x86/kprobes: Fix crash when probing CS CALL instructionsgrafted

When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:

<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>:  mov    %r14,%rdi
<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>:  mov    %eax,%r12d
<__hrtimer_run_queues+266>:  xchg   %ax,%ax
<__hrtimer_run_queues+268>:  mov    %r13,%rdi

Which triggers this crash:

  BUG: unable to handle page fault for address: 00000000000f41c9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
  RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.

The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.

During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.

Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.

[ mingo: Refined the changelog ]

Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Jinke Han <jinkehan@didiglobal.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000

3 files changed, 865 insertions, 0 deletions

diff --git a/sound/drivers/mpu401/Makefile b/sound/drivers/mpu401/Makefile
new file mode 100644
index 000000000..0a96e238e
--- /dev/null
+++ b/sound/drivers/mpu401/Makefile
@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Makefile for ALSA
+# Copyright (c) 2001 by Jaroslav Kysela <perex@perex.cz>
+#
+
+snd-mpu401-y := mpu401.o
+snd-mpu401-uart-y := mpu401_uart.o
+
+obj-$(CONFIG_SND_MPU401_UART) += snd-mpu401-uart.o
+
+# Toplevel Module Dependency
+obj-$(CONFIG_SND_MPU401) += snd-mpu401.o
diff --git a/sound/drivers/mpu401/mpu401.c b/sound/drivers/mpu401/mpu401.c
new file mode 100644
index 000000000..b93291ad0
--- /dev/null
+++ b/sound/drivers/mpu401/mpu401.c
@@ -0,0 +1,257 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *  Driver for generic MPU-401 boards (UART mode only)
+ *  Copyright (c) by Jaroslav Kysela <perex@perex.cz>
+ *  Copyright (c) 2004 by Castet Matthieu <castet.matthieu@free.fr>
+ */
+
+#include <linux/init.h>
+#include <linux/pnp.h>
+#include <linux/err.h>
+#include <linux/platform_device.h>
+#include <linux/module.h>
+#include <sound/core.h>
+#include <sound/mpu401.h>
+#include <sound/initval.h>
+
+MODULE_AUTHOR("Jaroslav Kysela <perex@perex.cz>");
+MODULE_DESCRIPTION("MPU-401 UART");
+MODULE_LICENSE("GPL");
+
+static int index[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS - 1)] = -2}; /* exclude the first card */
+static char *id[SNDRV_CARDS] = SNDRV_DEFAULT_STR;	/* ID for this card */
+static bool enable[SNDRV_CARDS] = SNDRV_DEFAULT_ENABLE;	/* Enable this card */
+#ifdef CONFIG_PNP
+static bool pnp[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS - 1)] = 1};
+#endif
+static long port[SNDRV_CARDS] = SNDRV_DEFAULT_PORT;	/* MPU-401 port number */
+static int irq[SNDRV_CARDS] = SNDRV_DEFAULT_IRQ;	/* MPU-401 IRQ */
+static bool uart_enter[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS - 1)] = 1};
+
+module_param_array(index, int, NULL, 0444);
+MODULE_PARM_DESC(index, "Index value for MPU-401 device.");
+module_param_array(id, charp, NULL, 0444);
+MODULE_PARM_DESC(id, "ID string for MPU-401 device.");
+module_param_array(enable, bool, NULL, 0444);
