x86/kprobes: Fix crash when probing CS CALL instructionsgrafted

When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:

<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>:  mov    %r14,%rdi
<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>:  mov    %eax,%r12d
<__hrtimer_run_queues+266>:  xchg   %ax,%ax
<__hrtimer_run_queues+268>:  mov    %r13,%rdi

Which triggers this crash:

  BUG: unable to handle page fault for address: 00000000000f41c9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
  RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.

The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.

During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.

Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.

[ mingo: Refined the changelog ]

Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Jinke Han <jinkehan@didiglobal.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000

9 files changed, 1156 insertions, 0 deletions

diff --git a/arch/mips/rb532/Makefile b/arch/mips/rb532/Makefile
new file mode 100644
index 000000000..fb4b4bf83
--- /dev/null
+++ b/arch/mips/rb532/Makefile
@@ -0,0 +1,8 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Makefile for the RB532 board specific parts of the kernel
+#
+
+obj-$(CONFIG_SERIAL_8250_CONSOLE) += serial.o
+
+obj-y	 += irq.o time.o setup.o prom.o gpio.o devices.o
diff --git a/arch/mips/rb532/Platform b/arch/mips/rb532/Platform
new file mode 100644
index 000000000..12eaa8790
--- /dev/null
+++ b/arch/mips/rb532/Platform
@@ -0,0 +1,6 @@
+#
+# Routerboard 532
+#
+cflags-$(CONFIG_MIKROTIK_RB532)		+=				\
+		-I$(srctree)/arch/mips/include/asm/mach-rc32434
+load-$(CONFIG_MIKROTIK_RB532)		+= 0xffffffff80101000
diff --git a/arch/mips/rb532/devices.c b/arch/mips/rb532/devices.c
new file mode 100644
index 000000000..a6e3dc112
--- /dev/null
+++ b/arch/mips/rb532/devices.c
@@ -0,0 +1,374 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *  RouterBoard 500 Platform devices
+ *
+ *  Copyright (C) 2006 Felix Fietkau <nbd@openwrt.org>
+ *  Copyright (C) 2007 Florian Fainelli <florian@openwrt.org>
+ */
+#include <linux/kernel.h>
+#include <linux/export.h>
+#include <linux/hex.h>
+#include <linux/init.h>
+#include <linux/ctype.h>
+#include <linux/string.h>
+#include <linux/platform_device.h>
+#include <linux/mtd/platnand.h>
+#include <linux/mtd/mtd.h>
+#include <linux/gpio/machine.h>
+#include <linux/gpio/property.h>
+#include <linux/gpio_keys.h>
+#include <linux/input.h>
+#include <linux/property.h>
+#include <linux/serial_8250.h>
+
+#include <asm/bootinfo.h>
+
+#include <asm/mach-rc32434/rc32434.h>
+#include <asm/mach-rc32434/dma.h>
+#include <asm/mach-rc32434/dma_v.h>
+#include <asm/mach-rc32434/eth.h>
+#include <asm/mach-rc32434/rb.h>
+#include <asm/mach-rc32434/integ.h>
+#include <asm/mach-rc32434/gpio.h>
+#include <asm/mach-rc32434/irq.h>
+
+#define ETH0_RX_DMA_ADDR  (DMA0_BASE_ADDR + 0 * DMA_CHAN_OFFSET)
+#define ETH0_TX_DMA_ADDR  (DMA0_BASE_ADDR + 1 * DMA_CHAN_OFFSET)
+
+extern unsigned int idt_cpu_freq;
+
+static struct mpmc_device dev3;
+
+static const struct software_node rb532_gpio0_node = {
+	.name = "gpio0",
+};
+
+void set_latch_u5(unsigned char or_mask, unsigned char nand_mask)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&dev3.lock, flags);
+
+	dev3.state = (dev3.state | or_mask) & ~nand_mask;
+	writeb(dev3.state, dev3.base);
+
+	spin_unlock_irqrestore(&dev3.lock, flags);
+}
+EXPORT_SYMBOL(set_latch_u5);
+
+unsigned char get_latch_u5(void)
+{
+	return dev3.state;
+}
+EXPORT_SYMBOL(get_latch_u5);
+
+static struct resource korina_dev0_res[] = {
+	{
+		.name = "emac",
