xref: /openbmc/linux/arch/powerpc/lib/code-patching.c (revision 413d6ed3)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *  Copyright 2008 Michael Ellerman, IBM Corporation.
4  */
5 
6 #include <linux/kernel.h>
7 #include <linux/kprobes.h>
8 #include <linux/vmalloc.h>
9 #include <linux/init.h>
10 #include <linux/mm.h>
11 #include <linux/cpuhotplug.h>
12 #include <linux/slab.h>
13 #include <linux/uaccess.h>
14 
15 #include <asm/tlbflush.h>
16 #include <asm/page.h>
17 #include <asm/code-patching.h>
18 #include <asm/setup.h>
19 #include <asm/inst.h>
20 
21 static int __patch_instruction(u32 *exec_addr, struct ppc_inst instr, u32 *patch_addr)
22 {
23 	if (!ppc_inst_prefixed(instr)) {
24 		u32 val = ppc_inst_val(instr);
25 
26 		__put_kernel_nofault(patch_addr, &val, u32, failed);
27 	} else {
28 		u64 val = ppc_inst_as_ulong(instr);
29 
30 		__put_kernel_nofault(patch_addr, &val, u64, failed);
31 	}
32 
33 	asm ("dcbst 0, %0; sync; icbi 0,%1; sync; isync" :: "r" (patch_addr),
34 							    "r" (exec_addr));
35 
36 	return 0;
37 
38 failed:
39 	return -EFAULT;
40 }
41 
42 int raw_patch_instruction(u32 *addr, struct ppc_inst instr)
43 {
44 	return __patch_instruction(addr, instr, addr);
45 }
46 
47 #ifdef CONFIG_STRICT_KERNEL_RWX
48 static DEFINE_PER_CPU(struct vm_struct *, text_poke_area);
49 
50 static int text_area_cpu_up(unsigned int cpu)
51 {
52 	struct vm_struct *area;
53 
54 	area = get_vm_area(PAGE_SIZE, VM_ALLOC);
55 	if (!area) {
56 		WARN_ONCE(1, "Failed to create text area for cpu %d\n",
57 			cpu);
58 		return -1;
59 	}
60 	this_cpu_write(text_poke_area, area);
61 
62 	return 0;
63 }
64 
65 static int text_area_cpu_down(unsigned int cpu)
66 {
67 	free_vm_area(this_cpu_read(text_poke_area));
68 	return 0;
69 }
70 
71 /*
72  * Run as a late init call. This allows all the boot time patching to be done
73  * simply by patching the code, and then we're called here prior to
74  * mark_rodata_ro(), which happens after all init calls are run. Although
75  * BUG_ON() is rude, in this case it should only happen if ENOMEM, and we judge
76  * it as being preferable to a kernel that will crash later when someone tries
77  * to use patch_instruction().
78  */
79 static int __init setup_text_poke_area(void)
80 {
81 	BUG_ON(!cpuhp_setup_state(CPUHP_AP_ONLINE_DYN,
82 		"powerpc/text_poke:online", text_area_cpu_up,
83 		text_area_cpu_down));
84 
85 	return 0;
86 }
87 late_initcall(setup_text_poke_area);
88 
89 /*
90  * This can be called for kernel text or a module.
