->pp_magic field in struct page is current used to identify if a page
belongs to a page pool. However, ->pp_magic will be removed and page
type bit in struct page e.i. PGTY_netpp can be used for that purpose.
Introduce and use the page type APIs e.g. PageNetpp(), __SetPageNetpp(),
and __ClearPageNetpp() instead, and remove the existing APIs accessing
->pp_magic e.g. page_pool_page_is_pp(), netmem_or_pp_magic(), and
netmem_clear_pp_magic().
This work was inspired by the following link:
[1] https://lore.kernel.org/all/582f41c0-2742-4400-9c81-0d46bf4e8314@gmail.com/
While at it, move the sanity check for page pool to on free.
Suggested-by: David Hildenbrand <david@redhat.com>
Co-developed-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Byungchul Park <byungchul@sk.com>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Zi Yan <ziy@nvidia.com>
---
Hi Mina,
I dropped your Reviewed-by tag since there are updates on some comments
in network part. Can I still keep your Reviewed-by?
Byungchul
---
.../net/ethernet/mellanox/mlx5/core/en/xdp.c | 2 +-
include/linux/mm.h | 27 +++----------------
include/linux/page-flags.h | 6 +++++
include/net/netmem.h | 2 +-
mm/page_alloc.c | 8 +++---
net/core/netmem_priv.h | 17 +++---------
net/core/page_pool.c | 14 +++++-----
7 files changed, 25 insertions(+), 51 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
index 5d51600935a6..def274f5c1ca 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
@@ -707,7 +707,7 @@ static void mlx5e_free_xdpsq_desc(struct mlx5e_xdpsq *sq,
xdpi = mlx5e_xdpi_fifo_pop(xdpi_fifo);
page = xdpi.page.page;
- /* No need to check page_pool_page_is_pp() as we
+ /* No need to check PageNetpp() as we
* know this is a page_pool page.
*/
page_pool_recycle_direct(pp_page_to_nmdesc(page)->pp,
diff --git a/include/linux/mm.h b/include/linux/mm.h
index b6fdf3557807..f5155f1c75f5 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -4361,10 +4361,9 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
* DMA mapping IDs for page_pool
*
* When DMA-mapping a page, page_pool allocates an ID (from an xarray) and
- * stashes it in the upper bits of page->pp_magic. We always want to be able to
- * unambiguously identify page pool pages (using page_pool_page_is_pp()). Non-PP
- * pages can have arbitrary kernel pointers stored in the same field as pp_magic
- * (since it overlaps with page->lru.next), so we must ensure that we cannot
+ * stashes it in the upper bits of page->pp_magic. Non-PP pages can have
+ * arbitrary kernel pointers stored in the same field as pp_magic (since
+ * it overlaps with page->lru.next), so we must ensure that we cannot
* mistake a valid kernel pointer with any of the values we write into this
* field.
*
@@ -4399,26 +4398,6 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
#define PP_DMA_INDEX_MASK GENMASK(PP_DMA_INDEX_BITS + PP_DMA_INDEX_SHIFT - 1, \
PP_DMA_INDEX_SHIFT)
-/* Mask used for checking in page_pool_page_is_pp() below. page->pp_magic is
- * OR'ed with PP_SIGNATURE after the allocation in order to preserve bit 0 for
- * the head page of compound page and bit 1 for pfmemalloc page, as well as the
- * bits used for the DMA index. page_is_pfmemalloc() is checked in
- * __page_pool_put_page() to avoid recycling the pfmemalloc page.
- */
-#define PP_MAGIC_MASK ~(PP_DMA_INDEX_MASK | 0x3UL)
-
-#ifdef CONFIG_PAGE_POOL
-static inline bool page_pool_page_is_pp(const struct page *page)
-{
- return (page->pp_magic & PP_MAGIC_MASK) == PP_SIGNATURE;
-}
-#else
-static inline bool page_pool_page_is_pp(const struct page *page)
-{
- return false;
-}
-#endif
-
#define PAGE_SNAPSHOT_FAITHFUL (1 << 0)
#define PAGE_SNAPSHOT_PG_BUDDY (1 << 1)
#define PAGE_SNAPSHOT_PG_IDLE (1 << 2)
diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index 0091ad1986bf..edf5418c91dd 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -934,6 +934,7 @@ enum pagetype {
PGTY_zsmalloc = 0xf6,
PGTY_unaccepted = 0xf7,
PGTY_large_kmalloc = 0xf8,
+ PGTY_netpp = 0xf9,
PGTY_mapcount_underflow = 0xff
};
@@ -1078,6 +1079,11 @@ PAGE_TYPE_OPS(Zsmalloc, zsmalloc, zsmalloc)
PAGE_TYPE_OPS(Unaccepted, unaccepted, unaccepted)
FOLIO_TYPE_OPS(large_kmalloc, large_kmalloc)
+/*
+ * Marks page_pool allocated pages.
