On Mon, Oct 12, 2026 at 6:42 PM Peter Zijlstra <[email protected]> wrote: > > On Fri, Oct 09, 2026 at 11:59:48PM +0800, Kunwu Chan wrote: > > Add an in-kernel AUX owner reference and setup/release helpers for > > kernel-created perf events that need an AUX buffer without a userspace > > mmap. The setup path validates that the event is a kernel event with > > no parent, rejects non-power-of-two page counts and negative watermark > > values, allocates the perf buffer and AUX pages, records the kernel > > owner, and attaches the buffer under the same lock. > > > > perf_event_release_aux() stops AUX writers, frees AUX storage, and > > detaches the buffer, in that order, matching the AUX teardown ordering > > of perf_mmap_close(): perf_pmu_output_stop() walks event->rb->event_list > > and rb_free_aux() must run while the buffer is still referenced by the > > event. The single event->rb reference is dropped by > > ring_buffer_attach(event, NULL) itself, so the release path does not > > put it again. > > > > Both functions run under event->mmap_mutex, the lock that already > > serialises ring-buffer attach/detach transitions for an event: > > perf_mmap(), perf_mmap_close(), _perf_event_set_output() and > > _free_event() all hold it around ring_buffer_attach(). Concurrent > > perf_event_release_aux() callers therefore go through the same > > serialisation point, and a second release call, or a release of a > > buffer this API does not own, is a no-op. > > > > Keep aux_mmap_count dedicated to userspace mappings. > > perf_aux_output_begin() accepts a writer while either a userspace or kernel > > owner remains, preserving the existing teardown ordering. > > > > > diff --git a/kernel/events/internal.h b/kernel/events/internal.h > > index c03c4f2eea57..760b7659ad87 100644 > > --- a/kernel/events/internal.h > > +++ b/kernel/events/internal.h > > @@ -48,6 +48,12 @@ struct perf_buffer { > > int aux_nr_pages; > > int aux_overwrite; > > refcount_t aux_mmap_count; > > + /* > > + * In-kernel AUX owner reference, set by perf_event_setup_aux(): > > + * admits writers and ties the AUX teardown to > > + * perf_event_release_aux() when no userspace mmap holds the buffer. > > + */ > > + refcount_t aux_kernel_count; > > unsigned long aux_mmap_locked; > > void (*free_aux)(void *); > > refcount_t aux_refcount; > > This doesn't make sense to me. If the even is a kernel event, then there > cannot be mmap users, so adding another refcount is just for giggles?
Hi Peter, I added `aux_kernel_count` to keep `aux_mmap_count` specific to userspace mappings. The two paths have different teardown responsibilities: `perf_mmap_close()` handles mmap cleanup, while `perf_event_release_aux()` stops AUX output, frees the AUX pages and detaches the buffer for a kernel consumer. `perf_aux_output_begin()` checks both counts so writers are admitted while either owner remains. Would you suggest a simpler approach here? Thanks, Kunwu
