x86/kprobes: Fix crash when probing CS CALL instructionsgrafted

When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:

<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>:  mov    %r14,%rdi
<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>:  mov    %eax,%r12d
<__hrtimer_run_queues+266>:  xchg   %ax,%ax
<__hrtimer_run_queues+268>:  mov    %r13,%rdi

Which triggers this crash:

  BUG: unable to handle page fault for address: 00000000000f41c9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
  RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.

The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.

During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.

Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.

[ mingo: Refined the changelog ]

Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Jinke Han <jinkehan@didiglobal.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000

12 files changed, 956 insertions, 0 deletions

diff --git a/arch/nios2/boot/.gitignore b/arch/nios2/boot/.gitignore
new file mode 100644
index 000000000..ef37cac5b
--- /dev/null
+++ b/arch/nios2/boot/.gitignore
@@ -0,0 +1,2 @@
+# SPDX-License-Identifier: GPL-2.0-only
+vmImage
diff --git a/arch/nios2/boot/Makefile b/arch/nios2/boot/Makefile
new file mode 100644
index 000000000..29c11a06b
--- /dev/null
+++ b/arch/nios2/boot/Makefile
@@ -0,0 +1,32 @@
+#
+# arch/nios2/boot/Makefile
+#
+# This file is subject to the terms and conditions of the GNU General Public
+# License.  See the file "COPYING" in the main directory of this archive
+# for more details.
+#
+
+UIMAGE_LOADADDR = $(shell $(NM) vmlinux | awk '$$NF == "_stext" {print $$1}')
+UIMAGE_ENTRYADDR = $(shell $(NM) vmlinux | awk '$$NF == "_start" {print $$1}')
+UIMAGE_COMPRESSION = gzip
+
+OBJCOPYFLAGS_vmlinux.bin := -O binary
+
+targets += vmlinux.bin vmlinux.gz vmImage
+
+$(obj)/vmlinux.bin: vmlinux FORCE
+	$(call if_changed,objcopy)
+
+$(obj)/vmlinux.gz: $(obj)/vmlinux.bin FORCE
+	$(call if_changed,gzip)
+
+$(obj)/vmImage: $(obj)/vmlinux.gz FORCE
+	$(call if_changed,uimage)
+	@$(kecho) 'Kernel: $@ is ready'
+
+$(obj)/zImage: $(obj)/compressed/vmlinux FORCE
+	$(call if_changed,objcopy)
+	@$(kecho) 'Kernel: $@ is ready'
+
+$(obj)/compressed/vmlinux: $(obj)/vmlinux.gz FORCE
+	$(Q)$(MAKE) $(build)=$(obj)/compressed $@
diff --git a/arch/nios2/boot/compressed/Makefile b/arch/nios2/boot/compressed/Makefile
new file mode 100644
index 000000000..791e43092
--- /dev/null
+++ b/arch/nios2/boot/compressed/Makefile
@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: GPL-2.0
+#
+# create a compressed vmlinux image from the original vmlinux
+#
+
+targets		:= vmlinux head.o misc.o piggy.o vmlinux.lds
+asflags-y	:=
+
+OBJECTS = $(obj)/head.o $(obj)/misc.o
+
+LDFLAGS_vmlinux := -T
+
+$(obj)/vmlinux: $(obj)/vmlinux.lds $(OBJECTS) $(obj)/piggy.o FORCE
+	$(call if_changed,ld)
+
+LDFLAGS_piggy.o := -r --format binary --oformat elf32-littlenios2 -T
+
+$(obj)/piggy.o: $(obj)/vmlinux.scr $(obj)/../vmlinux.gz FORCE
+	$(call if_changed,ld)
diff --git a/arch/nios2/boot/compressed/console.c b/arch/nios2/boot/compressed/console.c
new file mode 100644
index 000000000..2cb2e7c9f