+ */
+PAGE_TYPE_OPS(Netpp, netpp, netpp)
+
/**
* PageHuge - Determine if the page belongs to hugetlbfs
* @page: The page to test.
diff --git a/include/net/netmem.h b/include/net/netmem.h
index 651e2c62d1dd..0ec4c7561081 100644
--- a/include/net/netmem.h
+++ b/include/net/netmem.h
@@ -260,7 +260,7 @@ static inline unsigned long netmem_pfn_trace(netmem_ref netmem)
*/
#define pp_page_to_nmdesc(p) \
({ \
- DEBUG_NET_WARN_ON_ONCE(!page_pool_page_is_pp(p)); \
+ DEBUG_NET_WARN_ON_ONCE(!PageNetpp(p)); \
__pp_page_to_nmdesc(p); \
})
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index fb91c566327c..c69ed3741bbc 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1042,7 +1042,6 @@ static inline bool page_expected_state(struct page *page,
#ifdef CONFIG_MEMCG
page->memcg_data |
#endif
- page_pool_page_is_pp(page) |
(page->flags.f & check_flags)))
return false;
@@ -1069,8 +1068,6 @@ static const char *page_bad_reason(struct page *page, unsigned long flags)
if (unlikely(page->memcg_data))
bad_reason = "page still charged to cgroup";
#endif
- if (unlikely(page_pool_page_is_pp(page)))
- bad_reason = "page_pool leak";
return bad_reason;
}
@@ -1379,9 +1376,12 @@ __always_inline bool free_pages_prepare(struct page *page,
mod_mthp_stat(order, MTHP_STAT_NR_ANON, -1);
folio->mapping = NULL;
}
- if (unlikely(page_has_type(page)))
+ if (unlikely(page_has_type(page))) {
+ /* networking expects to clear its page type before releasing */
+ WARN_ON_ONCE(PageNetpp(page));
/* Reset the page_type (which overlays _mapcount) */
page->page_type = UINT_MAX;
+ }
if (is_check_pages_enabled()) {
if (free_page_is_bad(page))
diff --git a/net/core/netmem_priv.h b/net/core/netmem_priv.h
index 5561fd556bc5..664a9fe87c66 100644
--- a/net/core/netmem_priv.h
+++ b/net/core/netmem_priv.h
@@ -8,18 +8,6 @@ static inline unsigned long netmem_get_pp_magic(netmem_ref netmem)
return netmem_to_nmdesc(netmem)->pp_magic & ~PP_DMA_INDEX_MASK;
}
-static inline void netmem_or_pp_magic(netmem_ref netmem, unsigned long pp_magic)
-{
- netmem_to_nmdesc(netmem)->pp_magic |= pp_magic;
-}
-
-static inline void netmem_clear_pp_magic(netmem_ref netmem)
-{
- WARN_ON_ONCE(netmem_to_nmdesc(netmem)->pp_magic & PP_DMA_INDEX_MASK);
-
- netmem_to_nmdesc(netmem)->pp_magic = 0;
-}
-
static inline bool netmem_is_pp(netmem_ref netmem)
{
/* net_iov may be part of a page pool. For net_iov, ->pp in
@@ -30,7 +18,10 @@ static inline bool netmem_is_pp(netmem_ref netmem)
if (netmem_is_net_iov(netmem))
return !!netmem_to_nmdesc(netmem)->pp;
- return (netmem_get_pp_magic(netmem) & PP_MAGIC_MASK) == PP_SIGNATURE;
+ /* For system memory, page type in struct page can be used to
+ * determine if the pages belong to a page pool.
