merge: http://linuxtv.org/hg/~awalls/cx18-bugfix

From: Mauro Carvalho Chehab <mchehab@redhat.com>

Priority: normal

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

30 files changed, 658 insertions, 766 deletions

diff --git a/linux/drivers/media/video/cx18/cx18-av-audio.c b/linux/drivers/media/video/cx18/cx18-av-audio.c
index 486cad0c2..fd85b9b2d 100644
--- a/linux/drivers/media/video/cx18/cx18-av-audio.c
+++ b/linux/drivers/media/video/cx18/cx18-av-audio.c
@@ -4,6 +4,7 @@
  *  Derived from cx25840-audio.c
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU General Public License
diff --git a/linux/drivers/media/video/cx18/cx18-av-core.c b/linux/drivers/media/video/cx18/cx18-av-core.c
index 518bd701d..40ea6fde6 100644
--- a/linux/drivers/media/video/cx18/cx18-av-core.c
+++ b/linux/drivers/media/video/cx18/cx18-av-core.c
@@ -4,6 +4,7 @@
  *  Derived from cx25840-core.c
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU General Public License
@@ -80,11 +81,6 @@ u32 cx18_av_read4(struct cx18 *cx, u16 addr)
 	return cx18_read_reg(cx, 0xc40000 + addr);
 }
 
-u32 cx18_av_read4_noretry(struct cx18 *cx, u16 addr)
-{
-	return cx18_read_reg_noretry(cx, 0xc40000 + addr);
-}
-
 int cx18_av_and_or(struct cx18 *cx, u16 addr, unsigned and_mask,
 		   u8 or_value)
 {
diff --git a/linux/drivers/media/video/cx18/cx18-av-core.h b/linux/drivers/media/video/cx18/cx18-av-core.h
index a07988c6f..cf68a6039 100644
--- a/linux/drivers/media/video/cx18/cx18-av-core.h
+++ b/linux/drivers/media/video/cx18/cx18-av-core.h
@@ -4,6 +4,7 @@
  *  Derived from cx25840-core.h
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU General Public License
@@ -307,7 +308,6 @@ int cx18_av_write4_expect(struct cx18 *cx, u16 addr, u32 value, u32 eval,
 			  u32 mask);
 u8 cx18_av_read(struct cx18 *cx, u16 addr);
 u32 cx18_av_read4(struct cx18 *cx, u16 addr);
-u32 cx18_av_read4_noretry(struct cx18 *cx, u16 addr);
 int cx18_av_and_or(struct cx18 *cx, u16 addr, unsigned mask, u8 value);
 int cx18_av_and_or4(struct cx18 *cx, u16 addr, u32 mask, u32 value);
 int cx18_av_cmd(struct cx18 *cx, unsigned int cmd, void *arg);
diff --git a/linux/drivers/media/video/cx18/cx18-av-firmware.c b/linux/drivers/media/video/cx18/cx18-av-firmware.c
index 924691dca..c64fd0a05 100644
--- a/linux/drivers/media/video/cx18/cx18-av-firmware.c
+++ b/linux/drivers/media/video/cx18/cx18-av-firmware.c
@@ -2,6 +2,7 @@
  *  cx18 ADEC firmware functions
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU General Public License
@@ -68,8 +69,7 @@ int cx18_av_loadfw(struct cx18 *cx)
 				cx18_av_write4_noretry(cx, CXADEC_DL_CTL,
 						       dl_control);
 				udelay(10);
-				value = cx18_av_read4_noretry(cx,
-							      CXADEC_DL_CTL);
+				value = cx18_av_read4(cx, CXADEC_DL_CTL);
 				if (value == dl_control)
 					break;
 				/* Check if we can correct the byte by changing
@@ -80,8 +80,6 @@ int cx18_av_loadfw(struct cx18 *cx)
 					break;
 				}
 			}
-			cx18_log_write_retries(cx, retries2,
-					cx->reg_mem + 0xc40000 + CXADEC_DL_CTL);
 			if (unrec_err || retries2 >= CX18_MAX_MMIO_WR_RETRIES)
 				break;
 		}
diff --git a/linux/drivers/media/video/cx18/cx18-cards.c b/linux/drivers/media/video/cx18/cx18-cards.c
index 7345fc09d..23bd871b7 100644
--- a/linux/drivers/media/video/cx18/cx18-cards.c
+++ b/linux/drivers/media/video/cx18/cx18-cards.c
@@ -4,6 +4,7 @@
  *  Derived from ivtv-cards.c
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
diff --git a/linux/drivers/media/video/cx18/cx18-cards.h b/linux/drivers/media/video/cx18/cx18-cards.h
index 32155f6e6..a54aae9ed 100644
--- a/linux/drivers/media/video/cx18/cx18-cards.h
+++ b/linux/drivers/media/video/cx18/cx18-cards.h
@@ -4,6 +4,7 @@
  *  Derived from ivtv-cards.c
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
diff --git a/linux/drivers/media/video/cx18/cx18-driver.c b/linux/drivers/media/video/cx18/cx18-driver.c
index 54f0fde42..1fa9a670b 100644
--- a/linux/drivers/media/video/cx18/cx18-driver.c
+++ b/linux/drivers/media/video/cx18/cx18-driver.c
@@ -56,6 +56,9 @@ struct cx18 *cx18_cards[CX18_MAX_CARDS];
 /* Protects cx18_cards_active */
 DEFINE_SPINLOCK(cx18_cards_lock);
 
+/* Queue for deferrable IRQ handling work for all cx18 cards in system */
+struct workqueue_struct *cx18_work_queue;
+
 /* add your revision and whatnot here */
 static struct pci_device_id cx18_pci_tbl[] __devinitdata = {
 	{PCI_VENDOR_ID_CX, PCI_DEVICE_ID_CX23418,
@@ -75,14 +78,9 @@ static int radio[CX18_MAX_CARDS] = { -1, -1, -1, -1, -1, -1, -1, -1,
 				     -1, -1, -1, -1, -1, -1, -1, -1,
 				     -1, -1, -1, -1, -1, -1, -1, -1,
 				     -1, -1, -1, -1, -1, -1, -1, -1 };
-static int mmio_ndelay[CX18_MAX_CARDS] = { -1, -1, -1, -1, -1, -1, -1, -1,
-					   -1, -1, -1, -1, -1, -1, -1, -1,
-					   -1, -1, -1, -1, -1, -1, -1, -1,
-					   -1, -1, -1, -1, -1, -1, -1, -1 };
 static unsigned cardtype_c = 1;
 static unsigned tuner_c = 1;
 static unsigned radio_c = 1;
-static unsigned mmio_ndelay_c = 1;
 static char pal[] = "--";
 static char secam[] = "--";
 static char ntsc[] = "-";
@@ -96,18 +94,20 @@ static int enc_pcm_buffers = CX18_DEFAULT_ENC_PCM_BUFFERS;
 
 static int cx18_pci_latency = 1;
 
-int cx18_retry_mmio = 1;
+static int mmio_ndelay;
+static int retry_mmio = 1;
+
 int cx18_debug;
 
 module_param_array(tuner, int, &tuner_c, 0644);
 module_param_array(radio, bool, &radio_c, 0644);
 module_param_array(cardtype, int, &cardtype_c, 0644);
-module_param_array(mmio_ndelay, int, &mmio_ndelay_c, 0644);
 module_param_string(pal, pal, sizeof(pal), 0644);
 module_param_string(secam, secam, sizeof(secam), 0644);
 module_param_string(ntsc, ntsc, sizeof(ntsc), 0644);
 module_param_named(debug, cx18_debug, int, 0644);
-module_param_named(retry_mmio, cx18_retry_mmio, int, 0644);
+module_param(mmio_ndelay, int, 0644);
+module_param(retry_mmio, int, 0644);
 module_param(cx18_pci_latency, int, 0644);
 module_param(cx18_first_minor, int, 0644);
 
@@ -152,13 +152,11 @@ MODULE_PARM_DESC(cx18_pci_latency,
 		 "Change the PCI latency to 64 if lower: 0 = No, 1 = Yes,\n"
 		 "\t\t\tDefault: Yes");
 MODULE_PARM_DESC(retry_mmio,
-		 "Check and retry memory mapped IO accesses\n"
-		 "\t\t\tDefault: 1 [Yes]");
+		 "(Deprecated) MMIO writes are now always checked and retried\n"
+		 "\t\t\tEffectively: 1 [Yes]");
 MODULE_PARM_DESC(mmio_ndelay,
-		 "Delay (ns) for each CX23418 memory mapped IO access.\n"
-		 "\t\t\tTry larger values that are close to a multiple of the\n"
-		 "\t\t\tPCI clock period, 30.3 ns, if your card doesn't work.\n"
-		 "\t\t\tDefault: " __stringify(CX18_DEFAULT_MMIO_NDELAY));
+		 "(Deprecated) MMIO accesses are now never purposely delayed\n"
+		 "\t\t\tEffectively: 0 ns");
 MODULE_PARM_DESC(enc_mpg_buffers,
 		 "Encoder MPG Buffers (in MB)\n"
 		 "\t\t\tDefault: " __stringify(CX18_DEFAULT_ENC_MPG_BUFFERS));
@@ -375,11 +373,6 @@ static void cx18_process_options(struct cx18 *cx)
 	cx->options.tuner = tuner[cx->num];
 	cx->options.radio = radio[cx->num];
 
-	if (mmio_ndelay[cx->num] < 0)
-		cx->options.mmio_ndelay = CX18_DEFAULT_MMIO_NDELAY;
-	else
-		cx->options.mmio_ndelay = mmio_ndelay[cx->num];
-
 	cx->std = cx18_parse_std(cx);
 	if (cx->options.cardtype == -1) {
 		CX18_INFO("Ignore card\n");
@@ -440,6 +433,8 @@ done:
  */
 static int __devinit cx18_init_struct1(struct cx18 *cx)
 {
+	int i;
+
 	cx->base_addr = pci_resource_start(cx->dev, 0);
 
 	mutex_init(&cx->serialize_lock);
@@ -451,11 +446,16 @@ static int __devinit cx18_init_struct1(struct cx18 *cx)
 
 	spin_lock_init(&cx->lock);
 
+	for (i = 0; i < CX18_MAX_EPU_WORK_ORDERS; i++) {
+		cx->epu_work_order[i].cx = cx;
+		cx->epu_work_order[i].str = cx->epu_debug_str;
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 20)
-	INIT_WORK(&cx->work, cx18_work_handler);
+		INIT_WORK(&cx->epu_work_order[i].work, cx18_epu_work_handler);
 #else
-	INIT_WORK(&cx->work, cx18_work_handler, cx);
+		INIT_WORK(&cx->epu_work_order[i].work, cx18_epu_work_handler,
+			  &cx->epu_work_order[i].work);
 #endif
+	}
 
 	/* start counting open_id at 1 */
 	cx->open_id = 1;
@@ -839,7 +839,6 @@ err:
 	if (retval == 0)
 		retval = -ENODEV;
 	CX18_ERR("Error %d on initialization\n", retval);
-	cx18_log_statistics(cx);
 
 	i = cx->num;
 	spin_lock(&cx18_cards_lock);
@@ -918,6 +917,13 @@ int cx18_init_on_first_open(struct cx18 *cx)
 	return 0;
 }
 
+static void cx18_cancel_epu_work_orders(struct cx18 *cx)
+{
+	int i;
+	for (i = 0; i < CX18_MAX_EPU_WORK_ORDERS; i++)
+		cancel_work_sync(&cx->epu_work_order[i].work);
+}
+
 static void cx18_remove(struct pci_dev *pci_dev)
 {
 	struct cx18 *cx = pci_get_drvdata(pci_dev);
@@ -935,7 +941,7 @@ static void cx18_remove(struct pci_dev *pci_dev)
 
 	cx18_halt_firmware(cx);
 
-	flush_scheduled_work();
+	cx18_cancel_epu_work_orders(cx);
 
 	cx18_streams_cleanup(cx, 1);
 
@@ -949,7 +955,6 @@ static void cx18_remove(struct pci_dev *pci_dev)
 
 	pci_disable_device(cx->dev);
 
-	cx18_log_statistics(cx);
 	CX18_INFO("Removed %s, card #%d\n", cx->card_name, cx->num);
 }
 
@@ -979,8 +984,17 @@ static int module_start(void)
 		printk(KERN_INFO "cx18:   Debug value must be >= 0 and <= 511!\n");
 	}
 
