Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 updates from Martin Schwidefsky:
 "The bulk of the s390 updates for v3.14.

  New features are the perf support for the CPU-Measurement Sample
  Facility and the EP11 support for the crypto cards.  And the normal
  cleanups and bug-fixes"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (44 commits)
  s390/cpum_sf: fix printk format warnings
  s390: Fix misspellings using 'codespell' tool
  s390/qdio: bridgeport support - CHSC part
  s390: delete new instances of __cpuinit usage
  s390/compat: fix PSW32_USER_BITS definition
  s390/zcrypt: add support for EP11 coprocessor cards
  s390/mm: optimize randomize_et_dyn for !PF_RANDOMIZE
  s390: use IS_ENABLED to check if a CONFIG is set to y or m
  s390/cio: use device_lock to synchronize calls to the ccwgroup driver
  s390/cio: use device_lock to synchronize calls to the ccw driver
  s390/cio: fix unlocked access of online member
  s390/cpum_sf: Add flag to process full SDBs only
  s390/cpum_sf: Add raw data sampling to support the diagnostic-sampling function
  s390/cpum_sf: Filter perf events based event->attr.exclude_* settings
  s390/cpum_sf: Detect KVM guest samples
  s390/cpum_sf: Add helper to read TOD from trailer entries
  s390/cpum_sf: Atomically reset trailer entry fields of sample-data-blocks
  s390/cpum_sf: Dynamically extend the sampling buffer if overflows occur
  s390/pci: reenable per default
  s390/pci/dma: fix accounting of allocated_pages
  ...

24 files changed, 755 insertions, 152 deletions

diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index f302efa937ef..1eef0f586950 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -3386,7 +3386,7 @@ int dasd_generic_set_offline(struct ccw_device *cdev)
 
         if (test_bit(DASD_FLAG_SAFE_OFFLINE_RUNNING, &device->flags)) {
                 /*
-                 * safe offline allready running
+                 * safe offline already running
                  * could only be called by normal offline so safe_offline flag
                  * needs to be removed to run normal offline and kill all I/O
                  */
diff --git a/drivers/s390/char/sclp.h b/drivers/s390/char/sclp.h
index 6fbe09686d18..fea76aed9eea 100644
--- a/drivers/s390/char/sclp.h
+++ b/drivers/s390/char/sclp.h
@@ -183,7 +183,6 @@ extern unsigned long sclp_console_full;
 extern u8 sclp_fac84;
 extern unsigned long long sclp_rzm;
 extern unsigned long long sclp_rnmax;
-extern __initdata int sclp_early_read_info_sccb_valid;
 
 /* useful inlines */
 
diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
index eaa21d542c5c..cb3c4e05a385 100644
--- a/drivers/s390/char/sclp_cmd.c
+++ b/drivers/s390/char/sclp_cmd.c
@@ -455,8 +455,6 @@ static int __init sclp_detect_standby_memory(void)
 
         if (OLDMEM_BASE) /* No standby memory in kdump mode */
                 return 0;
-        if (!sclp_early_read_info_sccb_valid)
-                return 0;
         if ((sclp_facilities & 0xe00000000000ULL) != 0xe00000000000ULL)
                 return 0;
         rc = -ENOMEM;
diff --git a/drivers/s390/char/sclp_early.c b/drivers/s390/char/sclp_early.c
index 1465e9563101..82f2c389b4d1 100644
--- a/drivers/s390/char/sclp_early.c
+++ b/drivers/s390/char/sclp_early.c
@@ -35,11 +35,12 @@ struct read_info_sccb {
         u8      _reserved5[4096 - 112]; /* 112-4095 */
 } __packed __aligned(PAGE_SIZE);
 
-static __initdata struct read_info_sccb early_read_info_sccb;
-static __initdata char sccb_early[PAGE_SIZE] __aligned(PAGE_SIZE);
+static char sccb_early[PAGE_SIZE] __aligned(PAGE_SIZE) __initdata;
+static unsigned int sclp_con_has_vt220 __initdata;
+static unsigned int sclp_con_has_linemode __initdata;
 static unsigned long sclp_hsa_size;
+static struct sclp_ipl_info sclp_ipl_info;
 
-__initdata int sclp_early_read_info_sccb_valid;
 u64 sclp_facilities;
 u8 sclp_fac84;
 unsigned long long sclp_rzm;
@@ -63,15 +64,12 @@ out:
         return rc;
 }
 
-static void __init sclp_read_info_early(void)
+static int __init sclp_read_info_early(struct read_info_sccb *sccb)
 {
-        int rc;
-        int i;
-        struct read_info_sccb *sccb;
+        int rc, i;
         sclp_cmdw_t commands[] = {SCLP_CMDW_READ_SCP_INFO_FORCED,
                                   SCLP_CMDW_READ_SCP_INFO};
 
-        sccb = &early_read_info_sccb;
         for (i = 0; i < ARRAY_SIZE(commands); i++) {
                 do {
                         memset(sccb, 0, sizeof(*sccb));
@@ -83,24 +81,19 @@ static void __init sclp_read_info_early(void)
 
                 if (rc)
                         break;
-                if (sccb->header.response_code == 0x10) {
-                        sclp_early_read_info_sccb_valid = 1;
-                        break;
-                }
+                if (sccb->header.response_code == 0x10)
+                        return 0;
                 if (sccb->header.response_code != 0x1f0)
                         break;
         }
+        return -EIO;
 }
 
-static void __init sclp_facilities_detect(void)
+static void __init sclp_facilities_detect(struct read_info_sccb *sccb)
 {
-        struct read_info_sccb *sccb;
-
-        sclp_read_info_early();
-        if (!sclp_early_read_info_sccb_valid)
+        if (sclp_read_info_early(sccb))
                 return;
 
-        sccb = &early_read_info_sccb;
         sclp_facilities = sccb->facilities;
         sclp_fac84 = sccb->fac84;
         if (sccb->fac85 & 0x02)
@@ -108,30 +101,22 @@ static void __init sclp_facilities_detect(void)
         sclp_rnmax = sccb->rnmax ? sccb->rnmax : sccb->rnmax2;
         sclp_rzm = sccb->rnsize ? sccb->rnsize : sccb->rnsize2;
         sclp_rzm <<= 20;
+
+        /* Save IPL information */
+        sclp_ipl_info.is_valid = 1;
+        if (sccb->flags & 0x2)
+                sclp_ipl_info.has_dump = 1;
+        memcpy(&sclp_ipl_info.loadparm, &sccb->loadparm, LOADPARM_LEN);
 }
 
 bool __init sclp_has_linemode(void)
 {
-        struct init_sccb *sccb = (void *) &sccb_early;
-
-        if (sccb->header.response_code != 0x20)
-                return 0;
-        if (!(sccb->sclp_send_mask & (EVTYP_OPCMD_MASK | EVTYP_PMSGCMD_MASK)))
-                return 0;
-        if (!(sccb->sclp_receive_mask & (EVTYP_MSG_MASK | EVTYP_PMSGCMD_MASK)))
-                return 0;
-        return 1;
+        return !!sclp_con_has_linemode;
 }
 
 bool __init sclp_has_vt220(void)
 {
-        struct init_sccb *sccb = (void *) &sccb_early;
-
-        if (sccb->header.response_code != 0x20)
-                return 0;
-        if (sccb->sclp_send_mask & EVTYP_VT220MSG_MASK)
-                return 1;
-        return 0;
+        return !!sclp_con_has_vt220;
 }
 
 unsigned long long sclp_get_rnmax(void)
@@ -146,19 +131,12 @@ unsigned long long sclp_get_rzm(void)
 
 /*
  * This function will be called after sclp_facilities_detect(), which gets
- * called from early.c code. Therefore the sccb should have valid contents.
+ * called from early.c code. The sclp_facilities_detect() function retrieves
+ * and saves the IPL information.
  */
 void __init sclp_get_ipl_info(struct sclp_ipl_info *info)
 {
-        struct read_info_sccb *sccb;
-
-        if (!sclp_early_read_info_sccb_valid)
-                return;
-        sccb = &early_read_info_sccb;
-        info->is_valid = 1;
-        if (sccb->flags & 0x2)
-                info->has_dump = 1;
-        memcpy(&info->loadparm, &sccb->loadparm, LOADPARM_LEN);
+        *info = sclp_ipl_info;
 }
 
 static int __init sclp_cmd_early(sclp_cmdw_t cmd, void *sccb)
@@ -189,11 +167,10 @@ static void __init sccb_init_eq_size(struct sdias_sccb *sccb)
         sccb->evbuf.dbs = 1;
 }
 
