rapidio/mport_cdev: fix uapi type definitions

Fix problems in uapi definitions reported by Gabriel Laskar: (see
https://lkml.org/lkml/2016/4/5/205 for details)

 - move public header file rio_mport_cdev.h to include/uapi/linux directory
 - change types in data structures passed as IOCTL parameters
 - improve parameter checking in some IOCTL service routines

Signed-off-by: Alexandre Bounine <alexandre.bounine@idt.com>
Reported-by: Gabriel Laskar <gabriel@lse.epita.fr>
Tested-by: Barry Wood <barry.wood@idt.com>
Cc: Gabriel Laskar <gabriel@lse.epita.fr>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Aurelien Jacquiot <a-jacquiot@ti.com>
Cc: Andre van Herk <andre.van.herk@prodrive-technologies.com>
Cc: Barry Wood <barry.wood@idt.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2 files changed, 139 insertions, 120 deletions

diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
index 96168b819044..e165b7ce29d7 100644
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -126,7 +126,7 @@ struct rio_mport_mapping {
         struct list_head node;
         struct mport_dev *md;
         enum rio_mport_map_dir dir;
-        u32 rioid;
+        u16 rioid;
         u64 rio_addr;
         dma_addr_t phys_addr; /* for mmap */
         void *virt_addr; /* kernel address, for dma_free_coherent */
@@ -137,7 +137,7 @@ struct rio_mport_mapping {
 
 struct rio_mport_dma_map {
         int valid;
-        uint64_t length;
+        u64 length;
         void *vaddr;
         dma_addr_t paddr;
 };
@@ -208,7 +208,7 @@ struct mport_cdev_priv {
         struct kfifo            event_fifo;
         wait_queue_head_t       event_rx_wait;
         spinlock_t              fifo_lock;
-        unsigned int            event_mask; /* RIO_DOORBELL, RIO_PORTWRITE */
+        u32                     event_mask; /* RIO_DOORBELL, RIO_PORTWRITE */
 #ifdef CONFIG_RAPIDIO_DMA_ENGINE
         struct dma_chan         *dmach;
         struct list_head        async_list;
@@ -276,7 +276,8 @@ static int rio_mport_maint_rd(struct mport_cdev_priv *priv, void __user *arg,
                 return -EFAULT;
 
         if ((maint_io.offset % 4) ||
-            (maint_io.length == 0) || (maint_io.length % 4))
+            (maint_io.length == 0) || (maint_io.length % 4) ||
+            (maint_io.length + maint_io.offset) > RIO_MAINT_SPACE_SZ)
                 return -EINVAL;
 
         buffer = vmalloc(maint_io.length);
@@ -298,7 +299,8 @@ static int rio_mport_maint_rd(struct mport_cdev_priv *priv, void __user *arg,
                 offset += 4;
         }
 
-        if (unlikely(copy_to_user(maint_io.buffer, buffer, maint_io.length)))
+        if (unlikely(copy_to_user((void __user *)(uintptr_t)maint_io.buffer,
+                                   buffer, maint_io.length)))
                 ret = -EFAULT;
 out:
         vfree(buffer);
@@ -319,7 +321,8 @@ static int rio_mport_maint_wr(struct mport_cdev_priv *priv, void __user *arg,
                 return -EFAULT;
 
         if ((maint_io.offset % 4) ||
-            (maint_io.length == 0) || (maint_io.length % 4))
+            (maint_io.length == 0) || (maint_io.length % 4) ||
+            (maint_io.length + maint_io.offset) > RIO_MAINT_SPACE_SZ)
                 return -EINVAL;
 
         buffer = vmalloc(maint_io.length);
@@ -327,7 +330,8 @@ static int rio_mport_maint_wr(struct mport_cdev_priv *priv, void __user *arg,
                 return -ENOMEM;
         length = maint_io.length;
 
