- merge 2.6.9-rc1 changes (mostly __user stuff).

14 files changed, 156 insertions, 149 deletions

diff --git a/linux/drivers/media/video/bttv-cards.c b/linux/drivers/media/video/bttv-cards.c
index 290d71386..bd5ddc0b0 100644
--- a/linux/drivers/media/video/bttv-cards.c
+++ b/linux/drivers/media/video/bttv-cards.c
@@ -4114,15 +4114,15 @@ int __devinit bttv_handle_chipset(struct bttv *btv)
 }
 
 
-/* PXC200 muxsel helper 
+/* PXC200 muxsel helper
  * luke@syseng.anu.edu.au
- * another transplant 
+ * another transplant
  * from Alessandro Rubini (rubini@linux.it)
  *
  * There are 4 kinds of cards:
- * PXC200L which is bt848 
+ * PXC200L which is bt848
  * PXC200F which is bt848 with PIC controlling mux
- * PXC200AL which is bt878 
+ * PXC200AL which is bt878
  * PXC200AF which is bt878 with PIC controlling mux
  */
 #define PX_CFG_PXC200F 0x01
@@ -4161,10 +4161,10 @@ static void PXC200_muxsel(struct bttv *btv, unsigned int input)
 	/*  mux = bttv_tvcards[btv->type].muxsel[input] & 3; */
 	/* ** not needed!?   */
 	mux = input;
-  
+
 	/* make sure output pins are enabled */
 	/* bitmask=0x30f; */
-	bitmask=0x302; 
+	bitmask=0x302;
 	/* check whether we have a PXC200A */
  	if (btv->cardid == PX_PXC200A_CARDID)  {
 	   bitmask ^= 0x180; /* use 7 and 9, not 8 and 9 */
@@ -4173,7 +4173,7 @@ static void PXC200_muxsel(struct bttv *btv, unsigned int input)
 	btwrite(bitmask, BT848_GPIO_OUT_EN);
 
 	bitmask = btread(BT848_GPIO_DATA);
- 	if (btv->cardid == PX_PXC200A_CARDID) 
+ 	if (btv->cardid == PX_PXC200A_CARDID)
 	  bitmask = (bitmask & ~0x280) | ((mux & 2) << 8) | ((mux & 1) << 7);
 	else /* older device */
 	  bitmask = (bitmask & ~0x300) | ((mux & 3) << 8);
@@ -4183,10 +4183,10 @@ static void PXC200_muxsel(struct bttv *btv, unsigned int input)
 	 * Was "to be safe, set the bt848 to input 0"
 	 * Actually, since it's ok at load time, better not messing
 	 * with these bits (on PXC200AF you need to set mux 2 here)
-	 * 
+	 *
 	 * needed because bttv-driver sets mux before calling this function
 	 */
- 	if (btv->cardid == PX_PXC200A_CARDID) 
+ 	if (btv->cardid == PX_PXC200A_CARDID)
 	  btaor(2<<5, ~BT848_IFORM_MUXSEL, BT848_IFORM);
 	else /* older device */
 	  btand(~BT848_IFORM_MUXSEL,BT848_IFORM);
diff --git a/linux/drivers/media/video/bttv-driver.c b/linux/drivers/media/video/bttv-driver.c
index ba7282bc1..f332ee8fa 100644
--- a/linux/drivers/media/video/bttv-driver.c
+++ b/linux/drivers/media/video/bttv-driver.c
@@ -1070,7 +1070,7 @@ static void init_bt848(struct bttv *btv)
 	init_irqreg(btv);
 }
 
-extern void bttv_reinit_bt848(struct bttv *btv)
+void bttv_reinit_bt848(struct bttv *btv)
 {
 	unsigned long flags;
 
@@ -2264,7 +2264,7 @@ static int bttv_do_ioctl(struct inode *inode, struct file *file,
 		w2.w.width   = win->width;
 		w2.w.height  = win->height;
 		w2.clipcount = win->clipcount;
-		w2.clips     = (struct v4l2_clip*)win->clips;
+		w2.clips     = (struct v4l2_clip __user *)win->clips;
 		retval = setup_window(fh, btv, &w2, 0);
 		if (0 == retval) {
 			/* on v4l1 this ioctl affects the read() size too */
@@ -2824,7 +2824,7 @@ static int bttv_ioctl(struct inode *inode, struct file *file,
 	}
 }
 
-static ssize_t bttv_read(struct file *file, char *data,
+static ssize_t bttv_read(struct file *file, char __user *data,
 			 size_t count, loff_t *ppos)
 {
 	struct bttv_fh *fh = file->private_data;
@@ -3482,7 +3482,7 @@ bttv_irq_switch_vbi(struct bttv *btv)
 	if (!list_empty(&btv->vcapture))
 		new = list_entry(btv->vcapture.next, struct bttv_buffer, vb.queue);
 	old = btv->cvbi;
-	
+
 	rc = btread(BT848_RISC_COUNT);
 	if (NULL != old && (is_active(&old->top,    rc) ||
 			    is_active(&old->bottom, rc))) {
@@ -3492,12 +3492,12 @@ bttv_irq_switch_vbi(struct bttv *btv)
 		spin_unlock(&btv->s_lock);
 		return;
 	}
-	
+
 	/* switch */
 	btv->cvbi = new;
 	bttv_buffer_activate_vbi(btv, new);
 	bttv_set_dma(btv, 0, btv->curr.irqflags);
-	
+
 	bttv_irq_wakeup_vbi(btv, old, STATE_DONE);
 	spin_unlock(&btv->s_lock);
 }
diff --git a/linux/drivers/media/video/ir-kbd-gpio.c b/linux/drivers/media/video/ir-kbd-gpio.c
index ff3833fe6..8861e45cd 100644
--- a/linux/drivers/media/video/ir-kbd-gpio.c
+++ b/linux/drivers/media/video/ir-kbd-gpio.c
@@ -33,44 +33,44 @@
 /* ---------------------------------------------------------------------- */
 
