xref: /linux-6.15/arch/powerpc/lib/code-patching.c (revision 4546cde9)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *  Copyright 2008 Michael Ellerman, IBM Corporation.
4  */
5 
6 #include <linux/kernel.h>
7 #include <linux/kprobes.h>
8 #include <linux/vmalloc.h>
9 #include <linux/init.h>
10 #include <linux/mm.h>
11 #include <linux/cpuhotplug.h>
12 #include <linux/slab.h>
13 #include <linux/uaccess.h>
14 
15 #include <asm/pgtable.h>
16 #include <asm/tlbflush.h>
17 #include <asm/page.h>
18 #include <asm/code-patching.h>
19 #include <asm/setup.h>
20 #include <asm/inst.h>
21 
22 static int __patch_instruction(struct ppc_inst *exec_addr, struct ppc_inst instr,
23 			       struct ppc_inst *patch_addr)
24 {
25 	int err = 0;
26 
27 	if (!ppc_inst_prefixed(instr)) {
28 		__put_user_asm(ppc_inst_val(instr), patch_addr, err, "stw");
29 	} else {
30 		__put_user_asm(ppc_inst_as_u64(instr), patch_addr, err, "std");
31 	}
32 
33 	if (err)
34 		return err;
35 
36 	asm ("dcbst 0, %0; sync; icbi 0,%1; sync; isync" :: "r" (patch_addr),
37 							    "r" (exec_addr));
38 
39 	return 0;
40 }
41 
42 int raw_patch_instruction(struct ppc_inst *addr, struct ppc_inst instr)
43 {
44 	return __patch_instruction(addr, instr, addr);
45 }
46 
47 #ifdef CONFIG_STRICT_KERNEL_RWX
48 static DEFINE_PER_CPU(struct vm_struct *, text_poke_area);
49 
50 static int text_area_cpu_up(unsigned int cpu)
51 {
52 	struct vm_struct *area;
53 
54 	area = get_vm_area(PAGE_SIZE, VM_ALLOC);
55 	if (!area) {
56 		WARN_ONCE(1, "Failed to create text area for cpu %d\n",
57 			cpu);
58 		return -1;
59 	}
60 	this_cpu_write(text_poke_area, area);
61 
62 	return 0;
63 }
64 
65 static int text_area_cpu_down(unsigned int cpu)
66 {
67 	free_vm_area(this_cpu_read(text_poke_area));
68 	return 0;
69 }
70 
71 /*
72  * Run as a late init call. This allows all the boot time patching to be done
73  * simply by patching the code, and then we're called here prior to
74  * mark_rodata_ro(), which happens after all init calls are run. Although
75  * BUG_ON() is rude, in this case it should only happen if ENOMEM, and we judge
76  * it as being preferable to a kernel that will crash later when someone tries
77  * to use patch_instruction().
78  */
79 static int __init setup_text_poke_area(void)
80 {
81 	BUG_ON(!cpuhp_setup_state(CPUHP_AP_ONLINE_DYN,
82 		"powerpc/text_poke:online", text_area_cpu_up,
83 		text_area_cpu_down));
84 
85 	return 0;
86 }
87 late_initcall(setup_text_poke_area);
88 
89 /*
90  * This can be called for kernel text or a module.
