tunnels: fix netns vs proto registration ordering
[safe/jmp/linux-2.6] / drivers / input / joydev.c
index 949bdce..b1bd6dd 100644 (file)
 #include <linux/input.h>
 #include <linux/kernel.h>
 #include <linux/major.h>
+#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/mm.h>
 #include <linux/miscdevice.h>
 #include <linux/module.h>
 #include <linux/poll.h>
 #include <linux/init.h>
-#include <linux/smp_lock.h>
 #include <linux/device.h>
 
 MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
@@ -40,10 +40,13 @@ struct joydev {
        int exist;
        int open;
        int minor;
-       char name[16];
        struct input_handle handle;
        wait_queue_head_t wait;
-       struct list_head list;
+       struct list_head client_list;
+       spinlock_t client_lock; /* protects client_list */
+       struct mutex mutex;
+       struct device dev;
+
        struct js_corr corr[ABS_MAX + 1];
        struct JS_DATA_SAVE_TYPE glue;
        int nabs;
@@ -55,217 +58,384 @@ struct joydev {
        __s16 abs[ABS_MAX + 1];
 };
 
-struct joydev_list {
+struct joydev_client {
        struct js_event buffer[JOYDEV_BUFFER_SIZE];
        int head;
        int tail;
        int startup;
+       spinlock_t buffer_lock; /* protects access to buffer, head and tail */
        struct fasync_struct *fasync;
        struct joydev *joydev;
        struct list_head node;
 };
 
 static struct joydev *joydev_table[JOYDEV_MINORS];
+static DEFINE_MUTEX(joydev_table_mutex);
 
 static int joydev_correct(int value, struct js_corr *corr)
 {
        switch (corr->type) {
-               case JS_CORR_NONE:
-                       break;
-               case JS_CORR_BROKEN:
-                       value = value > corr->coef[0] ? (value < corr->coef[1] ? 0 :
-                               ((corr->coef[3] * (value - corr->coef[1])) >> 14)) :
-                               ((corr->coef[2] * (value - corr->coef[0])) >> 14);
-                       break;
-               default:
-                       return 0;
+
+       case JS_CORR_NONE:
+               break;
+
+       case JS_CORR_BROKEN:
+               value = value > corr->coef[0] ? (value < corr->coef[1] ? 0 :
+                       ((corr->coef[3] * (value - corr->coef[1])) >> 14)) :
+                       ((corr->coef[2] * (value - corr->coef[0])) >> 14);
+               break;
+
+       default:
+               return 0;
+       }
+
+       return value < -32767 ? -32767 : (value > 32767 ? 32767 : value);
+}
+
+static void joydev_pass_event(struct joydev_client *client,
+                             struct js_event *event)
+{
+       struct joydev *joydev = client->joydev;
+
+       /*
+        * IRQs already disabled, just acquire the lock
+        */
+       spin_lock(&client->buffer_lock);
+
+       client->buffer[client->head] = *event;
+
+       if (client->startup == joydev->nabs + joydev->nkey) {
+               client->head++;
+               client->head &= JOYDEV_BUFFER_SIZE - 1;
+               if (client->tail == client->head)
+                       client->startup = 0;
        }
 
-       if (value < -32767) return -32767;
-       if (value >  32767) return  32767;
+       spin_unlock(&client->buffer_lock);
 
-       return value;
+       kill_fasync(&client->fasync, SIGIO, POLL_IN);
 }
 
-static void joydev_event(struct input_handle *handle, unsigned int type, unsigned int code, int value)
+static void joydev_event(struct input_handle *handle,
+                        unsigned int type, unsigned int code, int value)
 {
        struct joydev *joydev = handle->private;
-       struct joydev_list *list;
+       struct joydev_client *client;
        struct js_event event;
 
        switch (type) {
 
-               case EV_KEY:
-                       if (code < BTN_MISC || value == 2) return;
-                       event.type = JS_EVENT_BUTTON;
-                       event.number = joydev->keymap[code - BTN_MISC];
-                       event.value = value;
-                       break;
-
-               case EV_ABS:
-                       event.type = JS_EVENT_AXIS;
-                       event.number = joydev->absmap[code];
-                       event.value = joydev_correct(value, joydev->corr + event.number);
-                       if (event.value == joydev->abs[event.number]) return;
-                       joydev->abs[event.number] = event.value;
-                       break;
+       case EV_KEY:
+               if (code < BTN_MISC || value == 2)
+                       return;
+               event.type = JS_EVENT_BUTTON;
+               event.number = joydev->keymap[code - BTN_MISC];
+               event.value = value;
+               break;
 
-               default:
+       case EV_ABS:
+               event.type = JS_EVENT_AXIS;
+               event.number = joydev->absmap[code];
+               event.value = joydev_correct(value,
+                                       &joydev->corr[event.number]);
+               if (event.value == joydev->abs[event.number])
                        return;
+               joydev->abs[event.number] = event.value;
+               break;
+
+       default:
+               return;
        }
 
        event.time = jiffies_to_msecs(jiffies);
 
