Changeset 9058

Timestamp:

02/15/08 00:52:51 (5 years ago)

Author:

BrainSlayer

Message:

update

Location:

src/linux/ar531x/linux-2.6.23

Files:

• .config_generic (modified) (1 diff)
• Makefile (modified) (1 diff)
• arch/i386/kernel/apm.c (modified) (2 diffs)
• arch/ia64/kernel/unaligned.c (modified) (1 diff)
• arch/mips/Makefile (modified) (1 diff)
• arch/mips/atheros/board.c (modified) (4 diffs)
• arch/mips/boot/Makefile (modified) (2 diffs)
• arch/sparc64/kernel/chmc.c (modified) (4 diffs)
• arch/sparc64/kernel/entry.S (modified) (1 diff)
• arch/sparc64/kernel/pci.c (modified) (1 diff)
• arch/sparc64/kernel/smp.c (modified) (5 diffs)
• arch/sparc64/mm/init.c (modified) (4 diffs)
• drivers/acpi/blacklist.c (modified) (4 diffs)
• drivers/acpi/bus.c (modified) (3 diffs)
• drivers/acpi/dispatcher/dsobject.c (modified) (3 diffs)
• drivers/acpi/events/evregion.c (modified) (4 diffs)
• drivers/acpi/osl.c (modified) (7 diffs)
• drivers/acpi/pci_irq.c (modified) (1 diff)
• drivers/acpi/video.c (modified) (2 diffs)
• drivers/ata/libata-core.c (modified) (6 diffs)
• drivers/ata/sata_promise.c (modified) (5 diffs)
• drivers/atm/nicstar.c (modified) (3 diffs)
• drivers/char/apm-emulation.c (modified) (3 diffs)
• drivers/char/drm/drm_vm.c (modified) (2 diffs)
• drivers/char/mspec.c (modified) (1 diff)
• drivers/char/tty_ioctl.c (modified) (1 diff)
• drivers/char/watchdog/ar2315_wdt.c (modified) (1 diff)
• drivers/connector/cn_queue.c (modified) (1 diff)
• drivers/crypto/padlock-aes.c (modified) (3 diffs)
• drivers/firmware/dmi-id.c (modified) (1 diff)
• drivers/input/evdev.c (modified) (26 diffs)
• drivers/input/input.c (modified) (19 diffs)
• drivers/input/joydev.c (modified) (26 diffs)
• drivers/input/mousedev.c (modified) (32 diffs)
• drivers/input/tsdev.c (modified) (23 diffs)
• drivers/isdn/capi/capidrv.c (modified) (1 diff)
• drivers/md/dm-crypt.c (modified) (5 diffs)
• drivers/md/dm-ioctl.c (modified) (2 diffs)
• drivers/md/dm-table.c (modified) (2 diffs)
• drivers/md/dm.c (modified) (5 diffs)
• drivers/md/dm.h (modified) (1 diff)
• drivers/md/raid5.c (modified) (2 diffs)
• drivers/misc/thinkpad_acpi.c (modified) (1 diff)
• drivers/mtd/redboot.c (modified) (1 diff)
• drivers/pci/hotplug/fakephp.c (modified) (9 diffs)
• drivers/pci/quirks.c (modified) (1 diff)
• drivers/spi/omap2_mcspi.c (modified) (6 diffs)
• drivers/usb/serial/sierra.c (modified) (4 diffs)
• fs/cifs/inode.c (modified) (1 diff)
• fs/exec.c (modified) (1 diff)
• fs/ncpfs/mmap.c (modified) (1 diff)
• fs/nfsd/nfs3xdr.c (modified) (1 diff)
• fs/nfsd/nfsxdr.c (modified) (1 diff)
• fs/splice.c (modified) (2 diffs)
• include/asm-m68k/Kbuild (modified) (1 diff)
• include/asm-powerpc/systbl.h (modified) (1 diff)
• include/asm-sparc64/dma-mapping.h (modified) (4 diffs)
• include/asm-sparc64/hypervisor.h (modified) (1 diff)
• include/asm-sparc64/pci.h (modified) (1 diff)
• include/linux/acpi.h (modified) (3 diffs)
• include/linux/dmi.h (modified) (2 diffs)
• include/linux/freezer.h (modified) (3 diffs)
• include/linux/input.h (modified) (8 diffs)
• include/linux/pci_ids.h (modified) (1 diff)
• include/linux/pm.h (modified) (1 diff)
• include/linux/pm_legacy.h (modified) (2 diffs)
• include/linux/quicklist.h (modified) (1 diff)
• kernel/kmod.c (modified) (2 diffs)
• kernel/power/main.c (modified) (1 diff)
• kernel/power/pm.c (modified) (2 diffs)
• kernel/relay.c (modified) (1 diff)
• kernel/time/tick-broadcast.c (modified) (4 diffs)
• mm/mmap.c (modified) (4 diffs)
• mm/quicklist.c (modified) (1 diff)
• mm/truncate.c (modified) (1 diff)
• net/8021q/vlan.c (modified) (1 diff)
• net/atm/mpc.c (modified) (1 diff)
• net/ax25/ax25_in.c (modified) (1 diff)
• net/bridge/br_netfilter.c (modified) (5 diffs)
• net/ipv4/devinet.c (modified) (1 diff)
• net/ipv4/ip_gre.c (modified) (1 diff)
• net/ipv4/raw.c (modified) (2 diffs)
• net/ipv4/route.c (modified) (2 diffs)
• net/irda/af_irda.c (modified) (1 diff)
• net/key/af_key.c (modified) (1 diff)
• net/netrom/nr_dev.c (modified) (1 diff)
• net/x25/x25_forward.c (modified) (1 diff)
• net/xfrm/xfrm_policy.c (modified) (3 diffs)
• sound/oss/via82cxxx_audio.c (modified) (2 diffs)
• sound/usb/usx2y/usX2Yhwdep.c (modified) (1 diff)
• sound/usb/usx2y/usx2yhwdeppcm.c (modified) (1 diff)

src/linux/ar531x/linux-2.6.23/.config_generic

@@ -170 +170 @@
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
-# CONFIG_PRINTK is not set
+# CONFIG_PRINTK=y
 # CONFIG_BUG is not set
 # CONFIG_ELF_CORE is not set

src/linux/ar531x/linux-2.6.23/Makefile

@@ -2 +2 @@
 PATCHLEVEL = 6
 SUBLEVEL = 23
-EXTRAVERSION = .14
+EXTRAVERSION = .15
 NAME = Arr Matey! A Hairy Bilge Rat!
 

src/linux/ar531x/linux-2.6.23/arch/i386/kernel/apm.c

@@ -2257 +2257 @@
                 return -ENODEV;
         }
-        if (PM_IS_ACTIVE()) {
+        if (pm_flags & PM_ACPI) {
                 printk(KERN_NOTICE "apm: overridden by ACPI.\n");
                 apm_info.disabled = 1;
                 return -ENODEV;
         }
-#ifdef CONFIG_PM_LEGACY
-        pm_active = 1;
-#endif
+        pm_flags |= PM_APM;
 
         /*
@@ -2367 +2365 @@
                 kapmd_task = NULL;
         }
-#ifdef CONFIG_PM_LEGACY
-        pm_active = 0;
-#endif
+        pm_flags &= ~PM_APM;
 }
 

src/linux/ar531x/linux-2.6.23/arch/ia64/kernel/unaligned.c

@@ -1488 +1488 @@
               case LDFCCLR_OP:
               case LDFCNC_OP:
+                if (u.insn.x)
+                        ret = emulate_load_floatpair(ifa, u.insn, regs);
+                else
+                        ret = emulate_load_float(ifa, u.insn, regs);
+                break;
+
               case LDF_IMM_OP:
               case LDFA_IMM_OP:
               case LDFCCLR_IMM_OP:
               case LDFCNC_IMM_OP:
-                if (u.insn.x)
-                        ret = emulate_load_floatpair(ifa, u.insn, regs);
-                else
-                        ret = emulate_load_float(ifa, u.insn, regs);
+                ret = emulate_load_float(ifa, u.insn, regs);
                 break;
 

src/linux/ar531x/linux-2.6.23/arch/mips/Makefile

@@ -650 +650 @@
         +@$(call makeboot,$@)
 
+zImage: $(vmlinux-32)
+        +@$(call makeboot,zImage)
+
+
 CLEAN_FILES += vmlinux.ecoff \
                vmlinux.srec

src/linux/ar531x/linux-2.6.23/arch/mips/atheros/board.c

@@ -121 +121 @@
 
         radio_config = board_config + 0x100 + ((rcfg - bcfg) & 0xfff);
+        printk("Found board config at 0x%x\n",bcfg);
         printk("Radio config found at offset 0x%x(0x%x)\n", rcfg - bcfg, radio_config - board_config);
         rcfg_size = BOARD_CONFIG_BUFSZ - ((rcfg - bcfg) & (BOARD_CONFIG_BUFSZ - 1));
@@ -147 +148 @@
 void __init plat_mem_setup(void)
 {
+printk(KERN_EMERG "mem setup\n");
+
         DO_AR5312(ar5312_plat_setup();)
         DO_AR5315(ar5315_plat_setup();)
@@ -258 +261 @@
         clear_c0_status(ST0_IM);
         mips_cpu_irq_init();
-
         /* Initialize interrupt controllers */
         DO_AR5312(ar5312_misc_intr_init(AR531X_MISC_IRQ_BASE);)
@@ -264 +266 @@
 
         /* Default "spurious interrupt" handlers */
-        setup_irq(AR531X_IRQ_NONE, &spurious_irq);
-        setup_irq(AR531X_MISC_IRQ_NONE, &spurious_misc);
+//      setup_irq(AR531X_IRQ_NONE, &spurious_irq);
+//      setup_irq(AR531X_MISC_IRQ_NONE, &spurious_misc);
 
 }

src/linux/ar531x/linux-2.6.23/arch/mips/boot/Makefile

@@ -11 +11 @@
 # Some DECstations need all possible sections of an ECOFF executable
 #
+USE_STANDARD_AS_RULE := true
+
+OBJCOPYFLAGS := -O binary -R .note -R .comment -S
+
+SYSTEM = $(VMLINUX)
+
+
+export SYSTEM ZTEXTADDR ZBSSADDR ZRELADDR 
+
+
 ifdef CONFIG_MACH_DECSTATION
   E2EFLAGS = -a
@@ -40 +50 @@
         $(OBJCOPY) -S -O srec $(strip-flags) $(VMLINUX) $(obj)/vmlinux.srec
 
+zImage: $(obj)/compressed/vmlinuz
+        $(OBJCOPY) $(strip-flags) $< $@
+
+$(obj)/compressed/vmlinuz: $(VMLINUX)
+        $(Q)$(MAKE) $(build)=$(obj)/compressed vmlinuz
+
 $(obj)/addinitrd: $(obj)/addinitrd.c
         $(HOSTCC) -o $@ $^

src/linux/ar531x/linux-2.6.23/arch/sparc64/kernel/chmc.c

@@ -1 @@
-/* $Id: chmc.c,v 1.4 2002/01/08 16:00:14 davem Exp $
- * memctrlr.c: Driver for UltraSPARC-III memory controller.
+/* memctrlr.c: Driver for UltraSPARC-III memory controller.
  *
- * Copyright (C) 2001 David S. Miller (davem@redhat.com)
+ * Copyright (C) 2001, 2007 David S. Miller (davem@davemloft.net)
  */
 
@@ -17 +16 @@
 #include <asm/spitfire.h>
 #include <asm/chmctrl.h>
+#include <asm/cpudata.h>
 #include <asm/oplib.h>
 #include <asm/prom.h>
@@ -243 +243 @@
 static u64 read_mcreg(struct mctrl_info *mp, unsigned long offset)
 {
-        unsigned long ret;
-        int this_cpu = get_cpu();
+        unsigned long ret, this_cpu;
+
+        preempt_disable();
+
+        this_cpu = real_hard_smp_processor_id();
 
         if (mp->portid == this_cpu) {
@@ -256 +259 @@
                                        "i" (ASI_PHYS_BYPASS_EC_E));
         }
-        put_cpu();
+
+        preempt_enable();
 
         return ret;

src/linux/ar531x/linux-2.6.23/arch/sparc64/kernel/entry.S

@@ -2594 +2594 @@
          nop
         .size   sun4v_mmustat_info, .-sun4v_mmustat_info
+
+        .globl  sun4v_mmu_demap_all
+        .type   sun4v_mmu_demap_all,#function
+sun4v_mmu_demap_all:
+        clr     %o0
+        clr     %o1
+        mov     HV_MMU_ALL, %o2
+        mov     HV_FAST_MMU_DEMAP_ALL, %o5
+        ta      HV_FAST_TRAP
+        retl
+         nop
+        .size   sun4v_mmu_demap_all, .-sun4v_mmu_demap_all

src/linux/ar531x/linux-2.6.23/arch/sparc64/kernel/pci.c

@@ -1277 +1277 @@
 }
 
+void pci_resource_to_user(const struct pci_dev *pdev, int bar,
+                          const struct resource *rp, resource_size_t *start,
+                          resource_size_t *end)
+{
+        struct pci_pbm_info *pbm = pdev->dev.archdata.host_controller;
+        unsigned long offset;
+
+        if (rp->flags & IORESOURCE_IO)
+                offset = pbm->io_space.start;
+        else
+                offset = pbm->mem_space.start;
+
+        *start = rp->start - offset;
+        *end = rp->end - offset;
+}
+
 #endif /* !(CONFIG_PCI) */

src/linux/ar531x/linux-2.6.23/arch/sparc64/kernel/smp.c

@@ -477 +477 @@
 static void cheetah_xcall_deliver(u64 data0, u64 data1, u64 data2, cpumask_t mask)
 {
-        u64 pstate, ver;
+        u64 pstate, ver, busy_mask;
         int nack_busy_id, is_jbus, need_more;
 
@@ -509 +509 @@
 
         nack_busy_id = 0;
+        busy_mask = 0;
         {
                 int i;
@@ -515 +516 @@
                         u64 target = (i << 14) | 0x70;
 
-                        if (!is_jbus)
+                        if (is_jbus) {
+                                busy_mask |= (0x1UL << (i * 2));
+                        } else {
                                 target |= (nack_busy_id << 24);
+                                busy_mask |= (0x1UL <<
+                                              (nack_busy_id * 2));
+                        }
                         __asm__ __volatile__(
                                 "stxa   %%g0, [%0] %1\n\t"
@@ -532 +538 @@
         /* Now, poll for completion. */
         {
-                u64 dispatch_stat;
+                u64 dispatch_stat, nack_mask;
                 long stuck;
 
                 stuck = 100000 * nack_busy_id;
+                nack_mask = busy_mask << 1;
                 do {
                         __asm__ __volatile__("ldxa      [%%g0] %1, %0"
                                              : "=r" (dispatch_stat)
                                              : "i" (ASI_INTR_DISPATCH_STAT));
-                        if (dispatch_stat == 0UL) {
+                        if (!(dispatch_stat & (busy_mask | nack_mask))) {
                                 __asm__ __volatile__("wrpr %0, 0x0, %%pstate"
                                                      : : "r" (pstate));
@@ -557 +564 @@
                         if (!--stuck)
                                 break;
-                } while (dispatch_stat & 0x5555555555555555UL);
+                } while (dispatch_stat & busy_mask);
 
                 __asm__ __volatile__("wrpr %0, 0x0, %%pstate"
                                      : : "r" (pstate));
 
-                if ((dispatch_stat & ~(0x5555555555555555UL)) == 0) {
+                if (dispatch_stat & busy_mask) {
                         /* Busy bits will not clear, continue instead
                          * of freezing up on this cpu.

src/linux/ar531x/linux-2.6.23/arch/sparc64/mm/init.c

@@ -1136 +1136 @@
 }
 
-static void __init kernel_physical_mapping_init(void)
+static void __init init_kpte_bitmap(void)
 {
         unsigned long i;
-#ifdef CONFIG_DEBUG_PAGEALLOC
-        unsigned long mem_alloced = 0UL;
-#endif
-
-        read_obp_memory("reg", &pall[0], &pall_ents);
 
         for (i = 0; i < pall_ents; i++) {
@@ -1152 +1147 @@
 
                 mark_kpte_bitmap(phys_start, phys_end);
-
+        }
+}
+
+static void __init kernel_physical_mapping_init(void)
+{
 #ifdef CONFIG_DEBUG_PAGEALLOC
+        unsigned long i, mem_alloced = 0UL;
+
+        for (i = 0; i < pall_ents; i++) {
+                unsigned long phys_start, phys_end;
+
+                phys_start = pall[i].phys_addr;
+                phys_end = phys_start + pall[i].reg_size;
+
                 mem_alloced += kernel_map_range(phys_start, phys_end,
                                                 PAGE_KERNEL);
-#endif
-        }
-
-#ifdef CONFIG_DEBUG_PAGEALLOC
+        }
+
         printk("Allocated %ld bytes for kernel page tables.\n",
                mem_alloced);
@@ -1401 +1406 @@
         inherit_prom_mappings();
         
+        read_obp_memory("reg", &pall[0], &pall_ents);
+
+        init_kpte_bitmap();
+
         /* Ok, we can use our TLB miss and window trap handlers safely.  */
         setup_tba();
@@ -1855 +1864 @@
                              : "=r" (pstate)
                              : "i" (PSTATE_IE));
-        if (tlb_type == spitfire) {
+        if (tlb_type == hypervisor) {
+                sun4v_mmu_demap_all();
+        } else if (tlb_type == spitfire) {
                 for (i = 0; i < 64; i++) {
                         /* Spitfire Errata #32 workaround */

src/linux/ar531x/linux-2.6.23/drivers/acpi/blacklist.c

@@ -4 +4 @@
  *  Check to see if the given machine has a known bad ACPI BIOS
  *  or if the BIOS is too old.
+ *  Check given machine against acpi_osi_dmi_table[].
  *
  *  Copyright (C) 2004 Len Brown <len.brown@intel.com>
@@ -50 +51 @@
         u32 is_critical_error;
 };
+
+static struct dmi_system_id acpi_osi_dmi_table[] __initdata;
 
 /*
@@ -68 +71 @@
         {"IBM   ", "TP600E  ", 0x00000105, ACPI_SIG_DSDT, less_than_or_equal,
          "Incorrect _ADR", 1},
-        {"ASUS\0\0", "P2B-S   ", 0, ACPI_SIG_DSDT, all_versions,
-         "Bogus PCI routing", 1},
 
         {""}
@@ -166 +167 @@
         blacklisted += blacklist_by_year();
 