-        if (unlikely(copy_from_user(buffer, maint_io.buffer, length))) {
+        if (unlikely(copy_from_user(buffer,
+                        (void __user *)(uintptr_t)maint_io.buffer, length))) {
                 ret = -EFAULT;
                 goto out;
         }
@@ -360,7 +364,7 @@ out:
  */
 static int
 rio_mport_create_outbound_mapping(struct mport_dev *md, struct file *filp,
-                                  u32 rioid, u64 raddr, u32 size,
+                                  u16 rioid, u64 raddr, u32 size,
                                   dma_addr_t *paddr)
 {
         struct rio_mport *mport = md->mport;
@@ -369,7 +373,7 @@ rio_mport_create_outbound_mapping(struct mport_dev *md, struct file *filp,
 
         rmcd_debug(OBW, "did=%d ra=0x%llx sz=0x%x", rioid, raddr, size);
 
-        map = kzalloc(sizeof(struct rio_mport_mapping), GFP_KERNEL);
+        map = kzalloc(sizeof(*map), GFP_KERNEL);
         if (map == NULL)
                 return -ENOMEM;
 
@@ -394,7 +398,7 @@ err_map_outb:
 
 static int
 rio_mport_get_outbound_mapping(struct mport_dev *md, struct file *filp,
-                               u32 rioid, u64 raddr, u32 size,
+                               u16 rioid, u64 raddr, u32 size,
                                dma_addr_t *paddr)
 {
         struct rio_mport_mapping *map;
@@ -433,7 +437,7 @@ static int rio_mport_obw_map(struct file *filp, void __user *arg)
         dma_addr_t paddr;
         int ret;
 
-        if (unlikely(copy_from_user(&map, arg, sizeof(struct rio_mmap))))
+        if (unlikely(copy_from_user(&map, arg, sizeof(map))))
                 return -EFAULT;
 
         rmcd_debug(OBW, "did=%d ra=0x%llx sz=0x%llx",
@@ -448,7 +452,7 @@ static int rio_mport_obw_map(struct file *filp, void __user *arg)
 
         map.handle = paddr;
 
-        if (unlikely(copy_to_user(arg, &map, sizeof(struct rio_mmap))))
+        if (unlikely(copy_to_user(arg, &map, sizeof(map))))
                 return -EFAULT;
         return 0;
 }
@@ -469,7 +473,7 @@ static int rio_mport_obw_free(struct file *filp, void __user *arg)
         if (!md->mport->ops->unmap_outb)
                 return -EPROTONOSUPPORT;
 
-        if (copy_from_user(&handle, arg, sizeof(u64)))
+        if (copy_from_user(&handle, arg, sizeof(handle)))
                 return -EFAULT;
 
         rmcd_debug(OBW, "h=0x%llx", handle);
@@ -498,9 +502,9 @@ static int rio_mport_obw_free(struct file *filp, void __user *arg)
 static int maint_hdid_set(struct mport_cdev_priv *priv, void __user *arg)
 {
         struct mport_dev *md = priv->md;
-        uint16_t hdid;
+        u16 hdid;
 
-        if (copy_from_user(&hdid, arg, sizeof(uint16_t)))
+        if (copy_from_user(&hdid, arg, sizeof(hdid)))
                 return -EFAULT;
 
         md->mport->host_deviceid = hdid;
@@ -520,9 +524,9 @@ static int maint_hdid_set(struct mport_cdev_priv *priv, void __user *arg)
 static int maint_comptag_set(struct mport_cdev_priv *priv, void __user *arg)
 {
         struct mport_dev *md = priv->md;
-        uint32_t comptag;
+        u32 comptag;
 
-        if (copy_from_user(&comptag, arg, sizeof(uint32_t)))
+        if (copy_from_user(&comptag, arg, sizeof(comptag)))
                 return -EFAULT;
 
         rio_local_write_config_32(md->mport, RIO_COMPONENT_TAG_CSR, comptag);
@@ -837,7 +841,7 @@ err_out:
  * @xfer: data transfer descriptor structure
  */
 static int
-rio_dma_transfer(struct file *filp, uint32_t transfer_mode,
+rio_dma_transfer(struct file *filp, u32 transfer_mode,
                  enum rio_transfer_sync sync, enum dma_data_direction dir,
                  struct rio_transfer_io *xfer)
 {
@@ -875,7 +879,7 @@ rio_dma_transfer(struct file *filp, uint32_t transfer_mode,
                 unsigned long offset;
                 long pinned;
 
