// SPDX-License-Identifier: GPL-2.0-only

  /*
   * Simple NUMA memory policy for the Linux kernel.
   *
   * Copyright 2003,2004 Andi Kleen, SuSE Labs.

   * (C) Copyright 2005 Christoph Lameter, Silicon Graphics, Inc.

   *
   * NUMA policy allows the user to give hints in which node(s) memory should
   * be allocated.
   *
   * Support four policies per VMA and per process:
   *
   * The VMA policy has priority over the process policy for a page fault.
   *
   * interleave     Allocate memory interleaved over a set of nodes,
   *                with normal fallback if it fails.
   *                For VMA based allocations this interleaves based on the
   *                offset into the backing object or offset into the mapping
   *                for anonymous memory. For process policy an process counter
   *                is used.

   *

   * bind           Only allocate memory on a specific set of nodes,
   *                no fallback.

   *                FIXME: memory is allocated starting with the first node
   *                to the last. It would be better if bind would truly restrict
   *                the allocation to memory nodes instead
   *

   * preferred       Try a specific node first before normal fallback.

   *                As a special case NUMA_NO_NODE here means do the allocation

   *                on the local CPU. This is normally identical to default,
   *                but useful to set in a VMA when you have a non default
   *                process policy.

   *

   * preferred many Try a set of nodes first before normal fallback. This is
   *                similar to preferred without the special case.
   *

   * default        Allocate on the local node first, or when on a VMA
   *                use the process policy. This is what Linux always did
   *		  in a NUMA aware kernel and still does by, ahem, default.
   *
   * The process policy is applied for most non interrupt memory allocations
   * in that process' context. Interrupts ignore the policies and always
   * try to allocate on the local CPU. The VMA policy is only applied for memory
   * allocations for a VMA in the VM.
   *
   * Currently there are a few corner cases in swapping where the policy
   * is not applied, but the majority should be handled. When process policy
   * is used it is not remembered over swap outs/swap ins.
   *
   * Only the highest zone in the zone hierarchy gets policied. Allocations
   * requesting a lower zone just use default policy. This implies that
   * on systems with highmem kernel lowmem allocation don't get policied.
   * Same with GFP_DMA allocations.
   *
   * For shmfs/tmpfs/hugetlbfs shared memory the policy is shared between
   * all users and remembered even when nobody has memory mapped.
   */
  
  /* Notebook:
     fix mmap readahead to honour policy and enable policy for any page cache
     object
     statistics for bigpages
     global policy for page cache? currently it uses process policy. Requires
     first item above.
     handle mremap for shared memory (currently ignored for the policy)
     grows down?
     make bind policy root only? It can trigger oom much faster and the
     kernel is not always grateful with that.

  */

  #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

  #include <linux/mempolicy.h>

  #include <linux/pagewalk.h>

  #include <linux/highmem.h>
  #include <linux/hugetlb.h>
  #include <linux/kernel.h>
  #include <linux/sched.h>

  #include <linux/sched/mm.h>

  #include <linux/sched/numa_balancing.h>

  #include <linux/sched/task.h>

  #include <linux/nodemask.h>
  #include <linux/cpuset.h>

  #include <linux/slab.h>
  #include <linux/string.h>

  #include <linux/export.h>

  #include <linux/nsproxy.h>

  #include <linux/interrupt.h>
  #include <linux/init.h>
  #include <linux/compat.h>

  #include <linux/ptrace.h>

  #include <linux/swap.h>

  #include <linux/seq_file.h>
  #include <linux/proc_fs.h>

  #include <linux/migrate.h>

  #include <linux/ksm.h>

  #include <linux/rmap.h>

  #include <linux/security.h>

  #include <linux/syscalls.h>

  #include <linux/ctype.h>

  #include <linux/mm_inline.h>

  #include <linux/mmu_notifier.h>

  #include <linux/printk.h>

  #include <linux/swapops.h>

  #include <asm/tlbflush.h>

  #include <linux/uaccess.h>

  #include "internal.h"

  /* Internal flags */

  #define MPOL_MF_DISCONTIG_OK (MPOL_MF_INTERNAL << 0)	/* Skip checks for continuous vmas */

  #define MPOL_MF_INVERT (MPOL_MF_INTERNAL << 1)		/* Invert check for nodemask */

  static struct kmem_cache *policy_cache;
  static struct kmem_cache *sn_cache;

  /* Highest zone. An specific allocation for a zone below that is not
     policied. */

  enum zone_type policy_zone = 0;

  /*
   * run-time system-wide default policy => local allocation
   */

  static struct mempolicy default_policy = {

  	.refcnt = ATOMIC_INIT(1), /* never free it */

  	.mode = MPOL_LOCAL,

  };

  static struct mempolicy preferred_node_policy[MAX_NUMNODES];

  /**
   * numa_map_to_online_node - Find closest online node

   * @node: Node id to start the search

   *
   * Lookup the next closest node by distance if @nid is not online.
   */
  int numa_map_to_online_node(int node)
  {

  	int min_dist = INT_MAX, dist, n, min_node;

  	if (node == NUMA_NO_NODE || node_online(node))
  		return node;

  
  	min_node = node;

  	for_each_online_node(n) {
  		dist = node_distance(node, n);
  		if (dist < min_dist) {
  			min_dist = dist;
  			min_node = n;

  		}
  	}
  
  	return min_node;
  }
  EXPORT_SYMBOL_GPL(numa_map_to_online_node);

  struct mempolicy *get_task_policy(struct task_struct *p)

  {
  	struct mempolicy *pol = p->mempolicy;

  	int node;

  	if (pol)
  		return pol;

  	node = numa_node_id();
  	if (node != NUMA_NO_NODE) {
  		pol = &preferred_node_policy[node];
  		/* preferred_node_policy is not initialised early in boot */
  		if (pol->mode)
  			return pol;

  	}

  	return &default_policy;

  }

  static const struct mempolicy_operations {
  	int (*create)(struct mempolicy *pol, const nodemask_t *nodes);

  	void (*rebind)(struct mempolicy *pol, const nodemask_t *nodes);