--- /dev/null
+++ b/arch/nios2/boot/compressed/console.c
@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *  Copyright (C) 2008-2010 Thomas Chou <thomas@wytron.com.tw>
+ */
+
+#include <linux/io.h>
+
+#if (defined(CONFIG_SERIAL_ALTERA_JTAGUART_CONSOLE) && defined(JTAG_UART_BASE))\
+	|| (defined(CONFIG_SERIAL_ALTERA_UART_CONSOLE) && defined(UART0_BASE))
+static void *my_ioremap(unsigned long physaddr)
+{
+	return (void *)(physaddr | CONFIG_NIOS2_IO_REGION_BASE);
+}
+#endif
+
+#if defined(CONFIG_SERIAL_ALTERA_JTAGUART_CONSOLE) && defined(JTAG_UART_BASE)
+
+#define ALTERA_JTAGUART_SIZE				8
+#define ALTERA_JTAGUART_DATA_REG			0
+#define ALTERA_JTAGUART_CONTROL_REG			4
+#define ALTERA_JTAGUART_CONTROL_AC_MSK			(0x00000400)
+#define ALTERA_JTAGUART_CONTROL_WSPACE_MSK		(0xFFFF0000)
+static void *uartbase;
+
+#if defined(CONFIG_SERIAL_ALTERA_JTAGUART_CONSOLE_BYPASS)
+static void jtag_putc(int ch)
+{
+	if (readl(uartbase + ALTERA_JTAGUART_CONTROL_REG) &
+		ALTERA_JTAGUART_CONTROL_WSPACE_MSK)
+		writeb(ch, uartbase + ALTERA_JTAGUART_DATA_REG);
+}
+#else
+static void jtag_putc(int ch)
+{
+	while ((readl(uartbase + ALTERA_JTAGUART_CONTROL_REG) &
+		ALTERA_JTAGUART_CONTROL_WSPACE_MSK) == 0)
+		;
+	writeb(ch, uartbase + ALTERA_JTAGUART_DATA_REG);
+}
+#endif
+
+static int putchar(int ch)
+{
+	jtag_putc(ch);
+	return ch;
+}
+
+static void console_init(void)
+{
+	uartbase = my_ioremap((unsigned long) JTAG_UART_BASE);
+	writel(ALTERA_JTAGUART_CONTROL_AC_MSK,
+		uartbase + ALTERA_JTAGUART_CONTROL_REG);
+}
+
+#elif defined(CONFIG_SERIAL_ALTERA_UART_CONSOLE) && defined(UART0_BASE)
+
+#define ALTERA_UART_SIZE		32
+#define ALTERA_UART_TXDATA_REG		4
+#define ALTERA_UART_STATUS_REG		8
+#define ALTERA_UART_DIVISOR_REG		16
+#define ALTERA_UART_STATUS_TRDY_MSK	(0x40)
+static unsigned uartbase;
+
+static void uart_putc(int ch)
+{
+	int i;
+
+	for (i = 0; (i < 0x10000); i++) {
+		if (readw(uartbase + ALTERA_UART_STATUS_REG) &
+			ALTERA_UART_STATUS_TRDY_MSK)
+			break;
+	}
+	writeb(ch, uartbase + ALTERA_UART_TXDATA_REG);
+}
+
+static int putchar(int ch)
+{
+	uart_putc(ch);
+	if (ch == '\n')
+		uart_putc('\r');
+	return ch;
+}
+
+static void console_init(void)
+{
+	unsigned int baud, baudclk;
+
+	uartbase = (unsigned long) my_ioremap((unsigned long) UART0_BASE);
+	baud = CONFIG_SERIAL_ALTERA_UART_BAUDRATE;
+	baudclk = UART0_FREQ / baud;
+	writew(baudclk, uartbase + ALTERA_UART_DIVISOR_REG);
+}
+
+#else
+
+static int putchar(int ch)
+{
+	return ch;
+}
+
+static void console_init(void)
+{
+}
+
+#endif
+
+static int puts(const char *s)
+{
+	while (*s)
+		putchar(*s++);
+	return 0;
+}
diff --git a/arch/nios2/boot/compressed/head.S b/arch/nios2/boot/compressed/head.S
new file mode 100644
index 000000000..15c6c48dd
--- /dev/null
+++ b/arch/nios2/boot/compressed/head.S
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2009 Thomas Chou <thomas@wytron.com.tw>
+ *
+ * Based on arch/nios2/kernel/head.S
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License. See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ */
+
+/*
+ *  This code can be loaded anywhere, eg FLASH ROM as reset vector,
+ *  as long as output does not overlap it.