 static IR_KEYTAB_TYPE ir_codes_avermedia[IR_KEYTAB_SIZE] = {
-	[ 34 ] = KEY_KP0, 
-	[ 40 ] = KEY_KP1, 
-	[ 24 ] = KEY_KP2, 
-	[ 56 ] = KEY_KP3, 
-	[ 36 ] = KEY_KP4, 
-	[ 20 ] = KEY_KP5, 
-	[ 52 ] = KEY_KP6, 
-	[ 44 ] = KEY_KP7, 
-	[ 28 ] = KEY_KP8, 
-	[ 60 ] = KEY_KP9, 
+	[ 34 ] = KEY_KP0,
+	[ 40 ] = KEY_KP1,
+	[ 24 ] = KEY_KP2,
+	[ 56 ] = KEY_KP3,
+	[ 36 ] = KEY_KP4,
+	[ 20 ] = KEY_KP5,
+	[ 52 ] = KEY_KP6,
+	[ 44 ] = KEY_KP7,
+	[ 28 ] = KEY_KP8,
+	[ 60 ] = KEY_KP9,
 
 	[ 48 ] = KEY_EJECTCD,     // Unmarked on my controller
-	[  0 ] = KEY_POWER, 
+	[  0 ] = KEY_POWER,
 	[ 18 ] = BTN_LEFT,        // DISPLAY/L
 	[ 50 ] = BTN_RIGHT,       // LOOP/R
-	[ 10 ] = KEY_MUTE, 
-	[ 38 ] = KEY_RECORD, 
-	[ 22 ] = KEY_PAUSE, 
-	[ 54 ] = KEY_STOP, 
-	[ 30 ] = KEY_VOLUMEDOWN, 
-	[ 62 ] = KEY_VOLUMEUP, 
+	[ 10 ] = KEY_MUTE,
+	[ 38 ] = KEY_RECORD,
+	[ 22 ] = KEY_PAUSE,
+	[ 54 ] = KEY_STOP,
+	[ 30 ] = KEY_VOLUMEDOWN,
+	[ 62 ] = KEY_VOLUMEUP,
 
 	[ 32 ] = KEY_TUNER,       // TV/FM
-	[ 16 ] = KEY_CD, 
-	[  8 ] = KEY_VIDEO, 
-	[  4 ] = KEY_AUDIO, 
+	[ 16 ] = KEY_CD,
+	[  8 ] = KEY_VIDEO,
+	[  4 ] = KEY_AUDIO,
 	[ 12 ] = KEY_ZOOM,        // full screen
-	[  2 ] = KEY_INFO,        // preview 
+	[  2 ] = KEY_INFO,        // preview
 	[ 42 ] = KEY_SEARCH,      // autoscan
-	[ 26 ] = KEY_STOP,        // freeze 
-	[ 58 ] = KEY_RECORD,      // capture 
+	[ 26 ] = KEY_STOP,        // freeze
+	[ 58 ] = KEY_RECORD,      // capture
 	[  6 ] = KEY_PLAY,        // unmarked
 	[ 46 ] = KEY_RED,         // unmarked
 	[ 14 ] = KEY_GREEN,       // unmarked
 
 	[ 33 ] = KEY_YELLOW,      // unmarked
-	[ 17 ] = KEY_CHANNELDOWN, 
-	[ 49 ] = KEY_CHANNELUP, 
+	[ 17 ] = KEY_CHANNELDOWN,
+	[ 49 ] = KEY_CHANNELUP,
 	[  1 ] = KEY_BLUE,        // unmarked
 };
 
@@ -90,7 +90,7 @@ static IR_KEYTAB_TYPE ir_codes_avermedia_dvbt[IR_KEYTAB_SIZE] = {
 	[ 0x20 ] = KEY_LIST,        // 'source'
 	[ 0x10 ] = KEY_TEXT,        // 'teletext'
 	[ 0x00 ] = KEY_POWER,       // 'power'
-	[ 0x04 ] = KEY_AUDIO,       // 'audio'	
+	[ 0x04 ] = KEY_AUDIO,       // 'audio'
 	[ 0x06 ] = KEY_ZOOM,        // 'full screen'
 	[ 0x18 ] = KEY_VIDEO,       // 'display'
 	[ 0x38 ] = KEY_SEARCH,      // 'loop'
@@ -169,7 +169,7 @@ static IR_KEYTAB_TYPE ir_codes_pixelview[IR_KEYTAB_SIZE] = {
 	[  6 ] = KEY_KP7,
 	[ 10 ] = KEY_KP8,
 	[ 18 ] = KEY_KP9,
-	
+
 	[  3 ] = KEY_TUNER,       // TV/FM
 	[  7 ] = KEY_SEARCH,      // scan
 	[ 28 ] = KEY_ZOOM,        // full screen
@@ -179,7 +179,7 @@ static IR_KEYTAB_TYPE ir_codes_pixelview[IR_KEYTAB_SIZE] = {
 	[ 20 ] = KEY_CHANNELDOWN,
 	[ 22 ] = KEY_CHANNELUP,
 	[ 24 ] = KEY_MUTE,
-	
+
 	[  0 ] = KEY_LIST,        // source
 	[ 19 ] = KEY_INFO,        // loop
 	[ 16 ] = KEY_LAST,        // +100
@@ -206,7 +206,7 @@ static IR_KEYTAB_TYPE ir_codes_apac_viewcomp[IR_KEYTAB_SIZE] = {
 	[ 23 ] = KEY_LAST,        // +100
 	[ 10 ] = KEY_LIST,        // recall
 
