Re: [PATCH v3 6/6] drm/pagemap: Add fault injection for higher-order RAM folio allocation

[Matthew Brost <matthew.brost@intel.com>]

On Thu, Aug 20, 2026 at 03:58:16PM +0530, Ghimiray, Himal Prasad wrote:
> 
> 
> On 20-08-2026 12:33, Matthew Brost wrote:
> > On Sun, Aug 16, 2026 at 08:44:21PM +0530, Ghimiray, Himal Prasad wrote:
> > > 
> > > 
> > > On 06-08-2026 04:40, Matthew Brost wrote:
> > > > Migrating a device-private THP back to system memory has two distinct
> > > > paths in __migrate_device_pages(): the fast path where both source and
> > > > destination carry MIGRATE_PFN_COMPOUND, and the fallback path where the
> > > > destination could only be satisfied with order-0 folios and the source
> > > > THP therefore has to be split via migrate_vma_split_unmapped_folio().
> > > > 
> > > > The fallback path only triggers under genuine memory pressure, which
> > > > makes it both rare and awkward to reproduce, yet it is the path where
> > > > the interesting refcounting happens (the CPU fault holds an extra
> > > > reference on the device folio taken by do_huge_pmd_device_private()).
> > > > 
> > > > Add a fault_attr, modelled on backup_fault_inject in ttm_pool.c, that
> > > > forces the higher-order allocation in
> > > > drm_pagemap_migrate_populate_ram_pfn() to fail so the existing order-0
> > > > fallback is taken deterministically.
> > > > 
> > > > The attribute is exposed at /sys/kernel/debug/drm_pagemap_fault_inject
> > > > and requires CONFIG_FAULT_INJECTION_DEBUG_FS. With
> > > > CONFIG_FAULT_INJECTION disabled the helper compiles out to a constant
> > > > false and the injection has no cost.
> > > > 
> > > > Cc: Andrew Morton <akpm@linux-foundation.org>
> > > > Cc: David Hildenbrand <david@kernel.org>
> > > > Cc: Lorenzo Stoakes <ljs@kernel.org>
> > > > Cc: Zi Yan <ziy@nvidia.com>
> > > > Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
> > > > Cc: Liam R. Howlett <liam@infradead.org>
> > > > Cc: Nico Pache <nico.pache@linux.dev>
> > > > Cc: Ryan Roberts <ryan.roberts@arm.com>
> > > > Cc: Dev Jain <dev.jain@arm.com>
> > > > Cc: Barry Song <baohua@kernel.org>
> > > > Cc: Lance Yang <lance.yang@linux.dev>
> > > > Cc: Usama Arif <usama.arif@linux.dev>
> > > > Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
> > > > Cc: Rakie Kim <rakie.kim@sk.com>
> > > > Cc: Byungchul Park <byungchul@sk.com>
> > > > Cc: Gregory Price <gourry@gourry.net>
> > > > Cc: Ying Huang <ying.huang@linux.alibaba.com>
> > > > Cc: Alistair Popple <apopple@nvidia.com>
> > > > Cc: Balbir Singh <balbirs@nvidia.com>
> > > > Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> > > > Cc: Maxime Ripard <mripard@kernel.org>
> > > > Cc: Thomas Zimmermann <tzimmermann@suse.de>
> > > > Cc: David Airlie <airlied@gmail.com>
> > > > Cc: Simona Vetter <simona@ffwll.ch>
> > > > Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> > > > Cc: Francois Dugast <francois.dugast@intel.com>
> > > > Cc: dri-devel@lists.freedesktop.org
> > > > Cc: linux-mm@kvack.org
> > > > Cc: linux-kernel@vger.kernel.org
> > > > Assisted-by: GitHub_Copilot:claude-opus-5
> > > > Signed-off-by: Matthew Brost <matthew.brost@intel.com>
> > > > ---
> > > >    drivers/gpu/drm/drm_pagemap.c | 36 ++++++++++++++++++++++++++++++++++-
> > > >    1 file changed, 35 insertions(+), 1 deletion(-)
> > > > 
> > > > diff --git a/drivers/gpu/drm/drm_pagemap.c b/drivers/gpu/drm/drm_pagemap.c
> > > > index 51c6f12e4256..6ae8c9aa36cc 100644