+        dmi_check_system(acpi_osi_dmi_table);
+
         return blacklisted;
 }
+#ifdef CONFIG_DMI
+static int __init dmi_enable_osi_linux(struct dmi_system_id *d)
+{
+        acpi_dmi_osi_linux(1, d);       /* enable */
+        return 0;
+}
+static int __init dmi_disable_osi_linux(struct dmi_system_id *d)
+{
+        acpi_dmi_osi_linux(0, d);       /* disable */
+        return 0;
+}
+static int __init dmi_unknown_osi_linux(struct dmi_system_id *d)
+{
+        acpi_dmi_osi_linux(-1, d);      /* unknown */
+        return 0;
+}
+
+/*
+ * Most BIOS that invoke OSI(Linux) do nothing with it.
+ * But some cause Linux to break.
+ * Only a couple use it to make Linux run better.
+ *
+ * Thus, Linux should continue to disable OSI(Linux) by default,
+ * should continue to discourage BIOS writers from using it, and
+ * should whitelist the few existing systems that require it.
+ *
+ * If it appears clear a vendor isn't using OSI(Linux)
+ * for anything constructive, blacklist them by name to disable
+ * unnecessary dmesg warnings on all of their products.
+ */
+
+static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
+        /*
+         * Disable OSI(Linux) warnings on all "Acer, inc."
+         *
+         * _OSI(Linux) disables the latest Windows BIOS code:
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 3100"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5050"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5100"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5580"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 3010"),
+         * _OSI(Linux) effect unknown:
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Ferrari 5000"),
+         */
+        /*
+         * note that dmi_check_system() uses strstr()
+         * to match sub-strings rather than !strcmp(),
+         * so "Acer" below matches "Acer, inc." above.
+         */
+        /*
+         * Disable OSI(Linux) warnings on all "Acer"
+         *
+         * _OSI(Linux) effect unknown:
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5315"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5610"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7720Z"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 5520"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 6460"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 7510"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Extensa 5220"),
+         */
+        {
+        .callback = dmi_unknown_osi_linux,
+        .ident = "Acer",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                },
+        },
+        /*
+         * Disable OSI(Linux) warnings on all "Apple Computer, Inc."
+         *
+         * _OSI(Linux) confirmed to be a NOP:
+         * DMI_MATCH(DMI_PRODUCT_NAME, "MacBook1,1"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "MacBook2,1"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro2,2"),
+         * _OSI(Linux) effect unknown:
+         * DMI_MATCH(DMI_PRODUCT_NAME, "MacPro2,1"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro1,1"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro3,1"),
+         */
+        {
+        .callback = dmi_disable_osi_linux,
+        .ident = "Apple",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Apple Computer, Inc."),
+                },
+        },
+        /*
+         * Disable OSI(Linux) warnings on all "BenQ"
+         *
+         * _OSI(Linux) confirmed to be a NOP:
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Joybook S31"),
+         */
+        {
+        .callback = dmi_disable_osi_linux,
+        .ident = "BenQ",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "BenQ"),
+                },
+        },
+        /*
+         * Disable OSI(Linux) warnings on all "Clevo Co."
+         *
+         * _OSI(Linux) confirmed to be a NOP:
+         * DMI_MATCH(DMI_PRODUCT_NAME, "M570RU"),
+         */
+        {
+        .callback = dmi_disable_osi_linux,
+        .ident = "Clevo",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Clevo Co."),
+                },
+        },
+        /*
+         * Disable OSI(Linux) warnings on all "COMPAL"
+         *
+         * _OSI(Linux) confirmed to be a NOP:
+         * DMI_MATCH(DMI_BOARD_NAME, "HEL8X"),
+         * _OSI(Linux) unknown effect:
+         * DMI_MATCH(DMI_BOARD_NAME, "IFL91"),
+         */
+        {
+        .callback = dmi_unknown_osi_linux,
+        .ident = "Compal",
+        .matches = {
+                     DMI_MATCH(DMI_BIOS_VENDOR, "COMPAL"),
+                },
+        },
+        { /* OSI(Linux) touches USB, unknown side-effect */
+        .callback = dmi_disable_osi_linux,
+        .ident = "Dell Dimension 5150",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "Dell DM051"),
+                },
+        },
+        { /* OSI(Linux) is a NOP */
+        .callback = dmi_disable_osi_linux,
+        .ident = "Dell",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1501"),
+                },
+        },
+        { /* OSI(Linux) effect unknown */
+        .callback = dmi_unknown_osi_linux,
+        .ident = "Dell",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "Latitude D830"),
+                },
+        },
+        { /* OSI(Linux) effect unknown */
+        .callback = dmi_unknown_osi_linux,
+        .ident = "Dell",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex GX620"),
+                },
+        },
+        { /* OSI(Linux) effect unknown */
+        .callback = dmi_unknown_osi_linux,
+        .ident = "Dell",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge 1900"),
+                },
+        },
+        { /* OSI(Linux) touches USB */
+        .callback = dmi_disable_osi_linux,
+        .ident = "Dell",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "Precision WorkStation 390"),
+                },
+        },
+        { /* OSI(Linux) is a NOP */
+        .callback = dmi_disable_osi_linux,
+        .ident = "Dell Vostro 1000",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "Vostro   1000"),
+                },
+        },
+        { /* OSI(Linux) effect unknown */
+        .callback = dmi_unknown_osi_linux,
+        .ident = "Dell",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge SC440"),
+                },
+        },
+        { /* OSI(Linux) effect unknown */
+        .callback = dmi_unknown_osi_linux,
+        .ident = "Dialogue Flybook V5",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Dialogue Technology Corporation"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "Flybook V5"),
+                },
+        },
+        /*
+         * Disable OSI(Linux) warnings on all "FUJITSU SIEMENS"
+         *
+         * _OSI(Linux) disables latest Windows BIOS code:
+         * DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pa 2510"),
+         * _OSI(Linux) confirmed to be a NOP:
+         * DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pi 1536"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pi 1556"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 1546"),
+         * _OSI(Linux) unknown effect:
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Amilo M1425"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Amilo Si 1520"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "ESPRIMO Mobile V5505"),
+         */
+        {
+        .callback = dmi_disable_osi_linux,
+        .ident = "Fujitsu Siemens",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                },
+        },
+        /*
+         * Disable OSI(Linux) warnings on all "Hewlett-Packard"
+         *
+         * _OSI(Linux) confirmed to be a NOP:
+         * .ident = "HP Pavilion tx 1000"
+         * DMI_MATCH(DMI_BOARD_NAME, "30BF"),
+         * .ident = "HP Pavilion dv2000"
+         * DMI_MATCH(DMI_BOARD_NAME, "30B5"),
+         * .ident = "HP Pavilion dv5000",
+         * DMI_MATCH(DMI_BOARD_NAME, "30A7"),
+         * .ident = "HP Pavilion dv6300 30BC",
+         * DMI_MATCH(DMI_BOARD_NAME, "30BC"),
+         * .ident = "HP Pavilion dv6000",
+         * DMI_MATCH(DMI_BOARD_NAME, "30B7"),
+         * DMI_MATCH(DMI_BOARD_NAME, "30B8"),
+         * .ident = "HP Pavilion dv9000",
+         * DMI_MATCH(DMI_BOARD_NAME, "30B9"),
+         * .ident = "HP Pavilion dv9500",
+         * DMI_MATCH(DMI_BOARD_NAME, "30CB"),
+         * .ident = "HP/Compaq Presario C500",
+         * DMI_MATCH(DMI_BOARD_NAME, "30C6"),
+         * .ident = "HP/Compaq Presario F500",
+         * DMI_MATCH(DMI_BOARD_NAME, "30D3"),
+         * _OSI(Linux) unknown effect:
+         * .ident = "HP Pavilion dv6500",
+         * DMI_MATCH(DMI_BOARD_NAME, "30D0"),
+         */
+        {
+        .callback = dmi_disable_osi_linux,
+        .ident = "Hewlett-Packard",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                },
+        },
+        /*
+         * Lenovo has a mix of systems OSI(Linux) situations
+         * and thus we can not wildcard the vendor.
+         *
+         * _OSI(Linux) helps sound
+         * DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad R61"),
+         * DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T61"),
+         * _OSI(Linux) is a NOP:
+         * DMI_MATCH(DMI_PRODUCT_VERSION, "3000 N100"),
+         */
+        {
+        .callback = dmi_enable_osi_linux,
+        .ident = "Lenovo ThinkPad R61",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad R61"),
+                },
+        },
+        {
+        .callback = dmi_enable_osi_linux,
+        .ident = "Lenovo ThinkPad T61",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T61"),
+                },
+        },
+        {
+        .callback = dmi_unknown_osi_linux,
+        .ident = "Lenovo 3000 V100",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "LENOVO3000 V100"),
+                },
+        },
+        {
+        .callback = dmi_disable_osi_linux,
+        .ident = "Lenovo 3000 N100",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "3000 N100"),
+                },
+        },
+        /*
+         * Disable OSI(Linux) warnings on all "LG Electronics"
+         *
+         * _OSI(Linux) confirmed to be a NOP:
+         * DMI_MATCH(DMI_PRODUCT_NAME, "P1-J150B"),
+         * with DMI_MATCH(DMI_BOARD_NAME, "ROCKY"),
+         *
+         * unknown:
+         * DMI_MATCH(DMI_PRODUCT_NAME, "S1-MDGDG"),
+         * with DMI_MATCH(DMI_BOARD_NAME, "ROCKY"),
+         */
+        {
+        .callback = dmi_disable_osi_linux,
+        .ident = "LG",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"),
+                },
+        },
+        /* NEC - OSI(Linux) effect unknown */
+        {
+        .callback = dmi_unknown_osi_linux,
+        .ident = "NEC VERSA M360",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "NEC Computers SAS"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "NEC VERSA M360"),
+                },
+        },
+        /*
+         * Disable OSI(Linux) warnings on all "Samsung Electronics"
+         *
+         * OSI(Linux) disables PNP0C32 and other BIOS code for Windows:
+         * DMI_MATCH(DMI_PRODUCT_NAME, "R40P/R41P"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "R59P/R60P/R61P"),
+         */
+        {
+        .callback = dmi_disable_osi_linux,
+        .ident = "Samsung",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+                },
+        },
+        /*
+         * Disable OSI(Linux) warnings on all "Sony Corporation"
+         *
+         * _OSI(Linux) is a NOP:
+         * DMI_MATCH(DMI_PRODUCT_NAME, "VGN-SZ650N"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "VGN-SZ38GP_C"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "VGN-TZ21MN_N"),
+         * _OSI(Linux) unknown effect:
+         * DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FZ11M"),
+         */
+        {
+        .callback = dmi_unknown_osi_linux,
+        .ident = "Sony",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                },
+        },
+        /*
+         * Disable OSI(Linux) warnings on all "TOSHIBA"
+         *
+         * _OSI(Linux) breaks sound (bugzilla 7787):
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Satellite P100"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Satellite P105"),
+         * _OSI(Linux) is a NOP:
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Satellite A100"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Satellite A210"),
+         * _OSI(Linux) unknown effect:
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Satellite A135"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Satellite A200"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Satellite P205"),
+         * DMI_MATCH(DMI_PRODUCT_NAME, "Satellite U305"),
+         */
+        {
+        .callback = dmi_disable_osi_linux,
+        .ident = "Toshiba",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                },
+        },
+        {}
+};
+
+#endif /* CONFIG_DMI */

src/linux/ar531x/linux-2.6.23/drivers/acpi/bus.c

@@ -30 +30 @@
 #include <linux/sched.h>
 #include <linux/pm.h>
-#include <linux/pm_legacy.h>
 #include <linux/device.h>
 #include <linux/proc_fs.h>
@@ -758 +757 @@
 
         if (!result) {
-#ifdef CONFIG_PM_LEGACY
-                if (!PM_IS_ACTIVE())
-                        pm_active = 1;
+                if (!(pm_flags & PM_APM))
+                        pm_flags |= PM_ACPI;
                 else {
                         printk(KERN_INFO PREFIX
@@ -767 +765 @@
                         result = -ENODEV;
                 }
-#endif
         } else
                 disable_acpi();

src/linux/ar531x/linux-2.6.23/drivers/acpi/dispatcher/dsobject.c

@@ -138 +138 @@
                         }
                 }
+
+                /* Special object resolution for elements of a package */
+
+                if ((op->common.parent->common.aml_opcode == AML_PACKAGE_OP) ||
+                    (op->common.parent->common.aml_opcode ==
+                     AML_VAR_PACKAGE_OP)) {
+                        /*
+                         * Attempt to resolve the node to a value before we insert it into
+                         * the package. If this is a reference to a common data type,
+                         * resolve it immediately. According to the ACPI spec, package
+                         * elements can only be "data objects" or method references.
+                         * Attempt to resolve to an Integer, Buffer, String or Package.
+                         * If cannot, return the named reference (for things like Devices,
+                         * Methods, etc.) Buffer Fields and Fields will resolve to simple
+                         * objects (int/buf/str/pkg).
+                         *
+                         * NOTE: References to things like Devices, Methods, Mutexes, etc.
+                         * will remain as named references. This behavior is not described
+                         * in the ACPI spec, but it appears to be an oversight.
+                         */
+                        obj_desc = (union acpi_operand_object *)op->common.node;
+
+                        status =
+                            acpi_ex_resolve_node_to_value(ACPI_CAST_INDIRECT_PTR
+                                                          (struct
+                                                           acpi_namespace_node,
+                                                           &obj_desc),
+                                                          walk_state);
+                        if (ACPI_FAILURE(status)) {
+                                return_ACPI_STATUS(status);
+                        }
+
+                        switch (op->common.node->type) {
+                                /*
+                                 * For these types, we need the actual node, not the subobject.
+                                 * However, the subobject got an extra reference count above.
+                                 */
+                        case ACPI_TYPE_MUTEX:
+                        case ACPI_TYPE_METHOD:
+                        case ACPI_TYPE_POWER:
+                        case ACPI_TYPE_PROCESSOR:
+                        case ACPI_TYPE_EVENT:
+                        case ACPI_TYPE_REGION:
+                        case ACPI_TYPE_DEVICE:
+                        case ACPI_TYPE_THERMAL:
+
+                                obj_desc =
+                                    (union acpi_operand_object *)op->common.
+                                    node;
+                                break;
+
+                        default:
+                                break;
+                        }
+
+                        /*
+                         * If above resolved to an operand object, we are done. Otherwise,
+                         * we have a NS node, we must create the package entry as a named
+                         * reference.
+                         */
+                        if (ACPI_GET_DESCRIPTOR_TYPE(obj_desc) !=
+                            ACPI_DESC_TYPE_NAMED) {
+                                goto exit;
+                        }
+                }
         }
 
@@ -157 +222 @@
         }
 
+      exit:
         *obj_desc_ptr = obj_desc;
         return_ACPI_STATUS(AE_OK);
@@ -357 +423 @@
         for (i = 0; arg && (i < element_count); i++) {
                 if (arg->common.aml_opcode == AML_INT_RETURN_VALUE_OP) {
-
-                        /* This package element is already built, just get it */
-
-                        obj_desc->package.elements[i] =
-                            ACPI_CAST_PTR(union acpi_operand_object,
-                                          arg->common.node);
+                        if (arg->common.node->type == ACPI_TYPE_METHOD) {
+                                /*
+                                 * A method reference "looks" to the parser to be a method
+                                 * invocation, so we special case it here
+                                 */
+                                arg->common.aml_opcode = AML_INT_NAMEPATH_OP;
+                                status =
+                                    acpi_ds_build_internal_object(walk_state,
+                                                                  arg,
+                                                                  &obj_desc->
+                                                                  package.
+                                                                  elements[i]);
+                        } else {
+                                /* This package element is already built, just get it */
+
+                                obj_desc->package.elements[i] =
+                                    ACPI_CAST_PTR(union acpi_operand_object,
+                                                  arg->common.node);
+                        }
                 } else {
                         status = acpi_ds_build_internal_object(walk_state, arg,

src/linux/ar531x/linux-2.6.23/drivers/acpi/events/evregion.c

@@ -345 +345 @@
                  * (e.g., _REG method for this region)
                  */
-                acpi_ex_relinquish_interpreter();
+                acpi_ex_exit_interpreter();
 
                 status = region_setup(region_obj, ACPI_REGION_ACTIVATE,
@@ -353 +353 @@
                 /* Re-enter the interpreter */
 
-                acpi_ex_reacquire_interpreter();
+                acpi_ex_enter_interpreter();
 
                 /* Check for failure of the Region Setup */
@@ -406 +406 @@
                  * know what it will do, so we can't hold the lock on the intepreter.
                  */
-                acpi_ex_relinquish_interpreter();
+                acpi_ex_exit_interpreter();
         }
 
@@ -427 +427 @@
                  * interpreter
                  */
-                acpi_ex_reacquire_interpreter();
+                acpi_ex_enter_interpreter();
         }
 

src/linux/ar531x/linux-2.6.23/drivers/acpi/osl.c

@@ -78 +78 @@
 static char osi_additional_string[OSI_STRING_LENGTH_MAX];
 
-static int osi_linux;           /* disable _OSI(Linux) by default */
-
-#ifdef CONFIG_DMI
-static struct __initdata dmi_system_id acpi_osl_dmi_table[];
-#endif
+/*
+ * "Ode to _OSI(Linux)"
+ *
+ * osi_linux -- Control response to BIOS _OSI(Linux) query.
+ *
+ * As Linux evolves, the features that it supports change.
+ * So an OSI string such as "Linux" is not specific enough
+ * to be useful across multiple versions of Linux.  It
+ * doesn't identify any particular feature, interface,
+ * or even any particular version of Linux...
+ *
+ * Unfortunately, Linux-2.6.22 and earlier responded "yes"
+ * to a BIOS _OSI(Linux) query.  When
+ * a reference mobile BIOS started using it, its use
+ * started to spread to many vendor platforms.
+ * As it is not supportable, we need to halt that spread.
+ *
+ * Today, most BIOS references to _OSI(Linux) are noise --
+ * they have no functional effect and are just dead code
+ * carried over from the reference BIOS.
+ *
+ * The next most common case is that _OSI(Linux) harms Linux,
+ * usually by causing the BIOS to follow paths that are
+ * not tested during Windows validation.
+ *
+ * Finally, there is a short list of platforms
+ * where OSI(Linux) benefits Linux.
+ *
+ * In Linux-2.6.23, OSI(Linux) is first disabled by default.
+ * DMI is used to disable the dmesg warning about OSI(Linux)
+ * on platforms where it is known to have no effect.
+ * But a dmesg warning remains for systems where
+ * we do not know if OSI(Linux) is good or bad for the system.
+ * DMI is also used to enable OSI(Linux) for the machines
+ * that are known to need it.
+ *
+ * BIOS writers should NOT query _OSI(Linux) on future systems.
+ * It will be ignored by default, and to get Linux to
+ * not ignore it will require a kernel source update to
+ * add a DMI entry, or a boot-time "acpi_osi=Linux" invocation.
+ */
+#define OSI_LINUX_ENABLE 0
+
+static struct osi_linux {
+        unsigned int    enable:1;
+        unsigned int    dmi:1;
+        unsigned int    cmdline:1;
+        unsigned int    known:1;
+} osi_linux = { OSI_LINUX_ENABLE, 0, 0, 0};
 
 static void __init acpi_request_region (struct acpi_generic_address *addr,
@@ -134 +178 @@
 acpi_status __init acpi_os_initialize(void)
 {
-        dmi_check_system(acpi_osl_dmi_table);
         return AE_OK;
 }
@@ -972 +1015 @@
 __setup("acpi_os_name=", acpi_os_name_setup);
 
-static void enable_osi_linux(int enable) {
-
-        if (osi_linux != enable)
-                printk(KERN_INFO PREFIX "%sabled _OSI(Linux)\n",
-                        enable ? "En": "Dis");
-
-        osi_linux = enable;
+static void __init set_osi_linux(unsigned int enable)
+{
+        if (osi_linux.enable != enable) {
+                osi_linux.enable = enable;
+                printk(KERN_NOTICE PREFIX "%sed _OSI(Linux)\n",
+                        enable ? "Add": "Delet");
+        }
+        return;
+}
+
+static void __init acpi_cmdline_osi_linux(unsigned int enable)
+{
+        osi_linux.cmdline = 1;  /* cmdline set the default */
+        set_osi_linux(enable);
+
+        return;
+}
+
+void __init acpi_dmi_osi_linux(int enable, const struct dmi_system_id *d)
+{
+        osi_linux.dmi = 1;      /* DMI knows that this box asks OSI(Linux) */
+
+        printk(KERN_NOTICE PREFIX "DMI detected: %s\n", d->ident);
+
+        if (enable == -1)
+                return;
+
+        osi_linux.known = 1;    /* DMI knows which OSI(Linux) default needed */
+
+        set_osi_linux(enable);
+
         return;
 }
@@ -995 +1062 @@
                 acpi_gbl_create_osi_method = FALSE;
         } else if (!strcmp("!Linux", str)) {
-                enable_osi_linux(0);
+                acpi_cmdline_osi_linux(0);      /* !enable */
         } else if (*str == '!') {
                 if (acpi_osi_invalidate(++str) == AE_OK)
                         printk(KERN_INFO PREFIX "Deleted _OSI(%s)\n", str);
         } else if (!strcmp("Linux", str)) {
-                enable_osi_linux(1);
+                acpi_cmdline_osi_linux(1);      /* enable */
         } else if (*osi_additional_string == '\0') {
                 strncpy(osi_additional_string, str, OSI_STRING_LENGTH_MAX);
@@ -1157 +1224 @@
 }
 
+/**
+ *      acpi_dmi_dump - dump DMI slots needed for blacklist entry
+ *
+ *      Returns 0 on success
+ */
+static int acpi_dmi_dump(void)
+{
+
+        if (!dmi_available)
+                return -1;
+
+        printk(KERN_NOTICE PREFIX "DMI System Vendor: %s\n",
+                dmi_get_system_info(DMI_SYS_VENDOR));
+        printk(KERN_NOTICE PREFIX "DMI Product Name: %s\n",
+                dmi_get_system_info(DMI_PRODUCT_NAME));
+        printk(KERN_NOTICE PREFIX "DMI Product Version: %s\n",
+                dmi_get_system_info(DMI_PRODUCT_VERSION));
+        printk(KERN_NOTICE PREFIX "DMI Board Name: %s\n",
+                dmi_get_system_info(DMI_BOARD_NAME));
+        printk(KERN_NOTICE PREFIX "DMI BIOS Vendor: %s\n",
+                dmi_get_system_info(DMI_BIOS_VENDOR));
+        printk(KERN_NOTICE PREFIX "DMI BIOS Date: %s\n",
+                dmi_get_system_info(DMI_BIOS_DATE));
+
+        return 0;
+}
+
+
 /******************************************************************************
  *
@@ -1176 +1271 @@
                 return AE_OK;
         if (!strcmp("Linux", interface)) {
-                printk(KERN_WARNING PREFIX
-                        "System BIOS is requesting _OSI(Linux)\n");
-                printk(KERN_WARNING PREFIX
-                        "If \"acpi_osi=Linux\" works better,\n"
-                        "Please send dmidecode "
-                        "to linux-acpi@vger.kernel.org\n");
-                if(osi_linux)
+
+                printk(KERN_NOTICE PREFIX
+                        "BIOS _OSI(Linux) query %s%s\n",
+                        osi_linux.enable ? "honored" : "ignored",
+                        osi_linux.cmdline ? " via cmdline" :
+                        osi_linux.dmi ? " via DMI" : "");
+
+                if (!osi_linux.dmi) {
+                        if (acpi_dmi_dump())
+                                printk(KERN_NOTICE PREFIX
+                                        "[please extract dmidecode output]\n");
+                        printk(KERN_NOTICE PREFIX
+                                "Please send DMI info above to "
+                                "linux-acpi@vger.kernel.org\n");
+                }
+                if (!osi_linux.known && !osi_linux.cmdline) {
+                        printk(KERN_NOTICE PREFIX
+                                "If \"acpi_osi=%sLinux\" works better, "
+                                "please notify linux-acpi@vger.kernel.org\n",
+                                osi_linux.enable ? "!" : "");
+                }
+
+                if (osi_linux.enable)
                         return AE_OK;
         }
@@ -1214 +1325 @@
 }
 
-#ifdef CONFIG_DMI
-static int dmi_osi_linux(struct dmi_system_id *d)
-{
-        printk(KERN_NOTICE "%s detected: enabling _OSI(Linux)\n", d->ident);
-        enable_osi_linux(1);
-        return 0;
-}
-
-static struct dmi_system_id acpi_osl_dmi_table[] __initdata = {
-        /*
-         * Boxes that need _OSI(Linux)
-         */
-        {
-         .callback = dmi_osi_linux,
-         .ident = "Intel Napa CRB",
-         .matches = {
-                     DMI_MATCH(DMI_BOARD_VENDOR, "Intel Corporation"),
-                     DMI_MATCH(DMI_BOARD_NAME, "MPAD-MSAE Customer Reference Boards"),
-                     },
-         },
-        {}
-};
-#endif /* CONFIG_DMI */
-
 #endif

src/linux/ar531x/linux-2.6.23/drivers/acpi/pci_irq.c

@@ -430 +430 @@
                                           acpi_pci_allocate_irq);
 
