From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 38101350A05; Wed, 10 Jun 2026 23:04:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.9 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781132656; cv=none; b=Zj3i+ZaIPG1/j/1M3xqccnAdrpJICfB0kv9bxmqPQzwa1aWDAX1oRjw3NjB6zP/MM3neohgMMeONOF8DohYmAASdeYjMSQiCGCgeQwVAzw93dpL6hPfUlzNVLdZQCcpuNhWpIABfGpB2iNlqlP6Wek49cwQAzGG2LQ3KhPIl3Pk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781132656; c=relaxed/simple; bh=bGrO4j/lpP7M6LZSDYm0KbIMb33OWQa142k1+jPLkOg=; h=Subject:To:Cc:From:Date:References:In-Reply-To:Message-Id; b=qwJROl93vsOMJnqXly2/IkvZMVJqM2aH9mFqtV6GEvmoeKT1EkXGMD1rnEXOOapIi33sKZnBkMtwT9qanB1hH4d4ub/OIRzNrZPHunAaMR14unGcF5nUUSfwRTruzP2kTsb5tUDr9pLqlAdoIsfWF0SeoOW8h3I4t5f6eTap1pA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=ERTAsX17; arc=none smtp.client-ip=198.175.65.9 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="ERTAsX17" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1781132655; x=1812668655; h=subject:to:cc:from:date:references:in-reply-to: message-id; bh=bGrO4j/lpP7M6LZSDYm0KbIMb33OWQa142k1+jPLkOg=; b=ERTAsX17FyBAZ2CrQJAZ27iJiA3YqniNIlgdpdpsl85kOtNC4nKNokn/ +FVuNlxdlmIW9Z9P8pLuGy76ZnII2MLYwpUwz6mphNQzwsb4rfLB2Ln+H QlwkGyBag4FQv9yH4CzSqT4YHT9+OZP2mI25ieshdKf/1TS++iTfr8Kkh Y8QjkLzmGiC0L7JuFY7s1Su2bwKnObOA21k2ncpKf00iQp2ZYgng44pZS hy2tVrmJxn49TYNqd8CgWOBIncsgbu5ncys0kJ+a9mXpUZlfI4CT4SRED yfpQ6+/n8dbfTNprxtdDZX5DwT9FAlZi1W2OVN226MUlExX+eH4t+RlHy g==; X-CSE-ConnectionGUID: ijx3QncfTZ2DE36tGK8Mgg== X-CSE-MsgGUID: Ta0oLX1RSamsut5EzylShg== X-IronPort-AV: E=McAfee;i="6800,10657,11813"; a="104603446" X-IronPort-AV: E=Sophos;i="6.24,197,1774335600"; d="scan'208";a="104603446" Received: from fmviesa005.fm.intel.com ([10.60.135.145]) by orvoesa101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Jun 2026 16:04:14 -0700 X-CSE-ConnectionGUID: AMr6fb/URwe10q+BucvLUg== X-CSE-MsgGUID: QxSHOM1hSKuX8djjKlIzxQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.24,197,1774335600"; d="scan'208";a="251409772" Received: from davehans-spike.ostc.intel.com (HELO localhost.localdomain) ([10.165.164.11]) by fmviesa005.fm.intel.com with ESMTP; 10 Jun 2026 16:04:13 -0700 Subject: [PATCH v2 2/5] binder: Make shrinker rely solely on per-VMA lock To: linux-kernel@vger.kernel.org Cc: Dave Hansen , Alice Ryhl , Andrew Morton , Arve Hjønnevåg , Carlos Llamas , Christian Brauner , David Ahern , "David S. Miller" , Greg Kroah-Hartman , "Liam R. Howlett" , linux-mm@kvack.org, Lorenzo Stoakes , netdev@vger.kernel.org, Shakeel Butt , Suren Baghdasaryan , Todd Kjos , Vlastimil Babka From: Dave Hansen Date: Wed, 10 Jun 2026 16:04:13 -0700 References: <20260610230409.A44D29FA@davehans-spike.ostc.intel.com> In-Reply-To: <20260610230409.A44D29FA@davehans-spike.ostc.intel.com> Message-Id: <20260610230413.D68967BC@davehans-spike.ostc.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: From: Dave Hansen tl;dr: lock_vma_under_rcu() is already a trylock. No need to do both it and mmap_read_trylock(). Long Version: == Background == Historically, binder used an mmap_read_trylock() in its shrinker code. This ensures that reclaim is not blocked on an mmap_lock. Commit 95bc2d4a9020 ("binder: use per-vma lock in page reclaiming") added support for the per-VMA lock, but left mmap_read_trylock() as a fallback. This was presumably because the per-VMA locking can fail for several