On Wed, Mar 11, 2020 at 06:28:30PM -0700, Ralph Campbell wrote:

...

mm/hmm.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/mm/hmm.c b/mm/hmm.c index 72e5a6d9a41756..35f85424176d14 100644 +++ b/mm/hmm.c @@ -325,6 +325,7 @@ static int hmm_vma_handle_pte(struct mm_walk *walk, unsigned long addr, } /* Report error for everything else */

• pte_unmap(ptep);
  

  *pfn = range->values[HMM_PFN_ERROR]; return -EFAULT; } else {

@@ -339,10 +340,13 @@ static int hmm_vma_handle_pte(struct mm_walk *walk, unsigned long addr, if (pte_devmap(pte)) { hmm_vma_walk->pgmap = get_dev_pagemap(pte_pfn(pte), hmm_vma_walk->pgmap);

• if (unlikely(!hmm_vma_walk->pgmap))
  

• if (unlikely(!hmm_vma_walk->pgmap)) {
  

• 	pte_unmap(ptep);
  return -EBUSY;
  

• }
  

  } else if (IS_ENABLED(CONFIG_ARCH_HAS_PTE_SPECIAL) && pte_special(pte)) { if (!is_zero_pfn(pte_pfn(pte))) {

• 	pte_unmap(ptep);
  *pfn = range->values[HMM_PFN_SPECIAL];
  return -EFAULT;
  

  }

@@ -437,7 +441,7 @@ static int hmm_vma_walk_pmd(pmd_t *pmdp, r = hmm_vma_handle_pte(walk, addr, end, pmdp, ptep, &pfns[i]); if (r) {

• 	/* hmm_vma_handle_pte() did unmap pte directory */
  

• 	/* hmm_vma_handle_pte() did pte_unmap() */
  hmm_vma_walk->last = addr;
  return r;
  

  }

I think there is a case where hmm_vma_handle_pte() is called, a fault is requested, pte_unmap() and hmm_vma_walk_hole_() are called, the latter returns zero (the fault was handled OK)

Not quite, hmm_vma_walk_hole_() never returns 0 if called with fault:

return (fault || write_fault) ? -EBUSY : 0;

And all the call sites of hmm_vma_walk_hole_() in hmm_vma_handle_pte() are structured as:

if (fault || write_fault) goto fault; fault: return hmm_vma_walk_hole_(addr, end, fault, write_fault, walk);

So, it never returns 0.

I already made a patch making this less twisty while fixing something else:

https://github.com/jgunthorpe/linux/commit/078e10ca5919f2c263c245784fb5fe63d...

Thanks, Jason

On 3/11/20 11:35 AM, Jason Gunthorpe wrote:

From: Jason Gunthorpe jgg@mellanox.com

The pgmap is held in the hmm_vma_walk variable in hope of speeding up future get_dev_pagemap() calls by hitting the same pointer. The algorithm doesn't actually care about how long the pgmap is held for.

Move the put of the cached pgmap to after the walk is completed and delete all the other now redundant puts.

This solves a possible leak of the reference in hmm_vma_walk_pmd() if a hmm_vma_handle_pte() fails while looping.

Fixes: 992de9a8b751 ("mm/hmm: allow to mirror vma of a file on a DAX backed filesystem") Signed-off-by: Jason Gunthorpe jgg@mellanox.com

Reviewed-by: Ralph Campbell rcampbell@nvidia.com

---

mm/hmm.c | 31 +++++++++---------------------- 1 file changed, 9 insertions(+), 22 deletions(-)

We talked about just deleting this stuff, but I think it makes alot sense for hmm_range_fault() to trigger fault on devmap pages that are not compatible with the caller - so lets just fix the leak on error path for now.

diff --git a/mm/hmm.c b/mm/hmm.c index 35f85424176d14..9e8f68eb83287a 100644 --- a/mm/hmm.c +++ b/mm/hmm.c @@ -239,10 +239,6 @@ static int hmm_vma_handle_pmd(struct mm_walk *walk, unsigned long addr, } pfns[i] = hmm_device_entry_from_pfn(range, pfn) | cpu_flags; }

• if (hmm_vma_walk->pgmap) {

• put_dev_pagemap(hmm_vma_walk->pgmap);
  

• hmm_vma_walk->pgmap = NULL;
  

