From: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
To: Muchun Song <songmuchun@bytedance.com>,
Dan Williams <djbw@kernel.org>,
Vishal Verma <vishal.l.verma@intel.com>,
Dave Jiang <dave.jiang@intel.com>,
Alison Schofield <alison.schofield@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
Joao Martins <joao.m.martins@oracle.com>,
Pavithra Prakash <pavrampu@linux.ibm.com>,
Muchun Song <muchun.song@linux.dev>,
stable@vger.kernel.org, nvdimm@lists.linux.dev,
linux-cxl@vger.kernel.org, linux-kernel@vger.kernel.org,
Muchun Song <songmuchun@bytedance.com>,
linuxppc-dev@lists.ozlabs.org
Subject: Re: [PATCH v2] dax/pmem: fix unaligned compound devmap initialization
Date: Mon, 09 Nov 2026 07:27:12 +0530 [thread overview]
Message-ID: <cxseojgn.ritesh.list@gmail.com> (raw)
In-Reply-To: <20261107030126.90894-1-songmuchun@bytedance.com>
Muchun Song <songmuchun@bytedance.com> writes:
> Static pmem Device DAX namespaces reserve space for namespace metadata
> before the user-visible data range, and may also include padding needed
> to satisfy the Device DAX alignment. __dax_pmem_probe() adjusts the
> dax_region range to start at the data range, but the dev_pagemap range
> still starts at the beginning of the namespace.
>
> That is not valid for compound devmap mappings whose memmap is stored in
> system RAM. Compound page initialization requires the start PFN to be
> naturally aligned to the compound page size, because the head and tail
> struct pages are initialized according to that geometry. If the pgmap
> starts before the aligned data range, memmap_init_zone_device() can build
> compound page metadata from an unaligned PFN.
>
> The resulting struct page layout is inconsistent with the Device DAX
> mapping. A later mmap fault can then resolve the user-visible PFN through
> invalid compound page metadata and hit a kernel panic while inserting the
> DAX folio.
>
> Fix this by rounding the pgmap start up to the Device DAX alignment for
> non-altmap mappings. This gives compound mappings the required naturally
> aligned start while retaining full-section vmemmap savings when the
> original start is already aligned. The altmap path remains unchanged
> because memmap_init_zone_device() skips the altmap reservation itself.
>
> Fixes: 14606001efb4 ("device-dax: compound devmap support")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Muchun Song <songmuchun@bytedance.com>
> Reported-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
> Closes: https://lore.kernel.org/r/wlrkqqvg.ritesh.list@gmail.com
Tested v2 also on my Power dev test setup. With this patch the reported
problem is fixed. I am no more hitting the following warning and crash:
[ 3.071811][ T1] WARNING: mm/mm_init.c:1175 at memmap_init_zone_device+0x144/0x470, CPU#0: swapper/0/1
[ 3.082276][ T1] NIP [c000000000596604] memmap_init_zone_device+0x144/0x470
[ 3.082763][ T1] LR [c0000000006d72b8] memremap_pages+0x3b0/0x974
[ 3.083345][ T1] Call Trace:
[ 3.083629][ T1] [c000000006d86e00] [c000000006d86e40] 0xc000000006d86e40 (unreliable)
[ 3.084975][ T1] [c000000006d86f10] [c0000000006d72b8] memremap_pages+0x3b0/0x974
[ 3.085449][ T1] [c000000006d86fe0] [c0000000006d78b8] devm_memremap_pages+0x3c/0xa4
[ 3.085891][ T1] [c000000006d87020] [c00000000125c084] dev_dax_probe+0x264/0x3d0
[ 3.086339][ T1] [c000000006d870c0] [c000000001259a28] dax_bus_probe+0x140/0x1c8
[ 3.086778][ T1] [c000000006d87110] [c0000000011ce640] really_probe+0x108/0x580
[ 3.087218][ T1] [c000000006d871a0] [c0000000011ceb84] __driver_probe_device+0xcc/0x284
[ 3.087668][ T1] [c000000006d87230] [c0000000011ceea0] driver_probe_device+0x5c/0x10c
[ 3.088123][ T1] [c000000006d87270] [c0000000011cf05c] __device_attach_driver+0x10c/0x1e8
[ 3.088582][ T1] [c000000006d872f0] [c0000000011cab70] bus_for_each_drv+0xc0/0x13c
[ 3.089035][ T1] [c000000006d87350] [c0000000011cf65c] __device_attach+0xdc/0x2b0