-       list_for_each_entry(list, &joydev->list, node) {
-
-               memcpy(list->buffer + list->head, &event, sizeof(struct js_event));
-
-               if (list->startup == joydev->nabs + joydev->nkey)
-                       if (list->tail == (list->head = (list->head + 1) & (JOYDEV_BUFFER_SIZE - 1)))
-                               list->startup = 0;
-
-               kill_fasync(&list->fasync, SIGIO, POLL_IN);
-       }
+       rcu_read_lock();
+       list_for_each_entry_rcu(client, &joydev->client_list, node)
+               joydev_pass_event(client, &event);
+       rcu_read_unlock();
 
        wake_up_interruptible(&joydev->wait);
 }
 
 static int joydev_fasync(int fd, struct file *file, int on)
 {
-       int retval;
-       struct joydev_list *list = file->private_data;
-       retval = fasync_helper(fd, file, on, &list->fasync);
-       return retval < 0 ? retval : 0;
+       struct joydev_client *client = file->private_data;
+
+       return fasync_helper(fd, file, on, &client->fasync);
 }
 
-static void joydev_free(struct joydev *joydev)
+static void joydev_free(struct device *dev)
 {
-       joydev_table[joydev->minor] = NULL;
+       struct joydev *joydev = container_of(dev, struct joydev, dev);
+
+       input_put_device(joydev->handle.dev);
        kfree(joydev);
 }
 
-static int joydev_release(struct inode * inode, struct file * file)
+static void joydev_attach_client(struct joydev *joydev,
+                                struct joydev_client *client)
 {
-       struct joydev_list *list = file->private_data;
+       spin_lock(&joydev->client_lock);
+       list_add_tail_rcu(&client->node, &joydev->client_list);
+       spin_unlock(&joydev->client_lock);
+       synchronize_rcu();
+}
 
-       joydev_fasync(-1, file, 0);
+static void joydev_detach_client(struct joydev *joydev,
+                                struct joydev_client *client)
+{
+       spin_lock(&joydev->client_lock);
+       list_del_rcu(&client->node);
+       spin_unlock(&joydev->client_lock);
+       synchronize_rcu();
+}
 
-       list_del(&list->node);
+static int joydev_open_device(struct joydev *joydev)
+{
+       int retval;
+
+       retval = mutex_lock_interruptible(&joydev->mutex);
+       if (retval)
+               return retval;
 
-       if (!--list->joydev->open) {
-               if (list->joydev->exist)
-                       input_close_device(&list->joydev->handle);
-               else
-                       joydev_free(list->joydev);
+       if (!joydev->exist)
+               retval = -ENODEV;
+       else if (!joydev->open++) {
+               retval = input_open_device(&joydev->handle);
+               if (retval)
+                       joydev->open--;
        }
 
-       kfree(list);
+       mutex_unlock(&joydev->mutex);
+       return retval;
+}
+
+static void joydev_close_device(struct joydev *joydev)
+{
+       mutex_lock(&joydev->mutex);
+
+       if (joydev->exist && !--joydev->open)
+               input_close_device(&joydev->handle);
+
+       mutex_unlock(&joydev->mutex);
+}
+
+/*
+ * Wake up users waiting for IO so they can disconnect from
+ * dead device.
+ */
+static void joydev_hangup(struct joydev *joydev)
+{
+       struct joydev_client *client;
+
+       spin_lock(&joydev->client_lock);
+       list_for_each_entry(client, &joydev->client_list, node)
+               kill_fasync(&client->fasync, SIGIO, POLL_HUP);
+       spin_unlock(&joydev->client_lock);
+
+       wake_up_interruptible(&joydev->wait);
+}
+
+static int joydev_release(struct inode *inode, struct file *file)
+{
+       struct joydev_client *client = file->private_data;
+       struct joydev *joydev = client->joydev;
+
+       joydev_detach_client(joydev, client);
+       kfree(client);
+
+       joydev_close_device(joydev);
+       put_device(&joydev->dev);
+
        return 0;
 }
 
 static int joydev_open(struct inode *inode, struct file *file)
 {
-       struct joydev_list *list;
+       struct joydev_client *client;
+       struct joydev *joydev;
        int i = iminor(inode) - JOYDEV_MINOR_BASE;
+       int error;
 
-       if (i >= JOYDEV_MINORS || !joydev_table[i])
+       if (i >= JOYDEV_MINORS)
                return -ENODEV;
 
-       if (!(list = kzalloc(sizeof(struct joydev_list), GFP_KERNEL)))
-               return -ENOMEM;
+       error = mutex_lock_interruptible(&joydev_table_mutex);
+       if (error)
+               return error;
+       joydev = joydev_table[i];
+       if (joydev)
+               get_device(&joydev->dev);
+       mutex_unlock(&joydev_table_mutex);
+
+       if (!joydev)
+               return -ENODEV;
 
-       list->joydev = joydev_table[i];
-       list_add_tail(&list->node, &joydev_table[i]->list);
-       file->private_data = list;
+       client = kzalloc(sizeof(struct joydev_client), GFP_KERNEL);
+       if (!client) {
+               error = -ENOMEM;
+               goto err_put_joydev;
+       }
 
-       if (!list->joydev->open++)
-               if (list->joydev->exist)
-                       input_open_device(&list->joydev->handle);
+       spin_lock_init(&client->buffer_lock);
+       client->joydev = joydev;
+       joydev_attach_client(joydev, client);
 
+       error = joydev_open_device(joydev);
+       if (error)
+               goto err_free_client;
+
+       file->private_data = client;
        return 0;
-}
 
-static ssize_t joydev_write(struct file * file, const char __user * buffer, size_t count, loff_t *ppos)
-{
-       return -EINVAL;
+ err_free_client:
+       joydev_detach_client(joydev, client);
+       kfree(client);
+ err_put_joydev:
+       put_device(&joydev->dev);
+       return error;
 }
 