• } hmm_vma_walk->last = end; return 0; }

@@ -360,10 +356,6 @@ static int hmm_vma_handle_pte(struct mm_walk *walk, unsigned long addr, return 0;

fault:

• if (hmm_vma_walk->pgmap) {

• put_dev_pagemap(hmm_vma_walk->pgmap);
  

• hmm_vma_walk->pgmap = NULL;
  

• } pte_unmap(ptep); /* Fault any virtual address we were asked to fault */ return hmm_vma_walk_hole_(addr, end, fault, write_fault, walk);

@@ -446,16 +438,6 @@ static int hmm_vma_walk_pmd(pmd_t *pmdp, return r; } }

• if (hmm_vma_walk->pgmap) {

• /*
  

•  * We do put_dev_pagemap() here and not in hmm_vma_handle_pte()
  

•  * so that we can leverage get_dev_pagemap() optimization which
  

•  * will not re-take a reference on a pgmap if we already have
  

•  * one.
  

•  */
  

• put_dev_pagemap(hmm_vma_walk->pgmap);
  

• hmm_vma_walk->pgmap = NULL;
  

• } pte_unmap(ptep - 1);

  hmm_vma_walk->last = addr;

@@ -529,10 +511,6 @@ static int hmm_vma_walk_pud(pud_t *pudp, unsigned long start, unsigned long end, pfns[i] = hmm_device_entry_from_pfn(range, pfn) | cpu_flags; }

• if (hmm_vma_walk->pgmap) {
  

• 	put_dev_pagemap(hmm_vma_walk->pgmap);
  

• 	hmm_vma_walk->pgmap = NULL;
  

• }
  

  hmm_vma_walk->last = end; goto out_unlock; }

@@ -694,6 +672,15 @@ long hmm_range_fault(struct hmm_range *range, unsigned int flags) return -EBUSY; ret = walk_page_range(mm, hmm_vma_walk.last, range->end, &hmm_walk_ops, &hmm_vma_walk);

• /*
  

•  * A pgmap is kept cached in the hmm_vma_walk to avoid expensive
  

•  * searching in the probably common case that the pgmap is the
  

•  * same for the entire requested range.
  

•  */
  

• if (hmm_vma_walk.pgmap) {
  

• 	put_dev_pagemap(hmm_vma_walk.pgmap);
  

• 	hmm_vma_walk.pgmap = NULL;
  

• }
  

  } while (ret == -EBUSY);

  if (ret)

On 3/11/20 11:35 AM, Jason Gunthorpe wrote:

From: Jason Gunthorpe jgg@mellanox.com

This eventually calls into handle_mm_fault() which is a sleeping function. Release the lock first.

hmm_vma_walk_hole() does not touch the contents of the PUD, so it does not need the lock.

Fixes: 3afc423632a1 ("mm: pagewalk: add p4d_entry() and pgd_entry()") Cc: Steven Price steven.price@arm.com Signed-off-by: Jason Gunthorpe jgg@mellanox.com

Reviewed-by: Ralph Campbell rcampbell@nvidia.com

---

mm/hmm.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/mm/hmm.c b/mm/hmm.c index 9e8f68eb83287a..32dcbfd3908315 100644 --- a/mm/hmm.c +++ b/mm/hmm.c @@ -473,8 +473,8 @@ static int hmm_vma_walk_pud(pud_t *pudp, unsigned long start, unsigned long end,

pud = READ_ONCE(*pudp); if (pud_none(pud)) {

• ret = hmm_vma_walk_hole(start, end, -1, walk);
  

• goto out_unlock;
  

• spin_unlock(ptl);
  

• return hmm_vma_walk_hole(start, end, -1, walk);
  

  }

  if (pud_huge(pud) && pud_devmap(pud)) {

@@ -483,8 +483,8 @@ static int hmm_vma_walk_pud(pud_t *pudp, unsigned long start, unsigned long end, bool fault, write_fault;

if (!pud_present(pud)) {

• 	ret = hmm_vma_walk_hole(start, end, -1, walk);
  

• 	goto out_unlock;
  

• 	spin_unlock(ptl);
  

• 	return hmm_vma_walk_hole(start, end, -1, walk);
  

  }

  i = (addr - range->start) >> PAGE_SHIFT;