-	
+
 	[ 28 ] = KEY_TUNER,       // TV/FM
 	[ 21 ] = KEY_SEARCH,      // scan
 	[ 18 ] = KEY_POWER,       // power
@@ -219,7 +219,7 @@ static IR_KEYTAB_TYPE ir_codes_apac_viewcomp[IR_KEYTAB_SIZE] = {
 	[ 15 ] = KEY_ZOOM,        // full screen
 	[ 19 ] = KEY_MUTE,        // mute/unmute
 	[ 16 ] = KEY_TEXT,        // min
-	
+
 	[ 13 ] = KEY_STOP,        // freeze
 	[ 14 ] = KEY_RECORD,      // record
 	[ 29 ] = KEY_PLAYPAUSE,   // stop
@@ -282,7 +282,7 @@ static void ir_handle_key(struct IR *ir)
 			return;
 		ir->last_gpio = gpio;
 	}
-	
+
 	/* extract data */
 	data = ir_extract_bits(gpio, ir->mask_keycode);
 	dprintk(DEVNAME ": irq gpio=0x%x code=%d | %s%s%s\n",
@@ -371,7 +371,7 @@ static int ir_probe(struct device *dev)
 		ir->mask_keydown = 0x000020;
 		ir->polling      = 50; // ms
 		break;
-		
+
 	case BTTV_PXELVWPLTVPAK:
 		ir_codes         = ir_codes_pixelview;
 		ir->mask_keycode = 0x003e00;
@@ -411,7 +411,7 @@ static int ir_probe(struct device *dev)
 	/* init hardware-specific stuff */
 	bttv_gpio_inout(sub->core, ir->mask_keycode | ir->mask_keydown, 0);
 	ir->sub = sub;
-	
+
 	/* init input device */
 	snprintf(ir->name, sizeof(ir->name), "bttv IR (card=%d)",
 		 sub->core->type);
diff --git a/linux/drivers/media/video/ir-kbd-i2c.c b/linux/drivers/media/video/ir-kbd-i2c.c
index bf99ddd24..301b418fb 100644
--- a/linux/drivers/media/video/ir-kbd-i2c.c
+++ b/linux/drivers/media/video/ir-kbd-i2c.c
@@ -43,26 +43,26 @@
 
 /* Mark Phalan <phalanm@o2.ie> */
 static IR_KEYTAB_TYPE ir_codes_pv951[IR_KEYTAB_SIZE] = {
-	[  0 ] = KEY_KP0, 
-	[  1 ] = KEY_KP1, 
-	[  2 ] = KEY_KP2, 
-	[  3 ] = KEY_KP3, 
-	[  4 ] = KEY_KP4, 
-	[  5 ] = KEY_KP5, 
-	[  6 ] = KEY_KP6, 
-	[  7 ] = KEY_KP7, 
-	[  8 ] = KEY_KP8, 
-	[  9 ] = KEY_KP9, 
-
-	[ 18 ] = KEY_POWER, 
-	[ 16 ] = KEY_MUTE, 
-	[ 31 ] = KEY_VOLUMEDOWN, 
-	[ 27 ] = KEY_VOLUMEUP, 
+	[  0 ] = KEY_KP0,
+	[  1 ] = KEY_KP1,
+	[  2 ] = KEY_KP2,
+	[  3 ] = KEY_KP3,
+	[  4 ] = KEY_KP4,
+	[  5 ] = KEY_KP5,
+	[  6 ] = KEY_KP6,
+	[  7 ] = KEY_KP7,
+	[  8 ] = KEY_KP8,
+	[  9 ] = KEY_KP9,
+
+	[ 18 ] = KEY_POWER,
+	[ 16 ] = KEY_MUTE,
+	[ 31 ] = KEY_VOLUMEDOWN,
+	[ 27 ] = KEY_VOLUMEUP,
 	[ 26 ] = KEY_CHANNELUP,
 	[ 30 ] = KEY_CHANNELDOWN,
 	[ 14 ] = KEY_PAGEUP,
-	[ 29 ] = KEY_PAGEDOWN,	
-	[ 19 ] = KEY_SOUND, 
+	[ 29 ] = KEY_PAGEDOWN,
+	[ 19 ] = KEY_SOUND,
 
 	[ 24 ] = KEY_KPPLUSMINUS,	// CH +/-
 	[ 22 ] = KEY_SUBTITLE,		// CC
@@ -75,7 +75,7 @@ static IR_KEYTAB_TYPE ir_codes_pv951[IR_KEYTAB_SIZE] = {
 
 	/* Not sure what to do with these ones! */
 	[ 15 ] = KEY_SELECT, 		// SOURCE
-	[ 10 ] = KEY_KPPLUS,		// +100  
+	[ 10 ] = KEY_KPPLUS,		// +100
 	[ 20 ] = KEY_KPEQUAL,		// SYNC
 	[ 28 ] = KEY_MEDIA,             // PC/TV
 };
@@ -114,8 +114,8 @@ static IR_KEYTAB_TYPE ir_codes_purpletv[IR_KEYTAB_SIZE] = {
 	[ 0x49 ] = KEY_LANGUAGE,	// MTS Select
 	[ 0x19 ] = KEY_SEARCH,		// Auto Scan
 