+	cx18_work_queue = create_singlethread_workqueue("cx18");
+	if (cx18_work_queue == NULL) {
+		printk(KERN_ERR
+		       "cx18:   Unable to create work hander thread\n");
+		return -ENOMEM;
+	}
+
 	if (pci_register_driver(&cx18_pci_driver)) {
 		printk(KERN_ERR "cx18:   Error detecting PCI card\n");
+		destroy_workqueue(cx18_work_queue);
+		cx18_work_queue = NULL;
 		return -ENODEV;
 	}
 	printk(KERN_INFO "cx18:  End initialization\n");
@@ -993,11 +1007,15 @@ static void module_cleanup(void)
 
 	pci_unregister_driver(&cx18_pci_driver);
 
+	destroy_workqueue(cx18_work_queue);
+	cx18_work_queue = NULL;
+
 	for (i = 0; i < cx18_cards_active; i++) {
 		if (cx18_cards[i] == NULL)
 			continue;
 		kfree(cx18_cards[i]);
 	}
+
 }
 
 module_init(module_start);
diff --git a/linux/drivers/media/video/cx18/cx18-driver.h b/linux/drivers/media/video/cx18/cx18-driver.h
index ce7680675..ca1f43781 100644
--- a/linux/drivers/media/video/cx18/cx18-driver.h
+++ b/linux/drivers/media/video/cx18/cx18-driver.h
@@ -4,6 +4,7 @@
  *  Derived from ivtv-driver.h
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -64,9 +65,6 @@
 #  error "This driver requires kernel PCI support."
 #endif
 
-/* Default delay to throttle mmio access to the CX23418 */
-#define CX18_DEFAULT_MMIO_NDELAY 0 /* 0 ns = 0 PCI clock(s) / 33 MHz */
-
 #define CX18_MEM_OFFSET	0x00000000
 #define CX18_MEM_SIZE	0x04000000
 #define CX18_REG_OFFSET	0x02000000
@@ -176,7 +174,6 @@
 
 #define CX18_MAX_PGM_INDEX (400)
 
-extern int cx18_retry_mmio;	/* enable check & retry of mmio accesses */
 extern int cx18_debug;
 
 
@@ -185,7 +182,6 @@ struct cx18_options {
 	int cardtype;		/* force card type on load */
 	int tuner;		/* set tuner on load */
 	int radio;		/* enable/disable radio */
-	unsigned long mmio_ndelay; /* delay in ns after every PCI mmio access */
 };
 
 /* per-buffer bit flags */
@@ -203,8 +199,6 @@ struct cx18_options {
 #define CX18_F_I_EOS			4 	/* End of encoder stream */
 #define CX18_F_I_RADIO_USER		5 	/* radio tuner is selected */
 #define CX18_F_I_ENC_PAUSED		13 	/* the encoder is paused */
-#define CX18_F_I_HAVE_WORK		15   	/* there is work to be done */
-#define CX18_F_I_WORK_HANDLER_DVB	18   	/* work to be done for DVB */
 #define CX18_F_I_INITED			21 	/* set after first open */
 #define CX18_F_I_FAILED			22 	/* set if first open failed */
 
@@ -219,6 +213,7 @@ struct cx18_buffer {
 	dma_addr_t dma_handle;
 	u32 id;
 	unsigned long b_flags;
+	unsigned skipped;
 	char *buf;
 
 	u32 bytesused;
@@ -247,6 +242,26 @@ struct cx18_dvb {
 struct cx18;	 /* forward reference */
 struct cx18_scb; /* forward reference */
 
+
+#define CX18_MAX_MDL_ACKS 2
+#define CX18_MAX_EPU_WORK_ORDERS 70 /* CPU_DE_RELEASE_MDL bursts 63 commands */
+
+#define CX18_F_EWO_MB_STALE_UPON_RECEIPT 0x1
+#define CX18_F_EWO_MB_STALE_WHILE_PROC   0x2
+#define CX18_F_EWO_MB_STALE \
+	     (CX18_F_EWO_MB_STALE_UPON_RECEIPT | CX18_F_EWO_MB_STALE_WHILE_PROC)
+
+struct cx18_epu_work_order {
+	struct work_struct work;
+	atomic_t pending;
+	struct cx18 *cx;
+	unsigned long flags;
+	int rpu;
+	struct cx18_mailbox mb;
+	struct cx18_mdl_ack mdl_ack[CX18_MAX_MDL_ACKS];
+	char *str;
+};
+
 #define CX18_INVALID_TASK_HANDLE 0xffffffff
 
 struct cx18_stream {
@@ -260,7 +275,7 @@ struct cx18_stream {
 	unsigned mdl_offset;
 
 	u32 id;
-	spinlock_t qlock; 	/* locks access to the queues */
+	struct mutex qlock; 	/* locks access to the queues */
 	unsigned long s_flags;	/* status flags, see above */
 	int dma;		/* can be PCI_DMA_TODEVICE,
 				   PCI_DMA_FROMDEVICE or
@@ -353,18 +368,6 @@ struct cx18_i2c_algo_callback_data {
 };
 
 #define CX18_MAX_MMIO_WR_RETRIES 10
-#define CX18_MAX_MMIO_RD_RETRIES  2
-
-struct cx18_mmio_stats {
-	atomic_t retried_write[CX18_MAX_MMIO_WR_RETRIES+1];
-	atomic_t retried_read[CX18_MAX_MMIO_RD_RETRIES+1];
-};
-
-#define CX18_MAX_MB_ACK_DELAY 100
-
-struct cx18_mbox_stats {
-	atomic_t mb_ack_delay[CX18_MAX_MB_ACK_DELAY+1];
-};
 
 /* Struct to hold info about cx18 cards */
 struct cx18 {
@@ -388,7 +391,6 @@ struct cx18 {
 	struct mutex epu2apu_mb_lock; /* protect driver to chip mailbox in SCB*/
 	struct mutex epu2cpu_mb_lock; /* protect driver to chip mailbox in SCB*/
 
-
 	struct cx18_av_state av_state;
 
 	/* codec settings */
@@ -441,7 +443,12 @@ struct cx18 {
 	/* when the current DMA is finished this queue is woken up */
 	wait_queue_head_t dma_waitq;
 
-	struct work_struct work;
+	u32 sw1_irq_mask;
+	u32 sw2_irq_mask;
+	u32 hw2_irq_mask;
+
+	struct cx18_epu_work_order epu_work_order[CX18_MAX_EPU_WORK_ORDERS];
+	char epu_debug_str[256]; /* CX18_EPU_DEBUG is rare: use shared space */
 
 	/* i2c */
 	struct i2c_adapter i2c_adap[2];
@@ -456,10 +463,6 @@ struct cx18 {
 	u32 gpio_val;
 	struct mutex gpio_lock;
 
-	/* Statistics */
-	struct cx18_mmio_stats mmio_stats;
-	struct cx18_mbox_stats mbox_stats;
-
 	/* v4l2 and User settings */
 
 	/* codec settings */
@@ -475,6 +478,7 @@ extern struct cx18 *cx18_cards[];
 extern int cx18_cards_active;
 extern int cx18_first_minor;
 extern spinlock_t cx18_cards_lock;
+extern struct workqueue_struct *cx18_work_queue;
 
 /*==============Prototypes==================*/
 
diff --git a/linux/drivers/media/video/cx18/cx18-dvb.c b/linux/drivers/media/video/cx18/cx18-dvb.c
index 4845f732e..034e09a37 100644
--- a/linux/drivers/media/video/cx18/cx18-dvb.c
+++ b/linux/drivers/media/video/cx18/cx18-dvb.c
@@ -2,6 +2,7 @@
  *  cx18 functions for DVB support
  *
  *  Copyright (c) 2008 Steven Toth <stoth@linuxtv.org>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -23,8 +24,6 @@
 #include "cx18-dvb.h"
 #include "cx18-io.h"
 #include "cx18-streams.h"
-#include "cx18-queue.h"
-#include "cx18-scb.h"
 #include "cx18-cards.h"
 #include "s5h1409.h"
 #include "mxl5005s.h"
@@ -305,26 +304,3 @@ static int dvb_register(struct cx18_stream *stream)
 
 	return ret;
 }
-
-void cx18_dvb_work_handler(struct cx18 *cx)
-{
-	struct cx18_buffer *buf;
-	struct cx18_stream *s = &cx->streams[CX18_ENC_STREAM_TYPE_TS];
-
-	while ((buf = cx18_dequeue(s, &s->q_full)) != NULL) {
-		if (s->dvb.enabled)
-			dvb_dmx_swfilter(&s->dvb.demux, buf->buf,
-					 buf->bytesused);
-
-		cx18_buf_sync_for_device(s, buf);
-		cx18_enqueue(s, buf, &s->q_free);
-
-		if (s->handle == CX18_INVALID_TASK_HANDLE ||
-		    !test_bit(CX18_F_S_STREAMING, &s->s_flags))
-			continue;
-
-		cx18_vapi(cx, CX18_CPU_DE_SET_MDL, 5, s->handle,
-		       (void __iomem *)&cx->scb->cpu_mdl[buf->id] - cx->enc_mem,
-		       1, buf->id, s->buf_size);
-	}
-}
diff --git a/linux/drivers/media/video/cx18/cx18-dvb.h b/linux/drivers/media/video/cx18/cx18-dvb.h
index bbdcefc87..bf8d8f6f5 100644
--- a/linux/drivers/media/video/cx18/cx18-dvb.h
+++ b/linux/drivers/media/video/cx18/cx18-dvb.h
@@ -23,4 +23,3 @@
 
 int cx18_dvb_register(struct cx18_stream *stream);
 void cx18_dvb_unregister(struct cx18_stream *stream);
-void cx18_dvb_work_handler(struct cx18 *cx);
diff --git a/linux/drivers/media/video/cx18/cx18-fileops.c b/linux/drivers/media/video/cx18/cx18-fileops.c
index e884271b8..45b5f402e 100644
--- a/linux/drivers/media/video/cx18/cx18-fileops.c
+++ b/linux/drivers/media/video/cx18/cx18-fileops.c
@@ -4,6 +4,7 @@
  *  Derived from ivtv-fileops.c
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
diff --git a/linux/drivers/media/video/cx18/cx18-firmware.c b/linux/drivers/media/video/cx18/cx18-firmware.c
index d9c5f55ab..8eac84314 100644
--- a/linux/drivers/media/video/cx18/cx18-firmware.c
+++ b/linux/drivers/media/video/cx18/cx18-firmware.c
@@ -2,6 +2,7 @@
  *  cx18 firmware functions
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -121,6 +122,7 @@ static int load_cpu_fw_direct(const char *fn, u8 __iomem *mem, struct cx18 *cx)
 			if (cx18_raw_readl(cx, dst) != *src) {
 				CX18_ERR("Mismatch at offset %x\n", i);
 				release_firmware(fw);
+				cx18_setup_page(cx, 0);
 				return -EIO;
 			}
 			dst++;
@@ -131,6 +133,7 @@ static int load_cpu_fw_direct(const char *fn, u8 __iomem *mem, struct cx18 *cx)
 		CX18_INFO("loaded %s firmware (%zd bytes)\n", fn, fw->size);
 	size = fw->size;
 	release_firmware(fw);
+	cx18_setup_page(cx, SCB_OFFSET);
 	return size;
 }
 
@@ -150,6 +153,7 @@ static int load_apu_fw_direct(const char *fn, u8 __iomem *dst, struct cx18 *cx,
 	if (request_firmware(&fw, fn, &cx->dev->dev)) {
 		CX18_ERR("unable to open firmware %s\n", fn);
 		CX18_ERR("did you put the firmware in the hotplug firmware directory?\n");
+		cx18_setup_page(cx, 0);
 		return -ENOMEM;
 	}
 