@@ -495,9 +495,9 @@ static int hmm_vma_walk_pud(pud_t *pudp, unsigned long start, unsigned long end, hmm_range_need_fault(hmm_vma_walk, pfns, npages, cpu_flags, &fault, &write_fault); if (fault || write_fault) {

• 	ret = hmm_vma_walk_hole_(addr, end, fault,
  

• 				 write_fault, walk);
  

• 	goto out_unlock;
  

• 	spin_unlock(ptl);
  

• 	return hmm_vma_walk_hole_(addr, end, fault, write_fault,
  

• 				  walk);
  

  }

  pfn = pud_pfn(pud) + ((addr & ~PUD_MASK) >> PAGE_SHIFT);

By refactoring to deal with the !pud_huge(pud) || !pud_devmap(pud) condition early it's possible to remove the 'ret' variable and remove a level of indentation from half the function making the code easier to read.

No functional change.

Signed-off-by: Steven Price steven.price@arm.com --- Thanks to Jason's changes there were only two code paths left using the out_unlock label so it seemed like a good opportunity to refactor. --- mm/hmm.c | 69 ++++++++++++++++++++++++++------------------------------ 1 file changed, 32 insertions(+), 37 deletions(-)

diff --git a/mm/hmm.c b/mm/hmm.c index ca33d086bdc1..0117c86426d1 100644 --- a/mm/hmm.c +++ b/mm/hmm.c @@ -466,8 +466,10 @@ static int hmm_vma_walk_pud(pud_t *pudp, unsigned long start, unsigned long end, struct hmm_range *range = hmm_vma_walk->range; unsigned long addr = start; pud_t pud; - int ret = 0; spinlock_t *ptl = pud_trans_huge_lock(pudp, walk->vma); + unsigned long i, npages, pfn; + uint64_t *pfns, cpu_flags; + bool fault, write_fault;

if (!ptl) return 0; @@ -481,50 +483,43 @@ static int hmm_vma_walk_pud(pud_t *pudp, unsigned long start, unsigned long end, return hmm_vma_walk_hole(start, end, -1, walk); }

- if (pud_huge(pud) && pud_devmap(pud)) { - unsigned long i, npages, pfn; - uint64_t *pfns, cpu_flags; - bool fault, write_fault; + if (!pud_huge(pud) || !pud_devmap(pud)) { + /* Ask for the PUD to be split */ + walk->action = ACTION_SUBTREE; + spin_unlock(ptl); + return 0; + }

- if (!pud_present(pud)) { - spin_unlock(ptl); - return hmm_vma_walk_hole(start, end, -1, walk); - } + if (!pud_present(pud)) { + spin_unlock(ptl); + return hmm_vma_walk_hole(start, end, -1, walk); + }

- i = (addr - range->start) >> PAGE_SHIFT; - npages = (end - addr) >> PAGE_SHIFT; - pfns = &range->pfns[i]; + i = (addr - range->start) >> PAGE_SHIFT; + npages = (end - addr) >> PAGE_SHIFT; + pfns = &range->pfns[i];

- cpu_flags = pud_to_hmm_pfn_flags(range, pud); - hmm_range_need_fault(hmm_vma_walk, pfns, npages, - cpu_flags, &fault, &write_fault); - if (fault || write_fault) { - spin_unlock(ptl); - return hmm_vma_walk_hole_(addr, end, fault, write_fault, - walk); - } + cpu_flags = pud_to_hmm_pfn_flags(range, pud); + hmm_range_need_fault(hmm_vma_walk, pfns, npages, + cpu_flags, &fault, &write_fault); + if (fault || write_fault) { + spin_unlock(ptl); + return hmm_vma_walk_hole_(addr, end, fault, write_fault, walk); + }

- pfn = pud_pfn(pud) + ((addr & ~PUD_MASK) >> PAGE_SHIFT); - for (i = 0; i < npages; ++i, ++pfn) { - hmm_vma_walk->pgmap = get_dev_pagemap(pfn, - hmm_vma_walk->pgmap); - if (unlikely(!hmm_vma_walk->pgmap)) { - ret = -EBUSY; - goto out_unlock; - } - pfns[i] = hmm_device_entry_from_pfn(range, pfn) | - cpu_flags; + pfn = pud_pfn(pud) + ((addr & ~PUD_MASK) >> PAGE_SHIFT); + for (i = 0; i < npages; ++i, ++pfn) { + hmm_vma_walk->pgmap = get_dev_pagemap(pfn, hmm_vma_walk->pgmap); + if (unlikely(!hmm_vma_walk->pgmap)) { + spin_unlock(ptl); + return -EBUSY; } - hmm_vma_walk->last = end; - goto out_unlock; + pfns[i] = hmm_device_entry_from_pfn(range, pfn) | cpu_flags; } + hmm_vma_walk->last = end;