-static ssize_t joydev_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
+static int joydev_generate_startup_event(struct joydev_client *client,
+                                        struct input_dev *input,
+                                        struct js_event *event)
 {
-       struct joydev_list *list = file->private_data;
-       struct joydev *joydev = list->joydev;
-       struct input_dev *input = joydev->handle.dev;
-       int retval = 0;
+       struct joydev *joydev = client->joydev;
+       int have_event;
 
-       if (!list->joydev->exist)
-               return -ENODEV;
+       spin_lock_irq(&client->buffer_lock);
 
-       if (count < sizeof(struct js_event))
-               return -EINVAL;
+       have_event = client->startup < joydev->nabs + joydev->nkey;
 
-       if (count == sizeof(struct JS_DATA_TYPE)) {
+       if (have_event) {
 
-               struct JS_DATA_TYPE data;
-               int i;
+               event->time = jiffies_to_msecs(jiffies);
+               if (client->startup < joydev->nkey) {
+                       event->type = JS_EVENT_BUTTON | JS_EVENT_INIT;
+                       event->number = client->startup;
+                       event->value = !!test_bit(joydev->keypam[event->number],
+                                                 input->key);
+               } else {
+                       event->type = JS_EVENT_AXIS | JS_EVENT_INIT;
+                       event->number = client->startup - joydev->nkey;
+                       event->value = joydev->abs[event->number];
+               }
+               client->startup++;
+       }
 
-               for (data.buttons = i = 0; i < 32 && i < joydev->nkey; i++)
-                       data.buttons |= test_bit(joydev->keypam[i], input->key) ? (1 << i) : 0;
-               data.x = (joydev->abs[0] / 256 + 128) >> joydev->glue.JS_CORR.x;
-               data.y = (joydev->abs[1] / 256 + 128) >> joydev->glue.JS_CORR.y;
+       spin_unlock_irq(&client->buffer_lock);
 
-               if (copy_to_user(buf, &data, sizeof(struct JS_DATA_TYPE)))
-                       return -EFAULT;
+       return have_event;
+}
 
-               list->startup = 0;
-               list->tail = list->head;
+static int joydev_fetch_next_event(struct joydev_client *client,
+                                  struct js_event *event)
+{
+       int have_event;
 
-               return sizeof(struct JS_DATA_TYPE);
+       spin_lock_irq(&client->buffer_lock);
+
+       have_event = client->head != client->tail;
+       if (have_event) {
+               *event = client->buffer[client->tail++];
+               client->tail &= JOYDEV_BUFFER_SIZE - 1;
        }
 
-       if (list->startup == joydev->nabs + joydev->nkey
-               && list->head == list->tail && (file->f_flags & O_NONBLOCK))
-                       return -EAGAIN;
+       spin_unlock_irq(&client->buffer_lock);
 
-       retval = wait_event_interruptible(list->joydev->wait,
-                                         !list->joydev->exist ||
-                                         list->startup < joydev->nabs + joydev->nkey ||
-                                         list->head != list->tail);
+       return have_event;
+}
 
-       if (retval)
-               return retval;
+/*
+ * Old joystick interface
+ */
+static ssize_t joydev_0x_read(struct joydev_client *client,
+                             struct input_dev *input,
+                             char __user *buf)
+{
+       struct joydev *joydev = client->joydev;
+       struct JS_DATA_TYPE data;
+       int i;
+
+       spin_lock_irq(&input->event_lock);
+
+       /*
+        * Get device state
+        */
+       for (data.buttons = i = 0; i < 32 && i < joydev->nkey; i++)
+               data.buttons |=
+                       test_bit(joydev->keypam[i], input->key) ? (1 << i) : 0;
+       data.x = (joydev->abs[0] / 256 + 128) >> joydev->glue.JS_CORR.x;
+       data.y = (joydev->abs[1] / 256 + 128) >> joydev->glue.JS_CORR.y;
+
+       /*
+        * Reset reader's event queue
+        */
+       spin_lock(&client->buffer_lock);
+       client->startup = 0;
+       client->tail = client->head;
+       spin_unlock(&client->buffer_lock);
+
+       spin_unlock_irq(&input->event_lock);
+
+       if (copy_to_user(buf, &data, sizeof(struct JS_DATA_TYPE)))
+               return -EFAULT;
+
+       return sizeof(struct JS_DATA_TYPE);
+}
+
+static inline int joydev_data_pending(struct joydev_client *client)
+{
+       struct joydev *joydev = client->joydev;
+
+       return client->startup < joydev->nabs + joydev->nkey ||
+               client->head != client->tail;
+}
 
-       if (!list->joydev->exist)
+static ssize_t joydev_read(struct file *file, char __user *buf,
+                          size_t count, loff_t *ppos)
+{
+       struct joydev_client *client = file->private_data;
+       struct joydev *joydev = client->joydev;
+       struct input_dev *input = joydev->handle.dev;
+       struct js_event event;
+       int retval;
+
+       if (!joydev->exist)
                return -ENODEV;
 
-       while (list->startup < joydev->nabs + joydev->nkey && retval + sizeof(struct js_event) <= count) {
+       if (count < sizeof(struct js_event))
+               return -EINVAL;
 
-               struct js_event event;
+       if (count == sizeof(struct JS_DATA_TYPE))
+               return joydev_0x_read(client, input, buf);
 
-               event.time = jiffies_to_msecs(jiffies);
+       if (!joydev_data_pending(client) && (file->f_flags & O_NONBLOCK))
+               return -EAGAIN;
 
