x86/kprobes: Fix crash when probing CS CALL instructionsgrafted

When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:

<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>:  mov    %r14,%rdi
<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>:  mov    %eax,%r12d
<__hrtimer_run_queues+266>:  xchg   %ax,%ax
<__hrtimer_run_queues+268>:  mov    %r13,%rdi

Which triggers this crash:

  BUG: unable to handle page fault for address: 00000000000f41c9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
  RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.

The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.

During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.

Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.

[ mingo: Refined the changelog ]

Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Jinke Han <jinkehan@didiglobal.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000

7 files changed, 1078 insertions, 0 deletions

diff --git a/arch/mips/jazz/Kconfig b/arch/mips/jazz/Kconfig
new file mode 100644
index 000000000..42932ca98
--- /dev/null
+++ b/arch/mips/jazz/Kconfig
@@ -0,0 +1,31 @@
+# SPDX-License-Identifier: GPL-2.0
+config ACER_PICA_61
+	bool "Support for Acer PICA 1 chipset"
+	depends on MACH_JAZZ
+	select DMA_NONCOHERENT
+	help
+	  This is a machine with a R4400 133/150 MHz CPU. To compile a Linux
+	  kernel that runs on these, say Y here. For details about Linux on
+	  the MIPS architecture, check out the Linux/MIPS FAQ on the WWW at
+	  <http://www.linux-mips.org/>.
+
+config MIPS_MAGNUM_4000
+	bool "Support for MIPS Magnum 4000"
+	depends on MACH_JAZZ
+	select DMA_NONCOHERENT
+	select SYS_SUPPORTS_BIG_ENDIAN
+	help
+	  This is a machine with a R4000 100 MHz CPU. To compile a Linux
+	  kernel that runs on these, say Y here. For details about Linux on
+	  the MIPS architecture, check out the Linux/MIPS FAQ on the WWW at
+	  <http://www.linux-mips.org/>.
+
+config OLIVETTI_M700
+	bool "Support for Olivetti M700-10"
+	depends on MACH_JAZZ
+	select DMA_NONCOHERENT
+	help
+	  This is a machine with a R4000 100 MHz CPU. To compile a Linux
+	  kernel that runs on these, say Y here. For details about Linux on
+	  the MIPS architecture, check out the Linux/MIPS FAQ on the WWW at
+	  <http://www.linux-mips.org/>.
diff --git a/arch/mips/jazz/Makefile b/arch/mips/jazz/Makefile
new file mode 100644
index 000000000..5815e1cb3
--- /dev/null
+++ b/arch/mips/jazz/Makefile
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Makefile for the Jazz family specific parts of the kernel
+#
+
+obj-y		:= irq.o jazzdma.o reset.o setup.o
diff --git a/arch/mips/jazz/Platform b/arch/mips/jazz/Platform
new file mode 100644
index 000000000..eb0490ae8
--- /dev/null
+++ b/arch/mips/jazz/Platform
@@ -0,0 +1,5 @@
+#
+# Acer PICA 61, Mips Magnum 4000 and Olivetti M700.
+#
+cflags-$(CONFIG_MACH_JAZZ)	+= -I$(srctree)/arch/mips/include/asm/mach-jazz
+load-$(CONFIG_MACH_JAZZ)	+= 0xffffffff80080000
diff --git a/arch/mips/jazz/irq.c b/arch/mips/jazz/irq.c
new file mode 100644
index 000000000..264d45387
--- /dev/null
+++ b/arch/mips/jazz/irq.c
@@ -0,0 +1,149 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 1992 Linus Torvalds
+ * Copyright (C) 1994 - 2001, 2003, 07 Ralf Baechle
+ */
+#include <linux/clockchips.h>
+#include <linux/i8253.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/kernel.h>
+#include <linux/smp.h>
+#include <linux/spinlock.h>
+#include <linux/irq.h>
+#include <linux/pgtable.h>
+
+#include <asm/irq_cpu.h>
+#include <asm/i8259.h>
+#include <asm/io.h>
+#include <asm/jazz.h>
+#include <asm/tlbmisc.h>
+
+static DEFINE_RAW_SPINLOCK(r4030_lock);
+
+static void enable_r4030_irq(struct irq_data *d)
+{
+	unsigned int mask = 1 << (d->irq - JAZZ_IRQ_START);
+	unsigned long flags;
+
+	raw_spin_lock_irqsave(&r4030_lock, flags);
+	mask |= r4030_read_reg16(JAZZ_IO_IRQ_ENABLE);
+	r4030_write_reg16(JAZZ_IO_IRQ_ENABLE, mask);
+	raw_spin_unlock_irqrestore(&r4030_lock, flags);
+}
+
+void disable_r4030_irq(struct irq_data *d)
+{
+	unsigned int mask = ~(1 << (d->irq - JAZZ_IRQ_START));
+	unsigned long flags;
+
+	raw_spin_lock_irqsave(&r4030_lock, flags);
+	mask &= r4030_read_reg16(JAZZ_IO_IRQ_ENABLE);
+	r4030_write_reg16(JAZZ_IO_IRQ_ENABLE, mask);
+	raw_spin_unlock_irqrestore(&r4030_lock, flags);
+}
+
+static struct irq_chip r4030_irq_type = {
+	.name = "R4030",
+	.irq_mask = disable_r4030_irq,
+	.irq_unmask = enable_r4030_irq,
+};
+
+void __init init_r4030_ints(void)
+{
+	int i;
+
+	for (i = JAZZ_IRQ_START; i <= JAZZ_IRQ_END; i++)
+		irq_set_chip_and_handler(i, &r4030_irq_type, handle_level_irq);
+
+	r4030_write_reg16(JAZZ_IO_IRQ_ENABLE, 0);
+	r4030_read_reg16(JAZZ_IO_IRQ_SOURCE);		/* clear pending IRQs */
+	r4030_read_reg32(JAZZ_R4030_INVAL_ADDR);	/* clear error bits */
+}
+
+/*
+ * On systems with i8259-style interrupt controllers we assume for
+ * driver compatibility reasons interrupts 0 - 15 to be the i8259
+ * interrupts even if the hardware uses a different interrupt numbering.