- /* Ask for the PUD to be split */ - walk->action = ACTION_SUBTREE; - -out_unlock: spin_unlock(ptl); - return ret; + return 0; } #else #define hmm_vma_walk_pud NULL

On 3/11/20 11:35 AM, Jason Gunthorpe wrote:

From: Jason Gunthorpe jgg@mellanox.com

All success exit paths from the walker functions must set the pfns array.

A migration entry with no required fault is a HMM_PFN_NONE return, just like the pte case.

Fixes: d08faca018c4 ("mm/hmm: properly handle migration pmd") Signed-off-by: Jason Gunthorpe jgg@mellanox.com

Reviewed-by: Ralph Campbell rcampbell@nvidia.com

---

mm/hmm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/hmm.c b/mm/hmm.c index 32dcbfd3908315..5f5ccf13dd1e85 100644 --- a/mm/hmm.c +++ b/mm/hmm.c @@ -394,7 +394,7 @@ static int hmm_vma_walk_pmd(pmd_t *pmdp, pmd_migration_entry_wait(walk->mm, pmdp); return -EBUSY; }

• return 0;
  

• return hmm_pfns_fill(start, end, range, HMM_PFN_NONE);
  

  } else if (!pmd_present(pmd)) return hmm_pfns_fill(start, end, range, HMM_PFN_ERROR);

On 3/11/20 11:35 AM, Jason Gunthorpe wrote:

From: Jason Gunthorpe jgg@mellanox.com

All return paths that do EFAULT must call hmm_range_need_fault() to determine if the user requires this page to be valid.

If the page cannot be made valid if the user later requires it, due to vma flags in this case, then the return should be HMM_PFN_ERROR.

Fixes: a3e0d41c2b1f ("mm/hmm: improve driver API to work and wait over a range") Signed-off-by: Jason Gunthorpe jgg@mellanox.com

Reviewed-by: Ralph Campbell rcampbell@nvidia.com

---

mm/hmm.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/mm/hmm.c b/mm/hmm.c index 5f5ccf13dd1e85..e10cd0adba7b37 100644 --- a/mm/hmm.c +++ b/mm/hmm.c @@ -582,18 +582,15 @@ static int hmm_vma_walk_test(unsigned long start, unsigned long end, struct vm_area_struct *vma = walk->vma;

/*

• * Skip vma ranges that don't have struct page backing them or
  

• * map I/O devices directly.
  

• */
  

• if (vma->vm_flags & (VM_IO | VM_PFNMAP | VM_MIXEDMAP))

• return -EFAULT;
  

• /*

• * Skip vma ranges that don't have struct page backing them or map I/O
  

• * devices directly.
  

• *
  

  • If the vma does not allow read access, then assume that it does not

• * allow write access either. HMM does not support architectures
  

• * that allow write without read.
  

• * allow write access either. HMM does not support architectures that
  

• * allow write without read.
  

  */

• if (!(vma->vm_flags & VM_READ)) {

• if ((vma->vm_flags & (VM_IO | VM_PFNMAP | VM_MIXEDMAP)) ||

•    !(vma->vm_flags & VM_READ)) {
  

  bool fault, write_fault;

  /*

@@ -607,7 +604,7 @@ static int hmm_vma_walk_test(unsigned long start, unsigned long end, if (fault || write_fault) return -EFAULT;

• hmm_pfns_fill(start, end, range, HMM_PFN_NONE);
  

• hmm_pfns_fill(start, end, range, HMM_PFN_ERROR);
  

  hmm_vma_walk->last = end;

  /* Skip this vma and continue processing the next vma. */

On 3/11/20 11:35 AM, Jason Gunthorpe wrote:

From: Jason Gunthorpe jgg@mellanox.com

The intention with this code is to determine if the caller required the pages to be valid, and if so, then take some action to make them valid. The action varies depending on the page type.