+ */
+ return PageNetpp(__netmem_to_page(netmem));
}
static inline void netmem_set_pp(netmem_ref netmem, struct page_pool *pool)
diff --git a/net/core/page_pool.c b/net/core/page_pool.c
index 2756b78754b0..c43a0f4479d4 100644
--- a/net/core/page_pool.c
+++ b/net/core/page_pool.c
@@ -700,12 +700,11 @@ void page_pool_set_pp_info(struct page_pool *pool, netmem_ref netmem)
{
netmem_set_pp(netmem, pool);
- /* For page-backed, pp_magic is used to identify if it's pp.
- * For net_iov, it's ensured nmdesc->pp is non-NULL if it's pp
- * and nmdesc->pp is NULL if it's not.
+ /* For system memory, page type in struct page is used to
+ * determine if the pages belong to a page pool.
*/
if (!netmem_is_net_iov(netmem))
- netmem_or_pp_magic(netmem, PP_SIGNATURE);
+ __SetPageNetpp(__netmem_to_page(netmem));
/* Ensuring all pages have been split into one fragment initially:
* page_pool_set_pp_info() is only called once for every page when it
@@ -720,12 +719,11 @@ void page_pool_set_pp_info(struct page_pool *pool, netmem_ref netmem)
void page_pool_clear_pp_info(netmem_ref netmem)
{
- /* For page-backed, pp_magic is used to identify if it's pp.
- * For net_iov, it's ensured nmdesc->pp is non-NULL if it's pp
- * and nmdesc->pp is NULL if it's not.
+ /* For system memory, page type in struct page is used to
+ * determine if the pages belong to a page pool.
*/
if (!netmem_is_net_iov(netmem))
- netmem_clear_pp_magic(netmem);
+ __ClearPageNetpp(__netmem_to_page(netmem));
netmem_set_pp(netmem, NULL);
}
--
2.17.1On Thu, Oct 23, 2025 at 12:45 AM Byungchul Park <byungchul@sk.com> wrote:
>
> ->pp_magic field in struct page is current used to identify if a page
> belongs to a page pool. However, ->pp_magic will be removed and page
> type bit in struct page e.i. PGTY_netpp can be used for that purpose.
>
> Introduce and use the page type APIs e.g. PageNetpp(), __SetPageNetpp(),
> and __ClearPageNetpp() instead, and remove the existing APIs accessing
> ->pp_magic e.g. page_pool_page_is_pp(), netmem_or_pp_magic(), and
> netmem_clear_pp_magic().
>
> This work was inspired by the following link:
>
> [1] https://lore.kernel.org/all/582f41c0-2742-4400-9c81-0d46bf4e8314@gmail.com/
>
> While at it, move the sanity check for page pool to on free.
>
> Suggested-by: David Hildenbrand <david@redhat.com>
> Co-developed-by: Pavel Begunkov <asml.silence@gmail.com>
> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
> Signed-off-by: Byungchul Park <byungchul@sk.com>
> Acked-by: David Hildenbrand <david@redhat.com>
> Acked-by: Zi Yan <ziy@nvidia.com>
> ---
> Hi Mina,
>
> I dropped your Reviewed-by tag since there are updates on some comments
> in network part. Can I still keep your Reviewed-by?
>
> Byungchul
> ---
> .../net/ethernet/mellanox/mlx5/core/en/xdp.c | 2 +-
> include/linux/mm.h | 27 +++----------------
> include/linux/page-flags.h | 6 +++++
> include/net/netmem.h | 2 +-
> mm/page_alloc.c | 8 +++---
> net/core/netmem_priv.h | 17 +++---------
> net/core/page_pool.c | 14 +++++-----
> 7 files changed, 25 insertions(+), 51 deletions(-)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> index 5d51600935a6..def274f5c1ca 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> @@ -707,7 +707,7 @@ static void mlx5e_free_xdpsq_desc(struct mlx5e_xdpsq *sq,
> xdpi = mlx5e_xdpi_fifo_pop(xdpi_fifo);
> page = xdpi.page.page;
>
> - /* No need to check page_pool_page_is_pp() as we
> + /* No need to check PageNetpp() as we
> * know this is a page_pool page.