@@ -185,6 +189,7 @@ static int load_apu_fw_direct(const char *fn, u8 __iomem *dst, struct cx18 *cx,
 					CX18_ERR("Mismatch at offset %x\n",
 						 offset + j);
 					release_firmware(fw);
+					cx18_setup_page(cx, 0);
 					return -EIO;
 				}
 			}
@@ -196,6 +201,7 @@ static int load_apu_fw_direct(const char *fn, u8 __iomem *dst, struct cx18 *cx,
 				fn, apu_version, fw->size);
 	size = fw->size;
 	release_firmware(fw);
+	cx18_setup_page(cx, 0);
 	return size;
 }
 
diff --git a/linux/drivers/media/video/cx18/cx18-gpio.c b/linux/drivers/media/video/cx18/cx18-gpio.c
index 17b7a32fc..1a99329f3 100644
--- a/linux/drivers/media/video/cx18/cx18-gpio.c
+++ b/linux/drivers/media/video/cx18/cx18-gpio.c
@@ -4,6 +4,7 @@
  *  Derived from ivtv-gpio.c
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -60,8 +61,6 @@ static void gpio_write(struct cx18 *cx)
 					CX18_REG_GPIO_DIR2, ~dir_hi, dir_hi);
 	cx18_write_reg_expect(cx, (dir_hi << 16) | val_hi,
 					CX18_REG_GPIO_OUT2, val_hi, dir_hi);
-	if (!cx18_retry_mmio)
-		(void) cx18_read_reg(cx, CX18_REG_GPIO_OUT2); /* sync */
 }
 
 void cx18_reset_i2c_slaves_gpio(struct cx18 *cx)
diff --git a/linux/drivers/media/video/cx18/cx18-gpio.h b/linux/drivers/media/video/cx18/cx18-gpio.h
index beb7424b9..39ffccc19 100644
--- a/linux/drivers/media/video/cx18/cx18-gpio.h
+++ b/linux/drivers/media/video/cx18/cx18-gpio.h
@@ -4,6 +4,7 @@
  *  Derived from ivtv-gpio.h
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
diff --git a/linux/drivers/media/video/cx18/cx18-i2c.c b/linux/drivers/media/video/cx18/cx18-i2c.c
index 1af9ea149..c0a79ecd4 100644
--- a/linux/drivers/media/video/cx18/cx18-i2c.c
+++ b/linux/drivers/media/video/cx18/cx18-i2c.c
@@ -4,6 +4,7 @@
  *  Derived from ivtv-i2c.c
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -184,9 +185,9 @@ static void cx18_setscl(void *data, int state)
 	u32 r = cx18_read_reg(cx, addr);
 
 	if (state)
-		cx18_write_reg_sync(cx, r | SETSCL_BIT, addr);
+		cx18_write_reg(cx, r | SETSCL_BIT, addr);
 	else
-		cx18_write_reg_sync(cx, r & ~SETSCL_BIT, addr);
+		cx18_write_reg(cx, r & ~SETSCL_BIT, addr);
 }
 
 static void cx18_setsda(void *data, int state)
@@ -197,9 +198,9 @@ static void cx18_setsda(void *data, int state)
 	u32 r = cx18_read_reg(cx, addr);
 
 	if (state)
-		cx18_write_reg_sync(cx, r | SETSDL_BIT, addr);
+		cx18_write_reg(cx, r | SETSDL_BIT, addr);
 	else
-		cx18_write_reg_sync(cx, r & ~SETSDL_BIT, addr);
+		cx18_write_reg(cx, r & ~SETSDL_BIT, addr);
 }
 
 static int cx18_getscl(void *data)
@@ -433,16 +434,10 @@ int init_cx18_i2c(struct cx18 *cx)
 	}
 	/* courtesy of Steven Toth <stoth@hauppauge.com> */
 	cx18_write_reg_expect(cx, 0x00c00000, 0xc7001c, 0x00000000, 0x00c000c0);
-	if (!cx18_retry_mmio)
-		(void) cx18_read_reg(cx, 0xc7001c); /* sync */
 	mdelay(10);
 	cx18_write_reg_expect(cx, 0x00c000c0, 0xc7001c, 0x000000c0, 0x00c000c0);
-	if (!cx18_retry_mmio)
-		(void) cx18_read_reg(cx, 0xc7001c); /* sync */
 	mdelay(10);
 	cx18_write_reg_expect(cx, 0x00c00000, 0xc7001c, 0x00000000, 0x00c000c0);
-	if (!cx18_retry_mmio)
-		(void) cx18_read_reg(cx, 0xc7001c); /* sync */
 	mdelay(10);
 
 	/* Set to edge-triggered intrs. */
@@ -452,12 +447,12 @@ int init_cx18_i2c(struct cx18 *cx)
 		       ~(HW2_I2C1_INT|HW2_I2C2_INT), HW2_I2C1_INT|HW2_I2C2_INT);
 
 	/* Hw I2C1 Clock Freq ~100kHz */
-	cx18_write_reg_sync(cx, 0x00021c0f & ~4, CX18_REG_I2C_1_WR);
+	cx18_write_reg(cx, 0x00021c0f & ~4, CX18_REG_I2C_1_WR);
 	cx18_setscl(&cx->i2c_algo_cb_data[0], 1);
 	cx18_setsda(&cx->i2c_algo_cb_data[0], 1);
 
 	/* Hw I2C2 Clock Freq ~100kHz */
-	cx18_write_reg_sync(cx, 0x00021c0f & ~4, CX18_REG_I2C_2_WR);
+	cx18_write_reg(cx, 0x00021c0f & ~4, CX18_REG_I2C_2_WR);
 	cx18_setscl(&cx->i2c_algo_cb_data[1], 1);
 	cx18_setsda(&cx->i2c_algo_cb_data[1], 1);
 
diff --git a/linux/drivers/media/video/cx18/cx18-io.c b/linux/drivers/media/video/cx18/cx18-io.c
index 3c6485fce..ec5b3d7bc 100644
--- a/linux/drivers/media/video/cx18/cx18-io.c
+++ b/linux/drivers/media/video/cx18/cx18-io.c
@@ -24,183 +24,6 @@
 #include "cx18-io.h"
 #include "cx18-irq.h"
 
-void cx18_log_statistics(struct cx18 *cx)
-{
-	int i;
-
-	if (!(cx18_debug & CX18_DBGFLG_INFO))
-		return;
-
-	for (i = 0; i <= CX18_MAX_MMIO_WR_RETRIES; i++)
-		CX18_DEBUG_INFO("retried_write[%d] = %d\n", i,
-				atomic_read(&cx->mmio_stats.retried_write[i]));
-	for (i = 0; i <= CX18_MAX_MMIO_RD_RETRIES; i++)
-		CX18_DEBUG_INFO("retried_read[%d] = %d\n", i,
-				atomic_read(&cx->mmio_stats.retried_read[i]));
-	for (i = 0; i <= CX18_MAX_MB_ACK_DELAY; i++)
-		if (atomic_read(&cx->mbox_stats.mb_ack_delay[i]))
-			CX18_DEBUG_INFO("mb_ack_delay[%d] = %d\n", i,
-				  atomic_read(&cx->mbox_stats.mb_ack_delay[i]));
-	return;
-}
-
-void cx18_raw_writel_retry(struct cx18 *cx, u32 val, void __iomem *addr)
-{
-	int i;
-	for (i = 0; i < CX18_MAX_MMIO_WR_RETRIES; i++) {
-		cx18_raw_writel_noretry(cx, val, addr);
-		if (val == cx18_raw_readl_noretry(cx, addr))
-			break;
-	}
-	cx18_log_write_retries(cx, i, addr);
-}
-
-u32 cx18_raw_readl_retry(struct cx18 *cx, const void __iomem *addr)
-{
-	int i;
-	u32 val;
-	for (i = 0; i < CX18_MAX_MMIO_RD_RETRIES; i++) {
-		val = cx18_raw_readl_noretry(cx, addr);
-		if (val != 0xffffffff) /* PCI bus read error */
-			break;
-	}
-	cx18_log_read_retries(cx, i, addr);
-	return val;
-}
-
-u16 cx18_raw_readw_retry(struct cx18 *cx, const void __iomem *addr)
-{
-	int i;
-	u16 val;
-	for (i = 0; i < CX18_MAX_MMIO_RD_RETRIES; i++) {
-		val = cx18_raw_readw_noretry(cx, addr);
-		if (val != 0xffff) /* PCI bus read error */
-			break;
-	}
-	cx18_log_read_retries(cx, i, addr);
-	return val;
-}
-
-void cx18_writel_retry(struct cx18 *cx, u32 val, void __iomem *addr)
-{
-	int i;
-	for (i = 0; i < CX18_MAX_MMIO_WR_RETRIES; i++) {
-		cx18_writel_noretry(cx, val, addr);
-		if (val == cx18_readl_noretry(cx, addr))
-			break;
-	}
-	cx18_log_write_retries(cx, i, addr);
-}
-
-void _cx18_writel_expect(struct cx18 *cx, u32 val, void __iomem *addr,
-			 u32 eval, u32 mask)
-{
-	int i;
-	eval &= mask;
-	for (i = 0; i < CX18_MAX_MMIO_WR_RETRIES; i++) {
-		cx18_writel_noretry(cx, val, addr);
-		if (eval == (cx18_readl_noretry(cx, addr) & mask))
-			break;
-	}
-	cx18_log_write_retries(cx, i, addr);
-}
-
-void cx18_writew_retry(struct cx18 *cx, u16 val, void __iomem *addr)
-{
-	int i;
-	for (i = 0; i < CX18_MAX_MMIO_WR_RETRIES; i++) {
-		cx18_writew_noretry(cx, val, addr);
-		if (val == cx18_readw_noretry(cx, addr))
-			break;
-	}
-	cx18_log_write_retries(cx, i, addr);
-}
-
-void cx18_writeb_retry(struct cx18 *cx, u8 val, void __iomem *addr)
-{
-	int i;
-	for (i = 0; i < CX18_MAX_MMIO_WR_RETRIES; i++) {
-		cx18_writeb_noretry(cx, val, addr);
-		if (val == cx18_readb_noretry(cx, addr))
-			break;
-	}
-	cx18_log_write_retries(cx, i, addr);
-}
-
-u32 cx18_readl_retry(struct cx18 *cx, const void __iomem *addr)
-{
-	int i;
-	u32 val;
-	for (i = 0; i < CX18_MAX_MMIO_RD_RETRIES; i++) {
-		val = cx18_readl_noretry(cx, addr);
-		if (val != 0xffffffff) /* PCI bus read error */
-			break;
-	}
-	cx18_log_read_retries(cx, i, addr);
-	return val;
-}
-
-u16 cx18_readw_retry(struct cx18 *cx, const void __iomem *addr)
-{
-	int i;
-	u16 val;
-	for (i = 0; i < CX18_MAX_MMIO_RD_RETRIES; i++) {
-		val = cx18_readw_noretry(cx, addr);
-		if (val != 0xffff) /* PCI bus read error */
-			break;
-	}
-	cx18_log_read_retries(cx, i, addr);
-	return val;
-}
-
-u8 cx18_readb_retry(struct cx18 *cx, const void __iomem *addr)
-{
-	int i;
-	u8 val;
-	for (i = 0; i < CX18_MAX_MMIO_RD_RETRIES; i++) {
-		val = cx18_readb_noretry(cx, addr);
-		if (val != 0xff) /* PCI bus read error */
-			break;
-	}
-	cx18_log_read_retries(cx, i, addr);
-	return val;
-}
-
-void cx18_memcpy_fromio(struct cx18 *cx, void *to,
-			const void __iomem *from, unsigned int len)
-{
-	const u8 __iomem *src = from;
-	u8 *dst = to;
-
-	/* Align reads on the CX23418's addresses */
-	if ((len > 0) && ((unsigned long) src & 1)) {
-		*dst = cx18_readb(cx, src);
-		len--;
-		dst++;
-		src++;
-	}
-	if ((len > 1) && ((unsigned long) src & 2)) {
-		*((u16 *)dst) = cx18_raw_readw(cx, src);
-		len -= 2;
-		dst += 2;
-		src += 2;
-	}
-	while (len > 3) {
-		*((u32 *)dst) = cx18_raw_readl(cx, src);
-		len -= 4;
-		dst += 4;
-		src += 4;
-	}
-	if (len > 1) {
-		*((u16 *)dst) = cx18_raw_readw(cx, src);
-		len -= 2;
-		dst += 2;
-		src += 2;
-	}
-	if (len > 0)
-		*dst = cx18_readb(cx, src);
-}
-
 void cx18_memset_io(struct cx18 *cx, void __iomem *addr, int val, size_t count)
 {
 	u8 __iomem *dst = addr;
@@ -234,32 +57,28 @@ void cx18_memset_io(struct cx18 *cx, void __iomem *addr, int val, size_t count)
 