91  */
92 static int map_patch_area(void *addr, unsigned long text_poke_addr)
93 {
94 	unsigned long pfn;
95 	int err;
96 
97 	if (is_vmalloc_addr(addr))
98 		pfn = vmalloc_to_pfn(addr);
99 	else
100 		pfn = __pa_symbol(addr) >> PAGE_SHIFT;
101 
102 	err = map_kernel_page(text_poke_addr, (pfn << PAGE_SHIFT), PAGE_KERNEL);
103 
104 	pr_devel("Mapped addr %lx with pfn %lx:%d\n", text_poke_addr, pfn, err);
105 	if (err)
106 		return -1;
107 
108 	return 0;
109 }
110 
111 static inline int unmap_patch_area(unsigned long addr)
112 {
113 	pte_t *ptep;
114 	pmd_t *pmdp;
115 	pud_t *pudp;
116 	p4d_t *p4dp;
117 	pgd_t *pgdp;
118 
119 	pgdp = pgd_offset_k(addr);
120 	if (unlikely(!pgdp))
121 		return -EINVAL;
122 
123 	p4dp = p4d_offset(pgdp, addr);
124 	if (unlikely(!p4dp))
125 		return -EINVAL;
126 
127 	pudp = pud_offset(p4dp, addr);
128 	if (unlikely(!pudp))
129 		return -EINVAL;
130 
131 	pmdp = pmd_offset(pudp, addr);
132 	if (unlikely(!pmdp))
133 		return -EINVAL;
134 
135 	ptep = pte_offset_kernel(pmdp, addr);
136 	if (unlikely(!ptep))
137 		return -EINVAL;
138 
139 	pr_devel("clearing mm %p, pte %p, addr %lx\n", &init_mm, ptep, addr);
140 
141 	/*
142 	 * In hash, pte_clear flushes the tlb, in radix, we have to
143 	 */
144 	pte_clear(&init_mm, addr, ptep);
145 	flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
146 
147 	return 0;
148 }
149 
150 static int do_patch_instruction(struct ppc_inst *addr, struct ppc_inst instr)
151 {
152 	int err;
153 	struct ppc_inst *patch_addr = NULL;
154 	unsigned long flags;
155 	unsigned long text_poke_addr;
156 	unsigned long kaddr = (unsigned long)addr;
157 
158 	/*
159 	 * During early early boot patch_instruction is called
160 	 * when text_poke_area is not ready, but we still need
161 	 * to allow patching. We just do the plain old patching
162 	 */
163 	if (!this_cpu_read(text_poke_area))
164 		return raw_patch_instruction(addr, instr);
165 
166 	local_irq_save(flags);
167 
168 	text_poke_addr = (unsigned long)__this_cpu_read(text_poke_area)->addr;
169 	if (map_patch_area(addr, text_poke_addr)) {
170 		err = -1;
171 		goto out;
172 	}
173 
174 	patch_addr = (struct ppc_inst *)(text_poke_addr + (kaddr & ~PAGE_MASK));
175 
176 	__patch_instruction(addr, instr, patch_addr);
177 
178 	err = unmap_patch_area(text_poke_addr);
179 	if (err)
180 		pr_warn("failed to unmap %lx\n", text_poke_addr);
181 
182 out:
183 	local_irq_restore(flags);
184 
185 	return err;
186 }
187 #else /* !CONFIG_STRICT_KERNEL_RWX */
188 
189 static int do_patch_instruction(struct ppc_inst *addr, struct ppc_inst instr)
190 {
191 	return raw_patch_instruction(addr, instr);
192 }
193 
194 #endif /* CONFIG_STRICT_KERNEL_RWX */
195 
196 int patch_instruction(struct ppc_inst *addr, struct ppc_inst instr)
197 {
198 	/* Make sure we aren't patching a freed init section */
199 	if (init_mem_is_free && init_section_contains(addr, 4)) {
200 		pr_debug("Skipping init section patching addr: 0x%px\n", addr);
201 		return 0;
202 	}
203 	return do_patch_instruction(addr, instr);
204 }
205 NOKPROBE_SYMBOL(patch_instruction);
206 
207 int patch_branch(struct ppc_inst *addr, unsigned long target, int flags)
208 {
209 	struct ppc_inst instr;
210 
211 	create_branch(&instr, addr, target, flags);
212 	return patch_instruction(addr, instr);
213 }
214 
215 bool is_offset_in_branch_range(long offset)
216 {
217 	/*
218 	 * Powerpc branch instruction is :
219 	 *
220 	 *  0         6                 30   31
221 	 *  +---------+----------------+---+---+