> */
> page_pool_recycle_direct(pp_page_to_nmdesc(page)->pp,
> diff --git a/include/linux/mm.h b/include/linux/mm.h
> index b6fdf3557807..f5155f1c75f5 100644
> --- a/include/linux/mm.h
> +++ b/include/linux/mm.h
> @@ -4361,10 +4361,9 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
> * DMA mapping IDs for page_pool
> *
> * When DMA-mapping a page, page_pool allocates an ID (from an xarray) and
> - * stashes it in the upper bits of page->pp_magic. We always want to be able to
> - * unambiguously identify page pool pages (using page_pool_page_is_pp()). Non-PP
> - * pages can have arbitrary kernel pointers stored in the same field as pp_magic
> - * (since it overlaps with page->lru.next), so we must ensure that we cannot
> + * stashes it in the upper bits of page->pp_magic. Non-PP pages can have
> + * arbitrary kernel pointers stored in the same field as pp_magic (since
> + * it overlaps with page->lru.next), so we must ensure that we cannot
> * mistake a valid kernel pointer with any of the values we write into this
> * field.
> *
> @@ -4399,26 +4398,6 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
> #define PP_DMA_INDEX_MASK GENMASK(PP_DMA_INDEX_BITS + PP_DMA_INDEX_SHIFT - 1, \
> PP_DMA_INDEX_SHIFT)
>
> -/* Mask used for checking in page_pool_page_is_pp() below. page->pp_magic is
> - * OR'ed with PP_SIGNATURE after the allocation in order to preserve bit 0 for
> - * the head page of compound page and bit 1 for pfmemalloc page, as well as the
> - * bits used for the DMA index. page_is_pfmemalloc() is checked in
> - * __page_pool_put_page() to avoid recycling the pfmemalloc page.
> - */
> -#define PP_MAGIC_MASK ~(PP_DMA_INDEX_MASK | 0x3UL)
> -
> -#ifdef CONFIG_PAGE_POOL
> -static inline bool page_pool_page_is_pp(const struct page *page)
> -{
> - return (page->pp_magic & PP_MAGIC_MASK) == PP_SIGNATURE;
> -}
> -#else
> -static inline bool page_pool_page_is_pp(const struct page *page)
> -{
> - return false;
> -}
> -#endif
> -
> #define PAGE_SNAPSHOT_FAITHFUL (1 << 0)
> #define PAGE_SNAPSHOT_PG_BUDDY (1 << 1)
> #define PAGE_SNAPSHOT_PG_IDLE (1 << 2)
> diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
> index 0091ad1986bf..edf5418c91dd 100644
> --- a/include/linux/page-flags.h
> +++ b/include/linux/page-flags.h
> @@ -934,6 +934,7 @@ enum pagetype {
> PGTY_zsmalloc = 0xf6,
> PGTY_unaccepted = 0xf7,
> PGTY_large_kmalloc = 0xf8,
> + PGTY_netpp = 0xf9,
>
> PGTY_mapcount_underflow = 0xff
> };
> @@ -1078,6 +1079,11 @@ PAGE_TYPE_OPS(Zsmalloc, zsmalloc, zsmalloc)
> PAGE_TYPE_OPS(Unaccepted, unaccepted, unaccepted)
> FOLIO_TYPE_OPS(large_kmalloc, large_kmalloc)
>
> +/*
> + * Marks page_pool allocated pages.
> + */
> +PAGE_TYPE_OPS(Netpp, netpp, netpp)
> +
> /**
> * PageHuge - Determine if the page belongs to hugetlbfs
> * @page: The page to test.
> diff --git a/include/net/netmem.h b/include/net/netmem.h
> index 651e2c62d1dd..0ec4c7561081 100644
> --- a/include/net/netmem.h
> +++ b/include/net/netmem.h
> @@ -260,7 +260,7 @@ static inline unsigned long netmem_pfn_trace(netmem_ref netmem)
> */
> #define pp_page_to_nmdesc(p) \
> ({ \
> - DEBUG_NET_WARN_ON_ONCE(!page_pool_page_is_pp(p)); \
> + DEBUG_NET_WARN_ON_ONCE(!PageNetpp(p)); \
> __pp_page_to_nmdesc(p); \
> })
>
> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> index fb91c566327c..c69ed3741bbc 100644
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -1042,7 +1042,6 @@ static inline bool page_expected_state(struct page *page,
> #ifdef CONFIG_MEMCG
> page->memcg_data |
> #endif
> - page_pool_page_is_pp(page) |
Shouldn't you replace the page_pool_page_is_pp check with a PageNetpp
check in this call site and below? Or is that no longer necessary for
some reason?
