[PATCH] mm, page_pool: introduce a new page type for page pool in page type

[PATCH] mm, page_pool: introduce a new page type for page pool in page type

[Byungchul Park]

Hi,

I focused on converting the existing APIs accessing ->pp_magic field to
page type APIs.  However, yes.  Additional works would better be
considered on top like:

   1. Adjust how to store and retrieve dma index.  Maybe network guys
      can work better on top.

   2. Move the sanity check for page pool in mm/page_alloc.c to on free.

   Byungchul

---8<---
From 7d207a1b3e9f4ff2a72f5b54b09e3ed0c4aaaca3 Mon Sep 17 00:00:00 2001
From: Byungchul Park <byungchul@sk.com>
Date: Mon, 21 Jul 2025 14:05:20 +0900
Subject: [PATCH] mm, page_pool: introduce a new page type for page pool in page type

->pp_magic field in struct page is current used to identify if a page
belongs to a page pool.  However, page type e.i. PGTY_netpp can be used
for that purpose.

Use the page type APIs e.g. PageNetpp(), __SetPageNetpp(), and
__ClearPageNetpp() instead, and remove the existing APIs accessing
->pp_magic e.g. page_pool_page_is_pp(), netmem_or_pp_magic(), and
netmem_clear_pp_magic() since they are totally replaced.

This work was inspired by the following link by Pavel:

[1] https://lore.kernel.org/all/582f41c0-2742-4400-9c81-0d46bf4e8314@gmail.com/

Suggested-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Byungchul Park <byungchul@sk.com>
---
 .../net/ethernet/mellanox/mlx5/core/en/xdp.c  |  2 +-
 include/linux/mm.h                            | 28 ++-----------------
 include/linux/page-flags.h                    |  6 ++++
 include/net/netmem.h                          |  2 +-
 mm/page_alloc.c                               |  4 +--
 net/core/netmem_priv.h                        | 16 ++---------
 net/core/page_pool.c                          | 10 +++++--
 7 files changed, 24 insertions(+), 44 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
index 5d51600935a6..def274f5c1ca 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
@@ -707,7 +707,7 @@ static void mlx5e_free_xdpsq_desc(struct mlx5e_xdpsq *sq,
 				xdpi = mlx5e_xdpi_fifo_pop(xdpi_fifo);
 				page = xdpi.page.page;
 
-				/* No need to check page_pool_page_is_pp() as we
+				/* No need to check PageNetpp() as we
 				 * know this is a page_pool page.
 				 */
 				page_pool_recycle_direct(pp_page_to_nmdesc(page)->pp,
diff --git a/include/linux/mm.h b/include/linux/mm.h
index ae50c1641bed..736061749535 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -4135,10 +4135,9 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
  * DMA mapping IDs for page_pool
  *
  * When DMA-mapping a page, page_pool allocates an ID (from an xarray) and
- * stashes it in the upper bits of page->pp_magic. We always want to be able to
- * unambiguously identify page pool pages (using page_pool_page_is_pp()). Non-PP
- * pages can have arbitrary kernel pointers stored in the same field as pp_magic
- * (since it overlaps with page->lru.next), so we must ensure that we cannot
+ * stashes it in the upper bits of page->pp_magic. Non-PP pages can have
+ * arbitrary kernel pointers stored in the same field as pp_magic (since
+ * it overlaps with page->lru.next), so we must ensure that we cannot
  * mistake a valid kernel pointer with any of the values we write into this
  * field.
  *
@@ -4168,25 +4167,4 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
 
 #define PP_DMA_INDEX_MASK GENMASK(PP_DMA_INDEX_BITS + PP_DMA_INDEX_SHIFT - 1, \
 				  PP_DMA_INDEX_SHIFT)
-
-/* Mask used for checking in page_pool_page_is_pp() below. page->pp_magic is
- * OR'ed with PP_SIGNATURE after the allocation in order to preserve bit 0 for
- * the head page of compound page and bit 1 for pfmemalloc page, as well as the
- * bits used for the DMA index. page_is_pfmemalloc() is checked in
- * __page_pool_put_page() to avoid recycling the pfmemalloc page.
- */
-#define PP_MAGIC_MASK ~(PP_DMA_INDEX_MASK | 0x3UL)
-
-#ifdef CONFIG_PAGE_POOL
-static inline bool page_pool_page_is_pp(const struct page *page)
-{
-	return (page->pp_magic & PP_MAGIC_MASK) == PP_SIGNATURE;
-}
-#else
-static inline bool page_pool_page_is_pp(const struct page *page)
-{
-	return false;
-}
-#endif
-
 #endif /* _LINUX_MM_H */
diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index 4fe5ee67535b..906ba7c9e372 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -957,6 +957,7 @@ enum pagetype {
 	PGTY_zsmalloc		= 0xf6,
 	PGTY_unaccepted		= 0xf7,
 	PGTY_large_kmalloc	= 0xf8,
+	PGTY_netpp		= 0xf9,
 
 	PGTY_mapcount_underflow = 0xff
 };
@@ -1101,6 +1102,11 @@ PAGE_TYPE_OPS(Zsmalloc, zsmalloc, zsmalloc)
 PAGE_TYPE_OPS(Unaccepted, unaccepted, unaccepted)
 FOLIO_TYPE_OPS(large_kmalloc, large_kmalloc)
 
+/*
+ * Marks page_pool allocated pages.
+ */
+PAGE_TYPE_OPS(Netpp, netpp, netpp)
+
 /**
  * PageHuge - Determine if the page belongs to hugetlbfs
  * @page: The page to test.
diff --git a/include/net/netmem.h b/include/net/netmem.h
index f7dacc9e75fd..3667334e16e7 100644
--- a/include/net/netmem.h
+++ b/include/net/netmem.h
@@ -298,7 +298,7 @@ static inline struct net_iov *__netmem_clear_lsb(netmem_ref netmem)
  */
 #define pp_page_to_nmdesc(p)						\
 ({									\
-	DEBUG_NET_WARN_ON_ONCE(!page_pool_page_is_pp(p));		\
+	DEBUG_NET_WARN_ON_ONCE(!PageNetpp(p));				\
 	__pp_page_to_nmdesc(p);						\
 })
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 2ef3c07266b3..71c7666e48a9 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -898,7 +898,7 @@ static inline bool page_expected_state(struct page *page,
 #ifdef CONFIG_MEMCG
 			page->memcg_data |
 #endif
-			page_pool_page_is_pp(page) |
+			PageNetpp(page) |
 			(page->flags & check_flags)))
 		return false;
 
@@ -925,7 +925,7 @@ static const char *page_bad_reason(struct page *page, unsigned long flags)
 	if (unlikely(page->memcg_data))
 		bad_reason = "page still charged to cgroup";
 #endif
-	if (unlikely(page_pool_page_is_pp(page)))
+	if (unlikely(PageNetpp(page)))
 		bad_reason = "page_pool leak";
 	return bad_reason;
 }
diff --git a/net/core/netmem_priv.h b/net/core/netmem_priv.h
index cd95394399b4..39a97703d9ed 100644
--- a/net/core/netmem_priv.h
+++ b/net/core/netmem_priv.h
@@ -8,21 +8,11 @@ static inline unsigned long netmem_get_pp_magic(netmem_ref netmem)
 	return __netmem_clear_lsb(netmem)->pp_magic & ~PP_DMA_INDEX_MASK;
 }
 
-static inline void netmem_or_pp_magic(netmem_ref netmem, unsigned long pp_magic)
-{
-	__netmem_clear_lsb(netmem)->pp_magic |= pp_magic;
-}
-
-static inline void netmem_clear_pp_magic(netmem_ref netmem)
-{
-	WARN_ON_ONCE(__netmem_clear_lsb(netmem)->pp_magic & PP_DMA_INDEX_MASK);
-
-	__netmem_clear_lsb(netmem)->pp_magic = 0;
-}
-
 static inline bool netmem_is_pp(netmem_ref netmem)
 {
-	return (netmem_get_pp_magic(netmem) & PP_MAGIC_MASK) == PP_SIGNATURE;
+	if (netmem_is_net_iov(netmem))
+		return true;
+	return PageNetpp(__netmem_to_page(netmem));
 }
 
 static inline void netmem_set_pp(netmem_ref netmem, struct page_pool *pool)
diff --git a/net/core/page_pool.c b/net/core/page_pool.c
index 05e2e22a8f7c..0a10f3026faa 100644
--- a/net/core/page_pool.c
+++ b/net/core/page_pool.c
@@ -654,7 +654,6 @@ s32 page_pool_inflight(const struct page_pool *pool, bool strict)
 void page_pool_set_pp_info(struct page_pool *pool, netmem_ref netmem)
 {
 	netmem_set_pp(netmem, pool);
-	netmem_or_pp_magic(netmem, PP_SIGNATURE);
 
 	/* Ensuring all pages have been split into one fragment initially:
 	 * page_pool_set_pp_info() is only called once for every page when it
@@ -665,12 +664,19 @@ void page_pool_set_pp_info(struct page_pool *pool, netmem_ref netmem)
 	page_pool_fragment_netmem(netmem, 1);
 	if (pool->has_init_callback)
 		pool->slow.init_callback(netmem, pool->slow.init_arg);
+
+	if (netmem_is_net_iov(netmem))
+		return;
+	__SetPageNetpp(__netmem_to_page(netmem));
 }
 
 void page_pool_clear_pp_info(netmem_ref netmem)
 {
-	netmem_clear_pp_magic(netmem);
 	netmem_set_pp(netmem, NULL);
+
+	if (netmem_is_net_iov(netmem))
+		return;
+	__ClearPageNetpp(__netmem_to_page(netmem));
 }
 
 static __always_inline void __page_pool_release_netmem_dma(struct page_pool *pool,
-- 
2.17.1

Re: [PATCH] mm, page_pool: introduce a new page type for page pool in page type

[David Hildenbrand]

On 21.07.25 07:49, Byungchul Park wrote:
> Hi,
> 
> I focused on converting the existing APIs accessing ->pp_magic field to
> page type APIs.  However, yes.  Additional works would better be
> considered on top like:
> 
>     1. Adjust how to store and retrieve dma index.  Maybe network guys
>        can work better on top.
> 
>     2. Move the sanity check for page pool in mm/page_alloc.c to on free.
> 
>     Byungchul
> 
> ---8<---
>  From 7d207a1b3e9f4ff2a72f5b54b09e3ed0c4aaaca3 Mon Sep 17 00:00:00 2001
> From: Byungchul Park <byungchul@sk.com>
> Date: Mon, 21 Jul 2025 14:05:20 +0900
> Subject: [PATCH] mm, page_pool: introduce a new page type for page pool in page type
> 
> ->pp_magic field in struct page is current used to identify if a page
> belongs to a page pool.  However, page type e.i. PGTY_netpp can be used
> for that purpose.
> 
> Use the page type APIs e.g. PageNetpp(), __SetPageNetpp(), and
> __ClearPageNetpp() instead, and remove the existing APIs accessing
> ->pp_magic e.g. page_pool_page_is_pp(), netmem_or_pp_magic(), and
> netmem_clear_pp_magic() since they are totally replaced.
> 
> This work was inspired by the following link by Pavel:
> 
> [1] https://lore.kernel.org/all/582f41c0-2742-4400-9c81-0d46bf4e8314@gmail.com/

I'm, sure you saw my comment (including my earlier suggestion for using 
a page type), in particular around ...

