xref: /linux-6.15/arch/powerpc/lib/code-patching.c (revision 31acc599)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *  Copyright 2008 Michael Ellerman, IBM Corporation.
4  */
5 
6 #include <linux/kernel.h>
7 #include <linux/kprobes.h>
8 #include <linux/vmalloc.h>
9 #include <linux/init.h>
10 #include <linux/mm.h>
11 #include <linux/cpuhotplug.h>
12 #include <linux/slab.h>
13 #include <linux/uaccess.h>
14 
15 #include <asm/tlbflush.h>
16 #include <asm/page.h>
17 #include <asm/code-patching.h>
18 #include <asm/inst.h>
19 
20 static int __patch_instruction(u32 *exec_addr, ppc_inst_t instr, u32 *patch_addr)
21 {
22 	if (!ppc_inst_prefixed(instr)) {
23 		u32 val = ppc_inst_val(instr);
24 
25 		__put_kernel_nofault(patch_addr, &val, u32, failed);
26 	} else {
27 		u64 val = ppc_inst_as_ulong(instr);
28 
29 		__put_kernel_nofault(patch_addr, &val, u64, failed);
30 	}
31 
32 	asm ("dcbst 0, %0; sync; icbi 0,%1; sync; isync" :: "r" (patch_addr),
33 							    "r" (exec_addr));
34 
35 	return 0;
36 
37 failed:
38 	return -EFAULT;
39 }
40 
41 int raw_patch_instruction(u32 *addr, ppc_inst_t instr)
42 {
43 	return __patch_instruction(addr, instr, addr);
44 }
45 
46 #ifdef CONFIG_STRICT_KERNEL_RWX
47 static DEFINE_PER_CPU(struct vm_struct *, text_poke_area);
48 
49 static int text_area_cpu_up(unsigned int cpu)
50 {
51 	struct vm_struct *area;
52 
53 	area = get_vm_area(PAGE_SIZE, VM_ALLOC);
54 	if (!area) {
55 		WARN_ONCE(1, "Failed to create text area for cpu %d\n",
56 			cpu);
57 		return -1;
58 	}
59 	this_cpu_write(text_poke_area, area);
60 
61 	return 0;
62 }
63 
64 static int text_area_cpu_down(unsigned int cpu)
65 {
66 	free_vm_area(this_cpu_read(text_poke_area));
67 	return 0;
68 }
69 
70 /*
71  * Although BUG_ON() is rude, in this case it should only happen if ENOMEM, and
72  * we judge it as being preferable to a kernel that will crash later when
73  * someone tries to use patch_instruction().
74  */
75 void __init poking_init(void)
76 {
77 	BUG_ON(!cpuhp_setup_state(CPUHP_AP_ONLINE_DYN,
78 		"powerpc/text_poke:online", text_area_cpu_up,
79 		text_area_cpu_down));
80 }
81 
82 /*
83  * This can be called for kernel text or a module.