+        if (irq < 0) {
+                /*
+                 * IDE legacy mode controller IRQs are magic. Why do compat
+                 * extensions always make such a nasty mess.
+                 */
+                if (dev->class >> 8 == PCI_CLASS_STORAGE_IDE &&
+                                (dev->class & 0x05) == 0)
+                        return 0;
+        }
         /*
          * No IRQ known to the ACPI subsystem - maybe the BIOS / 

src/linux/ar531x/linux-2.6.23/drivers/acpi/video.c

@@ -574 +574 @@
 
 
-        memset(&device->cap, 0, 4);
+        memset(&device->cap, 0, sizeof(device->cap));
 
         if (ACPI_SUCCESS(acpi_get_handle(device->dev->handle, "_ADR", &h_dummy1))) {
@@ -694 +694 @@
         acpi_handle h_dummy1;
 
-        memset(&video->cap, 0, 4);
+        memset(&video->cap, 0, sizeof(video->cap));
         if (ACPI_SUCCESS(acpi_get_handle(video->device->handle, "_DOS", &h_dummy1))) {
                 video->cap._DOS = 1;

src/linux/ar531x/linux-2.6.23/drivers/ata/libata-core.c

@@ -6122 +6122 @@
                         continue;
 
-                if ((host->flags & ATA_HOST_STARTED) && ap->ops->port_stop)
-                        ap->ops->port_stop(ap);
-        }
-
-        if ((host->flags & ATA_HOST_STARTED) && host->ops->host_stop)
-                host->ops->host_stop(host);
-
-        for (i = 0; i < host->n_ports; i++) {
-                struct ata_port *ap = host->ports[i];
-
-                if (!ap)
-                        continue;
-
                 if (ap->scsi_host)
                         scsi_host_put(ap->scsi_host);
@@ -6259 +6246 @@
 }
 
+static void ata_host_stop(struct device *gendev, void *res)
+{
+        struct ata_host *host = dev_get_drvdata(gendev);
+        int i;
+
+        WARN_ON(!(host->flags & ATA_HOST_STARTED));
+
+        for (i = 0; i < host->n_ports; i++) {
+                struct ata_port *ap = host->ports[i];
+
+                if (ap->ops->port_stop)
+                        ap->ops->port_stop(ap);
+        }
+
+        if (host->ops->host_stop)
+                host->ops->host_stop(host);
+}
+
 /**
  *      ata_host_start - start and freeze ports of an ATA host
@@ -6277 +6282 @@
 int ata_host_start(struct ata_host *host)
 {
+        int have_stop = 0;
+        void *start_dr = NULL;
         int i, rc;
 
@@ -6287 +6294 @@
                 if (!host->ops && !ata_port_is_dummy(ap))
                         host->ops = ap->ops;
+
+                if (ap->ops->port_stop)
+                        have_stop = 1;
+        }
+
+        if (host->ops->host_stop)
+                have_stop = 1;
+
+        if (have_stop) {
+                start_dr = devres_alloc(ata_host_stop, 0, GFP_KERNEL);
+                if (!start_dr)
+                        return -ENOMEM;
+        }
+
+        for (i = 0; i < host->n_ports; i++) {
+                struct ata_port *ap = host->ports[i];
 
                 if (ap->ops->port_start) {
@@ -6300 +6323 @@
         }
 
+        if (start_dr)
+                devres_add(host->dev, start_dr);
         host->flags |= ATA_HOST_STARTED;
         return 0;
@@ -6310 +6335 @@
                         ap->ops->port_stop(ap);
         }
+        devres_free(start_dr);
         return rc;
 }

src/linux/ar531x/linux-2.6.23/drivers/ata/sata_promise.c

@@ -51 +51 @@
         PDC_MAX_PORTS           = 4,
         PDC_MMIO_BAR            = 3,
+        PDC_MAX_PRD             = LIBATA_MAX_PRD - 1, /* -1 for ASIC PRD bug workaround */
 
         /* register offsets */
@@ -156 +157 @@
         .can_queue              = ATA_DEF_QUEUE,
         .this_id                = ATA_SHT_THIS_ID,
-        .sg_tablesize           = LIBATA_MAX_PRD,
+        .sg_tablesize           = PDC_MAX_PRD,
         .cmd_per_lun            = ATA_SHT_CMD_PER_LUN,
         .emulated               = ATA_SHT_EMULATED,
@@ -528 +529 @@
 }
 
+/**
+ *      pdc_fill_sg - Fill PCI IDE PRD table
+ *      @qc: Metadata associated with taskfile to be transferred
+ *
+ *      Fill PCI IDE PRD (scatter-gather) table with segments
+ *      associated with the current disk command.
+ *      Make sure hardware does not choke on it.
+ *
+ *      LOCKING:
+ *      spin_lock_irqsave(host lock)
+ *
+ */
+static void pdc_fill_sg(struct ata_queued_cmd *qc)
+{
+        struct ata_port *ap = qc->ap;
+        struct scatterlist *sg;
+        unsigned int idx;
+        const u32 SG_COUNT_ASIC_BUG = 41*4;
+
+        if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+                return;
+
+        WARN_ON(qc->__sg == NULL);
+        WARN_ON(qc->n_elem == 0 && qc->pad_len == 0);
+
+        idx = 0;
+        ata_for_each_sg(sg, qc) {
+                u32 addr, offset;
+                u32 sg_len, len;
+
+                /* determine if physical DMA addr spans 64K boundary.
+                 * Note h/w doesn't support 64-bit, so we unconditionally
+                 * truncate dma_addr_t to u32.
+                 */
+                addr = (u32) sg_dma_address(sg);
+                sg_len = sg_dma_len(sg);
+
+                while (sg_len) {
+                        offset = addr & 0xffff;
+                        len = sg_len;
+                        if ((offset + sg_len) > 0x10000)
+                                len = 0x10000 - offset;
+
+                        ap->prd[idx].addr = cpu_to_le32(addr);
+                        ap->prd[idx].flags_len = cpu_to_le32(len & 0xffff);
+                        VPRINTK("PRD[%u] = (0x%X, 0x%X)\n", idx, addr, len);
+
+                        idx++;
+                        sg_len -= len;
+                        addr += len;
+                }
+        }
+
+        if (idx) {
+                u32 len = le32_to_cpu(ap->prd[idx - 1].flags_len);
+
+                if (len > SG_COUNT_ASIC_BUG) {
+                        u32 addr;
+
+                        VPRINTK("Splitting last PRD.\n");
+
+                        addr = le32_to_cpu(ap->prd[idx - 1].addr);
+                        ap->prd[idx - 1].flags_len = cpu_to_le32(len - SG_COUNT_ASIC_BUG);
+                        VPRINTK("PRD[%u] = (0x%X, 0x%X)\n", idx - 1, addr, SG_COUNT_ASIC_BUG);
+
+                        addr = addr + len - SG_COUNT_ASIC_BUG;
+                        len = SG_COUNT_ASIC_BUG;
+                        ap->prd[idx].addr = cpu_to_le32(addr);
+                        ap->prd[idx].flags_len = cpu_to_le32(len);
+                        VPRINTK("PRD[%u] = (0x%X, 0x%X)\n", idx, addr, len);
+
+                        idx++;
+                }
+
+                ap->prd[idx - 1].flags_len |= cpu_to_le32(ATA_PRD_EOT);
+        }
+}
+
 static void pdc_qc_prep(struct ata_queued_cmd *qc)
 {
@@ -537 +616 @@
         switch (qc->tf.protocol) {
         case ATA_PROT_DMA:
-                ata_qc_prep(qc);
+                pdc_fill_sg(qc);
                 /* fall through */
 
@@ -553 +632 @@
 
         case ATA_PROT_ATAPI:
-                ata_qc_prep(qc);
+                pdc_fill_sg(qc);
                 break;
 
         case ATA_PROT_ATAPI_DMA:
-                ata_qc_prep(qc);
+                pdc_fill_sg(qc);
                 /*FALLTHROUGH*/
         case ATA_PROT_ATAPI_NODATA:

src/linux/ar531x/linux-2.6.23/drivers/atm/nicstar.c

@@ -626 +626 @@
       nicstar_init_eprom(card->membase);
 
-   if (request_irq(pcidev->irq, &ns_irq_handler, IRQF_DISABLED | IRQF_SHARED, "nicstar", card) != 0)
-   {
-      printk("nicstar%d: can't allocate IRQ %d.\n", i, pcidev->irq);
-      error = 9;
-      ns_init_card_error(card, error);
-      return error;
-   }
-
    /* Set the VPI/VCI MSb mask to zero so we can receive OAM cells */
    writel(0x00000000, card->membase + VPM);
@@ -859 +851 @@
    }
 
-   card->intcnt = 0;
-
    /* Configure NICStAR */
    if (card->rct_size == 4096)
@@ -868 +858 @@
 
    card->efbie = 1;
+
+   card->intcnt = 0;
+   if (request_irq(pcidev->irq, &ns_irq_handler, IRQF_DISABLED | IRQF_SHARED, "nicstar", card) != 0)
+   {
+      printk("nicstar%d: can't allocate IRQ %d.\n", i, pcidev->irq);
+      error = 9;
+      ns_init_card_error(card, error);
+      return error;
+   }
 
    /* Register device */

src/linux/ar531x/linux-2.6.23/drivers/char/apm-emulation.c

@@ -296 +296 @@
 {
         struct apm_user *as = filp->private_data;
-        unsigned long flags;
         int err = -EINVAL;
 
@@ -332 +331 @@
                          * are pending acknowledges, we wait here for them.
                          */
-                        flags = current->flags;
+                        freezer_do_not_count();
 
                         wait_event(apm_suspend_waitqueue,
                                    as->suspend_state == SUSPEND_DONE);
+
+                        /*
+                         * Since we are waiting until the suspend is done, the
+                         * try_to_freeze() in freezer_count() will not trigger
+                         */
+                        freezer_count();
                 } else {
                         as->suspend_state = SUSPEND_WAIT;
@@ -363 +368 @@
                          * are pending acknowledges, we wait here for them.
                          */
-                        flags = current->flags;
-
-                        wait_event_interruptible(apm_suspend_waitqueue,
+                        wait_event_freezable(apm_suspend_waitqueue,
                                          as->suspend_state == SUSPEND_DONE);
                 }
-
-                current->flags = flags;
 
                 mutex_lock(&state_lock);

src/linux/ar531x/linux-2.6.23/drivers/char/drm/drm_vm.c

@@ -507 +507 @@
 
         vma->vm_flags |= VM_RESERVED;   /* Don't swap */
+        vma->vm_flags |= VM_DONTEXPAND;
 
         vma->vm_file = filp;    /* Needed for drm_vm_open() */
@@ -656 +657 @@
         }
         vma->vm_flags |= VM_RESERVED;   /* Don't swap */
+        vma->vm_flags |= VM_DONTEXPAND;
 
         vma->vm_file = filp;    /* Needed for drm_vm_open() */

src/linux/ar531x/linux-2.6.23/drivers/char/mspec.c

@@ -284 +284 @@
         vma->vm_private_data = vdata;
 
-        vma->vm_flags |= (VM_IO | VM_RESERVED | VM_PFNMAP);
+        vma->vm_flags |= (VM_IO | VM_RESERVED | VM_PFNMAP | VM_DONTEXPAND);
         if (vdata->type == MSPEC_FETCHOP || vdata->type == MSPEC_UNCACHED)
                 vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);

src/linux/ar531x/linux-2.6.23/drivers/char/tty_ioctl.c

@@ -63 +63 @@
                 timeout = MAX_SCHEDULE_TIMEOUT;
         if (wait_event_interruptible_timeout(tty->write_wait,
-                        !tty->driver->chars_in_buffer(tty), timeout))
+                        !tty->driver->chars_in_buffer(tty), timeout) < 0)
                 return;
         if (tty->driver->wait_until_sent)

src/linux/ar531x/linux-2.6.23/drivers/char/watchdog/ar2315_wdt.c

@@ -79 +79 @@
 extern const char *get_arch_type (void);
 
-static int ar2315_wdt_print_info(void)
+static void ar2315_wdt_print_info(void)
 {
         printk("watchdog hb: %d", heartbeat);

src/linux/ar531x/linux-2.6.23/drivers/connector/cn_queue.c

@@ -100 +100 @@
 
         if (found) {
+                cn_queue_free_callback(cbq);
                 atomic_dec(&dev->refcnt);
-                cn_queue_free_callback(cbq);
                 return -EINVAL;
         }

src/linux/ar531x/linux-2.6.23/drivers/crypto/padlock-aes.c

@@ -420 +420 @@
 
 /* These are the real call to PadLock. */
+static inline void padlock_xcrypt(const u8 *input, u8 *output, void *key,
+                                  void *control_word)
+{
+        asm volatile (".byte 0xf3,0x0f,0xa7,0xc8"       /* rep xcryptecb */
+                      : "+S"(input), "+D"(output)
+                      : "d"(control_word), "b"(key), "c"(1));
+}
+
+static void aes_crypt_copy(const u8 *in, u8 *out, u32 *key, struct cword *cword)
+{
+        u8 buf[AES_BLOCK_SIZE * 2 + PADLOCK_ALIGNMENT - 1];
+        u8 *tmp = PTR_ALIGN(&buf[0], PADLOCK_ALIGNMENT);
+
+        memcpy(tmp, in, AES_BLOCK_SIZE);
+        padlock_xcrypt(tmp, out, key, cword);
+}
+
+static inline void aes_crypt(const u8 *in, u8 *out, u32 *key,
+                             struct cword *cword)
+{
+        asm volatile ("pushfl; popfl");
+
+        /* padlock_xcrypt requires at least two blocks of data. */
+        if (unlikely(!(((unsigned long)in ^ (PAGE_SIZE - AES_BLOCK_SIZE)) &
+                       (PAGE_SIZE - 1)))) {
+                aes_crypt_copy(in, out, key, cword);
+                return;
+        }
+
+        padlock_xcrypt(in, out, key, cword);
+}
+
 static inline void padlock_xcrypt_ecb(const u8 *input, u8 *output, void *key,
                                       void *control_word, u32 count)
 {
+        if (count == 1) {
+                aes_crypt(input, output, key, control_word);
+                return;
+        }
+
         asm volatile ("pushfl; popfl");         /* enforce key reload. */
-        asm volatile (".byte 0xf3,0x0f,0xa7,0xc8"       /* rep xcryptecb */
+        asm volatile ("test $1, %%cl;"
+                      "je 1f;"
+                      "lea -1(%%ecx), %%eax;"
+                      "mov $1, %%ecx;"
+                      ".byte 0xf3,0x0f,0xa7,0xc8;"      /* rep xcryptecb */
+                      "mov %%eax, %%ecx;"
+                      "1:"
+                      ".byte 0xf3,0x0f,0xa7,0xc8"       /* rep xcryptecb */
                       : "+S"(input), "+D"(output)
-                      : "d"(control_word), "b"(key), "c"(count));
+                      : "d"(control_word), "b"(key), "c"(count)
+                      : "ax");
 }
 
@@ -444 +489 @@
 {
         struct aes_ctx *ctx = aes_ctx(tfm);
-        padlock_xcrypt_ecb(in, out, ctx->E, &ctx->cword.encrypt, 1);
+        aes_crypt(in, out, ctx->E, &ctx->cword.encrypt);
 }
 
@@ -450 +495 @@
 {
         struct aes_ctx *ctx = aes_ctx(tfm);
-        padlock_xcrypt_ecb(in, out, ctx->D, &ctx->cword.decrypt, 1);
+        aes_crypt(in, out, ctx->D, &ctx->cword.decrypt);
 }
 

src/linux/ar531x/linux-2.6.23/drivers/firmware/dmi-id.c

@@ -159 +159 @@
         if (dmi_get_system_info(_field)) \
                 sys_dmi_attributes[i++] = & sys_dmi_##_name##_attr.attr;
-
-extern int dmi_available;
 
 static int __init dmi_id_init(void)

src/linux/ar531x/linux-2.6.23/drivers/input/evdev.c

@@ -31 +31 @@
         struct evdev_client *grab;
         struct list_head client_list;
+        spinlock_t client_lock; /* protects client_list */
+        struct mutex mutex;
         struct device dev;
 };
@@ -38 +40 @@
         int head;
         int tail;
+        spinlock_t buffer_lock; /* protects access to buffer, head and tail */
         struct fasync_struct *fasync;
         struct evdev *evdev;
@@ -44 +47 @@
 
 static struct evdev *evdev_table[EVDEV_MINORS];
-
-static void evdev_event(struct input_handle *handle, unsigned int type, unsigned int code, int value)
+static DEFINE_MUTEX(evdev_table_mutex);
+
+static void evdev_pass_event(struct evdev_client *client,
+                             struct input_event *event)
+{
+        /*
+         * Interrupts are disabled, just acquire the lock
+         */
+        spin_lock(&client->buffer_lock);
+        client->buffer[client->head++] = *event;
+        client->head &= EVDEV_BUFFER_SIZE - 1;
+        spin_unlock(&client->buffer_lock);
+
+        kill_fasync(&client->fasync, SIGIO, POLL_IN);
+}
+
+/*
+ * Pass incoming event to all connected clients. Note that we are
+ * caleld under a spinlock with interrupts off so we don't need
+ * to use rcu_read_lock() here. Writers will be using syncronize_sched()
+ * instead of synchrnoize_rcu().
+ */
+static void evdev_event(struct input_handle *handle,
+                        unsigned int type, unsigned int code, int value)
 {
         struct evdev *evdev = handle->private;
         struct evdev_client *client;
-
-        if (evdev->grab) {
-                client = evdev->grab;
-
-                do_gettimeofday(&client->buffer[client->head].time);
-                client->buffer[client->head].type = type;
-                client->buffer[client->head].code = code;
-                client->buffer[client->head].value = value;
-                client->head = (client->head + 1) & (EVDEV_BUFFER_SIZE - 1);
-
-                kill_fasync(&client->fasync, SIGIO, POLL_IN);
-        } else
-                list_for_each_entry(client, &evdev->client_list, node) {
-
-                        do_gettimeofday(&client->buffer[client->head].time);
-                        client->buffer[client->head].type = type;
-                        client->buffer[client->head].code = code;
-                        client->buffer[client->head].value = value;
-                        client->head = (client->head + 1) & (EVDEV_BUFFER_SIZE - 1);
-
-                        kill_fasync(&client->fasync, SIGIO, POLL_IN);
-                }
+        struct input_event event;
+
+        do_gettimeofday(&event.time);
+        event.type = type;
+        event.code = code;
+        event.value = value;
+
+        client = rcu_dereference(evdev->grab);
+        if (client)
+                evdev_pass_event(client, &event);
+        else
+                list_for_each_entry_rcu(client, &evdev->client_list, node)
+                        evdev_pass_event(client, &event);
 
         wake_up_interruptible(&evdev->wait);
@@ -89 +105 @@
         struct evdev_client *client = file->private_data;
         struct evdev *evdev = client->evdev;
+        int retval;
+
+        retval = mutex_lock_interruptible(&evdev->mutex);
+        if (retval)
+                return retval;
 
         if (!evdev->exist)
-                return -ENODEV;
-
-        return input_flush_device(&evdev->handle, file);
+                retval = -ENODEV;
+        else
+                retval = input_flush_device(&evdev->handle, file);
+
+        mutex_unlock(&evdev->mutex);
+        return retval;
 }
 
@@ -100 +124 @@
         struct evdev *evdev = container_of(dev, struct evdev, dev);
 
-        evdev_table[evdev->minor] = NULL;
         kfree(evdev);
+}
+
+/*
+ * Grabs an event device (along with underlying input device).
+ * This function is called with evdev->mutex taken.
+ */
+static int evdev_grab(struct evdev *evdev, struct evdev_client *client)
+{
+        int error;
+
+        if (evdev->grab)
+                return -EBUSY;
+
+        error = input_grab_device(&evdev->handle);
+        if (error)
+                return error;
+
+        rcu_assign_pointer(evdev->grab, client);
+        /*
+         * We don't use synchronize_rcu() here because read-side
+         * critical section is protected by a spinlock instead
+         * of rcu_read_lock().
+         */
+        synchronize_sched();
+
+        return 0;
+}
+
+static int evdev_ungrab(struct evdev *evdev, struct evdev_client *client)
+{
+        if (evdev->grab != client)
+                return  -EINVAL;
+
+        rcu_assign_pointer(evdev->grab, NULL);
+        synchronize_sched();
+        input_release_device(&evdev->handle);
+
+        return 0;
+}
+
+static void evdev_attach_client(struct evdev *evdev,
+                                struct evdev_client *client)
+{
+        spin_lock(&evdev->client_lock);
+        list_add_tail_rcu(&client->node, &evdev->client_list);
+        spin_unlock(&evdev->client_lock);
+        synchronize_sched();
+}
+
+static void evdev_detach_client(struct evdev *evdev,
+                                struct evdev_client *client)
+{
+        spin_lock(&evdev->client_lock);
+        list_del_rcu(&client->node);
+        spin_unlock(&evdev->client_lock);
+        synchronize_sched();
+}
+
+static int evdev_open_device(struct evdev *evdev)
+{
+        int retval;
+
+        retval = mutex_lock_interruptible(&evdev->mutex);
+        if (retval)
+                return retval;
+
+        if (!evdev->exist)
+                retval = -ENODEV;
+        else if (!evdev->open++) {
+                retval = input_open_device(&evdev->handle);
+                if (retval)
+                        evdev->open--;
+        }
+
+        mutex_unlock(&evdev->mutex);
+        return retval;
+}
+
+static void evdev_close_device(struct evdev *evdev)
+{
+        mutex_lock(&evdev->mutex);
+
+        if (evdev->exist && !--evdev->open)
+                input_close_device(&evdev->handle);
+
+        mutex_unlock(&evdev->mutex);
+}
+
+/*
+ * Wake up users waiting for IO so they can disconnect from
+ * dead device.
+ */
+static void evdev_hangup(struct evdev *evdev)
+{
+        struct evdev_client *client;
+
+        spin_lock(&evdev->client_lock);
+        list_for_each_entry(client, &evdev->client_list, node)
+                kill_fasync(&client->fasync, SIGIO, POLL_HUP);
+        spin_unlock(&evdev->client_lock);
+
+        wake_up_interruptible(&evdev->wait);
 }
 
@@ -109 +234 @@
         struct evdev *evdev = client->evdev;
 
