Merge branch 'rio.b19' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/bird

* 'rio.b19' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/bird:
  [PATCH] missing readb/readw in rio
  [PATCH] copy_to_user() from iomem is a bad thing
  [PATCH] forgotten swap of copyout() arguments
  [PATCH] handling rio MEMDUMP
  [PATCH] fix rio_copy_to_card() for OLDPCI case
  [PATCH] uses of ->Copy() in rioroute are bogus
  [PATCH] bogus order of copy_from_user() arguments
  [PATCH] rio ->Copy() expects the sourse as first argument
  [PATCH] trivial annotations in rio

17 files changed, 283 insertions, 261 deletions

diff --git a/drivers/char/rio/daemon.h b/drivers/char/rio/daemon.h
index 5818a8aa46e0..6e63f8b2c479 100644
--- a/drivers/char/rio/daemon.h
+++ b/drivers/char/rio/daemon.h
@@ -51,7 +51,7 @@ struct Error {
 };
 
 struct DownLoad {
-	char *DataP;
+	char __user *DataP;
 	unsigned int Count;
 	unsigned int ProductCode;
 };
@@ -83,18 +83,18 @@ struct PortSetup {
 struct LpbReq {
 	unsigned int Host;
 	unsigned int Link;
-	struct LPB *LpbP;
+	struct LPB __user *LpbP;
 };
 
 struct RupReq {
 	unsigned int HostNum;
 	unsigned int RupNum;
-	struct RUP *RupP;
+	struct RUP __user *RupP;
 };
 
 struct PortReq {
 	unsigned int SysPort;
-	struct Port *PortP;
+	struct Port __user *PortP;
 };
 
 struct StreamInfo {
@@ -105,12 +105,12 @@ struct StreamInfo {
 
 struct HostReq {
 	unsigned int HostNum;
-	struct Host *HostP;
+	struct Host __user *HostP;
 };
 
 struct HostDpRam {
 	unsigned int HostNum;
-	struct DpRam *DpRamP;
+	struct DpRam __user *DpRamP;
 };
 
 struct DebugCtrl {
diff --git a/drivers/char/rio/func.h b/drivers/char/rio/func.h
index e64fe9912394..6b039186856d 100644
--- a/drivers/char/rio/func.h
+++ b/drivers/char/rio/func.h
@@ -46,7 +46,7 @@ int RIOBootCodeRTA(struct rio_info *, struct DownLoad *);
 int RIOBootCodeHOST(struct rio_info *, struct DownLoad *);
 int RIOBootCodeUNKNOWN(struct rio_info *, struct DownLoad *);
 void msec_timeout(struct Host *);
-int RIOBootRup(struct rio_info *, unsigned int, struct Host *, struct PKT *);
+int RIOBootRup(struct rio_info *, unsigned int, struct Host *, struct PKT __iomem *);
 int RIOBootOk(struct rio_info *, struct Host *, unsigned long);
 int RIORtaBound(struct rio_info *, unsigned int);
 void rio_fill_host_slot(int, int, unsigned int, struct Host *);
@@ -55,8 +55,8 @@ void rio_fill_host_slot(int, int, unsigned int, struct Host *);
 int RIOFoadRta(struct Host *, struct Map *);
 int RIOZombieRta(struct Host *, struct Map *);
 int RIOCommandRta(struct rio_info *, unsigned long, int (*func) (struct Host *, struct Map *));
-int RIOIdentifyRta(struct rio_info *, void *);
-int RIOKillNeighbour(struct rio_info *, void *);
+int RIOIdentifyRta(struct rio_info *, void __user *);
+int RIOKillNeighbour(struct rio_info *, void __user *);
 int RIOSuspendBootRta(struct Host *, int, int);
 int RIOFoadWakeup(struct rio_info *);
 struct CmdBlk *RIOGetCmdBlk(void);
@@ -68,7 +68,8 @@ int RIORFlushEnable(unsigned long, struct CmdBlk *);
 int RIOUnUse(unsigned long, struct CmdBlk *);
 
 /* rioctrl.c */
-int riocontrol(struct rio_info *, dev_t, int, caddr_t, int);
+int riocontrol(struct rio_info *, dev_t, int, unsigned long, int);
+
 int RIOPreemptiveCmd(struct rio_info *, struct Port *, unsigned char);
 
 /* rioinit.c */
@@ -77,13 +78,13 @@ void RIOInitHosts(struct rio_info *, struct RioHostInfo *);
 void RIOISAinit(struct rio_info *, int);
 int RIODoAT(struct rio_info *, int, int);
 caddr_t RIOCheckForATCard(int);
-int RIOAssignAT(struct rio_info *, int, caddr_t, int);
-int RIOBoardTest(unsigned long, caddr_t, unsigned char, int);
+int RIOAssignAT(struct rio_info *, int, void __iomem *, int);
+int RIOBoardTest(unsigned long, void __iomem *, unsigned char, int);
 void RIOAllocDataStructs(struct rio_info *);
 void RIOSetupDataStructs(struct rio_info *);
 int RIODefaultName(struct rio_info *, struct Host *, unsigned int);
 struct rioVersion *RIOVersid(void);
-void RIOHostReset(unsigned int, struct DpRam *, unsigned int);
+void RIOHostReset(unsigned int, struct DpRam __iomem *, unsigned int);
 
 /* riointr.c */
 void RIOTxEnable(char *);
@@ -95,14 +96,14 @@ int RIOParam(struct Port *, int, int, int);
 int RIODelay(struct Port *PortP, int);
 int RIODelay_ni(struct Port *PortP, int);
 void ms_timeout(struct Port *);
-int can_add_transmit(struct PKT **, struct Port *);
+int can_add_transmit(struct PKT __iomem **, struct Port *);
 void add_transmit(struct Port *);
-void put_free_end(struct Host *, struct PKT *);
-int can_remove_receive(struct PKT **, struct Port *);
+void put_free_end(struct Host *, struct PKT __iomem *);
+int can_remove_receive(struct PKT __iomem **, struct Port *);
 void remove_receive(struct Port *);
 
