xref: /linux/arch/powerpc/lib/code-patching.c (revision bdaedca74d6293b6ac643a8ebe8231b52bf1171b)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *  Copyright 2008 Michael Ellerman, IBM Corporation.
4  */
5 
6 #include <linux/kernel.h>
7 #include <linux/kprobes.h>
8 #include <linux/vmalloc.h>
9 #include <linux/init.h>
10 #include <linux/mm.h>
11 #include <linux/cpuhotplug.h>
12 #include <linux/slab.h>
13 #include <linux/uaccess.h>
14 
15 #include <asm/tlbflush.h>
16 #include <asm/page.h>
17 #include <asm/code-patching.h>
18 #include <asm/setup.h>
19 #include <asm/inst.h>
20 
21 static int __patch_instruction(struct ppc_inst *exec_addr, struct ppc_inst instr,
22 			       struct ppc_inst *patch_addr)
23 {
24 	if (!ppc_inst_prefixed(instr)) {
25 		u32 val = ppc_inst_val(instr);
26 
27 		__put_kernel_nofault(patch_addr, &val, u32, failed);
28 	} else {
29 		u64 val = ppc_inst_as_ulong(instr);
30 
31 		__put_kernel_nofault(patch_addr, &val, u64, failed);
32 	}
33 
34 	asm ("dcbst 0, %0; sync; icbi 0,%1; sync; isync" :: "r" (patch_addr),
35 							    "r" (exec_addr));
36 
37 	return 0;
38 
39 failed:
40 	return -EFAULT;
41 }
42 
43 int raw_patch_instruction(struct ppc_inst *addr, struct ppc_inst instr)
44 {
45 	return __patch_instruction(addr, instr, addr);
46 }
47 
48 #ifdef CONFIG_STRICT_KERNEL_RWX
49 static DEFINE_PER_CPU(struct vm_struct *, text_poke_area);
50 
51 static int text_area_cpu_up(unsigned int cpu)
52 {
53 	struct vm_struct *area;
54 
55 	area = get_vm_area(PAGE_SIZE, VM_ALLOC);
56 	if (!area) {
57 		WARN_ONCE(1, "Failed to create text area for cpu %d\n",
58 			cpu);
59 		return -1;
60 	}
61 	this_cpu_write(text_poke_area, area);
62 
63 	return 0;
64 }
65 
66 static int text_area_cpu_down(unsigned int cpu)
67 {
68 	free_vm_area(this_cpu_read(text_poke_area));
69 	return 0;
70 }
71 
72 /*
73  * Run as a late init call. This allows all the boot time patching to be done
74  * simply by patching the code, and then we're called here prior to
75  * mark_rodata_ro(), which happens after all init calls are run. Although
76  * BUG_ON() is rude, in this case it should only happen if ENOMEM, and we judge
77  * it as being preferable to a kernel that will crash later when someone tries
78  * to use patch_instruction().
79  */
80 static int __init setup_text_poke_area(void)
81 {
82 	BUG_ON(!cpuhp_setup_state(CPUHP_AP_ONLINE_DYN,
83 		"powerpc/text_poke:online", text_area_cpu_up,
84 		text_area_cpu_down));
85 
86 	return 0;
87 }
88 late_initcall(setup_text_poke_area);
89 
90 /*
91  * This can be called for kernel text or a module.