+ */
+
+#include <linux/linkage.h>
+#include <asm/cache.h>
+
+	.text
+	.set noat
+ENTRY(_start)
+	wrctl	status, r0		/* disable interrupt */
+	/* invalidate all instruction cache */
+	movia	r1, NIOS2_ICACHE_SIZE
+	movui	r2, NIOS2_ICACHE_LINE_SIZE
+1:	initi	r1
+	sub	r1, r1, r2
+	bgt	r1, r0, 1b
+	/* invalidate all data cache */
+	movia	r1, NIOS2_DCACHE_SIZE
+	movui	r2, NIOS2_DCACHE_LINE_SIZE
+1:	initd	0(r1)
+	sub	r1, r1, r2
+	bgt	r1, r0, 1b
+
+	nextpc	r1			/* Find out where we are */
+chkadr:
+	movia	r2, chkadr
+	beq	r1, r2, finish_move	/* We are running in correct address,
+					   done */
+	/* move code, r1: src, r2: dest, r3: last dest */
+	addi	r1, r1, (_start - chkadr)	/* Source */
+	movia	r2, _start		/* Destination */
+	movia	r3, __bss_start		/* End of copy */
+1:	ldw	r8, 0(r1)		/* load a word from [r1] */
+	stw	r8, 0(r2)		/* stort a word to dest [r2] */
+	addi	r1, r1, 4		/* inc the src addr */
+	addi	r2, r2, 4		/* inc the dest addr */
+	blt	r2, r3, 1b
+	/* flush the data cache after moving */
+	movia	r1, NIOS2_DCACHE_SIZE
+	movui	r2, NIOS2_DCACHE_LINE_SIZE
+1:	flushd	0(r1)
+	sub	r1, r1, r2
+	bgt	r1, r0, 1b
+	movia	r1, finish_move
+	jmp	r1			/* jmp to linked address */
+
+finish_move:
+	/* zero out the .bss segment (uninitialized common data) */
+	movia	r2, __bss_start		/* presume nothing is between */
+	movia	r1, _end		/* the .bss and _end. */
+1: 	stb	r0, 0(r2)
+	addi	r2, r2, 1
+	bne	r1, r2, 1b
+	/*
+	 * set up the stack pointer, some where higher than _end.
+	 * The stack space must be greater than 32K for decompress.
+	 */
+	movia	sp, 0x10000
+	add	sp, sp, r1
+	/* save args passed from u-boot, maybe */
+	addi	sp, sp, -16
+	stw	r4, 0(sp)
+	stw	r5, 4(sp)
+	stw	r6, 8(sp)
+	stw	r7, 12(sp)
+	/* decompress the kernel */
+	call	decompress_kernel
+	/* pass saved args to kernel */
+	ldw	r4, 0(sp)
+	ldw	r5, 4(sp)
+	ldw	r6, 8(sp)
+	ldw	r7, 12(sp)
+
+	/* flush all data cache after decompressing */
+	movia	r1, NIOS2_DCACHE_SIZE
+	movui	r2, NIOS2_DCACHE_LINE_SIZE
+1:	flushd	0(r1)
+	sub	r1, r1, r2
+	bgt	r1, r0, 1b
+	/* flush all instruction cache */
+	movia	r1, NIOS2_ICACHE_SIZE
+	movui	r2, NIOS2_ICACHE_LINE_SIZE
+1:	flushi	r1
+	sub	r1, r1, r2
+	bgt	r1, r0, 1b
+	flushp
+	/* jump to start real kernel */
+	movia	r1, (CONFIG_NIOS2_MEM_BASE | CONFIG_NIOS2_KERNEL_REGION_BASE)
+	jmp	r1
+
+	.balign 512
+fake_headers_as_bzImage:
+	.short	0
+	.ascii	"HdrS"
+	.short	0x0202
+	.short	0
+	.short	0
+	.byte	0x00, 0x10
+	.short	0
+	.byte	0
+	.byte	1
+	.byte	0x00, 0x80
+	.long	0
+	.long	0
diff --git a/arch/nios2/boot/compressed/misc.c b/arch/nios2/boot/compressed/misc.c
new file mode 100644
index 000000000..42fc4bbe1
--- /dev/null
+++ b/arch/nios2/boot/compressed/misc.c
@@ -0,0 +1,174 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2009 Thomas Chou <thomas@wytron.com.tw>
+ *
+ * This is a collection of several routines from gzip-1.0.3
+ * adapted for Linux.