-               if (list->startup < joydev->nkey) {
-                       event.type = JS_EVENT_BUTTON | JS_EVENT_INIT;
-                       event.number = list->startup;
-                       event.value = !!test_bit(joydev->keypam[event.number], input->key);
-               } else {
-                       event.type = JS_EVENT_AXIS | JS_EVENT_INIT;
-                       event.number = list->startup - joydev->nkey;
-                       event.value = joydev->abs[event.number];
-               }
+       retval = wait_event_interruptible(joydev->wait,
+                       !joydev->exist || joydev_data_pending(client));
+       if (retval)
+               return retval;
+
+       if (!joydev->exist)
+               return -ENODEV;
+
+       while (retval + sizeof(struct js_event) <= count &&
+              joydev_generate_startup_event(client, input, &event)) {
 
                if (copy_to_user(buf + retval, &event, sizeof(struct js_event)))
                        return -EFAULT;
 
-               list->startup++;
                retval += sizeof(struct js_event);
        }
 
-       while (list->head != list->tail && retval + sizeof(struct js_event) <= count) {
+       while (retval + sizeof(struct js_event) <= count &&
+              joydev_fetch_next_event(client, &event)) {
 
-               if (copy_to_user(buf + retval, list->buffer + list->tail, sizeof(struct js_event)))
+               if (copy_to_user(buf + retval, &event, sizeof(struct js_event)))
                        return -EFAULT;
 
-               list->tail = (list->tail + 1) & (JOYDEV_BUFFER_SIZE - 1);
                retval += sizeof(struct js_event);
        }
 
@@ -275,109 +445,206 @@ static ssize_t joydev_read(struct file *file, char __user *buf, size_t count, lo
 /* No kernel lock - fine */
 static unsigned int joydev_poll(struct file *file, poll_table *wait)
 {
-       struct joydev_list *list = file->private_data;
-       poll_wait(file, &list->joydev->wait, wait);
-       return ((list->head != list->tail || list->startup < list->joydev->nabs + list->joydev->nkey) ? 
-               (POLLIN | POLLRDNORM) : 0) | (list->joydev->exist ? 0 : (POLLHUP | POLLERR));
+       struct joydev_client *client = file->private_data;
+       struct joydev *joydev = client->joydev;
+
+       poll_wait(file, &joydev->wait, wait);
+       return (joydev_data_pending(client) ? (POLLIN | POLLRDNORM) : 0) |
+               (joydev->exist ?  0 : (POLLHUP | POLLERR));
+}
+
+static int joydev_handle_JSIOCSAXMAP(struct joydev *joydev,
+                                    void __user *argp, size_t len)
+{
+       __u8 *abspam;
+       int i;
+       int retval = 0;
+
+       len = min(len, sizeof(joydev->abspam));
+
+       /* Validate the map. */
+       abspam = kmalloc(len, GFP_KERNEL);
+       if (!abspam)
+               return -ENOMEM;
+
+       if (copy_from_user(abspam, argp, len)) {
+               retval = -EFAULT;
+               goto out;
+       }
+
+       for (i = 0; i < joydev->nabs; i++) {
+               if (abspam[i] > ABS_MAX) {
+                       retval = -EINVAL;
+                       goto out;
+               }
+       }
+
+       memcpy(joydev->abspam, abspam, len);
+
+ out:
+       kfree(abspam);
+       return retval;
+}
+
+static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev,
+                                     void __user *argp, size_t len)
+{
+       __u16 *keypam;
+       int i;
+       int retval = 0;
+
+       len = min(len, sizeof(joydev->keypam));
+
+       /* Validate the map. */
+       keypam = kmalloc(len, GFP_KERNEL);
+       if (!keypam)
+               return -ENOMEM;
+
+       if (copy_from_user(keypam, argp, len)) {
+               retval = -EFAULT;
+               goto out;
+       }
+
+       for (i = 0; i < joydev->nkey; i++) {
+               if (keypam[i] > KEY_MAX || keypam[i] < BTN_MISC) {
+                       retval = -EINVAL;
+                       goto out;
+               }
+       }
+
+       memcpy(joydev->keypam, keypam, len);
+
+       for (i = 0; i < joydev->nkey; i++)
+               joydev->keymap[keypam[i] - BTN_MISC] = i;
+
+ out:
+       kfree(keypam);
+       return retval;
 }
 
-static int joydev_ioctl_common(struct joydev *joydev, unsigned int cmd, void __user *argp)
+
+static int joydev_ioctl_common(struct joydev *joydev,
+                               unsigned int cmd, void __user *argp)
 {
        struct input_dev *dev = joydev->handle.dev;
+       size_t len;
        int i, j;
+       const char *name;
 