> ---
>   .../net/ethernet/mellanox/mlx5/core/en/xdp.c  |  2 +-
>   include/linux/mm.h                            | 28 ++-----------------
>   include/linux/page-flags.h                    |  6 ++++
>   include/net/netmem.h                          |  2 +-
>   mm/page_alloc.c                               |  4 +--
>   net/core/netmem_priv.h                        | 16 ++---------
>   net/core/page_pool.c                          | 10 +++++--
>   7 files changed, 24 insertions(+), 44 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> index 5d51600935a6..def274f5c1ca 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> @@ -707,7 +707,7 @@ static void mlx5e_free_xdpsq_desc(struct mlx5e_xdpsq *sq,
>   				xdpi = mlx5e_xdpi_fifo_pop(xdpi_fifo);
>   				page = xdpi.page.page;
>   
> -				/* No need to check page_pool_page_is_pp() as we
> +				/* No need to check PageNetpp() as we
>   				 * know this is a page_pool page.
>   				 */
>   				page_pool_recycle_direct(pp_page_to_nmdesc(page)->pp,
> diff --git a/include/linux/mm.h b/include/linux/mm.h
> index ae50c1641bed..736061749535 100644
> --- a/include/linux/mm.h
> +++ b/include/linux/mm.h
> @@ -4135,10 +4135,9 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
>    * DMA mapping IDs for page_pool
>    *
>    * When DMA-mapping a page, page_pool allocates an ID (from an xarray) and
> - * stashes it in the upper bits of page->pp_magic. We always want to be able to
> - * unambiguously identify page pool pages (using page_pool_page_is_pp()). Non-PP
> - * pages can have arbitrary kernel pointers stored in the same field as pp_magic
> - * (since it overlaps with page->lru.next), so we must ensure that we cannot
> + * stashes it in the upper bits of page->pp_magic. Non-PP pages can have
> + * arbitrary kernel pointers stored in the same field as pp_magic (since
> + * it overlaps with page->lru.next), so we must ensure that we cannot
>    * mistake a valid kernel pointer with any of the values we write into this
>    * field.
>    *
> @@ -4168,25 +4167,4 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
>   
>   #define PP_DMA_INDEX_MASK GENMASK(PP_DMA_INDEX_BITS + PP_DMA_INDEX_SHIFT - 1, \
>   				  PP_DMA_INDEX_SHIFT)
> -
> -/* Mask used for checking in page_pool_page_is_pp() below. page->pp_magic is
> - * OR'ed with PP_SIGNATURE after the allocation in order to preserve bit 0 for
> - * the head page of compound page and bit 1 for pfmemalloc page, as well as the
> - * bits used for the DMA index. page_is_pfmemalloc() is checked in
> - * __page_pool_put_page() to avoid recycling the pfmemalloc page.
> - */
> -#define PP_MAGIC_MASK ~(PP_DMA_INDEX_MASK | 0x3UL)
> -
> -#ifdef CONFIG_PAGE_POOL
> -static inline bool page_pool_page_is_pp(const struct page *page)
> -{
> -	return (page->pp_magic & PP_MAGIC_MASK) == PP_SIGNATURE;
> -}
> -#else
> -static inline bool page_pool_page_is_pp(const struct page *page)
> -{
> -	return false;
> -}
> -#endif
> -
>   #endif /* _LINUX_MM_H */
> diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
> index 4fe5ee67535b..906ba7c9e372 100644
> --- a/include/linux/page-flags.h
> +++ b/include/linux/page-flags.h
> @@ -957,6 +957,7 @@ enum pagetype {
>   	PGTY_zsmalloc		= 0xf6,
>   	PGTY_unaccepted		= 0xf7,
>   	PGTY_large_kmalloc	= 0xf8,
> +	PGTY_netpp		= 0xf9,
>   
>   	PGTY_mapcount_underflow = 0xff
>   };
> @@ -1101,6 +1102,11 @@ PAGE_TYPE_OPS(Zsmalloc, zsmalloc, zsmalloc)
>   PAGE_TYPE_OPS(Unaccepted, unaccepted, unaccepted)
>   FOLIO_TYPE_OPS(large_kmalloc, large_kmalloc)
>   
> +/*
> + * Marks page_pool allocated pages.
> + */
> +PAGE_TYPE_OPS(Netpp, netpp, netpp)
> +
>   /**
>    * PageHuge - Determine if the page belongs to hugetlbfs
>    * @page: The page to test.
> diff --git a/include/net/netmem.h b/include/net/netmem.h
> index f7dacc9e75fd..3667334e16e7 100644
> --- a/include/net/netmem.h
> +++ b/include/net/netmem.h
> @@ -298,7 +298,7 @@ static inline struct net_iov *__netmem_clear_lsb(netmem_ref netmem)
>    */
>   #define pp_page_to_nmdesc(p)						\
>   ({									\
> -	DEBUG_NET_WARN_ON_ONCE(!page_pool_page_is_pp(p));		\
> +	DEBUG_NET_WARN_ON_ONCE(!PageNetpp(p));				\
>   	__pp_page_to_nmdesc(p);						\
>   })
>   
> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> index 2ef3c07266b3..71c7666e48a9 100644
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -898,7 +898,7 @@ static inline bool page_expected_state(struct page *page,
>   #ifdef CONFIG_MEMCG
>   			page->memcg_data |
>   #endif
> -			page_pool_page_is_pp(page) |
> +			PageNetpp(page) |
>   			(page->flags & check_flags)))
>   		return false;
>   
> @@ -925,7 +925,7 @@ static const char *page_bad_reason(struct page *page, unsigned long flags)
>   	if (unlikely(page->memcg_data))
>   		bad_reason = "page still charged to cgroup";
>   #endif
> -	if (unlikely(page_pool_page_is_pp(page)))
> +	if (unlikely(PageNetpp(page)))
>   		bad_reason = "page_pool leak";
>   	return bad_reason;
>   }

^ this

This will not work they way you want it once you rebase on top of 
linux-next, where we have (from mm/mm-stable)


commit 2dfcd1608f3a96364f10de7fcfe28727c0292e5d
Author: David Hildenbrand <david@redhat.com>
Date:   Fri Jul 4 12:24:58 2025 +0200

     mm/page_alloc: let page freeing clear any set page type


I commented what to do already.

-- 
Cheers,

David / dhildenb

Re: [PATCH] mm, page_pool: introduce a new page type for page pool in page type

[Byungchul Park]

On Mon, Jul 21, 2025 at 10:05:25AM +0200, David Hildenbrand wrote:
> On 21.07.25 07:49, Byungchul Park wrote:
> > Hi,
> > 
> > I focused on converting the existing APIs accessing ->pp_magic field to
> > page type APIs.  However, yes.  Additional works would better be
> > considered on top like:
> > 
> >     1. Adjust how to store and retrieve dma index.  Maybe network guys
> >        can work better on top.
> > 
> >     2. Move the sanity check for page pool in mm/page_alloc.c to on free.
> > 
> >     Byungchul
> > 
> > ---8<---
> >  From 7d207a1b3e9f4ff2a72f5b54b09e3ed0c4aaaca3 Mon Sep 17 00:00:00 2001
> > From: Byungchul Park <byungchul@sk.com>
> > Date: Mon, 21 Jul 2025 14:05:20 +0900
> > Subject: [PATCH] mm, page_pool: introduce a new page type for page pool in page type
> > 
> > ->pp_magic field in struct page is current used to identify if a page
> > belongs to a page pool.  However, page type e.i. PGTY_netpp can be used
> > for that purpose.
> > 
> > Use the page type APIs e.g. PageNetpp(), __SetPageNetpp(), and
> > __ClearPageNetpp() instead, and remove the existing APIs accessing
> > ->pp_magic e.g. page_pool_page_is_pp(), netmem_or_pp_magic(), and
> > netmem_clear_pp_magic() since they are totally replaced.
> > 
> > This work was inspired by the following link by Pavel:
> > 
> > [1] https://lore.kernel.org/all/582f41c0-2742-4400-9c81-0d46bf4e8314@gmail.com/
> 
> I'm, sure you saw my comment (including my earlier suggestion for using
> a page type), in particular around ...

Honestly, I was too confused to understand exactly what you meant.
Maybe my bad but I was and I'm still so.  Lemme add a question below.