+		.start = ETH0_BASE_ADDR,
+		.end = ETH0_BASE_ADDR + sizeof(struct eth_regs),
+		.flags = IORESOURCE_MEM,
+	 }, {
+		.name = "rx",
+		.start = ETH0_DMA_RX_IRQ,
+		.end = ETH0_DMA_RX_IRQ,
+		.flags = IORESOURCE_IRQ
+	}, {
+		.name = "tx",
+		.start = ETH0_DMA_TX_IRQ,
+		.end = ETH0_DMA_TX_IRQ,
+		.flags = IORESOURCE_IRQ
+	}, {
+		.name = "dma_rx",
+		.start = ETH0_RX_DMA_ADDR,
+		.end = ETH0_RX_DMA_ADDR + DMA_CHAN_OFFSET - 1,
+		.flags = IORESOURCE_MEM,
+	 }, {
+		.name = "dma_tx",
+		.start = ETH0_TX_DMA_ADDR,
+		.end = ETH0_TX_DMA_ADDR + DMA_CHAN_OFFSET - 1,
+		.flags = IORESOURCE_MEM,
+	 }
+};
+
+static struct korina_device korina_dev0_data = {
+	.name = "korina0",
+	.mac = {0xde, 0xca, 0xff, 0xc0, 0xff, 0xee}
+};
+
+static struct platform_device korina_dev0 = {
+	.id = -1,
+	.name = "korina",
+	.resource = korina_dev0_res,
+	.num_resources = ARRAY_SIZE(korina_dev0_res),
+	.dev = {
+		.platform_data = &korina_dev0_data.mac,
+	}
+};
+
+static struct resource cf_slot0_res[] = {
+	{
+		.name = "cf_membase",
+		.flags = IORESOURCE_MEM
+	}, {
+		.name = "cf_irq",
+		.start = (8 + 4 * 32 + CF_GPIO_NUM),	/* 149 */
+		.end = (8 + 4 * 32 + CF_GPIO_NUM),
+		.flags = IORESOURCE_IRQ
+	}
+};
+
+static struct gpiod_lookup_table cf_slot0_gpio_table = {
+	.dev_id = "pata-rb532-cf",
+	.table = {
+		GPIO_LOOKUP("gpio0", CF_GPIO_NUM,
+			    NULL, GPIO_ACTIVE_HIGH),
+		{ },
+	},
+};
+
+static struct platform_device cf_slot0 = {
+	.id = -1,
+	.name = "pata-rb532-cf",
+	.resource = cf_slot0_res,
+	.num_resources = ARRAY_SIZE(cf_slot0_res),
+};
+
+static void rb532_cmd_ctrl(struct nand_chip *chip, int cmd, unsigned int ctrl)
+{
+	unsigned char orbits, nandbits;
+
+	if (ctrl & NAND_CTRL_CHANGE) {
+		orbits = (ctrl & NAND_CLE) << 1;
+		orbits |= (ctrl & NAND_ALE) >> 1;
+
+		nandbits = (~ctrl & NAND_CLE) << 1;
+		nandbits |= (~ctrl & NAND_ALE) >> 1;
+
+		set_latch_u5(orbits, nandbits);
+	}
+	if (cmd != NAND_CMD_NONE)
+		writeb(cmd, chip->legacy.IO_ADDR_W);
+}
+
+static struct resource nand_slot0_res[] = {
+	[0] = {
+		.name = "nand_membase",
+		.flags = IORESOURCE_MEM
+	}
+};
+
+static struct platform_nand_data rb532_nand_data = {
+	.ctrl.cmd_ctrl	= rb532_cmd_ctrl,
+};
+
+static const struct property_entry nand0_properties[] = {
+	PROPERTY_ENTRY_GPIO("ready-gpios", &rb532_gpio0_node,
+			    GPIO_RDY, GPIO_ACTIVE_HIGH),
+	{ }
+};
+
+static const struct platform_device_info nand0_info  __initconst = {
+	.name		= "gen_nand",
+	.id		= PLATFORM_DEVID_NONE,
+	.res		= nand_slot0_res,
+	.num_res	= ARRAY_SIZE(nand_slot0_res),
+	.data		= &rb532_nand_data,
+	.size_data	= sizeof(struct platform_nand_data),
+	.properties	= nand0_properties,
+};
+
+static struct mtd_partition rb532_partition_info[] = {
+	{
+		.name = "Routerboard NAND boot",
+		.offset = 0,
+		.size = 4 * 1024 * 1024,
+	}, {
+		.name = "rootfs",
+		.offset = MTDPART_OFS_NXTBLK,
+		.size = MTDPART_SIZ_FULL,
+	}
+};
+
+static struct platform_device rb532_led = {
+	.name = "rb532-led",
+	.id = -1,
+};
+
+static struct resource rb532_wdt_res[] = {
+	{
+		.name = "rb532_wdt_res",
+		.start = INTEG0_BASE_ADDR,
+		.end = INTEG0_BASE_ADDR + sizeof(struct integ),
+		.flags = IORESOURCE_MEM,
+	}
+};
+
+static struct platform_device rb532_wdt = {
+	.name		= "rc32434_wdt",
+	.id		= -1,
+	.resource	= rb532_wdt_res,
+	.num_resources	= ARRAY_SIZE(rb532_wdt_res),
+};
+
+static struct plat_serial8250_port rb532_uart_res[] = {
+	{
+		.type           = PORT_16550A,
+		.mapbase        = REGBASE + UART0BASE,
+		.mapsize        = 0x1000,
+		.irq		= UART0_IRQ,
+		.regshift	= 2,
+		.iotype		= UPIO_MEM,
+		.flags		= UPF_BOOT_AUTOCONF | UPF_IOREMAP,