-	[ 0x4b ] = KEY_RECORD,    
-	[ 0x46 ] = KEY_PLAY,    
+	[ 0x4b ] = KEY_RECORD,
+	[ 0x46 ] = KEY_PLAY,
 	[ 0x45 ] = KEY_PAUSE,   	// Pause
 	[ 0x44 ] = KEY_STOP,
 #if 0
@@ -156,7 +156,7 @@ module_param(debug, int, 0644);    /* debug level (0,1,2) */
 static inline int reverse(int data, int bits)
 {
 	int i,c;
-	
+
 	for (c=0,i=0; i<bits; i++) {
 		c |= (((data & (1<<i)) ? 1:0)) << (bits-1-i);
 	}
@@ -193,7 +193,7 @@ static int get_key_haup(struct IR *ir, u32 *ir_key, u32 *ir_raw)
 static int get_key_pixelview(struct IR *ir, u32 *ir_key, u32 *ir_raw)
 {
         unsigned char b;
-	
+
 	/* poll IR chip */
 	if (1 != i2c_master_recv(&ir->c,&b,1)) {
 		dprintk(1,"read error\n");
@@ -207,7 +207,7 @@ static int get_key_pixelview(struct IR *ir, u32 *ir_key, u32 *ir_raw)
 static int get_key_pv951(struct IR *ir, u32 *ir_key, u32 *ir_raw)
 {
         unsigned char b;
-	
+
 	/* poll IR chip */
 	if (1 != i2c_master_recv(&ir->c,&b,1)) {
 		dprintk(1,"read error\n");
@@ -218,7 +218,7 @@ static int get_key_pv951(struct IR *ir, u32 *ir_key, u32 *ir_raw)
 	if (b==0xaa)
 		return 0;
 	dprintk(2,"key %02x\n", b);
-	
+
 	*ir_key = b;
 	*ir_raw = b;
 	return 1;
@@ -227,26 +227,26 @@ static int get_key_pv951(struct IR *ir, u32 *ir_key, u32 *ir_raw)
 static int get_key_knc1(struct IR *ir, u32 *ir_key, u32 *ir_raw)
 {
 	unsigned char b;
-	
+
 	/* poll IR chip */
 	if (1 != i2c_master_recv(&ir->c,&b,1)) {
 		dprintk(1,"read error\n");
 		return -EIO;
 	}
-	
+
 	/* it seems that 0xFE indicates that a button is still hold
 	   down, while 0xFF indicates that no button is hold
 	   down. 0xFE sequences are sometimes interrupted by 0xFF */
-	
+
 	dprintk(2,"key %02x\n", b);
-	
+
 	if (b == 0xFF)
 		return 0;
-	
+
 	if (b == 0xFE)
 		/* keep old data */
 		return 1;
-	
+
 	*ir_key = b;
 	*ir_raw = b;
 	return 1;
@@ -255,7 +255,7 @@ static int get_key_knc1(struct IR *ir, u32 *ir_key, u32 *ir_raw)
 static int get_key_purpletv(struct IR *ir, u32 *ir_key, u32 *ir_raw)
 {
         unsigned char b;
-	
+
 	/* poll IR chip */
 	if (1 != i2c_master_recv(&ir->c,&b,1)) {
 		dprintk(1,"read error\n");
@@ -267,7 +267,7 @@ static int get_key_purpletv(struct IR *ir, u32 *ir_key, u32 *ir_raw)
 		return 0;
 
 	/* repeating */
-	if (b & 0x80) 
+	if (b & 0x80)
 		return 1;
 
 	*ir_key = b;
@@ -323,7 +323,7 @@ static struct i2c_driver driver = {
         .detach_client  = ir_detach,
 };
 
-static struct i2c_client client_template = 
+static struct i2c_client client_template =
 {
         I2C_DEVNAME("unset"),
         .driver = &driver
@@ -336,7 +336,7 @@ static int ir_attach(struct i2c_adapter *adap, int addr,
 	char *name;
 	int ir_type;
         struct IR *ir;
-		
+
         if (NULL == (ir = kmalloc(sizeof(struct IR),GFP_KERNEL)))
                 return -ENOMEM;
 	memset(ir,0,sizeof(*ir));
@@ -400,14 +400,14 @@ static int ir_attach(struct i2c_adapter *adap, int addr,
 	input_register_device(&ir->input);
 	printk(DEVNAME ": %s detected at %s [%s]\n",
 	       ir->input.name,ir->input.phys,adap->name);
-	       
+
 	/* start polling via eventd */
 	INIT_WORK(&ir->work, ir_work, ir);
 	init_timer(&ir->timer);
 	ir->timer.function = ir_timer;
 	ir->timer.data     = (unsigned long)ir;
 	schedule_work(&ir->work);
-	
+
 	return 0;
 }
 
@@ -430,16 +430,16 @@ static int ir_detach(struct i2c_client *client)
 
 static int ir_probe(struct i2c_adapter *adap)
 {
-	
+
 	/* The external IR receiver is at i2c address 0x34 (0x35 for
 	   reads).  Future Hauppauge cards will have an internal
 	   receiver at 0x30 (0x31 for reads).  In theory, both can be
 	   fitted, and Hauppauge suggest an external overrides an
-	   internal. 
-	   
-	   That's why we probe 0x1a (~0x34) first. CB 
+	   internal.
+
+	   That's why we probe 0x1a (~0x34) first. CB
 	*/
-	
+
 	static const int probe_bttv[] = { 0x1a, 0x18, 0x4b, 0x64, 0x30, -1};
 	static const int probe_saa7134[] = { 0x7a, -1};
 	const int *probe = NULL;
@@ -455,14 +455,14 @@ static int ir_probe(struct i2c_adapter *adap)
 	}
 	if (NULL == probe)
 		return 0;
-	
+
 	memset(&c,0,sizeof(c));
 	c.adapter = adap;
 	for (i = 0; -1 != probe[i]; i++) {
 		c.addr = probe[i];
 		rc = i2c_master_recv(&c,&buf,1);
 		dprintk(1,"probe 0x%02x @ %s: %s\n",
-			probe[i], adap->name, 
+			probe[i], adap->name,
 			(1 == rc) ? "yes" : "no");
 		if (1 == rc) {
 			ir_attach(adap,probe[i],0,0);
diff --git a/linux/drivers/media/video/saa7134/saa7134-core.c b/linux/drivers/media/video/saa7134/saa7134-core.c
index a314a93eb..5de7c05f5 100644
--- a/linux/drivers/media/video/saa7134/saa7134-core.c
+++ b/linux/drivers/media/video/saa7134/saa7134-core.c
@@ -324,7 +324,7 @@ int saa7134_buffer_queue(struct saa7134_dev *dev,
 			 struct saa7134_buf *buf)
 {
 	struct saa7134_buf *next = NULL;
-#if DEBUG_SPINLOCKS
+#ifdef DEBUG_SPINLOCKS
 	BUG_ON(!spin_is_locked(&dev->slock));
 #endif
 	