92  */
93 static int map_patch_area(void *addr, unsigned long text_poke_addr)
94 {
95 	unsigned long pfn;
96 	int err;
97 
98 	if (is_vmalloc_or_module_addr(addr))
99 		pfn = vmalloc_to_pfn(addr);
100 	else
101 		pfn = __pa_symbol(addr) >> PAGE_SHIFT;
102 
103 	err = map_kernel_page(text_poke_addr, (pfn << PAGE_SHIFT), PAGE_KERNEL);
104 
105 	pr_devel("Mapped addr %lx with pfn %lx:%d\n", text_poke_addr, pfn, err);
106 	if (err)
107 		return -1;
108 
109 	return 0;
110 }
111 
112 static inline int unmap_patch_area(unsigned long addr)
113 {
114 	pte_t *ptep;
115 	pmd_t *pmdp;
116 	pud_t *pudp;
117 	p4d_t *p4dp;
118 	pgd_t *pgdp;
119 
120 	pgdp = pgd_offset_k(addr);
121 	if (unlikely(!pgdp))
122 		return -EINVAL;
123 
124 	p4dp = p4d_offset(pgdp, addr);
125 	if (unlikely(!p4dp))
126 		return -EINVAL;
127 
128 	pudp = pud_offset(p4dp, addr);
129 	if (unlikely(!pudp))
130 		return -EINVAL;
131 
132 	pmdp = pmd_offset(pudp, addr);
133 	if (unlikely(!pmdp))
134 		return -EINVAL;
135 
136 	ptep = pte_offset_kernel(pmdp, addr);
137 	if (unlikely(!ptep))
138 		return -EINVAL;
139 
140 	pr_devel("clearing mm %p, pte %p, addr %lx\n", &init_mm, ptep, addr);
141 
142 	/*
143 	 * In hash, pte_clear flushes the tlb, in radix, we have to
144 	 */
145 	pte_clear(&init_mm, addr, ptep);
146 	flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
147 
148 	return 0;
149 }
150 
151 static int do_patch_instruction(struct ppc_inst *addr, struct ppc_inst instr)
152 {
153 	int err;
154 	struct ppc_inst *patch_addr = NULL;
155 	unsigned long flags;
156 	unsigned long text_poke_addr;
157 	unsigned long kaddr = (unsigned long)addr;
158 
159 	/*
160 	 * During early early boot patch_instruction is called
161 	 * when text_poke_area is not ready, but we still need
162 	 * to allow patching. We just do the plain old patching
163 	 */
164 	if (!this_cpu_read(text_poke_area))
165 		return raw_patch_instruction(addr, instr);
166 
167 	local_irq_save(flags);
168 
169 	text_poke_addr = (unsigned long)__this_cpu_read(text_poke_area)->addr;
170 	if (map_patch_area(addr, text_poke_addr)) {
171 		err = -1;
172 		goto out;
173 	}
174 
175 	patch_addr = (struct ppc_inst *)(text_poke_addr + (kaddr & ~PAGE_MASK));
176 
177 	__patch_instruction(addr, instr, patch_addr);
178 
179 	err = unmap_patch_area(text_poke_addr);
180 	if (err)
181 		pr_warn("failed to unmap %lx\n", text_poke_addr);
182 
183 out:
184 	local_irq_restore(flags);
185 
186 	return err;
187 }
188 #else /* !CONFIG_STRICT_KERNEL_RWX */
189 
190 static int do_patch_instruction(struct ppc_inst *addr, struct ppc_inst instr)
191 {
192 	return raw_patch_instruction(addr, instr);
193 }
194 
195 #endif /* CONFIG_STRICT_KERNEL_RWX */
196 
197 int patch_instruction(struct ppc_inst *addr, struct ppc_inst instr)
198 {
199 	/* Make sure we aren't patching a freed init section */
200 	if (init_mem_is_free && init_section_contains(addr, 4)) {
201 		pr_debug("Skipping init section patching addr: 0x%px\n", addr);
202 		return 0;
203 	}
204 	return do_patch_instruction(addr, instr);
205 }
206 NOKPROBE_SYMBOL(patch_instruction);
207 
208 int patch_branch(struct ppc_inst *addr, unsigned long target, int flags)
209 {
210 	struct ppc_inst instr;
211 
212 	create_branch(&instr, addr, target, flags);
213 	return patch_instruction(addr, instr);
214 }
215 
216 bool is_offset_in_branch_range(long offset)
217 {
218 	/*
219 	 * Powerpc branch instruction is :
220 	 *
221 	 *  0         6                 30   31
222 	 *  +---------+----------------+---+---+