> > ---
> >   .../net/ethernet/mellanox/mlx5/core/en/xdp.c  |  2 +-
> >   include/linux/mm.h                            | 28 ++-----------------
> >   include/linux/page-flags.h                    |  6 ++++
> >   include/net/netmem.h                          |  2 +-
> >   mm/page_alloc.c                               |  4 +--
> >   net/core/netmem_priv.h                        | 16 ++---------
> >   net/core/page_pool.c                          | 10 +++++--
> >   7 files changed, 24 insertions(+), 44 deletions(-)
> > 
> > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> > index 5d51600935a6..def274f5c1ca 100644
> > --- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> > @@ -707,7 +707,7 @@ static void mlx5e_free_xdpsq_desc(struct mlx5e_xdpsq *sq,
> >                               xdpi = mlx5e_xdpi_fifo_pop(xdpi_fifo);
> >                               page = xdpi.page.page;
> > 
> > -                             /* No need to check page_pool_page_is_pp() as we
> > +                             /* No need to check PageNetpp() as we
> >                                * know this is a page_pool page.
> >                                */
> >                               page_pool_recycle_direct(pp_page_to_nmdesc(page)->pp,
> > diff --git a/include/linux/mm.h b/include/linux/mm.h
> > index ae50c1641bed..736061749535 100644
> > --- a/include/linux/mm.h
> > +++ b/include/linux/mm.h
> > @@ -4135,10 +4135,9 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
> >    * DMA mapping IDs for page_pool
> >    *
> >    * When DMA-mapping a page, page_pool allocates an ID (from an xarray) and
> > - * stashes it in the upper bits of page->pp_magic. We always want to be able to
> > - * unambiguously identify page pool pages (using page_pool_page_is_pp()). Non-PP
> > - * pages can have arbitrary kernel pointers stored in the same field as pp_magic
> > - * (since it overlaps with page->lru.next), so we must ensure that we cannot
> > + * stashes it in the upper bits of page->pp_magic. Non-PP pages can have
> > + * arbitrary kernel pointers stored in the same field as pp_magic (since
> > + * it overlaps with page->lru.next), so we must ensure that we cannot
> >    * mistake a valid kernel pointer with any of the values we write into this
> >    * field.
> >    *
> > @@ -4168,25 +4167,4 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
> > 
> >   #define PP_DMA_INDEX_MASK GENMASK(PP_DMA_INDEX_BITS + PP_DMA_INDEX_SHIFT - 1, \
> >                                 PP_DMA_INDEX_SHIFT)
> > -
> > -/* Mask used for checking in page_pool_page_is_pp() below. page->pp_magic is
> > - * OR'ed with PP_SIGNATURE after the allocation in order to preserve bit 0 for
> > - * the head page of compound page and bit 1 for pfmemalloc page, as well as the
> > - * bits used for the DMA index. page_is_pfmemalloc() is checked in
> > - * __page_pool_put_page() to avoid recycling the pfmemalloc page.
> > - */
> > -#define PP_MAGIC_MASK ~(PP_DMA_INDEX_MASK | 0x3UL)
> > -
> > -#ifdef CONFIG_PAGE_POOL
> > -static inline bool page_pool_page_is_pp(const struct page *page)
> > -{
> > -     return (page->pp_magic & PP_MAGIC_MASK) == PP_SIGNATURE;
> > -}
> > -#else
> > -static inline bool page_pool_page_is_pp(const struct page *page)
> > -{
> > -     return false;
> > -}
> > -#endif
> > -
> >   #endif /* _LINUX_MM_H */
> > diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
> > index 4fe5ee67535b..906ba7c9e372 100644
> > --- a/include/linux/page-flags.h
> > +++ b/include/linux/page-flags.h
> > @@ -957,6 +957,7 @@ enum pagetype {
> >       PGTY_zsmalloc           = 0xf6,
> >       PGTY_unaccepted         = 0xf7,
> >       PGTY_large_kmalloc      = 0xf8,
> > +     PGTY_netpp              = 0xf9,
> > 
> >       PGTY_mapcount_underflow = 0xff
> >   };
> > @@ -1101,6 +1102,11 @@ PAGE_TYPE_OPS(Zsmalloc, zsmalloc, zsmalloc)
> >   PAGE_TYPE_OPS(Unaccepted, unaccepted, unaccepted)
> >   FOLIO_TYPE_OPS(large_kmalloc, large_kmalloc)
> > 
> > +/*
> > + * Marks page_pool allocated pages.
> > + */
> > +PAGE_TYPE_OPS(Netpp, netpp, netpp)
> > +
> >   /**
> >    * PageHuge - Determine if the page belongs to hugetlbfs
> >    * @page: The page to test.
> > diff --git a/include/net/netmem.h b/include/net/netmem.h
> > index f7dacc9e75fd..3667334e16e7 100644
> > --- a/include/net/netmem.h
> > +++ b/include/net/netmem.h
> > @@ -298,7 +298,7 @@ static inline struct net_iov *__netmem_clear_lsb(netmem_ref netmem)
> >    */
> >   #define pp_page_to_nmdesc(p)                                                \
> >   ({                                                                  \
> > -     DEBUG_NET_WARN_ON_ONCE(!page_pool_page_is_pp(p));               \
> > +     DEBUG_NET_WARN_ON_ONCE(!PageNetpp(p));                          \
> >       __pp_page_to_nmdesc(p);                                         \
> >   })
> > 
> > diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> > index 2ef3c07266b3..71c7666e48a9 100644
> > --- a/mm/page_alloc.c
> > +++ b/mm/page_alloc.c
> > @@ -898,7 +898,7 @@ static inline bool page_expected_state(struct page *page,
> >   #ifdef CONFIG_MEMCG
> >                       page->memcg_data |
> >   #endif
> > -                     page_pool_page_is_pp(page) |
> > +                     PageNetpp(page) |
> >                       (page->flags & check_flags)))
> >               return false;
> > 
> > @@ -925,7 +925,7 @@ static const char *page_bad_reason(struct page *page, unsigned long flags)
> >       if (unlikely(page->memcg_data))
> >               bad_reason = "page still charged to cgroup";
> >   #endif
> > -     if (unlikely(page_pool_page_is_pp(page)))
> > +     if (unlikely(PageNetpp(page)))
> >               bad_reason = "page_pool leak";
> >       return bad_reason;
> >   }
> 
> ^ this
> 
> This will not work they way you want it once you rebase on top of
> linux-next, where we have (from mm/mm-stable)
>
> commit 2dfcd1608f3a96364f10de7fcfe28727c0292e5d

I just checked this.

So is it sufficient that I rebase on mm/mm-stable?  Or should I wait for
something else?  Or should I achieve this in other ways?

	Byungchul

> Author: David Hildenbrand <david@redhat.com>
> Date:   Fri Jul 4 12:24:58 2025 +0200
> 
>     mm/page_alloc: let page freeing clear any set page type
> 
> 
> I commented what to do already.
> 
> --
> Cheers,
> 
> David / dhildenb

Re: [PATCH] mm, page_pool: introduce a new page type for page pool in page type

[David Hildenbrand]

>>
>> This will not work they way you want it once you rebase on top of
>> linux-next, where we have (from mm/mm-stable)
>>
>> commit 2dfcd1608f3a96364f10de7fcfe28727c0292e5d
> 
> I just checked this.
> 
> So is it sufficient that I rebase on mm/mm-stable?  Or should I wait for
> something else?  Or should I achieve this in other ways?

Probably best to rebase (+test) to linux-next, where that commit should 
be in.

Whatever is in mm-stable is expected to go upstream in the next merge 
window (iow, soon), with stable commit ids.

-- 
Cheers,

David / dhildenb

Re: [PATCH] mm, page_pool: introduce a new page type for page pool in page type

[Pavel Begunkov]

On 7/21/25 06:49, Byungchul Park wrote:
> Hi,
> 
> I focused on converting the existing APIs accessing ->pp_magic field to
> page type APIs.  However, yes.  Additional works would better be
> considered on top like:
> 
>     1. Adjust how to store and retrieve dma index.  Maybe network guys
>        can work better on top.
> 
>     2. Move the sanity check for page pool in mm/page_alloc.c to on free.

Don't be in a hurry, I've got a branch, but as mentioned before,
it'll be for-6.18. And there will also be more time for testing.

> This work was inspired by the following link by Pavel:

The idea came from David, let's add

Suggested-by: David Hildenbrand <david@redhat.com>

...> -
>   static inline bool netmem_is_pp(netmem_ref netmem)
>   {
> -	return (netmem_get_pp_magic(netmem) & PP_MAGIC_MASK) == PP_SIGNATURE;
> +	if (netmem_is_net_iov(netmem))

This needs to return false for tx niovs. Seems like all callers are
gated on ->pp_recycle, so maybe it's fine, but we can at least
check pp. Mina, you've been checking tx doesn't mix with rx, any
opinion on that?

Question to net maintainers, can a ->pp_recycle marked skb contain
not page pool originated pages or a mix?

-- 
Pavel Begunkov

Re: [PATCH] mm, page_pool: introduce a new page type for page pool in page type

[Byungchul Park]

On Mon, Jul 21, 2025 at 12:12:39PM +0100, Pavel Begunkov wrote:
> On 7/21/25 06:49, Byungchul Park wrote:
> > Hi,
> > 
> > I focused on converting the existing APIs accessing ->pp_magic field to
> > page type APIs.  However, yes.  Additional works would better be
> > considered on top like:
> > 
> >     1. Adjust how to store and retrieve dma index.  Maybe network guys
> >        can work better on top.
> > 
> >     2. Move the sanity check for page pool in mm/page_alloc.c to on free.
> 
> Don't be in a hurry, I've got a branch, but as mentioned before,
> it'll be for-6.18. And there will also be more time for testing.

I'm not.  I listed the two items above wishing someone to work on it on
top of this patch in the future.

> > This work was inspired by the following link by Pavel:
> 
> The idea came from David, let's add
> 
> Suggested-by: David Hildenbrand <david@redhat.com>

Okay.  I will replace the current one with this.

> ...> -
> >   static inline bool netmem_is_pp(netmem_ref netmem)
> >   {
> > -     return (netmem_get_pp_magic(netmem) & PP_MAGIC_MASK) == PP_SIGNATURE;
> > +     if (netmem_is_net_iov(netmem))
> 
> This needs to return false for tx niovs. Seems like all callers are
> gated on ->pp_recycle, so maybe it's fine, but we can at least
> check pp. Mina, you've been checking tx doesn't mix with rx, any
> opinion on that?

I will wait for the answer of this before going ahead.

> Question to net maintainers, can a ->pp_recycle marked skb contain
> not page pool originated pages or a mix?

This too.

	Byungchul

> --
> Pavel Begunkov

Re: [PATCH] mm, page_pool: introduce a new page type for page pool in page type

[Byungchul Park]

On Mon, Jul 21, 2025 at 10:49:37AM +0200, David Hildenbrand wrote:
> > > This will not work they way you want it once you rebase on top of
> > > linux-next, where we have (from mm/mm-stable)
> > > 
> > > commit 2dfcd1608f3a96364f10de7fcfe28727c0292e5d
> > 
> > I just checked this.
> > 
> > So is it sufficient that I rebase on mm/mm-stable?  Or should I wait for
> > something else?  Or should I achieve this in other ways?
> 
> Probably best to rebase (+test) to linux-next, where that commit should
> be in.

I will.