222 	 *  | opcode  |     LI         |AA |LK |
223 	 *  +---------+----------------+---+---+
224 	 *  Where AA = 0 and LK = 0
225 	 *
226 	 * LI is a signed 24 bits integer. The real branch offset is computed
227 	 * by: imm32 = SignExtend(LI:'0b00', 32);
228 	 *
229 	 * So the maximum forward branch should be:
230 	 *   (0x007fffff << 2) = 0x01fffffc =  0x1fffffc
231 	 * The maximum backward branch should be:
232 	 *   (0xff800000 << 2) = 0xfe000000 = -0x2000000
233 	 */
234 	return (offset >= -0x2000000 && offset <= 0x1fffffc && !(offset & 0x3));
235 }
236 
237 /*
238  * Helper to check if a given instruction is a conditional branch
239  * Derived from the conditional checks in analyse_instr()
240  */
241 bool is_conditional_branch(struct ppc_inst instr)
242 {
243 	unsigned int opcode = ppc_inst_primary_opcode(instr);
244 
245 	if (opcode == 16)       /* bc, bca, bcl, bcla */
246 		return true;
247 	if (opcode == 19) {
248 		switch ((ppc_inst_val(instr) >> 1) & 0x3ff) {
249 		case 16:        /* bclr, bclrl */
250 		case 528:       /* bcctr, bcctrl */
251 		case 560:       /* bctar, bctarl */
252 			return true;
253 		}
254 	}
255 	return false;
256 }
257 NOKPROBE_SYMBOL(is_conditional_branch);
258 
259 int create_branch(struct ppc_inst *instr,
260 		  const struct ppc_inst *addr,
261 		  unsigned long target, int flags)
262 {
263 	long offset;
264 
265 	*instr = ppc_inst(0);
266 	offset = target;
267 	if (! (flags & BRANCH_ABSOLUTE))
268 		offset = offset - (unsigned long)addr;
269 
270 	/* Check we can represent the target in the instruction format */
271 	if (!is_offset_in_branch_range(offset))
272 		return 1;
273 
274 	/* Mask out the flags and target, so they don't step on each other. */
275 	*instr = ppc_inst(0x48000000 | (flags & 0x3) | (offset & 0x03FFFFFC));
276 
277 	return 0;
278 }
279 
280 int create_cond_branch(struct ppc_inst *instr, const struct ppc_inst *addr,
281 		       unsigned long target, int flags)
282 {
283 	long offset;
284 
285 	offset = target;
286 	if (! (flags & BRANCH_ABSOLUTE))
287 		offset = offset - (unsigned long)addr;
288 
289 	/* Check we can represent the target in the instruction format */
290 	if (offset < -0x8000 || offset > 0x7FFF || offset & 0x3)
291 		return 1;
292 
293 	/* Mask out the flags and target, so they don't step on each other. */
294 	*instr = ppc_inst(0x40000000 | (flags & 0x3FF0003) | (offset & 0xFFFC));
295 
296 	return 0;
297 }
298 
299 static unsigned int branch_opcode(struct ppc_inst instr)
300 {
301 	return ppc_inst_primary_opcode(instr) & 0x3F;
302 }
303 
304 static int instr_is_branch_iform(struct ppc_inst instr)
305 {
306 	return branch_opcode(instr) == 18;
307 }
308 
309 static int instr_is_branch_bform(struct ppc_inst instr)
310 {
311 	return branch_opcode(instr) == 16;
312 }
313 
314 int instr_is_relative_branch(struct ppc_inst instr)
315 {
316 	if (ppc_inst_val(instr) & BRANCH_ABSOLUTE)
317 		return 0;
318 
319 	return instr_is_branch_iform(instr) || instr_is_branch_bform(instr);
320 }
321 
322 int instr_is_relative_link_branch(struct ppc_inst instr)
323 {
324 	return instr_is_relative_branch(instr) && (ppc_inst_val(instr) & BRANCH_SET_LINK);
325 }
326 
327 static unsigned long branch_iform_target(const struct ppc_inst *instr)
328 {
329 	signed long imm;
330 
331 	imm = ppc_inst_val(*instr) & 0x3FFFFFC;
332 
333 	/* If the top bit of the immediate value is set this is negative */
334 	if (imm & 0x2000000)
335 		imm -= 0x4000000;
336 
337 	if ((ppc_inst_val(*instr) & BRANCH_ABSOLUTE) == 0)
