119 files changed, 7415 insertions, 2185 deletions

diff --git a/arch/s390/Kbuild b/arch/s390/Kbuild
index 9858476fa0fe..cc45d25487b0 100644
--- a/arch/s390/Kbuild
+++ b/arch/s390/Kbuild
@@ -5,3 +5,4 @@ obj-$(CONFIG_CRYPTO_HW)		+= crypto/
 obj-$(CONFIG_S390_HYPFS_FS)     += hypfs/
 obj-$(CONFIG_APPLDATA_BASE)     += appldata/
 obj-$(CONFIG_MATHEMU)           += math-emu/
+obj-y                           += net/
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index f5ab543396da..f9acddd9ace3 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -52,6 +52,12 @@ config PGSTE
 config ARCH_SUPPORTS_DEBUG_PAGEALLOC
         def_bool y
 
+config KEXEC
+        def_bool y
+
+config AUDIT_ARCH
+        def_bool y
+
 config S390
         def_bool y
         select USE_GENERIC_SMP_HELPERS if SMP
@@ -81,11 +87,13 @@ config S390
         select HAVE_KERNEL_XZ
         select HAVE_ARCH_MUTEX_CPU_RELAX
         select HAVE_ARCH_JUMP_LABEL if !MARCH_G5
+        select HAVE_BPF_JIT if 64BIT && PACK_STACK
         select ARCH_SAVE_PAGE_KEYS if HIBERNATION
         select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
         select HAVE_MEMBLOCK
         select HAVE_MEMBLOCK_NODE_MAP
         select HAVE_CMPXCHG_LOCAL
+        select HAVE_CMPXCHG_DOUBLE
         select HAVE_VIRT_CPU_ACCOUNTING
         select VIRT_CPU_ACCOUNTING
         select ARCH_DISCARD_MEMBLOCK
@@ -132,9 +140,79 @@ source "init/Kconfig"
 
 source "kernel/Kconfig.freezer"
 
-menu "Base setup"
+menu "Processor type and features"
+
+config HAVE_MARCH_Z900_FEATURES
+        def_bool n
+
+config HAVE_MARCH_Z990_FEATURES
+        def_bool n
+        select HAVE_MARCH_Z900_FEATURES
+
+config HAVE_MARCH_Z9_109_FEATURES
+        def_bool n
+        select HAVE_MARCH_Z990_FEATURES
+
+config HAVE_MARCH_Z10_FEATURES
+        def_bool n
+        select HAVE_MARCH_Z9_109_FEATURES
+
+config HAVE_MARCH_Z196_FEATURES
+        def_bool n
+        select HAVE_MARCH_Z10_FEATURES
+
+choice
+        prompt "Processor type"
+        default MARCH_G5
+
+config MARCH_G5
+        bool "System/390 model G5 and G6"
+        depends on !64BIT
+        help
+          Select this to build a 31 bit kernel that works
+          on all ESA/390 and z/Architecture machines.
 
-comment "Processor type and features"
+config MARCH_Z900
+        bool "IBM zSeries model z800 and z900"
+        select HAVE_MARCH_Z900_FEATURES if 64BIT
+        help
+          Select this to enable optimizations for model z800/z900 (2064 and
+          2066 series). This will enable some optimizations that are not
+          available on older ESA/390 (31 Bit) only CPUs.
+
+config MARCH_Z990
+        bool "IBM zSeries model z890 and z990"
+        select HAVE_MARCH_Z990_FEATURES if 64BIT
+        help
+          Select this to enable optimizations for model z890/z990 (2084 and
+          2086 series). The kernel will be slightly faster but will not work
+          on older machines.
+
+config MARCH_Z9_109
+        bool "IBM System z9"
+        select HAVE_MARCH_Z9_109_FEATURES if 64BIT
+        help
+          Select this to enable optimizations for IBM System z9 (2094 and
+          2096 series). The kernel will be slightly faster but will not work
+          on older machines.
+
+config MARCH_Z10
+        bool "IBM System z10"
+        select HAVE_MARCH_Z10_FEATURES if 64BIT
+        help
+          Select this to enable optimizations for IBM System z10 (2097 and
+          2098 series). The kernel will be slightly faster but will not work
+          on older machines.
+
+config MARCH_Z196
+        bool "IBM zEnterprise 114 and 196"
+        select HAVE_MARCH_Z196_FEATURES if 64BIT
+        help
+          Select this to enable optimizations for IBM zEnterprise 114 and 196
+          (2818 and 2817 series). The kernel will be slightly faster but will
+          not work on older machines.
+
+endchoice
 
 config 64BIT
         def_bool y
@@ -146,6 +224,24 @@ config 64BIT
 config 32BIT
         def_bool y if !64BIT
 
+config COMPAT
+        def_bool y
+        prompt "Kernel support for 31 bit emulation"
+        depends on 64BIT
+        select COMPAT_BINFMT_ELF if BINFMT_ELF
+        select ARCH_WANT_OLD_COMPAT_IPC
+        help
+          Select this option if you want to enable your system kernel to
+          handle system-calls from ELF binaries for 31 bit ESA.  This option
+          (and some other stuff like libraries and such) is needed for
+          executing 31 bit applications.  It is safe to say "Y".
+
+config SYSVIPC_COMPAT
+        def_bool y if COMPAT && SYSVIPC
+
+config KEYS_COMPAT
+        def_bool y if COMPAT && KEYS
+
 config SMP
         def_bool y
         prompt "Symmetric multi-processing support"
@@ -201,6 +297,8 @@ config SCHED_BOOK
           Book scheduler support improves the CPU scheduler's decision making
           when dealing with machines that have several books.
 
+source kernel/Kconfig.preempt
+
 config MATHEMU
         def_bool y
         prompt "IEEE FPU emulation"
@@ -210,100 +308,35 @@ config MATHEMU
           on older ESA/390 machines. Say Y unless you know your machine doesn't
           need this.
 
-config COMPAT
-        def_bool y
-        prompt "Kernel support for 31 bit emulation"
-        depends on 64BIT
-        select COMPAT_BINFMT_ELF if BINFMT_ELF
-        select ARCH_WANT_OLD_COMPAT_IPC
-        help
-          Select this option if you want to enable your system kernel to
-          handle system-calls from ELF binaries for 31 bit ESA.  This option
-          (and some other stuff like libraries and such) is needed for
-          executing 31 bit applications.  It is safe to say "Y".
+source kernel/Kconfig.hz
 
-config SYSVIPC_COMPAT
-        def_bool y if COMPAT && SYSVIPC
+endmenu
 
-config KEYS_COMPAT
-        def_bool y if COMPAT && KEYS
+menu "Memory setup"
 
-config AUDIT_ARCH
+config ARCH_SPARSEMEM_ENABLE
         def_bool y
+        select SPARSEMEM_VMEMMAP_ENABLE
+        select SPARSEMEM_VMEMMAP
+        select SPARSEMEM_STATIC if !64BIT
 
-config HAVE_MARCH_Z900_FEATURES
-        def_bool n
-
-config HAVE_MARCH_Z990_FEATURES
-        def_bool n
-        select HAVE_MARCH_Z900_FEATURES
-
-config HAVE_MARCH_Z9_109_FEATURES
-        def_bool n
-        select HAVE_MARCH_Z990_FEATURES
-
-config HAVE_MARCH_Z10_FEATURES
-        def_bool n
-        select HAVE_MARCH_Z9_109_FEATURES
-
-config HAVE_MARCH_Z196_FEATURES
-        def_bool n
-        select HAVE_MARCH_Z10_FEATURES
-
-comment "Code generation options"
-
-choice
-        prompt "Processor type"
-        default MARCH_G5
-
-config MARCH_G5
-        bool "System/390 model G5 and G6"
-        depends on !64BIT
-        help
-          Select this to build a 31 bit kernel that works
-          on all ESA/390 and z/Architecture machines.
-
-config MARCH_Z900
-        bool "IBM zSeries model z800 and z900"
-        select HAVE_MARCH_Z900_FEATURES if 64BIT
-        help
-          Select this to enable optimizations for model z800/z900 (2064 and
-          2066 series). This will enable some optimizations that are not
-          available on older ESA/390 (31 Bit) only CPUs.
+config ARCH_SPARSEMEM_DEFAULT
+        def_bool y
 
-config MARCH_Z990
-        bool "IBM zSeries model z890 and z990"
-        select HAVE_MARCH_Z990_FEATURES if 64BIT
-        help
-          Select this to enable optimizations for model z890/z990 (2084 and
-          2086 series). The kernel will be slightly faster but will not work
-          on older machines.
+config ARCH_SELECT_MEMORY_MODEL
+        def_bool y
 
-config MARCH_Z9_109
-        bool "IBM System z9"
-        select HAVE_MARCH_Z9_109_FEATURES if 64BIT
-        help
-          Select this to enable optimizations for IBM System z9 (2094 and
-          2096 series). The kernel will be slightly faster but will not work
-          on older machines.
+config ARCH_ENABLE_MEMORY_HOTPLUG
+        def_bool y if SPARSEMEM
 
-config MARCH_Z10
-        bool "IBM System z10"
-        select HAVE_MARCH_Z10_FEATURES if 64BIT
-        help
-          Select this to enable optimizations for IBM System z10 (2097 and
-          2098 series). The kernel will be slightly faster but will not work
-          on older machines.
+config ARCH_ENABLE_MEMORY_HOTREMOVE
+        def_bool y
 
-config MARCH_Z196
-        bool "IBM zEnterprise 114 and 196"
-        select HAVE_MARCH_Z196_FEATURES if 64BIT
-        help
-          Select this to enable optimizations for IBM zEnterprise 114 and 196
-          (2818 and 2817 series). The kernel will be slightly faster but will
-          not work on older machines.
+config FORCE_MAX_ZONEORDER
+        int
+        default "9"
 
-endchoice
+source "mm/Kconfig"
 
 config PACK_STACK
         def_bool y
@@ -367,34 +400,9 @@ config WARN_DYNAMIC_STACK
 
           Say N if you are unsure.
 
-comment "Kernel preemption"
-
-source "kernel/Kconfig.preempt"
-
-config ARCH_SPARSEMEM_ENABLE
-        def_bool y
-        select SPARSEMEM_VMEMMAP_ENABLE
-        select SPARSEMEM_VMEMMAP
-        select SPARSEMEM_STATIC if !64BIT
-
-config ARCH_SPARSEMEM_DEFAULT
-        def_bool y
-
-config ARCH_SELECT_MEMORY_MODEL
-        def_bool y
-
-config ARCH_ENABLE_MEMORY_HOTPLUG
-        def_bool y if SPARSEMEM
-
-config ARCH_ENABLE_MEMORY_HOTREMOVE
-        def_bool y
-
-config ARCH_HIBERNATION_POSSIBLE
-        def_bool y if 64BIT
-
-source "mm/Kconfig"
+endmenu
 
-comment "I/O subsystem configuration"
+menu "I/O subsystem"
 
 config QDIO
         def_tristate y
@@ -425,13 +433,102 @@ config CHSC_SCH
 
           If unsure, say N.
 
-comment "Misc"
+config SCM_BUS
+        def_bool y
+        depends on 64BIT
+        prompt "SCM bus driver"
+        help
+          Bus driver for Storage Class Memory.
+
+config EADM_SCH
+        def_tristate m
+        prompt "Support for EADM subchannels"
+        depends on SCM_BUS
+        help
+          This driver allows usage of EADM subchannels. EADM subchannels act
+          as a communication vehicle for SCM increments.
+
+          To compile this driver as a module, choose M here: the
+          module will be called eadm_sch.
+
+endmenu
+
+menu "Dump support"
+
+config CRASH_DUMP
+        bool "kernel crash dumps"
+        depends on 64BIT && SMP
+        select KEXEC
+        help
+          Generate crash dump after being started by kexec.
+          Crash dump kernels are loaded in the main kernel with kexec-tools
+          into a specially reserved region and then later executed after
+          a crash by kdump/kexec.
+          For more details see Documentation/kdump/kdump.txt
+
+config ZFCPDUMP
+        def_bool n
+        prompt "zfcpdump support"
+        select SMP
+        help
+          Select this option if you want to build an zfcpdump enabled kernel.
+          Refer to <file:Documentation/s390/zfcpdump.txt> for more details on this.
+
+endmenu
+
+menu "Executable file formats / Emulations"
 
 source "fs/Kconfig.binfmt"
 
-config FORCE_MAX_ZONEORDER
-        int
-        default "9"
+config SECCOMP
+        def_bool y
+        prompt "Enable seccomp to safely compute untrusted bytecode"
+        depends on PROC_FS
+        help
+          This kernel feature is useful for number crunching applications
+          that may need to compute untrusted bytecode during their
+          execution. By using pipes or other transports made available to
+          the process as file descriptors supporting the read/write
+          syscalls, it's possible to isolate those applications in
+          their own address space using seccomp. Once seccomp is
+          enabled via /proc/<pid>/seccomp, it cannot be disabled
+          and the task is only allowed to execute a few safe syscalls
+          defined by each seccomp mode.
+
+          If unsure, say Y.
+
+endmenu
+
+menu "Power Management"
+
+config ARCH_HIBERNATION_POSSIBLE
+        def_bool y if 64BIT
+
+source "kernel/power/Kconfig"
+
+endmenu
+
+source "net/Kconfig"
+
+config PCMCIA
+        def_bool n
+
+config CCW
+        def_bool y
+
+source "drivers/Kconfig"
+
+source "fs/Kconfig"
+
+source "arch/s390/Kconfig.debug"
+
+source "security/Kconfig"
+
+source "crypto/Kconfig"
+
+source "lib/Kconfig"
+
+menu "Virtualization"
 
 config PFAULT
         def_bool y
@@ -447,8 +544,8 @@ config PFAULT
           this option.
 
 config SHARED_KERNEL
-        def_bool y
-        prompt "VM shared kernel support"
+        bool "VM shared kernel support"
+        depends on !JUMP_LABEL
         help
           Select this option, if you want to share the text segment of the
           Linux kernel between different VM guests. This reduces memory
@@ -543,8 +640,6 @@ config APPLDATA_NET_SUM
           This can also be compiled as a module, which will be called
           appldata_net_sum.o.
 
-source kernel/Kconfig.hz
-
 config S390_HYPFS_FS
         def_bool y
         prompt "s390 hypervisor file system support"
@@ -553,90 +648,21 @@ config S390_HYPFS_FS
           This is a virtual file system intended to provide accounting
           information in an s390 hypervisor environment.
 
-config KEXEC
-        def_bool n
-        prompt "kexec system call"
-        help
-          kexec is a system call that implements the ability to shutdown your
-          current kernel, and to start another kernel.  It is like a reboot
-          but is independent of hardware/microcode support.
-
-config CRASH_DUMP
-        bool "kernel crash dumps"
-        depends on 64BIT && SMP
-        select KEXEC
-        help
-          Generate crash dump after being started by kexec.
-          Crash dump kernels are loaded in the main kernel with kexec-tools
-          into a specially reserved region and then later executed after
-          a crash by kdump/kexec.
-          For more details see Documentation/kdump/kdump.txt
-
-config ZFCPDUMP
-        def_bool n
-        prompt "zfcpdump support"
-        select SMP
-        help
-          Select this option if you want to build an zfcpdump enabled kernel.
-          Refer to <file:Documentation/s390/zfcpdump.txt> for more details on this.
+source "arch/s390/kvm/Kconfig"
 
 config S390_GUEST
         def_bool y
-        prompt "s390 guest support for KVM (EXPERIMENTAL)"
+        prompt "s390 support for virtio devices (EXPERIMENTAL)"
         depends on 64BIT && EXPERIMENTAL
         select VIRTUALIZATION
         select VIRTIO
         select VIRTIO_RING
         select VIRTIO_CONSOLE
         help
-          Select this option if you want to run the kernel as a guest under
-          the KVM hypervisor. This will add detection for KVM as well  as a
-          virtio transport. If KVM is detected, the virtio console will be
-          the default console.
-
-config SECCOMP
-        def_bool y
-        prompt "Enable seccomp to safely compute untrusted bytecode"
-        depends on PROC_FS
-        help
-          This kernel feature is useful for number crunching applications
-          that may need to compute untrusted bytecode during their
-          execution. By using pipes or other transports made available to
-          the process as file descriptors supporting the read/write
-          syscalls, it's possible to isolate those applications in
-          their own address space using seccomp. Once seccomp is
-          enabled via /proc/<pid>/seccomp, it cannot be disabled
-          and the task is only allowed to execute a few safe syscalls
-          defined by each seccomp mode.
-
-          If unsure, say Y.
-
-endmenu
+          Enabling this option adds support for virtio based paravirtual device
+          drivers on s390.
 
-menu "Power Management"
-
-source "kernel/power/Kconfig"
+          Select this option if you want to run the kernel as a guest under
+          the KVM hypervisor.
 
 endmenu
-
-source "net/Kconfig"
-
-config PCMCIA
-        def_bool n
-
-config CCW
-        def_bool y
-
-source "drivers/Kconfig"
-
-source "fs/Kconfig"
-
-source "arch/s390/Kconfig.debug"
-
-source "security/Kconfig"
-
-source "crypto/Kconfig"
-
-source "lib/Kconfig"
-
-source "arch/s390/kvm/Kconfig"
diff --git a/arch/s390/boot/compressed/Makefile b/arch/s390/boot/compressed/Makefile
index 10e22c4ec4a7..3ad8f61c9985 100644
--- a/arch/s390/boot/compressed/Makefile
+++ b/arch/s390/boot/compressed/Makefile
@@ -11,6 +11,7 @@ targets	:= vmlinux.lds vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 \
            sizes.h head$(BITS).o
 
 KBUILD_CFLAGS := -m$(BITS) -D__KERNEL__ $(LINUX_INCLUDE) -O2
+KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
 KBUILD_CFLAGS += $(cflags-y)
 KBUILD_CFLAGS += $(call cc-option,-mpacked-stack)
 KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
diff --git a/arch/s390/boot/compressed/misc.c b/arch/s390/boot/compressed/misc.c
index 465eca756feb..c4c6a1cf221b 100644
--- a/arch/s390/boot/compressed/misc.c
+++ b/arch/s390/boot/compressed/misc.c
@@ -71,34 +71,37 @@ void *memset(void *s, int c, size_t n)
 {
         char *xs;
 
-        if (c == 0)
-                return __builtin_memset(s, 0, n);
-
-        xs = (char *) s;
-        if (n > 0)
-                do {
-                        *xs++ = c;
-                } while (--n > 0);
+        xs = s;
+        while (n--)
+                *xs++ = c;
         return s;
 }
 
-void *memcpy(void *__dest, __const void *__src, size_t __n)
+void *memcpy(void *dest, const void *src, size_t n)
 {
-        return __builtin_memcpy(__dest, __src, __n);
+        const char *s = src;
+        char *d = dest;
+
+        while (n--)
+                *d++ = *s++;
+        return dest;
 }
 
-void *memmove(void *__dest, __const void *__src, size_t __n)
+void *memmove(void *dest, const void *src, size_t n)
 {
-        char *d;
-        const char *s;
-
-        if (__dest <= __src)
-                return __builtin_memcpy(__dest, __src, __n);
-        d = __dest + __n;
-        s = __src + __n;
-        while (__n--)
-                *--d = *--s;
-        return __dest;
+        const char *s = src;
+        char *d = dest;
+
+        if (d <= s) {
+                while (n--)
+                        *d++ = *s++;
+        } else {
+                d += n;
+                s += n;
+                while (n--)
+                        *--d = *--s;
+        }
+        return dest;
 }
 
 static void error(char *x)
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index f39cd710980b..b74400e3e035 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -16,8 +16,8 @@ CONFIG_CGROUPS=y
 CONFIG_CPUSETS=y
 CONFIG_CGROUP_CPUACCT=y
 CONFIG_RESOURCE_COUNTERS=y
-CONFIG_CGROUP_MEMCG=y
-CONFIG_CGROUP_MEM_RES_CTLR_SWAP=y
+CONFIG_MEMCG=y
+CONFIG_MEMCG_SWAP=y
 CONFIG_CGROUP_SCHED=y
 CONFIG_RT_GROUP_SCHED=y
 CONFIG_BLK_CGROUP=y
@@ -32,20 +32,19 @@ CONFIG_EXPERT=y
 CONFIG_PROFILING=y
 CONFIG_OPROFILE=y
 CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
 CONFIG_DEFAULT_DEADLINE=y
-CONFIG_PREEMPT=y
+CONFIG_HZ_100=y
 CONFIG_MEMORY_HOTPLUG=y
 CONFIG_MEMORY_HOTREMOVE=y
 CONFIG_KSM=y
-CONFIG_BINFMT_MISC=m
-CONFIG_CMM=m
-CONFIG_HZ_100=y
 CONFIG_CRASH_DUMP=y
+CONFIG_BINFMT_MISC=m
 CONFIG_HIBERNATION=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
@@ -75,6 +74,7 @@ CONFIG_NET_CLS_RSVP=m
 CONFIG_NET_CLS_RSVP6=m
 CONFIG_NET_CLS_ACT=y
 CONFIG_NET_ACT_POLICE=y
+CONFIG_BPF_JIT=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 CONFIG_BLK_DEV_LOOP=m
@@ -121,7 +121,6 @@ CONFIG_DEBUG_NOTIFIERS=y
 CONFIG_RCU_TRACE=y
 CONFIG_KPROBES_SANITY_TEST=y
 CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
-CONFIG_CPU_NOTIFIER_ERROR_INJECT=m
 CONFIG_LATENCYTOP=y
 CONFIG_DEBUG_PAGEALLOC=y
 CONFIG_BLK_DEV_IO_TRACE=y
@@ -173,3 +172,4 @@ CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
 CONFIG_CRC7=m
+CONFIG_CMM=m
diff --git a/arch/s390/include/asm/appldata.h b/arch/s390/include/asm/appldata.h
index f328294faeae..32a705987156 100644
--- a/arch/s390/include/asm/appldata.h
+++ b/arch/s390/include/asm/appldata.h
@@ -70,7 +70,7 @@ static inline int appldata_asm(struct appldata_product_id *id,
         int ry;
 
         if (!MACHINE_IS_VM)
-                return -ENOSYS;
+                return -EOPNOTSUPP;
         parm_list.diag = 0xdc;
         parm_list.function = fn;
         parm_list.parlist_length = sizeof(parm_list);
diff --git a/arch/s390/include/asm/chsc.h b/arch/s390/include/asm/chsc.h
index bf115b49f444..aea451fd182e 100644
--- a/arch/s390/include/asm/chsc.h
+++ b/arch/s390/include/asm/chsc.h
@@ -125,32 +125,4 @@ struct chsc_cpd_info {
 #define CHSC_INFO_CPD _IOWR(CHSC_IOCTL_MAGIC, 0x87, struct chsc_cpd_info)
 #define CHSC_INFO_DCAL _IOWR(CHSC_IOCTL_MAGIC, 0x88, struct chsc_dcal)
 
-#ifdef __KERNEL__
-
-struct css_general_char {
-        u64 : 12;
-        u32 dynio : 1;   /* bit 12 */
-        u32 : 28;
-        u32 aif : 1;     /* bit 41 */
-        u32 : 3;
-        u32 mcss : 1;    /* bit 45 */
-        u32 fcs : 1;     /* bit 46 */
-        u32 : 1;
-        u32 ext_mb : 1;  /* bit 48 */
-        u32 : 7;
-        u32 aif_tdd : 1; /* bit 56 */
-        u32 : 1;
-        u32 qebsm : 1;   /* bit 58 */
-        u32 : 8;
-        u32 aif_osa : 1; /* bit 67 */
-        u32 : 14;
-        u32 cib : 1;     /* bit 82 */
-        u32 : 5;
-        u32 fcx : 1;     /* bit 88 */
-        u32 : 7;
-}__attribute__((packed));
-
-extern struct css_general_char css_general_characteristics;
-
-#endif /* __KERNEL__ */
 #endif
diff --git a/arch/s390/include/asm/cio.h b/arch/s390/include/asm/cio.h
index 77043aa44d67..55bde6035216 100644
--- a/arch/s390/include/asm/cio.h
+++ b/arch/s390/include/asm/cio.h
@@ -80,6 +80,18 @@ struct erw {
 } __attribute__ ((packed));
 
 /**
+ * struct erw_eadm - EADM Subchannel extended report word
+ * @b: aob error
+ * @r: arsb error
+ */
+struct erw_eadm {
+        __u32 : 16;
+        __u32 b : 1;
+        __u32 r : 1;
+        __u32  : 14;
+} __packed;
+
+/**
  * struct sublog - subchannel logout area
  * @res0: reserved
  * @esf: extended status flags
@@ -170,9 +182,22 @@ struct esw3 {
 } __attribute__ ((packed));
 
 /**
+ * struct esw_eadm - EADM Subchannel Extended Status Word (ESW)
+ * @sublog: subchannel logout
+ * @erw: extended report word
+ */
+struct esw_eadm {
+        __u32 sublog;
+        struct erw_eadm erw;
+        __u32 : 32;
+        __u32 : 32;
+        __u32 : 32;
+} __packed;
+
+/**
  * struct irb - interruption response block
  * @scsw: subchannel status word
- * @esw: extened status word, 4 formats
+ * @esw: extened status word
  * @ecw: extended control word
  *
  * The irb that is handed to the device driver when an interrupt occurs. For
@@ -191,6 +216,7 @@ struct irb {
                 struct esw1 esw1;
                 struct esw2 esw2;
                 struct esw3 esw3;
+                struct esw_eadm eadm;
         } esw;
         __u8   ecw[32];
 } __attribute__ ((packed,aligned(4)));
diff --git a/arch/s390/include/asm/cmpxchg.h b/arch/s390/include/asm/cmpxchg.h
index 8d798e962b63..0f636cbdf342 100644
--- a/arch/s390/include/asm/cmpxchg.h
+++ b/arch/s390/include/asm/cmpxchg.h
@@ -7,7 +7,9 @@
 #ifndef __ASM_CMPXCHG_H
 #define __ASM_CMPXCHG_H
 