+ *
+ * malloc by Hannu Savolainen 1993 and Matthias Urlichs 1994
+ *
+ * Adapted for SH by Stuart Menefy, Aug 1999
+ *
+ * Modified to use standard LinuxSH BIOS by Greg Banks 7Jul2000
+ *
+ * Based on arch/sh/boot/compressed/misc.c
+ */
+
+#include <linux/string.h>
+
+/*
+ * gzip declarations
+ */
+#define OF(args)  args
+#define STATIC static
+
+#undef memset
+#undef memcpy
+#define memzero(s, n)		memset((s), 0, (n))
+
+typedef unsigned char  uch;
+typedef unsigned short ush;
+typedef unsigned long  ulg;
+#define WSIZE 0x8000		/* Window size must be at least 32k, */
+				/* and a power of two */
+
+static uch *inbuf;		/* input buffer */
+static uch window[WSIZE];	/* Sliding window buffer */
+
+static unsigned insize;	/* valid bytes in inbuf */
+static unsigned inptr;	/* index of next byte to be processed in inbuf */
+static unsigned outcnt;	/* bytes in output buffer */
+
+/* gzip flag byte */
+#define ASCII_FLAG	0x01 /* bit 0 set: file probably ASCII text */
+#define CONTINUATION	0x02 /* bit 1 set: continuation of multi-part gzip
+				file */
+#define EXTRA_FIELD	0x04 /* bit 2 set: extra field present */
+#define ORIG_NAME	0x08 /* bit 3 set: original file name present */
+#define COMMENT		0x10 /* bit 4 set: file comment present */
+#define ENCRYPTED	0x20 /* bit 5 set: file is encrypted */
+#define RESERVED	0xC0 /* bit 6,7:   reserved */
+
+#define get_byte()  (inptr < insize ? inbuf[inptr++] : fill_inbuf())
+
+#ifdef DEBUG
+#  define Assert(cond, msg) {if (!(cond)) error(msg); }
+#  define Trace(x) fprintf x
+#  define Tracev(x) {if (verbose) fprintf x ; }
+#  define Tracevv(x) {if (verbose > 1) fprintf x ; }
+#  define Tracec(c, x) {if (verbose && (c)) fprintf x ; }
+#  define Tracecv(c, x) {if (verbose > 1 && (c)) fprintf x ; }
+#else
+#  define Assert(cond, msg)
+#  define Trace(x)
+#  define Tracev(x)
+#  define Tracevv(x)
+#  define Tracec(c, x)
+#  define Tracecv(c, x)
+#endif
+static int  fill_inbuf(void);
+static void flush_window(void);
+static void error(char *m);
+
+extern char input_data[];
+extern int input_len;
+
+static long bytes_out;
+static uch *output_data;
+static unsigned long output_ptr;
+
+#include "console.c"
+
+static void error(char *m);
+
+int puts(const char *);
+
+extern int _end;
+static unsigned long free_mem_ptr;
+static unsigned long free_mem_end_ptr;
+
+#define HEAP_SIZE			0x10000
+
+#include "../../../../lib/inflate.c"
+
+void *memset(void *s, int c, size_t n)
+{
+	int i;
+	char *ss = (char *)s;
+
+	for (i = 0; i < n; i++)
+		ss[i] = c;
+	return s;
+}
+
+void *memcpy(void *__dest, __const void *__src, size_t __n)
+{
+	int i;
+	char *d = (char *)__dest, *s = (char *)__src;
+
+	for (i = 0; i < __n; i++)
+		d[i] = s[i];
+	return __dest;
+}
+
+/*
+ * Fill the input buffer. This is called only when the buffer is empty
+ * and at least one byte is really needed.
+ */
+static int fill_inbuf(void)
+{
+	if (insize != 0)
+		error("ran out of input data");
+
+	inbuf = input_data;
+	insize = input_len;
+	inptr = 1;
+	return inbuf[0];
+}
+
+/*
+ * Write the output window window[0..outcnt-1] and update crc and bytes_out.
+ * (Used for the decompressed data only.)