reasons and most (all?) lock_vma_under_rcu() callers have a fallback to mmap_read_trylock(). == Problem == The fallback is not worth the complexity here. lock_vma_under_rcu() is essentially already a non-blocking trylock. The main reason it fails is also the reason mmap_read_trylock() fails: something is holding mmap_write_lock(). The only remedy for a collision with mmap_write_lock() is to wait, which this code can not do. So the "fallback" after lock_vma_under_rcu() failure is not really a fallback: it is really likely to just be retrying in vain. That retry in an of itself isn't horrible. But it adds complexity. == Solution == Now that per-VMA locks are universally available, lock_vma_under_rcu() will not persistently fail. Rely on it alone and simplify the code. Full disclosure: I originally tried to do this with lock_vma_under_rcu_wait(), but it did not fit well with the mmap_lock trylock semantics. Claude caught this in a review and suggested the approach in this path. It seemed sane to me. So, Suggesed-by: Claude, I guess. Signed-off-by: Dave Hansen Reviewed-by: Suren Baghdasaryan Acked-by: Lorenzo Stoakes Cc: Andrew Morton Cc: "Liam R. Howlett" Cc: Vlastimil Babka Cc: Shakeel Butt Cc: linux-mm@kvack.org Cc: Greg Kroah-Hartman Cc: Arve Hjønnevåg Cc: Todd Kjos Cc: Christian Brauner Cc: Carlos Llamas Cc: Alice Ryhl Cc: "David S. Miller" Cc: David Ahern Cc: netdev@vger.kernel.org -- Changes from v1: * Move forward even if 'vma' is NULL in binder_alloc_free_page(). This can happen if the VMA is unmapped (Sashiko). * Rename goto label to be more accurate for new lock scheme --- b/drivers/android/binder_alloc.c | 26 +++++++++----------------- 1 file changed, 9 insertions(+), 17 deletions(-) diff -puN drivers/android/binder_alloc.c~binder-try-vma-lock drivers/android/binder_alloc.c --- a/drivers/android/binder_alloc.c~binder-try-vma-lock 2026-06-10 15:57:55.274412018 -0700 +++ b/drivers/android/binder_alloc.c 2026-06-10 15:57:55.277412124 -0700 @@ -1142,7 +1142,6 @@ enum lru_status binder_alloc_free_page(s struct vm_area_struct *vma; struct page *page_to_free; unsigned long page_addr; - int mm_locked = 0; size_t index; if (!mmget_not_zero(mm)) @@ -1151,15 +1150,12 @@ enum lru_status binder_alloc_free_page(s index = mdata->page_index; page_addr = alloc->vm_start + index * PAGE_SIZE; - /* attempt per-vma lock first */ + /* + * Attempt per-vma lock. This is essentially a + * "trylock". It can fail even if the VMA exists + * for 'page_addr'. + */ vma = lock_vma_under_rcu(mm, page_addr); - if (!vma) { - /* fall back to mmap_lock */ - if (!mmap_read_trylock(mm)) - goto err_mmap_read_lock_failed; - mm_locked = 1; - vma = vma_lookup(mm, page_addr); - } if (!mutex_trylock(&alloc->mutex)) goto err_get_alloc_mutex_failed; @@ -1188,13 +1184,11 @@ enum lru_status binder_alloc_free_page(s zap_vma_range(vma, page_addr, PAGE_SIZE); trace_binder_unmap_user_end(alloc, index); + + vma_end_read(vma); } mutex_unlock(&alloc->mutex); - if (mm_locked) - mmap_read_unlock(mm); - else - vma_end_read(vma); mmput_async(mm); binder_free_page(page_to_free); @@ -1203,11 +1197,9 @@ enum lru_status binder_alloc_free_page(s err_invalid_vma: mutex_unlock(&alloc->mutex); err_get_alloc_mutex_failed: - if (mm_locked) - mmap_read_unlock(mm); - else + if (vma) vma_end_read(vma); -err_mmap_read_lock_failed: +err_vma_lock_failed: mmput_async(mm); err_mmget: return LRU_SKIP; _