Re: [PATCH v3 6/6] drm/pagemap: Add fault injection for higher-order RAM folio allocation

[Matthew Brost <matthew.brost@intel.com>]

On Sun, Aug 16, 2026 at 08:44:21PM +0530, Ghimiray, Himal Prasad wrote:
> 
> 
> On 06-08-2026 04:40, Matthew Brost wrote:
> > Migrating a device-private THP back to system memory has two distinct
> > paths in __migrate_device_pages(): the fast path where both source and
> > destination carry MIGRATE_PFN_COMPOUND, and the fallback path where the
> > destination could only be satisfied with order-0 folios and the source
> > THP therefore has to be split via migrate_vma_split_unmapped_folio().
> > 
> > The fallback path only triggers under genuine memory pressure, which
> > makes it both rare and awkward to reproduce, yet it is the path where
> > the interesting refcounting happens (the CPU fault holds an extra
> > reference on the device folio taken by do_huge_pmd_device_private()).
> > 
> > Add a fault_attr, modelled on backup_fault_inject in ttm_pool.c, that
> > forces the higher-order allocation in
> > drm_pagemap_migrate_populate_ram_pfn() to fail so the existing order-0
> > fallback is taken deterministically.
> > 
> > The attribute is exposed at /sys/kernel/debug/drm_pagemap_fault_inject
> > and requires CONFIG_FAULT_INJECTION_DEBUG_FS. With
> > CONFIG_FAULT_INJECTION disabled the helper compiles out to a constant
> > false and the injection has no cost.
> > 
> > Cc: Andrew Morton <akpm@linux-foundation.org>
> > Cc: David Hildenbrand <david@kernel.org>
> > Cc: Lorenzo Stoakes <ljs@kernel.org>
> > Cc: Zi Yan <ziy@nvidia.com>
> > Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
> > Cc: Liam R. Howlett <liam@infradead.org>
> > Cc: Nico Pache <nico.pache@linux.dev>
> > Cc: Ryan Roberts <ryan.roberts@arm.com>
> > Cc: Dev Jain <dev.jain@arm.com>
> > Cc: Barry Song <baohua@kernel.org>
> > Cc: Lance Yang <lance.yang@linux.dev>
> > Cc: Usama Arif <usama.arif@linux.dev>
> > Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
> > Cc: Rakie Kim <rakie.kim@sk.com>
> > Cc: Byungchul Park <byungchul@sk.com>
> > Cc: Gregory Price <gourry@gourry.net>
> > Cc: Ying Huang <ying.huang@linux.alibaba.com>
> > Cc: Alistair Popple <apopple@nvidia.com>
> > Cc: Balbir Singh <balbirs@nvidia.com>
> > Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> > Cc: Maxime Ripard <mripard@kernel.org>
> > Cc: Thomas Zimmermann <tzimmermann@suse.de>
> > Cc: David Airlie <airlied@gmail.com>
> > Cc: Simona Vetter <simona@ffwll.ch>
> > Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> > Cc: Francois Dugast <francois.dugast@intel.com>
> > Cc: dri-devel@lists.freedesktop.org
> > Cc: linux-mm@kvack.org
> > Cc: linux-kernel@vger.kernel.org
> > Assisted-by: GitHub_Copilot:claude-opus-5
> > Signed-off-by: Matthew Brost <matthew.brost@intel.com>
> > ---
> >   drivers/gpu/drm/drm_pagemap.c | 36 ++++++++++++++++++++++++++++++++++-
> >   1 file changed, 35 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/gpu/drm/drm_pagemap.c b/drivers/gpu/drm/drm_pagemap.c
> > index 51c6f12e4256..6ae8c9aa36cc 100644
> > --- a/drivers/gpu/drm/drm_pagemap.c
> > +++ b/drivers/gpu/drm/drm_pagemap.c
> > @@ -3,6 +3,7 @@
> >    * Copyright © 2024-2025 Intel Corporation
> >    */
> > +#include <linux/debugfs.h>
> >   #include <linux/dma-fence.h>
> >   #include <linux/dma-mapping.h>
> >   #include <linux/migrate.h>
> > @@ -12,6 +13,27 @@
> >   #include <drm/drm_pagemap_util.h>
> >   #include <drm/drm_print.h>
> > +#ifdef CONFIG_FAULT_INJECTION
> > +#include <linux/fault-inject.h>
> > +static DECLARE_FAULT_ATTR(migrate_to_ram_fault_inject);
> > +
> > +/*
> > + * Force a higher-order destination folio allocation to fail in
> > + * drm_pagemap_migrate_populate_ram_pfn(), exercising the order-0 fallback
> > + * (and, in turn, the THP split path in __migrate_device_pages()) without
> > + * having to drive the system into actual memory pressure.
> > + */
> > +static bool drm_pagemap_fault_inject_folio(void)
> > +{
> > +	return should_fail(&migrate_to_ram_fault_inject, 1);
> > +}
> > +#else
> > +static bool drm_pagemap_fault_inject_folio(void)
> > +{
> > +	return false;
> > +}
> > +#endif
> > +
> >   /**
> >    * DOC: Overview
> >    *
> > @@ -960,7 +982,9 @@ static int drm_pagemap_migrate_populate_ram_pfn(struct vm_area_struct *vas,
> >   		if (order)
> >   			gfp |= __GFP_NOWARN;
> > -		if (vas)
> > +		if (order && drm_pagemap_fault_inject_folio())
> > +			folio = NULL;
> > +		else if (vas)
> >   			folio = vma_alloc_folio(gfp, order, vas, addr);
> >   		else
> >   			folio = folio_alloc(gfp, order);
> > @@ -1554,6 +1578,16 @@ void drm_pagemap_destroy(struct drm_pagemap *dpagemap, bool is_atomic_or_reclaim
> >   		kfree(dpagemap);
> >   }
> > +static int __init drm_pagemap_module_init(void)
> > +{
> > +#if defined(CONFIG_DEBUG_FS) && defined(CONFIG_FAULT_INJECTION)
> > +	fault_create_debugfs_attr("drm_pagemap_fault_inject", NULL,
> > +				  &migrate_to_ram_fault_inject);
> > +#endif
> > +	return 0;
> > +}
> > +module_init(drm_pagemap_module_init);
> > +
> >   static void drm_pagemap_exit(void)
> >   {
> 
> Missed fault injection debugfs removal ?
> 
> Sashiko flags it and looks valid concern.

I checked on this and kernel wide no code seems to undo
fault_create_debugfs_attr on module unload, nor is there a function in
linux/fault-inject.h to undo all debugfs entries setup.

So IMO this is either everyone is kernel is doing this wrong or this is
a non-issue. debugfs_create_file kernel doc seems to indicate all
debugfs enteries should be removed with debugfs_remove though (?).
Either way I'd say this out of scope for this series.

Matt

> >   	flush_work(&drm_pagemap_work);
>