> > > > --- a/drivers/gpu/drm/drm_pagemap.c
> > > > +++ b/drivers/gpu/drm/drm_pagemap.c
> > > > @@ -3,6 +3,7 @@
> > > >     * Copyright © 2024-2025 Intel Corporation
> > > >     */
> > > > +#include <linux/debugfs.h>
> > > >    #include <linux/dma-fence.h>
> > > >    #include <linux/dma-mapping.h>
> > > >    #include <linux/migrate.h>
> > > > @@ -12,6 +13,27 @@
> > > >    #include <drm/drm_pagemap_util.h>
> > > >    #include <drm/drm_print.h>
> > > > +#ifdef CONFIG_FAULT_INJECTION
> > > > +#include <linux/fault-inject.h>
> > > > +static DECLARE_FAULT_ATTR(migrate_to_ram_fault_inject);
> > > > +
> > > > +/*
> > > > + * Force a higher-order destination folio allocation to fail in
> > > > + * drm_pagemap_migrate_populate_ram_pfn(), exercising the order-0 fallback
> > > > + * (and, in turn, the THP split path in __migrate_device_pages()) without
> > > > + * having to drive the system into actual memory pressure.
> > > > + */
> > > > +static bool drm_pagemap_fault_inject_folio(void)
> > > > +{
> > > > +	return should_fail(&migrate_to_ram_fault_inject, 1);
> > > > +}
> > > > +#else
> > > > +static bool drm_pagemap_fault_inject_folio(void)
> > > > +{
> > > > +	return false;
> > > > +}
> > > > +#endif
> > > > +
> > > >    /**
> > > >     * DOC: Overview
> > > >     *
> > > > @@ -960,7 +982,9 @@ static int drm_pagemap_migrate_populate_ram_pfn(struct vm_area_struct *vas,
> > > >    		if (order)
> > > >    			gfp |= __GFP_NOWARN;
> > > > -		if (vas)
> > > > +		if (order && drm_pagemap_fault_inject_folio())
> > > > +			folio = NULL;
> > > > +		else if (vas)
> > > >    			folio = vma_alloc_folio(gfp, order, vas, addr);
> > > >    		else
> > > >    			folio = folio_alloc(gfp, order);
> > > > @@ -1554,6 +1578,16 @@ void drm_pagemap_destroy(struct drm_pagemap *dpagemap, bool is_atomic_or_reclaim
> > > >    		kfree(dpagemap);
> > > >    }
> > > > +static int __init drm_pagemap_module_init(void)
> > > > +{
> > > > +#if defined(CONFIG_DEBUG_FS) && defined(CONFIG_FAULT_INJECTION)
> > > > +	fault_create_debugfs_attr("drm_pagemap_fault_inject", NULL,
> > > > +				  &migrate_to_ram_fault_inject);
> > > > +#endif
> > > > +	return 0;
> > > > +}
> > > > +module_init(drm_pagemap_module_init);
> > > > +
> > > >    static void drm_pagemap_exit(void)
> > > >    {
> > > 
> > > Missed fault injection debugfs removal ?
> > > 
> > > Sashiko flags it and looks valid concern.
> > 
> > I checked on this and kernel wide no code seems to undo
> > fault_create_debugfs_attr on module unload, nor is there a function in
> > linux/fault-inject.h to undo all debugfs entries setup.
> 
> I believe the cleanup is done via standard debugfs_remove_recursive via
> passing the fault_create_debugfs_attr dir or parent. Here we have no parent
> so
> 
> dir = fault_create_debugfs_attr at init
> 
> and debugfs_remove_recursive(dir) should be sufficient during
> drm_pagemap_exit
> 
> I assume not cleaning it exit might leave the debugfs entries incase of
> module unload.

I think you are right here - realised this after typing this.

Will fix.

Matt

>  >
> > So IMO this is either everyone is kernel is doing this wrong or this is
> > a non-issue. debugfs_create_file kernel doc seems to indicate all
> > debugfs enteries should be removed with debugfs_remove though (?).
> > Either way I'd say this out of scope for this series.
> > 
> > Matt
> > 
> > > >    	flush_work(&drm_pagemap_work);
> > > 
>