); - mutex_init(&alloc->mutex); + spin_lock_init(&alloc->lock); INIT_LIST_HEAD(&alloc->buffers); alloc->freelist =3D freelist; } diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h index d6f1f6f2d00e..bea5a77bb6da 100644 --- a/drivers/android/binder_alloc.h +++ b/drivers/android/binder_alloc.h @@ -9,7 +9,7 @@ #include #include #include -#include +#include #include #include #include @@ -80,7 +80,7 @@ static inline struct list_head *page_to_lru(struct page *= p) =20 /** * struct binder_alloc - per-binder proc state for binder allocator - * @mutex: protects binder_alloc fields + * @lock: protects binder_alloc fields * @mm: copy of task->mm (invariant after open) * @vm_start: base of per-proc address space mapped via mmap * @buffers: list of all buffers for this proc @@ -105,7 +105,7 @@ static inline struct list_head *page_to_lru(struct page= *p) * struct binder_buffer objects used to track the user buffers */ struct binder_alloc { - struct mutex mutex; + spinlock_t lock; struct mm_struct *mm; unsigned long vm_start; struct list_head buffers; @@ -156,7 +156,7 @@ void binder_alloc_print_pages(struct seq_file *m, static inline size_t binder_alloc_get_free_async_space(struct binder_alloc *alloc) { - guard(mutex)(&alloc->mutex); + guard(spinlock)(&alloc->lock); return alloc->free_async_space; } =20 --=20 2.34.1 From nobody Fri Sep 25 23:09:14 2026 Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CE2D94DF4BE for ; Mon, 7 Sep 2026 13:01:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788786090; cv=none; b=gyxkLn1xyOFG+pjCumYtTEO1may/Z2rMhw++gtcGH9vx9NuP6A/bwgp7nF73CW/R6zhqk6iPGmZNmqavc20mO0t3NuJUvQbGBVDzA1zGCfY0PHHZkO1GXPbbIVcwY081eK4t/5+UbWHouFjpyMAO9ZqjUUkIfwaFWNI5po5vHBM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788786090; c=relaxed/simple; bh=Uu8Er2qciH/hteunKwwIyhQ8yN2NjkOur8S+PEwmODc=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=hPFFYDGSQPuwgJ03quk54Yn2KyZR92Jh5GBOrC2yClqfxLSzhjLegF2DWIJAYmCNUSa2ASBfpDvVZXEFuHtZq28lBqnRslZU0hs+cSQONW7e6OFbV7Dfta258afZGUAnAxipQs7WyrsHwAzBWHaUL5GUfDLQOY7PBKstmeAJhfM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BOx4L+YO; arc=none smtp.client-ip=209.85.216.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BOx4L+YO" Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-38dfe7eb825so2815892a91.0 for ; Mon, 07 Sep 2026 06:01:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788786063; x=1789390863; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=uQVw/+VqJ3DWkc1LzeHgs5adAH411wNwhFKsTiEvV6I=; b=BOx4L+YOhtfqeFyZOwZ5RnI4h3FqCRDXifNcSh5x+Nr5aYTb7mMFb1/xNT+ySUWP1Z oyuxZ0rKdhvBKECNSwpLSBOFdLfnbX6KN4P2Hbi4khOgu94TNzjxmAiZNQafigaWt051 dpnipfq3KRNjWT2fYtTGPxm12ARQPlA50rCM6CsVESXFTuWw+YGuChQtXtXk3U7z36V4 Kt9OurchJVDCgedStNFwsIlRGoEsBBsdKR29hXuQXbNeEor+jy/lU4Vf//rryPf+Gcmd FL98rn9kwvcO8Z1ibsRdjqiRJfJR0ltrhgg/2g4Hj0R4qLHevMNaThK24irs4yk2I3uN 2zKg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788786063; x=1789390863; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=uQVw/+VqJ3DWkc1LzeHgs5adAH411wNwhFKsTiEvV6I=; b=CYD5LRay7sXiznTSVWNksarWnHNVHMdsCXKRTpBIahNpN+fwcCPPmuFTbbq/SiAIdC Ag+od12X8VhK7r3+ynIEKtQ+Vn0mJlzdWSgpIZ5owECn4KQxed2lkHsX60fpZbO55g6P ZnBP64kr/4KNXASW8VgZrhH0GBjJbSir7CA2GQYjYDkzWbYc7+D1SRYHoGaSXGnIAMsr qBhqPQwIjT5LMgyRR1lfljeQtRnT8iP9CV3orASad7Dpqz21Y12ebz5rmo8ImiM7smfC TvpK9Y8qhtkGXcZyFgJlGNOrF9DcIfXHVKFB1HOZH+LfvQcTlWrYmHbKBh3qvxNddz2M z0Ig== X-Forwarded-Encrypted: i=1; AKwUvBw9yq78P94G+FgRU0eBOcj3qjrhfEpygX8TzJd68RxdIqFRH5L4sbwvAYYFD6DMHMTh80LyK/nQBzptc5w=@vger.kernel.org X-Gm-Message-State: AFuF++nTqOYS/CQPLTtyFIfMxO2E8hNLB/kFWtLQ8jsK+lsaYJYtiKUT SxaXvjvAVD82Y6AryxDJxzdUixKZfJtptWuYcHH14yFBA5Mf3vLBLJH9 