Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

16 files changed, 248 insertions, 352 deletions

diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 5819dc02a143..1c500c462225 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -23,6 +23,7 @@
 #include <asm/debug.h>
 #include <asm/idals.h>
 #include <asm/ebcdic.h>
+#include <asm/compat.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
 #include <asm/cio.h>
@@ -2844,13 +2845,16 @@ static int dasd_symm_io(struct dasd_device *device, void __user *argp)
         rc = -EFAULT;
         if (copy_from_user(&usrparm, argp, sizeof(usrparm)))
                 goto out;
-#ifndef CONFIG_64BIT
-        /* Make sure pointers are sane even on 31 bit. */
-        if ((usrparm.psf_data >> 32) != 0 || (usrparm.rssd_result >> 32) != 0) {
+        if (is_compat_task() || sizeof(long) == 4) {
+                /* Make sure pointers are sane even on 31 bit. */
                 rc = -EINVAL;
-                goto out;
+                if ((usrparm.psf_data >> 32) != 0)
+                        goto out;
+                if ((usrparm.rssd_result >> 32) != 0)
+                        goto out;
+                usrparm.psf_data &= 0x7fffffffULL;
+                usrparm.rssd_result &= 0x7fffffffULL;
         }
-#endif
         /* alloc I/O data area */
         psf_data = kzalloc(usrparm.psf_data_len, GFP_KERNEL | GFP_DMA);
         rssd_result = kzalloc(usrparm.rssd_result_len, GFP_KERNEL | GFP_DMA);
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index 478bcdb90b6f..fc7b30b4a255 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -17,7 +17,7 @@
 #include <linux/fs.h>
 #include <linux/blkpg.h>
 #include <linux/smp_lock.h>
-
+#include <asm/compat.h>
 #include <asm/ccwdev.h>
 #include <asm/cmb.h>
 #include <asm/uaccess.h>
@@ -358,9 +358,8 @@ dasd_ioctl_set_ro(struct block_device *bdev, void __user *argp)
 }
 
 static int dasd_ioctl_readall_cmb(struct dasd_block *block, unsigned int cmd,
-                unsigned long arg)
+                                  struct cmbdata __user *argp)
 {
-        struct cmbdata __user *argp = (void __user *) arg;
         size_t size = _IOC_SIZE(cmd);
         struct cmbdata data;
         int ret;
@@ -376,7 +375,12 @@ dasd_do_ioctl(struct block_device *bdev, fmode_t mode,
               unsigned int cmd, unsigned long arg)
 {
         struct dasd_block *block = bdev->bd_disk->private_data;
-        void __user *argp = (void __user *)arg;
+        void __user *argp;
+
+        if (is_compat_task())
+                argp = compat_ptr(arg);
+        else
+                argp = (void __user *)arg;
 
         if (!block)
                 return -ENODEV;
@@ -414,7 +418,7 @@ dasd_do_ioctl(struct block_device *bdev, fmode_t mode,
         case BIODASDCMFDISABLE:
                 return disable_cmf(block->base->cdev);
         case BIODASDREADALLCMB:
-                return dasd_ioctl_readall_cmb(block, cmd, arg);
+                return dasd_ioctl_readall_cmb(block, cmd, argp);
         default:
                 /* if the discipline has an ioctl method try it. */
                 if (block->base->discipline->ioctl) {
diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
index 9d61683b5633..59ec073724bf 100644
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -1037,22 +1037,6 @@ static void tty3215_flush_buffer(struct tty_struct *tty)
 }
 
 /*
- * Currently we don't have any io controls for 3215 ttys
- */
-static int tty3215_ioctl(struct tty_struct *tty, struct file * file,
-                         unsigned int cmd, unsigned long arg)
-{
-        if (tty->flags & (1 << TTY_IO_ERROR))
-                return -EIO;
-
-        switch (cmd) {
-        default:
-                return -ENOIOCTLCMD;
-        }
-        return 0;
-}
-
-/*
  * Disable reading from a 3215 tty
  */
 static void tty3215_throttle(struct tty_struct * tty)
@@ -1117,7 +1101,6 @@ static const struct tty_operations tty3215_ops = {
         .write_room = tty3215_write_room,
         .chars_in_buffer = tty3215_chars_in_buffer,
         .flush_buffer = tty3215_flush_buffer,
-        .ioctl = tty3215_ioctl,
         .throttle = tty3215_throttle,
         .unthrottle = tty3215_unthrottle,
         .stop = tty3215_stop,
diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
index 247b2b934728..31c59b0d6df0 100644
--- a/drivers/s390/char/fs3270.c
+++ b/drivers/s390/char/fs3270.c
@@ -15,6 +15,7 @@
 #include <linux/types.h>
 #include <linux/smp_lock.h>
 
+#include <asm/compat.h>
 #include <asm/ccwdev.h>
 #include <asm/cio.h>
 #include <asm/ebcdic.h>
@@ -322,6 +323,7 @@ fs3270_write(struct file *filp, const char __user *data, size_t count, loff_t *o
 static long
 fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
+        char __user *argp;
         struct fs3270 *fp;
         struct raw3270_iocb iocb;
         int rc;
@@ -329,6 +331,10 @@ fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
         fp = filp->private_data;
         if (!fp)
                 return -ENODEV;
+        if (is_compat_task())
+                argp = compat_ptr(arg);
+        else
+                argp = (char __user *)arg;
         rc = 0;
         mutex_lock(&fs3270_mutex);
         switch (cmd) {
@@ -339,10 +345,10 @@ fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 fp->write_command = arg;
                 break;
         case TUBGETI:
-                rc = put_user(fp->read_command, (char __user *) arg);
+                rc = put_user(fp->read_command, argp);
                 break;
         case TUBGETO:
-                rc = put_user(fp->write_command,(char __user *) arg);
+                rc = put_user(fp->write_command, argp);
                 break;
         case TUBGETMOD:
                 iocb.model = fp->view.model;
@@ -351,8 +357,7 @@ fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 iocb.pf_cnt = 24;
                 iocb.re_cnt = 20;
                 iocb.map = 0;
-                if (copy_to_user((char __user *) arg, &iocb,
-                                 sizeof(struct raw3270_iocb)))
+                if (copy_to_user(argp, &iocb, sizeof(struct raw3270_iocb)))
                         rc = -EFAULT;
                 break;
         }
@@ -511,8 +516,8 @@ static const struct file_operations fs3270_fops = {
         .write           = fs3270_write,        /* write */
         .unlocked_ioctl  = fs3270_ioctl,        /* ioctl */
         .compat_ioctl    = fs3270_ioctl,        /* ioctl */
-        .open           = fs3270_open,          /* open */
-        .release        = fs3270_close,         /* release */
+        .open            = fs3270_open,         /* open */
+        .release         = fs3270_close,        /* release */
 };
 