+       /* Process fixed-sized commands. */
        switch (cmd) {
 
-               case JS_SET_CAL:
-                       return copy_from_user(&joydev->glue.JS_CORR, argp,
+       case JS_SET_CAL:
+               return copy_from_user(&joydev->glue.JS_CORR, argp,
                                sizeof(joydev->glue.JS_CORR)) ? -EFAULT : 0;
-               case JS_GET_CAL:
-                       return copy_to_user(argp, &joydev->glue.JS_CORR,
+
+       case JS_GET_CAL:
+               return copy_to_user(argp, &joydev->glue.JS_CORR,
                                sizeof(joydev->glue.JS_CORR)) ? -EFAULT : 0;
-               case JS_SET_TIMEOUT:
-                       return get_user(joydev->glue.JS_TIMEOUT, (s32 __user *) argp);
-               case JS_GET_TIMEOUT:
-                       return put_user(joydev->glue.JS_TIMEOUT, (s32 __user *) argp);
-
-               case JSIOCGVERSION:
-                       return put_user(JS_VERSION, (__u32 __user *) argp);
-               case JSIOCGAXES:
-                       return put_user(joydev->nabs, (__u8 __user *) argp);
-               case JSIOCGBUTTONS:
-                       return put_user(joydev->nkey, (__u8 __user *) argp);
-               case JSIOCSCORR:
-                       if (copy_from_user(joydev->corr, argp,
-                                     sizeof(joydev->corr[0]) * joydev->nabs))
-                           return -EFAULT;
-                       for (i = 0; i < joydev->nabs; i++) {
-                               j = joydev->abspam[i];
-                               joydev->abs[i] = joydev_correct(dev->abs[j], joydev->corr + i);
-                       }
-                       return 0;
-               case JSIOCGCORR:
-                       return copy_to_user(argp, joydev->corr,
-                                               sizeof(joydev->corr[0]) * joydev->nabs) ? -EFAULT : 0;
-               case JSIOCSAXMAP:
-                       if (copy_from_user(joydev->abspam, argp, sizeof(__u8) * (ABS_MAX + 1)))
-                               return -EFAULT;
-                       for (i = 0; i < joydev->nabs; i++) {
-                               if (joydev->abspam[i] > ABS_MAX) return -EINVAL;
-                               joydev->absmap[joydev->abspam[i]] = i;
-                       }
-                       return 0;
-               case JSIOCGAXMAP:
-                       return copy_to_user(argp, joydev->abspam,
-                                               sizeof(__u8) * (ABS_MAX + 1)) ? -EFAULT : 0;
-               case JSIOCSBTNMAP:
-                       if (copy_from_user(joydev->keypam, argp, sizeof(__u16) * (KEY_MAX - BTN_MISC + 1)))
-                               return -EFAULT;
-                       for (i = 0; i < joydev->nkey; i++) {
-                               if (joydev->keypam[i] > KEY_MAX || joydev->keypam[i] < BTN_MISC) return -EINVAL;
-                               joydev->keymap[joydev->keypam[i] - BTN_MISC] = i;
-                       }
+
+       case JS_SET_TIMEOUT:
+               return get_user(joydev->glue.JS_TIMEOUT, (s32 __user *) argp);
+
+       case JS_GET_TIMEOUT:
+               return put_user(joydev->glue.JS_TIMEOUT, (s32 __user *) argp);
+
+       case JSIOCGVERSION:
+               return put_user(JS_VERSION, (__u32 __user *) argp);
+
+       case JSIOCGAXES:
+               return put_user(joydev->nabs, (__u8 __user *) argp);
+
+       case JSIOCGBUTTONS:
+               return put_user(joydev->nkey, (__u8 __user *) argp);
+
+       case JSIOCSCORR:
+               if (copy_from_user(joydev->corr, argp,
+                             sizeof(joydev->corr[0]) * joydev->nabs))
+                   return -EFAULT;
+
+               for (i = 0; i < joydev->nabs; i++) {
+                       j = joydev->abspam[i];
+                       joydev->abs[i] = joydev_correct(dev->abs[j],
+                                                       &joydev->corr[i]);
+               }
+               return 0;
+
+       case JSIOCGCORR:
+               return copy_to_user(argp, joydev->corr,
+                       sizeof(joydev->corr[0]) * joydev->nabs) ? -EFAULT : 0;
+
+       }
+
+       /*
+        * Process variable-sized commands (the axis and button map commands
+        * are considered variable-sized to decouple them from the values of
+        * ABS_MAX and KEY_MAX).
+        */
+       switch (cmd & ~IOCSIZE_MASK) {
+
+       case (JSIOCSAXMAP & ~IOCSIZE_MASK):
+               return joydev_handle_JSIOCSAXMAP(joydev, argp, _IOC_SIZE(cmd));
+
+       case (JSIOCGAXMAP & ~IOCSIZE_MASK):
+               len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->abspam));
+               return copy_to_user(argp, joydev->abspam, len) ? -EFAULT : len;
+
+       case (JSIOCSBTNMAP & ~IOCSIZE_MASK):
+               return joydev_handle_JSIOCSBTNMAP(joydev, argp, _IOC_SIZE(cmd));
+
+       case (JSIOCGBTNMAP & ~IOCSIZE_MASK):
+               len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->keypam));
+               return copy_to_user(argp, joydev->keypam, len) ? -EFAULT : len;
+
+       case JSIOCGNAME(0):
+               name = dev->name;
+               if (!name)
                        return 0;
-               case JSIOCGBTNMAP:
-                       return copy_to_user(argp, joydev->keypam,
-                                               sizeof(__u16) * (KEY_MAX - BTN_MISC + 1)) ? -EFAULT : 0;
-               default:
-                       if ((cmd & ~(_IOC_SIZEMASK << _IOC_SIZESHIFT)) == JSIOCGNAME(0)) {
-                               int len;
-                               if (!dev->name) return 0;
-                               len = strlen(dev->name) + 1;
-                               if (len > _IOC_SIZE(cmd)) len = _IOC_SIZE(cmd);
-                               if (copy_to_user(argp, dev->name, len)) return -EFAULT;
-                               return len;
-                       }
+
+               len = min_t(size_t, _IOC_SIZE(cmd), strlen(name) + 1);
+               return copy_to_user(argp, name, len) ? -EFAULT : len;
        }
+
        return -EINVAL;
 }
 