+	},
+	{
+		.flags		= 0,
+	}
+};
+
+static struct platform_device rb532_uart = {
+	.name		   = "serial8250",
+	.id		   = PLAT8250_DEV_PLATFORM,
+	.dev.platform_data = &rb532_uart_res,
+};
+
+static struct platform_device *rb532_devs[] = {
+	&korina_dev0,
+	&cf_slot0,
+	&rb532_led,
+	&rb532_uart,
+	&rb532_wdt
+};
+
+#define GPIOBASE 0x050000
+
+static struct resource rb532_gpio_reg0_res[] = {
+	{
+		.name	= "gpio_reg0",
+		.start	= REGBASE + GPIOBASE,
+		.end	= REGBASE + GPIOBASE + sizeof(struct rb532_gpio_reg) - 1,
+		.flags	= IORESOURCE_MEM,
+	}
+};
+
+static struct platform_device_info rb532_gpio_devinfo = {
+	.name		= "rb532-gpio",
+	.id		= PLATFORM_DEVID_NONE,
+	.res		= rb532_gpio_reg0_res,
+	.num_res	= ARRAY_SIZE(rb532_gpio_reg0_res),
+	.swnode		= &rb532_gpio0_node,
+};
+
+static const struct property_entry rb532_button_properties[] = {
+	PROPERTY_ENTRY_GPIO("button-gpios", &rb532_gpio0_node,
+			    GPIO_BTN_S1, GPIO_ACTIVE_LOW),
+	{ }
+};
+
+static const struct platform_device_info rb532_button_info  __initconst = {
+	.name		= "rb532-button",
+	.id		= PLATFORM_DEVID_NONE,
+	.properties	= rb532_button_properties,
+};
+
+
+/* NAND definitions */
+#define NAND_CHIP_DELAY 25
+
+static void __init rb532_nand_setup(void)
+{
+	switch (mips_machtype) {
+	case MACH_MIKROTIK_RB532A:
+		set_latch_u5(LO_FOFF | LO_CEX,
+				LO_ULED | LO_ALE | LO_CLE | LO_WPX);
+		break;
+	default:
+		set_latch_u5(LO_WPX | LO_FOFF | LO_CEX,
+				LO_ULED | LO_ALE | LO_CLE);
+		break;
+	}
+
+	/* Setup NAND specific settings */
+	rb532_nand_data.chip.nr_chips = 1;
+	rb532_nand_data.chip.nr_partitions = ARRAY_SIZE(rb532_partition_info);
+	rb532_nand_data.chip.partitions = rb532_partition_info;
+	rb532_nand_data.chip.chip_delay = NAND_CHIP_DELAY;
+}
+
+
+static int __init plat_setup_devices(void)
+{
+	struct platform_device *pd;
+	int ret;
+
+	/* Look for the CF card reader */
+	if (!readl(IDT434_REG_BASE + DEV1MASK))
+		rb532_devs[2] = NULL;	/* disable cf_slot0 at index 2 */
+	else {
+		cf_slot0_res[0].start =
+		    readl(IDT434_REG_BASE + DEV1BASE);
+		cf_slot0_res[0].end = cf_slot0_res[0].start + 0x1000;
+	}
+
+	/* Read the NAND resources from the device controller */
+	nand_slot0_res[0].start = readl(IDT434_REG_BASE + DEV2BASE);
+	nand_slot0_res[0].end = nand_slot0_res[0].start + 0x1000;
+
+	/* Read and map device controller 3 */
+	dev3.base = ioremap(readl(IDT434_REG_BASE + DEV3BASE), 1);
+
+	if (!dev3.base) {
+		printk(KERN_ERR "rb532: cannot remap device controller 3\n");
+		return -ENXIO;
+	}
+
+	/* Initialise the NAND device */
+	rb532_nand_setup();
+
+	/* set the uart clock to the current cpu frequency */
+	rb532_uart_res[0].uartclk = idt_cpu_freq;
+
+	pd = platform_device_register_full(&rb532_gpio_devinfo);
+	ret = PTR_ERR_OR_ZERO(pd);
+	if (ret) {
+		pr_err("failed to create the GPIO device: %d\n", ret);
+		return ret;
+	}
+
+	gpiod_add_lookup_table(&cf_slot0_gpio_table);
+	ret = platform_add_devices(rb532_devs, ARRAY_SIZE(rb532_devs));
+	if (ret)
+		return ret;
+
+	pd = platform_device_register_full(&nand0_info);
+	ret = PTR_ERR_OR_ZERO(pd);
+	if (ret) {
+		pr_err("failed to create NAND slot0 device: %d\n", ret);
+		return ret;
+	}
+
+	pd = platform_device_register_full(&rb532_button_info);
+	ret = PTR_ERR_OR_ZERO(pd);
+	if (ret) {
+		pr_err("failed to create RB532 button device: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+#ifdef CONFIG_NET
+
+static int __init setup_kmac(char *s)
+{
+	printk(KERN_INFO "korina mac = %s\n", s);
+	if (!mac_pton(s, korina_dev0_data.mac))
+		printk(KERN_ERR "Invalid mac\n");
+	return 1;
+}
+
+__setup("kmac=", setup_kmac);