-        if (evdev->grab == client) {
-                input_release_device(&evdev->handle);
-                evdev->grab = NULL;
-        }
+        mutex_lock(&evdev->mutex);
+        if (evdev->grab == client)
+                evdev_ungrab(evdev, client);
+        mutex_unlock(&evdev->mutex);
 
         evdev_fasync(-1, file, 0);
-        list_del(&client->node);
+        evdev_detach_client(evdev, client);
         kfree(client);
 
-        if (!--evdev->open && evdev->exist)
-                input_close_device(&evdev->handle);
-
+        evdev_close_device(evdev);
         put_device(&evdev->dev);
 
@@ -128 +251 @@
 static int evdev_open(struct inode *inode, struct file *file)
 {
+        struct evdev *evdev;
         struct evdev_client *client;
-        struct evdev *evdev;
         int i = iminor(inode) - EVDEV_MINOR_BASE;
         int error;
@@ -136 +259 @@
                 return -ENODEV;
 
+        error = mutex_lock_interruptible(&evdev_table_mutex);
+        if (error)
+                return error;
         evdev = evdev_table[i];
-
-        if (!evdev || !evdev->exist)
+        if (evdev)
+                get_device(&evdev->dev);
+        mutex_unlock(&evdev_table_mutex);
+
+        if (!evdev)
                 return -ENODEV;
-
-        get_device(&evdev->dev);
 
         client = kzalloc(sizeof(struct evdev_client), GFP_KERNEL);
@@ -149 +276 @@
         }
 
+        spin_lock_init(&client->buffer_lock);
         client->evdev = evdev;
-        list_add_tail(&client->node, &evdev->client_list);
-
-        if (!evdev->open++ && evdev->exist) {
-                error = input_open_device(&evdev->handle);
-                if (error)
-                        goto err_free_client;
-        }
+        evdev_attach_client(evdev, client);
+
+        error = evdev_open_device(evdev);
+        if (error)
+                goto err_free_client;
 
         file->private_data = client;
@@ -162 +288 @@
 
  err_free_client:
-        list_del(&client->node);
+        evdev_detach_client(evdev, client);
         kfree(client);
  err_put_evdev:
@@ -198 +324 @@
 }
 
-static int evdev_event_from_user(const char __user *buffer, struct input_event *event)
+static int evdev_event_from_user(const char __user *buffer,
+                                 struct input_event *event)
 {
         if (COMPAT_TEST) {
                 struct input_event_compat compat_event;
 
-                if (copy_from_user(&compat_event, buffer, sizeof(struct input_event_compat)))
+                if (copy_from_user(&compat_event, buffer,
+                                   sizeof(struct input_event_compat)))
                         return -EFAULT;
 
@@ -220 +348 @@
 }
 
-static int evdev_event_to_user(char __user *buffer, const struct input_event *event)
+static int evdev_event_to_user(char __user *buffer,
+                                const struct input_event *event)
 {
         if (COMPAT_TEST) {
@@ -231 +360 @@
                 compat_event.value = event->value;
 
-                if (copy_to_user(buffer, &compat_event, sizeof(struct input_event_compat)))
+                if (copy_to_user(buffer, &compat_event,
+                                 sizeof(struct input_event_compat)))
                         return -EFAULT;
 
@@ -249 +379 @@
 }
 
-static int evdev_event_from_user(const char __user *buffer, struct input_event *event)
+static int evdev_event_from_user(const char __user *buffer,
+                                 struct input_event *event)
 {
         if (copy_from_user(event, buffer, sizeof(struct input_event)))
@@ -257 +388 @@
 }
 
-static int evdev_event_to_user(char __user *buffer, const struct input_event *event)
+static int evdev_event_to_user(char __user *buffer,
+                                const struct input_event *event)
 {
         if (copy_to_user(buffer, event, sizeof(struct input_event)))
@@ -267 +399 @@
 #endif /* CONFIG_COMPAT */
 
-static ssize_t evdev_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos)
+static ssize_t evdev_write(struct file *file, const char __user *buffer,
+                           size_t count, loff_t *ppos)
 {
         struct evdev_client *client = file->private_data;
         struct evdev *evdev = client->evdev;
         struct input_event event;
-        int retval = 0;
-
-        if (!evdev->exist)
-                return -ENODEV;
+        int retval;
+
+        retval = mutex_lock_interruptible(&evdev->mutex);
+        if (retval)
+                return retval;
+
+        if (!evdev->exist) {
+                retval = -ENODEV;
+                goto out;
+        }
 
         while (retval < count) {
 
-                if (evdev_event_from_user(buffer + retval, &event))
-                        return -EFAULT;
-                input_inject_event(&evdev->handle, event.type, event.code, event.value);
+                if (evdev_event_from_user(buffer + retval, &event)) {
+                        retval = -EFAULT;
+                        goto out;
+                }
+
+                input_inject_event(&evdev->handle,
+                                   event.type, event.code, event.value);
                 retval += evdev_event_size();
         }
 
+ out:
+        mutex_unlock(&evdev->mutex);
         return retval;
 }
 
-static ssize_t evdev_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
+static int evdev_fetch_next_event(struct evdev_client *client,
+                                  struct input_event *event)
+{
+        int have_event;
+
+        spin_lock_irq(&client->buffer_lock);
+
+        have_event = client->head != client->tail;
+        if (have_event) {
+                *event = client->buffer[client->tail++];
+                client->tail &= EVDEV_BUFFER_SIZE - 1;
+        }
+
+        spin_unlock_irq(&client->buffer_lock);
+
+        return have_event;
+}
+
+static ssize_t evdev_read(struct file *file, char __user *buffer,
+                          size_t count, loff_t *ppos)
 {
         struct evdev_client *client = file->private_data;
         struct evdev *evdev = client->evdev;
+        struct input_event event;
         int retval;
 
@@ -297 +462 @@
                 return -EINVAL;
 
-        if (client->head == client->tail && evdev->exist && (file->f_flags & O_NONBLOCK))
+        if (client->head == client->tail && evdev->exist &&
+            (file->f_flags & O_NONBLOCK))
                 return -EAGAIN;
 
@@ -308 +474 @@
                 return -ENODEV;
 
-        while (client->head != client->tail && retval + evdev_event_size() <= count) {
-
-                struct input_event *event = (struct input_event *) client->buffer + client->tail;
-
-                if (evdev_event_to_user(buffer + retval, event))
-                        return -EFAULT;
-
-                client->tail = (client->tail + 1) & (EVDEV_BUFFER_SIZE - 1);
+        while (retval + evdev_event_size() <= count &&
+               evdev_fetch_next_event(client, &event)) {
+
+                if (evdev_event_to_user(buffer + retval, &event))
+                        return -EFAULT;
+
                 retval += evdev_event_size();
         }
@@ -410 +574 @@
 }
 
-static long evdev_ioctl_handler(struct file *file, unsigned int cmd,
-                                void __user *p, int compat_mode)
+static long evdev_do_ioctl(struct file *file, unsigned int cmd,
+                           void __user *p, int compat_mode)
 {
         struct evdev_client *client = file->private_data;
@@ -422 +586 @@
         int error;
 
-        if (!evdev->exist)
-                return -ENODEV;
-
         switch (cmd) {
 
-                case EVIOCGVERSION:
-                        return put_user(EV_VERSION, ip);
-
-                case EVIOCGID:
-                        if (copy_to_user(p, &dev->id, sizeof(struct input_id)))
-                                return -EFAULT;
-                        return 0;
-
-                case EVIOCGREP:
-                        if (!test_bit(EV_REP, dev->evbit))
-                                return -ENOSYS;
-                        if (put_user(dev->rep[REP_DELAY], ip))
-                                return -EFAULT;
-                        if (put_user(dev->rep[REP_PERIOD], ip + 1))
-                                return -EFAULT;
-                        return 0;
-
-                case EVIOCSREP:
-                        if (!test_bit(EV_REP, dev->evbit))
-                                return -ENOSYS;
-                        if (get_user(u, ip))
-                                return -EFAULT;
-                        if (get_user(v, ip + 1))
-                                return -EFAULT;
-
-                        input_inject_event(&evdev->handle, EV_REP, REP_DELAY, u);
-                        input_inject_event(&evdev->handle, EV_REP, REP_PERIOD, v);
-
-                        return 0;
-
-                case EVIOCGKEYCODE:
-                        if (get_user(t, ip))
-                                return -EFAULT;
-
-                        error = dev->getkeycode(dev, t, &v);
-                        if (error)
-                                return error;
-
-                        if (put_user(v, ip + 1))
-                                return -EFAULT;
-
-                        return 0;
-
-                case EVIOCSKEYCODE:
-                        if (get_user(t, ip) || get_user(v, ip + 1))
-                                return -EFAULT;
-
-                        return dev->setkeycode(dev, t, v);
-
-                case EVIOCSFF:
-                        if (copy_from_user(&effect, p, sizeof(effect)))
-                                return -EFAULT;
-
-                        error = input_ff_upload(dev, &effect, file);
-
-                        if (put_user(effect.id, &(((struct ff_effect __user *)p)->id)))
-                                return -EFAULT;
-
+        case EVIOCGVERSION:
+                return put_user(EV_VERSION, ip);
+
+        case EVIOCGID:
+                if (copy_to_user(p, &dev->id, sizeof(struct input_id)))
+                        return -EFAULT;
+                return 0;
+
+        case EVIOCGREP:
+                if (!test_bit(EV_REP, dev->evbit))
+                        return -ENOSYS;
+                if (put_user(dev->rep[REP_DELAY], ip))
+                        return -EFAULT;
+                if (put_user(dev->rep[REP_PERIOD], ip + 1))
+                        return -EFAULT;
+                return 0;
+
+        case EVIOCSREP:
+                if (!test_bit(EV_REP, dev->evbit))
+                        return -ENOSYS;
+                if (get_user(u, ip))
+                        return -EFAULT;
+                if (get_user(v, ip + 1))
+                        return -EFAULT;
+
+                input_inject_event(&evdev->handle, EV_REP, REP_DELAY, u);
+                input_inject_event(&evdev->handle, EV_REP, REP_PERIOD, v);
+
+                return 0;
+
+        case EVIOCGKEYCODE:
+                if (get_user(t, ip))
+                        return -EFAULT;
+
+                error = dev->getkeycode(dev, t, &v);
+                if (error)
                         return error;
 
-                case EVIOCRMFF:
-                        return input_ff_erase(dev, (int)(unsigned long) p, file);
-
-                case EVIOCGEFFECTS:
-                        i = test_bit(EV_FF, dev->evbit) ? dev->ff->max_effects : 0;
-                        if (put_user(i, ip))
-                                return -EFAULT;
-                        return 0;
-
-                case EVIOCGRAB:
-                        if (p) {
-                                if (evdev->grab)
-                                        return -EBUSY;
-                                if (input_grab_device(&evdev->handle))
-                                        return -EBUSY;
-                                evdev->grab = client;
-                                return 0;
-                        } else {
-                                if (evdev->grab != client)
-                                        return -EINVAL;
-                                input_release_device(&evdev->handle);
-                                evdev->grab = NULL;
+                if (put_user(v, ip + 1))
+                        return -EFAULT;
+
+                return 0;
+
+        case EVIOCSKEYCODE:
+                if (get_user(t, ip) || get_user(v, ip + 1))
+                        return -EFAULT;
+
+                return dev->setkeycode(dev, t, v);
+
+        case EVIOCSFF:
+                if (copy_from_user(&effect, p, sizeof(effect)))
+                        return -EFAULT;
+
+                error = input_ff_upload(dev, &effect, file);
+
+                if (put_user(effect.id, &(((struct ff_effect __user *)p)->id)))
+                        return -EFAULT;
+
+                return error;
+
+        case EVIOCRMFF:
+                return input_ff_erase(dev, (int)(unsigned long) p, file);
+
+        case EVIOCGEFFECTS:
+                i = test_bit(EV_FF, dev->evbit) ?
+                                dev->ff->max_effects : 0;
+                if (put_user(i, ip))
+                        return -EFAULT;
+                return 0;
+
+        case EVIOCGRAB:
+                if (p)
+                        return evdev_grab(evdev, client);
+                else
+                        return evdev_ungrab(evdev, client);
+
+        default:
+
+                if (_IOC_TYPE(cmd) != 'E')
+                        return -EINVAL;
+
+                if (_IOC_DIR(cmd) == _IOC_READ) {
+
+                        if ((_IOC_NR(cmd) & ~EV_MAX) == _IOC_NR(EVIOCGBIT(0, 0))) {
+
+                                unsigned long *bits;
+                                int len;
+
+                                switch (_IOC_NR(cmd) & EV_MAX) {
+
+                                case      0: bits = dev->evbit;  len = EV_MAX;  break;
+                                case EV_KEY: bits = dev->keybit; len = KEY_MAX; break;
+                                case EV_REL: bits = dev->relbit; len = REL_MAX; break;
+                                case EV_ABS: bits = dev->absbit; len = ABS_MAX; break;
+                                case EV_MSC: bits = dev->mscbit; len = MSC_MAX; break;
+                                case EV_LED: bits = dev->ledbit; len = LED_MAX; break;
+                                case EV_SND: bits = dev->sndbit; len = SND_MAX; break;
+                                case EV_FF:  bits = dev->ffbit;  len = FF_MAX;  break;
+                                case EV_SW:  bits = dev->swbit;  len = SW_MAX;  break;
+                                default: return -EINVAL;
+                        }
+                                return bits_to_user(bits, len, _IOC_SIZE(cmd), p, compat_mode);
+                        }
+
+                        if (_IOC_NR(cmd) == _IOC_NR(EVIOCGKEY(0)))
+                                return bits_to_user(dev->key, KEY_MAX, _IOC_SIZE(cmd),
+                                                    p, compat_mode);
+
+                        if (_IOC_NR(cmd) == _IOC_NR(EVIOCGLED(0)))
+                                return bits_to_user(dev->led, LED_MAX, _IOC_SIZE(cmd),
+                                                    p, compat_mode);
+
+                        if (_IOC_NR(cmd) == _IOC_NR(EVIOCGSND(0)))
+                                return bits_to_user(dev->snd, SND_MAX, _IOC_SIZE(cmd),
+                                                    p, compat_mode);
+
+                        if (_IOC_NR(cmd) == _IOC_NR(EVIOCGSW(0)))
+                                return bits_to_user(dev->sw, SW_MAX, _IOC_SIZE(cmd),
+                                                    p, compat_mode);
+
+                        if (_IOC_NR(cmd) == _IOC_NR(EVIOCGNAME(0)))
+                                return str_to_user(dev->name, _IOC_SIZE(cmd), p);
+
+                        if (_IOC_NR(cmd) == _IOC_NR(EVIOCGPHYS(0)))
+                                return str_to_user(dev->phys, _IOC_SIZE(cmd), p);
+
+                        if (_IOC_NR(cmd) == _IOC_NR(EVIOCGUNIQ(0)))
+                                return str_to_user(dev->uniq, _IOC_SIZE(cmd), p);
+
+                        if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCGABS(0))) {
+
+                                t = _IOC_NR(cmd) & ABS_MAX;
+
+                                abs.value = dev->abs[t];
+                                abs.minimum = dev->absmin[t];
+                                abs.maximum = dev->absmax[t];
+                                abs.fuzz = dev->absfuzz[t];
+                                abs.flat = dev->absflat[t];
+
+                                if (copy_to_user(p, &abs, sizeof(struct input_absinfo)))
+                                        return -EFAULT;
+
                                 return 0;
                         }
 
-                default:
-
-                        if (_IOC_TYPE(cmd) != 'E')
-                                return -EINVAL;
-
-                        if (_IOC_DIR(cmd) == _IOC_READ) {
-
-                                if ((_IOC_NR(cmd) & ~EV_MAX) == _IOC_NR(EVIOCGBIT(0,0))) {
-
-                                        unsigned long *bits;
-                                        int len;
-
-                                        switch (_IOC_NR(cmd) & EV_MAX) {
-                                                case      0: bits = dev->evbit;  len = EV_MAX;  break;
-                                                case EV_KEY: bits = dev->keybit; len = KEY_MAX; break;
-                                                case EV_REL: bits = dev->relbit; len = REL_MAX; break;
-                                                case EV_ABS: bits = dev->absbit; len = ABS_MAX; break;
-                                                case EV_MSC: bits = dev->mscbit; len = MSC_MAX; break;
-                                                case EV_LED: bits = dev->ledbit; len = LED_MAX; break;
-                                                case EV_SND: bits = dev->sndbit; len = SND_MAX; break;
-                                                case EV_FF:  bits = dev->ffbit;  len = FF_MAX;  break;
-                                                case EV_SW:  bits = dev->swbit;  len = SW_MAX;  break;
-                                                default: return -EINVAL;
-                                        }
-                                        return bits_to_user(bits, len, _IOC_SIZE(cmd), p, compat_mode);
-                                }
-
-                                if (_IOC_NR(cmd) == _IOC_NR(EVIOCGKEY(0)))
-                                        return bits_to_user(dev->key, KEY_MAX, _IOC_SIZE(cmd),
-                                                            p, compat_mode);
-
-                                if (_IOC_NR(cmd) == _IOC_NR(EVIOCGLED(0)))
-                                        return bits_to_user(dev->led, LED_MAX, _IOC_SIZE(cmd),
-                                                            p, compat_mode);
-
-                                if (_IOC_NR(cmd) == _IOC_NR(EVIOCGSND(0)))
-                                        return bits_to_user(dev->snd, SND_MAX, _IOC_SIZE(cmd),
-                                                            p, compat_mode);
-
-                                if (_IOC_NR(cmd) == _IOC_NR(EVIOCGSW(0)))
-                                        return bits_to_user(dev->sw, SW_MAX, _IOC_SIZE(cmd),
-                                                            p, compat_mode);
-
-                                if (_IOC_NR(cmd) == _IOC_NR(EVIOCGNAME(0)))
-                                        return str_to_user(dev->name, _IOC_SIZE(cmd), p);
-
-                                if (_IOC_NR(cmd) == _IOC_NR(EVIOCGPHYS(0)))
-                                        return str_to_user(dev->phys, _IOC_SIZE(cmd), p);
-
-                                if (_IOC_NR(cmd) == _IOC_NR(EVIOCGUNIQ(0)))
-                                        return str_to_user(dev->uniq, _IOC_SIZE(cmd), p);
-
-                                if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCGABS(0))) {
-
-                                        t = _IOC_NR(cmd) & ABS_MAX;
-
-                                        abs.value = dev->abs[t];
-                                        abs.minimum = dev->absmin[t];
-                                        abs.maximum = dev->absmax[t];
-                                        abs.fuzz = dev->absfuzz[t];
-                                        abs.flat = dev->absflat[t];
-
-                                        if (copy_to_user(p, &abs, sizeof(struct input_absinfo)))
-                                                return -EFAULT;
-
-                                        return 0;
-                                }
-
+                }
+
+                if (_IOC_DIR(cmd) == _IOC_WRITE) {
+
+                        if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCSABS(0))) {
+
+                                t = _IOC_NR(cmd) & ABS_MAX;
+
+                                if (copy_from_user(&abs, p,
+                                                sizeof(struct input_absinfo)))
+                                        return -EFAULT;
+
+                                /*
+                                 * Take event lock to ensure that we are not
+                                 * changing device parameters in the middle
+                                 * of event.
+                                 */
+                                spin_lock_irq(&dev->event_lock);
+
+                                dev->abs[t] = abs.value;
+                                dev->absmin[t] = abs.minimum;
+                                dev->absmax[t] = abs.maximum;
+                                dev->absfuzz[t] = abs.fuzz;
+                                dev->absflat[t] = abs.flat;
+
+                                spin_unlock_irq(&dev->event_lock);
+
+                                return 0;
                         }
-
-                        if (_IOC_DIR(cmd) == _IOC_WRITE) {
-
-                                if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCSABS(0))) {
-
-                                        t = _IOC_NR(cmd) & ABS_MAX;
-
-                                        if (copy_from_user(&abs, p, sizeof(struct input_absinfo)))
-                                                return -EFAULT;
-
-                                        dev->abs[t] = abs.value;
-                                        dev->absmin[t] = abs.minimum;
-                                        dev->absmax[t] = abs.maximum;
-                                        dev->absfuzz[t] = abs.fuzz;
-                                        dev->absflat[t] = abs.flat;
-
-                                        return 0;
-                                }
-                        }
+                }
         }
         return -EINVAL;
 }
 
+static long evdev_ioctl_handler(struct file *file, unsigned int cmd,
+                                void __user *p, int compat_mode)
+{
+        struct evdev_client *client = file->private_data;
+        struct evdev *evdev = client->evdev;
+        int retval;
+
+        retval = mutex_lock_interruptible(&evdev->mutex);
+        if (retval)
+                return retval;
+
+        if (!evdev->exist) {
+                retval = -ENODEV;
+                goto out;
+        }
+
+        retval = evdev_do_ioctl(file, cmd, p, compat_mode);
+
+ out:
+        mutex_unlock(&evdev->mutex);
+        return retval;
+}
+
 static long evdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
@@ -610 +796 @@
 
 #ifdef CONFIG_COMPAT
-static long evdev_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg)
+static long evdev_ioctl_compat(struct file *file,
+                                unsigned int cmd, unsigned long arg)
 {
         return evdev_ioctl_handler(file, cmd, compat_ptr(arg), 1);
@@ -617 +804 @@
 
 static const struct file_operations evdev_fops = {
-        .owner =        THIS_MODULE,
-        .read =         evdev_read,
-        .write =        evdev_write,
-        .poll =         evdev_poll,
-        .open =         evdev_open,
-        .release =      evdev_release,
-        .unlocked_ioctl = evdev_ioctl,
+        .owner          = THIS_MODULE,
+        .read           = evdev_read,
+        .write          = evdev_write,
+        .poll           = evdev_poll,
+        .open           = evdev_open,
+        .release        = evdev_release,
+        .unlocked_ioctl = evdev_ioctl,
 #ifdef CONFIG_COMPAT
-        .compat_ioctl = evdev_ioctl_compat,
+        .compat_ioctl   = evdev_ioctl_compat,
 #endif
-        .fasync =       evdev_fasync,
-        .flush =        evdev_flush
+        .fasync         = evdev_fasync,
+        .flush          = evdev_flush
 };
 