91  */
92 static int map_patch_area(void *addr, unsigned long text_poke_addr)
93 {
94 	unsigned long pfn;
95 	int err;
96 
97 	if (is_vmalloc_or_module_addr(addr))
98 		pfn = vmalloc_to_pfn(addr);
99 	else
100 		pfn = __pa_symbol(addr) >> PAGE_SHIFT;
101 
102 	err = map_kernel_page(text_poke_addr, (pfn << PAGE_SHIFT), PAGE_KERNEL);
103 
104 	pr_devel("Mapped addr %lx with pfn %lx:%d\n", text_poke_addr, pfn, err);
105 	if (err)
106 		return -1;
107 
108 	return 0;
109 }
110 
111 static inline int unmap_patch_area(unsigned long addr)
112 {
113 	pte_t *ptep;
114 	pmd_t *pmdp;
115 	pud_t *pudp;
116 	p4d_t *p4dp;
117 	pgd_t *pgdp;
118 
119 	pgdp = pgd_offset_k(addr);
120 	if (unlikely(!pgdp))
121 		return -EINVAL;
122 
123 	p4dp = p4d_offset(pgdp, addr);
124 	if (unlikely(!p4dp))
125 		return -EINVAL;
126 
127 	pudp = pud_offset(p4dp, addr);
128 	if (unlikely(!pudp))
129 		return -EINVAL;
130 
131 	pmdp = pmd_offset(pudp, addr);
132 	if (unlikely(!pmdp))
133 		return -EINVAL;
134 
135 	ptep = pte_offset_kernel(pmdp, addr);
136 	if (unlikely(!ptep))
137 		return -EINVAL;
138 
139 	pr_devel("clearing mm %p, pte %p, addr %lx\n", &init_mm, ptep, addr);
140 
141 	/*
142 	 * In hash, pte_clear flushes the tlb, in radix, we have to
143 	 */
144 	pte_clear(&init_mm, addr, ptep);
145 	flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
146 
147 	return 0;
148 }
149 
150 static int do_patch_instruction(u32 *addr, struct ppc_inst instr)
151 {
152 	int err;
153 	u32 *patch_addr = NULL;
154 	unsigned long flags;
155 	unsigned long text_poke_addr;
156 	unsigned long kaddr = (unsigned long)addr;
157 
158 	/*
159 	 * During early early boot patch_instruction is called
160 	 * when text_poke_area is not ready, but we still need
161 	 * to allow patching. We just do the plain old patching
162 	 */
163 	if (!this_cpu_read(text_poke_area))
164 		return raw_patch_instruction(addr, instr);
165 
166 	local_irq_save(flags);
167 
168 	text_poke_addr = (unsigned long)__this_cpu_read(text_poke_area)->addr;
169 	if (map_patch_area(addr, text_poke_addr)) {
170 		err = -1;
171 		goto out;
172 	}
173 
174 	patch_addr = (u32 *)(text_poke_addr + (kaddr & ~PAGE_MASK));
175 
176 	__patch_instruction(addr, instr, patch_addr);
177 
178 	err = unmap_patch_area(text_poke_addr);
179 	if (err)
180 		pr_warn("failed to unmap %lx\n", text_poke_addr);
181 
182 out:
183 	local_irq_restore(flags);
184 
185 	return err;
186 }
187 #else /* !CONFIG_STRICT_KERNEL_RWX */
188 
189 static int do_patch_instruction(u32 *addr, struct ppc_inst instr)
190 {
191 	return raw_patch_instruction(addr, instr);
192 }
193 
194 #endif /* CONFIG_STRICT_KERNEL_RWX */
195 
196 int patch_instruction(u32 *addr, struct ppc_inst instr)
197 {
198 	/* Make sure we aren't patching a freed init section */
199 	if (init_mem_is_free && init_section_contains(addr, 4)) {
200 		pr_debug("Skipping init section patching addr: 0x%px\n", addr);
201 		return 0;
202 	}
203 	return do_patch_instruction(addr, instr);
204 }
205 NOKPROBE_SYMBOL(patch_instruction);
206 
207 int patch_branch(u32 *addr, unsigned long target, int flags)
208 {
209 	struct ppc_inst instr;
210 
211 	create_branch(&instr, addr, target, flags);
212 	return patch_instruction(addr, instr);
213 }
214 
215 bool is_offset_in_branch_range(long offset)
216 {
217 	/*
218 	 * Powerpc branch instruction is :
219 	 *
220 	 *  0         6                 30   31
221 	 *  +---------+----------------+---+---+
222 	 *  | opcode  |     LI         |AA |LK |
223 	 *  +---------+----------------+---+---+
224 	 *  Where AA = 0 and LK = 0