338 		imm += (unsigned long)instr;
339 
340 	return (unsigned long)imm;
341 }
342 
343 static unsigned long branch_bform_target(const struct ppc_inst *instr)
344 {
345 	signed long imm;
346 
347 	imm = ppc_inst_val(*instr) & 0xFFFC;
348 
349 	/* If the top bit of the immediate value is set this is negative */
350 	if (imm & 0x8000)
351 		imm -= 0x10000;
352 
353 	if ((ppc_inst_val(*instr) & BRANCH_ABSOLUTE) == 0)
354 		imm += (unsigned long)instr;
355 
356 	return (unsigned long)imm;
357 }
358 
359 unsigned long branch_target(const struct ppc_inst *instr)
360 {
361 	if (instr_is_branch_iform(ppc_inst_read(instr)))
362 		return branch_iform_target(instr);
363 	else if (instr_is_branch_bform(ppc_inst_read(instr)))
364 		return branch_bform_target(instr);
365 
366 	return 0;
367 }
368 
369 int instr_is_branch_to_addr(const struct ppc_inst *instr, unsigned long addr)
370 {
371 	if (instr_is_branch_iform(ppc_inst_read(instr)) ||
372 	    instr_is_branch_bform(ppc_inst_read(instr)))
373 		return branch_target(instr) == addr;
374 
375 	return 0;
376 }
377 
378 int translate_branch(struct ppc_inst *instr, const struct ppc_inst *dest,
379 		     const struct ppc_inst *src)
380 {
381 	unsigned long target;
382 	target = branch_target(src);
383 
384 	if (instr_is_branch_iform(ppc_inst_read(src)))
385 		return create_branch(instr, dest, target,
386 				     ppc_inst_val(ppc_inst_read(src)));
387 	else if (instr_is_branch_bform(ppc_inst_read(src)))
388 		return create_cond_branch(instr, dest, target,
389 					  ppc_inst_val(ppc_inst_read(src)));
390 
391 	return 1;
392 }
393 
394 #ifdef CONFIG_PPC_BOOK3E_64
395 void __patch_exception(int exc, unsigned long addr)
396 {
397 	extern unsigned int interrupt_base_book3e;
398 	unsigned int *ibase = &interrupt_base_book3e;
399 
400 	/* Our exceptions vectors start with a NOP and -then- a branch
401 	 * to deal with single stepping from userspace which stops on
402 	 * the second instruction. Thus we need to patch the second
403 	 * instruction of the exception, not the first one
404 	 */
405 
406 	patch_branch((struct ppc_inst *)(ibase + (exc / 4) + 1), addr, 0);
407 }
408 #endif
409 
410 #ifdef CONFIG_CODE_PATCHING_SELFTEST
411 
412 static void __init test_trampoline(void)
413 {
414 	asm ("nop;\n");
415 }
416 
417 #define check(x)	\
418 	if (!(x)) printk("code-patching: test failed at line %d\n", __LINE__);
419 
420 static void __init test_branch_iform(void)
421 {
422 	int err;
423 	struct ppc_inst instr;
424 	unsigned long addr;
425 
426 	addr = (unsigned long)&instr;
427 
428 	/* The simplest case, branch to self, no flags */
429 	check(instr_is_branch_iform(ppc_inst(0x48000000)));
430 	/* All bits of target set, and flags */
431 	check(instr_is_branch_iform(ppc_inst(0x4bffffff)));
432 	/* High bit of opcode set, which is wrong */
433 	check(!instr_is_branch_iform(ppc_inst(0xcbffffff)));
434 	/* Middle bits of opcode set, which is wrong */
435 	check(!instr_is_branch_iform(ppc_inst(0x7bffffff)));
436 
437 	/* Simplest case, branch to self with link */
438 	check(instr_is_branch_iform(ppc_inst(0x48000001)));
439 	/* All bits of targets set */
440 	check(instr_is_branch_iform(ppc_inst(0x4bfffffd)));
441 	/* Some bits of targets set */
442 	check(instr_is_branch_iform(ppc_inst(0x4bff00fd)));
443 	/* Must be a valid branch to start with */
444 	check(!instr_is_branch_iform(ppc_inst(0x7bfffffd)));
445 
446 	/* Absolute branch to 0x100 */
447 	instr = ppc_inst(0x48000103);