-static int __init sclp_set_event_mask(unsigned long receive_mask,
+static int __init sclp_set_event_mask(struct init_sccb *sccb,
+                                      unsigned long receive_mask,
                                       unsigned long send_mask)
 {
-        struct init_sccb *sccb = (void *) &sccb_early;
-
         memset(sccb, 0, sizeof(*sccb));
         sccb->header.length = sizeof(*sccb);
         sccb->mask_length = sizeof(sccb_mask_t);
@@ -202,10 +179,8 @@ static int __init sclp_set_event_mask(unsigned long receive_mask,
         return sclp_cmd_early(SCLP_CMDW_WRITE_EVENT_MASK, sccb);
 }
 
-static long __init sclp_hsa_size_init(void)
+static long __init sclp_hsa_size_init(struct sdias_sccb *sccb)
 {
-        struct sdias_sccb *sccb = (void *) &sccb_early;
-
         sccb_init_eq_size(sccb);
         if (sclp_cmd_early(SCLP_CMDW_WRITE_EVENT_DATA, sccb))
                 return -EIO;
@@ -214,10 +189,8 @@ static long __init sclp_hsa_size_init(void)
         return 0;
 }
 
-static long __init sclp_hsa_copy_wait(void)
+static long __init sclp_hsa_copy_wait(struct sccb_header *sccb)
 {
-        struct sccb_header *sccb = (void *) &sccb_early;
-
         memset(sccb, 0, PAGE_SIZE);
         sccb->length = PAGE_SIZE;
         if (sclp_cmd_early(SCLP_CMDW_READ_EVENT_DATA, sccb))
@@ -230,34 +203,62 @@ unsigned long sclp_get_hsa_size(void)
         return sclp_hsa_size;
 }
 
-static void __init sclp_hsa_size_detect(void)
+static void __init sclp_hsa_size_detect(void *sccb)
 {
         long size;
 
         /* First try synchronous interface (LPAR) */
-        if (sclp_set_event_mask(0, 0x40000010))
+        if (sclp_set_event_mask(sccb, 0, 0x40000010))
                 return;
-        size = sclp_hsa_size_init();
+        size = sclp_hsa_size_init(sccb);
         if (size < 0)
                 return;
         if (size != 0)
                 goto out;
         /* Then try asynchronous interface (z/VM) */
-        if (sclp_set_event_mask(0x00000010, 0x40000010))
+        if (sclp_set_event_mask(sccb, 0x00000010, 0x40000010))
                 return;
-        size = sclp_hsa_size_init();
+        size = sclp_hsa_size_init(sccb);
         if (size < 0)
                 return;
-        size = sclp_hsa_copy_wait();
+        size = sclp_hsa_copy_wait(sccb);
         if (size < 0)
                 return;
 out:
         sclp_hsa_size = size;
 }
 
+static unsigned int __init sclp_con_check_linemode(struct init_sccb *sccb)
+{
+        if (!(sccb->sclp_send_mask & (EVTYP_OPCMD_MASK | EVTYP_PMSGCMD_MASK)))
+                return 0;
+        if (!(sccb->sclp_receive_mask & (EVTYP_MSG_MASK | EVTYP_PMSGCMD_MASK)))
+                return 0;
+        return 1;
+}
+
+static void __init sclp_console_detect(struct init_sccb *sccb)
+{
+        if (sccb->header.response_code != 0x20)
+                return;
+
+        if (sccb->sclp_send_mask & EVTYP_VT220MSG_MASK)
+                sclp_con_has_vt220 = 1;
+
+        if (sclp_con_check_linemode(sccb))
+                sclp_con_has_linemode = 1;
+}
+
 void __init sclp_early_detect(void)
 {
-        sclp_facilities_detect();
-        sclp_hsa_size_detect();
-        sclp_set_event_mask(0, 0);
+        void *sccb = &sccb_early;
+
+        sclp_facilities_detect(sccb);
+        sclp_hsa_size_detect(sccb);
+
+        /* Turn off SCLP event notifications.  Also save remote masks in the
+         * sccb.  These are sufficient to detect sclp console capabilities.
+         */
+        sclp_set_event_mask(sccb, 0, 0);
+        sclp_console_detect(sccb);
 }
diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
index 34629ea913d4..e91b89dc6d1f 100644
--- a/drivers/s390/char/tty3270.c
+++ b/drivers/s390/char/tty3270.c
@@ -125,10 +125,7 @@ static void tty3270_resize_work(struct work_struct *work);
  */
 static void tty3270_set_timer(struct tty3270 *tp, int expires)
 {
-        if (expires == 0)
-                del_timer(&tp->timer);
-        else
-                mod_timer(&tp->timer, jiffies + expires);
+        mod_timer(&tp->timer, jiffies + expires);
 }
 
 /*
@@ -744,7 +741,6 @@ tty3270_free_view(struct tty3270 *tp)
 {
         int pages;
 
-        del_timer_sync(&tp->timer);
         kbd_free(tp->kbd);
         raw3270_request_free(tp->kreset);
         raw3270_request_free(tp->read);
@@ -877,6 +873,7 @@ tty3270_free(struct raw3270_view *view)
 {
         struct tty3270 *tp = container_of(view, struct tty3270, view);
 
+        del_timer_sync(&tp->timer);
         tty3270_free_screen(tp->screen, tp->view.rows);
         tty3270_free_view(tp);
 }
diff --git a/drivers/s390/cio/blacklist.c b/drivers/s390/cio/blacklist.c
index a9fe3de2dec1..b3f791b2c1f8 100644
--- a/drivers/s390/cio/blacklist.c
+++ b/drivers/s390/cio/blacklist.c
@@ -260,16 +260,16 @@ static int blacklist_parse_proc_parameters(char *buf)
 
         parm = strsep(&buf, " ");
 
-        if (strcmp("free", parm) == 0)
+        if (strcmp("free", parm) == 0) {
                 rc = blacklist_parse_parameters(buf, free, 0);
-        else if (strcmp("add", parm) == 0)
+                css_schedule_eval_all_unreg(0);
+        } else if (strcmp("add", parm) == 0)
                 rc = blacklist_parse_parameters(buf, add, 0);
         else if (strcmp("purge", parm) == 0)
                 return ccw_purge_blacklisted();
         else
                 return -EINVAL;
 
-        css_schedule_reprobe();
 
         return rc;
 }
diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index 959135a01847..fd3367a1dc7a 100644
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -128,14 +128,14 @@ static ssize_t ccwgroup_online_store(struct device *dev,
                                      const char *buf, size_t count)
 {
         struct ccwgroup_device *gdev = to_ccwgroupdev(dev);
-        struct ccwgroup_driver *gdrv = to_ccwgroupdrv(dev->driver);
         unsigned long value;
         int ret;
 
-        if (!dev->driver)
-                return -EINVAL;
-        if (!try_module_get(gdrv->driver.owner))
-                return -EINVAL;
+        device_lock(dev);
+        if (!dev->driver) {
+                ret = -EINVAL;
+                goto out;
+        }
 
         ret = kstrtoul(buf, 0, &value);
         if (ret)
@@ -148,7 +148,7 @@ static ssize_t ccwgroup_online_store(struct device *dev,
         else
                 ret = -EINVAL;
 out:
-        module_put(gdrv->driver.owner);
+        device_unlock(dev);
         return (ret == 0) ? count : ret;
 }
 
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 13299f902676..f6b9188c5af5 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -55,6 +55,7 @@ int chsc_error_from_response(int response)
         case 0x0004:
                 return -EOPNOTSUPP;
         case 0x000b:
+        case 0x0107:            /* "Channel busy" for the op 0x003d */
                 return -EBUSY;
         case 0x0100:
         case 0x0102:
@@ -237,26 +238,6 @@ void chsc_chp_offline(struct chp_id chpid)
         for_each_subchannel_staged(s390_subchannel_remove_chpid, NULL, &link);
 }
 