225 	 *
226 	 * LI is a signed 24 bits integer. The real branch offset is computed
227 	 * by: imm32 = SignExtend(LI:'0b00', 32);
228 	 *
229 	 * So the maximum forward branch should be:
230 	 *   (0x007fffff << 2) = 0x01fffffc =  0x1fffffc
231 	 * The maximum backward branch should be:
232 	 *   (0xff800000 << 2) = 0xfe000000 = -0x2000000
233 	 */
234 	return (offset >= -0x2000000 && offset <= 0x1fffffc && !(offset & 0x3));
235 }
236 
237 /*
238  * Helper to check if a given instruction is a conditional branch
239  * Derived from the conditional checks in analyse_instr()
240  */
241 bool is_conditional_branch(struct ppc_inst instr)
242 {
243 	unsigned int opcode = ppc_inst_primary_opcode(instr);
244 
245 	if (opcode == 16)       /* bc, bca, bcl, bcla */
246 		return true;
247 	if (opcode == 19) {
248 		switch ((ppc_inst_val(instr) >> 1) & 0x3ff) {
249 		case 16:        /* bclr, bclrl */
250 		case 528:       /* bcctr, bcctrl */
251 		case 560:       /* bctar, bctarl */
252 			return true;
253 		}
254 	}
255 	return false;
256 }
257 NOKPROBE_SYMBOL(is_conditional_branch);
258 
259 int create_branch(struct ppc_inst *instr, const u32 *addr,
260 		  unsigned long target, int flags)
261 {
262 	long offset;
263 
264 	*instr = ppc_inst(0);
265 	offset = target;
266 	if (! (flags & BRANCH_ABSOLUTE))
267 		offset = offset - (unsigned long)addr;
268 
269 	/* Check we can represent the target in the instruction format */
270 	if (!is_offset_in_branch_range(offset))
271 		return 1;
272 
273 	/* Mask out the flags and target, so they don't step on each other. */
274 	*instr = ppc_inst(0x48000000 | (flags & 0x3) | (offset & 0x03FFFFFC));
275 
276 	return 0;
277 }
278 
279 int create_cond_branch(struct ppc_inst *instr, const u32 *addr,
280 		       unsigned long target, int flags)
281 {
282 	long offset;
283 
284 	offset = target;
285 	if (! (flags & BRANCH_ABSOLUTE))
286 		offset = offset - (unsigned long)addr;
287 
288 	/* Check we can represent the target in the instruction format */
289 	if (offset < -0x8000 || offset > 0x7FFF || offset & 0x3)
290 		return 1;
291 
292 	/* Mask out the flags and target, so they don't step on each other. */
293 	*instr = ppc_inst(0x40000000 | (flags & 0x3FF0003) | (offset & 0xFFFC));
294 
295 	return 0;
296 }
297 
298 static unsigned int branch_opcode(struct ppc_inst instr)
299 {
300 	return ppc_inst_primary_opcode(instr) & 0x3F;
301 }
302 
303 static int instr_is_branch_iform(struct ppc_inst instr)
304 {
305 	return branch_opcode(instr) == 18;
306 }
307 
308 static int instr_is_branch_bform(struct ppc_inst instr)
309 {
310 	return branch_opcode(instr) == 16;
311 }
312 
313 int instr_is_relative_branch(struct ppc_inst instr)
314 {
315 	if (ppc_inst_val(instr) & BRANCH_ABSOLUTE)
316 		return 0;
317 
318 	return instr_is_branch_iform(instr) || instr_is_branch_bform(instr);
319 }
320 
321 int instr_is_relative_link_branch(struct ppc_inst instr)
322 {
323 	return instr_is_relative_branch(instr) && (ppc_inst_val(instr) & BRANCH_SET_LINK);
324 }
325 
326 static unsigned long branch_iform_target(const u32 *instr)
327 {
328 	signed long imm;
329 
330 	imm = ppc_inst_val(ppc_inst_read(instr)) & 0x3FFFFFC;
331 
332 	/* If the top bit of the immediate value is set this is negative */
333 	if (imm & 0x2000000)
334 		imm -= 0x4000000;
335 
336 	if ((ppc_inst_val(ppc_inst_read(instr)) & BRANCH_ABSOLUTE) == 0)
337 		imm += (unsigned long)instr;
338 
339 	return (unsigned long)imm;
340 }
341 
342 static unsigned long branch_bform_target(const u32 *instr)
343 {
344 	signed long imm;