+ */
+static void flush_window(void)
+{
+	ulg c = crc;	/* temporary variable */
+	unsigned n;
+	uch *in, *out, ch;
+
+	in = window;
+	out = &output_data[output_ptr];
+	for (n = 0; n < outcnt; n++) {
+		ch = *out++ = *in++;
+		c = crc_32_tab[((int)c ^ ch) & 0xff] ^ (c >> 8);
+	}
+	crc = c;
+	bytes_out += (ulg)outcnt;
+	output_ptr += (ulg)outcnt;
+	outcnt = 0;
+}
+
+static void error(char *x)
+{
+	puts("\nERROR\n");
+	puts(x);
+	puts("\n\n -- System halted");
+
+	while (1)	/* Halt */
+		;
+}
+
+void decompress_kernel(void)
+{
+	output_data = (void *) (CONFIG_NIOS2_MEM_BASE |
+				CONFIG_NIOS2_KERNEL_REGION_BASE);
+	output_ptr = 0;
+	free_mem_ptr = (unsigned long)&_end;
+	free_mem_end_ptr = free_mem_ptr + HEAP_SIZE;
+
+	console_init();
+	makecrc();
+	puts("Uncompressing Linux... ");
+	gunzip();
+	puts("Ok, booting the kernel.\n");
+}
diff --git a/arch/nios2/boot/compressed/vmlinux.lds.S b/arch/nios2/boot/compressed/vmlinux.lds.S
new file mode 100644
index 000000000..9b02d0c97
--- /dev/null
+++ b/arch/nios2/boot/compressed/vmlinux.lds.S
@@ -0,0 +1,45 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2009 Thomas Chou <thomas@wytron.com.tw>
+ */
+
+#include <asm-generic/vmlinux.lds.h>
+
+OUTPUT_FORMAT("elf32-littlenios2", "elf32-littlenios2", "elf32-littlenios2")
+
+OUTPUT_ARCH(nios)
+ENTRY(_start)	/* Defined in head.S */
+
+SECTIONS
+{
+	. = (CONFIG_NIOS2_MEM_BASE + CONFIG_NIOS2_BOOT_LINK_OFFSET) |	\
+		CONFIG_NIOS2_KERNEL_REGION_BASE;
+
+	_text = .;
+	.text : { *(.text) } = 0
+	.rodata : { *(.rodata) *(.rodata.*) }
+	_etext = .;
+
+	. = ALIGN(32 / 8);
+	.data : { *(.data) }
+	. = ALIGN(32 / 8);
+	_got = .;
+	.got : {
+		*(.got.plt)
+		*(.igot.plt)
+		*(.got)
+		*(.igot)
+	}
+	_egot = .;
+	_edata =  .;
+
+	. = ALIGN(32 / 8);
+	__bss_start = .;
+	.bss : { *(.bss) *(.sbss) }
+	. = ALIGN(32 / 8);
+	_ebss = .;
+	end = . ;
+	_end = . ;
+
+	got_len = (_egot - _got);
+}
diff --git a/arch/nios2/boot/compressed/vmlinux.scr b/arch/nios2/boot/compressed/vmlinux.scr
new file mode 100644
index 000000000..28c42f1d1
--- /dev/null
+++ b/arch/nios2/boot/compressed/vmlinux.scr
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2009 Thomas Chou <thomas@wytron.com.tw>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+SECTIONS
+{
+	.data : {
+		input_len = .;
+		LONG(input_data_end - input_data) input_data = .;
+		*(.data)
+		. = ALIGN(4);
+		input_data_end = .;
+	}
+}
diff --git a/arch/nios2/boot/dts/10m50_devboard.dts b/arch/nios2/boot/dts/10m50_devboard.dts
new file mode 100644
index 000000000..0e7e5b0dd
--- /dev/null
+++ b/arch/nios2/boot/dts/10m50_devboard.dts
@@ -0,0 +1,237 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2015 Altera Corporation. All rights reserved.