 void cx18_sw1_irq_enable(struct cx18 *cx, u32 val)
 {
-	u32 r;
 	cx18_write_reg_expect(cx, val, SW1_INT_STATUS, ~val, val);
-	r = cx18_read_reg(cx, SW1_INT_ENABLE_PCI);
-	cx18_write_reg(cx, r | val, SW1_INT_ENABLE_PCI);
+	cx->sw1_irq_mask = cx18_read_reg(cx, SW1_INT_ENABLE_PCI) | val;
+	cx18_write_reg(cx, cx->sw1_irq_mask, SW1_INT_ENABLE_PCI);
 }
 
 void cx18_sw1_irq_disable(struct cx18 *cx, u32 val)
 {
-	u32 r;
-	r = cx18_read_reg(cx, SW1_INT_ENABLE_PCI);
-	cx18_write_reg(cx, r & ~val, SW1_INT_ENABLE_PCI);
+	cx->sw1_irq_mask = cx18_read_reg(cx, SW1_INT_ENABLE_PCI) & ~val;
+	cx18_write_reg(cx, cx->sw1_irq_mask, SW1_INT_ENABLE_PCI);
 }
 
 void cx18_sw2_irq_enable(struct cx18 *cx, u32 val)
 {
-	u32 r;
 	cx18_write_reg_expect(cx, val, SW2_INT_STATUS, ~val, val);
-	r = cx18_read_reg(cx, SW2_INT_ENABLE_PCI);
-	cx18_write_reg(cx, r | val, SW2_INT_ENABLE_PCI);
+	cx->sw2_irq_mask = cx18_read_reg(cx, SW2_INT_ENABLE_PCI) | val;
+	cx18_write_reg(cx, cx->sw2_irq_mask, SW2_INT_ENABLE_PCI);
 }
 
 void cx18_sw2_irq_disable(struct cx18 *cx, u32 val)
 {
-	u32 r;
-	r = cx18_read_reg(cx, SW2_INT_ENABLE_PCI);
-	cx18_write_reg(cx, r & ~val, SW2_INT_ENABLE_PCI);
+	cx->sw2_irq_mask = cx18_read_reg(cx, SW2_INT_ENABLE_PCI) & ~val;
+	cx18_write_reg(cx, cx->sw2_irq_mask, SW2_INT_ENABLE_PCI);
 }
 
 void cx18_sw2_irq_disable_cpu(struct cx18 *cx, u32 val)
diff --git a/linux/drivers/media/video/cx18/cx18-io.h b/linux/drivers/media/video/cx18/cx18-io.h
index 4486b73fa..e6716dcb1 100644
--- a/linux/drivers/media/video/cx18/cx18-io.h
+++ b/linux/drivers/media/video/cx18/cx18-io.h
@@ -25,232 +25,121 @@
 
 #include "cx18-driver.h"
 
-static inline void cx18_io_delay(struct cx18 *cx)
-{
-	if (cx->options.mmio_ndelay)
-		ndelay(cx->options.mmio_ndelay);
-}
-
 /*
  * Readback and retry of MMIO access for reliability:
  * The concept was suggested by Steve Toth <stoth@linuxtv.org>.
  * The implmentation is the fault of Andy Walls <awalls@radix.net>.
+ *
+ * *write* functions are implied to retry the mmio unless suffixed with _noretry
+ * *read* functions never retry the mmio (it never helps to do so)
  */
 
-/* Statistics gathering */
-static inline
-void cx18_log_write_retries(struct cx18 *cx, int i, const void __iomem *addr)
-{
-	if (i > CX18_MAX_MMIO_WR_RETRIES)
-		i = CX18_MAX_MMIO_WR_RETRIES;
-	atomic_inc(&cx->mmio_stats.retried_write[i]);
-	return;
-}
-
-static inline
-void cx18_log_read_retries(struct cx18 *cx, int i, const void __iomem *addr)
+/* Non byteswapping memory mapped IO */
+static inline u32 cx18_raw_readl(struct cx18 *cx, const void __iomem *addr)
 {
-	if (i > CX18_MAX_MMIO_RD_RETRIES)
-		i = CX18_MAX_MMIO_RD_RETRIES;
-	atomic_inc(&cx->mmio_stats.retried_read[i]);
-	return;
+	return __raw_readl(addr);
 }
 
-void cx18_log_statistics(struct cx18 *cx);
-
-/* Non byteswapping memory mapped IO */
 static inline
 void cx18_raw_writel_noretry(struct cx18 *cx, u32 val, void __iomem *addr)
 {
 	__raw_writel(val, addr);
-	cx18_io_delay(cx);
 }
 
-void cx18_raw_writel_retry(struct cx18 *cx, u32 val, void __iomem *addr);
-
 static inline void cx18_raw_writel(struct cx18 *cx, u32 val, void __iomem *addr)
 {
-	if (cx18_retry_mmio)
-		cx18_raw_writel_retry(cx, val, addr);
-	else
+	int i;
+	for (i = 0; i < CX18_MAX_MMIO_WR_RETRIES; i++) {
 		cx18_raw_writel_noretry(cx, val, addr);
+		if (val == cx18_raw_readl(cx, addr))
+			break;
+	}
 }
 
-
-static inline
-u32 cx18_raw_readl_noretry(struct cx18 *cx, const void __iomem *addr)
-{
-	u32 ret = __raw_readl(addr);
-	cx18_io_delay(cx);
-	return ret;
-}
-
-u32 cx18_raw_readl_retry(struct cx18 *cx, const void __iomem *addr);
-
-static inline u32 cx18_raw_readl(struct cx18 *cx, const void __iomem *addr)
+/* Normal memory mapped IO */
+static inline u32 cx18_readl(struct cx18 *cx, const void __iomem *addr)
 {
-	if (cx18_retry_mmio)
-		return cx18_raw_readl_retry(cx, addr);
-
-	return cx18_raw_readl_noretry(cx, addr);
+	return readl(addr);
 }
 
-
 static inline
-u16 cx18_raw_readw_noretry(struct cx18 *cx, const void __iomem *addr)
+void cx18_writel_noretry(struct cx18 *cx, u32 val, void __iomem *addr)
 {
-	u16 ret = __raw_readw(addr);
-	cx18_io_delay(cx);
-	return ret;
+	writel(val, addr);
 }
 
-u16 cx18_raw_readw_retry(struct cx18 *cx, const void __iomem *addr);
-
-static inline u16 cx18_raw_readw(struct cx18 *cx, const void __iomem *addr)
+static inline void cx18_writel(struct cx18 *cx, u32 val, void __iomem *addr)
 {
-	if (cx18_retry_mmio)
-		return cx18_raw_readw_retry(cx, addr);
-
-	return cx18_raw_readw_noretry(cx, addr);
+	int i;
+	for (i = 0; i < CX18_MAX_MMIO_WR_RETRIES; i++) {
+		cx18_writel_noretry(cx, val, addr);
+		if (val == cx18_readl(cx, addr))
+			break;
+	}
 }
 
-
-/* Normal memory mapped IO */
 static inline
-void cx18_writel_noretry(struct cx18 *cx, u32 val, void __iomem *addr)
+void cx18_writel_expect(struct cx18 *cx, u32 val, void __iomem *addr,
+			u32 eval, u32 mask)
 {
-	writel(val, addr);
-	cx18_io_delay(cx);
+	int i;
+	eval &= mask;
+	for (i = 0; i < CX18_MAX_MMIO_WR_RETRIES; i++) {
+		cx18_writel_noretry(cx, val, addr);
+		if (eval == (cx18_readl(cx, addr) & mask))
+			break;
+	}
 }
 
-void cx18_writel_retry(struct cx18 *cx, u32 val, void __iomem *addr);
-
-static inline void cx18_writel(struct cx18 *cx, u32 val, void __iomem *addr)
+static inline u16 cx18_readw(struct cx18 *cx, const void __iomem *addr)
 {
-	if (cx18_retry_mmio)
-		cx18_writel_retry(cx, val, addr);
-	else
-		cx18_writel_noretry(cx, val, addr);
+	return readw(addr);
 }
 
-void _cx18_writel_expect(struct cx18 *cx, u32 val, void __iomem *addr,
-			 u32 eval, u32 mask);
-
 static inline
 void cx18_writew_noretry(struct cx18 *cx, u16 val, void __iomem *addr)
 {
 	writew(val, addr);
-	cx18_io_delay(cx);
 }
 
-void cx18_writew_retry(struct cx18 *cx, u16 val, void __iomem *addr);
-
 static inline void cx18_writew(struct cx18 *cx, u16 val, void __iomem *addr)
 {
-	if (cx18_retry_mmio)
-		cx18_writew_retry(cx, val, addr);
-	else
+	int i;
+	for (i = 0; i < CX18_MAX_MMIO_WR_RETRIES; i++) {
 		cx18_writew_noretry(cx, val, addr);
+		if (val == cx18_readw(cx, addr))
+			break;
+	}
 }
 
+static inline u8 cx18_readb(struct cx18 *cx, const void __iomem *addr)
+{
+	return readb(addr);
+}
 
 static inline
 void cx18_writeb_noretry(struct cx18 *cx, u8 val, void __iomem *addr)
 {
 	writeb(val, addr);
-	cx18_io_delay(cx);
 }
 
-void cx18_writeb_retry(struct cx18 *cx, u8 val, void __iomem *addr);
-
 static inline void cx18_writeb(struct cx18 *cx, u8 val, void __iomem *addr)
 {
-	if (cx18_retry_mmio)
-		cx18_writeb_retry(cx, val, addr);
-	else
+	int i;
+	for (i = 0; i < CX18_MAX_MMIO_WR_RETRIES; i++) {
 		cx18_writeb_noretry(cx, val, addr);
-}
-
-
-static inline u32 cx18_readl_noretry(struct cx18 *cx, const void __iomem *addr)
-{
-	u32 ret = readl(addr);
-	cx18_io_delay(cx);
-	return ret;
-}
-
-u32 cx18_readl_retry(struct cx18 *cx, const void __iomem *addr);
-
-static inline u32 cx18_readl(struct cx18 *cx, const void __iomem *addr)
-{
-	if (cx18_retry_mmio)
-		return cx18_readl_retry(cx, addr);
-
-	return cx18_readl_noretry(cx, addr);
-}
-
-
-static inline u16 cx18_readw_noretry(struct cx18 *cx, const void __iomem *addr)
-{
-	u16 ret = readw(addr);
-	cx18_io_delay(cx);
-	return ret;
-}
-
-u16 cx18_readw_retry(struct cx18 *cx, const void __iomem *addr);
-
-static inline u16 cx18_readw(struct cx18 *cx, const void __iomem *addr)
-{
-	if (cx18_retry_mmio)
-		return cx18_readw_retry(cx, addr);
-
-	return cx18_readw_noretry(cx, addr);
-}
-
-
-static inline u8 cx18_readb_noretry(struct cx18 *cx, const void __iomem *addr)
-{
-	u8 ret = readb(addr);
-	cx18_io_delay(cx);
-	return ret;
-}
-
-u8 cx18_readb_retry(struct cx18 *cx, const void __iomem *addr);
-
-static inline u8 cx18_readb(struct cx18 *cx, const void __iomem *addr)
-{
-	if (cx18_retry_mmio)
-		return cx18_readb_retry(cx, addr);
-
-	return cx18_readb_noretry(cx, addr);
-}
-
-
-static inline
-u32 cx18_write_sync_noretry(struct cx18 *cx, u32 val, void __iomem *addr)
-{
-	cx18_writel_noretry(cx, val, addr);
-	return cx18_readl_noretry(cx, addr);
+		if (val == cx18_readb(cx, addr))
+			break;
+	}
 }
 
 static inline
-u32 cx18_write_sync_retry(struct cx18 *cx, u32 val, void __iomem *addr)
-{
-	cx18_writel_retry(cx, val, addr);
-	return cx18_readl_retry(cx, addr);
-}
-
-static inline u32 cx18_write_sync(struct cx18 *cx, u32 val, void __iomem *addr)
+void cx18_memcpy_fromio(struct cx18 *cx, void *to,
+			const void __iomem *from, unsigned int len)
 {
-	if (cx18_retry_mmio)
-		return cx18_write_sync_retry(cx, val, addr);
-
-	return cx18_write_sync_noretry(cx, val, addr);
+	memcpy_fromio(to, from, len);
 }
 