+
+#endif /* CONFIG_NET */
+
+arch_initcall(plat_setup_devices);
diff --git a/arch/mips/rb532/gpio.c b/arch/mips/rb532/gpio.c
new file mode 100644
index 000000000..49e1a15a3
--- /dev/null
+++ b/arch/mips/rb532/gpio.c
@@ -0,0 +1,220 @@
+/*
+ *  Miscellaneous functions for IDT EB434 board
+ *
+ *  Copyright 2004 IDT Inc. (rischelp@idt.com)
+ *  Copyright 2006 Phil Sutter <n0-1@freewrt.org>
+ *  Copyright 2007 Florian Fainelli <florian@openwrt.org>
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
+ *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
+ *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
+ *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
+ *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
+ *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *  You should have received a copy of the  GNU General Public License along
+ *  with this program; if not, write  to the Free Software Foundation, Inc.,
+ *  675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/export.h>
+#include <linux/spinlock.h>
+#include <linux/platform_device.h>
+#include <linux/gpio/driver.h>
+
+#include <asm/mach-rc32434/rb.h>
+#include <asm/mach-rc32434/gpio.h>
+
+/* Offsets relative to GPIOBASE */
+#define GPIOFUNC	0x00
+#define GPIOCFG		0x04
+#define GPIOD		0x08
+#define GPIOILEVEL	0x0C
+#define GPIOISTAT	0x10
+#define GPIONMIEN	0x14
+#define IMASK6		0x38
+
+struct rb532_gpio_chip {
+	struct gpio_chip chip;
+	void __iomem	 *regbase;
+};
+
+/* rb532_set_bit - sanely set a bit
+ *
+ * bitval: new value for the bit
+ * offset: bit index in the 4 byte address range
+ * ioaddr: 4 byte aligned address being altered
+ */
+static inline void rb532_set_bit(unsigned bitval,
+		unsigned offset, void __iomem *ioaddr)
+{
+	unsigned long flags;
+	u32 val;
+
+	local_irq_save(flags);
+
+	val = readl(ioaddr);
+	val &= ~(!bitval << offset);   /* unset bit if bitval == 0 */
+	val |= (!!bitval << offset);   /* set bit if bitval == 1 */
+	writel(val, ioaddr);
+
+	local_irq_restore(flags);
+}
+
+/* rb532_get_bit - read a bit
+ *
+ * returns the boolean state of the bit, which may be > 1
+ */
+static inline int rb532_get_bit(unsigned offset, void __iomem *ioaddr)
+{
+	return readl(ioaddr) & (1 << offset);
+}
+
+/*
+ * Return GPIO level */
+static int rb532_gpio_get(struct gpio_chip *chip, unsigned offset)
+{
+	struct rb532_gpio_chip	*gpch;
+
+	gpch = gpiochip_get_data(chip);
+	return !!rb532_get_bit(offset, gpch->regbase + GPIOD);
+}
+
+/*
+ * Set output GPIO level
+ */
+static int rb532_gpio_set(struct gpio_chip *chip, unsigned int offset,
+			  int value)
+{
+	struct rb532_gpio_chip	*gpch;
+
+	gpch = gpiochip_get_data(chip);
+	rb532_set_bit(value, offset, gpch->regbase + GPIOD);
+
+	return 0;
+}
+
+/*
+ * Set GPIO direction to input
+ */
+static int rb532_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
+{
+	struct rb532_gpio_chip	*gpch;
+
+	gpch = gpiochip_get_data(chip);
+
+	/* disable alternate function in case it's set */
+	rb532_set_bit(0, offset, gpch->regbase + GPIOFUNC);
+
+	rb532_set_bit(0, offset, gpch->regbase + GPIOCFG);
+	return 0;
+}
+
+/*
+ * Set GPIO direction to output
+ */
+static int rb532_gpio_direction_output(struct gpio_chip *chip,
+					unsigned offset, int value)
+{
+	struct rb532_gpio_chip	*gpch;
+
+	gpch = gpiochip_get_data(chip);
+
+	/* disable alternate function in case it's set */
+	rb532_set_bit(0, offset, gpch->regbase + GPIOFUNC);
+
+	/* set the initial output value */
+	rb532_set_bit(value, offset, gpch->regbase + GPIOD);
+
+	rb532_set_bit(1, offset, gpch->regbase + GPIOCFG);
+	return 0;
+}
+
