41 files changed, 674 insertions, 424 deletions

diff --git a/drivers/media/video/cafe_ccic.c b/drivers/media/video/cafe_ccic.c
index a8c068e1de1c..1740b9ebdcef 100644
--- a/drivers/media/video/cafe_ccic.c
+++ b/drivers/media/video/cafe_ccic.c
@@ -1476,12 +1476,9 @@ static int cafe_v4l_open(struct inode *inode, struct file *filp)
 {
         struct cafe_camera *cam;
 
-        lock_kernel();
         cam = cafe_find_dev(iminor(inode));
-        if (cam == NULL) {
-                unlock_kernel();
+        if (cam == NULL)
                 return -ENODEV;
-        }
         filp->private_data = cam;
 
         mutex_lock(&cam->s_mutex);
@@ -1493,7 +1490,6 @@ static int cafe_v4l_open(struct inode *inode, struct file *filp)
         }
         (cam->users)++;
         mutex_unlock(&cam->s_mutex);
-        unlock_kernel();
         return 0;
 }
 
diff --git a/drivers/media/video/compat_ioctl32.c b/drivers/media/video/compat_ioctl32.c
index bd5d9de5a008..e6ca4012b5f0 100644
--- a/drivers/media/video/compat_ioctl32.c
+++ b/drivers/media/video/compat_ioctl32.c
@@ -867,6 +867,7 @@ long v4l_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
         case VIDIOC_STREAMON32:
         case VIDIOC_STREAMOFF32:
         case VIDIOC_G_PARM:
+        case VIDIOC_S_PARM:
         case VIDIOC_G_STD:
         case VIDIOC_S_STD:
         case VIDIOC_G_TUNER:
@@ -885,6 +886,8 @@ long v4l_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
         case VIDIOC_S_INPUT32:
         case VIDIOC_TRY_FMT32:
         case VIDIOC_S_HW_FREQ_SEEK:
+        case VIDIOC_ENUM_FRAMESIZES:
+        case VIDIOC_ENUM_FRAMEINTERVALS:
                 ret = do_video_ioctl(file, cmd, arg);
                 break;
 
diff --git a/drivers/media/video/cx18/cx18-driver.c b/drivers/media/video/cx18/cx18-driver.c
index 7a1a7830a6b3..7874d9790a51 100644
--- a/drivers/media/video/cx18/cx18-driver.c
+++ b/drivers/media/video/cx18/cx18-driver.c
@@ -448,7 +448,14 @@ static int __devinit cx18_init_struct1(struct cx18 *cx)
         mutex_init(&cx->gpio_lock);
 
         spin_lock_init(&cx->lock);
-        spin_lock_init(&cx->dma_reg_lock);
+
+        cx->work_queue = create_singlethread_workqueue(cx->name);
+        if (cx->work_queue == NULL) {
+                CX18_ERR("Could not create work queue\n");
+                return -1;
+        }
+
+        INIT_WORK(&cx->work, cx18_work_handler);
 
         /* start counting open_id at 1 */
         cx->open_id = 1;
@@ -581,10 +588,10 @@ static void cx18_load_and_init_modules(struct cx18 *cx)
 
 #ifdef MODULE
         /* load modules */
-#ifndef CONFIG_MEDIA_TUNER
+#ifdef CONFIG_MEDIA_TUNER_MODULE
         hw = cx18_request_module(cx, hw, "tuner", CX18_HW_TUNER);
 #endif
-#ifndef CONFIG_VIDEO_CS5345
+#ifdef CONFIG_VIDEO_CS5345_MODULE
         hw = cx18_request_module(cx, hw, "cs5345", CX18_HW_CS5345);
 #endif
 #endif
@@ -832,6 +839,7 @@ free_map:
 free_mem:
         release_mem_region(cx->base_addr, CX18_MEM_SIZE);
 free_workqueue:
+        destroy_workqueue(cx->work_queue);
 err:
         if (retval == 0)
                 retval = -ENODEV;
@@ -932,6 +940,9 @@ static void cx18_remove(struct pci_dev *pci_dev)
 
         cx18_halt_firmware(cx);
 
+        flush_workqueue(cx->work_queue);
+        destroy_workqueue(cx->work_queue);
+
         cx18_streams_cleanup(cx, 1);
 
         exit_cx18_i2c(cx);
diff --git a/drivers/media/video/cx18/cx18-driver.h b/drivers/media/video/cx18/cx18-driver.h
index a4b1708fafe7..bbdd5f25041d 100644
--- a/drivers/media/video/cx18/cx18-driver.h
+++ b/drivers/media/video/cx18/cx18-driver.h
@@ -199,12 +199,15 @@ struct cx18_options {
 #define CX18_F_S_APPL_IO        8       /* this stream is used read/written by an application */
 
 /* per-cx18, i_flags */
-#define CX18_F_I_LOADED_FW      0       /* Loaded the firmware the first time */
-#define CX18_F_I_EOS            4       /* End of encoder stream reached */
-#define CX18_F_I_RADIO_USER     5       /* The radio tuner is selected */
-#define CX18_F_I_ENC_PAUSED     13      /* the encoder is paused */
-#define CX18_F_I_INITED         21      /* set after first open */
-#define CX18_F_I_FAILED         22      /* set if first open failed */
+#define CX18_F_I_LOADED_FW              0       /* Loaded firmware 1st time */
+#define CX18_F_I_EOS                    4       /* End of encoder stream */
+#define CX18_F_I_RADIO_USER             5       /* radio tuner is selected */
+#define CX18_F_I_ENC_PAUSED             13      /* the encoder is paused */
+#define CX18_F_I_HAVE_WORK              15      /* there is work to be done */
+#define CX18_F_I_WORK_HANDLER_DVB       18      /* work to be done for DVB */
+#define CX18_F_I_INITED                 21      /* set after first open */
+#define CX18_F_I_FAILED                 22      /* set if first open failed */
+#define CX18_F_I_WORK_INITED            23      /* worker thread initialized */
 
 /* These are the VBI types as they appear in the embedded VBI private packets. */
 #define CX18_SLICED_TYPE_TELETEXT_B     (1)
@@ -402,8 +405,6 @@ struct cx18 {
         spinlock_t lock;        /* lock access to this struct */
         int search_pack_header;
 
-        spinlock_t dma_reg_lock; /* lock access to DMA engine registers */
-
         int open_id;            /* incremented each time an open occurs, used as
                                    unique ID. Starts at 1, so 0 can be used as
                                    uninitialized value in the stream->id. */
@@ -433,6 +434,9 @@ struct cx18 {
         /* when the current DMA is finished this queue is woken up */
         wait_queue_head_t dma_waitq;
 
+        struct workqueue_struct *work_queue;
+        struct work_struct work;
+
         /* i2c */
         struct i2c_adapter i2c_adap[2];
         struct i2c_algo_bit_data i2c_algo[2];
diff --git a/drivers/media/video/cx18/cx18-dvb.c b/drivers/media/video/cx18/cx18-dvb.c
index afc694e7bdb2..4542e2e5e3d7 100644
--- a/drivers/media/video/cx18/cx18-dvb.c
+++ b/drivers/media/video/cx18/cx18-dvb.c
@@ -23,6 +23,8 @@
 #include "cx18-dvb.h"
 #include "cx18-io.h"
 #include "cx18-streams.h"
+#include "cx18-queue.h"
+#include "cx18-scb.h"
 #include "cx18-cards.h"
 #include "s5h1409.h"
 #include "mxl5005s.h"
@@ -300,3 +302,24 @@ static int dvb_register(struct cx18_stream *stream)
 
         return ret;
 }
+
+void cx18_dvb_work_handler(struct cx18 *cx)
+{
+        struct cx18_buffer *buf;
+        struct cx18_stream *s = &cx->streams[CX18_ENC_STREAM_TYPE_TS];
+
+        while ((buf = cx18_dequeue(s, &s->q_full)) != NULL) {
+                if (s->dvb.enabled)
+                        dvb_dmx_swfilter(&s->dvb.demux, buf->buf,
+                                         buf->bytesused);
+
+                cx18_enqueue(s, buf, &s->q_free);
+                cx18_buf_sync_for_device(s, buf);
+                if (s->handle == CX18_INVALID_TASK_HANDLE) /* FIXME: improve */
+                        continue;
+
+                cx18_vapi(cx, CX18_CPU_DE_SET_MDL, 5, s->handle,
+                       (void __iomem *)&cx->scb->cpu_mdl[buf->id] - cx->enc_mem,
+                       1, buf->id, s->buf_size);
+        }
+}
diff --git a/drivers/media/video/cx18/cx18-dvb.h b/drivers/media/video/cx18/cx18-dvb.h
index bf8d8f6f5455..bbdcefc87f28 100644
--- a/drivers/media/video/cx18/cx18-dvb.h
+++ b/drivers/media/video/cx18/cx18-dvb.h
@@ -23,3 +23,4 @@
 
 int cx18_dvb_register(struct cx18_stream *stream);
 void cx18_dvb_unregister(struct cx18_stream *stream);
+void cx18_dvb_work_handler(struct cx18 *cx);
diff --git a/drivers/media/video/cx18/cx18-io.c b/drivers/media/video/cx18/cx18-io.c
index 700ab9439c16..220fae8d4ad7 100644
--- a/drivers/media/video/cx18/cx18-io.c
+++ b/drivers/media/video/cx18/cx18-io.c
@@ -88,6 +88,19 @@ void cx18_writel_retry(struct cx18 *cx, u32 val, void __iomem *addr)
         cx18_log_write_retries(cx, i, addr);
 }
 
+void _cx18_writel_expect(struct cx18 *cx, u32 val, void __iomem *addr,
+                         u32 eval, u32 mask)
+{
+        int i;
+        eval &= mask;
+        for (i = 0; i < CX18_MAX_MMIO_RETRIES; i++) {
+                cx18_writel_noretry(cx, val, addr);
+                if (eval == (cx18_readl_noretry(cx, addr) & mask))
+                        break;
+        }
+        cx18_log_write_retries(cx, i, addr);
+}
+
 void cx18_writew_retry(struct cx18 *cx, u16 val, void __iomem *addr)
 {
         int i;
@@ -218,7 +231,7 @@ void cx18_memset_io(struct cx18 *cx, void __iomem *addr, int val, size_t count)
 void cx18_sw1_irq_enable(struct cx18 *cx, u32 val)
 {
         u32 r;
-        cx18_write_reg(cx, val, SW1_INT_STATUS);
+        cx18_write_reg_expect(cx, val, SW1_INT_STATUS, ~val, val);
         r = cx18_read_reg(cx, SW1_INT_ENABLE_PCI);
         cx18_write_reg(cx, r | val, SW1_INT_ENABLE_PCI);
 }
@@ -233,7 +246,7 @@ void cx18_sw1_irq_disable(struct cx18 *cx, u32 val)
 void cx18_sw2_irq_enable(struct cx18 *cx, u32 val)
 {
         u32 r;
-        cx18_write_reg(cx, val, SW2_INT_STATUS);
+        cx18_write_reg_expect(cx, val, SW2_INT_STATUS, ~val, val);
         r = cx18_read_reg(cx, SW2_INT_ENABLE_PCI);
         cx18_write_reg(cx, r | val, SW2_INT_ENABLE_PCI);
 }
diff --git a/drivers/media/video/cx18/cx18-io.h b/drivers/media/video/cx18/cx18-io.h
index 287a5e8bf67b..425244453ea7 100644
--- a/drivers/media/video/cx18/cx18-io.h
+++ b/drivers/media/video/cx18/cx18-io.h
@@ -133,6 +133,8 @@ static inline void cx18_writel(struct cx18 *cx, u32 val, void __iomem *addr)
                 cx18_writel_noretry(cx, val, addr);
 }
 
+void _cx18_writel_expect(struct cx18 *cx, u32 val, void __iomem *addr,
+                         u32 eval, u32 mask);
 
 static inline
 void cx18_writew_noretry(struct cx18 *cx, u16 val, void __iomem *addr)
@@ -271,6 +273,21 @@ static inline void cx18_write_reg(struct cx18 *cx, u32 val, u32 reg)
                 cx18_write_reg_noretry(cx, val, reg);
 }
 
+static inline void _cx18_write_reg_expect(struct cx18 *cx, u32 val, u32 reg,
+                                          u32 eval, u32 mask)
+{
+        _cx18_writel_expect(cx, val, cx->reg_mem + reg, eval, mask);
+}
+
+static inline void cx18_write_reg_expect(struct cx18 *cx, u32 val, u32 reg,
+                                         u32 eval, u32 mask)
+{
+        if (cx18_retry_mmio)
+                _cx18_write_reg_expect(cx, val, reg, eval, mask);
+        else
+                cx18_write_reg_noretry(cx, val, reg);
+}
+
 
 static inline u32 cx18_read_reg_noretry(struct cx18 *cx, u32 reg)
 {
diff --git a/drivers/media/video/cx18/cx18-irq.c b/drivers/media/video/cx18/cx18-irq.c
index 360330f5463f..5fbfbd0f1493 100644
--- a/drivers/media/video/cx18/cx18-irq.c
+++ b/drivers/media/video/cx18/cx18-irq.c
@@ -29,8 +29,20 @@
 #include "cx18-mailbox.h"
 #include "cx18-vbi.h"
 #include "cx18-scb.h"
+#include "cx18-dvb.h"
 
-#define DMA_MAGIC_COOKIE 0x000001fe
+void cx18_work_handler(struct work_struct *work)
+{
+        struct cx18 *cx = container_of(work, struct cx18, work);
+        if (test_and_clear_bit(CX18_F_I_WORK_INITED, &cx->i_flags)) {
+                struct sched_param param = { .sched_priority = MAX_RT_PRIO-1 };
+                /* This thread must use the FIFO scheduler as it
+                 * is realtime sensitive. */
+                sched_setscheduler(current, SCHED_FIFO, &param);
+        }
+        if (test_and_clear_bit(CX18_F_I_WORK_HANDLER_DVB, &cx->i_flags))
+                cx18_dvb_work_handler(cx);
+}
 
 static void epu_dma_done(struct cx18 *cx, struct cx18_mailbox *mb)
 {
@@ -67,17 +79,11 @@ static void epu_dma_done(struct cx18 *cx, struct cx18_mailbox *mb)
         if (buf) {
                 cx18_buf_sync_for_cpu(s, buf);
                 if (s->type == CX18_ENC_STREAM_TYPE_TS && s->dvb.enabled) {
-                        /* process the buffer here */
-                        CX18_DEBUG_HI_DMA("TS recv and sent bytesused=%d\n",
-                                        buf->bytesused);
-
-                        dvb_dmx_swfilter(&s->dvb.demux, buf->buf,
+                        CX18_DEBUG_HI_DMA("TS recv bytesused = %d\n",
                                         buf->bytesused);
 