 #ifdef CONFIG_COMPAT
-static long joydev_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+static long joydev_compat_ioctl(struct file *file,
+                               unsigned int cmd, unsigned long arg)
 {
-       struct joydev_list *list = file->private_data;
-       struct joydev *joydev = list->joydev;
+       struct joydev_client *client = file->private_data;
+       struct joydev *joydev = client->joydev;
        void __user *argp = (void __user *)arg;
        s32 tmp32;
        struct JS_DATA_SAVE_TYPE_32 ds32;
-       int err;
+       int retval;
+
+       retval = mutex_lock_interruptible(&joydev->mutex);
+       if (retval)
+               return retval;
+
+       if (!joydev->exist) {
+               retval = -ENODEV;
+               goto out;
+       }
+
+       switch (cmd) {
 
-       if (!joydev->exist) return -ENODEV;
-       switch(cmd) {
        case JS_SET_TIMELIMIT:
-               err = get_user(tmp32, (s32 __user *) arg);
-               if (err == 0)
+               retval = get_user(tmp32, (s32 __user *) arg);
+               if (retval == 0)
                        joydev->glue.JS_TIMELIMIT = tmp32;
                break;
+
        case JS_GET_TIMELIMIT:
                tmp32 = joydev->glue.JS_TIMELIMIT;
-               err = put_user(tmp32, (s32 __user *) arg);
+               retval = put_user(tmp32, (s32 __user *) arg);
                break;
 
        case JS_SET_ALL:
-               err = copy_from_user(&ds32, argp,
-                                    sizeof(ds32)) ? -EFAULT : 0;
-               if (err == 0) {
+               retval = copy_from_user(&ds32, argp,
+                                       sizeof(ds32)) ? -EFAULT : 0;
+               if (retval == 0) {
                        joydev->glue.JS_TIMEOUT    = ds32.JS_TIMEOUT;
                        joydev->glue.BUSY          = ds32.BUSY;
                        joydev->glue.JS_EXPIRETIME = ds32.JS_EXPIRETIME;
@@ -395,80 +662,153 @@ static long joydev_compat_ioctl(struct file *file, unsigned int cmd, unsigned lo
                ds32.JS_SAVE       = joydev->glue.JS_SAVE;
                ds32.JS_CORR       = joydev->glue.JS_CORR;
 
-               err = copy_to_user(argp, &ds32,
-                                         sizeof(ds32)) ? -EFAULT : 0;
+               retval = copy_to_user(argp, &ds32, sizeof(ds32)) ? -EFAULT : 0;
                break;
 
        default:
-               err = joydev_ioctl_common(joydev, cmd, argp);
+               retval = joydev_ioctl_common(joydev, cmd, argp);
+               break;
        }
-       return err;
+
+ out:
+       mutex_unlock(&joydev->mutex);
+       return retval;
 }
 #endif /* CONFIG_COMPAT */
 
-static int joydev_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
+static long joydev_ioctl(struct file *file,
+                        unsigned int cmd, unsigned long arg)
 {
-       struct joydev_list *list = file->private_data;
-       struct joydev *joydev = list->joydev;
+       struct joydev_client *client = file->private_data;
+       struct joydev *joydev = client->joydev;
        void __user *argp = (void __user *)arg;
+       int retval;
+
+       retval = mutex_lock_interruptible(&joydev->mutex);
+       if (retval)
+               return retval;
+
+       if (!joydev->exist) {
+               retval = -ENODEV;
+               goto out;
+       }
+
+       switch (cmd) {
+
+       case JS_SET_TIMELIMIT:
+               retval = get_user(joydev->glue.JS_TIMELIMIT,
+                                 (long __user *) arg);
+               break;
+
+       case JS_GET_TIMELIMIT:
+               retval = put_user(joydev->glue.JS_TIMELIMIT,
+                                 (long __user *) arg);
+               break;
+
+       case JS_SET_ALL:
+               retval = copy_from_user(&joydev->glue, argp,
+                                       sizeof(joydev->glue)) ? -EFAULT: 0;
+               break;
+
+       case JS_GET_ALL:
+               retval = copy_to_user(argp, &joydev->glue,
+                                     sizeof(joydev->glue)) ? -EFAULT : 0;
+               break;
 
-       if (!joydev->exist) return -ENODEV;
-
-       switch(cmd) {
-               case JS_SET_TIMELIMIT:
-                       return get_user(joydev->glue.JS_TIMELIMIT, (long __user *) arg);
-               case JS_GET_TIMELIMIT:
-                       return put_user(joydev->glue.JS_TIMELIMIT, (long __user *) arg);
-               case JS_SET_ALL:
-                       return copy_from_user(&joydev->glue, argp,
-                                               sizeof(joydev->glue)) ? -EFAULT : 0;
-               case JS_GET_ALL:
-                       return copy_to_user(argp, &joydev->glue,
-                                               sizeof(joydev->glue)) ? -EFAULT : 0;
-               default:
-                       return joydev_ioctl_common(joydev, cmd, argp);
+       default:
+               retval = joydev_ioctl_common(joydev, cmd, argp);
+               break;
        }
+ out:
+       mutex_unlock(&joydev->mutex);
+       return retval;
 }
 