345 
346 	imm = ppc_inst_val(ppc_inst_read(instr)) & 0xFFFC;
347 
348 	/* If the top bit of the immediate value is set this is negative */
349 	if (imm & 0x8000)
350 		imm -= 0x10000;
351 
352 	if ((ppc_inst_val(ppc_inst_read(instr)) & BRANCH_ABSOLUTE) == 0)
353 		imm += (unsigned long)instr;
354 
355 	return (unsigned long)imm;
356 }
357 
358 unsigned long branch_target(const u32 *instr)
359 {
360 	if (instr_is_branch_iform(ppc_inst_read(instr)))
361 		return branch_iform_target(instr);
362 	else if (instr_is_branch_bform(ppc_inst_read(instr)))
363 		return branch_bform_target(instr);
364 
365 	return 0;
366 }
367 
368 int translate_branch(struct ppc_inst *instr, const u32 *dest, const u32 *src)
369 {
370 	unsigned long target;
371 	target = branch_target(src);
372 
373 	if (instr_is_branch_iform(ppc_inst_read(src)))
374 		return create_branch(instr, dest, target,
375 				     ppc_inst_val(ppc_inst_read(src)));
376 	else if (instr_is_branch_bform(ppc_inst_read(src)))
377 		return create_cond_branch(instr, dest, target,
378 					  ppc_inst_val(ppc_inst_read(src)));
379 
380 	return 1;
381 }
382 
383 #ifdef CONFIG_PPC_BOOK3E_64
384 void __patch_exception(int exc, unsigned long addr)
385 {
386 	extern unsigned int interrupt_base_book3e;
387 	unsigned int *ibase = &interrupt_base_book3e;
388 
389 	/* Our exceptions vectors start with a NOP and -then- a branch
390 	 * to deal with single stepping from userspace which stops on
391 	 * the second instruction. Thus we need to patch the second
392 	 * instruction of the exception, not the first one
393 	 */
394 
395 	patch_branch(ibase + (exc / 4) + 1, addr, 0);
396 }
397 #endif
398 
399 #ifdef CONFIG_CODE_PATCHING_SELFTEST
400 
401 static int instr_is_branch_to_addr(const u32 *instr, unsigned long addr)
402 {
403 	if (instr_is_branch_iform(ppc_inst_read(instr)) ||
404 	    instr_is_branch_bform(ppc_inst_read(instr)))
405 		return branch_target(instr) == addr;
406 
407 	return 0;
408 }
409 
410 static void __init test_trampoline(void)
411 {
412 	asm ("nop;\n");
413 }
414 
415 #define check(x)	\
416 	if (!(x)) printk("code-patching: test failed at line %d\n", __LINE__);
417 
418 static void __init test_branch_iform(void)
419 {
420 	int err;
421 	struct ppc_inst instr;
422 	u32 tmp[2];
423 	u32 *iptr = tmp;
424 	unsigned long addr = (unsigned long)tmp;
425 
426 	/* The simplest case, branch to self, no flags */
427 	check(instr_is_branch_iform(ppc_inst(0x48000000)));
428 	/* All bits of target set, and flags */
429 	check(instr_is_branch_iform(ppc_inst(0x4bffffff)));
430 	/* High bit of opcode set, which is wrong */
431 	check(!instr_is_branch_iform(ppc_inst(0xcbffffff)));
432 	/* Middle bits of opcode set, which is wrong */
433 	check(!instr_is_branch_iform(ppc_inst(0x7bffffff)));
434 
435 	/* Simplest case, branch to self with link */
436 	check(instr_is_branch_iform(ppc_inst(0x48000001)));
437 	/* All bits of targets set */
438 	check(instr_is_branch_iform(ppc_inst(0x4bfffffd)));
439 	/* Some bits of targets set */
440 	check(instr_is_branch_iform(ppc_inst(0x4bff00fd)));
441 	/* Must be a valid branch to start with */
442 	check(!instr_is_branch_iform(ppc_inst(0x7bfffffd)));
443 
444 	/* Absolute branch to 0x100 */
445 	patch_instruction(iptr, ppc_inst(0x48000103));
446 	check(instr_is_branch_to_addr(iptr, 0x100));
447 	/* Absolute branch to 0x420fc */
448 	patch_instruction(iptr, ppc_inst(0x480420ff));
449 	check(instr_is_branch_to_addr(iptr, 0x420fc));
450 	/* Maximum positive relative branch, + 20MB - 4B */
451 	patch_instruction(iptr, ppc_inst(0x49fffffc));