 /* rioroute.c */
-int RIORouteRup(struct rio_info *, unsigned int, struct Host *, struct PKT *);
+int RIORouteRup(struct rio_info *, unsigned int, struct Host *, struct PKT __iomem *);
 void RIOFixPhbs(struct rio_info *, struct Host *, unsigned int);
 unsigned int GetUnitType(unsigned int);
 int RIOSetChange(struct rio_info *);
@@ -139,7 +140,7 @@ int rio_isr_thread(char *);
 struct rio_info *rio_info_store(int cmd, struct rio_info *p);
 #endif
 
-extern void rio_copy_to_card(void *to, void *from, int len);
+extern void rio_copy_to_card(void *from, void __iomem *to, int len);
 extern int rio_minor(struct tty_struct *tty);
 extern int rio_ismodem(struct tty_struct *tty);
 
diff --git a/drivers/char/rio/host.h b/drivers/char/rio/host.h
index 179cdbea712b..ee2ddea7a63a 100644
--- a/drivers/char/rio/host.h
+++ b/drivers/char/rio/host.h
@@ -48,8 +48,8 @@ struct Host {
 	unsigned char Ivec;		/* POLLED or ivec number */
 	unsigned char Mode;		/* Control stuff */
 	unsigned char Slot;		/* Slot */
-	caddr_t Caddr;			/* KV address of DPRAM */
-	struct DpRam *CardP;		/* KV address of DPRAM, with overlay */
+	void  __iomem *Caddr;		/* KV address of DPRAM */
+	struct DpRam __iomem *CardP;	/* KV address of DPRAM, with overlay */
 	unsigned long PaddrP;		/* Phys. address of DPRAM */
 	char Name[MAX_NAME_LEN];	/* The name of the host */
 	unsigned int UniqueNum;		/* host unique number */
@@ -57,7 +57,7 @@ struct Host {
 	unsigned int WorkToBeDone;	/* set to true each interrupt */
 	unsigned int InIntr;		/* Being serviced? */
 	unsigned int IntSrvDone;	/* host's interrupt has been serviced */
-	void (*Copy) (void *, void *, int);	/* copy func */
+	void (*Copy) (void *, void __iomem *, int);	/* copy func */
 	struct timer_list timer;
 	/*
 	 **               I M P O R T A N T !
@@ -83,11 +83,11 @@ struct Host {
 
 	struct Top Topology[LINKS_PER_UNIT];	/* one per link */
 	struct Map Mapping[MAX_RUP];		/* Mappings for host */
-	struct PHB *PhbP;			/* Pointer to the PHB array */
-	unsigned short *PhbNumP;		/* Ptr to Number of PHB's */
-	struct LPB *LinkStrP;			/* Link Structure Array */
-	struct RUP *RupP;			/* Sixteen real rups here */
-	struct PARM_MAP *ParmMapP;		/* points to the parmmap */
+	struct PHB __iomem *PhbP;		/* Pointer to the PHB array */
+	unsigned short __iomem *PhbNumP;	/* Ptr to Number of PHB's */
+	struct LPB __iomem *LinkStrP;		/* Link Structure Array */
+	struct RUP __iomem *RupP;		/* Sixteen real rups here */
+	struct PARM_MAP __iomem *ParmMapP;	/* points to the parmmap */
 	unsigned int ExtraUnits[MAX_EXTRA_UNITS];	/* unknown things */
 	unsigned int NumExtraBooted;		/* how many of the above */
 	/*
diff --git a/drivers/char/rio/port.h b/drivers/char/rio/port.h
index 9b5fa3eb0402..49cf6d15ee54 100644
--- a/drivers/char/rio/port.h
+++ b/drivers/char/rio/port.h
@@ -40,7 +40,7 @@ struct Port {
 	struct gs_port gs;
 	int PortNum;			/* RIO port no., 0-511 */
 	struct Host *HostP;
-	caddr_t Caddr;
+	void __iomem *Caddr;
 	unsigned short HostPort;	/* Port number on host card */
 	unsigned char RupNum;		/* Number of RUP for port */
 	unsigned char ID2;		/* Second ID of RTA for port */
@@ -92,13 +92,13 @@ struct Port {
 #define RIO_RTSFLOW	0x0400		/* RIO's own RTSFLOW flag */
 
 
-	struct PHB *PhbP;		/* pointer to PHB for port */
-	u16 *TxAdd;			/* Add packets here */
-	u16 *TxStart;			/* Start of add array */
-	u16 *TxEnd;			/* End of add array */
-	u16 *RxRemove;			/* Remove packets here */
-	u16 *RxStart;			/* Start of remove array */
-	u16 *RxEnd;			/* End of remove array */
+	struct PHB __iomem *PhbP;	/* pointer to PHB for port */
+	u16 __iomem *TxAdd;		/* Add packets here */
+	u16 __iomem *TxStart;		/* Start of add array */
+	u16 __iomem *TxEnd;		/* End of add array */
+	u16 __iomem *RxRemove;		/* Remove packets here */
+	u16 __iomem *RxStart;		/* Start of remove array */
+	u16 __iomem *RxEnd;		/* End of remove array */
 	unsigned int RtaUniqueNum;	/* Unique number of RTA */
 	unsigned short PortState;	/* status of port */
 	unsigned short ModemState;	/* status of modem lines */
diff --git a/drivers/char/rio/rio.h b/drivers/char/rio/rio.h
index b4c91871ba28..1bf36223a4e8 100644
--- a/drivers/char/rio/rio.h
+++ b/drivers/char/rio/rio.h
@@ -129,8 +129,8 @@
 **	RIO_OBJ takes hostp->Caddr and a UNIX pointer to an object and
 **	returns the offset into the DP RAM area.
 */
-#define	RIO_PTR(C,O) (((unsigned char *)(C))+(0xFFFF&(O)))
-#define	RIO_OFF(C,O) ((long)(O)-(long)(C))
+#define	RIO_PTR(C,O) (((unsigned char __iomem *)(C))+(0xFFFF&(O)))
+#define	RIO_OFF(C,O) ((unsigned char __iomem *)(O)-(unsigned char __iomem *)(C))
 