+ */
+void __init arch_init_irq(void)
+{
+	/*
+	 * this is a hack to get back the still needed wired mapping
+	 * killed by init_mm()
+	 */
+
+	/* Map 0xe0000000 -> 0x0:800005C0, 0xe0010000 -> 0x1:30000580 */
+	add_wired_entry(0x02000017, 0x03c00017, 0xe0000000, PM_64K);
+	/* Map 0xe2000000 -> 0x0:900005C0, 0xe3010000 -> 0x0:910005C0 */
+	add_wired_entry(0x02400017, 0x02440017, 0xe2000000, PM_16M);
+	/* Map 0xe4000000 -> 0x0:600005C0, 0xe4100000 -> 400005C0 */
+	add_wired_entry(0x01800017, 0x01000017, 0xe4000000, PM_4M);
+
+	init_i8259_irqs();			/* Integrated i8259  */
+	mips_cpu_irq_init();
+	init_r4030_ints();
+
+	change_c0_status(ST0_IM, IE_IRQ2 | IE_IRQ1);
+}
+
+asmlinkage void plat_irq_dispatch(void)
+{
+	unsigned int pending = read_c0_cause() & read_c0_status();
+	unsigned int irq;
+
+	if (pending & IE_IRQ4) {
+		r4030_read_reg32(JAZZ_TIMER_REGISTER);
+		do_IRQ(JAZZ_TIMER_IRQ);
+	} else if (pending & IE_IRQ2) {
+		irq = *(volatile u8 *)JAZZ_EISA_IRQ_ACK;
+		do_IRQ(irq);
+	} else if (pending & IE_IRQ1) {
+		irq = *(volatile u8 *)JAZZ_IO_IRQ_SOURCE >> 2;
+		if (likely(irq > 0))
+			do_IRQ(irq + JAZZ_IRQ_START - 1);
+		else
+			panic("Unimplemented loc_no_irq handler");
+	}
+}
+
+struct clock_event_device r4030_clockevent = {
+	.name		= "r4030",
+	.features	= CLOCK_EVT_FEAT_PERIODIC,
+	.rating		= 300,
+	.irq		= JAZZ_TIMER_IRQ,
+};
+
+static irqreturn_t r4030_timer_interrupt(int irq, void *dev_id)
+{
+	struct clock_event_device *cd = dev_id;
+
+	cd->event_handler(cd);
+	return IRQ_HANDLED;
+}
+
+void __init plat_time_init(void)
+{
+	struct clock_event_device *cd = &r4030_clockevent;
+	unsigned int cpu = smp_processor_id();
+
+	BUG_ON(HZ != 100);
+
+	cd->cpumask		= cpumask_of(cpu);
+	clockevents_register_device(cd);
+	if (request_irq(JAZZ_TIMER_IRQ, r4030_timer_interrupt, IRQF_TIMER,
+			"R4030 timer", cd))
+		pr_err("Failed to register R4030 timer interrupt\n");
+
+	/*
+	 * Set clock to 100Hz.
+	 *
+	 * The R4030 timer receives an input clock of 1kHz which is divided by
+	 * a programmable 4-bit divider.  This makes it fairly inflexible.
+	 */
+	r4030_write_reg32(JAZZ_TIMER_INTERVAL, 9);
+	setup_pit_timer();
+}
diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c
new file mode 100644
index 000000000..eb9fb2f2a
--- /dev/null
+++ b/arch/mips/jazz/jazzdma.c
@@ -0,0 +1,629 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Mips Jazz DMA controller support
+ * Copyright (C) 1995, 1996 by Andreas Busse
+ *
+ * NOTE: Some of the argument checking could be removed when
+ * things have settled down. Also, instead of returning 0xffffffff
+ * on failure of vdma_alloc() one could leave page #0 unused
+ * and return the more usual NULL pointer as logical address.
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/export.h>
+#include <linux/errno.h>
+#include <linux/mm.h>
+#include <linux/memblock.h>
+#include <linux/spinlock.h>
+#include <linux/gfp.h>
+#include <linux/dma-map-ops.h>
+#include <asm/mipsregs.h>
+#include <asm/jazz.h>
+#include <asm/io.h>
+#include <linux/uaccess.h>
+#include <asm/dma.h>
+#include <asm/jazzdma.h>
+
+/*
+ * Set this to one to enable additional vdma debug code.