+MODULE_PARM_DESC(enable, "Enable MPU-401 device.");
+#ifdef CONFIG_PNP
+module_param_array(pnp, bool, NULL, 0444);
+MODULE_PARM_DESC(pnp, "PnP detection for MPU-401 device.");
+#endif
+module_param_hw_array(port, long, ioport, NULL, 0444);
+MODULE_PARM_DESC(port, "Port # for MPU-401 device.");
+module_param_hw_array(irq, int, irq, NULL, 0444);
+MODULE_PARM_DESC(irq, "IRQ # for MPU-401 device.");
+module_param_array(uart_enter, bool, NULL, 0444);
+MODULE_PARM_DESC(uart_enter, "Issue UART_ENTER command at open.");
+
+static struct platform_device *platform_devices[SNDRV_CARDS];
+static int pnp_registered __ro_after_init;
+static unsigned int snd_mpu401_devices;
+
+static int snd_mpu401_create(struct device *devptr, int dev,
+			     struct snd_card **rcard)
+{
+	struct snd_card *card;
+	int err;
+
+	if (!uart_enter[dev])
+		dev_err(devptr, "the uart_enter option is obsolete; remove it\n");
+
+	*rcard = NULL;
+	err = snd_devm_card_new(devptr, index[dev], id[dev], THIS_MODULE,
+				0, &card);
+	if (err < 0)
+		return err;
+	strscpy(card->driver, "MPU-401 UART");
+	strscpy(card->shortname, card->driver);
+	sprintf(card->longname, "%s at %#lx, ", card->shortname, port[dev]);
+	if (irq[dev] >= 0) {
+		sprintf(card->longname + strlen(card->longname), "irq %d", irq[dev]);
+	} else {
+		strcat(card->longname, "polled");
+	}
+
+	err = snd_mpu401_uart_new(card, 0, MPU401_HW_MPU401, port[dev], 0,
+				  irq[dev], NULL);
+	if (err < 0) {
+		dev_err(devptr, "MPU401 not detected at 0x%lx\n", port[dev]);
+		return err;
+	}
+
+	*rcard = card;
+	return 0;
+}
+
+static int snd_mpu401_probe(struct platform_device *devptr)
+{
+	int dev = devptr->id;
+	int err;
+	struct snd_card *card;
+
+	if (dev < 0 || dev >= SNDRV_CARDS) {
+		dev_warn(&devptr->dev,
+			 "Invalid card index %d, using default 0\n", dev);
+		dev = 0;
+	}
+
+	if (port[dev] == SNDRV_AUTO_PORT) {
+		dev_err(&devptr->dev, "specify port\n");
+		return -EINVAL;
+	}
+	if (irq[dev] == SNDRV_AUTO_IRQ) {
+		dev_err(&devptr->dev, "specify or disable IRQ\n");
+		return -EINVAL;
+	}
+	err = snd_mpu401_create(&devptr->dev, dev, &card);
+	if (err < 0)
+		return err;
+	err = snd_card_register(card);
+	if (err < 0)
+		return err;
+	platform_set_drvdata(devptr, card);
+	return 0;
+}
+
+#define SND_MPU401_DRIVER	"snd_mpu401"
+
+static struct platform_driver snd_mpu401_driver = {
+	.probe		= snd_mpu401_probe,
+	.driver		= {
+		.name	= SND_MPU401_DRIVER,
+	},
+};
+
+
+#ifdef CONFIG_PNP
+
+#define IO_EXTENT 2
+
+static const struct pnp_device_id snd_mpu401_pnpids[] = {
+	{ .id = "PNPb006" },
+	{ }
+};
+
+MODULE_DEVICE_TABLE(pnp, snd_mpu401_pnpids);
+
+static int snd_mpu401_pnp(int dev, struct pnp_dev *device,
+			  const struct pnp_device_id *id)
+{
+	if (!pnp_port_valid(device, 0) ||
+	    pnp_port_flags(device, 0) & IORESOURCE_DISABLED) {
+		dev_err(&device->dev, "no PnP port\n");
+		return -ENODEV;
+	}
+	if (pnp_port_len(device, 0) < IO_EXTENT) {
+		dev_err(&device->dev, "PnP port length is %llu, expected %d\n",
+			   (unsigned long long)pnp_port_len(device, 0),
+			   IO_EXTENT);
+		return -ENODEV;
+	}
+	port[dev] = pnp_port_start(device, 0);
+