X-Gm-Gg: AYBFou0hdlV/PkNszGITUMh7OS1ZFh0t6DzSzcoJxdkmsSNEEh6/HN4RZZTzVBM2iC2 Nlbv/a6Nw9tu+uCyPHM834xFcffygGgKv0hgGydegE1deBFzYEVbxB8xZOHf1p//SoGtKUvAXt0 SuZ7/4NtHMBCcKOV53Gl8vkLQinS13AZYu3dUOM3OgcOkHjl4DaVAGGkafEQxFEKCUbZMz+d09Y 0BMHWWAXuCUjBv/9xv6dEbSPNkukOIHr2RRjnPgSyCiJc5WNEC1FbaQNDYMf8g51QLe+O6LR1Pi BhafMrTeB5mylZ/wl+LO+Wf8aTeFgJMtaBgkD8ypXZkoios9GTA5+nqyWUkfKO2Oq+xv7KpO5N0 yvjWAMiuCFXTclgw2Da99vjk6HPgoBJqshVNC1kjreOAwcPt8EuRRHWBUTdOcnVGvT7DNve1aE0 GiaQHdSTg1RmaahYbY19K2iAocw3ufJ3ONVVP4PSK9MevR6WuvFeSx6ENinnBU2nzz+HRq5OpKv hxPAT0= X-Received: by 2002:a17:90a:15cf:b0:39b:57c6:e280 with SMTP id 98e67ed59e1d1-39b57c6e283mr8442729a91.7.1788786063170; Mon, 07 Sep 2026 06:01:03 -0700 (PDT) Received: from zhangbo56-PC.mioffice.cn ([43.224.245.235]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39ae62a54f6sm10916296a91.1.2026.09.07.06.01.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 07 Sep 2026 06:01:02 -0700 (PDT) From: Bo Zhang To: aliceryhl@google.com, gregkh@linuxfoundation.org, cmllamas@google.com Cc: arve@android.com, tkjos@android.com, christian@brauner.io, surenb@google.com, baohua@kernel.org, zhanghongru06@gmail.com, linux-kernel@vger.kernel.org, Bo Zhang , Bo Zhang Subject: [RFC PATCH v4 2/2] binder: add install_mutex to serialize page install and shrinker zap Date: Mon, 7 Sep 2026 21:00:28 +0800 Message-Id: <20260907130028.807366-3-zhangbo0325@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260907130028.807366-1-zhangbo0325@gmail.com> References: <20260907130028.807366-1-zhangbo0325@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The previous patch converted alloc->mutex to a spinlock for the hot path (buffer alloc/free). However, page installation may sleep in vm_insert_page(), and the shrinker may sleep in zap_vma_range(), so these cannot be serialized by the spinlock. Without serialization, the install side could observe and reuse a page that the shrinker is about to zap and free. Add a separate install_mutex to serialize page installation against the shrinker's zap. The two locks have distinct roles: - alloc->lock (spinlock) exclusively owns the non-sleeping metadata: pages[], the LRU list, the rb-trees and free_async_space. - install_mutex only serializes the sleeping PTE operations (vm_insert_page vs zap_vma_range) for a given alloc. pages[] and the LRU are always updated together under alloc->lock, so binder_lru_freelist_del() always observes a consistent state. The shrinker acquires install_mutex with mutex_trylock() and skips the page (LRU_SKIP) on failure. This is required because the install side may hold install_mutex while its vm_insert_page() recurses into direct reclaim and re-enters this shrinker on the same thread; a blocking acquire would self-deadlock. Using trylock also keeps the shrinker out of any blocking lock cycle with mmap_lock, so the install side may take mmap_lock while holding install_mutex without risking an ABBA deadlock. Performance (binderThroughputTest, Qualcomm SM8850, 2 workers, 10 runs) under concurrent drop_caches shows no regression from the install_mutex: mutex (baseline) spinlock + install_mutex throughput: 27k-59k iter/s 84k-89k iter/s average: 0.031-0.068ms 0.021-0.022ms P99: 0.088-0.148ms 0.046-0.056ms Signed-off-by: Bo Zhang --- drivers/android/binder_alloc.c | 59 +++++++++++++++++++++------------- drivers/android/binder_alloc.h | 3 ++ 2 files changed, 39 insertions(+), 23 deletions(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index 9775df3616aa..61544e3cdae1 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -325,34 +325,34 @@ static int binder_install_single_page(struct