In all cases, if the caller doesn't ask for the page, then hmm_range_fault() should not return an error.

Revise the implementation to be clearer, and fix some bugs:

• hmm_pte_need_fault() must always be called before testing fault or write_fault otherwise the defaults of false apply and the if()'s don't work. This was missed on the is_migration_entry() branch

• -EFAULT should not be returned unless hmm_pte_need_fault() indicates fault is required - ie snapshotting should not fail.

• For !pte_present() the cpu_flags are always 0, except in the special case of is_device_private_entry(), calling pte_to_hmm_pfn_flags() is confusing.

Reorganize the flow so that it always follows the pattern of calling hmm_pte_need_fault() and then checking fault || write_fault.

Fixes: 2aee09d8c116 ("mm/hmm: change hmm_vma_fault() to allow write fault on page basis") Signed-off-by: Jason Gunthorpe jgg@mellanox.com

Reviewed-by: Ralph Campbell rcampbell@nvidia.com

---

mm/hmm.c | 35 +++++++++++++++-------------------- 1 file changed, 15 insertions(+), 20 deletions(-)

diff --git a/mm/hmm.c b/mm/hmm.c index e10cd0adba7b37..bf676cfef3e8ee 100644 --- a/mm/hmm.c +++ b/mm/hmm.c @@ -282,15 +282,6 @@ static int hmm_vma_handle_pte(struct mm_walk *walk, unsigned long addr, if (!pte_present(pte)) { swp_entry_t entry = pte_to_swp_entry(pte);

• if (!non_swap_entry(entry)) {
  

• 	cpu_flags = pte_to_hmm_pfn_flags(range, pte);
  

• 	hmm_pte_need_fault(hmm_vma_walk, orig_pfn, cpu_flags,
  

• 			   &fault, &write_fault);
  

• 	if (fault || write_fault)
  

• 		goto fault;
  

• 	return 0;
  

• }
  

• /*
  • This is a special swap entry, ignore migration, use
  • device and report anything else as error.

@@ -310,26 +301,30 @@ static int hmm_vma_handle_pte(struct mm_walk *walk, unsigned long addr, return 0; }

• if (is_migration_entry(entry)) {
  

• 	if (fault || write_fault) {
  

• 		pte_unmap(ptep);
  

• 		hmm_vma_walk->last = addr;
  

• 		migration_entry_wait(walk->mm, pmdp, addr);
  

• 		return -EBUSY;
  

• 	}
  

• hmm_pte_need_fault(hmm_vma_walk, orig_pfn, 0, &fault,
  

• 		   &write_fault);
  

• if (!fault && !write_fault)
  return 0;
  

• if (!non_swap_entry(entry))
  

• 	goto fault;
  

• if (is_migration_entry(entry)) {
  

• 	pte_unmap(ptep);
  

• 	hmm_vma_walk->last = addr;
  

• 	migration_entry_wait(walk->mm, pmdp, addr);
  

• 	return -EBUSY;
  

  }

  /* Report error for everything else */ pte_unmap(ptep); *pfn = range->values[HMM_PFN_ERROR]; return -EFAULT;

• } else {

• cpu_flags = pte_to_hmm_pfn_flags(range, pte);
  

• hmm_pte_need_fault(hmm_vma_walk, orig_pfn, cpu_flags,
  

• 		   &fault, &write_fault);
  

  }

• cpu_flags = pte_to_hmm_pfn_flags(range, pte);
• hmm_pte_need_fault(hmm_vma_walk, orig_pfn, cpu_flags, &fault,

• 	   &write_fault);
  

  if (fault || write_fault) goto fault;

On 3/11/20 11:35 AM, Jason Gunthorpe wrote:

From: Jason Gunthorpe jgg@mellanox.com

hmm_range_fault() should never return 0 if the caller requested a valid page, but the pfns output for that page would be HMM_PFN_ERROR.

hmm_pte_need_fault() must always be called before setting HMM_PFN_ERROR to detect if the page is in faulting mode or not.

Fix two cases in hmm_vma_walk_pmd() and reorganize some of the duplicated code.