+	if (!pnp_irq_valid(device, 0) ||
+	    pnp_irq_flags(device, 0) & IORESOURCE_DISABLED) {
+		dev_warn(&device->dev, "no PnP irq, using polling\n");
+		irq[dev] = -1;
+	} else {
+		irq[dev] = pnp_irq(device, 0);
+	}
+	return 0;
+}
+
+static int snd_mpu401_pnp_probe(struct pnp_dev *pnp_dev,
+				const struct pnp_device_id *id)
+{
+	static int dev;
+	struct snd_card *card;
+	int err;
+
+	for ( ; dev < SNDRV_CARDS; ++dev) {
+		if (!enable[dev] || !pnp[dev])
+			continue;
+		err = snd_mpu401_pnp(dev, pnp_dev, id);
+		if (err < 0)
+			return err;
+		err = snd_mpu401_create(&pnp_dev->dev, dev, &card);
+		if (err < 0)
+			return err;
+		err = snd_card_register(card);
+		if (err < 0)
+			return err;
+		pnp_set_drvdata(pnp_dev, card);
+		snd_mpu401_devices++;
+		++dev;
+		return 0;
+	}
+	return -ENODEV;
+}
+
+static struct pnp_driver snd_mpu401_pnp_driver = {
+	.name = "mpu401",
+	.id_table = snd_mpu401_pnpids,
+	.probe = snd_mpu401_pnp_probe,
+};
+#else
+static struct pnp_driver snd_mpu401_pnp_driver;
+#endif
+
+static void snd_mpu401_unregister_all(void)
+{
+	int i;
+
+	if (pnp_registered)
+		pnp_unregister_driver(&snd_mpu401_pnp_driver);
+	for (i = 0; i < ARRAY_SIZE(platform_devices); ++i)
+		platform_device_unregister(platform_devices[i]);
+	platform_driver_unregister(&snd_mpu401_driver);
+}
+
+static int __init alsa_card_mpu401_init(void)
+{
+	int i, err;
+
+	err = platform_driver_register(&snd_mpu401_driver);
+	if (err < 0)
+		return err;
+
+	for (i = 0; i < SNDRV_CARDS; i++) {
+		struct platform_device *device;
+		if (! enable[i])
+			continue;
+#ifdef CONFIG_PNP
+		if (pnp[i])
+			continue;
+#endif
+		device = platform_device_register_simple(SND_MPU401_DRIVER,
+							 i, NULL, 0);
+		if (IS_ERR(device))
+			continue;
+		if (!platform_get_drvdata(device)) {
+			platform_device_unregister(device);
+			continue;
+		}
+		platform_devices[i] = device;
+		snd_mpu401_devices++;
+	}
+	err = pnp_register_driver(&snd_mpu401_pnp_driver);
+	if (!err)
+		pnp_registered = 1;
+
+	if (!snd_mpu401_devices) {
+#ifdef MODULE
+		pr_err("MPU-401 device not found or device busy\n");
+#endif
+		snd_mpu401_unregister_all();
+		return -ENODEV;
+	}
+	return 0;
+}
+
+static void __exit alsa_card_mpu401_exit(void)
+{
+	snd_mpu401_unregister_all();
+}
+
+module_init(alsa_card_mpu401_init)
+module_exit(alsa_card_mpu401_exit)
diff --git a/sound/drivers/mpu401/mpu401_uart.c b/sound/drivers/mpu401/mpu401_uart.c
new file mode 100644
index 000000000..6de03d72a
--- /dev/null
+++ b/sound/drivers/mpu401/mpu401_uart.c
@@ -0,0 +1,595 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *  Copyright (c) by Jaroslav Kysela <perex@perex.cz>
+ *  Routines for control of MPU-401 in UART mode
+ *
+ *  MPU-401 supports UART mode which is not capable generate transmit
+ *  interrupts thus output is done via polling. Without interrupt,
+ *  input is done also via polling. Do not expect good performance.
+ *
+ *   13-03-2003:
+ *      Added support for different kind of hardware I/O. Build in choices
+ *      are port and mmio. For other kind of I/O, set mpu->read and
+ *      mpu->write to your own I/O functions.