binder_a= lloc *alloc, goto out; } =20 - ret =3D binder_page_insert(alloc, addr, page); - switch (ret) { - case -EBUSY: - /* - * EBUSY is ok. Someone installed the pte first but the - * alloc->pages[index] has not been updated yet. Discard - * our page and look up the one already installed. - */ - ret =3D 0; + mutex_lock(&alloc->install_mutex); + + /* Someone may have installed it already; check under alloc->lock */ + spin_lock(&alloc->lock); + if (binder_get_installed_page(alloc, index)) { + spin_unlock(&alloc->lock); + mutex_unlock(&alloc->install_mutex); binder_free_page(page); - page =3D binder_page_lookup(alloc, addr); - if (!page) { - pr_err("%d: failed to find page at offset %lx\n", - alloc->pid, addr - alloc->vm_start); - ret =3D -ESRCH; - break; - } - fallthrough; - case 0: - /* Mark page installation complete and safe to use */ - binder_set_installed_page(alloc, index, page); - break; - default: + ret =3D 0; + goto out; + } + spin_unlock(&alloc->lock); + + ret =3D binder_page_insert(alloc, addr, page); + if (ret) { binder_free_page(page); pr_err("%d: %s failed to insert page at offset %lx with %d\n", alloc->pid, __func__, addr - alloc->vm_start, ret); - break; + mutex_unlock(&alloc->install_mutex); + goto out; } + + /* Mark page installation complete under alloc->lock */ + spin_lock(&alloc->lock); + binder_set_installed_page(alloc, index, page); + spin_unlock(&alloc->lock); + + mutex_unlock(&alloc->install_mutex); out: mmput_async(alloc->mm); return ret; @@ -1161,6 +1161,14 @@ enum lru_status binder_alloc_free_page(struct list_h= ead *item, vma =3D vma_lookup(mm, page_addr); } =20 + /* + * Use trylock: the install side may hold install_mutex while its + * vm_insert_page() recurses into reclaim and re-enters this shrinker + * on the same thread, so blocking here would self-deadlock. + */ + if (!mutex_trylock(&alloc->install_mutex)) + goto err_get_install_mutex_failed; + if (!spin_trylock(&alloc->lock)) goto err_get_alloc_lock_failed; =20 @@ -1191,6 +1199,8 @@ enum lru_status binder_alloc_free_page(struct list_he= ad *item, trace_binder_unmap_user_end(alloc, index); } =20 + mutex_unlock(&alloc->install_mutex); + if (mm_locked) mmap_read_unlock(mm); else @@ -1203,6 +1213,8 @@ enum lru_status binder_alloc_free_page(struct list_he= ad *item, err_invalid_vma: spin_unlock(&alloc->lock); err_get_alloc_lock_failed: + mutex_unlock(&alloc->install_mutex); +err_get_install_mutex_failed: if (mm_locked) mmap_read_unlock(mm); else @@ -1236,6 +1248,7 @@ VISIBLE_IF_KUNIT void __binder_alloc_init(struct bind= er_alloc *alloc, alloc->mm =3D current->mm; mmgrab(alloc->mm); spin_lock_init(&alloc->lock); + mutex_init(&alloc->install_mutex); INIT_LIST_HEAD(&alloc->buffers); alloc->freelist =3D freelist; } diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h index bea5a77bb6da..85817efdbef6 100644 --- a/drivers/android/binder_alloc.h +++ b/drivers/android/binder_alloc.h @@ -9,6 +9,7 @@ #include #include #include +#include #include #include #include @@ -81,6 +82,7 @@ static inline struct list_head *page_to_lru(struct page *= p) /** * struct binder_alloc - per-binder proc state for binder allocator * @lock: protects binder_alloc fields + * @install_mutex: serializes page installation and shrinker zap * @mm: copy of task->mm (invariant after open) * @vm_start: base of per-proc address space mapped via mmap * @buffers: list of all buffers for this proc @@ -106,6 +108,7 @@ static inline struct list_head *page_to_lru(struct page= *p) */ struct binder_alloc { spinlock_t lock; + struct mutex install_mutex; struct mm_struct *mm; unsigned long vm_start; struct list_head buffers; --=20 2.34.1