Fixes: d08faca018c4 ("mm/hmm: properly handle migration pmd") Fixes: da4c3c735ea4 ("mm/hmm/mirror: helper to snapshot CPU page table") Signed-off-by: Jason Gunthorpe jgg@mellanox.com

Reviewed-by: Ralph Campbell rcampbell@nvidia.com

---

mm/hmm.c | 38 +++++++++++++++++++++----------------- 1 file changed, 21 insertions(+), 17 deletions(-)

diff --git a/mm/hmm.c b/mm/hmm.c index bf676cfef3e8ee..f61fddf2ef6505 100644 --- a/mm/hmm.c +++ b/mm/hmm.c @@ -363,8 +363,10 @@ static int hmm_vma_walk_pmd(pmd_t *pmdp, { struct hmm_vma_walk *hmm_vma_walk = walk->private; struct hmm_range *range = hmm_vma_walk->range;

• uint64_t *pfns = range->pfns;
• unsigned long addr = start, i;

• uint64_t *pfns = &range->pfns[(start - range->start) >> PAGE_SHIFT];
• unsigned long npages = (end - start) >> PAGE_SHIFT;
• unsigned long addr = start;
• bool fault, write_fault; pte_t *ptep; pmd_t pmd;

@@ -374,14 +376,6 @@ static int hmm_vma_walk_pmd(pmd_t *pmdp, return hmm_vma_walk_hole(start, end, -1, walk);

if (thp_migration_supported() && is_pmd_migration_entry(pmd)) {

• bool fault, write_fault;
  

• unsigned long npages;
  

• uint64_t *pfns;
  

• i = (addr - range->start) >> PAGE_SHIFT;
  

• npages = (end - addr) >> PAGE_SHIFT;
  

• pfns = &range->pfns[i];
  

• hmm_range_need_fault(hmm_vma_walk, pfns, npages, 0, &fault, &write_fault); if (fault || write_fault) {

@@ -390,8 +384,15 @@ static int hmm_vma_walk_pmd(pmd_t *pmdp, return -EBUSY; } return hmm_pfns_fill(start, end, range, HMM_PFN_NONE);

• } else if (!pmd_present(pmd))

• }
• if (!pmd_present(pmd)) {

• hmm_range_need_fault(hmm_vma_walk, pfns, npages, 0, &fault,
  

• 		     &write_fault);
  

• if (fault || write_fault)
  

• 	return -EFAULT;
  

  return hmm_pfns_fill(start, end, range, HMM_PFN_ERROR);

Shouldn't this fill with HMM_PFN_NONE instead of HMM_PFN_ERROR? Otherwise, when a THP is swapped out, you will get a different value than if a PTE is swapped out and you are prefetching/snapshotting.

• }

  if (pmd_devmap(pmd) || pmd_trans_huge(pmd)) { /*

@@ -408,8 +409,7 @@ static int hmm_vma_walk_pmd(pmd_t *pmdp, if (!pmd_devmap(pmd) && !pmd_trans_huge(pmd)) goto again;

• i = (addr - range->start) >> PAGE_SHIFT;
  

• return hmm_vma_handle_pmd(walk, addr, end, &pfns[i], pmd);
  

• return hmm_vma_handle_pmd(walk, addr, end, pfns, pmd);
  

  }

  /*

@@ -418,15 +418,19 @@ static int hmm_vma_walk_pmd(pmd_t *pmdp, * entry pointing to pte directory or it is a bad pmd that will not * recover. */

• if (pmd_bad(pmd))

• if (pmd_bad(pmd)) {

• hmm_range_need_fault(hmm_vma_walk, pfns, npages, 0, &fault,
  

• 		     &write_fault);
  

• if (fault || write_fault)
  

• 	return -EFAULT;
  

  return hmm_pfns_fill(start, end, range, HMM_PFN_ERROR);

• }

  ptep = pte_offset_map(pmdp, addr);

• i = (addr - range->start) >> PAGE_SHIFT;
• for (; addr < end; addr += PAGE_SIZE, ptep++, i++) {

• for (; addr < end; addr += PAGE_SIZE, ptep++, pfns++) { int r;

• r = hmm_vma_handle_pte(walk, addr, end, pmdp, ptep, &pfns[i]);
  

• r = hmm_vma_handle_pte(walk, addr, end, pmdp, ptep, pfns);
  

  if (r) { /* hmm_vma_handle_pte() did pte_unmap() */ hmm_vma_walk->last = addr;