-                offset = (unsigned long)xfer->loc_addr & ~PAGE_MASK;
+                offset = (unsigned long)(uintptr_t)xfer->loc_addr & ~PAGE_MASK;
                 nr_pages = PAGE_ALIGN(xfer->length + offset) >> PAGE_SHIFT;
 
                 page_list = kmalloc_array(nr_pages,
@@ -1015,19 +1019,20 @@ static int rio_mport_transfer_ioctl(struct file *filp, void __user *arg)
         if (unlikely(copy_from_user(&transaction, arg, sizeof(transaction))))
                 return -EFAULT;
 
-        if (transaction.count != 1)
+        if (transaction.count != 1) /* only single transfer for now */
                 return -EINVAL;
 
         if ((transaction.transfer_mode &
              priv->md->properties.transfer_mode) == 0)
                 return -ENODEV;
 
-        transfer = vmalloc(transaction.count * sizeof(struct rio_transfer_io));
+        transfer = vmalloc(transaction.count * sizeof(*transfer));
         if (!transfer)
                 return -ENOMEM;
 
-        if (unlikely(copy_from_user(transfer, transaction.block,
-              transaction.count * sizeof(struct rio_transfer_io)))) {
+        if (unlikely(copy_from_user(transfer,
+                                    (void __user *)(uintptr_t)transaction.block,
+                                    transaction.count * sizeof(*transfer)))) {
                 ret = -EFAULT;
                 goto out_free;
         }
@@ -1038,8 +1043,9 @@ static int rio_mport_transfer_ioctl(struct file *filp, void __user *arg)
                 ret = rio_dma_transfer(filp, transaction.transfer_mode,
                         transaction.sync, dir, &transfer[i]);
 
-        if (unlikely(copy_to_user(transaction.block, transfer,
-              transaction.count * sizeof(struct rio_transfer_io))))
+        if (unlikely(copy_to_user((void __user *)(uintptr_t)transaction.block,
+                                  transfer,
+                                  transaction.count * sizeof(*transfer))))
                 ret = -EFAULT;
 
 out_free:
@@ -1129,11 +1135,11 @@ err_tmo:
 }
 
 static int rio_mport_create_dma_mapping(struct mport_dev *md, struct file *filp,
-                        uint64_t size, struct rio_mport_mapping **mapping)
+                        u64 size, struct rio_mport_mapping **mapping)
 {
         struct rio_mport_mapping *map;
 
-        map = kzalloc(sizeof(struct rio_mport_mapping), GFP_KERNEL);
+        map = kzalloc(sizeof(*map), GFP_KERNEL);
         if (map == NULL)
                 return -ENOMEM;
 
@@ -1165,7 +1171,7 @@ static int rio_mport_alloc_dma(struct file *filp, void __user *arg)
         struct rio_mport_mapping *mapping = NULL;
         int ret;
 
-        if (unlikely(copy_from_user(&map, arg, sizeof(struct rio_dma_mem))))
+        if (unlikely(copy_from_user(&map, arg, sizeof(map))))
                 return -EFAULT;
 
         ret = rio_mport_create_dma_mapping(md, filp, map.length, &mapping);
@@ -1174,7 +1180,7 @@ static int rio_mport_alloc_dma(struct file *filp, void __user *arg)
 
         map.dma_handle = mapping->phys_addr;
 