-
-void cx18_memcpy_fromio(struct cx18 *cx, void *to,
-			const void __iomem *from, unsigned int len);
 void cx18_memset_io(struct cx18 *cx, void __iomem *addr, int val, size_t count);
 
 
@@ -260,130 +149,32 @@ static inline void cx18_write_reg_noretry(struct cx18 *cx, u32 val, u32 reg)
 	cx18_writel_noretry(cx, val, cx->reg_mem + reg);
 }
 
-static inline void cx18_write_reg_retry(struct cx18 *cx, u32 val, u32 reg)
-{
-	cx18_writel_retry(cx, val, cx->reg_mem + reg);
-}
-
 static inline void cx18_write_reg(struct cx18 *cx, u32 val, u32 reg)
 {
-	if (cx18_retry_mmio)
-		cx18_write_reg_retry(cx, val, reg);
-	else
-		cx18_write_reg_noretry(cx, val, reg);
-}
-
-static inline void _cx18_write_reg_expect(struct cx18 *cx, u32 val, u32 reg,
-					  u32 eval, u32 mask)
-{
-	_cx18_writel_expect(cx, val, cx->reg_mem + reg, eval, mask);
+	cx18_writel(cx, val, cx->reg_mem + reg);
 }
 
 static inline void cx18_write_reg_expect(struct cx18 *cx, u32 val, u32 reg,
 					 u32 eval, u32 mask)
 {
-	if (cx18_retry_mmio)
-		_cx18_write_reg_expect(cx, val, reg, eval, mask);
-	else
-		cx18_write_reg_noretry(cx, val, reg);
-}
-
-
-static inline u32 cx18_read_reg_noretry(struct cx18 *cx, u32 reg)
-{
-	return cx18_readl_noretry(cx, cx->reg_mem + reg);
-}
-
-static inline u32 cx18_read_reg_retry(struct cx18 *cx, u32 reg)
-{
-	return cx18_readl_retry(cx, cx->reg_mem + reg);
+	cx18_writel_expect(cx, val, cx->reg_mem + reg, eval, mask);
 }
 
 static inline u32 cx18_read_reg(struct cx18 *cx, u32 reg)
 {
-	if (cx18_retry_mmio)
-		return cx18_read_reg_retry(cx, reg);
-
-	return cx18_read_reg_noretry(cx, reg);
-}
-
-
-static inline u32 cx18_write_reg_sync_noretry(struct cx18 *cx, u32 val, u32 reg)
-{
-	return cx18_write_sync_noretry(cx, val, cx->reg_mem + reg);
-}
-
-static inline u32 cx18_write_reg_sync_retry(struct cx18 *cx, u32 val, u32 reg)
-{
-	return cx18_write_sync_retry(cx, val, cx->reg_mem + reg);
-}
-
-static inline u32 cx18_write_reg_sync(struct cx18 *cx, u32 val, u32 reg)
-{
-	if (cx18_retry_mmio)
-		return cx18_write_reg_sync_retry(cx, val, reg);
-
-	return cx18_write_reg_sync_noretry(cx, val, reg);
+	return cx18_readl(cx, cx->reg_mem + reg);
 }
 
 
 /* Access "encoder memory" region of CX23418 memory mapped I/O */
-static inline void cx18_write_enc_noretry(struct cx18 *cx, u32 val, u32 addr)
-{
-	cx18_writel_noretry(cx, val, cx->enc_mem + addr);
-}
-
-static inline void cx18_write_enc_retry(struct cx18 *cx, u32 val, u32 addr)
-{
-	cx18_writel_retry(cx, val, cx->enc_mem + addr);
-}
-
 static inline void cx18_write_enc(struct cx18 *cx, u32 val, u32 addr)
 {
-	if (cx18_retry_mmio)
-		cx18_write_enc_retry(cx, val, addr);
-	else
-		cx18_write_enc_noretry(cx, val, addr);
-}
-
-
-static inline u32 cx18_read_enc_noretry(struct cx18 *cx, u32 addr)
-{
-	return cx18_readl_noretry(cx, cx->enc_mem + addr);
-}
-
-static inline u32 cx18_read_enc_retry(struct cx18 *cx, u32 addr)
-{
-	return cx18_readl_retry(cx, cx->enc_mem + addr);
+	cx18_writel(cx, val, cx->enc_mem + addr);
 }
 
 static inline u32 cx18_read_enc(struct cx18 *cx, u32 addr)
 {
-	if (cx18_retry_mmio)
-		return cx18_read_enc_retry(cx, addr);
-
-	return cx18_read_enc_noretry(cx, addr);
-}
-
-static inline
-u32 cx18_write_enc_sync_noretry(struct cx18 *cx, u32 val, u32 addr)
-{
-	return cx18_write_sync_noretry(cx, val, cx->enc_mem + addr);
-}
-
-static inline
-u32 cx18_write_enc_sync_retry(struct cx18 *cx, u32 val, u32 addr)
-{
-	return cx18_write_sync_retry(cx, val, cx->enc_mem + addr);
-}
-
-static inline
-u32 cx18_write_enc_sync(struct cx18 *cx, u32 val, u32 addr)
-{
-	if (cx18_retry_mmio)
-		return cx18_write_enc_sync_retry(cx, val, addr);
-
-	return cx18_write_enc_sync_noretry(cx, val, addr);
+	return cx18_readl(cx, cx->enc_mem + addr);
 }
 
 void cx18_sw1_irq_enable(struct cx18 *cx, u32 val);
diff --git a/linux/drivers/media/video/cx18/cx18-ioctl.c b/linux/drivers/media/video/cx18/cx18-ioctl.c
index 20c7650d7..5d9c1146e 100644
--- a/linux/drivers/media/video/cx18/cx18-ioctl.c
+++ b/linux/drivers/media/video/cx18/cx18-ioctl.c
@@ -4,6 +4,7 @@
  *  Derived from ivtv-ioctl.c
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -857,7 +858,6 @@ static int cx18_log_status(struct file *file, void *fh)
 	CX18_INFO("Read MPEG/VBI: %lld/%lld bytes\n",
 			(long long)cx->mpg_data_received,
 			(long long)cx->vbi_data_inserted);
-	cx18_log_statistics(cx);
 	CX18_INFO("==================  END STATUS CARD #%d  ==================\n", cx->num);
 	return 0;
 }
diff --git a/linux/drivers/media/video/cx18/cx18-ioctl.h b/linux/drivers/media/video/cx18/cx18-ioctl.h
index 2222f679d..08fe24e95 100644
--- a/linux/drivers/media/video/cx18/cx18-ioctl.h
+++ b/linux/drivers/media/video/cx18/cx18-ioctl.h
@@ -4,6 +4,7 @@
  *  Derived from ivtv-ioctl.h
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
diff --git a/linux/drivers/media/video/cx18/cx18-irq.c b/linux/drivers/media/video/cx18/cx18-irq.c
index 3e23fc350..8c22637f4 100644
--- a/linux/drivers/media/video/cx18/cx18-irq.c
+++ b/linux/drivers/media/video/cx18/cx18-irq.c
@@ -2,6 +2,7 @@
  *  cx18 interrupt handling
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -21,127 +22,9 @@
 
 #include "cx18-driver.h"
 #include "cx18-io.h"
-#include "cx18-firmware.h"
-#include "cx18-fileops.h"
-#include "cx18-queue.h"
 #include "cx18-irq.h"
-#include "cx18-ioctl.h"
 #include "cx18-mailbox.h"
-#include "cx18-vbi.h"
 #include "cx18-scb.h"
-#include "cx18-dvb.h"
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 20)
-void cx18_work_handler(struct work_struct *work)
-{
-	struct cx18 *cx = container_of(work, struct cx18, work);
-#else
-void cx18_work_handler(void *arg)
-{
-	struct cx18 *cx = arg;
-#endif
-	if (test_and_clear_bit(CX18_F_I_WORK_HANDLER_DVB, &cx->i_flags))
-		cx18_dvb_work_handler(cx);
-}
-
-static void epu_dma_done(struct cx18 *cx, struct cx18_mailbox *mb, int rpu)
-{
-	u32 handle = mb->args[0];
-	struct cx18_stream *s = NULL;
-	struct cx18_buffer *buf;
-	u32 off;
-	int i;
-	int id;
-
-	for (i = 0; i < CX18_MAX_STREAMS; i++) {
-		s = &cx->streams[i];
-		if ((handle == s->handle) && (s->dvb.enabled))
-			break;
-		if (s->v4l2dev && handle == s->handle)
-			break;
-	}
-	if (i == CX18_MAX_STREAMS) {
-		CX18_WARN("Got DMA done notification for unknown/inactive"
-			  " handle %d\n", handle);
-		mb->error = CXERR_NOT_OPEN;
-		mb->cmd = 0;
-		cx18_mb_ack(cx, mb, rpu);
-		return;
-	}
-
-	off = mb->args[1];
-	if (mb->args[2] != 1)
-		CX18_WARN("Ack struct = %d for %s\n",
-			mb->args[2], s->name);
-	id = cx18_read_enc(cx, off);
-	buf = cx18_queue_get_buf_irq(s, id, cx18_read_enc(cx, off + 4));
-	CX18_DEBUG_HI_DMA("DMA DONE for %s (buffer %d)\n", s->name, id);
-	if (buf) {
-		cx18_buf_sync_for_cpu(s, buf);
-		if (s->type == CX18_ENC_STREAM_TYPE_TS && s->dvb.enabled) {
-			CX18_DEBUG_HI_DMA("TS recv bytesused = %d\n",
-					buf->bytesused);
-
-			set_bit(CX18_F_I_WORK_HANDLER_DVB, &cx->i_flags);
-			set_bit(CX18_F_I_HAVE_WORK, &cx->i_flags);
-		} else
-			set_bit(CX18_F_B_NEED_BUF_SWAP, &buf->b_flags);
-	} else {
-		CX18_WARN("Could not find buf %d for stream %s\n",
-				cx18_read_enc(cx, off), s->name);
-	}
-	mb->error = 0;
-	mb->cmd = 0;
-	cx18_mb_ack(cx, mb, rpu);
-	wake_up(&cx->dma_waitq);
-	if (s->id != -1)
-		wake_up(&s->waitq);
-}
-
-static void epu_debug(struct cx18 *cx, struct cx18_mailbox *mb, int rpu)
-{
-	char str[256] = { 0 };
-	char *p;
-
-	if (mb->args[1]) {
-		cx18_setup_page(cx, mb->args[1]);
-		cx18_memcpy_fromio(cx, str, cx->enc_mem + mb->args[1], 252);
-		str[252] = 0;
-	}
-	cx18_mb_ack(cx, mb, rpu);
-	CX18_DEBUG_INFO("%x %s\n", mb->args[0], str);
-	p = strchr(str, '.');
-	if (!test_bit(CX18_F_I_LOADED_FW, &cx->i_flags) && p && p > str)
-		CX18_INFO("FW version: %s\n", p - 1);
-}
-
-static void epu_cmd(struct cx18 *cx, u32 sw1)
-{
-	struct cx18_mailbox mb;
-
-	if (sw1 & IRQ_CPU_TO_EPU) {
-		cx18_memcpy_fromio(cx, &mb, &cx->scb->cpu2epu_mb, sizeof(mb));
-		mb.error = 0;
-
-		switch (mb.cmd) {
-		case CX18_EPU_DMA_DONE:
-			epu_dma_done(cx, &mb, CPU);
-			break;
-		case CX18_EPU_DEBUG:
-			epu_debug(cx, &mb, CPU);
-			break;
-		default:
-			CX18_WARN("Unknown CPU_TO_EPU mailbox command %#08x\n",
-				  mb.cmd);
-			break;
-		}
-	}
-
-	if (sw1 & IRQ_APU_TO_EPU) {
-		cx18_memcpy_fromio(cx, &mb, &cx->scb->apu2epu_mb, sizeof(mb));
-		CX18_WARN("Unknown APU_TO_EPU mailbox command %#08x\n", mb.cmd);
-	}
-}
 
 static void xpu_ack(struct cx18 *cx, u32 sw2)
 {
@@ -151,6 +34,14 @@ static void xpu_ack(struct cx18 *cx, u32 sw2)
 		wake_up(&cx->mb_apu_waitq);
 }
 