  } mpol_ops[MPOL_MAX];

  static inline int mpol_store_user_nodemask(const struct mempolicy *pol)
  {

  	return pol->flags & MPOL_MODE_FLAGS;

  }
  
  static void mpol_relative_nodemask(nodemask_t *ret, const nodemask_t *orig,
  				   const nodemask_t *rel)
  {
  	nodemask_t tmp;
  	nodes_fold(tmp, *orig, nodes_weight(*rel));
  	nodes_onto(*ret, tmp, *rel);

  }

  static int mpol_new_nodemask(struct mempolicy *pol, const nodemask_t *nodes)

  {
  	if (nodes_empty(*nodes))
  		return -EINVAL;

  	pol->nodes = *nodes;

  	return 0;
  }
  
  static int mpol_new_preferred(struct mempolicy *pol, const nodemask_t *nodes)
  {

  	if (nodes_empty(*nodes))
  		return -EINVAL;

  
  	nodes_clear(pol->nodes);
  	node_set(first_node(*nodes), pol->nodes);

  	return 0;
  }

  /*
   * mpol_set_nodemask is called after mpol_new() to set up the nodemask, if
   * any, for the new policy.  mpol_new() has already validated the nodes

   * parameter with respect to the policy mode and flags.

   *
   * Must be called holding task's alloc_lock to protect task's mems_allowed

   * and mempolicy.  May also be called holding the mmap_lock for write.

   */

  static int mpol_set_nodemask(struct mempolicy *pol,
  		     const nodemask_t *nodes, struct nodemask_scratch *nsc)

  {

  	int ret;

  	/*
  	 * Default (pol==NULL) resp. local memory policies are not a
  	 * subject of any remapping. They also do not need any special
  	 * constructor.
  	 */
  	if (!pol || pol->mode == MPOL_LOCAL)

  		return 0;

  	/* Check N_MEMORY */

  	nodes_and(nsc->mask1,

  		  cpuset_current_mems_allowed, node_states[N_MEMORY]);

  
  	VM_BUG_ON(!nodes);

  	if (pol->flags & MPOL_F_RELATIVE_NODES)
  		mpol_relative_nodemask(&nsc->mask2, nodes, &nsc->mask1);
  	else
  		nodes_and(nsc->mask2, *nodes, nsc->mask1);

  	if (mpol_store_user_nodemask(pol))
  		pol->w.user_nodemask = *nodes;

  	else

  		pol->w.cpuset_mems_allowed = cpuset_current_mems_allowed;
  
  	ret = mpol_ops[pol->mode].create(pol, &nsc->mask2);

  	return ret;
  }
  
  /*
   * This function just creates a new policy, does some check and simple
   * initialization. You must invoke mpol_set_nodemask() to set nodes.
   */

  static struct mempolicy *mpol_new(unsigned short mode, unsigned short flags,
  				  nodemask_t *nodes)

  {
  	struct mempolicy *policy;

  	pr_debug("setting mode %d flags %d nodes[0] %lx
  ",

  		 mode, flags, nodes ? nodes_addr(*nodes)[0] : NUMA_NO_NODE);

  	if (mode == MPOL_DEFAULT) {
  		if (nodes && !nodes_empty(*nodes))

  			return ERR_PTR(-EINVAL);

  		return NULL;

  	}

  	VM_BUG_ON(!nodes);
  
  	/*
  	 * MPOL_PREFERRED cannot be used with MPOL_F_STATIC_NODES or
  	 * MPOL_F_RELATIVE_NODES if the nodemask is empty (local allocation).
  	 * All other modes require a valid pointer to a non-empty nodemask.
  	 */
  	if (mode == MPOL_PREFERRED) {
  		if (nodes_empty(*nodes)) {
  			if (((flags & MPOL_F_STATIC_NODES) ||
  			     (flags & MPOL_F_RELATIVE_NODES)))
  				return ERR_PTR(-EINVAL);

  
  			mode = MPOL_LOCAL;

  		}

  	} else if (mode == MPOL_LOCAL) {

  		if (!nodes_empty(*nodes) ||
  		    (flags & MPOL_F_STATIC_NODES) ||
  		    (flags & MPOL_F_RELATIVE_NODES))

  			return ERR_PTR(-EINVAL);

  	} else if (nodes_empty(*nodes))
  		return ERR_PTR(-EINVAL);

  	policy = kmem_cache_alloc(policy_cache, GFP_KERNEL);
  	if (!policy)
  		return ERR_PTR(-ENOMEM);
  	atomic_set(&policy->refcnt, 1);

  	policy->mode = mode;

  	policy->flags = flags;

  	return policy;

  }

  /* Slow path of a mpol destructor. */
  void __mpol_put(struct mempolicy *p)
  {
  	if (!atomic_dec_and_test(&p->refcnt))
  		return;

  	kmem_cache_free(policy_cache, p);
  }

  static void mpol_rebind_default(struct mempolicy *pol, const nodemask_t *nodes)

  {
  }

  static void mpol_rebind_nodemask(struct mempolicy *pol, const nodemask_t *nodes)

  {
  	nodemask_t tmp;
  
  	if (pol->flags & MPOL_F_STATIC_NODES)
  		nodes_and(tmp, pol->w.user_nodemask, *nodes);
  	else if (pol->flags & MPOL_F_RELATIVE_NODES)
  		mpol_relative_nodemask(&tmp, &pol->w.user_nodemask, nodes);
  	else {

  		nodes_remap(tmp, pol->nodes, pol->w.cpuset_mems_allowed,

  								*nodes);

  		pol->w.cpuset_mems_allowed = *nodes;

  	}

  	if (nodes_empty(tmp))
  		tmp = *nodes;

  	pol->nodes = tmp;

  }
  
  static void mpol_rebind_preferred(struct mempolicy *pol,

  						const nodemask_t *nodes)

  {

  	pol->w.cpuset_mems_allowed = *nodes;

  }

  /*
   * mpol_rebind_policy - Migrate a policy to a different set of nodes
   *

   * Per-vma policies are protected by mmap_lock. Allocations using per-task

   * policies are protected by task->mems_allowed_seq to prevent a premature
   * OOM/allocation failure due to parallel nodemask modification.