-static struct file_operations joydev_fops = {
-       .owner =        THIS_MODULE,
-       .read =         joydev_read,
-       .write =        joydev_write,
-       .poll =         joydev_poll,
-       .open =         joydev_open,
-       .release =      joydev_release,
-       .ioctl =        joydev_ioctl,
+static const struct file_operations joydev_fops = {
+       .owner          = THIS_MODULE,
+       .read           = joydev_read,
+       .poll           = joydev_poll,
+       .open           = joydev_open,
+       .release        = joydev_release,
+       .unlocked_ioctl = joydev_ioctl,
 #ifdef CONFIG_COMPAT
-       .compat_ioctl = joydev_compat_ioctl,
+       .compat_ioctl   = joydev_compat_ioctl,
 #endif
-       .fasync =       joydev_fasync,
+       .fasync         = joydev_fasync,
 };
 
-static struct input_handle *joydev_connect(struct input_handler *handler, struct input_dev *dev, struct input_device_id *id)
+static int joydev_install_chrdev(struct joydev *joydev)
+{
+       joydev_table[joydev->minor] = joydev;
+       return 0;
+}
+
+static void joydev_remove_chrdev(struct joydev *joydev)
+{
+       mutex_lock(&joydev_table_mutex);
+       joydev_table[joydev->minor] = NULL;
+       mutex_unlock(&joydev_table_mutex);
+}
+
+/*
+ * Mark device non-existant. This disables writes, ioctls and
+ * prevents new users from opening the device. Already posted
+ * blocking reads will stay, however new ones will fail.
+ */
+static void joydev_mark_dead(struct joydev *joydev)
+{
+       mutex_lock(&joydev->mutex);
+       joydev->exist = 0;
+       mutex_unlock(&joydev->mutex);
+}
+
+static void joydev_cleanup(struct joydev *joydev)
+{
+       struct input_handle *handle = &joydev->handle;
+
+       joydev_mark_dead(joydev);
+       joydev_hangup(joydev);
+       joydev_remove_chrdev(joydev);
+
+       /* joydev is marked dead so noone else accesses joydev->open */
+       if (joydev->open)
+               input_close_device(handle);
+}
+
+static int joydev_connect(struct input_handler *handler, struct input_dev *dev,
+                         const struct input_device_id *id)
 {
        struct joydev *joydev;
-       struct class_device *cdev;
        int i, j, t, minor;
+       int error;
+
+       for (minor = 0; minor < JOYDEV_MINORS; minor++)
+               if (!joydev_table[minor])
+                       break;
 
-       for (minor = 0; minor < JOYDEV_MINORS && joydev_table[minor]; minor++);
        if (minor == JOYDEV_MINORS) {
                printk(KERN_ERR "joydev: no more free joydev devices\n");
-               return NULL;
+               return -ENFILE;
        }
 
-       if (!(joydev = kzalloc(sizeof(struct joydev), GFP_KERNEL)))
-               return NULL;
+       joydev = kzalloc(sizeof(struct joydev), GFP_KERNEL);
+       if (!joydev)
+               return -ENOMEM;
 
-       INIT_LIST_HEAD(&joydev->list);
+       INIT_LIST_HEAD(&joydev->client_list);
+       spin_lock_init(&joydev->client_lock);
+       mutex_init(&joydev->mutex);
        init_waitqueue_head(&joydev->wait);
 
+       dev_set_name(&joydev->dev, "js%d", minor);
+       joydev->exist = 1;
        joydev->minor = minor;
+
        joydev->exist = 1;
-       joydev->handle.dev = dev;
-       joydev->handle.name = joydev->name;
+       joydev->handle.dev = input_get_device(dev);
+       joydev->handle.name = dev_name(&joydev->dev);
        joydev->handle.handler = handler;
        joydev->handle.private = joydev;
-       sprintf(joydev->name, "js%d", minor);
 
        for (i = 0; i < ABS_MAX + 1; i++)
                if (test_bit(i, dev->absbit)) {
@@ -500,92 +840,114 @@ static struct input_handle *joydev_connect(struct input_handler *handler, struct
                }
                joydev->corr[i].type = JS_CORR_BROKEN;
                joydev->corr[i].prec = dev->absfuzz[j];
-               joydev->corr[i].coef[0] = (dev->absmax[j] + dev->absmin[j]) / 2 - dev->absflat[j];
-               joydev->corr[i].coef[1] = (dev->absmax[j] + dev->absmin[j]) / 2 + dev->absflat[j];
-               if (!(t = ((dev->absmax[j] - dev->absmin[j]) / 2 - 2 * dev->absflat[j])))
-                       continue;
-               joydev->corr[i].coef[2] = (1 << 29) / t;
-               joydev->corr[i].coef[3] = (1 << 29) / t;
-
-               joydev->abs[i] = joydev_correct(dev->abs[j], joydev->corr + i);
+               joydev->corr[i].coef[0] =
+                       (dev->absmax[j] + dev->absmin[j]) / 2 - dev->absflat[j];
+               joydev->corr[i].coef[1] =
+                       (dev->absmax[j] + dev->absmin[j]) / 2 + dev->absflat[j];
+
+               t = (dev->absmax[j] - dev->absmin[j]) / 2 - 2 * dev->absflat[j];
+               if (t) {
+                       joydev->corr[i].coef[2] = (1 << 29) / t;
+                       joydev->corr[i].coef[3] = (1 << 29) / t;
+
+                       joydev->abs[i] = joydev_correct(dev->abs[j],
+                                                       joydev->corr + i);
+               }
        }
 