+ */
+#define CONF_DEBUG_VDMA 0
+
+static VDMA_PGTBL_ENTRY *pgtbl;
+
+static DEFINE_SPINLOCK(vdma_lock);
+
+/*
+ * Debug stuff
+ */
+#define vdma_debug     ((CONF_DEBUG_VDMA) ? debuglvl : 0)
+
+static int debuglvl = 3;
+
+/*
+ * Initialize the pagetable with a one-to-one mapping of
+ * the first 16 Mbytes of main memory and declare all
+ * entries to be unused. Using this method will at least
+ * allow some early device driver operations to work.
+ */
+static inline void vdma_pgtbl_init(void)
+{
+	unsigned long paddr = 0;
+	int i;
+
+	for (i = 0; i < VDMA_PGTBL_ENTRIES; i++) {
+		pgtbl[i].frame = paddr;
+		pgtbl[i].owner = VDMA_PAGE_EMPTY;
+		paddr += VDMA_PAGESIZE;
+	}
+}
+
+/*
+ * Initialize the Jazz R4030 dma controller
+ */
+static int __init vdma_init(void)
+{
+	/*
+	 * Allocate 32k of memory for DMA page tables.	This needs to be page
+	 * aligned and should be uncached to avoid cache flushing after every
+	 * update.
+	 */
+	pgtbl = (VDMA_PGTBL_ENTRY *)__get_free_pages(GFP_KERNEL | GFP_DMA,
+						    get_order(VDMA_PGTBL_SIZE));
+	BUG_ON(!pgtbl);
+	dma_cache_wback_inv((unsigned long)pgtbl, VDMA_PGTBL_SIZE);
+	pgtbl = (VDMA_PGTBL_ENTRY *)CKSEG1ADDR((unsigned long)pgtbl);
+
+	/*
+	 * Clear the R4030 translation table
+	 */
+	vdma_pgtbl_init();
+
+	r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE,
+			  CPHYSADDR((unsigned long)pgtbl));
+	r4030_write_reg32(JAZZ_R4030_TRSTBL_LIM, VDMA_PGTBL_SIZE);
+	r4030_write_reg32(JAZZ_R4030_TRSTBL_INV, 0);
+
+	printk(KERN_INFO "VDMA: R4030 DMA pagetables initialized.\n");
+	return 0;
+}
+arch_initcall(vdma_init);
+
+/*
+ * Allocate DMA pagetables using a simple first-fit algorithm
+ */
+unsigned long vdma_alloc(unsigned long paddr, unsigned long size)
+{
+	int first, last, pages, frame, i;
+	unsigned long laddr, flags;
+
+	/* check arguments */
+
+	if (paddr > 0x1fffffff) {
+		if (vdma_debug)
+			printk("vdma_alloc: Invalid physical address: %08lx\n",
+			       paddr);
+		return DMA_MAPPING_ERROR;	/* invalid physical address */
+	}
+	if (size > 0x400000 || size == 0) {
+		if (vdma_debug)
+			printk("vdma_alloc: Invalid size: %08lx\n", size);
+		return DMA_MAPPING_ERROR;	/* invalid physical address */
+	}
+
+	spin_lock_irqsave(&vdma_lock, flags);
+	/*
+	 * Find free chunk
+	 */
+	pages = VDMA_PAGE(paddr + size) - VDMA_PAGE(paddr) + 1;
+	first = 0;
+	while (1) {
+		while (pgtbl[first].owner != VDMA_PAGE_EMPTY &&
+		       first < VDMA_PGTBL_ENTRIES) first++;
+		if (first + pages > VDMA_PGTBL_ENTRIES) {	/* nothing free */
+			spin_unlock_irqrestore(&vdma_lock, flags);
+			return DMA_MAPPING_ERROR;
+		}
+
+		last = first + 1;
+		while (pgtbl[last].owner == VDMA_PAGE_EMPTY
+		       && last - first < pages)
+			last++;
+
+		if (last - first == pages)
+			break;	/* found */
+		first = last + 1;
+	}
+
+	/*
+	 * Mark pages as allocated
+	 */
+	laddr = (first << 12) + (paddr & (VDMA_PAGESIZE - 1));
+	frame = paddr & ~(VDMA_PAGESIZE - 1);
+
+	for (i = first; i < last; i++) {
+		pgtbl[i].frame = frame;
+		pgtbl[i].owner = laddr;
+		frame += VDMA_PAGESIZE;
+	}
+
+	/*
+	 * Update translation table and return logical start address
+	 */
+	r4030_write_reg32(JAZZ_R4030_TRSTBL_INV, 0);
+
+	if (vdma_debug > 1)
+		printk("vdma_alloc: Allocated %d pages starting from %08lx\n",
+		     pages, laddr);
+
+	if (vdma_debug > 2) {
+		printk("LADDR: ");
+		for (i = first; i < last; i++)
+			printk("%08x ", i << 12);
+		printk("\nPADDR: ");
+		for (i = first; i < last; i++)
+			printk("%08x ", pgtbl[i].frame);
+		printk("\nOWNER: ");
+		for (i = first; i < last; i++)
+			printk("%08x ", pgtbl[i].owner);
+		printk("\n");
+	}
+
+	spin_unlock_irqrestore(&vdma_lock, flags);
+
+	return laddr;
+}
+
+EXPORT_SYMBOL(vdma_alloc);
+
+/*
+ * Free previously allocated dma translation pages
+ * Note that this does NOT change the translation table,
+ * it just marks the free'd pages as unused!
