5 files changed, 114 insertions, 9 deletions

diff --git a/Documentation/vm/hwpoison.txt b/Documentation/vm/hwpoison.txt
index 3ffadf8da61f..f047e75acb23 100644
--- a/Documentation/vm/hwpoison.txt
+++ b/Documentation/vm/hwpoison.txt
@@ -98,10 +98,22 @@ madvise(MADV_POISON, ....)
 
 
 hwpoison-inject module through debugfs
-        /sys/debug/hwpoison/corrupt-pfn
 
-Inject hwpoison fault at PFN echoed into this file
+/sys/debug/hwpoison/
 
+corrupt-pfn
+
+Inject hwpoison fault at PFN echoed into this file.
+
+unpoison-pfn
+
+Software-unpoison page at PFN echoed into this file. This
+way a page can be reused again.
+This only works for Linux injected failures, not for real
+memory failures.
+
+Note these injection interfaces are not stable and might change between
+kernel versions
 
 Architecture specific MCE injector
 
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 135e19198cd3..8cdb941fc7b5 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1336,6 +1336,7 @@ enum mf_flags {
 };
 extern void memory_failure(unsigned long pfn, int trapno);
 extern int __memory_failure(unsigned long pfn, int trapno, int flags);
+extern int unpoison_memory(unsigned long pfn);
 extern int sysctl_memory_failure_early_kill;
 extern int sysctl_memory_failure_recovery;
 extern void shake_page(struct page *p);
diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index 49e907bd067f..f9df6308af95 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -275,7 +275,7 @@ PAGEFLAG_FALSE(Uncached)
 
 #ifdef CONFIG_MEMORY_FAILURE
 PAGEFLAG(HWPoison, hwpoison)
-TESTSETFLAG(HWPoison, hwpoison)
+TESTSCFLAG(HWPoison, hwpoison)
 #define __PG_HWPOISON (1UL << PG_hwpoison)
 #else
 PAGEFLAG_FALSE(HWPoison)
diff --git a/mm/hwpoison-inject.c b/mm/hwpoison-inject.c
index e1d85137f086..6e35e563bf50 100644
--- a/mm/hwpoison-inject.c
+++ b/mm/hwpoison-inject.c
@@ -4,7 +4,7 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 
-static struct dentry *hwpoison_dir, *corrupt_pfn;
+static struct dentry *hwpoison_dir;
 
 static int hwpoison_inject(void *data, u64 val)
 {
@@ -14,7 +14,16 @@ static int hwpoison_inject(void *data, u64 val)
         return __memory_failure(val, 18, 0);
 }
 
+static int hwpoison_unpoison(void *data, u64 val)
+{
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
+        return unpoison_memory(val);
+}
+
 DEFINE_SIMPLE_ATTRIBUTE(hwpoison_fops, NULL, hwpoison_inject, "%lli\n");
+DEFINE_SIMPLE_ATTRIBUTE(unpoison_fops, NULL, hwpoison_unpoison, "%lli\n");
 
 static void pfn_inject_exit(void)
 {
@@ -24,16 +33,31 @@ static void pfn_inject_exit(void)
 
 static int pfn_inject_init(void)
 {
+        struct dentry *dentry;
+
         hwpoison_dir = debugfs_create_dir("hwpoison", NULL);
         if (hwpoison_dir == NULL)
                 return -ENOMEM;
-        corrupt_pfn = debugfs_create_file("corrupt-pfn", 0600, hwpoison_dir,
+
+        /*
+         * Note that the below poison/unpoison interfaces do not involve
+         * hardware status change, hence do not require hardware support.
+         * They are mainly for testing hwpoison in software level.
+         */
+        dentry = debugfs_create_file("corrupt-pfn", 0600, hwpoison_dir,
                                           NULL, &hwpoison_fops);
-        if (corrupt_pfn == NULL) {
-                pfn_inject_exit();
-                return -ENOMEM;
-        }
+        if (!dentry)
+                goto fail;
+
+        dentry = debugfs_create_file("unpoison-pfn", 0600, hwpoison_dir,
+                                     NULL, &unpoison_fops);
+        if (!dentry)
+                goto fail;
+
         return 0;
+fail:
+        pfn_inject_exit();
+        return -ENOMEM;
 }
 
 module_init(pfn_inject_init);
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 5055b940df5f..ed6e91c87a54 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -838,6 +838,16 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
          * and in many cases impossible, so we just avoid it here.
          */
         lock_page_nosync(p);
+
+        /*
+         * unpoison always clear PG_hwpoison inside page lock
+         */
+        if (!PageHWPoison(p)) {
+                action_result(pfn, "unpoisoned", IGNORED);
+                res = 0;
+                goto out;
+        }
+
         wait_on_page_writeback(p);
 
         /*
@@ -893,3 +903,61 @@ void memory_failure(unsigned long pfn, int trapno)
 {
         __memory_failure(pfn, trapno, 0);
 }
+
+/**
+ * unpoison_memory - Unpoison a previously poisoned page
+ * @pfn: Page number of the to be unpoisoned page
+ *
+ * Software-unpoison a page that has been poisoned by
+ * memory_failure() earlier.
+ *
+ * This is only done on the software-level, so it only works
+ * for linux injected failures, not real hardware failures
+ *
+ * Returns 0 for success, otherwise -errno.
+ */
+int unpoison_memory(unsigned long pfn)
+{
+        struct page *page;
+        struct page *p;
+        int freeit = 0;
+
+        if (!pfn_valid(pfn))
+                return -ENXIO;
+
+        p = pfn_to_page(pfn);
+        page = compound_head(p);
+
+        if (!PageHWPoison(p)) {
+                pr_debug("MCE: Page was already unpoisoned %#lx\n", pfn);
+                return 0;
+        }
+
+        if (!get_page_unless_zero(page)) {
+                if (TestClearPageHWPoison(p))
+                        atomic_long_dec(&mce_bad_pages);
+                pr_debug("MCE: Software-unpoisoned free page %#lx\n", pfn);
+                return 0;
+        }
+
+        lock_page_nosync(page);
+        /*
+         * This test is racy because PG_hwpoison is set outside of page lock.
+         * That's acceptable because that won't trigger kernel panic. Instead,
+         * the PG_hwpoison page will be caught and isolated on the entrance to
+         * the free buddy page pool.
+         */
+        if (TestClearPageHWPoison(p)) {
+                pr_debug("MCE: Software-unpoisoned page %#lx\n", pfn);
+                atomic_long_dec(&mce_bad_pages);
+                freeit = 1;
+        }
+        unlock_page(page);
+
+        put_page(page);
+        if (freeit)
+                put_page(page);
+
+        return 0;
+}
+EXPORT_SYMBOL(unpoison_memory);