+#include <linux/mmdebug.h>
 #include <linux/types.h>
+#include <linux/bug.h>
 
 extern void __xchg_called_with_bad_pointer(void);
 
@@ -203,6 +205,65 @@ static inline unsigned long long __cmpxchg64(void *ptr,
 })
 #endif /* CONFIG_64BIT */
 
+#define __cmpxchg_double_op(p1, p2, o1, o2, n1, n2, insn)               \
+({                                                                      \
+        register __typeof__(*(p1)) __old1 asm("2") = (o1);              \
+        register __typeof__(*(p2)) __old2 asm("3") = (o2);              \
+        register __typeof__(*(p1)) __new1 asm("4") = (n1);              \
+        register __typeof__(*(p2)) __new2 asm("5") = (n2);              \
+        int cc;                                                         \
+        asm volatile(                                                   \
+                        insn   " %[old],%[new],%[ptr]\n"                \
+                "       ipm     %[cc]\n"                                \
+                "       srl     %[cc],28"                               \
+                : [cc] "=d" (cc), [old] "+d" (__old1), "+d" (__old2)    \
+                : [new] "d" (__new1), "d" (__new2),                     \
+                  [ptr] "Q" (*(p1)), "Q" (*(p2))                        \
+                : "memory", "cc");                                      \
+        !cc;                                                            \
+})
+
+#define __cmpxchg_double_4(p1, p2, o1, o2, n1, n2) \
+        __cmpxchg_double_op(p1, p2, o1, o2, n1, n2, "cds")
+
+#define __cmpxchg_double_8(p1, p2, o1, o2, n1, n2) \
+        __cmpxchg_double_op(p1, p2, o1, o2, n1, n2, "cdsg")
+
+extern void __cmpxchg_double_called_with_bad_pointer(void);
+
+#define __cmpxchg_double(p1, p2, o1, o2, n1, n2)                        \
+({                                                                      \
+        int __ret;                                                      \
+        switch (sizeof(*(p1))) {                                        \
+        case 4:                                                         \
+                __ret = __cmpxchg_double_4(p1, p2, o1, o2, n1, n2);     \
+                break;                                                  \
+        case 8:                                                         \
+                __ret = __cmpxchg_double_8(p1, p2, o1, o2, n1, n2);     \
+                break;                                                  \
+        default:                                                        \
+                __cmpxchg_double_called_with_bad_pointer();             \
+        }                                                               \
+        __ret;                                                          \
+})
+
+#define cmpxchg_double(p1, p2, o1, o2, n1, n2)                          \
+({                                                                      \
+        __typeof__(p1) __p1 = (p1);                                     \
+        __typeof__(p2) __p2 = (p2);                                     \
+        int __ret;                                                      \
+        BUILD_BUG_ON(sizeof(*(p1)) != sizeof(long));                    \
+        BUILD_BUG_ON(sizeof(*(p2)) != sizeof(long));                    \
+        VM_BUG_ON((unsigned long)((__p1) + 1) != (unsigned long)(__p2));\
+        if (sizeof(long) == 4)                                          \
+                __ret = __cmpxchg_double_4(__p1, __p2, o1, o2, n1, n2); \
+        else                                                            \
+                __ret = __cmpxchg_double_8(__p1, __p2, o1, o2, n1, n2); \
+        __ret;                                                          \
+})
+
+#define system_has_cmpxchg_double()     1
+
 #include <asm-generic/cmpxchg-local.h>
 
 static inline unsigned long __cmpxchg_local(void *ptr,
diff --git a/arch/s390/include/asm/cpu_mf.h b/arch/s390/include/asm/cpu_mf.h
index a3afecdae145..35f0020b7ba7 100644
--- a/arch/s390/include/asm/cpu_mf.h
+++ b/arch/s390/include/asm/cpu_mf.h
@@ -21,11 +21,15 @@
 #define CPU_MF_INT_SF_LSDA      (1 << 22)       /* loss of sample data alert */
 #define CPU_MF_INT_CF_CACA      (1 <<  7)       /* counter auth. change alert */
 #define CPU_MF_INT_CF_LCDA      (1 <<  6)       /* loss of counter data alert */
+#define CPU_MF_INT_RI_HALTED    (1 <<  5)       /* run-time instr. halted */
+#define CPU_MF_INT_RI_BUF_FULL  (1 <<  4)       /* run-time instr. program
+                                                   buffer full */
 
 #define CPU_MF_INT_CF_MASK      (CPU_MF_INT_CF_CACA|CPU_MF_INT_CF_LCDA)
 #define CPU_MF_INT_SF_MASK      (CPU_MF_INT_SF_IAE|CPU_MF_INT_SF_ISE|   \
                                  CPU_MF_INT_SF_PRA|CPU_MF_INT_SF_SACA|  \
                                  CPU_MF_INT_SF_LSDA)
+#define CPU_MF_INT_RI_MASK      (CPU_MF_INT_RI_HALTED|CPU_MF_INT_RI_BUF_FULL)
 
 /* CPU measurement facility support */
 static inline int cpum_cf_avail(void)
diff --git a/arch/s390/include/asm/css_chars.h b/arch/s390/include/asm/css_chars.h
new file mode 100644
index 000000000000..a06ebc2623fb
--- /dev/null
+++ b/arch/s390/include/asm/css_chars.h
@@ -0,0 +1,39 @@
+#ifndef _ASM_CSS_CHARS_H
+#define _ASM_CSS_CHARS_H
+
+#include <linux/types.h>
+
+#ifdef __KERNEL__
+
+struct css_general_char {
+        u64 : 12;
+        u32 dynio : 1;   /* bit 12 */
+        u32 : 4;
+        u32 eadm : 1;    /* bit 17 */
+        u32 : 23;
+        u32 aif : 1;     /* bit 41 */
+        u32 : 3;
+        u32 mcss : 1;    /* bit 45 */
+        u32 fcs : 1;     /* bit 46 */
+        u32 : 1;
+        u32 ext_mb : 1;  /* bit 48 */
+        u32 : 7;
+        u32 aif_tdd : 1; /* bit 56 */
+        u32 : 1;
+        u32 qebsm : 1;   /* bit 58 */
+        u32 : 8;
+        u32 aif_osa : 1; /* bit 67 */
+        u32 : 12;
+        u32 eadm_rf : 1; /* bit 80 */
+        u32 : 1;
+        u32 cib : 1;     /* bit 82 */
+        u32 : 5;
+        u32 fcx : 1;     /* bit 88 */
+        u32 : 19;
+        u32 alt_ssi : 1; /* bit 108 */
+} __packed;
+
+extern struct css_general_char css_general_characteristics;
+
+#endif /* __KERNEL__ */
+#endif
diff --git a/arch/s390/include/asm/eadm.h b/arch/s390/include/asm/eadm.h
new file mode 100644
index 000000000000..8d4847191ecc
--- /dev/null
+++ b/arch/s390/include/asm/eadm.h
@@ -0,0 +1,124 @@
+#ifndef _ASM_S390_EADM_H
+#define _ASM_S390_EADM_H
+
+#include <linux/types.h>
+#include <linux/device.h>
+
+struct arqb {
+        u64 data;
+        u16 fmt:4;
+        u16:12;
+        u16 cmd_code;
+        u16:16;
+        u16 msb_count;
+        u32 reserved[12];
+} __packed;
+
+#define ARQB_CMD_MOVE   1
+
+struct arsb {
+        u16 fmt:4;
+        u32:28;
+        u8 ef;
+        u8:8;
+        u8 ecbi;
+        u8:8;
+        u8 fvf;
+        u16:16;
+        u8 eqc;
+        u32:32;
+        u64 fail_msb;
+        u64 fail_aidaw;
+        u64 fail_ms;
+        u64 fail_scm;
+        u32 reserved[4];
+} __packed;
+
+struct msb {
+        u8 fmt:4;
+        u8 oc:4;
+        u8 flags;
+        u16:12;
+        u16 bs:4;
+        u32 blk_count;
+        u64 data_addr;
+        u64 scm_addr;
+        u64:64;
+} __packed;
+
+struct aidaw {
+        u8 flags;
+        u32 :24;
+        u32 :32;
+        u64 data_addr;
+} __packed;
+
+#define MSB_OC_CLEAR    0
+#define MSB_OC_READ     1
+#define MSB_OC_WRITE    2
+#define MSB_OC_RELEASE  3
+
+#define MSB_FLAG_BNM    0x80
+#define MSB_FLAG_IDA    0x40
+
+#define MSB_BS_4K       0
+#define MSB_BS_1M       1
+
+#define AOB_NR_MSB      124
+
+struct aob {
+        struct arqb request;
+        struct arsb response;
+        struct msb msb[AOB_NR_MSB];
+} __packed __aligned(PAGE_SIZE);
+
+struct aob_rq_header {
+        struct scm_device *scmdev;
+        char data[0];
+};
+
+struct scm_device {
+        u64 address;
+        u64 size;
+        unsigned int nr_max_block;
+        struct device dev;
+        struct {
+                unsigned int persistence:4;
+                unsigned int oper_state:4;
+                unsigned int data_state:4;
+                unsigned int rank:4;
+                unsigned int release:1;
+                unsigned int res_id:8;
+        } __packed attrs;
+};
+
+#define OP_STATE_GOOD           1
+#define OP_STATE_TEMP_ERR       2
+#define OP_STATE_PERM_ERR       3
+
+struct scm_driver {
+        struct device_driver drv;
+        int (*probe) (struct scm_device *scmdev);
+        int (*remove) (struct scm_device *scmdev);
+        void (*notify) (struct scm_device *scmdev);
+        void (*handler) (struct scm_device *scmdev, void *data, int error);
+};
+
+int scm_driver_register(struct scm_driver *scmdrv);
+void scm_driver_unregister(struct scm_driver *scmdrv);
+
+int scm_start_aob(struct aob *aob);
+void scm_irq_handler(struct aob *aob, int error);
+
+struct eadm_ops {
+        int (*eadm_start) (struct aob *aob);
+        struct module *owner;
+};
+
+int scm_get_ref(void);
+void scm_put_ref(void);
+
+void register_eadm_ops(struct eadm_ops *ops);
+void unregister_eadm_ops(struct eadm_ops *ops);
+
+#endif /* _ASM_S390_EADM_H */
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index 9b94a160fe7f..178ff966a8ba 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -101,6 +101,7 @@
 #define HWCAP_S390_HPAGE        128
 #define HWCAP_S390_ETF3EH       256
 #define HWCAP_S390_HIGH_GPRS    512
+#define HWCAP_S390_TE           1024
 
 /*
  * These are used to set parameters in the core dumps.
@@ -212,4 +213,6 @@ int arch_setup_additional_pages(struct linux_binprm *, int);
 extern unsigned long arch_randomize_brk(struct mm_struct *mm);
 #define arch_randomize_brk arch_randomize_brk
 
+void *fill_cpu_elf_notes(void *ptr, struct save_area *sa);
+
 #endif
diff --git a/arch/s390/include/asm/etr.h b/arch/s390/include/asm/etr.h
index a24b03b9fb64..629b79a93165 100644
--- a/arch/s390/include/asm/etr.h
+++ b/arch/s390/include/asm/etr.h
@@ -140,7 +140,7 @@ struct etr_ptff_qto {
 /* Inline assembly helper functions */
 static inline int etr_setr(struct etr_eacr *ctrl)
 {
-        int rc = -ENOSYS;
+        int rc = -EOPNOTSUPP;
 
         asm volatile(
                 "       .insn   s,0xb2160000,%1\n"
@@ -154,7 +154,7 @@ static inline int etr_setr(struct etr_eacr *ctrl)
 /* Stores a format 1 aib with 64 bytes */
 static inline int etr_stetr(struct etr_aib *aib)
 {
-        int rc = -ENOSYS;
+        int rc = -EOPNOTSUPP;
 
         asm volatile(
                 "       .insn   s,0xb2170000,%1\n"
@@ -169,7 +169,7 @@ static inline int etr_stetr(struct etr_aib *aib)
 static inline int etr_steai(struct etr_aib *aib, unsigned int func)
 {
         register unsigned int reg0 asm("0") = func;
-        int rc = -ENOSYS;
+        int rc = -EOPNOTSUPP;
 
         asm volatile(
                 "       .insn   s,0xb2b30000,%1\n"
@@ -190,7 +190,7 @@ static inline int etr_ptff(void *ptff_block, unsigned int func)
 {
         register unsigned int reg0 asm("0") = func;
         register unsigned long reg1 asm("1") = (unsigned long) ptff_block;
-        int rc = -ENOSYS;
+        int rc = -EOPNOTSUPP;
 
         asm volatile(
                 "       .word   0x0104\n"
diff --git a/arch/s390/include/asm/irq.h b/arch/s390/include/asm/irq.h
index 2b9d41899d21..6703dd986fd4 100644
--- a/arch/s390/include/asm/irq.h
+++ b/arch/s390/include/asm/irq.h
@@ -19,6 +19,7 @@ enum interruption_class {
         EXTINT_IUC,
         EXTINT_CMS,
         EXTINT_CMC,
+        EXTINT_CMR,
         IOINT_CIO,
         IOINT_QAI,
         IOINT_DAS,
@@ -30,6 +31,7 @@ enum interruption_class {
         IOINT_CLW,
         IOINT_CTC,
         IOINT_APB,
+        IOINT_ADM,
         IOINT_CSC,
         NMI_NMI,
         NR_IRQS,
diff --git a/arch/s390/include/asm/isc.h b/arch/s390/include/asm/isc.h
index 1420a1115948..5ae606456b0a 100644
--- a/arch/s390/include/asm/isc.h
+++ b/arch/s390/include/asm/isc.h
@@ -14,6 +14,7 @@
 /* Regular I/O interrupts. */
 #define IO_SCH_ISC 3                    /* regular I/O subchannels */
 #define CONSOLE_ISC 1                   /* console I/O subchannel */
+#define EADM_SCH_ISC 4                  /* EADM subchannels */
 #define CHSC_SCH_ISC 7                  /* CHSC subchannels */
 /* Adapter interrupts. */
 #define QDIO_AIRQ_ISC IO_SCH_ISC        /* I/O subchannel in qdio mode */
diff --git a/arch/s390/include/asm/lowcore.h b/arch/s390/include/asm/lowcore.h
index aab5555bbbda..bbf8141408cd 100644
--- a/arch/s390/include/asm/lowcore.h
+++ b/arch/s390/include/asm/lowcore.h
@@ -329,9 +329,13 @@ struct _lowcore {
         __u8    pad_0x1338[0x1340-0x1338];      /* 0x1338 */
         __u32   access_regs_save_area[16];      /* 0x1340 */
         __u64   cregs_save_area[16];            /* 0x1380 */
+        __u8    pad_0x1400[0x1800-0x1400];      /* 0x1400 */
+
+        /* Transaction abort diagnostic block */
+        __u8    pgm_tdb[256];                   /* 0x1800 */
 
         /* align to the top of the prefix area */
-        __u8    pad_0x1400[0x2000-0x1400];      /* 0x1400 */
+        __u8    pad_0x1900[0x2000-0x1900];      /* 0x1900 */
 } __packed;
 
 #endif /* CONFIG_32BIT */
diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
index b749c5733657..084e7755ed9b 100644
--- a/arch/s390/include/asm/mmu_context.h
+++ b/arch/s390/include/asm/mmu_context.h
@@ -57,7 +57,7 @@ static inline void update_mm(struct mm_struct *mm, struct task_struct *tsk)
         pgd_t *pgd = mm->pgd;
 
         S390_lowcore.user_asce = mm->context.asce_bits | __pa(pgd);
-        if (addressing_mode != HOME_SPACE_MODE) {
+        if (s390_user_mode != HOME_SPACE_MODE) {
                 /* Load primary space page table origin. */
                 asm volatile(LCTL_OPCODE" 1,1,%0\n"
                              : : "m" (S390_lowcore.user_asce) );
diff --git a/arch/s390/include/asm/percpu.h b/arch/s390/include/asm/percpu.h
index 6537e72e0853..86fe0ee2cee5 100644
--- a/arch/s390/include/asm/percpu.h
+++ b/arch/s390/include/asm/percpu.h
@@ -20,7 +20,7 @@
 #endif
 
 #define arch_this_cpu_to_op(pcp, val, op)                               \
-do {                                                                    \
+({                                                                      \
         typedef typeof(pcp) pcp_op_T__;                                 \
         pcp_op_T__ old__, new__, prev__;                                \
         pcp_op_T__ *ptr__;                                              \
@@ -39,13 +39,19 @@ do {									\
                 }                                                       \
         } while (prev__ != old__);                                      \
         preempt_enable();                                               \
-} while (0)
+        new__;                                                          \
+})
 
 #define this_cpu_add_1(pcp, val) arch_this_cpu_to_op(pcp, val, +)
 #define this_cpu_add_2(pcp, val) arch_this_cpu_to_op(pcp, val, +)
 #define this_cpu_add_4(pcp, val) arch_this_cpu_to_op(pcp, val, +)
 #define this_cpu_add_8(pcp, val) arch_this_cpu_to_op(pcp, val, +)
 
+#define this_cpu_add_return_1(pcp, val) arch_this_cpu_to_op(pcp, val, +)
+#define this_cpu_add_return_2(pcp, val) arch_this_cpu_to_op(pcp, val, +)
+#define this_cpu_add_return_4(pcp, val) arch_this_cpu_to_op(pcp, val, +)
+#define this_cpu_add_return_8(pcp, val) arch_this_cpu_to_op(pcp, val, +)
+
 #define this_cpu_and_1(pcp, val) arch_this_cpu_to_op(pcp, val, &)
 #define this_cpu_and_2(pcp, val) arch_this_cpu_to_op(pcp, val, &)
 #define this_cpu_and_4(pcp, val) arch_this_cpu_to_op(pcp, val, &)
@@ -61,7 +67,7 @@ do {									\
 #define this_cpu_xor_4(pcp, val) arch_this_cpu_to_op(pcp, val, ^)
 #define this_cpu_xor_8(pcp, val) arch_this_cpu_to_op(pcp, val, ^)
 
-#define arch_this_cpu_cmpxchg(pcp, oval, nval)                  \
+#define arch_this_cpu_cmpxchg(pcp, oval, nval)                          \
 ({                                                                      \
         typedef typeof(pcp) pcp_op_T__;                                 \
         pcp_op_T__ ret__;                                               \
@@ -84,6 +90,44 @@ do {									\
 #define this_cpu_cmpxchg_4(pcp, oval, nval) arch_this_cpu_cmpxchg(pcp, oval, nval)
 #define this_cpu_cmpxchg_8(pcp, oval, nval) arch_this_cpu_cmpxchg(pcp, oval, nval)
 
+#define arch_this_cpu_xchg(pcp, nval)                                   \
+({                                                                      \
+        typeof(pcp) *ptr__;                                             \
+        typeof(pcp) ret__;                                              \
+        preempt_disable();                                              \
+        ptr__ = __this_cpu_ptr(&(pcp));                                 \
+        ret__ = xchg(ptr__, nval);                                      \
+        preempt_enable();                                               \
+        ret__;                                                          \
+})
+
+#define this_cpu_xchg_1(pcp, nval) arch_this_cpu_xchg(pcp, nval)
+#define this_cpu_xchg_2(pcp, nval) arch_this_cpu_xchg(pcp, nval)
+#define this_cpu_xchg_4(pcp, nval) arch_this_cpu_xchg(pcp, nval)
+#ifdef CONFIG_64BIT
+#define this_cpu_xchg_8(pcp, nval) arch_this_cpu_xchg(pcp, nval)
+#endif
+
+#define arch_this_cpu_cmpxchg_double(pcp1, pcp2, o1, o2, n1, n2)        \
+({                                                                      \
+        typeof(pcp1) o1__ = (o1), n1__ = (n1);                          \
+        typeof(pcp2) o2__ = (o2), n2__ = (n2);                          \
+        typeof(pcp1) *p1__;                                             \
+        typeof(pcp2) *p2__;                                             \
+        int ret__;                                                      \
+        preempt_disable();                                              \
+        p1__ = __this_cpu_ptr(&(pcp1));                                 \
+        p2__ = __this_cpu_ptr(&(pcp2));                                 \
+        ret__ = __cmpxchg_double(p1__, p2__, o1__, o2__, n1__, n2__);   \
+        preempt_enable();                                               \
+        ret__;                                                          \
+})
+
+#define this_cpu_cmpxchg_double_4 arch_this_cpu_cmpxchg_double
+#ifdef CONFIG_64BIT
+#define this_cpu_cmpxchg_double_8 arch_this_cpu_cmpxchg_double
+#endif
+
 #include <asm-generic/percpu.h>
 
 #endif /* __ARCH_S390_PERCPU__ */
diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
index 11e4e3236937..f3e0aabfc6bc 100644
--- a/arch/s390/include/asm/processor.h
+++ b/arch/s390/include/asm/processor.h
@@ -11,12 +11,15 @@
 #ifndef __ASM_S390_PROCESSOR_H
 #define __ASM_S390_PROCESSOR_H
 
+#ifndef __ASSEMBLY__
+
 #include <linux/linkage.h>
 #include <linux/irqflags.h>
 #include <asm/cpu.h>
 #include <asm/page.h>
 #include <asm/ptrace.h>
 #include <asm/setup.h>
+#include <asm/runtime_instr.h>
 
 /*
  * Default implementation of macro that returns current
@@ -75,11 +78,20 @@ struct thread_struct {
         unsigned long gmap_addr;        /* address of last gmap fault. */
         struct per_regs per_user;       /* User specified PER registers */
         struct per_event per_event;     /* Cause of the last PER trap */
+        unsigned long per_flags;        /* Flags to control debug behavior */
         /* pfault_wait is used to block the process on a pfault event */
         unsigned long pfault_wait;
         struct list_head list;
+        /* cpu runtime instrumentation */
+        struct runtime_instr_cb *ri_cb;
+        int ri_signum;
+#ifdef CONFIG_64BIT
+        unsigned char trap_tdb[256];    /* Transaction abort diagnose block */
+#endif
 };
 
+#define PER_FLAG_NO_TE          1UL     /* Flag to disable transactions. */
+
 typedef struct thread_struct thread_struct;
 
 /*
@@ -130,6 +142,12 @@ struct task_struct;
 struct mm_struct;
 struct seq_file;
 
+#ifdef CONFIG_64BIT
+extern void show_cacheinfo(struct seq_file *m);
+#else
+static inline void show_cacheinfo(struct seq_file *m) { }
+#endif
+
 /* Free all resources held by a thread. */
 extern void release_thread(struct task_struct *);
 extern int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags);
@@ -140,6 +158,7 @@ extern int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags);
 extern unsigned long thread_saved_pc(struct task_struct *t);
 
 extern void show_code(struct pt_regs *regs);
+extern void print_fn_code(unsigned char *code, unsigned long len);
 
 unsigned long get_wchan(struct task_struct *p);
 #define task_pt_regs(tsk) ((struct pt_regs *) \
@@ -331,23 +350,6 @@ extern void (*s390_base_ext_handler_fn)(void);
 
 #define ARCH_LOW_ADDRESS_LIMIT  0x7fffffffUL
 
-/*
- * Helper macro for exception table entries
- */
-#ifndef CONFIG_64BIT
-#define EX_TABLE(_fault,_target)                        \
-        ".section __ex_table,\"a\"\n"                   \
-        "       .align 4\n"                             \
-        "       .long  " #_fault "," #_target "\n"      \
-        ".previous\n"
-#else
-#define EX_TABLE(_fault,_target)                        \
-        ".section __ex_table,\"a\"\n"                   \
-        "       .align 8\n"                             \
-        "       .quad  " #_fault "," #_target "\n"      \
-        ".previous\n"
-#endif
-
 extern int memcpy_real(void *, void *, size_t);
 extern void memcpy_absolute(void *, void *, size_t);
 
@@ -358,4 +360,25 @@ extern void memcpy_absolute(void *, void *, size_t);
         memcpy_absolute(&(dest), &__tmp, sizeof(__tmp));        \
 }
 
-#endif                                 /* __ASM_S390_PROCESSOR_H           */
+/*
+ * Helper macro for exception table entries
+ */
+#define EX_TABLE(_fault, _target)       \
+        ".section __ex_table,\"a\"\n"   \
+        ".align 4\n"                    \
+        ".long  (" #_fault ") - .\n"    \
+        ".long  (" #_target ") - .\n"   \
+        ".previous\n"
+
+#else /* __ASSEMBLY__ */
+
+#define EX_TABLE(_fault, _target)       \
+        .section __ex_table,"a" ;       \
+        .align  4 ;                     \
+        .long   (_fault) - . ;          \
+        .long   (_target) - . ;         \
+        .previous
+
+#endif /* __ASSEMBLY__ */
+
+#endif /* __ASM_S390_PROCESSOR_H */
diff --git a/arch/s390/include/asm/ptrace.h b/arch/s390/include/asm/ptrace.h
index d5f08ea566ed..ce20a53afe91 100644
--- a/arch/s390/include/asm/ptrace.h
+++ b/arch/s390/include/asm/ptrace.h
@@ -235,6 +235,7 @@ typedef struct
 #define PSW_MASK_ASC            0x0000C000UL
 #define PSW_MASK_CC             0x00003000UL
 #define PSW_MASK_PM             0x00000F00UL
+#define PSW_MASK_RI             0x00000000UL
 #define PSW_MASK_EA             0x00000000UL
 #define PSW_MASK_BA             0x00000000UL
 