+ */
+int vdma_free(unsigned long laddr)
+{
+	int i;
+
+	i = laddr >> 12;
+
+	if (pgtbl[i].owner != laddr) {
+		printk
+		    ("vdma_free: trying to free other's dma pages, laddr=%8lx\n",
+		     laddr);
+		return -1;
+	}
+
+	while (i < VDMA_PGTBL_ENTRIES && pgtbl[i].owner == laddr) {
+		pgtbl[i].owner = VDMA_PAGE_EMPTY;
+		i++;
+	}
+
+	if (vdma_debug > 1)
+		printk("vdma_free: freed %ld pages starting from %08lx\n",
+		       i - (laddr >> 12), laddr);
+
+	return 0;
+}
+
+EXPORT_SYMBOL(vdma_free);
+
+/*
+ * Translate a physical address to a logical address.
+ * This will return the logical address of the first
+ * match.
+ */
+unsigned long vdma_phys2log(unsigned long paddr)
+{
+	int i;
+	int frame;
+
+	frame = paddr & ~(VDMA_PAGESIZE - 1);
+
+	for (i = 0; i < VDMA_PGTBL_ENTRIES; i++) {
+		if (pgtbl[i].frame == frame)
+			break;
+	}
+
+	if (i == VDMA_PGTBL_ENTRIES)
+		return ~0UL;
+
+	return (i << 12) + (paddr & (VDMA_PAGESIZE - 1));
+}
+
+EXPORT_SYMBOL(vdma_phys2log);
+
+/*
+ * Translate a logical DMA address to a physical address
+ */
+unsigned long vdma_log2phys(unsigned long laddr)
+{
+	return pgtbl[laddr >> 12].frame + (laddr & (VDMA_PAGESIZE - 1));
+}
+
+EXPORT_SYMBOL(vdma_log2phys);
+
+/*
+ * Print DMA statistics
+ */
+void vdma_stats(void)
+{
+	int i;
+
+	printk("vdma_stats: CONFIG: %08x\n",
+	       r4030_read_reg32(JAZZ_R4030_CONFIG));
+	printk("R4030 translation table base: %08x\n",
+	       r4030_read_reg32(JAZZ_R4030_TRSTBL_BASE));
+	printk("R4030 translation table limit: %08x\n",
+	       r4030_read_reg32(JAZZ_R4030_TRSTBL_LIM));
+	printk("vdma_stats: INV_ADDR: %08x\n",
+	       r4030_read_reg32(JAZZ_R4030_INV_ADDR));
+	printk("vdma_stats: R_FAIL_ADDR: %08x\n",
+	       r4030_read_reg32(JAZZ_R4030_R_FAIL_ADDR));
+	printk("vdma_stats: M_FAIL_ADDR: %08x\n",
+	       r4030_read_reg32(JAZZ_R4030_M_FAIL_ADDR));
+	printk("vdma_stats: IRQ_SOURCE: %08x\n",
+	       r4030_read_reg32(JAZZ_R4030_IRQ_SOURCE));
+	printk("vdma_stats: I386_ERROR: %08x\n",
+	       r4030_read_reg32(JAZZ_R4030_I386_ERROR));
+	printk("vdma_chnl_modes:   ");
+	for (i = 0; i < 8; i++)
+		printk("%04x ",
+		       (unsigned) r4030_read_reg32(JAZZ_R4030_CHNL_MODE +
+						   (i << 5)));
+	printk("\n");
+	printk("vdma_chnl_enables: ");
+	for (i = 0; i < 8; i++)
+		printk("%04x ",
+		       (unsigned) r4030_read_reg32(JAZZ_R4030_CHNL_ENABLE +
+						   (i << 5)));
+	printk("\n");
+}
+
+/*
+ * DMA transfer functions
+ */
+
+/*
+ * Enable a DMA channel. Also clear any error conditions.