-        if (unlikely(copy_to_user(arg, &map, sizeof(struct rio_dma_mem)))) {
+        if (unlikely(copy_to_user(arg, &map, sizeof(map)))) {
                 mutex_lock(&md->buf_mutex);
                 kref_put(&mapping->ref, mport_release_mapping);
                 mutex_unlock(&md->buf_mutex);
@@ -1192,7 +1198,7 @@ static int rio_mport_free_dma(struct file *filp, void __user *arg)
         int ret = -EFAULT;
         struct rio_mport_mapping *map, *_map;
 
-        if (copy_from_user(&handle, arg, sizeof(u64)))
+        if (copy_from_user(&handle, arg, sizeof(handle)))
                 return -EFAULT;
         rmcd_debug(EXIT, "filp=%p", filp);
 
@@ -1242,14 +1248,18 @@ static int rio_mport_free_dma(struct file *filp, void __user *arg)
 
 static int
 rio_mport_create_inbound_mapping(struct mport_dev *md, struct file *filp,
-                                u64 raddr, u32 size,
+                                u64 raddr, u64 size,
                                 struct rio_mport_mapping **mapping)
 {
         struct rio_mport *mport = md->mport;
         struct rio_mport_mapping *map;
         int ret;
 
-        map = kzalloc(sizeof(struct rio_mport_mapping), GFP_KERNEL);
+        /* rio_map_inb_region() accepts u32 size */
+        if (size > 0xffffffff)
+                return -EINVAL;
+
+        map = kzalloc(sizeof(*map), GFP_KERNEL);
         if (map == NULL)
                 return -ENOMEM;
 
@@ -1262,7 +1272,7 @@ rio_mport_create_inbound_mapping(struct mport_dev *md, struct file *filp,
 
         if (raddr == RIO_MAP_ANY_ADDR)
                 raddr = map->phys_addr;
-        ret = rio_map_inb_region(mport, map->phys_addr, raddr, size, 0);
+        ret = rio_map_inb_region(mport, map->phys_addr, raddr, (u32)size, 0);
         if (ret < 0)
                 goto err_map_inb;
 
@@ -1288,7 +1298,7 @@ err_dma_alloc:
 
 static int
 rio_mport_get_inbound_mapping(struct mport_dev *md, struct file *filp,
-                              u64 raddr, u32 size,
+                              u64 raddr, u64 size,
                               struct rio_mport_mapping **mapping)
 {
         struct rio_mport_mapping *map;
@@ -1331,7 +1341,7 @@ static int rio_mport_map_inbound(struct file *filp, void __user *arg)
 
         if (!md->mport->ops->map_inb)
                 return -EPROTONOSUPPORT;
-        if (unlikely(copy_from_user(&map, arg, sizeof(struct rio_mmap))))
+        if (unlikely(copy_from_user(&map, arg, sizeof(map))))
                 return -EFAULT;
 
         rmcd_debug(IBW, "%s filp=%p", dev_name(&priv->md->dev), filp);
@@ -1344,7 +1354,7 @@ static int rio_mport_map_inbound(struct file *filp, void __user *arg)
         map.handle = mapping->phys_addr;
         map.rio_addr = mapping->rio_addr;
 
-        if (unlikely(copy_to_user(arg, &map, sizeof(struct rio_mmap)))) {
+        if (unlikely(copy_to_user(arg, &map, sizeof(map)))) {
                 /* Delete mapping if it was created by this request */
                 if (ret == 0 && mapping->filp == filp) {
                         mutex_lock(&md->buf_mutex);
@@ -1375,7 +1385,7 @@ static int rio_mport_inbound_free(struct file *filp, void __user *arg)
         if (!md->mport->ops->unmap_inb)
                 return -EPROTONOSUPPORT;
 
-        if (copy_from_user(&handle, arg, sizeof(u64)))
+        if (copy_from_user(&handle, arg, sizeof(handle)))
                 return -EFAULT;
 
         mutex_lock(&md->buf_mutex);
@@ -1401,7 +1411,7 @@ static int rio_mport_inbound_free(struct file *filp, void __user *arg)
 static int maint_port_idx_get(struct mport_cdev_priv *priv, void __user *arg)
 {
         struct mport_dev *md = priv->md;
-        uint32_t port_idx = md->mport->index;
+        u32 port_idx = md->mport->index;
 
         rmcd_debug(MPORT, "port_index=%d", port_idx);
 