84  */
85 static int map_patch_area(void *addr, unsigned long text_poke_addr)
86 {
87 	unsigned long pfn;
88 
89 	if (is_vmalloc_or_module_addr(addr))
90 		pfn = vmalloc_to_pfn(addr);
91 	else
92 		pfn = __pa_symbol(addr) >> PAGE_SHIFT;
93 
94 	return map_kernel_page(text_poke_addr, (pfn << PAGE_SHIFT), PAGE_KERNEL);
95 }
96 
97 static void unmap_patch_area(unsigned long addr)
98 {
99 	pte_t *ptep;
100 	pmd_t *pmdp;
101 	pud_t *pudp;
102 	p4d_t *p4dp;
103 	pgd_t *pgdp;
104 
105 	pgdp = pgd_offset_k(addr);
106 	if (WARN_ON(pgd_none(*pgdp)))
107 		return;
108 
109 	p4dp = p4d_offset(pgdp, addr);
110 	if (WARN_ON(p4d_none(*p4dp)))
111 		return;
112 
113 	pudp = pud_offset(p4dp, addr);
114 	if (WARN_ON(pud_none(*pudp)))
115 		return;
116 
117 	pmdp = pmd_offset(pudp, addr);
118 	if (WARN_ON(pmd_none(*pmdp)))
119 		return;
120 
121 	ptep = pte_offset_kernel(pmdp, addr);
122 	if (WARN_ON(pte_none(*ptep)))
123 		return;
124 
125 	/*
126 	 * In hash, pte_clear flushes the tlb, in radix, we have to
127 	 */
128 	pte_clear(&init_mm, addr, ptep);
129 	flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
130 }
131 
132 static int __do_patch_instruction(u32 *addr, ppc_inst_t instr)
133 {
134 	int err;
135 	u32 *patch_addr;
136 	unsigned long text_poke_addr;
137 
138 	text_poke_addr = (unsigned long)__this_cpu_read(text_poke_area)->addr;
139 	patch_addr = (u32 *)(text_poke_addr + offset_in_page(addr));
140 
141 	err = map_patch_area(addr, text_poke_addr);
142 	if (err)
143 		return err;
144 
145 	err = __patch_instruction(addr, instr, patch_addr);
146 
147 	unmap_patch_area(text_poke_addr);
148 
149 	return err;
150 }
151 
152 static int do_patch_instruction(u32 *addr, ppc_inst_t instr)
153 {
154 	int err;
155 	unsigned long flags;
156 
157 	/*
158 	 * During early early boot patch_instruction is called
159 	 * when text_poke_area is not ready, but we still need
160 	 * to allow patching. We just do the plain old patching
161 	 */
162 	if (!this_cpu_read(text_poke_area))
163 		return raw_patch_instruction(addr, instr);
164 
165 	local_irq_save(flags);
166 	err = __do_patch_instruction(addr, instr);
167 	local_irq_restore(flags);
168 
169 	return err;
170 }
171 #else /* !CONFIG_STRICT_KERNEL_RWX */
172 
173 static int do_patch_instruction(u32 *addr, ppc_inst_t instr)
174 {
175 	return raw_patch_instruction(addr, instr);
176 }
177 
178 #endif /* CONFIG_STRICT_KERNEL_RWX */
179 
180 int patch_instruction(u32 *addr, ppc_inst_t instr)
181 {
182 	/* Make sure we aren't patching a freed init section */
183 	if (system_state >= SYSTEM_FREEING_INITMEM && init_section_contains(addr, 4))
184 		return 0;
185 
186 	return do_patch_instruction(addr, instr);
187 }
188 NOKPROBE_SYMBOL(patch_instruction);
189 
190 int patch_branch(u32 *addr, unsigned long target, int flags)
191 {
192 	ppc_inst_t instr;
193 
194 	if (create_branch(&instr, addr, target, flags))
195 		return -ERANGE;
196 
197 	return patch_instruction(addr, instr);
198 }
199 
200 bool is_offset_in_branch_range(long offset)
201 {
202 	/*
203 	 * Powerpc branch instruction is :
204 	 *
205 	 *  0         6                 30   31
206 	 *  +---------+----------------+---+---+
207 	 *  | opcode  |     LI         |AA |LK |
208 	 *  +---------+----------------+---+---+
209 	 *  Where AA = 0 and LK = 0
210 	 *
