On Fri, Oct 09, 2026 at 11:59:48PM +0800, Kunwu Chan wrote:
> Add an in-kernel AUX owner reference and setup/release helpers for
> kernel-created perf events that need an AUX buffer without a userspace
> mmap. The setup path validates that the event is a kernel event with
> no parent, rejects non-power-of-two page counts and negative watermark
> values, allocates the perf buffer and AUX pages, records the kernel
> owner, and attaches the buffer under the same lock.
>
> perf_event_release_aux() stops AUX writers, frees AUX storage, and
> detaches the buffer, in that order, matching the AUX teardown ordering
> of perf_mmap_close(): perf_pmu_output_stop() walks event->rb->event_list
> and rb_free_aux() must run while the buffer is still referenced by the
> event. The single event->rb reference is dropped by
> ring_buffer_attach(event, NULL) itself, so the release path does not
> put it again.
>
> Both functions run under event->mmap_mutex, the lock that already
> serialises ring-buffer attach/detach transitions for an event:
> perf_mmap(), perf_mmap_close(), _perf_event_set_output() and
> _free_event() all hold it around ring_buffer_attach(). Concurrent
> perf_event_release_aux() callers therefore go through the same
> serialisation point, and a second release call, or a release of a
> buffer this API does not own, is a no-op.
>
> Keep aux_mmap_count dedicated to userspace mappings.
> perf_aux_output_begin() accepts a writer while either a userspace or kernel
> owner remains, preserving the existing teardown ordering.
>
> diff --git a/kernel/events/internal.h b/kernel/events/internal.h
> index c03c4f2eea57..760b7659ad87 100644
> --- a/kernel/events/internal.h
> +++ b/kernel/events/internal.h
> @@ -48,6 +48,12 @@ struct perf_buffer {
> int aux_nr_pages;
> int aux_overwrite;
> refcount_t aux_mmap_count;
> + /*
> + * In-kernel AUX owner reference, set by perf_event_setup_aux():
> + * admits writers and ties the AUX teardown to
> + * perf_event_release_aux() when no userspace mmap holds the buffer.
> + */
> + refcount_t aux_kernel_count;
> unsigned long aux_mmap_locked;
> void (*free_aux)(void *);
> refcount_t aux_refcount;
This doesn't make sense to me. If the even is a kernel event, then there
cannot be mmap users, so adding another refcount is just for giggles?