223 	 *  | opcode  |     LI         |AA |LK |
224 	 *  +---------+----------------+---+---+
225 	 *  Where AA = 0 and LK = 0
226 	 *
227 	 * LI is a signed 24 bits integer. The real branch offset is computed
228 	 * by: imm32 = SignExtend(LI:'0b00', 32);
229 	 *
230 	 * So the maximum forward branch should be:
231 	 *   (0x007fffff << 2) = 0x01fffffc =  0x1fffffc
232 	 * The maximum backward branch should be:
233 	 *   (0xff800000 << 2) = 0xfe000000 = -0x2000000
234 	 */
235 	return (offset >= -0x2000000 && offset <= 0x1fffffc && !(offset & 0x3));
236 }
237 
238 /*
239  * Helper to check if a given instruction is a conditional branch
240  * Derived from the conditional checks in analyse_instr()
241  */
242 bool is_conditional_branch(struct ppc_inst instr)
243 {
244 	unsigned int opcode = ppc_inst_primary_opcode(instr);
245 
246 	if (opcode == 16)       /* bc, bca, bcl, bcla */
247 		return true;
248 	if (opcode == 19) {
249 		switch ((ppc_inst_val(instr) >> 1) & 0x3ff) {
250 		case 16:        /* bclr, bclrl */
251 		case 528:       /* bcctr, bcctrl */
252 		case 560:       /* bctar, bctarl */
253 			return true;
254 		}
255 	}
256 	return false;
257 }
258 NOKPROBE_SYMBOL(is_conditional_branch);
259 
260 int create_branch(struct ppc_inst *instr,
261 		  const struct ppc_inst *addr,
262 		  unsigned long target, int flags)
263 {
264 	long offset;
265 
266 	*instr = ppc_inst(0);
267 	offset = target;
268 	if (! (flags & BRANCH_ABSOLUTE))
269 		offset = offset - (unsigned long)addr;
270 
271 	/* Check we can represent the target in the instruction format */
272 	if (!is_offset_in_branch_range(offset))
273 		return 1;
274 
275 	/* Mask out the flags and target, so they don't step on each other. */
276 	*instr = ppc_inst(0x48000000 | (flags & 0x3) | (offset & 0x03FFFFFC));
277 
278 	return 0;
279 }
280 
281 int create_cond_branch(struct ppc_inst *instr, const struct ppc_inst *addr,
282 		       unsigned long target, int flags)
283 {
284 	long offset;
285 
286 	offset = target;
287 	if (! (flags & BRANCH_ABSOLUTE))
288 		offset = offset - (unsigned long)addr;
289 
290 	/* Check we can represent the target in the instruction format */
291 	if (offset < -0x8000 || offset > 0x7FFF || offset & 0x3)
292 		return 1;
293 
294 	/* Mask out the flags and target, so they don't step on each other. */
295 	*instr = ppc_inst(0x40000000 | (flags & 0x3FF0003) | (offset & 0xFFFC));
296 
297 	return 0;
298 }
299 
300 static unsigned int branch_opcode(struct ppc_inst instr)
301 {
302 	return ppc_inst_primary_opcode(instr) & 0x3F;
303 }
304 
305 static int instr_is_branch_iform(struct ppc_inst instr)
306 {
307 	return branch_opcode(instr) == 18;
308 }
309 
310 static int instr_is_branch_bform(struct ppc_inst instr)
311 {
312 	return branch_opcode(instr) == 16;
313 }
314 
315 int instr_is_relative_branch(struct ppc_inst instr)
316 {
317 	if (ppc_inst_val(instr) & BRANCH_ABSOLUTE)
318 		return 0;
319 
320 	return instr_is_branch_iform(instr) || instr_is_branch_bform(instr);
321 }
322 
323 int instr_is_relative_link_branch(struct ppc_inst instr)
324 {
325 	return instr_is_relative_branch(instr) && (ppc_inst_val(instr) & BRANCH_SET_LINK);
326 }
327 
328 static unsigned long branch_iform_target(const struct ppc_inst *instr)
329 {
330 	signed long imm;
331 
332 	imm = ppc_inst_val(*instr) & 0x3FFFFFC;
333 
334 	/* If the top bit of the immediate value is set this is negative */
335 	if (imm & 0x2000000)
336 		imm -= 0x4000000;
337 
338 	if ((ppc_inst_val(*instr) & BRANCH_ABSOLUTE) == 0)