@@ -264,10 +265,11 @@ typedef struct
 #define PSW_MASK_ASC            0x0000C00000000000UL
 #define PSW_MASK_CC             0x0000300000000000UL
 #define PSW_MASK_PM             0x00000F0000000000UL
+#define PSW_MASK_RI             0x0000008000000000UL
 #define PSW_MASK_EA             0x0000000100000000UL
 #define PSW_MASK_BA             0x0000000080000000UL
 
-#define PSW_MASK_USER           0x00003F0180000000UL
+#define PSW_MASK_USER           0x00003F8180000000UL
 
 #define PSW_ADDR_AMODE          0x0000000000000000UL
 #define PSW_ADDR_INSN           0xFFFFFFFFFFFFFFFFUL
@@ -359,17 +361,19 @@ struct per_struct_kernel {
         unsigned char access_id;        /* PER trap access identification */
 };
 
-#define PER_EVENT_MASK                  0xE9000000UL
+#define PER_EVENT_MASK                  0xEB000000UL
 
 #define PER_EVENT_BRANCH                0x80000000UL
 #define PER_EVENT_IFETCH                0x40000000UL
 #define PER_EVENT_STORE                 0x20000000UL
 #define PER_EVENT_STORE_REAL            0x08000000UL
+#define PER_EVENT_TRANSACTION_END       0x02000000UL
 #define PER_EVENT_NULLIFICATION         0x01000000UL
 
-#define PER_CONTROL_MASK                0x00a00000UL
+#define PER_CONTROL_MASK                0x00e00000UL
 
 #define PER_CONTROL_BRANCH_ADDRESS      0x00800000UL
+#define PER_CONTROL_SUSPENSION          0x00400000UL
 #define PER_CONTROL_ALTERATION          0x00200000UL
 
 #endif
@@ -483,6 +487,8 @@ typedef struct
 #define PTRACE_GET_LAST_BREAK         0x5006
 #define PTRACE_PEEK_SYSTEM_CALL       0x5007
 #define PTRACE_POKE_SYSTEM_CALL       0x5008
+#define PTRACE_ENABLE_TE              0x5009
+#define PTRACE_DISABLE_TE             0x5010
 
 /*
  * PT_PROT definition is loosely based on hppa bsd definition in
diff --git a/arch/s390/include/asm/runtime_instr.h b/arch/s390/include/asm/runtime_instr.h
new file mode 100644
index 000000000000..830da737ff85
--- /dev/null
+++ b/arch/s390/include/asm/runtime_instr.h
@@ -0,0 +1,98 @@
+#ifndef _RUNTIME_INSTR_H
+#define _RUNTIME_INSTR_H
+
+#define S390_RUNTIME_INSTR_START        0x1
+#define S390_RUNTIME_INSTR_STOP         0x2
+
+struct runtime_instr_cb {
+        __u64 buf_current;
+        __u64 buf_origin;
+        __u64 buf_limit;
+
+        __u32 valid             : 1;
+        __u32 pstate            : 1;
+        __u32 pstate_set_buf    : 1;
+        __u32 home_space        : 1;
+        __u32 altered           : 1;
+        __u32                   : 3;
+        __u32 pstate_sample     : 1;
+        __u32 sstate_sample     : 1;
+        __u32 pstate_collect    : 1;
+        __u32 sstate_collect    : 1;
+        __u32                   : 1;
+        __u32 halted_int        : 1;
+        __u32 int_requested     : 1;
+        __u32 buffer_full_int   : 1;
+        __u32 key               : 4;
+        __u32                   : 9;
+        __u32 rgs               : 3;
+
+        __u32 mode              : 4;
+        __u32 next              : 1;
+        __u32 mae               : 1;
+        __u32                   : 2;
+        __u32 call_type_br      : 1;
+        __u32 return_type_br    : 1;
+        __u32 other_type_br     : 1;
+        __u32 bc_other_type     : 1;
+        __u32 emit              : 1;
+        __u32 tx_abort          : 1;
+        __u32                   : 2;
+        __u32 bp_xn             : 1;
+        __u32 bp_xt             : 1;
+        __u32 bp_ti             : 1;
+        __u32 bp_ni             : 1;
+        __u32 suppr_y           : 1;
+        __u32 suppr_z           : 1;
+
+        __u32 dc_miss_extra     : 1;
+        __u32 lat_lev_ignore    : 1;
+        __u32 ic_lat_lev        : 4;
+        __u32 dc_lat_lev        : 4;
+
+        __u64 reserved1;
+        __u64 scaling_factor;
+        __u64 rsic;
+        __u64 reserved2;
+} __packed __aligned(8);
+
+extern struct runtime_instr_cb runtime_instr_empty_cb;
+
+static inline void load_runtime_instr_cb(struct runtime_instr_cb *cb)
+{
+        asm volatile(".insn     rsy,0xeb0000000060,0,0,%0"      /* LRIC */
+                : : "Q" (*cb));
+}
+
+static inline void store_runtime_instr_cb(struct runtime_instr_cb *cb)
+{
+        asm volatile(".insn     rsy,0xeb0000000061,0,0,%0"      /* STRIC */
+                : "=Q" (*cb) : : "cc");
+}
+
+static inline void save_ri_cb(struct runtime_instr_cb *cb_prev)
+{
+#ifdef CONFIG_64BIT
+        if (cb_prev)
+                store_runtime_instr_cb(cb_prev);
+#endif
+}
+
+static inline void restore_ri_cb(struct runtime_instr_cb *cb_next,
+                                 struct runtime_instr_cb *cb_prev)
+{
+#ifdef CONFIG_64BIT
+        if (cb_next)
+                load_runtime_instr_cb(cb_next);
+        else if (cb_prev)
+                load_runtime_instr_cb(&runtime_instr_empty_cb);
+#endif
+}
+
+#ifdef CONFIG_64BIT
+extern void exit_thread_runtime_instr(void);
+#else
+static inline void exit_thread_runtime_instr(void) { }
+#endif
+
+#endif /* _RUNTIME_INSTR_H */
diff --git a/arch/s390/include/asm/scsw.h b/arch/s390/include/asm/scsw.h
index 4071d00978cb..4af99cdaddf5 100644
--- a/arch/s390/include/asm/scsw.h
+++ b/arch/s390/include/asm/scsw.h
@@ -1,7 +1,7 @@
 /*
  *  Helper functions for scsw access.
  *
- *    Copyright IBM Corp. 2008, 2009
+ *    Copyright IBM Corp. 2008, 2012
  *    Author(s): Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
  */
 
@@ -9,7 +9,7 @@
 #define _ASM_S390_SCSW_H_
 
 #include <linux/types.h>
-#include <asm/chsc.h>
+#include <asm/css_chars.h>
 #include <asm/cio.h>
 
 /**
@@ -100,14 +100,46 @@ struct tm_scsw {
 } __attribute__ ((packed));
 
 /**
+ * struct eadm_scsw - subchannel status word for eadm subchannels
+ * @key: subchannel key
+ * @eswf: esw format
+ * @cc: deferred condition code
+ * @ectl: extended control
+ * @fctl: function control
+ * @actl: activity control
+ * @stctl: status control
+ * @aob: AOB address
+ * @dstat: device status
+ * @cstat: subchannel status
+ */
+struct eadm_scsw {
+        u32 key:4;
+        u32:1;
+        u32 eswf:1;
+        u32 cc:2;
+        u32:6;
+        u32 ectl:1;
+        u32:2;
+        u32 fctl:3;
+        u32 actl:7;
+        u32 stctl:5;
+        u32 aob;
+        u32 dstat:8;
+        u32 cstat:8;
+        u32:16;
+} __packed;
+
+/**
  * union scsw - subchannel status word
  * @cmd: command-mode SCSW
  * @tm: transport-mode SCSW
+ * @eadm: eadm SCSW
  */
 union scsw {
         struct cmd_scsw cmd;
         struct tm_scsw tm;
-} __attribute__ ((packed));
+        struct eadm_scsw eadm;
+} __packed;
 
 #define SCSW_FCTL_CLEAR_FUNC     0x1
 #define SCSW_FCTL_HALT_FUNC      0x2
diff --git a/arch/s390/include/asm/setup.h b/arch/s390/include/asm/setup.h
index e6859d16ee2d..87b47ca954f1 100644
--- a/arch/s390/include/asm/setup.h
+++ b/arch/s390/include/asm/setup.h
@@ -60,7 +60,7 @@ void create_mem_hole(struct mem_chunk memory_chunk[], unsigned long addr,
 #define SECONDARY_SPACE_MODE    2
 #define HOME_SPACE_MODE         3
 
-extern unsigned int addressing_mode;
+extern unsigned int s390_user_mode;
 
 /*
  * Machine features detected in head.S
@@ -80,6 +80,7 @@ extern unsigned int addressing_mode;
 #define MACHINE_FLAG_LPAR       (1UL << 12)
 #define MACHINE_FLAG_SPP        (1UL << 13)
 #define MACHINE_FLAG_TOPOLOGY   (1UL << 14)
+#define MACHINE_FLAG_TE         (1UL << 15)
 
 #define MACHINE_IS_VM           (S390_lowcore.machine_flags & MACHINE_FLAG_VM)
 #define MACHINE_IS_KVM          (S390_lowcore.machine_flags & MACHINE_FLAG_KVM)
@@ -98,6 +99,7 @@ extern unsigned int addressing_mode;
 #define MACHINE_HAS_PFMF        (0)
 #define MACHINE_HAS_SPP         (0)
 #define MACHINE_HAS_TOPOLOGY    (0)
+#define MACHINE_HAS_TE                (0)
 #else /* CONFIG_64BIT */
 #define MACHINE_HAS_IEEE        (1)
 #define MACHINE_HAS_CSP         (1)
@@ -109,6 +111,7 @@ extern unsigned int addressing_mode;
 #define MACHINE_HAS_PFMF        (S390_lowcore.machine_flags & MACHINE_FLAG_PFMF)
 #define MACHINE_HAS_SPP         (S390_lowcore.machine_flags & MACHINE_FLAG_SPP)
 #define MACHINE_HAS_TOPOLOGY    (S390_lowcore.machine_flags & MACHINE_FLAG_TOPOLOGY)
+#define MACHINE_HAS_TE          (S390_lowcore.machine_flags & MACHINE_FLAG_TE)
 #endif /* CONFIG_64BIT */
 
 #define ZFCPDUMP_HSA_SIZE       (32UL<<20)
diff --git a/arch/s390/include/asm/smp.h b/arch/s390/include/asm/smp.h
index ce26ac3cb162..b64f15c3b4cc 100644
--- a/arch/s390/include/asm/smp.h
+++ b/arch/s390/include/asm/smp.h
@@ -30,6 +30,8 @@ extern int smp_vcpu_scheduled(int cpu);
 extern void smp_yield_cpu(int cpu);
 extern void smp_yield(void);
 extern void smp_stop_cpu(void);
+extern void smp_cpu_set_polarization(int cpu, int val);
+extern int smp_cpu_get_polarization(int cpu);
 
 #else /* CONFIG_SMP */
 
@@ -43,7 +45,7 @@ static inline void smp_call_online_cpu(void (*func)(void *), void *data)
         func(data);
 }
 
-static inline int smp_find_processor_id(int address) { return 0; }
+static inline int smp_find_processor_id(u16 address) { return 0; }
 static inline int smp_store_status(int cpu) { return 0; }
 static inline int smp_vcpu_scheduled(int cpu) { return 1; }
 static inline void smp_yield_cpu(int cpu) { }
diff --git a/arch/s390/include/asm/string.h b/arch/s390/include/asm/string.h
index 1bd1352fa3b5..7e2dcd7c57ef 100644
--- a/arch/s390/include/asm/string.h
+++ b/arch/s390/include/asm/string.h
@@ -96,7 +96,6 @@ static inline char *strcat(char *dst, const char *src)
 
 static inline char *strcpy(char *dst, const char *src)
 {
-#if __GNUC__ < 4
         register int r0 asm("0") = 0;
         char *ret = dst;
 
@@ -106,14 +105,10 @@ static inline char *strcpy(char *dst, const char *src)
                 : "+&a" (dst), "+&a" (src) : "d" (r0)
                 : "cc", "memory");
         return ret;
-#else
-        return __builtin_strcpy(dst, src);
-#endif
 }
 
 static inline size_t strlen(const char *s)
 {
-#if __GNUC__ < 4
         register unsigned long r0 asm("0") = 0;
         const char *tmp = s;
 
@@ -122,9 +117,6 @@ static inline size_t strlen(const char *s)
                 "       jo      0b"
                 : "+d" (r0), "+a" (tmp) :  : "cc");
         return r0 - (unsigned long) s;
-#else
-        return __builtin_strlen(s);
-#endif
 }
 
 static inline size_t strnlen(const char * s, size_t n)
diff --git a/arch/s390/include/asm/switch_to.h b/arch/s390/include/asm/switch_to.h
index 314cc9426fc4..f3a9e0f92704 100644
--- a/arch/s390/include/asm/switch_to.h
+++ b/arch/s390/include/asm/switch_to.h
@@ -80,10 +80,12 @@ static inline void restore_access_regs(unsigned int *acrs)
         if (prev->mm) {                                                 \
                 save_fp_regs(&prev->thread.fp_regs);                    \
                 save_access_regs(&prev->thread.acrs[0]);                \
+                save_ri_cb(prev->thread.ri_cb);                         \
         }                                                               \
         if (next->mm) {                                                 \
                 restore_fp_regs(&next->thread.fp_regs);                 \
                 restore_access_regs(&next->thread.acrs[0]);             \
+                restore_ri_cb(next->thread.ri_cb, prev->thread.ri_cb);  \
                 update_per_regs(next);                                  \
         }                                                               \
         prev = __switch_to(prev,next);                                  \
diff --git a/arch/s390/include/asm/sysinfo.h b/arch/s390/include/asm/sysinfo.h
index 282ee36f6162..f92428e459f8 100644
--- a/arch/s390/include/asm/sysinfo.h
+++ b/arch/s390/include/asm/sysinfo.h
@@ -17,7 +17,10 @@
 #include <asm/bitsperlong.h>
 
 struct sysinfo_1_1_1 {
-        unsigned short :16;
+        unsigned char p:1;
+        unsigned char :6;
+        unsigned char t:1;
+        unsigned char :8;
         unsigned char ccr;
         unsigned char cai;
         char reserved_0[28];
@@ -30,9 +33,14 @@ struct sysinfo_1_1_1 {
         char model[16];
         char model_perm_cap[16];
         char model_temp_cap[16];
-        char model_cap_rating[4];
-        char model_perm_cap_rating[4];
-        char model_temp_cap_rating[4];
+        unsigned int model_cap_rating;
+        unsigned int model_perm_cap_rating;
+        unsigned int model_temp_cap_rating;
+        unsigned char typepct[5];
+        unsigned char reserved_2[3];
+        unsigned int ncr;
+        unsigned int npr;
+        unsigned int ntr;
 };
 
 struct sysinfo_1_2_1 {
@@ -47,8 +55,9 @@ struct sysinfo_1_2_2 {
         char format;
         char reserved_0[1];
         unsigned short acc_offset;
-        char reserved_1[24];
-        unsigned int secondary_capability;
+        char reserved_1[20];
+        unsigned int nominal_cap;
+        unsigned int secondary_cap;
         unsigned int capability;
         unsigned short cpus_total;
         unsigned short cpus_configured;
@@ -109,6 +118,8 @@ struct sysinfo_3_2_2 {
         char reserved_544[3552];
 };
 
+extern int topology_max_mnest;
+
 #define TOPOLOGY_CPU_BITS       64
 #define TOPOLOGY_NR_MAG         6
 
@@ -142,21 +153,7 @@ struct sysinfo_15_1_x {
         union topology_entry tle[0];
 };
 
-static inline int stsi(void *sysinfo, int fc, int sel1, int sel2)
-{
-        register int r0 asm("0") = (fc << 28) | sel1;
-        register int r1 asm("1") = sel2;
-
-        asm volatile(
-                "   stsi 0(%2)\n"
-                "0: jz   2f\n"
-                "1: lhi  %0,%3\n"
-                "2:\n"
-                EX_TABLE(0b, 1b)
-                : "+d" (r0) : "d" (r1), "a" (sysinfo), "K" (-ENOSYS)
-                : "cc", "memory");
-        return r0;
-}
+int stsi(void *sysinfo, int fc, int sel1, int sel2);
 
 /*
  * Service level reporting interface.
diff --git a/arch/s390/include/asm/topology.h b/arch/s390/include/asm/topology.h
index 0837de80c351..9ca305383760 100644
--- a/arch/s390/include/asm/topology.h
+++ b/arch/s390/include/asm/topology.h
@@ -2,8 +2,8 @@
 #define _ASM_S390_TOPOLOGY_H
 
 #include <linux/cpumask.h>
-#include <asm/sysinfo.h>
 
+struct sysinfo_15_1_x;
 struct cpu;
 
 #ifdef CONFIG_SCHED_BOOK
@@ -51,24 +51,6 @@ static inline void topology_expect_change(void) { }
 #define POLARIZATION_VM         (2)
 #define POLARIZATION_VH         (3)
 
-extern int cpu_polarization[];
-
-static inline void cpu_set_polarization(int cpu, int val)
-{
-#ifdef CONFIG_SCHED_BOOK
-        cpu_polarization[cpu] = val;
-#endif
-}
-
-static inline int cpu_read_polarization(int cpu)
-{
-#ifdef CONFIG_SCHED_BOOK
-        return cpu_polarization[cpu];
-#else
-        return POLARIZATION_HRZ;
-#endif
-}
-
 #ifdef CONFIG_SCHED_BOOK
 void s390_init_cpu_topology(void);
 #else
diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
index a8ab18b18b54..34268df959a3 100644
--- a/arch/s390/include/asm/uaccess.h
+++ b/arch/s390/include/asm/uaccess.h
@@ -76,9 +76,22 @@ static inline int __range_ok(unsigned long addr, unsigned long size)
 
 struct exception_table_entry
 {
-        unsigned long insn, fixup;
+        int insn, fixup;
 };
 
+static inline unsigned long extable_insn(const struct exception_table_entry *x)
+{
+        return (unsigned long)&x->insn + x->insn;
+}
+
+static inline unsigned long extable_fixup(const struct exception_table_entry *x)
+{
+        return (unsigned long)&x->fixup + x->fixup;
+}
+
+#define ARCH_HAS_SORT_EXTABLE
+#define ARCH_HAS_SEARCH_EXTABLE
+
 struct uaccess_ops {
         size_t (*copy_from_user)(size_t, const void __user *, void *);
         size_t (*copy_from_user_small)(size_t, const void __user *, void *);
diff --git a/arch/s390/include/asm/unistd.h b/arch/s390/include/asm/unistd.h
index 6756e78f4808..4e64b5cd1558 100644
--- a/arch/s390/include/asm/unistd.h
+++ b/arch/s390/include/asm/unistd.h
@@ -277,7 +277,9 @@
 #define __NR_setns              339
 #define __NR_process_vm_readv   340
 #define __NR_process_vm_writev  341
-#define NR_syscalls 342
+#define __NR_s390_runtime_instr 342
+#define __NR_kcmp               343
+#define NR_syscalls 344
 
 /* 
  * There are some system calls that are not present on 64 bit, some
diff --git a/arch/s390/kernel/Makefile b/arch/s390/kernel/Makefile
index 9733b3f0eb6d..4da52fe31743 100644
--- a/arch/s390/kernel/Makefile
+++ b/arch/s390/kernel/Makefile
@@ -23,10 +23,11 @@ CFLAGS_sysinfo.o += -Iinclude/math-emu -Iarch/s390/math-emu -w
 obj-y   :=  bitmap.o traps.o time.o process.o base.o early.o setup.o vtime.o \
             processor.o sys_s390.o ptrace.o signal.o cpcmd.o ebcdic.o nmi.o \
             debug.o irq.o ipl.o dis.o diag.o mem_detect.o sclp.o vdso.o \
-            sysinfo.o jump_label.o lgr.o os_info.o
+            sysinfo.o jump_label.o lgr.o os_info.o machine_kexec.o
 
 obj-y   += $(if $(CONFIG_64BIT),entry64.o,entry.o)
 obj-y   += $(if $(CONFIG_64BIT),reipl64.o,reipl.o)
+obj-y   += $(if $(CONFIG_64BIT),relocate_kernel64.o,relocate_kernel.o)
 
 extra-y                         += head.o vmlinux.lds
 extra-y                         += $(if $(CONFIG_64BIT),head64.o,head31.o)
@@ -48,12 +49,11 @@ obj-$(CONFIG_DYNAMIC_FTRACE)	+= ftrace.o
 obj-$(CONFIG_FUNCTION_GRAPH_TRACER) += ftrace.o
 obj-$(CONFIG_FTRACE_SYSCALLS)  += ftrace.o
 obj-$(CONFIG_CRASH_DUMP)        += crash_dump.o
-obj-$(CONFIG_PERF_EVENTS)       += perf_event.o perf_cpum_cf.o
 
-# Kexec part
-S390_KEXEC_OBJS := machine_kexec.o crash.o
-S390_KEXEC_OBJS += $(if $(CONFIG_64BIT),relocate_kernel64.o,relocate_kernel.o)
-obj-$(CONFIG_KEXEC) += $(S390_KEXEC_OBJS)
+ifdef CONFIG_64BIT
+obj-$(CONFIG_PERF_EVENTS)       += perf_event.o perf_cpum_cf.o
+obj-y                           += runtime_instr.o cache.o
+endif
 