   */

  static void mpol_rebind_policy(struct mempolicy *pol, const nodemask_t *newmask)

  {

  	if (!pol || pol->mode == MPOL_LOCAL)

  		return;

  	if (!mpol_store_user_nodemask(pol) &&

  	    nodes_equal(pol->w.cpuset_mems_allowed, *newmask))
  		return;

  	mpol_ops[pol->mode].rebind(pol, newmask);

  }
  
  /*
   * Wrapper for mpol_rebind_policy() that just requires task
   * pointer, and updates task mempolicy.

   *
   * Called with task's alloc_lock held.

   */

  void mpol_rebind_task(struct task_struct *tsk, const nodemask_t *new)

  {

  	mpol_rebind_policy(tsk->mempolicy, new);

  }
  
  /*
   * Rebind each vma in mm to new nodemask.
   *

   * Call holding a reference to mm.  Takes mm->mmap_lock during call.

   */
  
  void mpol_rebind_mm(struct mm_struct *mm, nodemask_t *new)
  {
  	struct vm_area_struct *vma;

  	mmap_write_lock(mm);

  	for (vma = mm->mmap; vma; vma = vma->vm_next)

  		mpol_rebind_policy(vma->vm_policy, new);

  	mmap_write_unlock(mm);

  }

  static const struct mempolicy_operations mpol_ops[MPOL_MAX] = {
  	[MPOL_DEFAULT] = {
  		.rebind = mpol_rebind_default,
  	},
  	[MPOL_INTERLEAVE] = {

  		.create = mpol_new_nodemask,

  		.rebind = mpol_rebind_nodemask,
  	},
  	[MPOL_PREFERRED] = {
  		.create = mpol_new_preferred,
  		.rebind = mpol_rebind_preferred,
  	},
  	[MPOL_BIND] = {

  		.create = mpol_new_nodemask,

  		.rebind = mpol_rebind_nodemask,
  	},

  	[MPOL_LOCAL] = {
  		.rebind = mpol_rebind_default,
  	},

  	[MPOL_PREFERRED_MANY] = {

  		.create = mpol_new_nodemask,

  		.rebind = mpol_rebind_preferred,
  	},

  };

  static int migrate_page_add(struct page *page, struct list_head *pagelist,

  				unsigned long flags);

  struct queue_pages {
  	struct list_head *pagelist;
  	unsigned long flags;
  	nodemask_t *nmask;

  	unsigned long start;
  	unsigned long end;
  	struct vm_area_struct *first;

  };

  /*

   * Check if the page's nid is in qp->nmask.
   *
   * If MPOL_MF_INVERT is set in qp->flags, check if the nid is
   * in the invert of qp->nmask.
   */
  static inline bool queue_pages_required(struct page *page,
  					struct queue_pages *qp)
  {
  	int nid = page_to_nid(page);
  	unsigned long flags = qp->flags;
  
  	return node_isset(nid, *qp->nmask) == !(flags & MPOL_MF_INVERT);
  }

  /*

   * queue_pages_pmd() has four possible return values:

   * 0 - pages are placed on the right node or queued successfully, or
   *     special page is met, i.e. huge zero page.

   * 1 - there is unmovable page, and MPOL_MF_MOVE* & MPOL_MF_STRICT were
   *     specified.
   * 2 - THP was split.
   * -EIO - is migration entry or only MPOL_MF_STRICT was specified and an
   *        existing page was already on a node that does not follow the
   *        policy.

   */

  static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr,
  				unsigned long end, struct mm_walk *walk)

  	__releases(ptl)

  {
  	int ret = 0;
  	struct page *page;
  	struct queue_pages *qp = walk->private;
  	unsigned long flags;
  
  	if (unlikely(is_pmd_migration_entry(*pmd))) {

  		ret = -EIO;

  		goto unlock;
  	}
  	page = pmd_page(*pmd);
  	if (is_huge_zero_page(page)) {
  		spin_unlock(ptl);

  		walk->action = ACTION_CONTINUE;

  		goto out;
  	}

  	if (!queue_pages_required(page, qp))

  		goto unlock;

  	flags = qp->flags;
  	/* go to thp migration */

  	if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {

  		if (!vma_migratable(walk->vma) ||
  		    migrate_page_add(page, qp->pagelist, flags)) {

  			ret = 1;

  			goto unlock;
  		}

  	} else
  		ret = -EIO;

  unlock:
  	spin_unlock(ptl);
  out:
  	return ret;
  }

  /*

   * Scan through pages checking if pages follow certain conditions,
   * and move them to the pagelist if they do.

   *
   * queue_pages_pte_range() has three possible return values:

   * 0 - pages are placed on the right node or queued successfully, or
   *     special page is met, i.e. zero page.

   * 1 - there is unmovable page, and MPOL_MF_MOVE* & MPOL_MF_STRICT were
   *     specified.
   * -EIO - only MPOL_MF_STRICT was specified and an existing page was already
   *        on a node that does not follow the policy.

   */

  static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
  			unsigned long end, struct mm_walk *walk)

  {

  	struct vm_area_struct *vma = walk->vma;
  	struct page *page;
  	struct queue_pages *qp = walk->private;
  	unsigned long flags = qp->flags;

  	int ret;

  	bool has_unmovable = false;

  	pte_t *pte, *mapped_pte;

  	spinlock_t *ptl;

  	ptl = pmd_trans_huge_lock(pmd, vma);
  	if (ptl) {
  		ret = queue_pages_pmd(pmd, ptl, addr, end, walk);

  		if (ret != 2)

  			return ret;

  	}

  	/* THP was split, fall through to pte walk */

  	if (pmd_trans_unstable(pmd))
  		return 0;

  	mapped_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);

  	for (; addr != end; pte++, addr += PAGE_SIZE) {

  		if (!pte_present(*pte))

  			continue;

  		page = vm_normal_page(vma, addr, *pte);
  		if (!page)

  			continue;

  		/*

  		 * vm_normal_page() filters out zero pages, but there might
  		 * still be PageReserved pages to skip, perhaps in a VDSO.