452 	check(instr_is_branch_to_addr(iptr, addr + 0x1FFFFFC));
453 	/* Smallest negative relative branch, - 4B */
454 	patch_instruction(iptr, ppc_inst(0x4bfffffc));
455 	check(instr_is_branch_to_addr(iptr, addr - 4));
456 	/* Largest negative relative branch, - 32 MB */
457 	patch_instruction(iptr, ppc_inst(0x4a000000));
458 	check(instr_is_branch_to_addr(iptr, addr - 0x2000000));
459 
460 	/* Branch to self, with link */
461 	err = create_branch(&instr, iptr, addr, BRANCH_SET_LINK);
462 	patch_instruction(iptr, instr);
463 	check(instr_is_branch_to_addr(iptr, addr));
464 
465 	/* Branch to self - 0x100, with link */
466 	err = create_branch(&instr, iptr, addr - 0x100, BRANCH_SET_LINK);
467 	patch_instruction(iptr, instr);
468 	check(instr_is_branch_to_addr(iptr, addr - 0x100));
469 
470 	/* Branch to self + 0x100, no link */
471 	err = create_branch(&instr, iptr, addr + 0x100, 0);
472 	patch_instruction(iptr, instr);
473 	check(instr_is_branch_to_addr(iptr, addr + 0x100));
474 
475 	/* Maximum relative negative offset, - 32 MB */
476 	err = create_branch(&instr, iptr, addr - 0x2000000, BRANCH_SET_LINK);
477 	patch_instruction(iptr, instr);
478 	check(instr_is_branch_to_addr(iptr, addr - 0x2000000));
479 
480 	/* Out of range relative negative offset, - 32 MB + 4*/
481 	err = create_branch(&instr, iptr, addr - 0x2000004, BRANCH_SET_LINK);
482 	check(err);
483 
484 	/* Out of range relative positive offset, + 32 MB */
485 	err = create_branch(&instr, iptr, addr + 0x2000000, BRANCH_SET_LINK);
486 	check(err);
487 
488 	/* Unaligned target */
489 	err = create_branch(&instr, iptr, addr + 3, BRANCH_SET_LINK);
490 	check(err);
491 
492 	/* Check flags are masked correctly */
493 	err = create_branch(&instr, iptr, addr, 0xFFFFFFFC);
494 	patch_instruction(iptr, instr);
495 	check(instr_is_branch_to_addr(iptr, addr));
496 	check(ppc_inst_equal(instr, ppc_inst(0x48000000)));
497 }
498 
499 static void __init test_create_function_call(void)
500 {
501 	u32 *iptr;
502 	unsigned long dest;
503 	struct ppc_inst instr;
504 
505 	/* Check we can create a function call */
506 	iptr = (u32 *)ppc_function_entry(test_trampoline);
507 	dest = ppc_function_entry(test_create_function_call);
508 	create_branch(&instr, iptr, dest, BRANCH_SET_LINK);
509 	patch_instruction(iptr, instr);
510 	check(instr_is_branch_to_addr(iptr, dest));
511 }
512 
513 static void __init test_branch_bform(void)
514 {
515 	int err;
516 	unsigned long addr;
517 	struct ppc_inst instr;
518 	u32 tmp[2];
519 	u32 *iptr = tmp;
520 	unsigned int flags;
521 
522 	addr = (unsigned long)iptr;
523 
524 	/* The simplest case, branch to self, no flags */
525 	check(instr_is_branch_bform(ppc_inst(0x40000000)));
526 	/* All bits of target set, and flags */
527 	check(instr_is_branch_bform(ppc_inst(0x43ffffff)));
528 	/* High bit of opcode set, which is wrong */
529 	check(!instr_is_branch_bform(ppc_inst(0xc3ffffff)));
530 	/* Middle bits of opcode set, which is wrong */
531 	check(!instr_is_branch_bform(ppc_inst(0x7bffffff)));
532 
533 	/* Absolute conditional branch to 0x100 */
534 	patch_instruction(iptr, ppc_inst(0x43ff0103));
535 	check(instr_is_branch_to_addr(iptr, 0x100));
536 	/* Absolute conditional branch to 0x20fc */
537 	patch_instruction(iptr, ppc_inst(0x43ff20ff));
538 	check(instr_is_branch_to_addr(iptr, 0x20fc));
539 	/* Maximum positive relative conditional branch, + 32 KB - 4B */
540 	patch_instruction(iptr, ppc_inst(0x43ff7ffc));
541 	check(instr_is_branch_to_addr(iptr, addr + 0x7FFC));