+ */
+void vdma_enable(int channel)
+{
+	int status;
+
+	if (vdma_debug)
+		printk("vdma_enable: channel %d\n", channel);
+
+	/*
+	 * Check error conditions first
+	 */
+	status = r4030_read_reg32(JAZZ_R4030_CHNL_ENABLE + (channel << 5));
+	if (status & 0x400)
+		printk("VDMA: Channel %d: Address error!\n", channel);
+	if (status & 0x200)
+		printk("VDMA: Channel %d: Memory error!\n", channel);
+
+	/*
+	 * Clear all interrupt flags
+	 */
+	r4030_write_reg32(JAZZ_R4030_CHNL_ENABLE + (channel << 5),
+			  r4030_read_reg32(JAZZ_R4030_CHNL_ENABLE +
+					   (channel << 5)) | R4030_TC_INTR
+			  | R4030_MEM_INTR | R4030_ADDR_INTR);
+
+	/*
+	 * Enable the desired channel
+	 */
+	r4030_write_reg32(JAZZ_R4030_CHNL_ENABLE + (channel << 5),
+			  r4030_read_reg32(JAZZ_R4030_CHNL_ENABLE +
+					   (channel << 5)) |
+			  R4030_CHNL_ENABLE);
+}
+
+EXPORT_SYMBOL(vdma_enable);
+
+/*
+ * Disable a DMA channel
+ */
+void vdma_disable(int channel)
+{
+	if (vdma_debug) {
+		int status =
+		    r4030_read_reg32(JAZZ_R4030_CHNL_ENABLE +
+				     (channel << 5));
+
+		printk("vdma_disable: channel %d\n", channel);
+		printk("VDMA: channel %d status: %04x (%s) mode: "
+		       "%02x addr: %06x count: %06x\n",
+		       channel, status,
+		       ((status & 0x600) ? "ERROR" : "OK"),
+		       (unsigned) r4030_read_reg32(JAZZ_R4030_CHNL_MODE +
+						   (channel << 5)),
+		       (unsigned) r4030_read_reg32(JAZZ_R4030_CHNL_ADDR +
+						   (channel << 5)),
+		       (unsigned) r4030_read_reg32(JAZZ_R4030_CHNL_COUNT +
+						   (channel << 5)));
+	}
+
+	r4030_write_reg32(JAZZ_R4030_CHNL_ENABLE + (channel << 5),
+			  r4030_read_reg32(JAZZ_R4030_CHNL_ENABLE +
+					   (channel << 5)) &
+			  ~R4030_CHNL_ENABLE);
+
+	/*
+	 * After disabling a DMA channel a remote bus register should be
+	 * read to ensure that the current DMA acknowledge cycle is completed.
+	 */
+	*((volatile unsigned int *) JAZZ_DUMMY_DEVICE);
+}
+
+EXPORT_SYMBOL(vdma_disable);
+
+/*
+ * Set DMA mode. This function accepts the mode values used
+ * to set a PC-style DMA controller. For the SCSI and FDC
+ * channels, we also set the default modes each time we're
+ * called.
+ * NOTE: The FAST and BURST dma modes are supported by the
+ * R4030 Rev. 2 and PICA chipsets only. I leave them disabled
+ * for now.
+ */
+void vdma_set_mode(int channel, int mode)
+{
+	if (vdma_debug)
+		printk("vdma_set_mode: channel %d, mode 0x%x\n", channel,
+		       mode);
+
+	switch (channel) {
+	case JAZZ_SCSI_DMA:	/* scsi */
+		r4030_write_reg32(JAZZ_R4030_CHNL_MODE + (channel << 5),
+/*			  R4030_MODE_FAST | */
+/*			  R4030_MODE_BURST | */
+				  R4030_MODE_INTR_EN |
+				  R4030_MODE_WIDTH_16 |
+				  R4030_MODE_ATIME_80);
+		break;
+
+	case JAZZ_FLOPPY_DMA:	/* floppy */
+		r4030_write_reg32(JAZZ_R4030_CHNL_MODE + (channel << 5),
+/*			  R4030_MODE_FAST | */
+/*			  R4030_MODE_BURST | */
+				  R4030_MODE_INTR_EN |
+				  R4030_MODE_WIDTH_8 |
+				  R4030_MODE_ATIME_120);
+		break;
+
+	case JAZZ_AUDIOL_DMA:
+	case JAZZ_AUDIOR_DMA:
+		printk("VDMA: Audio DMA not supported yet.\n");
+		break;
+
+	default:
+		printk
+		    ("VDMA: vdma_set_mode() called with unsupported channel %d!\n",
+		     channel);
+	}
+
+	switch (mode) {
+	case DMA_MODE_READ:
+		r4030_write_reg32(JAZZ_R4030_CHNL_ENABLE + (channel << 5),
+				  r4030_read_reg32(JAZZ_R4030_CHNL_ENABLE +
+						   (channel << 5)) &
+				  ~R4030_CHNL_WRITE);
+		break;
+
+	case DMA_MODE_WRITE:
+		r4030_write_reg32(JAZZ_R4030_CHNL_ENABLE + (channel << 5),
+				  r4030_read_reg32(JAZZ_R4030_CHNL_ENABLE +
+						   (channel << 5)) |
+				  R4030_CHNL_WRITE);
+		break;
+
+	default:
+		printk
+		    ("VDMA: vdma_set_mode() called with unknown dma mode 0x%x\n",
+		     mode);
+	}
+}
+
+EXPORT_SYMBOL(vdma_set_mode);
+
+/*
+ * Set Transfer Address
+ */
+void vdma_set_addr(int channel, long addr)
