1 files changed, 32 insertions, 8 deletions

diff --git a/mm/ksm.c b/mm/ksm.c
index 47c885368890..ae539f0b8aa1 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -709,15 +709,22 @@ static int write_protect_page(struct vm_area_struct *vma, struct page *page,
         spinlock_t *ptl;
         int swapped;
         int err = -EFAULT;
+        unsigned long mmun_start;       /* For mmu_notifiers */
+        unsigned long mmun_end;         /* For mmu_notifiers */
 
         addr = page_address_in_vma(page, vma);
         if (addr == -EFAULT)
                 goto out;
 
         BUG_ON(PageTransCompound(page));
+
+        mmun_start = addr;
+        mmun_end   = addr + PAGE_SIZE;
+        mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
+
         ptep = page_check_address(page, mm, addr, &ptl, 0);
         if (!ptep)
-                goto out;
+                goto out_mn;
 
         if (pte_write(*ptep) || pte_dirty(*ptep)) {
                 pte_t entry;
@@ -752,6 +759,8 @@ static int write_protect_page(struct vm_area_struct *vma, struct page *page,
 
 out_unlock:
         pte_unmap_unlock(ptep, ptl);
+out_mn:
+        mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
 out:
         return err;
 }
@@ -776,6 +785,8 @@ static int replace_page(struct vm_area_struct *vma, struct page *page,
         spinlock_t *ptl;
         unsigned long addr;
         int err = -EFAULT;
+        unsigned long mmun_start;       /* For mmu_notifiers */
+        unsigned long mmun_end;         /* For mmu_notifiers */
 
         addr = page_address_in_vma(page, vma);
         if (addr == -EFAULT)
@@ -794,10 +805,14 @@ static int replace_page(struct vm_area_struct *vma, struct page *page,
         if (!pmd_present(*pmd))
                 goto out;
 
+        mmun_start = addr;
+        mmun_end   = addr + PAGE_SIZE;
+        mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
+
         ptep = pte_offset_map_lock(mm, pmd, addr, &ptl);
         if (!pte_same(*ptep, orig_pte)) {
                 pte_unmap_unlock(ptep, ptl);
-                goto out;
+                goto out_mn;
         }
 
         get_page(kpage);
@@ -814,6 +829,8 @@ static int replace_page(struct vm_area_struct *vma, struct page *page,
 
         pte_unmap_unlock(ptep, ptl);
         err = 0;
+out_mn:
+        mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
 out:
         return err;
 }
@@ -1469,10 +1486,14 @@ int ksm_madvise(struct vm_area_struct *vma, unsigned long start,
                  */
                 if (*vm_flags & (VM_MERGEABLE | VM_SHARED  | VM_MAYSHARE   |
                                  VM_PFNMAP    | VM_IO      | VM_DONTEXPAND |
-                                 VM_RESERVED  | VM_HUGETLB | VM_INSERTPAGE |
-                                 VM_NONLINEAR | VM_MIXEDMAP | VM_SAO))
+                                 VM_HUGETLB | VM_NONLINEAR | VM_MIXEDMAP))
                         return 0;               /* just ignore the advice */
 
+#ifdef VM_SAO
+                if (*vm_flags & VM_SAO)
+                        return 0;
+#endif
+
                 if (!test_bit(MMF_VM_MERGEABLE, &mm->flags)) {
                         err = __ksm_enter(mm);
                         if (err)
@@ -1582,7 +1603,7 @@ struct page *ksm_does_need_to_copy(struct page *page,
                 SetPageSwapBacked(new_page);
                 __set_page_locked(new_page);
 
-                if (page_evictable(new_page, vma))
+                if (!mlocked_vma_newpage(vma, new_page))
                         lru_cache_add_lru(new_page, LRU_ACTIVE_ANON);
                 else
                         add_page_to_unevictable_list(new_page);
@@ -1614,7 +1635,8 @@ again:
                 struct vm_area_struct *vma;
 
                 anon_vma_lock(anon_vma);
-                list_for_each_entry(vmac, &anon_vma->head, same_anon_vma) {
+                anon_vma_interval_tree_foreach(vmac, &anon_vma->rb_root,
+                                               0, ULONG_MAX) {
                         vma = vmac->vma;
                         if (rmap_item->address < vma->vm_start ||
                             rmap_item->address >= vma->vm_end)
@@ -1667,7 +1689,8 @@ again:
                 struct vm_area_struct *vma;
 
                 anon_vma_lock(anon_vma);
-                list_for_each_entry(vmac, &anon_vma->head, same_anon_vma) {
+                anon_vma_interval_tree_foreach(vmac, &anon_vma->rb_root,
+                                               0, ULONG_MAX) {
                         vma = vmac->vma;
                         if (rmap_item->address < vma->vm_start ||
                             rmap_item->address >= vma->vm_end)
@@ -1719,7 +1742,8 @@ again:
                 struct vm_area_struct *vma;
 
                 anon_vma_lock(anon_vma);
-                list_for_each_entry(vmac, &anon_vma->head, same_anon_vma) {
+                anon_vma_interval_tree_foreach(vmac, &anon_vma->rb_root,
+                                               0, ULONG_MAX) {
                         vma = vmac->vma;
                         if (rmap_item->address < vma->vm_start ||
                             rmap_item->address >= vma->vm_end)