-                        cx18_buf_sync_for_device(s, buf);
-                        cx18_vapi(cx, CX18_CPU_DE_SET_MDL, 5, s->handle,
-                            (void __iomem *)&cx->scb->cpu_mdl[buf->id] - cx->enc_mem,
-                            1, buf->id, s->buf_size);
+                        set_bit(CX18_F_I_WORK_HANDLER_DVB, &cx->i_flags);
+                        set_bit(CX18_F_I_HAVE_WORK, &cx->i_flags);
                 } else
                         set_bit(CX18_F_B_NEED_BUF_SWAP, &buf->b_flags);
         } else {
@@ -109,7 +115,7 @@ static void epu_debug(struct cx18 *cx, struct cx18_mailbox *mb)
                 CX18_INFO("FW version: %s\n", p - 1);
 }
 
-static void hpu_cmd(struct cx18 *cx, u32 sw1)
+static void epu_cmd(struct cx18 *cx, u32 sw1)
 {
         struct cx18_mailbox mb;
 
@@ -125,12 +131,31 @@ static void hpu_cmd(struct cx18 *cx, u32 sw1)
                         epu_debug(cx, &mb);
                         break;
                 default:
-                        CX18_WARN("Unexpected mailbox command %08x\n", mb.cmd);
+                        CX18_WARN("Unknown CPU_TO_EPU mailbox command %#08x\n",
+                                  mb.cmd);
                         break;
                 }
         }
-        if (sw1 & (IRQ_APU_TO_EPU | IRQ_HPU_TO_EPU))
-                CX18_WARN("Unexpected interrupt %08x\n", sw1);
+
+        if (sw1 & IRQ_APU_TO_EPU) {
+                cx18_memcpy_fromio(cx, &mb, &cx->scb->apu2epu_mb, sizeof(mb));
+                CX18_WARN("Unknown APU_TO_EPU mailbox command %#08x\n", mb.cmd);
+        }
+
+        if (sw1 & IRQ_HPU_TO_EPU) {
+                cx18_memcpy_fromio(cx, &mb, &cx->scb->hpu2epu_mb, sizeof(mb));
+                CX18_WARN("Unknown HPU_TO_EPU mailbox command %#08x\n", mb.cmd);
+        }
+}
+
+static void xpu_ack(struct cx18 *cx, u32 sw2)
+{
+        if (sw2 & IRQ_CPU_TO_EPU_ACK)
+                wake_up(&cx->mb_cpu_waitq);
+        if (sw2 & IRQ_APU_TO_EPU_ACK)
+                wake_up(&cx->mb_apu_waitq);
+        if (sw2 & IRQ_HPU_TO_EPU_ACK)
+                wake_up(&cx->mb_hpu_waitq);
 }
 
 irqreturn_t cx18_irq_handler(int irq, void *dev_id)
@@ -140,43 +165,36 @@ irqreturn_t cx18_irq_handler(int irq, void *dev_id)
         u32 sw2, sw2_mask;
         u32 hw2, hw2_mask;
 
-        spin_lock(&cx->dma_reg_lock);
-
+        sw1_mask = cx18_read_reg(cx, SW1_INT_ENABLE_PCI);
+        sw1 = cx18_read_reg(cx, SW1_INT_STATUS) & sw1_mask;
+        sw2_mask = cx18_read_reg(cx, SW2_INT_ENABLE_PCI);
+        sw2 = cx18_read_reg(cx, SW2_INT_STATUS) & sw2_mask;
         hw2_mask = cx18_read_reg(cx, HW2_INT_MASK5_PCI);
         hw2 = cx18_read_reg(cx, HW2_INT_CLR_STATUS) & hw2_mask;
-        sw2_mask = cx18_read_reg(cx, SW2_INT_ENABLE_PCI) | IRQ_EPU_TO_HPU_ACK;
-        sw2 = cx18_read_reg(cx, SW2_INT_STATUS) & sw2_mask;
-        sw1_mask = cx18_read_reg(cx, SW1_INT_ENABLE_PCI) | IRQ_EPU_TO_HPU;
-        sw1 = cx18_read_reg(cx, SW1_INT_STATUS) & sw1_mask;
 
-        cx18_write_reg(cx, sw2&sw2_mask, SW2_INT_STATUS);
-        cx18_write_reg(cx, sw1&sw1_mask, SW1_INT_STATUS);
-        cx18_write_reg(cx, hw2&hw2_mask, HW2_INT_CLR_STATUS);
+        if (sw1)
+                cx18_write_reg_expect(cx, sw1, SW1_INT_STATUS, ~sw1, sw1);
+        if (sw2)
+                cx18_write_reg_expect(cx, sw2, SW2_INT_STATUS, ~sw2, sw2);
+        if (hw2)
+                cx18_write_reg_expect(cx, hw2, HW2_INT_CLR_STATUS, ~hw2, hw2);
 
         if (sw1 || sw2 || hw2)
                 CX18_DEBUG_HI_IRQ("SW1: %x  SW2: %x  HW2: %x\n", sw1, sw2, hw2);
 
         /* To do: interrupt-based I2C handling
-        if (hw2 & 0x00c00000) {
+        if (hw2 & (HW2_I2C1_INT|HW2_I2C2_INT)) {
         }
         */
 
-        if (sw2) {
-                if (sw2 & (cx18_readl(cx, &cx->scb->cpu2hpu_irq_ack) |
-                           cx18_readl(cx, &cx->scb->cpu2epu_irq_ack)))
-                        wake_up(&cx->mb_cpu_waitq);
-                if (sw2 & (cx18_readl(cx, &cx->scb->apu2hpu_irq_ack) |
-                           cx18_readl(cx, &cx->scb->apu2epu_irq_ack)))
-                        wake_up(&cx->mb_apu_waitq);
-                if (sw2 & cx18_readl(cx, &cx->scb->epu2hpu_irq_ack))
-                        wake_up(&cx->mb_epu_waitq);
-                if (sw2 & cx18_readl(cx, &cx->scb->hpu2epu_irq_ack))
-                        wake_up(&cx->mb_hpu_waitq);
-        }
+        if (sw2)
+                xpu_ack(cx, sw2);
 
         if (sw1)
-                hpu_cmd(cx, sw1);
-        spin_unlock(&cx->dma_reg_lock);
+                epu_cmd(cx, sw1);
+
+        if (test_and_clear_bit(CX18_F_I_HAVE_WORK, &cx->i_flags))
+                queue_work(cx->work_queue, &cx->work);
 
-        return (hw2 | sw1 | sw2) ? IRQ_HANDLED : IRQ_NONE;
+        return (sw1 || sw2 || hw2) ? IRQ_HANDLED : IRQ_NONE;
 }
diff --git a/drivers/media/video/cx18/cx18-irq.h b/drivers/media/video/cx18/cx18-irq.h
index 379f704f5cba..6173ca3bc9e4 100644
--- a/drivers/media/video/cx18/cx18-irq.h
+++ b/drivers/media/video/cx18/cx18-irq.h
@@ -32,6 +32,4 @@
 
 irqreturn_t cx18_irq_handler(int irq, void *dev_id);
 
-void cx18_irq_work_handler(struct work_struct *work);
-void cx18_dma_stream_dec_prepare(struct cx18_stream *s, u32 offset, int lock);
-void cx18_unfinished_dma(unsigned long arg);
+void cx18_work_handler(struct work_struct *work);
diff --git a/drivers/media/video/cx18/cx18-mailbox.c b/drivers/media/video/cx18/cx18-mailbox.c
index 9d18dd22de76..acff7dfb60df 100644
--- a/drivers/media/video/cx18/cx18-mailbox.c
+++ b/drivers/media/video/cx18/cx18-mailbox.c
@@ -83,7 +83,7 @@ static const struct cx18_api_info api_info[] = {
         API_ENTRY(CPU, CX18_CPU_DE_SET_MDL_ACK,                 0),
         API_ENTRY(CPU, CX18_CPU_DE_SET_MDL,                     API_FAST),
         API_ENTRY(CPU, CX18_APU_RESETAI,                        API_FAST),
-        API_ENTRY(CPU, CX18_CPU_DE_RELEASE_MDL,                 0),
+        API_ENTRY(CPU, CX18_CPU_DE_RELEASE_MDL,                 API_SLOW),
         API_ENTRY(0, 0,                                         0),
 };
 
@@ -176,7 +176,7 @@ long cx18_mb_ack(struct cx18 *cx, const struct cx18_mailbox *mb)
 
         cx18_setup_page(cx, SCB_OFFSET);
         cx18_write_sync(cx, mb->request, &ack_mb->ack);
-        cx18_write_reg(cx, ack_irq, SW2_INT_SET);
+        cx18_write_reg_expect(cx, ack_irq, SW2_INT_SET, ack_irq, ack_irq);
         return 0;
 }
 
@@ -225,7 +225,7 @@ static int cx18_api_call(struct cx18 *cx, u32 cmd, int args, u32 data[])
         }
         if (info->flags & API_FAST)
                 timeout /= 2;
-        cx18_write_reg(cx, irq, SW1_INT_SET);
+        cx18_write_reg_expect(cx, irq, SW1_INT_SET, irq, irq);
 
         while (!sig && cx18_readl(cx, &mb->ack) != cx18_readl(cx, &mb->request)
                && cnt < 660) {
diff --git a/drivers/media/video/cx18/cx18-queue.c b/drivers/media/video/cx18/cx18-queue.c
index a33ba04a2686..174682c2582f 100644
--- a/drivers/media/video/cx18/cx18-queue.c
+++ b/drivers/media/video/cx18/cx18-queue.c
@@ -88,15 +88,13 @@ struct cx18_buffer *cx18_queue_get_buf_irq(struct cx18_stream *s, u32 id,
 
                 if (buf->id != id)
                         continue;
+
                 buf->bytesused = bytesused;
-                /* the transport buffers are handled differently,
-                   they are not moved to the full queue */
-                if (s->type != CX18_ENC_STREAM_TYPE_TS) {
-                        atomic_dec(&s->q_free.buffers);
-                        atomic_inc(&s->q_full.buffers);
-                        s->q_full.bytesused += buf->bytesused;
-                        list_move_tail(&buf->list, &s->q_full.list);
-                }
+                atomic_dec(&s->q_free.buffers);
+                atomic_inc(&s->q_full.buffers);
+                s->q_full.bytesused += buf->bytesused;
+                list_move_tail(&buf->list, &s->q_full.list);
+
                 spin_unlock(&s->qlock);
                 return buf;
         }
diff --git a/drivers/media/video/cx18/cx18-scb.h b/drivers/media/video/cx18/cx18-scb.h
index 86b4cb15d163..594713bbed68 100644
--- a/drivers/media/video/cx18/cx18-scb.h
+++ b/drivers/media/video/cx18/cx18-scb.h
@@ -128,22 +128,22 @@ struct cx18_scb {
         u32 apu2cpu_irq;
         /* Value to write to register SW2 register set (0xC7003140) after the
            command is cleared */
-        u32 apu2cpu_irq_ack;
+        u32 cpu2apu_irq_ack;
         u32 reserved2[13];
 
         u32 hpu2cpu_mb_offset;
         u32 hpu2cpu_irq;
-        u32 hpu2cpu_irq_ack;
+        u32 cpu2hpu_irq_ack;
         u32 reserved3[13];
 
         u32 ppu2cpu_mb_offset;
         u32 ppu2cpu_irq;
-        u32 ppu2cpu_irq_ack;
+        u32 cpu2ppu_irq_ack;
         u32 reserved4[13];
 
         u32 epu2cpu_mb_offset;
         u32 epu2cpu_irq;
-        u32 epu2cpu_irq_ack;
+        u32 cpu2epu_irq_ack;
         u32 reserved5[13];
         u32 reserved6[8];
 
@@ -153,22 +153,22 @@ struct cx18_scb {
         u32 reserved11[7];
         u32 cpu2apu_mb_offset;
         u32 cpu2apu_irq;
-        u32 cpu2apu_irq_ack;
+        u32 apu2cpu_irq_ack;
         u32 reserved12[13];
 
         u32 hpu2apu_mb_offset;
         u32 hpu2apu_irq;
-        u32 hpu2apu_irq_ack;
+        u32 apu2hpu_irq_ack;
         u32 reserved13[13];
 
         u32 ppu2apu_mb_offset;
         u32 ppu2apu_irq;
-        u32 ppu2apu_irq_ack;
+        u32 apu2ppu_irq_ack;
         u32 reserved14[13];
 
         u32 epu2apu_mb_offset;
         u32 epu2apu_irq;
-        u32 epu2apu_irq_ack;
+        u32 apu2epu_irq_ack;
         u32 reserved15[13];
         u32 reserved16[8];
 
@@ -178,22 +178,22 @@ struct cx18_scb {
         u32 reserved21[7];
         u32 cpu2hpu_mb_offset;
         u32 cpu2hpu_irq;
-        u32 cpu2hpu_irq_ack;
+        u32 hpu2cpu_irq_ack;
         u32 reserved22[13];
 
         u32 apu2hpu_mb_offset;
         u32 apu2hpu_irq;
-        u32 apu2hpu_irq_ack;
+        u32 hpu2apu_irq_ack;
         u32 reserved23[13];
 
         u32 ppu2hpu_mb_offset;
         u32 ppu2hpu_irq;
-        u32 ppu2hpu_irq_ack;
+        u32 hpu2ppu_irq_ack;
         u32 reserved24[13];
 
         u32 epu2hpu_mb_offset;
         u32 epu2hpu_irq;
-        u32 epu2hpu_irq_ack;
+        u32 hpu2epu_irq_ack;
         u32 reserved25[13];
         u32 reserved26[8];
 