	Byungchul

> Whatever is in mm-stable is expected to go upstream in the next merge
> window (iow, soon), with stable commit ids.
> 
> --
> Cheers,
> 
> David / dhildenb

Re: [PATCH] mm, page_pool: introduce a new page type for page pool in page type

[Mina Almasry]

On Sun, Jul 20, 2025 at 10:49 PM Byungchul Park <byungchul@sk.com> wrote:
>
> Hi,
>
> I focused on converting the existing APIs accessing ->pp_magic field to
> page type APIs.  However, yes.  Additional works would better be
> considered on top like:
>
>    1. Adjust how to store and retrieve dma index.  Maybe network guys
>       can work better on top.
>
>    2. Move the sanity check for page pool in mm/page_alloc.c to on free.
>
>    Byungchul
>
> ---8<---
> From 7d207a1b3e9f4ff2a72f5b54b09e3ed0c4aaaca3 Mon Sep 17 00:00:00 2001
> From: Byungchul Park <byungchul@sk.com>
> Date: Mon, 21 Jul 2025 14:05:20 +0900
> Subject: [PATCH] mm, page_pool: introduce a new page type for page pool in page type
>
> ->pp_magic field in struct page is current used to identify if a page
> belongs to a page pool.  However, page type e.i. PGTY_netpp can be used
> for that purpose.
>
> Use the page type APIs e.g. PageNetpp(), __SetPageNetpp(), and
> __ClearPageNetpp() instead, and remove the existing APIs accessing
> ->pp_magic e.g. page_pool_page_is_pp(), netmem_or_pp_magic(), and
> netmem_clear_pp_magic() since they are totally replaced.
>
> This work was inspired by the following link by Pavel:
>
> [1] https://lore.kernel.org/all/582f41c0-2742-4400-9c81-0d46bf4e8314@gmail.com/
>
> Suggested-by: Pavel Begunkov <asml.silence@gmail.com>
> Signed-off-by: Byungchul Park <byungchul@sk.com>
> ---
>  .../net/ethernet/mellanox/mlx5/core/en/xdp.c  |  2 +-
>  include/linux/mm.h                            | 28 ++-----------------
>  include/linux/page-flags.h                    |  6 ++++
>  include/net/netmem.h                          |  2 +-
>  mm/page_alloc.c                               |  4 +--
>  net/core/netmem_priv.h                        | 16 ++---------
>  net/core/page_pool.c                          | 10 +++++--
>  7 files changed, 24 insertions(+), 44 deletions(-)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> index 5d51600935a6..def274f5c1ca 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> @@ -707,7 +707,7 @@ static void mlx5e_free_xdpsq_desc(struct mlx5e_xdpsq *sq,
>                                 xdpi = mlx5e_xdpi_fifo_pop(xdpi_fifo);
>                                 page = xdpi.page.page;
>
> -                               /* No need to check page_pool_page_is_pp() as we
> +                               /* No need to check PageNetpp() as we
>                                  * know this is a page_pool page.
>                                  */
>                                 page_pool_recycle_direct(pp_page_to_nmdesc(page)->pp,
> diff --git a/include/linux/mm.h b/include/linux/mm.h
> index ae50c1641bed..736061749535 100644
> --- a/include/linux/mm.h
> +++ b/include/linux/mm.h
> @@ -4135,10 +4135,9 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
>   * DMA mapping IDs for page_pool
>   *
>   * When DMA-mapping a page, page_pool allocates an ID (from an xarray) and
> - * stashes it in the upper bits of page->pp_magic. We always want to be able to
> - * unambiguously identify page pool pages (using page_pool_page_is_pp()). Non-PP
> - * pages can have arbitrary kernel pointers stored in the same field as pp_magic
> - * (since it overlaps with page->lru.next), so we must ensure that we cannot
> + * stashes it in the upper bits of page->pp_magic. Non-PP pages can have
> + * arbitrary kernel pointers stored in the same field as pp_magic (since
> + * it overlaps with page->lru.next), so we must ensure that we cannot
>   * mistake a valid kernel pointer with any of the values we write into this
>   * field.
>   *
> @@ -4168,25 +4167,4 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
>
>  #define PP_DMA_INDEX_MASK GENMASK(PP_DMA_INDEX_BITS + PP_DMA_INDEX_SHIFT - 1, \
>                                   PP_DMA_INDEX_SHIFT)
> -
> -/* Mask used for checking in page_pool_page_is_pp() below. page->pp_magic is
> - * OR'ed with PP_SIGNATURE after the allocation in order to preserve bit 0 for
> - * the head page of compound page and bit 1 for pfmemalloc page, as well as the
> - * bits used for the DMA index. page_is_pfmemalloc() is checked in
> - * __page_pool_put_page() to avoid recycling the pfmemalloc page.
> - */
> -#define PP_MAGIC_MASK ~(PP_DMA_INDEX_MASK | 0x3UL)
> -
> -#ifdef CONFIG_PAGE_POOL
> -static inline bool page_pool_page_is_pp(const struct page *page)
> -{
> -       return (page->pp_magic & PP_MAGIC_MASK) == PP_SIGNATURE;
> -}
> -#else
> -static inline bool page_pool_page_is_pp(const struct page *page)
> -{
> -       return false;
> -}
> -#endif
> -
>  #endif /* _LINUX_MM_H */
> diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
> index 4fe5ee67535b..906ba7c9e372 100644
> --- a/include/linux/page-flags.h
> +++ b/include/linux/page-flags.h
> @@ -957,6 +957,7 @@ enum pagetype {
>         PGTY_zsmalloc           = 0xf6,
>         PGTY_unaccepted         = 0xf7,
>         PGTY_large_kmalloc      = 0xf8,
> +       PGTY_netpp              = 0xf9,
>
>         PGTY_mapcount_underflow = 0xff
>  };
> @@ -1101,6 +1102,11 @@ PAGE_TYPE_OPS(Zsmalloc, zsmalloc, zsmalloc)
>  PAGE_TYPE_OPS(Unaccepted, unaccepted, unaccepted)
>  FOLIO_TYPE_OPS(large_kmalloc, large_kmalloc)
>
> +/*
> + * Marks page_pool allocated pages.
> + */
> +PAGE_TYPE_OPS(Netpp, netpp, netpp)
> +
>  /**
>   * PageHuge - Determine if the page belongs to hugetlbfs
>   * @page: The page to test.
> diff --git a/include/net/netmem.h b/include/net/netmem.h
> index f7dacc9e75fd..3667334e16e7 100644
> --- a/include/net/netmem.h
> +++ b/include/net/netmem.h
> @@ -298,7 +298,7 @@ static inline struct net_iov *__netmem_clear_lsb(netmem_ref netmem)
>   */
>  #define pp_page_to_nmdesc(p)                                           \
>  ({                                                                     \
> -       DEBUG_NET_WARN_ON_ONCE(!page_pool_page_is_pp(p));               \
> +       DEBUG_NET_WARN_ON_ONCE(!PageNetpp(p));                          \
>         __pp_page_to_nmdesc(p);                                         \
>  })
>
> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> index 2ef3c07266b3..71c7666e48a9 100644
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -898,7 +898,7 @@ static inline bool page_expected_state(struct page *page,
>  #ifdef CONFIG_MEMCG
>                         page->memcg_data |
>  #endif
> -                       page_pool_page_is_pp(page) |
> +                       PageNetpp(page) |
>                         (page->flags & check_flags)))
>                 return false;
>
> @@ -925,7 +925,7 @@ static const char *page_bad_reason(struct page *page, unsigned long flags)
>         if (unlikely(page->memcg_data))
>                 bad_reason = "page still charged to cgroup";
>  #endif
> -       if (unlikely(page_pool_page_is_pp(page)))
> +       if (unlikely(PageNetpp(page)))
>                 bad_reason = "page_pool leak";
>         return bad_reason;
>  }
> diff --git a/net/core/netmem_priv.h b/net/core/netmem_priv.h
> index cd95394399b4..39a97703d9ed 100644
> --- a/net/core/netmem_priv.h
> +++ b/net/core/netmem_priv.h
> @@ -8,21 +8,11 @@ static inline unsigned long netmem_get_pp_magic(netmem_ref netmem)
>         return __netmem_clear_lsb(netmem)->pp_magic & ~PP_DMA_INDEX_MASK;
>  }
>
> -static inline void netmem_or_pp_magic(netmem_ref netmem, unsigned long pp_magic)
> -{
> -       __netmem_clear_lsb(netmem)->pp_magic |= pp_magic;
> -}
> -
> -static inline void netmem_clear_pp_magic(netmem_ref netmem)
> -{
> -       WARN_ON_ONCE(__netmem_clear_lsb(netmem)->pp_magic & PP_DMA_INDEX_MASK);
> -
> -       __netmem_clear_lsb(netmem)->pp_magic = 0;
> -}
> -
>  static inline bool netmem_is_pp(netmem_ref netmem)
>  {
> -       return (netmem_get_pp_magic(netmem) & PP_MAGIC_MASK) == PP_SIGNATURE;
> +       if (netmem_is_net_iov(netmem))
> +               return true;

As Pavel alludes, this is dubious, and at least it's difficult to
reason about it.

There could be net_iovs that are not attached to pp, and should not be
treated as pp memory. These are in the devmem (and future net_iov) tx
paths.

We need a way to tell if a net_iov is pp or not. A couple of options:

1. We could have it such that if net_iov->pp is set, then the
netmem_is_pp == true, otherwise false.
2. We could implement a page-flags equivalent for net_iov.

Option #1 is simpler and is my preferred. To do that properly, you need to:

1. Make sure everywhere net_iovs are allocated that pp=NULL in the
non-pp case and pp=non NULL in the pp case. those callsites are
net_devmem_bind_dmabuf (devmem rx & tx path), io_zcrx_create_area
(io_uring rx path).