@@ -353,7 +353,7 @@ void saa7134_buffer_finish(struct saa7134_dev *dev,
 			   struct saa7134_dmaqueue *q,
 			   unsigned int state)
 {
-#if DEBUG_SPINLOCKS
+#ifdef DEBUG_SPINLOCKS
 	BUG_ON(!spin_is_locked(&dev->slock));
 #endif
 	dprintk("buffer_finish %p\n",q->curr);
@@ -370,7 +370,7 @@ void saa7134_buffer_next(struct saa7134_dev *dev,
 {
 	struct saa7134_buf *buf,*next = NULL;
 
-#if DEBUG_SPINLOCKS
+#ifdef DEBUG_SPINLOCKS
 	BUG_ON(!spin_is_locked(&dev->slock));
 #endif
 	BUG_ON(NULL != q->curr);
@@ -427,7 +427,7 @@ int saa7134_set_dmabits(struct saa7134_dev *dev)
 	enum v4l2_field cap = V4L2_FIELD_ANY;
 	enum v4l2_field ov  = V4L2_FIELD_ANY;
 
-#if DEBUG_SPINLOCKS
+#ifdef DEBUG_SPINLOCKS
 	BUG_ON(!spin_is_locked(&dev->slock));
 #endif
 
diff --git a/linux/drivers/media/video/saa7134/saa7134-oss.c b/linux/drivers/media/video/saa7134/saa7134-oss.c
index 26c15b99a..63b32ab17 100644
--- a/linux/drivers/media/video/saa7134/saa7134-oss.c
+++ b/linux/drivers/media/video/saa7134/saa7134-oss.c
@@ -281,7 +281,7 @@ static int dsp_release(struct inode *inode, struct file *file)
 	return 0;
 }
 
-static ssize_t dsp_read(struct file *file, char *buffer,
+static ssize_t dsp_read(struct file *file, char __user *buffer,
 			size_t count, loff_t *ppos)
 {
 	struct saa7134_dev *dev = file->private_data;
@@ -354,7 +354,7 @@ static ssize_t dsp_read(struct file *file, char *buffer,
 	return ret;
 }
 
-static ssize_t dsp_write(struct file *file, const char *buffer,
+static ssize_t dsp_write(struct file *file, const char __user *buffer,
 			 size_t count, loff_t *ppos)
 {
 	return -EINVAL;
@@ -364,25 +364,27 @@ static int dsp_ioctl(struct inode *inode, struct file *file,
 		     unsigned int cmd, unsigned long arg)
 {
 	struct saa7134_dev *dev = file->private_data;
+	void __user *argp = (void __user *) arg;
+	int __user *p = argp;
 	int val = 0;
 	
 	if (oss_debug > 1)
 		saa7134_print_ioctl(dev->name,cmd);
         switch (cmd) {
         case OSS_GETVERSION:
-                return put_user(SOUND_VERSION, (int *)arg);
+                return put_user(SOUND_VERSION, p);
         case SNDCTL_DSP_GETCAPS:
 		return 0;
 
         case SNDCTL_DSP_SPEED:
-		if (get_user(val, (int*)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 		/* fall through */
         case SOUND_PCM_READ_RATE:
-		return put_user(dev->oss.rate, (int*)arg);
+		return put_user(dev->oss.rate, p);
 
         case SNDCTL_DSP_STEREO:
-		if (get_user(val, (int*)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 		down(&dev->oss.lock);
 		dev->oss.channels = val ? 2 : 1;
@@ -391,10 +393,10 @@ static int dsp_ioctl(struct inode *inode, struct file *file,
 			dsp_rec_start(dev);
 		}
 		up(&dev->oss.lock);
-		return put_user(dev->oss.channels-1, (int *)arg);
+		return put_user(dev->oss.channels-1, p);
 
         case SNDCTL_DSP_CHANNELS:
-		if (get_user(val, (int*)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 		if (val != 1 && val != 2)
 			return -EINVAL;
@@ -407,15 +409,15 @@ static int dsp_ioctl(struct inode *inode, struct file *file,
 		up(&dev->oss.lock);
 		/* fall through */
         case SOUND_PCM_READ_CHANNELS:
-		return put_user(dev->oss.channels, (int *)arg);
+		return put_user(dev->oss.channels, p);
 		
         case SNDCTL_DSP_GETFMTS: /* Returns a mask */
 		return put_user(AFMT_U8     | AFMT_S8     |
 				AFMT_U16_LE | AFMT_U16_BE |
-				AFMT_S16_LE | AFMT_S16_BE, (int*)arg);
+				AFMT_S16_LE | AFMT_S16_BE, p);
 
