Re: [PATCH v2 1/5] perf/core: add AUX buffer ownership for kernel events

[Peter Zijlstra <peterz@infradead.org>]

On Fri, Oct 09, 2026 at 11:59:48PM +0800, Kunwu Chan wrote:
> Add an in-kernel AUX owner reference and setup/release helpers for
> kernel-created perf events that need an AUX buffer without a userspace
> mmap.  The setup path validates that the event is a kernel event with
> no parent, rejects non-power-of-two page counts and negative watermark
> values, allocates the perf buffer and AUX pages, records the kernel
> owner, and attaches the buffer under the same lock.
> 
> perf_event_release_aux() stops AUX writers, frees AUX storage, and
> detaches the buffer, in that order, matching the AUX teardown ordering
> of perf_mmap_close(): perf_pmu_output_stop() walks event->rb->event_list
> and rb_free_aux() must run while the buffer is still referenced by the
> event.  The single event->rb reference is dropped by
> ring_buffer_attach(event, NULL) itself, so the release path does not
> put it again.
> 
> Both functions run under event->mmap_mutex, the lock that already
> serialises ring-buffer attach/detach transitions for an event:
> perf_mmap(), perf_mmap_close(), _perf_event_set_output() and
> _free_event() all hold it around ring_buffer_attach().  Concurrent
> perf_event_release_aux() callers therefore go through the same
> serialisation point, and a second release call, or a release of a
> buffer this API does not own, is a no-op.
> 
> Keep aux_mmap_count dedicated to userspace mappings.
> perf_aux_output_begin() accepts a writer while either a userspace or kernel
> owner remains, preserving the existing teardown ordering.
> 

> diff --git a/kernel/events/internal.h b/kernel/events/internal.h
> index c03c4f2eea57..760b7659ad87 100644
> --- a/kernel/events/internal.h
> +++ b/kernel/events/internal.h
> @@ -48,6 +48,12 @@ struct perf_buffer {
>  	int				aux_nr_pages;
>  	int				aux_overwrite;
>  	refcount_t			aux_mmap_count;
> +	/*
> +	 * In-kernel AUX owner reference, set by perf_event_setup_aux():
> +	 * admits writers and ties the AUX teardown to
> +	 * perf_event_release_aux() when no userspace mmap holds the buffer.
> +	 */
> +	refcount_t			aux_kernel_count;
>  	unsigned long			aux_mmap_locked;
>  	void				(*free_aux)(void *);
>  	refcount_t			aux_refcount;

This doesn't make sense to me. If the even is a kernel event, then there
cannot be mmap users, so adding another refcount is just for giggles?