2. Change netmem_is_pp to check net_iov->pp in the net_iov case.

-- 
Thanks,
Mina

Re: [PATCH] mm, page_pool: introduce a new page type for page pool in page type

[Mina Almasry]

On Mon, Jul 21, 2025 at 4:11 AM Pavel Begunkov <asml.silence@gmail.com> wrote:
>
> On 7/21/25 06:49, Byungchul Park wrote:
> > Hi,
> >
> > I focused on converting the existing APIs accessing ->pp_magic field to
> > page type APIs.  However, yes.  Additional works would better be
> > considered on top like:
> >
> >     1. Adjust how to store and retrieve dma index.  Maybe network guys
> >        can work better on top.
> >
> >     2. Move the sanity check for page pool in mm/page_alloc.c to on free.
>
> Don't be in a hurry, I've got a branch, but as mentioned before,
> it'll be for-6.18. And there will also be more time for testing.
>
> > This work was inspired by the following link by Pavel:
>
> The idea came from David, let's add
>
> Suggested-by: David Hildenbrand <david@redhat.com>
>
> ...> -
> >   static inline bool netmem_is_pp(netmem_ref netmem)
> >   {
> > -     return (netmem_get_pp_magic(netmem) & PP_MAGIC_MASK) == PP_SIGNATURE;
> > +     if (netmem_is_net_iov(netmem))
>
> This needs to return false for tx niovs. Seems like all callers are
> gated on ->pp_recycle, so maybe it's fine, but we can at least
> check pp. Mina, you've been checking tx doesn't mix with rx, any
> opinion on that?
>
> Question to net maintainers, can a ->pp_recycle marked skb contain
> not page pool originated pages or a mix?
>

IIRC last I looked at the code ->pp_recycle technically means it could
be a mix. Technically it means "consider this netmem for pp recycling
when the skb is freed." and non-pp netmems don't get recycled to the
pp obviously, because napi_pp_put_page rejects recycling them.


-- 
Thanks,
Mina

Re: [PATCH] mm, page_pool: introduce a new page type for page pool in page type

[Byungchul Park]

On Tue, Jul 22, 2025 at 03:17:15PM -0700, Mina Almasry wrote:
> On Sun, Jul 20, 2025 at 10:49 PM Byungchul Park <byungchul@sk.com> wrote:
> >
> > Hi,
> >
> > I focused on converting the existing APIs accessing ->pp_magic field to
> > page type APIs.  However, yes.  Additional works would better be
> > considered on top like:
> >
> >    1. Adjust how to store and retrieve dma index.  Maybe network guys
> >       can work better on top.
> >
> >    2. Move the sanity check for page pool in mm/page_alloc.c to on free.
> >
> >    Byungchul
> >
> > ---8<---
> > From 7d207a1b3e9f4ff2a72f5b54b09e3ed0c4aaaca3 Mon Sep 17 00:00:00 2001
> > From: Byungchul Park <byungchul@sk.com>
> > Date: Mon, 21 Jul 2025 14:05:20 +0900
> > Subject: [PATCH] mm, page_pool: introduce a new page type for page pool in page type
> >
> > ->pp_magic field in struct page is current used to identify if a page
> > belongs to a page pool.  However, page type e.i. PGTY_netpp can be used
> > for that purpose.
> >
> > Use the page type APIs e.g. PageNetpp(), __SetPageNetpp(), and
> > __ClearPageNetpp() instead, and remove the existing APIs accessing
> > ->pp_magic e.g. page_pool_page_is_pp(), netmem_or_pp_magic(), and
> > netmem_clear_pp_magic() since they are totally replaced.
> >
> > This work was inspired by the following link by Pavel:
> >
> > [1] https://lore.kernel.org/all/582f41c0-2742-4400-9c81-0d46bf4e8314@gmail.com/
> >
> > Suggested-by: Pavel Begunkov <asml.silence@gmail.com>
> > Signed-off-by: Byungchul Park <byungchul@sk.com>
> > ---
> >  .../net/ethernet/mellanox/mlx5/core/en/xdp.c  |  2 +-
> >  include/linux/mm.h                            | 28 ++-----------------
> >  include/linux/page-flags.h                    |  6 ++++
> >  include/net/netmem.h                          |  2 +-
> >  mm/page_alloc.c                               |  4 +--
> >  net/core/netmem_priv.h                        | 16 ++---------
> >  net/core/page_pool.c                          | 10 +++++--
> >  7 files changed, 24 insertions(+), 44 deletions(-)
> >
> > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> > index 5d51600935a6..def274f5c1ca 100644
> > --- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> > @@ -707,7 +707,7 @@ static void mlx5e_free_xdpsq_desc(struct mlx5e_xdpsq *sq,
> >                                 xdpi = mlx5e_xdpi_fifo_pop(xdpi_fifo);
> >                                 page = xdpi.page.page;
> >
> > -                               /* No need to check page_pool_page_is_pp() as we
> > +                               /* No need to check PageNetpp() as we
> >                                  * know this is a page_pool page.
> >                                  */
> >                                 page_pool_recycle_direct(pp_page_to_nmdesc(page)->pp,
> > diff --git a/include/linux/mm.h b/include/linux/mm.h
> > index ae50c1641bed..736061749535 100644
> > --- a/include/linux/mm.h
> > +++ b/include/linux/mm.h
> > @@ -4135,10 +4135,9 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
> >   * DMA mapping IDs for page_pool
> >   *
> >   * When DMA-mapping a page, page_pool allocates an ID (from an xarray) and
> > - * stashes it in the upper bits of page->pp_magic. We always want to be able to
> > - * unambiguously identify page pool pages (using page_pool_page_is_pp()). Non-PP
> > - * pages can have arbitrary kernel pointers stored in the same field as pp_magic
> > - * (since it overlaps with page->lru.next), so we must ensure that we cannot
> > + * stashes it in the upper bits of page->pp_magic. Non-PP pages can have
> > + * arbitrary kernel pointers stored in the same field as pp_magic (since
> > + * it overlaps with page->lru.next), so we must ensure that we cannot
> >   * mistake a valid kernel pointer with any of the values we write into this
> >   * field.
> >   *
> > @@ -4168,25 +4167,4 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
> >
> >  #define PP_DMA_INDEX_MASK GENMASK(PP_DMA_INDEX_BITS + PP_DMA_INDEX_SHIFT - 1, \
> >                                   PP_DMA_INDEX_SHIFT)
> > -
> > -/* Mask used for checking in page_pool_page_is_pp() below. page->pp_magic is
> > - * OR'ed with PP_SIGNATURE after the allocation in order to preserve bit 0 for
> > - * the head page of compound page and bit 1 for pfmemalloc page, as well as the
> > - * bits used for the DMA index. page_is_pfmemalloc() is checked in
> > - * __page_pool_put_page() to avoid recycling the pfmemalloc page.
> > - */
> > -#define PP_MAGIC_MASK ~(PP_DMA_INDEX_MASK | 0x3UL)
> > -
> > -#ifdef CONFIG_PAGE_POOL
> > -static inline bool page_pool_page_is_pp(const struct page *page)
> > -{
> > -       return (page->pp_magic & PP_MAGIC_MASK) == PP_SIGNATURE;
> > -}
> > -#else
> > -static inline bool page_pool_page_is_pp(const struct page *page)
> > -{
> > -       return false;
> > -}
> > -#endif
> > -
> >  #endif /* _LINUX_MM_H */
> > diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
> > index 4fe5ee67535b..906ba7c9e372 100644
> > --- a/include/linux/page-flags.h
> > +++ b/include/linux/page-flags.h
> > @@ -957,6 +957,7 @@ enum pagetype {
> >         PGTY_zsmalloc           = 0xf6,
> >         PGTY_unaccepted         = 0xf7,
> >         PGTY_large_kmalloc      = 0xf8,
> > +       PGTY_netpp              = 0xf9,
> >
> >         PGTY_mapcount_underflow = 0xff
> >  };
> > @@ -1101,6 +1102,11 @@ PAGE_TYPE_OPS(Zsmalloc, zsmalloc, zsmalloc)
> >  PAGE_TYPE_OPS(Unaccepted, unaccepted, unaccepted)
> >  FOLIO_TYPE_OPS(large_kmalloc, large_kmalloc)
> >
> > +/*
> > + * Marks page_pool allocated pages.
> > + */
> > +PAGE_TYPE_OPS(Netpp, netpp, netpp)
> > +
> >  /**
> >   * PageHuge - Determine if the page belongs to hugetlbfs
> >   * @page: The page to test.
> > diff --git a/include/net/netmem.h b/include/net/netmem.h
> > index f7dacc9e75fd..3667334e16e7 100644
> > --- a/include/net/netmem.h
> > +++ b/include/net/netmem.h
> > @@ -298,7 +298,7 @@ static inline struct net_iov *__netmem_clear_lsb(netmem_ref netmem)
> >   */
> >  #define pp_page_to_nmdesc(p)                                           \
> >  ({                                                                     \
> > -       DEBUG_NET_WARN_ON_ONCE(!page_pool_page_is_pp(p));               \
> > +       DEBUG_NET_WARN_ON_ONCE(!PageNetpp(p));                          \
> >         __pp_page_to_nmdesc(p);                                         \
> >  })
> >
> > diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> > index 2ef3c07266b3..71c7666e48a9 100644
> > --- a/mm/page_alloc.c
> > +++ b/mm/page_alloc.c
> > @@ -898,7 +898,7 @@ static inline bool page_expected_state(struct page *page,
> >  #ifdef CONFIG_MEMCG
> >                         page->memcg_data |
> >  #endif
> > -                       page_pool_page_is_pp(page) |
> > +                       PageNetpp(page) |
> >                         (page->flags & check_flags)))
> >                 return false;
> >
> > @@ -925,7 +925,7 @@ static const char *page_bad_reason(struct page *page, unsigned long flags)
> >         if (unlikely(page->memcg_data))
> >                 bad_reason = "page still charged to cgroup";
> >  #endif
> > -       if (unlikely(page_pool_page_is_pp(page)))
> > +       if (unlikely(PageNetpp(page)))
> >                 bad_reason = "page_pool leak";
> >         return bad_reason;
> >  }
> > diff --git a/net/core/netmem_priv.h b/net/core/netmem_priv.h
> > index cd95394399b4..39a97703d9ed 100644
> > --- a/net/core/netmem_priv.h
> > +++ b/net/core/netmem_priv.h
> > @@ -8,21 +8,11 @@ static inline unsigned long netmem_get_pp_magic(netmem_ref netmem)
> >         return __netmem_clear_lsb(netmem)->pp_magic & ~PP_DMA_INDEX_MASK;
> >  }
> >
> > -static inline void netmem_or_pp_magic(netmem_ref netmem, unsigned long pp_magic)
> > -{
> > -       __netmem_clear_lsb(netmem)->pp_magic |= pp_magic;
> > -}
> > -
> > -static inline void netmem_clear_pp_magic(netmem_ref netmem)
> > -{
> > -       WARN_ON_ONCE(__netmem_clear_lsb(netmem)->pp_magic & PP_DMA_INDEX_MASK);
> > -
> > -       __netmem_clear_lsb(netmem)->pp_magic = 0;
> > -}
> > -
> >  static inline bool netmem_is_pp(netmem_ref netmem)
> >  {
> > -       return (netmem_get_pp_magic(netmem) & PP_MAGIC_MASK) == PP_SIGNATURE;
> > +       if (netmem_is_net_iov(netmem))
> > +               return true;
> 
> As Pavel alludes, this is dubious, and at least it's difficult to
> reason about it.
> 
> There could be net_iovs that are not attached to pp, and should not be
> treated as pp memory. These are in the devmem (and future net_iov) tx
> paths.
> 
> We need a way to tell if a net_iov is pp or not. A couple of options:
> 
> 1. We could have it such that if net_iov->pp is set, then the
> netmem_is_pp == true, otherwise false.
> 2. We could implement a page-flags equivalent for net_iov.
> 
> Option #1 is simpler and is my preferred. To do that properly, you need to:
> 
> 1. Make sure everywhere net_iovs are allocated that pp=NULL in the
> non-pp case and pp=non NULL in the pp case. those callsites are
> net_devmem_bind_dmabuf (devmem rx & tx path), io_zcrx_create_area
> (io_uring rx path).
> 
> 2. Change netmem_is_pp to check net_iov->pp in the net_iov case.