@@ -1451,7 +1461,7 @@ static void rio_mport_doorbell_handler(struct rio_mport *mport, void *dev_id,
         handled = 0;
         spin_lock(&data->db_lock);
         list_for_each_entry(db_filter, &data->doorbells, data_node) {
-                if (((db_filter->filter.rioid == 0xffffffff ||
+                if (((db_filter->filter.rioid == RIO_INVALID_DESTID ||
                       db_filter->filter.rioid == src)) &&
                       info >= db_filter->filter.low &&
                       info <= db_filter->filter.high) {
@@ -1525,6 +1535,9 @@ static int rio_mport_remove_db_filter(struct mport_cdev_priv *priv,
         if (copy_from_user(&filter, arg, sizeof(filter)))
                 return -EFAULT;
 
+        if (filter.low > filter.high)
+                return -EINVAL;
+
         spin_lock_irqsave(&priv->md->db_lock, flags);
         list_for_each_entry(db_filter, &priv->db_filters, priv_node) {
                 if (db_filter->filter.rioid == filter.rioid &&
@@ -1737,10 +1750,10 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv,
                 return -EEXIST;
         }
 
-        size = sizeof(struct rio_dev);
+        size = sizeof(*rdev);
         mport = md->mport;
-        destid = (u16)dev_info.destid;
-        hopcount = (u8)dev_info.hopcount;
+        destid = dev_info.destid;
+        hopcount = dev_info.hopcount;
 
         if (rio_mport_read_config_32(mport, destid, hopcount,
                                      RIO_PEF_CAR, &rval))
@@ -1872,8 +1885,8 @@ static int rio_mport_del_riodev(struct mport_cdev_priv *priv, void __user *arg)
                 do {
                         rdev = rio_get_comptag(dev_info.comptag, rdev);
                         if (rdev && rdev->dev.parent == &mport->net->dev &&
-                            rdev->destid == (u16)dev_info.destid &&
-                            rdev->hopcount == (u8)dev_info.hopcount)
+                            rdev->destid == dev_info.destid &&
+                            rdev->hopcount == dev_info.hopcount)
                                 break;
                 } while (rdev);
         }
@@ -2146,8 +2159,8 @@ static long mport_cdev_ioctl(struct file *filp,
                 return maint_port_idx_get(data, (void __user *)arg);
         case RIO_MPORT_GET_PROPERTIES:
                 md->properties.hdid = md->mport->host_deviceid;
-                if (copy_to_user((void __user *)arg, &(data->md->properties),
-                                 sizeof(data->md->properties)))
+                if (copy_to_user((void __user *)arg, &(md->properties),
+                                 sizeof(md->properties)))
                         return -EFAULT;
                 return 0;
         case RIO_ENABLE_DOORBELL_RANGE:
@@ -2159,11 +2172,11 @@ static long mport_cdev_ioctl(struct file *filp,
         case RIO_DISABLE_PORTWRITE_RANGE:
                 return rio_mport_remove_pw_filter(data, (void __user *)arg);
         case RIO_SET_EVENT_MASK:
-                data->event_mask = arg;
+                data->event_mask = (u32)arg;
                 return 0;
         case RIO_GET_EVENT_MASK:
                 if (copy_to_user((void __user *)arg, &data->event_mask,
-                                    sizeof(data->event_mask)))
+                                    sizeof(u32)))
                         return -EFAULT;
                 return 0;
         case RIO_MAP_OUTBOUND:
@@ -2374,7 +2387,7 @@ static ssize_t mport_write(struct file *filp, const char __user *buf,
                         return -EINVAL;
 
                 ret = rio_mport_send_doorbell(mport,
-                                              (u16)event.u.doorbell.rioid,
+                                              event.u.doorbell.rioid,
                                               event.u.doorbell.payload);
                 if (ret < 0)
                         return ret;
@@ -2421,7 +2434,7 @@ static struct mport_dev *mport_cdev_add(struct rio_mport *mport)
         struct mport_dev *md;
         struct rio_mport_attr attr;
 