+static int evdev_install_chrdev(struct evdev *evdev)
+{
+        /*
+         * No need to do any locking here as calls to connect and
+         * disconnect are serialized by the input core
+         */
+        evdev_table[evdev->minor] = evdev;
+        return 0;
+}
+
+static void evdev_remove_chrdev(struct evdev *evdev)
+{
+        /*
+         * Lock evdev table to prevent race with evdev_open()
+         */
+        mutex_lock(&evdev_table_mutex);
+        evdev_table[evdev->minor] = NULL;
+        mutex_unlock(&evdev_table_mutex);
+}
+
+/*
+ * Mark device non-existent. This disables writes, ioctls and
+ * prevents new users from opening the device. Already posted
+ * blocking reads will stay, however new ones will fail.
+ */
+static void evdev_mark_dead(struct evdev *evdev)
+{
+        mutex_lock(&evdev->mutex);
+        evdev->exist = 0;
+        mutex_unlock(&evdev->mutex);
+}
+
+static void evdev_cleanup(struct evdev *evdev)
+{
+        struct input_handle *handle = &evdev->handle;
+
+        evdev_mark_dead(evdev);
+        evdev_hangup(evdev);
+        evdev_remove_chrdev(evdev);
+
+        /* evdev is marked dead so no one else accesses evdev->open */
+        if (evdev->open) {
+                input_flush_device(handle, NULL);
+                input_close_device(handle);
+        }
+}
+
+/*
+ * Create new evdev device. Note that input core serializes calls
+ * to connect and disconnect so we don't need to lock evdev_table here.
+ */
 static int evdev_connect(struct input_handler *handler, struct input_dev *dev,
                          const struct input_device_id *id)
@@ -638 +876 @@
         int error;
 
-        for (minor = 0; minor < EVDEV_MINORS && evdev_table[minor]; minor++);
+        for (minor = 0; minor < EVDEV_MINORS; minor++)
+                if (!evdev_table[minor])
+                        break;
+
         if (minor == EVDEV_MINORS) {
                 printk(KERN_ERR "evdev: no more free evdev devices\n");
@@ -649 +890 @@
 
         INIT_LIST_HEAD(&evdev->client_list);
+        spin_lock_init(&evdev->client_lock);
+        mutex_init(&evdev->mutex);
         init_waitqueue_head(&evdev->wait);
 
+        snprintf(evdev->name, sizeof(evdev->name), "event%d", minor);
         evdev->exist = 1;
         evdev->minor = minor;
+
         evdev->handle.dev = dev;
         evdev->handle.name = evdev->name;
         evdev->handle.handler = handler;
         evdev->handle.private = evdev;
-        snprintf(evdev->name, sizeof(evdev->name), "event%d", minor);
-
-        snprintf(evdev->dev.bus_id, sizeof(evdev->dev.bus_id),
-                 "event%d", minor);
+
+        strlcpy(evdev->dev.bus_id, evdev->name, sizeof(evdev->dev.bus_id));
+        evdev->dev.devt = MKDEV(INPUT_MAJOR, EVDEV_MINOR_BASE + minor);
         evdev->dev.class = &input_class;
         evdev->dev.parent = &dev->dev;
-        evdev->dev.devt = MKDEV(INPUT_MAJOR, EVDEV_MINOR_BASE + minor);
         evdev->dev.release = evdev_free;
         device_initialize(&evdev->dev);
 
-        evdev_table[minor] = evdev;
+        error = input_register_handle(&evdev->handle);
+        if (error)
+                goto err_free_evdev;
+
+        error = evdev_install_chrdev(evdev);
+        if (error)
+                goto err_unregister_handle;
 
         error = device_add(&evdev->dev);
         if (error)
-                goto err_free_evdev;
-
-        error = input_register_handle(&evdev->handle);
-        if (error)
-                goto err_delete_evdev;
+                goto err_cleanup_evdev;
 
         return 0;
 
- err_delete_evdev:
-        device_del(&evdev->dev);
+ err_cleanup_evdev:
+        evdev_cleanup(evdev);
+ err_unregister_handle:
+        input_unregister_handle(&evdev->handle);
  err_free_evdev:
         put_device(&evdev->dev);
@@ -689 +936 @@
 {
         struct evdev *evdev = handle->private;
-        struct evdev_client *client;
-
+
+        device_del(&evdev->dev);
+        evdev_cleanup(evdev);
         input_unregister_handle(handle);
-        device_del(&evdev->dev);
-
-        evdev->exist = 0;
-
-        if (evdev->open) {
-                input_flush_device(handle, NULL);
-                input_close_device(handle);
-                list_for_each_entry(client, &evdev->client_list, node)
-                        kill_fasync(&client->fasync, SIGIO, POLL_HUP);
-                wake_up_interruptible(&evdev->wait);
-        }
-
         put_device(&evdev->dev);
 }
@@ -715 +951 @@
 
 static struct input_handler evdev_handler = {
-        .event =        evdev_event,
-        .connect =      evdev_connect,
-        .disconnect =   evdev_disconnect,
-        .fops =         &evdev_fops,
-        .minor =        EVDEV_MINOR_BASE,
-        .name =         "evdev",
-        .id_table =     evdev_ids,
+        .event          = evdev_event,
+        .connect        = evdev_connect,
+        .disconnect     = evdev_disconnect,
+        .fops           = &evdev_fops,
+        .minor          = EVDEV_MINOR_BASE,
+        .name           = "evdev",
+        .id_table       = evdev_ids,
 };
 

src/linux/ar531x/linux-2.6.23/drivers/input/input.c

@@ -18 +18 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
-#include <linux/interrupt.h>
 #include <linux/poll.h>
 #include <linux/device.h>
 #include <linux/mutex.h>
+#include <linux/rcupdate.h>
 
 MODULE_AUTHOR("Vojtech Pavlik <vojtech@suse.cz>");
@@ -32 +32 @@
 static LIST_HEAD(input_handler_list);
 
+/*
+ * input_mutex protects access to both input_dev_list and input_handler_list.
+ * This also causes input_[un]register_device and input_[un]register_handler
+ * be mutually exclusive which simplifies locking in drivers implementing
+ * input handlers.
+ */
+static DEFINE_MUTEX(input_mutex);
+
 static struct input_handler *input_table[8];
+
+static inline int is_event_supported(unsigned int code,
+                                     unsigned long *bm, unsigned int max)
+{
+        return code <= max && test_bit(code, bm);
+}
+
+static int input_defuzz_abs_event(int value, int old_val, int fuzz)
+{
+        if (fuzz) {
+                if (value > old_val - fuzz / 2 && value < old_val + fuzz / 2)
+                        return old_val;
+
+                if (value > old_val - fuzz && value < old_val + fuzz)
+                        return (old_val * 3 + value) / 4;
+
+                if (value > old_val - fuzz * 2 && value < old_val + fuzz * 2)
+                        return (old_val + value) / 2;
+        }
+
+        return value;
+}
+
+/*
+ * Pass event through all open handles. This function is called with
+ * dev->event_lock held and interrupts disabled. Because of that we
+ * do not need to use rcu_read_lock() here although we are using RCU
+ * to access handle list. Note that because of that write-side uses
+ * synchronize_sched() instead of synchronize_ru().
+ */
+static void input_pass_event(struct input_dev *dev,
+                             unsigned int type, unsigned int code, int value)
+{
+        struct input_handle *handle = rcu_dereference(dev->grab);
+
+        if (handle)
+                handle->handler->event(handle, type, code, value);
+        else
+                list_for_each_entry_rcu(handle, &dev->h_list, d_node)
+                        if (handle->open)
+                                handle->handler->event(handle,
+                                                        type, code, value);
+}
+
+/*
+ * Generate software autorepeat event. Note that we take
+ * dev->event_lock here to avoid racing with input_event
+ * which may cause keys get "stuck".
+ */
+static void input_repeat_key(unsigned long data)
+{
+        struct input_dev *dev = (void *) data;
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev->event_lock, flags);
+
+        if (test_bit(dev->repeat_key, dev->key) &&
+            is_event_supported(dev->repeat_key, dev->keybit, KEY_MAX)) {
+
+                input_pass_event(dev, EV_KEY, dev->repeat_key, 2);
+
+                if (dev->sync) {
+                        /*
+                         * Only send SYN_REPORT if we are not in a middle
+                         * of driver parsing a new hardware packet.
+                         * Otherwise assume that the driver will send
+                         * SYN_REPORT once it's done.
+                         */
+                        input_pass_event(dev, EV_SYN, SYN_REPORT, 1);
+                }
+
+                if (dev->rep[REP_PERIOD])
+                        mod_timer(&dev->timer, jiffies +
+                                        msecs_to_jiffies(dev->rep[REP_PERIOD]));
+        }
+
+        spin_unlock_irqrestore(&dev->event_lock, flags);
+}
+
+static void input_start_autorepeat(struct input_dev *dev, int code)
+{
+        if (test_bit(EV_REP, dev->evbit) &&
+            dev->rep[REP_PERIOD] && dev->rep[REP_DELAY] &&
+            dev->timer.data) {
+                dev->repeat_key = code;
+                mod_timer(&dev->timer,
+                          jiffies + msecs_to_jiffies(dev->rep[REP_DELAY]));
+        }
+}
+
+#define INPUT_IGNORE_EVENT      0
+#define INPUT_PASS_TO_HANDLERS  1
+#define INPUT_PASS_TO_DEVICE    2
+#define INPUT_PASS_TO_ALL       (INPUT_PASS_TO_HANDLERS | INPUT_PASS_TO_DEVICE)
+
+static void input_handle_event(struct input_dev *dev,
+                               unsigned int type, unsigned int code, int value)
+{
+        int disposition = INPUT_IGNORE_EVENT;
+
+        switch (type) {
+
+        case EV_SYN:
+                switch (code) {
+                case SYN_CONFIG:
+                        disposition = INPUT_PASS_TO_ALL;
+                        break;
+
+                case SYN_REPORT:
+                        if (!dev->sync) {
+                                dev->sync = 1;
+                                disposition = INPUT_PASS_TO_HANDLERS;
+                        }
+                        break;
+                }
+                break;
+
+        case EV_KEY:
+                if (is_event_supported(code, dev->keybit, KEY_MAX) &&
+                    !!test_bit(code, dev->key) != value) {
+
+                        if (value != 2) {
+                                __change_bit(code, dev->key);
+                                if (value)
+                                        input_start_autorepeat(dev, code);
+                        }
+
+                        disposition = INPUT_PASS_TO_HANDLERS;
+                }
+                break;
+
+        case EV_SW:
+                if (is_event_supported(code, dev->swbit, SW_MAX) &&
+                    !!test_bit(code, dev->sw) != value) {
+
+                        __change_bit(code, dev->sw);
+                        disposition = INPUT_PASS_TO_HANDLERS;
+                }
+                break;
+
+        case EV_ABS:
+                if (is_event_supported(code, dev->absbit, ABS_MAX)) {
+
+                        value = input_defuzz_abs_event(value,
+                                        dev->abs[code], dev->absfuzz[code]);
+
+                        if (dev->abs[code] != value) {
+                                dev->abs[code] = value;
+                                disposition = INPUT_PASS_TO_HANDLERS;
+                        }
+                }
+                break;
+
+        case EV_REL:
+                if (is_event_supported(code, dev->relbit, REL_MAX) && value)
+                        disposition = INPUT_PASS_TO_HANDLERS;
+
+                break;
+
+        case EV_MSC:
+                if (is_event_supported(code, dev->mscbit, MSC_MAX))
+                        disposition = INPUT_PASS_TO_ALL;
+
+                break;
+
+        case EV_LED:
+                if (is_event_supported(code, dev->ledbit, LED_MAX) &&
+                    !!test_bit(code, dev->led) != value) {
+
+                        __change_bit(code, dev->led);
+                        disposition = INPUT_PASS_TO_ALL;
+                }
+                break;
+
+        case EV_SND:
+                if (is_event_supported(code, dev->sndbit, SND_MAX)) {
+
+                        if (!!test_bit(code, dev->snd) != !!value)
+                                __change_bit(code, dev->snd);
+                        disposition = INPUT_PASS_TO_ALL;
+                }
+                break;
+
+        case EV_REP:
+                if (code <= REP_MAX && value >= 0 && dev->rep[code] != value) {
+                        dev->rep[code] = value;
+                        disposition = INPUT_PASS_TO_ALL;
+                }
+                break;
+
+        case EV_FF:
+                if (value >= 0)
+                        disposition = INPUT_PASS_TO_ALL;
+                break;
+        }
+
+        if (type != EV_SYN)
+                dev->sync = 0;
+
+        if ((disposition & INPUT_PASS_TO_DEVICE) && dev->event)
+                dev->event(dev, type, code, value);
+
+        if (disposition & INPUT_PASS_TO_HANDLERS)
+                input_pass_event(dev, type, code, value);
+}
 
 /**
@@ -41 +254 @@
  * @value: value of the event
  *
- * This function should be used by drivers implementing various input devices
- * See also input_inject_event()
- */
-void input_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
-{
-        struct input_handle *handle;
-
-        if (type > EV_MAX || !test_bit(type, dev->evbit))
-                return;
-
-        add_input_randomness(type, code, value);
-
-        switch (type) {
-
-                case EV_SYN:
-                        switch (code) {
-                                case SYN_CONFIG:
-                                        if (dev->event)
-                                                dev->event(dev, type, code, value);
-                                        break;
-
-                                case SYN_REPORT:
-                                        if (dev->sync)
-                                                return;
-                                        dev->sync = 1;
-                                        break;
-                        }
-                        break;
-
-                case EV_KEY:
-
-                        if (code > KEY_MAX || !test_bit(code, dev->keybit) || !!test_bit(code, dev->key) == value)
-                                return;
-
-                        if (value == 2)
-                                break;
-
-                        change_bit(code, dev->key);
-
-                        if (test_bit(EV_REP, dev->evbit) && dev->rep[REP_PERIOD] && dev->rep[REP_DELAY] && dev->timer.data && value) {
-                                dev->repeat_key = code;
-                                mod_timer(&dev->timer, jiffies + msecs_to_jiffies(dev->rep[REP_DELAY]));
-                        }
-
-                        break;
-
-                case EV_SW:
-
-                        if (code > SW_MAX || !test_bit(code, dev->swbit) || !!test_bit(code, dev->sw) == value)
-                                return;
-
-                        change_bit(code, dev->sw);
-
-                        break;
-
-                case EV_ABS:
-
-                        if (code > ABS_MAX || !test_bit(code, dev->absbit))
-                                return;
-
-                        if (dev->absfuzz[code]) {
-                                if ((value > dev->abs[code] - (dev->absfuzz[code] >> 1)) &&
-                                    (value < dev->abs[code] + (dev->absfuzz[code] >> 1)))
-                                        return;
-
-                                if ((value > dev->abs[code] - dev->absfuzz[code]) &&
-                                    (value < dev->abs[code] + dev->absfuzz[code]))
-                                        value = (dev->abs[code] * 3 + value) >> 2;
-
-                                if ((value > dev->abs[code] - (dev->absfuzz[code] << 1)) &&
-                                    (value < dev->abs[code] + (dev->absfuzz[code] << 1)))
-                                        value = (dev->abs[code] + value) >> 1;
-                        }
-
-                        if (dev->abs[code] == value)
-                                return;
-
-                        dev->abs[code] = value;
-                        break;
-
-                case EV_REL:
-
-                        if (code > REL_MAX || !test_bit(code, dev->relbit) || (value == 0))
-                                return;
-
-                        break;
-
-                case EV_MSC:
-
-                        if (code > MSC_MAX || !test_bit(code, dev->mscbit))
-                                return;
-
-                        if (dev->event)
-                                dev->event(dev, type, code, value);
-
-                        break;
-
-                case EV_LED:
-
-                        if (code > LED_MAX || !test_bit(code, dev->ledbit) || !!test_bit(code, dev->led) == value)
-                                return;
-
-                        change_bit(code, dev->led);
-
-                        if (dev->event)
-                                dev->event(dev, type, code, value);
-
-                        break;
-
-                case EV_SND:
-
-                        if (code > SND_MAX || !test_bit(code, dev->sndbit))
-                                return;
-
-                        if (!!test_bit(code, dev->snd) != !!value)
-                                change_bit(code, dev->snd);
-
-                        if (dev->event)
-                                dev->event(dev, type, code, value);
-
-                        break;
-
-                case EV_REP:
-
-                        if (code > REP_MAX || value < 0 || dev->rep[code] == value)
-                                return;
-
-                        dev->rep[code] = value;
-                        if (dev->event)
-                                dev->event(dev, type, code, value);
-
-                        break;
-
-                case EV_FF:
-
-                        if (value < 0)
-                                return;
-
-                        if (dev->event)
-                                dev->event(dev, type, code, value);
-                        break;
-        }
-
-        if (type != EV_SYN)
-                dev->sync = 0;
-
-        if (dev->grab)
-                dev->grab->handler->event(dev->grab, type, code, value);
-        else
-                list_for_each_entry(handle, &dev->h_list, d_node)
-                        if (handle->open)
-                                handle->handler->event(handle, type, code, value);
+ * This function should be used by drivers implementing various input
+ * devices. See also input_inject_event().
+ */
+
+void input_event(struct input_dev *dev,
+                 unsigned int type, unsigned int code, int value)
+{
+        unsigned long flags;
+
+        if (is_event_supported(type, dev->evbit, EV_MAX)) {
+
+                spin_lock_irqsave(&dev->event_lock, flags);
+                add_input_randomness(type, code, value);
+                input_handle_event(dev, type, code, value);
+                spin_unlock_irqrestore(&dev->event_lock, flags);
+        }
 }
 EXPORT_SYMBOL(input_event);
@@ -203 +280 @@
  * @value: value of the event
  *
- * Similar to input_event() but will ignore event if device is "grabbed" and handle
- * injecting event is not the one that owns the device.
- */
-void input_inject_event(struct input_handle *handle, unsigned int type, unsigned int code, int value)
-{
-        if (!handle->dev->grab || handle->dev->grab == handle)
-                input_event(handle->dev, type, code, value);
+ * Similar to input_event() but will ignore event if device is
+ * "grabbed" and handle injecting event is not the one that owns
+ * the device.
+ */
+void input_inject_event(struct input_handle *handle,
+                        unsigned int type, unsigned int code, int value)
+{
+        struct input_dev *dev = handle->dev;
+        struct input_handle *grab;
+        unsigned long flags;
+
+        if (is_event_supported(type, dev->evbit, EV_MAX)) {
+                spin_lock_irqsave(&dev->event_lock, flags);
+
+                grab = rcu_dereference(dev->grab);
+                if (!grab || grab == handle)
+                        input_handle_event(dev, type, code, value);
+
+                spin_unlock_irqrestore(&dev->event_lock, flags);
+        }
 }
 EXPORT_SYMBOL(input_inject_event);
 
-static void input_repeat_key(unsigned long data)
-{
-        struct input_dev *dev = (void *) data;
-
-        if (!test_bit(dev->repeat_key, dev->key))
-                return;
-
-        input_event(dev, EV_KEY, dev->repeat_key, 2);
-        input_sync(dev);
-
-        if (dev->rep[REP_PERIOD])
-                mod_timer(&dev->timer, jiffies + msecs_to_jiffies(dev->rep[REP_PERIOD]));
-}
-
+/**
+ * input_grab_device - grabs device for exclusive use
+ * @handle: input handle that wants to own the device
+ *
+ * When a device is grabbed by an input handle all events generated by
+ * the device are delivered only to this handle. Also events injected
+ * by other input handles are ignored while device is grabbed.
+ */
 int input_grab_device(struct input_handle *handle)
 {
-        if (handle->dev->grab)
-                return -EBUSY;
-
-        handle->dev->grab = handle;
-        return 0;
+        struct input_dev *dev = handle->dev;
+        int retval;
+
+        retval = mutex_lock_interruptible(&dev->mutex);
+        if (retval)
+                return retval;
+
+        if (dev->grab) {
+                retval = -EBUSY;
+                goto out;
+        }
+
+        rcu_assign_pointer(dev->grab, handle);
+        /*
+         * Not using synchronize_rcu() because read-side is protected
+         * by a spinlock with interrupts off instead of rcu_read_lock().
+         */
+        synchronize_sched();
+
+ out:
+        mutex_unlock(&dev->mutex);
+        return retval;
 }
 EXPORT_SYMBOL(input_grab_device);
 
+static void __input_release_device(struct input_handle *handle)
+{
+        struct input_dev *dev = handle->dev;
+
+        if (dev->grab == handle) {
+                rcu_assign_pointer(dev->grab, NULL);
+                /* Make sure input_pass_event() notices that grab is gone */
+                synchronize_sched();
+
+                list_for_each_entry(handle, &dev->h_list, d_node)
+                        if (handle->open && handle->handler->start)
+                                handle->handler->start(handle);
+        }
+}
+
+/**
+ * input_release_device - release previously grabbed device
+ * @handle: input handle that owns the device
+ *
+ * Releases previously grabbed device so that other input handles can
+ * start receiving input events. Upon release all handlers attached
+ * to the device have their start() method called so they have a change
+ * to synchronize device state with the rest of the system.
+ */
 void input_release_device(struct input_handle *handle)
 {
         struct input_dev *dev = handle->dev;
 
-        if (dev->grab == handle) {
-                dev->grab = NULL;
-
-                list_for_each_entry(handle, &dev->h_list, d_node)
-                        if (handle->handler->start)
-                                handle->handler->start(handle);
-        }
+        mutex_lock(&dev->mutex);
+        __input_release_device(handle);
+        mutex_unlock(&dev->mutex);
 }
 EXPORT_SYMBOL(input_release_device);
 