542 	/* Smallest negative relative conditional branch, - 4B */
543 	patch_instruction(iptr, ppc_inst(0x43fffffc));
544 	check(instr_is_branch_to_addr(iptr, addr - 4));
545 	/* Largest negative relative conditional branch, - 32 KB */
546 	patch_instruction(iptr, ppc_inst(0x43ff8000));
547 	check(instr_is_branch_to_addr(iptr, addr - 0x8000));
548 
549 	/* All condition code bits set & link */
550 	flags = 0x3ff000 | BRANCH_SET_LINK;
551 
552 	/* Branch to self */
553 	err = create_cond_branch(&instr, iptr, addr, flags);
554 	patch_instruction(iptr, instr);
555 	check(instr_is_branch_to_addr(iptr, addr));
556 
557 	/* Branch to self - 0x100 */
558 	err = create_cond_branch(&instr, iptr, addr - 0x100, flags);
559 	patch_instruction(iptr, instr);
560 	check(instr_is_branch_to_addr(iptr, addr - 0x100));
561 
562 	/* Branch to self + 0x100 */
563 	err = create_cond_branch(&instr, iptr, addr + 0x100, flags);
564 	patch_instruction(iptr, instr);
565 	check(instr_is_branch_to_addr(iptr, addr + 0x100));
566 
567 	/* Maximum relative negative offset, - 32 KB */
568 	err = create_cond_branch(&instr, iptr, addr - 0x8000, flags);
569 	patch_instruction(iptr, instr);
570 	check(instr_is_branch_to_addr(iptr, addr - 0x8000));
571 
572 	/* Out of range relative negative offset, - 32 KB + 4*/
573 	err = create_cond_branch(&instr, iptr, addr - 0x8004, flags);
574 	check(err);
575 
576 	/* Out of range relative positive offset, + 32 KB */
577 	err = create_cond_branch(&instr, iptr, addr + 0x8000, flags);
578 	check(err);
579 
580 	/* Unaligned target */
581 	err = create_cond_branch(&instr, iptr, addr + 3, flags);
582 	check(err);
583 
584 	/* Check flags are masked correctly */
585 	err = create_cond_branch(&instr, iptr, addr, 0xFFFFFFFC);
586 	patch_instruction(iptr, instr);
587 	check(instr_is_branch_to_addr(iptr, addr));
588 	check(ppc_inst_equal(instr, ppc_inst(0x43FF0000)));
589 }
590 
591 static void __init test_translate_branch(void)
592 {
593 	unsigned long addr;
594 	void *p, *q;
595 	struct ppc_inst instr;
596 	void *buf;
597 
598 	buf = vmalloc(PAGE_ALIGN(0x2000000 + 1));
599 	check(buf);
600 	if (!buf)
601 		return;
602 
603 	/* Simple case, branch to self moved a little */
604 	p = buf;
605 	addr = (unsigned long)p;
606 	patch_branch(p, addr, 0);
607 	check(instr_is_branch_to_addr(p, addr));
608 	q = p + 4;
609 	translate_branch(&instr, q, p);
610 	patch_instruction(q, instr);
611 	check(instr_is_branch_to_addr(q, addr));
612 
613 	/* Maximum negative case, move b . to addr + 32 MB */
614 	p = buf;
615 	addr = (unsigned long)p;
616 	patch_branch(p, addr, 0);
617 	q = buf + 0x2000000;
618 	translate_branch(&instr, q, p);
619 	patch_instruction(q, instr);
620 	check(instr_is_branch_to_addr(p, addr));
621 	check(instr_is_branch_to_addr(q, addr));
622 	check(ppc_inst_equal(ppc_inst_read(q), ppc_inst(0x4a000000)));
623 
624 	/* Maximum positive case, move x to x - 32 MB + 4 */
625 	p = buf + 0x2000000;
626 	addr = (unsigned long)p;
627 	patch_branch(p, addr, 0);
628 	q = buf + 4;
629 	translate_branch(&instr, q, p);
630 	patch_instruction(q, instr);
631 	check(instr_is_branch_to_addr(p, addr));
632 	check(instr_is_branch_to_addr(q, addr));
633 	check(ppc_inst_equal(ppc_inst_read(q), ppc_inst(0x49fffffc)));
634 
635 	/* Jump to x + 16 MB moved to x + 20 MB */
636 	p = buf;
637 	addr = 0x1000000 + (unsigned long)buf;
638 	patch_branch(p, addr, BRANCH_SET_LINK);
639 	q = buf + 0x1400000;
640 	translate_branch(&instr, q, p);
641 	patch_instruction(q, instr);
642 	check(instr_is_branch_to_addr(p, addr));
643 	check(instr_is_branch_to_addr(q, addr));