+static int rb532_gpio_to_irq(struct gpio_chip *chip, unsigned gpio)
+{
+	return 8 + 4 * 32 + gpio;
+}
+
+static struct rb532_gpio_chip rb532_gpio_chip[] = {
+	[0] = {
+		.chip = {
+			.label			= "gpio0",
+			.direction_input	= rb532_gpio_direction_input,
+			.direction_output	= rb532_gpio_direction_output,
+			.get			= rb532_gpio_get,
+			.set			= rb532_gpio_set,
+			.to_irq			= rb532_gpio_to_irq,
+			.base			= 0,
+			.ngpio			= 32,
+		},
+	},
+};
+
+/*
+ * Set GPIO interrupt level
+ */
+void rb532_gpio_set_ilevel(int bit, unsigned gpio)
+{
+	rb532_set_bit(bit, gpio, rb532_gpio_chip->regbase + GPIOILEVEL);
+}
+EXPORT_SYMBOL(rb532_gpio_set_ilevel);
+
+/*
+ * Set GPIO interrupt status
+ */
+void rb532_gpio_set_istat(int bit, unsigned gpio)
+{
+	rb532_set_bit(bit, gpio, rb532_gpio_chip->regbase + GPIOISTAT);
+}
+EXPORT_SYMBOL(rb532_gpio_set_istat);
+
+/*
+ * Configure GPIO alternate function
+ */
+void rb532_gpio_set_func(unsigned gpio)
+{
+       rb532_set_bit(1, gpio, rb532_gpio_chip->regbase + GPIOFUNC);
+}
+EXPORT_SYMBOL(rb532_gpio_set_func);
+
+static int rb532_gpio_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct resource *res;
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!res)
+		return -EINVAL;
+
+	rb532_gpio_chip->regbase = devm_ioremap_resource(dev, res);
+	if (IS_ERR(rb532_gpio_chip->regbase))
+		return PTR_ERR(rb532_gpio_chip->regbase);
+
+	/* Register our GPIO chip */
+	return devm_gpiochip_add_data(dev, &rb532_gpio_chip->chip, rb532_gpio_chip);
+}
+
+static struct platform_driver rb532_gpio_driver = {
+	.driver = {
+		.name = "rb532-gpio",
+	},
+	.probe = rb532_gpio_probe,
+};
+
+static int __init rb532_gpio_init(void)
+{
+	return platform_driver_register(&rb532_gpio_driver);
+}
+arch_initcall(rb532_gpio_init);
diff --git a/arch/mips/rb532/irq.c b/arch/mips/rb532/irq.c
new file mode 100644
index 000000000..25cc250f2
--- /dev/null
+++ b/arch/mips/rb532/irq.c
@@ -0,0 +1,234 @@
+/*
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
+ *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
+ *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
+ *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
+ *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
+ *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *  You should have received a copy of the  GNU General Public License along
+ *  with this program; if not, write  to the Free Software Foundation, Inc.,
+ *  675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ * Copyright 2002 MontaVista Software Inc.
+ * Author: MontaVista Software, Inc.
+ *		stevel@mvista.com or source@mvista.com
+ */
+
+#include <linux/bitops.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/io.h>
+#include <linux/kernel_stat.h>
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/types.h>
+#include <linux/interrupt.h>
+#include <linux/ioport.h>
+#include <linux/timex.h>
+#include <linux/random.h>
+#include <linux/delay.h>
+
+#include <asm/bootinfo.h>
+#include <asm/time.h>
+#include <asm/mipsregs.h>
+
+#include <asm/mach-rc32434/irq.h>
+#include <asm/mach-rc32434/gpio.h>
+
+struct intr_group {
+	u32 mask;	/* mask of valid bits in pending/mask registers */
+	volatile u32 *base_addr;
+};
+
+#define RC32434_NR_IRQS	 (GROUP4_IRQ_BASE + 32)
+
+#if (NR_IRQS < RC32434_NR_IRQS)
+#error Too little irqs defined. Did you override <asm/irq.h> ?
+#endif
+
+static const struct intr_group intr_group[NUM_INTR_GROUPS] = {
+	{
+		.mask	= 0x0000efff,
+		.base_addr = (u32 *) KSEG1ADDR(IC_GROUP0_PEND + 0 * IC_GROUP_OFFSET)},
+	{
+		.mask	= 0x00001fff,
+		.base_addr = (u32 *) KSEG1ADDR(IC_GROUP0_PEND + 1 * IC_GROUP_OFFSET)},
+	{