  		 */

  		if (PageReserved(page))

  			continue;

  		if (!queue_pages_required(page, qp))

  			continue;

  		if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {

  			/* MPOL_MF_STRICT must be specified if we get here */
  			if (!vma_migratable(vma)) {
  				has_unmovable = true;

  				break;

  			}

  
  			/*
  			 * Do not abort immediately since there may be
  			 * temporary off LRU pages in the range.  Still
  			 * need migrate other LRU pages.
  			 */
  			if (migrate_page_add(page, qp->pagelist, flags))
  				has_unmovable = true;

  		} else
  			break;

  	}

  	pte_unmap_unlock(mapped_pte, ptl);

  	cond_resched();

  
  	if (has_unmovable)
  		return 1;

  	return addr != end ? -EIO : 0;

  }

  static int queue_pages_hugetlb(pte_t *pte, unsigned long hmask,
  			       unsigned long addr, unsigned long end,
  			       struct mm_walk *walk)

  {

  	int ret = 0;

  #ifdef CONFIG_HUGETLB_PAGE

  	struct queue_pages *qp = walk->private;

  	unsigned long flags = (qp->flags & MPOL_MF_VALID);

  	struct page *page;

  	spinlock_t *ptl;

  	pte_t entry;

  	ptl = huge_pte_lock(hstate_vma(walk->vma), walk->mm, pte);
  	entry = huge_ptep_get(pte);

  	if (!pte_present(entry))
  		goto unlock;
  	page = pte_page(entry);

  	if (!queue_pages_required(page, qp))

  		goto unlock;

  
  	if (flags == MPOL_MF_STRICT) {
  		/*
  		 * STRICT alone means only detecting misplaced page and no
  		 * need to further check other vma.
  		 */
  		ret = -EIO;
  		goto unlock;
  	}
  
  	if (!vma_migratable(walk->vma)) {
  		/*
  		 * Must be STRICT with MOVE*, otherwise .test_walk() have
  		 * stopped walking current vma.
  		 * Detecting misplaced page but allow migrating pages which
  		 * have been queued.
  		 */
  		ret = 1;
  		goto unlock;
  	}

  	/* With MPOL_MF_MOVE, we migrate only unshared hugepage. */
  	if (flags & (MPOL_MF_MOVE_ALL) ||

  	    (flags & MPOL_MF_MOVE && page_mapcount(page) == 1)) {
  		if (!isolate_huge_page(page, qp->pagelist) &&
  			(flags & MPOL_MF_STRICT))
  			/*
  			 * Failed to isolate page but allow migrating pages
  			 * which have been queued.
  			 */
  			ret = 1;
  	}

  unlock:

  	spin_unlock(ptl);

  #else
  	BUG();
  #endif

  	return ret;

  }

  #ifdef CONFIG_NUMA_BALANCING

  /*

   * This is used to mark a range of virtual addresses to be inaccessible.
   * These are later cleared by a NUMA hinting fault. Depending on these
   * faults, pages may be migrated for better NUMA placement.
   *
   * This is assuming that NUMA faults are handled using PROT_NONE. If
   * an architecture makes a different choice, it will need further
   * changes to the core.

   */

  unsigned long change_prot_numa(struct vm_area_struct *vma,
  			unsigned long addr, unsigned long end)

  {

  	int nr_updated;

  	nr_updated = change_protection(vma, addr, end, PAGE_NONE, MM_CP_PROT_NUMA);

  	if (nr_updated)
  		count_vm_numa_events(NUMA_PTE_UPDATES, nr_updated);

  	return nr_updated;

  }
  #else
  static unsigned long change_prot_numa(struct vm_area_struct *vma,
  			unsigned long addr, unsigned long end)
  {
  	return 0;
  }

  #endif /* CONFIG_NUMA_BALANCING */

  static int queue_pages_test_walk(unsigned long start, unsigned long end,
  				struct mm_walk *walk)
  {
  	struct vm_area_struct *vma = walk->vma;
  	struct queue_pages *qp = walk->private;
  	unsigned long endvma = vma->vm_end;
  	unsigned long flags = qp->flags;

  	/* range check first */

  	VM_BUG_ON_VMA(!range_in_vma(vma, start, end), vma);

  
  	if (!qp->first) {
  		qp->first = vma;
  		if (!(flags & MPOL_MF_DISCONTIG_OK) &&
  			(qp->start < vma->vm_start))
  			/* hole at head side of range */

  			return -EFAULT;
  	}

  	if (!(flags & MPOL_MF_DISCONTIG_OK) &&
  		((vma->vm_end < qp->end) &&
  		(!vma->vm_next || vma->vm_end < vma->vm_next->vm_start)))
  		/* hole at middle or tail of range */
  		return -EFAULT;

  	/*
  	 * Need check MPOL_MF_STRICT to return -EIO if possible
  	 * regardless of vma_migratable
  	 */
  	if (!vma_migratable(vma) &&
  	    !(flags & MPOL_MF_STRICT))

  		return 1;

  	if (endvma > end)
  		endvma = end;

  	if (flags & MPOL_MF_LAZY) {
  		/* Similar to task_numa_work, skip inaccessible VMAs */

  		if (!is_vm_hugetlb_page(vma) && vma_is_accessible(vma) &&

  			!(vma->vm_flags & VM_MIXEDMAP))

  			change_prot_numa(vma, start, endvma);
  		return 1;
  	}

  	/* queue pages from current vma */

  	if (flags & MPOL_MF_VALID)

  		return 0;
  	return 1;
  }

  static const struct mm_walk_ops queue_pages_walk_ops = {
  	.hugetlb_entry		= queue_pages_hugetlb,
  	.pmd_entry		= queue_pages_pte_range,
  	.test_walk		= queue_pages_test_walk,
  };

  /*

   * Walk through page tables and collect pages to be migrated.
   *
   * If pages found in a given range are on a set of nodes (determined by
   * @nodes and @flags,) it's isolated and queued to the pagelist which is

   * passed via @private.
   *
   * queue_pages_range() has three possible return values:
   * 1 - there is unmovable page, but MPOL_MF_MOVE* & MPOL_MF_STRICT were
   *     specified.
   * 0 - queue pages successfully or no misplaced page.