448 	check(instr_is_branch_to_addr(&instr, 0x100));
449 	/* Absolute branch to 0x420fc */
450 	instr = ppc_inst(0x480420ff);
451 	check(instr_is_branch_to_addr(&instr, 0x420fc));
452 	/* Maximum positive relative branch, + 20MB - 4B */
453 	instr = ppc_inst(0x49fffffc);
454 	check(instr_is_branch_to_addr(&instr, addr + 0x1FFFFFC));
455 	/* Smallest negative relative branch, - 4B */
456 	instr = ppc_inst(0x4bfffffc);
457 	check(instr_is_branch_to_addr(&instr, addr - 4));
458 	/* Largest negative relative branch, - 32 MB */
459 	instr = ppc_inst(0x4a000000);
460 	check(instr_is_branch_to_addr(&instr, addr - 0x2000000));
461 
462 	/* Branch to self, with link */
463 	err = create_branch(&instr, &instr, addr, BRANCH_SET_LINK);
464 	check(instr_is_branch_to_addr(&instr, addr));
465 
466 	/* Branch to self - 0x100, with link */
467 	err = create_branch(&instr, &instr, addr - 0x100, BRANCH_SET_LINK);
468 	check(instr_is_branch_to_addr(&instr, addr - 0x100));
469 
470 	/* Branch to self + 0x100, no link */
471 	err = create_branch(&instr, &instr, addr + 0x100, 0);
472 	check(instr_is_branch_to_addr(&instr, addr + 0x100));
473 
474 	/* Maximum relative negative offset, - 32 MB */
475 	err = create_branch(&instr, &instr, addr - 0x2000000, BRANCH_SET_LINK);
476 	check(instr_is_branch_to_addr(&instr, addr - 0x2000000));
477 
478 	/* Out of range relative negative offset, - 32 MB + 4*/
479 	err = create_branch(&instr, &instr, addr - 0x2000004, BRANCH_SET_LINK);
480 	check(err);
481 
482 	/* Out of range relative positive offset, + 32 MB */
483 	err = create_branch(&instr, &instr, addr + 0x2000000, BRANCH_SET_LINK);
484 	check(err);
485 
486 	/* Unaligned target */
487 	err = create_branch(&instr, &instr, addr + 3, BRANCH_SET_LINK);
488 	check(err);
489 
490 	/* Check flags are masked correctly */
491 	err = create_branch(&instr, &instr, addr, 0xFFFFFFFC);
492 	check(instr_is_branch_to_addr(&instr, addr));
493 	check(ppc_inst_equal(instr, ppc_inst(0x48000000)));
494 }
495 
496 static void __init test_create_function_call(void)
497 {
498 	struct ppc_inst *iptr;
499 	unsigned long dest;
500 	struct ppc_inst instr;
501 
502 	/* Check we can create a function call */
503 	iptr = (struct ppc_inst *)ppc_function_entry(test_trampoline);
504 	dest = ppc_function_entry(test_create_function_call);
505 	create_branch(&instr, iptr, dest, BRANCH_SET_LINK);
506 	patch_instruction(iptr, instr);
507 	check(instr_is_branch_to_addr(iptr, dest));
508 }
509 
510 static void __init test_branch_bform(void)
511 {
512 	int err;
513 	unsigned long addr;
514 	struct ppc_inst *iptr, instr;
515 	unsigned int flags;
516 
517 	iptr = &instr;
518 	addr = (unsigned long)iptr;
519 
520 	/* The simplest case, branch to self, no flags */
521 	check(instr_is_branch_bform(ppc_inst(0x40000000)));
522 	/* All bits of target set, and flags */
523 	check(instr_is_branch_bform(ppc_inst(0x43ffffff)));
524 	/* High bit of opcode set, which is wrong */
525 	check(!instr_is_branch_bform(ppc_inst(0xc3ffffff)));
526 	/* Middle bits of opcode set, which is wrong */
527 	check(!instr_is_branch_bform(ppc_inst(0x7bffffff)));
528 
529 	/* Absolute conditional branch to 0x100 */
530 	instr = ppc_inst(0x43ff0103);
531 	check(instr_is_branch_to_addr(&instr, 0x100));
532 	/* Absolute conditional branch to 0x20fc */
533 	instr = ppc_inst(0x43ff20ff);
534 	check(instr_is_branch_to_addr(&instr, 0x20fc));
535 	/* Maximum positive relative conditional branch, + 32 KB - 4B */
536 	instr = ppc_inst(0x43ff7ffc);