 # vdso
 obj-$(CONFIG_64BIT)             += vdso64/
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index 45ef1a7b08f9..fface87056eb 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -157,6 +157,8 @@ int main(void)
         DEFINE(__LC_LAST_BREAK, offsetof(struct _lowcore, breaking_event_addr));
         DEFINE(__LC_VDSO_PER_CPU, offsetof(struct _lowcore, vdso_per_cpu_data));
         DEFINE(__LC_GMAP, offsetof(struct _lowcore, gmap));
+        DEFINE(__LC_PGM_TDB, offsetof(struct _lowcore, pgm_tdb));
+        DEFINE(__THREAD_trap_tdb, offsetof(struct task_struct, thread.trap_tdb));
         DEFINE(__GMAP_ASCE, offsetof(struct gmap, asce));
 #endif /* CONFIG_32BIT */
         return 0;
diff --git a/arch/s390/kernel/cache.c b/arch/s390/kernel/cache.c
new file mode 100644
index 000000000000..8df8d8a19c98
--- /dev/null
+++ b/arch/s390/kernel/cache.c
@@ -0,0 +1,385 @@
+/*
+ * Extract CPU cache information and expose them via sysfs.
+ *
+ *    Copyright IBM Corp. 2012
+ *    Author(s): Heiko Carstens <heiko.carstens@de.ibm.com>
+ */
+
+#include <linux/notifier.h>
+#include <linux/seq_file.h>
+#include <linux/init.h>
+#include <linux/list.h>
+#include <linux/slab.h>
+#include <linux/cpu.h>
+#include <asm/facility.h>
+
+struct cache {
+        unsigned long size;
+        unsigned int line_size;
+        unsigned int associativity;
+        unsigned int nr_sets;
+        unsigned int level   : 3;
+        unsigned int type    : 2;
+        unsigned int private : 1;
+        struct list_head list;
+};
+
+struct cache_dir {
+        struct kobject *kobj;
+        struct cache_index_dir *index;
+};
+
+struct cache_index_dir {
+        struct kobject kobj;
+        int cpu;
+        struct cache *cache;
+        struct cache_index_dir *next;
+};
+
+enum {
+        CACHE_SCOPE_NOTEXISTS,
+        CACHE_SCOPE_PRIVATE,
+        CACHE_SCOPE_SHARED,
+        CACHE_SCOPE_RESERVED,
+};
+
+enum {
+        CACHE_TYPE_SEPARATE,
+        CACHE_TYPE_DATA,
+        CACHE_TYPE_INSTRUCTION,
+        CACHE_TYPE_UNIFIED,
+};
+
+enum {
+        EXTRACT_TOPOLOGY,
+        EXTRACT_LINE_SIZE,
+        EXTRACT_SIZE,
+        EXTRACT_ASSOCIATIVITY,
+};
+
+enum {
+        CACHE_TI_UNIFIED = 0,
+        CACHE_TI_INSTRUCTION = 0,
+        CACHE_TI_DATA,
+};
+
+struct cache_info {
+        unsigned char       : 4;
+        unsigned char scope : 2;
+        unsigned char type  : 2;
+};
+
+#define CACHE_MAX_LEVEL 8
+
+union cache_topology {
+        struct cache_info ci[CACHE_MAX_LEVEL];
+        unsigned long long raw;
+};
+
+static const char * const cache_type_string[] = {
+        "Data",
+        "Instruction",
+        "Unified",
+};
+
+static struct cache_dir *cache_dir_cpu[NR_CPUS];
+static LIST_HEAD(cache_list);
+
+void show_cacheinfo(struct seq_file *m)
+{
+        struct cache *cache;
+        int index = 0;
+
+        list_for_each_entry(cache, &cache_list, list) {
+                seq_printf(m, "cache%-11d: ", index);
+                seq_printf(m, "level=%d ", cache->level);
+                seq_printf(m, "type=%s ", cache_type_string[cache->type]);
+                seq_printf(m, "scope=%s ", cache->private ? "Private" : "Shared");
+                seq_printf(m, "size=%luK ", cache->size >> 10);
+                seq_printf(m, "line_size=%u ", cache->line_size);
+                seq_printf(m, "associativity=%d", cache->associativity);
+                seq_puts(m, "\n");
+                index++;
+        }
+}
+
+static inline unsigned long ecag(int ai, int li, int ti)
+{
+        unsigned long cmd, val;
+
+        cmd = ai << 4 | li << 1 | ti;
+        asm volatile(".insn     rsy,0xeb000000004c,%0,0,0(%1)" /* ecag */
+                     : "=d" (val) : "a" (cmd));
+        return val;
+}
+
+static int __init cache_add(int level, int private, int type)
+{
+        struct cache *cache;
+        int ti;
+
+        cache = kzalloc(sizeof(*cache), GFP_KERNEL);
+        if (!cache)
+                return -ENOMEM;
+        ti = type == CACHE_TYPE_DATA ? CACHE_TI_DATA : CACHE_TI_UNIFIED;
+        cache->size = ecag(EXTRACT_SIZE, level, ti);
+        cache->line_size = ecag(EXTRACT_LINE_SIZE, level, ti);
+        cache->associativity = ecag(EXTRACT_ASSOCIATIVITY, level, ti);
+        cache->nr_sets = cache->size / cache->associativity;
+        cache->nr_sets /= cache->line_size;
+        cache->private = private;
+        cache->level = level + 1;
+        cache->type = type - 1;
+        list_add_tail(&cache->list, &cache_list);
+        return 0;
+}
+
+static void __init cache_build_info(void)
+{
+        struct cache *cache, *next;
+        union cache_topology ct;
+        int level, private, rc;
+
+        ct.raw = ecag(EXTRACT_TOPOLOGY, 0, 0);
+        for (level = 0; level < CACHE_MAX_LEVEL; level++) {
+                switch (ct.ci[level].scope) {
+                case CACHE_SCOPE_NOTEXISTS:
+                case CACHE_SCOPE_RESERVED:
+                        return;
+                case CACHE_SCOPE_SHARED:
+                        private = 0;
+                        break;
+                case CACHE_SCOPE_PRIVATE:
+                        private = 1;
+                        break;
+                }
+                if (ct.ci[level].type == CACHE_TYPE_SEPARATE) {
+                        rc  = cache_add(level, private, CACHE_TYPE_DATA);
+                        rc |= cache_add(level, private, CACHE_TYPE_INSTRUCTION);
+                } else {
+                        rc = cache_add(level, private, ct.ci[level].type);
+                }
+                if (rc)
+                        goto error;
+        }
+        return;
+error:
+        list_for_each_entry_safe(cache, next, &cache_list, list) {
+                list_del(&cache->list);
+                kfree(cache);
+        }
+}
+
+static struct cache_dir *__cpuinit cache_create_cache_dir(int cpu)
+{
+        struct cache_dir *cache_dir;
+        struct kobject *kobj = NULL;
+        struct device *dev;
+
+        dev = get_cpu_device(cpu);
+        if (!dev)
+                goto out;
+        kobj = kobject_create_and_add("cache", &dev->kobj);
+        if (!kobj)
+                goto out;
+        cache_dir = kzalloc(sizeof(*cache_dir), GFP_KERNEL);
+        if (!cache_dir)
+                goto out;
+        cache_dir->kobj = kobj;
+        cache_dir_cpu[cpu] = cache_dir;
+        return cache_dir;
+out:
+        kobject_put(kobj);
+        return NULL;
+}
+
+static struct cache_index_dir *kobj_to_cache_index_dir(struct kobject *kobj)
+{
+        return container_of(kobj, struct cache_index_dir, kobj);
+}
+
+static void cache_index_release(struct kobject *kobj)
+{
+        struct cache_index_dir *index;
+
+        index = kobj_to_cache_index_dir(kobj);
+        kfree(index);
+}
+
+static ssize_t cache_index_show(struct kobject *kobj,
+                                struct attribute *attr, char *buf)
+{
+        struct kobj_attribute *kobj_attr;
+
+        kobj_attr = container_of(attr, struct kobj_attribute, attr);
+        return kobj_attr->show(kobj, kobj_attr, buf);
+}
+
+#define DEFINE_CACHE_ATTR(_name, _format, _value)                       \
+static ssize_t cache_##_name##_show(struct kobject *kobj,               \
+                                    struct kobj_attribute *attr,        \
+                                    char *buf)                          \
+{                                                                       \
+        struct cache_index_dir *index;                                  \
+                                                                        \
+        index = kobj_to_cache_index_dir(kobj);                          \
+        return sprintf(buf, _format, _value);                           \
+}                                                                       \
+static struct kobj_attribute cache_##_name##_attr =                     \
+        __ATTR(_name, 0444, cache_##_name##_show, NULL);
+
+DEFINE_CACHE_ATTR(size, "%luK\n", index->cache->size >> 10);
+DEFINE_CACHE_ATTR(coherency_line_size, "%u\n", index->cache->line_size);
+DEFINE_CACHE_ATTR(number_of_sets, "%u\n", index->cache->nr_sets);
+DEFINE_CACHE_ATTR(ways_of_associativity, "%u\n", index->cache->associativity);
+DEFINE_CACHE_ATTR(type, "%s\n", cache_type_string[index->cache->type]);
+DEFINE_CACHE_ATTR(level, "%d\n", index->cache->level);
+
+static ssize_t shared_cpu_map_func(struct kobject *kobj, int type, char *buf)
+{
+        struct cache_index_dir *index;
+        int len;
+
+        index = kobj_to_cache_index_dir(kobj);
+        len = type ?
+                cpulist_scnprintf(buf, PAGE_SIZE - 2, cpumask_of(index->cpu)) :
+                cpumask_scnprintf(buf, PAGE_SIZE - 2, cpumask_of(index->cpu));
+        len += sprintf(&buf[len], "\n");
+        return len;
+}
+
+static ssize_t shared_cpu_map_show(struct kobject *kobj,
+                                   struct kobj_attribute *attr, char *buf)
+{
+        return shared_cpu_map_func(kobj, 0, buf);
+}
+static struct kobj_attribute cache_shared_cpu_map_attr =
+        __ATTR(shared_cpu_map, 0444, shared_cpu_map_show, NULL);
+
+static ssize_t shared_cpu_list_show(struct kobject *kobj,
+                                    struct kobj_attribute *attr, char *buf)
+{
+        return shared_cpu_map_func(kobj, 1, buf);
+}
+static struct kobj_attribute cache_shared_cpu_list_attr =
+        __ATTR(shared_cpu_list, 0444, shared_cpu_list_show, NULL);
+
+static struct attribute *cache_index_default_attrs[] = {
+        &cache_type_attr.attr,
+        &cache_size_attr.attr,
+        &cache_number_of_sets_attr.attr,
+        &cache_ways_of_associativity_attr.attr,
+        &cache_level_attr.attr,
+        &cache_coherency_line_size_attr.attr,
+        &cache_shared_cpu_map_attr.attr,
+        &cache_shared_cpu_list_attr.attr,
+        NULL,
+};
+
+static const struct sysfs_ops cache_index_ops = {
+        .show = cache_index_show,
+};
+
+static struct kobj_type cache_index_type = {
+        .sysfs_ops = &cache_index_ops,
+        .release = cache_index_release,
+        .default_attrs = cache_index_default_attrs,
+};
+
+static int __cpuinit cache_create_index_dir(struct cache_dir *cache_dir,
+                                            struct cache *cache, int index,
+                                            int cpu)
+{
+        struct cache_index_dir *index_dir;
+        int rc;
+
+        index_dir = kzalloc(sizeof(*index_dir), GFP_KERNEL);
+        if (!index_dir)
+                return -ENOMEM;
+        index_dir->cache = cache;
+        index_dir->cpu = cpu;
+        rc = kobject_init_and_add(&index_dir->kobj, &cache_index_type,
+                                  cache_dir->kobj, "index%d", index);
+        if (rc)
+                goto out;
+        index_dir->next = cache_dir->index;
+        cache_dir->index = index_dir;
+        return 0;
+out:
+        kfree(index_dir);
+        return rc;
+}
+
+static int __cpuinit cache_add_cpu(int cpu)
+{
+        struct cache_dir *cache_dir;
+        struct cache *cache;
+        int rc, index = 0;
+
+        if (list_empty(&cache_list))
+                return 0;
+        cache_dir = cache_create_cache_dir(cpu);
+        if (!cache_dir)
+                return -ENOMEM;
+        list_for_each_entry(cache, &cache_list, list) {
+                if (!cache->private)
+                        break;
+                rc = cache_create_index_dir(cache_dir, cache, index, cpu);
+                if (rc)
+                        return rc;
+                index++;
+        }
+        return 0;
+}
+
+static void __cpuinit cache_remove_cpu(int cpu)
+{
+        struct cache_index_dir *index, *next;
+        struct cache_dir *cache_dir;
+
+        cache_dir = cache_dir_cpu[cpu];
+        if (!cache_dir)
+                return;
+        index = cache_dir->index;
+        while (index) {
+                next = index->next;
+                kobject_put(&index->kobj);
+                index = next;
+        }
+        kobject_put(cache_dir->kobj);
+        kfree(cache_dir);
+        cache_dir_cpu[cpu] = NULL;
+}
+
+static int __cpuinit cache_hotplug(struct notifier_block *nfb,
+                                   unsigned long action, void *hcpu)
+{
+        int cpu = (long)hcpu;
+        int rc = 0;
+
+        switch (action & ~CPU_TASKS_FROZEN) {
+        case CPU_ONLINE:
+                rc = cache_add_cpu(cpu);
+                if (rc)
+                        cache_remove_cpu(cpu);
+                break;
+        case CPU_DEAD:
+                cache_remove_cpu(cpu);
+                break;
+        }
+        return rc ? NOTIFY_BAD : NOTIFY_OK;
+}
+
+static int __init cache_init(void)
+{
+        int cpu;
+
+        if (!test_facility(34))
+                return 0;
+        cache_build_info();
+        for_each_online_cpu(cpu)
+                cache_add_cpu(cpu);
+        hotcpu_notifier(cache_hotplug, 0);
+        return 0;
+}
+device_initcall(cache_init);
diff --git a/arch/s390/kernel/compat_wrapper.S b/arch/s390/kernel/compat_wrapper.S
index 2d82cfcbce5b..3afba804fe97 100644
--- a/arch/s390/kernel/compat_wrapper.S
+++ b/arch/s390/kernel/compat_wrapper.S
@@ -1646,3 +1646,16 @@ ENTRY(compat_sys_process_vm_writev_wrapper)
         llgf    %r0,164(%r15)           # unsigned long
         stg     %r0,160(%r15)
         jg      compat_sys_process_vm_writev
+
+ENTRY(sys_s390_runtime_instr_wrapper)
+        lgfr    %r2,%r2                 # int
+        lgfr    %r3,%r3                 # int
+        jg      sys_s390_runtime_instr
+
+ENTRY(sys_kcmp_wrapper)
+        lgfr    %r2,%r2                 # pid_t
+        lgfr    %r3,%r3                 # pid_t
+        lgfr    %r4,%r4                 # int
+        llgfr   %r5,%r5                 # unsigned long
+        llgfr   %r6,%r6                 # unsigned long
+        jg      sys_kcmp
diff --git a/arch/s390/kernel/crash.c b/arch/s390/kernel/crash.c
deleted file mode 100644
index 3819153de8bd..000000000000
--- a/arch/s390/kernel/crash.c
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * Copyright IBM Corp. 2005
- *
- * Author(s): Heiko Carstens <heiko.carstens@de.ibm.com>
- *
- */
-
-#include <linux/threads.h>
-#include <linux/kexec.h>
-#include <linux/reboot.h>
-
-void machine_crash_shutdown(struct pt_regs *regs)
-{
-}
diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c
index cc1172b26873..fb8d8781a011 100644
--- a/arch/s390/kernel/crash_dump.c
+++ b/arch/s390/kernel/crash_dump.c
@@ -13,8 +13,9 @@
 #include <linux/slab.h>
 #include <linux/bootmem.h>
 #include <linux/elf.h>
-#include <asm/ipl.h>
 #include <asm/os_info.h>
+#include <asm/elf.h>
+#include <asm/ipl.h>
 
 #define PTR_ADD(x, y) (((char *) (x)) + ((unsigned long) (y)))
 #define PTR_SUB(x, y) (((char *) (x)) - ((unsigned long) (y)))
diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c
index 619c5d350726..cc84a24c023f 100644
--- a/arch/s390/kernel/dis.c
+++ b/arch/s390/kernel/dis.c
@@ -315,6 +315,11 @@ enum {
         LONG_INSN_POPCNT,
         LONG_INSN_RISBHG,
         LONG_INSN_RISBLG,
+        LONG_INSN_RINEXT,
+        LONG_INSN_RIEMIT,
+        LONG_INSN_TABORT,
+        LONG_INSN_TBEGIN,
+        LONG_INSN_TBEGINC,
 };
 
 static char *long_insn_name[] = {
@@ -329,7 +334,12 @@ static char *long_insn_name[] = {
         [LONG_INSN_LLGHRL] = "llghrl",
         [LONG_INSN_POPCNT] = "popcnt",
         [LONG_INSN_RISBHG] = "risbhg",
-        [LONG_INSN_RISBLG] = "risblk",
+        [LONG_INSN_RISBLG] = "risblg",
+        [LONG_INSN_RINEXT] = "rinext",
+        [LONG_INSN_RIEMIT] = "riemit",
+        [LONG_INSN_TABORT] = "tabort",
+        [LONG_INSN_TBEGIN] = "tbegin",
+        [LONG_INSN_TBEGINC] = "tbeginc",
 };
 
 static struct insn opcode[] = {
@@ -582,6 +592,17 @@ static struct insn opcode_a7[] = {
         { "", 0, INSTR_INVALID }
 };
 
+static struct insn opcode_aa[] = {
+#ifdef CONFIG_64BIT
+        { { 0, LONG_INSN_RINEXT }, 0x00, INSTR_RI_RI },
+        { "rion", 0x01, INSTR_RI_RI },
+        { "tric", 0x02, INSTR_RI_RI },
+        { "rioff", 0x03, INSTR_RI_RI },
+        { { 0, LONG_INSN_RIEMIT }, 0x04, INSTR_RI_RI },
+#endif
+        { "", 0, INSTR_INVALID }
+};
+
 static struct insn opcode_b2[] = {
 #ifdef CONFIG_64BIT
         { "sske", 0x2b, INSTR_RRF_M0RR },
@@ -594,6 +615,9 @@ static struct insn opcode_b2[] = {
         { "lpswe", 0xb2, INSTR_S_RD },
         { "srnmt", 0xb9, INSTR_S_RD },
         { "lfas", 0xbd, INSTR_S_RD },
+        { "etndg", 0xec, INSTR_RRE_R0 },
+        { { 0, LONG_INSN_TABORT }, 0xfc, INSTR_S_RD },
+        { "tend", 0xf8, INSTR_S_RD },
 #endif
         { "stidp", 0x02, INSTR_S_RD },
         { "sck", 0x04, INSTR_S_RD },
@@ -1150,6 +1174,7 @@ static struct insn opcode_e3[] = {
         { "stfh", 0xcb, INSTR_RXY_RRRD },
         { "chf", 0xcd, INSTR_RXY_RRRD },
         { "clhf", 0xcf, INSTR_RXY_RRRD },
+        { "ntstg", 0x25, INSTR_RXY_RRRD },
 #endif
         { "lrv", 0x1e, INSTR_RXY_RRRD },
         { "lrvh", 0x1f, INSTR_RXY_RRRD },
@@ -1173,6 +1198,8 @@ static struct insn opcode_e5[] = {
         { "mvhhi", 0x44, INSTR_SIL_RDI },
         { "mvhi", 0x4c, INSTR_SIL_RDI },
         { "mvghi", 0x48, INSTR_SIL_RDI },
+        { { 0, LONG_INSN_TBEGIN }, 0x60, INSTR_SIL_RDU },
+        { { 0, LONG_INSN_TBEGINC }, 0x61, INSTR_SIL_RDU },
 #endif
         { "lasp", 0x00, INSTR_SSE_RDRD },
         { "tprot", 0x01, INSTR_SSE_RDRD },
@@ -1210,6 +1237,9 @@ static struct insn opcode_eb[] = {
         { "cliy", 0x55, INSTR_SIY_URD },
         { "oiy", 0x56, INSTR_SIY_URD },
         { "xiy", 0x57, INSTR_SIY_URD },
+        { "lric", 0x60, INSTR_RSY_RDRM },
+        { "stric", 0x61, INSTR_RSY_RDRM },
+        { "mric", 0x62, INSTR_RSY_RDRM },
         { "icmh", 0x80, INSTR_RSE_RURD },
         { "icmh", 0x80, INSTR_RSY_RURD },
         { "icmy", 0x81, INSTR_RSY_RURD },
@@ -1408,6 +1438,9 @@ static struct insn *find_insn(unsigned char *code)
         case 0xa7:
                 table = opcode_a7;
                 break;
+        case 0xaa:
+                table = opcode_aa;
+                break;
         case 0xb2:
                 table = opcode_b2;
                 break;
@@ -1601,3 +1634,26 @@ void show_code(struct pt_regs *regs)
         }
         printk("\n");
 }
+
+void print_fn_code(unsigned char *code, unsigned long len)
+{
+        char buffer[64], *ptr;
+        int opsize, i;
+
+        while (len) {
+                ptr = buffer;
+                opsize = insn_length(*code);
+                ptr += sprintf(ptr, "%p: ", code);
+                for (i = 0; i < opsize; i++)
+                        ptr += sprintf(ptr, "%02x", code[i]);
+                *ptr++ = '\t';
+                if (i < 4)
+                        *ptr++ = '\t';
+                ptr += print_insn(ptr, code, (unsigned long) code);
+                *ptr++ = '\n';
+                *ptr++ = 0;
+                printk(buffer);
+                code += opsize;
+                len -= opsize;
+        }
+}
diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
index 83c3271c442b..7f4717675c19 100644
--- a/arch/s390/kernel/early.c
+++ b/arch/s390/kernel/early.c
@@ -215,36 +215,54 @@ static noinline __init void init_kernel_storage_key(void)
                                      PAGE_DEFAULT_KEY, 0);
 }
 
-static __initdata struct sysinfo_3_2_2 vmms __aligned(PAGE_SIZE);
+static __initdata char sysinfo_page[PAGE_SIZE] __aligned(PAGE_SIZE);
 
 static noinline __init void detect_machine_type(void)
 {
+        struct sysinfo_3_2_2 *vmms = (struct sysinfo_3_2_2 *)&sysinfo_page;
+
         /* Check current-configuration-level */
-        if ((stsi(NULL, 0, 0, 0) >> 28) <= 2) {
+        if (stsi(NULL, 0, 0, 0) <= 2) {
                 S390_lowcore.machine_flags |= MACHINE_FLAG_LPAR;
                 return;
         }
         /* Get virtual-machine cpu information. */
-        if (stsi(&vmms, 3, 2, 2) == -ENOSYS || !vmms.count)
+        if (stsi(vmms, 3, 2, 2) || !vmms->count)
                 return;
 
         /* Running under KVM? If not we assume z/VM */
-        if (!memcmp(vmms.vm[0].cpi, "\xd2\xe5\xd4", 3))
+        if (!memcmp(vmms->vm[0].cpi, "\xd2\xe5\xd4", 3))
                 S390_lowcore.machine_flags |= MACHINE_FLAG_KVM;
         else
                 S390_lowcore.machine_flags |= MACHINE_FLAG_VM;
 }
 
+static __init void setup_topology(void)
+{
+#ifdef CONFIG_64BIT
+        int max_mnest;
+
+        if (!test_facility(11))
+                return;
+        S390_lowcore.machine_flags |= MACHINE_FLAG_TOPOLOGY;
+        for (max_mnest = 6; max_mnest > 1; max_mnest--) {
+                if (stsi(&sysinfo_page, 15, 1, max_mnest) == 0)
+                        break;
+        }
+        topology_max_mnest = max_mnest;
+#endif
+}
+
 static void early_pgm_check_handler(void)
 {
-        unsigned long addr;
         const struct exception_table_entry *fixup;
+        unsigned long addr;
 
         addr = S390_lowcore.program_old_psw.addr;
         fixup = search_exception_tables(addr & PSW_ADDR_INSN);
         if (!fixup)
                 disabled_wait(0);
-        S390_lowcore.program_old_psw.addr = fixup->fixup | PSW_ADDR_AMODE;
+        S390_lowcore.program_old_psw.addr = extable_fixup(fixup)|PSW_ADDR_AMODE;
 }
 
 static noinline __init void setup_lowcore_early(void)
@@ -267,12 +285,10 @@ static noinline __init void setup_facility_list(void)
 
 static noinline __init void setup_hpage(void)
 {
-#ifndef CONFIG_DEBUG_PAGEALLOC
         if (!test_facility(2) || !test_facility(8))
                 return;
         S390_lowcore.machine_flags |= MACHINE_FLAG_HPAGE;
         __ctl_set_bit(0, 23);
-#endif
 }
 
 static __init void detect_mvpg(void)
@@ -366,12 +382,12 @@ static __init void detect_machine_facilities(void)
                 S390_lowcore.machine_flags |= MACHINE_FLAG_IDTE;
         if (test_facility(8))
                 S390_lowcore.machine_flags |= MACHINE_FLAG_PFMF;
-        if (test_facility(11))
-                S390_lowcore.machine_flags |= MACHINE_FLAG_TOPOLOGY;
         if (test_facility(27))
                 S390_lowcore.machine_flags |= MACHINE_FLAG_MVCOS;
         if (test_facility(40))
                 S390_lowcore.machine_flags |= MACHINE_FLAG_SPP;
+        if (test_facility(50) && test_facility(73))
+                S390_lowcore.machine_flags |= MACHINE_FLAG_TE;
 #endif
 }
 
@@ -441,7 +457,6 @@ static void __init setup_boot_command_line(void)
         append_to_cmdline(append_ipl_scpdata);
 }
 
-
 /*
  * Save ipl parameters, clear bss memory, initialize storage keys
  * and create a kernel NSS at startup if the SAVESYS= parm is defined
@@ -468,6 +483,7 @@ void __init startup_init(void)
         detect_diag44();
         detect_machine_facilities();
         setup_hpage();
+        setup_topology();
         sclp_facilities_detect();
         detect_memory_layout(memory_chunk);
 #ifdef CONFIG_DYNAMIC_FTRACE
diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index 349b7eeb348a..7549985402f7 100644
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -10,6 +10,7 @@
 
 #include <linux/init.h>
 #include <linux/linkage.h>
+#include <asm/processor.h>
 #include <asm/cache.h>
 #include <asm/errno.h>
 #include <asm/ptrace.h>
@@ -412,6 +413,11 @@ ENTRY(pgm_check_handler)
 1:      UPDATE_VTIME %r14,__LC_SYNC_ENTER_TIMER
         LAST_BREAK %r14
         lg      %r15,__LC_KERNEL_STACK
+        lg      %r14,__TI_task(%r12)
+        lghi    %r13,__LC_PGM_TDB
+        tm      __LC_PGM_ILC+2,0x02     # check for transaction abort
+        jz      2f
+        mvc     __THREAD_trap_tdb(256,%r14),0(%r13)
 2:      aghi    %r15,-(STACK_FRAME_OVERHEAD + __PT_SIZE)
         la      %r11,STACK_FRAME_OVERHEAD(%r15)
         stmg    %r0,%r7,__PT_R0(%r11)
@@ -422,13 +428,12 @@ ENTRY(pgm_check_handler)
         stg     %r10,__PT_ARGS(%r11)
         tm      __LC_PGM_ILC+3,0x80     # check for per exception
         jz      0f
-        lg      %r1,__TI_task(%r12)
         tmhh    %r8,0x0001              # kernel per event ?
         jz      pgm_kprobe
         oi      __TI_flags+7(%r12),_TIF_PER_TRAP
-        mvc     __THREAD_per_address(8,%r1),__LC_PER_ADDRESS
-        mvc     __THREAD_per_cause(2,%r1),__LC_PER_CAUSE
-        mvc     __THREAD_per_paid(1,%r1),__LC_PER_PAID
+        mvc     __THREAD_per_address(8,%r14),__LC_PER_ADDRESS
+        mvc     __THREAD_per_cause(2,%r14),__LC_PER_CAUSE
+        mvc     __THREAD_per_paid(1,%r14),__LC_PER_PAID
 0:      REENABLE_IRQS
         xc      __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
         larl    %r1,pgm_check_table
@@ -1004,9 +1009,7 @@ sie_fault:
 .Lhost_id:
         .quad   0
 
-        .section __ex_table,"a"
-        .quad   sie_loop,sie_fault
-        .previous
+        EX_TABLE(sie_loop,sie_fault)
 #endif
 