 /*
diff --git a/drivers/s390/char/tape_block.c b/drivers/s390/char/tape_block.c
index 96816149368a..8d3d720737da 100644
--- a/drivers/s390/char/tape_block.c
+++ b/drivers/s390/char/tape_block.c
@@ -46,8 +46,6 @@
  */
 static int tapeblock_open(struct block_device *, fmode_t);
 static int tapeblock_release(struct gendisk *, fmode_t);
-static int tapeblock_ioctl(struct block_device *, fmode_t, unsigned int,
-                                unsigned long);
 static int tapeblock_medium_changed(struct gendisk *);
 static int tapeblock_revalidate_disk(struct gendisk *);
 
@@ -55,7 +53,6 @@ static const struct block_device_operations tapeblock_fops = {
         .owner           = THIS_MODULE,
         .open            = tapeblock_open,
         .release         = tapeblock_release,
-        .ioctl           = tapeblock_ioctl,
         .media_changed   = tapeblock_medium_changed,
         .revalidate_disk = tapeblock_revalidate_disk,
 };
@@ -416,42 +413,6 @@ tapeblock_release(struct gendisk *disk, fmode_t mode)
 }
 
 /*
- * Support of some generic block device IOCTLs.
- */
-static int
-tapeblock_ioctl(
-        struct block_device *   bdev,
-        fmode_t                 mode,
-        unsigned int            command,
-        unsigned long           arg
-) {
-        int rc;
-        int minor;
-        struct gendisk *disk = bdev->bd_disk;
-        struct tape_device *device;
-
-        rc     = 0;
-        BUG_ON(!disk);
-        device = disk->private_data;
-        BUG_ON(!device);
-        minor  = MINOR(bdev->bd_dev);
-
-        DBF_LH(6, "tapeblock_ioctl(0x%0x)\n", command);
-        DBF_LH(6, "device = %d:%d\n", tapeblock_major, minor);
-
-        switch (command) {
-                /* Refuse some IOCTL calls without complaining (mount). */
-                case 0x5310:            /* CDROMMULTISESSION */
-                        rc = -EINVAL;
-                        break;
-                default:
-                        rc = -EINVAL;
-        }
-
-        return rc;
-}
-
-/*
  * Initialize block device frontend.
  */
 int
diff --git a/drivers/s390/char/tape_char.c b/drivers/s390/char/tape_char.c
index 2125ec7d95f0..539045acaad4 100644
--- a/drivers/s390/char/tape_char.c
+++ b/drivers/s390/char/tape_char.c
@@ -18,6 +18,7 @@
 #include <linux/proc_fs.h>
 #include <linux/mtio.h>
 #include <linux/smp_lock.h>
+#include <linux/compat.h>
 
 #include <asm/uaccess.h>
 
@@ -37,8 +38,9 @@ static ssize_t tapechar_write(struct file *, const char __user *, size_t, loff_t
 static int tapechar_open(struct inode *,struct file *);
 static int tapechar_release(struct inode *,struct file *);
 static long tapechar_ioctl(struct file *, unsigned int, unsigned long);
-static long tapechar_compat_ioctl(struct file *, unsigned int,
-                          unsigned long);
+#ifdef CONFIG_COMPAT
+static long tapechar_compat_ioctl(struct file *, unsigned int, unsigned long);
+#endif
 
 static const struct file_operations tape_fops =
 {
@@ -46,7 +48,9 @@ static const struct file_operations tape_fops =
         .read = tapechar_read,
         .write = tapechar_write,
         .unlocked_ioctl = tapechar_ioctl,
+#ifdef CONFIG_COMPAT
         .compat_ioctl = tapechar_compat_ioctl,
+#endif
         .open = tapechar_open,
         .release = tapechar_release,
 };
@@ -457,15 +461,22 @@ tapechar_ioctl(struct file *filp, unsigned int no, unsigned long data)
         return rc;
 }
 
+#ifdef CONFIG_COMPAT
 static long
 tapechar_compat_ioctl(struct file *filp, unsigned int no, unsigned long data)
 {
         struct tape_device *device = filp->private_data;
         int rval = -ENOIOCTLCMD;
+        unsigned long argp;
 
+        /* The 'arg' argument of any ioctl function may only be used for
+         * pointers because of the compat pointer conversion.
+         * Consider this when adding new ioctls.
+         */
+        argp = (unsigned long) compat_ptr(data);
         if (device->discipline->ioctl_fn) {
                 mutex_lock(&device->mutex);
-                rval = device->discipline->ioctl_fn(device, no, data);
+                rval = device->discipline->ioctl_fn(device, no, argp);
                 mutex_unlock(&device->mutex);
                 if (rval == -EINVAL)
                         rval = -ENOIOCTLCMD;
@@ -473,6 +484,7 @@ tapechar_compat_ioctl(struct file *filp, unsigned int no, unsigned long data)
 
         return rval;
 }
+#endif /* CONFIG_COMPAT */
 
 /*
  * Initialize character device frontend.
diff --git a/drivers/s390/char/vmcp.c b/drivers/s390/char/vmcp.c
index a6087cec55b4..921dcda77676 100644
--- a/drivers/s390/char/vmcp.c
+++ b/drivers/s390/char/vmcp.c
@@ -19,6 +19,7 @@
 #include <linux/kernel.h>
 #include <linux/miscdevice.h>
 #include <linux/module.h>
+#include <asm/compat.h>
 #include <asm/cpcmd.h>
 #include <asm/debug.h>
 #include <asm/uaccess.h>
@@ -139,21 +140,26 @@ vmcp_write(struct file *file, const char __user *buff, size_t count,
 static long vmcp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
         struct vmcp_session *session;
+        int __user *argp;
         int temp;
 