+static void epu_cmd(struct cx18 *cx, u32 sw1)
+{
+	if (sw1 & IRQ_CPU_TO_EPU)
+		cx18_api_epu_cmd_irq(cx, CPU);
+	if (sw1 & IRQ_APU_TO_EPU)
+		cx18_api_epu_cmd_irq(cx, APU);
+}
+
 #if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18)
 irqreturn_t cx18_irq_handler(int irq, void *dev_id, struct pt_regs *regs)
 #else
@@ -158,16 +49,11 @@ irqreturn_t cx18_irq_handler(int irq, void *dev_id)
 #endif
 {
 	struct cx18 *cx = (struct cx18 *)dev_id;
-	u32 sw1, sw1_mask;
-	u32 sw2, sw2_mask;
-	u32 hw2, hw2_mask;
+	u32 sw1, sw2, hw2;
 
-	sw1_mask = cx18_read_reg(cx, SW1_INT_ENABLE_PCI);
-	sw1 = cx18_read_reg(cx, SW1_INT_STATUS) & sw1_mask;
-	sw2_mask = cx18_read_reg(cx, SW2_INT_ENABLE_PCI);
-	sw2 = cx18_read_reg(cx, SW2_INT_STATUS) & sw2_mask;
-	hw2_mask = cx18_read_reg(cx, HW2_INT_MASK5_PCI);
-	hw2 = cx18_read_reg(cx, HW2_INT_CLR_STATUS) & hw2_mask;
+	sw1 = cx18_read_reg(cx, SW1_INT_STATUS) & cx->sw1_irq_mask;
+	sw2 = cx18_read_reg(cx, SW2_INT_STATUS) & cx->sw2_irq_mask;
+	hw2 = cx18_read_reg(cx, HW2_INT_CLR_STATUS) & cx->hw2_irq_mask;
 
 	if (sw1)
 		cx18_write_reg_expect(cx, sw1, SW1_INT_STATUS, ~sw1, sw1);
@@ -180,6 +66,13 @@ irqreturn_t cx18_irq_handler(int irq, void *dev_id)
 		CX18_DEBUG_HI_IRQ("received interrupts "
 				  "SW1: %x  SW2: %x  HW2: %x\n", sw1, sw2, hw2);
 
+	/*
+	 * SW1 responses have to happen first.  The sending XPU times out the
+	 * incoming mailboxes on us rather rapidly.
+	 */
+	if (sw1)
+		epu_cmd(cx, sw1);
+
 	/* To do: interrupt-based I2C handling
 	if (hw2 & (HW2_I2C1_INT|HW2_I2C2_INT)) {
 	}
@@ -188,11 +81,5 @@ irqreturn_t cx18_irq_handler(int irq, void *dev_id)
 	if (sw2)
 		xpu_ack(cx, sw2);
 
-	if (sw1)
-		epu_cmd(cx, sw1);
-
-	if (test_and_clear_bit(CX18_F_I_HAVE_WORK, &cx->i_flags))
-		schedule_work(&cx->work);
-
 	return (sw1 || sw2 || hw2) ? IRQ_HANDLED : IRQ_NONE;
 }
diff --git a/linux/drivers/media/video/cx18/cx18-irq.h b/linux/drivers/media/video/cx18/cx18-irq.h
index 6472e42c6..b94ca6019 100644
--- a/linux/drivers/media/video/cx18/cx18-irq.h
+++ b/linux/drivers/media/video/cx18/cx18-irq.h
@@ -2,6 +2,7 @@
  *  cx18 interrupt handling
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -36,9 +37,3 @@ irqreturn_t cx18_irq_handler(int irq, void *dev_id, struct pt_regs *regs);
 #else
 irqreturn_t cx18_irq_handler(int irq, void *dev_id);
 #endif
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 20)
-void cx18_work_handler(struct work_struct *work);
-#else
-void cx18_work_handler(void *arg);
-#endif
diff --git a/linux/drivers/media/video/cx18/cx18-mailbox.c b/linux/drivers/media/video/cx18/cx18-mailbox.c
index 35f7188d4..8415b9683 100644
--- a/linux/drivers/media/video/cx18/cx18-mailbox.c
+++ b/linux/drivers/media/video/cx18/cx18-mailbox.c
@@ -2,6 +2,7 @@
  *  cx18 mailbox functions
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -26,6 +27,10 @@
 #include "cx18-scb.h"
 #include "cx18-irq.h"
 #include "cx18-mailbox.h"
+#include "cx18-queue.h"
+#include "cx18-streams.h"
+
+static const char *rpu_str[] = { "APU", "CPU", "EPU", "HPU" };
 
 #define API_FAST (1 << 2) /* Short timeout */
 #define API_SLOW (1 << 3) /* Additional 300ms timeout */
@@ -92,12 +97,187 @@ static const struct cx18_api_info *find_api_info(u32 cmd)
 	return NULL;
 }
 
-long cx18_mb_ack(struct cx18 *cx, const struct cx18_mailbox *mb, int rpu)
+static void dump_mb(struct cx18 *cx, struct cx18_mailbox *mb, char *name)
+{
+	char argstr[MAX_MB_ARGUMENTS*11+1];
+	char *p;
+	int i;
+
+	if (!(cx18_debug & CX18_DBGFLG_API))
+		return;
+
+	for (i = 0, p = argstr; i < MAX_MB_ARGUMENTS; i++, p += 11) {
+		/* kernel snprintf() appends '\0' always */
+		snprintf(p, 12, " %#010x", mb->args[i]);
+	}
+	CX18_DEBUG_API("%s: req %#010x ack %#010x cmd %#010x err %#010x args%s"
+		"\n", name, mb->request, mb->ack, mb->cmd, mb->error, argstr);
+}
+
+
+/*
+ * Functions that run in a work_queue work handling context
+ */
+
+static void epu_dma_done(struct cx18 *cx, struct cx18_epu_work_order *order)
+{
+	u32 handle, mdl_ack_count, id;
+	struct cx18_mailbox *mb;
+	struct cx18_mdl_ack *mdl_ack;
+	struct cx18_stream *s;
+	struct cx18_buffer *buf;
+	int i;
+
+	mb = &order->mb;
+	handle = mb->args[0];
+	s = cx18_handle_to_stream(cx, handle);
+
+	if (s == NULL) {
+		CX18_WARN("Got DMA done notification for unknown/inactive"
+			  " handle %d, %s mailbox seq no %d\n", handle,
+			  (order->flags & CX18_F_EWO_MB_STALE_UPON_RECEIPT) ?
+			  "stale" : "good", mb->request);
+		return;
+	}
+
+	mdl_ack_count = mb->args[2];
+	mdl_ack = order->mdl_ack;
+	for (i = 0; i < mdl_ack_count; i++, mdl_ack++) {
+		id = mdl_ack->id;
+		/*
+		 * Simple integrity check for processing a stale (and possibly
+		 * inconsistent mailbox): make sure the buffer id is in the
+		 * valid range for the stream.
+		 *
+		 * We go through the trouble of dealing with stale mailboxes
+		 * because most of the time, the mailbox data is still valid and
+		 * unchanged (and in practice the firmware ping-pongs the
+		 * two mdl_ack buffers so mdl_acks are not stale).
+		 *
+		 * There are occasions when we get a half changed mailbox,
+		 * which this check catches for a handle & id mismatch.  If the
+		 * handle and id do correspond, the worst case is that we
+		 * completely lost the old buffer, but pick up the new buffer
+		 * early (but the new mdl_ack is guaranteed to be good in this
+		 * case as the firmware wouldn't point us to a new mdl_ack until
+		 * it's filled in).
+		 *
+		 * cx18_queue_get buf() will detect the lost buffers
+		 * and put them back in rotation eventually.
+		 */
+		if ((order->flags & CX18_F_EWO_MB_STALE_UPON_RECEIPT) &&
+		    !(id >= s->mdl_offset &&
+		      id < (s->mdl_offset + s->buffers))) {
+			CX18_WARN("Fell behind! Ignoring stale mailbox with "
+				  " inconsistent data. Lost buffer for mailbox "
+				  "seq no %d\n", mb->request);
+			break;
+		}
+		buf = cx18_queue_get_buf(s, id, mdl_ack->data_used);
+		CX18_DEBUG_HI_DMA("DMA DONE for %s (buffer %d)\n", s->name, id);
+		if (buf == NULL) {
+			CX18_WARN("Could not find buf %d for stream %s\n",
+				  id, s->name);
+			continue;
+		}
+
+		cx18_buf_sync_for_cpu(s, buf);
+		if (s->type == CX18_ENC_STREAM_TYPE_TS && s->dvb.enabled) {
+			CX18_DEBUG_HI_DMA("TS recv bytesused = %d\n",
+					  buf->bytesused);
+
+			dvb_dmx_swfilter(&s->dvb.demux, buf->buf,
+					 buf->bytesused);
+
+			cx18_buf_sync_for_device(s, buf);
+			cx18_enqueue(s, buf, &s->q_free);
+
+			if (s->handle != CX18_INVALID_TASK_HANDLE &&
+			    test_bit(CX18_F_S_STREAMING, &s->s_flags))
+				cx18_vapi(cx,
+				       CX18_CPU_DE_SET_MDL, 5, s->handle,
+				       (void __iomem *)
+				       &cx->scb->cpu_mdl[buf->id] - cx->enc_mem,
+				       1, buf->id, s->buf_size);
+		} else
+			set_bit(CX18_F_B_NEED_BUF_SWAP, &buf->b_flags);
+	}
+	wake_up(&cx->dma_waitq);
+	if (s->id != -1)
+		wake_up(&s->waitq);
+}
+
+static void epu_debug(struct cx18 *cx, struct cx18_epu_work_order *order)
+{
+	char *p;
+	char *str = order->str;
+
+	CX18_DEBUG_INFO("%x %s\n", order->mb.args[0], str);
+	p = strchr(str, '.');
+	if (!test_bit(CX18_F_I_LOADED_FW, &cx->i_flags) && p && p > str)
+		CX18_INFO("FW version: %s\n", p - 1);
+}
+
+static void epu_cmd(struct cx18 *cx, struct cx18_epu_work_order *order)
+{
+	switch (order->rpu) {
+	case CPU:
+	{
+		switch (order->mb.cmd) {
+		case CX18_EPU_DMA_DONE:
+			epu_dma_done(cx, order);
+			break;
+		case CX18_EPU_DEBUG:
+			epu_debug(cx, order);
+			break;
+		default:
+			CX18_WARN("Unknown CPU to EPU mailbox command %#0x\n",
+				  order->mb.cmd);
+			break;
+		}
+		break;
+	}
+	case APU:
+		CX18_WARN("Unknown APU to EPU mailbox command %#0x\n",
+			  order->mb.cmd);
+		break;
+	default:
+		break;
+	}
+}
+
+static
+void free_epu_work_order(struct cx18 *cx, struct cx18_epu_work_order *order)
+{
+	atomic_set(&order->pending, 0);
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 20)
+void cx18_epu_work_handler(struct work_struct *work)
+{
+	struct cx18_epu_work_order *order =
+			container_of(work, struct cx18_epu_work_order, work);
+#else
+void cx18_epu_work_handler(void *arg)
+{
+	struct cx18_epu_work_order *order = arg;
+#endif
+	struct cx18 *cx = order->cx;
+	epu_cmd(cx, order);
+	free_epu_work_order(cx, order);
+}
+
+
+/*
+ * Functions that run in an interrupt handling context
+ */
+
+static void mb_ack_irq(struct cx18 *cx, struct cx18_epu_work_order *order)
 {
 	struct cx18_mailbox __iomem *ack_mb;
-	u32 ack_irq;
+	u32 ack_irq, req;
 
-	switch (rpu) {
+	switch (order->rpu) {
 	case APU:
 		ack_irq = IRQ_EPU_TO_APU_ACK;
 		ack_mb = &cx->scb->apu2epu_mb;
@@ -108,23 +288,187 @@ long cx18_mb_ack(struct cx18 *cx, const struct cx18_mailbox *mb, int rpu)
 		break;
 	default:
 		CX18_WARN("Unhandled RPU (%d) for command %x ack\n",
-			  rpu, mb->cmd);
-		return -EINVAL;
+			  order->rpu, order->mb.cmd);
+		return;
 	}
 