211 	 * LI is a signed 24 bits integer. The real branch offset is computed
212 	 * by: imm32 = SignExtend(LI:'0b00', 32);
213 	 *
214 	 * So the maximum forward branch should be:
215 	 *   (0x007fffff << 2) = 0x01fffffc =  0x1fffffc
216 	 * The maximum backward branch should be:
217 	 *   (0xff800000 << 2) = 0xfe000000 = -0x2000000
218 	 */
219 	return (offset >= -0x2000000 && offset <= 0x1fffffc && !(offset & 0x3));
220 }
221 
222 bool is_offset_in_cond_branch_range(long offset)
223 {
224 	return offset >= -0x8000 && offset <= 0x7fff && !(offset & 0x3);
225 }
226 
227 /*
228  * Helper to check if a given instruction is a conditional branch
229  * Derived from the conditional checks in analyse_instr()
230  */
231 bool is_conditional_branch(ppc_inst_t instr)
232 {
233 	unsigned int opcode = ppc_inst_primary_opcode(instr);
234 
235 	if (opcode == 16)       /* bc, bca, bcl, bcla */
236 		return true;
237 	if (opcode == 19) {
238 		switch ((ppc_inst_val(instr) >> 1) & 0x3ff) {
239 		case 16:        /* bclr, bclrl */
240 		case 528:       /* bcctr, bcctrl */
241 		case 560:       /* bctar, bctarl */
242 			return true;
243 		}
244 	}
245 	return false;
246 }
247 NOKPROBE_SYMBOL(is_conditional_branch);
248 
249 int create_branch(ppc_inst_t *instr, const u32 *addr,
250 		  unsigned long target, int flags)
251 {
252 	long offset;
253 
254 	*instr = ppc_inst(0);
255 	offset = target;
256 	if (! (flags & BRANCH_ABSOLUTE))
257 		offset = offset - (unsigned long)addr;
258 
259 	/* Check we can represent the target in the instruction format */
260 	if (!is_offset_in_branch_range(offset))
261 		return 1;
262 
263 	/* Mask out the flags and target, so they don't step on each other. */
264 	*instr = ppc_inst(0x48000000 | (flags & 0x3) | (offset & 0x03FFFFFC));
265 
266 	return 0;
267 }
268 
269 int create_cond_branch(ppc_inst_t *instr, const u32 *addr,
270 		       unsigned long target, int flags)
271 {
272 	long offset;
273 
274 	offset = target;
275 	if (! (flags & BRANCH_ABSOLUTE))
276 		offset = offset - (unsigned long)addr;
277 
278 	/* Check we can represent the target in the instruction format */
279 	if (!is_offset_in_cond_branch_range(offset))
280 		return 1;
281 
282 	/* Mask out the flags and target, so they don't step on each other. */
283 	*instr = ppc_inst(0x40000000 | (flags & 0x3FF0003) | (offset & 0xFFFC));
284 
285 	return 0;
286 }
287 
288 int instr_is_relative_branch(ppc_inst_t instr)
289 {
290 	if (ppc_inst_val(instr) & BRANCH_ABSOLUTE)
291 		return 0;
292 
293 	return instr_is_branch_iform(instr) || instr_is_branch_bform(instr);
294 }
295 
296 int instr_is_relative_link_branch(ppc_inst_t instr)
297 {
298 	return instr_is_relative_branch(instr) && (ppc_inst_val(instr) & BRANCH_SET_LINK);
299 }
300 
301 static unsigned long branch_iform_target(const u32 *instr)
302 {
303 	signed long imm;
304 
305 	imm = ppc_inst_val(ppc_inst_read(instr)) & 0x3FFFFFC;
306 
307 	/* If the top bit of the immediate value is set this is negative */
308 	if (imm & 0x2000000)
309 		imm -= 0x4000000;
310 
311 	if ((ppc_inst_val(ppc_inst_read(instr)) & BRANCH_ABSOLUTE) == 0)
312 		imm += (unsigned long)instr;
313 
314 	return (unsigned long)imm;
315 }
316 
317 static unsigned long branch_bform_target(const u32 *instr)
318 {
319 	signed long imm;
320 
321 	imm = ppc_inst_val(ppc_inst_read(instr)) & 0xFFFC;
322 
