On Thu, Jan 27, 2022 at 08:40:51PM +0800, Shiyang Ruan wrote: > +static int mf_generic_kill_procs(unsigned long long pfn, int flags, > + struct dev_pagemap *pgmap) > +{ > + struct page *page = pfn_to_page(pfn); > + LIST_HEAD(to_kill); > + dax_entry_t cookie; > + > + /* > + * Prevent the inode from being freed while we are interrogating > + * the address_space, typically this would be handled by > + * lock_page(), but dax pages do not use the page lock. This > + * also prevents changes to the mapping of this pfn until > + * poison signaling is complete. > + */ > + cookie = dax_lock_page(page); > + if (!cookie) > + return -EBUSY; > + > + if (hwpoison_filter(page)) > + return 0; > + > + if (pgmap->type == MEMORY_DEVICE_PRIVATE) { > + /* > + * TODO: Handle HMM pages which may need coordination > + * with device-side memory. > + */ > + return -EBUSY; > + } > + > + /* > + * Use this flag as an indication that the dax page has been > + * remapped UC to prevent speculative consumption of poison. > + */ > + SetPageHWPoison(page); > + > + /* > + * Unlike System-RAM there is no possibility to swap in a > + * different physical page at a given virtual address, so all > + * userspace consumption of ZONE_DEVICE memory necessitates > + * SIGBUS (i.e. MF_MUST_KILL) > + */ > + flags |= MF_ACTION_REQUIRED | MF_MUST_KILL; > + collect_procs(page, &to_kill, true); > + > + unmap_and_kill(&to_kill, pfn, page->mapping, page->index, flags); > + dax_unlock_page(page, cookie); > + return 0; > +} There's an assumption here that fsdax only has order-0 pages. pfn_to_page() is going to return the precise page for that pfn, but then page->mapping and page->index are not valid for tail pages. I'm currently trying to folio-ise memory-failure.c, and it is not going well! There are several places where it's hard to tell what should happen.