-        md = kzalloc(sizeof(struct mport_dev), GFP_KERNEL);
+        md = kzalloc(sizeof(*md), GFP_KERNEL);
         if (!md) {
                 rmcd_error("Unable allocate a device object");
                 return NULL;
@@ -2470,7 +2483,7 @@ static struct mport_dev *mport_cdev_add(struct rio_mport *mport)
         /* The transfer_mode property will be returned through mport query
          * interface
          */
-#ifdef CONFIG_PPC /* for now: only on Freescale's SoCs */
+#ifdef CONFIG_FSL_RIO /* for now: only on Freescale's SoCs */
         md->properties.transfer_mode |= RIO_TRANSFER_MODE_MAPPED;
 #else
         md->properties.transfer_mode |= RIO_TRANSFER_MODE_TRANSFER;
diff --git a/include/linux/rio_mport_cdev.h b/include/uapi/linux/rio_mport_cdev.h
index b65d19df76d2..5796bf1d06ad 100644
--- a/include/linux/rio_mport_cdev.h
+++ b/include/uapi/linux/rio_mport_cdev.h
@@ -39,16 +39,16 @@
 #ifndef _RIO_MPORT_CDEV_H_
 #define _RIO_MPORT_CDEV_H_
 
-#ifndef __user
-#define __user
-#endif
+#include <linux/ioctl.h>
+#include <linux/types.h>
 
 struct rio_mport_maint_io {
-        uint32_t rioid;         /* destID of remote device */
-        uint32_t hopcount;      /* hopcount to remote device */
-        uint32_t offset;        /* offset in register space */
-        size_t length;          /* length in bytes */
-        void __user *buffer;    /* data buffer */
+        __u16 rioid;            /* destID of remote device */
+        __u8  hopcount;         /* hopcount to remote device */
+        __u8  pad0[5];
+        __u32 offset;           /* offset in register space */
+        __u32 length;           /* length in bytes */
+        __u64 buffer;           /* pointer to data buffer */
 };
 
 /*
@@ -66,22 +66,23 @@ struct rio_mport_maint_io {
 #define RIO_CAP_MAP_INB                 (1 << 7)
 
 struct rio_mport_properties {
-        uint16_t hdid;
-        uint8_t id;                     /* Physical port ID */
-        uint8_t  index;
-        uint32_t flags;
-        uint32_t sys_size;              /* Default addressing size */
-        uint8_t  port_ok;
-        uint8_t  link_speed;
-        uint8_t  link_width;
-        uint32_t dma_max_sge;
-        uint32_t dma_max_size;
-        uint32_t dma_align;
-        uint32_t transfer_mode;         /* Default transfer mode */
-        uint32_t cap_sys_size;          /* Capable system sizes */
-        uint32_t cap_addr_size;         /* Capable addressing sizes */
-        uint32_t cap_transfer_mode;     /* Capable transfer modes */
-        uint32_t cap_mport;             /* Mport capabilities */
+        __u16 hdid;
+        __u8  id;                       /* Physical port ID */
+        __u8  index;
+        __u32 flags;
+        __u32 sys_size;         /* Default addressing size */
+        __u8  port_ok;
+        __u8  link_speed;
+        __u8  link_width;
+        __u8  pad0;
+        __u32 dma_max_sge;
+        __u32 dma_max_size;
+        __u32 dma_align;
+        __u32 transfer_mode;            /* Default transfer mode */
+        __u32 cap_sys_size;             /* Capable system sizes */
+        __u32 cap_addr_size;            /* Capable addressing sizes */
+        __u32 cap_transfer_mode;        /* Capable transfer modes */
+        __u32 cap_mport;                /* Mport capabilities */
 };
 