323 	/* If the top bit of the immediate value is set this is negative */
324 	if (imm & 0x8000)
325 		imm -= 0x10000;
326 
327 	if ((ppc_inst_val(ppc_inst_read(instr)) & BRANCH_ABSOLUTE) == 0)
328 		imm += (unsigned long)instr;
329 
330 	return (unsigned long)imm;
331 }
332 
333 unsigned long branch_target(const u32 *instr)
334 {
335 	if (instr_is_branch_iform(ppc_inst_read(instr)))
336 		return branch_iform_target(instr);
337 	else if (instr_is_branch_bform(ppc_inst_read(instr)))
338 		return branch_bform_target(instr);
339 
340 	return 0;
341 }
342 
343 int translate_branch(ppc_inst_t *instr, const u32 *dest, const u32 *src)
344 {
345 	unsigned long target;
346 	target = branch_target(src);
347 
348 	if (instr_is_branch_iform(ppc_inst_read(src)))
349 		return create_branch(instr, dest, target,
350 				     ppc_inst_val(ppc_inst_read(src)));
351 	else if (instr_is_branch_bform(ppc_inst_read(src)))
352 		return create_cond_branch(instr, dest, target,
353 					  ppc_inst_val(ppc_inst_read(src)));
354 
355 	return 1;
356 }
357 
358 #ifdef CONFIG_CODE_PATCHING_SELFTEST
359 
360 static int __init instr_is_branch_to_addr(const u32 *instr, unsigned long addr)
361 {
362 	if (instr_is_branch_iform(ppc_inst_read(instr)) ||
363 	    instr_is_branch_bform(ppc_inst_read(instr)))
364 		return branch_target(instr) == addr;
365 
366 	return 0;
367 }
368 
369 static void __init test_trampoline(void)
370 {
371 	asm ("nop;nop;\n");
372 }
373 
374 #define check(x)	do {	\
375 	if (!(x))		\
376 		pr_err("code-patching: test failed at line %d\n", __LINE__); \
377 } while (0)
378 
379 static void __init test_branch_iform(void)
380 {
381 	int err;
382 	ppc_inst_t instr;
383 	u32 tmp[2];
384 	u32 *iptr = tmp;
385 	unsigned long addr = (unsigned long)tmp;
386 
387 	/* The simplest case, branch to self, no flags */
388 	check(instr_is_branch_iform(ppc_inst(0x48000000)));
389 	/* All bits of target set, and flags */
390 	check(instr_is_branch_iform(ppc_inst(0x4bffffff)));
391 	/* High bit of opcode set, which is wrong */
392 	check(!instr_is_branch_iform(ppc_inst(0xcbffffff)));
393 	/* Middle bits of opcode set, which is wrong */
394 	check(!instr_is_branch_iform(ppc_inst(0x7bffffff)));
395 
396 	/* Simplest case, branch to self with link */
397 	check(instr_is_branch_iform(ppc_inst(0x48000001)));
398 	/* All bits of targets set */
399 	check(instr_is_branch_iform(ppc_inst(0x4bfffffd)));
400 	/* Some bits of targets set */
401 	check(instr_is_branch_iform(ppc_inst(0x4bff00fd)));
402 	/* Must be a valid branch to start with */
403 	check(!instr_is_branch_iform(ppc_inst(0x7bfffffd)));
404 
405 	/* Absolute branch to 0x100 */
406 	patch_instruction(iptr, ppc_inst(0x48000103));
407 	check(instr_is_branch_to_addr(iptr, 0x100));
408 	/* Absolute branch to 0x420fc */
409 	patch_instruction(iptr, ppc_inst(0x480420ff));
410 	check(instr_is_branch_to_addr(iptr, 0x420fc));
411 	/* Maximum positive relative branch, + 20MB - 4B */
412 	patch_instruction(iptr, ppc_inst(0x49fffffc));
413 	check(instr_is_branch_to_addr(iptr, addr + 0x1FFFFFC));
414 	/* Smallest negative relative branch, - 4B */
415 	patch_instruction(iptr, ppc_inst(0x4bfffffc));
416 	check(instr_is_branch_to_addr(iptr, addr - 4));
417 	/* Largest negative relative branch, - 32 MB */
418 	patch_instruction(iptr, ppc_inst(0x4a000000));
419 	check(instr_is_branch_to_addr(iptr, addr - 0x2000000));