@@ -203,22 +203,22 @@ struct cx18_scb {
         u32 reserved31[7];
         u32 cpu2ppu_mb_offset;
         u32 cpu2ppu_irq;
-        u32 cpu2ppu_irq_ack;
+        u32 ppu2cpu_irq_ack;
         u32 reserved32[13];
 
         u32 apu2ppu_mb_offset;
         u32 apu2ppu_irq;
-        u32 apu2ppu_irq_ack;
+        u32 ppu2apu_irq_ack;
         u32 reserved33[13];
 
         u32 hpu2ppu_mb_offset;
         u32 hpu2ppu_irq;
-        u32 hpu2ppu_irq_ack;
+        u32 ppu2hpu_irq_ack;
         u32 reserved34[13];
 
         u32 epu2ppu_mb_offset;
         u32 epu2ppu_irq;
-        u32 epu2ppu_irq_ack;
+        u32 ppu2epu_irq_ack;
         u32 reserved35[13];
         u32 reserved36[8];
 
@@ -228,22 +228,22 @@ struct cx18_scb {
         u32 reserved41[7];
         u32 cpu2epu_mb_offset;
         u32 cpu2epu_irq;
-        u32 cpu2epu_irq_ack;
+        u32 epu2cpu_irq_ack;
         u32 reserved42[13];
 
         u32 apu2epu_mb_offset;
         u32 apu2epu_irq;
-        u32 apu2epu_irq_ack;
+        u32 epu2apu_irq_ack;
         u32 reserved43[13];
 
         u32 hpu2epu_mb_offset;
         u32 hpu2epu_irq;
-        u32 hpu2epu_irq_ack;
+        u32 epu2hpu_irq_ack;
         u32 reserved44[13];
 
         u32 ppu2epu_mb_offset;
         u32 ppu2epu_irq;
-        u32 ppu2epu_irq_ack;
+        u32 epu2ppu_irq_ack;
         u32 reserved45[13];
         u32 reserved46[8];
 
diff --git a/drivers/media/video/cx88/cx88-blackbird.c b/drivers/media/video/cx88/cx88-blackbird.c
index 078be6319556..d3ae5b4dfca7 100644
--- a/drivers/media/video/cx88/cx88-blackbird.c
+++ b/drivers/media/video/cx88/cx88-blackbird.c
@@ -1078,7 +1078,7 @@ static int mpeg_open(struct inode *inode, struct file *file)
                 }
         }
 
-        if (blackbird_initialize_codec(dev) < 0) {
+        if (!atomic_read(&dev->core->mpeg_users) && blackbird_initialize_codec(dev) < 0) {
                 if (drv)
                         drv->request_release(drv);
                 unlock_kernel();
@@ -1109,6 +1109,8 @@ static int mpeg_open(struct inode *inode, struct file *file)
                         fh->mpegq.field);
         unlock_kernel();
 
+        atomic_inc(&dev->core->mpeg_users);
+
         return 0;
 }
 
@@ -1118,7 +1120,7 @@ static int mpeg_release(struct inode *inode, struct file *file)
         struct cx8802_dev *dev = fh->dev;
         struct cx8802_driver *drv = NULL;
 
-        if (dev->mpeg_active)
+        if (dev->mpeg_active && atomic_read(&dev->core->mpeg_users) == 1)
                 blackbird_stop_codec(dev);
 
         cx8802_cancel_buffers(fh->dev);
@@ -1138,6 +1140,8 @@ static int mpeg_release(struct inode *inode, struct file *file)
         if (drv)
                 drv->request_release(drv);
 
+        atomic_dec(&dev->core->mpeg_users);
+
         return 0;
 }
 
@@ -1158,6 +1162,10 @@ static unsigned int
 mpeg_poll(struct file *file, struct poll_table_struct *wait)
 {
         struct cx8802_fh *fh = file->private_data;
+        struct cx8802_dev *dev = fh->dev;
+
+        if (!dev->mpeg_active)
+                blackbird_start_codec(file, fh);
 
         return videobuf_poll_stream(file, &fh->mpegq, wait);
 }
diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c
index cf6c30d4e545..309ca5e68063 100644
--- a/drivers/media/video/cx88/cx88-dvb.c
+++ b/drivers/media/video/cx88/cx88-dvb.c
@@ -598,6 +598,11 @@ static int dvb_register(struct cx8802_dev *dev)
         struct videobuf_dvb_frontend *fe0, *fe1 = NULL;
         int mfe_shared = 0; /* bus not shared by default */
 
+        if (0 != core->i2c_rc) {
+                printk(KERN_ERR "%s/2: no i2c-bus available, cannot attach dvb drivers\n", core->name);
+                goto frontend_detach;
+        }
+
         /* Get the first frontend */
         fe0 = videobuf_dvb_get_frontend(&dev->frontends, 1);
         if (!fe0)
diff --git a/drivers/media/video/cx88/cx88-mpeg.c b/drivers/media/video/cx88/cx88-mpeg.c
index a1c435b4b1cd..3ebdcd1d83f8 100644
--- a/drivers/media/video/cx88/cx88-mpeg.c
+++ b/drivers/media/video/cx88/cx88-mpeg.c
@@ -769,10 +769,6 @@ static int __devinit cx8802_probe(struct pci_dev *pci_dev,
         struct cx8802_dev *dev;
         struct cx88_core  *core;
         int err;
-#if defined(CONFIG_VIDEO_CX88_DVB) || defined(CONFIG_VIDEO_CX88_DVB_MODULE)
-        struct videobuf_dvb_frontend *demod;
-        int i;
-#endif
 
         /* general setup */
         core = cx88_core_get(pci_dev);
@@ -803,15 +799,21 @@ static int __devinit cx8802_probe(struct pci_dev *pci_dev,
         mutex_init(&dev->frontends.lock);
         INIT_LIST_HEAD(&dev->frontends.felist);
 
-        if (core->board.num_frontends)
-                printk(KERN_INFO "%s() allocating %d frontend(s)\n", __func__, core->board.num_frontends);
-
-        for (i = 1; i <= core->board.num_frontends; i++) {
-                demod = videobuf_dvb_alloc_frontend(&dev->frontends, i);
-                if(demod == NULL) {
-                        printk(KERN_ERR "%s() failed to alloc\n", __func__);
-                        err = -ENOMEM;
-                        goto fail_free;
+        if (core->board.num_frontends) {
+                struct videobuf_dvb_frontend *fe;
+                int i;
+
+                printk(KERN_INFO "%s() allocating %d frontend(s)\n", __func__,
+                        core->board.num_frontends);
+                for (i = 1; i <= core->board.num_frontends; i++) {
+                        fe = videobuf_dvb_alloc_frontend(&dev->frontends, i);
+                        if(fe == NULL) {
+                                printk(KERN_ERR "%s() failed to alloc\n",
+                                        __func__);
+                                videobuf_dvb_dealloc_frontends(&dev->frontends);
+                                err = -ENOMEM;
+                                goto fail_free;
+                        }
                 }
         }
 #endif
diff --git a/drivers/media/video/cx88/cx88-video.c b/drivers/media/video/cx88/cx88-video.c
index 61265fd04d56..b96ce991d968 100644
--- a/drivers/media/video/cx88/cx88-video.c
+++ b/drivers/media/video/cx88/cx88-video.c
@@ -1216,8 +1216,12 @@ static int vidioc_streamon(struct file *file, void *priv, enum v4l2_buf_type i)
         struct cx8800_fh  *fh   = priv;
         struct cx8800_dev *dev  = fh->dev;
 
-        if (unlikely(fh->type != V4L2_BUF_TYPE_VIDEO_CAPTURE))
+        /* We should remember that this driver also supports teletext,  */
+        /* so we have to test if the v4l2_buf_type is VBI capture data. */
+        if (unlikely((fh->type != V4L2_BUF_TYPE_VIDEO_CAPTURE) &&
+                     (fh->type != V4L2_BUF_TYPE_VBI_CAPTURE)))
                 return -EINVAL;
+
         if (unlikely(i != fh->type))
                 return -EINVAL;
 
@@ -1232,8 +1236,10 @@ static int vidioc_streamoff(struct file *file, void *priv, enum v4l2_buf_type i)
         struct cx8800_dev *dev  = fh->dev;
         int               err, res;
 
-        if (fh->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+        if ((fh->type != V4L2_BUF_TYPE_VIDEO_CAPTURE) &&
+            (fh->type != V4L2_BUF_TYPE_VBI_CAPTURE))
                 return -EINVAL;
+
         if (i != fh->type)
                 return -EINVAL;
 
diff --git a/drivers/media/video/cx88/cx88.h b/drivers/media/video/cx88/cx88.h
index 76207c2856b7..f4240965be32 100644
--- a/drivers/media/video/cx88/cx88.h
+++ b/drivers/media/video/cx88/cx88.h
@@ -352,6 +352,7 @@ struct cx88_core {
         /* various v4l controls */
         u32                        freq;
         atomic_t                   users;
+        atomic_t                   mpeg_users;
 
         /* cx88-video needs to access cx8802 for hybrid tuner pll access. */
         struct cx8802_dev          *dvbdev;
diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index ac3292d7646c..7a8d49ef646e 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -62,7 +62,7 @@ static int em28xx_isoc_audio_deinit(struct em28xx *dev)
 
         dprintk("Stopping isoc\n");
         for (i = 0; i < EM28XX_AUDIO_BUFS; i++) {
-                usb_kill_urb(dev->adev->urb[i]);
+                usb_unlink_urb(dev->adev->urb[i]);
                 usb_free_urb(dev->adev->urb[i]);
                 dev->adev->urb[i] = NULL;
         }
@@ -75,7 +75,6 @@ static void em28xx_audio_isocirq(struct urb *urb)
         struct em28xx            *dev = urb->context;
         int                      i;
         unsigned int             oldptr;
-        unsigned long            flags;
         int                      period_elapsed = 0;
         int                      status;
         unsigned char            *cp;
@@ -96,9 +95,21 @@ static void em28xx_audio_isocirq(struct urb *urb)
                         if (!length)
                                 continue;
 
-                        spin_lock_irqsave(&dev->adev->slock, flags);
-
                         oldptr = dev->adev->hwptr_done_capture;
+                        if (oldptr + length >= runtime->buffer_size) {
+                                unsigned int cnt =
+                                    runtime->buffer_size - oldptr;
+                                memcpy(runtime->dma_area + oldptr * stride, cp,
+                                       cnt * stride);
+                                memcpy(runtime->dma_area, cp + cnt * stride,
+                                       length * stride - cnt * stride);
+                        } else {
+                                memcpy(runtime->dma_area + oldptr * stride, cp,
+                                       length * stride);
+                        }
+
+                        snd_pcm_stream_lock(substream);
+
                         dev->adev->hwptr_done_capture += length;
                         if (dev->adev->hwptr_done_capture >=
                             runtime->buffer_size)
@@ -113,19 +124,7 @@ static void em28xx_audio_isocirq(struct urb *urb)
                                 period_elapsed = 1;
                         }
 
-                        spin_unlock_irqrestore(&dev->adev->slock, flags);
-
-                        if (oldptr + length >= runtime->buffer_size) {
-                                unsigned int cnt =
-                                    runtime->buffer_size - oldptr;
-                                memcpy(runtime->dma_area + oldptr * stride, cp,
-                                       cnt * stride);
-                                memcpy(runtime->dma_area, cp + cnt * stride,
-                                       length * stride - cnt * stride);
-                        } else {
-                                memcpy(runtime->dma_area + oldptr * stride, cp,
-                                       length * stride);
-                        }
+                        snd_pcm_stream_unlock(substream);
                 }
                 if (period_elapsed)
                         snd_pcm_period_elapsed(substream);
diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index 5d837c16ee22..15e2b525310d 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -69,19 +69,33 @@ int em28xx_read_reg_req_len(struct em28xx *dev, u8 req, u16 reg,
         int ret, byte;
 
         if (dev->state & DEV_DISCONNECTED)
-                return(-ENODEV);
+                return -ENODEV;
+
+        if (len > URB_MAX_CTRL_SIZE)
+                return -EINVAL;
 
         em28xx_regdbg("req=%02x, reg=%02x ", req, reg);
 
+        mutex_lock(&dev->ctrl_urb_lock);
         ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), req,
                               USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                              0x0000, reg, buf, len, HZ);
+                              0x0000, reg, dev->urb_buf, len, HZ);
+        if (ret < 0) {
+                if (reg_debug)
+                        printk(" failed!\n");
+                mutex_unlock(&dev->ctrl_urb_lock);
+                return ret;
+        }
+
+        if (len)
+                memcpy(buf, dev->urb_buf, len);
+
+        mutex_unlock(&dev->ctrl_urb_lock);
 
         if (reg_debug) {
-                printk(ret < 0 ? " failed!\n" : "%02x values: ", ret);
+                printk("%02x values: ", ret);
                 for (byte = 0; byte < len; byte++)
                         printk(" %02x", (unsigned char)buf[byte]);
-
                 printk("\n");
         }
 
@@ -102,16 +116,20 @@ int em28xx_read_reg_req(struct em28xx *dev, u8 req, u16 reg)
 
         em28xx_regdbg("req=%02x, reg=%02x:", req, reg);
 
+        mutex_lock(&dev->ctrl_urb_lock);
         ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), req,
                               USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                              0x0000, reg, &val, 1, HZ);
-
-        if (reg_debug)
-                printk(ret < 0 ? " failed!\n" :
-                                 "%02x\n", (unsigned char) val);
+                              0x0000, reg, dev->urb_buf, 1, HZ);
+        val = dev->urb_buf[0];
+        mutex_unlock(&dev->ctrl_urb_lock);
 
-        if (ret < 0)
+        if (ret < 0) {
+                printk(" failed!\n");
                 return ret;
+        }
+
+        if (reg_debug)
+                printk("%02x\n", (unsigned char) val);
 
         return val;
 }
@@ -130,19 +148,13 @@ int em28xx_write_regs_req(struct em28xx *dev, u8 req, u16 reg, char *buf,
 {
         int ret;
 
-        /*usb_control_msg seems to expect a kmalloced buffer */
-        unsigned char *bufs;
-
         if (dev->state & DEV_DISCONNECTED)
                 return -ENODEV;
 
-        if (len < 1)
+        if ((len < 1) || (len > URB_MAX_CTRL_SIZE))
                 return -EINVAL;
 
-        bufs = kmalloc(len, GFP_KERNEL);
-
         em28xx_regdbg("req=%02x reg=%02x:", req, reg);
-
         if (reg_debug) {
                 int i;
                 for (i = 0; i < len; ++i)
@@ -150,16 +162,16 @@ int em28xx_write_regs_req(struct em28xx *dev, u8 req, u16 reg, char *buf,
                 printk("\n");
         }
 