-       joydev_table[minor] = joydev;
+       joydev->dev.devt = MKDEV(INPUT_MAJOR, JOYDEV_MINOR_BASE + minor);
+       joydev->dev.class = &input_class;
+       joydev->dev.parent = &dev->dev;
+       joydev->dev.release = joydev_free;
+       device_initialize(&joydev->dev);
+
+       error = input_register_handle(&joydev->handle);
+       if (error)
+               goto err_free_joydev;
 
-       cdev = class_device_create(&input_class, &dev->cdev,
-                       MKDEV(INPUT_MAJOR, JOYDEV_MINOR_BASE + minor),
-                       dev->cdev.dev, joydev->name);
+       error = joydev_install_chrdev(joydev);
+       if (error)
+               goto err_unregister_handle;
 
-       /* temporary symlink to keep userspace happy */
-       sysfs_create_link(&input_class.subsys.kset.kobj, &cdev->kobj,
-                         joydev->name);
+       error = device_add(&joydev->dev);
+       if (error)
+               goto err_cleanup_joydev;
 
-       return &joydev->handle;
+       return 0;
+
+ err_cleanup_joydev:
+       joydev_cleanup(joydev);
+ err_unregister_handle:
+       input_unregister_handle(&joydev->handle);
+ err_free_joydev:
+       put_device(&joydev->dev);
+       return error;
 }
 
 static void joydev_disconnect(struct input_handle *handle)
 {
        struct joydev *joydev = handle->private;
-       struct joydev_list *list;
-
-       sysfs_remove_link(&input_class.subsys.kset.kobj, joydev->name);
-       class_device_destroy(&input_class, MKDEV(INPUT_MAJOR, JOYDEV_MINOR_BASE + joydev->minor));
-       joydev->exist = 0;
 
-       if (joydev->open) {
-               input_close_device(handle);
-               wake_up_interruptible(&joydev->wait);
-               list_for_each_entry(list, &joydev->list, node)
-                       kill_fasync(&list->fasync, SIGIO, POLL_HUP);
-       } else
-               joydev_free(joydev);
+       device_del(&joydev->dev);
+       joydev_cleanup(joydev);
+       input_unregister_handle(handle);
+       put_device(&joydev->dev);
 }
 
-static struct input_device_id joydev_blacklist[] = {
+static const struct input_device_id joydev_blacklist[] = {
+       {
+               .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                               INPUT_DEVICE_ID_MATCH_KEYBIT,
+               .evbit = { BIT_MASK(EV_KEY) },
+               .keybit = { [BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH) },
+       },      /* Avoid itouchpads and touchscreens */
        {
-               .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_KEYBIT,
-               .evbit = { BIT(EV_KEY) },
-               .keybit = { [LONG(BTN_TOUCH)] = BIT(BTN_TOUCH) },
-       },      /* Avoid itouchpads, touchscreens and tablets */
-       { },    /* Terminating entry */
+               .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                               INPUT_DEVICE_ID_MATCH_KEYBIT,
+               .evbit = { BIT_MASK(EV_KEY) },
+               .keybit = { [BIT_WORD(BTN_DIGI)] = BIT_MASK(BTN_DIGI) },
+       },      /* Avoid tablets, digitisers and similar devices */
+       { }     /* Terminating entry */
 };
 
-static struct input_device_id joydev_ids[] = {
+static const struct input_device_id joydev_ids[] = {
        {
-               .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_ABSBIT,
-               .evbit = { BIT(EV_ABS) },
-               .absbit = { BIT(ABS_X) },
+               .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                               INPUT_DEVICE_ID_MATCH_ABSBIT,
+               .evbit = { BIT_MASK(EV_ABS) },
+               .absbit = { BIT_MASK(ABS_X) },
        },
        {
-               .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_ABSBIT,
-               .evbit = { BIT(EV_ABS) },
-               .absbit = { BIT(ABS_WHEEL) },
+               .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                               INPUT_DEVICE_ID_MATCH_ABSBIT,
+               .evbit = { BIT_MASK(EV_ABS) },
+               .absbit = { BIT_MASK(ABS_WHEEL) },
        },
        {
-               .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_ABSBIT,
-               .evbit = { BIT(EV_ABS) },
-               .absbit = { BIT(ABS_THROTTLE) },
+               .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                               INPUT_DEVICE_ID_MATCH_ABSBIT,
+               .evbit = { BIT_MASK(EV_ABS) },
+               .absbit = { BIT_MASK(ABS_THROTTLE) },
        },
-       { },    /* Terminating entry */
+       { }     /* Terminating entry */
 };
 
 MODULE_DEVICE_TABLE(input, joydev_ids);
 
 static struct input_handler joydev_handler = {
-       .event =        joydev_event,
-       .connect =      joydev_connect,
-       .disconnect =   joydev_disconnect,
-       .fops =         &joydev_fops,
-       .minor =        JOYDEV_MINOR_BASE,
-       .name =         "joydev",
-       .id_table =     joydev_ids,
-       .blacklist =    joydev_blacklist,
+       .event          = joydev_event,
+       .connect        = joydev_connect,
+       .disconnect     = joydev_disconnect,
+       .fops           = &joydev_fops,
+       .minor          = JOYDEV_MINOR_BASE,
+       .name           = "joydev",
+       .id_table       = joydev_ids,
+       .blacklist      = joydev_blacklist,
 };
 
 static int __init joydev_init(void)
 {
-       input_register_handler(&joydev_handler);
-       return 0;
+       return input_register_handler(&joydev_handler);
 }
 
 static void __exit joydev_exit(void)