]> git.ipfire.org Git - thirdparty/linux.git/commitdiff
Revert "mm: introduce a new page type for page pool in page type"
authorByungchul Park <byungchul@sk.com>
Fri, 15 May 2026 03:47:01 +0000 (12:47 +0900)
committerAndrew Morton <akpm@linux-foundation.org>
Fri, 22 May 2026 02:06:13 +0000 (19:06 -0700)
This reverts commit db359fccf212 ("mm: introduce a new page type for page
pool in page type") and a part of 735a309b4bfb9e ("net: add net_iov_init()
and use it to initialize ->page_type").

Netpp page_type'ed pages might be used in mapping so as to use @_mapcount.
However, since @page_type and @_mapcount are union'ed in struct page,
these two can't be used at the same time.  Revert the commit introducing
page_type for Netpp for now.

The patch will be retried once @page_type and @_mapcount get allowed to be
used at the same time.

The revert also includes removal of @page_type initialization part
introduced by commit 735a309b4bfb9e ("net: add net_iov_init() and use it
to initialize ->page_type"), which will be restored on the retry.

Link: https://lore.kernel.org/20260515034701.17027-1-byungchul@sk.com
Fixes: db359fccf212 ("mm: introduce a new page type for page pool in page type")
Signed-off-by: Byungchul Park <byungchul@sk.com>
Reported-by: Dragos Tatulea <dtatulea@nvidia.com>
Closes: https://lore.kernel.org/all/982b9bc1-0a0a-4fc5-8e3a-3672db2b29a1@nvidia.com
Acked-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Harry Yoo (Oracle) <harry@kernel.org>
Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Jesper Dangaard Brouer <hawk@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Mark Bloch <mbloch@nvidia.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Pavel Begunkov <asml.silence@gmail.com>
Cc: Saeed Mahameed <saeedm@nvidia.com>
Cc: Simon Horman <horms@kernel.org>
Cc: Stanislav Fomichev <sdf@fomichev.me>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Tariq Toukan <tariqt@nvidia.com>
Cc: Toke Hoiland-Jorgensen <toke@redhat.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
include/linux/mm.h
include/linux/page-flags.h
include/net/netmem.h
mm/page_alloc.c
net/core/netmem_priv.h
net/core/page_pool.c

index 190b8b66b3ce12ae5a51c0f48c65df9693c239ab..d3bab198c99c004d2c9617b5f611bf2621347416 100644 (file)
@@ -708,7 +708,7 @@ static void mlx5e_free_xdpsq_desc(struct mlx5e_xdpsq *sq,
                                xdpi = mlx5e_xdpi_fifo_pop(xdpi_fifo);
                                page = xdpi.page.page;
 
-                               /* No need to check PageNetpp() as we
+                               /* No need to check page_pool_page_is_pp() as we
                                 * know this is a page_pool page.
                                 */
                                page_pool_recycle_direct(pp_page_to_nmdesc(page)->pp,
index af23453e9dbd0b5d7569f16d2ef95d48e8a8969c..06bbe9eba636fbadc1fcc23c9d586ed8886a7d1c 100644 (file)
@@ -5174,9 +5174,10 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
  * DMA mapping IDs for page_pool
  *
  * When DMA-mapping a page, page_pool allocates an ID (from an xarray) and
- * stashes it in the upper bits of page->pp_magic. Non-PP pages can have
- * arbitrary kernel pointers stored in the same field as pp_magic (since
- * it overlaps with page->lru.next), so we must ensure that we cannot
+ * stashes it in the upper bits of page->pp_magic. We always want to be able to
+ * unambiguously identify page pool pages (using page_pool_page_is_pp()). Non-PP
+ * pages can have arbitrary kernel pointers stored in the same field as pp_magic
+ * (since it overlaps with page->lru.next), so we must ensure that we cannot
  * mistake a valid kernel pointer with any of the values we write into this
  * field.
  *
@@ -5211,6 +5212,26 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
 #define PP_DMA_INDEX_MASK GENMASK(PP_DMA_INDEX_BITS + PP_DMA_INDEX_SHIFT - 1, \
                                  PP_DMA_INDEX_SHIFT)
 