         session = (struct vmcp_session *)file->private_data;
+        if (is_compat_task())
+                argp = compat_ptr(arg);
+        else
+                argp = (int __user *)arg;
         if (mutex_lock_interruptible(&session->mutex))
                 return -ERESTARTSYS;
         switch (cmd) {
         case VMCP_GETCODE:
                 temp = session->resp_code;
                 mutex_unlock(&session->mutex);
-                return put_user(temp, (int __user *)arg);
+                return put_user(temp, argp);
         case VMCP_SETBUF:
                 free_pages((unsigned long)session->response,
                                 get_order(session->bufsize));
                 session->response=NULL;
-                temp = get_user(session->bufsize, (int __user *)arg);
+                temp = get_user(session->bufsize, argp);
                 if (get_order(session->bufsize) > 8) {
                         session->bufsize = PAGE_SIZE;
                         temp = -EINVAL;
@@ -163,7 +169,7 @@ static long vmcp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         case VMCP_GETSIZE:
                 temp = session->resp_size;
                 mutex_unlock(&session->mutex);
-                return put_user(temp, (int __user *)arg);
+                return put_user(temp, argp);
         default:
                 mutex_unlock(&session->mutex);
                 return -ENOIOCTLCMD;
diff --git a/drivers/s390/cio/Makefile b/drivers/s390/cio/Makefile
index d033414f7599..e1b700a19648 100644
--- a/drivers/s390/cio/Makefile
+++ b/drivers/s390/cio/Makefile
@@ -10,5 +10,5 @@ obj-y += ccw_device.o cmf.o
 obj-$(CONFIG_CHSC_SCH) += chsc_sch.o
 obj-$(CONFIG_CCWGROUP) += ccwgroup.o
 
-qdio-objs := qdio_main.o qdio_thinint.o qdio_debug.o qdio_perf.o qdio_setup.o
+qdio-objs := qdio_main.o qdio_thinint.o qdio_debug.o qdio_setup.o
 obj-$(CONFIG_QDIO) += qdio.o
diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c
index cc5144b6f9d9..c84ac9443079 100644
--- a/drivers/s390/cio/chsc_sch.c
+++ b/drivers/s390/cio/chsc_sch.c
@@ -12,6 +12,7 @@
 #include <linux/uaccess.h>
 #include <linux/miscdevice.h>
 
+#include <asm/compat.h>
 #include <asm/cio.h>
 #include <asm/chsc.h>
 #include <asm/isc.h>
@@ -770,24 +771,30 @@ out_free:
 static long chsc_ioctl(struct file *filp, unsigned int cmd,
                        unsigned long arg)
 {
+        void __user *argp;
+
         CHSC_MSG(2, "chsc_ioctl called, cmd=%x\n", cmd);
+        if (is_compat_task())
+                argp = compat_ptr(arg);
+        else
+                argp = (void __user *)arg;
         switch (cmd) {
         case CHSC_START:
-                return chsc_ioctl_start((void __user *)arg);
+                return chsc_ioctl_start(argp);
         case CHSC_INFO_CHANNEL_PATH:
-                return chsc_ioctl_info_channel_path((void __user *)arg);
+                return chsc_ioctl_info_channel_path(argp);
         case CHSC_INFO_CU:
-                return chsc_ioctl_info_cu((void __user *)arg);
+                return chsc_ioctl_info_cu(argp);
         case CHSC_INFO_SCH_CU:
-                return chsc_ioctl_info_sch_cu((void __user *)arg);
+                return chsc_ioctl_info_sch_cu(argp);
         case CHSC_INFO_CI:
-                return chsc_ioctl_conf_info((void __user *)arg);
+                return chsc_ioctl_conf_info(argp);
         case CHSC_INFO_CCL:
-                return chsc_ioctl_conf_comp_list((void __user *)arg);
+                return chsc_ioctl_conf_comp_list(argp);
         case CHSC_INFO_CPD:
-                return chsc_ioctl_chpd((void __user *)arg);
+                return chsc_ioctl_chpd(argp);
         case CHSC_INFO_DCAL:
-                return chsc_ioctl_dcal((void __user *)arg);
+                return chsc_ioctl_dcal(argp);
         default: /* unknown ioctl number */
                 return -ENOIOCTLCMD;
         }
diff --git a/drivers/s390/cio/qdio.h b/drivers/s390/cio/qdio.h
index ff7748a9199d..44f2f6a97f33 100644
--- a/drivers/s390/cio/qdio.h
+++ b/drivers/s390/cio/qdio.h
@@ -182,6 +182,34 @@ struct scssc_area {
         u32:32;
 } __attribute__ ((packed));
 
+struct qdio_dev_perf_stat {
+        unsigned int adapter_int;
+        unsigned int qdio_int;
+        unsigned int pci_request_int;
+
+        unsigned int tasklet_inbound;
+        unsigned int tasklet_inbound_resched;
+        unsigned int tasklet_inbound_resched2;
+        unsigned int tasklet_outbound;
+
+        unsigned int siga_read;
+        unsigned int siga_write;
+        unsigned int siga_sync;
+
+        unsigned int inbound_call;
+        unsigned int inbound_handler;
+        unsigned int stop_polling;
+        unsigned int inbound_queue_full;
+        unsigned int outbound_call;
+        unsigned int outbound_handler;
+        unsigned int fast_requeue;
+        unsigned int target_full;
+        unsigned int eqbs;
+        unsigned int eqbs_partial;
+        unsigned int sqbs;
+        unsigned int sqbs_partial;
+};
+
 struct qdio_input_q {
         /* input buffer acknowledgement flag */
         int polling;
@@ -269,6 +297,7 @@ struct qdio_irq {
         u32 *dsci;              /* address of device state change indicator */
         struct ccw_device *cdev;
         struct dentry *debugfs_dev;
+        struct dentry *debugfs_perf;
 
         unsigned long int_parm;
         struct subchannel_id schid;
@@ -286,9 +315,10 @@ struct qdio_irq {
         struct ciw aqueue;
 
         struct qdio_ssqd_desc ssqd_desc;
-
         void (*orig_handler) (struct ccw_device *, unsigned long, struct irb *);
 