                 .section .rodata, "a"
diff --git a/arch/s390/kernel/irq.c b/arch/s390/kernel/irq.c
index dd7630d8aab7..6cdc55b26d68 100644
--- a/arch/s390/kernel/irq.c
+++ b/arch/s390/kernel/irq.c
@@ -30,33 +30,35 @@ struct irq_class {
 };
 
 static const struct irq_class intrclass_names[] = {
-        {.name = "EXT" },
-        {.name = "I/O" },
-        {.name = "CLK", .desc = "[EXT] Clock Comparator" },
-        {.name = "EXC", .desc = "[EXT] External Call" },
-        {.name = "EMS", .desc = "[EXT] Emergency Signal" },
-        {.name = "TMR", .desc = "[EXT] CPU Timer" },
-        {.name = "TAL", .desc = "[EXT] Timing Alert" },
-        {.name = "PFL", .desc = "[EXT] Pseudo Page Fault" },
-        {.name = "DSD", .desc = "[EXT] DASD Diag" },
-        {.name = "VRT", .desc = "[EXT] Virtio" },
-        {.name = "SCP", .desc = "[EXT] Service Call" },
-        {.name = "IUC", .desc = "[EXT] IUCV" },
-        {.name = "CMS", .desc = "[EXT] CPU-Measurement: Sampling" },
-        {.name = "CMC", .desc = "[EXT] CPU-Measurement: Counter" },
-        {.name = "CIO", .desc = "[I/O] Common I/O Layer Interrupt" },
-        {.name = "QAI", .desc = "[I/O] QDIO Adapter Interrupt" },
-        {.name = "DAS", .desc = "[I/O] DASD" },
-        {.name = "C15", .desc = "[I/O] 3215" },
-        {.name = "C70", .desc = "[I/O] 3270" },
-        {.name = "TAP", .desc = "[I/O] Tape" },
-        {.name = "VMR", .desc = "[I/O] Unit Record Devices" },
-        {.name = "LCS", .desc = "[I/O] LCS" },
-        {.name = "CLW", .desc = "[I/O] CLAW" },
-        {.name = "CTC", .desc = "[I/O] CTC" },
-        {.name = "APB", .desc = "[I/O] AP Bus" },
-        {.name = "CSC", .desc = "[I/O] CHSC Subchannel" },
-        {.name = "NMI", .desc = "[NMI] Machine Check" },
+        [EXTERNAL_INTERRUPT] = {.name = "EXT"},
+        [IO_INTERRUPT]       = {.name = "I/O"},
+        [EXTINT_CLK] = {.name = "CLK", .desc = "[EXT] Clock Comparator"},
+        [EXTINT_EXC] = {.name = "EXC", .desc = "[EXT] External Call"},
+        [EXTINT_EMS] = {.name = "EMS", .desc = "[EXT] Emergency Signal"},
+        [EXTINT_TMR] = {.name = "TMR", .desc = "[EXT] CPU Timer"},
+        [EXTINT_TLA] = {.name = "TAL", .desc = "[EXT] Timing Alert"},
+        [EXTINT_PFL] = {.name = "PFL", .desc = "[EXT] Pseudo Page Fault"},
+        [EXTINT_DSD] = {.name = "DSD", .desc = "[EXT] DASD Diag"},
+        [EXTINT_VRT] = {.name = "VRT", .desc = "[EXT] Virtio"},
+        [EXTINT_SCP] = {.name = "SCP", .desc = "[EXT] Service Call"},
+        [EXTINT_IUC] = {.name = "IUC", .desc = "[EXT] IUCV"},
+        [EXTINT_CMS] = {.name = "CMS", .desc = "[EXT] CPU-Measurement: Sampling"},
+        [EXTINT_CMC] = {.name = "CMC", .desc = "[EXT] CPU-Measurement: Counter"},
+        [EXTINT_CMR] = {.name = "CMR", .desc = "[EXT] CPU-Measurement: RI"},
+        [IOINT_CIO]  = {.name = "CIO", .desc = "[I/O] Common I/O Layer Interrupt"},
+        [IOINT_QAI]  = {.name = "QAI", .desc = "[I/O] QDIO Adapter Interrupt"},
+        [IOINT_DAS]  = {.name = "DAS", .desc = "[I/O] DASD"},
+        [IOINT_C15]  = {.name = "C15", .desc = "[I/O] 3215"},
+        [IOINT_C70]  = {.name = "C70", .desc = "[I/O] 3270"},
+        [IOINT_TAP]  = {.name = "TAP", .desc = "[I/O] Tape"},
+        [IOINT_VMR]  = {.name = "VMR", .desc = "[I/O] Unit Record Devices"},
+        [IOINT_LCS]  = {.name = "LCS", .desc = "[I/O] LCS"},
+        [IOINT_CLW]  = {.name = "CLW", .desc = "[I/O] CLAW"},
+        [IOINT_CTC]  = {.name = "CTC", .desc = "[I/O] CTC"},
+        [IOINT_APB]  = {.name = "APB", .desc = "[I/O] AP Bus"},
+        [IOINT_ADM]  = {.name = "ADM", .desc = "[I/O] EADM Subchannel"},
+        [IOINT_CSC]  = {.name = "CSC", .desc = "[I/O] CHSC Subchannel"},
+        [NMI_NMI]    = {.name = "NMI", .desc = "[NMI] Machine Check"},
 };
 
 /*
diff --git a/arch/s390/kernel/kprobes.c b/arch/s390/kernel/kprobes.c
index 8aa634f5944b..d1c7214e157c 100644
--- a/arch/s390/kernel/kprobes.c
+++ b/arch/s390/kernel/kprobes.c
@@ -547,7 +547,7 @@ static int __kprobes kprobe_trap_handler(struct pt_regs *regs, int trapnr)
                  */
                 entry = search_exception_tables(regs->psw.addr & PSW_ADDR_INSN);
                 if (entry) {
-                        regs->psw.addr = entry->fixup | PSW_ADDR_AMODE;
+                        regs->psw.addr = extable_fixup(entry) | PSW_ADDR_AMODE;
                         return 1;
                 }
 
diff --git a/arch/s390/kernel/lgr.c b/arch/s390/kernel/lgr.c
index eca94e74d19a..6ea6d69339b5 100644
--- a/arch/s390/kernel/lgr.c
+++ b/arch/s390/kernel/lgr.c
@@ -51,16 +51,6 @@ static struct lgr_info lgr_info_cur;
 static struct debug_info *lgr_dbf;
 
 /*
- * Return number of valid stsi levels
- */
-static inline int stsi_0(void)
-{
-        int rc = stsi(NULL, 0, 0, 0);
-
-        return rc == -ENOSYS ? rc : (((unsigned int) rc) >> 28);
-}
-
-/*
  * Copy buffer and then convert it to ASCII
  */
 static void cpascii(char *dst, char *src, int size)
@@ -76,7 +66,7 @@ static void lgr_stsi_1_1_1(struct lgr_info *lgr_info)
 {
         struct sysinfo_1_1_1 *si = (void *) lgr_page;
 
-        if (stsi(si, 1, 1, 1) == -ENOSYS)
+        if (stsi(si, 1, 1, 1))
                 return;
         cpascii(lgr_info->manufacturer, si->manufacturer,
                 sizeof(si->manufacturer));
@@ -93,7 +83,7 @@ static void lgr_stsi_2_2_2(struct lgr_info *lgr_info)
 {
         struct sysinfo_2_2_2 *si = (void *) lgr_page;
 
-        if (stsi(si, 2, 2, 2) == -ENOSYS)
+        if (stsi(si, 2, 2, 2))
                 return;
         cpascii(lgr_info->name, si->name, sizeof(si->name));
         memcpy(&lgr_info->lpar_number, &si->lpar_number,
@@ -108,7 +98,7 @@ static void lgr_stsi_3_2_2(struct lgr_info *lgr_info)
         struct sysinfo_3_2_2 *si = (void *) lgr_page;
         int i;
 
-        if (stsi(si, 3, 2, 2) == -ENOSYS)
+        if (stsi(si, 3, 2, 2))
                 return;
         for (i = 0; i < min_t(u8, si->count, VM_LEVEL_MAX); i++) {
                 cpascii(lgr_info->vm[i].name, si->vm[i].name,
@@ -124,16 +114,17 @@ static void lgr_stsi_3_2_2(struct lgr_info *lgr_info)
  */
 static void lgr_info_get(struct lgr_info *lgr_info)
 {
+        int level;
+
         memset(lgr_info, 0, sizeof(*lgr_info));
         stfle(lgr_info->stfle_fac_list, ARRAY_SIZE(lgr_info->stfle_fac_list));
-        lgr_info->level = stsi_0();
-        if (lgr_info->level == -ENOSYS)
-                return;
-        if (lgr_info->level >= 1)
+        level = stsi(NULL, 0, 0, 0);
+        lgr_info->level = level;
+        if (level >= 1)
                 lgr_stsi_1_1_1(lgr_info);
-        if (lgr_info->level >= 2)
+        if (level >= 2)
                 lgr_stsi_2_2_2(lgr_info);
-        if (lgr_info->level >= 3)
+        if (level >= 3)
                 lgr_stsi_3_2_2(lgr_info);
 }
 
diff --git a/arch/s390/kernel/machine_kexec.c b/arch/s390/kernel/machine_kexec.c
index 493304bdf1c7..b3de27700016 100644
--- a/arch/s390/kernel/machine_kexec.c
+++ b/arch/s390/kernel/machine_kexec.c
@@ -21,6 +21,7 @@
 #include <asm/reset.h>
 #include <asm/ipl.h>
 #include <asm/diag.h>
+#include <asm/elf.h>
 #include <asm/asm-offsets.h>
 #include <asm/os_info.h>
 
@@ -31,8 +32,6 @@ extern const unsigned long long relocate_kernel_len;
 
 #ifdef CONFIG_CRASH_DUMP
 
-void *fill_cpu_elf_notes(void *ptr, struct save_area *sa);
-
 /*
  * Create ELF notes for one CPU
  */
@@ -159,7 +158,7 @@ int machine_kexec_prepare(struct kimage *image)
 
         /* Can't replace kernel image since it is read-only. */
         if (ipl_flags & IPL_NSS_VALID)
-                return -ENOSYS;
+                return -EOPNOTSUPP;
 
         if (image->type == KEXEC_TYPE_CRASH)
                 return machine_kexec_prepare_kdump();
@@ -191,6 +190,10 @@ void machine_shutdown(void)
 {
 }
 
+void machine_crash_shutdown(struct pt_regs *regs)
+{
+}
+
 /*
  * Do normal kexec
  */
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 733175373a4c..5024be27df44 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -26,10 +26,12 @@
 #include <asm/io.h>
 #include <asm/processor.h>
 #include <asm/vtimer.h>
+#include <asm/exec.h>
 #include <asm/irq.h>
 #include <asm/nmi.h>
 #include <asm/smp.h>
 #include <asm/switch_to.h>
+#include <asm/runtime_instr.h>
 #include "entry.h"
 
 asmlinkage void ret_from_fork(void) asm ("ret_from_fork");
@@ -132,6 +134,7 @@ EXPORT_SYMBOL(kernel_thread);
  */
 void exit_thread(void)
 {
+        exit_thread_runtime_instr();
 }
 
 void flush_thread(void)
@@ -170,6 +173,11 @@ int copy_thread(unsigned long clone_flags, unsigned long new_stackp,
         /* Save access registers to new thread structure. */
         save_access_regs(&p->thread.acrs[0]);
 
+        /* Don't copy runtime instrumentation info */
+        p->thread.ri_cb = NULL;
+        p->thread.ri_signum = 0;
+        frame->childregs.psw.mask &= ~PSW_MASK_RI;
+
 #ifndef CONFIG_64BIT
         /*
          * save fprs to current->thread.fp_regs to merge them with
diff --git a/arch/s390/kernel/processor.c b/arch/s390/kernel/processor.c
index 572d4c9cb33b..753c41d0ffd3 100644
--- a/arch/s390/kernel/processor.c
+++ b/arch/s390/kernel/processor.c
@@ -39,9 +39,9 @@ void __cpuinit cpu_init(void)
  */
 static int show_cpuinfo(struct seq_file *m, void *v)
 {
-        static const char *hwcap_str[10] = {
+        static const char *hwcap_str[] = {
                 "esan3", "zarch", "stfle", "msa", "ldisp", "eimm", "dfp",
-                "edat", "etf3eh", "highgprs"
+                "edat", "etf3eh", "highgprs", "te"
         };
         unsigned long n = (unsigned long) v - 1;
         int i;
@@ -54,10 +54,11 @@ static int show_cpuinfo(struct seq_file *m, void *v)
                            num_online_cpus(), loops_per_jiffy/(500000/HZ),
                            (loops_per_jiffy/(5000/HZ))%100);
                 seq_puts(m, "features\t: ");
-                for (i = 0; i < 10; i++)
+                for (i = 0; i < ARRAY_SIZE(hwcap_str); i++)
                         if (hwcap_str[i] && (elf_hwcap & (1UL << i)))
                                 seq_printf(m, "%s ", hwcap_str[i]);
                 seq_puts(m, "\n");
+                show_cacheinfo(m);
         }
         get_online_cpus();
         if (cpu_online(n)) {
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index e4be113fbac6..a314c57f4e94 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -42,6 +42,7 @@ enum s390_regset {
         REGSET_GENERAL,
         REGSET_FP,
         REGSET_LAST_BREAK,
+        REGSET_TDB,
         REGSET_SYSTEM_CALL,
         REGSET_GENERAL_EXTENDED,
 };
@@ -52,6 +53,22 @@ void update_per_regs(struct task_struct *task)
         struct thread_struct *thread = &task->thread;
         struct per_regs old, new;
 
+#ifdef CONFIG_64BIT
+        /* Take care of the enable/disable of transactional execution. */
+        if (MACHINE_HAS_TE) {
+                unsigned long cr0, cr0_new;
+
+                __ctl_store(cr0, 0, 0);
+                /* set or clear transaction execution bits 8 and 9. */
+                if (task->thread.per_flags & PER_FLAG_NO_TE)
+                        cr0_new = cr0 & ~(3UL << 54);
+                else
+                        cr0_new = cr0 | (3UL << 54);
+                /* Only load control register 0 if necessary. */
+                if (cr0 != cr0_new)
+                        __ctl_load(cr0_new, 0, 0);
+        }
+#endif
         /* Copy user specified PER registers */
         new.control = thread->per_user.control;
         new.start = thread->per_user.start;
@@ -60,6 +77,10 @@ void update_per_regs(struct task_struct *task)
         /* merge TIF_SINGLE_STEP into user specified PER registers. */
         if (test_tsk_thread_flag(task, TIF_SINGLE_STEP)) {
                 new.control |= PER_EVENT_IFETCH;
+#ifdef CONFIG_64BIT
+                new.control |= PER_CONTROL_SUSPENSION;
+                new.control |= PER_EVENT_TRANSACTION_END;
+#endif
                 new.start = 0;
                 new.end = PSW_ADDR_INSN;
         }
@@ -100,6 +121,7 @@ void ptrace_disable(struct task_struct *task)
         memset(&task->thread.per_event, 0, sizeof(task->thread.per_event));
         clear_tsk_thread_flag(task, TIF_SINGLE_STEP);
         clear_tsk_thread_flag(task, TIF_PER_TRAP);
+        task->thread.per_flags = 0;
 }
 
 #ifndef CONFIG_64BIT
@@ -416,6 +438,16 @@ long arch_ptrace(struct task_struct *child, long request,
                 put_user(task_thread_info(child)->last_break,
                          (unsigned long __user *) data);
                 return 0;
+        case PTRACE_ENABLE_TE:
+                if (!MACHINE_HAS_TE)
+                        return -EIO;
+                child->thread.per_flags &= ~PER_FLAG_NO_TE;
+                return 0;
+        case PTRACE_DISABLE_TE:
+                if (!MACHINE_HAS_TE)
+                        return -EIO;
+                child->thread.per_flags |= PER_FLAG_NO_TE;
+                return 0;
         default:
                 /* Removing high order bit from addr (only for 31 bit). */
                 addr &= PSW_ADDR_INSN;
@@ -903,6 +935,28 @@ static int s390_last_break_set(struct task_struct *target,
         return 0;
 }
 
+static int s390_tdb_get(struct task_struct *target,
+                        const struct user_regset *regset,
+                        unsigned int pos, unsigned int count,
+                        void *kbuf, void __user *ubuf)
+{
+        struct pt_regs *regs = task_pt_regs(target);
+        unsigned char *data;
+
+        if (!(regs->int_code & 0x200))
+                return -ENODATA;
+        data = target->thread.trap_tdb;
+        return user_regset_copyout(&pos, &count, &kbuf, &ubuf, data, 0, 256);
+}
+
+static int s390_tdb_set(struct task_struct *target,
+                        const struct user_regset *regset,
+                        unsigned int pos, unsigned int count,
+                        const void *kbuf, const void __user *ubuf)
+{
+        return 0;
+}
+
 #endif
 
 static int s390_system_call_get(struct task_struct *target,
@@ -951,6 +1005,14 @@ static const struct user_regset s390_regsets[] = {
                 .get = s390_last_break_get,
                 .set = s390_last_break_set,
         },
+        [REGSET_TDB] = {
+                .core_note_type = NT_S390_TDB,
+                .n = 1,
+                .size = 256,
+                .align = 1,
+                .get = s390_tdb_get,
+                .set = s390_tdb_set,
+        },
 #endif
         [REGSET_SYSTEM_CALL] = {
                 .core_note_type = NT_S390_SYSTEM_CALL,
@@ -1148,6 +1210,14 @@ static const struct user_regset s390_compat_regsets[] = {
                 .get = s390_compat_last_break_get,
                 .set = s390_compat_last_break_set,
         },
+        [REGSET_TDB] = {
+                .core_note_type = NT_S390_TDB,
+                .n = 1,
+                .size = 256,
+                .align = 1,
+                .get = s390_tdb_get,
+                .set = s390_tdb_set,
+        },
         [REGSET_SYSTEM_CALL] = {
                 .core_note_type = NT_S390_SYSTEM_CALL,
                 .n = 1,
diff --git a/arch/s390/kernel/runtime_instr.c b/arch/s390/kernel/runtime_instr.c
new file mode 100644
index 000000000000..61066f6f71a5
--- /dev/null
+++ b/arch/s390/kernel/runtime_instr.c
@@ -0,0 +1,150 @@
+/*
+ * Copyright IBM Corp. 2012
+ * Author(s): Jan Glauber <jang@linux.vnet.ibm.com>
+ */
+
+#include <linux/kernel.h>
+#include <linux/syscalls.h>
+#include <linux/signal.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/init.h>
+#include <linux/errno.h>
+#include <linux/kernel_stat.h>
+#include <asm/runtime_instr.h>
+#include <asm/cpu_mf.h>
+#include <asm/irq.h>
+
+/* empty control block to disable RI by loading it */
+struct runtime_instr_cb runtime_instr_empty_cb;
+
+static int runtime_instr_avail(void)
+{
+        return test_facility(64);
+}
+
+static void disable_runtime_instr(void)
+{
+        struct pt_regs *regs = task_pt_regs(current);
+
+        load_runtime_instr_cb(&runtime_instr_empty_cb);
+
+        /*
+         * Make sure the RI bit is deleted from the PSW. If the user did not
+         * switch off RI before the system call the process will get a
+         * specification exception otherwise.
+         */
+        regs->psw.mask &= ~PSW_MASK_RI;
+}
+
+static void init_runtime_instr_cb(struct runtime_instr_cb *cb)
+{
+        cb->buf_limit = 0xfff;
+        if (s390_user_mode == HOME_SPACE_MODE)
+                cb->home_space = 1;
+        cb->int_requested = 1;
+        cb->pstate = 1;
+        cb->pstate_set_buf = 1;
+        cb->pstate_sample = 1;
+        cb->pstate_collect = 1;
+        cb->key = PAGE_DEFAULT_KEY;
+        cb->valid = 1;
+}
+
+void exit_thread_runtime_instr(void)
+{
+        struct task_struct *task = current;
+
+        if (!task->thread.ri_cb)
+                return;
+        disable_runtime_instr();
+        kfree(task->thread.ri_cb);
+        task->thread.ri_signum = 0;
+        task->thread.ri_cb = NULL;
+}
+
+static void runtime_instr_int_handler(struct ext_code ext_code,
+                                unsigned int param32, unsigned long param64)
+{
+        struct siginfo info;
+
+        if (!(param32 & CPU_MF_INT_RI_MASK))
+                return;
+
+        kstat_cpu(smp_processor_id()).irqs[EXTINT_CMR]++;
+
+        if (!current->thread.ri_cb)
+                return;
+        if (current->thread.ri_signum < SIGRTMIN ||
+            current->thread.ri_signum > SIGRTMAX) {
+                WARN_ON_ONCE(1);
+                return;
+        }
+
+        memset(&info, 0, sizeof(info));
+        info.si_signo = current->thread.ri_signum;
+        info.si_code = SI_QUEUE;
+        if (param32 & CPU_MF_INT_RI_BUF_FULL)
+                info.si_int = ENOBUFS;
+        else if (param32 & CPU_MF_INT_RI_HALTED)
+                info.si_int = ECANCELED;
+        else
+                return; /* unknown reason */
+
+        send_sig_info(current->thread.ri_signum, &info, current);
+}
+
+SYSCALL_DEFINE2(s390_runtime_instr, int, command, int, signum)
+{
+        struct runtime_instr_cb *cb;
+
+        if (!runtime_instr_avail())
+                return -EOPNOTSUPP;
+
+        if (command == S390_RUNTIME_INSTR_STOP) {
+                preempt_disable();
+                exit_thread_runtime_instr();
+                preempt_enable();
+                return 0;
+        }
+
+        if (command != S390_RUNTIME_INSTR_START ||
+            (signum < SIGRTMIN || signum > SIGRTMAX))
+                return -EINVAL;
+
+        if (!current->thread.ri_cb) {
+                cb = kzalloc(sizeof(*cb), GFP_KERNEL);
+                if (!cb)
+                        return -ENOMEM;
+        } else {
+                cb = current->thread.ri_cb;
+                memset(cb, 0, sizeof(*cb));
+        }
+
+        init_runtime_instr_cb(cb);
+        current->thread.ri_signum = signum;
+
+        /* now load the control block to make it available */
+        preempt_disable();
+        current->thread.ri_cb = cb;
+        load_runtime_instr_cb(cb);
+        preempt_enable();
+        return 0;
+}
+
+static int __init runtime_instr_init(void)
+{
+        int rc;
+
+        if (!runtime_instr_avail())
+                return 0;
+
+        measurement_alert_subclass_register();
+        rc = register_external_interrupt(0x1407, runtime_instr_int_handler);
+        if (rc)
+                measurement_alert_subclass_unregister();
+        else
+                pr_info("Runtime instrumentation facility initialized\n");
+        return rc;
+}
+device_initcall(runtime_instr_init);
diff --git a/arch/s390/kernel/s390_ksyms.c b/arch/s390/kernel/s390_ksyms.c
index 57b536649b00..9bdbcef1da9e 100644
--- a/arch/s390/kernel/s390_ksyms.c
+++ b/arch/s390/kernel/s390_ksyms.c
@@ -8,3 +8,5 @@ EXPORT_SYMBOL(_mcount);
 #if defined(CONFIG_KVM) || defined(CONFIG_KVM_MODULE)
 EXPORT_SYMBOL(sie64a);
 #endif
+EXPORT_SYMBOL(memcpy);
+EXPORT_SYMBOL(memset);
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 40b57693de38..afa9fdba200e 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -302,10 +302,10 @@ static int __init parse_vmalloc(char *arg)
 }
 early_param("vmalloc", parse_vmalloc);
 
-unsigned int addressing_mode = HOME_SPACE_MODE;
-EXPORT_SYMBOL_GPL(addressing_mode);
+unsigned int s390_user_mode = PRIMARY_SPACE_MODE;
+EXPORT_SYMBOL_GPL(s390_user_mode);
 
-static int set_amode_primary(void)
+static void __init set_user_mode_primary(void)
 {
         psw_kernel_bits = (psw_kernel_bits & ~PSW_MASK_ASC) | PSW_ASC_HOME;
         psw_user_bits = (psw_user_bits & ~PSW_MASK_ASC) | PSW_ASC_PRIMARY;
@@ -313,48 +313,30 @@ static int set_amode_primary(void)
         psw32_user_bits =
                 (psw32_user_bits & ~PSW32_MASK_ASC) | PSW32_ASC_PRIMARY;
 #endif
-
-        if (MACHINE_HAS_MVCOS) {
-                memcpy(&uaccess, &uaccess_mvcos_switch, sizeof(uaccess));
-                return 1;
-        } else {
-                memcpy(&uaccess, &uaccess_pt, sizeof(uaccess));
-                return 0;
-        }
-}
-
-/*
- * Switch kernel/user addressing modes?
- */
-static int __init early_parse_switch_amode(char *p)
-{
-        addressing_mode = PRIMARY_SPACE_MODE;
-        return 0;
+        uaccess = MACHINE_HAS_MVCOS ? uaccess_mvcos_switch : uaccess_pt;
 }
-early_param("switch_amode", early_parse_switch_amode);
 
 static int __init early_parse_user_mode(char *p)
 {
         if (p && strcmp(p, "primary") == 0)
-                addressing_mode = PRIMARY_SPACE_MODE;
+                s390_user_mode = PRIMARY_SPACE_MODE;
         else if (!p || strcmp(p, "home") == 0)
-                addressing_mode = HOME_SPACE_MODE;
+                s390_user_mode = HOME_SPACE_MODE;
         else
                 return 1;
         return 0;
 }
 early_param("user_mode", early_parse_user_mode);
 
-static void setup_addressing_mode(void)
+static void __init setup_addressing_mode(void)
 {
-        if (addressing_mode == PRIMARY_SPACE_MODE) {
-                if (set_amode_primary())
-                        pr_info("Address spaces switched, "
-                                "mvcos available\n");
-                else
-                        pr_info("Address spaces switched, "
-                                "mvcos not available\n");
-        }
+        if (s390_user_mode != PRIMARY_SPACE_MODE)
+                return;
+        set_user_mode_primary();
+        if (MACHINE_HAS_MVCOS)
+                pr_info("Address spaces switched, mvcos available\n");
+        else
+                pr_info("Address spaces switched, mvcos not available\n");
 }
 
 void *restart_stack __attribute__((__section__(".data")));
@@ -602,9 +584,7 @@ static void __init setup_memory_end(void)
 
 static void __init setup_vmcoreinfo(void)
 {
-#ifdef CONFIG_KEXEC
         mem_assign_absolute(S390_lowcore.vmcore_info, paddr_vmcoreinfo_note());
-#endif
 }
 
 #ifdef CONFIG_CRASH_DUMP
@@ -980,6 +960,12 @@ static void __init setup_hwcaps(void)
          * HWCAP_S390_HIGH_GPRS is bit 9.
          */
         elf_hwcap |= HWCAP_S390_HIGH_GPRS;
+
+        /*
+         * Transactional execution support HWCAP_S390_TE is bit 10.
+         */
+        if (test_facility(50) && test_facility(73))
+                elf_hwcap |= HWCAP_S390_TE;
 #endif
 
         get_cpu_id(&cpu_id);
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 720fda1620f2..ea431e551c6b 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -66,7 +66,7 @@ struct pcpu {
         unsigned long panic_stack;      /* panic stack for the cpu */
         unsigned long ec_mask;          /* bit mask for ec_xxx functions */
         int state;                      /* physical cpu state */
-        u32 status;                     /* last status received via sigp */
+        int polarization;               /* physical polarization */
         u16 address;                    /* physical cpu address */
 };
 