   * errno - i.e. misplaced pages with MPOL_MF_STRICT specified (-EIO) or
   *         memory range specified by nodemask and maxnode points outside
   *         your accessible address space (-EFAULT)

   */

  static int

  queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,

  		nodemask_t *nodes, unsigned long flags,
  		struct list_head *pagelist)

  {

  	int err;

  	struct queue_pages qp = {
  		.pagelist = pagelist,
  		.flags = flags,
  		.nmask = nodes,

  		.start = start,
  		.end = end,
  		.first = NULL,

  	};

  	err = walk_page_range(mm, start, end, &queue_pages_walk_ops, &qp);
  
  	if (!qp.first)
  		/* whole range in hole */
  		err = -EFAULT;
  
  	return err;

  }

  /*
   * Apply policy to a single VMA

   * This must be called with the mmap_lock held for writing.

   */
  static int vma_replace_policy(struct vm_area_struct *vma,
  						struct mempolicy *pol)

  {

  	int err;
  	struct mempolicy *old;
  	struct mempolicy *new;

  
  	pr_debug("vma %lx-%lx/%lx vm_ops %p vm_file %p set_policy %p
  ",
  		 vma->vm_start, vma->vm_end, vma->vm_pgoff,
  		 vma->vm_ops, vma->vm_file,
  		 vma->vm_ops ? vma->vm_ops->set_policy : NULL);

  	new = mpol_dup(pol);
  	if (IS_ERR(new))
  		return PTR_ERR(new);
  
  	if (vma->vm_ops && vma->vm_ops->set_policy) {

  		err = vma->vm_ops->set_policy(vma, new);

  		if (err)
  			goto err_out;

  	}

  
  	old = vma->vm_policy;

  	vma->vm_policy = new; /* protected by mmap_lock */

  	mpol_put(old);
  
  	return 0;
   err_out:
  	mpol_put(new);

  	return err;
  }

  /* Step 2: apply policy to a range and do splits. */

  static int mbind_range(struct mm_struct *mm, unsigned long start,
  		       unsigned long end, struct mempolicy *new_pol)

  {

  	struct vm_area_struct *prev;
  	struct vm_area_struct *vma;
  	int err = 0;

  	pgoff_t pgoff;

  	unsigned long vmstart;
  	unsigned long vmend;

  	vma = find_vma(mm, start);

  	VM_BUG_ON(!vma);

  	prev = vma->vm_prev;

  	if (start > vma->vm_start)
  		prev = vma;

  	for (; vma && vma->vm_start < end; prev = vma, vma = vma->vm_next) {

  		vmstart = max(start, vma->vm_start);
  		vmend   = min(end, vma->vm_end);

  		if (mpol_equal(vma_policy(vma), new_pol))
  			continue;
  
  		pgoff = vma->vm_pgoff +
  			((vmstart - vma->vm_start) >> PAGE_SHIFT);

  		prev = vma_merge(mm, prev, vmstart, vmend, vma->vm_flags,

  				 vma->anon_vma, vma->vm_file, pgoff,
  				 new_pol, vma->vm_userfaultfd_ctx);

  		if (prev) {
  			vma = prev;

  			goto replace;

  		}
  		if (vma->vm_start != vmstart) {
  			err = split_vma(vma->vm_mm, vma, vmstart, 1);
  			if (err)
  				goto out;
  		}
  		if (vma->vm_end != vmend) {
  			err = split_vma(vma->vm_mm, vma, vmend, 0);
  			if (err)
  				goto out;
  		}

   replace:

  		err = vma_replace_policy(vma, new_pol);

  		if (err)
  			goto out;

  	}

  
   out:

  	return err;
  }

  /* Set the process memory policy */

  static long do_set_mempolicy(unsigned short mode, unsigned short flags,
  			     nodemask_t *nodes)

  {

  	struct mempolicy *new, *old;

  	NODEMASK_SCRATCH(scratch);

  	int ret;

  	if (!scratch)
  		return -ENOMEM;

  	new = mpol_new(mode, flags, nodes);
  	if (IS_ERR(new)) {
  		ret = PTR_ERR(new);
  		goto out;
  	}

  	ret = mpol_set_nodemask(new, nodes, scratch);

  	if (ret) {

  		mpol_put(new);

  		goto out;

  	}

  	task_lock(current);

  	old = current->mempolicy;

  	current->mempolicy = new;

  	if (new && new->mode == MPOL_INTERLEAVE)
  		current->il_prev = MAX_NUMNODES-1;

  	task_unlock(current);

  	mpol_put(old);

  	ret = 0;
  out:
  	NODEMASK_SCRATCH_FREE(scratch);
  	return ret;

  }

  /*
   * Return nodemask for policy for get_mempolicy() query

   *
   * Called with task's alloc_lock held

   */
  static void get_policy_nodemask(struct mempolicy *p, nodemask_t *nodes)

  {

  	nodes_clear(*nodes);

  	if (p == &default_policy)
  		return;

  	switch (p->mode) {

  	case MPOL_BIND:

  	case MPOL_INTERLEAVE:

  	case MPOL_PREFERRED:

  	case MPOL_PREFERRED_MANY:

  		*nodes = p->nodes;

  		break;

  	case MPOL_LOCAL:
  		/* return empty node mask for local allocation */
  		break;

  	default:
  		BUG();
  	}
  }

  static int lookup_node(struct mm_struct *mm, unsigned long addr)

  {

  	struct page *p = NULL;

  	int err;

  	int locked = 1;
  	err = get_user_pages_locked(addr & PAGE_MASK, 1, 0, &p, &locked);

  	if (err > 0) {

  		err = page_to_nid(p);
  		put_page(p);
  	}

  	if (locked)

  		mmap_read_unlock(mm);

  	return err;
  }

  /* Retrieve NUMA policy */

  static long do_get_mempolicy(int *policy, nodemask_t *nmask,
  			     unsigned long addr, unsigned long flags)