420 
421 	/* Branch to self, with link */
422 	err = create_branch(&instr, iptr, addr, BRANCH_SET_LINK);
423 	patch_instruction(iptr, instr);
424 	check(instr_is_branch_to_addr(iptr, addr));
425 
426 	/* Branch to self - 0x100, with link */
427 	err = create_branch(&instr, iptr, addr - 0x100, BRANCH_SET_LINK);
428 	patch_instruction(iptr, instr);
429 	check(instr_is_branch_to_addr(iptr, addr - 0x100));
430 
431 	/* Branch to self + 0x100, no link */
432 	err = create_branch(&instr, iptr, addr + 0x100, 0);
433 	patch_instruction(iptr, instr);
434 	check(instr_is_branch_to_addr(iptr, addr + 0x100));
435 
436 	/* Maximum relative negative offset, - 32 MB */
437 	err = create_branch(&instr, iptr, addr - 0x2000000, BRANCH_SET_LINK);
438 	patch_instruction(iptr, instr);
439 	check(instr_is_branch_to_addr(iptr, addr - 0x2000000));
440 
441 	/* Out of range relative negative offset, - 32 MB + 4*/
442 	err = create_branch(&instr, iptr, addr - 0x2000004, BRANCH_SET_LINK);
443 	check(err);
444 
445 	/* Out of range relative positive offset, + 32 MB */
446 	err = create_branch(&instr, iptr, addr + 0x2000000, BRANCH_SET_LINK);
447 	check(err);
448 
449 	/* Unaligned target */
450 	err = create_branch(&instr, iptr, addr + 3, BRANCH_SET_LINK);
451 	check(err);
452 
453 	/* Check flags are masked correctly */
454 	err = create_branch(&instr, iptr, addr, 0xFFFFFFFC);
455 	patch_instruction(iptr, instr);
456 	check(instr_is_branch_to_addr(iptr, addr));
457 	check(ppc_inst_equal(instr, ppc_inst(0x48000000)));
458 }
459 
460 static void __init test_create_function_call(void)
461 {
462 	u32 *iptr;
463 	unsigned long dest;
464 	ppc_inst_t instr;
465 
466 	/* Check we can create a function call */
467 	iptr = (u32 *)ppc_function_entry(test_trampoline);
468 	dest = ppc_function_entry(test_create_function_call);
469 	create_branch(&instr, iptr, dest, BRANCH_SET_LINK);
470 	patch_instruction(iptr, instr);
471 	check(instr_is_branch_to_addr(iptr, dest));
472 }
473 
474 static void __init test_branch_bform(void)
475 {
476 	int err;
477 	unsigned long addr;
478 	ppc_inst_t instr;
479 	u32 tmp[2];
480 	u32 *iptr = tmp;
481 	unsigned int flags;
482 
483 	addr = (unsigned long)iptr;
484 
485 	/* The simplest case, branch to self, no flags */
486 	check(instr_is_branch_bform(ppc_inst(0x40000000)));
487 	/* All bits of target set, and flags */
488 	check(instr_is_branch_bform(ppc_inst(0x43ffffff)));
489 	/* High bit of opcode set, which is wrong */
490 	check(!instr_is_branch_bform(ppc_inst(0xc3ffffff)));
491 	/* Middle bits of opcode set, which is wrong */
492 	check(!instr_is_branch_bform(ppc_inst(0x7bffffff)));
493 
494 	/* Absolute conditional branch to 0x100 */
495 	patch_instruction(iptr, ppc_inst(0x43ff0103));
496 	check(instr_is_branch_to_addr(iptr, 0x100));
497 	/* Absolute conditional branch to 0x20fc */
498 	patch_instruction(iptr, ppc_inst(0x43ff20ff));
499 	check(instr_is_branch_to_addr(iptr, 0x20fc));
500 	/* Maximum positive relative conditional branch, + 32 KB - 4B */
501 	patch_instruction(iptr, ppc_inst(0x43ff7ffc));
502 	check(instr_is_branch_to_addr(iptr, addr + 0x7FFC));
503 	/* Smallest negative relative conditional branch, - 4B */
504 	patch_instruction(iptr, ppc_inst(0x43fffffc));
505 	check(instr_is_branch_to_addr(iptr, addr - 4));