+		.mask	= 0x00000007,
+		.base_addr = (u32 *) KSEG1ADDR(IC_GROUP0_PEND + 2 * IC_GROUP_OFFSET)},
+	{
+		.mask	= 0x0003ffff,
+		.base_addr = (u32 *) KSEG1ADDR(IC_GROUP0_PEND + 3 * IC_GROUP_OFFSET)},
+	{
+		.mask	= 0xffffffff,
+		.base_addr = (u32 *) KSEG1ADDR(IC_GROUP0_PEND + 4 * IC_GROUP_OFFSET)}
+};
+
+#define READ_PEND(base) (*(base))
+#define READ_MASK(base) (*(base + 2))
+#define WRITE_MASK(base, val) (*(base + 2) = (val))
+
+static inline int irq_to_group(unsigned int irq_nr)
+{
+	return (irq_nr - GROUP0_IRQ_BASE) >> 5;
+}
+
+static inline int group_to_ip(unsigned int group)
+{
+	return group + 2;
+}
+
+static inline void enable_local_irq(unsigned int ip)
+{
+	int ipnum = 0x100 << ip;
+
+	set_c0_status(ipnum);
+}
+
+static inline void disable_local_irq(unsigned int ip)
+{
+	int ipnum = 0x100 << ip;
+
+	clear_c0_status(ipnum);
+}
+
+static inline void ack_local_irq(unsigned int ip)
+{
+	int ipnum = 0x100 << ip;
+
+	clear_c0_cause(ipnum);
+}
+
+static void rb532_enable_irq(struct irq_data *d)
+{
+	unsigned int group, intr_bit, irq_nr = d->irq;
+	int ip = irq_nr - GROUP0_IRQ_BASE;
+	volatile unsigned int *addr;
+
+	if (ip < 0)
+		enable_local_irq(irq_nr);
+	else {
+		group = ip >> 5;
+
+		ip &= (1 << 5) - 1;
+		intr_bit = 1 << ip;
+
+		enable_local_irq(group_to_ip(group));
+
+		addr = intr_group[group].base_addr;
+		WRITE_MASK(addr, READ_MASK(addr) & ~intr_bit);
+	}
+}
+
+static void rb532_disable_irq(struct irq_data *d)
+{
+	unsigned int group, intr_bit, mask, irq_nr = d->irq;
+	int ip = irq_nr - GROUP0_IRQ_BASE;
+	volatile unsigned int *addr;
+
+	if (ip < 0) {
+		disable_local_irq(irq_nr);
+	} else {
+		group = ip >> 5;
+
+		ip &= (1 << 5) - 1;
+		intr_bit = 1 << ip;
+		addr = intr_group[group].base_addr;
+		mask = READ_MASK(addr);
+		mask |= intr_bit;
+		WRITE_MASK(addr, mask);
+
+		/* There is a maximum of 14 GPIO interrupts */
+		if (group == GPIO_MAPPED_IRQ_GROUP && irq_nr <= (GROUP4_IRQ_BASE + 13))
+			rb532_gpio_set_istat(0, irq_nr - GPIO_MAPPED_IRQ_BASE);
+
+		/*
+		 * if there are no more interrupts enabled in this
+		 * group, disable corresponding IP
+		 */
+		if (mask == intr_group[group].mask)
+			disable_local_irq(group_to_ip(group));
+	}
+}
+
+static void rb532_mask_and_ack_irq(struct irq_data *d)
+{
+	rb532_disable_irq(d);
+	ack_local_irq(group_to_ip(irq_to_group(d->irq)));
+}
+
+static int rb532_set_type(struct irq_data *d,  unsigned type)
+{
+	int gpio = d->irq - GPIO_MAPPED_IRQ_BASE;
+	int group = irq_to_group(d->irq);
+
+	if (group != GPIO_MAPPED_IRQ_GROUP || d->irq > (GROUP4_IRQ_BASE + 13))
+		return (type == IRQ_TYPE_LEVEL_HIGH) ? 0 : -EINVAL;
+
+	switch (type) {
+	case IRQ_TYPE_LEVEL_HIGH:
+		rb532_gpio_set_ilevel(1, gpio);
+		break;
+	case IRQ_TYPE_LEVEL_LOW:
+		rb532_gpio_set_ilevel(0, gpio);
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static struct irq_chip rc32434_irq_type = {
+	.name		= "RB532",
+	.irq_ack	= rb532_disable_irq,
+	.irq_mask	= rb532_disable_irq,
+	.irq_mask_ack	= rb532_mask_and_ack_irq,
+	.irq_unmask	= rb532_enable_irq,
+	.irq_set_type	= rb532_set_type,
+};
+
+void __init arch_init_irq(void)
+{
+	int i;
+
+	pr_info("Initializing IRQ's: %d out of %d\n", RC32434_NR_IRQS, NR_IRQS);
+
+	for (i = 0; i < RC32434_NR_IRQS; i++)
+		irq_set_chip_and_handler(i, &rc32434_irq_type,
+					 handle_level_irq);
+}
+
+/* Main Interrupt dispatcher */
+asmlinkage void plat_irq_dispatch(void)
+{
+	unsigned int ip, pend, group;
+	volatile unsigned int *addr;
+	unsigned int cp0_cause = read_c0_cause() & read_c0_status();
+
+	if (cp0_cause & CAUSEF_IP7) {
+		do_IRQ(7);
+	} else {
+		ip = (cp0_cause & 0x7c00);
+		if (ip) {