  {

  	int err;

  	struct mm_struct *mm = current->mm;
  	struct vm_area_struct *vma = NULL;

  	struct mempolicy *pol = current->mempolicy, *pol_refcount = NULL;

  	if (flags &
  		~(unsigned long)(MPOL_F_NODE|MPOL_F_ADDR|MPOL_F_MEMS_ALLOWED))

  		return -EINVAL;

  
  	if (flags & MPOL_F_MEMS_ALLOWED) {
  		if (flags & (MPOL_F_NODE|MPOL_F_ADDR))
  			return -EINVAL;
  		*policy = 0;	/* just so it's initialized */

  		task_lock(current);

  		*nmask  = cpuset_current_mems_allowed;

  		task_unlock(current);

  		return 0;
  	}

  	if (flags & MPOL_F_ADDR) {

  		/*
  		 * Do NOT fall back to task policy if the
  		 * vma/shared policy at addr is NULL.  We
  		 * want to return MPOL_DEFAULT in this case.
  		 */

  		mmap_read_lock(mm);

  		vma = vma_lookup(mm, addr);

  		if (!vma) {

  			mmap_read_unlock(mm);

  			return -EFAULT;
  		}
  		if (vma->vm_ops && vma->vm_ops->get_policy)
  			pol = vma->vm_ops->get_policy(vma, addr);
  		else
  			pol = vma->vm_policy;
  	} else if (addr)
  		return -EINVAL;
  
  	if (!pol)

  		pol = &default_policy;	/* indicates default behavior */

  
  	if (flags & MPOL_F_NODE) {
  		if (flags & MPOL_F_ADDR) {

  			/*
  			 * Take a refcount on the mpol, lookup_node()

  			 * will drop the mmap_lock, so after calling

  			 * lookup_node() only "pol" remains valid, "vma"
  			 * is stale.
  			 */
  			pol_refcount = pol;
  			vma = NULL;
  			mpol_get(pol);
  			err = lookup_node(mm, addr);

  			if (err < 0)
  				goto out;

  			*policy = err;

  		} else if (pol == current->mempolicy &&

  				pol->mode == MPOL_INTERLEAVE) {

  			*policy = next_node_in(current->il_prev, pol->nodes);

  		} else {
  			err = -EINVAL;
  			goto out;
  		}

  	} else {
  		*policy = pol == &default_policy ? MPOL_DEFAULT :
  						pol->mode;

  		/*
  		 * Internal mempolicy flags must be masked off before exposing
  		 * the policy to userspace.
  		 */
  		*policy |= (pol->flags & MPOL_MODE_FLAGS);

  	}

  	err = 0;

  	if (nmask) {

  		if (mpol_store_user_nodemask(pol)) {
  			*nmask = pol->w.user_nodemask;
  		} else {
  			task_lock(current);
  			get_policy_nodemask(pol, nmask);
  			task_unlock(current);
  		}

  	}

  
   out:

  	mpol_cond_put(pol);

  	if (vma)

  		mmap_read_unlock(mm);

  	if (pol_refcount)
  		mpol_put(pol_refcount);

  	return err;
  }

  #ifdef CONFIG_MIGRATION

  /*

   * page migration, thp tail pages can be passed.

   */

  static int migrate_page_add(struct page *page, struct list_head *pagelist,

  				unsigned long flags)

  {

  	struct page *head = compound_head(page);

  	/*

  	 * Avoid migrating a page that is shared with others.

  	 */

  	if ((flags & MPOL_MF_MOVE_ALL) || page_mapcount(head) == 1) {
  		if (!isolate_lru_page(head)) {
  			list_add_tail(&head->lru, pagelist);
  			mod_node_page_state(page_pgdat(head),

  				NR_ISOLATED_ANON + page_is_file_lru(head),

  				thp_nr_pages(head));

  		} else if (flags & MPOL_MF_STRICT) {
  			/*
  			 * Non-movable page may reach here.  And, there may be
  			 * temporary off LRU pages or non-LRU movable pages.
  			 * Treat them as unmovable pages since they can't be
  			 * isolated, so they can't be moved at the moment.  It
  			 * should return -EIO for this case too.
  			 */
  			return -EIO;

  		}
  	}

  
  	return 0;

  }

  /*
   * Migrate pages from one node to a target node.
   * Returns error or the number of pages not migrated.
   */

  static int migrate_to_node(struct mm_struct *mm, int source, int dest,
  			   int flags)

  {
  	nodemask_t nmask;
  	LIST_HEAD(pagelist);
  	int err = 0;

  	struct migration_target_control mtc = {
  		.nid = dest,
  		.gfp_mask = GFP_HIGHUSER_MOVABLE | __GFP_THISNODE,
  	};

  
  	nodes_clear(nmask);
  	node_set(source, nmask);

  	/*
  	 * This does not "check" the range but isolates all pages that
  	 * need migration.  Between passing in the full user address
  	 * space range and MPOL_MF_DISCONTIG_OK, this call can not fail.
  	 */
  	VM_BUG_ON(!(flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)));

  	queue_pages_range(mm, mm->mmap->vm_start, mm->task_size, &nmask,

  			flags | MPOL_MF_DISCONTIG_OK, &pagelist);

  	if (!list_empty(&pagelist)) {

  		err = migrate_pages(&pagelist, alloc_migration_target, NULL,

  				(unsigned long)&mtc, MIGRATE_SYNC, MR_SYSCALL, NULL);

  		if (err)

  			putback_movable_pages(&pagelist);

  	}

  	return err;

  }
  
  /*

   * Move pages between the two nodesets so as to preserve the physical
   * layout as much as possible.