+        struct qdio_dev_perf_stat perf_stat;
+        int perf_stat_enabled;
         /*
          * Warning: Leave these members together at the end so they won't be
          * cleared in qdio_setup_irq.
@@ -311,6 +341,10 @@ struct qdio_irq {
         (irq->qib.qfmt == QDIO_IQDIO_QFMT || \
          css_general_characteristics.aif_osa)
 
+#define qperf(qdev,attr)        qdev->perf_stat.attr
+#define qperf_inc(q,attr)       if (q->irq_ptr->perf_stat_enabled) \
+                                        q->irq_ptr->perf_stat.attr++
+
 /* the highest iqdio queue is used for multicast */
 static inline int multicast_outbound(struct qdio_q *q)
 {
diff --git a/drivers/s390/cio/qdio_debug.c b/drivers/s390/cio/qdio_debug.c
index 76769978285f..f49761ff9a00 100644
--- a/drivers/s390/cio/qdio_debug.c
+++ b/drivers/s390/cio/qdio_debug.c
@@ -55,13 +55,11 @@ static int qstat_show(struct seq_file *m, void *v)
         if (!q)
                 return 0;
 
-        seq_printf(m, "device state indicator: %d\n", *(u32 *)q->irq_ptr->dsci);
-        seq_printf(m, "nr_used: %d\n", atomic_read(&q->nr_buf_used));
-        seq_printf(m, "ftc: %d\n", q->first_to_check);
-        seq_printf(m, "last_move: %d\n", q->last_move);
-        seq_printf(m, "polling: %d\n", q->u.in.polling);
-        seq_printf(m, "ack start: %d\n", q->u.in.ack_start);
-        seq_printf(m, "ack count: %d\n", q->u.in.ack_count);
+        seq_printf(m, "DSCI: %d   nr_used: %d\n",
+                   *(u32 *)q->irq_ptr->dsci, atomic_read(&q->nr_buf_used));
+        seq_printf(m, "ftc: %d  last_move: %d\n", q->first_to_check, q->last_move);
+        seq_printf(m, "polling: %d  ack start: %d  ack count: %d\n",
+                   q->u.in.polling, q->u.in.ack_start, q->u.in.ack_count);
         seq_printf(m, "slsb buffer states:\n");
         seq_printf(m, "|0      |8      |16     |24     |32     |40     |48     |56  63|\n");
 
@@ -110,7 +108,6 @@ static ssize_t qstat_seq_write(struct file *file, const char __user *buf,
 
         if (!q)
                 return 0;
-
         if (q->is_input_q)
                 xchg(q->irq_ptr->dsci, 1);
         local_bh_disable();
@@ -134,6 +131,98 @@ static const struct file_operations debugfs_fops = {
         .release = single_release,
 };
 
+static char *qperf_names[] = {
+        "Assumed adapter interrupts",
+        "QDIO interrupts",
+        "Requested PCIs",
+        "Inbound tasklet runs",
+        "Inbound tasklet resched",
+        "Inbound tasklet resched2",
+        "Outbound tasklet runs",
+        "SIGA read",
+        "SIGA write",
+        "SIGA sync",
+        "Inbound calls",
+        "Inbound handler",
+        "Inbound stop_polling",
+        "Inbound queue full",
+        "Outbound calls",
+        "Outbound handler",
+        "Outbound fast_requeue",
+        "Outbound target_full",
+        "QEBSM eqbs",
+        "QEBSM eqbs partial",
+        "QEBSM sqbs",
+        "QEBSM sqbs partial"
+};
+
+static int qperf_show(struct seq_file *m, void *v)
+{
+        struct qdio_irq *irq_ptr = m->private;
+        unsigned int *stat;
+        int i;
+
+        if (!irq_ptr)
+                return 0;
+        if (!irq_ptr->perf_stat_enabled) {
+                seq_printf(m, "disabled\n");
+                return 0;
+        }
+        stat = (unsigned int *)&irq_ptr->perf_stat;
+
+        for (i = 0; i < ARRAY_SIZE(qperf_names); i++)
+                seq_printf(m, "%26s:\t%u\n",
+                           qperf_names[i], *(stat + i));
+        return 0;
+}
+
+static ssize_t qperf_seq_write(struct file *file, const char __user *ubuf,
+                               size_t count, loff_t *off)
+{
+        struct seq_file *seq = file->private_data;
+        struct qdio_irq *irq_ptr = seq->private;
+        unsigned long val;
+        char buf[8];
+        int ret;
+
+        if (!irq_ptr)
+                return 0;
+        if (count >= sizeof(buf))
+                return -EINVAL;
+        if (copy_from_user(&buf, ubuf, count))
+                return -EFAULT;
+        buf[count] = 0;
+
+        ret = strict_strtoul(buf, 10, &val);
+        if (ret < 0)
+                return ret;
+
+        switch (val) {
+        case 0:
+                irq_ptr->perf_stat_enabled = 0;
+                memset(&irq_ptr->perf_stat, 0, sizeof(irq_ptr->perf_stat));
+                break;
+        case 1:
+                irq_ptr->perf_stat_enabled = 1;
+                break;
+        }
+        return count;
+}
+
+static int qperf_seq_open(struct inode *inode, struct file *filp)
+{
+        return single_open(filp, qperf_show,
+                           filp->f_path.dentry->d_inode->i_private);
+}
+
+static struct file_operations debugfs_perf_fops = {
+        .owner   = THIS_MODULE,
+        .open    = qperf_seq_open,
+        .read    = seq_read,
+        .write   = qperf_seq_write,
+        .llseek  = seq_lseek,
+        .release = single_release,
+};
 static void setup_debugfs_entry(struct qdio_q *q, struct ccw_device *cdev)
 {
         char name[QDIO_DEBUGFS_NAME_LEN];
@@ -156,6 +245,14 @@ void qdio_setup_debug_entries(struct qdio_irq *irq_ptr, struct ccw_device *cdev)
                                                   debugfs_root);
         if (IS_ERR(irq_ptr->debugfs_dev))
                 irq_ptr->debugfs_dev = NULL;
+
+        irq_ptr->debugfs_perf = debugfs_create_file("statistics",
+                                S_IFREG | S_IRUGO | S_IWUSR,
+                                irq_ptr->debugfs_dev, irq_ptr,
+                                &debugfs_perf_fops);
+        if (IS_ERR(irq_ptr->debugfs_perf))
+                irq_ptr->debugfs_perf = NULL;
+
         for_each_input_queue(irq_ptr, q, i)
                 setup_debugfs_entry(q, cdev);
         for_each_output_queue(irq_ptr, q, i)
@@ -171,6 +268,7 @@ void qdio_shutdown_debug_entries(struct qdio_irq *irq_ptr, struct ccw_device *cd
                 debugfs_remove(q->debugfs_q);
         for_each_output_queue(irq_ptr, q, i)
                 debugfs_remove(q->debugfs_q);
+        debugfs_remove(irq_ptr->debugfs_perf);
         debugfs_remove(irq_ptr->debugfs_dev);
 }
 