+/**
+ * input_open_device - open input device
+ * @handle: handle through which device is being accessed
+ *
+ * This function should be called by input handlers when they
+ * want to start receive events from given input device.
+ */
 int input_open_device(struct input_handle *handle)
 {
         struct input_dev *dev = handle->dev;
-        int err;
-
-        err = mutex_lock_interruptible(&dev->mutex);
-        if (err)
-                return err;
+        int retval;
+
+        retval = mutex_lock_interruptible(&dev->mutex);
+        if (retval)
+                return retval;
+
+        if (dev->going_away) {
+                retval = -ENODEV;
+                goto out;
+        }
 
         handle->open++;
 
         if (!dev->users++ && dev->open)
-                err = dev->open(dev);
-
-        if (err)
-                handle->open--;
-
+                retval = dev->open(dev);
+
+        if (retval) {
+                dev->users--;
+                if (!--handle->open) {
+                        /*
+                         * Make sure we are not delivering any more events
+                         * through this handle
+                         */
+                        synchronize_sched();
+                }
+        }
+
+ out:
         mutex_unlock(&dev->mutex);
-
-        return err;
+        return retval;
 }
 EXPORT_SYMBOL(input_open_device);
 
-int input_flush_device(struct input_handle* handle, struct file* file)
-{
-        if (handle->dev->flush)
-                return handle->dev->flush(handle->dev, file);
-
-        return 0;
+int input_flush_device(struct input_handle *handle, struct file *file)
+{
+        struct input_dev *dev = handle->dev;
+        int retval;
+
+        retval = mutex_lock_interruptible(&dev->mutex);
+        if (retval)
+                return retval;
+
+        if (dev->flush)
+                retval = dev->flush(dev, file);
+
+        mutex_unlock(&dev->mutex);
+        return retval;
 }
 EXPORT_SYMBOL(input_flush_device);
 
+/**
+ * input_close_device - close input device
+ * @handle: handle through which device is being accessed
+ *
+ * This function should be called by input handlers when they
+ * want to stop receive events from given input device.
+ */
 void input_close_device(struct input_handle *handle)
 {
         struct input_dev *dev = handle->dev;
 
-        input_release_device(handle);
-
         mutex_lock(&dev->mutex);
+
+        __input_release_device(handle);
 
         if (!--dev->users && dev->close)
                 dev->close(dev);
-        handle->open--;
+
+        if (!--handle->open) {
+                /*
+                 * synchronize_sched() makes sure that input_pass_event()
+                 * completed and that no more input events are delivered
+                 * through this handle
+                 */
+                synchronize_sched();
+        }
 
         mutex_unlock(&dev->mutex);
 }
 EXPORT_SYMBOL(input_close_device);
+
+/*
+ * Prepare device for unregistering
+ */
+static void input_disconnect_device(struct input_dev *dev)
+{
+        struct input_handle *handle;
+        int code;
+
+        /*
+         * Mark device as going away. Note that we take dev->mutex here
+         * not to protect access to dev->going_away but rather to ensure
+         * that there are no threads in the middle of input_open_device()
+         */
+        mutex_lock(&dev->mutex);
+        dev->going_away = 1;
+        mutex_unlock(&dev->mutex);
+
+        spin_lock_irq(&dev->event_lock);
+
+        /*
+         * Simulate keyup events for all pressed keys so that handlers
+         * are not left with "stuck" keys. The driver may continue
+         * generate events even after we done here but they will not
+         * reach any handlers.
+         */
+        if (is_event_supported(EV_KEY, dev->evbit, EV_MAX)) {
+                for (code = 0; code <= KEY_MAX; code++) {
+                        if (is_event_supported(code, dev->keybit, KEY_MAX) &&
+                            test_bit(code, dev->key)) {
+                                input_pass_event(dev, EV_KEY, code, 0);
+                        }
+                }
+                input_pass_event(dev, EV_SYN, SYN_REPORT, 1);
+        }
+
+        list_for_each_entry(handle, &dev->h_list, d_node)
+                handle->open = 0;
+
+        spin_unlock_irq(&dev->event_lock);
+}
 
 static int input_fetch_keycode(struct input_dev *dev, int scancode)
@@ -474 +679 @@
 static void *input_devices_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        /* acquire lock here ... Yes, we do need locking, I knowi, I know... */
+        if (mutex_lock_interruptible(&input_mutex))
+                return NULL;
 
         return seq_list_start(&input_dev_list, *pos);
@@ -486 +692 @@
 static void input_devices_seq_stop(struct seq_file *seq, void *v)
 {
-        /* release lock here */
+        mutex_unlock(&input_mutex);
 }
 
@@ -570 +776 @@
 static void *input_handlers_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        /* acquire lock here ... Yes, we do need locking, I knowi, I know... */
+        if (mutex_lock_interruptible(&input_mutex))
+                return NULL;
+
         seq->private = (void *)(unsigned long)*pos;
         return seq_list_start(&input_handler_list, *pos);
@@ -583 +791 @@
 static void input_handlers_seq_stop(struct seq_file *seq, void *v)
 {
-        /* release lock here */
+        mutex_unlock(&input_mutex);
 }
 
@@ -1006 +1214 @@
                 device_initialize(&dev->dev);
                 mutex_init(&dev->mutex);
+                spin_lock_init(&dev->event_lock);
                 INIT_LIST_HEAD(&dev->h_list);
                 INIT_LIST_HEAD(&dev->node);
@@ -1023 +1232 @@
  * was not called yet or if it failed. Once device was registered
  * use input_unregister_device() and memory will be freed once last
- * refrence to the device is dropped.
+ * reference to the device is dropped.
  *
  * Device should be allocated by input_allocate_device().
@@ -1093 +1302 @@
 EXPORT_SYMBOL(input_set_capability);
 
+/**
+ * input_register_device - register device with input core
+ * @dev: device to be registered
+ *
+ * This function registers device with input core. The device must be
+ * allocated with input_allocate_device() and all it's capabilities
+ * set up before registering.
+ * If function fails the device must be freed with input_free_device().
+ * Once device has been successfully registered it can be unregistered
+ * with input_unregister_device(); input_free_device() should not be
+ * called in this case.
+ */
 int input_register_device(struct input_dev *dev)
 {
@@ -1100 +1321 @@
         int error;
 
-        set_bit(EV_SYN, dev->evbit);
+        __set_bit(EV_SYN, dev->evbit);
 
         /*
@@ -1121 +1342 @@
                 dev->setkeycode = input_default_setkeycode;
 
-        list_add_tail(&dev->node, &input_dev_list);
-
         snprintf(dev->dev.bus_id, sizeof(dev->dev.bus_id),
                  "input%ld", (unsigned long) atomic_inc_return(&input_no) - 1);
@@ -1138 +1357 @@
         kfree(path);
 
+        error = mutex_lock_interruptible(&input_mutex);
+        if (error) {
+                device_del(&dev->dev);
+                return error;
+        }
+
+        list_add_tail(&dev->node, &input_dev_list);
+
         list_for_each_entry(handler, &input_handler_list, node)
                 input_attach_handler(dev, handler);
@@ -1143 +1370 @@
         input_wakeup_procfs_readers();
 
+        mutex_unlock(&input_mutex);
+
         return 0;
 }
 EXPORT_SYMBOL(input_register_device);
 
+/**
+ * input_unregister_device - unregister previously registered device
+ * @dev: device to be unregistered
+ *
+ * This function unregisters an input device. Once device is unregistered
+ * the caller should not try to access it as it may get freed at any moment.
+ */
 void input_unregister_device(struct input_dev *dev)
 {
         struct input_handle *handle, *next;
-        int code;
-
-        for (code = 0; code <= KEY_MAX; code++)
-                if (test_bit(code, dev->key))
-                        input_report_key(dev, code, 0);
-        input_sync(dev);
-
-        del_timer_sync(&dev->timer);
+
+        input_disconnect_device(dev);
+
+        mutex_lock(&input_mutex);
 
         list_for_each_entry_safe(handle, next, &dev->h_list, d_node)
@@ -1163 +1395 @@
         WARN_ON(!list_empty(&dev->h_list));
 
+        del_timer_sync(&dev->timer);
         list_del_init(&dev->node);
 
+        input_wakeup_procfs_readers();
+
+        mutex_unlock(&input_mutex);
+
         device_unregister(&dev->dev);
-
-        input_wakeup_procfs_readers();
 }
 EXPORT_SYMBOL(input_unregister_device);
 
+/**
+ * input_register_handler - register a new input handler
+ * @handler: handler to be registered
+ *
+ * This function registers a new input handler (interface) for input
+ * devices in the system and attaches it to all input devices that
+ * are compatible with the handler.
+ */
 int input_register_handler(struct input_handler *handler)
 {
         struct input_dev *dev;
+        int retval;
+
+        retval = mutex_lock_interruptible(&input_mutex);
+        if (retval)
+                return retval;
 
         INIT_LIST_HEAD(&handler->h_list);
 
         if (handler->fops != NULL) {
-                if (input_table[handler->minor >> 5])
-                        return -EBUSY;
-
+                if (input_table[handler->minor >> 5]) {
+                        retval = -EBUSY;
+                        goto out;
+                }
                 input_table[handler->minor >> 5] = handler;
         }
@@ -1190 +1439 @@
 
         input_wakeup_procfs_readers();
-        return 0;
+
+ out:
+        mutex_unlock(&input_mutex);
+        return retval;
 }
 EXPORT_SYMBOL(input_register_handler);
 
+/**
+ * input_unregister_handler - unregisters an input handler
+ * @handler: handler to be unregistered
+ *
+ * This function disconnects a handler from its input devices and
+ * removes it from lists of known handlers.
+ */
 void input_unregister_handler(struct input_handler *handler)
 {
         struct input_handle *handle, *next;
+
+        mutex_lock(&input_mutex);
 
         list_for_each_entry_safe(handle, next, &handler->h_list, h_node)
@@ -1208 +1469 @@
 
         input_wakeup_procfs_readers();
+
+        mutex_unlock(&input_mutex);
 }
 EXPORT_SYMBOL(input_unregister_handler);
 
+/**
+ * input_register_handle - register a new input handle
+ * @handle: handle to register
+ *
+ * This function puts a new input handle onto device's
+ * and handler's lists so that events can flow through
+ * it once it is opened using input_open_device().
+ *
+ * This function is supposed to be called from handler's
+ * connect() method.
+ */
 int input_register_handle(struct input_handle *handle)
 {
         struct input_handler *handler = handle->handler;
-
-        list_add_tail(&handle->d_node, &handle->dev->h_list);
+        struct input_dev *dev = handle->dev;
+        int error;
+
+        /*
+         * We take dev->mutex here to prevent race with
+         * input_release_device().
+         */
+        error = mutex_lock_interruptible(&dev->mutex);
+        if (error)
+                return error;
+        list_add_tail_rcu(&handle->d_node, &dev->h_list);
+        mutex_unlock(&dev->mutex);
+        /*
+         * We don't use synchronize_rcu() here because we rely
+         * on dev->event_lock to protect read-side critical
+         * section in input_pass_event().
+         */
+        synchronize_sched();
+
+        /*
+         * Since we are supposed to be called from ->connect()
+         * which is mutually exclusive with ->disconnect()
+         * we can't be racing with input_unregister_handle()
+         * and so separate lock is not needed here.
+         */
         list_add_tail(&handle->h_node, &handler->h_list);
 
@@ -1225 +1522 @@
 EXPORT_SYMBOL(input_register_handle);
 
+/**
+ * input_unregister_handle - unregister an input handle
+ * @handle: handle to unregister
+ *
+ * This function removes input handle from device's
+ * and handler's lists.
+ *
+ * This function is supposed to be called from handler's
+ * disconnect() method.
+ */
 void input_unregister_handle(struct input_handle *handle)
 {
+        struct input_dev *dev = handle->dev;
+
         list_del_init(&handle->h_node);
-        list_del_init(&handle->d_node);
+
+        /*
+         * Take dev->mutex to prevent race with input_release_device().
+         */
+        mutex_lock(&dev->mutex);
+        list_del_rcu(&handle->d_node);
+        mutex_unlock(&dev->mutex);
+        synchronize_sched();
 }
 EXPORT_SYMBOL(input_unregister_handle);

src/linux/ar531x/linux-2.6.23/drivers/input/joydev.c

@@ -44 +44 @@
         wait_queue_head_t wait;
         struct list_head client_list;
+        spinlock_t client_lock; /* protects client_list */
+        struct mutex mutex;
         struct device dev;
 
@@ -62 +64 @@
         int tail;
         int startup;
+        spinlock_t buffer_lock; /* protects access to buffer, head and tail */
         struct fasync_struct *fasync;
         struct joydev *joydev;
@@ -68 +71 @@
 
 static struct joydev *joydev_table[JOYDEV_MINORS];
+static DEFINE_MUTEX(joydev_table_mutex);
 
 static int joydev_correct(int value, struct js_corr *corr)
 {
         switch (corr->type) {
-                case JS_CORR_NONE:
-                        break;
-                case JS_CORR_BROKEN:
-                        value = value > corr->coef[0] ? (value < corr->coef[1] ? 0 :
-                                ((corr->coef[3] * (value - corr->coef[1])) >> 14)) :
-                                ((corr->coef[2] * (value - corr->coef[0])) >> 14);
-                        break;
-                default:
-                        return 0;
+
+        case JS_CORR_NONE:
+                break;
+
+        case JS_CORR_BROKEN:
+                value = value > corr->coef[0] ? (value < corr->coef[1] ? 0 :
+                        ((corr->coef[3] * (value - corr->coef[1])) >> 14)) :
+                        ((corr->coef[2] * (value - corr->coef[0])) >> 14);
+                break;
+
+        default:
+                return 0;
         }
 
@@ -86 +93 @@
 }
 
-static void joydev_event(struct input_handle *handle, unsigned int type, unsigned int code, int value)
+static void joydev_pass_event(struct joydev_client *client,
+                              struct js_event *event)
+{
+        struct joydev *joydev = client->joydev;
+
+        /*
+         * IRQs already disabled, just acquire the lock
+         */
+        spin_lock(&client->buffer_lock);
+
+        client->buffer[client->head] = *event;
+
+        if (client->startup == joydev->nabs + joydev->nkey) {
+                client->head++;
+                client->head &= JOYDEV_BUFFER_SIZE - 1;
+                if (client->tail == client->head)
+                        client->startup = 0;
+        }
+
+        spin_unlock(&client->buffer_lock);
+
+        kill_fasync(&client->fasync, SIGIO, POLL_IN);
+}
+
+static void joydev_event(struct input_handle *handle,
+                         unsigned int type, unsigned int code, int value)
 {
         struct joydev *joydev = handle->private;
@@ -94 +126 @@
         switch (type) {
 
-                case EV_KEY:
-                        if (code < BTN_MISC || value == 2)
-                                return;
-                        event.type = JS_EVENT_BUTTON;
-                        event.number = joydev->keymap[code - BTN_MISC];
-                        event.value = value;
-                        break;
-
-                case EV_ABS:
-                        event.type = JS_EVENT_AXIS;
-                        event.number = joydev->absmap[code];
-                        event.value = joydev_correct(value, joydev->corr + event.number);
-                        if (event.value == joydev->abs[event.number])
-                                return;
-                        joydev->abs[event.number] = event.value;
-                        break;
-
-                default:
+        case EV_KEY:
+                if (code < BTN_MISC || value == 2)
                         return;
+                event.type = JS_EVENT_BUTTON;
+                event.number = joydev->keymap[code - BTN_MISC];
+                event.value = value;
+                break;
+
+        case EV_ABS:
+                event.type = JS_EVENT_AXIS;
+                event.number = joydev->absmap[code];
+                event.value = joydev_correct(value,
+                                        &joydev->corr[event.number]);
+                if (event.value == joydev->abs[event.number])
+                        return;
+                joydev->abs[event.number] = event.value;
+                break;
+
+        default:
+                return;
         }
 
         event.time = jiffies_to_msecs(jiffies);
 
-        list_for_each_entry(client, &joydev->client_list, node) {
-
-                memcpy(client->buffer + client->head, &event, sizeof(struct js_event));
-
-                if (client->startup == joydev->nabs + joydev->nkey)
-                        if (client->tail == (client->head = (client->head + 1) & (JOYDEV_BUFFER_SIZE - 1)))
-                                client->startup = 0;
-
-                kill_fasync(&client->fasync, SIGIO, POLL_IN);
-        }
+        list_for_each_entry_rcu(client, &joydev->client_list, node)
+                joydev_pass_event(client, &event);
 
         wake_up_interruptible(&joydev->wait);
@@ -145 +170 @@
         struct joydev *joydev = container_of(dev, struct joydev, dev);
 
-        joydev_table[joydev->minor] = NULL;
         kfree(joydev);
+}
+
+static void joydev_attach_client(struct joydev *joydev,
+                                 struct joydev_client *client)
+{
+        spin_lock(&joydev->client_lock);
+        list_add_tail_rcu(&client->node, &joydev->client_list);
+        spin_unlock(&joydev->client_lock);
+        /*
+         * We don't use synchronize_rcu() here because read-side
+         * critical section is protected by a spinlock (dev->event_lock)
+         * instead of rcu_read_lock().
+         */
+        synchronize_sched();
+}
+
+static void joydev_detach_client(struct joydev *joydev,
+                                 struct joydev_client *client)
+{
+        spin_lock(&joydev->client_lock);
+        list_del_rcu(&client->node);
+        spin_unlock(&joydev->client_lock);
+        synchronize_sched();
+}
+
+static int joydev_open_device(struct joydev *joydev)
+{
+        int retval;
+
+        retval = mutex_lock_interruptible(&joydev->mutex);
+        if (retval)
+                return retval;
+
+        if (!joydev->exist)
+                retval = -ENODEV;
+        else if (!joydev->open++) {
+                retval = input_open_device(&joydev->handle);
+                if (retval)
+                        joydev->open--;
+        }
+
+        mutex_unlock(&joydev->mutex);
+        return retval;
+}
+
+static void joydev_close_device(struct joydev *joydev)
+{
+        mutex_lock(&joydev->mutex);
+
+        if (joydev->exist && !--joydev->open)
+                input_close_device(&joydev->handle);
+
+        mutex_unlock(&joydev->mutex);
+}
+
+/*
+ * Wake up users waiting for IO so they can disconnect from
+ * dead device.
+ */
+static void joydev_hangup(struct joydev *joydev)
+{
+        struct joydev_client *client;
+
+        spin_lock(&joydev->client_lock);
+        list_for_each_entry(client, &joydev->client_list, node)
+                kill_fasync(&client->fasync, SIGIO, POLL_HUP);
+        spin_unlock(&joydev->client_lock);
+
+        wake_up_interruptible(&joydev->wait);
 }
 
@@ -155 +248 @@
 
         joydev_fasync(-1, file, 0);
-
-        list_del(&client->node);
+        joydev_detach_client(joydev, client);
         kfree(client);
 
-        if (!--joydev->open && joydev->exist)
-                input_close_device(&joydev->handle);
-
+        joydev_close_device(joydev);
         put_device(&joydev->dev);
 
@@ -177 +267 @@
                 return -ENODEV;
 
+        error = mutex_lock_interruptible(&joydev_table_mutex);
+        if (error)
+                return error;
         joydev = joydev_table[i];
-        if (!joydev || !joydev->exist)
+        if (joydev)
+                get_device(&joydev->dev);
+        mutex_unlock(&joydev_table_mutex);
+
+        if (!joydev)
                 return -ENODEV;
-
-        get_device(&joydev->dev);
 
         client = kzalloc(sizeof(struct joydev_client), GFP_KERNEL);
@@ -189 +284 @@
         }
 
+        spin_lock_init(&client->buffer_lock);
         client->joydev = joydev;
-        list_add_tail(&client->node, &joydev->client_list);
-
-        if (!joydev->open++ && joydev->exist) {
-                error = input_open_device(&joydev->handle);
-                if (error)
-                        goto err_free_client;
-        }
+        joydev_attach_client(joydev, client);
+
+        error = joydev_open_device(joydev);
+        if (error)
+                goto err_free_client;
 
         file->private_data = client;
@@ -202 +296 @@
 
  err_free_client:
-        list_del(&client->node);
+        joydev_detach_client(joydev, client);
         kfree(client);
  err_put_joydev:
@@ -209 +303 @@
 }
 
-static ssize_t joydev_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos)
-{
-        return -EINVAL;
-}
-
-static ssize_t joydev_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
+static int joydev_generate_startup_event(struct joydev_client *client,
+                                         struct input_dev *input,
+                                         struct js_event *event)
+{
+        struct joydev *joydev = client->joydev;
+        int have_event;
+
+        spin_lock_irq(&client->buffer_lock);
+
+        have_event = client->startup < joydev->nabs + joydev->nkey;
+
+        if (have_event) {
+
+                event->time = jiffies_to_msecs(jiffies);
+                if (client->startup < joydev->nkey) {
+                        event->type = JS_EVENT_BUTTON | JS_EVENT_INIT;
+                        event->number = client->startup;
+                        event->value = !!test_bit(joydev->keypam[event->number],
+                                                  input->key);
+                } else {
+                        event->type = JS_EVENT_AXIS | JS_EVENT_INIT;
+                        event->number = client->startup - joydev->nkey;
+                        event->value = joydev->abs[event->number];
+                }
+                client->startup++;
+        }
+
+        spin_unlock_irq(&client->buffer_lock);
+
+        return have_event;
+}
+
+static int joydev_fetch_next_event(struct joydev_client *client,
+                                   struct js_event *event)
+{
+        int have_event;
+
+        spin_lock_irq(&client->buffer_lock);
+
+        have_event = client->head != client->tail;
+        if (have_event) {
+                *event = client->buffer[client->tail++];
+                client->tail &= JOYDEV_BUFFER_SIZE - 1;
+        }
+
+        spin_unlock_irq(&client->buffer_lock);
+
+        return have_event;
+}
+
+/*
+ * Old joystick interface
+ */
+static ssize_t joydev_0x_read(struct joydev_client *client,
+                              struct input_dev *input,
+                              char __user *buf)
+{
+        struct joydev *joydev = client->joydev;
+        struct JS_DATA_TYPE data;
+        int i;
+
+        spin_lock_irq(&input->event_lock);
+
+        /*
+         * Get device state
+         */
+        for (data.buttons = i = 0; i < 32 && i < joydev->nkey; i++)
+                data.buttons |=
+                        test_bit(joydev->keypam[i], input->key) ? (1 << i) : 0;
+        data.x = (joydev->abs[0] / 256 + 128) >> joydev->glue.JS_CORR.x;
+        data.y = (joydev->abs[1] / 256 + 128) >> joydev->glue.JS_CORR.y;
+
+        /*
+         * Reset reader's event queue
+         */
+        spin_lock(&client->buffer_lock);
+        client->startup = 0;
+        client->tail = client->head;
+        spin_unlock(&client->buffer_lock);
+
+        spin_unlock_irq(&input->event_lock);
+
+        if (copy_to_user(buf, &data, sizeof(struct JS_DATA_TYPE)))
+                return -EFAULT;
+
+        return sizeof(struct JS_DATA_TYPE);
+}
+
+static inline int joydev_data_pending(struct joydev_client *client)
+{
+        struct joydev *joydev = client->joydev;
+
+        return client->startup < joydev->nabs + joydev->nkey ||
+                client->head != client->tail;
+}
+
+static ssize_t joydev_read(struct file *file, char __user *buf,
+                           size_t count, loff_t *ppos)
 {
         struct joydev_client *client = file->private_data;
         struct joydev *joydev = client->joydev;
         struct input_dev *input = joydev->handle.dev;
-        int retval = 0;
+        struct js_event event;
+        int retval;
 
         if (!joydev->exist)
@@ -227 +414 @@
                 return -EINVAL;
 