   *
   * Returns the number of page that could not be moved.
   */

  int do_migrate_pages(struct mm_struct *mm, const nodemask_t *from,
  		     const nodemask_t *to, int flags)

  {

  	int busy = 0;

  	int err = 0;

  	nodemask_t tmp;

  	lru_cache_disable();

  	mmap_read_lock(mm);

  	/*
  	 * Find a 'source' bit set in 'tmp' whose corresponding 'dest'
  	 * bit in 'to' is not also set in 'tmp'.  Clear the found 'source'
  	 * bit in 'tmp', and return that <source, dest> pair for migration.
  	 * The pair of nodemasks 'to' and 'from' define the map.
  	 *
  	 * If no pair of bits is found that way, fallback to picking some
  	 * pair of 'source' and 'dest' bits that are not the same.  If the
  	 * 'source' and 'dest' bits are the same, this represents a node
  	 * that will be migrating to itself, so no pages need move.
  	 *
  	 * If no bits are left in 'tmp', or if all remaining bits left
  	 * in 'tmp' correspond to the same bit in 'to', return false
  	 * (nothing left to migrate).
  	 *
  	 * This lets us pick a pair of nodes to migrate between, such that
  	 * if possible the dest node is not already occupied by some other
  	 * source node, minimizing the risk of overloading the memory on a
  	 * node that would happen if we migrated incoming memory to a node
  	 * before migrating outgoing memory source that same node.
  	 *
  	 * A single scan of tmp is sufficient.  As we go, we remember the
  	 * most recent <s, d> pair that moved (s != d).  If we find a pair
  	 * that not only moved, but what's better, moved to an empty slot
  	 * (d is not set in tmp), then we break out then, with that pair.

  	 * Otherwise when we finish scanning from_tmp, we at least have the

  	 * most recent <s, d> pair that moved.  If we get all the way through
  	 * the scan of tmp without finding any node that moved, much less
  	 * moved to an empty node, then there is nothing left worth migrating.
  	 */

  	tmp = *from;

  	while (!nodes_empty(tmp)) {

  		int s, d;

  		int source = NUMA_NO_NODE;

  		int dest = 0;
  
  		for_each_node_mask(s, tmp) {

  
  			/*
  			 * do_migrate_pages() tries to maintain the relative
  			 * node relationship of the pages established between
  			 * threads and memory areas.
                           *
  			 * However if the number of source nodes is not equal to
  			 * the number of destination nodes we can not preserve
  			 * this node relative relationship.  In that case, skip
  			 * copying memory from a node that is in the destination
  			 * mask.
  			 *
  			 * Example: [2,3,4] -> [3,4,5] moves everything.
  			 *          [0-7] - > [3,4,5] moves only 0,1,2,6,7.
  			 */

  			if ((nodes_weight(*from) != nodes_weight(*to)) &&
  						(node_isset(s, *to)))

  				continue;

  			d = node_remap(s, *from, *to);

  			if (s == d)
  				continue;
  
  			source = s;	/* Node moved. Memorize */
  			dest = d;
  
  			/* dest not in remaining from nodes? */
  			if (!node_isset(dest, tmp))
  				break;
  		}

  		if (source == NUMA_NO_NODE)

  			break;
  
  		node_clear(source, tmp);
  		err = migrate_to_node(mm, source, dest, flags);
  		if (err > 0)
  			busy += err;
  		if (err < 0)
  			break;

  	}

  	mmap_read_unlock(mm);

  	lru_cache_enable();

  	if (err < 0)
  		return err;
  	return busy;

  
  }

  /*
   * Allocate a new page for page migration based on vma policy.

   * Start by assuming the page is mapped by the same vma as contains @start.

   * Search forward from there, if not.  N.B., this assumes that the
   * list of pages handed to migrate_pages()--which is how we get here--
   * is in virtual address order.
   */

  static struct page *new_page(struct page *page, unsigned long start)

  {

  	struct vm_area_struct *vma;

  	unsigned long address;

  	vma = find_vma(current->mm, start);

  	while (vma) {
  		address = page_address_in_vma(page, vma);
  		if (address != -EFAULT)
  			break;
  		vma = vma->vm_next;
  	}

  
  	if (PageHuge(page)) {

  		return alloc_huge_page_vma(page_hstate(compound_head(page)),
  				vma, address);

  	} else if (PageTransHuge(page)) {

  		struct page *thp;

  		thp = alloc_hugepage_vma(GFP_TRANSHUGE, vma, address,
  					 HPAGE_PMD_ORDER);

  		if (!thp)
  			return NULL;
  		prep_transhuge_page(thp);
  		return thp;

  	}

  	/*

  	 * if !vma, alloc_page_vma() will use task or system default policy

  	 */

  	return alloc_page_vma(GFP_HIGHUSER_MOVABLE | __GFP_RETRY_MAYFAIL,
  			vma, address);

  }

  #else

  static int migrate_page_add(struct page *page, struct list_head *pagelist,

  				unsigned long flags)
  {

  	return -EIO;

  }

  int do_migrate_pages(struct mm_struct *mm, const nodemask_t *from,
  		     const nodemask_t *to, int flags)

  {
  	return -ENOSYS;
  }

  static struct page *new_page(struct page *page, unsigned long start)

  {
  	return NULL;
  }

  #endif

  static long do_mbind(unsigned long start, unsigned long len,

  		     unsigned short mode, unsigned short mode_flags,
  		     nodemask_t *nmask, unsigned long flags)

  {

  	struct mm_struct *mm = current->mm;
  	struct mempolicy *new;
  	unsigned long end;
  	int err;

  	int ret;

  	LIST_HEAD(pagelist);

  	if (flags & ~(unsigned long)MPOL_MF_VALID)

  		return -EINVAL;

  	if ((flags & MPOL_MF_MOVE_ALL) && !capable(CAP_SYS_NICE))

  		return -EPERM;
  
  	if (start & ~PAGE_MASK)
  		return -EINVAL;
  
  	if (mode == MPOL_DEFAULT)
  		flags &= ~MPOL_MF_STRICT;
  
  	len = (len + PAGE_SIZE - 1) & PAGE_MASK;
  	end = start + len;
  
  	if (end < start)
  		return -EINVAL;
  	if (end == start)
  		return 0;

  	new = mpol_new(mode, mode_flags, nmask);

  	if (IS_ERR(new))
  		return PTR_ERR(new);

  	if (flags & MPOL_MF_LAZY)
  		new->flags |= MPOL_F_MOF;