+ */
+
+/dts-v1/;
+
+/ {
+	model = "Altera NiosII Max10";
+	compatible = "altr,niosii-max10";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	cpus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		cpu: cpu@0 {
+			device_type = "cpu";
+			compatible = "altr,nios2-1.1";
+			reg = <0x00000000>;
+			interrupt-controller;
+			#interrupt-cells = <1>;
+			altr,exception-addr = <0xc8000120>;
+			altr,fast-tlb-miss-addr = <0xc0000100>;
+			altr,has-div = <1>;
+			altr,has-initda = <1>;
+			altr,has-mmu = <1>;
+			altr,has-mul = <1>;
+			altr,implementation = "fast";
+			altr,pid-num-bits = <8>;
+			altr,reset-addr = <0xd4000000>;
+			altr,tlb-num-entries = <256>;
+			altr,tlb-num-ways = <16>;
+			altr,tlb-ptr-sz = <8>;
+			clock-frequency = <75000000>;
+			dcache-line-size = <32>;
+			dcache-size = <32768>;
+			icache-line-size = <32>;
+			icache-size = <32768>;
+		};
+	};
+
+	memory {
+		device_type = "memory";
+		reg = <0x08000000 0x08000000>,
+			<0x00000000 0x00000400>;
+	};
+
+	sopc0: sopc@0 {
+		device_type = "soc";
+		ranges;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "altr,avalon", "simple-bus";
+		bus-frequency = <75000000>;
+
+		jtag_uart: serial@18001530 {
+			compatible = "altr,juart-1.0";
+			reg = <0x18001530 0x00000008>;
+			interrupt-parent = <&cpu>;
+			interrupts = <7>;
+		};
+
+		a_16550_uart_0: serial@18001600 {
+			compatible = "altr,16550-FIFO32", "ns16550a";
+			reg = <0x18001600 0x00000200>;
+			interrupt-parent = <&cpu>;
+			interrupts = <1>;
+			auto-flow-control = <1>;
+			clock-frequency = <50000000>;
+			fifo-size = <32>;
+			reg-io-width = <4>;
+			reg-shift = <2>;
+			tx-threshold = <16>;
+		};
+
+		sysid: sysid@18001528 {
+			compatible = "altr,sysid-1.0";
+			reg = <0x18001528 0x00000008>;
+			id = <4207856382>;
+			timestamp = <1431309290>;
+		};
+
+		rgmii_0_eth_tse_0: ethernet@400 {
+			compatible = "altr,tse-msgdma-1.0", "altr,tse-1.0";
+			reg = <0x00000400 0x00000400>,
+				<0x00000820 0x00000020>,
+				<0x00000800 0x00000020>,
+				<0x000008c0 0x00000008>,
+				<0x00000840 0x00000020>,
+				<0x00000860 0x00000020>;
+			reg-names = "control_port", "rx_csr", "rx_desc", "rx_resp", "tx_csr", "tx_desc";
+			interrupt-parent = <&cpu>;
+			interrupts = <2 3>;
+			interrupt-names = "rx_irq", "tx_irq";
+			rx-fifo-depth = <8192>;
+			tx-fifo-depth = <8192>;
+			address-bits = <48>;
+			max-frame-size = <1500>;
+			local-mac-address = [00 00 00 00 00 00];
+			altr,has-supplementary-unicast;
+			altr,enable-sup-addr = <1>;
+			altr,has-hash-multicast-filter;
+			altr,enable-hash = <1>;
+			phy-mode = "rgmii-id";
+			phy-handle = <&phy0>;
+			rgmii_0_eth_tse_0_mdio: mdio {
+				compatible = "altr,tse-mdio";
+				#address-cells = <1>;
+				#size-cells = <0>;
+				phy0: ethernet-phy@0 {
+					reg = <0>;
+					device_type = "ethernet-phy";
+				};
+			};
+		};
+
+		enet_pll: clock@0 {
+			compatible = "altr,pll-1.0";
+			#clock-cells = <1>;
+
+			enet_pll_c0: enet_pll_c0 {
+				compatible = "fixed-clock";
+				#clock-cells = <0>;
+				clock-frequency = <125000000>;
+				clock-output-names = "enet_pll-c0";
+			};
+
+			enet_pll_c1: enet_pll_c1 {
+				compatible = "fixed-clock";
+				#clock-cells = <0>;
+				clock-frequency = <25000000>;
+				clock-output-names = "enet_pll-c1";
+			};
+
+			enet_pll_c2: enet_pll_c2 {
+				compatible = "fixed-clock";
+				#clock-cells = <0>;
+				clock-frequency = <2500000>;
+				clock-output-names = "enet_pll-c2";
+			};
+		};
+
+		sys_pll: clock@1 {
+			compatible = "altr,pll-1.0";
+			#clock-cells = <1>;
+
+			sys_pll_c0: sys_pll_c0 {