+{
+	if (vdma_debug)
+		printk("vdma_set_addr: channel %d, addr %lx\n", channel,
+		       addr);
+
+	r4030_write_reg32(JAZZ_R4030_CHNL_ADDR + (channel << 5), addr);
+}
+
+EXPORT_SYMBOL(vdma_set_addr);
+
+/*
+ * Set Transfer Count
+ */
+void vdma_set_count(int channel, int count)
+{
+	if (vdma_debug)
+		printk("vdma_set_count: channel %d, count %08x\n", channel,
+		       (unsigned) count);
+
+	r4030_write_reg32(JAZZ_R4030_CHNL_COUNT + (channel << 5), count);
+}
+
+EXPORT_SYMBOL(vdma_set_count);
+
+/*
+ * Get Residual
+ */
+int vdma_get_residue(int channel)
+{
+	int residual;
+
+	residual = r4030_read_reg32(JAZZ_R4030_CHNL_COUNT + (channel << 5));
+
+	if (vdma_debug)
+		printk("vdma_get_residual: channel %d: residual=%d\n",
+		       channel, residual);
+
+	return residual;
+}
+
+/*
+ * Get DMA channel enable register
+ */
+int vdma_get_enable(int channel)
+{
+	int enable;
+
+	enable = r4030_read_reg32(JAZZ_R4030_CHNL_ENABLE + (channel << 5));
+
+	if (vdma_debug)
+		printk("vdma_get_enable: channel %d: enable=%d\n", channel,
+		       enable);
+
+	return enable;
+}
+
+static void *jazz_dma_alloc(struct device *dev, size_t size,
+		dma_addr_t *dma_handle, gfp_t gfp, unsigned long attrs)
+{
+	struct page *page;
+	void *ret;
+
+	if (attrs & DMA_ATTR_NO_WARN)
+		gfp |= __GFP_NOWARN;
+
+	size = PAGE_ALIGN(size);
+	page = alloc_pages(gfp, get_order(size));
+	if (!page)
+		return NULL;
+	ret = page_address(page);
+	memset(ret, 0, size);
+	*dma_handle = vdma_alloc(virt_to_phys(ret), size);
+	if (*dma_handle == DMA_MAPPING_ERROR)
+		goto out_free_pages;
+	arch_dma_prep_coherent(page, size);
+	return (void *)(UNCAC_BASE + __pa(ret));
+
+out_free_pages:
+	__free_pages(page, get_order(size));
+	return NULL;
+}
+
+static void jazz_dma_free(struct device *dev, size_t size, void *vaddr,
+		dma_addr_t dma_handle, unsigned long attrs)
+{
+	vdma_free(dma_handle);
+	__free_pages(virt_to_page(vaddr), get_order(size));
+}
+
+static dma_addr_t jazz_dma_map_phys(struct device *dev, phys_addr_t phys,
+		size_t size, enum dma_data_direction dir, unsigned long attrs)
+{
+	if (unlikely(attrs & DMA_ATTR_MMIO))
+		/*
+		 * This check is included because older versions of the code lacked
+		 * MMIO path support, and my ability to test this path is limited.
+		 * However, from a software technical standpoint, there is no restriction,
+		 * as the following code operates solely on physical addresses.
+		 */
+		return DMA_MAPPING_ERROR;
+
+	if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC))
+		arch_sync_dma_for_device(phys, size, dir);
+	return vdma_alloc(phys, size);
+}
+
+static void jazz_dma_unmap_phys(struct device *dev, dma_addr_t dma_addr,
+		size_t size, enum dma_data_direction dir, unsigned long attrs)
+{
+	if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC))
+		arch_sync_dma_for_cpu(vdma_log2phys(dma_addr), size, dir);
+	vdma_free(dma_addr);
+}
+
+static int jazz_dma_map_sg(struct device *dev, struct scatterlist *sglist,
+		int nents, enum dma_data_direction dir, unsigned long attrs)
+{
+	int i;
+	struct scatterlist *sg;
+
+	for_each_sg(sglist, sg, nents, i) {
+		if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC))
+			arch_sync_dma_for_device(sg_phys(sg), sg->length,
+				dir);
+		sg->dma_address = vdma_alloc(sg_phys(sg), sg->length);
+		if (sg->dma_address == DMA_MAPPING_ERROR)
+			return -EIO;
+		sg_dma_len(sg) = sg->length;
+	}
+
+	return nents;
+}
+
+static void jazz_dma_unmap_sg(struct device *dev, struct scatterlist *sglist,
+		int nents, enum dma_data_direction dir, unsigned long attrs)
+{
+	int i;
+	struct scatterlist *sg;
+
+	for_each_sg(sglist, sg, nents, i) {
+		if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC))
+			arch_sync_dma_for_cpu(sg_phys(sg), sg->length, dir);
+		vdma_free(sg->dma_address);
+	}
+}
+
+static void jazz_dma_sync_single_for_device(struct device *dev,