339 		imm += (unsigned long)instr;
340 
341 	return (unsigned long)imm;
342 }
343 
344 static unsigned long branch_bform_target(const struct ppc_inst *instr)
345 {
346 	signed long imm;
347 
348 	imm = ppc_inst_val(*instr) & 0xFFFC;
349 
350 	/* If the top bit of the immediate value is set this is negative */
351 	if (imm & 0x8000)
352 		imm -= 0x10000;
353 
354 	if ((ppc_inst_val(*instr) & BRANCH_ABSOLUTE) == 0)
355 		imm += (unsigned long)instr;
356 
357 	return (unsigned long)imm;
358 }
359 
360 unsigned long branch_target(const struct ppc_inst *instr)
361 {
362 	if (instr_is_branch_iform(ppc_inst_read(instr)))
363 		return branch_iform_target(instr);
364 	else if (instr_is_branch_bform(ppc_inst_read(instr)))
365 		return branch_bform_target(instr);
366 
367 	return 0;
368 }
369 
370 int instr_is_branch_to_addr(const struct ppc_inst *instr, unsigned long addr)
371 {
372 	if (instr_is_branch_iform(ppc_inst_read(instr)) ||
373 	    instr_is_branch_bform(ppc_inst_read(instr)))
374 		return branch_target(instr) == addr;
375 
376 	return 0;
377 }
378 
379 int translate_branch(struct ppc_inst *instr, const struct ppc_inst *dest,
380 		     const struct ppc_inst *src)
381 {
382 	unsigned long target;
383 	target = branch_target(src);
384 
385 	if (instr_is_branch_iform(ppc_inst_read(src)))
386 		return create_branch(instr, dest, target,
387 				     ppc_inst_val(ppc_inst_read(src)));
388 	else if (instr_is_branch_bform(ppc_inst_read(src)))
389 		return create_cond_branch(instr, dest, target,
390 					  ppc_inst_val(ppc_inst_read(src)));
391 
392 	return 1;
393 }
394 
395 #ifdef CONFIG_PPC_BOOK3E_64
396 void __patch_exception(int exc, unsigned long addr)
397 {
398 	extern unsigned int interrupt_base_book3e;
399 	unsigned int *ibase = &interrupt_base_book3e;
400 
401 	/* Our exceptions vectors start with a NOP and -then- a branch
402 	 * to deal with single stepping from userspace which stops on
403 	 * the second instruction. Thus we need to patch the second
404 	 * instruction of the exception, not the first one
405 	 */
406 
407 	patch_branch((struct ppc_inst *)(ibase + (exc / 4) + 1), addr, 0);
408 }
409 #endif
410 
411 #ifdef CONFIG_CODE_PATCHING_SELFTEST
412 
413 static void __init test_trampoline(void)
414 {
415 	asm ("nop;\n");
416 }
417 
418 #define check(x)	\
419 	if (!(x)) printk("code-patching: test failed at line %d\n", __LINE__);
420 
421 static void __init test_branch_iform(void)
422 {
423 	int err;
424 	struct ppc_inst instr;
425 	unsigned long addr;
426 
427 	addr = (unsigned long)&instr;
428 
429 	/* The simplest case, branch to self, no flags */
430 	check(instr_is_branch_iform(ppc_inst(0x48000000)));
431 	/* All bits of target set, and flags */
432 	check(instr_is_branch_iform(ppc_inst(0x4bffffff)));
433 	/* High bit of opcode set, which is wrong */
434 	check(!instr_is_branch_iform(ppc_inst(0xcbffffff)));
435 	/* Middle bits of opcode set, which is wrong */
436 	check(!instr_is_branch_iform(ppc_inst(0x7bffffff)));
437 
438 	/* Simplest case, branch to self with link */
439 	check(instr_is_branch_iform(ppc_inst(0x48000001)));
440 	/* All bits of targets set */
441 	check(instr_is_branch_iform(ppc_inst(0x4bfffffd)));
442 	/* Some bits of targets set */
443 	check(instr_is_branch_iform(ppc_inst(0x4bff00fd)));
444 	/* Must be a valid branch to start with */
445 	check(!instr_is_branch_iform(ppc_inst(0x7bfffffd)));
446 
447 	/* Absolute branch to 0x100 */
448 	instr = ppc_inst(0x48000103);