+				compatible = "fixed-clock";
+				#clock-cells = <0>;
+				clock-frequency = <100000000>;
+				clock-output-names = "sys_pll-c0";
+			};
+
+			sys_pll_c1: sys_pll_c1 {
+				compatible = "fixed-clock";
+				#clock-cells = <0>;
+				clock-frequency = <50000000>;
+				clock-output-names = "sys_pll-c1";
+			};
+
+			sys_pll_c2: sys_pll_c2 {
+				compatible = "fixed-clock";
+				#clock-cells = <0>;
+				clock-frequency = <75000000>;
+				clock-output-names = "sys_pll-c2";
+			};
+		};
+
+		sys_clk_timer: timer@18001440 {
+			compatible = "altr,timer-1.0";
+			reg = <0x18001440 0x00000020>;
+			interrupt-parent = <&cpu>;
+			interrupts = <0>;
+			clock-frequency = <75000000>;
+		};
+
+		led_pio: gpio@180014d0 {
+			compatible = "altr,pio-1.0";
+			reg = <0x180014d0 0x00000010>;
+			altr,ngpio = <4>;
+			#gpio-cells = <2>;
+			gpio-controller;
+		};
+
+		button_pio: gpio@180014c0 {
+			compatible = "altr,pio-1.0";
+			reg = <0x180014c0 0x00000010>;
+			interrupt-parent = <&cpu>;
+			interrupts = <6>;
+			altr,ngpio = <3>;
+			altr,interrupt-type = <2>;
+			edge_type = <1>;
+			level_trigger = <0>;
+			#gpio-cells = <2>;
+			gpio-controller;
+		};
+
+		sys_clk_timer_1: timer@880 {
+			compatible = "altr,timer-1.0";
+			reg = <0x00000880 0x00000020>;
+			interrupt-parent = <&cpu>;
+			interrupts = <5>;
+			clock-frequency = <75000000>;
+		};
+
+		fpga_leds: leds {
+			compatible = "gpio-leds";
+
+			led_fpga0: fpga0 {
+				label = "fpga_led0";
+				gpios = <&led_pio 0 1>;
+			};
+
+			led_fpga1: fpga1 {
+				label = "fpga_led1";
+				gpios = <&led_pio 1 1>;
+			};
+
+			led_fpga2: fpga2 {
+				label = "fpga_led2";
+				gpios = <&led_pio 2 1>;
+			};
+
+			led_fpga3: fpga3 {
+				label = "fpga_led3";
+				gpios = <&led_pio 3 1>;
+			};
+		};
+	};
+
+	chosen {
+		bootargs = "debug earlycon console=ttyS0,115200";
+		stdout-path = &a_16550_uart_0;
+	};
+};
diff --git a/arch/nios2/boot/dts/3c120_devboard.dts b/arch/nios2/boot/dts/3c120_devboard.dts
new file mode 100644
index 000000000..3ee316906
--- /dev/null
+++ b/arch/nios2/boot/dts/3c120_devboard.dts
@@ -0,0 +1,153 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *  Copyright (C) 2013 Altera Corporation
+ *
+ * This file is generated by sopc2dts.
+ */
+
+/dts-v1/;
+
+/ {
+	model = "altr,qsys_ghrd_3c120";
+	compatible = "altr,qsys_ghrd_3c120";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	cpus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		cpu: cpu@0 {
+			device_type = "cpu";
+			compatible = "altr,nios2-1.0";
+			reg = <0x00000000>;
+			interrupt-controller;
+			#interrupt-cells = <1>;
+			clock-frequency = <125000000>;
+			dcache-line-size = <32>;
+			icache-line-size = <32>;
+			dcache-size = <32768>;
+			icache-size = <32768>;
+			altr,implementation = "fast";
+			altr,pid-num-bits = <8>;
+			altr,tlb-num-ways = <16>;
+			altr,tlb-num-entries = <128>;
+			altr,tlb-ptr-sz = <7>;
+			altr,has-div = <1>;
+			altr,has-mul = <1>;
+			altr,reset-addr = <0xc2800000>;
+			altr,fast-tlb-miss-addr = <0xc7fff400>;
+			altr,exception-addr = <0xd0000020>;
+			altr,has-initda = <1>;
+			altr,has-mmu = <1>;
+		};
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x10000000 0x08000000>,
+			<0x07fff400 0x00000400>;
+	};
+
+	sopc@0 {
+		device_type = "soc";
+		ranges;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "altr,avalon", "simple-bus";
+		bus-frequency = <125000000>;
+
+		pb_cpu_to_io: bridge@8000000 {
+			compatible = "simple-bus";
+			reg = <0x08000000 0x00800000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			ranges = <0x00002000 0x08002000 0x00002000>,
