Re: [PATCH v3 2/6] mm/sparse-vmemmap: support device DAX in common vmemmap path

On Sep 30, 2026, at 16:53, Lance Yang [off-list ref] wrote:


On Tue, Sep 29, 2026 at 01:32:27PM +0800, Muchun Song wrote:

quoted

The common vmemmap population path cannot yet handle optimized Device DAX
mappings on its own. It uses pfn_to_zone() to find the shared tail page,
but Device DAX populates its vmemmap at runtime before the ZONE_DEVICE span
is initialized.

Teach the common path to use device_zone() for runtime optimized vmemmap
population while retaining pfn_to_zone() for early boot. This allows the
same path to support both early boot mappings and Device DAX.

The backing PFN supplied by the Device DAX-specific population path is no
longer used, allowing the redundant lookup and population code to be
removed later.

Signed-off-by: Muchun Song <redacted>
Acked-by: Qi Zheng <qi.zheng@linux.dev>
---
v3:
- Collect Acked-by from Qi Zheng

v2:
- Expand comments around slab initialization to explain zone lookup and
page refcounting (suggested by Qi Zheng)
---
mm/sparse-vmemmap.c | 64 +++++++++++++++++++++++++--------------------
1 file changed, 35 insertions(+), 29 deletions(-)

diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c
index 8219abc6c3e5..ee4c113ca938 100644
--- a/mm/sparse-vmemmap.c
+++ b/mm/sparse-vmemmap.c

@@ -237,18 +237,43 @@ static __meminit void *vmemmap_alloc_pte(unsigned long pfn, int node,

struct page *page;
const unsigned int order = pfn_to_section_compound_order(pfn);

- /*
-  * Device DAX still relies on vmemmap_populate_compound_pages() for
-  * head/first-tail allocation and tail-page reuse.
-  */
if (!vmemmap_optimizable_pfn(pfn))
return vmemmap_alloc_block_buf(PAGE_SIZE, node, altmap);

- zone = pfn_to_zone(pfn, node);
+ /*
+  * Before slab is available, vmemmap optimization is used for early
+  * system RAM, whose zone can be determined from the PFN.
+  *
+  * Once slab is available, only ZONE_DEVICE memory reaches this
+  * optimized population path. Its zone span has not been initialized
+  * while its vmemmap is being populated, so pfn_to_zone() cannot be
+  * used. Obtain ZONE_DEVICE directly from the node instead.
+  */
+ zone = slab_is_available() ? device_zone(node) : pfn_to_zone(pfn, node);
page = vmemmap_shared_tail_page(order, zone);
if (!page)
return NULL;

+ /*
+  * During early vmemmap population, the shared tail vmemmap backing
+  * page is allocated from memblock before its struct page can safely
+  * participate in page refcounting. Therefore, no reference can be
+  * held for each shared PTE mapping, and the mappings must be unshared
+  * before the vmemmap is depopulated.
+  *
+  * Once slab is available, the shared backing page is allocated from
+  * the buddy allocator and can be refcounted. Hold one reference for
+  * each shared PTE mapping. The architecture vmemmap teardown drops
+  * the reference through __free_pages() when removing the mapping,
+  * preventing the backing page from being freed while it is shared.
+  *
+  * The backing page may be shared by enough PTE mappings to exhaust
+  * the positive range of its reference count. Stop populating the
+  * vmemmap if another reference cannot be acquired.
+  */
+ if (slab_is_available() && !try_get_page(page))
+ return NULL;

BTW, shouldn't __add_pages() undo the earlier sections on a population
failure? Say the first section is added successfully, but populating the
next one fails, e.g. due to an allocation failure:

void *memremap_pages(struct dev_pagemap *pgmap, int nid)
{
	...
	const int nr_range = pgmap->nr_range;
	int error, i;
	...
	pgmap->nr_range = 0;
	error = 0;
	for (i = 0; i < nr_range; i++) {
		error = pagemap_range(pgmap, &params, i, nid);
		if (error)
			break;
		pgmap->nr_range++;
	}

	if (i < nr_range) {
		memunmap_pages(pgmap);
		pgmap->nr_range = nr_range;
		return ERR_PTR(error);
	}
...
}

We still need to undo the sections already added in the failed range,
though ... memunmap_pages() won't touch those, since it only removes
completed ranges.

If the range starts at a section boundary, we'd hit -EEXIST in
fill_subsection_map() on retry while those subsection bits are still set.

The old DAX path had this issue too. Could we roll back [start_pfn, pfn)
in __add_pages() as a separate fix? Something like this:

---8<---

diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 796af1028ee2..16a0a2c885bc 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c

@@ -380,6 +380,7 @@ EXPORT_SYMBOL_GPL(pfn_to_online_page);

int __add_pages(int nid, unsigned long pfn, unsigned long nr_pages,
struct mhp_params *params)
{
+ 	const unsigned long start_pfn = pfn;
	const unsigned long end_pfn = pfn + nr_pages;
	unsigned long cur_nr_pages;
	int err;

@@ -417,6 +418,10 @@ int __add_pages(int nid, unsigned long pfn, unsigned long nr_pages,

			break;
		cond_resched();
}
+
+ 	/* Roll back the sections added before the failure. */
+ 	if (err && pfn != start_pfn)
+ 		__remove_pages(start_pfn, pfn - start_pfn, altmap, params->pgmap);
	vmemmap_populate_print_last();
	return err;
}
--

Hope I haven't missed anything :)