-static int s390_process_res_acc_new_sch(struct subchannel_id schid, void *data)
-{
-        struct schib schib;
-        /*
-         * We don't know the device yet, but since a path
-         * may be available now to the device we'll have
-         * to do recognition again.
-         * Since we don't have any idea about which chpid
-         * that beast may be on we'll have to do a stsch
-         * on all devices, grr...
-         */
-        if (stsch_err(schid, &schib))
-                /* We're through */
-                return -ENXIO;
-
-        /* Put it on the slow path. */
-        css_schedule_eval(schid);
-        return 0;
-}
-
 static int __s390_process_res_acc(struct subchannel *sch, void *data)
 {
         spin_lock_irq(sch->lock);
@@ -287,8 +268,8 @@ static void s390_process_res_acc(struct chp_link *link)
          * The more information we have (info), the less scanning
          * will we have to do.
          */
-        for_each_subchannel_staged(__s390_process_res_acc,
-                                   s390_process_res_acc_new_sch, link);
+        for_each_subchannel_staged(__s390_process_res_acc, NULL, link);
+        css_schedule_reprobe();
 }
 
 static int
@@ -663,19 +644,6 @@ static int s390_subchannel_vary_chpid_on(struct subchannel *sch, void *data)
         return 0;
 }
 
-static int
-__s390_vary_chpid_on(struct subchannel_id schid, void *data)
-{
-        struct schib schib;
-
-        if (stsch_err(schid, &schib))
-                /* We're through */
-                return -ENXIO;
-        /* Put it on the slow path. */
-        css_schedule_eval(schid);
-        return 0;
-}
-
 /**
  * chsc_chp_vary - propagate channel-path vary operation to subchannels
  * @chpid: channl-path ID
@@ -694,7 +662,8 @@ int chsc_chp_vary(struct chp_id chpid, int on)
                 /* Try to update the channel path description. */
                 chp_update_desc(chp);
                 for_each_subchannel_staged(s390_subchannel_vary_chpid_on,
-                                           __s390_vary_chpid_on, &chpid);
+                                           NULL, &chpid);
+                css_schedule_reprobe();
         } else
                 for_each_subchannel_staged(s390_subchannel_vary_chpid_off,
                                            NULL, &chpid);
@@ -1234,3 +1203,35 @@ out:
         return ret;
 }
 EXPORT_SYMBOL_GPL(chsc_scm_info);
+
+/**
+ * chsc_pnso_brinfo() - Perform Network-Subchannel Operation, Bridge Info.
+ * @schid:              id of the subchannel on which PNSO is performed
+ * @brinfo_area:        request and response block for the operation
+ * @resume_token:       resume token for multiblock response
+ * @cnc:                Boolean change-notification control
+ *
+ * brinfo_area must be allocated by the caller with get_zeroed_page(GFP_KERNEL)
+ *
+ * Returns 0 on success.
+ */
+int chsc_pnso_brinfo(struct subchannel_id schid,
+                struct chsc_pnso_area *brinfo_area,
+                struct chsc_brinfo_resume_token resume_token,
+                int cnc)
+{
+        memset(brinfo_area, 0, sizeof(*brinfo_area));
+        brinfo_area->request.length = 0x0030;
+        brinfo_area->request.code = 0x003d; /* network-subchannel operation */
+        brinfo_area->m     = schid.m;
+        brinfo_area->ssid  = schid.ssid;
+        brinfo_area->sch   = schid.sch_no;
+        brinfo_area->cssid = schid.cssid;
+        brinfo_area->oc    = 0; /* Store-network-bridging-information list */
+        brinfo_area->resume_token = resume_token;
+        brinfo_area->n     = (cnc != 0);
+        if (chsc(brinfo_area))
+                return -EIO;
+        return chsc_error_from_response(brinfo_area->response.code);
+}
+EXPORT_SYMBOL_GPL(chsc_pnso_brinfo);
diff --git a/drivers/s390/cio/chsc.h b/drivers/s390/cio/chsc.h
index 23d072e70eb2..7e53a9c8b0b9 100644
--- a/drivers/s390/cio/chsc.h
+++ b/drivers/s390/cio/chsc.h
@@ -61,7 +61,9 @@ struct css_chsc_char {
         u32 : 20;
         u32 scssc : 1;  /* bit 107 */
         u32 scsscf : 1; /* bit 108 */
-        u32 : 19;
+        u32:7;
+        u32 pnso:1; /* bit 116 */
+        u32:11;
 }__attribute__((packed));
 
 extern struct css_chsc_char css_chsc_characteristics;
@@ -188,6 +190,53 @@ struct chsc_scm_info {
 
 int chsc_scm_info(struct chsc_scm_info *scm_area, u64 token);
 
+struct chsc_brinfo_resume_token {
+        u64 t1;
+        u64 t2;
+} __packed;
+
+struct chsc_brinfo_naihdr {
+        struct chsc_brinfo_resume_token resume_token;
+        u32:32;
+        u32 instance;
+        u32:24;
+        u8 naids;
+        u32 reserved[3];
+} __packed;
+
+struct chsc_pnso_area {
+        struct chsc_header request;
+        u8:2;
+        u8 m:1;
+        u8:5;
+        u8:2;
+        u8 ssid:2;
+        u8 fmt:4;
+        u16 sch;
+        u8:8;
+        u8 cssid;
+        u16:16;
+        u8 oc;
+        u32:24;
+        struct chsc_brinfo_resume_token resume_token;
+        u32 n:1;
+        u32:31;
+        u32 reserved[3];
+        struct chsc_header response;
+        u32:32;
+        struct chsc_brinfo_naihdr naihdr;
+        union {
+                struct qdio_brinfo_entry_l3_ipv6 l3_ipv6[0];
+                struct qdio_brinfo_entry_l3_ipv4 l3_ipv4[0];
+                struct qdio_brinfo_entry_l2      l2[0];
+        } entries;
+} __packed;
+
+int chsc_pnso_brinfo(struct subchannel_id schid,
+                struct chsc_pnso_area *brinfo_area,
+                struct chsc_brinfo_resume_token resume_token,
+                int cnc);
+
 #ifdef CONFIG_SCM_BUS
 int scm_update_information(void);
 int scm_process_availability_information(void);
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 8c2cb87bccc5..0268e5fd59b5 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -69,7 +69,8 @@ static int call_fn_known_sch(struct device *dev, void *data)
         struct cb_data *cb = data;
         int rc = 0;
 
-        idset_sch_del(cb->set, sch->schid);
+        if (cb->set)
+                idset_sch_del(cb->set, sch->schid);
         if (cb->fn_known_sch)
                 rc = cb->fn_known_sch(sch, cb->data);
         return rc;
@@ -115,6 +116,13 @@ int for_each_subchannel_staged(int (*fn_known)(struct subchannel *, void *),
         cb.fn_known_sch = fn_known;
         cb.fn_unknown_sch = fn_unknown;
 
+        if (fn_known && !fn_unknown) {
+                /* Skip idset allocation in case of known-only loop. */
+                cb.set = NULL;
+                return bus_for_each_dev(&css_bus_type, NULL, &cb,
+                                        call_fn_known_sch);
+        }
+
         cb.set = idset_sch_new();
         if (!cb.set)
                 /* fall back to brute force scanning in case of oom */
@@ -553,6 +561,9 @@ static int slow_eval_unknown_fn(struct subchannel_id schid, void *data)
                 default:
                         rc = 0;
                 }
+                /* Allow scheduling here since the containing loop might
+                 * take a while.  */
+                cond_resched();
         }
         return rc;
 }
@@ -572,7 +583,7 @@ static void css_slow_path_func(struct work_struct *unused)
         spin_unlock_irqrestore(&slow_subchannel_lock, flags);
 }
 
-static DECLARE_WORK(slow_path_work, css_slow_path_func);
+static DECLARE_DELAYED_WORK(slow_path_work, css_slow_path_func);
 struct workqueue_struct *cio_work_q;
 
 void css_schedule_eval(struct subchannel_id schid)
@@ -582,7 +593,7 @@ void css_schedule_eval(struct subchannel_id schid)
         spin_lock_irqsave(&slow_subchannel_lock, flags);
         idset_sch_add(slow_subchannel_set, schid);
         atomic_set(&css_eval_scheduled, 1);
-        queue_work(cio_work_q, &slow_path_work);
+        queue_delayed_work(cio_work_q, &slow_path_work, 0);
         spin_unlock_irqrestore(&slow_subchannel_lock, flags);
 }
 
@@ -593,7 +604,7 @@ void css_schedule_eval_all(void)
         spin_lock_irqsave(&slow_subchannel_lock, flags);
         idset_fill(slow_subchannel_set);
         atomic_set(&css_eval_scheduled, 1);
-        queue_work(cio_work_q, &slow_path_work);
+        queue_delayed_work(cio_work_q, &slow_path_work, 0);
         spin_unlock_irqrestore(&slow_subchannel_lock, flags);
 }
 
@@ -606,7 +617,7 @@ static int __unset_registered(struct device *dev, void *data)
         return 0;
 }
 
-static void css_schedule_eval_all_unreg(void)
+void css_schedule_eval_all_unreg(unsigned long delay)
 {
         unsigned long flags;
         struct idset *unreg_set;
@@ -624,7 +635,7 @@ static void css_schedule_eval_all_unreg(void)
         spin_lock_irqsave(&slow_subchannel_lock, flags);
         idset_add_set(slow_subchannel_set, unreg_set);
         atomic_set(&css_eval_scheduled, 1);
-        queue_work(cio_work_q, &slow_path_work);
+        queue_delayed_work(cio_work_q, &slow_path_work, delay);
         spin_unlock_irqrestore(&slow_subchannel_lock, flags);
         idset_free(unreg_set);
 }
@@ -637,7 +648,8 @@ void css_wait_for_slow_path(void)
 /* Schedule reprobing of all unregistered subchannels. */
 void css_schedule_reprobe(void)
 {
-        css_schedule_eval_all_unreg();
+        /* Schedule with a delay to allow merging of subsequent calls. */
+        css_schedule_eval_all_unreg(1 * HZ);
 }
 EXPORT_SYMBOL_GPL(css_schedule_reprobe);
 
diff --git a/drivers/s390/cio/css.h b/drivers/s390/cio/css.h
index 29351321bad6..2c9107e20251 100644
--- a/drivers/s390/cio/css.h
+++ b/drivers/s390/cio/css.h
@@ -133,6 +133,7 @@ extern struct channel_subsystem *channel_subsystems[];
 /* Helper functions to build lists for the slow path. */
 void css_schedule_eval(struct subchannel_id schid);
 void css_schedule_eval_all(void);
+void css_schedule_eval_all_unreg(unsigned long delay);
 int css_complete_work(void);
 
 int sch_is_pseudo_sch(struct subchannel *);
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index e4a7ab2bb629..e9d783563cbb 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -333,9 +333,9 @@ int ccw_device_set_offline(struct ccw_device *cdev)
                 if (ret != 0)
                         return ret;
         }
-        cdev->online = 0;
         spin_lock_irq(cdev->ccwlock);
         sch = to_subchannel(cdev->dev.parent);
+        cdev->online = 0;
         /* Wait until a final state or DISCONNECTED is reached */
         while (!dev_fsm_final_state(cdev) &&
                cdev->private->state != DEV_STATE_DISCONNECTED) {
@@ -446,7 +446,10 @@ int ccw_device_set_online(struct ccw_device *cdev)
                 ret = cdev->drv->set_online(cdev);
         if (ret)
                 goto rollback;
+
+        spin_lock_irq(cdev->ccwlock);
         cdev->online = 1;
+        spin_unlock_irq(cdev->ccwlock);
         return 0;
 
 rollback:
@@ -546,17 +549,12 @@ static ssize_t online_store (struct device *dev, struct device_attribute *attr,
         if (!dev_fsm_final_state(cdev) &&
             cdev->private->state != DEV_STATE_DISCONNECTED) {
                 ret = -EAGAIN;
-                goto out_onoff;
+                goto out;
         }
         /* Prevent conflict between pending work and on-/offline processing.*/
         if (work_pending(&cdev->private->todo_work)) {
                 ret = -EAGAIN;
-                goto out_onoff;
-        }
-
-        if (cdev->drv && !try_module_get(cdev->drv->driver.owner)) {
-                ret = -EINVAL;
-                goto out_onoff;
+                goto out;
         }
         if (!strncmp(buf, "force\n", count)) {
                 force = 1;
@@ -568,6 +566,8 @@ static ssize_t online_store (struct device *dev, struct device_attribute *attr,
         }
         if (ret)
                 goto out;
+
+        device_lock(dev);
         switch (i) {
         case 0:
                 ret = online_store_handle_offline(cdev);
@@ -578,10 +578,9 @@ static ssize_t online_store (struct device *dev, struct device_attribute *attr,
         default:
                 ret = -EINVAL;
         }
+        device_unlock(dev);
+
 out:
-        if (cdev->drv)
-                module_put(cdev->drv->driver.owner);
-out_onoff:
         atomic_set(&cdev->private->onoff, 0);
         return (ret < 0) ? ret : count;
 }
@@ -1745,8 +1744,7 @@ ccw_device_probe (struct device *dev)
         return 0;
 }
 
-static int
-ccw_device_remove (struct device *dev)
+static int ccw_device_remove(struct device *dev)
 {
         struct ccw_device *cdev = to_ccwdev(dev);
         struct ccw_driver *cdrv = cdev->drv;
@@ -1754,9 +1752,10 @@ ccw_device_remove (struct device *dev)
 
         if (cdrv->remove)
                 cdrv->remove(cdev);
+
+        spin_lock_irq(cdev->ccwlock);
         if (cdev->online) {
                 cdev->online = 0;
-                spin_lock_irq(cdev->ccwlock);
                 ret = ccw_device_offline(cdev);
                 spin_unlock_irq(cdev->ccwlock);
                 if (ret == 0)
@@ -1769,10 +1768,12 @@ ccw_device_remove (struct device *dev)
                                       cdev->private->dev_id.devno);
                 /* Give up reference obtained in ccw_device_set_online(). */
                 put_device(&cdev->dev);
+                spin_lock_irq(cdev->ccwlock);
         }
         ccw_device_set_timeout(cdev, 0);
         cdev->drv = NULL;
         cdev->private->int_class = IRQIO_CIO;
+        spin_unlock_irq(cdev->ccwlock);
         return 0;
 }
 
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 3e602e8affa7..c883a085c059 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -1752,6 +1752,97 @@ int qdio_stop_irq(struct ccw_device *cdev, int nr)
 }
 EXPORT_SYMBOL(qdio_stop_irq);
 
+/**
+ * qdio_pnso_brinfo() - perform network subchannel op #0 - bridge info.
+ * @schid:              Subchannel ID.
+ * @cnc:                Boolean Change-Notification Control
+ * @response:           Response code will be stored at this address
+ * @cb:                 Callback function will be executed for each element
+ *                      of the address list
+ * @priv:               Pointer passed from the caller to qdio_pnso_brinfo()
+ * @type:               Type of the address entry passed to the callback
+ * @entry:              Entry containg the address of the specified type
+ * @priv:               Pointer to pass to the callback function.
+ *
+ * Performs "Store-network-bridging-information list" operation and calls
+ * the callback function for every entry in the list. If "change-
+ * notification-control" is set, further changes in the address list
+ * will be reported via the IPA command.
+ */
+int qdio_pnso_brinfo(struct subchannel_id schid,
+                int cnc, u16 *response,
+                void (*cb)(void *priv, enum qdio_brinfo_entry_type type,
+                                void *entry),
+                void *priv)
+{
+        struct chsc_pnso_area *rr;
+        int rc;
+        u32 prev_instance = 0;
+        int isfirstblock = 1;
+        int i, size, elems;
+
+        rr = (struct chsc_pnso_area *)get_zeroed_page(GFP_KERNEL);
+        if (rr == NULL)
+                return -ENOMEM;
+        do {
+                /* on the first iteration, naihdr.resume_token will be zero */
+                rc = chsc_pnso_brinfo(schid, rr, rr->naihdr.resume_token, cnc);
+                if (rc != 0 && rc != -EBUSY)
+                        goto out;
+                if (rr->response.code != 1) {
+                        rc = -EIO;
+                        continue;
+                } else
+                        rc = 0;
+
+                if (cb == NULL)
+                        continue;
+
+                size = rr->naihdr.naids;
+                elems = (rr->response.length -
+                                sizeof(struct chsc_header) -
+                                sizeof(struct chsc_brinfo_naihdr)) /
+                                size;
+
+                if (!isfirstblock && (rr->naihdr.instance != prev_instance)) {
+                        /* Inform the caller that they need to scrap */
+                        /* the data that was already reported via cb */
+                                rc = -EAGAIN;
+                                break;
+                }
+                isfirstblock = 0;
+                prev_instance = rr->naihdr.instance;
+                for (i = 0; i < elems; i++)
+                        switch (size) {
+                        case sizeof(struct qdio_brinfo_entry_l3_ipv6):
+                                (*cb)(priv, l3_ipv6_addr,
+                                                &rr->entries.l3_ipv6[i]);
+                                break;
+                        case sizeof(struct qdio_brinfo_entry_l3_ipv4):
+                                (*cb)(priv, l3_ipv4_addr,
+                                                &rr->entries.l3_ipv4[i]);
+                                break;
+                        case sizeof(struct qdio_brinfo_entry_l2):
+                                (*cb)(priv, l2_addr_lnid,
+                                                &rr->entries.l2[i]);
+                                break;
+                        default:
+                                WARN_ON_ONCE(1);
+                                rc = -EIO;
+                                goto out;
+                        }
+        } while (rr->response.code == 0x0107 ||  /* channel busy */
+                  (rr->response.code == 1 && /* list stored */
+                   /* resume token is non-zero => list incomplete */
+                   (rr->naihdr.resume_token.t1 || rr->naihdr.resume_token.t2)));
+        (*response) = rr->response.code;
+
+out:
+        free_page((unsigned long)rr);
+        return rc;
+}
+EXPORT_SYMBOL_GPL(qdio_pnso_brinfo);
+
 static int __init init_QDIO(void)
 {
         int rc;
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 02300dcfac91..ab3baa7f9508 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -591,7 +591,13 @@ static int ap_init_queue(ap_qid_t qid)
                 if (rc != -ENODEV && rc != -EBUSY)
                         break;
                 if (i < AP_MAX_RESET - 1) {
-                        udelay(5);
+                        /* Time we are waiting until we give up (0.7sec * 90).
+                         * Since the actual request (in progress) will not
+                         * interrupted immediately for the reset command,
+                         * we have to be patient. In worst case we have to
+                         * wait 60sec + reset time (some msec).
+                         */
+                        schedule_timeout(AP_RESET_TIMEOUT);
                         status = ap_test_queue(qid, &dummy, &dummy);
                 }
         }
@@ -992,6 +998,28 @@ static ssize_t ap_domain_show(struct bus_type *bus, char *buf)
 
 static BUS_ATTR(ap_domain, 0444, ap_domain_show, NULL);
 
+static ssize_t ap_control_domain_mask_show(struct bus_type *bus, char *buf)
+{
+        if (ap_configuration != NULL) { /* QCI not supported */
+                if (test_facility(76)) { /* format 1 - 256 bit domain field */
+                        return snprintf(buf, PAGE_SIZE,
+                                "0x%08x%08x%08x%08x%08x%08x%08x%08x\n",
+                        ap_configuration->adm[0], ap_configuration->adm[1],
+                        ap_configuration->adm[2], ap_configuration->adm[3],
+                        ap_configuration->adm[4], ap_configuration->adm[5],
+                        ap_configuration->adm[6], ap_configuration->adm[7]);
+                } else { /* format 0 - 16 bit domain field */
+                        return snprintf(buf, PAGE_SIZE, "%08x%08x\n",
+                        ap_configuration->adm[0], ap_configuration->adm[1]);
+                  }
+        } else {
+                return snprintf(buf, PAGE_SIZE, "not supported\n");
+          }
+}
+
+static BUS_ATTR(ap_control_domain_mask, 0444,
+                ap_control_domain_mask_show, NULL);
+
 static ssize_t ap_config_time_show(struct bus_type *bus, char *buf)
 {
         return snprintf(buf, PAGE_SIZE, "%d\n", ap_config_time);
@@ -1077,6 +1105,7 @@ static BUS_ATTR(poll_timeout, 0644, poll_timeout_show, poll_timeout_store);
 
 static struct bus_attribute *const ap_bus_attrs[] = {
         &bus_attr_ap_domain,
+        &bus_attr_ap_control_domain_mask,
         &bus_attr_config_time,
         &bus_attr_poll_thread,
         &bus_attr_ap_interrupts,
diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
index 685f6cc022f9..6405ae24a7a6 100644
--- a/drivers/s390/crypto/ap_bus.h
+++ b/drivers/s390/crypto/ap_bus.h
@@ -33,7 +33,7 @@
 #define AP_DEVICES 64           /* Number of AP devices. */
 #define AP_DOMAINS 16           /* Number of AP domains. */
 #define AP_MAX_RESET 90         /* Maximum number of resets. */
-#define AP_RESET_TIMEOUT (HZ/2) /* Time in ticks for reset timeouts. */
+#define AP_RESET_TIMEOUT (HZ*0.7)       /* Time in ticks for reset timeouts. */
 #define AP_CONFIG_TIME 30       /* Time in seconds between AP bus rescans. */
 #define AP_POLL_TIME 1          /* Time in ticks between receive polls. */
 
@@ -125,6 +125,8 @@ static inline int ap_test_bit(unsigned int *ptr, unsigned int nr)
 #define AP_FUNC_CRT4K 2
 #define AP_FUNC_COPRO 3
 #define AP_FUNC_ACCEL 4
+#define AP_FUNC_EP11  5
+#define AP_FUNC_APXA  6
 
 /*
  * AP reset flag states
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 31cfaa556072..4b824b15194f 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -44,6 +44,8 @@
 #include "zcrypt_debug.h"
 #include "zcrypt_api.h"
 
+#include "zcrypt_msgtype6.h"
+
 /*
  * Module description.
  */
@@ -554,9 +556,9 @@ static long zcrypt_send_cprb(struct ica_xcRB *xcRB)
         spin_lock_bh(&zcrypt_device_lock);
         list_for_each_entry(zdev, &zcrypt_device_list, list) {
                 if (!zdev->online || !zdev->ops->send_cprb ||
-                    (xcRB->user_defined != AUTOSELECT &&
-                        AP_QID_DEVICE(zdev->ap_dev->qid) != xcRB->user_defined)
-                    )
+                   (zdev->ops->variant == MSGTYPE06_VARIANT_EP11) ||
+                   (xcRB->user_defined != AUTOSELECT &&
+                    AP_QID_DEVICE(zdev->ap_dev->qid) != xcRB->user_defined))
                         continue;
                 zcrypt_device_get(zdev);
                 get_device(&zdev->ap_dev->device);
@@ -581,6 +583,90 @@ static long zcrypt_send_cprb(struct ica_xcRB *xcRB)
         return -ENODEV;
 }
 
+struct ep11_target_dev_list {
+        unsigned short          targets_num;
+        struct ep11_target_dev  *targets;
+};
+
+static bool is_desired_ep11dev(unsigned int dev_qid,
+                               struct ep11_target_dev_list dev_list)
+{
+        int n;
+
+        for (n = 0; n < dev_list.targets_num; n++, dev_list.targets++) {
+                if ((AP_QID_DEVICE(dev_qid) == dev_list.targets->ap_id) &&
+                    (AP_QID_QUEUE(dev_qid) == dev_list.targets->dom_id)) {
+                        return true;
+                }
+        }
+        return false;
+}
+
+static long zcrypt_send_ep11_cprb(struct ep11_urb *xcrb)
+{
+        struct zcrypt_device *zdev;
+        bool autoselect = false;
+        int rc;
+        struct ep11_target_dev_list ep11_dev_list = {
+                .targets_num    =  0x00,
+                .targets        =  NULL,
+        };
+
+        ep11_dev_list.targets_num = (unsigned short) xcrb->targets_num;
+
+        /* empty list indicates autoselect (all available targets) */
+        if (ep11_dev_list.targets_num == 0)
+                autoselect = true;
+        else {
+                ep11_dev_list.targets = kcalloc((unsigned short)
+                                                xcrb->targets_num,
+                                                sizeof(struct ep11_target_dev),
+                                                GFP_KERNEL);
+                if (!ep11_dev_list.targets)
+                        return -ENOMEM;
+
+                if (copy_from_user(ep11_dev_list.targets,
+                                   (struct ep11_target_dev *)xcrb->targets,
+                                   xcrb->targets_num *
+                                   sizeof(struct ep11_target_dev)))
+                        return -EFAULT;
+        }
+
+        spin_lock_bh(&zcrypt_device_lock);
+        list_for_each_entry(zdev, &zcrypt_device_list, list) {
+                /* check if device is eligible */
+                if (!zdev->online ||
+                    zdev->ops->variant != MSGTYPE06_VARIANT_EP11)
+                        continue;
+
+                /* check if device is selected as valid target */
+                if (!is_desired_ep11dev(zdev->ap_dev->qid, ep11_dev_list) &&
+                    !autoselect)
+                        continue;
+
+                zcrypt_device_get(zdev);
+                get_device(&zdev->ap_dev->device);
+                zdev->request_count++;
+                __zcrypt_decrease_preference(zdev);
+                if (try_module_get(zdev->ap_dev->drv->driver.owner)) {
+                        spin_unlock_bh(&zcrypt_device_lock);
+                        rc = zdev->ops->send_ep11_cprb(zdev, xcrb);
+                        spin_lock_bh(&zcrypt_device_lock);
+                        module_put(zdev->ap_dev->drv->driver.owner);
+                } else {
+                        rc = -EAGAIN;
+                  }
+                zdev->request_count--;
+                __zcrypt_increase_preference(zdev);
+                put_device(&zdev->ap_dev->device);
+                zcrypt_device_put(zdev);
+                spin_unlock_bh(&zcrypt_device_lock);
+                return rc;
+        }
+        spin_unlock_bh(&zcrypt_device_lock);
+        return -ENODEV;
+}
+
 static long zcrypt_rng(char *buffer)
 {
         struct zcrypt_device *zdev;
@@ -784,6 +870,23 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
                         return -EFAULT;
                 return rc;
         }
+        case ZSENDEP11CPRB: {
+                struct ep11_urb __user *uxcrb = (void __user *)arg;
+                struct ep11_urb xcrb;
+                if (copy_from_user(&xcrb, uxcrb, sizeof(xcrb)))
+                        return -EFAULT;
+                do {
+                        rc = zcrypt_send_ep11_cprb(&xcrb);
+                } while (rc == -EAGAIN);
+                /* on failure: retry once again after a requested rescan */
+                if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+                        do {
+                                rc = zcrypt_send_ep11_cprb(&xcrb);
+                        } while (rc == -EAGAIN);
+                if (copy_to_user(uxcrb, &xcrb, sizeof(xcrb)))
+                        return -EFAULT;
+                return rc;
+        }
         case Z90STAT_STATUS_MASK: {
                 char status[AP_DEVICES];
                 zcrypt_status_mask(status);
diff --git a/drivers/s390/crypto/zcrypt_api.h b/drivers/s390/crypto/zcrypt_api.h
index 89632919c993..b3d496bfaa7e 100644
--- a/drivers/s390/crypto/zcrypt_api.h
+++ b/drivers/s390/crypto/zcrypt_api.h
@@ -74,6 +74,7 @@ struct ica_z90_status {
 #define ZCRYPT_CEX2A            6
 #define ZCRYPT_CEX3C            7
 #define ZCRYPT_CEX3A            8
+#define ZCRYPT_CEX4            10
 
