[PATCH v2 0/1] finalize removing the page pool members in struct page

[PATCH v2 0/1] finalize removing the page pool members in struct page

[Byungchul Park]

Since this patch requires to use newly introduced APIs in net tree, I've
been waiting for those to be ready in mm tree.  Now that mm tree has
been rebased so as to include the APIs, this patch can be merged to mm
tree.

This patch has been carried out in a separate thread so far for the
reviews [1]:

 [1] https://lore.kernel.org/all/20251119012709.35895-1-byungchul@sk.com/
---
Changes from v1:
	1. Drop the finalizing patch removing the pp fields of struct
	   page since I found that there is still code accessing a pp
	   field via struct page.  I will retry the finalizing patch
	   after resolving the issue.
---
Byungchul Park (1):
  mm: introduce a new page type for page pool in page type

 .../net/ethernet/mellanox/mlx5/core/en/xdp.c  |  2 +-
 include/linux/mm.h                            | 27 +++----------------
 include/linux/page-flags.h                    |  6 +++++
 include/net/netmem.h                          | 15 +++++++++--
 mm/page_alloc.c                               | 11 +++++---
 net/core/netmem_priv.h                        | 20 +++++---------
 net/core/page_pool.c                          | 18 +++++++++++--
 7 files changed, 53 insertions(+), 46 deletions(-)


base-commit: d0a24447990a9d8212bfb3a692d59efa74ce9f86
-- 
2.17.1

[PATCH v2 1/1] mm: introduce a new page type for page pool in page type

[Byungchul Park]

Currently, the condition 'page->pp_magic == PP_SIGNATURE' is used to
determine if a page belongs to a page pool.  However, with the planned
removal of @pp_magic, we should instead leverage the page_type in struct
page, such as PGTY_netpp, for this purpose.

Introduce and use the page type APIs e.g. PageNetpp(), __SetPageNetpp(),
and __ClearPageNetpp() instead, and remove the existing APIs accessing
@pp_magic e.g. page_pool_page_is_pp(), netmem_or_pp_magic(), and
netmem_clear_pp_magic().

Plus, add @page_type to struct net_iov at the same offset as struct page
so as to use the page_type APIs for struct net_iov as well.  While at it,
reorder @type and @owner in struct net_iov to avoid a hole and
increasing the struct size.

This work was inspired by the following link:

  https://lore.kernel.org/all/582f41c0-2742-4400-9c81-0d46bf4e8314@gmail.com/

While at it, move the sanity check for page pool to on the free path.

Suggested-by: David Hildenbrand <david@redhat.com>
Co-developed-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Byungchul Park <byungchul@sk.com>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
---
 .../net/ethernet/mellanox/mlx5/core/en/xdp.c  |  2 +-
 include/linux/mm.h                            | 27 +++----------------
 include/linux/page-flags.h                    |  6 +++++
 include/net/netmem.h                          | 15 +++++++++--
 mm/page_alloc.c                               | 11 +++++---
 net/core/netmem_priv.h                        | 20 +++++---------
 net/core/page_pool.c                          | 18 +++++++++++--
 7 files changed, 53 insertions(+), 46 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
index 80f9fc10877ad..7d90d2485c787 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
@@ -707,7 +707,7 @@ static void mlx5e_free_xdpsq_desc(struct mlx5e_xdpsq *sq,
 				xdpi = mlx5e_xdpi_fifo_pop(xdpi_fifo);
 				page = xdpi.page.page;
 