-	cx18_setup_page(cx, SCB_OFFSET);
-	cx18_write_sync(cx, mb->request, &ack_mb->ack);
+	req = order->mb.request;
+	/* Don't ack if the RPU has gotten impatient and timed us out */
+	if (req != cx18_readl(cx, &ack_mb->request) ||
+	    req == cx18_readl(cx, &ack_mb->ack)) {
+		CX18_DEBUG_WARN("Possibly falling behind: %s self-ack'ed our "
+				"incoming %s to EPU mailbox (sequence no. %u) "
+				"while processing\n",
+				rpu_str[order->rpu], rpu_str[order->rpu], req);
+		order->flags |= CX18_F_EWO_MB_STALE_WHILE_PROC;
+		return;
+	}
+	cx18_writel(cx, req, &ack_mb->ack);
 	cx18_write_reg_expect(cx, ack_irq, SW2_INT_SET, ack_irq, ack_irq);
-	return 0;
+	return;
 }
 
-static void cx18_api_log_ack_delay(struct cx18 *cx, int msecs)
+static int epu_dma_done_irq(struct cx18 *cx, struct cx18_epu_work_order *order)
 {
-	if (msecs > CX18_MAX_MB_ACK_DELAY)
-		msecs = CX18_MAX_MB_ACK_DELAY;
-	atomic_inc(&cx->mbox_stats.mb_ack_delay[msecs]);
+	u32 handle, mdl_ack_offset, mdl_ack_count;
+	struct cx18_mailbox *mb;
+
+	mb = &order->mb;
+	handle = mb->args[0];
+	mdl_ack_offset = mb->args[1];
+	mdl_ack_count = mb->args[2];
+
+	if (handle == CX18_INVALID_TASK_HANDLE ||
+	    mdl_ack_count == 0 || mdl_ack_count > CX18_MAX_MDL_ACKS) {
+		if ((order->flags & CX18_F_EWO_MB_STALE) == 0)
+			mb_ack_irq(cx, order);
+		return -1;
+	}
+
+	cx18_memcpy_fromio(cx, order->mdl_ack, cx->enc_mem + mdl_ack_offset,
+			   sizeof(struct cx18_mdl_ack) * mdl_ack_count);
+
+	if ((order->flags & CX18_F_EWO_MB_STALE) == 0)
+		mb_ack_irq(cx, order);
+	return 1;
+}
+
+static
+int epu_debug_irq(struct cx18 *cx, struct cx18_epu_work_order *order)
+{
+	u32 str_offset;
+	char *str = order->str;
+
+	str[0] = '\0';
+	str_offset = order->mb.args[1];
+	if (str_offset) {
+		cx18_setup_page(cx, str_offset);
+		cx18_memcpy_fromio(cx, str, cx->enc_mem + str_offset, 252);
+		str[252] = '\0';
+		cx18_setup_page(cx, SCB_OFFSET);
+	}
+
+	if ((order->flags & CX18_F_EWO_MB_STALE) == 0)
+		mb_ack_irq(cx, order);
+
+	return str_offset ? 1 : 0;
+}
+
+static inline
+int epu_cmd_irq(struct cx18 *cx, struct cx18_epu_work_order *order)
+{
+	int ret = -1;
+
+	switch (order->rpu) {
+	case CPU:
+	{
+		switch (order->mb.cmd) {
+		case CX18_EPU_DMA_DONE:
+			ret = epu_dma_done_irq(cx, order);
+			break;
+		case CX18_EPU_DEBUG:
+			ret = epu_debug_irq(cx, order);
+			break;
+		default:
+			CX18_WARN("Unknown CPU to EPU mailbox command %#0x\n",
+				  order->mb.cmd);
+			break;
+		}
+		break;
+	}
+	case APU:
+		CX18_WARN("Unknown APU to EPU mailbox command %#0x\n",
+			  order->mb.cmd);
+		break;
+	default:
+		break;
+	}
+	return ret;
+}
+
+static inline
+struct cx18_epu_work_order *alloc_epu_work_order_irq(struct cx18 *cx)
+{
+	int i;
+	struct cx18_epu_work_order *order = NULL;
+
+	for (i = 0; i < CX18_MAX_EPU_WORK_ORDERS; i++) {
+		/*
+		 * We only need "pending" atomic to inspect its contents,
+		 * and need not do a check and set because:
+		 * 1. Any work handler thread only clears "pending" and only
+		 * on one, particular work order at a time, per handler thread.
+		 * 2. "pending" is only set here, and we're serialized because
+		 * we're called in an IRQ handler context.
+		 */
+		if (atomic_read(&cx->epu_work_order[i].pending) == 0) {
+			order = &cx->epu_work_order[i];
+			atomic_set(&order->pending, 1);
+			break;
+		}
+	}
+	return order;
+}
+
+void cx18_api_epu_cmd_irq(struct cx18 *cx, int rpu)
+{
+	struct cx18_mailbox __iomem *mb;
+	struct cx18_mailbox *order_mb;
+	struct cx18_epu_work_order *order;
+	int submit;
+
+	switch (rpu) {
+	case CPU:
+		mb = &cx->scb->cpu2epu_mb;
+		break;
+	case APU:
+		mb = &cx->scb->apu2epu_mb;
+		break;
+	default:
+		return;
+	}
+
+	order = alloc_epu_work_order_irq(cx);
+	if (order == NULL) {
+		CX18_WARN("Unable to find blank work order form to schedule "
+			  "incoming mailbox command processing\n");
+		return;
+	}
+
+	order->flags = 0;
+	order->rpu = rpu;
+	order_mb = &order->mb;
+
+	/* mb->cmd and mb->args[0] through mb->args[2] */
+	cx18_memcpy_fromio(cx, &order_mb->cmd, &mb->cmd, 4 * sizeof(u32));
+	/* mb->request and mb->ack.  N.B. we want to read mb->ack last */
+	cx18_memcpy_fromio(cx, &order_mb->request, &mb->request,
+			   2 * sizeof(u32));
+
+	if (order_mb->request == order_mb->ack) {
+		CX18_DEBUG_WARN("Possibly falling behind: %s self-ack'ed our "
+				"incoming %s to EPU mailbox (sequence no. %u)"
+				"\n",
+				rpu_str[rpu], rpu_str[rpu], order_mb->request);
+		dump_mb(cx, order_mb, "incoming");
+		order->flags = CX18_F_EWO_MB_STALE_UPON_RECEIPT;
+	}
+
+	/*
+	 * Individual EPU command processing is responsible for ack-ing
+	 * a non-stale mailbox as soon as possible
+	 */
+	submit = epu_cmd_irq(cx, order);
+	if (submit > 0) {
+		queue_work(cx18_work_queue, &order->work);
+	}
 }
 
+
+/*
+ * Functions called from a non-interrupt, non work_queue context
+ */
+
 static int cx18_api_call(struct cx18 *cx, u32 cmd, int args, u32 data[])
 {
 	const struct cx18_api_info *info = find_api_info(cmd);
@@ -167,8 +511,6 @@ static int cx18_api_call(struct cx18 *cx, u32 cmd, int args, u32 data[])
 	}
 
 	mutex_lock(mb_lock);
-	cx18_setup_page(cx, SCB_OFFSET);
-
 	/*
 	 * Wait for an in-use mailbox to complete
 	 *
@@ -181,7 +523,7 @@ static int cx18_api_call(struct cx18 *cx, u32 cmd, int args, u32 data[])
 	 */
 	state = cx18_readl(cx, xpu_state);
 	req = cx18_readl(cx, &mb->request);
-	timeout = msecs_to_jiffies(20); /* 1 field at 50 Hz vertical refresh */
+	timeout = msecs_to_jiffies(10);
 	ret = wait_event_timeout(*waitq,
 				 (ack = cx18_readl(cx, &mb->ack)) == req,
 				 timeout);
@@ -191,8 +533,8 @@ static int cx18_api_call(struct cx18 *cx, u32 cmd, int args, u32 data[])
 		CX18_ERR("mbox was found stuck busy when setting up for %s; "
 			 "clearing busy and trying to proceed\n", info->name);
 	} else if (ret != timeout)
-		CX18_DEBUG_API("waited %u usecs for busy mbox to be acked\n",
-			       jiffies_to_usecs(timeout-ret));
+		CX18_DEBUG_API("waited %u msecs for busy mbox to be acked\n",
+			       jiffies_to_msecs(timeout-ret));
 
 	/* Build the outgoing mailbox */
 	req = ((req & 0xfffffffe) == 0xfffffffe) ? 1 : req + 1;
@@ -206,10 +548,8 @@ static int cx18_api_call(struct cx18 *cx, u32 cmd, int args, u32 data[])
 
 	/*
 	 * Notify the XPU and wait for it to send an Ack back
-	 * 21 ms = ~ 0.5 frames at a frame rate of 24 fps
-	 * 42 ms = ~ 1 frame at a frame rate of 24 fps
 	 */
-	timeout = msecs_to_jiffies((info->flags & API_FAST) ? 21 : 42);
+	timeout = msecs_to_jiffies((info->flags & API_FAST) ? 10 : 20);
 
 	CX18_DEBUG_HI_IRQ("sending interrupt SW1: %x to send %s\n",
 			  irq, info->name);
@@ -219,27 +559,19 @@ static int cx18_api_call(struct cx18 *cx, u32 cmd, int args, u32 data[])
 		       *waitq,
 		       cx18_readl(cx, &mb->ack) == cx18_readl(cx, &mb->request),
 		       timeout);
+
 	if (ret == 0) {
 		/* Timed out */
 		mutex_unlock(mb_lock);
-		i = jiffies_to_msecs(timeout);
-		cx18_api_log_ack_delay(cx, i);
-		CX18_WARN("sending %s timed out waiting %d msecs for RPU "
-			  "acknowledgement\n", info->name, i);
+		CX18_DEBUG_WARN("sending %s timed out waiting %d msecs for RPU "
+				"acknowledgement\n",
+				info->name, jiffies_to_msecs(timeout));
 		return -EINVAL;
-	} else if (ret < 0) {
-		/* Interrupted */
-		mutex_unlock(mb_lock);
-		CX18_WARN("sending %s was interrupted waiting for RPU"
-			  "acknowledgement\n", info->name);
-		return -EINTR;
 	}
 
-	i = jiffies_to_msecs(timeout-ret);
-	cx18_api_log_ack_delay(cx, i);
 	if (ret != timeout)
 		CX18_DEBUG_HI_API("waited %u msecs for %s to be acked\n",
-				  i, info->name);
+				  jiffies_to_msecs(timeout-ret), info->name);
 
 	/* Collect data returned by the XPU */
 	for (i = 0; i < MAX_MB_ARGUMENTS; i++)
diff --git a/linux/drivers/media/video/cx18/cx18-mailbox.h b/linux/drivers/media/video/cx18/cx18-mailbox.h
index 54758f32d..35104458e 100644
--- a/linux/drivers/media/video/cx18/cx18-mailbox.h
+++ b/linux/drivers/media/video/cx18/cx18-mailbox.h
@@ -2,6 +2,7 @@
  *  cx18 mailbox functions
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -37,6 +38,17 @@
 
 struct cx18;
 
+/*
+ * This structure is used by CPU to provide completed buffers information
+ * Its structure is dictrated by the layout of the SCB, required by the
+ * firmware, but its defintion needs to be here, instead of in cx18-scb.h,
+ * for mailbox work order scheduling
+ */
+struct cx18_mdl_ack {
+    u32 id;        /* ID of a completed MDL */
+    u32 data_used; /* Total data filled in the MDL for buffer 'id' */
+};
+
 /* The cx18_mailbox struct is the mailbox structure which is used for passing
    messages between processors */
 struct cx18_mailbox {
@@ -73,6 +85,13 @@ int cx18_vapi_result(struct cx18 *cx, u32 data[MAX_MB_ARGUMENTS], u32 cmd,
 int cx18_vapi(struct cx18 *cx, u32 cmd, int args, ...);
 int cx18_api_func(void *priv, u32 cmd, int in, int out,
 		u32 data[CX2341X_MBOX_MAX_DATA]);
-long cx18_mb_ack(struct cx18 *cx, const struct cx18_mailbox *mb, int rpu);
+
+void cx18_api_epu_cmd_irq(struct cx18 *cx, int rpu);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 20)
+void cx18_epu_work_handler(struct work_struct *work);
+#else
+void cx18_epu_work_handler(void *arg);
+#endif
 