On 27 Oct 2025, at 21:28, Mina Almasry wrote:
> On Thu, Oct 23, 2025 at 12:45 AM Byungchul Park <byungchul@sk.com> wrote:
>>
>> ->pp_magic field in struct page is current used to identify if a page
>> belongs to a page pool. However, ->pp_magic will be removed and page
>> type bit in struct page e.i. PGTY_netpp can be used for that purpose.
>>
>> Introduce and use the page type APIs e.g. PageNetpp(), __SetPageNetpp(),
>> and __ClearPageNetpp() instead, and remove the existing APIs accessing
>> ->pp_magic e.g. page_pool_page_is_pp(), netmem_or_pp_magic(), and
>> netmem_clear_pp_magic().
>>
>> This work was inspired by the following link:
>>
>> [1] https://lore.kernel.org/all/582f41c0-2742-4400-9c81-0d46bf4e8314@gmail.com/
>>
>> While at it, move the sanity check for page pool to on free.
>>
>> Suggested-by: David Hildenbrand <david@redhat.com>
>> Co-developed-by: Pavel Begunkov <asml.silence@gmail.com>
>> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
>> Signed-off-by: Byungchul Park <byungchul@sk.com>
>> Acked-by: David Hildenbrand <david@redhat.com>
>> Acked-by: Zi Yan <ziy@nvidia.com>
>> ---
>> Hi Mina,
>>
>> I dropped your Reviewed-by tag since there are updates on some comments
>> in network part. Can I still keep your Reviewed-by?
>>
>> Byungchul
>> ---
>> .../net/ethernet/mellanox/mlx5/core/en/xdp.c | 2 +-
>> include/linux/mm.h | 27 +++----------------
>> include/linux/page-flags.h | 6 +++++
>> include/net/netmem.h | 2 +-
>> mm/page_alloc.c | 8 +++---
>> net/core/netmem_priv.h | 17 +++---------
>> net/core/page_pool.c | 14 +++++-----
>> 7 files changed, 25 insertions(+), 51 deletions(-)
>>
>> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
>> index 5d51600935a6..def274f5c1ca 100644
>> --- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
>> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
>> @@ -707,7 +707,7 @@ static void mlx5e_free_xdpsq_desc(struct mlx5e_xdpsq *sq,
>> xdpi = mlx5e_xdpi_fifo_pop(xdpi_fifo);
>> page = xdpi.page.page;
>>
>> - /* No need to check page_pool_page_is_pp() as we
>> + /* No need to check PageNetpp() as we
>> * know this is a page_pool page.
>> */
>> page_pool_recycle_direct(pp_page_to_nmdesc(page)->pp,
>> diff --git a/include/linux/mm.h b/include/linux/mm.h
>> index b6fdf3557807..f5155f1c75f5 100644
>> --- a/include/linux/mm.h
>> +++ b/include/linux/mm.h
>> @@ -4361,10 +4361,9 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
>> * DMA mapping IDs for page_pool
>> *
>> * When DMA-mapping a page, page_pool allocates an ID (from an xarray) and
>> - * stashes it in the upper bits of page->pp_magic. We always want to be able to
>> - * unambiguously identify page pool pages (using page_pool_page_is_pp()). Non-PP
>> - * pages can have arbitrary kernel pointers stored in the same field as pp_magic
>> - * (since it overlaps with page->lru.next), so we must ensure that we cannot
>> + * stashes it in the upper bits of page->pp_magic. Non-PP pages can have
>> + * arbitrary kernel pointers stored in the same field as pp_magic (since
>> + * it overlaps with page->lru.next), so we must ensure that we cannot
>> * mistake a valid kernel pointer with any of the values we write into this
>> * field.
>> *
>> @@ -4399,26 +4398,6 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
>> #define PP_DMA_INDEX_MASK GENMASK(PP_DMA_INDEX_BITS + PP_DMA_INDEX_SHIFT - 1, \
>> PP_DMA_INDEX_SHIFT)
>>
>> -/* Mask used for checking in page_pool_page_is_pp() below. page->pp_magic is
>> - * OR'ed with PP_SIGNATURE after the allocation in order to preserve bit 0 for
>> - * the head page of compound page and bit 1 for pfmemalloc page, as well as the
>> - * bits used for the DMA index. page_is_pfmemalloc() is checked in
>> - * __page_pool_put_page() to avoid recycling the pfmemalloc page.
