[PATCH] drm/shmem-helper: Add huge page fault handler

[PATCH] drm/shmem-helper: Add huge page fault handler

[Loïc Molinari]

This gives the mm subsystem the ability to propose the insertion of a
PMD or PUD mapping for the faulting address.

If the virtual address provided from userspace with mmap() using the
address hint parameter is aligned to a huge page size, if the GEM
object is backed by a tmpfs mount point using Transparent Hugepage and
if the shmem backing store manages to allocate enough contiguous
physical pages to fit within a huge page, the CPU mapping will then
benefit from significantly increased memcpy() performance. For
instance, when these conditions are met on a system with 2 MiB huge
pages, a (fresh) aligned copy of 2 MiB would raise a single page fault
instead of 4096.

Signed-off-by: Loïc Molinari <loic.molinari@collabora.com>
---
 drivers/gpu/drm/drm_gem_shmem_helper.c | 51 ++++++++++++++++++++++++--
 1 file changed, 47 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c
index 50594cf8e17c..30aa0d72093b 100644
--- a/drivers/gpu/drm/drm_gem_shmem_helper.c
+++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
@@ -573,7 +573,8 @@ int drm_gem_shmem_dumb_create(struct drm_file *file, struct drm_device *dev,
 }
 EXPORT_SYMBOL_GPL(drm_gem_shmem_dumb_create);
 
-static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf)
+static vm_fault_t drm_gem_shmem_huge_fault(struct vm_fault *vmf,
+					   unsigned int order)
 {
 	struct vm_area_struct *vma = vmf->vma;
 	struct drm_gem_object *obj = vma->vm_private_data;
@@ -582,6 +583,7 @@ static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf)
 	vm_fault_t ret;
 	struct page *page;
 	pgoff_t page_offset;
+	unsigned long pfn, paddr;
 
 	/* We don't use vmf->pgoff since that has the fake offset */
 	page_offset = (vmf->address - vma->vm_start) >> PAGE_SHIFT;
@@ -592,17 +594,55 @@ static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf)
 	    drm_WARN_ON_ONCE(obj->dev, !shmem->pages) ||
 	    shmem->madv < 0) {
 		ret = VM_FAULT_SIGBUS;
-	} else {
-		page = shmem->pages[page_offset];
+		goto out;
+	}
+
+	page = shmem->pages[page_offset];
+	pfn = page_to_pfn(page);
+
+	switch (order) {
+	case 0:
+		ret = vmf_insert_pfn(vma, vmf->address, pfn);
+		break;
+
+#ifdef CONFIG_ARCH_SUPPORTS_PMD_PFNMAP
+	case PMD_ORDER:
+		paddr = pfn << PAGE_SHIFT;
+		if (((vmf->address & ~PMD_MASK) == (paddr & ~PMD_MASK)) &&
+		    (folio_order(page_folio(page)) == PMD_ORDER))
+			ret = vmf_insert_pfn_pmd(
+				    vmf, pfn & (PMD_MASK >> PAGE_SHIFT), false);
+		else
+			ret = VM_FAULT_FALLBACK;
+		break;
+#endif
+
+#ifdef CONFIG_ARCH_SUPPORTS_PUD_PFNMAP
+	case PUD_ORDER:
+		paddr = pfn << PAGE_SHIFT;
+		if (((vmf->address & ~PUD_MASK) == (paddr & ~PUD_MASK)) &&
+		    (folio_order(page_folio(page)) == PUD_ORDER))
+			ret = vmf_insert_pfn_pud(
+				    vmf, pfn & (PUD_MASK >> PAGE_SHIFT), false);
+		else
+			ret = VM_FAULT_FALLBACK;
+		break;
+#endif
 
-		ret = vmf_insert_pfn(vma, vmf->address, page_to_pfn(page));
+	default:
 	}
 
+ out:
 	dma_resv_unlock(shmem->base.resv);
 
 	return ret;
 }
 
+static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf)
+{
+	return drm_gem_shmem_huge_fault(vmf, 0);
+}
+
 static void drm_gem_shmem_vm_open(struct vm_area_struct *vma)
 {
 	struct drm_gem_object *obj = vma->vm_private_data;
@@ -639,6 +679,9 @@ static void drm_gem_shmem_vm_close(struct vm_area_struct *vma)
 
 const struct vm_operations_struct drm_gem_shmem_vm_ops = {
 	.fault = drm_gem_shmem_fault,
+#if defined(CONFIG_ARCH_SUPPORTS_PMD_PFNMAP) || defined(CONFIG_ARCH_SUPPORTS_PUD_PFNMAP)
+	.huge_fault = drm_gem_shmem_huge_fault,
+#endif
 	.open = drm_gem_shmem_vm_open,
 	.close = drm_gem_shmem_vm_close,
 };
-- 
2.47.3