506 	/* Largest negative relative conditional branch, - 32 KB */
507 	patch_instruction(iptr, ppc_inst(0x43ff8000));
508 	check(instr_is_branch_to_addr(iptr, addr - 0x8000));
509 
510 	/* All condition code bits set & link */
511 	flags = 0x3ff000 | BRANCH_SET_LINK;
512 
513 	/* Branch to self */
514 	err = create_cond_branch(&instr, iptr, addr, flags);
515 	patch_instruction(iptr, instr);
516 	check(instr_is_branch_to_addr(iptr, addr));
517 
518 	/* Branch to self - 0x100 */
519 	err = create_cond_branch(&instr, iptr, addr - 0x100, flags);
520 	patch_instruction(iptr, instr);
521 	check(instr_is_branch_to_addr(iptr, addr - 0x100));
522 
523 	/* Branch to self + 0x100 */
524 	err = create_cond_branch(&instr, iptr, addr + 0x100, flags);
525 	patch_instruction(iptr, instr);
526 	check(instr_is_branch_to_addr(iptr, addr + 0x100));
527 
528 	/* Maximum relative negative offset, - 32 KB */
529 	err = create_cond_branch(&instr, iptr, addr - 0x8000, flags);
530 	patch_instruction(iptr, instr);
531 	check(instr_is_branch_to_addr(iptr, addr - 0x8000));
532 
533 	/* Out of range relative negative offset, - 32 KB + 4*/
534 	err = create_cond_branch(&instr, iptr, addr - 0x8004, flags);
535 	check(err);
536 
537 	/* Out of range relative positive offset, + 32 KB */
538 	err = create_cond_branch(&instr, iptr, addr + 0x8000, flags);
539 	check(err);
540 
541 	/* Unaligned target */
542 	err = create_cond_branch(&instr, iptr, addr + 3, flags);
543 	check(err);
544 
545 	/* Check flags are masked correctly */
546 	err = create_cond_branch(&instr, iptr, addr, 0xFFFFFFFC);
547 	patch_instruction(iptr, instr);
548 	check(instr_is_branch_to_addr(iptr, addr));
549 	check(ppc_inst_equal(instr, ppc_inst(0x43FF0000)));
550 }
551 
552 static void __init test_translate_branch(void)
553 {
554 	unsigned long addr;
555 	void *p, *q;
556 	ppc_inst_t instr;
557 	void *buf;
558 
559 	buf = vmalloc(PAGE_ALIGN(0x2000000 + 1));
560 	check(buf);
561 	if (!buf)
562 		return;
563 
564 	/* Simple case, branch to self moved a little */
565 	p = buf;
566 	addr = (unsigned long)p;
567 	patch_branch(p, addr, 0);
568 	check(instr_is_branch_to_addr(p, addr));
569 	q = p + 4;
570 	translate_branch(&instr, q, p);
571 	patch_instruction(q, instr);
572 	check(instr_is_branch_to_addr(q, addr));
573 
574 	/* Maximum negative case, move b . to addr + 32 MB */
575 	p = buf;
576 	addr = (unsigned long)p;
577 	patch_branch(p, addr, 0);
578 	q = buf + 0x2000000;
579 	translate_branch(&instr, q, p);
580 	patch_instruction(q, instr);
581 	check(instr_is_branch_to_addr(p, addr));
582 	check(instr_is_branch_to_addr(q, addr));
583 	check(ppc_inst_equal(ppc_inst_read(q), ppc_inst(0x4a000000)));
584 
585 	/* Maximum positive case, move x to x - 32 MB + 4 */
586 	p = buf + 0x2000000;
587 	addr = (unsigned long)p;
588 	patch_branch(p, addr, 0);
589 	q = buf + 4;
590 	translate_branch(&instr, q, p);
591 	patch_instruction(q, instr);
592 	check(instr_is_branch_to_addr(p, addr));
593 	check(instr_is_branch_to_addr(q, addr));
594 	check(ppc_inst_equal(ppc_inst_read(q), ppc_inst(0x49fffffc)));
595 
596 	/* Jump to x + 16 MB moved to x + 20 MB */
597 	p = buf;
598 	addr = 0x1000000 + (unsigned long)buf;
599 	patch_branch(p, addr, BRANCH_SET_LINK);
600 	q = buf + 0x1400000;
601 	translate_branch(&instr, q, p);
602 	patch_instruction(q, instr);