 /*
@@ -93,54 +94,57 @@ struct rio_mport_properties {
 #define RIO_PORTWRITE   (1 << 1)
 
 struct rio_doorbell {
-        uint32_t rioid;
-        uint16_t payload;
+        __u16 rioid;
+        __u16 payload;
 };
 
 struct rio_doorbell_filter {
-        uint32_t rioid;                 /* 0xffffffff to match all ids */
-        uint16_t low;
-        uint16_t high;
+        __u16 rioid;    /* Use RIO_INVALID_DESTID to match all ids */
+        __u16 low;
+        __u16 high;
+        __u16 pad0;
 };
 
 
 struct rio_portwrite {
-        uint32_t payload[16];
+        __u32 payload[16];
 };
 
 struct rio_pw_filter {
-        uint32_t mask;
-        uint32_t low;
-        uint32_t high;
+        __u32 mask;
+        __u32 low;
+        __u32 high;
+        __u32 pad0;
 };
 
 /* RapidIO base address for inbound requests set to value defined below
  * indicates that no specific RIO-to-local address translation is requested
  * and driver should use direct (one-to-one) address mapping.
 */
-#define RIO_MAP_ANY_ADDR        (uint64_t)(~((uint64_t) 0))
+#define RIO_MAP_ANY_ADDR        (__u64)(~((__u64) 0))
 
 struct rio_mmap {
-        uint32_t rioid;
-        uint64_t rio_addr;
-        uint64_t length;
-        uint64_t handle;
-        void *address;
+        __u16 rioid;
+        __u16 pad0[3];
+        __u64 rio_addr;
+        __u64 length;
+        __u64 handle;
+        __u64 address;
 };
 
 struct rio_dma_mem {
-        uint64_t length;                /* length of DMA memory */
-        uint64_t dma_handle;            /* handle associated with this memory */
-        void *buffer;                   /* pointer to this memory */
+        __u64 length;           /* length of DMA memory */
+        __u64 dma_handle;       /* handle associated with this memory */
+        __u64 address;
 };
 
-
 struct rio_event {
-        unsigned int header;    /* event type RIO_DOORBELL or RIO_PORTWRITE */
+        __u32 header;   /* event type RIO_DOORBELL or RIO_PORTWRITE */
         union {
                 struct rio_doorbell doorbell;   /* header for RIO_DOORBELL */
                 struct rio_portwrite portwrite; /* header for RIO_PORTWRITE */
         } u;
+        __u32 pad0;
 };
 
 enum rio_transfer_sync {
@@ -184,35 +188,37 @@ enum rio_exchange {
 };
 
 struct rio_transfer_io {
-        uint32_t rioid;                 /* Target destID */
-        uint64_t rio_addr;              /* Address in target's RIO mem space */
-        enum rio_exchange method;       /* Data exchange method */
-        void __user *loc_addr;
-        uint64_t handle;
-        uint64_t offset;                /* Offset in buffer */
-        uint64_t length;                /* Length in bytes */
-        uint32_t completion_code;       /* Completion code for this transfer */
+        __u64 rio_addr; /* Address in target's RIO mem space */
+        __u64 loc_addr;
+        __u64 handle;
+        __u64 offset;   /* Offset in buffer */
+        __u64 length;   /* Length in bytes */
+        __u16 rioid;    /* Target destID */
+        __u16 method;   /* Data exchange method, one of rio_exchange enum */
+        __u32 completion_code;  /* Completion code for this transfer */
 };
 
 struct rio_transaction {
-        uint32_t transfer_mode;         /* Data transfer mode */
-        enum rio_transfer_sync sync;    /* Synchronization method */
-        enum rio_transfer_dir dir;      /* Transfer direction */
-        size_t count;                   /* Number of transfers */
-        struct rio_transfer_io __user *block;   /* Array of <count> transfers */
+        __u64 block;    /* Pointer to array of <count> transfers */
+        __u32 count;    /* Number of transfers */
+        __u32 transfer_mode;    /* Data transfer mode */
+        __u16 sync;     /* Synch method, one of rio_transfer_sync enum */
+        __u16 dir;      /* Transfer direction, one of rio_transfer_dir enum */
+        __u32 pad0;
 };
 
 struct rio_async_tx_wait {
-        uint32_t token;         /* DMA transaction ID token */
-        uint32_t timeout;       /* Wait timeout in msec, if 0 use default TO */
+        __u32 token;    /* DMA transaction ID token */
+        __u32 timeout;  /* Wait timeout in msec, if 0 use default TO */
 };
 