-				/* No need to check page_pool_page_is_pp() as we
+				/* No need to check PageNetpp() as we
 				 * know this is a page_pool page.
 				 */
 				page_pool_recycle_direct(pp_page_to_nmdesc(page)->pp,
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 15076261d0c2e..94f824bf0d38c 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -4565,10 +4565,9 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
  * DMA mapping IDs for page_pool
  *
  * When DMA-mapping a page, page_pool allocates an ID (from an xarray) and
- * stashes it in the upper bits of page->pp_magic. We always want to be able to
- * unambiguously identify page pool pages (using page_pool_page_is_pp()). Non-PP
- * pages can have arbitrary kernel pointers stored in the same field as pp_magic
- * (since it overlaps with page->lru.next), so we must ensure that we cannot
+ * stashes it in the upper bits of page->pp_magic. Non-PP pages can have
+ * arbitrary kernel pointers stored in the same field as pp_magic (since
+ * it overlaps with page->lru.next), so we must ensure that we cannot
  * mistake a valid kernel pointer with any of the values we write into this
  * field.
  *
@@ -4603,26 +4602,6 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
 #define PP_DMA_INDEX_MASK GENMASK(PP_DMA_INDEX_BITS + PP_DMA_INDEX_SHIFT - 1, \
 				  PP_DMA_INDEX_SHIFT)
 
-/* Mask used for checking in page_pool_page_is_pp() below. page->pp_magic is
- * OR'ed with PP_SIGNATURE after the allocation in order to preserve bit 0 for
- * the head page of compound page and bit 1 for pfmemalloc page, as well as the
- * bits used for the DMA index. page_is_pfmemalloc() is checked in
- * __page_pool_put_page() to avoid recycling the pfmemalloc page.
- */
-#define PP_MAGIC_MASK ~(PP_DMA_INDEX_MASK | 0x3UL)
-
-#ifdef CONFIG_PAGE_POOL
-static inline bool page_pool_page_is_pp(const struct page *page)
-{
-	return (page->pp_magic & PP_MAGIC_MASK) == PP_SIGNATURE;
-}
-#else
-static inline bool page_pool_page_is_pp(const struct page *page)
-{
-	return false;
-}
-#endif
-
 #define PAGE_SNAPSHOT_FAITHFUL (1 << 0)
 #define PAGE_SNAPSHOT_PG_BUDDY (1 << 1)
 #define PAGE_SNAPSHOT_PG_IDLE  (1 << 2)
diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index f7a0e4af0c734..39a21ee87b437 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -934,6 +934,7 @@ enum pagetype {
 	PGTY_zsmalloc		= 0xf6,
 	PGTY_unaccepted		= 0xf7,
 	PGTY_large_kmalloc	= 0xf8,
+	PGTY_netpp		= 0xf9,
 
 	PGTY_mapcount_underflow = 0xff
 };
@@ -1066,6 +1067,11 @@ PAGE_TYPE_OPS(Zsmalloc, zsmalloc, zsmalloc)
 PAGE_TYPE_OPS(Unaccepted, unaccepted, unaccepted)
 PAGE_TYPE_OPS(LargeKmalloc, large_kmalloc, large_kmalloc)
 
+/*
+ * Marks page_pool allocated pages.
+ */
+PAGE_TYPE_OPS(Netpp, netpp, netpp)
+
 /**
  * PageHuge - Determine if the page belongs to hugetlbfs
  * @page: The page to test.
diff --git a/include/net/netmem.h b/include/net/netmem.h
index 9e10f4ac50c3d..2a73b68f16b15 100644
--- a/include/net/netmem.h
+++ b/include/net/netmem.h
@@ -110,10 +110,21 @@ struct net_iov {
 			atomic_long_t pp_ref_count;
 		};
 	};
-	struct net_iov_area *owner;
+
+	unsigned int page_type;
 	enum net_iov_type type;
+	struct net_iov_area *owner;
 };
 
