From 8eb05e8e47f1a56042a4ac113e84b68a6d0fda6d Mon Sep 17 00:00:00 2001 From: Alice Ryhl Date: Tue, 11 Aug 2026 20:56:25 +0000 Subject: [PATCH] rust_binder: add TF_DEFER_COMPLETE flag for avoiding userspace roundtrip Outgoing transactions are able to send a message and wait for its reply in a single ioctl. Why not avoid a userspace roundtrip by applying the same logic for replying to incoming messages and waiting for the next incoming message? Generally, when you send a reply using BC_REPLY, the kernel sends BR_TRANSACTION_COMPLETE as a reply to BC_REPLY right away. The BR_TRANSACTION_COMPLETE command indicates that it's safe for userspace to free any resources associated with this message (such as embedded fds or Binder nodes). However, the BR_TRANSACTION_COMPLETE message is problematic because after BC_REPLY is issued, there will be a pending message for userspace. The kernel will refuse to sleep for incoming messages in this scenario. The way this is handled for outgoing transaction is through a mechanism known as deferred delivery of BR_TRANSACTION_COMPLETE. The idea is that when you send an outgoing transaction, then we do not return to userspace right away if BR_TRANSACTION_COMPLETE is the only pending message. This patch adds a new flag called TF_DEFER_COMPLETE that lets userspace opt-in to the same deferred delivery mechanism for BR_TRANSACTION_COMPLETE when using BC_REPLY. Given this new uapi, we can adjust sendReply in userspace libbinder so that it writes the BC_REPLY command into mOut but does not flush the buffer to the kernel. Then, userspace simply continues running until it returns all the way out to the top-level joinThreadPool() loop, which calls into the kernel to get the next incoming transaction. At this point, mOut is flushed, sending the reply. The same ioctl then proceeds to sleep for an incoming message. Userspace only actually specifies TF_DEFER_COMPLETE when the Parcel does not contain fds or refcounts on binder objects. This is because otherwise said fd or binder node will not be freed until the binder thread receives another incoming transaction, which could be a long time. In the case of fds, this is especially important because delaying fclose() can result in processes hanging because they read from a pipe that isn't being closed due to fclose() not getting called. Note that even if TF_DEFER_COMPLETE is not specified for this transaction, it can still be useful to defer the BC_REPLY command, as it can still avoid a userspace roundtrip when a new incoming transaction is available right away. Observing the cuttlefish logs while booting with this change shows that there were 4297 opportunities for this optimization to kick in (that is, boot invoked BC_REPLY 4297 times). Out of those, 3441 binder ioctls sent and received a transaction in the same ioctl. This indicates that we successfully eliminated a syscall on the server side for 80% of incoming transactions. Generally, this means that a server is now able to handle incoming messages using one syscall per incoming message (for each incoming transaction, the syscall handles one BC_FREE_BUFFER and BC_REPLY command, and then waits for the next incoming transaction). Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260811-defer-complete-v3-1-832193c92885@google.com Signed-off-by: Greg Kroah-Hartman --- drivers/android/binder/defs.rs | 3 +- drivers/android/binder/process.rs | 8 ++++ drivers/android/binder/thread.rs | 56 ++++++++++++++++++++++----- drivers/android/binder/transaction.rs | 1 + include/uapi/linux/android/binder.h | 1 + 5 files changed, 59 insertions(+), 10 deletions(-) diff --git a/drivers/android/binder/defs.rs b/drivers/android/binder/defs.rs index 8ac9bdd7a499..cc4becd6e168 100644 --- a/drivers/android/binder/defs.rs +++ b/drivers/android/binder/defs.rs @@ -77,7 +77,8 @@ macro_rules! pub_no_prefix { TF_ONE_WAY, TF_ACCEPT_FDS, TF_CLEAR_BUF, - TF_UPDATE_TXN + TF_UPDATE_TXN, + TF_DEFER_COMPLETE, ); pub(crate) use uapi::{ diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs index 5372bfbd93b3..384ce15e8a1a 100644 --- a/drivers/android/binder/process.rs +++ b/drivers/android/binder/process.rs @@ -686,8 +686,16 @@ pub(crate) fn get_work(&self) -> Option> { pub(crate) fn get_work_or_register<'a>( &'a self, thread: &'a Arc, + thread_has_deferred_work: bool, ) -> GetWorkOrRegister<'a> { let mut inner = self.inner.lock(); + + if thread_has_deferred_work && !inner.work.is_empty() { + if let Some(work) = thread.pop_work_even_if_deferred() { + return GetWorkOrRegister::Work(work); + } + } + // Try to get work from the process queue. if let Some(work) = inner.work.pop_front() { return GetWorkOrRegister::Work(work); diff --git a/drivers/android/binder/thread.rs b/drivers/android/binder/thread.rs index 18a14aa8a835..8b08b8b37ecb 100644 --- a/drivers/android/binder/thread.rs +++ b/drivers/android/binder/thread.rs @@ -584,9 +584,21 @@ fn get_work_local(self: &Arc, wait: bool) -> Result, wait: bool) -> Result>> { + let thread_has_deferred_work; + // Try to get work from the thread's work queue, using only a local lock. { let mut inner = self.inner.lock(); + + // The process_work_list boolean is used to make us go to sleep even if there is work + // in the thread todo-list, but it doesn't apply to the process todo-list. Furthermore, + // work in the thread todo-list must still be delivered before the process list. + // + // Thus, in some scenarios we must return the thread work now even if we were requested + // to wait. Adjust `process_work_list` to `true` accordingly. + inner.process_work_list |= inner.looper_need_return; + inner.process_work_list |= !wait; + if let Some(work) = inner.pop_work() { return Ok(Some(work)); } @@ -594,18 +606,26 @@ fn get_work(self: &Arc, wait: bool) -> Result return Ok(Some(work)), GetWorkOrRegister::Register(reg) => reg, }; @@ -621,14 +641,18 @@ fn get_work(self: &Arc, wait: bool) -> Result Ok(Some(work)), None if signal_pending => Err(EINTR), None => Ok(None), @@ -686,6 +710,12 @@ pub(crate) fn push_return_work(&self, reply: u32) { self.inner.lock().push_return_work(reply); } + pub(crate) fn pop_work_even_if_deferred(&self) -> Option> { + let mut thread_inner = self.inner.lock(); + thread_inner.process_work_list = true; + thread_inner.pop_work() + } + fn translate_object( &self, obj_index: usize, @@ -1410,8 +1440,16 @@ fn reply_inner(self: &Arc, info: &mut TransactionInfo) -> BinderResult { let process = orig.from.process.clone(); let allow_fds = orig.flags.contains(TransactionFlag::AcceptFds); let reply = Transaction::new_reply(self, process, info, allow_fds)?; - // Not notifying: Reply to current thread. - let _ = self.inner.lock().push_work(completion); + { + let mut inner = self.inner.lock(); + if info.flags.contains(TransactionFlag::DeferComplete) { + // The flag is set. Perform a deferred push so that `read` can wait for the + // next incoming transaction without a userspace roundtrip. + inner.push_work_deferred(completion); + } else { + let _ = inner.push_work(completion); + } + } orig.from.deliver_reply(Ok(reply), &orig, None); Ok(()) })() diff --git a/drivers/android/binder/transaction.rs b/drivers/android/binder/transaction.rs index 245f1556b5db..f2877ce05f72 100644 --- a/drivers/android/binder/transaction.rs +++ b/drivers/android/binder/transaction.rs @@ -39,6 +39,7 @@ pub enum TransactionFlag { AcceptFds = TF_ACCEPT_FDS, ClearBuf = TF_CLEAR_BUF, UpdateTxn = TF_UPDATE_TXN, + DeferComplete = TF_DEFER_COMPLETE, } ); diff --git a/include/uapi/linux/android/binder.h b/include/uapi/linux/android/binder.h index 701cad36de43..96e5b0184a1b 100644 --- a/include/uapi/linux/android/binder.h +++ b/include/uapi/linux/android/binder.h @@ -296,6 +296,7 @@ enum transaction_flags { TF_ACCEPT_FDS = 0x10, /* allow replies with file descriptors */ TF_CLEAR_BUF = 0x20, /* clear buffer on txn complete */ TF_UPDATE_TXN = 0x40, /* update the outdated pending async txn */ + TF_DEFER_COMPLETE = 0x80, /* defer transaction complete to userspace */ }; struct binder_transaction_data {