         case SNDCTL_DSP_SETFMT: /* Selects ONE fmt */
-		if (get_user(val, (int*)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 		switch (val) {
 		case AFMT_QUERY:
@@ -434,7 +436,7 @@ static int dsp_ioctl(struct inode *inode, struct file *file,
 				dsp_rec_start(dev);
 			}
 			up(&dev->oss.lock);
-			return put_user(dev->oss.afmt,(int*)arg);
+			return put_user(dev->oss.afmt, p);
 		default:
 			return -EINVAL;
 		}
@@ -443,12 +445,12 @@ static int dsp_ioctl(struct inode *inode, struct file *file,
 		switch (dev->oss.afmt) {
 		case AFMT_U8:
 		case AFMT_S8:
-			return put_user(8, (int*)arg);
+			return put_user(8, p);
 		case AFMT_U16_LE:
 		case AFMT_U16_BE:
 		case AFMT_S16_LE:
 		case AFMT_S16_BE:
-			return put_user(16, (int*)arg);
+			return put_user(16, p);
 		default:
 			return -EINVAL;
 		}
@@ -464,15 +466,16 @@ static int dsp_ioctl(struct inode *inode, struct file *file,
 		up(&dev->oss.lock);
 		return 0;
         case SNDCTL_DSP_GETBLKSIZE:
-		return put_user(dev->oss.blksize,(int*)arg);
+		return put_user(dev->oss.blksize, p);
 
         case SNDCTL_DSP_SETFRAGMENT:
-		if (get_user(val, (int*)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 		if (dev->oss.recording_on)
 			return -EBUSY;
 		dsp_buffer_free(dev);
-		dsp_buffer_conf(dev,1 << (val & 0xffff), (arg >> 16) & 0xffff);
+		/* used to be arg >> 16 instead of val >> 16; fixed */
+		dsp_buffer_conf(dev,1 << (val & 0xffff), (val >> 16) & 0xffff);
 		dsp_buffer_init(dev);
 		return 0;
 
@@ -487,7 +490,7 @@ static int dsp_ioctl(struct inode *inode, struct file *file,
 		info.fragstotal = dev->oss.blocks;
 		info.bytes      = dev->oss.read_count;
 		info.fragments  = info.bytes / info.fragsize;
-		if (copy_to_user((void *)arg, &info, sizeof(info)))
+		if (copy_to_user(argp, &info, sizeof(info)))
 			return -EFAULT;
 		return 0;
 	}
@@ -648,12 +651,14 @@ static int mixer_ioctl(struct inode *inode, struct file *file,
 	struct saa7134_dev *dev = file->private_data;
 	enum saa7134_audio_in input;
 	int val,ret;
+	void __user *argp = (void __user *) arg;
+	int __user *p = argp;
 	
 	if (oss_debug > 1)
 		saa7134_print_ioctl(dev->name,cmd);
         switch (cmd) {
         case OSS_GETVERSION:
-                return put_user(SOUND_VERSION, (int *)arg);
+                return put_user(SOUND_VERSION, p);
 	case SOUND_MIXER_INFO:
 	{
 		mixer_info info;
@@ -661,7 +666,7 @@ static int mixer_ioctl(struct inode *inode, struct file *file,
                 strlcpy(info.id,   "TV audio", sizeof(info.id));
                 strlcpy(info.name, dev->name,  sizeof(info.name));
                 info.modify_counter = dev->oss.count;
-                if (copy_to_user((void *)arg, &info, sizeof(info)))
+                if (copy_to_user(argp, &info, sizeof(info)))
                         return -EFAULT;
 		return 0;
 	}
@@ -671,23 +676,23 @@ static int mixer_ioctl(struct inode *inode, struct file *file,
 		memset(&info,0,sizeof(info));
                 strlcpy(info.id,   "TV audio", sizeof(info.id));
                 strlcpy(info.name, dev->name,  sizeof(info.name));
-                if (copy_to_user((void *)arg, &info, sizeof(info)))
+                if (copy_to_user(argp, &info, sizeof(info)))
                         return -EFAULT;
 		return 0;
 	}
 	case MIXER_READ(SOUND_MIXER_CAPS):
-		return put_user(SOUND_CAP_EXCL_INPUT,(int*)arg);
+		return put_user(SOUND_CAP_EXCL_INPUT, p);
 	case MIXER_READ(SOUND_MIXER_STEREODEVS):
-		return put_user(0,(int*)arg);
+		return put_user(0, p);
 	case MIXER_READ(SOUND_MIXER_RECMASK):
 	case MIXER_READ(SOUND_MIXER_DEVMASK):
 		val = SOUND_MASK_LINE1 | SOUND_MASK_LINE2;
 		if (32000 == dev->oss.rate)
 			val |= SOUND_MASK_VIDEO;
-		return put_user(val,(int*)arg);
+		return put_user(val, p);
 
 	case MIXER_WRITE(SOUND_MIXER_RECSRC):
-		if (get_user(val, (int *)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 		input = dev->oss.input;
 		if (32000 == dev->oss.rate  &&
@@ -707,16 +712,16 @@ static int mixer_ioctl(struct inode *inode, struct file *file,
 		case LINE2: ret = SOUND_MASK_LINE2; break;
 		default:    ret = 0;
 		}
-		return put_user(ret,(int*)arg);
+		return put_user(ret, p);
 
 	case MIXER_WRITE(SOUND_MIXER_VIDEO):
 	case MIXER_READ(SOUND_MIXER_VIDEO):
 		if (32000 != dev->oss.rate)
 			return -EINVAL;
-		return put_user(100 | 100 << 8,(int*)arg);
+		return put_user(100 | 100 << 8, p);
 
 	case MIXER_WRITE(SOUND_MIXER_LINE1):
-		if (get_user(val, (int *)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 		val &= 0xff;
 		val = (val <= 50) ? 50 : 100;
@@ -724,11 +729,10 @@ static int mixer_ioctl(struct inode *inode, struct file *file,
 		mixer_level(dev,LINE1,dev->oss.line1);
 		/* fall throuth */
 	case MIXER_READ(SOUND_MIXER_LINE1):
-		return put_user(dev->oss.line1 | dev->oss.line1 << 8,
-				(int*)arg);
+		return put_user(dev->oss.line1 | dev->oss.line1 << 8, p);
 