@@ -74,6 +74,10 @@ static u8 boot_cpu_type;
 static u16 boot_cpu_address;
 static struct pcpu pcpu_devices[NR_CPUS];
 
+/*
+ * The smp_cpu_state_mutex must be held when changing the state or polarization
+ * member of a pcpu data structure within the pcpu_devices arreay.
+ */
 DEFINE_MUTEX(smp_cpu_state_mutex);
 
 /*
@@ -99,7 +103,7 @@ static inline int __pcpu_sigp_relax(u16 addr, u8 order, u32 parm, u32 *status)
         int cc;
 
         while (1) {
-                cc = __pcpu_sigp(addr, order, parm, status);
+                cc = __pcpu_sigp(addr, order, parm, NULL);
                 if (cc != SIGP_CC_BUSY)
                         return cc;
                 cpu_relax();
@@ -111,7 +115,7 @@ static int pcpu_sigp_retry(struct pcpu *pcpu, u8 order, u32 parm)
         int cc, retry;
 
         for (retry = 0; ; retry++) {
-                cc = __pcpu_sigp(pcpu->address, order, parm, &pcpu->status);
+                cc = __pcpu_sigp(pcpu->address, order, parm, NULL);
                 if (cc != SIGP_CC_BUSY)
                         break;
                 if (retry >= 3)
@@ -122,16 +126,18 @@ static int pcpu_sigp_retry(struct pcpu *pcpu, u8 order, u32 parm)
 
 static inline int pcpu_stopped(struct pcpu *pcpu)
 {
+        u32 uninitialized_var(status);
+
         if (__pcpu_sigp(pcpu->address, SIGP_SENSE,
-                        0, &pcpu->status) != SIGP_CC_STATUS_STORED)
+                        0, &status) != SIGP_CC_STATUS_STORED)
                 return 0;
-        return !!(pcpu->status & (SIGP_STATUS_CHECK_STOP|SIGP_STATUS_STOPPED));
+        return !!(status & (SIGP_STATUS_CHECK_STOP|SIGP_STATUS_STOPPED));
 }
 
 static inline int pcpu_running(struct pcpu *pcpu)
 {
         if (__pcpu_sigp(pcpu->address, SIGP_SENSE_RUNNING,
-                        0, &pcpu->status) != SIGP_CC_STATUS_STORED)
+                        0, NULL) != SIGP_CC_STATUS_STORED)
                 return 1;
         /* Status stored condition code is equivalent to cpu not running. */
         return 0;
@@ -586,6 +592,16 @@ static inline void smp_get_save_area(int cpu, u16 address) { }
 
 #endif /* CONFIG_ZFCPDUMP || CONFIG_CRASH_DUMP */
 
+void smp_cpu_set_polarization(int cpu, int val)
+{
+        pcpu_devices[cpu].polarization = val;
+}
+
+int smp_cpu_get_polarization(int cpu)
+{
+        return pcpu_devices[cpu].polarization;
+}
+
 static struct sclp_cpu_info *smp_get_cpu_info(void)
 {
         static int use_sigp_detection;
@@ -628,7 +644,7 @@ static int __devinit __smp_rescan_cpus(struct sclp_cpu_info *info,
                 pcpu->address = info->cpu[i].address;
                 pcpu->state = (cpu >= info->configured) ?
                         CPU_STATE_STANDBY : CPU_STATE_CONFIGURED;
-                cpu_set_polarization(cpu, POLARIZATION_UNKNOWN);
+                smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN);
                 set_cpu_present(cpu, true);
                 if (sysfs_add && smp_add_present_cpu(cpu) != 0)
                         set_cpu_present(cpu, false);
@@ -796,7 +812,7 @@ void __init smp_prepare_boot_cpu(void)
         pcpu->async_stack = S390_lowcore.async_stack - ASYNC_SIZE;
         pcpu->panic_stack = S390_lowcore.panic_stack - PAGE_SIZE;
         S390_lowcore.percpu_offset = __per_cpu_offset[0];
-        cpu_set_polarization(0, POLARIZATION_UNKNOWN);
+        smp_cpu_set_polarization(0, POLARIZATION_UNKNOWN);
         set_cpu_present(0, true);
         set_cpu_online(0, true);
 }
@@ -862,7 +878,7 @@ static ssize_t cpu_configure_store(struct device *dev,
                 if (rc)
                         break;
                 pcpu->state = CPU_STATE_STANDBY;
-                cpu_set_polarization(cpu, POLARIZATION_UNKNOWN);
+                smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN);
                 topology_expect_change();
                 break;
         case 1:
@@ -872,7 +888,7 @@ static ssize_t cpu_configure_store(struct device *dev,
                 if (rc)
                         break;
                 pcpu->state = CPU_STATE_CONFIGURED;
-                cpu_set_polarization(cpu, POLARIZATION_UNKNOWN);
+                smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN);
                 topology_expect_change();
                 break;
         default:
@@ -959,23 +975,17 @@ static int __cpuinit smp_cpu_notify(struct notifier_block *self,
         struct device *s = &c->dev;
         int err = 0;
 
-        switch (action) {
+        switch (action & ~CPU_TASKS_FROZEN) {
         case CPU_ONLINE:
-        case CPU_ONLINE_FROZEN:
                 err = sysfs_create_group(&s->kobj, &cpu_online_attr_group);
                 break;
         case CPU_DEAD:
-        case CPU_DEAD_FROZEN:
                 sysfs_remove_group(&s->kobj, &cpu_online_attr_group);
                 break;
         }
         return notifier_from_errno(err);
 }
 
-static struct notifier_block __cpuinitdata smp_cpu_nb = {
-        .notifier_call = smp_cpu_notify,
-};
-
 static int __devinit smp_add_present_cpu(int cpu)
 {
         struct cpu *c = &pcpu_devices[cpu].cpu;
@@ -1050,7 +1060,7 @@ static int __init s390_smp_init(void)
 {
         int cpu, rc;
 
-        register_cpu_notifier(&smp_cpu_nb);
+        hotcpu_notifier(smp_cpu_notify, 0);
 #ifdef CONFIG_HOTPLUG_CPU
         rc = device_create_file(cpu_subsys.dev_root, &dev_attr_rescan);
         if (rc)
diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
index bcab2f04ba58..48174850f3b0 100644
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -350,3 +350,5 @@ SYSCALL(sys_syncfs,sys_syncfs,sys_syncfs_wrapper)
 SYSCALL(sys_setns,sys_setns,sys_setns_wrapper)
 SYSCALL(sys_process_vm_readv,sys_process_vm_readv,compat_sys_process_vm_readv_wrapper) /* 340 */
 SYSCALL(sys_process_vm_writev,sys_process_vm_writev,compat_sys_process_vm_writev_wrapper)
+SYSCALL(sys_ni_syscall,sys_s390_runtime_instr,sys_s390_runtime_instr_wrapper)
+SYSCALL(sys_kcmp,sys_kcmp,sys_kcmp_wrapper)
diff --git a/arch/s390/kernel/sysinfo.c b/arch/s390/kernel/sysinfo.c
index fa0eb238dac7..62f89d98e880 100644
--- a/arch/s390/kernel/sysinfo.c
+++ b/arch/s390/kernel/sysinfo.c
@@ -22,17 +22,41 @@
 #include <math-emu/soft-fp.h>
 #include <math-emu/single.h>
 
-static inline int stsi_0(void)
+int topology_max_mnest;
+
+/*
+ * stsi - store system information
+ *
+ * Returns the current configuration level if function code 0 was specified.
+ * Otherwise returns 0 on success or a negative value on error.
+ */
+int stsi(void *sysinfo, int fc, int sel1, int sel2)
 {
-        int rc = stsi(NULL, 0, 0, 0);
-        return rc == -ENOSYS ? rc : (((unsigned int) rc) >> 28);
+        register int r0 asm("0") = (fc << 28) | sel1;
+        register int r1 asm("1") = sel2;
+        int rc = 0;
+
+        asm volatile(
+                "       stsi    0(%3)\n"
+                "0:     jz      2f\n"
+                "1:     lhi     %1,%4\n"
+                "2:\n"
+                EX_TABLE(0b, 1b)
+                : "+d" (r0), "+d" (rc)
+                : "d" (r1), "a" (sysinfo), "K" (-EOPNOTSUPP)
+                : "cc", "memory");
+        if (rc)
+                return rc;
+        return fc ? 0 : ((unsigned int) r0) >> 28;
 }
+EXPORT_SYMBOL(stsi);
 
-static int stsi_1_1_1(struct sysinfo_1_1_1 *info, char *page, int len)
+static void stsi_1_1_1(struct seq_file *m, struct sysinfo_1_1_1 *info)
 {
-        if (stsi(info, 1, 1, 1) == -ENOSYS)
-                return len;
+        int i;
 
+        if (stsi(info, 1, 1, 1))
+                return;
         EBCASC(info->manufacturer, sizeof(info->manufacturer));
         EBCASC(info->type, sizeof(info->type));
         EBCASC(info->model, sizeof(info->model));
@@ -41,242 +65,197 @@ static int stsi_1_1_1(struct sysinfo_1_1_1 *info, char *page, int len)
         EBCASC(info->model_capacity, sizeof(info->model_capacity));
         EBCASC(info->model_perm_cap, sizeof(info->model_perm_cap));
         EBCASC(info->model_temp_cap, sizeof(info->model_temp_cap));
-        len += sprintf(page + len, "Manufacturer:         %-16.16s\n",
-                       info->manufacturer);
-        len += sprintf(page + len, "Type:                 %-4.4s\n",
-                       info->type);
+        seq_printf(m, "Manufacturer:         %-16.16s\n", info->manufacturer);
+        seq_printf(m, "Type:                 %-4.4s\n", info->type);
+        /*
+         * Sigh: the model field has been renamed with System z9
+         * to model_capacity and a new model field has been added
+         * after the plant field. To avoid confusing older programs
+         * the "Model:" prints "model_capacity model" or just
+         * "model_capacity" if the model string is empty .
+         */
+        seq_printf(m, "Model:                %-16.16s", info->model_capacity);
         if (info->model[0] != '\0')
-                /*
-                 * Sigh: the model field has been renamed with System z9
-                 * to model_capacity and a new model field has been added
-                 * after the plant field. To avoid confusing older programs
-                 * the "Model:" prints "model_capacity model" or just
-                 * "model_capacity" if the model string is empty .
-                 */
-                len += sprintf(page + len,
-                               "Model:                %-16.16s %-16.16s\n",
-                               info->model_capacity, info->model);
-        else
-                len += sprintf(page + len, "Model:                %-16.16s\n",
-                               info->model_capacity);
-        len += sprintf(page + len, "Sequence Code:        %-16.16s\n",
-                       info->sequence);
-        len += sprintf(page + len, "Plant:                %-4.4s\n",
-                       info->plant);
-        len += sprintf(page + len, "Model Capacity:       %-16.16s %08u\n",
-                       info->model_capacity, *(u32 *) info->model_cap_rating);
-        if (info->model_perm_cap[0] != '\0')
-                len += sprintf(page + len,
-                               "Model Perm. Capacity: %-16.16s %08u\n",
-                               info->model_perm_cap,
-                               *(u32 *) info->model_perm_cap_rating);
-        if (info->model_temp_cap[0] != '\0')
-                len += sprintf(page + len,
-                               "Model Temp. Capacity: %-16.16s %08u\n",
-                               info->model_temp_cap,
-                               *(u32 *) info->model_temp_cap_rating);
+                seq_printf(m, " %-16.16s", info->model);
+        seq_putc(m, '\n');
+        seq_printf(m, "Sequence Code:        %-16.16s\n", info->sequence);
+        seq_printf(m, "Plant:                %-4.4s\n", info->plant);
+        seq_printf(m, "Model Capacity:       %-16.16s %08u\n",
+                   info->model_capacity, info->model_cap_rating);
+        if (info->model_perm_cap_rating)
+                seq_printf(m, "Model Perm. Capacity: %-16.16s %08u\n",
+                           info->model_perm_cap,
+                           info->model_perm_cap_rating);
+        if (info->model_temp_cap_rating)
+                seq_printf(m, "Model Temp. Capacity: %-16.16s %08u\n",
+                           info->model_temp_cap,
+                           info->model_temp_cap_rating);
+        if (info->ncr)
+                seq_printf(m, "Nominal Cap. Rating:  %08u\n", info->ncr);
+        if (info->npr)
+                seq_printf(m, "Nominal Perm. Rating: %08u\n", info->npr);
+        if (info->ntr)
+                seq_printf(m, "Nominal Temp. Rating: %08u\n", info->ntr);
         if (info->cai) {
-                len += sprintf(page + len,
-                               "Capacity Adj. Ind.:   %d\n",
-                               info->cai);
-                len += sprintf(page + len, "Capacity Ch. Reason:  %d\n",
-                               info->ccr);
+                seq_printf(m, "Capacity Adj. Ind.:   %d\n", info->cai);
+                seq_printf(m, "Capacity Ch. Reason:  %d\n", info->ccr);
+                seq_printf(m, "Capacity Transient:   %d\n", info->t);
+        }
+        if (info->p) {
+                for (i = 1; i <= ARRAY_SIZE(info->typepct); i++) {
+                        seq_printf(m, "Type %d Percentage:    %d\n",
+                                   i, info->typepct[i - 1]);
+                }
         }
-        return len;
 }
 
-static int stsi_15_1_x(struct sysinfo_15_1_x *info, char *page, int len)
+static void stsi_15_1_x(struct seq_file *m, struct sysinfo_15_1_x *info)
 {
         static int max_mnest;
         int i, rc;
 
-        len += sprintf(page + len, "\n");
+        seq_putc(m, '\n');
         if (!MACHINE_HAS_TOPOLOGY)
-                return len;
-        if (max_mnest) {
-                stsi(info, 15, 1, max_mnest);
-        } else {
-                for (max_mnest = 6; max_mnest > 1; max_mnest--) {
-                        rc = stsi(info, 15, 1, max_mnest);
-                        if (rc != -ENOSYS)
-                                break;
-                }
-        }
-        len += sprintf(page + len, "CPU Topology HW:     ");
+                return;
+        if (stsi(info, 15, 1, topology_max_mnest))
+                return;
+        seq_printf(m, "CPU Topology HW:     ");
         for (i = 0; i < TOPOLOGY_NR_MAG; i++)
-                len += sprintf(page + len, " %d", info->mag[i]);
-        len += sprintf(page + len, "\n");
+                seq_printf(m, " %d", info->mag[i]);
+        seq_putc(m, '\n');
 #ifdef CONFIG_SCHED_MC
         store_topology(info);
-        len += sprintf(page + len, "CPU Topology SW:     ");
+        seq_printf(m, "CPU Topology SW:     ");
         for (i = 0; i < TOPOLOGY_NR_MAG; i++)
-                len += sprintf(page + len, " %d", info->mag[i]);
-        len += sprintf(page + len, "\n");
+                seq_printf(m, " %d", info->mag[i]);
+        seq_putc(m, '\n');
 #endif
-        return len;
 }
 
-static int stsi_1_2_2(struct sysinfo_1_2_2 *info, char *page, int len)
+static void stsi_1_2_2(struct seq_file *m, struct sysinfo_1_2_2 *info)
 {
         struct sysinfo_1_2_2_extension *ext;
         int i;
 
-        if (stsi(info, 1, 2, 2) == -ENOSYS)
-                return len;
+        if (stsi(info, 1, 2, 2))
+                return;
         ext = (struct sysinfo_1_2_2_extension *)
                 ((unsigned long) info + info->acc_offset);
-
-        len += sprintf(page + len, "CPUs Total:           %d\n",
-                       info->cpus_total);
-        len += sprintf(page + len, "CPUs Configured:      %d\n",
-                       info->cpus_configured);
-        len += sprintf(page + len, "CPUs Standby:         %d\n",
-                       info->cpus_standby);
-        len += sprintf(page + len, "CPUs Reserved:        %d\n",
-                       info->cpus_reserved);
-
-        if (info->format == 1) {
-                /*
-                 * Sigh 2. According to the specification the alternate
-                 * capability field is a 32 bit floating point number
-                 * if the higher order 8 bits are not zero. Printing
-                 * a floating point number in the kernel is a no-no,
-                 * always print the number as 32 bit unsigned integer.
-                 * The user-space needs to know about the strange
-                 * encoding of the alternate cpu capability.
-                 */
-                len += sprintf(page + len, "Capability:           %u %u\n",
-                               info->capability, ext->alt_capability);
-                for (i = 2; i <= info->cpus_total; i++)
-                        len += sprintf(page + len,
-                                       "Adjustment %02d-way:    %u %u\n",
-                                       i, info->adjustment[i-2],
-                                       ext->alt_adjustment[i-2]);
-
-        } else {
-                len += sprintf(page + len, "Capability:           %u\n",
-                               info->capability);
-                for (i = 2; i <= info->cpus_total; i++)
-                        len += sprintf(page + len,
-                                       "Adjustment %02d-way:    %u\n",
-                                       i, info->adjustment[i-2]);
+        seq_printf(m, "CPUs Total:           %d\n", info->cpus_total);
+        seq_printf(m, "CPUs Configured:      %d\n", info->cpus_configured);
+        seq_printf(m, "CPUs Standby:         %d\n", info->cpus_standby);
+        seq_printf(m, "CPUs Reserved:        %d\n", info->cpus_reserved);
+        /*
+         * Sigh 2. According to the specification the alternate
+         * capability field is a 32 bit floating point number
+         * if the higher order 8 bits are not zero. Printing
+         * a floating point number in the kernel is a no-no,
+         * always print the number as 32 bit unsigned integer.
+         * The user-space needs to know about the strange
+         * encoding of the alternate cpu capability.
+         */
+        seq_printf(m, "Capability:           %u", info->capability);
+        if (info->format == 1)
+                seq_printf(m, " %u", ext->alt_capability);
+        seq_putc(m, '\n');
+        if (info->nominal_cap)
+                seq_printf(m, "Nominal Capability:   %d\n", info->nominal_cap);
+        if (info->secondary_cap)
+                seq_printf(m, "Secondary Capability: %d\n", info->secondary_cap);
+        for (i = 2; i <= info->cpus_total; i++) {
+                seq_printf(m, "Adjustment %02d-way:    %u",
+                           i, info->adjustment[i-2]);
+                if (info->format == 1)
+                        seq_printf(m, " %u", ext->alt_adjustment[i-2]);
+                seq_putc(m, '\n');
         }
-
-        if (info->secondary_capability != 0)
-                len += sprintf(page + len, "Secondary Capability: %d\n",
-                               info->secondary_capability);
-        return len;
 }
 
-static int stsi_2_2_2(struct sysinfo_2_2_2 *info, char *page, int len)
+static void stsi_2_2_2(struct seq_file *m, struct sysinfo_2_2_2 *info)
 {
-        if (stsi(info, 2, 2, 2) == -ENOSYS)
-                return len;
-
+        if (stsi(info, 2, 2, 2))
+                return;
         EBCASC(info->name, sizeof(info->name));
-
-        len += sprintf(page + len, "\n");
-        len += sprintf(page + len, "LPAR Number:          %d\n",
-                       info->lpar_number);
-
-        len += sprintf(page + len, "LPAR Characteristics: ");
+        seq_putc(m, '\n');
+        seq_printf(m, "LPAR Number:          %d\n", info->lpar_number);
+        seq_printf(m, "LPAR Characteristics: ");
         if (info->characteristics & LPAR_CHAR_DEDICATED)
-                len += sprintf(page + len, "Dedicated ");
+                seq_printf(m, "Dedicated ");
         if (info->characteristics & LPAR_CHAR_SHARED)
-                len += sprintf(page + len, "Shared ");
+                seq_printf(m, "Shared ");
         if (info->characteristics & LPAR_CHAR_LIMITED)
-                len += sprintf(page + len, "Limited ");
-        len += sprintf(page + len, "\n");
-
-        len += sprintf(page + len, "LPAR Name:            %-8.8s\n",
-                       info->name);
-
-        len += sprintf(page + len, "LPAR Adjustment:      %d\n",
-                       info->caf);
-
-        len += sprintf(page + len, "LPAR CPUs Total:      %d\n",
-                       info->cpus_total);
-        len += sprintf(page + len, "LPAR CPUs Configured: %d\n",
-                       info->cpus_configured);
-        len += sprintf(page + len, "LPAR CPUs Standby:    %d\n",
-                       info->cpus_standby);
-        len += sprintf(page + len, "LPAR CPUs Reserved:   %d\n",
-                       info->cpus_reserved);
-        len += sprintf(page + len, "LPAR CPUs Dedicated:  %d\n",
-                       info->cpus_dedicated);
-        len += sprintf(page + len, "LPAR CPUs Shared:     %d\n",
-                       info->cpus_shared);
-        return len;
+                seq_printf(m, "Limited ");
+        seq_putc(m, '\n');
+        seq_printf(m, "LPAR Name:            %-8.8s\n", info->name);
+        seq_printf(m, "LPAR Adjustment:      %d\n", info->caf);
+        seq_printf(m, "LPAR CPUs Total:      %d\n", info->cpus_total);
+        seq_printf(m, "LPAR CPUs Configured: %d\n", info->cpus_configured);
+        seq_printf(m, "LPAR CPUs Standby:    %d\n", info->cpus_standby);
+        seq_printf(m, "LPAR CPUs Reserved:   %d\n", info->cpus_reserved);
+        seq_printf(m, "LPAR CPUs Dedicated:  %d\n", info->cpus_dedicated);
+        seq_printf(m, "LPAR CPUs Shared:     %d\n", info->cpus_shared);
 }
 
-static int stsi_3_2_2(struct sysinfo_3_2_2 *info, char *page, int len)
+static void stsi_3_2_2(struct seq_file *m, struct sysinfo_3_2_2 *info)
 {
         int i;
 
-        if (stsi(info, 3, 2, 2) == -ENOSYS)
-                return len;
+        if (stsi(info, 3, 2, 2))
+                return;
         for (i = 0; i < info->count; i++) {
                 EBCASC(info->vm[i].name, sizeof(info->vm[i].name));
                 EBCASC(info->vm[i].cpi, sizeof(info->vm[i].cpi));
-                len += sprintf(page + len, "\n");
-                len += sprintf(page + len, "VM%02d Name:            %-8.8s\n",
-                               i, info->vm[i].name);
-                len += sprintf(page + len, "VM%02d Control Program: %-16.16s\n",
-                               i, info->vm[i].cpi);
-
-                len += sprintf(page + len, "VM%02d Adjustment:      %d\n",
-                               i, info->vm[i].caf);
-
-                len += sprintf(page + len, "VM%02d CPUs Total:      %d\n",
-                               i, info->vm[i].cpus_total);
-                len += sprintf(page + len, "VM%02d CPUs Configured: %d\n",
-                               i, info->vm[i].cpus_configured);
-                len += sprintf(page + len, "VM%02d CPUs Standby:    %d\n",
-                               i, info->vm[i].cpus_standby);
-                len += sprintf(page + len, "VM%02d CPUs Reserved:   %d\n",
-                               i, info->vm[i].cpus_reserved);
+                seq_putc(m, '\n');
+                seq_printf(m, "VM%02d Name:            %-8.8s\n", i, info->vm[i].name);
+                seq_printf(m, "VM%02d Control Program: %-16.16s\n", i, info->vm[i].cpi);
+                seq_printf(m, "VM%02d Adjustment:      %d\n", i, info->vm[i].caf);
+                seq_printf(m, "VM%02d CPUs Total:      %d\n", i, info->vm[i].cpus_total);
+                seq_printf(m, "VM%02d CPUs Configured: %d\n", i, info->vm[i].cpus_configured);
+                seq_printf(m, "VM%02d CPUs Standby:    %d\n", i, info->vm[i].cpus_standby);
+                seq_printf(m, "VM%02d CPUs Reserved:   %d\n", i, info->vm[i].cpus_reserved);
         }
-        return len;
 }
 
-static int proc_read_sysinfo(char *page, char **start,
-                             off_t off, int count,
-                             int *eof, void *data)
+static int sysinfo_show(struct seq_file *m, void *v)
 {
-        unsigned long info = get_zeroed_page(GFP_KERNEL);
-        int level, len;
+        void *info = (void *)get_zeroed_page(GFP_KERNEL);
+        int level;
 
         if (!info)
                 return 0;
-
-        len = 0;
-        level = stsi_0();
+        level = stsi(NULL, 0, 0, 0);
         if (level >= 1)
-                len = stsi_1_1_1((struct sysinfo_1_1_1 *) info, page, len);
-
+                stsi_1_1_1(m, info);
         if (level >= 1)
-                len = stsi_15_1_x((struct sysinfo_15_1_x *) info, page, len);
-
+                stsi_15_1_x(m, info);
         if (level >= 1)
-                len = stsi_1_2_2((struct sysinfo_1_2_2 *) info, page, len);
-
+                stsi_1_2_2(m, info);
         if (level >= 2)
-                len = stsi_2_2_2((struct sysinfo_2_2_2 *) info, page, len);
-
+                stsi_2_2_2(m, info);
         if (level >= 3)
-                len = stsi_3_2_2((struct sysinfo_3_2_2 *) info, page, len);
+                stsi_3_2_2(m, info);
+        free_page((unsigned long)info);
+        return 0;
+}
 
-        free_page(info);
-        return len;
+static int sysinfo_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, sysinfo_show, NULL);
 }
 