-        if (!bufs)
-                return -ENOMEM;
-        memcpy(bufs, buf, len);
+        mutex_lock(&dev->ctrl_urb_lock);
+        memcpy(dev->urb_buf, buf, len);
         ret = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), req,
                               USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                              0x0000, reg, bufs, len, HZ);
+                              0x0000, reg, dev->urb_buf, len, HZ);
+        mutex_unlock(&dev->ctrl_urb_lock);
+
         if (dev->wait_after_write)
                 msleep(dev->wait_after_write);
 
-        kfree(bufs);
         return ret;
 }
 
@@ -270,6 +282,8 @@ static int em28xx_set_audio_source(struct em28xx *dev)
                         break;
                 case EM28XX_AMUX_LINE_IN:
                         input = EM28XX_AUDIO_SRC_LINE;
+                        video = disable;
+                        line  = enable;
                         break;
                 case EM28XX_AMUX_AC97_VIDEO:
                         input = EM28XX_AUDIO_SRC_LINE;
diff --git a/drivers/media/video/em28xx/em28xx-i2c.c b/drivers/media/video/em28xx/em28xx-i2c.c
index 3bab56b997fc..2360c61ddca9 100644
--- a/drivers/media/video/em28xx/em28xx-i2c.c
+++ b/drivers/media/video/em28xx/em28xx-i2c.c
@@ -337,9 +337,9 @@ static int em28xx_i2c_eeprom(struct em28xx *dev, unsigned char *eedata, int len)
         /* Check if board has eeprom */
         err = i2c_master_recv(&dev->i2c_client, &buf, 0);
         if (err < 0) {
-                em28xx_errdev("%s: i2c_master_recv failed! err [%d]\n",
-                        __func__, err);
-                return err;
+                em28xx_errdev("board has no eeprom\n");
+                memset(eedata, 0, len);
+                return -ENODEV;
         }
 
         buf = 0;
@@ -609,14 +609,16 @@ int em28xx_i2c_register(struct em28xx *dev)
         dev->i2c_client.adapter = &dev->i2c_adap;
 
         retval = em28xx_i2c_eeprom(dev, dev->eedata, sizeof(dev->eedata));
-        if (retval < 0) {
+        if ((retval < 0) && (retval != -ENODEV)) {
                 em28xx_errdev("%s: em28xx_i2_eeprom failed! retval [%d]\n",
                         __func__, retval);
+
                 return retval;
         }
 
         if (i2c_scan)
                 em28xx_do_i2c_scan(dev);
+
         return 0;
 }
 
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index a1ab2ef45578..610f535a257c 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -73,6 +73,7 @@ MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
 
 static LIST_HEAD(em28xx_devlist);
+static DEFINE_MUTEX(em28xx_devlist_mutex);
 
 static unsigned int card[]     = {[0 ... (EM28XX_MAXBOARDS - 1)] = UNSET };
 static unsigned int video_nr[] = {[0 ... (EM28XX_MAXBOARDS - 1)] = UNSET };
@@ -1519,7 +1520,7 @@ static int em28xx_v4l2_open(struct inode *inode, struct file *filp)
         struct em28xx_fh *fh;
         enum v4l2_buf_type fh_type = 0;
 
-        lock_kernel();
+        mutex_lock(&em28xx_devlist_mutex);
         list_for_each_entry(h, &em28xx_devlist, devlist) {
                 if (h->vdev->minor == minor) {
                         dev  = h;
@@ -1535,10 +1536,11 @@ static int em28xx_v4l2_open(struct inode *inode, struct file *filp)
                         dev   = h;
                 }
         }
-        if (NULL == dev) {
-                unlock_kernel();
+        mutex_unlock(&em28xx_devlist_mutex);
+        if (NULL == dev)
                 return -ENODEV;
-        }
+
+        mutex_lock(&dev->lock);
 
         em28xx_videodbg("open minor=%d type=%s users=%d\n",
                                 minor, v4l2_type_names[fh_type], dev->users);
@@ -1547,10 +1549,9 @@ static int em28xx_v4l2_open(struct inode *inode, struct file *filp)
         fh = kzalloc(sizeof(struct em28xx_fh), GFP_KERNEL);
         if (!fh) {
                 em28xx_errdev("em28xx-video.c: Out of memory?!\n");
-                unlock_kernel();
+                mutex_unlock(&dev->lock);
                 return -ENOMEM;
         }
-        mutex_lock(&dev->lock);
         fh->dev = dev;
         fh->radio = radio;
         fh->type = fh_type;
@@ -1584,7 +1585,6 @@ static int em28xx_v4l2_open(struct inode *inode, struct file *filp)
                         sizeof(struct em28xx_buffer), fh);
 
         mutex_unlock(&dev->lock);
-        unlock_kernel();
 
         return errCode;
 }
@@ -1871,6 +1871,7 @@ int em28xx_register_extension(struct em28xx_ops *ops)
 {
         struct em28xx *dev = NULL;
 
+        mutex_lock(&em28xx_devlist_mutex);
         mutex_lock(&em28xx_extension_devlist_lock);
         list_add_tail(&ops->next, &em28xx_extension_devlist);
         list_for_each_entry(dev, &em28xx_devlist, devlist) {
@@ -1879,6 +1880,7 @@ int em28xx_register_extension(struct em28xx_ops *ops)
         }
         printk(KERN_INFO "Em28xx: Initialized (%s) extension\n", ops->name);
         mutex_unlock(&em28xx_extension_devlist_lock);
+        mutex_unlock(&em28xx_devlist_mutex);
         return 0;
 }
 EXPORT_SYMBOL(em28xx_register_extension);
@@ -1887,6 +1889,7 @@ void em28xx_unregister_extension(struct em28xx_ops *ops)
 {
         struct em28xx *dev = NULL;
 
+        mutex_lock(&em28xx_devlist_mutex);
         list_for_each_entry(dev, &em28xx_devlist, devlist) {
                 if (dev)
                         ops->fini(dev);
@@ -1896,6 +1899,7 @@ void em28xx_unregister_extension(struct em28xx_ops *ops)
         printk(KERN_INFO "Em28xx: Removed (%s) extension\n", ops->name);
         list_del(&ops->next);
         mutex_unlock(&em28xx_extension_devlist_lock);
+        mutex_unlock(&em28xx_devlist_mutex);
 }
 EXPORT_SYMBOL(em28xx_unregister_extension);
 
@@ -1921,6 +1925,60 @@ static struct video_device *em28xx_vdev_init(struct em28xx *dev,
 }
 
 
+static int register_analog_devices(struct em28xx *dev)
+{
+        int ret;
+
+        /* allocate and fill video video_device struct */
+        dev->vdev = em28xx_vdev_init(dev, &em28xx_video_template, "video");
+        if (!dev->vdev) {
+                em28xx_errdev("cannot allocate video_device.\n");
+                return -ENODEV;
+        }
+
+        /* register v4l2 video video_device */
+        ret = video_register_device(dev->vdev, VFL_TYPE_GRABBER,
+                                       video_nr[dev->devno]);
+        if (ret) {
+                em28xx_errdev("unable to register video device (error=%i).\n",
+                              ret);
+                return ret;
+        }
+
+        /* Allocate and fill vbi video_device struct */
+        dev->vbi_dev = em28xx_vdev_init(dev, &em28xx_video_template, "vbi");
+
+        /* register v4l2 vbi video_device */
+        ret = video_register_device(dev->vbi_dev, VFL_TYPE_VBI,
+                                        vbi_nr[dev->devno]);
+        if (ret < 0) {
+                em28xx_errdev("unable to register vbi device\n");
+                return ret;
+        }
+
+        if (em28xx_boards[dev->model].radio.type == EM28XX_RADIO) {
+                dev->radio_dev = em28xx_vdev_init(dev, &em28xx_radio_template, "radio");
+                if (!dev->radio_dev) {
+                        em28xx_errdev("cannot allocate video_device.\n");
+                        return -ENODEV;
+                }
+                ret = video_register_device(dev->radio_dev, VFL_TYPE_RADIO,
+                                            radio_nr[dev->devno]);
+                if (ret < 0) {
+                        em28xx_errdev("can't register radio device\n");
+                        return ret;
+                }
+                em28xx_info("Registered radio device as /dev/radio%d\n",
+                            dev->radio_dev->num);
+        }
+
+        em28xx_info("V4L2 device registered as /dev/video%d and /dev/vbi%d\n",
+                                dev->vdev->num, dev->vbi_dev->num);
+
+        return 0;
+}
+
+
 /*
  * em28xx_init_dev()
  * allocates and inits the device structs, registers i2c bus and v4l device
@@ -1936,6 +1994,7 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
 
         dev->udev = udev;
         mutex_init(&dev->lock);
+        mutex_init(&dev->ctrl_urb_lock);
         spin_lock_init(&dev->slock);
         init_waitqueue_head(&dev->open);
         init_waitqueue_head(&dev->wait_frame);
@@ -1953,8 +2012,6 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
         errCode = em28xx_config(dev);
         if (errCode) {
                 em28xx_errdev("error configuring device\n");
-                em28xx_devused &= ~(1<<dev->devno);
-                kfree(dev);
                 return -ENOMEM;
         }
 
@@ -2001,50 +2058,6 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
                 return errCode;
         }
 
-        list_add_tail(&dev->devlist, &em28xx_devlist);
-
-        /* allocate and fill video video_device struct */
-        dev->vdev = em28xx_vdev_init(dev, &em28xx_video_template, "video");
-        if (NULL == dev->vdev) {
-                em28xx_errdev("cannot allocate video_device.\n");
-                goto fail_unreg;
-        }
-
-        /* register v4l2 video video_device */
-        retval = video_register_device(dev->vdev, VFL_TYPE_GRABBER,
-                                       video_nr[dev->devno]);
-        if (retval) {
-                em28xx_errdev("unable to register video device (error=%i).\n",
-                              retval);
-                goto fail_unreg;
-        }
-
-        /* Allocate and fill vbi video_device struct */
-        dev->vbi_dev = em28xx_vdev_init(dev, &em28xx_video_template, "vbi");
-        /* register v4l2 vbi video_device */
-        if (video_register_device(dev->vbi_dev, VFL_TYPE_VBI,
-                                        vbi_nr[dev->devno]) < 0) {
-                em28xx_errdev("unable to register vbi device\n");
-                retval = -ENODEV;
-                goto fail_unreg;
-        }
-
-        if (em28xx_boards[dev->model].radio.type == EM28XX_RADIO) {
-                dev->radio_dev = em28xx_vdev_init(dev, &em28xx_radio_template, "radio");
-                if (NULL == dev->radio_dev) {
-                        em28xx_errdev("cannot allocate video_device.\n");
-                        goto fail_unreg;
-                }
-                retval = video_register_device(dev->radio_dev, VFL_TYPE_RADIO,
-                                            radio_nr[dev->devno]);
-                if (retval < 0) {
-                        em28xx_errdev("can't register radio device\n");
-                        goto fail_unreg;
-                }
-                em28xx_info("Registered radio device as /dev/radio%d\n",
-                            dev->radio_dev->num);
-        }
-
         /* init video dma queues */
         INIT_LIST_HEAD(&dev->vidq.active);
         INIT_LIST_HEAD(&dev->vidq.queued);
@@ -2071,8 +2084,14 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
 
         video_mux(dev, 0);
 
-        em28xx_info("V4L2 device registered as /dev/video%d and /dev/vbi%d\n",
-                                dev->vdev->num, dev->vbi_dev->num);
+        mutex_lock(&em28xx_devlist_mutex);
+        list_add_tail(&dev->devlist, &em28xx_devlist);
+        retval = register_analog_devices(dev);
+        if (retval < 0) {
+                em28xx_release_resources(dev);
+                mutex_unlock(&em28xx_devlist_mutex);
+                goto fail_reg_devices;
+        }
 
         mutex_lock(&em28xx_extension_devlist_lock);
         if (!list_empty(&em28xx_extension_devlist)) {
@@ -2082,13 +2101,12 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
                 }
         }
         mutex_unlock(&em28xx_extension_devlist_lock);
+        mutex_unlock(&em28xx_devlist_mutex);
 
         return 0;
 
-fail_unreg:
-        em28xx_release_resources(dev);
+fail_reg_devices:
         mutex_unlock(&dev->lock);
-        kfree(dev);
         return retval;
 }
 
@@ -2231,8 +2249,12 @@ static int em28xx_usb_probe(struct usb_interface *interface,
 
         /* allocate device struct */
         retval = em28xx_init_dev(&dev, udev, nr);
-        if (retval)
+        if (retval) {
+                em28xx_devused &= ~(1<<dev->devno);
+                kfree(dev);
+
                 return retval;
+        }
 
         em28xx_info("Found %s\n", em28xx_boards[dev->model].name);
 
diff --git a/drivers/media/video/em28xx/em28xx.h b/drivers/media/video/em28xx/em28xx.h
index 82781178e0a3..5956e9b3062f 100644
--- a/drivers/media/video/em28xx/em28xx.h
+++ b/drivers/media/video/em28xx/em28xx.h
@@ -102,6 +102,9 @@
 #define EM28XX_MIN_BUF 4
 #define EM28XX_DEF_BUF 8
 
+/*Limits the max URB message size */
+#define URB_MAX_CTRL_SIZE 80
+
 /* Params for validated field */
 #define EM28XX_BOARD_NOT_VALIDATED 1
 #define EM28XX_BOARD_VALIDATED     0
@@ -430,6 +433,7 @@ struct em28xx {
 
         /* locks */
         struct mutex lock;
+        struct mutex ctrl_urb_lock;     /* protects urb_buf */
         /* spinlock_t queue_lock; */
         struct list_head inqueue, outqueue;
         wait_queue_head_t open, wait_frame, wait_stream;
@@ -451,6 +455,8 @@ struct em28xx {
         unsigned int *alt_max_pkt_size; /* array of wMaxPacketSize */
         struct urb *urb[EM28XX_NUM_BUFS];       /* urb for isoc transfers */
         char *transfer_buffer[EM28XX_NUM_BUFS]; /* transfer buffers for isoc transfer */
+        char urb_buf[URB_MAX_CTRL_SIZE];        /* urb control msg buffer */
+
         /* helper funcs that call usb_control_msg */
         int (*em28xx_write_regs) (struct em28xx *dev, u16 reg,
                                         char *buf, int len);
diff --git a/drivers/media/video/gspca/Kconfig b/drivers/media/video/gspca/Kconfig
index 4d0817471c9f..6b557c057fac 100644
--- a/drivers/media/video/gspca/Kconfig
+++ b/drivers/media/video/gspca/Kconfig
@@ -3,16 +3,16 @@ menuconfig USB_GSPCA
         depends on VIDEO_V4L2
         default m
         ---help---
-        Say Y here if you want to enable selecting webcams based
-        on the GSPCA framework.
+          Say Y here if you want to enable selecting webcams based
+          on the GSPCA framework.
 