+ */
+
+#include <linux/io.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/ioport.h>
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/errno.h>
+#include <sound/core.h>
+#include <sound/mpu401.h>
+
+MODULE_AUTHOR("Jaroslav Kysela <perex@perex.cz>");
+MODULE_DESCRIPTION("Routines for control of MPU-401 in UART mode");
+MODULE_LICENSE("GPL");
+
+static void snd_mpu401_uart_input_read(struct snd_mpu401 * mpu);
+static void snd_mpu401_uart_output_write(struct snd_mpu401 * mpu);
+
+/*
+
+ */
+
+#define snd_mpu401_input_avail(mpu) \
+	(!(mpu->read(mpu, MPU401C(mpu)) & MPU401_RX_EMPTY))
+#define snd_mpu401_output_ready(mpu) \
+	(!(mpu->read(mpu, MPU401C(mpu)) & MPU401_TX_FULL))
+
+/* Build in lowlevel io */
+static void mpu401_write_port(struct snd_mpu401 *mpu, unsigned char data,
+			      unsigned long addr)
+{
+	outb(data, addr);
+}
+
+static unsigned char mpu401_read_port(struct snd_mpu401 *mpu,
+				      unsigned long addr)
+{
+	return inb(addr);
+}
+
+static void mpu401_write_mmio(struct snd_mpu401 *mpu, unsigned char data,
+			      unsigned long addr)
+{
+	writeb(data, (void __iomem *)addr);
+}
+
+static unsigned char mpu401_read_mmio(struct snd_mpu401 *mpu,
+				      unsigned long addr)
+{
+	return readb((void __iomem *)addr);
+}
+/*  */
+
+static void snd_mpu401_uart_clear_rx(struct snd_mpu401 *mpu)
+{
+	int timeout = 100000;
+	for (; timeout > 0 && snd_mpu401_input_avail(mpu); timeout--)
+		mpu->read(mpu, MPU401D(mpu));
+#ifdef CONFIG_SND_DEBUG
+	if (timeout <= 0)
+		dev_err(mpu->rmidi->dev,
+			"cmd: clear rx timeout (status = 0x%x)\n",
+			mpu->read(mpu, MPU401C(mpu)));
+#endif
+}
+
+static void uart_interrupt_tx(struct snd_mpu401 *mpu)
+{
+	if (test_bit(MPU401_MODE_BIT_OUTPUT, &mpu->mode) &&
+	    test_bit(MPU401_MODE_BIT_OUTPUT_TRIGGER, &mpu->mode)) {
+		guard(spinlock_irqsave)(&mpu->output_lock);
+		snd_mpu401_uart_output_write(mpu);
+	}
+}
+
+static void _snd_mpu401_uart_interrupt(struct snd_mpu401 *mpu)
+{
+	if (mpu->info_flags & MPU401_INFO_INPUT) {
+		guard(spinlock_irqsave)(&mpu->input_lock);
+		if (test_bit(MPU401_MODE_BIT_INPUT, &mpu->mode))
+			snd_mpu401_uart_input_read(mpu);
+		else
+			snd_mpu401_uart_clear_rx(mpu);
+	}
+	if (! (mpu->info_flags & MPU401_INFO_TX_IRQ))
+		/* ok. for better Tx performance try do some output
+		   when input is done */
+		uart_interrupt_tx(mpu);
+}
+
+/**
+ * snd_mpu401_uart_interrupt - generic MPU401-UART interrupt handler
+ * @irq: the irq number
+ * @dev_id: mpu401 instance
+ *
+ * Processes the interrupt for MPU401-UART i/o.
+ *
+ * Return: %IRQ_HANDLED if the interrupt was handled. %IRQ_NONE otherwise.
+ */
+irqreturn_t snd_mpu401_uart_interrupt(int irq, void *dev_id)
+{
+	struct snd_mpu401 *mpu = dev_id;
+	
+	if (!mpu)
+		return IRQ_NONE;
+	_snd_mpu401_uart_interrupt(mpu);
+	return IRQ_HANDLED;
+}
+
+EXPORT_SYMBOL(snd_mpu401_uart_interrupt);
+
+/**
+ * snd_mpu401_uart_interrupt_tx - generic MPU401-UART transmit irq handler
+ * @irq: the irq number
+ * @dev_id: mpu401 instance
+ *
+ * Processes the interrupt for MPU401-UART output.
+ *
+ * Return: %IRQ_HANDLED if the interrupt was handled. %IRQ_NONE otherwise.