>> - */
>> -#define PP_MAGIC_MASK ~(PP_DMA_INDEX_MASK | 0x3UL)
>> -
>> -#ifdef CONFIG_PAGE_POOL
>> -static inline bool page_pool_page_is_pp(const struct page *page)
>> -{
>> - return (page->pp_magic & PP_MAGIC_MASK) == PP_SIGNATURE;
>> -}
>> -#else
>> -static inline bool page_pool_page_is_pp(const struct page *page)
>> -{
>> - return false;
>> -}
>> -#endif
>> -
>> #define PAGE_SNAPSHOT_FAITHFUL (1 << 0)
>> #define PAGE_SNAPSHOT_PG_BUDDY (1 << 1)
>> #define PAGE_SNAPSHOT_PG_IDLE (1 << 2)
>> diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
>> index 0091ad1986bf..edf5418c91dd 100644
>> --- a/include/linux/page-flags.h
>> +++ b/include/linux/page-flags.h
>> @@ -934,6 +934,7 @@ enum pagetype {
>> PGTY_zsmalloc = 0xf6,
>> PGTY_unaccepted = 0xf7,
>> PGTY_large_kmalloc = 0xf8,
>> + PGTY_netpp = 0xf9,
>>
>> PGTY_mapcount_underflow = 0xff
>> };
>> @@ -1078,6 +1079,11 @@ PAGE_TYPE_OPS(Zsmalloc, zsmalloc, zsmalloc)
>> PAGE_TYPE_OPS(Unaccepted, unaccepted, unaccepted)
>> FOLIO_TYPE_OPS(large_kmalloc, large_kmalloc)
>>
>> +/*
>> + * Marks page_pool allocated pages.
>> + */
>> +PAGE_TYPE_OPS(Netpp, netpp, netpp)
>> +
>> /**
>> * PageHuge - Determine if the page belongs to hugetlbfs
>> * @page: The page to test.
>> diff --git a/include/net/netmem.h b/include/net/netmem.h
>> index 651e2c62d1dd..0ec4c7561081 100644
>> --- a/include/net/netmem.h
>> +++ b/include/net/netmem.h
>> @@ -260,7 +260,7 @@ static inline unsigned long netmem_pfn_trace(netmem_ref netmem)
>> */
>> #define pp_page_to_nmdesc(p) \
>> ({ \
>> - DEBUG_NET_WARN_ON_ONCE(!page_pool_page_is_pp(p)); \
>> + DEBUG_NET_WARN_ON_ONCE(!PageNetpp(p)); \
>> __pp_page_to_nmdesc(p); \
>> })
>>
>> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
>> index fb91c566327c..c69ed3741bbc 100644
>> --- a/mm/page_alloc.c
>> +++ b/mm/page_alloc.c
>> @@ -1042,7 +1042,6 @@ static inline bool page_expected_state(struct page *page,
>> #ifdef CONFIG_MEMCG
>> page->memcg_data |
>> #endif
>> - page_pool_page_is_pp(page) |
>
> Shouldn't you replace the page_pool_page_is_pp check with a PageNetpp
> check in this call site and below? Or is that no longer necessary for
> some reason?
It is done in the hunk below this one:
@@ -1379,9 +1376,12 @@ __always_inline bool free_pages_prepare(struct page *page,
mod_mthp_stat(order, MTHP_STAT_NR_ANON, -1);
folio->mapping = NULL;
}
- if (unlikely(page_has_type(page)))
+ if (unlikely(page_has_type(page))) {
+ /* networking expects to clear its page type before releasing */
+ WARN_ON_ONCE(PageNetpp(page));
/* Reset the page_type (which overlays _mapcount) */
page->page_type = UINT_MAX;
+ }
if (is_check_pages_enabled()) {
if (free_page_is_bad(page))
where
free_pages_prepare()
-> free_page_is_bad()
-> page_expected_state()
--
Best Regards,
Yan, Zi
On Mon, Oct 27, 2025 at 6:45 PM Zi Yan <ziy@nvidia.com> wrote:
>
> On 27 Oct 2025, at 21:28, Mina Almasry wrote:
>
> > On Thu, Oct 23, 2025 at 12:45 AM Byungchul Park <byungchul@sk.com> wrote:
> >>
> >> ->pp_magic field in struct page is current used to identify if a page
> >> belongs to a page pool. However, ->pp_magic will be removed and page
> >> type bit in struct page e.i. PGTY_netpp can be used for that purpose.