-        See <file:Documentation/video4linux/gspca.txt> for more info.
+          See <file:Documentation/video4linux/gspca.txt> for more info.
 
-        This driver uses the Video For Linux API. You must say Y or M to
-        "Video For Linux" to use this driver.
+          This driver uses the Video For Linux API. You must say Y or M to
+          "Video For Linux" to use this driver.
 
-        To compile this driver as modules, choose M here: the
-        modules will be called gspca_main.
+          To compile this driver as modules, choose M here: the
+          modules will be called gspca_main.
 
 
 if USB_GSPCA && VIDEO_V4L2
@@ -23,190 +23,190 @@ config USB_GSPCA_CONEX
         tristate "Conexant Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the Conexant chip.
+          Say Y here if you want support for cameras based on the Conexant chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_conex.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_conex.
 
 config USB_GSPCA_ETOMS
         tristate "Etoms USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the Etoms chip.
+          Say Y here if you want support for cameras based on the Etoms chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_etoms.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_etoms.
 
 config USB_GSPCA_FINEPIX
         tristate "Fujifilm FinePix USB V4L2 driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the FinePix chip.
+          Say Y here if you want support for cameras based on the FinePix chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_finepix.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_finepix.
 
 config USB_GSPCA_MARS
         tristate "Mars USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the Mars chip.
+          Say Y here if you want support for cameras based on the Mars chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_mars.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_mars.
 
 config USB_GSPCA_OV519
         tristate "OV519 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the OV519 chip.
+          Say Y here if you want support for cameras based on the OV519 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_ov519.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_ov519.
 
 config USB_GSPCA_PAC207
         tristate "Pixart PAC207 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the PAC207 chip.
+          Say Y here if you want support for cameras based on the PAC207 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_pac207.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_pac207.
 
 config USB_GSPCA_PAC7311
         tristate "Pixart PAC7311 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the PAC7311 chip.
+          Say Y here if you want support for cameras based on the PAC7311 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_pac7311.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_pac7311.
 
 config USB_GSPCA_SONIXB
         tristate "SN9C102 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the SONIXB chip.
+          Say Y here if you want support for cameras based on the SONIXB chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_sonixb.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_sonixb.
 
 config USB_GSPCA_SONIXJ
         tristate "SONIX JPEG USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the SONIXJ chip.
+          Say Y here if you want support for cameras based on the SONIXJ chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_sonixj
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_sonixj
 
 config USB_GSPCA_SPCA500
         tristate "SPCA500 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the SPCA500 chip.
+          Say Y here if you want support for cameras based on the SPCA500 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_spca500.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_spca500.
 
 config USB_GSPCA_SPCA501
         tristate "SPCA501 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the SPCA501 chip.
+          Say Y here if you want support for cameras based on the SPCA501 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_spca501.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_spca501.
 
 config USB_GSPCA_SPCA505
         tristate "SPCA505 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the SPCA505 chip.
+          Say Y here if you want support for cameras based on the SPCA505 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_spca505.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_spca505.
 
 config USB_GSPCA_SPCA506
         tristate "SPCA506 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the SPCA506 chip.
+          Say Y here if you want support for cameras based on the SPCA506 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_spca506.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_spca506.
 
 config USB_GSPCA_SPCA508
         tristate "SPCA508 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the SPCA508 chip.
+          Say Y here if you want support for cameras based on the SPCA508 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_spca508.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_spca508.
 
 config USB_GSPCA_SPCA561
         tristate "SPCA561 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the SPCA561 chip.
+          Say Y here if you want support for cameras based on the SPCA561 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_spca561.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_spca561.
 
 config USB_GSPCA_STK014
         tristate "Syntek DV4000 (STK014) USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the STK014 chip.
+          Say Y here if you want support for cameras based on the STK014 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_stk014.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_stk014.
 
 config USB_GSPCA_SUNPLUS
         tristate "SUNPLUS USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the Sunplus
-        SPCA504(abc) SPCA533 SPCA536 chips.
+          Say Y here if you want support for cameras based on the Sunplus
+          SPCA504(abc) SPCA533 SPCA536 chips.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_spca5xx.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_spca5xx.
 
 config USB_GSPCA_T613
         tristate "T613 (JPEG Compliance) USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the T613 chip.
+          Say Y here if you want support for cameras based on the T613 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_t613.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_t613.
 
 config USB_GSPCA_TV8532
         tristate "TV8532 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the TV8531 chip.
+          Say Y here if you want support for cameras based on the TV8531 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_tv8532.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_tv8532.
 
 config USB_GSPCA_VC032X
         tristate "VC032X USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the VC032X chip.
+          Say Y here if you want support for cameras based on the VC032X chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_vc032x.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_vc032x.
 
 config USB_GSPCA_ZC3XX
-        tristate "VC3xx USB Camera Driver"
+        tristate "ZC3XX USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the ZC3XX chip.
+          Say Y here if you want support for cameras based on the ZC3XX chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_zc3xx.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_zc3xx.
 
 endif
diff --git a/drivers/media/video/gspca/conex.c b/drivers/media/video/gspca/conex.c
index a9d51ba7c57c..de28354ea5ba 100644
--- a/drivers/media/video/gspca/conex.c
+++ b/drivers/media/video/gspca/conex.c
@@ -846,10 +846,13 @@ static int sd_start(struct gspca_dev *gspca_dev)
         return 0;
 }
 
+/* called on streamoff with alt 0 and on disconnect */
 static void sd_stop0(struct gspca_dev *gspca_dev)
 {
         int retry = 50;
 
+        if (!gspca_dev->present)
+                return;
         reg_w_val(gspca_dev, 0x0000, 0x00);
         reg_r(gspca_dev, 0x0002, 1);
         reg_w_val(gspca_dev, 0x0053, 0x00);
diff --git a/drivers/media/video/gspca/finepix.c b/drivers/media/video/gspca/finepix.c
index 65d3cbfe6b27..607942fd7970 100644
--- a/drivers/media/video/gspca/finepix.c
+++ b/drivers/media/video/gspca/finepix.c
@@ -276,6 +276,12 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
         /* Stop the state machine */
         if (dev->state != FPIX_NOP)
                 wait_for_completion(&dev->can_close);
+}
+
+/* called on streamoff with alt 0 and disconnect */
+static void sd_stop0(struct gspca_dev *gspca_dev)
+{
+        struct usb_fpix *dev = (struct usb_fpix *) gspca_dev;
 
         usb_free_urb(dev->control_urb);
         dev->control_urb = NULL;
@@ -385,6 +391,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
 error:
         /* Free the ressources */
         sd_stopN(gspca_dev);
+        sd_stop0(gspca_dev);
         return ret;
 }
 
@@ -425,6 +432,7 @@ static const struct sd_desc sd_desc = {
         .init = sd_init,
         .start = sd_start,
         .stopN = sd_stopN,
+        .stop0 = sd_stop0,
 };
 
 /* -- device connect -- */
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index e48fbfc8ad05..748a87e82e44 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -646,15 +646,14 @@ static void gspca_stream_off(struct gspca_dev *gspca_dev)
 {
         gspca_dev->streaming = 0;
         atomic_set(&gspca_dev->nevent, 0);
-        if (gspca_dev->present) {
-                if (gspca_dev->sd_desc->stopN)
-                        gspca_dev->sd_desc->stopN(gspca_dev);
-                destroy_urbs(gspca_dev);
-                gspca_set_alt0(gspca_dev);
-                if (gspca_dev->sd_desc->stop0)
-                        gspca_dev->sd_desc->stop0(gspca_dev);
-                PDEBUG(D_STREAM, "stream off OK");
-        }
+        if (gspca_dev->present
+            && gspca_dev->sd_desc->stopN)
+                gspca_dev->sd_desc->stopN(gspca_dev);
+        destroy_urbs(gspca_dev);
+        gspca_set_alt0(gspca_dev);
+        if (gspca_dev->sd_desc->stop0)
+                gspca_dev->sd_desc->stop0(gspca_dev);
+        PDEBUG(D_STREAM, "stream off OK");
 }
 
 static void gspca_set_default_mode(struct gspca_dev *gspca_dev)
@@ -863,7 +862,7 @@ static int dev_open(struct inode *inode, struct file *file)
         int ret;
 
         PDEBUG(D_STREAM, "%s open", current->comm);
-        gspca_dev = (struct gspca_dev *) video_devdata(file);
+        gspca_dev = video_drvdata(file);
         if (mutex_lock_interruptible(&gspca_dev->queue_lock))
                 return -ERESTARTSYS;
         if (!gspca_dev->present) {
@@ -875,6 +874,13 @@ static int dev_open(struct inode *inode, struct file *file)
                 ret = -EBUSY;
                 goto out;
         }
+
+        /* protect the subdriver against rmmod */
+        if (!try_module_get(gspca_dev->module)) {
+                ret = -ENODEV;
+                goto out;
+        }
+
         gspca_dev->users++;
 
         /* one more user */
@@ -884,10 +890,10 @@ static int dev_open(struct inode *inode, struct file *file)
 #ifdef GSPCA_DEBUG
         /* activate the v4l2 debug */
         if (gspca_debug & D_V4L2)
-                gspca_dev->vdev.debug |= V4L2_DEBUG_IOCTL
+                gspca_dev->vdev->debug |= V4L2_DEBUG_IOCTL
                                         | V4L2_DEBUG_IOCTL_ARG;
         else
-                gspca_dev->vdev.debug &= ~(V4L2_DEBUG_IOCTL
+                gspca_dev->vdev->debug &= ~(V4L2_DEBUG_IOCTL
                                         | V4L2_DEBUG_IOCTL_ARG);
 #endif
         ret = 0;
@@ -921,6 +927,7 @@ static int dev_close(struct inode *inode, struct file *file)
                 gspca_dev->memory = GSPCA_MEMORY_NO;
         }
         file->private_data = NULL;
+        module_put(gspca_dev->module);
         mutex_unlock(&gspca_dev->queue_lock);
 
         PDEBUG(D_STREAM, "close done");
@@ -1748,11 +1755,6 @@ out:
         return ret;
 }
 
-static void dev_release(struct video_device *vfd)
-{
-        /* nothing */
-}
-
 static struct file_operations dev_fops = {
         .owner = THIS_MODULE,
         .open = dev_open,
@@ -1800,7 +1802,7 @@ static struct video_device gspca_template = {
         .name = "gspca main driver",
         .fops = &dev_fops,
         .ioctl_ops = &dev_ioctl_ops,
-        .release = dev_release,         /* mandatory */
+        .release = video_device_release,
         .minor = -1,
 };
 
@@ -1869,17 +1871,18 @@ int gspca_dev_probe(struct usb_interface *intf,
         init_waitqueue_head(&gspca_dev->wq);
 
         /* init video stuff */
-        memcpy(&gspca_dev->vdev, &gspca_template, sizeof gspca_template);
-        gspca_dev->vdev.parent = &dev->dev;
-        memcpy(&gspca_dev->fops, &dev_fops, sizeof gspca_dev->fops);
-        gspca_dev->vdev.fops = &gspca_dev->fops;
-        gspca_dev->fops.owner = module;         /* module protection */
+        gspca_dev->vdev = video_device_alloc();
+        memcpy(gspca_dev->vdev, &gspca_template, sizeof gspca_template);
+        gspca_dev->vdev->parent = &dev->dev;
+        gspca_dev->module = module;
         gspca_dev->present = 1;
-        ret = video_register_device(&gspca_dev->vdev,
+        video_set_drvdata(gspca_dev->vdev, gspca_dev);
+        ret = video_register_device(gspca_dev->vdev,
                                   VFL_TYPE_GRABBER,
                                   video_nr);
         if (ret < 0) {
                 err("video_register_device err %d", ret);
+                video_device_release(gspca_dev->vdev);
                 goto out;
         }
 
@@ -1887,7 +1890,8 @@ int gspca_dev_probe(struct usb_interface *intf,
         PDEBUG(D_PROBE, "probe ok");
         return 0;
 out:
-        kref_put(&gspca_dev->kref, gspca_delete);
+        kfree(gspca_dev->usb_buf);
+        kfree(gspca_dev);
         return ret;
 }
 EXPORT_SYMBOL(gspca_dev_probe);
@@ -1905,7 +1909,7 @@ void gspca_disconnect(struct usb_interface *intf)
         usb_set_intfdata(intf, NULL);
 
 /* We don't want people trying to open up the device */
-        video_unregister_device(&gspca_dev->vdev);
+        video_unregister_device(gspca_dev->vdev);
 
         gspca_dev->present = 0;
         gspca_dev->streaming = 0;
diff --git a/drivers/media/video/gspca/gspca.h b/drivers/media/video/gspca/gspca.h
index 1d9dc90b4791..d25e8d69373b 100644
--- a/drivers/media/video/gspca/gspca.h
+++ b/drivers/media/video/gspca/gspca.h
@@ -97,7 +97,7 @@ struct sd_desc {
         cam_pkt_op pkt_scan;
 /* optional operations */
         cam_v_op stopN;         /* called on stream off - main alt */
-        cam_v_op stop0;         /* called on stream off - alt 0 */
+        cam_v_op stop0;         /* called on stream off & disconnect - alt 0 */
         cam_v_op dq_callback;   /* called when a frame has been dequeued */
         cam_jpg_op get_jcomp;
         cam_jpg_op set_jcomp;
@@ -120,8 +120,8 @@ struct gspca_frame {
 };
 
 struct gspca_dev {
-        struct video_device vdev;       /* !! must be the first item */
-        struct file_operations fops;
+        struct video_device *vdev;
+        struct module *module;          /* subdriver handling the device */
         struct usb_device *dev;
         struct kref kref;
         struct file *capt_file;         /* file doing video capture */
diff --git a/drivers/media/video/gspca/pac7311.c b/drivers/media/video/gspca/pac7311.c
index e5ff9a6199ef..fbd45e235d97 100644
--- a/drivers/media/video/gspca/pac7311.c
+++ b/drivers/media/video/gspca/pac7311.c
@@ -749,10 +749,13 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
         reg_w(gspca_dev, 0x78, 0x44); /* Bit_0=start stream, Bit_6=LED */
 }
 