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index b2275c5000e7..999fe80c4051 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -22,7 +22,6 @@
 #include "device.h"
 #include "qdio.h"
 #include "qdio_debug.h"
-#include "qdio_perf.h"
 
 MODULE_AUTHOR("Utz Bacher <utz.bacher@de.ibm.com>,"\
         "Jan Glauber <jang@linux.vnet.ibm.com>");
@@ -126,7 +125,7 @@ static int qdio_do_eqbs(struct qdio_q *q, unsigned char *state,
         int rc;
 
         BUG_ON(!q->irq_ptr->sch_token);
-        qdio_perf_stat_inc(&perf_stats.debug_eqbs_all);
+        qperf_inc(q, eqbs);
 
         if (!q->is_input_q)
                 nr += q->irq_ptr->nr_input_qs;
@@ -139,7 +138,7 @@ again:
          * buffers later.
          */
         if ((ccq == 96) && (count != tmp_count)) {
-                qdio_perf_stat_inc(&perf_stats.debug_eqbs_incomplete);
+                qperf_inc(q, eqbs_partial);
                 return (count - tmp_count);
         }
 
@@ -182,7 +181,7 @@ static int qdio_do_sqbs(struct qdio_q *q, unsigned char state, int start,
                 return 0;
 
         BUG_ON(!q->irq_ptr->sch_token);
-        qdio_perf_stat_inc(&perf_stats.debug_sqbs_all);
+        qperf_inc(q, sqbs);
 
         if (!q->is_input_q)
                 nr += q->irq_ptr->nr_input_qs;
@@ -191,7 +190,7 @@ again:
         rc = qdio_check_ccq(q, ccq);
         if (rc == 1) {
                 DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "SQBS again:%2d", ccq);
-                qdio_perf_stat_inc(&perf_stats.debug_sqbs_incomplete);
+                qperf_inc(q, sqbs_partial);
                 goto again;
         }
         if (rc < 0) {
@@ -285,7 +284,7 @@ static inline int qdio_siga_sync(struct qdio_q *q, unsigned int output,
                 return 0;
 
         DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "siga-s:%1d", q->nr);
-        qdio_perf_stat_inc(&perf_stats.siga_sync);
+        qperf_inc(q, siga_sync);
 
         cc = do_siga_sync(q->irq_ptr->schid, output, input);
         if (cc)
@@ -350,7 +349,7 @@ static inline int qdio_siga_input(struct qdio_q *q)
         int cc;
 
         DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "siga-r:%1d", q->nr);
-        qdio_perf_stat_inc(&perf_stats.siga_in);
+        qperf_inc(q, siga_read);
 
         cc = do_siga_input(q->irq_ptr->schid, q->mask);
         if (cc)
@@ -382,7 +381,7 @@ static inline void qdio_stop_polling(struct qdio_q *q)
                 return;
 
         q->u.in.polling = 0;
-        qdio_perf_stat_inc(&perf_stats.debug_stop_polling);
+        qperf_inc(q, stop_polling);
 
         /* show the card that we are not polling anymore */
         if (is_qebsm(q)) {
@@ -400,7 +399,7 @@ static void announce_buffer_error(struct qdio_q *q, int count)
         /* special handling for no target buffer empty */
         if ((!q->is_input_q &&
             (q->sbal[q->first_to_check]->element[15].flags & 0xff) == 0x10)) {
-                qdio_perf_stat_inc(&perf_stats.outbound_target_full);
+                qperf_inc(q, target_full);
                 DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "OUTFULL FTC:%02x",
                               q->first_to_check);
                 return;
@@ -487,7 +486,7 @@ static int get_inbound_buffer_frontier(struct qdio_q *q)
                 inbound_primed(q, count);
                 q->first_to_check = add_buf(q->first_to_check, count);
                 if (atomic_sub(count, &q->nr_buf_used) == 0)
-                        qdio_perf_stat_inc(&perf_stats.inbound_queue_full);
+                        qperf_inc(q, inbound_queue_full);
                 break;
         case SLSB_P_INPUT_ERROR:
                 announce_buffer_error(q, count);
@@ -567,9 +566,10 @@ static void qdio_kick_handler(struct qdio_q *q)
         count = sub_buf(end, start);
 
         if (q->is_input_q) {
-                qdio_perf_stat_inc(&perf_stats.inbound_handler);
+                qperf_inc(q, inbound_handler);
                 DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "kih s:%02x c:%02x", start, count);
         } else
+                qperf_inc(q, outbound_handler);
                 DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "koh: s:%02x c:%02x",
                               start, count);
 
@@ -583,24 +583,28 @@ static void qdio_kick_handler(struct qdio_q *q)
 
 static void __qdio_inbound_processing(struct qdio_q *q)
 {
-        qdio_perf_stat_inc(&perf_stats.tasklet_inbound);
+        qperf_inc(q, tasklet_inbound);
 again:
         if (!qdio_inbound_q_moved(q))
                 return;
 
         qdio_kick_handler(q);
 
-        if (!qdio_inbound_q_done(q))
+        if (!qdio_inbound_q_done(q)) {
                 /* means poll time is not yet over */
+                qperf_inc(q, tasklet_inbound_resched);
                 goto again;
+        }
 
         qdio_stop_polling(q);
         /*
          * We need to check again to not lose initiative after
          * resetting the ACK state.
          */
-        if (!qdio_inbound_q_done(q))
+        if (!qdio_inbound_q_done(q)) {
+                qperf_inc(q, tasklet_inbound_resched2);
                 goto again;
+        }
 }
 
 void qdio_inbound_processing(unsigned long data)
@@ -688,7 +692,7 @@ static int qdio_kick_outbound_q(struct qdio_q *q)
                 return 0;
 
         DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "siga-w:%1d", q->nr);
-        qdio_perf_stat_inc(&perf_stats.siga_out);
+        qperf_inc(q, siga_write);
 
         cc = qdio_siga_output(q, &busy_bit);
         switch (cc) {
@@ -711,7 +715,7 @@ static int qdio_kick_outbound_q(struct qdio_q *q)
 
 static void __qdio_outbound_processing(struct qdio_q *q)
 {
-        qdio_perf_stat_inc(&perf_stats.tasklet_outbound);
+        qperf_inc(q, tasklet_outbound);
         BUG_ON(atomic_read(&q->nr_buf_used) < 0);
 
         if (qdio_outbound_q_moved(q))
@@ -739,12 +743,9 @@ static void __qdio_outbound_processing(struct qdio_q *q)
          */
         if (qdio_outbound_q_done(q))
                 del_timer(&q->u.out.timer);
-        else {
-                if (!timer_pending(&q->u.out.timer)) {
+        else
+                if (!timer_pending(&q->u.out.timer))
                         mod_timer(&q->u.out.timer, jiffies + 10 * HZ);
-                        qdio_perf_stat_inc(&perf_stats.debug_tl_out_timer);
-                }
-        }
         return;
 
 sched:
@@ -784,7 +785,7 @@ static inline void qdio_check_outbound_after_thinint(struct qdio_q *q)
 
 static void __tiqdio_inbound_processing(struct qdio_q *q)
 {
-        qdio_perf_stat_inc(&perf_stats.thinint_inbound);
+        qperf_inc(q, tasklet_inbound);
         qdio_sync_after_thinint(q);
 
         /*
@@ -799,7 +800,7 @@ static void __tiqdio_inbound_processing(struct qdio_q *q)
         qdio_kick_handler(q);
 
         if (!qdio_inbound_q_done(q)) {
-                qdio_perf_stat_inc(&perf_stats.thinint_inbound_loop);
+                qperf_inc(q, tasklet_inbound_resched);
                 if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED)) {
                         tasklet_schedule(&q->tasklet);
                         return;
@@ -812,7 +813,7 @@ static void __tiqdio_inbound_processing(struct qdio_q *q)
          * resetting the ACK state.
          */
         if (!qdio_inbound_q_done(q)) {
-                qdio_perf_stat_inc(&perf_stats.thinint_inbound_loop2);
+                qperf_inc(q, tasklet_inbound_resched2);
                 if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED))
                         tasklet_schedule(&q->tasklet);
         }
@@ -851,8 +852,6 @@ static void qdio_int_handler_pci(struct qdio_irq *irq_ptr)
         if (unlikely(irq_ptr->state == QDIO_IRQ_STATE_STOPPED))
                 return;
 
-        qdio_perf_stat_inc(&perf_stats.pci_int);
-
         for_each_input_queue(irq_ptr, q, i)
                 tasklet_schedule(&q->tasklet);
 
@@ -923,8 +922,6 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
         struct qdio_irq *irq_ptr = cdev->private->qdio_data;
         int cstat, dstat;
 
-        qdio_perf_stat_inc(&perf_stats.qdio_int);
-
         if (!intparm || !irq_ptr) {
                 DBF_ERROR("qint:%4x", cdev->private->schid.sch_no);
                 return;
@@ -1383,6 +1380,8 @@ static int handle_inbound(struct qdio_q *q, unsigned int callflags,
 {
         int used, diff;
 
+        qperf_inc(q, inbound_call);
+
         if (!q->u.in.polling)
                 goto set;
 
@@ -1438,14 +1437,16 @@ static int handle_outbound(struct qdio_q *q, unsigned int callflags,
         unsigned char state;
         int used, rc = 0;
 
-        qdio_perf_stat_inc(&perf_stats.outbound_handler);
+        qperf_inc(q, outbound_call);
 
         count = set_buf_states(q, bufnr, SLSB_CU_OUTPUT_PRIMED, count);
         used = atomic_add_return(count, &q->nr_buf_used);
         BUG_ON(used > QDIO_MAX_BUFFERS_PER_Q);
 
-        if (callflags & QDIO_FLAG_PCI_OUT)
+        if (callflags & QDIO_FLAG_PCI_OUT) {
                 q->u.out.pci_out_enabled = 1;
+                qperf_inc(q, pci_request_int);
+        }
         else
                 q->u.out.pci_out_enabled = 0;
 
@@ -1484,7 +1485,7 @@ static int handle_outbound(struct qdio_q *q, unsigned int callflags,
         if (state != SLSB_CU_OUTPUT_PRIMED)
                 rc = qdio_kick_outbound_q(q);
         else
-                qdio_perf_stat_inc(&perf_stats.fast_requeue);
+                qperf_inc(q, fast_requeue);
 
 out:
         tasklet_schedule(&q->tasklet);
@@ -1540,16 +1541,11 @@ static int __init init_QDIO(void)
         rc = qdio_debug_init();
         if (rc)
                 goto out_ti;
-        rc = qdio_setup_perf_stats();
-        if (rc)
-                goto out_debug;
         rc = tiqdio_register_thinints();
         if (rc)
-                goto out_perf;
+                goto out_debug;
         return 0;
 