 /*
 **	How to convert from various different device number formats:
diff --git a/drivers/char/rio/rio_linux.c b/drivers/char/rio/rio_linux.c
index 78dd856534ce..aa43436d5d1b 100644
--- a/drivers/char/rio/rio_linux.c
+++ b/drivers/char/rio/rio_linux.c
@@ -333,9 +333,9 @@ int RIODelay_ni(struct Port *PortP, int njiffies)
 	return !RIO_FAIL;
 }
 
-void rio_copy_to_card(void *to, void *from, int len)
+void rio_copy_to_card(void *from, void __iomem *to, int len)
 {
-	rio_memcpy_toio(NULL, to, from, len);
+	rio_copy_toio(to, from, len);
 }
 
 int rio_minor(struct tty_struct *tty)
@@ -573,7 +573,7 @@ static int rio_fw_ioctl(struct inode *inode, struct file *filp, unsigned int cmd
 	func_enter();
 
 	/* The "dev" argument isn't used. */
-	rc = riocontrol(p, 0, cmd, (void *) arg, capable(CAP_SYS_ADMIN));
+	rc = riocontrol(p, 0, cmd, arg, capable(CAP_SYS_ADMIN));
 
 	func_exit();
 	return rc;
@@ -583,6 +583,7 @@ extern int RIOShortCommand(struct rio_info *p, struct Port *PortP, int command,
 
 static int rio_ioctl(struct tty_struct *tty, struct file *filp, unsigned int cmd, unsigned long arg)
 {
+	void __user *argp = (void __user *)arg;
 	int rc;
 	struct Port *PortP;
 	int ival;
@@ -594,14 +595,14 @@ static int rio_ioctl(struct tty_struct *tty, struct file *filp, unsigned int cmd
 	rc = 0;
 	switch (cmd) {
 	case TIOCSSOFTCAR:
-		if ((rc = get_user(ival, (unsigned int *) arg)) == 0) {
+		if ((rc = get_user(ival, (unsigned __user *) argp)) == 0) {
 			tty->termios->c_cflag = (tty->termios->c_cflag & ~CLOCAL) | (ival ? CLOCAL : 0);
 		}
 		break;
 	case TIOCGSERIAL:
 		rc = -EFAULT;
-		if (access_ok(VERIFY_WRITE, (void *) arg, sizeof(struct serial_struct)))
-			rc = gs_getserial(&PortP->gs, (struct serial_struct *) arg);
+		if (access_ok(VERIFY_WRITE, argp, sizeof(struct serial_struct)))
+			rc = gs_getserial(&PortP->gs, argp);
 		break;
 	case TCSBRK:
 		if (PortP->State & RIO_DELETED) {
@@ -631,8 +632,8 @@ static int rio_ioctl(struct tty_struct *tty, struct file *filp, unsigned int cmd
 		break;
 	case TIOCSSERIAL:
 		rc = -EFAULT;
-		if (access_ok(VERIFY_READ, (void *) arg, sizeof(struct serial_struct)))
-			rc = gs_setserial(&PortP->gs, (struct serial_struct *) arg);
+		if (access_ok(VERIFY_READ, argp, sizeof(struct serial_struct)))
+			rc = gs_setserial(&PortP->gs, argp);
 		break;
 	default:
 		rc = -ENOIOCTLCMD;
@@ -919,7 +920,7 @@ static void __exit rio_release_drivers(void)
 static void fix_rio_pci(struct pci_dev *pdev)
 {
 	unsigned long hwbase;
-	unsigned char *rebase;
+	unsigned char __iomem *rebase;
 	unsigned int t;
 
 #define CNTRL_REG_OFFSET        0x50
@@ -999,7 +1000,7 @@ static int __init rio_init(void)
 		if (((1 << hp->Ivec) & rio_irqmask) == 0)
 			hp->Ivec = 0;
 		hp->Caddr = ioremap(p->RIOHosts[p->RIONumHosts].PaddrP, RIO_WINDOW_LEN);
-		hp->CardP = (struct DpRam *) hp->Caddr;
+		hp->CardP = (struct DpRam __iomem *) hp->Caddr;
 		hp->Type = RIO_PCI;
 		hp->Copy = rio_copy_to_card;
 		hp->Mode = RIO_PCI_BOOT_FROM_RAM;
@@ -1021,7 +1022,7 @@ static int __init rio_init(void)
 			p->RIONumHosts++;
 			found++;
 		} else {
-			iounmap((char *) (p->RIOHosts[p->RIONumHosts].Caddr));
+			iounmap(p->RIOHosts[p->RIONumHosts].Caddr);
 		}
 	}
 
@@ -1047,7 +1048,7 @@ static int __init rio_init(void)
 			hp->Ivec = 0;
 		hp->Ivec |= 0x8000;	/* Mark as non-sharable */
 		hp->Caddr = ioremap(p->RIOHosts[p->RIONumHosts].PaddrP, RIO_WINDOW_LEN);
-		hp->CardP = (struct DpRam *) hp->Caddr;
+		hp->CardP = (struct DpRam __iomem *) hp->Caddr;
 		hp->Type = RIO_PCI;
 		hp->Copy = rio_copy_to_card;
 		hp->Mode = RIO_PCI_BOOT_FROM_RAM;
@@ -1070,7 +1071,7 @@ static int __init rio_init(void)
 			p->RIONumHosts++;
 			found++;
 		} else {
-			iounmap((char *) (p->RIOHosts[p->RIONumHosts].Caddr));
+			iounmap(p->RIOHosts[p->RIONumHosts].Caddr);
 		}
 #else
 		printk(KERN_ERR "Found an older RIO PCI card, but the driver is not " "compiled to support it.\n");
@@ -1085,7 +1086,7 @@ static int __init rio_init(void)
 		/* There was something about the IRQs of these cards. 'Forget what.--REW */
 		hp->Ivec = 0;
 		hp->Caddr = ioremap(p->RIOHosts[p->RIONumHosts].PaddrP, RIO_WINDOW_LEN);
-		hp->CardP = (struct DpRam *) hp->Caddr;
+		hp->CardP = (struct DpRam __iomem *) hp->Caddr;
 		hp->Type = RIO_AT;
 		hp->Copy = rio_copy_to_card;	/* AT card PCI???? - PVDL
                                          * -- YES! this is now a normal copy. Only the
@@ -1111,7 +1112,7 @@ static int __init rio_init(void)
 			}
 
 			if (!okboard)
-				iounmap((char *) (hp->Caddr));
+				iounmap(hp->Caddr);
 		}
 	}
 
diff --git a/drivers/char/rio/rio_linux.h b/drivers/char/rio/rio_linux.h
index 4ce77fb1fae5..55b9c97e8477 100644
--- a/drivers/char/rio/rio_linux.h
+++ b/drivers/char/rio/rio_linux.h
@@ -131,9 +131,9 @@ struct vpd_prom {
 
 
 #ifdef CONFIG_RIO_OLDPCI
-static inline void *rio_memcpy_toio(void *dummy, void *dest, void *source, int n)
+static inline void __iomem *rio_memcpy_toio(void __iomem *dummy, void __iomem *dest, void *source, int n)
 {
-	char *dst = dest;
+	char __iomem *dst = dest;
 	char *src = source;
 
 	while (n--) {
@@ -144,11 +144,22 @@ static inline void *rio_memcpy_toio(void *dummy, void *dest, void *source, int n
 	return dest;
 }
 
+static inline void __iomem *rio_copy_toio(void __iomem *dest, void *source, int n)
+{
+	char __iomem *dst = dest;
+	char *src = source;
+
+	while (n--)
+		writeb(*src++, dst++);
 
-static inline void *rio_memcpy_fromio(void *dest, void *source, int n)
+	return dest;
+}
+
+
+static inline void *rio_memcpy_fromio(void *dest, void __iomem *source, int n)
 {
 	char *dst = dest;
-	char *src = source;
+	char __iomem *src = source;
 
 	while (n--)
 		*dst++ = readb(src++);
@@ -158,6 +169,7 @@ static inline void *rio_memcpy_fromio(void *dest, void *source, int n)
 
 #else
 #define rio_memcpy_toio(dummy,dest,source,n)   memcpy_toio(dest, source, n)
+#define rio_copy_toio   		       memcpy_toio
 #define rio_memcpy_fromio                      memcpy_fromio
 #endif
 
diff --git a/drivers/char/rio/rioboot.c b/drivers/char/rio/rioboot.c
index 290143addd34..eca2b95343e2 100644
--- a/drivers/char/rio/rioboot.c
+++ b/drivers/char/rio/rioboot.c
@@ -71,7 +71,7 @@
 #include "cmdblk.h"
 #include "route.h"
 
-static int RIOBootComplete(struct rio_info *p, struct Host *HostP, unsigned int Rup, struct PktCmd *PktCmdP);
+static int RIOBootComplete(struct rio_info *p, struct Host *HostP, unsigned int Rup, struct PktCmd __iomem *PktCmdP);
 
 static const unsigned char RIOAtVec2Ctrl[] = {
 	/* 0 */ INTERRUPT_DISABLE,
@@ -204,13 +204,13 @@ void rio_start_card_running(struct Host *HostP)
 int RIOBootCodeHOST(struct rio_info *p, struct DownLoad *rbp)
 {
 	struct Host *HostP;
-	u8 *Cad;
-	PARM_MAP *ParmMapP;
+	u8 __iomem *Cad;
+	PARM_MAP __iomem *ParmMapP;
 	int RupN;
 	int PortN;
 	unsigned int host;
-	u8 *StartP;
-	u8 *DestP;
+	u8 __iomem *StartP;
+	u8 __iomem *DestP;
 	int wait_count;
 	u16 OldParmMap;
 	u16 offset;		/* It is very important that this is a u16 */
@@ -262,7 +262,7 @@ int RIOBootCodeHOST(struct rio_info *p, struct DownLoad *rbp)
 		 ** Ensure that the host really is stopped.
 		 ** Disable it's external bus & twang its reset line.
 		 */
-		RIOHostReset(HostP->Type, (struct DpRam *) HostP->CardP, HostP->Slot);
+		RIOHostReset(HostP->Type, HostP->CardP, HostP->Slot);
 
 		/*
 		 ** Copy the data directly from user space to the SRAM.
@@ -280,7 +280,7 @@ int RIOBootCodeHOST(struct rio_info *p, struct DownLoad *rbp)
 			func_exit();
 			return -ENOMEM;
 		}
-		if (copy_from_user(rbp->DataP, DownCode, rbp->Count)) {
+		if (copy_from_user(DownCode, rbp->DataP, rbp->Count)) {
 			kfree(DownCode);
 			p->RIOError.Error = COPYIN_FAILED;
 			func_exit();
@@ -366,7 +366,7 @@ int RIOBootCodeHOST(struct rio_info *p, struct DownLoad *rbp)
 		 ** a short branch to 0x7FF8, where a long branch is coded.
 		 */
 
-		DestP = (u8 *) &Cad[0x7FF8];	/* <<<---- READ THE ABOVE COMMENTS */
+		DestP = &Cad[0x7FF8];	/* <<<---- READ THE ABOVE COMMENTS */
 
 #define	NFIX(N)	(0x60 | (N))	/* .O  = (~(.O + N))<<4 */
 #define	PFIX(N)	(0x20 | (N))	/* .O  =   (.O + N)<<4  */
@@ -438,7 +438,7 @@ int RIOBootCodeHOST(struct rio_info *p, struct DownLoad *rbp)
 			rio_dprintk(RIO_DEBUG_BOOT, "RIO Mesg Run Fail\n");
 			HostP->Flags &= ~RUN_STATE;
 			HostP->Flags |= RC_STUFFED;
-			RIOHostReset( HostP->Type, (struct DpRam *)HostP->CardP, HostP->Slot );
+			RIOHostReset( HostP->Type, HostP->CardP, HostP->Slot );
 			continue;
 		}
 
@@ -453,9 +453,9 @@ int RIOBootCodeHOST(struct rio_info *p, struct DownLoad *rbp)
 		/*
 		 ** Grab a 32 bit pointer to the parmmap structure
 		 */
-		ParmMapP = (PARM_MAP *) RIO_PTR(Cad, readw(&HostP->__ParmMapR));
+		ParmMapP = (PARM_MAP __iomem *) RIO_PTR(Cad, readw(&HostP->__ParmMapR));
 		rio_dprintk(RIO_DEBUG_BOOT, "ParmMapP : %p\n", ParmMapP);
-		ParmMapP = (PARM_MAP *) ((unsigned long) Cad + readw(&HostP->__ParmMapR));
+		ParmMapP = (PARM_MAP __iomem *)(Cad + readw(&HostP->__ParmMapR));
 		rio_dprintk(RIO_DEBUG_BOOT, "ParmMapP : %p\n", ParmMapP);
 
 		/*
@@ -468,7 +468,7 @@ int RIOBootCodeHOST(struct rio_info *p, struct DownLoad *rbp)
 			rio_dprintk(RIO_DEBUG_BOOT, "Links = 0x%x\n", readw(&ParmMapP->links));
 			HostP->Flags &= ~RUN_STATE;
 			HostP->Flags |= RC_STUFFED;
-			RIOHostReset( HostP->Type, (struct DpRam *)HostP->CardP, HostP->Slot );
+			RIOHostReset( HostP->Type, HostP->CardP, HostP->Slot );
 			continue;
 		}
 
@@ -491,7 +491,7 @@ int RIOBootCodeHOST(struct rio_info *p, struct DownLoad *rbp)
 			rio_dprintk(RIO_DEBUG_BOOT, "Timedout waiting for init_done\n");
 			HostP->Flags &= ~RUN_STATE;
 			HostP->Flags |= RC_STUFFED;
-			RIOHostReset( HostP->Type, (struct DpRam *)HostP->CardP, HostP->Slot );
+			RIOHostReset( HostP->Type, HostP->CardP, HostP->Slot );
 			continue;
 		}
 
@@ -512,10 +512,10 @@ int RIOBootCodeHOST(struct rio_info *p, struct DownLoad *rbp)
 		 ** 32 bit pointers for the driver in ioremap space.
 		 */
 		HostP->ParmMapP = ParmMapP;
-		HostP->PhbP = (struct PHB *) RIO_PTR(Cad, readw(&ParmMapP->phb_ptr));
-		HostP->RupP = (struct RUP *) RIO_PTR(Cad, readw(&ParmMapP->rups));
-		HostP->PhbNumP = (unsigned short *) RIO_PTR(Cad, readw(&ParmMapP->phb_num_ptr));
-		HostP->LinkStrP = (struct LPB *) RIO_PTR(Cad, readw(&ParmMapP->link_str_ptr));
+		HostP->PhbP = (struct PHB __iomem *) RIO_PTR(Cad, readw(&ParmMapP->phb_ptr));
+		HostP->RupP = (struct RUP __iomem *) RIO_PTR(Cad, readw(&ParmMapP->rups));
+		HostP->PhbNumP = (unsigned short __iomem *) RIO_PTR(Cad, readw(&ParmMapP->phb_num_ptr));
+		HostP->LinkStrP = (struct LPB __iomem *) RIO_PTR(Cad, readw(&ParmMapP->link_str_ptr));
 
 		/*
 		 ** point the UnixRups at the real Rups
@@ -540,7 +540,7 @@ int RIOBootCodeHOST(struct rio_info *p, struct DownLoad *rbp)
 		for (PortN = p->RIOFirstPortsMapped; PortN < p->RIOLastPortsMapped + PORTS_PER_RTA; PortN++) {
 			if (p->RIOPortp[PortN]->HostP == HostP) {
 				struct Port *PortP = p->RIOPortp[PortN];
-				struct PHB *PhbP;
+				struct PHB __iomem *PhbP;
 				/* int oldspl; */
 
 				if (!PortP->Mapped)
@@ -551,12 +551,12 @@ int RIOBootCodeHOST(struct rio_info *p, struct DownLoad *rbp)
 
 				PortP->PhbP = PhbP;
 