+/* called on streamoff with alt 0 and on disconnect */
 static void sd_stop0(struct gspca_dev *gspca_dev)
 {
         struct sd *sd = (struct sd *) gspca_dev;
 
+        if (!gspca_dev->present)
+                return;
         if (sd->sensor == SENSOR_PAC7302) {
                 reg_w(gspca_dev, 0xff, 0x01);
                 reg_w(gspca_dev, 0x78, 0x40);
diff --git a/drivers/media/video/gspca/spca501.c b/drivers/media/video/gspca/spca501.c
index b742f260c7ca..e29954c1c38c 100644
--- a/drivers/media/video/gspca/spca501.c
+++ b/drivers/media/video/gspca/spca501.c
@@ -2022,8 +2022,11 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
         reg_write(gspca_dev->dev, SPCA501_REG_CTLRL, 0x01, 0x00);
 }
 
+/* called on streamoff with alt 0 and on disconnect */
 static void sd_stop0(struct gspca_dev *gspca_dev)
 {
+        if (!gspca_dev->present)
+                return;
         reg_write(gspca_dev->dev, SPCA501_REG_CTLRL, 0x05, 0x00);
 }
 
diff --git a/drivers/media/video/gspca/spca505.c b/drivers/media/video/gspca/spca505.c
index b345749213cf..895b9fe4018c 100644
--- a/drivers/media/video/gspca/spca505.c
+++ b/drivers/media/video/gspca/spca505.c
@@ -742,8 +742,12 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
         reg_write(gspca_dev->dev, 0x02, 0x00, 0x00);
 }
 
+/* called on streamoff with alt 0 and on disconnect */
 static void sd_stop0(struct gspca_dev *gspca_dev)
 {
+        if (!gspca_dev->present)
+                return;
+
         /* This maybe reset or power control */
         reg_write(gspca_dev->dev, 0x03, 0x03, 0x20);
         reg_write(gspca_dev->dev, 0x03, 0x01, 0x0);
diff --git a/drivers/media/video/gspca/spca561.c b/drivers/media/video/gspca/spca561.c
index 020a03c466c1..c3de4e44123d 100644
--- a/drivers/media/video/gspca/spca561.c
+++ b/drivers/media/video/gspca/spca561.c
@@ -766,10 +766,13 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
         }
 }
 
+/* called on streamoff with alt 0 and on disconnect */
 static void sd_stop0(struct gspca_dev *gspca_dev)
 {
         struct sd *sd = (struct sd *) gspca_dev;
 
+        if (!gspca_dev->present)
+                return;
         if (sd->chip_revision == Rev012A) {
                 reg_w_val(gspca_dev->dev, 0x8118, 0x29);
                 reg_w_val(gspca_dev->dev, 0x8114, 0x08);
diff --git a/drivers/media/video/gspca/vc032x.c b/drivers/media/video/gspca/vc032x.c
index be46d9232540..17af353ddd1c 100644
--- a/drivers/media/video/gspca/vc032x.c
+++ b/drivers/media/video/gspca/vc032x.c
@@ -1633,10 +1633,13 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
         reg_w(dev, 0xa0, 0x09, 0xb003);
 }
 
+/* called on streamoff with alt 0 and on disconnect */
 static void sd_stop0(struct gspca_dev *gspca_dev)
 {
         struct usb_device *dev = gspca_dev->dev;
 
+        if (!gspca_dev->present)
+                return;
         reg_w(dev, 0x89, 0xffff, 0xffff);
 }
 
diff --git a/drivers/media/video/gspca/zc3xx.c b/drivers/media/video/gspca/zc3xx.c
index d0a4451dc46f..0befacf49855 100644
--- a/drivers/media/video/gspca/zc3xx.c
+++ b/drivers/media/video/gspca/zc3xx.c
@@ -2266,7 +2266,7 @@ static const struct usb_action hdcs2020b_NoFliker[] = {
         {}
 };
 
-static const struct usb_action hv7131bxx_Initial[] = {
+static const struct usb_action hv7131bxx_Initial[] = {          /* 320x240 */
         {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
         {0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},
         {0xa0, 0x00, ZC3XX_R010_CMOSSENSORSELECT},
@@ -2290,7 +2290,7 @@ static const struct usb_action hv7131bxx_Initial[] = {
         {0xaa, 0x14, 0x0001},
         {0xaa, 0x15, 0x00e8},
         {0xaa, 0x16, 0x0002},
-        {0xaa, 0x17, 0x0086},
+        {0xaa, 0x17, 0x0086},           /* 00,17,88,aa */
         {0xaa, 0x31, 0x0038},
         {0xaa, 0x32, 0x0038},
         {0xaa, 0x33, 0x0038},
@@ -2309,7 +2309,7 @@ static const struct usb_action hv7131bxx_Initial[] = {
         {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
         {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
         {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
-        {0xaa, 0x02, 0x0080},   /* {0xaa, 0x02, 0x0090}; */
+        {0xaa, 0x02, 0x0090},                   /* 00,02,80,aa */
         {0xa1, 0x01, 0x0002},
         {0xa0, 0x00, ZC3XX_R092_I2CADDRESSSELECT},
         {0xa0, 0x02, ZC3XX_R090_I2CCOMMAND},
@@ -2374,7 +2374,7 @@ static const struct usb_action hv7131bxx_Initial[] = {
         {}
 };
 
-static const struct usb_action hv7131bxx_InitialScale[] = {
+static const struct usb_action hv7131bxx_InitialScale[] = {     /* 640x480*/
         {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
         {0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},
         {0xa0, 0x00, ZC3XX_R010_CMOSSENSORSELECT},
@@ -6388,6 +6388,8 @@ static void setbrightness(struct gspca_dev *gspca_dev)
 /*fixme: is it really write to 011d and 018d for all other sensors? */
         brightness = sd->brightness;
         reg_w(gspca_dev->dev, brightness, 0x011d);
+        if (sd->sensor == SENSOR_HV7131B)
+                return;
         if (brightness < 0x70)
                 brightness += 0x10;
         else
@@ -6529,6 +6531,7 @@ static void setquality(struct gspca_dev *gspca_dev)
 
         switch (sd->sensor) {
         case SENSOR_GC0305:
+        case SENSOR_HV7131B:
         case SENSOR_OV7620:
         case SENSOR_PO2030:
                 return;
@@ -7209,7 +7212,6 @@ static int sd_start(struct gspca_dev *gspca_dev)
         mode = gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].priv;
         zc3_init = init_tb[(int) sd->sensor][mode];
         switch (sd->sensor) {
-        case SENSOR_HV7131B:
         case SENSOR_HV7131C:
                 zcxx_probeSensor(gspca_dev);
                 break;
@@ -7334,10 +7336,13 @@ static int sd_start(struct gspca_dev *gspca_dev)
         return 0;
 }
 
+/* called on streamoff with alt 0 and on disconnect */
 static void sd_stop0(struct gspca_dev *gspca_dev)
 {
         struct sd *sd = (struct sd *) gspca_dev;
 
+        if (!gspca_dev->present)
+                return;
         send_unknown(gspca_dev->dev, sd->sensor);
 }
 
diff --git a/drivers/media/video/ivtv/Kconfig b/drivers/media/video/ivtv/Kconfig
index 0069898bddab..c46bfb1569e3 100644
--- a/drivers/media/video/ivtv/Kconfig
+++ b/drivers/media/video/ivtv/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_IVTV
         tristate "Conexant cx23416/cx23415 MPEG encoder/decoder support"
-        depends on VIDEO_V4L1 && VIDEO_V4L2 && PCI && I2C && EXPERIMENTAL
+        depends on VIDEO_V4L2 && PCI && I2C
         depends on INPUT   # due to VIDEO_IR
         select I2C_ALGOBIT
         select VIDEO_IR
@@ -12,7 +12,6 @@ config VIDEO_IVTV
         select VIDEO_SAA711X
         select VIDEO_SAA717X
         select VIDEO_SAA7127
-        select VIDEO_TVAUDIO
         select VIDEO_CS53L32A
         select VIDEO_M52790
         select VIDEO_WM8775
@@ -32,7 +31,7 @@ config VIDEO_IVTV
 
 config VIDEO_FB_IVTV
         tristate "Conexant cx23415 framebuffer support"
-        depends on VIDEO_IVTV && FB && EXPERIMENTAL
+        depends on VIDEO_IVTV && FB
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
diff --git a/drivers/media/video/ivtv/ivtv-driver.c b/drivers/media/video/ivtv/ivtv-driver.c
index d36485023b68..b69cc1d55e5b 100644
--- a/drivers/media/video/ivtv/ivtv-driver.c
+++ b/drivers/media/video/ivtv/ivtv-driver.c
@@ -875,43 +875,43 @@ static void ivtv_load_and_init_modules(struct ivtv *itv)
 
 #ifdef MODULE
         /* load modules */
-#ifndef CONFIG_MEDIA_TUNER
+#ifdef CONFIG_MEDIA_TUNER_MODULE
         hw = ivtv_request_module(itv, hw, "tuner", IVTV_HW_TUNER);
 #endif
-#ifndef CONFIG_VIDEO_CX25840
+#ifdef CONFIG_VIDEO_CX25840_MODULE
         hw = ivtv_request_module(itv, hw, "cx25840", IVTV_HW_CX25840);
 #endif
-#ifndef CONFIG_VIDEO_SAA711X
+#ifdef CONFIG_VIDEO_SAA711X_MODULE
         hw = ivtv_request_module(itv, hw, "saa7115", IVTV_HW_SAA711X);
 #endif
-#ifndef CONFIG_VIDEO_SAA7127
+#ifdef CONFIG_VIDEO_SAA7127_MODULE
         hw = ivtv_request_module(itv, hw, "saa7127", IVTV_HW_SAA7127);
 #endif
-#ifndef CONFIG_VIDEO_SAA717X
+#ifdef CONFIG_VIDEO_SAA717X_MODULE
         hw = ivtv_request_module(itv, hw, "saa717x", IVTV_HW_SAA717X);
 #endif
-#ifndef CONFIG_VIDEO_UPD64031A
+#ifdef CONFIG_VIDEO_UPD64031A_MODULE
         hw = ivtv_request_module(itv, hw, "upd64031a", IVTV_HW_UPD64031A);
 #endif
-#ifndef CONFIG_VIDEO_UPD64083
+#ifdef CONFIG_VIDEO_UPD64083_MODULE
         hw = ivtv_request_module(itv, hw, "upd64083", IVTV_HW_UPD6408X);
 #endif
-#ifndef CONFIG_VIDEO_MSP3400
+#ifdef CONFIG_VIDEO_MSP3400_MODULE
         hw = ivtv_request_module(itv, hw, "msp3400", IVTV_HW_MSP34XX);
 #endif
-#ifndef CONFIG_VIDEO_VP27SMPX
+#ifdef CONFIG_VIDEO_VP27SMPX_MODULE
         hw = ivtv_request_module(itv, hw, "vp27smpx", IVTV_HW_VP27SMPX);
 #endif
-#ifndef CONFIG_VIDEO_WM8775
+#ifdef CONFIG_VIDEO_WM8775_MODULE
         hw = ivtv_request_module(itv, hw, "wm8775", IVTV_HW_WM8775);
 #endif
-#ifndef CONFIG_VIDEO_WM8739
+#ifdef CONFIG_VIDEO_WM8739_MODULE
         hw = ivtv_request_module(itv, hw, "wm8739", IVTV_HW_WM8739);
 #endif
-#ifndef CONFIG_VIDEO_CS53L32A
+#ifdef CONFIG_VIDEO_CS53L32A_MODULE
         hw = ivtv_request_module(itv, hw, "cs53l32a", IVTV_HW_CS53L32A);
 #endif
-#ifndef CONFIG_VIDEO_M52790
+#ifdef CONFIG_VIDEO_M52790_MODULE
         hw = ivtv_request_module(itv, hw, "m52790", IVTV_HW_M52790);
 #endif
 #endif
diff --git a/drivers/media/video/s2255drv.c b/drivers/media/video/s2255drv.c
index 5272926db73e..3c3f8cf73108 100644
--- a/drivers/media/video/s2255drv.c
+++ b/drivers/media/video/s2255drv.c
@@ -192,7 +192,7 @@ struct s2255_dmaqueue {
 #define S2255_FW_FAILED         3
 #define S2255_FW_DISCONNECTING  4
 
-#define S2255_FW_MARKER         0x22552f2f
+#define S2255_FW_MARKER         cpu_to_le32(0x22552f2f)
 /* 2255 read states */
 #define S2255_READ_IDLE         0
 #define S2255_READ_FRAME        1
diff --git a/drivers/media/video/saa7110.c b/drivers/media/video/saa7110.c
index adf2ba79496a..37860698f782 100644
--- a/drivers/media/video/saa7110.c
+++ b/drivers/media/video/saa7110.c
@@ -47,7 +47,7 @@ module_param(debug, int, 0);
 MODULE_PARM_DESC(debug, "Debug level (0-1)");
 
 #define SAA7110_MAX_INPUT       9       /* 6 CVBS, 3 SVHS */
-#define SAA7110_MAX_OUTPUT      0       /* its a decoder only */
+#define SAA7110_MAX_OUTPUT      1       /* 1 YUV */
 