 #endif
diff --git a/linux/drivers/media/video/cx18/cx18-queue.c b/linux/drivers/media/video/cx18/cx18-queue.c
index 174682c25..7b09c9a3e 100644
--- a/linux/drivers/media/video/cx18/cx18-queue.c
+++ b/linux/drivers/media/video/cx18/cx18-queue.c
@@ -4,6 +4,7 @@
  *  Derived from ivtv-queue.c
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -44,83 +45,116 @@ void cx18_queue_init(struct cx18_queue *q)
 void cx18_enqueue(struct cx18_stream *s, struct cx18_buffer *buf,
 		struct cx18_queue *q)
 {
-	unsigned long flags = 0;
-
 	/* clear the buffer if it is going to be enqueued to the free queue */
 	if (q == &s->q_free) {
 		buf->bytesused = 0;
 		buf->readpos = 0;
 		buf->b_flags = 0;
+		buf->skipped = 0;
 	}
-	spin_lock_irqsave(&s->qlock, flags);
+	mutex_lock(&s->qlock);
 	list_add_tail(&buf->list, &q->list);
 	atomic_inc(&q->buffers);
 	q->bytesused += buf->bytesused - buf->readpos;
-	spin_unlock_irqrestore(&s->qlock, flags);
+	mutex_unlock(&s->qlock);
 }
 
 struct cx18_buffer *cx18_dequeue(struct cx18_stream *s, struct cx18_queue *q)
 {
 	struct cx18_buffer *buf = NULL;
-	unsigned long flags = 0;
 
-	spin_lock_irqsave(&s->qlock, flags);
+	mutex_lock(&s->qlock);
 	if (!list_empty(&q->list)) {
 		buf = list_entry(q->list.next, struct cx18_buffer, list);
 		list_del_init(q->list.next);
 		atomic_dec(&q->buffers);
 		q->bytesused -= buf->bytesused - buf->readpos;
+		buf->skipped = 0;
 	}
-	spin_unlock_irqrestore(&s->qlock, flags);
+	mutex_unlock(&s->qlock);
 	return buf;
 }
 
-struct cx18_buffer *cx18_queue_get_buf_irq(struct cx18_stream *s, u32 id,
+struct cx18_buffer *cx18_queue_get_buf(struct cx18_stream *s, u32 id,
 	u32 bytesused)
 {
 	struct cx18 *cx = s->cx;
-	struct list_head *p;
-
-	spin_lock(&s->qlock);
-	list_for_each(p, &s->q_free.list) {
-		struct cx18_buffer *buf =
-			list_entry(p, struct cx18_buffer, list);
-
-		if (buf->id != id)
+	struct cx18_buffer *buf;
+	struct cx18_buffer *ret = NULL;
+	struct list_head *p, *t;
+	LIST_HEAD(r);
+
+	mutex_lock(&s->qlock);
+	list_for_each_safe(p, t, &s->q_free.list) {
+		buf = list_entry(p, struct cx18_buffer, list);
+
+		if (buf->id != id) {
+			buf->skipped++;
+			if (buf->skipped >= atomic_read(&s->q_free.buffers)-1) {
+				/* buffer must have fallen out of rotation */
+				atomic_dec(&s->q_free.buffers);
+				list_move_tail(&buf->list, &r);
+				CX18_WARN("Skipped %s, buffer %d, %d "
+					  "times - it must have dropped out of "
+					  "rotation\n", s->name, buf->id,
+					  buf->skipped);
+			}
 			continue;
+		}
 
 		buf->bytesused = bytesused;
 		atomic_dec(&s->q_free.buffers);
-		atomic_inc(&s->q_full.buffers);
-		s->q_full.bytesused += buf->bytesused;
-		list_move_tail(&buf->list, &s->q_full.list);
+		if (s->type == CX18_ENC_STREAM_TYPE_TS) {
+			/*
+			 * TS doesn't use q_full, but for sweeping up lost
+			 * buffers, we want the TS to requeue the buffer just
+			 * before sending the MDL back to the firmware, so we
+			 * pull it off the list here.
+			 */
+			list_del_init(&buf->list);
+		} else {
+			atomic_inc(&s->q_full.buffers);
+			s->q_full.bytesused += buf->bytesused;
+			list_move_tail(&buf->list, &s->q_full.list);
+		}
+
+		ret = buf;
+		break;
+	}
+	mutex_unlock(&s->qlock);
 
-		spin_unlock(&s->qlock);
-		return buf;
+	/* Put lost buffers back into firmware transfer rotation */
+	while (!list_empty(&r)) {
+		buf = list_entry(r.next, struct cx18_buffer, list);
+		list_del_init(r.next);
+		cx18_enqueue(s, buf, &s->q_free);
+		cx18_vapi(cx, CX18_CPU_DE_SET_MDL, 5, s->handle,
+		       (void __iomem *)&cx->scb->cpu_mdl[buf->id] - cx->enc_mem,
+		       1, buf->id, s->buf_size);
+		CX18_INFO("Returning %s, buffer %d back to transfer rotation\n",
+			  s->name, buf->id);
+		/* and there was much rejoicing... */
 	}
-	spin_unlock(&s->qlock);
-	CX18_ERR("Cannot find buffer %d for stream %s\n", id, s->name);
-	return NULL;
+	return ret;
 }
 
 /* Move all buffers of a queue to q_free, while flushing the buffers */
 static void cx18_queue_flush(struct cx18_stream *s, struct cx18_queue *q)
 {
-	unsigned long flags;
 	struct cx18_buffer *buf;
 
 	if (q == &s->q_free)
 		return;
 
-	spin_lock_irqsave(&s->qlock, flags);
+	mutex_lock(&s->qlock);
 	while (!list_empty(&q->list)) {
 		buf = list_entry(q->list.next, struct cx18_buffer, list);
 		list_move_tail(q->list.next, &s->q_free.list);
-		buf->bytesused = buf->readpos = buf->b_flags = 0;
+		buf->bytesused = buf->readpos = buf->b_flags = buf->skipped = 0;
 		atomic_inc(&s->q_free.buffers);
 	}
 	cx18_queue_init(q);
-	spin_unlock_irqrestore(&s->qlock, flags);
+	mutex_unlock(&s->qlock);
 }
 
 void cx18_flush_queues(struct cx18_stream *s)
diff --git a/linux/drivers/media/video/cx18/cx18-queue.h b/linux/drivers/media/video/cx18/cx18-queue.h
index 7f93bb13c..ff50a2b7e 100644
--- a/linux/drivers/media/video/cx18/cx18-queue.h
+++ b/linux/drivers/media/video/cx18/cx18-queue.h
@@ -4,6 +4,7 @@
  *  Derived from ivtv-queue.h
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -46,7 +47,7 @@ void cx18_queue_init(struct cx18_queue *q);
 void cx18_enqueue(struct cx18_stream *s, struct cx18_buffer *buf,
 	struct cx18_queue *q);
 struct cx18_buffer *cx18_dequeue(struct cx18_stream *s, struct cx18_queue *q);
-struct cx18_buffer *cx18_queue_get_buf_irq(struct cx18_stream *s, u32 id,
+struct cx18_buffer *cx18_queue_get_buf(struct cx18_stream *s, u32 id,
 	u32 bytesused);
 void cx18_flush_queues(struct cx18_stream *s);
 
diff --git a/linux/drivers/media/video/cx18/cx18-scb.c b/linux/drivers/media/video/cx18/cx18-scb.c
index f56d3772a..ac18bd932 100644
--- a/linux/drivers/media/video/cx18/cx18-scb.c
+++ b/linux/drivers/media/video/cx18/cx18-scb.c
@@ -2,6 +2,7 @@
  *  cx18 System Control Block initialization
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
diff --git a/linux/drivers/media/video/cx18/cx18-scb.h b/linux/drivers/media/video/cx18/cx18-scb.h
index 594713bbe..1dc1c431f 100644
--- a/linux/drivers/media/video/cx18/cx18-scb.h
+++ b/linux/drivers/media/video/cx18/cx18-scb.h
@@ -2,6 +2,7 @@
  *  cx18 System Control Block initialization
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -85,12 +86,6 @@ struct cx18_mdl {
     u32 length; /* Length of the buffer segment */
 };
 
-/* This structure is used by CPU to provide completed buffers information */
-struct cx18_mdl_ack {
-    u32 id;        /* ID of a completed MDL */
-    u32 data_used; /* Total data filled in the MDL for buffer 'id' */
-};
-
 struct cx18_scb {
 	/* These fields form the System Control Block which is used at boot time
 	   for localizing the IPC data as well as the code positions for all
@@ -276,7 +271,7 @@ struct cx18_scb {
 	struct cx18_mailbox  hpu2epu_mb;
 	struct cx18_mailbox  ppu2epu_mb;
 
-	struct cx18_mdl_ack  cpu_mdl_ack[CX18_MAX_STREAMS][2];
+	struct cx18_mdl_ack  cpu_mdl_ack[CX18_MAX_STREAMS][CX18_MAX_MDL_ACKS];
 	struct cx18_mdl      cpu_mdl[1];
 };
 
diff --git a/linux/drivers/media/video/cx18/cx18-streams.c b/linux/drivers/media/video/cx18/cx18-streams.c
index d29a0b61b..f7a7f38d8 100644
--- a/linux/drivers/media/video/cx18/cx18-streams.c
+++ b/linux/drivers/media/video/cx18/cx18-streams.c
@@ -4,6 +4,7 @@
  *  Derived from ivtv-streams.c
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -132,7 +133,7 @@ static void cx18_stream_init(struct cx18 *cx, int type)
 		s->buffers = 63;
 		s->buf_size = (max_size / s->buffers) & ~0xfff;
 	}
-	spin_lock_init(&s->qlock);
+	mutex_init(&s->qlock);
 	init_waitqueue_head(&s->waitq);
 	s->id = -1;
 	cx18_queue_init(&s->q_free);
@@ -622,3 +623,21 @@ u32 cx18_find_handle(struct cx18 *cx)
 	}
 	return CX18_INVALID_TASK_HANDLE;
 }
+
+struct cx18_stream *cx18_handle_to_stream(struct cx18 *cx, u32 handle)
+{
+	int i;
+	struct cx18_stream *s;
+
+	if (handle == CX18_INVALID_TASK_HANDLE)
+		return NULL;
+
+	for (i = 0; i < CX18_MAX_STREAMS; i++) {
+		s = &cx->streams[i];
+		if (s->handle != handle)
+			continue;
+		if (s->v4l2dev || s->dvb.enabled)
+			return s;
+	}
+	return NULL;
+}
diff --git a/linux/drivers/media/video/cx18/cx18-streams.h b/linux/drivers/media/video/cx18/cx18-streams.h
index f327e947b..7218b1504 100644
--- a/linux/drivers/media/video/cx18/cx18-streams.h
+++ b/linux/drivers/media/video/cx18/cx18-streams.h
@@ -4,6 +4,7 @@
  *  Derived from ivtv-streams.h
  *
  *  Copyright (C) 2007  Hans Verkuil <hverkuil@xs4all.nl>
+ *  Copyright (C) 2008  Andy Walls <awalls@radix.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -22,6 +23,7 @@
  */
 
 u32 cx18_find_handle(struct cx18 *cx);
+struct cx18_stream *cx18_handle_to_stream(struct cx18 *cx, u32 handle);
 int cx18_streams_setup(struct cx18 *cx);
 int cx18_streams_register(struct cx18 *cx);
 void cx18_streams_cleanup(struct cx18 *cx, int unregister);
diff --git a/linux/drivers/media/video/cx18/cx18-version.h b/linux/drivers/media/video/cx18/cx18-version.h
index 366cc1472..eb043d599 100644
--- a/linux/drivers/media/video/cx18/cx18-version.h
+++ b/linux/drivers/media/video/cx18/cx18-version.h
@@ -25,7 +25,7 @@
 #define CX18_DRIVER_NAME "cx18"
 #define CX18_DRIVER_VERSION_MAJOR 1
 #define CX18_DRIVER_VERSION_MINOR 0
-#define CX18_DRIVER_VERSION_PATCHLEVEL 2
+#define CX18_DRIVER_VERSION_PATCHLEVEL 3
 
 #define CX18_VERSION __stringify(CX18_DRIVER_VERSION_MAJOR) "." __stringify(CX18_DRIVER_VERSION_MINOR) "." __stringify(CX18_DRIVER_VERSION_PATCHLEVEL)
 #define CX18_DRIVER_VERSION KERNEL_VERSION(CX18_DRIVER_VERSION_MAJOR, \