Where do ttm->pages come from?

[Matthew Wilcox]

We're close to removing page->mapping from the kernel, and I've run into
amdgpu's use of page->mapping (setting it to ->dev_mapping and comparing
it against ->dev_mapping).

What I need to understand to know how to fix this properly is who
allocates these pages for what purpose?  I've got this far:

amdgpu_ttm_tt_set_user_pages() populates ttm->pages.
That's called from amdgpu_cs_parser_bos() which got e->userpages from
amdgpu_ttm_tt_get_user_pages().
amdgpu_ttm_tt_get_user_pages() got them from
amdgpu_hmm_range_get_pages()
amdgpu_hmm_range_get_pages() gets them from calling hmm_pfn_to_page()
which ... could get pages from anywhere?

But cleaarly they can't be _any_ pages because if they were anon or
file pages, overwriting page->mapping would blow up horribly today.
So they must be driver pages, but I can't see where they're allocated.
Is it ttm_pool_alloc_page()?