 #define SAA7110_NR_REG          0x35
 
@@ -327,7 +327,7 @@ saa7110_command (struct i2c_client *client,
 
         case DECODER_SET_INPUT:
                 v = *(int *) arg;
-                if (v < 0 || v > SAA7110_MAX_INPUT) {
+                if (v < 0 || v >= SAA7110_MAX_INPUT) {
                         v4l_dbg(1, debug, client, "input=%d not available\n", v);
                         return -EINVAL;
                 }
diff --git a/drivers/media/video/saa7134/saa7134-core.c b/drivers/media/video/saa7134/saa7134-core.c
index 249184452949..dfbe08a9ad9b 100644
--- a/drivers/media/video/saa7134/saa7134-core.c
+++ b/drivers/media/video/saa7134/saa7134-core.c
@@ -941,7 +941,8 @@ static int __devinit saa7134_initdev(struct pci_dev *pci_dev,
                        dev->name,(unsigned long long)pci_resource_start(pci_dev,0));
                 goto fail1;
         }
-        dev->lmmio = ioremap(pci_resource_start(pci_dev,0), 0x1000);
+        dev->lmmio = ioremap(pci_resource_start(pci_dev, 0),
+                             pci_resource_len(pci_dev, 0));
         dev->bmmio = (__u8 __iomem *)dev->lmmio;
         if (NULL == dev->lmmio) {
                 err = -EIO;
diff --git a/drivers/media/video/tvaudio.c b/drivers/media/video/tvaudio.c
index b59e47272abf..3720f0e03a16 100644
--- a/drivers/media/video/tvaudio.c
+++ b/drivers/media/video/tvaudio.c
@@ -1,5 +1,5 @@
 /*
- * experimental driver for simple i2c audio chips.
+ * Driver for simple i2c audio chips.
  *
  * Copyright (c) 2000 Gerd Knorr
  * based on code by:
@@ -7,6 +7,10 @@
  *   Steve VanDeBogart (vandebo@uclink.berkeley.edu)
  *   Greg Alexander (galexand@acm.org)
  *
+ * Copyright(c) 2005-2008 Mauro Carvalho Chehab
+ *      - Some cleanups, code fixes, etc
+ *      - Convert it to V4L2 API
+ *
  * This code is placed under the terms of the GNU General Public License
  *
  * OPTIONS:
@@ -30,6 +34,7 @@
 
 #include <media/tvaudio.h>
 #include <media/v4l2-common.h>
+#include <media/v4l2-ioctl.h>
 #include <media/v4l2-chip-ident.h>
 #include <media/v4l2-i2c-drv-legacy.h>
 
@@ -58,7 +63,6 @@ typedef int  (*checkit)(struct CHIPSTATE*);
 typedef int  (*initialize)(struct CHIPSTATE*);
 typedef int  (*getmode)(struct CHIPSTATE*);
 typedef void (*setmode)(struct CHIPSTATE*, int mode);
-typedef void (*checkmode)(struct CHIPSTATE*);
 
 /* i2c command */
 typedef struct AUDIOCMD {
@@ -79,6 +83,7 @@ struct CHIPDESC {
 #define CHIP_HAS_VOLUME      1
 #define CHIP_HAS_BASSTREBLE  2
 #define CHIP_HAS_INPUTSEL    4
+#define CHIP_NEED_CHECKMODE  8
 
         /* various i2c command sequences */
         audiocmd   init;
@@ -96,23 +101,20 @@ struct CHIPDESC {
         getmode  getmode;
         setmode  setmode;
 
-        /* check / autoswitch audio after channel switches */
-        checkmode  checkmode;
-
         /* input switch register + values for v4l inputs */
         int  inputreg;
         int  inputmap[4];
         int  inputmute;
         int  inputmask;
 };
-static struct CHIPDESC chiplist[];
 
 /* current state of the chip */
 struct CHIPSTATE {
         struct i2c_client *c;
 
-        /* index into CHIPDESC array */
-        int type;
+        /* chip-specific description - should point to
+           an entry at CHIPDESC table */
+        struct CHIPDESC *desc;
 
         /* shadow register set */
         audiocmd   shadow;
@@ -152,7 +154,7 @@ static int chip_write(struct CHIPSTATE *chip, int subaddr, int val)
 {
         unsigned char buffer[2];
 
-        if (-1 == subaddr) {
+        if (subaddr < 0) {
                 v4l_dbg(1, debug, chip->c, "%s: chip_write: 0x%x\n",
                         chip->c->name, val);
                 chip->shadow.bytes[1] = val;
@@ -163,6 +165,13 @@ static int chip_write(struct CHIPSTATE *chip, int subaddr, int val)
                         return -1;
                 }
         } else {
+                if (subaddr + 1 >= ARRAY_SIZE(chip->shadow.bytes)) {
+                        v4l_info(chip->c,
+                                "Tried to access a non-existent register: %d\n",
+                                subaddr);
+                        return -EINVAL;
+                }
+
                 v4l_dbg(1, debug, chip->c, "%s: chip_write: reg%d=0x%x\n",
                         chip->c->name, subaddr, val);
                 chip->shadow.bytes[subaddr+1] = val;
@@ -177,12 +186,20 @@ static int chip_write(struct CHIPSTATE *chip, int subaddr, int val)
         return 0;
 }
 
-static int chip_write_masked(struct CHIPSTATE *chip, int subaddr, int val, int mask)
+static int chip_write_masked(struct CHIPSTATE *chip,
+                             int subaddr, int val, int mask)
 {
         if (mask != 0) {
-                if (-1 == subaddr) {
+                if (subaddr < 0) {
                         val = (chip->shadow.bytes[1] & ~mask) | (val & mask);
                 } else {
+                        if (subaddr + 1 >= ARRAY_SIZE(chip->shadow.bytes)) {
+                                v4l_info(chip->c,
+                                        "Tried to access a non-existent register: %d\n",
+                                        subaddr);
+                                return -EINVAL;
+                        }
+
                         val = (chip->shadow.bytes[subaddr+1] & ~mask) | (val & mask);
                 }
         }
@@ -228,6 +245,15 @@ static int chip_cmd(struct CHIPSTATE *chip, char *name, audiocmd *cmd)
         if (0 == cmd->count)
                 return 0;
 
+        if (cmd->count + cmd->bytes[0] - 1 >= ARRAY_SIZE(chip->shadow.bytes)) {
+                v4l_info(chip->c,
+                         "Tried to access a non-existent register range: %d to %d\n",
+                         cmd->bytes[0] + 1, cmd->bytes[0] + cmd->count - 1);
+                return -EINVAL;
+        }
+
+        /* FIXME: it seems that the shadow bytes are wrong bellow !*/
+
         /* update our shadow register set; print bytes if (debug > 0) */
         v4l_dbg(1, debug, chip->c, "%s: chip_cmd(%s): reg=%d, data:",
                 chip->c->name, name,cmd->bytes[0]);
@@ -263,7 +289,8 @@ static void chip_thread_wake(unsigned long data)
 static int chip_thread(void *data)
 {
         struct CHIPSTATE *chip = data;
-        struct CHIPDESC  *desc = chiplist + chip->type;
+        struct CHIPDESC  *desc = chip->desc;
+        int mode;
 
         v4l_dbg(1, debug, chip->c, "%s: thread started\n", chip->c->name);
         set_freezable();
@@ -282,7 +309,26 @@ static int chip_thread(void *data)
                         continue;
 
                 /* have a look what's going on */
-                desc->checkmode(chip);
+                mode = desc->getmode(chip);
+                if (mode == chip->prevmode)
+                        continue;
+
+                /* chip detected a new audio mode - set it */
+                v4l_dbg(1, debug, chip->c, "%s: thread checkmode\n",
+                        chip->c->name);
+
+                chip->prevmode = mode;
+
+                if (mode & V4L2_TUNER_MODE_STEREO)
+                        desc->setmode(chip, V4L2_TUNER_MODE_STEREO);
+                if (mode & V4L2_TUNER_MODE_LANG1_LANG2)
+                        desc->setmode(chip, V4L2_TUNER_MODE_STEREO);
+                else if (mode & V4L2_TUNER_MODE_LANG1)
+                        desc->setmode(chip, V4L2_TUNER_MODE_LANG1);
+                else if (mode & V4L2_TUNER_MODE_LANG2)
+                        desc->setmode(chip, V4L2_TUNER_MODE_LANG2);
+                else
+                        desc->setmode(chip, V4L2_TUNER_MODE_MONO);
 
                 /* schedule next check */
                 mod_timer(&chip->wt, jiffies+msecs_to_jiffies(2000));
@@ -292,29 +338,6 @@ static int chip_thread(void *data)
         return 0;
 }
 
-static void generic_checkmode(struct CHIPSTATE *chip)
-{
-        struct CHIPDESC  *desc = chiplist + chip->type;
-        int mode = desc->getmode(chip);
-
-        if (mode == chip->prevmode)
-        return;
-
-        v4l_dbg(1, debug, chip->c, "%s: thread checkmode\n", chip->c->name);
-        chip->prevmode = mode;
-
-        if (mode & V4L2_TUNER_MODE_STEREO)
-                desc->setmode(chip,V4L2_TUNER_MODE_STEREO);
-        if (mode & V4L2_TUNER_MODE_LANG1_LANG2)
-                desc->setmode(chip,V4L2_TUNER_MODE_STEREO);
-        else if (mode & V4L2_TUNER_MODE_LANG1)
-                desc->setmode(chip,V4L2_TUNER_MODE_LANG1);
-        else if (mode & V4L2_TUNER_MODE_LANG2)
-                desc->setmode(chip,V4L2_TUNER_MODE_LANG2);
-        else
-                desc->setmode(chip,V4L2_TUNER_MODE_MONO);
-}
-
 /* ---------------------------------------------------------------------- */
 /* audio chip descriptions - defines+functions for tda9840                */
 
@@ -777,7 +800,7 @@ static struct tda9874a_MODES {
         char *name;
         audiocmd cmd;
 } tda9874a_modelist[9] = {
-  {     "A2, B/G",
+  {     "A2, B/G", /* default */
         { 9, { TDA9874A_C1FRA, 0x72,0x95,0x55, 0x77,0xA0,0x00, 0x00,0x00 }} },
   {     "A2, M (Korea)",
         { 9, { TDA9874A_C1FRA, 0x5D,0xC0,0x00, 0x62,0x6A,0xAA, 0x20,0x22 }} },
@@ -791,7 +814,7 @@ static struct tda9874a_MODES {
         { 9, { TDA9874A_C1FRA, 0x7D,0x00,0x00, 0x88,0x8A,0xAA, 0x08,0x33 }} },
   {     "NICAM, B/G",
         { 9, { TDA9874A_C1FRA, 0x72,0x95,0x55, 0x79,0xEA,0xAA, 0x08,0x33 }} },
-  {     "NICAM, D/K", /* default */
+  {     "NICAM, D/K",
         { 9, { TDA9874A_C1FRA, 0x87,0x6A,0xAA, 0x79,0xEA,0xAA, 0x08,0x33 }} },
   {     "NICAM, L",
         { 9, { TDA9874A_C1FRA, 0x87,0x6A,0xAA, 0x79,0xEA,0xAA, 0x09,0x33 }} }
@@ -981,7 +1004,7 @@ static int tda9874a_initialize(struct CHIPSTATE *chip)
 {
         if (tda9874a_SIF > 2)
                 tda9874a_SIF = 1;
-        if (tda9874a_STD > 8)
+        if (tda9874a_STD >= ARRAY_SIZE(tda9874a_modelist))
                 tda9874a_STD = 0;
         if(tda9874a_AMSEL > 1)
                 tda9874a_AMSEL = 0;
@@ -1089,7 +1112,7 @@ static int tda8425_shift12(int val) { return (val >> 12) | 0xf0; }
 
 static int tda8425_initialize(struct CHIPSTATE *chip)
 {
-        struct CHIPDESC *desc = chiplist + chip->type;
+        struct CHIPDESC *desc = chip->desc;
         int inputmap[4] = { /* tuner    */ TDA8425_S1_CH2, /* radio  */ TDA8425_S1_CH1,
                             /* extern   */ TDA8425_S1_CH1, /* intern */ TDA8425_S1_OFF};
 
@@ -1259,27 +1282,28 @@ static struct CHIPDESC chiplist[] = {
                 .addr_lo    = I2C_ADDR_TDA9840 >> 1,
                 .addr_hi    = I2C_ADDR_TDA9840 >> 1,
                 .registers  = 5,
+                .flags      = CHIP_NEED_CHECKMODE,
 
+                /* callbacks */
                 .checkit    = tda9840_checkit,
                 .getmode    = tda9840_getmode,
                 .setmode    = tda9840_setmode,
-                .checkmode  = generic_checkmode,
 
                 .init       = { 2, { TDA9840_TEST, TDA9840_TEST_INT1SN
                                 /* ,TDA9840_SW, TDA9840_MONO */} }
         },
         {
                 .name       = "tda9873h",
-                .checkit    = tda9873_checkit,
                 .insmodopt  = &tda9873,
                 .addr_lo    = I2C_ADDR_TDA985x_L >> 1,
                 .addr_hi    = I2C_ADDR_TDA985x_H >> 1,
                 .registers  = 3,
-                .flags      = CHIP_HAS_INPUTSEL,
+                .flags      = CHIP_HAS_INPUTSEL | CHIP_NEED_CHECKMODE,
 
+                /* callbacks */
+                .checkit    = tda9873_checkit,
                 .getmode    = tda9873_getmode,
                 .setmode    = tda9873_setmode,
-                .checkmode  = generic_checkmode,
 
                 .init       = { 4, { TDA9873_SW, 0xa4, 0x06, 0x03 } },
                 .inputreg   = TDA9873_SW,
@@ -1290,15 +1314,16 @@ static struct CHIPDESC chiplist[] = {
         },
         {
                 .name       = "tda9874h/a",
-                .checkit    = tda9874a_checkit,
-                .initialize = tda9874a_initialize,
                 .insmodopt  = &tda9874a,
                 .addr_lo    = I2C_ADDR_TDA9874 >> 1,
                 .addr_hi    = I2C_ADDR_TDA9874 >> 1,
+                .flags      = CHIP_NEED_CHECKMODE,
 
+                /* callbacks */
+                .initialize = tda9874a_initialize,
+                .checkit    = tda9874a_checkit,
                 .getmode    = tda9874a_getmode,
                 .setmode    = tda9874a_setmode,
-                .checkmode  = generic_checkmode,
         },
         {
                 .name       = "tda9850",
@@ -1324,10 +1349,11 @@ static struct CHIPDESC chiplist[] = {
                 .rightreg   = TDA9855_VR,
                 .bassreg    = TDA9855_BA,
                 .treblereg  = TDA9855_TR,
+
+                /* callbacks */
                 .volfunc    = tda9855_volume,
                 .bassfunc   = tda9855_bass,
                 .treblefunc = tda9855_treble,
-
                 .getmode    = tda985x_getmode,
                 .setmode    = tda985x_setmode,
 