+		dma_addr_t addr, size_t size, enum dma_data_direction dir)
+{
+	arch_sync_dma_for_device(vdma_log2phys(addr), size, dir);
+}
+
+static void jazz_dma_sync_single_for_cpu(struct device *dev,
+		dma_addr_t addr, size_t size, enum dma_data_direction dir)
+{
+	arch_sync_dma_for_cpu(vdma_log2phys(addr), size, dir);
+}
+
+static void jazz_dma_sync_sg_for_device(struct device *dev,
+		struct scatterlist *sgl, int nents, enum dma_data_direction dir)
+{
+	struct scatterlist *sg;
+	int i;
+
+	for_each_sg(sgl, sg, nents, i)
+		arch_sync_dma_for_device(sg_phys(sg), sg->length, dir);
+}
+
+static void jazz_dma_sync_sg_for_cpu(struct device *dev,
+		struct scatterlist *sgl, int nents, enum dma_data_direction dir)
+{
+	struct scatterlist *sg;
+	int i;
+
+	for_each_sg(sgl, sg, nents, i)
+		arch_sync_dma_for_cpu(sg_phys(sg), sg->length, dir);
+}
+
+const struct dma_map_ops jazz_dma_ops = {
+	.alloc			= jazz_dma_alloc,
+	.free			= jazz_dma_free,
+	.map_phys		= jazz_dma_map_phys,
+	.unmap_phys		= jazz_dma_unmap_phys,
+	.map_sg			= jazz_dma_map_sg,
+	.unmap_sg		= jazz_dma_unmap_sg,
+	.sync_single_for_cpu	= jazz_dma_sync_single_for_cpu,
+	.sync_single_for_device	= jazz_dma_sync_single_for_device,
+	.sync_sg_for_cpu	= jazz_dma_sync_sg_for_cpu,
+	.sync_sg_for_device	= jazz_dma_sync_sg_for_device,
+	.mmap			= dma_common_mmap,
+	.get_sgtable		= dma_common_get_sgtable,
+	.alloc_pages_op		= dma_common_alloc_pages,
+	.free_pages		= dma_common_free_pages,
+};
+EXPORT_SYMBOL(jazz_dma_ops);
diff --git a/arch/mips/jazz/reset.c b/arch/mips/jazz/reset.c
new file mode 100644
index 000000000..052b01f5d
--- /dev/null
+++ b/arch/mips/jazz/reset.c
@@ -0,0 +1,57 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Reset a Jazz machine.
+ *
+ * We don't trust the firmware so we do it the classic way by poking and
+ * stabbing at the keyboard controller ...
+ */
+#include <linux/jiffies.h>
+#include <asm/jazz.h>
+
+#define KBD_STAT_IBF		0x02	/* Keyboard input buffer full */
+
+static void jazz_write_output(unsigned char val)
+{
+	int status;
+
+	do {
+		status = jazz_kh->command;
+	} while (status & KBD_STAT_IBF);
+	jazz_kh->data = val;
+}
+
+static void jazz_write_command(unsigned char val)
+{
+	int status;
+
+	do {
+		status = jazz_kh->command;
+	} while (status & KBD_STAT_IBF);
+	jazz_kh->command = val;
+}
+
+static unsigned char jazz_read_status(void)
+{
+	return jazz_kh->command;
+}
+
+static inline void kb_wait(void)
+{
+	unsigned long start = jiffies;
+	unsigned long timeout = start + HZ/2;
+
+	do {
+		if (! (jazz_read_status() & 0x02))
+			return;
+	} while (time_before_eq(jiffies, timeout));
+}
+
+void jazz_machine_restart(char *command)
+{
+	while(1) {
+		kb_wait();
+		jazz_write_command(0xd1);
+		kb_wait();
+		jazz_write_output(0x00);
+	}
+}
diff --git a/arch/mips/jazz/setup.c b/arch/mips/jazz/setup.c
new file mode 100644
index 000000000..d21e5d441
--- /dev/null
+++ b/arch/mips/jazz/setup.c
@@ -0,0 +1,201 @@
+/*
+ * Setup pointers to hardware-dependent routines.
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 1996, 1997, 1998, 2001, 07, 08 by Ralf Baechle
+ * Copyright (C) 2001 MIPS Technologies, Inc.
+ * Copyright (C) 2007 by Thomas Bogendoerfer
+ */
+#include <linux/eisa.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/console.h>
+#include <linux/platform_device.h>
+#include <linux/serial_8250.h>
+#include <linux/dma-mapping.h>
+#include <linux/pgtable.h>
+
+#include <asm/jazz.h>
+#include <asm/jazzdma.h>
+#include <asm/reboot.h>
+#include <asm/tlbmisc.h>
+
+extern void jazz_machine_restart(char *command);
+
+static struct resource jazz_io_resources[] = {
+	{
+		.start	= 0x00,
+		.end	= 0x1f,
+		.name	= "dma1",
+		.flags	= IORESOURCE_IO | IORESOURCE_BUSY
+	}, {
+		.start	= 0x40,
+		.end	= 0x5f,
+		.name	= "timer",
+		.flags	= IORESOURCE_IO | IORESOURCE_BUSY