-        if (count == sizeof(struct JS_DATA_TYPE)) {
-
-                struct JS_DATA_TYPE data;
-                int i;
-
-                for (data.buttons = i = 0; i < 32 && i < joydev->nkey; i++)
-                        data.buttons |= test_bit(joydev->keypam[i], input->key) ? (1 << i) : 0;
-                data.x = (joydev->abs[0] / 256 + 128) >> joydev->glue.JS_CORR.x;
-                data.y = (joydev->abs[1] / 256 + 128) >> joydev->glue.JS_CORR.y;
-
-                if (copy_to_user(buf, &data, sizeof(struct JS_DATA_TYPE)))
-                        return -EFAULT;
-
-                client->startup = 0;
-                client->tail = client->head;
-
-                return sizeof(struct JS_DATA_TYPE);
-        }
-
-        if (client->startup == joydev->nabs + joydev->nkey &&
-            client->head == client->tail && (file->f_flags & O_NONBLOCK))
+        if (count == sizeof(struct JS_DATA_TYPE))
+                return joydev_0x_read(client, input, buf);
+
+        if (!joydev_data_pending(client) && (file->f_flags & O_NONBLOCK))
                 return -EAGAIN;
 
         retval = wait_event_interruptible(joydev->wait,
-                                          !joydev->exist ||
-                                          client->startup < joydev->nabs + joydev->nkey ||
-                                          client->head != client->tail);
+                        !joydev->exist || joydev_data_pending(client));
         if (retval)
                 return retval;
@@ -260 +428 @@
                 return -ENODEV;
 
-        while (client->startup < joydev->nabs + joydev->nkey && retval + sizeof(struct js_event) <= count) {
-
-                struct js_event event;
-
-                event.time = jiffies_to_msecs(jiffies);
-
-                if (client->startup < joydev->nkey) {
-                        event.type = JS_EVENT_BUTTON | JS_EVENT_INIT;
-                        event.number = client->startup;
-                        event.value = !!test_bit(joydev->keypam[event.number], input->key);
-                } else {
-                        event.type = JS_EVENT_AXIS | JS_EVENT_INIT;
-                        event.number = client->startup - joydev->nkey;
-                        event.value = joydev->abs[event.number];
-                }
+        while (retval + sizeof(struct js_event) <= count &&
+               joydev_generate_startup_event(client, input, &event)) {
 
                 if (copy_to_user(buf + retval, &event, sizeof(struct js_event)))
                         return -EFAULT;
 
-                client->startup++;
                 retval += sizeof(struct js_event);
         }
 
-        while (client->head != client->tail && retval + sizeof(struct js_event) <= count) {
-
-                if (copy_to_user(buf + retval, client->buffer + client->tail, sizeof(struct js_event)))
+        while (retval + sizeof(struct js_event) <= count &&
+               joydev_fetch_next_event(client, &event)) {
+
+                if (copy_to_user(buf + retval, &event, sizeof(struct js_event)))
                         return -EFAULT;
 
-                client->tail = (client->tail + 1) & (JOYDEV_BUFFER_SIZE - 1);
                 retval += sizeof(struct js_event);
         }
@@ -302 +456 @@
 
         poll_wait(file, &joydev->wait, wait);
-        return ((client->head != client->tail || client->startup < joydev->nabs + joydev->nkey) ?
-                (POLLIN | POLLRDNORM) : 0) | (joydev->exist ? 0 : (POLLHUP | POLLERR));
-}
-
-static int joydev_ioctl_common(struct joydev *joydev, unsigned int cmd, void __user *argp)
+        return (joydev_data_pending(client) ? (POLLIN | POLLRDNORM) : 0) |
+                (joydev->exist ?  0 : (POLLHUP | POLLERR));
+}
+
+static int joydev_ioctl_common(struct joydev *joydev,
+                                unsigned int cmd, void __user *argp)
 {
         struct input_dev *dev = joydev->handle.dev;
@@ -313 +468 @@
         switch (cmd) {
 
-                case JS_SET_CAL:
-                        return copy_from_user(&joydev->glue.JS_CORR, argp,
+        case JS_SET_CAL:
+                return copy_from_user(&joydev->glue.JS_CORR, argp,
                                 sizeof(joydev->glue.JS_CORR)) ? -EFAULT : 0;
 
-                case JS_GET_CAL:
-                        return copy_to_user(argp, &joydev->glue.JS_CORR,
+        case JS_GET_CAL:
+                return copy_to_user(argp, &joydev->glue.JS_CORR,
                                 sizeof(joydev->glue.JS_CORR)) ? -EFAULT : 0;
 
-                case JS_SET_TIMEOUT:
-                        return get_user(joydev->glue.JS_TIMEOUT, (s32 __user *) argp);
-
-                case JS_GET_TIMEOUT:
-                        return put_user(joydev->glue.JS_TIMEOUT, (s32 __user *) argp);
-
-                case JSIOCGVERSION:
-                        return put_user(JS_VERSION, (__u32 __user *) argp);
-
-                case JSIOCGAXES:
-                        return put_user(joydev->nabs, (__u8 __user *) argp);
-
-                case JSIOCGBUTTONS:
-                        return put_user(joydev->nkey, (__u8 __user *) argp);
-
-                case JSIOCSCORR:
-                        if (copy_from_user(joydev->corr, argp,
-                                      sizeof(joydev->corr[0]) * joydev->nabs))
-                            return -EFAULT;
-                        for (i = 0; i < joydev->nabs; i++) {
-                                j = joydev->abspam[i];
-                                joydev->abs[i] = joydev_correct(dev->abs[j], joydev->corr + i);
-                        }
-                        return 0;
-
-                case JSIOCGCORR:
-                        return copy_to_user(argp, joydev->corr,
-                                                sizeof(joydev->corr[0]) * joydev->nabs) ? -EFAULT : 0;
-
-                case JSIOCSAXMAP:
-                        if (copy_from_user(joydev->abspam, argp, sizeof(__u8) * (ABS_MAX + 1)))
+        case JS_SET_TIMEOUT:
+                return get_user(joydev->glue.JS_TIMEOUT, (s32 __user *) argp);
+
+        case JS_GET_TIMEOUT:
+                return put_user(joydev->glue.JS_TIMEOUT, (s32 __user *) argp);
+
+        case JSIOCGVERSION:
+                return put_user(JS_VERSION, (__u32 __user *) argp);
+
+        case JSIOCGAXES:
+                return put_user(joydev->nabs, (__u8 __user *) argp);
+
+        case JSIOCGBUTTONS:
+                return put_user(joydev->nkey, (__u8 __user *) argp);
+
+        case JSIOCSCORR:
+                if (copy_from_user(joydev->corr, argp,
+                              sizeof(joydev->corr[0]) * joydev->nabs))
+                    return -EFAULT;
+
+                for (i = 0; i < joydev->nabs; i++) {
+                        j = joydev->abspam[i];
+                        joydev->abs[i] = joydev_correct(dev->abs[j],
+                                                        &joydev->corr[i]);
+                }
+                return 0;
+
+        case JSIOCGCORR:
+                return copy_to_user(argp, joydev->corr,
+                        sizeof(joydev->corr[0]) * joydev->nabs) ? -EFAULT : 0;
+
+        case JSIOCSAXMAP:
+                if (copy_from_user(joydev->abspam, argp,
+                                   sizeof(__u8) * (ABS_MAX + 1)))
+                        return -EFAULT;
+
+                for (i = 0; i < joydev->nabs; i++) {
+                        if (joydev->abspam[i] > ABS_MAX)
+                                return -EINVAL;
+                        joydev->absmap[joydev->abspam[i]] = i;
+                }
+                return 0;
+
+        case JSIOCGAXMAP:
+                return copy_to_user(argp, joydev->abspam,
+                        sizeof(__u8) * (ABS_MAX + 1)) ? -EFAULT : 0;
+
+        case JSIOCSBTNMAP:
+                if (copy_from_user(joydev->keypam, argp,
+                                   sizeof(__u16) * (KEY_MAX - BTN_MISC + 1)))
+                        return -EFAULT;
+
+                for (i = 0; i < joydev->nkey; i++) {
+                        if (joydev->keypam[i] > KEY_MAX ||
+                            joydev->keypam[i] < BTN_MISC)
+                                return -EINVAL;
+                        joydev->keymap[joydev->keypam[i] - BTN_MISC] = i;
+                }
+
+                return 0;
+
+        case JSIOCGBTNMAP:
+                return copy_to_user(argp, joydev->keypam,
+                        sizeof(__u16) * (KEY_MAX - BTN_MISC + 1)) ? -EFAULT : 0;
+
+        default:
+                if ((cmd & ~IOCSIZE_MASK) == JSIOCGNAME(0)) {
+                        int len;
+                        if (!dev->name)
+                                return 0;
+                        len = strlen(dev->name) + 1;
+                        if (len > _IOC_SIZE(cmd))
+                                len = _IOC_SIZE(cmd);
+                        if (copy_to_user(argp, dev->name, len))
                                 return -EFAULT;
-                        for (i = 0; i < joydev->nabs; i++) {
-                                if (joydev->abspam[i] > ABS_MAX)
-                                        return -EINVAL;
-                                joydev->absmap[joydev->abspam[i]] = i;
-                        }
-                        return 0;
-
-                case JSIOCGAXMAP:
-                        return copy_to_user(argp, joydev->abspam,
-                                                sizeof(__u8) * (ABS_MAX + 1)) ? -EFAULT : 0;
-
-                case JSIOCSBTNMAP:
-                        if (copy_from_user(joydev->keypam, argp, sizeof(__u16) * (KEY_MAX - BTN_MISC + 1)))
-                                return -EFAULT;
-                        for (i = 0; i < joydev->nkey; i++) {
-                                if (joydev->keypam[i] > KEY_MAX || joydev->keypam[i] < BTN_MISC)
-                                        return -EINVAL;
-                                joydev->keymap[joydev->keypam[i] - BTN_MISC] = i;
-                        }
-                        return 0;
-
-                case JSIOCGBTNMAP:
-                        return copy_to_user(argp, joydev->keypam,
-                                                sizeof(__u16) * (KEY_MAX - BTN_MISC + 1)) ? -EFAULT : 0;
-
-                default:
-                        if ((cmd & ~(_IOC_SIZEMASK << _IOC_SIZESHIFT)) == JSIOCGNAME(0)) {
-                                int len;
-                                if (!dev->name)
-                                        return 0;
-                                len = strlen(dev->name) + 1;
-                                if (len > _IOC_SIZE(cmd))
-                                        len = _IOC_SIZE(cmd);
-                                if (copy_to_user(argp, dev->name, len))
-                                        return -EFAULT;
-                                return len;
-                        }
+                        return len;
+                }
         }
         return -EINVAL;
@@ -395 +558 @@
 
 #ifdef CONFIG_COMPAT
-static long joydev_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+static long joydev_compat_ioctl(struct file *file,
+                                unsigned int cmd, unsigned long arg)
 {
         struct joydev_client *client = file->private_data;
@@ -402 +566 @@
         s32 tmp32;
         struct JS_DATA_SAVE_TYPE_32 ds32;
-        int err;
-
-        if (!joydev->exist)
-                return -ENODEV;
-
-        switch(cmd) {
+        int retval;
+
+        retval = mutex_lock_interruptible(&joydev->mutex);
+        if (retval)
+                return retval;
+
+        if (!joydev->exist) {
+                retval = -ENODEV;
+                goto out;
+        }
+
+        switch (cmd) {
+
         case JS_SET_TIMELIMIT:
-                err = get_user(tmp32, (s32 __user *) arg);
-                if (err == 0)
+                retval = get_user(tmp32, (s32 __user *) arg);
+                if (retval == 0)
                         joydev->glue.JS_TIMELIMIT = tmp32;
                 break;
+
         case JS_GET_TIMELIMIT:
                 tmp32 = joydev->glue.JS_TIMELIMIT;
-                err = put_user(tmp32, (s32 __user *) arg);
+                retval = put_user(tmp32, (s32 __user *) arg);
                 break;
 
         case JS_SET_ALL:
-                err = copy_from_user(&ds32, argp,
-                                     sizeof(ds32)) ? -EFAULT : 0;
-                if (err == 0) {
+                retval = copy_from_user(&ds32, argp,
+                                        sizeof(ds32)) ? -EFAULT : 0;
+                if (retval == 0) {
                         joydev->glue.JS_TIMEOUT    = ds32.JS_TIMEOUT;
                         joydev->glue.BUSY          = ds32.BUSY;
@@ -439 +611 @@
                 ds32.JS_CORR       = joydev->glue.JS_CORR;
 
-                err = copy_to_user(argp, &ds32, sizeof(ds32)) ? -EFAULT : 0;
+                retval = copy_to_user(argp, &ds32, sizeof(ds32)) ? -EFAULT : 0;
                 break;
 
         default:
-                err = joydev_ioctl_common(joydev, cmd, argp);
-        }
-        return err;
+                retval = joydev_ioctl_common(joydev, cmd, argp);
+                break;
+        }
+
+ out:
+        mutex_unlock(&joydev->mutex);
+        return retval;
 }
 #endif /* CONFIG_COMPAT */
 
-static int joydev_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
+static long joydev_ioctl(struct file *file,
+                         unsigned int cmd, unsigned long arg)
 {
         struct joydev_client *client = file->private_data;
         struct joydev *joydev = client->joydev;
         void __user *argp = (void __user *)arg;
-
-        if (!joydev->exist)
-                return -ENODEV;
-
-        switch(cmd) {
-                case JS_SET_TIMELIMIT:
-                        return get_user(joydev->glue.JS_TIMELIMIT, (long __user *) arg);
-                case JS_GET_TIMELIMIT:
-                        return put_user(joydev->glue.JS_TIMELIMIT, (long __user *) arg);
-                case JS_SET_ALL:
-                        return copy_from_user(&joydev->glue, argp,
-                                                sizeof(joydev->glue)) ? -EFAULT : 0;
-                case JS_GET_ALL:
-                        return copy_to_user(argp, &joydev->glue,
-                                                sizeof(joydev->glue)) ? -EFAULT : 0;
-                default:
-                        return joydev_ioctl_common(joydev, cmd, argp);
-        }
+        int retval;
+
+        retval = mutex_lock_interruptible(&joydev->mutex);
+        if (retval)
+                return retval;
+
+        if (!joydev->exist) {
+                retval = -ENODEV;
+                goto out;
+        }
+
+        switch (cmd) {
+
+        case JS_SET_TIMELIMIT:
+                retval = get_user(joydev->glue.JS_TIMELIMIT,
+                                  (long __user *) arg);
+                break;
+
+        case JS_GET_TIMELIMIT:
+                retval = put_user(joydev->glue.JS_TIMELIMIT,
+                                  (long __user *) arg);
+                break;
+
+        case JS_SET_ALL:
+                retval = copy_from_user(&joydev->glue, argp,
+                                        sizeof(joydev->glue)) ? -EFAULT: 0;
+                break;
+
+        case JS_GET_ALL:
+                retval = copy_to_user(argp, &joydev->glue,
+                                      sizeof(joydev->glue)) ? -EFAULT : 0;
+                break;
+
+        default:
+                retval = joydev_ioctl_common(joydev, cmd, argp);
+                break;
+        }
+ out:
+        mutex_unlock(&joydev->mutex);
+        return retval;
 }
 
 static const struct file_operations joydev_fops = {
-        .owner =        THIS_MODULE,
-        .read =         joydev_read,
-        .write =        joydev_write,
-        .poll =         joydev_poll,
-        .open =         joydev_open,
-        .release =      joydev_release,
-        .ioctl =        joydev_ioctl,
+        .owner          = THIS_MODULE,
+        .read           = joydev_read,
+        .poll           = joydev_poll,
+        .open           = joydev_open,
+        .release        = joydev_release,
+        .unlocked_ioctl = joydev_ioctl,
 #ifdef CONFIG_COMPAT
-        .compat_ioctl = joydev_compat_ioctl,
+        .compat_ioctl   = joydev_compat_ioctl,
 #endif
-        .fasync =       joydev_fasync,
+        .fasync         = joydev_fasync,
 };
+
+static int joydev_install_chrdev(struct joydev *joydev)
+{
+        joydev_table[joydev->minor] = joydev;
+        return 0;
+}
+
+static void joydev_remove_chrdev(struct joydev *joydev)
+{
+        mutex_lock(&joydev_table_mutex);
+        joydev_table[joydev->minor] = NULL;
+        mutex_unlock(&joydev_table_mutex);
+}
+
+/*
+ * Mark device non-existant. This disables writes, ioctls and
+ * prevents new users from opening the device. Already posted
+ * blocking reads will stay, however new ones will fail.
+ */
+static void joydev_mark_dead(struct joydev *joydev)
+{
+        mutex_lock(&joydev->mutex);
+        joydev->exist = 0;
+        mutex_unlock(&joydev->mutex);
+}
+
+static void joydev_cleanup(struct joydev *joydev)
+{
+        struct input_handle *handle = &joydev->handle;
+
+        joydev_mark_dead(joydev);
+        joydev_hangup(joydev);
+        joydev_remove_chrdev(joydev);
+
+        /* joydev is marked dead so noone else accesses joydev->open */
+        if (joydev->open)
+                input_close_device(handle);
+}
 
 static int joydev_connect(struct input_handler *handler, struct input_dev *dev,
@@ -495 +731 @@
         int error;
 
-        for (minor = 0; minor < JOYDEV_MINORS && joydev_table[minor]; minor++);
+        for (minor = 0; minor < JOYDEV_MINORS; minor++)
+                if (!joydev_table[minor])
+                        break;
+
         if (minor == JOYDEV_MINORS) {
                 printk(KERN_ERR "joydev: no more free joydev devices\n");
@@ -506 +745 @@
 
         INIT_LIST_HEAD(&joydev->client_list);
+        spin_lock_init(&joydev->client_lock);
+        mutex_init(&joydev->mutex);
         init_waitqueue_head(&joydev->wait);
 
+        snprintf(joydev->name, sizeof(joydev->name), "js%d", minor);
+        joydev->exist = 1;
         joydev->minor = minor;
+
         joydev->exist = 1;
         joydev->handle.dev = dev;
@@ -514 +758 @@
         joydev->handle.handler = handler;
         joydev->handle.private = joydev;
-        snprintf(joydev->name, sizeof(joydev->name), "js%d", minor);
 
         for (i = 0; i < ABS_MAX + 1; i++)
@@ -546 +789 @@
                 joydev->corr[i].type = JS_CORR_BROKEN;
                 joydev->corr[i].prec = dev->absfuzz[j];
-                joydev->corr[i].coef[0] = (dev->absmax[j] + dev->absmin[j]) / 2 - dev->absflat[j];
-                joydev->corr[i].coef[1] = (dev->absmax[j] + dev->absmin[j]) / 2 + dev->absflat[j];
-                if (!(t = ((dev->absmax[j] - dev->absmin[j]) / 2 - 2 * dev->absflat[j])))
-                        continue;
-                joydev->corr[i].coef[2] = (1 << 29) / t;
-                joydev->corr[i].coef[3] = (1 << 29) / t;
-
-                joydev->abs[i] = joydev_correct(dev->abs[j], joydev->corr + i);
-        }
-
-        snprintf(joydev->dev.bus_id, sizeof(joydev->dev.bus_id),
-                 "js%d", minor);
+                joydev->corr[i].coef[0] =
+                        (dev->absmax[j] + dev->absmin[j]) / 2 - dev->absflat[j];
+                joydev->corr[i].coef[1] =
+                        (dev->absmax[j] + dev->absmin[j]) / 2 + dev->absflat[j];
+
+                t = (dev->absmax[j] - dev->absmin[j]) / 2 - 2 * dev->absflat[j];
+                if (t) {
+                        joydev->corr[i].coef[2] = (1 << 29) / t;
+                        joydev->corr[i].coef[3] = (1 << 29) / t;
+
+                        joydev->abs[i] = joydev_correct(dev->abs[j],
+                                                        joydev->corr + i);
+                }
+        }
+
+        strlcpy(joydev->dev.bus_id, joydev->name, sizeof(joydev->dev.bus_id));
+        joydev->dev.devt = MKDEV(INPUT_MAJOR, JOYDEV_MINOR_BASE + minor);
         joydev->dev.class = &input_class;
         joydev->dev.parent = &dev->dev;
-        joydev->dev.devt = MKDEV(INPUT_MAJOR, JOYDEV_MINOR_BASE + minor);
         joydev->dev.release = joydev_free;
         device_initialize(&joydev->dev);
 
-        joydev_table[minor] = joydev;
+        error = input_register_handle(&joydev->handle);
+        if (error)
+                goto err_free_joydev;
+
+        error = joydev_install_chrdev(joydev);
+        if (error)
+                goto err_unregister_handle;
 
         error = device_add(&joydev->dev);
         if (error)
-                goto err_free_joydev;
-
-        error = input_register_handle(&joydev->handle);
-        if (error)
-                goto err_delete_joydev;
+                goto err_cleanup_joydev;
 
         return 0;
 