@@ -1348,6 +1374,8 @@ static struct CHIPDESC chiplist[] = {
                 .rightreg   = TEA6300_VL,
                 .bassreg    = TEA6300_BA,
                 .treblereg  = TEA6300_TR,
+
+                /* callbacks */
                 .volfunc    = tea6300_shift10,
                 .bassfunc   = tea6300_shift12,
                 .treblefunc = tea6300_shift12,
@@ -1358,7 +1386,6 @@ static struct CHIPDESC chiplist[] = {
         },
         {
                 .name       = "tea6320",
-                .initialize = tea6320_initialize,
                 .insmodopt  = &tea6320,
                 .addr_lo    = I2C_ADDR_TEA6300 >> 1,
                 .addr_hi    = I2C_ADDR_TEA6300 >> 1,
@@ -1369,6 +1396,9 @@ static struct CHIPDESC chiplist[] = {
                 .rightreg   = TEA6320_V,
                 .bassreg    = TEA6320_BA,
                 .treblereg  = TEA6320_TR,
+
+                /* callbacks */
+                .initialize = tea6320_initialize,
                 .volfunc    = tea6320_volume,
                 .bassfunc   = tea6320_shift11,
                 .treblefunc = tea6320_shift11,
@@ -1401,16 +1431,18 @@ static struct CHIPDESC chiplist[] = {
                 .rightreg   = TDA8425_VR,
                 .bassreg    = TDA8425_BA,
                 .treblereg  = TDA8425_TR,
+
+                /* callbacks */
+                .initialize = tda8425_initialize,
                 .volfunc    = tda8425_shift10,
                 .bassfunc   = tda8425_shift12,
                 .treblefunc = tda8425_shift12,
+                .setmode    = tda8425_setmode,
 
                 .inputreg   = TDA8425_S1,
                 .inputmap   = { TDA8425_S1_CH1, TDA8425_S1_CH1, TDA8425_S1_CH1 },
                 .inputmute  = TDA8425_S1_OFF,
 
-                .setmode    = tda8425_setmode,
-                .initialize = tda8425_initialize,
         },
         {
                 .name       = "pic16c54 (PV951)",
@@ -1434,10 +1466,11 @@ static struct CHIPDESC chiplist[] = {
                 .addr_lo    = I2C_ADDR_TDA9840 >> 1,
                 .addr_hi    = I2C_ADDR_TDA9840 >> 1,
                 .registers  = 2,
+                .flags      = CHIP_NEED_CHECKMODE,
 
+                /* callbacks */
                 .getmode    = ta8874z_getmode,
                 .setmode    = ta8874z_setmode,
-                .checkmode  = generic_checkmode,
 
                 .init       = {2, { TA8874Z_MONO_SET, TA8874Z_SEPARATION_DEFAULT}},
         },
@@ -1481,6 +1514,7 @@ static int chip_probe(struct i2c_client *client, const struct i2c_device_id *id)
         }
         if (desc->name == NULL) {
                 v4l_dbg(1, debug, client, "no matching chip description found\n");
+                kfree(chip);
                 return -EIO;
         }
         v4l_info(client, "%s found @ 0x%x (%s)\n", desc->name, client->addr<<1, client->adapter->name);
@@ -1494,7 +1528,7 @@ static int chip_probe(struct i2c_client *client, const struct i2c_device_id *id)
         /* fill required data structures */
         if (!id)
                 strlcpy(client->name, desc->name, I2C_NAME_SIZE);
-        chip->type = desc-chiplist;
+        chip->desc = desc;
         chip->shadow.count = desc->registers+1;
         chip->prevmode = -1;
         chip->audmode = V4L2_TUNER_MODE_LANG1;
@@ -1506,20 +1540,49 @@ static int chip_probe(struct i2c_client *client, const struct i2c_device_id *id)
                 chip_cmd(chip,"init",&desc->init);
 
         if (desc->flags & CHIP_HAS_VOLUME) {
-                chip->left   = desc->leftinit   ? desc->leftinit   : 65535;
-                chip->right  = desc->rightinit  ? desc->rightinit  : 65535;
-                chip_write(chip,desc->leftreg,desc->volfunc(chip->left));
-                chip_write(chip,desc->rightreg,desc->volfunc(chip->right));
+                if (!desc->volfunc) {
+                        /* This shouldn't be happen. Warn user, but keep working
+                           without volume controls
+                         */
+                        v4l_info(chip->c, "volume callback undefined!\n");
+                        desc->flags &= ~CHIP_HAS_VOLUME;
+                } else {
+                        chip->left  = desc->leftinit  ? desc->leftinit  : 65535;
+                        chip->right = desc->rightinit ? desc->rightinit : 65535;
+                        chip_write(chip, desc->leftreg,
+                                   desc->volfunc(chip->left));
+                        chip_write(chip, desc->rightreg,
+                                   desc->volfunc(chip->right));
+                }
         }
         if (desc->flags & CHIP_HAS_BASSTREBLE) {
-                chip->treble = desc->trebleinit ? desc->trebleinit : 32768;
-                chip->bass   = desc->bassinit   ? desc->bassinit   : 32768;
-                chip_write(chip,desc->bassreg,desc->bassfunc(chip->bass));
-                chip_write(chip,desc->treblereg,desc->treblefunc(chip->treble));
+                if (!desc->bassfunc || !desc->treblefunc) {
+                        /* This shouldn't be happen. Warn user, but keep working
+                           without bass/treble controls
+                         */
+                        v4l_info(chip->c, "bass/treble callbacks undefined!\n");
+                        desc->flags &= ~CHIP_HAS_BASSTREBLE;
+                } else {
+                        chip->treble = desc->trebleinit ?
+                                                desc->trebleinit : 32768;
+                        chip->bass   = desc->bassinit   ?
+                                                desc->bassinit   : 32768;
+                        chip_write(chip, desc->bassreg,
+                                   desc->bassfunc(chip->bass));
+                        chip_write(chip, desc->treblereg,
+                                   desc->treblefunc(chip->treble));
+                }
         }
 
         chip->thread = NULL;
-        if (desc->checkmode) {
+        if (desc->flags & CHIP_NEED_CHECKMODE) {
+                if (!desc->getmode || !desc->setmode) {
+                        /* This shouldn't be happen. Warn user, but keep working
+                           without kthread
+                         */
+                        v4l_info(chip->c, "set/get mode callbacks undefined!\n");
+                        return 0;
+                }
                 /* start async thread */
                 init_timer(&chip->wt);
                 chip->wt.function = chip_thread_wake;
@@ -1552,7 +1615,7 @@ static int chip_remove(struct i2c_client *client)
 static int tvaudio_get_ctrl(struct CHIPSTATE *chip,
                             struct v4l2_control *ctrl)
 {
-        struct CHIPDESC *desc = chiplist + chip->type;
+        struct CHIPDESC *desc = chip->desc;
 
         switch (ctrl->id) {
         case V4L2_CID_AUDIO_MUTE:
@@ -1576,13 +1639,13 @@ static int tvaudio_get_ctrl(struct CHIPSTATE *chip,
                 return 0;
         }
         case V4L2_CID_AUDIO_BASS:
-                if (desc->flags & CHIP_HAS_BASSTREBLE)
+                if (!(desc->flags & CHIP_HAS_BASSTREBLE))
                         break;
                 ctrl->value = chip->bass;
                 return 0;
         case V4L2_CID_AUDIO_TREBLE:
-                if (desc->flags & CHIP_HAS_BASSTREBLE)
-                        return -EINVAL;
+                if (!(desc->flags & CHIP_HAS_BASSTREBLE))
+                        break;
                 ctrl->value = chip->treble;
                 return 0;
         }
@@ -1592,7 +1655,7 @@ static int tvaudio_get_ctrl(struct CHIPSTATE *chip,
 static int tvaudio_set_ctrl(struct CHIPSTATE *chip,
                             struct v4l2_control *ctrl)
 {
-        struct CHIPDESC *desc = chiplist + chip->type;
+        struct CHIPDESC *desc = chip->desc;
 
         switch (ctrl->id) {
         case V4L2_CID_AUDIO_MUTE:
@@ -1642,16 +1705,15 @@ static int tvaudio_set_ctrl(struct CHIPSTATE *chip,
                 return 0;
         }
         case V4L2_CID_AUDIO_BASS:
-                if (desc->flags & CHIP_HAS_BASSTREBLE)
+                if (!(desc->flags & CHIP_HAS_BASSTREBLE))
                         break;
                 chip->bass = ctrl->value;
                 chip_write(chip,desc->bassreg,desc->bassfunc(chip->bass));
 
                 return 0;
         case V4L2_CID_AUDIO_TREBLE:
-                if (desc->flags & CHIP_HAS_BASSTREBLE)
-                        return -EINVAL;
-
+                if (!(desc->flags & CHIP_HAS_BASSTREBLE))
+                        break;
                 chip->treble = ctrl->value;
                 chip_write(chip,desc->treblereg,desc->treblefunc(chip->treble));
 
@@ -1668,9 +1730,12 @@ static int chip_command(struct i2c_client *client,
                         unsigned int cmd, void *arg)
 {
         struct CHIPSTATE *chip = i2c_get_clientdata(client);
-        struct CHIPDESC  *desc = chiplist + chip->type;
+        struct CHIPDESC  *desc = chip->desc;
 
-        v4l_dbg(1, debug, chip->c, "%s: chip_command 0x%x\n", chip->c->name, cmd);
+        if (debug > 0) {
+                v4l_i2c_print_ioctl(chip->c, cmd);
+                printk("\n");
+        }
 
         switch (cmd) {
         case AUDC_SET_RADIO:
@@ -1695,7 +1760,7 @@ static int chip_command(struct i2c_client *client,
                                 break;
                         case V4L2_CID_AUDIO_BASS:
                         case V4L2_CID_AUDIO_TREBLE:
-                                if (desc->flags & CHIP_HAS_BASSTREBLE)
+                                if (!(desc->flags & CHIP_HAS_BASSTREBLE))
                                         return -EINVAL;
                                 break;
                         default:
@@ -1792,12 +1857,20 @@ static int chip_command(struct i2c_client *client,
                 break;
         case VIDIOC_S_FREQUENCY:
                 chip->mode = 0; /* automatic */
-                if (desc->checkmode && desc->setmode) {
+
+                /* For chips that provide getmode and setmode, and doesn't
+                   automatically follows the stereo carrier, a kthread is
+                   created to set the audio standard. In this case, when then
+                   the video channel is changed, tvaudio starts on MONO mode.
+                   After waiting for 2 seconds, the kernel thread is called,
+                   to follow whatever audio standard is pointed by the
+                   audio carrier.
+                 */
+                if (chip->thread) {
                         desc->setmode(chip,V4L2_TUNER_MODE_MONO);
                         if (chip->prevmode != V4L2_TUNER_MODE_MONO)
                                 chip->prevmode = -1; /* reset previous mode */
                         mod_timer(&chip->wt, jiffies+msecs_to_jiffies(2000));
-                        /* the thread will call checkmode() later */
                 }
                 break;
 
@@ -1836,9 +1909,3 @@ static struct v4l2_i2c_driver_data v4l2_i2c_data = {
         .legacy_probe = chip_legacy_probe,
         .id_table = chip_id,
 };
-
-/*
- * Local variables:
- * c-basic-offset: 8
- * End:
- */
diff --git a/drivers/media/video/usbvideo/ibmcam.c b/drivers/media/video/usbvideo/ibmcam.c
index 28421d386f1e..c710bcd1df48 100644
--- a/drivers/media/video/usbvideo/ibmcam.c
+++ b/drivers/media/video/usbvideo/ibmcam.c
@@ -3695,7 +3695,7 @@ static int ibmcam_probe(struct usb_interface *intf, const struct usb_device_id *
         unsigned char video_ep = 0;
 
         if (debug >= 1)
-                dev_info(&uvd->dev->dev, "ibmcam_probe(%p,%u.)\n", intf, ifnum);
+                dev_info(&dev->dev, "ibmcam_probe(%p,%u.)\n", intf, ifnum);
 
         /* We don't handle multi-config cameras */
         if (dev->descriptor.bNumConfigurations != 1)
@@ -3746,7 +3746,7 @@ static int ibmcam_probe(struct usb_interface *intf, const struct usb_device_id *
                         brand = "IBM PC Camera"; /* a.k.a. Xirlink C-It */
                         break;
                 }
-                dev_info(&uvd->dev->dev,
+                dev_info(&dev->dev,
                          "%s USB camera found (model %d, rev. 0x%04x)\n",
                          brand, model, le16_to_cpu(dev->descriptor.bcdDevice));
         } while (0);
@@ -3754,7 +3754,7 @@ static int ibmcam_probe(struct usb_interface *intf, const struct usb_device_id *
         /* Validate found interface: must have one ISO endpoint */
         nas = intf->num_altsetting;
         if (debug > 0)
-                dev_info(&uvd->dev->dev, "Number of alternate settings=%d.\n",
+                dev_info(&dev->dev, "Number of alternate settings=%d.\n",
                          nas);
         if (nas < 2) {
                 err("Too few alternate settings for this camera!");
@@ -3799,7 +3799,7 @@ static int ibmcam_probe(struct usb_interface *intf, const struct usb_device_id *
                                 actInterface = i;
                                 maxPS = le16_to_cpu(endpoint->wMaxPacketSize);
                                 if (debug > 0)
-                                        dev_info(&uvd->dev->dev,
+                                        dev_info(&dev->dev,
                                                  "Active setting=%d. "
                                                  "maxPS=%d.\n", i, maxPS);
                         } else
@@ -3840,7 +3840,7 @@ static int ibmcam_probe(struct usb_interface *intf, const struct usb_device_id *
                         RESTRICT_TO_RANGE(framerate, 0, 5);
                         break;
                 default:
-                        dev_info(&uvd->dev->dev, "IBM camera: using 320x240\n");
+                        dev_info(&dev->dev, "IBM camera: using 320x240\n");
                         size = SIZE_320x240;
                         /* No break here */
                 case SIZE_320x240:
@@ -3869,7 +3869,7 @@ static int ibmcam_probe(struct usb_interface *intf, const struct usb_device_id *
                         canvasY = 120;
                         break;
                 default:
-                        dev_info(&uvd->dev->dev, "IBM NetCamera: using 176x144\n");
+                        dev_info(&dev->dev, "IBM NetCamera: using 176x144\n");
                         size = SIZE_176x144;
                         /* No break here */
                 case SIZE_176x144: