STRUCT BINDER_ALLOC(9)

💖 NAME 💖

struct binder_alloc — the per-binder-proc state for the binder allocator, bestie ✨ (this is from the Kernel API Manual, in case you were wondering 🫶)

---

✨ SYNOPSIS ✨

struct binder_alloc {
    struct mutex mutex;
    struct mm_struct *mm;
    unsigned long vm_start;
    struct list_head buffers;
    struct rb_root free_buffers;
    struct rb_root allocated_buffers;
    size_t free_async_space;
    struct page **pages;
    struct list_lru *freelist;
    size_t buffer_size;
    int pid;
    size_t pages_high;
    bool mapped;
    bool oneway_spam_detected;
 };

---

🎀 MEMBERS 🎀

Okay so every single field, one by one, no skipping, we're doing this 💅

• mutex — the bodyguard 🛡️ it protects the binder_alloc fields, that's literally its whole job.
• mm — a copy of task->mm, and it's invariant after open, so like, it does not change. Periodt.
• vm_start — the base of the per-proc address space, the one mapped via mmap.
• buffers — a list of all the buffers for this proc. The whole friend group 🫶
• free_buffers — an rb tree of buffers that are available for allocation, sorted by size. Shopping the free pile, iykyk.
• allocated_buffers — an rb tree of the allocated buffers, sorted by address. Already-claimed besties ✨
• free_async_space — the VA space available for async buffers. It gets initialized at mmap time to 1/2 the full VA space, no cap 🍓
• pages — an array of struct page *.
• freelist — the lru list to use for free pages, and it's invariant after init 😌
• buffer_size — the size of the address space specified via mmap.
• pid — the pid for the associated binder_proc, and it's invariant after init 🔒
• pages_high — the high watermark of the offset in pages. It's giving peak performance tracking 📈
• mapped — whether the vm area is mapped. Important caveat: each binder instance is allowed a single mapping throughout its lifetime, so like, one (1) mapping, that's the whole vibe check.
• oneway_spam_detected — true if oneway spam detection fired 💀 clear that flag once the async buffer has returned to a healthy state, we don't hold grudges.

---

🦋 DESCRIPTION 🦋

So this is the bookkeeping structure for per-proc address space management for binder buffers — literally the receipts for who's using what memory, and it ate 🍽️

It's normally initialized during binder_init and binder_mmap calls, like two little glow-up checkpoints at birth ✨

And the address space is used for both the user-visible buffers and for struct binder_buffer objects that are used to track the user buffers. Dual-purpose icon behavior 👑

---

🌈 SEE ALSO 🌈

• Kernel file ./drivers/android/binder_alloc.h
• struct binder_buffer(9)
• struct binder_shrinker_mdata(9)
• binder_alloc_get_free_async_space(9)

---

That's the whole page bestie, go read the kernel source now 🧚‍♀️✨ This one came from ./drivers/android and it's dated October 2026 — mwah, take care of her 💜🎀💅