+			group = 21 + (fls(ip) - 32);
+
+			addr = intr_group[group].base_addr;
+
+			pend = READ_PEND(addr);
+			pend &= ~READ_MASK(addr);	/* only unmasked interrupts */
+			pend = 39 + (fls(pend) - 32);
+			do_IRQ((group << 5) + pend);
+		}
+	}
+}
diff --git a/arch/mips/rb532/prom.c b/arch/mips/rb532/prom.c
new file mode 100644
index 000000000..8c370eb18
--- /dev/null
+++ b/arch/mips/rb532/prom.c
@@ -0,0 +1,125 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *  RouterBoard 500 specific prom routines
+ *
+ *  Copyright (C) 2003, Peter Sadik <peter.sadik@idt.com>
+ *  Copyright (C) 2005-2006, P.Christeas <p_christ@hol.gr>
+ *  Copyright (C) 2007, Gabor Juhos <juhosg@openwrt.org>
+ *			Felix Fietkau <nbd@openwrt.org>
+ *			Florian Fainelli <florian@openwrt.org>
+ */
+
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/export.h>
+#include <linux/string.h>
+#include <linux/console.h>
+#include <linux/memblock.h>
+#include <linux/ioport.h>
+
+#include <asm/bootinfo.h>
+#include <asm/mach-rc32434/ddr.h>
+#include <asm/mach-rc32434/prom.h>
+
+unsigned int idt_cpu_freq = 132000000;
+EXPORT_SYMBOL(idt_cpu_freq);
+
+static struct resource ddr_reg[] = {
+	{
+		.name = "ddr-reg",
+		.start = DDR0_PHYS_ADDR,
+		.end = DDR0_PHYS_ADDR + sizeof(struct ddr_ram),
+		.flags = IORESOURCE_MEM,
+	}
+};
+
+static inline int match_tag(char *arg, const char *tag)
+{
+	return strncmp(arg, tag, strlen(tag)) == 0;
+}
+
+static inline unsigned long tag2ul(char *arg, const char *tag)
+{
+	char *num;
+
+	num = arg + strlen(tag);
+	return simple_strtoul(num, 0, 10);
+}
+
+static void __init prom_setup_cmdline(void)
+{
+	static char cmd_line[COMMAND_LINE_SIZE] __initdata;
+	char *cp, *board;
+	int prom_argc;
+	char **prom_argv;
+	int i;
+	size_t len;
+
+	prom_argc = fw_arg0;
+	prom_argv = (char **) fw_arg1;
+
+	cp = cmd_line;
+		/* Note: it is common that parameters start
+		 * at argv[1] and not argv[0],
+		 * however, our elf loader starts at [0] */
+	for (i = 0; i < prom_argc; i++) {
+		if (match_tag(prom_argv[i], FREQ_TAG)) {
+			idt_cpu_freq = tag2ul(prom_argv[i], FREQ_TAG);
+			continue;
+		}
+#ifdef IGNORE_CMDLINE_MEM
+		/* parses out the "mem=xx" arg */
+		if (match_tag(prom_argv[i], MEM_TAG))
+			continue;
+#endif
+		if (i > 0)
+			*(cp++) = ' ';
+		if (match_tag(prom_argv[i], BOARD_TAG)) {
+			board = prom_argv[i] + strlen(BOARD_TAG);
+
+			if (match_tag(board, BOARD_RB532A))
+				mips_machtype = MACH_MIKROTIK_RB532A;
+			else
+				mips_machtype = MACH_MIKROTIK_RB532;
+		}
+
+		len = strlen(prom_argv[i]);
+		memcpy(cp, prom_argv[i], len + 1);
+		cp += len;
+	}
+	*(cp++) = ' ';
+
+	len = strlen(arcs_cmdline);
+	if (len > 0) {
+		*(cp++) = ' ';
+		memcpy(cp, arcs_cmdline, len + 1);
+		cp += len;
+	}
+	cmd_line[COMMAND_LINE_SIZE - 1] = '\0';
+	strscpy(arcs_cmdline, cmd_line);
+}
+
+void __init prom_init(void)
+{
+	struct ddr_ram __iomem *ddr;
+	phys_addr_t memsize;
+	phys_addr_t ddrbase;
+
+	ddr = ioremap(ddr_reg[0].start,
+			ddr_reg[0].end - ddr_reg[0].start);
+
+	if (!ddr) {
+		printk(KERN_ERR "Unable to remap DDR register\n");
+		return;
+	}
+
+	ddrbase = (phys_addr_t)&ddr->ddrbase;
+	memsize = (phys_addr_t)&ddr->ddrmask;
+	memsize = 0 - memsize;
+
+	prom_setup_cmdline();
+
+	/* give all RAM to boot allocator,
+	 * except for the first 0x400 and the last 0x200 bytes */
+	memblock_add(ddrbase + 0x400, memsize - 0x600);
+}
diff --git a/arch/mips/rb532/serial.c b/arch/mips/rb532/serial.c
new file mode 100644
index 000000000..228eff07e
--- /dev/null
+++ b/arch/mips/rb532/serial.c
@@ -0,0 +1,54 @@
+/*
+ *  BRIEF MODULE DESCRIPTION
+ *     Serial port initialisation.