-				PortP->TxAdd = (u16 *) RIO_PTR(Cad, readw(&PhbP->tx_add));
-				PortP->TxStart = (u16 *) RIO_PTR(Cad, readw(&PhbP->tx_start));
-				PortP->TxEnd = (u16 *) RIO_PTR(Cad, readw(&PhbP->tx_end));
-				PortP->RxRemove = (u16 *) RIO_PTR(Cad, readw(&PhbP->rx_remove));
-				PortP->RxStart = (u16 *) RIO_PTR(Cad, readw(&PhbP->rx_start));
-				PortP->RxEnd = (u16 *) RIO_PTR(Cad, readw(&PhbP->rx_end));
+				PortP->TxAdd = (u16 __iomem *) RIO_PTR(Cad, readw(&PhbP->tx_add));
+				PortP->TxStart = (u16 __iomem *) RIO_PTR(Cad, readw(&PhbP->tx_start));
+				PortP->TxEnd = (u16 __iomem *) RIO_PTR(Cad, readw(&PhbP->tx_end));
+				PortP->RxRemove = (u16 __iomem *) RIO_PTR(Cad, readw(&PhbP->rx_remove));
+				PortP->RxStart = (u16 __iomem *) RIO_PTR(Cad, readw(&PhbP->rx_start));
+				PortP->RxEnd = (u16 __iomem *) RIO_PTR(Cad, readw(&PhbP->rx_end));
 
 				rio_spin_unlock_irqrestore(&PortP->portSem, flags);
 				/*
@@ -601,9 +601,9 @@ int RIOBootCodeHOST(struct rio_info *p, struct DownLoad *rbp)
  *	return 1. If we havent, then return 0.
  */
 
-int RIOBootRup(struct rio_info *p, unsigned int Rup, struct Host *HostP, struct PKT *PacketP)
+int RIOBootRup(struct rio_info *p, unsigned int Rup, struct Host *HostP, struct PKT __iomem *PacketP)
 {
-	struct PktCmd *PktCmdP = (struct PktCmd *) PacketP->data;
+	struct PktCmd __iomem *PktCmdP = (struct PktCmd __iomem *) PacketP->data;
 	struct PktCmd_M *PktReplyP;
 	struct CmdBlk *CmdBlkP;
 	unsigned int sequence;
@@ -722,7 +722,7 @@ int RIOBootRup(struct rio_info *p, unsigned int Rup, struct Host *HostP, struct
  *	RtaUniq is the booted RTA.
  */
 
-static int RIOBootComplete(struct rio_info *p, struct Host *HostP, unsigned int Rup, struct PktCmd *PktCmdP)
+static int RIOBootComplete(struct rio_info *p, struct Host *HostP, unsigned int Rup, struct PktCmd __iomem *PktCmdP)
 {
 	struct Map *MapP = NULL;
 	struct Map *MapP2 = NULL;
diff --git a/drivers/char/rio/riocmd.c b/drivers/char/rio/riocmd.c
index e6d2b14b5e65..4df6ab2206a1 100644
--- a/drivers/char/rio/riocmd.c
+++ b/drivers/char/rio/riocmd.c
@@ -180,7 +180,7 @@ int RIOCommandRta(struct rio_info *p, unsigned long RtaUnique, int (*func) (stru
 }
 
 
-int RIOIdentifyRta(struct rio_info *p, void * arg)
+int RIOIdentifyRta(struct rio_info *p, void __user * arg)
 {
 	unsigned int Host;
 
@@ -245,7 +245,7 @@ int RIOIdentifyRta(struct rio_info *p, void * arg)
 }
 
 
-int RIOKillNeighbour(struct rio_info *p, void * arg)
+int RIOKillNeighbour(struct rio_info *p, void __user * arg)
 {
 	uint Host;
 	uint ID;
@@ -370,9 +370,9 @@ int RIOFoadWakeup(struct rio_info *p)
 /*
 ** Incoming command on the COMMAND_RUP to be processed.
 */
-static int RIOCommandRup(struct rio_info *p, uint Rup, struct Host *HostP, struct PKT * PacketP)
+static int RIOCommandRup(struct rio_info *p, uint Rup, struct Host *HostP, struct PKT __iomem *PacketP)
 {
-	struct PktCmd *PktCmdP = (struct PktCmd *) PacketP->data;
+	struct PktCmd __iomem *PktCmdP = (struct PktCmd __iomem *)PacketP->data;
 	struct Port *PortP;
 	struct UnixRup *UnixRupP;
 	unsigned short SysPort;
@@ -407,12 +407,12 @@ static int RIOCommandRup(struct rio_info *p, uint Rup, struct Host *HostP, struc
 		} else
 			rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: This is the RUP for link ``%c'' of host ``%s''\n", ('A' + Rup - MAX_RUP), HostP->Name);
 