  	/*
  	 * If we are using the default policy then operation
  	 * on discontinuous address spaces is okay after all
  	 */
  	if (!new)
  		flags |= MPOL_MF_DISCONTIG_OK;

  	pr_debug("mbind %lx-%lx mode:%d flags:%d nodes:%lx
  ",
  		 start, start + len, mode, mode_flags,

  		 nmask ? nodes_addr(*nmask)[0] : NUMA_NO_NODE);

  	if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {

  		lru_cache_disable();

  	}

  	{
  		NODEMASK_SCRATCH(scratch);
  		if (scratch) {

  			mmap_write_lock(mm);

  			err = mpol_set_nodemask(new, nmask, scratch);

  			if (err)

  				mmap_write_unlock(mm);

  		} else
  			err = -ENOMEM;
  		NODEMASK_SCRATCH_FREE(scratch);
  	}

  	if (err)
  		goto mpol_out;

  	ret = queue_pages_range(mm, start, end, nmask,

  			  flags | MPOL_MF_INVERT, &pagelist);

  
  	if (ret < 0) {

  		err = ret;

  		goto up_out;
  	}
  
  	err = mbind_range(mm, start, end, new);

  	if (!err) {
  		int nr_failed = 0;

  		if (!list_empty(&pagelist)) {

  			WARN_ON_ONCE(flags & MPOL_MF_LAZY);

  			nr_failed = migrate_pages(&pagelist, new_page, NULL,

  				start, MIGRATE_SYNC, MR_MEMPOLICY_MBIND, NULL);

  			if (nr_failed)

  				putback_movable_pages(&pagelist);

  		}

  		if ((ret > 0) || (nr_failed && (flags & MPOL_MF_STRICT)))

  			err = -EIO;

  	} else {

  up_out:

  		if (!list_empty(&pagelist))
  			putback_movable_pages(&pagelist);
  	}

  	mmap_write_unlock(mm);

  mpol_out:

  	mpol_put(new);

  	if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))

  		lru_cache_enable();

  	return err;
  }

  /*

   * User space interface with variable sized bitmaps for nodelists.
   */

  static int get_bitmap(unsigned long *mask, const unsigned long __user *nmask,
  		      unsigned long maxnode)
  {
  	unsigned long nlongs = BITS_TO_LONGS(maxnode);
  	int ret;
  
  	if (in_compat_syscall())
  		ret = compat_get_bitmap(mask,
  					(const compat_ulong_t __user *)nmask,
  					maxnode);
  	else
  		ret = copy_from_user(mask, nmask,
  				     nlongs * sizeof(unsigned long));
  
  	if (ret)
  		return -EFAULT;
  
  	if (maxnode % BITS_PER_LONG)
  		mask[nlongs - 1] &= (1UL << (maxnode % BITS_PER_LONG)) - 1;
  
  	return 0;
  }

  
  /* Copy a node mask from user space. */

  static int get_nodes(nodemask_t *nodes, const unsigned long __user *nmask,

  		     unsigned long maxnode)
  {

  	--maxnode;
  	nodes_clear(*nodes);
  	if (maxnode == 0 || !nmask)
  		return 0;

  	if (maxnode > PAGE_SIZE*BITS_PER_BYTE)

  		return -EINVAL;

  	/*
  	 * When the user specified more nodes than supported just check

  	 * if the non supported part is all zero, one word at a time,
  	 * starting at the end.

  	 */

  	while (maxnode > MAX_NUMNODES) {
  		unsigned long bits = min_t(unsigned long, maxnode, BITS_PER_LONG);
  		unsigned long t;

  		if (get_bitmap(&t, &nmask[(maxnode - 1) / BITS_PER_LONG], bits))

  			return -EFAULT;

  
  		if (maxnode - bits >= MAX_NUMNODES) {
  			maxnode -= bits;
  		} else {
  			maxnode = MAX_NUMNODES;
  			t &= ~((1UL << (MAX_NUMNODES % BITS_PER_LONG)) - 1);
  		}
  		if (t)

  			return -EINVAL;
  	}

  	return get_bitmap(nodes_addr(*nodes), nmask, maxnode);

  }
  
  /* Copy a kernel node mask to user space */
  static int copy_nodes_to_user(unsigned long __user *mask, unsigned long maxnode,
  			      nodemask_t *nodes)
  {
  	unsigned long copy = ALIGN(maxnode-1, 64) / 8;

  	unsigned int nbytes = BITS_TO_LONGS(nr_node_ids) * sizeof(long);

  	bool compat = in_compat_syscall();
  
  	if (compat)
  		nbytes = BITS_TO_COMPAT_LONGS(nr_node_ids) * sizeof(compat_long_t);

  
  	if (copy > nbytes) {
  		if (copy > PAGE_SIZE)
  			return -EINVAL;
  		if (clear_user((char __user *)mask + nbytes, copy - nbytes))
  			return -EFAULT;
  		copy = nbytes;

  		maxnode = nr_node_ids;

  	}

  
  	if (compat)
  		return compat_put_bitmap((compat_ulong_t __user *)mask,
  					 nodes_addr(*nodes), maxnode);

  	return copy_to_user(mask, nodes_addr(*nodes), copy) ? -EFAULT : 0;
  }

  /* Basic parameter sanity check used by both mbind() and set_mempolicy() */
  static inline int sanitize_mpol_flags(int *mode, unsigned short *flags)
  {
  	*flags = *mode & MPOL_MODE_FLAGS;
  	*mode &= ~MPOL_MODE_FLAGS;

  	if ((unsigned int)(*mode) >=  MPOL_MAX)

  		return -EINVAL;
  	if ((*flags & MPOL_F_STATIC_NODES) && (*flags & MPOL_F_RELATIVE_NODES))
  		return -EINVAL;