-static __init int create_proc_sysinfo(void)
+static const struct file_operations sysinfo_fops = {
+        .open           = sysinfo_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static int __init sysinfo_create_proc(void)
 {
-        create_proc_read_entry("sysinfo", 0444, NULL,
-                               proc_read_sysinfo, NULL);
+        proc_create("sysinfo", 0444, NULL, &sysinfo_fops);
         return 0;
 }
-device_initcall(create_proc_sysinfo);
+device_initcall(sysinfo_create_proc);
 
 /*
  * Service levels interface.
@@ -407,7 +386,7 @@ void s390_adjust_jiffies(void)
         if (!info)
                 return;
 
-        if (stsi(info, 1, 2, 2) != -ENOSYS) {
+        if (stsi(info, 1, 2, 2) == 0) {
                 /*
                  * Major sigh. The cpu capability encoding is "special".
                  * If the first 9 bits of info->capability are 0 then it
diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
index dcec960fc724..2db1011b8b19 100644
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@@ -329,7 +329,7 @@ static unsigned long clock_sync_flags;
  * The synchronous get_clock function. It will write the current clock
  * value to the clock pointer and return 0 if the clock is in sync with
  * the external time source. If the clock mode is local it will return
- * -ENOSYS and -EAGAIN if the clock is not in sync with the external
+ * -EOPNOTSUPP and -EAGAIN if the clock is not in sync with the external
  * reference.
  */
 int get_sync_clock(unsigned long long *clock)
@@ -347,7 +347,7 @@ int get_sync_clock(unsigned long long *clock)
                 return 0;
         if (!test_bit(CLOCK_SYNC_HAS_ETR, &clock_sync_flags) &&
             !test_bit(CLOCK_SYNC_HAS_STP, &clock_sync_flags))
-                return -ENOSYS;
+                return -EOPNOTSUPP;
         if (!test_bit(CLOCK_SYNC_ETR, &clock_sync_flags) &&
             !test_bit(CLOCK_SYNC_STP, &clock_sync_flags))
                 return -EACCES;
diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c
index 05151e06c388..54d93f4b6818 100644
--- a/arch/s390/kernel/topology.c
+++ b/arch/s390/kernel/topology.c
@@ -17,6 +17,7 @@
 #include <linux/cpu.h>
 #include <linux/smp.h>
 #include <linux/mm.h>
+#include <asm/sysinfo.h>
 
 #define PTF_HORIZONTAL  (0UL)
 #define PTF_VERTICAL    (1UL)
@@ -44,9 +45,6 @@ static struct mask_info book_info;
 cpumask_t cpu_book_map[NR_CPUS];
 unsigned char cpu_book_id[NR_CPUS];
 
-/* smp_cpu_state_mutex must be held when accessing this array */
-int cpu_polarization[NR_CPUS];
-
 static cpumask_t cpu_group_map(struct mask_info *info, unsigned int cpu)
 {
         cpumask_t mask;
@@ -75,10 +73,7 @@ static struct mask_info *add_cpus_to_mask(struct topology_cpu *tl_cpu,
 {
         unsigned int cpu;
 
-        for (cpu = find_first_bit(&tl_cpu->mask[0], TOPOLOGY_CPU_BITS);
-             cpu < TOPOLOGY_CPU_BITS;
-             cpu = find_next_bit(&tl_cpu->mask[0], TOPOLOGY_CPU_BITS, cpu + 1))
-        {
+        for_each_set_bit(cpu, &tl_cpu->mask[0], TOPOLOGY_CPU_BITS) {
                 unsigned int rcpu;
                 int lcpu;
 
@@ -94,7 +89,7 @@ static struct mask_info *add_cpus_to_mask(struct topology_cpu *tl_cpu,
                         } else {
                                 cpu_core_id[lcpu] = core->id;
                         }
-                        cpu_set_polarization(lcpu, tl_cpu->pp);
+                        smp_cpu_set_polarization(lcpu, tl_cpu->pp);
                 }
         }
         return core;
@@ -201,7 +196,7 @@ static void topology_update_polarization_simple(void)
 
         mutex_lock(&smp_cpu_state_mutex);
         for_each_possible_cpu(cpu)
-                cpu_set_polarization(cpu, POLARIZATION_HRZ);
+                smp_cpu_set_polarization(cpu, POLARIZATION_HRZ);
         mutex_unlock(&smp_cpu_state_mutex);
 }
 
@@ -231,7 +226,7 @@ int topology_set_cpu_management(int fc)
         if (rc)
                 return -EBUSY;
         for_each_possible_cpu(cpu)
-                cpu_set_polarization(cpu, POLARIZATION_UNKNOWN);
+                smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN);
         return rc;
 }
 
@@ -250,12 +245,10 @@ static void update_cpu_core_map(void)
 
 void store_topology(struct sysinfo_15_1_x *info)
 {
-        int rc;
-
-        rc = stsi(info, 15, 1, 3);
-        if (rc != -ENOSYS)
-                return;
-        stsi(info, 15, 1, 2);
+        if (topology_max_mnest >= 3)
+                stsi(info, 15, 1, 3);
+        else
+                stsi(info, 15, 1, 2);
 }
 
 int arch_update_cpu_topology(void)
@@ -415,7 +408,7 @@ static ssize_t cpu_polarization_show(struct device *dev,
         ssize_t count;
 
         mutex_lock(&smp_cpu_state_mutex);
-        switch (cpu_read_polarization(cpu)) {
+        switch (smp_cpu_get_polarization(cpu)) {
         case POLARIZATION_HRZ:
                 count = sprintf(buf, "horizontal\n");
                 break;
diff --git a/arch/s390/kernel/traps.c b/arch/s390/kernel/traps.c
index 01775c04a90e..3d2b0fa37db0 100644
--- a/arch/s390/kernel/traps.c
+++ b/arch/s390/kernel/traps.c
@@ -57,6 +57,23 @@ static int kstack_depth_to_print = 12;
 static int kstack_depth_to_print = 20;
 #endif /* CONFIG_64BIT */
 
+static inline void __user *get_trap_ip(struct pt_regs *regs)
+{
+#ifdef CONFIG_64BIT
+        unsigned long address;
+
+        if (regs->int_code & 0x200)
+                address = *(unsigned long *)(current->thread.trap_tdb + 24);
+        else
+                address = regs->psw.addr;
+        return (void __user *)
+                ((address - (regs->int_code >> 16)) & PSW_ADDR_INSN);
+#else
+        return (void __user *)
+                ((regs->psw.addr - (regs->int_code >> 16)) & PSW_ADDR_INSN);
+#endif
+}
+
 /*
  * For show_trace we have tree different stack to consider:
  *   - the panic stack which is used if the kernel stack has overflown
@@ -214,7 +231,6 @@ void show_registers(struct pt_regs *regs)
 
 void show_regs(struct pt_regs *regs)
 {
-        print_modules();
         printk("CPU: %d %s %s %.*s\n",
                task_thread_info(current)->cpu, print_tainted(),
                init_utsname()->release,
@@ -254,6 +270,7 @@ void die(struct pt_regs *regs, const char *str)
 #endif
         printk("\n");
         notify_die(DIE_OOPS, str, regs, 0, regs->int_code & 0xffff, SIGSEGV);
+        print_modules();
         show_regs(regs);
         bust_spinlocks(0);
         add_taint(TAINT_DIE);
@@ -285,12 +302,6 @@ int is_valid_bugaddr(unsigned long addr)
         return 1;
 }
 
-static inline void __user *get_psw_address(struct pt_regs *regs)
-{
-        return (void __user *)
-                ((regs->psw.addr - (regs->int_code >> 16)) & PSW_ADDR_INSN);
-}
-
 static void __kprobes do_trap(struct pt_regs *regs,
                               int si_signo, int si_code, char *str)
 {
@@ -304,14 +315,14 @@ static void __kprobes do_trap(struct pt_regs *regs,
                 info.si_signo = si_signo;
                 info.si_errno = 0;
                 info.si_code = si_code;
-                info.si_addr = get_psw_address(regs);
+                info.si_addr = get_trap_ip(regs);
                 force_sig_info(si_signo, &info, current);
                 report_user_fault(regs, si_signo);
         } else {
                 const struct exception_table_entry *fixup;
                 fixup = search_exception_tables(regs->psw.addr & PSW_ADDR_INSN);
                 if (fixup)
-                        regs->psw.addr = fixup->fixup | PSW_ADDR_AMODE;
+                        regs->psw.addr = extable_fixup(fixup) | PSW_ADDR_AMODE;
                 else {
                         enum bug_trap_type btt;
 
@@ -381,6 +392,11 @@ DO_ERROR_INFO(special_op_exception, SIGILL, ILL_ILLOPN,
 DO_ERROR_INFO(translation_exception, SIGILL, ILL_ILLOPN,
               "translation exception")
 
+#ifdef CONFIG_64BIT
+DO_ERROR_INFO(transaction_exception, SIGILL, ILL_ILLOPN,
+              "transaction constraint exception")
+#endif
+
 static inline void do_fp_trap(struct pt_regs *regs, int fpc)
 {
         int si_code = 0;
@@ -408,7 +424,7 @@ static void __kprobes illegal_op(struct pt_regs *regs)
         __u16 __user *location;
         int signal = 0;
 
-        location = get_psw_address(regs);
+        location = get_trap_ip(regs);
 
         if (user_mode(regs)) {
                 if (get_user(*((__u16 *) opcode), (__u16 __user *) location))
@@ -476,7 +492,7 @@ void specification_exception(struct pt_regs *regs)
         __u16 __user *location = NULL;
         int signal = 0;
 
-        location = (__u16 __user *) get_psw_address(regs);
+        location = (__u16 __user *) get_trap_ip(regs);
 
         if (user_mode(regs)) {
                 get_user(*((__u16 *) opcode), location);
@@ -525,7 +541,7 @@ static void data_exception(struct pt_regs *regs)
         __u16 __user *location;
         int signal = 0;
 
-        location = get_psw_address(regs);
+        location = get_trap_ip(regs);
 
         if (MACHINE_HAS_IEEE)
                 asm volatile("stfpc %0" : "=m" (current->thread.fp_regs.fpc));
@@ -641,6 +657,7 @@ void __init trap_init(void)
         pgm_check_table[0x12] = &translation_exception;
         pgm_check_table[0x13] = &special_op_exception;
 #ifdef CONFIG_64BIT
+        pgm_check_table[0x18] = &transaction_exception;
         pgm_check_table[0x38] = &do_asce_exception;
         pgm_check_table[0x39] = &do_dat_exception;
         pgm_check_table[0x3A] = &do_dat_exception;
diff --git a/arch/s390/kernel/vdso.c b/arch/s390/kernel/vdso.c
index 9a19ca367c17..d7776281cb60 100644
--- a/arch/s390/kernel/vdso.c
+++ b/arch/s390/kernel/vdso.c
@@ -85,7 +85,7 @@ struct vdso_data *vdso_data = &vdso_data_store.data;
 static void vdso_init_data(struct vdso_data *vd)
 {
         vd->ectg_available =
-                addressing_mode != HOME_SPACE_MODE && test_facility(31);
+                s390_user_mode != HOME_SPACE_MODE && test_facility(31);
 }
 
 #ifdef CONFIG_64BIT
@@ -102,7 +102,7 @@ int vdso_alloc_per_cpu(struct _lowcore *lowcore)
 
         lowcore->vdso_per_cpu_data = __LC_PASTE;
 
-        if (addressing_mode == HOME_SPACE_MODE || !vdso_enabled)
+        if (s390_user_mode == HOME_SPACE_MODE || !vdso_enabled)
                 return 0;
 
         segment_table = __get_free_pages(GFP_KERNEL, SEGMENT_ORDER);
@@ -147,7 +147,7 @@ void vdso_free_per_cpu(struct _lowcore *lowcore)
         unsigned long segment_table, page_table, page_frame;
         u32 *psal, *aste;
 
-        if (addressing_mode == HOME_SPACE_MODE || !vdso_enabled)
+        if (s390_user_mode == HOME_SPACE_MODE || !vdso_enabled)
                 return;
 
         psal = (u32 *)(addr_t) lowcore->paste[4];
@@ -165,7 +165,7 @@ static void vdso_init_cr5(void)
 {
         unsigned long cr5;
 
-        if (addressing_mode == HOME_SPACE_MODE || !vdso_enabled)
+        if (s390_user_mode == HOME_SPACE_MODE || !vdso_enabled)
                 return;
         cr5 = offsetof(struct _lowcore, paste);
         __ctl_load(cr5, 5, 5);
diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
index cb5093c26d16..790334427895 100644
--- a/arch/s390/kernel/vtime.c
+++ b/arch/s390/kernel/vtime.c
@@ -378,9 +378,8 @@ static int __cpuinit s390_nohz_notify(struct notifier_block *self,
         long cpu = (long) hcpu;
 
         idle = &per_cpu(s390_idle, cpu);
-        switch (action) {
+        switch (action & ~CPU_TASKS_FROZEN) {
         case CPU_DYING:
-        case CPU_DYING_FROZEN:
                 idle->nohz_delay = 0;
         default:
                 break;
diff --git a/arch/s390/kvm/Kconfig b/arch/s390/kvm/Kconfig
index 78eb9847008f..9b04a32e5695 100644
--- a/arch/s390/kvm/Kconfig
+++ b/arch/s390/kvm/Kconfig
@@ -5,7 +5,7 @@ source "virt/kvm/Kconfig"
 
 menuconfig VIRTUALIZATION
         def_bool y
-        prompt "Virtualization"
+        prompt "KVM"
         ---help---
           Say Y here to get to see options for using your Linux host to run other
           operating systems inside virtual machines (guests).
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index 60da903d6f3e..310be61bead7 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -211,7 +211,7 @@ static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem)
         spin_unlock(&fi->lock);
 
         /* deal with other level 3 hypervisors */
-        if (stsi(mem, 3, 2, 2) == -ENOSYS)
+        if (stsi(mem, 3, 2, 2))
                 mem->count = 0;
         if (mem->count < 8)
                 mem->count++;
@@ -259,7 +259,7 @@ static int handle_stsi(struct kvm_vcpu *vcpu)
                 mem = get_zeroed_page(GFP_KERNEL);
                 if (!mem)
                         goto out_fail;
-                if (stsi((void *) mem, fc, sel1, sel2) == -ENOSYS)
+                if (stsi((void *) mem, fc, sel1, sel2))
                         goto out_mem;
                 break;
         case 3:
diff --git a/arch/s390/lib/Makefile b/arch/s390/lib/Makefile
index 761ab8b56afc..6ab0d0b5cec8 100644
--- a/arch/s390/lib/Makefile
+++ b/arch/s390/lib/Makefile
@@ -4,6 +4,7 @@
 
 lib-y += delay.o string.o uaccess_std.o uaccess_pt.o
 obj-y += usercopy.o
-obj-$(CONFIG_32BIT) += div64.o qrnnd.o ucmpdi2.o
+obj-$(CONFIG_32BIT) += div64.o qrnnd.o ucmpdi2.o mem32.o
+obj-$(CONFIG_64BIT) += mem64.o
 lib-$(CONFIG_64BIT) += uaccess_mvcos.o
 lib-$(CONFIG_SMP) += spinlock.o
diff --git a/arch/s390/lib/mem32.S b/arch/s390/lib/mem32.S
new file mode 100644
index 000000000000..14ca9244b615
--- /dev/null
+++ b/arch/s390/lib/mem32.S
@@ -0,0 +1,92 @@
+/*
+ * String handling functions.
+ *
+ * Copyright IBM Corp. 2012
+ */
+
+#include <linux/linkage.h>
+
+/*
+ * memset implementation
+ *
+ * This code corresponds to the C construct below. We do distinguish
+ * between clearing (c == 0) and setting a memory array (c != 0) simply
+ * because nearly all memset invocations in the kernel clear memory and
+ * the xc instruction is preferred in such cases.
+ *
+ * void *memset(void *s, int c, size_t n)
+ * {
+ *      if (likely(c == 0))
+ *              return __builtin_memset(s, 0, n);
+ *      return __builtin_memset(s, c, n);
+ * }
+ */
+ENTRY(memset)
+        basr    %r5,%r0
+.Lmemset_base:
+        ltr     %r4,%r4
+        bzr     %r14
+        ltr     %r3,%r3
+        jnz     .Lmemset_fill
+        ahi     %r4,-1
+        lr      %r3,%r4
+        srl     %r3,8
+        ltr     %r3,%r3
+        lr      %r1,%r2
+        je      .Lmemset_clear_rest
+.Lmemset_clear_loop:
+        xc      0(256,%r1),0(%r1)
+        la      %r1,256(%r1)
+        brct    %r3,.Lmemset_clear_loop
+.Lmemset_clear_rest:
+        ex      %r4,.Lmemset_xc-.Lmemset_base(%r5)
+        br      %r14
+.Lmemset_fill:
+        stc     %r3,0(%r2)
+        chi     %r4,1
+        lr      %r1,%r2
+        ber     %r14
+        ahi     %r4,-2
+        lr      %r3,%r4
+        srl     %r3,8
+        ltr     %r3,%r3
+        je      .Lmemset_fill_rest
+.Lmemset_fill_loop:
+        mvc     1(256,%r1),0(%r1)
+        la      %r1,256(%r1)
+        brct    %r3,.Lmemset_fill_loop
+.Lmemset_fill_rest:
+        ex      %r4,.Lmemset_mvc-.Lmemset_base(%r5)
+        br      %r14
+.Lmemset_xc:
+        xc      0(1,%r1),0(%r1)
+.Lmemset_mvc:
+        mvc     1(1,%r1),0(%r1)
+
+/*
+ * memcpy implementation
+ *
+ * void *memcpy(void *dest, const void *src, size_t n)
+ */
+ENTRY(memcpy)
+        basr    %r5,%r0
+.Lmemcpy_base:
+        ltr     %r4,%r4
+        bzr     %r14
+        ahi     %r4,-1
+        lr      %r0,%r4
+        srl     %r0,8
+        ltr     %r0,%r0
+        lr      %r1,%r2
+        jnz     .Lmemcpy_loop
+.Lmemcpy_rest:
+        ex      %r4,.Lmemcpy_mvc-.Lmemcpy_base(%r5)
+        br      %r14
+.Lmemcpy_loop:
+        mvc     0(256,%r1),0(%r3)
+        la      %r1,256(%r1)
+        la      %r3,256(%r3)
+        brct    %r0,.Lmemcpy_loop
+        j       .Lmemcpy_rest
+.Lmemcpy_mvc:
+        mvc     0(1,%r1),0(%r3)
diff --git a/arch/s390/lib/mem64.S b/arch/s390/lib/mem64.S
new file mode 100644
index 000000000000..c6d553e85ab1
--- /dev/null
+++ b/arch/s390/lib/mem64.S
@@ -0,0 +1,88 @@
+/*
+ * String handling functions.
+ *
+ * Copyright IBM Corp. 2012
+ */
+
+#include <linux/linkage.h>
+
+/*
+ * memset implementation
+ *
+ * This code corresponds to the C construct below. We do distinguish
+ * between clearing (c == 0) and setting a memory array (c != 0) simply
+ * because nearly all memset invocations in the kernel clear memory and
+ * the xc instruction is preferred in such cases.
+ *
+ * void *memset(void *s, int c, size_t n)
+ * {
+ *      if (likely(c == 0))
+ *              return __builtin_memset(s, 0, n);
+ *      return __builtin_memset(s, c, n);
+ * }
+ */
+ENTRY(memset)
+        ltgr    %r4,%r4
+        bzr     %r14
+        ltgr    %r3,%r3
+        jnz     .Lmemset_fill
+        aghi    %r4,-1
+        srlg    %r3,%r4,8
+        ltgr    %r3,%r3
+        lgr     %r1,%r2
+        jz      .Lmemset_clear_rest
+.Lmemset_clear_loop:
+        xc      0(256,%r1),0(%r1)
+        la      %r1,256(%r1)
+        brctg   %r3,.Lmemset_clear_loop
+.Lmemset_clear_rest:
+        larl    %r3,.Lmemset_xc
+        ex      %r4,0(%r3)
+        br      %r14
+.Lmemset_fill:
+        stc     %r3,0(%r2)
+        cghi    %r4,1
+        lgr     %r1,%r2
+        ber     %r14
+        aghi    %r4,-2
+        srlg    %r3,%r4,8
+        ltgr    %r3,%r3
+        jz      .Lmemset_fill_rest
+.Lmemset_fill_loop:
+        mvc     1(256,%r1),0(%r1)
+        la      %r1,256(%r1)
+        brctg   %r3,.Lmemset_fill_loop
+.Lmemset_fill_rest:
+        larl    %r3,.Lmemset_mvc
+        ex      %r4,0(%r3)
+        br      %r14
+.Lmemset_xc:
+        xc      0(1,%r1),0(%r1)
+.Lmemset_mvc:
+        mvc     1(1,%r1),0(%r1)
+
+/*
+ * memcpy implementation
+ *
+ * void *memcpy(void *dest, const void *src, size_t n)
+ */
+ENTRY(memcpy)
+        ltgr    %r4,%r4
+        bzr     %r14
+        aghi    %r4,-1
+        srlg    %r5,%r4,8
+        ltgr    %r5,%r5
+        lgr     %r1,%r2
+        jnz     .Lmemcpy_loop
+.Lmemcpy_rest:
+        larl    %r5,.Lmemcpy_mvc
+        ex      %r4,0(%r5)
+        br      %r14
+.Lmemcpy_loop:
+        mvc     0(256,%r1),0(%r3)
+        la      %r1,256(%r1)
+        la      %r3,256(%r3)
+        brctg   %r5,.Lmemcpy_loop
+        j       .Lmemcpy_rest
+.Lmemcpy_mvc:
+        mvc     0(1,%r1),0(%r3)
diff --git a/arch/s390/lib/string.c b/arch/s390/lib/string.c
index 846ec64ab2c9..b647d5ff0ad9 100644
--- a/arch/s390/lib/string.c
+++ b/arch/s390/lib/string.c
@@ -43,11 +43,7 @@ static inline char *__strnend(const char *s, size_t n)
  */
 size_t strlen(const char *s)
 {
-#if __GNUC__ < 4
         return __strend(s) - s;
-#else
-        return __builtin_strlen(s);
-#endif
 }
 EXPORT_SYMBOL(strlen);
 
@@ -73,7 +69,6 @@ EXPORT_SYMBOL(strnlen);
  */
 char *strcpy(char *dest, const char *src)
 {
-#if __GNUC__ < 4
         register int r0 asm("0") = 0;
         char *ret = dest;
 
@@ -82,9 +77,6 @@ char *strcpy(char *dest, const char *src)
                       : "+&a" (dest), "+&a" (src) : "d" (r0)
                       : "cc", "memory" );
         return ret;
-#else
-        return __builtin_strcpy(dest, src);
-#endif
 }
 EXPORT_SYMBOL(strcpy);
 