Re: [PATCH] drm/shmem-helper: Add huge page fault handler

[kernel test robot]

Hi Loïc,

kernel test robot noticed the following build warnings:

[auto build test WARNING on drm-misc/drm-misc-next]
[also build test WARNING on drm/drm-next drm-exynos/exynos-drm-next drm-intel/for-linux-next drm-intel/for-linux-next-fixes drm-tip/drm-tip linus/master v6.17-rc7 next-20250923]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Lo-c-Molinari/drm-shmem-helper-Add-huge-page-fault-handler/20250923-175753
base:   git://anongit.freedesktop.org/drm/drm-misc drm-misc-next
patch link:    https://lore.kernel.org/r/20250923095634.50051-1-loic.molinari%40collabora.com
patch subject: [PATCH] drm/shmem-helper: Add huge page fault handler
config: i386-buildonly-randconfig-002-20250924 (https://download.01.org/0day-ci/archive/20250924/202509241315.8jjCyL7U-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250924/202509241315.8jjCyL7U-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202509241315.8jjCyL7U-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> drivers/gpu/drm/drm_gem_shmem_helper.c:595:2: warning: label at end of compound statement is a C23 extension [-Wc23-extensions]
     595 |         }
         |         ^
   drivers/gpu/drm/drm_gem_shmem_helper.c:548:21: warning: unused variable 'paddr' [-Wunused-variable]
     548 |         unsigned long pfn, paddr;
         |                            ^~~~~
>> drivers/gpu/drm/drm_gem_shmem_helper.c:594:2: warning: variable 'ret' is used uninitialized whenever switch default is taken [-Wsometimes-uninitialized]
     594 |         default:
         |         ^~~~~~~
   drivers/gpu/drm/drm_gem_shmem_helper.c:600:9: note: uninitialized use occurs here
     600 |         return ret;
         |                ^~~
   drivers/gpu/drm/drm_gem_shmem_helper.c:545:16: note: initialize the variable 'ret' to silence this warning
     545 |         vm_fault_t ret;
         |                       ^
         |                        = 0
   3 warnings generated.


vim +595 drivers/gpu/drm/drm_gem_shmem_helper.c

2194a63a818db71 Noralf Trønnes  2019-03-12  593  
16bf6748ef6aaf1 Loïc Molinari   2025-09-23 @594  	default:
d611b4a0907cece Neil Roberts    2021-02-23 @595  	}
d611b4a0907cece Neil Roberts    2021-02-23  596  
16bf6748ef6aaf1 Loïc Molinari   2025-09-23  597   out:
21aa27ddc582693 Dmitry Osipenko 2023-05-30  598  	dma_resv_unlock(shmem->base.resv);
d611b4a0907cece Neil Roberts    2021-02-23  599  
d611b4a0907cece Neil Roberts    2021-02-23  600  	return ret;
2194a63a818db71 Noralf Trønnes  2019-03-12  601  }
2194a63a818db71 Noralf Trønnes  2019-03-12  602  

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] drm/shmem-helper: Add huge page fault handler

[kernel test robot]

Hi Loïc,

kernel test robot noticed the following build errors:

[auto build test ERROR on drm-misc/drm-misc-next]
[also build test ERROR on drm/drm-next drm-exynos/exynos-drm-next drm-intel/for-linux-next drm-intel/for-linux-next-fixes drm-tip/drm-tip linus/master v6.17-rc7 next-20250923]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Lo-c-Molinari/drm-shmem-helper-Add-huge-page-fault-handler/20250923-175753
base:   git://anongit.freedesktop.org/drm/drm-misc drm-misc-next
patch link:    https://lore.kernel.org/r/20250923095634.50051-1-loic.molinari%40collabora.com
patch subject: [PATCH] drm/shmem-helper: Add huge page fault handler
config: alpha-randconfig-r073-20250924 (https://download.01.org/0day-ci/archive/20250924/202509241654.qJk1H5kr-lkp@intel.com/config)
compiler: alpha-linux-gcc (GCC) 8.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250924/202509241654.qJk1H5kr-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202509241654.qJk1H5kr-lkp@intel.com/