 	case MIXER_WRITE(SOUND_MIXER_LINE2):
-		if (get_user(val, (int *)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 		val &= 0xff;
 		val = (val <= 50) ? 50 : 100;
@@ -736,8 +740,7 @@ static int mixer_ioctl(struct inode *inode, struct file *file,
 		mixer_level(dev,LINE2,dev->oss.line2);
 		/* fall throuth */
 	case MIXER_READ(SOUND_MIXER_LINE2):
-		return put_user(dev->oss.line2 | dev->oss.line2 << 8,
-				(int*)arg);
+		return put_user(dev->oss.line2 | dev->oss.line2 << 8, p);
 
 	default:
 		return -EINVAL;
@@ -773,6 +776,8 @@ int saa7134_oss_init1(struct saa7134_dev *dev)
 	dev->oss.rate = 32000;
 	if (oss_rate)
 		dev->oss.rate = oss_rate;
+	if (saa7134_boards[dev->board].i2s_rate)
+		dev->oss.rate = saa7134_boards[dev->board].i2s_rate;
 	dev->oss.rate = (dev->oss.rate > 40000) ? 48000 : 32000;
 
 	/* mixer */
diff --git a/linux/drivers/media/video/saa7134/saa7134-ts.c b/linux/drivers/media/video/saa7134/saa7134-ts.c
index a3a3f60ad..9e1e0e296 100644
--- a/linux/drivers/media/video/saa7134/saa7134-ts.c
+++ b/linux/drivers/media/video/saa7134/saa7134-ts.c
@@ -245,7 +245,7 @@ static int ts_release(struct inode *inode, struct file *file)
 }
 
 static ssize_t
-ts_read(struct file *file, char *data, size_t count, loff_t *ppos)
+ts_read(struct file *file, char __user *data, size_t count, loff_t *ppos)
 {
 	struct saa7134_dev *dev = file->private_data;
 
diff --git a/linux/drivers/media/video/saa7134/saa7134-video.c b/linux/drivers/media/video/saa7134/saa7134-video.c
index 58afc8b53..c1812091a 100644
--- a/linux/drivers/media/video/saa7134/saa7134-video.c
+++ b/linux/drivers/media/video/saa7134/saa7134-video.c
@@ -1261,7 +1261,7 @@ static int video_open(struct inode *inode, struct file *file)
 }
 
 static ssize_t
-video_read(struct file *file, char *data, size_t count, loff_t *ppos)
+video_read(struct file *file, char __user *data, size_t count, loff_t *ppos)
 {
 	struct saa7134_fh *fh = file->private_data;
 
diff --git a/linux/drivers/media/video/tvmixer.c b/linux/drivers/media/video/tvmixer.c
index f5917b636..ec59e4598 100644
--- a/linux/drivers/media/video/tvmixer.c
+++ b/linux/drivers/media/video/tvmixer.c
@@ -19,8 +19,6 @@
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
 # include "i2c-compat.h"
 # include "id.h"
-#else
-# include <media/id.h>
 #endif
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,71)
 # define strlcpy(dest,src,len) strncpy(dest,src,(len)-1)
@@ -89,6 +87,8 @@ static int tvmixer_ioctl(struct inode *inode, struct file *file, unsigned int cm
 	int left,right,ret,val = 0;
         struct TVMIXER *mix = file->private_data;
 	struct i2c_client *client = mix->dev;
+	void __user *argp = (void __user *)arg;
+	int __user *p = argp;
 
 	if (NULL == client)
 		return -ENODEV;
@@ -98,7 +98,7 @@ static int tvmixer_ioctl(struct inode *inode, struct file *file, unsigned int cm
                 strlcpy(info.id, "tv card", sizeof(info.id));
                 strlcpy(info.name, i2c_clientname(client), sizeof(info.name));
                 info.modify_counter = 42 /* FIXME */;
-                if (copy_to_user((void *)arg, &info, sizeof(info)))
+                if (copy_to_user(argp, &info, sizeof(info)))
                         return -EFAULT;
                 return 0;
         }
@@ -106,15 +106,15 @@ static int tvmixer_ioctl(struct inode *inode, struct file *file, unsigned int cm
                 _old_mixer_info info;
                 strlcpy(info.id, "tv card", sizeof(info.id));
                 strlcpy(info.name, i2c_clientname(client), sizeof(info.name));
-                if (copy_to_user((void *)arg, &info, sizeof(info)))
+                if (copy_to_user(argp, &info, sizeof(info)))
                         return -EFAULT;
                 return 0;
         }
         if (cmd == OSS_GETVERSION)
-                return put_user(SOUND_VERSION, (int *)arg);
+                return put_user(SOUND_VERSION, p);
 