 /**
  * Large random numbers are pulled in 4096 byte chunks from the crypto cards
@@ -89,6 +90,7 @@ struct zcrypt_ops {
         long (*rsa_modexpo_crt)(struct zcrypt_device *,
                                 struct ica_rsa_modexpo_crt *);
         long (*send_cprb)(struct zcrypt_device *, struct ica_xcRB *);
+        long (*send_ep11_cprb)(struct zcrypt_device *, struct ep11_urb *);
         long (*rng)(struct zcrypt_device *, char *);
         struct list_head list;          /* zcrypt ops list. */
         struct module *owner;
diff --git a/drivers/s390/crypto/zcrypt_cex4.c b/drivers/s390/crypto/zcrypt_cex4.c
index ce1226398ac9..569f8b1d86c0 100644
--- a/drivers/s390/crypto/zcrypt_cex4.c
+++ b/drivers/s390/crypto/zcrypt_cex4.c
@@ -30,7 +30,12 @@
 #define CEX4A_MAX_MESSAGE_SIZE  MSGTYPE50_CRB3_MAX_MSG_SIZE
 #define CEX4C_MAX_MESSAGE_SIZE  MSGTYPE06_MAX_MSG_SIZE
 
-#define CEX4_CLEANUP_TIME       (15*HZ)
+/* Waiting time for requests to be processed.
+ * Currently there are some types of request which are not deterministic.
+ * But the maximum time limit managed by the stomper code is set to 60sec.
+ * Hence we have to wait at least that time period.
+ */
+#define CEX4_CLEANUP_TIME       (61*HZ)
 
 static struct ap_device_id zcrypt_cex4_ids[] = {
         { AP_DEVICE(AP_DEVICE_TYPE_CEX4)  },
@@ -101,6 +106,19 @@ static int zcrypt_cex4_probe(struct ap_device *ap_dev)
                         zdev->speed_rating = CEX4C_SPEED_RATING;
                         zdev->ops = zcrypt_msgtype_request(MSGTYPE06_NAME,
                                                            MSGTYPE06_VARIANT_DEFAULT);
+                } else if (ap_test_bit(&ap_dev->functions, AP_FUNC_EP11)) {
+                        zdev = zcrypt_device_alloc(CEX4C_MAX_MESSAGE_SIZE);
+                        if (!zdev)
+                                return -ENOMEM;
+                        zdev->type_string = "CEX4P";
+                        zdev->user_space_type = ZCRYPT_CEX4;
+                        zdev->min_mod_size = CEX4C_MIN_MOD_SIZE;
+                        zdev->max_mod_size = CEX4C_MAX_MOD_SIZE;
+                        zdev->max_exp_bit_length = CEX4C_MAX_MOD_SIZE;
+                        zdev->short_crt = 0;
+                        zdev->speed_rating = CEX4C_SPEED_RATING;
+                        zdev->ops = zcrypt_msgtype_request(MSGTYPE06_NAME,
+                                                        MSGTYPE06_VARIANT_EP11);
                 }
                 break;
         }
diff --git a/drivers/s390/crypto/zcrypt_error.h b/drivers/s390/crypto/zcrypt_error.h
index 0079b6617211..7b23f43c7b08 100644
--- a/drivers/s390/crypto/zcrypt_error.h
+++ b/drivers/s390/crypto/zcrypt_error.h
@@ -106,15 +106,15 @@ static inline int convert_error(struct zcrypt_device *zdev,
         //   REP88_ERROR_MESSAGE_TYPE           // '20' CEX2A
                 /*
                  * To sent a message of the wrong type is a bug in the
-                 * device driver. Warn about it, disable the device
+                 * device driver. Send error msg, disable the device
                  * and then repeat the request.
                  */
-                WARN_ON(1);
                 atomic_set(&zcrypt_rescan_req, 1);
                 zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
                 ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
-                               zdev->ap_dev->qid,
-                               zdev->online, ehdr->reply_code);
+                        zdev->ap_dev->qid, zdev->online, ehdr->reply_code);
                 return -EAGAIN;
         case REP82_ERROR_TRANSPORT_FAIL:
         case REP82_ERROR_MACHINE_FAILURE:
@@ -122,15 +122,17 @@ static inline int convert_error(struct zcrypt_device *zdev,
                 /* If a card fails disable it and repeat the request. */
                 atomic_set(&zcrypt_rescan_req, 1);
                 zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
                 ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
-                               zdev->ap_dev->qid,
-                               zdev->online, ehdr->reply_code);
+                        zdev->ap_dev->qid, zdev->online, ehdr->reply_code);
                 return -EAGAIN;
         default:
                 zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
                 ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
-                               zdev->ap_dev->qid,
-                               zdev->online, ehdr->reply_code);
+                        zdev->ap_dev->qid, zdev->online, ehdr->reply_code);
                 return -EAGAIN; /* repeat the request on a different device. */
         }
 }
diff --git a/drivers/s390/crypto/zcrypt_msgtype50.c b/drivers/s390/crypto/zcrypt_msgtype50.c
index 7c522f338bda..334e282f255b 100644
--- a/drivers/s390/crypto/zcrypt_msgtype50.c
+++ b/drivers/s390/crypto/zcrypt_msgtype50.c
@@ -25,6 +25,9 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+#define KMSG_COMPONENT "zcrypt"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/init.h>
@@ -332,6 +335,11 @@ static int convert_type80(struct zcrypt_device *zdev,
         if (t80h->len < sizeof(*t80h) + outputdatalength) {
                 /* The result is too short, the CEX2A card may not do that.. */
                 zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
+                               zdev->ap_dev->qid, zdev->online, t80h->code);
+
                 return -EAGAIN; /* repeat the request on a different device. */
         }
         if (zdev->user_space_type == ZCRYPT_CEX2A)
@@ -359,6 +367,10 @@ static int convert_response(struct zcrypt_device *zdev,
                                       outputdata, outputdatalength);
         default: /* Unknown response type, this should NEVER EVER happen */
                 zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%dfail",
+                               zdev->ap_dev->qid, zdev->online);
                 return -EAGAIN; /* repeat the request on a different device. */
         }
 }
diff --git a/drivers/s390/crypto/zcrypt_msgtype6.c b/drivers/s390/crypto/zcrypt_msgtype6.c
index 7d97fa5a26d0..dc542e0a3055 100644
--- a/drivers/s390/crypto/zcrypt_msgtype6.c
+++ b/drivers/s390/crypto/zcrypt_msgtype6.c
@@ -25,6 +25,9 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+#define KMSG_COMPONENT "zcrypt"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/err.h>
@@ -50,6 +53,7 @@ struct response_type {
 };
 #define PCIXCC_RESPONSE_TYPE_ICA  0
 #define PCIXCC_RESPONSE_TYPE_XCRB 1
+#define PCIXCC_RESPONSE_TYPE_EP11 2
 