All errors (new ones prefixed by >>):

   drivers/gpu/drm/drm_gem_shmem_helper.c: In function 'drm_gem_shmem_huge_fault':
>> drivers/gpu/drm/drm_gem_shmem_helper.c:594:2: error: label at end of compound statement
     default:
     ^~~~~~~
   drivers/gpu/drm/drm_gem_shmem_helper.c:548:21: warning: unused variable 'paddr' [-Wunused-variable]
     unsigned long pfn, paddr;
                        ^~~~~


vim +594 drivers/gpu/drm/drm_gem_shmem_helper.c

   593	
 > 594		default:
   595		}
   596	
   597	 out:
   598		dma_resv_unlock(shmem->base.resv);
   599	
   600		return ret;
   601	}
   602	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] drm/shmem-helper: Add huge page fault handler

[kernel test robot]

Hi Loïc,

kernel test robot noticed the following build warnings:

[auto build test WARNING on drm-misc/drm-misc-next]
[also build test WARNING on drm/drm-next drm-exynos/exynos-drm-next drm-intel/for-linux-next drm-intel/for-linux-next-fixes drm-tip/drm-tip linus/master v6.17-rc7 next-20250923]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Lo-c-Molinari/drm-shmem-helper-Add-huge-page-fault-handler/20250923-175753
base:   git://anongit.freedesktop.org/drm/drm-misc drm-misc-next
patch link:    https://lore.kernel.org/r/20250923095634.50051-1-loic.molinari%40collabora.com
patch subject: [PATCH] drm/shmem-helper: Add huge page fault handler
config: arm64-randconfig-r111-20250924 (https://download.01.org/0day-ci/archive/20250924/202509241920.PtSEkfd4-lkp@intel.com/config)
compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project cafc064fc7a96b3979a023ddae1da2b499d6c954)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250924/202509241920.PtSEkfd4-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202509241920.PtSEkfd4-lkp@intel.com/

sparse warnings: (new ones prefixed by >>)
>> drivers/gpu/drm/drm_gem_shmem_helper.c:595:9: sparse: sparse: statement expected after case label

vim +595 drivers/gpu/drm/drm_gem_shmem_helper.c

2194a63a818db7 Noralf Trønnes  2019-03-12  593  
16bf6748ef6aaf Loïc Molinari   2025-09-23  594  	default:
d611b4a0907cec Neil Roberts    2021-02-23 @595  	}
d611b4a0907cec Neil Roberts    2021-02-23  596  
16bf6748ef6aaf Loïc Molinari   2025-09-23  597   out:
21aa27ddc58269 Dmitry Osipenko 2023-05-30  598  	dma_resv_unlock(shmem->base.resv);
d611b4a0907cec Neil Roberts    2021-02-23  599  
d611b4a0907cec Neil Roberts    2021-02-23  600  	return ret;
2194a63a818db7 Noralf Trønnes  2019-03-12  601  }
2194a63a818db7 Noralf Trønnes  2019-03-12  602  

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] drm/shmem-helper: Add huge page fault handler

[Boris Brezillon]

On Tue, 23 Sep 2025 11:56:34 +0200
Loïc Molinari <loic.molinari@collabora.com> wrote:

> This gives the mm subsystem the ability to propose the insertion of a
> PMD or PUD mapping for the faulting address.
> 
> If the virtual address provided from userspace with mmap() using the
> address hint parameter is aligned to a huge page size, if the GEM
> object is backed by a tmpfs mount point using Transparent Hugepage and
> if the shmem backing store manages to allocate enough contiguous
> physical pages to fit within a huge page, the CPU mapping will then
> benefit from significantly increased memcpy() performance. For
> instance, when these conditions are met on a system with 2 MiB huge
> pages, a (fresh) aligned copy of 2 MiB would raise a single page fault
> instead of 4096.
> 
> Signed-off-by: Loïc Molinari <loic.molinari@collabora.com>
> ---
>  drivers/gpu/drm/drm_gem_shmem_helper.c | 51 ++++++++++++++++++++++++--
>  1 file changed, 47 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c
> index 50594cf8e17c..30aa0d72093b 100644
> --- a/drivers/gpu/drm/drm_gem_shmem_helper.c
> +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
> @@ -573,7 +573,8 @@ int drm_gem_shmem_dumb_create(struct drm_file *file, struct drm_device *dev,
>  }
>  EXPORT_SYMBOL_GPL(drm_gem_shmem_dumb_create);
>  
> -static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf)
> +static vm_fault_t drm_gem_shmem_huge_fault(struct vm_fault *vmf,
> +					   unsigned int order)
>  {
>  	struct vm_area_struct *vma = vmf->vma;
>  	struct drm_gem_object *obj = vma->vm_private_data;
> @@ -582,6 +583,7 @@ static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf)
>  	vm_fault_t ret;
>  	struct page *page;
>  	pgoff_t page_offset;
> +	unsigned long pfn, paddr;
>  
>  	/* We don't use vmf->pgoff since that has the fake offset */
>  	page_offset = (vmf->address - vma->vm_start) >> PAGE_SHIFT;
> @@ -592,17 +594,55 @@ static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf)
>  	    drm_WARN_ON_ONCE(obj->dev, !shmem->pages) ||
>  	    shmem->madv < 0) {
>  		ret = VM_FAULT_SIGBUS;
> -	} else {
> -		page = shmem->pages[page_offset];
> +		goto out;
> +	}
> +
> +	page = shmem->pages[page_offset];
> +	pfn = page_to_pfn(page);
> +
> +	switch (order) {
> +	case 0:
> +		ret = vmf_insert_pfn(vma, vmf->address, pfn);
> +		break;
> +
> +#ifdef CONFIG_ARCH_SUPPORTS_PMD_PFNMAP
> +	case PMD_ORDER:
> +		paddr = pfn << PAGE_SHIFT;
> +		if (((vmf->address & ~PMD_MASK) == (paddr & ~PMD_MASK)) &&
> +		    (folio_order(page_folio(page)) == PMD_ORDER))
> +			ret = vmf_insert_pfn_pmd(
> +				    vmf, pfn & (PMD_MASK >> PAGE_SHIFT), false);
> +		else
> +			ret = VM_FAULT_FALLBACK;
> +		break;
> +#endif
> +
> +#ifdef CONFIG_ARCH_SUPPORTS_PUD_PFNMAP
> +	case PUD_ORDER:
> +		paddr = pfn << PAGE_SHIFT;
> +		if (((vmf->address & ~PUD_MASK) == (paddr & ~PUD_MASK)) &&
> +		    (folio_order(page_folio(page)) == PUD_ORDER))
> +			ret = vmf_insert_pfn_pud(
> +				    vmf, pfn & (PUD_MASK >> PAGE_SHIFT), false);
> +		else
> +			ret = VM_FAULT_FALLBACK;
> +		break;
> +#endif
>  
> -		ret = vmf_insert_pfn(vma, vmf->address, page_to_pfn(page));
> +	default:

Not sure about the error, but we should have something like

		ret = VM_FAULT_FALLBACK;
		break;

because otherwise ret is uninitialized. We probably want a WARN_ON()
too, because this function is not supposed to be called with a
non-PTE/PUD/PMD order.

The rest looks good to me, so once this is addressed, you can add

Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>

>  	}
>  
> + out:
>  	dma_resv_unlock(shmem->base.resv);
>  
>  	return ret;
>  }
>  
> +static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf)
> +{
> +	return drm_gem_shmem_huge_fault(vmf, 0);
> +}
> +
>  static void drm_gem_shmem_vm_open(struct vm_area_struct *vma)
>  {
>  	struct drm_gem_object *obj = vma->vm_private_data;
> @@ -639,6 +679,9 @@ static void drm_gem_shmem_vm_close(struct vm_area_struct *vma)
>  
>  const struct vm_operations_struct drm_gem_shmem_vm_ops = {
>  	.fault = drm_gem_shmem_fault,
> +#if defined(CONFIG_ARCH_SUPPORTS_PMD_PFNMAP) || defined(CONFIG_ARCH_SUPPORTS_PUD_PFNMAP)
> +	.huge_fault = drm_gem_shmem_huge_fault,
> +#endif
>  	.open = drm_gem_shmem_vm_open,
>  	.close = drm_gem_shmem_vm_close,
>  };