537 	check(instr_is_branch_to_addr(&instr, addr + 0x7FFC));
538 	/* Smallest negative relative conditional branch, - 4B */
539 	instr = ppc_inst(0x43fffffc);
540 	check(instr_is_branch_to_addr(&instr, addr - 4));
541 	/* Largest negative relative conditional branch, - 32 KB */
542 	instr = ppc_inst(0x43ff8000);
543 	check(instr_is_branch_to_addr(&instr, addr - 0x8000));
544 
545 	/* All condition code bits set & link */
546 	flags = 0x3ff000 | BRANCH_SET_LINK;
547 
548 	/* Branch to self */
549 	err = create_cond_branch(&instr, iptr, addr, flags);
550 	check(instr_is_branch_to_addr(&instr, addr));
551 
552 	/* Branch to self - 0x100 */
553 	err = create_cond_branch(&instr, iptr, addr - 0x100, flags);
554 	check(instr_is_branch_to_addr(&instr, addr - 0x100));
555 
556 	/* Branch to self + 0x100 */
557 	err = create_cond_branch(&instr, iptr, addr + 0x100, flags);
558 	check(instr_is_branch_to_addr(&instr, addr + 0x100));
559 
560 	/* Maximum relative negative offset, - 32 KB */
561 	err = create_cond_branch(&instr, iptr, addr - 0x8000, flags);
562 	check(instr_is_branch_to_addr(&instr, addr - 0x8000));
563 
564 	/* Out of range relative negative offset, - 32 KB + 4*/
565 	err = create_cond_branch(&instr, iptr, addr - 0x8004, flags);
566 	check(err);
567 
568 	/* Out of range relative positive offset, + 32 KB */
569 	err = create_cond_branch(&instr, iptr, addr + 0x8000, flags);
570 	check(err);
571 
572 	/* Unaligned target */
573 	err = create_cond_branch(&instr, iptr, addr + 3, flags);
574 	check(err);
575 
576 	/* Check flags are masked correctly */
577 	err = create_cond_branch(&instr, iptr, addr, 0xFFFFFFFC);
578 	check(instr_is_branch_to_addr(&instr, addr));
579 	check(ppc_inst_equal(instr, ppc_inst(0x43FF0000)));
580 }
581 
582 static void __init test_translate_branch(void)
583 {
584 	unsigned long addr;
585 	void *p, *q;
586 	struct ppc_inst instr;
587 	void *buf;
588 
589 	buf = vmalloc(PAGE_ALIGN(0x2000000 + 1));
590 	check(buf);
591 	if (!buf)
592 		return;
593 
594 	/* Simple case, branch to self moved a little */
595 	p = buf;
596 	addr = (unsigned long)p;
597 	patch_branch(p, addr, 0);
598 	check(instr_is_branch_to_addr(p, addr));
599 	q = p + 4;
600 	translate_branch(&instr, q, p);
601 	patch_instruction(q, instr);
602 	check(instr_is_branch_to_addr(q, addr));
603 
604 	/* Maximum negative case, move b . to addr + 32 MB */
605 	p = buf;
606 	addr = (unsigned long)p;
607 	patch_branch(p, addr, 0);
608 	q = buf + 0x2000000;
609 	translate_branch(&instr, q, p);
610 	patch_instruction(q, instr);
611 	check(instr_is_branch_to_addr(p, addr));
612 	check(instr_is_branch_to_addr(q, addr));
613 	check(ppc_inst_equal(ppc_inst_read(q), ppc_inst(0x4a000000)));
614 
615 	/* Maximum positive case, move x to x - 32 MB + 4 */
616 	p = buf + 0x2000000;
617 	addr = (unsigned long)p;
618 	patch_branch(p, addr, 0);
619 	q = buf + 4;
620 	translate_branch(&instr, q, p);
621 	patch_instruction(q, instr);
622 	check(instr_is_branch_to_addr(p, addr));
623 	check(instr_is_branch_to_addr(q, addr));
624 	check(ppc_inst_equal(ppc_inst_read(q), ppc_inst(0x49fffffc)));
625 
626 	/* Jump to x + 16 MB moved to x + 20 MB */
627 	p = buf;
628 	addr = 0x1000000 + (unsigned long)buf;
629 	patch_branch(p, addr, BRANCH_SET_LINK);
630 	q = buf + 0x1400000;
631 	translate_branch(&instr, q, p);
632 	patch_instruction(q, instr);
633 	check(instr_is_branch_to_addr(p, addr));
634 	check(instr_is_branch_to_addr(q, addr));
635 
636 	/* Jump to x + 16 MB moved to x - 16 MB + 4 */
637 	p = buf + 0x1000000;
638 	addr = 0x2000000 + (unsigned long)buf;
639 	patch_branch(p, addr, 0);
640 	q = buf + 4;
641 	translate_branch(&instr, q, p);
642 	patch_instruction(q, instr);
643 	check(instr_is_branch_to_addr(p, addr));
644 	check(instr_is_branch_to_addr(q, addr));
645 
646 
647 	/* Conditional branch tests */
648 
649 	/* Simple case, branch to self moved a little */
650 	p = buf;
651 	addr = (unsigned long)p;
652 	create_cond_branch(&instr, p, addr, 0);
653 	patch_instruction(p, instr);
654 	check(instr_is_branch_to_addr(p, addr));
655 	q = buf + 4;
656 	translate_branch(&instr, q, p);
657 	patch_instruction(q, instr);
658 	check(instr_is_branch_to_addr(q, addr));
659 
660 	/* Maximum negative case, move b . to addr + 32 KB */
661 	p = buf;
662 	addr = (unsigned long)p;
663 	create_cond_branch(&instr, p, addr, 0xFFFFFFFC);
664 	patch_instruction(p, instr);
665 	q = buf + 0x8000;
666 	translate_branch(&instr, q, p);
667 	patch_instruction(q, instr);
668 	check(instr_is_branch_to_addr(p, addr));
669 	check(instr_is_branch_to_addr(q, addr));
670 	check(ppc_inst_equal(ppc_inst_read(q), ppc_inst(0x43ff8000)));
671 
672 	/* Maximum positive case, move x to x - 32 KB + 4 */
673 	p = buf + 0x8000;
674 	addr = (unsigned long)p;
675 	create_cond_branch(&instr, p, addr, 0xFFFFFFFC);
676 	patch_instruction(p, instr);
677 	q = buf + 4;
678 	translate_branch(&instr, q, p);
679 	patch_instruction(q, instr);
680 	check(instr_is_branch_to_addr(p, addr));
681 	check(instr_is_branch_to_addr(q, addr));
682 	check(ppc_inst_equal(ppc_inst_read(q), ppc_inst(0x43ff7ffc)));
683 
684 	/* Jump to x + 12 KB moved to x + 20 KB */
685 	p = buf;
686 	addr = 0x3000 + (unsigned long)buf;
687 	create_cond_branch(&instr, p, addr, BRANCH_SET_LINK);
688 	patch_instruction(p, instr);
689 	q = buf + 0x5000;
690 	translate_branch(&instr, q, p);
691 	patch_instruction(q, instr);
692 	check(instr_is_branch_to_addr(p, addr));
693 	check(instr_is_branch_to_addr(q, addr));
694 
695 	/* Jump to x + 8 KB moved to x - 8 KB + 4 */
696 	p = buf + 0x2000;
697 	addr = 0x4000 + (unsigned long)buf;
698 	create_cond_branch(&instr, p, addr, 0);
699 	patch_instruction(p, instr);
700 	q = buf + 4;
701 	translate_branch(&instr, q, p);
702 	patch_instruction(q, instr);
703 	check(instr_is_branch_to_addr(p, addr));
704 	check(instr_is_branch_to_addr(q, addr));
705 
706 	/* Free the buffer we were using */
707 	vfree(buf);
708 }
709 
710 #ifdef CONFIG_PPC64
711 static void __init test_prefixed_patching(void)
712 {
713 	extern unsigned int code_patching_test1[];
714 	extern unsigned int code_patching_test1_expected[];
715 	extern unsigned int end_code_patching_test1[];
716 
717 	__patch_instruction((struct ppc_inst *)code_patching_test1,
718 			    ppc_inst_prefix(OP_PREFIX << 26, 0x00000000),
719 			    (struct ppc_inst *)code_patching_test1);
720 
721 	check(!memcmp(code_patching_test1,
722 		      code_patching_test1_expected,
723 		      sizeof(unsigned int) *
724 		      (end_code_patching_test1 - code_patching_test1)));
725 }
726 #else
727 static inline void test_prefixed_patching(void) {}
728 #endif
729 
730 static int __init test_code_patching(void)
731 {
732 	printk(KERN_DEBUG "Running code patching self-tests ...\n");
733 
734 	test_branch_iform();
735 	test_branch_bform();
736 	test_create_function_call();
737 	test_translate_branch();
738 	test_prefixed_patching();
739 
740 	return 0;
741 }
742 late_initcall(test_code_patching);
743 
744 #endif /* CONFIG_CODE_PATCHING_SELFTEST */
745