+/* Make sure 'the offset of page_type in struct page == the offset of
+ * type in struct net_iov'.
+ */
+#define NET_IOV_ASSERT_OFFSET(pg, iov)			\
+	static_assert(offsetof(struct page, pg) ==	\
+		      offsetof(struct net_iov, iov))
+NET_IOV_ASSERT_OFFSET(page_type, page_type);
+#undef NET_IOV_ASSERT_OFFSET
+
 struct net_iov_area {
 	/* Array of net_iovs for this area. */
 	struct net_iov *niovs;
@@ -256,7 +267,7 @@ static inline unsigned long netmem_pfn_trace(netmem_ref netmem)
  */
 #define pp_page_to_nmdesc(p)						\
 ({									\
-	DEBUG_NET_WARN_ON_ONCE(!page_pool_page_is_pp(p));		\
+	DEBUG_NET_WARN_ON_ONCE(!PageNetpp(p));				\
 	__pp_page_to_nmdesc(p);						\
 })
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 5bb3a7844abb6..c126a9790953b 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1042,7 +1042,6 @@ static inline bool page_expected_state(struct page *page,
 #ifdef CONFIG_MEMCG
 			page->memcg_data |
 #endif
-			page_pool_page_is_pp(page) |
 			(page->flags.f & check_flags)))
 		return false;
 
@@ -1069,8 +1068,6 @@ static const char *page_bad_reason(struct page *page, unsigned long flags)
 	if (unlikely(page->memcg_data))
 		bad_reason = "page still charged to cgroup";
 #endif
-	if (unlikely(page_pool_page_is_pp(page)))
-		bad_reason = "page_pool leak";
 	return bad_reason;
 }
 
@@ -1379,9 +1376,15 @@ __always_inline bool free_pages_prepare(struct page *page,
 		mod_mthp_stat(order, MTHP_STAT_NR_ANON, -1);
 		folio->mapping = NULL;
 	}
-	if (unlikely(page_has_type(page)))
+	if (unlikely(page_has_type(page))) {
+		/* networking expects to clear its page type before releasing */
+		if (unlikely(PageNetpp(page))) {
+			bad_page(page, "page_pool leak");
+			return false;
+		}
 		/* Reset the page_type (which overlays _mapcount) */
 		page->page_type = UINT_MAX;
+	}
 
 	if (is_check_pages_enabled()) {
 		if (free_page_is_bad(page))
diff --git a/net/core/netmem_priv.h b/net/core/netmem_priv.h
index 23175cb2bd866..6b7d90b8ebb9b 100644
--- a/net/core/netmem_priv.h
+++ b/net/core/netmem_priv.h
@@ -8,21 +8,15 @@ static inline unsigned long netmem_get_pp_magic(netmem_ref netmem)
 	return netmem_to_nmdesc(netmem)->pp_magic & ~PP_DMA_INDEX_MASK;
 }
 
-static inline void netmem_or_pp_magic(netmem_ref netmem, unsigned long pp_magic)
-{
-	netmem_to_nmdesc(netmem)->pp_magic |= pp_magic;
-}
-
-static inline void netmem_clear_pp_magic(netmem_ref netmem)
-{
-	WARN_ON_ONCE(netmem_to_nmdesc(netmem)->pp_magic & PP_DMA_INDEX_MASK);
-
-	netmem_to_nmdesc(netmem)->pp_magic = 0;
-}
-
 static inline bool netmem_is_pp(netmem_ref netmem)
 {
-	return (netmem_get_pp_magic(netmem) & PP_MAGIC_MASK) == PP_SIGNATURE;
+	/* XXX: Now that the offset of page_type is shared between
+	 * struct page and net_iov, just cast the netmem to struct page
+	 * unconditionally by clearing NET_IOV if any, no matter whether
+	 * it comes from struct net_iov or struct page.  This should be
+	 * adjusted once the offset is no longer shared.
+	 */
+	return PageNetpp(__netmem_to_page((__force unsigned long)netmem & ~NET_IOV));
 }
 