+ *
+ *  Copyright 2004 IDT Inc. (rischelp@idt.com)
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
+ *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
+ *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
+ *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
+ *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
+ *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *  You should have received a copy of the  GNU General Public License along
+ *  with this program; if not, write  to the Free Software Foundation, Inc.,
+ *  675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/init.h>
+#include <linux/tty.h>
+#include <linux/serial_core.h>
+#include <linux/serial_8250.h>
+#include <linux/irq.h>
+
+#include <asm/serial.h>
+#include <asm/mach-rc32434/rb.h>
+
+extern unsigned int idt_cpu_freq;
+
+static struct uart_port rb532_uart = {
+	.flags = UPF_BOOT_AUTOCONF,
+	.line = 0,
+	.irq = UART0_IRQ,
+	.iotype = UPIO_MEM,
+	.membase = (char *)KSEG1ADDR(REGBASE + UART0BASE),
+	.regshift = 2
+};
+
+static int __init setup_serial_port(void)
+{
+	rb532_uart.uartclk = idt_cpu_freq;
+
+	return early_serial_setup(&rb532_uart);
+}
+arch_initcall(setup_serial_port);
diff --git a/arch/mips/rb532/setup.c b/arch/mips/rb532/setup.c
new file mode 100644
index 000000000..51af9d374
--- /dev/null
+++ b/arch/mips/rb532/setup.c
@@ -0,0 +1,81 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * setup.c - boot time setup code
+ */
+
+#include <linux/init.h>
+#include <linux/export.h>
+
+#include <asm/bootinfo.h>
+#include <asm/reboot.h>
+#include <asm/time.h>
+#include <linux/ioport.h>
+
+#include <asm/mach-rc32434/rb.h>
+#include <asm/mach-rc32434/pci.h>
+
+struct pci_reg __iomem *pci_reg;
+EXPORT_SYMBOL(pci_reg);
+
+static struct resource pci0_res[] = {
+	{
+		.name = "pci_reg0",
+		.start = PCI0_BASE_ADDR,
+		.end = PCI0_BASE_ADDR + sizeof(struct pci_reg),
+		.flags = IORESOURCE_MEM,
+	}
+};
+
+static void rb_machine_restart(char *command)
+{
+	/* just jump to the reset vector */
+	writel(0x80000001, IDT434_REG_BASE + RST);
+	((void (*)(void)) KSEG1ADDR(0x1FC00000u))();
+}
+
+static void rb_machine_halt(void)
+{
+	for (;;)
+		continue;
+}
+
+void __init plat_mem_setup(void)
+{
+	u32 val;
+
+	_machine_restart = rb_machine_restart;
+	_machine_halt = rb_machine_halt;
+	pm_power_off = rb_machine_halt;
+
+	set_io_port_base(KSEG1);
+
+	pci_reg = ioremap(pci0_res[0].start,
+				pci0_res[0].end - pci0_res[0].start);
+	if (!pci_reg) {
+		printk(KERN_ERR "Could not remap PCI registers\n");
+		return;
+	}
+
+	val = __raw_readl(&pci_reg->pcic);
+	val &= 0xFFFFFF7;
+	__raw_writel(val, (void *)&pci_reg->pcic);
+
+#ifdef CONFIG_PCI
+	/* Enable PCI interrupts in EPLD Mask register */
+	*epld_mask = 0x0;
+	*(epld_mask + 1) = 0x0;
+#endif
+	write_c0_wired(0);
+}
+
+const char *get_system_type(void)
+{
+	switch (mips_machtype) {
+	case MACH_MIKROTIK_RB532A:
+		return "Mikrotik RB532A";
+		break;
+	default:
+		return "Mikrotik RB532";
+		break;
+	}
+}
diff --git a/arch/mips/rb532/time.c b/arch/mips/rb532/time.c
new file mode 100644
index 000000000..68713dd32
--- /dev/null
+++ b/arch/mips/rb532/time.c
@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Carsten Langgaard, carstenl@mips.com
+ * Copyright (C) 1999,2000 MIPS Technologies, Inc.  All rights reserved.
+ *
+ *  Setting up the clock on the MIPS boards.
+ */
+
+#include <linux/init.h>
+#include <linux/kernel_stat.h>
+#include <linux/ptrace.h>
+#include <linux/sched.h>
+#include <linux/spinlock.h>
+#include <linux/mc146818rtc.h>
+#include <linux/irq.h>
+#include <linux/timex.h>
+
+#include <asm/mipsregs.h>
+#include <asm/time.h>
+#include <asm/mach-rc32434/rc32434.h>
+
+extern unsigned int idt_cpu_freq;
+
+/*
+ * Figure out the r4k offset, the amount to increment the compare
+ * register for each time tick. There is no RTC available.
+ *
+ * The RC32434 counts at half the CPU *core* speed.
+ */
+static unsigned long __init cal_r4koff(void)
+{
+	mips_hpt_frequency = idt_cpu_freq * IDT_CLOCK_MULT / 2;
+
+	return mips_hpt_frequency / HZ;
+}
+
+void __init plat_time_init(void)
+{
+	unsigned int est_freq;
+	unsigned long flags, r4k_offset;
+
+	local_irq_save(flags);
+
+	printk(KERN_INFO "calculating r4koff... ");
+	r4k_offset = cal_r4koff();
+	printk("%08lx(%d)\n", r4k_offset, (int) r4k_offset);
+
+	est_freq = 2 * r4k_offset * HZ;
+	est_freq += 5000;	/* round */
+	est_freq -= est_freq % 10000;
+	printk(KERN_INFO "CPU frequency %d.%02d MHz\n", est_freq / 1000000,
+	       (est_freq % 1000000) * 100 / 1000000);
+	local_irq_restore(flags);
+}