 MODULE_AUTHOR("IBM Corporation");
 MODULE_DESCRIPTION("Cryptographic Coprocessor (message type 6), " \
@@ -358,6 +362,91 @@ static int XCRB_msg_to_type6CPRB_msgX(struct zcrypt_device *zdev,
         return 0;
 }
 
+static int xcrb_msg_to_type6_ep11cprb_msgx(struct zcrypt_device *zdev,
+                                       struct ap_message *ap_msg,
+                                       struct ep11_urb *xcRB)
+{
+        unsigned int lfmt;
+
+        static struct type6_hdr static_type6_ep11_hdr = {
+                .type           =  0x06,
+                .rqid           = {0x00, 0x01},
+                .function_code  = {0x00, 0x00},
+                .agent_id[0]    =  0x58,        /* {'X'} */
+                .agent_id[1]    =  0x43,        /* {'C'} */
+                .offset1        =  0x00000058,
+        };
+
+        struct {
+                struct type6_hdr hdr;
+                struct ep11_cprb cprbx;
+                unsigned char   pld_tag;        /* fixed value 0x30 */
+                unsigned char   pld_lenfmt;     /* payload length format */
+        } __packed * msg = ap_msg->message;
+
+        struct pld_hdr {
+                unsigned char   func_tag;       /* fixed value 0x4 */
+                unsigned char   func_len;       /* fixed value 0x4 */
+                unsigned int    func_val;       /* function ID     */
+                unsigned char   dom_tag;        /* fixed value 0x4 */
+                unsigned char   dom_len;        /* fixed value 0x4 */
+                unsigned int    dom_val;        /* domain id       */
+        } __packed * payload_hdr;
+
+        /* length checks */
+        ap_msg->length = sizeof(struct type6_hdr) + xcRB->req_len;
+        if (CEIL4(xcRB->req_len) > MSGTYPE06_MAX_MSG_SIZE -
+                                   (sizeof(struct type6_hdr)))
+                return -EINVAL;
+
+        if (CEIL4(xcRB->resp_len) > MSGTYPE06_MAX_MSG_SIZE -
+                                    (sizeof(struct type86_fmt2_msg)))
+                return -EINVAL;
+
+        /* prepare type6 header */
+        msg->hdr = static_type6_ep11_hdr;
+        msg->hdr.ToCardLen1   = xcRB->req_len;
+        msg->hdr.FromCardLen1 = xcRB->resp_len;
+
+        /* Import CPRB data from the ioctl input parameter */
+        if (copy_from_user(&(msg->cprbx.cprb_len),
+                           (char *)xcRB->req, xcRB->req_len)) {
+                return -EFAULT;
+        }
+
+        /*
+         The target domain field within the cprb body/payload block will be
+         replaced by the usage domain for non-management commands only.
+         Therefore we check the first bit of the 'flags' parameter for
+         management command indication.
+           0 - non management command
+           1 - management command
+        */
+        if (!((msg->cprbx.flags & 0x80) == 0x80)) {
+                msg->cprbx.target_id = (unsigned int)
+                                        AP_QID_QUEUE(zdev->ap_dev->qid);
+
+                if ((msg->pld_lenfmt & 0x80) == 0x80) { /*ext.len.fmt 2 or 3*/
+                        switch (msg->pld_lenfmt & 0x03) {
+                        case 1:
+                                lfmt = 2;
+                                break;
+                        case 2:
+                                lfmt = 3;
+                                break;
+                        default:
+                                return -EINVAL;
+                        }
+                } else {
+                        lfmt = 1; /* length format #1 */
+                  }
+                payload_hdr = (struct pld_hdr *)((&(msg->pld_lenfmt))+lfmt);
+                payload_hdr->dom_val = (unsigned int)
+                                        AP_QID_QUEUE(zdev->ap_dev->qid);
+        }
+        return 0;
+}
+
 /**
  * Copy results from a type 86 ICA reply message back to user space.
  *
@@ -377,6 +466,12 @@ struct type86x_reply {
         char text[0];
 } __packed;
 
+struct type86_ep11_reply {
+        struct type86_hdr hdr;
+        struct type86_fmt2_ext fmt2;
+        struct ep11_cprb cprbx;
+} __packed;
+
 static int convert_type86_ica(struct zcrypt_device *zdev,
                           struct ap_message *reply,
                           char __user *outputdata,
@@ -440,6 +535,11 @@ static int convert_type86_ica(struct zcrypt_device *zdev,
                 if (service_rc == 8 && service_rs == 72)
                         return -EINVAL;
                 zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
+                               zdev->ap_dev->qid, zdev->online,
+                               msg->hdr.reply_code);
                 return -EAGAIN; /* repeat the request on a different device. */
         }
         data = msg->text;
@@ -503,6 +603,33 @@ static int convert_type86_xcrb(struct zcrypt_device *zdev,
         return 0;
 }
 
+/**
+ * Copy results from a type 86 EP11 XCRB reply message back to user space.
+ *
+ * @zdev: crypto device pointer
+ * @reply: reply AP message.
+ * @xcRB: pointer to EP11 user request block
+ *
+ * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
+ */
+static int convert_type86_ep11_xcrb(struct zcrypt_device *zdev,
+                                    struct ap_message *reply,
+                                    struct ep11_urb *xcRB)
+{
+        struct type86_fmt2_msg *msg = reply->message;
+        char *data = reply->message;
+
+        if (xcRB->resp_len < msg->fmt2.count1)
+                return -EINVAL;
+
+        /* Copy response CPRB to user */
+        if (copy_to_user((char *)xcRB->resp,
+                         data + msg->fmt2.offset1, msg->fmt2.count1))
+                return -EFAULT;
+        xcRB->resp_len = msg->fmt2.count1;
+        return 0;
+}
+
 static int convert_type86_rng(struct zcrypt_device *zdev,
                           struct ap_message *reply,
                           char *buffer)
@@ -551,6 +678,10 @@ static int convert_response_ica(struct zcrypt_device *zdev,
                  * response */
         default: /* Unknown response type, this should NEVER EVER happen */
                 zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%dfail",
+                               zdev->ap_dev->qid, zdev->online);
                 return -EAGAIN; /* repeat the request on a different device. */
         }
 }
@@ -579,10 +710,40 @@ static int convert_response_xcrb(struct zcrypt_device *zdev,
         default: /* Unknown response type, this should NEVER EVER happen */
                 xcRB->status = 0x0008044DL; /* HDD_InvalidParm */
                 zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%dfail",
+                               zdev->ap_dev->qid, zdev->online);
                 return -EAGAIN; /* repeat the request on a different device. */
         }
 }
 
+static int convert_response_ep11_xcrb(struct zcrypt_device *zdev,
+        struct ap_message *reply, struct ep11_urb *xcRB)
+{
+        struct type86_ep11_reply *msg = reply->message;
+
+        /* Response type byte is the second byte in the response. */
+        switch (((unsigned char *)reply->message)[1]) {
+        case TYPE82_RSP_CODE:
+        case TYPE87_RSP_CODE:
+                return convert_error(zdev, reply);
+        case TYPE86_RSP_CODE:
+                if (msg->hdr.reply_code)
+                        return convert_error(zdev, reply);
+                if (msg->cprbx.cprb_ver_id == 0x04)
+                        return convert_type86_ep11_xcrb(zdev, reply, xcRB);
+        /* Fall through, no break, incorrect cprb version is an unknown resp.*/
+        default: /* Unknown response type, this should NEVER EVER happen */
+                zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%dfail",
+                               zdev->ap_dev->qid, zdev->online);
+                return -EAGAIN; /* repeat the request on a different device. */
+        }
+}
+
 static int convert_response_rng(struct zcrypt_device *zdev,
                                  struct ap_message *reply,
                                  char *data)
@@ -602,6 +763,10 @@ static int convert_response_rng(struct zcrypt_device *zdev,
                  * response */
         default: /* Unknown response type, this should NEVER EVER happen */
                 zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%dfail",
+                               zdev->ap_dev->qid, zdev->online);
                 return -EAGAIN; /* repeat the request on a different device. */
         }
 }
@@ -657,6 +822,51 @@ out:
         complete(&(resp_type->work));
 }
 