Good idea, but I'm not sure if I could work on it without consuming your
additional review efforts.  Can anyone add net_iov_is_pp() helper?

Or use the page type, Netpp, as an additional way to identify if it's a
pp page for system memory, keeping the current way using ->pp_magic.
So the page type, Netpp, is used for system memory, and ->pp_magic is
used for net_iov.  The clean up for ->pp_magic can be done if needed.

	Byungchul

> --
> Thanks,
> Mina

Re: [PATCH] mm, page_pool: introduce a new page type for page pool in page type

[Mina Almasry]

On Tue, Jul 22, 2025 at 9:46 PM Byungchul Park <byungchul@sk.com> wrote:
>
> On Tue, Jul 22, 2025 at 03:17:15PM -0700, Mina Almasry wrote:
> > On Sun, Jul 20, 2025 at 10:49 PM Byungchul Park <byungchul@sk.com> wrote:
> > >
> > > Hi,
> > >
> > > I focused on converting the existing APIs accessing ->pp_magic field to
> > > page type APIs.  However, yes.  Additional works would better be
> > > considered on top like:
> > >
> > >    1. Adjust how to store and retrieve dma index.  Maybe network guys
> > >       can work better on top.
> > >
> > >    2. Move the sanity check for page pool in mm/page_alloc.c to on free.
> > >
> > >    Byungchul
> > >
> > > ---8<---
> > > From 7d207a1b3e9f4ff2a72f5b54b09e3ed0c4aaaca3 Mon Sep 17 00:00:00 2001
> > > From: Byungchul Park <byungchul@sk.com>
> > > Date: Mon, 21 Jul 2025 14:05:20 +0900
> > > Subject: [PATCH] mm, page_pool: introduce a new page type for page pool in page type
> > >
> > > ->pp_magic field in struct page is current used to identify if a page
> > > belongs to a page pool.  However, page type e.i. PGTY_netpp can be used
> > > for that purpose.
> > >
> > > Use the page type APIs e.g. PageNetpp(), __SetPageNetpp(), and
> > > __ClearPageNetpp() instead, and remove the existing APIs accessing
> > > ->pp_magic e.g. page_pool_page_is_pp(), netmem_or_pp_magic(), and
> > > netmem_clear_pp_magic() since they are totally replaced.
> > >
> > > This work was inspired by the following link by Pavel:
> > >
> > > [1] https://lore.kernel.org/all/582f41c0-2742-4400-9c81-0d46bf4e8314@gmail.com/
> > >
> > > Suggested-by: Pavel Begunkov <asml.silence@gmail.com>
> > > Signed-off-by: Byungchul Park <byungchul@sk.com>
> > > ---
> > >  .../net/ethernet/mellanox/mlx5/core/en/xdp.c  |  2 +-
> > >  include/linux/mm.h                            | 28 ++-----------------
> > >  include/linux/page-flags.h                    |  6 ++++
> > >  include/net/netmem.h                          |  2 +-
> > >  mm/page_alloc.c                               |  4 +--
> > >  net/core/netmem_priv.h                        | 16 ++---------
> > >  net/core/page_pool.c                          | 10 +++++--
> > >  7 files changed, 24 insertions(+), 44 deletions(-)
> > >
> > > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> > > index 5d51600935a6..def274f5c1ca 100644
> > > --- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> > > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> > > @@ -707,7 +707,7 @@ static void mlx5e_free_xdpsq_desc(struct mlx5e_xdpsq *sq,
> > >                                 xdpi = mlx5e_xdpi_fifo_pop(xdpi_fifo);
> > >                                 page = xdpi.page.page;
> > >
> > > -                               /* No need to check page_pool_page_is_pp() as we
> > > +                               /* No need to check PageNetpp() as we
> > >                                  * know this is a page_pool page.
> > >                                  */
> > >                                 page_pool_recycle_direct(pp_page_to_nmdesc(page)->pp,
> > > diff --git a/include/linux/mm.h b/include/linux/mm.h
> > > index ae50c1641bed..736061749535 100644
> > > --- a/include/linux/mm.h
> > > +++ b/include/linux/mm.h
> > > @@ -4135,10 +4135,9 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
> > >   * DMA mapping IDs for page_pool
> > >   *
> > >   * When DMA-mapping a page, page_pool allocates an ID (from an xarray) and
> > > - * stashes it in the upper bits of page->pp_magic. We always want to be able to
> > > - * unambiguously identify page pool pages (using page_pool_page_is_pp()). Non-PP
> > > - * pages can have arbitrary kernel pointers stored in the same field as pp_magic
> > > - * (since it overlaps with page->lru.next), so we must ensure that we cannot
> > > + * stashes it in the upper bits of page->pp_magic. Non-PP pages can have
> > > + * arbitrary kernel pointers stored in the same field as pp_magic (since
> > > + * it overlaps with page->lru.next), so we must ensure that we cannot
> > >   * mistake a valid kernel pointer with any of the values we write into this
> > >   * field.
> > >   *
> > > @@ -4168,25 +4167,4 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
> > >
> > >  #define PP_DMA_INDEX_MASK GENMASK(PP_DMA_INDEX_BITS + PP_DMA_INDEX_SHIFT - 1, \
> > >                                   PP_DMA_INDEX_SHIFT)
> > > -
> > > -/* Mask used for checking in page_pool_page_is_pp() below. page->pp_magic is
> > > - * OR'ed with PP_SIGNATURE after the allocation in order to preserve bit 0 for
> > > - * the head page of compound page and bit 1 for pfmemalloc page, as well as the
> > > - * bits used for the DMA index. page_is_pfmemalloc() is checked in
> > > - * __page_pool_put_page() to avoid recycling the pfmemalloc page.
> > > - */
> > > -#define PP_MAGIC_MASK ~(PP_DMA_INDEX_MASK | 0x3UL)
> > > -
> > > -#ifdef CONFIG_PAGE_POOL
> > > -static inline bool page_pool_page_is_pp(const struct page *page)
> > > -{
> > > -       return (page->pp_magic & PP_MAGIC_MASK) == PP_SIGNATURE;
> > > -}
> > > -#else
> > > -static inline bool page_pool_page_is_pp(const struct page *page)
> > > -{
> > > -       return false;
> > > -}
> > > -#endif
> > > -
> > >  #endif /* _LINUX_MM_H */
> > > diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
> > > index 4fe5ee67535b..906ba7c9e372 100644
> > > --- a/include/linux/page-flags.h
> > > +++ b/include/linux/page-flags.h
> > > @@ -957,6 +957,7 @@ enum pagetype {
> > >         PGTY_zsmalloc           = 0xf6,
> > >         PGTY_unaccepted         = 0xf7,
> > >         PGTY_large_kmalloc      = 0xf8,
> > > +       PGTY_netpp              = 0xf9,
> > >
> > >         PGTY_mapcount_underflow = 0xff
> > >  };
> > > @@ -1101,6 +1102,11 @@ PAGE_TYPE_OPS(Zsmalloc, zsmalloc, zsmalloc)
> > >  PAGE_TYPE_OPS(Unaccepted, unaccepted, unaccepted)
> > >  FOLIO_TYPE_OPS(large_kmalloc, large_kmalloc)
> > >
> > > +/*
> > > + * Marks page_pool allocated pages.
> > > + */
> > > +PAGE_TYPE_OPS(Netpp, netpp, netpp)
> > > +
> > >  /**
> > >   * PageHuge - Determine if the page belongs to hugetlbfs
> > >   * @page: The page to test.
> > > diff --git a/include/net/netmem.h b/include/net/netmem.h
> > > index f7dacc9e75fd..3667334e16e7 100644
> > > --- a/include/net/netmem.h
> > > +++ b/include/net/netmem.h
> > > @@ -298,7 +298,7 @@ static inline struct net_iov *__netmem_clear_lsb(netmem_ref netmem)
> > >   */
> > >  #define pp_page_to_nmdesc(p)                                           \
> > >  ({                                                                     \
> > > -       DEBUG_NET_WARN_ON_ONCE(!page_pool_page_is_pp(p));               \
> > > +       DEBUG_NET_WARN_ON_ONCE(!PageNetpp(p));                          \
> > >         __pp_page_to_nmdesc(p);                                         \
> > >  })
> > >
> > > diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> > > index 2ef3c07266b3..71c7666e48a9 100644
> > > --- a/mm/page_alloc.c
> > > +++ b/mm/page_alloc.c
> > > @@ -898,7 +898,7 @@ static inline bool page_expected_state(struct page *page,
> > >  #ifdef CONFIG_MEMCG
> > >                         page->memcg_data |
> > >  #endif
> > > -                       page_pool_page_is_pp(page) |
> > > +                       PageNetpp(page) |
> > >                         (page->flags & check_flags)))
> > >                 return false;
> > >
> > > @@ -925,7 +925,7 @@ static const char *page_bad_reason(struct page *page, unsigned long flags)
> > >         if (unlikely(page->memcg_data))
> > >                 bad_reason = "page still charged to cgroup";
> > >  #endif
> > > -       if (unlikely(page_pool_page_is_pp(page)))
> > > +       if (unlikely(PageNetpp(page)))
> > >                 bad_reason = "page_pool leak";
> > >         return bad_reason;
> > >  }
> > > diff --git a/net/core/netmem_priv.h b/net/core/netmem_priv.h
> > > index cd95394399b4..39a97703d9ed 100644
> > > --- a/net/core/netmem_priv.h
> > > +++ b/net/core/netmem_priv.h
> > > @@ -8,21 +8,11 @@ static inline unsigned long netmem_get_pp_magic(netmem_ref netmem)
> > >         return __netmem_clear_lsb(netmem)->pp_magic & ~PP_DMA_INDEX_MASK;
> > >  }
> > >
> > > -static inline void netmem_or_pp_magic(netmem_ref netmem, unsigned long pp_magic)
> > > -{
> > > -       __netmem_clear_lsb(netmem)->pp_magic |= pp_magic;
> > > -}
> > > -
> > > -static inline void netmem_clear_pp_magic(netmem_ref netmem)
> > > -{
> > > -       WARN_ON_ONCE(__netmem_clear_lsb(netmem)->pp_magic & PP_DMA_INDEX_MASK);
> > > -
> > > -       __netmem_clear_lsb(netmem)->pp_magic = 0;
> > > -}
> > > -
> > >  static inline bool netmem_is_pp(netmem_ref netmem)
> > >  {
> > > -       return (netmem_get_pp_magic(netmem) & PP_MAGIC_MASK) == PP_SIGNATURE;
> > > +       if (netmem_is_net_iov(netmem))
> > > +               return true;
> >
> > As Pavel alludes, this is dubious, and at least it's difficult to
> > reason about it.
> >
> > There could be net_iovs that are not attached to pp, and should not be
> > treated as pp memory. These are in the devmem (and future net_iov) tx
> > paths.
> >
> > We need a way to tell if a net_iov is pp or not. A couple of options:
> >
> > 1. We could have it such that if net_iov->pp is set, then the
> > netmem_is_pp == true, otherwise false.
> > 2. We could implement a page-flags equivalent for net_iov.
> >
> > Option #1 is simpler and is my preferred. To do that properly, you need to:
> >
> > 1. Make sure everywhere net_iovs are allocated that pp=NULL in the
> > non-pp case and pp=non NULL in the pp case. those callsites are
> > net_devmem_bind_dmabuf (devmem rx & tx path), io_zcrx_create_area
> > (io_uring rx path).
> >
> > 2. Change netmem_is_pp to check net_iov->pp in the net_iov case.
>
> Good idea, but I'm not sure if I could work on it without consuming your
> additional review efforts.  Can anyone add net_iov_is_pp() helper?
>