-out_perf:
-        qdio_remove_perf_stats();
 out_debug:
         qdio_debug_exit();
 out_ti:
@@ -1563,7 +1559,6 @@ static void __exit exit_QDIO(void)
 {
         tiqdio_unregister_thinints();
         tiqdio_free_memory();
-        qdio_remove_perf_stats();
         qdio_debug_exit();
         qdio_setup_exit();
 }
diff --git a/drivers/s390/cio/qdio_perf.c b/drivers/s390/cio/qdio_perf.c
deleted file mode 100644
index 54f7c325a3e6..000000000000
--- a/drivers/s390/cio/qdio_perf.c
+++ /dev/null
@@ -1,149 +0,0 @@
-/*
- *  drivers/s390/cio/qdio_perf.c
- *
- *  Copyright IBM Corp. 2008
- *
- *  Author: Jan Glauber (jang@linux.vnet.ibm.com)
- */
-#include <linux/kernel.h>
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
-#include <asm/ccwdev.h>
-
-#include "cio.h"
-#include "css.h"
-#include "device.h"
-#include "ioasm.h"
-#include "chsc.h"
-#include "qdio_debug.h"
-#include "qdio_perf.h"
-
-int qdio_performance_stats;
-struct qdio_perf_stats perf_stats;
-
-#ifdef CONFIG_PROC_FS
-static struct proc_dir_entry *qdio_perf_pde;
-#endif
-
-/*
- * procfs functions
- */
-static int qdio_perf_proc_show(struct seq_file *m, void *v)
-{
-        seq_printf(m, "Number of qdio interrupts\t\t\t: %li\n",
-                   (long)atomic_long_read(&perf_stats.qdio_int));
-        seq_printf(m, "Number of PCI interrupts\t\t\t: %li\n",
-                   (long)atomic_long_read(&perf_stats.pci_int));
-        seq_printf(m, "Number of adapter interrupts\t\t\t: %li\n",
-                   (long)atomic_long_read(&perf_stats.thin_int));
-        seq_printf(m, "\n");
-        seq_printf(m, "Inbound tasklet runs\t\t\t\t: %li\n",
-                   (long)atomic_long_read(&perf_stats.tasklet_inbound));
-        seq_printf(m, "Outbound tasklet runs\t\t\t\t: %li\n",
-                   (long)atomic_long_read(&perf_stats.tasklet_outbound));
-        seq_printf(m, "Adapter interrupt tasklet runs/loops\t\t: %li/%li\n",
-                   (long)atomic_long_read(&perf_stats.tasklet_thinint),
-                   (long)atomic_long_read(&perf_stats.tasklet_thinint_loop));
-        seq_printf(m, "Adapter interrupt inbound tasklet runs/loops\t: %li/%li\n",
-                   (long)atomic_long_read(&perf_stats.thinint_inbound),
-                   (long)atomic_long_read(&perf_stats.thinint_inbound_loop));
-        seq_printf(m, "\n");
-        seq_printf(m, "Number of SIGA In issued\t\t\t: %li\n",
-                   (long)atomic_long_read(&perf_stats.siga_in));
-        seq_printf(m, "Number of SIGA Out issued\t\t\t: %li\n",
-                   (long)atomic_long_read(&perf_stats.siga_out));
-        seq_printf(m, "Number of SIGA Sync issued\t\t\t: %li\n",
-                   (long)atomic_long_read(&perf_stats.siga_sync));
-        seq_printf(m, "\n");
-        seq_printf(m, "Number of inbound transfers\t\t\t: %li\n",
-                   (long)atomic_long_read(&perf_stats.inbound_handler));
-        seq_printf(m, "Number of outbound transfers\t\t\t: %li\n",
-                   (long)atomic_long_read(&perf_stats.outbound_handler));
-        seq_printf(m, "\n");
-        seq_printf(m, "Number of fast requeues (outg. SBAL w/o SIGA)\t: %li\n",
-                   (long)atomic_long_read(&perf_stats.fast_requeue));
-        seq_printf(m, "Number of outbound target full condition\t: %li\n",
-                   (long)atomic_long_read(&perf_stats.outbound_target_full));
-        seq_printf(m, "Number of inbound queue full condition\t\t: %li\n",
-                   (long)atomic_long_read(&perf_stats.inbound_queue_full));
-        seq_printf(m, "Number of outbound tasklet mod_timer calls\t: %li\n",
-                   (long)atomic_long_read(&perf_stats.debug_tl_out_timer));
-        seq_printf(m, "Number of stop polling calls\t\t\t: %li\n",
-                   (long)atomic_long_read(&perf_stats.debug_stop_polling));
-        seq_printf(m, "AI inbound tasklet loops after stop polling\t: %li\n",
-                   (long)atomic_long_read(&perf_stats.thinint_inbound_loop2));
-        seq_printf(m, "QEBSM EQBS total/incomplete\t\t\t: %li/%li\n",
-                   (long)atomic_long_read(&perf_stats.debug_eqbs_all),
-                   (long)atomic_long_read(&perf_stats.debug_eqbs_incomplete));
-        seq_printf(m, "QEBSM SQBS total/incomplete\t\t\t: %li/%li\n",
-                   (long)atomic_long_read(&perf_stats.debug_sqbs_all),
-                   (long)atomic_long_read(&perf_stats.debug_sqbs_incomplete));
-        seq_printf(m, "\n");
-        return 0;
-}
-static int qdio_perf_seq_open(struct inode *inode, struct file *filp)
-{
-        return single_open(filp, qdio_perf_proc_show, NULL);
-}
-
-static const struct file_operations qdio_perf_proc_fops = {
-        .owner   = THIS_MODULE,
-        .open    = qdio_perf_seq_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = single_release,
-};
-
-/*
- * sysfs functions
- */
-static ssize_t qdio_perf_stats_show(struct bus_type *bus, char *buf)
-{
-        return sprintf(buf, "%i\n", qdio_performance_stats ? 1 : 0);
-}
-
-static ssize_t qdio_perf_stats_store(struct bus_type *bus,
-                              const char *buf, size_t count)
-{
-        unsigned long i;
-
-        if (strict_strtoul(buf, 16, &i) != 0)
-                return -EINVAL;
-        if ((i != 0) && (i != 1))
-                return -EINVAL;
-        if (i == qdio_performance_stats)
-                return count;
-
-        qdio_performance_stats = i;
-        /* reset performance statistics */
-        if (i == 0)
-                memset(&perf_stats, 0, sizeof(struct qdio_perf_stats));
-        return count;
-}
-
-static BUS_ATTR(qdio_performance_stats, 0644, qdio_perf_stats_show,
-                qdio_perf_stats_store);
-
-int __init qdio_setup_perf_stats(void)
-{
-        int rc;
-
-        rc = bus_create_file(&ccw_bus_type, &bus_attr_qdio_performance_stats);
-        if (rc)
-                return rc;
-
-#ifdef CONFIG_PROC_FS
-        memset(&perf_stats, 0, sizeof(struct qdio_perf_stats));
-        qdio_perf_pde = proc_create("qdio_perf", S_IFREG | S_IRUGO,
-                                    NULL, &qdio_perf_proc_fops);
-#endif
-        return 0;
-}
-
-void qdio_remove_perf_stats(void)
-{
-#ifdef CONFIG_PROC_FS
-        remove_proc_entry("qdio_perf", NULL);
-#endif
-        bus_remove_file(&ccw_bus_type, &bus_attr_qdio_performance_stats);
-}
diff --git a/drivers/s390/cio/qdio_perf.h b/drivers/s390/cio/qdio_perf.h
deleted file mode 100644
index 12454231dc8b..000000000000
--- a/drivers/s390/cio/qdio_perf.h
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- *  drivers/s390/cio/qdio_perf.h
- *
- *  Copyright IBM Corp. 2008
- *
- *  Author: Jan Glauber (jang@linux.vnet.ibm.com)
- */
-#ifndef QDIO_PERF_H
-#define QDIO_PERF_H
-
-#include <linux/types.h>
-#include <asm/atomic.h>
-
-struct qdio_perf_stats {
-        /* interrupt handler calls */
-        atomic_long_t qdio_int;
-        atomic_long_t pci_int;
-        atomic_long_t thin_int;
-
-        /* tasklet runs */
-        atomic_long_t tasklet_inbound;
-        atomic_long_t tasklet_outbound;
-        atomic_long_t tasklet_thinint;
-        atomic_long_t tasklet_thinint_loop;
-        atomic_long_t thinint_inbound;
-        atomic_long_t thinint_inbound_loop;
-        atomic_long_t thinint_inbound_loop2;
-
-        /* signal adapter calls */
-        atomic_long_t siga_out;
-        atomic_long_t siga_in;
-        atomic_long_t siga_sync;
-
-        /* misc */
-        atomic_long_t inbound_handler;
-        atomic_long_t outbound_handler;
-        atomic_long_t fast_requeue;
-        atomic_long_t outbound_target_full;
-        atomic_long_t inbound_queue_full;
-
-        /* for debugging */
-        atomic_long_t debug_tl_out_timer;
-        atomic_long_t debug_stop_polling;
-        atomic_long_t debug_eqbs_all;
-        atomic_long_t debug_eqbs_incomplete;
-        atomic_long_t debug_sqbs_all;
-        atomic_long_t debug_sqbs_incomplete;
-};
-
-extern struct qdio_perf_stats perf_stats;
-extern int qdio_performance_stats;
-
-static inline void qdio_perf_stat_inc(atomic_long_t *count)
-{
-        if (qdio_performance_stats)
-                atomic_long_inc(count);
-}
-
-int qdio_setup_perf_stats(void);
-void qdio_remove_perf_stats(void);
-
-#endif
diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
index 981a77ea7ee2..091d904d3182 100644
--- a/drivers/s390/cio/qdio_thinint.c
+++ b/drivers/s390/cio/qdio_thinint.c
@@ -1,9 +1,7 @@
 /*
  * linux/drivers/s390/cio/thinint_qdio.c
  *
- * thin interrupt support for qdio
- *
- * Copyright 2000-2008 IBM Corp.
+ * Copyright 2000,2009 IBM Corp.
  * Author(s): Utz Bacher <utz.bacher@de.ibm.com>
  *            Cornelia Huck <cornelia.huck@de.ibm.com>
  *            Jan Glauber <jang@linux.vnet.ibm.com>
@@ -19,7 +17,6 @@
 #include "ioasm.h"
 #include "qdio.h"
 #include "qdio_debug.h"
-#include "qdio_perf.h"
 