+/* Mask used for checking in page_pool_page_is_pp() below. page->pp_magic is
+ * OR'ed with PP_SIGNATURE after the allocation in order to preserve bit 0 for
+ * the head page of compound page and bit 1 for pfmemalloc page, as well as the
+ * bits used for the DMA index. page_is_pfmemalloc() is checked in
+ * __page_pool_put_page() to avoid recycling the pfmemalloc page.
+ */
+#define PP_MAGIC_MASK ~(PP_DMA_INDEX_MASK | 0x3UL)
+
+#ifdef CONFIG_PAGE_POOL
+static inline bool page_pool_page_is_pp(const struct page *page)
+{
+       return (page->pp_magic & PP_MAGIC_MASK) == PP_SIGNATURE;
+}
+#else
+static inline bool page_pool_page_is_pp(const struct page *page)
+{
+       return false;
+}
+#endif
+
 #define PAGE_SNAPSHOT_FAITHFUL (1 << 0)
 #define PAGE_SNAPSHOT_PG_BUDDY (1 << 1)
 #define PAGE_SNAPSHOT_PG_IDLE  (1 << 2)
index 0e03d816e8b9dba6670fab525f118beb0cb60221..7223f6f4e2b4035494e8fb14f2b35fe5c33f8eda 100644 (file)
@@ -923,7 +923,6 @@ enum pagetype {
        PGTY_zsmalloc           = 0xf6,
        PGTY_unaccepted         = 0xf7,
        PGTY_large_kmalloc      = 0xf8,
-       PGTY_netpp              = 0xf9,
 
        PGTY_mapcount_underflow = 0xff
 };
@@ -1056,11 +1055,6 @@ PAGE_TYPE_OPS(Zsmalloc, zsmalloc, zsmalloc)
 PAGE_TYPE_OPS(Unaccepted, unaccepted, unaccepted)
 PAGE_TYPE_OPS(LargeKmalloc, large_kmalloc, large_kmalloc)
 
-/*
- * Marks page_pool allocated pages.
- */
-PAGE_TYPE_OPS(Netpp, netpp, netpp)
-
 /**
  * PageHuge - Determine if the page belongs to hugetlbfs
  * @page: The page to test.
index 78fe51e5756b101807fe633999fab67314661d08..bccacd21b6c374dfa83c37194512c55b5874fb39 100644 (file)
@@ -94,20 +94,10 @@ enum net_iov_type {
  */
 struct net_iov {
        struct netmem_desc desc;
-       unsigned int page_type;
        enum net_iov_type type;
        struct net_iov_area *owner;
 };
 
-/* Make sure 'the offset of page_type in struct page == the offset of
- * type in struct net_iov'.
- */
-#define NET_IOV_ASSERT_OFFSET(pg, iov)                 \
-       static_assert(offsetof(struct page, pg) ==      \
-                     offsetof(struct net_iov, iov))
-NET_IOV_ASSERT_OFFSET(page_type, page_type);
-#undef NET_IOV_ASSERT_OFFSET
-
 struct net_iov_area {
        /* Array of net_iovs for this area. */
        struct net_iov *niovs;
@@ -127,11 +117,7 @@ static inline unsigned int net_iov_idx(const struct net_iov *niov)
        return niov - net_iov_owner(niov)->niovs;
 }
 
-/* Initialize a niov: stamp the owning area, the memory provider type,
- * and the page_type "no type" sentinel expected by the page-type API
- * (see PAGE_TYPE_OPS in <linux/page-flags.h>) so that
- * page_pool_set_pp_info() can later call __SetPageNetpp() on a niov
- * cast to struct page.
+/* Initialize a niov: stamp the owning area, the memory provider type.
  */
 static inline void net_iov_init(struct net_iov *niov,
                                struct net_iov_area *owner,
@@ -139,7 +125,6 @@ static inline void net_iov_init(struct net_iov *niov,
 {
        niov->owner = owner;
        niov->type = type;
-       niov->page_type = UINT_MAX;
 }
 
 /* netmem */
@@ -245,7 +230,7 @@ static inline unsigned long netmem_pfn_trace(netmem_ref netmem)
  */
 #define pp_page_to_nmdesc(p)                                           \
 ({                                                                     \
-       DEBUG_NET_WARN_ON_ONCE(!PageNetpp(p));                          \
+       DEBUG_NET_WARN_ON_ONCE(!page_pool_page_is_pp(p));               \
        __pp_page_to_nmdesc(p);                                         \
 })
 
index 23c7298d3be298ae39ceb56982e8e25ea437ad2f..d49c254174da79fd50028b757e57c2acfb2093d3 100644 (file)
@@ -1035,6 +1035,7 @@ static inline bool page_expected_state(struct page *page,
 #ifdef CONFIG_MEMCG
                        page->memcg_data |
 #endif
+                       page_pool_page_is_pp(page) |
                        (page->flags.f & check_flags)))
                return false;
 