449 	check(instr_is_branch_to_addr(&instr, 0x100));
450 	/* Absolute branch to 0x420fc */
451 	instr = ppc_inst(0x480420ff);
452 	check(instr_is_branch_to_addr(&instr, 0x420fc));
453 	/* Maximum positive relative branch, + 20MB - 4B */
454 	instr = ppc_inst(0x49fffffc);
455 	check(instr_is_branch_to_addr(&instr, addr + 0x1FFFFFC));
456 	/* Smallest negative relative branch, - 4B */
457 	instr = ppc_inst(0x4bfffffc);
458 	check(instr_is_branch_to_addr(&instr, addr - 4));
459 	/* Largest negative relative branch, - 32 MB */
460 	instr = ppc_inst(0x4a000000);
461 	check(instr_is_branch_to_addr(&instr, addr - 0x2000000));
462 
463 	/* Branch to self, with link */
464 	err = create_branch(&instr, &instr, addr, BRANCH_SET_LINK);
465 	check(instr_is_branch_to_addr(&instr, addr));
466 
467 	/* Branch to self - 0x100, with link */
468 	err = create_branch(&instr, &instr, addr - 0x100, BRANCH_SET_LINK);
469 	check(instr_is_branch_to_addr(&instr, addr - 0x100));
470 
471 	/* Branch to self + 0x100, no link */
472 	err = create_branch(&instr, &instr, addr + 0x100, 0);
473 	check(instr_is_branch_to_addr(&instr, addr + 0x100));
474 
475 	/* Maximum relative negative offset, - 32 MB */
476 	err = create_branch(&instr, &instr, addr - 0x2000000, BRANCH_SET_LINK);
477 	check(instr_is_branch_to_addr(&instr, addr - 0x2000000));
478 
479 	/* Out of range relative negative offset, - 32 MB + 4*/
480 	err = create_branch(&instr, &instr, addr - 0x2000004, BRANCH_SET_LINK);
481 	check(err);
482 
483 	/* Out of range relative positive offset, + 32 MB */
484 	err = create_branch(&instr, &instr, addr + 0x2000000, BRANCH_SET_LINK);
485 	check(err);
486 
487 	/* Unaligned target */
488 	err = create_branch(&instr, &instr, addr + 3, BRANCH_SET_LINK);
489 	check(err);
490 
491 	/* Check flags are masked correctly */
492 	err = create_branch(&instr, &instr, addr, 0xFFFFFFFC);
493 	check(instr_is_branch_to_addr(&instr, addr));
494 	check(ppc_inst_equal(instr, ppc_inst(0x48000000)));
495 }
496 
497 static void __init test_create_function_call(void)
498 {
499 	struct ppc_inst *iptr;
500 	unsigned long dest;
501 	struct ppc_inst instr;
502 
503 	/* Check we can create a function call */
504 	iptr = (struct ppc_inst *)ppc_function_entry(test_trampoline);
505 	dest = ppc_function_entry(test_create_function_call);
506 	create_branch(&instr, iptr, dest, BRANCH_SET_LINK);
507 	patch_instruction(iptr, instr);
508 	check(instr_is_branch_to_addr(iptr, dest));
509 }
510 
511 static void __init test_branch_bform(void)
512 {
513 	int err;
514 	unsigned long addr;
515 	struct ppc_inst *iptr, instr;
516 	unsigned int flags;
517 
518 	iptr = &instr;
519 	addr = (unsigned long)iptr;
520 
521 	/* The simplest case, branch to self, no flags */
522 	check(instr_is_branch_bform(ppc_inst(0x40000000)));
523 	/* All bits of target set, and flags */
524 	check(instr_is_branch_bform(ppc_inst(0x43ffffff)));
525 	/* High bit of opcode set, which is wrong */
526 	check(!instr_is_branch_bform(ppc_inst(0xc3ffffff)));
527 	/* Middle bits of opcode set, which is wrong */
528 	check(!instr_is_branch_bform(ppc_inst(0x7bffffff)));
529 
530 	/* Absolute conditional branch to 0x100 */
531 	instr = ppc_inst(0x43ff0103);
532 	check(instr_is_branch_to_addr(&instr, 0x100));
533 	/* Absolute conditional branch to 0x20fc */
534 	instr = ppc_inst(0x43ff20ff);
535 	check(instr_is_branch_to_addr(&instr, 0x20fc));
536 	/* Maximum positive relative conditional branch, + 32 KB - 4B */
537 	instr = ppc_inst(0x43ff7ffc);