 static inline void netmem_set_pp(netmem_ref netmem, struct page_pool *pool)
diff --git a/net/core/page_pool.c b/net/core/page_pool.c
index 265a729431bb7..323314b1333ee 100644
--- a/net/core/page_pool.c
+++ b/net/core/page_pool.c
@@ -703,7 +703,14 @@ s32 page_pool_inflight(const struct page_pool *pool, bool strict)
 void page_pool_set_pp_info(struct page_pool *pool, netmem_ref netmem)
 {
 	netmem_set_pp(netmem, pool);
-	netmem_or_pp_magic(netmem, PP_SIGNATURE);
+
+	/* XXX: Now that the offset of page_type is shared between
+	 * struct page and net_iov, just cast the netmem to struct page
+	 * unconditionally by clearing NET_IOV if any, no matter whether
+	 * it comes from struct net_iov or struct page.  This should be
+	 * adjusted once the offset is no longer shared.
+	 */
+	__SetPageNetpp(__netmem_to_page((__force unsigned long)netmem & ~NET_IOV));
 
 	/* Ensuring all pages have been split into one fragment initially:
 	 * page_pool_set_pp_info() is only called once for every page when it
@@ -718,7 +725,14 @@ void page_pool_set_pp_info(struct page_pool *pool, netmem_ref netmem)
 
 void page_pool_clear_pp_info(netmem_ref netmem)
 {
-	netmem_clear_pp_magic(netmem);
+	/* XXX: Now that the offset of page_type is shared between
+	 * struct page and net_iov, just cast the netmem to struct page
+	 * unconditionally by clearing NET_IOV if any, no matter whether
+	 * it comes from struct net_iov or struct page.  This should be
+	 * adjusted once the offset is no longer shared.
+	 */
+	__ClearPageNetpp(__netmem_to_page((__force unsigned long)netmem & ~NET_IOV));
+
 	netmem_set_pp(netmem, NULL);
 }
 
-- 
2.17.1

Re: [PATCH v2 0/1] finalize removing the page pool members in struct page

[Vlastimil Babka]

On 12/16/25 04:03, Byungchul Park wrote:
> Since this patch requires to use newly introduced APIs in net tree, I've
> been waiting for those to be ready in mm tree.  Now that mm tree has
> been rebased so as to include the APIs, this patch can be merged to mm
> tree.
> 
> This patch has been carried out in a separate thread so far for the
> reviews [1]:
> 
>  [1] https://lore.kernel.org/all/20251119012709.35895-1-byungchul@sk.com/
> ---
> Changes from v1:
> 	1. Drop the finalizing patch removing the pp fields of struct
> 	   page since I found that there is still code accessing a pp
> 	   field via struct page.  I will retry the finalizing patch
> 	   after resolving the issue.

Could we just make that necessary change of
drivers/net/ethernet/intel/ice/ice_ethtool.c part of this series and do it
all at once? We're changing both mm and net anyway.

Also which tree will carry the series? I assume net will want to, as the
changes are mostly there?

> ---
> Byungchul Park (1):
>   mm: introduce a new page type for page pool in page type
> 
>  .../net/ethernet/mellanox/mlx5/core/en/xdp.c  |  2 +-
>  include/linux/mm.h                            | 27 +++----------------
>  include/linux/page-flags.h                    |  6 +++++
>  include/net/netmem.h                          | 15 +++++++++--
>  mm/page_alloc.c                               | 11 +++++---
>  net/core/netmem_priv.h                        | 20 +++++---------
>  net/core/page_pool.c                          | 18 +++++++++++--
>  7 files changed, 53 insertions(+), 46 deletions(-)
> 
> 
> base-commit: d0a24447990a9d8212bfb3a692d59efa74ce9f86

Re: [PATCH v2 0/1] finalize removing the page pool members in struct page

[Byungchul Park]

On Wed, Dec 17, 2025 at 02:43:07PM +0100, Vlastimil Babka wrote:
> On 12/16/25 04:03, Byungchul Park wrote:
> > Since this patch requires to use newly introduced APIs in net tree, I've
> > been waiting for those to be ready in mm tree.  Now that mm tree has
> > been rebased so as to include the APIs, this patch can be merged to mm
> > tree.
> >
> > This patch has been carried out in a separate thread so far for the
> > reviews [1]:
> >
> >  [1] https://lore.kernel.org/all/20251119012709.35895-1-byungchul@sk.com/
> > ---
> > Changes from v1:
> >       1. Drop the finalizing patch removing the pp fields of struct
> >          page since I found that there is still code accessing a pp
> >          field via struct page.  I will retry the finalizing patch
> >          after resolving the issue.
> 
> Could we just make that necessary change of
> drivers/net/ethernet/intel/ice/ice_ethtool.c part of this series and do it
> all at once? We're changing both mm and net anyway.