@@ -1061,6 +1062,8 @@ static const char *page_bad_reason(struct page *page, unsigned long flags)
        if (unlikely(page->memcg_data))
                bad_reason = "page still charged to cgroup";
 #endif
+       if (unlikely(page_pool_page_is_pp(page)))
+               bad_reason = "page_pool leak";
        return bad_reason;
 }
 
@@ -1377,17 +1380,9 @@ __always_inline bool __free_pages_prepare(struct page *page,
                mod_mthp_stat(order, MTHP_STAT_NR_ANON, -1);
                folio->mapping = NULL;
        }
-       if (unlikely(page_has_type(page))) {
-               /* networking expects to clear its page type before releasing */
-               if (is_check_pages_enabled()) {
-                       if (unlikely(PageNetpp(page))) {
-                               bad_page(page, "page_pool leak");
-                               return false;
-                       }
-               }
+       if (unlikely(page_has_type(page)))
                /* Reset the page_type (which overlays _mapcount) */
                page->page_type = UINT_MAX;
-       }
 
        if (is_check_pages_enabled()) {
                if (free_page_is_bad(page))
index 3e6fde8f1726f22dd8daba9e49134a8407964af5..23175cb2bd86688c2ecd0978336949955734c9dd 100644 (file)
@@ -8,18 +8,21 @@ static inline unsigned long netmem_get_pp_magic(netmem_ref netmem)
        return netmem_to_nmdesc(netmem)->pp_magic & ~PP_DMA_INDEX_MASK;
 }
 
-static inline bool netmem_is_pp(netmem_ref netmem)
+static inline void netmem_or_pp_magic(netmem_ref netmem, unsigned long pp_magic)
+{
+       netmem_to_nmdesc(netmem)->pp_magic |= pp_magic;
+}
+
+static inline void netmem_clear_pp_magic(netmem_ref netmem)
 {
-       struct page *page;
+       WARN_ON_ONCE(netmem_to_nmdesc(netmem)->pp_magic & PP_DMA_INDEX_MASK);
 
-       /* XXX: Now that the offset of page_type is shared between
-        * struct page and net_iov, just cast the netmem to struct page
-        * unconditionally by clearing NET_IOV if any, no matter whether
-        * it comes from struct net_iov or struct page.  This should be
-        * adjusted once the offset is no longer shared.
-        */
-       page = (struct page *)((__force unsigned long)netmem & ~NET_IOV);
-       return PageNetpp(page);
+       netmem_to_nmdesc(netmem)->pp_magic = 0;
+}
+
+static inline bool netmem_is_pp(netmem_ref netmem)
+{
+       return (netmem_get_pp_magic(netmem) & PP_MAGIC_MASK) == PP_SIGNATURE;
 }
 
 static inline void netmem_set_pp(netmem_ref netmem, struct page_pool *pool)
index 6e576dec80db42ebf5434566db17e46a56b3bf08..8171d1173221b42fb77dce064b57b59f93ab14a5 100644 (file)
@@ -707,18 +707,8 @@ s32 page_pool_inflight(const struct page_pool *pool, bool strict)
 
 void page_pool_set_pp_info(struct page_pool *pool, netmem_ref netmem)
 {
-       struct page *page;
-
        netmem_set_pp(netmem, pool);
-
-       /* XXX: Now that the offset of page_type is shared between
-        * struct page and net_iov, just cast the netmem to struct page
-        * unconditionally by clearing NET_IOV if any, no matter whether
-        * it comes from struct net_iov or struct page.  This should be
-        * adjusted once the offset is no longer shared.
-        */
-       page = (struct page *)((__force unsigned long)netmem & ~NET_IOV);
-       __SetPageNetpp(page);
+       netmem_or_pp_magic(netmem, PP_SIGNATURE);
 
        /* Ensuring all pages have been split into one fragment initially:
         * page_pool_set_pp_info() is only called once for every page when it
@@ -733,17 +723,7 @@ void page_pool_set_pp_info(struct page_pool *pool, netmem_ref netmem)
 
 void page_pool_clear_pp_info(netmem_ref netmem)
 {
-       struct page *page;
-
-       /* XXX: Now that the offset of page_type is shared between
-        * struct page and net_iov, just cast the netmem to struct page
-        * unconditionally by clearing NET_IOV if any, no matter whether
-        * it comes from struct net_iov or struct page.  This should be
-        * adjusted once the offset is no longer shared.
-        */
-       page = (struct page *)((__force unsigned long)netmem & ~NET_IOV);
-       __ClearPageNetpp(page);
-
+       netmem_clear_pp_magic(netmem);
        netmem_set_pp(netmem, NULL);
 }