538 	check(instr_is_branch_to_addr(&instr, addr + 0x7FFC));
539 	/* Smallest negative relative conditional branch, - 4B */
540 	instr = ppc_inst(0x43fffffc);
541 	check(instr_is_branch_to_addr(&instr, addr - 4));
542 	/* Largest negative relative conditional branch, - 32 KB */
543 	instr = ppc_inst(0x43ff8000);
544 	check(instr_is_branch_to_addr(&instr, addr - 0x8000));
545 
546 	/* All condition code bits set & link */
547 	flags = 0x3ff000 | BRANCH_SET_LINK;
548 
549 	/* Branch to self */
550 	err = create_cond_branch(&instr, iptr, addr, flags);
551 	check(instr_is_branch_to_addr(&instr, addr));
552 
553 	/* Branch to self - 0x100 */
554 	err = create_cond_branch(&instr, iptr, addr - 0x100, flags);
555 	check(instr_is_branch_to_addr(&instr, addr - 0x100));
556 
557 	/* Branch to self + 0x100 */
558 	err = create_cond_branch(&instr, iptr, addr + 0x100, flags);
559 	check(instr_is_branch_to_addr(&instr, addr + 0x100));
560 
561 	/* Maximum relative negative offset, - 32 KB */
562 	err = create_cond_branch(&instr, iptr, addr - 0x8000, flags);
563 	check(instr_is_branch_to_addr(&instr, addr - 0x8000));
564 
565 	/* Out of range relative negative offset, - 32 KB + 4*/
566 	err = create_cond_branch(&instr, iptr, addr - 0x8004, flags);
567 	check(err);
568 
569 	/* Out of range relative positive offset, + 32 KB */
570 	err = create_cond_branch(&instr, iptr, addr + 0x8000, flags);
571 	check(err);
572 
573 	/* Unaligned target */
574 	err = create_cond_branch(&instr, iptr, addr + 3, flags);
575 	check(err);
576 
577 	/* Check flags are masked correctly */
578 	err = create_cond_branch(&instr, iptr, addr, 0xFFFFFFFC);
579 	check(instr_is_branch_to_addr(&instr, addr));
580 	check(ppc_inst_equal(instr, ppc_inst(0x43FF0000)));
581 }
582 
583 static void __init test_translate_branch(void)
584 {
585 	unsigned long addr;
586 	void *p, *q;
587 	struct ppc_inst instr;
588 	void *buf;
589 
590 	buf = vmalloc(PAGE_ALIGN(0x2000000 + 1));
591 	check(buf);
592 	if (!buf)
593 		return;
594 
595 	/* Simple case, branch to self moved a little */
596 	p = buf;
597 	addr = (unsigned long)p;
598 	patch_branch(p, addr, 0);
599 	check(instr_is_branch_to_addr(p, addr));
600 	q = p + 4;
601 	translate_branch(&instr, q, p);
602 	patch_instruction(q, instr);
603 	check(instr_is_branch_to_addr(q, addr));
604 
605 	/* Maximum negative case, move b . to addr + 32 MB */
606 	p = buf;
607 	addr = (unsigned long)p;
608 	patch_branch(p, addr, 0);
609 	q = buf + 0x2000000;
610 	translate_branch(&instr, q, p);
611 	patch_instruction(q, instr);
612 	check(instr_is_branch_to_addr(p, addr));
613 	check(instr_is_branch_to_addr(q, addr));
614 	check(ppc_inst_equal(ppc_inst_read(q), ppc_inst(0x4a000000)));
615 
616 	/* Maximum positive case, move x to x - 32 MB + 4 */
617 	p = buf + 0x2000000;
618 	addr = (unsigned long)p;
619 	patch_branch(p, addr, 0);
620 	q = buf + 4;
621 	translate_branch(&instr, q, p);
622 	patch_instruction(q, instr);
623 	check(instr_is_branch_to_addr(p, addr));
624 	check(instr_is_branch_to_addr(q, addr));
625 	check(ppc_inst_equal(ppc_inst_read(q), ppc_inst(0x49fffffc)));
626 
627 	/* Jump to x + 16 MB moved to x + 20 MB */
628 	p = buf;
629 	addr = 0x1000000 + (unsigned long)buf;
630 	patch_branch(p, addr, BRANCH_SET_LINK);
631 	q = buf + 0x1400000;
632 	translate_branch(&instr, q, p);
633 	patch_instruction(q, instr);
634 	check(instr_is_branch_to_addr(p, addr));
635 	check(instr_is_branch_to_addr(q, addr));
636 
637 	/* Jump to x + 16 MB moved to x - 16 MB + 4 */