> >>
> >> Introduce and use the page type APIs e.g. PageNetpp(), __SetPageNetpp(),
> >> and __ClearPageNetpp() instead, and remove the existing APIs accessing
> >> ->pp_magic e.g. page_pool_page_is_pp(), netmem_or_pp_magic(), and
> >> netmem_clear_pp_magic().
> >>
> >> This work was inspired by the following link:
> >>
> >> [1] https://lore.kernel.org/all/582f41c0-2742-4400-9c81-0d46bf4e8314@gmail.com/
> >>
> >> While at it, move the sanity check for page pool to on free.
> >>
> >> Suggested-by: David Hildenbrand <david@redhat.com>
> >> Co-developed-by: Pavel Begunkov <asml.silence@gmail.com>
> >> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
> >> Signed-off-by: Byungchul Park <byungchul@sk.com>
> >> Acked-by: David Hildenbrand <david@redhat.com>
> >> Acked-by: Zi Yan <ziy@nvidia.com>
> >> ---
> >> Hi Mina,
> >>
> >> I dropped your Reviewed-by tag since there are updates on some comments
> >> in network part. Can I still keep your Reviewed-by?
> >>
> >> Byungchul
> >> ---
> >> .../net/ethernet/mellanox/mlx5/core/en/xdp.c | 2 +-
> >> include/linux/mm.h | 27 +++----------------
> >> include/linux/page-flags.h | 6 +++++
> >> include/net/netmem.h | 2 +-
> >> mm/page_alloc.c | 8 +++---
> >> net/core/netmem_priv.h | 17 +++---------
> >> net/core/page_pool.c | 14 +++++-----
> >> 7 files changed, 25 insertions(+), 51 deletions(-)
> >>
> >> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> >> index 5d51600935a6..def274f5c1ca 100644
> >> --- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> >> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> >> @@ -707,7 +707,7 @@ static void mlx5e_free_xdpsq_desc(struct mlx5e_xdpsq *sq,
> >> xdpi = mlx5e_xdpi_fifo_pop(xdpi_fifo);
> >> page = xdpi.page.page;
> >>
> >> - /* No need to check page_pool_page_is_pp() as we
> >> + /* No need to check PageNetpp() as we
> >> * know this is a page_pool page.
> >> */
> >> page_pool_recycle_direct(pp_page_to_nmdesc(page)->pp,
> >> diff --git a/include/linux/mm.h b/include/linux/mm.h
> >> index b6fdf3557807..f5155f1c75f5 100644
> >> --- a/include/linux/mm.h
> >> +++ b/include/linux/mm.h
> >> @@ -4361,10 +4361,9 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
> >> * DMA mapping IDs for page_pool
> >> *
> >> * When DMA-mapping a page, page_pool allocates an ID (from an xarray) and
> >> - * stashes it in the upper bits of page->pp_magic. We always want to be able to
> >> - * unambiguously identify page pool pages (using page_pool_page_is_pp()). Non-PP
> >> - * pages can have arbitrary kernel pointers stored in the same field as pp_magic
> >> - * (since it overlaps with page->lru.next), so we must ensure that we cannot
> >> + * stashes it in the upper bits of page->pp_magic. Non-PP pages can have
> >> + * arbitrary kernel pointers stored in the same field as pp_magic (since
> >> + * it overlaps with page->lru.next), so we must ensure that we cannot
> >> * mistake a valid kernel pointer with any of the values we write into this
> >> * field.
> >> *
> >> @@ -4399,26 +4398,6 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
> >> #define PP_DMA_INDEX_MASK GENMASK(PP_DMA_INDEX_BITS + PP_DMA_INDEX_SHIFT - 1, \
> >> PP_DMA_INDEX_SHIFT)
> >>
> >> -/* Mask used for checking in page_pool_page_is_pp() below. page->pp_magic is
> >> - * OR'ed with PP_SIGNATURE after the allocation in order to preserve bit 0 for
> >> - * the head page of compound page and bit 1 for pfmemalloc page, as well as the
> >> - * bits used for the DMA index. page_is_pfmemalloc() is checked in
> >> - * __page_pool_put_page() to avoid recycling the pfmemalloc page.