-		rio_dprintk(RIO_DEBUG_CMD, "PACKET information: Destination 0x%x:0x%x\n", PacketP->dest_unit, PacketP->dest_port);
-		rio_dprintk(RIO_DEBUG_CMD, "PACKET information: Source	  0x%x:0x%x\n", PacketP->src_unit, PacketP->src_port);
-		rio_dprintk(RIO_DEBUG_CMD, "PACKET information: Length	  0x%x (%d)\n", PacketP->len, PacketP->len);
-		rio_dprintk(RIO_DEBUG_CMD, "PACKET information: Control	 0x%x (%d)\n", PacketP->control, PacketP->control);
-		rio_dprintk(RIO_DEBUG_CMD, "PACKET information: Check	   0x%x (%d)\n", PacketP->csum, PacketP->csum);
-		rio_dprintk(RIO_DEBUG_CMD, "COMMAND information: Host Port Number 0x%x, " "Command Code 0x%x\n", PktCmdP->PhbNum, PktCmdP->Command);
+		rio_dprintk(RIO_DEBUG_CMD, "PACKET information: Destination 0x%x:0x%x\n", readb(&PacketP->dest_unit), readb(&PacketP->dest_port));
+		rio_dprintk(RIO_DEBUG_CMD, "PACKET information: Source	  0x%x:0x%x\n", readb(&PacketP->src_unit), readb(&PacketP->src_port));
+		rio_dprintk(RIO_DEBUG_CMD, "PACKET information: Length	  0x%x (%d)\n", readb(&PacketP->len), readb(&PacketP->len));
+		rio_dprintk(RIO_DEBUG_CMD, "PACKET information: Control	 0x%x (%d)\n", readb(&PacketP->control), readb(&PacketP->control));
+		rio_dprintk(RIO_DEBUG_CMD, "PACKET information: Check	   0x%x (%d)\n", readw(&PacketP->csum), readw(&PacketP->csum));
+		rio_dprintk(RIO_DEBUG_CMD, "COMMAND information: Host Port Number 0x%x, " "Command Code 0x%x\n", readb(&PktCmdP->PhbNum), readb(&PktCmdP->Command));
 		return 1;
 	}
 	PortP = p->RIOPortp[SysPort];
@@ -601,7 +601,7 @@ int RIOQueueCmdBlk(struct Host *HostP, uint Rup, struct CmdBlk *CmdBlkP)
 		/*
 		 ** Whammy! blat that pack!
 		 */
-		HostP->Copy((caddr_t) & CmdBlkP->Packet, RIO_PTR(HostP->Caddr, UnixRupP->RupP->txpkt), sizeof(struct PKT));
+		HostP->Copy(&CmdBlkP->Packet, RIO_PTR(HostP->Caddr, readw(&UnixRupP->RupP->txpkt)), sizeof(struct PKT));
 
 		/*
 		 ** place command packet on the pending position.
@@ -655,7 +655,7 @@ void RIOPollHostCommands(struct rio_info *p, struct Host *HostP)
 {
 	struct CmdBlk *CmdBlkP;
 	struct UnixRup *UnixRupP;
-	struct PKT *PacketP;
+	struct PKT __iomem *PacketP;
 	unsigned short Rup;
 	unsigned long flags;
 
@@ -676,7 +676,7 @@ void RIOPollHostCommands(struct rio_info *p, struct Host *HostP)
 		if (readw(&UnixRupP->RupP->rxcontrol) != RX_RUP_INACTIVE) {
 			int FreeMe;
 
-			PacketP = (struct PKT *) RIO_PTR(HostP->Caddr, readw(&UnixRupP->RupP->rxpkt));
+			PacketP = (struct PKT __iomem *) RIO_PTR(HostP->Caddr, readw(&UnixRupP->RupP->rxpkt));
 
 			switch (readb(&PacketP->dest_port)) {
 			case BOOT_RUP:
@@ -694,9 +694,9 @@ void RIOPollHostCommands(struct rio_info *p, struct Host *HostP)
 				 */
 				rio_spin_unlock_irqrestore(&UnixRupP->RupLock, flags);
 				FreeMe = RIOCommandRup(p, Rup, HostP, PacketP);
-				if (PacketP->data[5] == MEMDUMP) {
-					rio_dprintk(RIO_DEBUG_CMD, "Memdump from 0x%x complete\n", *(unsigned short *) & (PacketP->data[6]));
-					HostP->Copy((caddr_t) & (PacketP->data[8]), (caddr_t) p->RIOMemDump, 32);
+				if (readb(&PacketP->data[5]) == MEMDUMP) {
+					rio_dprintk(RIO_DEBUG_CMD, "Memdump from 0x%x complete\n", readw(&(PacketP->data[6])));
+					rio_memcpy_fromio(p->RIOMemDump, &(PacketP->data[8]), 32);
 				}
 				rio_spin_lock_irqsave(&UnixRupP->RupLock, flags);
 				break;
@@ -782,7 +782,7 @@ void RIOPollHostCommands(struct rio_info *p, struct Host *HostP)
 				/*
 				 ** Whammy! blat that pack!
 				 */
-				HostP->Copy((caddr_t) & CmdBlkP->Packet, RIO_PTR(HostP->Caddr, UnixRupP->RupP->txpkt), sizeof(struct PKT));
+				HostP->Copy(&CmdBlkP->Packet, RIO_PTR(HostP->Caddr, readw(&UnixRupP->RupP->txpkt)), sizeof(struct PKT));
 
 				/*
 				 ** remove the command from the rup command queue...
@@ -824,7 +824,7 @@ int RIOWFlushMark(unsigned long iPortP, struct CmdBlk *CmdBlkP)
 int RIORFlushEnable(unsigned long iPortP, struct CmdBlk *CmdBlkP)
 {
 	struct Port *PortP = (struct Port *) iPortP;
-	struct PKT *PacketP;
+	struct PKT __iomem *PacketP;
 	unsigned long flags;
 
 	rio_spin_lock_irqsave(&PortP->portSem, flags);
diff --git a/drivers/char/rio/rioctrl.c b/drivers/char/rio/rioctrl.c
index 75b2557c37ec..052e8120a471 100644
--- a/drivers/char/rio/rioctrl.c
+++ b/drivers/char/rio/rioctrl.c
@@ -80,7 +80,7 @@ static char *_rioctrl_c_sccs_ = "@(#)rioctrl.c	1.3";
 static struct LpbReq LpbReq;
 static struct RupReq RupReq;
 static struct PortReq PortReq;
-static struct HostReq HostReq;
+static struct HostReq HostReq;	/* oh really?  global?  and no locking? */
 static struct HostDpRam HostDpRam;
 static struct DebugCtrl DebugCtrl;
 static struct Map MapEnt;
@@ -126,12 +126,19 @@ static int
 
 #define drv_makedev(maj, min) ((((uint) maj & 0xff) << 8) | ((uint) min & 0xff))
 