 #define RIO_MAX_DEVNAME_SZ      20
 
 struct rio_rdev_info {
-        uint32_t destid;
-        uint8_t hopcount;
-        uint32_t comptag;
+        __u16 destid;
+        __u8 hopcount;
+        __u8 pad0;
+        __u32 comptag;
         char name[RIO_MAX_DEVNAME_SZ + 1];
 };
 
@@ -220,11 +226,11 @@ struct rio_rdev_info {
 #define RIO_MPORT_DRV_MAGIC           'm'
 
 #define RIO_MPORT_MAINT_HDID_SET        \
-        _IOW(RIO_MPORT_DRV_MAGIC, 1, uint16_t)
+        _IOW(RIO_MPORT_DRV_MAGIC, 1, __u16)
 #define RIO_MPORT_MAINT_COMPTAG_SET     \
-        _IOW(RIO_MPORT_DRV_MAGIC, 2, uint32_t)
+        _IOW(RIO_MPORT_DRV_MAGIC, 2, __u32)
 #define RIO_MPORT_MAINT_PORT_IDX_GET    \
-        _IOR(RIO_MPORT_DRV_MAGIC, 3, uint32_t)
+        _IOR(RIO_MPORT_DRV_MAGIC, 3, __u32)
 #define RIO_MPORT_GET_PROPERTIES \
         _IOR(RIO_MPORT_DRV_MAGIC, 4, struct rio_mport_properties)
 #define RIO_MPORT_MAINT_READ_LOCAL \
@@ -244,9 +250,9 @@ struct rio_rdev_info {
 #define RIO_DISABLE_PORTWRITE_RANGE     \
         _IOW(RIO_MPORT_DRV_MAGIC, 12, struct rio_pw_filter)
 #define RIO_SET_EVENT_MASK              \
-        _IOW(RIO_MPORT_DRV_MAGIC, 13, unsigned int)
+        _IOW(RIO_MPORT_DRV_MAGIC, 13, __u32)
 #define RIO_GET_EVENT_MASK              \
-        _IOR(RIO_MPORT_DRV_MAGIC, 14, unsigned int)
+        _IOR(RIO_MPORT_DRV_MAGIC, 14, __u32)
 #define RIO_MAP_OUTBOUND \
         _IOWR(RIO_MPORT_DRV_MAGIC, 15, struct rio_mmap)
 #define RIO_UNMAP_OUTBOUND \
@@ -254,11 +260,11 @@ struct rio_rdev_info {
 #define RIO_MAP_INBOUND \
         _IOWR(RIO_MPORT_DRV_MAGIC, 17, struct rio_mmap)
 #define RIO_UNMAP_INBOUND \
-        _IOW(RIO_MPORT_DRV_MAGIC, 18, uint64_t)
+        _IOW(RIO_MPORT_DRV_MAGIC, 18, __u64)
 #define RIO_ALLOC_DMA \
         _IOWR(RIO_MPORT_DRV_MAGIC, 19, struct rio_dma_mem)
 #define RIO_FREE_DMA \
-        _IOW(RIO_MPORT_DRV_MAGIC, 20, uint64_t)
+        _IOW(RIO_MPORT_DRV_MAGIC, 20, __u64)
 #define RIO_TRANSFER \
         _IOWR(RIO_MPORT_DRV_MAGIC, 21, struct rio_transaction)
 #define RIO_WAIT_FOR_ASYNC \