 /*
  * Restriction: only 63 iqdio subchannels would have its own indicator,
@@ -132,8 +129,6 @@ static void tiqdio_thinint_handler(void *ind, void *drv_data)
 {
         struct qdio_q *q;
 
-        qdio_perf_stat_inc(&perf_stats.thin_int);
-
         /*
          * SVS only when needed: issue SVS to benefit from iqdio interrupt
          * avoidance (SVS clears adapter interrupt suppression overwrite)
@@ -154,6 +149,7 @@ static void tiqdio_thinint_handler(void *ind, void *drv_data)
         list_for_each_entry_rcu(q, &tiq_list, entry)
                 /* only process queues from changed sets */
                 if (*q->irq_ptr->dsci) {
+                        qperf_inc(q, adapter_int);
 
                         /* only clear it if the indicator is non-shared */
                         if (!shared_ind(q->irq_ptr))
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 0d4d18bdd45c..c68be24e27d9 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -393,10 +393,12 @@ static long zcrypt_rsa_crt(struct ica_rsa_modexpo_crt *crt)
                          * u_mult_inv > 128 bytes.
                          */
                         if (copied == 0) {
-                                int len;
+                                unsigned int len;
                                 spin_unlock_bh(&zcrypt_device_lock);
                                 /* len is max 256 / 2 - 120 = 8 */
                                 len = crt->inputdatalength / 2 - 120;
+                                if (len > sizeof(z1))
+                                        return -EFAULT;
                                 z1 = z2 = z3 = 0;
                                 if (copy_from_user(&z1, crt->np_prime, len) ||
                                     copy_from_user(&z2, crt->bp_key, len) ||