+ */
+irqreturn_t snd_mpu401_uart_interrupt_tx(int irq, void *dev_id)
+{
+	struct snd_mpu401 *mpu = dev_id;
+	
+	if (!mpu)
+		return IRQ_NONE;
+	uart_interrupt_tx(mpu);
+	return IRQ_HANDLED;
+}
+
+EXPORT_SYMBOL(snd_mpu401_uart_interrupt_tx);
+
+/*
+ * timer callback
+ * reprogram the timer and call the interrupt job
+ */
+static void snd_mpu401_uart_timer(struct timer_list *t)
+{
+	struct snd_mpu401 *mpu = timer_container_of(mpu, t, timer);
+
+	scoped_guard(spinlock_irqsave, &mpu->timer_lock) {
+		/*mpu->mode |= MPU401_MODE_TIMER;*/
+		mod_timer(&mpu->timer,  1 + jiffies);
+	}
+	if (mpu->rmidi)
+		_snd_mpu401_uart_interrupt(mpu);
+}
+
+/*
+ * initialize the timer callback if not programmed yet
+ */
+static void snd_mpu401_uart_add_timer (struct snd_mpu401 *mpu, int input)
+{
+	guard(spinlock_irqsave)(&mpu->timer_lock);
+	if (mpu->timer_invoked == 0) {
+		timer_setup(&mpu->timer, snd_mpu401_uart_timer, 0);
+		mod_timer(&mpu->timer, 1 + jiffies);
+	} 
+	mpu->timer_invoked |= input ? MPU401_MODE_INPUT_TIMER :
+		MPU401_MODE_OUTPUT_TIMER;
+}
+
+/*
+ * remove the timer callback if still active
+ */
+static void snd_mpu401_uart_remove_timer (struct snd_mpu401 *mpu, int input)
+{
+	guard(spinlock_irqsave)(&mpu->timer_lock);
+	if (mpu->timer_invoked) {
+		mpu->timer_invoked &= input ? ~MPU401_MODE_INPUT_TIMER :
+			~MPU401_MODE_OUTPUT_TIMER;
+		if (! mpu->timer_invoked)
+			timer_delete(&mpu->timer);
+	}
+}
+
+/*
+ * send a UART command
+ * return zero if successful, non-zero for some errors
+ */
+
+static int snd_mpu401_uart_cmd(struct snd_mpu401 * mpu, unsigned char cmd,
+			       int ack)
+{
+	int timeout, ok;
+
+	guard(spinlock_irqsave)(&mpu->input_lock);
+	if (mpu->hardware != MPU401_HW_TRID4DWAVE) {
+		mpu->write(mpu, 0x00, MPU401D(mpu));
+		/*snd_mpu401_uart_clear_rx(mpu);*/
+	}
+	/* ok. standard MPU-401 initialization */
+	if (mpu->hardware != MPU401_HW_SB) {
+		for (timeout = 1000; timeout > 0 &&
+			     !snd_mpu401_output_ready(mpu); timeout--)
+			udelay(10);
+#ifdef CONFIG_SND_DEBUG
+		if (!timeout)
+			dev_err(mpu->rmidi->dev,
+				"cmd: tx timeout (status = 0x%x)\n",
+				mpu->read(mpu, MPU401C(mpu)));
+#endif
+	}
+	mpu->write(mpu, cmd, MPU401C(mpu));
+	if (ack && !(mpu->info_flags & MPU401_INFO_NO_ACK)) {
+		ok = 0;
+		timeout = 10000;
+		while (!ok && timeout-- > 0) {
+			if (snd_mpu401_input_avail(mpu)) {
+				if (mpu->read(mpu, MPU401D(mpu)) == MPU401_ACK)
+					ok = 1;
+			}
+		}
+		if (!ok && mpu->read(mpu, MPU401D(mpu)) == MPU401_ACK)
+			ok = 1;
+	} else
+		ok = 1;
+	if (!ok) {
+		dev_err(mpu->rmidi->dev,
+			"cmd: 0x%x failed at 0x%lx (status = 0x%x, data = 0x%x)\n",
+			cmd, mpu->port,
+			mpu->read(mpu, MPU401C(mpu)),
+			mpu->read(mpu, MPU401D(mpu)));
+		return 1;
+	}
+	return 0;
+}
+
+static int snd_mpu401_do_reset(struct snd_mpu401 *mpu)
+{
+	if (snd_mpu401_uart_cmd(mpu, MPU401_RESET, 1))
+		return -EIO;
+	if (snd_mpu401_uart_cmd(mpu, MPU401_ENTER_UART, 0))
+		return -EIO;
+	return 0;
+}
+
+/*
+ * input/output open/close - protected by open_mutex in rawmidi.c
+ */
+static int snd_mpu401_uart_input_open(struct snd_rawmidi_substream *substream)
+{
+	struct snd_mpu401 *mpu;
+	int err;
+
+	mpu = substream->rmidi->private_data;
+	if (mpu->open_input) {
+		err = mpu->open_input(mpu);
+		if (err < 0)
+			return err;
+	}
+	if (! test_bit(MPU401_MODE_BIT_OUTPUT, &mpu->mode)) {
+		if (snd_mpu401_do_reset(mpu) < 0)
+			goto error_out;
+	}
+	mpu->substream_input = substream;