638 	p = buf + 0x1000000;
639 	addr = 0x2000000 + (unsigned long)buf;
640 	patch_branch(p, addr, 0);
641 	q = buf + 4;
642 	translate_branch(&instr, q, p);
643 	patch_instruction(q, instr);
644 	check(instr_is_branch_to_addr(p, addr));
645 	check(instr_is_branch_to_addr(q, addr));
646 
647 
648 	/* Conditional branch tests */
649 
650 	/* Simple case, branch to self moved a little */
651 	p = buf;
652 	addr = (unsigned long)p;
653 	create_cond_branch(&instr, p, addr, 0);
654 	patch_instruction(p, instr);
655 	check(instr_is_branch_to_addr(p, addr));
656 	q = buf + 4;
657 	translate_branch(&instr, q, p);
658 	patch_instruction(q, instr);
659 	check(instr_is_branch_to_addr(q, addr));
660 
661 	/* Maximum negative case, move b . to addr + 32 KB */
662 	p = buf;
663 	addr = (unsigned long)p;
664 	create_cond_branch(&instr, p, addr, 0xFFFFFFFC);
665 	patch_instruction(p, instr);
666 	q = buf + 0x8000;
667 	translate_branch(&instr, q, p);
668 	patch_instruction(q, instr);
669 	check(instr_is_branch_to_addr(p, addr));
670 	check(instr_is_branch_to_addr(q, addr));
671 	check(ppc_inst_equal(ppc_inst_read(q), ppc_inst(0x43ff8000)));
672 
673 	/* Maximum positive case, move x to x - 32 KB + 4 */
674 	p = buf + 0x8000;
675 	addr = (unsigned long)p;
676 	create_cond_branch(&instr, p, addr, 0xFFFFFFFC);
677 	patch_instruction(p, instr);
678 	q = buf + 4;
679 	translate_branch(&instr, q, p);
680 	patch_instruction(q, instr);
681 	check(instr_is_branch_to_addr(p, addr));
682 	check(instr_is_branch_to_addr(q, addr));
683 	check(ppc_inst_equal(ppc_inst_read(q), ppc_inst(0x43ff7ffc)));
684 
685 	/* Jump to x + 12 KB moved to x + 20 KB */
686 	p = buf;
687 	addr = 0x3000 + (unsigned long)buf;
688 	create_cond_branch(&instr, p, addr, BRANCH_SET_LINK);
689 	patch_instruction(p, instr);
690 	q = buf + 0x5000;
691 	translate_branch(&instr, q, p);
692 	patch_instruction(q, instr);
693 	check(instr_is_branch_to_addr(p, addr));
694 	check(instr_is_branch_to_addr(q, addr));
695 
696 	/* Jump to x + 8 KB moved to x - 8 KB + 4 */
697 	p = buf + 0x2000;
698 	addr = 0x4000 + (unsigned long)buf;
699 	create_cond_branch(&instr, p, addr, 0);
700 	patch_instruction(p, instr);
701 	q = buf + 4;
702 	translate_branch(&instr, q, p);
703 	patch_instruction(q, instr);
704 	check(instr_is_branch_to_addr(p, addr));
705 	check(instr_is_branch_to_addr(q, addr));
706 
707 	/* Free the buffer we were using */
708 	vfree(buf);
709 }
710 
711 #ifdef CONFIG_PPC64
712 static void __init test_prefixed_patching(void)
713 {
714 	extern unsigned int code_patching_test1[];
715 	extern unsigned int code_patching_test1_expected[];
716 	extern unsigned int end_code_patching_test1[];
717 
718 	__patch_instruction((struct ppc_inst *)code_patching_test1,
719 			    ppc_inst_prefix(OP_PREFIX << 26, 0x00000000),
720 			    (struct ppc_inst *)code_patching_test1);
721 
722 	check(!memcmp(code_patching_test1,
723 		      code_patching_test1_expected,
724 		      sizeof(unsigned int) *
725 		      (end_code_patching_test1 - code_patching_test1)));
726 }
727 #else
728 static inline void test_prefixed_patching(void) {}
729 #endif
730 
731 static int __init test_code_patching(void)
732 {
733 	printk(KERN_DEBUG "Running code patching self-tests ...\n");
734 
735 	test_branch_iform();
736 	test_branch_bform();
737 	test_create_function_call();
738 	test_translate_branch();
739 	test_prefixed_patching();
740 
741 	return 0;
742 }
743 late_initcall(test_code_patching);
744 
745 #endif /* CONFIG_CODE_PATCHING_SELFTEST */
746