 	if (_SIOC_DIR(cmd) & _SIOC_WRITE)
-		if (get_user(val, (int *)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 
 	/* read state */
@@ -180,7 +180,7 @@ static int tvmixer_ioctl(struct inode *inode, struct file *file, unsigned int cm
 	default:
 		return -EINVAL;
 	}
-	if (put_user(ret, (int *)arg))
+	if (put_user(ret, p))
 		return -EFAULT;
 	return 0;
 }
diff --git a/linux/drivers/media/video/v4l1-compat.c b/linux/drivers/media/video/v4l1-compat.c
index 6398d023d..6e1389147 100644
--- a/linux/drivers/media/video/v4l1-compat.c
+++ b/linux/drivers/media/video/v4l1-compat.c
@@ -502,7 +502,7 @@ v4l_compat_translate_ioctl(struct inode         *inode,
 		fmt2->fmt.win.w.width   = win->width;
 		fmt2->fmt.win.w.height  = win->height;
 		fmt2->fmt.win.chromakey = win->chromakey;
-		fmt2->fmt.win.clips     = (void *)win->clips;
+		fmt2->fmt.win.clips     = (void __user *)win->clips;
 		fmt2->fmt.win.clipcount = win->clipcount;
 		err2 = drv(inode, file, VIDIOC_S_FMT, fmt2);
 		if (err2 < 0)
@@ -940,7 +940,7 @@ v4l_compat_translate_ioctl(struct inode         *inode,
 			dprintk("VIDIOCSYNC / VIDIOC_STREAMON: %d\n",err);
 			break;
 		}
-		
+
 		/*  Loop as long as the buffer is queued, but not done  */
 		while ((buf2.flags &
 			(V4L2_BUF_FLAG_QUEUED | V4L2_BUF_FLAG_DONE))
diff --git a/linux/drivers/media/video/video-buf.c b/linux/drivers/media/video/video-buf.c
index b3d64a6aa..35c9ea9b3 100644
--- a/linux/drivers/media/video/video-buf.c
+++ b/linux/drivers/media/video/video-buf.c
@@ -186,7 +186,7 @@ int videobuf_dma_init_overlay(struct videobuf_dmabuf *dma, int direction,
 	dma->direction = direction;
 	if (0 == addr)
 		return -EINVAL;
-	
+
 	dma->bus_addr = addr;
 	dma->nr_pages = nr_pages;
 	return 0;
@@ -745,7 +745,7 @@ int videobuf_streamoff(struct file *file, struct videobuf_queue *q)
 
 static ssize_t
 videobuf_read_zerocopy(struct file *file, struct videobuf_queue *q,
-		       char *data, size_t count, loff_t *ppos)
+		       char __user *data, size_t count, loff_t *ppos)
 {
 	enum v4l2_field field;
 	unsigned long flags;
@@ -787,7 +787,7 @@ videobuf_read_zerocopy(struct file *file, struct videobuf_queue *q,
 }
 
 ssize_t videobuf_read_one(struct file *file, struct videobuf_queue *q,
-			  char *data, size_t count, loff_t *ppos)
+			  char __user *data, size_t count, loff_t *ppos)
 {
 	enum v4l2_field field;
 	unsigned long flags;
@@ -911,7 +911,7 @@ void videobuf_read_stop(struct file *file, struct videobuf_queue *q)
 }
 
 ssize_t videobuf_read_stream(struct file *file, struct videobuf_queue *q,
-			     char *data, size_t count, loff_t *ppos,
+			     char __user *data, size_t count, loff_t *ppos,
 			     int vbihack)
 {
 	unsigned int *fc, bytes;
diff --git a/linux/include/linux/videodev.h b/linux/include/linux/videodev.h
index 28be56ad5..30ab076ce 100644
--- a/linux/include/linux/videodev.h
+++ b/linux/include/linux/videodev.h
@@ -1,6 +1,7 @@
 #ifndef __LINUX_VIDEODEV_H
 #define __LINUX_VIDEODEV_H
 
+#include <linux/compiler.h>
 #include <linux/types.h>
 #include <linux/version.h>
 
@@ -248,7 +249,7 @@ struct video_window
 	__u32	width,height;		/* Its size */
 	__u32	chromakey;
 	__u32	flags;
-	struct	video_clip *clips;	/* Set only */
+	struct	video_clip __user *clips;	/* Set only */
 	int	clipcount;
 #define VIDEO_WINDOW_INTERLACE	1
 #define VIDEO_WINDOW_CHROMAKEY	16	/* Overlay by chromakey */
@@ -455,8 +456,9 @@ struct video_code
 #define VID_HARDWARE_CPIA2	33
 #define VID_HARDWARE_VICAM      34
 #define VID_HARDWARE_SF16FMR2	35
-#define VID_HARDWARE_W9968CF    36
+#define VID_HARDWARE_W9968CF	36
 #define VID_HARDWARE_SAA7114H   37
+#define VID_HARDWARE_SN9C102	38
 #endif /* __LINUX_VIDEODEV_H */
 
 /*
diff --git a/linux/include/linux/videodev2.h b/linux/include/linux/videodev2.h
index ab8727d92..076dd41d5 100644
--- a/linux/include/linux/videodev2.h
+++ b/linux/include/linux/videodev2.h
@@ -433,9 +433,9 @@ struct v4l2_window
 	struct v4l2_rect        w;
 	enum v4l2_field  	field;
 	__u32			chromakey;
-	struct v4l2_clip	*clips;
+	struct v4l2_clip	__user *clips;
 	__u32			clipcount;
-	void			*bitmap;
+	void			__user *bitmap;
 };
 
 
diff --git a/linux/include/media/video-buf.h b/linux/include/media/video-buf.h
index 17b2ae290..3c17bdf0b 100644
--- a/linux/include/media/video-buf.h
+++ b/linux/include/media/video-buf.h
@@ -226,10 +226,10 @@ int videobuf_streamoff(struct file *file, struct videobuf_queue *q);
 int videobuf_read_start(struct file *file, struct videobuf_queue *q);
 void videobuf_read_stop(struct file *file, struct videobuf_queue *q);
 ssize_t videobuf_read_stream(struct file *file, struct videobuf_queue *q,
-			     char *data, size_t count, loff_t *ppos,
+			     char __user *data, size_t count, loff_t *ppos,
 			     int vbihack);
 ssize_t videobuf_read_one(struct file *file, struct videobuf_queue *q,
-			  char *data, size_t count, loff_t *ppos);
+			  char __user *data, size_t count, loff_t *ppos);
 unsigned int videobuf_poll_stream(struct file *file,
 				  struct videobuf_queue *q,
 				  poll_table *wait);