+	set_bit(MPU401_MODE_BIT_INPUT, &mpu->mode);
+	return 0;
+
+error_out:
+	if (mpu->open_input && mpu->close_input)
+		mpu->close_input(mpu);
+	return -EIO;
+}
+
+static int snd_mpu401_uart_output_open(struct snd_rawmidi_substream *substream)
+{
+	struct snd_mpu401 *mpu;
+	int err;
+
+	mpu = substream->rmidi->private_data;
+	if (mpu->open_output) {
+		err = mpu->open_output(mpu);
+		if (err < 0)
+			return err;
+	}
+	if (! test_bit(MPU401_MODE_BIT_INPUT, &mpu->mode)) {
+		if (snd_mpu401_do_reset(mpu) < 0)
+			goto error_out;
+	}
+	mpu->substream_output = substream;
+	set_bit(MPU401_MODE_BIT_OUTPUT, &mpu->mode);
+	return 0;
+
+error_out:
+	if (mpu->open_output && mpu->close_output)
+		mpu->close_output(mpu);
+	return -EIO;
+}
+
+static int snd_mpu401_uart_input_close(struct snd_rawmidi_substream *substream)
+{
+	struct snd_mpu401 *mpu;
+	int err = 0;
+
+	mpu = substream->rmidi->private_data;
+	clear_bit(MPU401_MODE_BIT_INPUT, &mpu->mode);
+	mpu->substream_input = NULL;
+	if (! test_bit(MPU401_MODE_BIT_OUTPUT, &mpu->mode))
+		err = snd_mpu401_uart_cmd(mpu, MPU401_RESET, 0);
+	if (mpu->close_input)
+		mpu->close_input(mpu);
+	if (err)
+		return -EIO;
+	return 0;
+}
+
+static int snd_mpu401_uart_output_close(struct snd_rawmidi_substream *substream)
+{
+	struct snd_mpu401 *mpu;
+	int err = 0;
+
+	mpu = substream->rmidi->private_data;
+	clear_bit(MPU401_MODE_BIT_OUTPUT, &mpu->mode);
+	mpu->substream_output = NULL;
+	if (! test_bit(MPU401_MODE_BIT_INPUT, &mpu->mode))
+		err = snd_mpu401_uart_cmd(mpu, MPU401_RESET, 0);
+	if (mpu->close_output)
+		mpu->close_output(mpu);
+	if (err)
+		return -EIO;
+	return 0;
+}
+
+/*
+ * trigger input callback
+ */
+static void
+snd_mpu401_uart_input_trigger(struct snd_rawmidi_substream *substream, int up)
+{
+	struct snd_mpu401 *mpu;
+	int max = 64;
+
+	mpu = substream->rmidi->private_data;
+	if (up) {
+		if (! test_and_set_bit(MPU401_MODE_BIT_INPUT_TRIGGER,
+				       &mpu->mode)) {
+			/* first time - flush FIFO */
+			while (max-- > 0)
+				mpu->read(mpu, MPU401D(mpu));
+			if (mpu->info_flags & MPU401_INFO_USE_TIMER)
+				snd_mpu401_uart_add_timer(mpu, 1);
+		}
+		
+		/* read data in advance */
+		guard(spinlock_irqsave)(&mpu->input_lock);
+		snd_mpu401_uart_input_read(mpu);
+	} else {
+		if (mpu->info_flags & MPU401_INFO_USE_TIMER)
+			snd_mpu401_uart_remove_timer(mpu, 1);
+		clear_bit(MPU401_MODE_BIT_INPUT_TRIGGER, &mpu->mode);
+	}
+
+}
+
+/*
+ * transfer input pending data
+ * call with input_lock spinlock held
+ */
+static void snd_mpu401_uart_input_read(struct snd_mpu401 * mpu)
+{
+	int max = 128;
+	unsigned char byte;
+
+	while (max-- > 0) {
+		if (! snd_mpu401_input_avail(mpu))
+			break; /* input not available */
+		byte = mpu->read(mpu, MPU401D(mpu));
+		if (test_bit(MPU401_MODE_BIT_INPUT_TRIGGER, &mpu->mode))
+			snd_rawmidi_receive(mpu->substream_input, &byte, 1);
+	}
+}
+
+/*
+ *  Tx FIFO sizes:
+ *    CS4237B			- 16 bytes
+ *    AudioDrive ES1688         - 12 bytes
+ *    S3 SonicVibes             -  8 bytes
+ *    SoundBlaster AWE 64       -  2 bytes (ugly hardware)
+ */
+
+/*
+ * write output pending bytes
+ * call with output_lock spinlock held
+ */
+static void snd_mpu401_uart_output_write(struct snd_mpu401 * mpu)
+{
+	unsigned char byte;
+	int max = 256;
+
+	do {
+		if (snd_rawmidi_transmit_peek(mpu->substream_output,
+					      &byte, 1) == 1) {
+			/*
+			 * Try twice because there is hardware that insists on
+			 * setting the output busy bit after each write.