+/**
+ * This function is called from the AP bus code after a crypto request
+ * "msg" has finished with the reply message "reply".
+ * It is called from tasklet context.
+ * @ap_dev: pointer to the AP device
+ * @msg: pointer to the AP message
+ * @reply: pointer to the AP reply message
+ */
+static void zcrypt_msgtype6_receive_ep11(struct ap_device *ap_dev,
+                                         struct ap_message *msg,
+                                         struct ap_message *reply)
+{
+        static struct error_hdr error_reply = {
+                .type = TYPE82_RSP_CODE,
+                .reply_code = REP82_ERROR_MACHINE_FAILURE,
+        };
+        struct response_type *resp_type =
+                (struct response_type *)msg->private;
+        struct type86_ep11_reply *t86r;
+        int length;
+
+        /* Copy the reply message to the request message buffer. */
+        if (IS_ERR(reply)) {
+                memcpy(msg->message, &error_reply, sizeof(error_reply));
+                goto out;
+        }
+        t86r = reply->message;
+        if (t86r->hdr.type == TYPE86_RSP_CODE &&
+            t86r->cprbx.cprb_ver_id == 0x04) {
+                switch (resp_type->type) {
+                case PCIXCC_RESPONSE_TYPE_EP11:
+                        length = t86r->fmt2.offset1 + t86r->fmt2.count1;
+                        length = min(MSGTYPE06_MAX_MSG_SIZE, length);
+                        memcpy(msg->message, reply->message, length);
+                        break;
+                default:
+                        memcpy(msg->message, &error_reply, sizeof(error_reply));
+                }
+        } else {
+                memcpy(msg->message, reply->message, sizeof(error_reply));
+          }
+out:
+        complete(&(resp_type->work));
+}
+
 static atomic_t zcrypt_step = ATOMIC_INIT(0);
 
 /**
@@ -782,6 +992,46 @@ out_free:
 }
 
 /**
+ * The request distributor calls this function if it picked the CEX4P
+ * device to handle a send_ep11_cprb request.
+ * @zdev: pointer to zcrypt_device structure that identifies the
+ *        CEX4P device to the request distributor
+ * @xcRB: pointer to the ep11 user request block
+ */
+static long zcrypt_msgtype6_send_ep11_cprb(struct zcrypt_device *zdev,
+                                                struct ep11_urb *xcrb)
+{
+        struct ap_message ap_msg;
+        struct response_type resp_type = {
+                .type = PCIXCC_RESPONSE_TYPE_EP11,
+        };
+        int rc;
+
+        ap_init_message(&ap_msg);
+        ap_msg.message = kmalloc(MSGTYPE06_MAX_MSG_SIZE, GFP_KERNEL);
+        if (!ap_msg.message)
+                return -ENOMEM;
+        ap_msg.receive = zcrypt_msgtype6_receive_ep11;
+        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
+                                atomic_inc_return(&zcrypt_step);
+        ap_msg.private = &resp_type;
+        rc = xcrb_msg_to_type6_ep11cprb_msgx(zdev, &ap_msg, xcrb);
+        if (rc)
+                goto out_free;
+        init_completion(&resp_type.work);
+        ap_queue_message(zdev->ap_dev, &ap_msg);
+        rc = wait_for_completion_interruptible(&resp_type.work);
+        if (rc == 0)
+                rc = convert_response_ep11_xcrb(zdev, &ap_msg, xcrb);
+        else /* Signal pending. */
+                ap_cancel_message(zdev->ap_dev, &ap_msg);
+
+out_free:
+        kzfree(ap_msg.message);
+        return rc;
+}
+
+/**
  * The request distributor calls this function if it picked the PCIXCC/CEX2C
  * device to generate random data.
  * @zdev: pointer to zcrypt_device structure that identifies the
@@ -839,10 +1089,19 @@ static struct zcrypt_ops zcrypt_msgtype6_ops = {
         .rng = zcrypt_msgtype6_rng,
 };
 
+static struct zcrypt_ops zcrypt_msgtype6_ep11_ops = {
+        .owner = THIS_MODULE,
+        .variant = MSGTYPE06_VARIANT_EP11,
+        .rsa_modexpo = NULL,
+        .rsa_modexpo_crt = NULL,
+        .send_ep11_cprb = zcrypt_msgtype6_send_ep11_cprb,
+};
+
 int __init zcrypt_msgtype6_init(void)
 {
         zcrypt_msgtype_register(&zcrypt_msgtype6_norng_ops);
         zcrypt_msgtype_register(&zcrypt_msgtype6_ops);
+        zcrypt_msgtype_register(&zcrypt_msgtype6_ep11_ops);
         return 0;
 }
 
@@ -850,6 +1109,7 @@ void __exit zcrypt_msgtype6_exit(void)
 {
         zcrypt_msgtype_unregister(&zcrypt_msgtype6_norng_ops);
         zcrypt_msgtype_unregister(&zcrypt_msgtype6_ops);
+        zcrypt_msgtype_unregister(&zcrypt_msgtype6_ep11_ops);
 }
 
 module_init(zcrypt_msgtype6_init);
diff --git a/drivers/s390/crypto/zcrypt_msgtype6.h b/drivers/s390/crypto/zcrypt_msgtype6.h
index 1e500d3c0735..207247570623 100644
--- a/drivers/s390/crypto/zcrypt_msgtype6.h
+++ b/drivers/s390/crypto/zcrypt_msgtype6.h
@@ -32,6 +32,7 @@
 #define MSGTYPE06_NAME                  "zcrypt_msgtype6"
 #define MSGTYPE06_VARIANT_DEFAULT       0
 #define MSGTYPE06_VARIANT_NORNG         1
+#define MSGTYPE06_VARIANT_EP11          2
 
 #define MSGTYPE06_MAX_MSG_SIZE          (12*1024)
 
@@ -99,6 +100,7 @@ struct type86_hdr {
 } __packed;
 
 #define TYPE86_RSP_CODE 0x86
+#define TYPE87_RSP_CODE 0x87
 #define TYPE86_FMT2     0x02
 
 struct type86_fmt2_ext {
diff --git a/drivers/s390/crypto/zcrypt_pcica.c b/drivers/s390/crypto/zcrypt_pcica.c
index f2b71d8df01f..7a743f4c646c 100644
--- a/drivers/s390/crypto/zcrypt_pcica.c
+++ b/drivers/s390/crypto/zcrypt_pcica.c
@@ -24,6 +24,9 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+#define KMSG_COMPONENT "zcrypt"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/init.h>
@@ -199,6 +202,10 @@ static int convert_type84(struct zcrypt_device *zdev,
         if (t84h->len < sizeof(*t84h) + outputdatalength) {
                 /* The result is too short, the PCICA card may not do that.. */
                 zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
+                               zdev->ap_dev->qid, zdev->online, t84h->code);
                 return -EAGAIN; /* repeat the request on a different device. */
         }
         BUG_ON(t84h->len > PCICA_MAX_RESPONSE_SIZE);
@@ -223,6 +230,10 @@ static int convert_response(struct zcrypt_device *zdev,
                                       outputdata, outputdatalength);
         default: /* Unknown response type, this should NEVER EVER happen */
                 zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%dfail",
+                               zdev->ap_dev->qid, zdev->online);
                 return -EAGAIN; /* repeat the request on a different device. */
         }
 }
diff --git a/drivers/s390/crypto/zcrypt_pcicc.c b/drivers/s390/crypto/zcrypt_pcicc.c
index 0d90a4334055..4d14c04b746e 100644
--- a/drivers/s390/crypto/zcrypt_pcicc.c
+++ b/drivers/s390/crypto/zcrypt_pcicc.c
@@ -24,6 +24,9 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+#define KMSG_COMPONENT "zcrypt"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/gfp.h>
@@ -372,6 +375,11 @@ static int convert_type86(struct zcrypt_device *zdev,
                 if (service_rc == 8 && service_rs == 72)
                         return -EINVAL;
                 zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
+                               zdev->ap_dev->qid, zdev->online,
+                               msg->hdr.reply_code);
                 return -EAGAIN; /* repeat the request on a different device. */
         }
         data = msg->text;
@@ -425,6 +433,10 @@ static int convert_response(struct zcrypt_device *zdev,
                 /* no break, incorrect cprb version is an unknown response */
         default: /* Unknown response type, this should NEVER EVER happen */
                 zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%dfail",
+                               zdev->ap_dev->qid, zdev->online);
                 return -EAGAIN; /* repeat the request on a different device. */
         }
 }