644 
645 	/* Jump to x + 16 MB moved to x - 16 MB + 4 */
646 	p = buf + 0x1000000;
647 	addr = 0x2000000 + (unsigned long)buf;
648 	patch_branch(p, addr, 0);
649 	q = buf + 4;
650 	translate_branch(&instr, q, p);
651 	patch_instruction(q, instr);
652 	check(instr_is_branch_to_addr(p, addr));
653 	check(instr_is_branch_to_addr(q, addr));
654 
655 
656 	/* Conditional branch tests */
657 
658 	/* Simple case, branch to self moved a little */
659 	p = buf;
660 	addr = (unsigned long)p;
661 	create_cond_branch(&instr, p, addr, 0);
662 	patch_instruction(p, instr);
663 	check(instr_is_branch_to_addr(p, addr));
664 	q = buf + 4;
665 	translate_branch(&instr, q, p);
666 	patch_instruction(q, instr);
667 	check(instr_is_branch_to_addr(q, addr));
668 
669 	/* Maximum negative case, move b . to addr + 32 KB */
670 	p = buf;
671 	addr = (unsigned long)p;
672 	create_cond_branch(&instr, p, addr, 0xFFFFFFFC);
673 	patch_instruction(p, instr);
674 	q = buf + 0x8000;
675 	translate_branch(&instr, q, p);
676 	patch_instruction(q, instr);
677 	check(instr_is_branch_to_addr(p, addr));
678 	check(instr_is_branch_to_addr(q, addr));
679 	check(ppc_inst_equal(ppc_inst_read(q), ppc_inst(0x43ff8000)));
680 
681 	/* Maximum positive case, move x to x - 32 KB + 4 */
682 	p = buf + 0x8000;
683 	addr = (unsigned long)p;
684 	create_cond_branch(&instr, p, addr, 0xFFFFFFFC);
685 	patch_instruction(p, instr);
686 	q = buf + 4;
687 	translate_branch(&instr, q, p);
688 	patch_instruction(q, instr);
689 	check(instr_is_branch_to_addr(p, addr));
690 	check(instr_is_branch_to_addr(q, addr));
691 	check(ppc_inst_equal(ppc_inst_read(q), ppc_inst(0x43ff7ffc)));
692 
693 	/* Jump to x + 12 KB moved to x + 20 KB */
694 	p = buf;
695 	addr = 0x3000 + (unsigned long)buf;
696 	create_cond_branch(&instr, p, addr, BRANCH_SET_LINK);
697 	patch_instruction(p, instr);
698 	q = buf + 0x5000;
699 	translate_branch(&instr, q, p);
700 	patch_instruction(q, instr);
701 	check(instr_is_branch_to_addr(p, addr));
702 	check(instr_is_branch_to_addr(q, addr));
703 
704 	/* Jump to x + 8 KB moved to x - 8 KB + 4 */
705 	p = buf + 0x2000;
706 	addr = 0x4000 + (unsigned long)buf;
707 	create_cond_branch(&instr, p, addr, 0);
708 	patch_instruction(p, instr);
709 	q = buf + 4;
710 	translate_branch(&instr, q, p);
711 	patch_instruction(q, instr);
712 	check(instr_is_branch_to_addr(p, addr));
713 	check(instr_is_branch_to_addr(q, addr));
714 
715 	/* Free the buffer we were using */
716 	vfree(buf);
717 }
718 
719 #ifdef CONFIG_PPC64
720 static void __init test_prefixed_patching(void)
721 {
722 	extern unsigned int code_patching_test1[];
723 	extern unsigned int code_patching_test1_expected[];
724 	extern unsigned int end_code_patching_test1[];
725 
726 	__patch_instruction(code_patching_test1,
727 			    ppc_inst_prefix(OP_PREFIX << 26, 0x00000000),
728 			    code_patching_test1);
729 
730 	check(!memcmp(code_patching_test1,
731 		      code_patching_test1_expected,
732 		      sizeof(unsigned int) *
733 		      (end_code_patching_test1 - code_patching_test1)));
734 }
735 #else
736 static inline void test_prefixed_patching(void) {}
737 #endif
738 
739 static int __init test_code_patching(void)
740 {
741 	printk(KERN_DEBUG "Running code patching self-tests ...\n");
742 
743 	test_branch_iform();
744 	test_branch_bform();
745 	test_create_function_call();
746 	test_translate_branch();
747 	test_prefixed_patching();
748 
749 	return 0;
750 }
751 late_initcall(test_code_patching);
752 
753 #endif /* CONFIG_CODE_PATCHING_SELFTEST */
754