+			 */
+			if (!snd_mpu401_output_ready(mpu) &&
+			    !snd_mpu401_output_ready(mpu))
+				break;	/* Tx FIFO full - try again later */
+			mpu->write(mpu, byte, MPU401D(mpu));
+			snd_rawmidi_transmit_ack(mpu->substream_output, 1);
+		} else {
+			snd_mpu401_uart_remove_timer (mpu, 0);
+			break;	/* no other data - leave the tx loop */
+		}
+	} while (--max > 0);
+}
+
+/*
+ * output trigger callback
+ */
+static void
+snd_mpu401_uart_output_trigger(struct snd_rawmidi_substream *substream, int up)
+{
+	struct snd_mpu401 *mpu;
+
+	mpu = substream->rmidi->private_data;
+	if (up) {
+		set_bit(MPU401_MODE_BIT_OUTPUT_TRIGGER, &mpu->mode);
+
+		/* try to add the timer at each output trigger,
+		 * since the output timer might have been removed in
+		 * snd_mpu401_uart_output_write().
+		 */
+		if (! (mpu->info_flags & MPU401_INFO_TX_IRQ))
+			snd_mpu401_uart_add_timer(mpu, 0);
+
+		/* output pending data */
+		guard(spinlock_irqsave)(&mpu->output_lock);
+		snd_mpu401_uart_output_write(mpu);
+	} else {
+		if (! (mpu->info_flags & MPU401_INFO_TX_IRQ))
+			snd_mpu401_uart_remove_timer(mpu, 0);
+		clear_bit(MPU401_MODE_BIT_OUTPUT_TRIGGER, &mpu->mode);
+	}
+}
+
+/*
+
+ */
+
+static const struct snd_rawmidi_ops snd_mpu401_uart_output =
+{
+	.open =		snd_mpu401_uart_output_open,
+	.close =	snd_mpu401_uart_output_close,
+	.trigger =	snd_mpu401_uart_output_trigger,
+};
+
+static const struct snd_rawmidi_ops snd_mpu401_uart_input =
+{
+	.open =		snd_mpu401_uart_input_open,
+	.close =	snd_mpu401_uart_input_close,
+	.trigger =	snd_mpu401_uart_input_trigger,
+};
+
+static void snd_mpu401_uart_free(struct snd_rawmidi *rmidi)
+{
+	struct snd_mpu401 *mpu = rmidi->private_data;
+	if (mpu->irq >= 0)
+		free_irq(mpu->irq, (void *) mpu);
+	release_and_free_resource(mpu->res);
+	kfree(mpu);
+}
+
+/**
+ * snd_mpu401_uart_new - create an MPU401-UART instance
+ * @card: the card instance
+ * @device: the device index, zero-based
+ * @hardware: the hardware type, MPU401_HW_XXXX
+ * @port: the base address of MPU401 port
+ * @info_flags: bitflags MPU401_INFO_XXX
+ * @irq: the ISA irq number, -1 if not to be allocated
+ * @rrawmidi: the pointer to store the new rawmidi instance
+ *
+ * Creates a new MPU-401 instance.
+ *
+ * Note that the rawmidi instance is returned on the rrawmidi argument,
+ * not the mpu401 instance itself.  To access to the mpu401 instance,
+ * cast from rawmidi->private_data (with struct snd_mpu401 magic-cast).
+ *
+ * Return: Zero if successful, or a negative error code.