- err_delete_joydev:
-        device_del(&joydev->dev);
+ err_cleanup_joydev:
+        joydev_cleanup(joydev);
+ err_unregister_handle:
+        input_unregister_handle(&joydev->handle);
  err_free_joydev:
         put_device(&joydev->dev);
@@ -583 +834 @@
 }
 
-
 static void joydev_disconnect(struct input_handle *handle)
 {
         struct joydev *joydev = handle->private;
-        struct joydev_client *client;
-
+
+        device_del(&joydev->dev);
+        joydev_cleanup(joydev);
         input_unregister_handle(handle);
-        device_del(&joydev->dev);
-
-        joydev->exist = 0;
-
-        if (joydev->open) {
-                input_close_device(handle);
-                list_for_each_entry(client, &joydev->client_list, node)
-                        kill_fasync(&client->fasync, SIGIO, POLL_HUP);
-                wake_up_interruptible(&joydev->wait);
-        }
-
         put_device(&joydev->dev);
 }
@@ -606 +846 @@
 static const struct input_device_id joydev_blacklist[] = {
         {
-                .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_KEYBIT,
                 .evbit = { BIT(EV_KEY) },
                 .keybit = { [LONG(BTN_TOUCH)] = BIT(BTN_TOUCH) },
@@ -615 +856 @@
 static const struct input_device_id joydev_ids[] = {
         {
-                .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_ABSBIT,
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_ABSBIT,
                 .evbit = { BIT(EV_ABS) },
                 .absbit = { BIT(ABS_X) },
         },
         {
-                .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_ABSBIT,
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_ABSBIT,
                 .evbit = { BIT(EV_ABS) },
                 .absbit = { BIT(ABS_WHEEL) },
         },
         {
-                .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_ABSBIT,
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_ABSBIT,
                 .evbit = { BIT(EV_ABS) },
                 .absbit = { BIT(ABS_THROTTLE) },
@@ -635 +879 @@
 
 static struct input_handler joydev_handler = {
-        .event =        joydev_event,
-        .connect =      joydev_connect,
-        .disconnect =   joydev_disconnect,
-        .fops =         &joydev_fops,
-        .minor =        JOYDEV_MINOR_BASE,
-        .name =         "joydev",
-        .id_table =     joydev_ids,
-        .blacklist =    joydev_blacklist,
+        .event          = joydev_event,
+        .connect        = joydev_connect,
+        .disconnect     = joydev_disconnect,
+        .fops           = &joydev_fops,
+        .minor          = JOYDEV_MINOR_BASE,
+        .name           = "joydev",
+        .id_table       = joydev_ids,
+        .blacklist      = joydev_blacklist,
 };
 

src/linux/ar531x/linux-2.6.23/drivers/input/mousedev.c

@@ -62 +62 @@
         int minor;
         char name[16];
+        struct input_handle handle;
         wait_queue_head_t wait;
         struct list_head client_list;
-        struct input_handle handle;
+        spinlock_t client_lock; /* protects client_list */
+        struct mutex mutex;
         struct device dev;
 
@@ -114 +116 @@
 
 static struct mousedev *mousedev_table[MOUSEDEV_MINORS];
+static DEFINE_MUTEX(mousedev_table_mutex);
 static struct mousedev *mousedev_mix;
 static LIST_HEAD(mousedev_mix_list);
 
+static void mixdev_open_devices(void);
+static void mixdev_close_devices(void);
+
 #define fx(i)  (mousedev->old_x[(mousedev->pkt_count - (i)) & 03])
 #define fy(i)  (mousedev->old_y[(mousedev->pkt_count - (i)) & 03])
 
-static void mousedev_touchpad_event(struct input_dev *dev, struct mousedev *mousedev, unsigned int code, int value)
+static void mousedev_touchpad_event(struct input_dev *dev,
+                                    struct mousedev *mousedev,
+                                    unsigned int code, int value)
 {
         int size, tmp;
@@ -126 +134 @@
 
         switch (code) {
-                case ABS_X:
-                        fx(0) = value;
-                        if (mousedev->touch && mousedev->pkt_count >= 2) {
-                                size = dev->absmax[ABS_X] - dev->absmin[ABS_X];
-                                if (size == 0)
-                                        size = 256 * 2;
-                                tmp = ((value - fx(2)) * (256 * FRACTION_DENOM)) / size;
-                                tmp += mousedev->frac_dx;
-                                mousedev->packet.dx = tmp / FRACTION_DENOM;
-                                mousedev->frac_dx = tmp - mousedev->packet.dx * FRACTION_DENOM;
-                        }
-                        break;
-
-                case ABS_Y:
-                        fy(0) = value;
-                        if (mousedev->touch && mousedev->pkt_count >= 2) {
-                                /* use X size to keep the same scale */
-                                size = dev->absmax[ABS_X] - dev->absmin[ABS_X];
-                                if (size == 0)
-                                        size = 256 * 2;
-                                tmp = -((value - fy(2)) * (256 * FRACTION_DENOM)) / size;
-                                tmp += mousedev->frac_dy;
-                                mousedev->packet.dy = tmp / FRACTION_DENOM;
-                                mousedev->frac_dy = tmp - mousedev->packet.dy * FRACTION_DENOM;
-                        }
-                        break;
-        }
-}
-
-static void mousedev_abs_event(struct input_dev *dev, struct mousedev *mousedev, unsigned int code, int value)
-{
-        int size;
-
-        switch (code) {
-                case ABS_X:
+
+        case ABS_X:
+                fx(0) = value;
+                if (mousedev->touch && mousedev->pkt_count >= 2) {
                         size = dev->absmax[ABS_X] - dev->absmin[ABS_X];
                         if (size == 0)
-                                size = xres ? : 1;
-                        if (value > dev->absmax[ABS_X])
-                                value = dev->absmax[ABS_X];
-                        if (value < dev->absmin[ABS_X])
-                                value = dev->absmin[ABS_X];
-                        mousedev->packet.x = ((value - dev->absmin[ABS_X]) * xres) / size;
-                        mousedev->packet.abs_event = 1;
-                        break;
-
-                case ABS_Y:
-                        size = dev->absmax[ABS_Y] - dev->absmin[ABS_Y];
+                                size = 256 * 2;
+                        tmp = ((value - fx(2)) * 256 * FRACTION_DENOM) / size;
+                        tmp += mousedev->frac_dx;
+                        mousedev->packet.dx = tmp / FRACTION_DENOM;
+                        mousedev->frac_dx =
+                                tmp - mousedev->packet.dx * FRACTION_DENOM;
+                }
+                break;
+
+        case ABS_Y:
+                fy(0) = value;
+                if (mousedev->touch && mousedev->pkt_count >= 2) {
+                        /* use X size to keep the same scale */
+                        size = dev->absmax[ABS_X] - dev->absmin[ABS_X];
                         if (size == 0)
-                                size = yres ? : 1;
-                        if (value > dev->absmax[ABS_Y])
-                                value = dev->absmax[ABS_Y];
-                        if (value < dev->absmin[ABS_Y])
-                                value = dev->absmin[ABS_Y];
-                        mousedev->packet.y = yres - ((value - dev->absmin[ABS_Y]) * yres) / size;
-                        mousedev->packet.abs_event = 1;
-                        break;
-        }
-}
-
-static void mousedev_rel_event(struct mousedev *mousedev, unsigned int code, int value)
-{
+                                size = 256 * 2;
+                        tmp = -((value - fy(2)) * 256 * FRACTION_DENOM) / size;
+                        tmp += mousedev->frac_dy;
+                        mousedev->packet.dy = tmp / FRACTION_DENOM;
+                        mousedev->frac_dy = tmp -
+                                mousedev->packet.dy * FRACTION_DENOM;
+                }
+                break;
+        }
+}
+
+static void mousedev_abs_event(struct input_dev *dev, struct mousedev *mousedev,
+                                unsigned int code, int value)
+{
+        int size;
+
         switch (code) {
-                case REL_X:     mousedev->packet.dx += value; break;
-                case REL_Y:     mousedev->packet.dy -= value; break;
-                case REL_WHEEL: mousedev->packet.dz -= value; break;
-        }
-}
-
-static void mousedev_key_event(struct mousedev *mousedev, unsigned int code, int value)
+
+        case ABS_X:
+                size = dev->absmax[ABS_X] - dev->absmin[ABS_X];
+                if (size == 0)
+                        size = xres ? : 1;
+                if (value > dev->absmax[ABS_X])
+                        value = dev->absmax[ABS_X];
+                if (value < dev->absmin[ABS_X])
+                        value = dev->absmin[ABS_X];
+                mousedev->packet.x =
+                        ((value - dev->absmin[ABS_X]) * xres) / size;
+                mousedev->packet.abs_event = 1;
+                break;
+
+        case ABS_Y:
+                size = dev->absmax[ABS_Y] - dev->absmin[ABS_Y];
+                if (size == 0)
+                        size = yres ? : 1;
+                if (value > dev->absmax[ABS_Y])
+                        value = dev->absmax[ABS_Y];
+                if (value < dev->absmin[ABS_Y])
+                        value = dev->absmin[ABS_Y];
+                mousedev->packet.y = yres -
+                        ((value - dev->absmin[ABS_Y]) * yres) / size;
+                mousedev->packet.abs_event = 1;
+                break;
+        }
+}
+
+static void mousedev_rel_event(struct mousedev *mousedev,
+                                unsigned int code, int value)
+{
+        switch (code) {
+        case REL_X:
+                mousedev->packet.dx += value;
+                break;
+
+        case REL_Y:
+                mousedev->packet.dy -= value;
+                break;
+
+        case REL_WHEEL:
+                mousedev->packet.dz -= value;
+                break;
+        }
+}
+
+static void mousedev_key_event(struct mousedev *mousedev,
+                                unsigned int code, int value)
 {
         int index;
 
         switch (code) {
-                case BTN_TOUCH:
-                case BTN_0:
-                case BTN_LEFT:          index = 0; break;
-                case BTN_STYLUS:
-                case BTN_1:
-                case BTN_RIGHT:         index = 1; break;
-                case BTN_2:
-                case BTN_FORWARD:
-                case BTN_STYLUS2:
-                case BTN_MIDDLE:        index = 2; break;
-                case BTN_3:
-                case BTN_BACK:
-                case BTN_SIDE:          index = 3; break;
-                case BTN_4:
-                case BTN_EXTRA:         index = 4; break;
-                default:                return;
+
+        case BTN_TOUCH:
+        case BTN_0:
+        case BTN_LEFT:          index = 0; break;
+
+        case BTN_STYLUS:
+        case BTN_1:
+        case BTN_RIGHT:         index = 1; break;
+
+        case BTN_2:
+        case BTN_FORWARD:
+        case BTN_STYLUS2:
+        case BTN_MIDDLE:        index = 2; break;
+
+        case BTN_3:
+        case BTN_BACK:
+        case BTN_SIDE:          index = 3; break;
+
+        case BTN_4:
+        case BTN_EXTRA:         index = 4; break;
+
+        default:                return;
         }
 
@@ -227 +258 @@
 }
 
-static void mousedev_notify_readers(struct mousedev *mousedev, struct mousedev_hw_data *packet)
+static void mousedev_notify_readers(struct mousedev *mousedev,
+                                    struct mousedev_hw_data *packet)
 {
         struct mousedev_client *client;
         struct mousedev_motion *p;
-        unsigned long flags;
+        unsigned int new_head;
         int wake_readers = 0;
 
-        list_for_each_entry(client, &mousedev->client_list, node) {
-                spin_lock_irqsave(&client->packet_lock, flags);
+        list_for_each_entry_rcu(client, &mousedev->client_list, node) {
+
+                /* Just acquire the lock, interrupts already disabled */
+                spin_lock(&client->packet_lock);
 
                 p = &client->packets[client->head];
                 if (client->ready && p->buttons != mousedev->packet.buttons) {
-                        unsigned int new_head = (client->head + 1) % PACKET_QUEUE_LEN;
+                        new_head = (client->head + 1) % PACKET_QUEUE_LEN;
                         if (new_head != client->tail) {
                                 p = &client->packets[client->head = new_head];
@@ -254 +288 @@
 
                 client->pos_x += packet->dx;
-                client->pos_x = client->pos_x < 0 ? 0 : (client->pos_x >= xres ? xres : client->pos_x);
+                client->pos_x = client->pos_x < 0 ?
+                        0 : (client->pos_x >= xres ? xres : client->pos_x);
                 client->pos_y += packet->dy;
-                client->pos_y = client->pos_y < 0 ? 0 : (client->pos_y >= yres ? yres : client->pos_y);
+                client->pos_y = client->pos_y < 0 ?
+                        0 : (client->pos_y >= yres ? yres : client->pos_y);
 
                 p->dx += packet->dx;
@@ -263 +299 @@
                 p->buttons = mousedev->packet.buttons;
 
-                if (p->dx || p->dy || p->dz || p->buttons != client->last_buttons)
+                if (p->dx || p->dy || p->dz ||
+                    p->buttons != client->last_buttons)
                         client->ready = 1;
 
-                spin_unlock_irqrestore(&client->packet_lock, flags);
+                spin_unlock(&client->packet_lock);
 
                 if (client->ready) {
@@ -282 +319 @@
         if (!value) {
                 if (mousedev->touch &&
-                    time_before(jiffies, mousedev->touch + msecs_to_jiffies(tap_time))) {
+                    time_before(jiffies,
+                                mousedev->touch + msecs_to_jiffies(tap_time))) {
                         /*
                          * Toggle left button to emulate tap.
@@ -291 +329 @@
                         set_bit(0, &mousedev_mix->packet.buttons);
                         mousedev_notify_readers(mousedev, &mousedev_mix->packet);
-                        mousedev_notify_readers(mousedev_mix, &mousedev_mix->packet);
+                        mousedev_notify_readers(mousedev_mix,
+                                                &mousedev_mix->packet);
                         clear_bit(0, &mousedev->packet.buttons);
                         clear_bit(0, &mousedev_mix->packet.buttons);
@@ -303 +342 @@
 }
 
-static void mousedev_event(struct input_handle *handle, unsigned int type, unsigned int code, int value)
+static void mousedev_event(struct input_handle *handle,
+                           unsigned int type, unsigned int code, int value)
 {
         struct mousedev *mousedev = handle->private;
 
         switch (type) {
-                case EV_ABS:
-                        /* Ignore joysticks */
-                        if (test_bit(BTN_TRIGGER, handle->dev->keybit))
-                                return;
-
-                        if (test_bit(BTN_TOOL_FINGER, handle->dev->keybit))
-                                mousedev_touchpad_event(handle->dev, mousedev, code, value);
+
+        case EV_ABS:
+                /* Ignore joysticks */
+                if (test_bit(BTN_TRIGGER, handle->dev->keybit))
+                        return;
+
+                if (test_bit(BTN_TOOL_FINGER, handle->dev->keybit))
+                        mousedev_touchpad_event(handle->dev,
+                                                mousedev, code, value);
+                else
+                        mousedev_abs_event(handle->dev, mousedev, code, value);
+
+                break;
+
+        case EV_REL:
+                mousedev_rel_event(mousedev, code, value);
+                break;
+
+        case EV_KEY:
+                if (value != 2) {
+                        if (code == BTN_TOUCH &&
+                            test_bit(BTN_TOOL_FINGER, handle->dev->keybit))
+                                mousedev_touchpad_touch(mousedev, value);
                         else
-                                mousedev_abs_event(handle->dev, mousedev, code, value);
-
-                        break;
-
-                case EV_REL:
-                        mousedev_rel_event(mousedev, code, value);
-                        break;
-
-                case EV_KEY:
-                        if (value != 2) {
-                                if (code == BTN_TOUCH && test_bit(BTN_TOOL_FINGER, handle->dev->keybit))
-                                        mousedev_touchpad_touch(mousedev, value);
-                                else
-                                        mousedev_key_event(mousedev, code, value);
+                                mousedev_key_event(mousedev, code, value);
+                }
+                break;
+
+        case EV_SYN:
+                if (code == SYN_REPORT) {
+                        if (mousedev->touch) {
+                                mousedev->pkt_count++;
+                                /*
+                                 * Input system eats duplicate events,
+                                 * but we need all of them to do correct
+                                 * averaging so apply present one forward
+                                 */
+                                fx(0) = fx(1);
+                                fy(0) = fy(1);
                         }
-                        break;
-
-                case EV_SYN:
-                        if (code == SYN_REPORT) {
-                                if (mousedev->touch) {
-                                        mousedev->pkt_count++;
-                                        /* Input system eats duplicate events, but we need all of them
-                                         * to do correct averaging so apply present one forward
-                                         */
-                                        fx(0) = fx(1);
-                                        fy(0) = fy(1);
-                                }
-
-                                mousedev_notify_readers(mousedev, &mousedev->packet);
-                                mousedev_notify_readers(mousedev_mix, &mousedev->packet);
-
-                                mousedev->packet.dx = mousedev->packet.dy = mousedev->packet.dz = 0;
-                                mousedev->packet.abs_event = 0;
-                        }
-                        break;
+
+                        mousedev_notify_readers(mousedev, &mousedev->packet);
+                        mousedev_notify_readers(mousedev_mix, &mousedev->packet);
+
+                        mousedev->packet.dx = mousedev->packet.dy =
+                                mousedev->packet.dz = 0;
+                        mousedev->packet.abs_event = 0;
+                }
+                break;
         }
 }
@@ -368 +414 @@
         struct mousedev *mousedev = container_of(dev, struct mousedev, dev);
 
-        mousedev_table[mousedev->minor] = NULL;
         kfree(mousedev);
 }
 
-static int mixdev_add_device(struct mousedev *mousedev)
-{
-        int error;
-
-        if (mousedev_mix->open) {
-                error = input_open_device(&mousedev->handle);
-                if (error)
-                        return error;
-
-                mousedev->open++;
-                mousedev->mixdev_open = 1;
-        }
-
-        get_device(&mousedev->dev);
-        list_add_tail(&mousedev->mixdev_node, &mousedev_mix_list);
-
-        return 0;
-}
-
-static void mixdev_remove_device(struct mousedev *mousedev)
-{
-        if (mousedev->mixdev_open) {
-                mousedev->mixdev_open = 0;
-                if (!--mousedev->open && mousedev->exist)
-                        input_close_device(&mousedev->handle);
-        }
-
-        list_del_init(&mousedev->mixdev_node);
-        put_device(&mousedev->dev);
-}
-
+static int mousedev_open_device(struct mousedev *mousedev)
+{
+        int retval;
+
+        retval = mutex_lock_interruptible(&mousedev->mutex);
+        if (retval)
+                return retval;
+
+        if (mousedev->minor == MOUSEDEV_MIX)
+                mixdev_open_devices();
+        else if (!mousedev->exist)
+                retval = -ENODEV;
+        else if (!mousedev->open++) {
+                retval = input_open_device(&mousedev->handle);
+                if (retval)
+                        mousedev->open--;
+        }
+
+        mutex_unlock(&mousedev->mutex);
+        return retval;
+}
+
+static void mousedev_close_device(struct mousedev *mousedev)
+{
+        mutex_lock(&mousedev->mutex);
+
+        if (mousedev->minor == MOUSEDEV_MIX)
+                mixdev_close_devices();
+        else if (mousedev->exist && !--mousedev->open)
+                input_close_device(&mousedev->handle);
+
+        mutex_unlock(&mousedev->mutex);
+}
+
+/*
+ * Open all available devices so they can all be multiplexed in one.
+ * stream. Note that this function is called with mousedev_mix->mutex
+ * held.
+ */
 static void mixdev_open_devices(void)
 {
@@ -412 +465 @@
         list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) {
                 if (!mousedev->mixdev_open) {
-                        if (!mousedev->open && mousedev->exist)
-                                if (input_open_device(&mousedev->handle))
-                                        continue;
-
-                        mousedev->open++;
+                        if (mousedev_open_device(mousedev))
+                                continue;
+
                         mousedev->mixdev_open = 1;
                 }
@@ -422 +473 @@
 }
 
+/*
+ * Close all devices that were opened as part of multiplexed
+ * device. Note that this function is called with mousedev_mix->mutex
+ * held.
+ */
 static void mixdev_close_devices(void)
 {
@@ -432 +488 @@
                 if (mousedev->mixdev_open) {
                         mousedev->mixdev_open = 0;
-                        if (!--mousedev->open && mousedev->exist)
-                                input_close_device(&mousedev->handle);
+                        mousedev_close_device(mousedev);
                 }
         }
+}
+
+
+static void mousedev_attach_client(struct mousedev *mousedev,
+                                   struct mousedev_client *client)
+{
+        spin_lock(&mousedev->client_lock);
+        list_add_tail_rcu(&client->node, &mousedev->client_list);
+        spin_unlock(&mousedev->client_lock);
+        /*
+         * We don't use synchronize_rcu() here because read-side
+         * critical section is protected by a spinlock (dev->event_lock)
+         * instead of rcu_read_lock().
+         */
+        synchronize_sched();
+}
+
+static void mousedev_detach_client(struct mousedev *mousedev,
+                                   struct mousedev_client *client)
+{
+        spin_lock(&mousedev->client_lock);
+        list_del_rcu(&client->node);
+        spin_unlock(&mousedev->client_lock);
+        synchronize_sched();
 }
 
@@ -444 +523 @@
 
         mousedev_fasync(-1, file, 0);
-
-        list_del(&client->node);
+        mousedev_detach_client(mousedev, client);
         kfree(client);
 
-        if (mousedev->minor == MOUSEDEV_MIX)
-                mixdev_close_devices();
-        else if (!--mousedev->open && mousedev->exist)
-                input_close_device(&mousedev->handle);
-
+        mousedev_close_device(mousedev);
         put_device(&mousedev->dev);
 
         return 0;
 }
-
 
 static int mousedev_open(struct inode *inode, struct file *file)
@@ -476 +549 @@
                 return -ENODEV;
 
+        error = mutex_lock_interruptible(&mousedev_table_mutex);
+        if (error)
+                return error;
         mousedev = mousedev_table[i];
+        if (mousedev)
+                get_device(&mousedev->dev);
+        mutex_unlock(&mousedev_table_mutex);
+
         if (!mousedev)