[ 3.089467][ T1] [c000000006d873f0] [c0000000011cfaac] device_initial_probe+0x80/0x98
[ 3.089910][ T1] [c000000006d87420] [c0000000011cac44] __bus_probe_device+0x58/0xf4
[ 3.090358][ T1] [c000000006d87470] [c0000000011c8030] device_add+0x850/0xa78
[ 3.090778][ T1] [c000000006d87530] [c00000000125b040] __devm_create_dev_dax+0x1c0/0x638
[ 3.091236][ T1] [c000000006d875d0] [c00000000125b6c8] devm_create_dev_dax+0x44/0x7c
[ 3.091676][ T1] [c000000006d87600] [c00000000125dbe8] __dax_pmem_probe+0x238/0x27c
[ 3.092120][ T1] [c000000006d87770] [c00000000125dc4c] dax_pmem_probe+0x20/0x44
[ 3.092542][ T1] [c000000006d87790] [c000000001237a14] nvdimm_bus_probe+0xcc/0x370
[ 3.093097][ T1] [c000000006d87830] [c0000000011ce640] really_probe+0x108/0x580
[ 3.093610][ T1] [c000000006d878c0] [c0000000011ceb84] __driver_probe_device+0xcc/0x284
<...>
[ 3.099405][ T1] ---- interrupt: 0 at 0x0
[ 3.099837][ T1] Code: 7c0802a6 fa8100b0 faa100b8 fb8100f0 7d574030 7d4a4030 f8010120 fbe10108 3917ffff 7d294038 3109ffff 7d284910 <0b090000> 3d2201c5 7bb53664 7ed607b4
[ 3.101209][ T1] ---[ end trace 0000000000000000 ]---
[ 3.104702][ T1] BUG: Unable to handle kernel data access on write at 0xc00c000000210000
[ 3.105209][ T1] Faulting instruction address: 0xc000000000596394
cpu 0x0: Vector: 300 (Data Access) at [c000000006d86aa0]
lr: c0000000005962c4: memmap_init_compound+0xac/0x2a8
sp: c000000006d86d40
msr: 8000000002009033
dar: c00c000000210000
dsisr: a000000
current = 0xc000000006d33e00
paca = 0xc000000005010000 irqmask: 0x03 irq_happened: 0x01
pid = 1, comm = swapper/0
Linux version 7.3.0-17056-gc0944ee4a2c4 (powerpc64le-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #111 SMP PREEMPT Mon Nov 9 07:25:29 IST 2026
enter ? for help
[c000000006d86e00] c0000000005968f8 memmap_init_zone_device+0x438/0x470
[c000000006d86f10] c0000000006d72b8 memremap_pages+0x3b0/0x974
[c000000006d86fe0] c0000000006d78b8 devm_memremap_pages+0x3c/0xa4
[c000000006d87020] c00000000125c084 dev_dax_probe+0x264/0x3d0
[c000000006d870c0] c000000001259a28 dax_bus_probe+0x140/0x1c8
[c000000006d87110] c0000000011ce640 really_probe+0x108/0x580
[c000000006d871a0] c0000000011ceb84 __driver_probe_device+0xcc/0x284
[c000000006d87230] c0000000011ceea0 driver_probe_device+0x5c/0x10c
[c000000006d87270] c0000000011cf05c __device_attach_driver+0x10c/0x1e8
[c000000006d872f0] c0000000011cab70 bus_for_each_drv+0xc0/0x13c
[c000000006d87350] c0000000011cf65c __device_attach+0xdc/0x2b0
[c000000006d873f0] c0000000011cfaac device_initial_probe+0x80/0x98
[c000000006d87420] c0000000011cac44 __bus_probe_device+0x58/0xf4
[c000000006d87470] c0000000011c8030 device_add+0x850/0xa78
[c000000006d87530] c00000000125b040 __devm_create_dev_dax+0x1c0/0x638
[c000000006d875d0] c00000000125b6c8 devm_create_dev_dax+0x44/0x7c
[c000000006d87600] c00000000125dbe8 __dax_pmem_probe+0x238/0x27c
[c000000006d87770] c00000000125dc4c dax_pmem_probe+0x20/0x44
[c000000006d87790] c000000001237a14 nvdimm_bus_probe+0xcc/0x370
[c000000006d87830] c0000000011ce640 really_probe+0x108/0x580
<...>
Feel free to add:
Tested-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
next prev parent reply other threads:[~2026-11-09 2:03 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-07 3:01 [PATCH v2] dax/pmem: fix unaligned compound devmap initialization Muchun Song
2026-11-09 1:57 ` Ritesh Harjani [this message]
2026-11-09 2:34 ` Muchun Song
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cxseojgn.ritesh.list@gmail.com \
--to=ritesh.list@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=alison.schofield@intel.com \
--cc=dave.jiang@intel.com \
--cc=djbw@kernel.org \
--cc=joao.m.martins@oracle.com \
--cc=linux-cxl@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=muchun.song@linux.dev \
--cc=nvdimm@lists.linux.dev \
--cc=pavrampu@linux.ibm.com \
--cc=songmuchun@bytedance.com \
--cc=stable@vger.kernel.org \
--cc=vishal.l.verma@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.