Things did indeed get busy for me with work work the past week and I
still need to look at your merged netmem desc series, but I'm happy to
review whenever I can.

> Or use the page type, Netpp, as an additional way to identify if it's a
> pp page for system memory, keeping the current way using ->pp_magic.
> So the page type, Netpp, is used for system memory, and ->pp_magic is
> used for net_iov.  The clean up for ->pp_magic can be done if needed.
>

IMO I would like to avoid deviations like this, especially since
->pp_magic is in the netmem_desc struct that is now shared between
page and net_iov. I'd rather both use pp_magic or both not, but that
may just be me.


-- 
Thanks,
Mina

Re: [PATCH] mm, page_pool: introduce a new page type for page pool in page type

[Byungchul Park]

On Thu, Jul 24, 2025 at 02:23:05PM -0700, Mina Almasry wrote:
> On Tue, Jul 22, 2025 at 9:46 PM Byungchul Park <byungchul@sk.com> wrote:
> >
> > On Tue, Jul 22, 2025 at 03:17:15PM -0700, Mina Almasry wrote:
> > > On Sun, Jul 20, 2025 at 10:49 PM Byungchul Park <byungchul@sk.com> wrote:
> > > >
> > > > Hi,
> > > >
> > > > I focused on converting the existing APIs accessing ->pp_magic field to
> > > > page type APIs.  However, yes.  Additional works would better be
> > > > considered on top like:
> > > >
> > > >    1. Adjust how to store and retrieve dma index.  Maybe network guys
> > > >       can work better on top.
> > > >
> > > >    2. Move the sanity check for page pool in mm/page_alloc.c to on free.
> > > >
> > > >    Byungchul
> > > >
> > > > ---8<---
> > > > From 7d207a1b3e9f4ff2a72f5b54b09e3ed0c4aaaca3 Mon Sep 17 00:00:00 2001
> > > > From: Byungchul Park <byungchul@sk.com>
> > > > Date: Mon, 21 Jul 2025 14:05:20 +0900
> > > > Subject: [PATCH] mm, page_pool: introduce a new page type for page pool in page type
> > > >
> > > > ->pp_magic field in struct page is current used to identify if a page
> > > > belongs to a page pool.  However, page type e.i. PGTY_netpp can be used
> > > > for that purpose.
> > > >
> > > > Use the page type APIs e.g. PageNetpp(), __SetPageNetpp(), and
> > > > __ClearPageNetpp() instead, and remove the existing APIs accessing
> > > > ->pp_magic e.g. page_pool_page_is_pp(), netmem_or_pp_magic(), and
> > > > netmem_clear_pp_magic() since they are totally replaced.
> > > >
> > > > This work was inspired by the following link by Pavel:
> > > >
> > > > [1] https://lore.kernel.org/all/582f41c0-2742-4400-9c81-0d46bf4e8314@gmail.com/
> > > >
> > > > Suggested-by: Pavel Begunkov <asml.silence@gmail.com>
> > > > Signed-off-by: Byungchul Park <byungchul@sk.com>
> > > > ---
> > > >  .../net/ethernet/mellanox/mlx5/core/en/xdp.c  |  2 +-
> > > >  include/linux/mm.h                            | 28 ++-----------------
> > > >  include/linux/page-flags.h                    |  6 ++++
> > > >  include/net/netmem.h                          |  2 +-
> > > >  mm/page_alloc.c                               |  4 +--
> > > >  net/core/netmem_priv.h                        | 16 ++---------
> > > >  net/core/page_pool.c                          | 10 +++++--
> > > >  7 files changed, 24 insertions(+), 44 deletions(-)
> > > >
> > > > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> > > > index 5d51600935a6..def274f5c1ca 100644
> > > > --- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> > > > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> > > > @@ -707,7 +707,7 @@ static void mlx5e_free_xdpsq_desc(struct mlx5e_xdpsq *sq,
> > > >                                 xdpi = mlx5e_xdpi_fifo_pop(xdpi_fifo);
> > > >                                 page = xdpi.page.page;
> > > >
> > > > -                               /* No need to check page_pool_page_is_pp() as we
> > > > +                               /* No need to check PageNetpp() as we
> > > >                                  * know this is a page_pool page.
> > > >                                  */
> > > >                                 page_pool_recycle_direct(pp_page_to_nmdesc(page)->pp,
> > > > diff --git a/include/linux/mm.h b/include/linux/mm.h
> > > > index ae50c1641bed..736061749535 100644
> > > > --- a/include/linux/mm.h
> > > > +++ b/include/linux/mm.h
> > > > @@ -4135,10 +4135,9 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
> > > >   * DMA mapping IDs for page_pool
> > > >   *
> > > >   * When DMA-mapping a page, page_pool allocates an ID (from an xarray) and
> > > > - * stashes it in the upper bits of page->pp_magic. We always want to be able to
> > > > - * unambiguously identify page pool pages (using page_pool_page_is_pp()). Non-PP
> > > > - * pages can have arbitrary kernel pointers stored in the same field as pp_magic
> > > > - * (since it overlaps with page->lru.next), so we must ensure that we cannot
> > > > + * stashes it in the upper bits of page->pp_magic. Non-PP pages can have
> > > > + * arbitrary kernel pointers stored in the same field as pp_magic (since
> > > > + * it overlaps with page->lru.next), so we must ensure that we cannot
> > > >   * mistake a valid kernel pointer with any of the values we write into this
> > > >   * field.
> > > >   *
> > > > @@ -4168,25 +4167,4 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
> > > >
> > > >  #define PP_DMA_INDEX_MASK GENMASK(PP_DMA_INDEX_BITS + PP_DMA_INDEX_SHIFT - 1, \
> > > >                                   PP_DMA_INDEX_SHIFT)
> > > > -
> > > > -/* Mask used for checking in page_pool_page_is_pp() below. page->pp_magic is
> > > > - * OR'ed with PP_SIGNATURE after the allocation in order to preserve bit 0 for
> > > > - * the head page of compound page and bit 1 for pfmemalloc page, as well as the
> > > > - * bits used for the DMA index. page_is_pfmemalloc() is checked in
> > > > - * __page_pool_put_page() to avoid recycling the pfmemalloc page.
> > > > - */
> > > > -#define PP_MAGIC_MASK ~(PP_DMA_INDEX_MASK | 0x3UL)
> > > > -
> > > > -#ifdef CONFIG_PAGE_POOL
> > > > -static inline bool page_pool_page_is_pp(const struct page *page)
> > > > -{
> > > > -       return (page->pp_magic & PP_MAGIC_MASK) == PP_SIGNATURE;
> > > > -}
> > > > -#else
> > > > -static inline bool page_pool_page_is_pp(const struct page *page)
> > > > -{
> > > > -       return false;
> > > > -}
> > > > -#endif
> > > > -
> > > >  #endif /* _LINUX_MM_H */
> > > > diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
> > > > index 4fe5ee67535b..906ba7c9e372 100644
> > > > --- a/include/linux/page-flags.h
> > > > +++ b/include/linux/page-flags.h
> > > > @@ -957,6 +957,7 @@ enum pagetype {
> > > >         PGTY_zsmalloc           = 0xf6,
> > > >         PGTY_unaccepted         = 0xf7,
> > > >         PGTY_large_kmalloc      = 0xf8,
> > > > +       PGTY_netpp              = 0xf9,
> > > >
> > > >         PGTY_mapcount_underflow = 0xff
> > > >  };
> > > > @@ -1101,6 +1102,11 @@ PAGE_TYPE_OPS(Zsmalloc, zsmalloc, zsmalloc)
> > > >  PAGE_TYPE_OPS(Unaccepted, unaccepted, unaccepted)
> > > >  FOLIO_TYPE_OPS(large_kmalloc, large_kmalloc)
> > > >
> > > > +/*
> > > > + * Marks page_pool allocated pages.
> > > > + */
> > > > +PAGE_TYPE_OPS(Netpp, netpp, netpp)
> > > > +
> > > >  /**
> > > >   * PageHuge - Determine if the page belongs to hugetlbfs
> > > >   * @page: The page to test.
> > > > diff --git a/include/net/netmem.h b/include/net/netmem.h
> > > > index f7dacc9e75fd..3667334e16e7 100644
> > > > --- a/include/net/netmem.h
> > > > +++ b/include/net/netmem.h
> > > > @@ -298,7 +298,7 @@ static inline struct net_iov *__netmem_clear_lsb(netmem_ref netmem)
> > > >   */
> > > >  #define pp_page_to_nmdesc(p)                                           \
> > > >  ({                                                                     \
> > > > -       DEBUG_NET_WARN_ON_ONCE(!page_pool_page_is_pp(p));               \
> > > > +       DEBUG_NET_WARN_ON_ONCE(!PageNetpp(p));                          \
> > > >         __pp_page_to_nmdesc(p);                                         \
> > > >  })
> > > >
> > > > diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> > > > index 2ef3c07266b3..71c7666e48a9 100644
> > > > --- a/mm/page_alloc.c
> > > > +++ b/mm/page_alloc.c
> > > > @@ -898,7 +898,7 @@ static inline bool page_expected_state(struct page *page,
> > > >  #ifdef CONFIG_MEMCG
> > > >                         page->memcg_data |
> > > >  #endif
> > > > -                       page_pool_page_is_pp(page) |
> > > > +                       PageNetpp(page) |
> > > >                         (page->flags & check_flags)))
> > > >                 return false;
> > > >
> > > > @@ -925,7 +925,7 @@ static const char *page_bad_reason(struct page *page, unsigned long flags)
> > > >         if (unlikely(page->memcg_data))
> > > >                 bad_reason = "page still charged to cgroup";
> > > >  #endif
> > > > -       if (unlikely(page_pool_page_is_pp(page)))
> > > > +       if (unlikely(PageNetpp(page)))
> > > >                 bad_reason = "page_pool leak";
> > > >         return bad_reason;
> > > >  }
> > > > diff --git a/net/core/netmem_priv.h b/net/core/netmem_priv.h
> > > > index cd95394399b4..39a97703d9ed 100644
> > > > --- a/net/core/netmem_priv.h
> > > > +++ b/net/core/netmem_priv.h
> > > > @@ -8,21 +8,11 @@ static inline unsigned long netmem_get_pp_magic(netmem_ref netmem)
> > > >         return __netmem_clear_lsb(netmem)->pp_magic & ~PP_DMA_INDEX_MASK;
> > > >  }
> > > >
> > > > -static inline void netmem_or_pp_magic(netmem_ref netmem, unsigned long pp_magic)
> > > > -{
> > > > -       __netmem_clear_lsb(netmem)->pp_magic |= pp_magic;
> > > > -}
> > > > -
> > > > -static inline void netmem_clear_pp_magic(netmem_ref netmem)
> > > > -{
> > > > -       WARN_ON_ONCE(__netmem_clear_lsb(netmem)->pp_magic & PP_DMA_INDEX_MASK);
> > > > -
> > > > -       __netmem_clear_lsb(netmem)->pp_magic = 0;
> > > > -}
> > > > -
> > > >  static inline bool netmem_is_pp(netmem_ref netmem)
> > > >  {
> > > > -       return (netmem_get_pp_magic(netmem) & PP_MAGIC_MASK) == PP_SIGNATURE;
> > > > +       if (netmem_is_net_iov(netmem))
> > > > +               return true;
> > >
> > > As Pavel alludes, this is dubious, and at least it's difficult to
> > > reason about it.
> > >
> > > There could be net_iovs that are not attached to pp, and should not be
> > > treated as pp memory. These are in the devmem (and future net_iov) tx
> > > paths.
> > >
> > > We need a way to tell if a net_iov is pp or not. A couple of options:
> > >
> > > 1. We could have it such that if net_iov->pp is set, then the
> > > netmem_is_pp == true, otherwise false.
> > > 2. We could implement a page-flags equivalent for net_iov.
> > >
> > > Option #1 is simpler and is my preferred. To do that properly, you need to:
> > >
> > > 1. Make sure everywhere net_iovs are allocated that pp=NULL in the
> > > non-pp case and pp=non NULL in the pp case. those callsites are
> > > net_devmem_bind_dmabuf (devmem rx & tx path), io_zcrx_create_area
> > > (io_uring rx path).
> > >
> > > 2. Change netmem_is_pp to check net_iov->pp in the net_iov case.
> >
> > Good idea, but I'm not sure if I could work on it without consuming your
> > additional review efforts.  Can anyone add net_iov_is_pp() helper?
> >
> 
> Things did indeed get busy for me with work work the past week and I
> still need to look at your merged netmem desc series, but I'm happy to
> review whenever I can.
> 
> > Or use the page type, Netpp, as an additional way to identify if it's a
> > pp page for system memory, keeping the current way using ->pp_magic.
> > So the page type, Netpp, is used for system memory, and ->pp_magic is
> > used for net_iov.  The clean up for ->pp_magic can be done if needed.
> >
> 
> IMO I would like to avoid deviations like this, especially since
> ->pp_magic is in the netmem_desc struct that is now shared between
> page and net_iov. I'd rather both use pp_magic or both not, but that
> may just be me.