+	}, {
+		.start	= 0x80,
+		.end	= 0x8f,
+		.name	= "dma page reg",
+		.flags	= IORESOURCE_IO | IORESOURCE_BUSY
+	}, {
+		.start	= 0xc0,
+		.end	= 0xdf,
+		.name	= "dma2",
+		.flags	= IORESOURCE_IO | IORESOURCE_BUSY
+	}
+};
+
+void __init plat_mem_setup(void)
+{
+	int i;
+
+	/* Map 0xe0000000 -> 0x0:800005C0, 0xe0010000 -> 0x1:30000580 */
+	add_wired_entry(0x02000017, 0x03c00017, 0xe0000000, PM_64K);
+	/* Map 0xe2000000 -> 0x0:900005C0, 0xe3010000 -> 0x0:910005C0 */
+	add_wired_entry(0x02400017, 0x02440017, 0xe2000000, PM_16M);
+	/* Map 0xe4000000 -> 0x0:600005C0, 0xe4100000 -> 400005C0 */
+	add_wired_entry(0x01800017, 0x01000017, 0xe4000000, PM_4M);
+
+	set_io_port_base(JAZZ_PORT_BASE);
+#ifdef CONFIG_EISA
+	EISA_bus = 1;
+#endif
+
+	/* request I/O space for devices used on all i[345]86 PCs */
+	for (i = 0; i < ARRAY_SIZE(jazz_io_resources); i++)
+		request_resource(&ioport_resource, jazz_io_resources + i);
+
+	/* The RTC is outside the port address space */
+
+	_machine_restart = jazz_machine_restart;
+
+	add_preferred_console("ttyS", 0, "9600");
+}
+
+#ifdef CONFIG_OLIVETTI_M700
+#define UART_CLK  1843200
+#else
+/* Some Jazz machines seem to have an 8MHz crystal clock but I don't know
+   exactly which ones ... XXX */
+#define UART_CLK (8000000 / 16) /* ( 3072000 / 16) */
+#endif
+
+#define MEMPORT(_base, _irq)				\
+	{						\
+		.mapbase	= (_base),		\
+		.membase	= (void *)(_base),	\
+		.irq		= (_irq),		\
+		.uartclk	= UART_CLK,		\
+		.iotype		= UPIO_MEM,		\
+		.flags		= UPF_BOOT_AUTOCONF,	\
+	}
+
+static struct plat_serial8250_port jazz_serial_data[] = {
+	MEMPORT(JAZZ_SERIAL1_BASE, JAZZ_SERIAL1_IRQ),
+	MEMPORT(JAZZ_SERIAL2_BASE, JAZZ_SERIAL2_IRQ),
+	{ },
+};
+
+static struct platform_device jazz_serial8250_device = {
+	.name			= "serial8250",
+	.id			= PLAT8250_DEV_PLATFORM,
+	.dev			= {
+		.platform_data	= jazz_serial_data,
+	},
+};
+
+static struct resource jazz_esp_rsrc[] = {
+	{
+		.start = JAZZ_SCSI_BASE,
+		.end   = JAZZ_SCSI_BASE + 31,
+		.flags = IORESOURCE_MEM
+	},
+	{
+		.start = JAZZ_SCSI_DMA,
+		.end   = JAZZ_SCSI_DMA,
+		.flags = IORESOURCE_MEM
+	},
+	{
+		.start = JAZZ_SCSI_IRQ,
+		.end   = JAZZ_SCSI_IRQ,
+		.flags = IORESOURCE_IRQ
+	}
+};
+
+static u64 jazz_esp_dma_mask = DMA_BIT_MASK(32);
+
+static struct platform_device jazz_esp_pdev = {
+	.name		= "jazz_esp",
+	.num_resources	= ARRAY_SIZE(jazz_esp_rsrc),
+	.resource	= jazz_esp_rsrc,
+	.dev = {
+		.dma_mask	   = &jazz_esp_dma_mask,
+		.coherent_dma_mask = DMA_BIT_MASK(32),
+	}
+};
+
+static struct resource jazz_sonic_rsrc[] = {
+	{
+		.start = JAZZ_ETHERNET_BASE,
+		.end   = JAZZ_ETHERNET_BASE + 0xff,
+		.flags = IORESOURCE_MEM
+	},
+	{
+		.start = JAZZ_ETHERNET_IRQ,
+		.end   = JAZZ_ETHERNET_IRQ,
+		.flags = IORESOURCE_IRQ
+	}
+};
+
+static u64 jazz_sonic_dma_mask = DMA_BIT_MASK(32);
+
+static struct platform_device jazz_sonic_pdev = {
+	.name		= "jazzsonic",
+	.num_resources	= ARRAY_SIZE(jazz_sonic_rsrc),
+	.resource	= jazz_sonic_rsrc,
+	.dev = {
+		.dma_mask	   = &jazz_sonic_dma_mask,
+		.coherent_dma_mask = DMA_BIT_MASK(32),
+	}
+};
+
+static struct resource jazz_cmos_rsrc[] = {
+	{
+		.start = 0x70,
+		.end   = 0x71,
+		.flags = IORESOURCE_IO
+	},
+	{
+		.start = 8,
+		.end   = 8,
+		.flags = IORESOURCE_IRQ
+	}
+};
+
+static struct platform_device jazz_cmos_pdev = {
+	.name		= "rtc_cmos",
+	.num_resources	= ARRAY_SIZE(jazz_cmos_rsrc),
+	.resource	= jazz_cmos_rsrc
+};
+
+static struct platform_device pcspeaker_pdev = {
+	.name		= "pcspkr",
+	.id		= -1,
+};
+
+static int __init jazz_setup_devinit(void)
+{
+	platform_device_register(&jazz_serial8250_device);
+	platform_device_register(&jazz_esp_pdev);
+	platform_device_register(&jazz_sonic_pdev);
+	platform_device_register(&jazz_cmos_pdev);
+	platform_device_register(&pcspeaker_pdev);
+
+	return 0;
+}
+
+device_initcall(jazz_setup_devinit);