+ */
+int snd_mpu401_uart_new(struct snd_card *card, int device,
+			unsigned short hardware,
+			unsigned long port,
+			unsigned int info_flags,
+			int irq,
+			struct snd_rawmidi ** rrawmidi)
+{
+	struct snd_mpu401 *mpu;
+	struct snd_rawmidi *rmidi;
+	int in_enable, out_enable;
+	int err;
+
+	if (rrawmidi)
+		*rrawmidi = NULL;
+	if (! (info_flags & (MPU401_INFO_INPUT | MPU401_INFO_OUTPUT)))
+		info_flags |= MPU401_INFO_INPUT | MPU401_INFO_OUTPUT;
+	in_enable = (info_flags & MPU401_INFO_INPUT) ? 1 : 0;
+	out_enable = (info_flags & MPU401_INFO_OUTPUT) ? 1 : 0;
+	err = snd_rawmidi_new(card, "MPU-401U", device,
+			      out_enable, in_enable, &rmidi);
+	if (err < 0)
+		return err;
+	mpu = kzalloc_obj(*mpu);
+	if (!mpu) {
+		err = -ENOMEM;
+		goto free_device;
+	}
+	rmidi->private_data = mpu;
+	rmidi->private_free = snd_mpu401_uart_free;
+	spin_lock_init(&mpu->input_lock);
+	spin_lock_init(&mpu->output_lock);
+	spin_lock_init(&mpu->timer_lock);
+	mpu->hardware = hardware;
+	mpu->irq = -1;
+	mpu->rmidi = rmidi;
+	if (! (info_flags & MPU401_INFO_INTEGRATED)) {
+		int res_size = hardware == MPU401_HW_PC98II ? 4 : 2;
+		mpu->res = request_region(port, res_size, "MPU401 UART");
+		if (!mpu->res) {
+			dev_err(rmidi->dev,
+				"mpu401_uart: unable to grab port 0x%lx size %d\n",
+				port, res_size);
+			err = -EBUSY;
+			goto free_device;
+		}
+	}
+	if (info_flags & MPU401_INFO_MMIO) {
+		mpu->write = mpu401_write_mmio;
+		mpu->read = mpu401_read_mmio;
+	} else {
+		mpu->write = mpu401_write_port;
+		mpu->read = mpu401_read_port;
+	}
+	mpu->port = port;
+	if (hardware == MPU401_HW_PC98II)
+		mpu->cport = port + 2;
+	else
+		mpu->cport = port + 1;
+	if (irq >= 0) {
+		if (request_irq(irq, snd_mpu401_uart_interrupt, 0,
+				"MPU401 UART", (void *) mpu)) {
+			dev_err(rmidi->dev,
+				"mpu401_uart: unable to grab IRQ %d\n", irq);
+			err = -EBUSY;
+			goto free_device;
+		}
+	}
+	if (irq < 0 && !(info_flags & MPU401_INFO_IRQ_HOOK))
+		info_flags |= MPU401_INFO_USE_TIMER;
+	mpu->info_flags = info_flags;
+	mpu->irq = irq;
+	if (card->shortname[0])
+		snprintf(rmidi->name, sizeof(rmidi->name), "%s MIDI",
+			 card->shortname);
+	else
+		sprintf(rmidi->name, "MPU-401 MIDI %d-%d",card->number, device);
+	if (out_enable) {
+		snd_rawmidi_set_ops(rmidi, SNDRV_RAWMIDI_STREAM_OUTPUT,
+				    &snd_mpu401_uart_output);
+		rmidi->info_flags |= SNDRV_RAWMIDI_INFO_OUTPUT;
+	}
+	if (in_enable) {
+		snd_rawmidi_set_ops(rmidi, SNDRV_RAWMIDI_STREAM_INPUT,
+				    &snd_mpu401_uart_input);
+		rmidi->info_flags |= SNDRV_RAWMIDI_INFO_INPUT;
+		if (out_enable)
+			rmidi->info_flags |= SNDRV_RAWMIDI_INFO_DUPLEX;
+	}
+	if (rrawmidi)
+		*rrawmidi = rmidi;
+	return 0;
+free_device:
+	snd_device_free(card, rmidi);
+	return err;
+}
+
+EXPORT_SYMBOL(snd_mpu401_uart_new);