3 files changed, 31 insertions, 14 deletions

diff --git a/mm/ksm.c b/mm/ksm.c
index ecbc090cdaad..ae539f0b8aa1 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -709,15 +709,22 @@ static int write_protect_page(struct vm_area_struct *vma, struct page *page,
         spinlock_t *ptl;
         int swapped;
         int err = -EFAULT;
+        unsigned long mmun_start;       /* For mmu_notifiers */
+        unsigned long mmun_end;         /* For mmu_notifiers */
 
         addr = page_address_in_vma(page, vma);
         if (addr == -EFAULT)
                 goto out;
 
         BUG_ON(PageTransCompound(page));
+
+        mmun_start = addr;
+        mmun_end   = addr + PAGE_SIZE;
+        mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
+
         ptep = page_check_address(page, mm, addr, &ptl, 0);
         if (!ptep)
-                goto out;
+                goto out_mn;
 
         if (pte_write(*ptep) || pte_dirty(*ptep)) {
                 pte_t entry;
@@ -752,6 +759,8 @@ static int write_protect_page(struct vm_area_struct *vma, struct page *page,
 
 out_unlock:
         pte_unmap_unlock(ptep, ptl);
+out_mn:
+        mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
 out:
         return err;
 }
@@ -776,6 +785,8 @@ static int replace_page(struct vm_area_struct *vma, struct page *page,
         spinlock_t *ptl;
         unsigned long addr;
         int err = -EFAULT;
+        unsigned long mmun_start;       /* For mmu_notifiers */
+        unsigned long mmun_end;         /* For mmu_notifiers */
 
         addr = page_address_in_vma(page, vma);
         if (addr == -EFAULT)
@@ -794,10 +805,14 @@ static int replace_page(struct vm_area_struct *vma, struct page *page,
         if (!pmd_present(*pmd))
                 goto out;
 
+        mmun_start = addr;
+        mmun_end   = addr + PAGE_SIZE;
+        mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
+
         ptep = pte_offset_map_lock(mm, pmd, addr, &ptl);
         if (!pte_same(*ptep, orig_pte)) {
                 pte_unmap_unlock(ptep, ptl);
-                goto out;
+                goto out_mn;
         }
 
         get_page(kpage);
@@ -814,6 +829,8 @@ static int replace_page(struct vm_area_struct *vma, struct page *page,
 
         pte_unmap_unlock(ptep, ptl);
         err = 0;
+out_mn:
+        mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
 out:
         return err;
 }
diff --git a/mm/memory.c b/mm/memory.c
index b03a4a21c1d0..01ec048ece8b 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2527,6 +2527,9 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
         int ret = 0;
         int page_mkwrite = 0;
         struct page *dirty_page = NULL;
+        unsigned long mmun_start;       /* For mmu_notifiers */
+        unsigned long mmun_end;         /* For mmu_notifiers */
+        bool mmun_called = false;       /* For mmu_notifiers */
 
         old_page = vm_normal_page(vma, address, orig_pte);
         if (!old_page) {
@@ -2704,6 +2707,11 @@ gotten:
         if (mem_cgroup_newpage_charge(new_page, mm, GFP_KERNEL))
                 goto oom_free_new;
 
+        mmun_start  = address & PAGE_MASK;
+        mmun_end    = (address & PAGE_MASK) + PAGE_SIZE;
+        mmun_called = true;
+        mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
+
         /*
          * Re-check the pte - we dropped the lock
          */
@@ -2766,14 +2774,12 @@ gotten:
         } else
                 mem_cgroup_uncharge_page(new_page);
 
+        if (new_page)
+                page_cache_release(new_page);
 unlock:
         pte_unmap_unlock(page_table, ptl);
-        if (new_page) {
-                if (new_page == old_page)
-                        /* cow happened, notify before releasing old_page */
-                        mmu_notifier_invalidate_page(mm, address);
-                page_cache_release(new_page);
-        }
+        if (mmun_called)
+                mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
         if (old_page) {
                 /*
                  * Don't let another task, with possibly unlocked vma,
diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c
index c297142f0fe6..479a1e751a73 100644
--- a/mm/mmu_notifier.c
+++ b/mm/mmu_notifier.c
@@ -137,12 +137,6 @@ void __mmu_notifier_change_pte(struct mm_struct *mm, unsigned long address,
         hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist) {
                 if (mn->ops->change_pte)
                         mn->ops->change_pte(mn, mm, address, pte);
-                /*
-                 * Some drivers don't have change_pte,
-                 * so we must call invalidate_page in that case.
-                 */
-                else if (mn->ops->invalidate_page)
-                        mn->ops->invalidate_page(mn, mm, address);
         }
         srcu_read_unlock(&srcu, id);
 }