+				<0x00004000 0x08004000 0x00000400>,
+				<0x00004400 0x08004400 0x00000040>,
+				<0x00004800 0x08004800 0x00000040>,
+				<0x00004c80 0x08004c80 0x00000020>,
+				<0x00004d50 0x08004d50 0x00000008>,
+				<0x00008000 0x08008000 0x00000020>,
+				<0x00400000 0x08400000 0x00000020>;
+
+			timer_1ms: timer@400000 {
+				compatible = "altr,timer-1.0";
+				reg = <0x00400000 0x00000020>;
+				interrupt-parent = <&cpu>;
+				interrupts = <11>;
+				clock-frequency = <125000000>;
+			};
+
+			timer_0: timer@8000 {
+				compatible = "altr,timer-1.0";
+				reg = < 0x00008000 0x00000020 >;
+				interrupt-parent = < &cpu >;
+				interrupts = < 5 >;
+				clock-frequency = < 125000000 >;
+			};
+
+			jtag_uart: serial@4d50 {
+				compatible = "altr,juart-1.0";
+				reg = <0x00004d50 0x00000008>;
+				interrupt-parent = <&cpu>;
+				interrupts = <1>;
+			};
+
+			tse_mac: ethernet@4000 {
+				compatible = "altr,tse-1.0";
+				reg = <0x00004000 0x00000400>,
+					<0x00004400 0x00000040>,
+					<0x00004800 0x00000040>,
+					<0x00002000 0x00002000>;
+				reg-names = "control_port", "rx_csr", "tx_csr", "s1";
+				interrupt-parent = <&cpu>;
+				interrupts = <2 3>;
+				interrupt-names = "rx_irq", "tx_irq";
+				rx-fifo-depth = <8192>;
+				tx-fifo-depth = <8192>;
+				max-frame-size = <1500>;
+				local-mac-address = [ 00 00 00 00 00 00 ];
+				phy-mode = "rgmii-id";
+				phy-handle = <&phy0>;
+				tse_mac_mdio: mdio {
+					compatible = "altr,tse-mdio";
+					#address-cells = <1>;
+					#size-cells = <0>;
+					phy0: ethernet-phy@18 {
+						reg = <18>;
+						device_type = "ethernet-phy";
+					};
+				};
+			};
+
+			uart: serial@4c80 {
+				compatible = "altr,uart-1.0";
+				reg = <0x00004c80 0x00000020>;
+				interrupt-parent = <&cpu>;
+				interrupts = <10>;
+				current-speed = <115200>;
+				clock-frequency = <62500000>;
+			};
+		};
+
+		cfi_flash_64m: flash@0 {
+			compatible = "cfi-flash";
+			reg = <0x00000000 0x04000000>;
+			bank-width = <2>;
+			device-width = <1>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@800000 {
+				reg = <0x00800000 0x01e00000>;
+				label = "JFFS2 Filesystem";
+			};
+		};
+	};
+
+	chosen {
+		bootargs = "debug earlycon console=ttyJ0,115200";
+		stdout-path = &jtag_uart;
+	};
+};
diff --git a/arch/nios2/boot/dts/Makefile b/arch/nios2/boot/dts/Makefile
new file mode 100644
index 000000000..1b8f41c41
--- /dev/null
+++ b/arch/nios2/boot/dts/Makefile
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0
+
+dtb-y := $(addsuffix .dtb, $(CONFIG_BUILTIN_DTB_NAME))
+
+dtb-$(CONFIG_OF_ALL_DTBS) += $(patsubst $(src)/%.dts,%.dtb, $(wildcard $(src)/*.dts))
diff --git a/arch/nios2/boot/install.sh b/arch/nios2/boot/install.sh
new file mode 100755
index 000000000..1161f2bf5
--- /dev/null
+++ b/arch/nios2/boot/install.sh
@@ -0,0 +1,32 @@
+#!/bin/sh
+#
+# This file is subject to the terms and conditions of the GNU General Public
+# License.  See the file "COPYING" in the main directory of this archive
+# for more details.
+#
+# Copyright (C) 1995 by Linus Torvalds
+#
+# Adapted from code in arch/i386/boot/Makefile by H. Peter Anvin
+#
+# "make install" script for nios2 architecture
+#
+# Arguments:
+#   $1 - kernel version
+#   $2 - kernel image file
+#   $3 - kernel map file
+#   $4 - default install path (blank if root directory)
+
+set -e
+
+if [ -f $4/vmlinuz ]; then
+	mv $4/vmlinuz $4/vmlinuz.old
+fi
+
+if [ -f $4/System.map ]; then
+	mv $4/System.map $4/System.old
+fi
+
+cat $2 > $4/vmlinuz
+cp $3 $4/System.map
+
+sync