> >> - */
> >> -#define PP_MAGIC_MASK ~(PP_DMA_INDEX_MASK | 0x3UL)
> >> -
> >> -#ifdef CONFIG_PAGE_POOL
> >> -static inline bool page_pool_page_is_pp(const struct page *page)
> >> -{
> >> - return (page->pp_magic & PP_MAGIC_MASK) == PP_SIGNATURE;
> >> -}
> >> -#else
> >> -static inline bool page_pool_page_is_pp(const struct page *page)
> >> -{
> >> - return false;
> >> -}
> >> -#endif
> >> -
> >> #define PAGE_SNAPSHOT_FAITHFUL (1 << 0)
> >> #define PAGE_SNAPSHOT_PG_BUDDY (1 << 1)
> >> #define PAGE_SNAPSHOT_PG_IDLE (1 << 2)
> >> diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
> >> index 0091ad1986bf..edf5418c91dd 100644
> >> --- a/include/linux/page-flags.h
> >> +++ b/include/linux/page-flags.h
> >> @@ -934,6 +934,7 @@ enum pagetype {
> >> PGTY_zsmalloc = 0xf6,
> >> PGTY_unaccepted = 0xf7,
> >> PGTY_large_kmalloc = 0xf8,
> >> + PGTY_netpp = 0xf9,
> >>
> >> PGTY_mapcount_underflow = 0xff
> >> };
> >> @@ -1078,6 +1079,11 @@ PAGE_TYPE_OPS(Zsmalloc, zsmalloc, zsmalloc)
> >> PAGE_TYPE_OPS(Unaccepted, unaccepted, unaccepted)
> >> FOLIO_TYPE_OPS(large_kmalloc, large_kmalloc)
> >>
> >> +/*
> >> + * Marks page_pool allocated pages.
> >> + */
> >> +PAGE_TYPE_OPS(Netpp, netpp, netpp)
> >> +
> >> /**
> >> * PageHuge - Determine if the page belongs to hugetlbfs
> >> * @page: The page to test.
> >> diff --git a/include/net/netmem.h b/include/net/netmem.h
> >> index 651e2c62d1dd..0ec4c7561081 100644
> >> --- a/include/net/netmem.h
> >> +++ b/include/net/netmem.h
> >> @@ -260,7 +260,7 @@ static inline unsigned long netmem_pfn_trace(netmem_ref netmem)
> >> */
> >> #define pp_page_to_nmdesc(p) \
> >> ({ \
> >> - DEBUG_NET_WARN_ON_ONCE(!page_pool_page_is_pp(p)); \
> >> + DEBUG_NET_WARN_ON_ONCE(!PageNetpp(p)); \
> >> __pp_page_to_nmdesc(p); \
> >> })
> >>
> >> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> >> index fb91c566327c..c69ed3741bbc 100644
> >> --- a/mm/page_alloc.c
> >> +++ b/mm/page_alloc.c
> >> @@ -1042,7 +1042,6 @@ static inline bool page_expected_state(struct page *page,
> >> #ifdef CONFIG_MEMCG
> >> page->memcg_data |
> >> #endif
> >> - page_pool_page_is_pp(page) |
> >
> > Shouldn't you replace the page_pool_page_is_pp check with a PageNetpp
> > check in this call site and below? Or is that no longer necessary for
> > some reason?
>
> It is done in the hunk below this one:
>
> @@ -1379,9 +1376,12 @@ __always_inline bool free_pages_prepare(struct page *page,
> mod_mthp_stat(order, MTHP_STAT_NR_ANON, -1);
> folio->mapping = NULL;
> }
> - if (unlikely(page_has_type(page)))
> + if (unlikely(page_has_type(page))) {
> + /* networking expects to clear its page type before releasing */
> + WARN_ON_ONCE(PageNetpp(page));
> /* Reset the page_type (which overlays _mapcount) */
> page->page_type = UINT_MAX;
> + }
>
> if (is_check_pages_enabled()) {
> if (free_page_is_bad(page))
>
> where
> free_pages_prepare()
> -> free_page_is_bad()
> -> page_expected_state()
>
Thanks, looks fine to me then. I'm not extremely familiar with this
code so I won't give a Reviewed-by, but here is an ack, FWIW:
Acked-by: Mina Almasry <almasrymina@google.com>
--
Thanks,
Mina
© 2016 - 2026 Red Hat, Inc.