Totally Agree.  Lemme try your option #1 then.

	Byungchul
> 
> 
> --
> Thanks,
> Mina

Re: [PATCH] mm, page_pool: introduce a new page type for page pool in page type

[Byungchul Park]

On Tue, Jul 22, 2025 at 03:17:15PM -0700, Mina Almasry wrote:
> On Sun, Jul 20, 2025 at 10:49 PM Byungchul Park <byungchul@sk.com> wrote:
> > diff --git a/net/core/netmem_priv.h b/net/core/netmem_priv.h
> > index cd95394399b4..39a97703d9ed 100644
> > --- a/net/core/netmem_priv.h
> > +++ b/net/core/netmem_priv.h
> > @@ -8,21 +8,11 @@ static inline unsigned long netmem_get_pp_magic(netmem_ref netmem)
> >         return __netmem_clear_lsb(netmem)->pp_magic & ~PP_DMA_INDEX_MASK;
> >  }
> >
> > -static inline void netmem_or_pp_magic(netmem_ref netmem, unsigned long pp_magic)
> > -{
> > -       __netmem_clear_lsb(netmem)->pp_magic |= pp_magic;
> > -}
> > -
> > -static inline void netmem_clear_pp_magic(netmem_ref netmem)
> > -{
> > -       WARN_ON_ONCE(__netmem_clear_lsb(netmem)->pp_magic & PP_DMA_INDEX_MASK);
> > -
> > -       __netmem_clear_lsb(netmem)->pp_magic = 0;
> > -}
> > -
> >  static inline bool netmem_is_pp(netmem_ref netmem)
> >  {
> > -       return (netmem_get_pp_magic(netmem) & PP_MAGIC_MASK) == PP_SIGNATURE;
> > +       if (netmem_is_net_iov(netmem))
> > +               return true;
> 
> As Pavel alludes, this is dubious, and at least it's difficult to
> reason about it.
> 
> There could be net_iovs that are not attached to pp, and should not be
> treated as pp memory. These are in the devmem (and future net_iov) tx
> paths.
> 
> We need a way to tell if a net_iov is pp or not. A couple of options:
> 
> 1. We could have it such that if net_iov->pp is set, then the
> netmem_is_pp == true, otherwise false.
> 2. We could implement a page-flags equivalent for net_iov.
> 
> Option #1 is simpler and is my preferred. To do that properly, you need to:
> 
> 1. Make sure everywhere net_iovs are allocated that pp=NULL in the
> non-pp case and pp=non NULL in the pp case. those callsites are
> net_devmem_bind_dmabuf (devmem rx & tx path), io_zcrx_create_area

A few seconds reviewing the code, fortunately netmem_set_pp(pool) and
netmem_or_pp_magic(PP_SIGNATURE) are always called paired, and
netmem_set_pp(NULL) and netmem_clear_pp_magic() are always called paired
too.

And there's no code to directly assign a value to ->pp and ->pp_magic,
except in net_devmem_alloc_dmabuf() but that is also safe because always
followed by page_pool_set_pp_info().

Even though I think it's already equivalent between checking
'->pp != NULL' and '->pp_magic == PP_SIGNATURE' with the current code,
more consideration for better code should be always welcome.

As you mentioned, at net_devmem_bind_dmabuf() and io_zcrx_create_area(),
it'd better initialize ->pp and ->pp_magic like:

--
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 00d0064b22a5..8f2051b2c505 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -430,6 +430,7 @@ static int io_zcrx_create_area(struct io_zcrx_ifq *ifq,
 		area->freelist[i] = i;
 		atomic_set(&area->user_refs[i], 0);
 		niov->type = NET_IOV_IOURING;
+		page_pool_clear_pp_info(net_iov_to_netmem(niov));
 	}
 
 	area->free_count = nr_iovs;
diff --git a/net/core/devmem.c b/net/core/devmem.c
index b3a62ca0df65..5d017c9f4986 100644
--- a/net/core/devmem.c
+++ b/net/core/devmem.c
@@ -285,6 +285,7 @@ net_devmem_bind_dmabuf(struct net_device *dev,
 			niov = &owner->area.niovs[i];
 			niov->type = NET_IOV_DMABUF;
 			niov->owner = &owner->area;
+			page_pool_clear_pp_info(net_iov_to_netmem(niov));
 			page_pool_set_dma_addr_netmem(net_iov_to_netmem(niov),
 						      net_devmem_get_dma_addr(niov));
 			if (direction == DMA_TO_DEVICE)
--

Do you think it works for using ->pp to check if a niov is pp?

	Byungchul

Re: [PATCH] mm, page_pool: introduce a new page type for page pool in page type

[Byungchul Park]

On Mon, Jul 21, 2025 at 10:49:37AM +0200, David Hildenbrand wrote:
> > > 
> > > This will not work they way you want it once you rebase on top of
> > > linux-next, where we have (from mm/mm-stable)
> > > 
> > > commit 2dfcd1608f3a96364f10de7fcfe28727c0292e5d
> > 
> > I just checked this.
> > 
> > So is it sufficient that I rebase on mm/mm-stable?  Or should I wait for
> > something else?  Or should I achieve this in other ways?
> 
> Probably best to rebase (+test) to linux-next, where that commit should
> be in.

+cc sfr@canb.auug.org.au

	Byungchul
> 
> Whatever is in mm-stable is expected to go upstream in the next merge
> window (iow, soon), with stable commit ids.
> 
> --
> Cheers,
> 
> David / dhildenb