-int riocontrol(p, dev, cmd, arg, su)
-struct rio_info *p;
-dev_t dev;
-int cmd;
-caddr_t arg;
-int su;
+static int copy_from_io(void __user *to, void __iomem *from, size_t size)
+{
+	void *buf = kmalloc(size, GFP_KERNEL);
+	int res = -ENOMEM;
+	if (buf) {
+		rio_memcpy_fromio(buf, from, size);
+		res = copy_to_user(to, buf, size);
+		kfree(buf);
+	}
+	return res;
+}
+
+int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su)
 {
 	uint Host;		/* leave me unsigned! */
 	uint port;		/* and me! */
@@ -139,9 +146,10 @@ int su;
 	ushort loop;
 	int Entry;
 	struct Port *PortP;
-	struct PKT *PacketP;
+	struct PKT __iomem *PacketP;
 	int retval = 0;
 	unsigned long flags;
+	void __user *argp = (void __user *)arg;
 
 	func_enter();
 
@@ -149,7 +157,7 @@ int su;
 	Host = 0;
 	PortP = NULL;
 
-	rio_dprintk(RIO_DEBUG_CTRL, "control ioctl cmd: 0x%x arg: %p\n", cmd, arg);
+	rio_dprintk(RIO_DEBUG_CTRL, "control ioctl cmd: 0x%x arg: %p\n", cmd, argp);
 
 	switch (cmd) {
 		/*
@@ -160,11 +168,11 @@ int su;
 		 ** otherwise just the specified host card will be changed.
 		 */
 	case RIO_SET_TIMER:
-		rio_dprintk(RIO_DEBUG_CTRL, "RIO_SET_TIMER to %ldms\n", (unsigned long)arg);
+		rio_dprintk(RIO_DEBUG_CTRL, "RIO_SET_TIMER to %ldms\n", arg);
 		{
 			int host, value;
-			host = ((unsigned long) arg >> 16) & 0x0000FFFF;
-			value = (unsigned long) arg & 0x0000ffff;
+			host = (arg >> 16) & 0x0000FFFF;
+			value = arg & 0x0000ffff;
 			if (host == -1) {
 				for (host = 0; host < p->RIONumHosts; host++) {
 					if (p->RIOHosts[host].Flags == RC_RUNNING) {
@@ -183,26 +191,26 @@ int su;
 
 	case RIO_FOAD_RTA:
 		rio_dprintk(RIO_DEBUG_CTRL, "RIO_FOAD_RTA\n");
-		return RIOCommandRta(p, (unsigned long)arg, RIOFoadRta);
+		return RIOCommandRta(p, arg, RIOFoadRta);
 
 	case RIO_ZOMBIE_RTA:
 		rio_dprintk(RIO_DEBUG_CTRL, "RIO_ZOMBIE_RTA\n");
-		return RIOCommandRta(p, (unsigned long)arg, RIOZombieRta);
+		return RIOCommandRta(p, arg, RIOZombieRta);
 
 	case RIO_IDENTIFY_RTA:
 		rio_dprintk(RIO_DEBUG_CTRL, "RIO_IDENTIFY_RTA\n");
-		return RIOIdentifyRta(p, arg);
+		return RIOIdentifyRta(p, argp);
 
 	case RIO_KILL_NEIGHBOUR:
 		rio_dprintk(RIO_DEBUG_CTRL, "RIO_KILL_NEIGHBOUR\n");
-		return RIOKillNeighbour(p, arg);
+		return RIOKillNeighbour(p, argp);
 
 	case SPECIAL_RUP_CMD:
 		{
 			struct CmdBlk *CmdBlkP;
 
 			rio_dprintk(RIO_DEBUG_CTRL, "SPECIAL_RUP_CMD\n");
-			if (copy_from_user(&SpecialRupCmd, arg, sizeof(SpecialRupCmd))) {
+			if (copy_from_user(&SpecialRupCmd, argp, sizeof(SpecialRupCmd))) {
 				rio_dprintk(RIO_DEBUG_CTRL, "SPECIAL_RUP_CMD copy failed\n");
 				p->RIOError.Error = COPYIN_FAILED;
 				return -EFAULT;
@@ -239,7 +247,7 @@ int su;
 		if ((retval = RIOApel(p)) != 0)
 			return retval;
 
-		if (copy_to_user(arg, p->RIOConnectTable, TOTAL_MAP_ENTRIES * sizeof(struct Map))) {
+		if (copy_to_user(argp, p->RIOConnectTable, TOTAL_MAP_ENTRIES * sizeof(struct Map))) {
 			rio_dprintk(RIO_DEBUG_CTRL, "RIO_GET_TABLE copy failed\n");
 			p->RIOError.Error = COPYOUT_FAILED;
 			return -EFAULT;
@@ -284,7 +292,7 @@ int su;
 			p->RIOError.Error = NOT_SUPER_USER;
 			return -EPERM;
 		}
-		if (copy_from_user(&p->RIOConnectTable[0], arg, TOTAL_MAP_ENTRIES * sizeof(struct Map))) {
+		if (copy_from_user(&p->RIOConnectTable[0], argp, TOTAL_MAP_ENTRIES * sizeof(struct Map))) {
 			rio_dprintk(RIO_DEBUG_CTRL, "RIO_PUT_TABLE copy failed\n");
 			p->RIOError.Error = COPYIN_FAILED;
 			return -EFAULT;
@@ -330,7 +338,7 @@ int su;
 			p->RIOError.Error = NOT_SUPER_USER;
 			return -EPERM;
 		}
-		if (copy_to_user(arg, p->RIOBindTab, (sizeof(ulong) * MAX_RTA_BINDINGS))) {
+		if (copy_to_user(argp, p->RIOBindTab, (sizeof(ulong) * MAX_RTA_BINDINGS))) {
 			rio_dprintk(RIO_DEBUG_CTRL, "RIO_GET_BINDINGS copy failed\n");
 			p->RIOError.Error = COPYOUT_FAILED;
 			return -EFAULT;