603 	check(instr_is_branch_to_addr(p, addr));
604 	check(instr_is_branch_to_addr(q, addr));
605 
606 	/* Jump to x + 16 MB moved to x - 16 MB + 4 */
607 	p = buf + 0x1000000;
608 	addr = 0x2000000 + (unsigned long)buf;
609 	patch_branch(p, addr, 0);
610 	q = buf + 4;
611 	translate_branch(&instr, q, p);
612 	patch_instruction(q, instr);
613 	check(instr_is_branch_to_addr(p, addr));
614 	check(instr_is_branch_to_addr(q, addr));
615 
616 
617 	/* Conditional branch tests */
618 
619 	/* Simple case, branch to self moved a little */
620 	p = buf;
621 	addr = (unsigned long)p;
622 	create_cond_branch(&instr, p, addr, 0);
623 	patch_instruction(p, instr);
624 	check(instr_is_branch_to_addr(p, addr));
625 	q = buf + 4;
626 	translate_branch(&instr, q, p);
627 	patch_instruction(q, instr);
628 	check(instr_is_branch_to_addr(q, addr));
629 
630 	/* Maximum negative case, move b . to addr + 32 KB */
631 	p = buf;
632 	addr = (unsigned long)p;
633 	create_cond_branch(&instr, p, addr, 0xFFFFFFFC);
634 	patch_instruction(p, instr);
635 	q = buf + 0x8000;
636 	translate_branch(&instr, q, p);
637 	patch_instruction(q, instr);
638 	check(instr_is_branch_to_addr(p, addr));
639 	check(instr_is_branch_to_addr(q, addr));
640 	check(ppc_inst_equal(ppc_inst_read(q), ppc_inst(0x43ff8000)));
641 
642 	/* Maximum positive case, move x to x - 32 KB + 4 */
643 	p = buf + 0x8000;
644 	addr = (unsigned long)p;
645 	create_cond_branch(&instr, p, addr, 0xFFFFFFFC);
646 	patch_instruction(p, instr);
647 	q = buf + 4;
648 	translate_branch(&instr, q, p);
649 	patch_instruction(q, instr);
650 	check(instr_is_branch_to_addr(p, addr));
651 	check(instr_is_branch_to_addr(q, addr));
652 	check(ppc_inst_equal(ppc_inst_read(q), ppc_inst(0x43ff7ffc)));
653 
654 	/* Jump to x + 12 KB moved to x + 20 KB */
655 	p = buf;
656 	addr = 0x3000 + (unsigned long)buf;
657 	create_cond_branch(&instr, p, addr, BRANCH_SET_LINK);
658 	patch_instruction(p, instr);
659 	q = buf + 0x5000;
660 	translate_branch(&instr, q, p);
661 	patch_instruction(q, instr);
662 	check(instr_is_branch_to_addr(p, addr));
663 	check(instr_is_branch_to_addr(q, addr));
664 
665 	/* Jump to x + 8 KB moved to x - 8 KB + 4 */
666 	p = buf + 0x2000;
667 	addr = 0x4000 + (unsigned long)buf;
668 	create_cond_branch(&instr, p, addr, 0);
669 	patch_instruction(p, instr);
670 	q = buf + 4;
671 	translate_branch(&instr, q, p);
672 	patch_instruction(q, instr);
673 	check(instr_is_branch_to_addr(p, addr));
674 	check(instr_is_branch_to_addr(q, addr));
675 
676 	/* Free the buffer we were using */
677 	vfree(buf);
678 }
679 
680 static void __init test_prefixed_patching(void)
681 {
682 	u32 *iptr = (u32 *)ppc_function_entry(test_trampoline);
683 	u32 expected[2] = {OP_PREFIX << 26, 0};
684 	ppc_inst_t inst = ppc_inst_prefix(OP_PREFIX << 26, 0);
685 
686 	if (!IS_ENABLED(CONFIG_PPC64))
687 		return;
688 
689 	patch_instruction(iptr, inst);
690 
691 	check(!memcmp(iptr, expected, sizeof(expected)));
692 }
693 
694 static int __init test_code_patching(void)
695 {
696 	pr_info("Running code patching self-tests ...\n");
697 
698 	test_branch_iform();
699 	test_branch_bform();
700 	test_create_function_call();
701 	test_translate_branch();
702 	test_prefixed_patching();
703 
704 	return 0;
705 }
706 late_initcall(test_code_patching);
707 
708 #endif /* CONFIG_CODE_PATCHING_SELFTEST */
709