Yes.  That's what I think it'd better do.  1/2 can be merged separately
and Andrew took it.  I'd like to re-post 'ice fix' + 2/2 in a series if
it's allowed.

> Also which tree will carry the series? I assume net will want to, as the

I'm trying to apply changes focused on mm to mm tree, and changes
focused on net to net tree.  However, yeah, it'd make things simpler if
I can go with a single series for mm tree.

	Byungchul

> changes are mostly there?
> 
> > ---
> > Byungchul Park (1):
> >   mm: introduce a new page type for page pool in page type
> >
> >  .../net/ethernet/mellanox/mlx5/core/en/xdp.c  |  2 +-
> >  include/linux/mm.h                            | 27 +++----------------
> >  include/linux/page-flags.h                    |  6 +++++
> >  include/net/netmem.h                          | 15 +++++++++--
> >  mm/page_alloc.c                               | 11 +++++---
> >  net/core/netmem_priv.h                        | 20 +++++---------
> >  net/core/page_pool.c                          | 18 +++++++++++--
> >  7 files changed, 53 insertions(+), 46 deletions(-)
> >
> >
> > base-commit: d0a24447990a9d8212bfb3a692d59efa74ce9f86

Re: [PATCH v2 0/1] finalize removing the page pool members in struct page

[Paolo Abeni]

On 12/18/25 1:17 AM, Byungchul Park wrote:
> On Wed, Dec 17, 2025 at 02:43:07PM +0100, Vlastimil Babka wrote:
>> On 12/16/25 04:03, Byungchul Park wrote:
>>> Since this patch requires to use newly introduced APIs in net tree, I've
>>> been waiting for those to be ready in mm tree.  Now that mm tree has
>>> been rebased so as to include the APIs, this patch can be merged to mm
>>> tree.
>>>
>>> This patch has been carried out in a separate thread so far for the
>>> reviews [1]:
>>>
>>>  [1] https://lore.kernel.org/all/20251119012709.35895-1-byungchul@sk.com/
>>> ---
>>> Changes from v1:
>>>       1. Drop the finalizing patch removing the pp fields of struct
>>>          page since I found that there is still code accessing a pp
>>>          field via struct page.  I will retry the finalizing patch
>>>          after resolving the issue.
>>
>> Could we just make that necessary change of
>> drivers/net/ethernet/intel/ice/ice_ethtool.c part of this series and do it
>> all at once? We're changing both mm and net anyway.
> 
> Yes.  That's what I think it'd better do.  1/2 can be merged separately
> and Andrew took it.  I'd like to re-post 'ice fix' + 2/2 in a series if
> it's allowed.
> 
>> Also which tree will carry the series? I assume net will want to, as the
> 
> I'm trying to apply changes focused on mm to mm tree, and changes
> focused on net to net tree.  However, yeah, it'd make things simpler if
> I can go with a single series for mm tree.

I *think* that the ice patch should go via the net-next tree (and
ideally via the iwl tree first). Also it looks like both patches could
cause quite a bit of conflicts, as the page pool code and the ice driver
are touched frequently.

Perhaps the easier/cleaner way to handle this is publishing a stable
branch somewhere based on the most recent common ancestor and let both
the mm and the net-next tree pull from it? Other opinions welcome!

Anyway the net-next tree is and will be closed up to Jan 2.

Cheers,

Paolo