@@ -106,7 +98,7 @@ size_t strlcpy(char *dest, const char *src, size_t size)
         if (size) {
                 size_t len = (ret >= size) ? size-1 : ret;
                 dest[len] = '\0';
-                __builtin_memcpy(dest, src, len);
+                memcpy(dest, src, len);
         }
         return ret;
 }
@@ -124,8 +116,8 @@ EXPORT_SYMBOL(strlcpy);
 char *strncpy(char *dest, const char *src, size_t n)
 {
         size_t len = __strnend(src, n) - src;
-        __builtin_memset(dest + len, 0, n - len);
-        __builtin_memcpy(dest, src, len);
+        memset(dest + len, 0, n - len);
+        memcpy(dest, src, len);
         return dest;
 }
 EXPORT_SYMBOL(strncpy);
@@ -171,7 +163,7 @@ size_t strlcat(char *dest, const char *src, size_t n)
                 if (len >= n)
                         len = n - 1;
                 dest[len] = '\0';
-                __builtin_memcpy(dest, src, len);
+                memcpy(dest, src, len);
         }
         return res;
 }
@@ -194,7 +186,7 @@ char *strncat(char *dest, const char *src, size_t n)
         char *p = __strend(dest);
 
         p[len] = '\0';
-        __builtin_memcpy(p, src, len);
+        memcpy(p, src, len);
         return dest;
 }
 EXPORT_SYMBOL(strncat);
@@ -348,41 +340,3 @@ void *memscan(void *s, int c, size_t n)
         return (void *) ret;
 }
 EXPORT_SYMBOL(memscan);
-
-/**
- * memcpy - Copy one area of memory to another
- * @dest: Where to copy to
- * @src: Where to copy from
- * @n: The size of the area.
- *
- * returns a pointer to @dest
- */
-void *memcpy(void *dest, const void *src, size_t n)
-{
-        return __builtin_memcpy(dest, src, n);
-}
-EXPORT_SYMBOL(memcpy);
-
-/**
- * memset - Fill a region of memory with the given value
- * @s: Pointer to the start of the area.
- * @c: The byte to fill the area with
- * @n: The size of the area.
- *
- * returns a pointer to @s
- */
-void *memset(void *s, int c, size_t n)
-{
-        char *xs;
-
-        if (c == 0)
-                return __builtin_memset(s, 0, n);
-
-        xs = (char *) s;
-        if (n > 0)
-                do {
-                        *xs++ = c;
-                } while (--n > 0);
-        return s;
-}
-EXPORT_SYMBOL(memset);
diff --git a/arch/s390/mm/Makefile b/arch/s390/mm/Makefile
index d98fe9004a52..0f5536b0c1a1 100644
--- a/arch/s390/mm/Makefile
+++ b/arch/s390/mm/Makefile
@@ -3,7 +3,7 @@
 #
 
 obj-y    := init.o fault.o extmem.o mmap.o vmem.o pgtable.o maccess.o \
-            page-states.o gup.o
+            page-states.o gup.o extable.o
 obj-$(CONFIG_CMM) += cmm.o
 obj-$(CONFIG_HUGETLB_PAGE) += hugetlbpage.o
 obj-$(CONFIG_DEBUG_SET_MODULE_RONX) += pageattr.o
diff --git a/arch/s390/mm/extable.c b/arch/s390/mm/extable.c
new file mode 100644
index 000000000000..4d1ee88864e8
--- /dev/null
+++ b/arch/s390/mm/extable.c
@@ -0,0 +1,81 @@
+#include <linux/module.h>
+#include <linux/sort.h>
+#include <asm/uaccess.h>
+
+/*
+ * Search one exception table for an entry corresponding to the
+ * given instruction address, and return the address of the entry,
+ * or NULL if none is found.
+ * We use a binary search, and thus we assume that the table is
+ * already sorted.
+ */
+const struct exception_table_entry *
+search_extable(const struct exception_table_entry *first,
+               const struct exception_table_entry *last,
+               unsigned long value)
+{
+        const struct exception_table_entry *mid;
+        unsigned long addr;
+
+        while (first <= last) {
+                mid = ((last - first) >> 1) + first;
+                addr = extable_insn(mid);
+                if (addr < value)
+                        first = mid + 1;
+                else if (addr > value)
+                        last = mid - 1;
+                else
+                        return mid;
+        }
+        return NULL;
+}
+
+/*
+ * The exception table needs to be sorted so that the binary
+ * search that we use to find entries in it works properly.
+ * This is used both for the kernel exception table and for
+ * the exception tables of modules that get loaded.
+ *
+ */
+static int cmp_ex(const void *a, const void *b)
+{
+        const struct exception_table_entry *x = a, *y = b;
+
+        /* This compare is only valid after normalization. */
+        return x->insn - y->insn;
+}
+
+void sort_extable(struct exception_table_entry *start,
+                  struct exception_table_entry *finish)
+{
+        struct exception_table_entry *p;
+        int i;
+
+        /* Normalize entries to being relative to the start of the section */
+        for (p = start, i = 0; p < finish; p++, i += 8)
+                p->insn += i;
+        sort(start, finish - start, sizeof(*start), cmp_ex, NULL);
+        /* Denormalize all entries */
+        for (p = start, i = 0; p < finish; p++, i += 8)
+                p->insn -= i;
+}
+
+#ifdef CONFIG_MODULES
+/*
+ * If the exception table is sorted, any referring to the module init
+ * will be at the beginning or the end.
+ */
+void trim_init_extable(struct module *m)
+{
+        /* Trim the beginning */
+        while (m->num_exentries &&
+               within_module_init(extable_insn(&m->extable[0]), m)) {
+                m->extable++;
+                m->num_exentries--;
+        }
+        /* Trim the end */
+        while (m->num_exentries &&
+               within_module_init(extable_insn(&m->extable[m->num_exentries-1]), m))
+                m->num_exentries--;
+}
+#endif /* CONFIG_MODULES */
diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 6c013f544146..ac9122ca1152 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -111,7 +111,7 @@ static inline int user_space_fault(unsigned long trans_exc_code)
         if (trans_exc_code == 2)
                 /* Access via secondary space, set_fs setting decides */
                 return current->thread.mm_segment.ar4;
-        if (addressing_mode == HOME_SPACE_MODE)
+        if (s390_user_mode == HOME_SPACE_MODE)
                 /* User space if the access has been done via home space. */
                 return trans_exc_code == 3;
         /*
@@ -163,7 +163,7 @@ static noinline void do_no_context(struct pt_regs *regs)
         /* Are we prepared to handle this kernel fault?  */
         fixup = search_exception_tables(regs->psw.addr & PSW_ADDR_INSN);
         if (fixup) {
-                regs->psw.addr = fixup->fixup | PSW_ADDR_AMODE;
+                regs->psw.addr = extable_fixup(fixup) | PSW_ADDR_AMODE;
                 return;
         }
 
@@ -628,9 +628,8 @@ static int __cpuinit pfault_cpu_notify(struct notifier_block *self,
         struct thread_struct *thread, *next;
         struct task_struct *tsk;
 
-        switch (action) {
+        switch (action & ~CPU_TASKS_FROZEN) {
         case CPU_DEAD:
-        case CPU_DEAD_FROZEN:
                 spin_lock_irq(&pfault_lock);
                 list_for_each_entry_safe(thread, next, &pfault_list, list) {
                         thread->pfault_wait = 0;
diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c
index 65cb06e2af4e..eeaf8023851f 100644
--- a/arch/s390/mm/gup.c
+++ b/arch/s390/mm/gup.c
@@ -154,6 +154,43 @@ static inline int gup_pud_range(pgd_t *pgdp, pgd_t pgd, unsigned long addr,
         return 1;
 }
 
+/*
+ * Like get_user_pages_fast() except its IRQ-safe in that it won't fall
+ * back to the regular GUP.
+ */
+int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
+                          struct page **pages)
+{
+        struct mm_struct *mm = current->mm;
+        unsigned long addr, len, end;
+        unsigned long next, flags;
+        pgd_t *pgdp, pgd;
+        int nr = 0;
+
+        start &= PAGE_MASK;
+        addr = start;
+        len = (unsigned long) nr_pages << PAGE_SHIFT;
+        end = start + len;
+        if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
+                                        (void __user *)start, len)))
+                return 0;
+
+        local_irq_save(flags);
+        pgdp = pgd_offset(mm, addr);
+        do {
+                pgd = *pgdp;
+                barrier();
+                next = pgd_addr_end(addr, end);
+                if (pgd_none(pgd))
+                        break;
+                if (!gup_pud_range(pgdp, pgd, addr, next, write, pages, &nr))
+                        break;
+        } while (pgdp++, addr = next, addr != end);
+        local_irq_restore(flags);
+
+        return nr;
+}
+
 /**
  * get_user_pages_fast() - pin user pages in memory
  * @start:      starting user address
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index 6adbc082618a..81e596c65dee 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -42,7 +42,7 @@ pgd_t swapper_pg_dir[PTRS_PER_PGD] __attribute__((__aligned__(PAGE_SIZE)));
 unsigned long empty_zero_page, zero_page_mask;
 EXPORT_SYMBOL(empty_zero_page);
 
-static unsigned long setup_zero_pages(void)
+static unsigned long __init setup_zero_pages(void)
 {
         struct cpuid cpu_id;
         unsigned int order;
@@ -212,7 +212,7 @@ void free_initmem(void)
 }
 
 #ifdef CONFIG_BLK_DEV_INITRD
-void free_initrd_mem(unsigned long start, unsigned long end)
+void __init free_initrd_mem(unsigned long start, unsigned long end)
 {
         free_init_pages("initrd memory", start, end);
 }
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 18df31d1f2c9..b402991e43d7 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -609,8 +609,8 @@ static inline unsigned int atomic_xor_bits(atomic_t *v, unsigned int bits)
  */
 unsigned long *page_table_alloc(struct mm_struct *mm, unsigned long vmaddr)
 {
-        struct page *page;
-        unsigned long *table;
+        unsigned long *uninitialized_var(table);
+        struct page *uninitialized_var(page);
         unsigned int mask, bit;
 
         if (mm_has_pgste(mm))
@@ -796,7 +796,7 @@ int s390_enable_sie(void)
         struct mm_struct *mm, *old_mm;
 
         /* Do we have switched amode? If no, we cannot do sie */
-        if (addressing_mode == HOME_SPACE_MODE)
+        if (s390_user_mode == HOME_SPACE_MODE)
                 return -EINVAL;
 
         /* Do we have pgstes? if yes, we are done */
diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c
index 6f896e75ab49..c22abf900c9e 100644
--- a/arch/s390/mm/vmem.c
+++ b/arch/s390/mm/vmem.c
@@ -107,7 +107,7 @@ static int vmem_add_mem(unsigned long start, unsigned long size, int ro)
                 pte = mk_pte_phys(address, __pgprot(ro ? _PAGE_RO : 0));
                 pm_dir = pmd_offset(pu_dir, address);
 
-#ifdef CONFIG_64BIT
+#if defined(CONFIG_64BIT) && !defined(CONFIG_DEBUG_PAGEALLOC)
                 if (MACHINE_HAS_HPAGE && !(address & ~HPAGE_MASK) &&
                     (address + HPAGE_SIZE <= start + size) &&
                     (address >= HPAGE_SIZE)) {
diff --git a/arch/s390/net/Makefile b/arch/s390/net/Makefile
new file mode 100644
index 000000000000..90568c33ddb0
--- /dev/null
+++ b/arch/s390/net/Makefile
@@ -0,0 +1,4 @@
+#
+# Arch-specific network modules
+#
+obj-$(CONFIG_BPF_JIT) += bpf_jit.o bpf_jit_comp.o
diff --git a/arch/s390/net/bpf_jit.S b/arch/s390/net/bpf_jit.S
new file mode 100644
index 000000000000..7e45d13816c1
--- /dev/null
+++ b/arch/s390/net/bpf_jit.S
@@ -0,0 +1,130 @@
+/*
+ * BPF Jit compiler for s390, help functions.
+ *
+ * Copyright IBM Corp. 2012
+ *
+ * Author(s): Martin Schwidefsky <schwidefsky@de.ibm.com>
+ */
+#include <linux/linkage.h>
+
+/*
+ * Calling convention:
+ * registers %r2, %r6-%r8, %r10-%r11, %r13, %r15 are call saved
+ *   %r2: skb pointer
+ *   %r3: offset parameter
+ *   %r5: BPF A accumulator
+ *   %r8: return address
+ *   %r9: save register for skb pointer
+ *   %r10: skb->data
+ *   %r11: skb->len - skb->data_len (headlen)
+ *   %r12: BPF X accumulator
+ *
+ * skb_copy_bits takes 4 parameters:
+ *   %r2 = skb pointer
+ *   %r3 = offset into skb data
+ *   %r4 = length to copy
+ *   %r5 = pointer to temp buffer
+ */
+#define SKBDATA %r8
+
+        /* A = *(u32 *) (skb->data+K+X) */
+ENTRY(sk_load_word_ind)
+        ar      %r3,%r12                # offset += X
+        bmr     %r8                     # < 0 -> return with cc
+
+        /* A = *(u32 *) (skb->data+K) */
+ENTRY(sk_load_word)
+        llgfr   %r1,%r3                 # extend offset
+        ahi     %r3,4                   # offset + 4
+        clr     %r11,%r3                # hlen <= offset + 4 ?
+        jl      sk_load_word_slow
+        l       %r5,0(%r1,%r10)         # get word from skb
+        xr      %r1,%r1                 # set cc to zero
+        br      %r8
+
+sk_load_word_slow:
+        lgr     %r9,%r2                 # save %r2
+        lhi     %r4,4                   # 4 bytes
+        la      %r5,160(%r15)           # pointer to temp buffer
+        brasl   %r14,skb_copy_bits      # get data from skb
+        l       %r5,160(%r15)           # load result from temp buffer
+        ltgr    %r2,%r2                 # set cc to (%r2 != 0)
+        lgr     %r2,%r9                 # restore %r2
+        br      %r8
+
+        /* A = *(u16 *) (skb->data+K+X) */
+ENTRY(sk_load_half_ind)
+        ar      %r3,%r12                # offset += X
+        bmr     %r8                     # < 0 -> return with cc
+
+        /* A = *(u16 *) (skb->data+K) */
+ENTRY(sk_load_half)
+        llgfr   %r1,%r3                 # extend offset
+        ahi     %r3,2                   # offset + 2
+        clr     %r11,%r3                # hlen <= offset + 2 ?
+        jl      sk_load_half_slow
+        llgh    %r5,0(%r1,%r10)         # get half from skb
+        xr      %r1,%r1                 # set cc to zero
+        br      %r8
+
+sk_load_half_slow:
+        lgr     %r9,%r2                 # save %r2
+        lhi     %r4,2                   # 2 bytes
+        la      %r5,162(%r15)           # pointer to temp buffer
+        brasl   %r14,skb_copy_bits      # get data from skb
+        xc      160(2,%r15),160(%r15)
+        l       %r5,160(%r15)           # load result from temp buffer
+        ltgr    %r2,%r2                 # set cc to (%r2 != 0)
+        lgr     %r2,%r9                 # restore %r2
+        br      %r8
+
+        /* A = *(u8 *) (skb->data+K+X) */
+ENTRY(sk_load_byte_ind)
+        ar      %r3,%r12                # offset += X
+        bmr     %r8                     # < 0 -> return with cc
+
+        /* A = *(u8 *) (skb->data+K) */
+ENTRY(sk_load_byte)
+        llgfr   %r1,%r3                 # extend offset
+        clr     %r11,%r3                # hlen < offset ?
+        jle     sk_load_byte_slow
+        lhi     %r5,0
+        ic      %r5,0(%r1,%r10)         # get byte from skb
+        xr      %r1,%r1                 # set cc to zero
+        br      %r8
+
+sk_load_byte_slow:
+        lgr     %r9,%r2                 # save %r2
+        lhi     %r4,1                   # 1 bytes
+        la      %r5,163(%r15)           # pointer to temp buffer
+        brasl   %r14,skb_copy_bits      # get data from skb
+        xc      160(3,%r15),160(%r15)
+        l       %r5,160(%r15)           # load result from temp buffer
+        ltgr    %r2,%r2                 # set cc to (%r2 != 0)
+        lgr     %r2,%r9                 # restore %r2
+        br      %r8
+
+        /* A = (*(u8 *)(skb->data+K) & 0xf) << 2 */
+ENTRY(sk_load_byte_msh)
+        llgfr   %r1,%r3                 # extend offset
+        clr     %r11,%r3                # hlen < offset ?
+        jle     sk_load_byte_slow
+        lhi     %r12,0
+        ic      %r12,0(%r1,%r10)        # get byte from skb
+        nill    %r12,0x0f
+        sll     %r12,2
+        xr      %r1,%r1                 # set cc to zero
+        br      %r8
+
+sk_load_byte_msh_slow:
+        lgr     %r9,%r2                 # save %r2
+        lhi     %r4,2                   # 2 bytes
+        la      %r5,162(%r15)           # pointer to temp buffer
+        brasl   %r14,skb_copy_bits      # get data from skb
+        xc      160(3,%r15),160(%r15)
+        l       %r12,160(%r15)          # load result from temp buffer
+        nill    %r12,0x0f
+        sll     %r12,2
+        ltgr    %r2,%r2                 # set cc to (%r2 != 0)
+        lgr     %r2,%r9                 # restore %r2
+        br      %r8
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
new file mode 100644
index 000000000000..9b355b406afa
--- /dev/null
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -0,0 +1,776 @@
+/*
+ * BPF Jit compiler for s390.
+ *
+ * Copyright IBM Corp. 2012
+ *
+ * Author(s): Martin Schwidefsky <schwidefsky@de.ibm.com>
+ */
+#include <linux/moduleloader.h>
+#include <linux/netdevice.h>
+#include <linux/filter.h>
+#include <asm/cacheflush.h>
+#include <asm/processor.h>
+#include <asm/facility.h>
+
+/*
+ * Conventions:
+ *   %r2 = skb pointer
+ *   %r3 = offset parameter
+ *   %r4 = scratch register / length parameter
+ *   %r5 = BPF A accumulator
+ *   %r8 = return address
+ *   %r9 = save register for skb pointer
+ *   %r10 = skb->data
+ *   %r11 = skb->len - skb->data_len (headlen)
+ *   %r12 = BPF X accumulator
+ *   %r13 = literal pool pointer
+ *   0(%r15) - 63(%r15) scratch memory array with BPF_MEMWORDS
+ */
+int bpf_jit_enable __read_mostly;
+
+/*
+ * assembly code in arch/x86/net/bpf_jit.S
+ */
+extern u8 sk_load_word[], sk_load_half[], sk_load_byte[], sk_load_byte_msh[];
+extern u8 sk_load_word_ind[], sk_load_half_ind[], sk_load_byte_ind[];
+
+struct bpf_jit {
+        unsigned int seen;
+        u8 *start;
+        u8 *prg;
+        u8 *mid;
+        u8 *lit;
+        u8 *end;
+        u8 *base_ip;
+        u8 *ret0_ip;
+        u8 *exit_ip;
+        unsigned int off_load_word;
+        unsigned int off_load_half;
+        unsigned int off_load_byte;
+        unsigned int off_load_bmsh;
+        unsigned int off_load_iword;
+        unsigned int off_load_ihalf;
+        unsigned int off_load_ibyte;
+};
+
+#define BPF_SIZE_MAX    4096    /* Max size for program */
+
+#define SEEN_DATAREF    1       /* might call external helpers */
+#define SEEN_XREG       2       /* ebx is used */
+#define SEEN_MEM        4       /* use mem[] for temporary storage */
+#define SEEN_RET0       8       /* pc_ret0 points to a valid return 0 */
+#define SEEN_LITERAL    16      /* code uses literals */
+#define SEEN_LOAD_WORD  32      /* code uses sk_load_word */
+#define SEEN_LOAD_HALF  64      /* code uses sk_load_half */
+#define SEEN_LOAD_BYTE  128     /* code uses sk_load_byte */
+#define SEEN_LOAD_BMSH  256     /* code uses sk_load_byte_msh */
+#define SEEN_LOAD_IWORD 512     /* code uses sk_load_word_ind */
+#define SEEN_LOAD_IHALF 1024    /* code uses sk_load_half_ind */
+#define SEEN_LOAD_IBYTE 2048    /* code uses sk_load_byte_ind */
+
+#define EMIT2(op)                                       \
+({                                                      \
+        if (jit->prg + 2 <= jit->mid)                   \
+                *(u16 *) jit->prg = op;                 \
+        jit->prg += 2;                                  \
+})
+
+#define EMIT4(op)                                       \
+({                                                      \
+        if (jit->prg + 4 <= jit->mid)                   \
+                *(u32 *) jit->prg = op;                 \
+        jit->prg += 4;                                  \
+})
+
+#define EMIT4_DISP(op, disp)                            \
+({                                                      \
+        unsigned int __disp = (disp) & 0xfff;           \
+        EMIT4(op | __disp);                             \
+})
+
+#define EMIT4_IMM(op, imm)                              \
+({                                                      \
+        unsigned int __imm = (imm) & 0xffff;            \
+        EMIT4(op | __imm);                              \
+})
+
+#define EMIT4_PCREL(op, pcrel)                          \
+({                                                      \
+        long __pcrel = ((pcrel) >> 1) & 0xffff;         \
+        EMIT4(op | __pcrel);                            \
+})
+
+#define EMIT6(op1, op2)                                 \
+({                                                      \
+        if (jit->prg + 6 <= jit->mid) {                 \
+                *(u32 *) jit->prg = op1;                \
+                *(u16 *) (jit->prg + 4) = op2;          \
+        }                                               \
+        jit->prg += 6;                                  \
+})
+
+#define EMIT6_DISP(op1, op2, disp)                      \
+({                                                      \
+        unsigned int __disp = (disp) & 0xfff;           \
+        EMIT6(op1 | __disp, op2);                       \
+})
+
+#define EMIT6_IMM(op, imm)                              \
+({                                                      \
+        unsigned int __imm = (imm);                     \
+        EMIT6(op | (__imm >> 16), __imm & 0xffff);      \
+})
+
+#define EMIT_CONST(val)                                 \
+({                                                      \
+        unsigned int ret;                               \
+        ret = (unsigned int) (jit->lit - jit->base_ip); \
+        jit->seen |= SEEN_LITERAL;                      \
+        if (jit->lit + 4 <= jit->end)                   \
+                *(u32 *) jit->lit = val;                \
+        jit->lit += 4;                                  \
+        ret;                                            \
+})
+
+#define EMIT_FN_CONST(bit, fn)                          \
+({                                                      \
+        unsigned int ret;                               \
+        ret = (unsigned int) (jit->lit - jit->base_ip); \
+        if (jit->seen & bit) {                          \
+                jit->seen |= SEEN_LITERAL;              \
+                if (jit->lit + 8 <= jit->end)           \
+                        *(void **) jit->lit = fn;       \
+                jit->lit += 8;                          \
+        }                                               \
+        ret;                                            \
+})
+
+static void bpf_jit_prologue(struct bpf_jit *jit)
+{
+        /* Save registers and create stack frame if necessary */
+        if (jit->seen & SEEN_DATAREF) {
+                /* stmg %r8,%r15,88(%r15) */
+                EMIT6(0xeb8ff058, 0x0024);
+                /* lgr %r14,%r15 */
+                EMIT4(0xb90400ef);
+                /* ahi %r15,<offset> */
+                EMIT4_IMM(0xa7fa0000, (jit->seen & SEEN_MEM) ? -112 : -80);
+                /* stg %r14,152(%r15) */
+                EMIT6(0xe3e0f098, 0x0024);
+        } else if ((jit->seen & SEEN_XREG) && (jit->seen & SEEN_LITERAL))
+                /* stmg %r12,%r13,120(%r15) */
+                EMIT6(0xebcdf078, 0x0024);
+        else if (jit->seen & SEEN_XREG)
+                /* stg %r12,120(%r15) */
+                EMIT6(0xe3c0f078, 0x0024);
+        else if (jit->seen & SEEN_LITERAL)
+                /* stg %r13,128(%r15) */
+                EMIT6(0xe3d0f080, 0x0024);
+
+        /* Setup literal pool */
+        if (jit->seen & SEEN_LITERAL) {
+                /* basr %r13,0 */
+                EMIT2(0x0dd0);
+                jit->base_ip = jit->prg;
+        }
+        jit->off_load_word = EMIT_FN_CONST(SEEN_LOAD_WORD, sk_load_word);
+        jit->off_load_half = EMIT_FN_CONST(SEEN_LOAD_HALF, sk_load_half);
+        jit->off_load_byte = EMIT_FN_CONST(SEEN_LOAD_BYTE, sk_load_byte);
+        jit->off_load_bmsh = EMIT_FN_CONST(SEEN_LOAD_BMSH, sk_load_byte_msh);
+        jit->off_load_iword = EMIT_FN_CONST(SEEN_LOAD_IWORD, sk_load_word_ind);
+        jit->off_load_ihalf = EMIT_FN_CONST(SEEN_LOAD_IHALF, sk_load_half_ind);
+        jit->off_load_ibyte = EMIT_FN_CONST(SEEN_LOAD_IBYTE, sk_load_byte_ind);
+
+        /* Filter needs to access skb data */
+        if (jit->seen & SEEN_DATAREF) {
+                /* l %r11,<len>(%r2) */
+                EMIT4_DISP(0x58b02000, offsetof(struct sk_buff, len));
+                /* s %r11,<data_len>(%r2) */
+                EMIT4_DISP(0x5bb02000, offsetof(struct sk_buff, data_len));
+                /* lg %r10,<data>(%r2) */
+                EMIT6_DISP(0xe3a02000, 0x0004,
+                           offsetof(struct sk_buff, data));
+        }
+}
+
+static void bpf_jit_epilogue(struct bpf_jit *jit)
+{
+        /* Return 0 */
+        if (jit->seen & SEEN_RET0) {
+                jit->ret0_ip = jit->prg;
+                /* lghi %r2,0 */
+                EMIT4(0xa7290000);
+        }
+        jit->exit_ip = jit->prg;
+        /* Restore registers */
+        if (jit->seen & SEEN_DATAREF)
+                /* lmg %r8,%r15,<offset>(%r15) */
+                EMIT6_DISP(0xeb8ff000, 0x0004,
+                           (jit->seen & SEEN_MEM) ? 200 : 168);
+        else if ((jit->seen & SEEN_XREG) && (jit->seen & SEEN_LITERAL))
+                /* lmg %r12,%r13,120(%r15) */
+                EMIT6(0xebcdf078, 0x0004);
+        else if (jit->seen & SEEN_XREG)
+                /* lg %r12,120(%r15) */
+                EMIT6(0xe3c0f078, 0x0004);
+        else if (jit->seen & SEEN_LITERAL)
+                /* lg %r13,128(%r15) */
+                EMIT6(0xe3d0f080, 0x0004);
+        /* br %r14 */
+        EMIT2(0x07fe);
+}
+
+/*
+ * make sure we dont leak kernel information to user
+ */
+static void bpf_jit_noleaks(struct bpf_jit *jit, struct sock_filter *filter)
+{
+        /* Clear temporary memory if (seen & SEEN_MEM) */
+        if (jit->seen & SEEN_MEM)
+                /* xc 0(64,%r15),0(%r15) */
+                EMIT6(0xd73ff000, 0xf000);
+        /* Clear X if (seen & SEEN_XREG) */
+        if (jit->seen & SEEN_XREG)
+                /* lhi %r12,0 */
+                EMIT4(0xa7c80000);
+        /* Clear A if the first register does not set it. */
+        switch (filter[0].code) {
+        case BPF_S_LD_W_ABS:
+        case BPF_S_LD_H_ABS:
+        case BPF_S_LD_B_ABS:
+        case BPF_S_LD_W_LEN:
+        case BPF_S_LD_W_IND:
+        case BPF_S_LD_H_IND:
+        case BPF_S_LD_B_IND:
+        case BPF_S_LDX_B_MSH:
+        case BPF_S_LD_IMM:
+        case BPF_S_LD_MEM:
+        case BPF_S_MISC_TXA:
+        case BPF_S_ANC_PROTOCOL:
+        case BPF_S_ANC_PKTTYPE:
+        case BPF_S_ANC_IFINDEX:
+        case BPF_S_ANC_MARK:
+        case BPF_S_ANC_QUEUE:
+        case BPF_S_ANC_HATYPE:
+        case BPF_S_ANC_RXHASH:
+        case BPF_S_ANC_CPU:
+        case BPF_S_RET_K:
+                /* first instruction sets A register */
+                break;
+        default: /* A = 0 */
+                /* lhi %r5,0 */
+                EMIT4(0xa7580000);
+        }
+}
+
+static int bpf_jit_insn(struct bpf_jit *jit, struct sock_filter *filter,
+                        unsigned int *addrs, int i, int last)
+{
+        unsigned int K;
+        int offset;
+        unsigned int mask;
+
+        K = filter->k;
+        switch (filter->code) {
+        case BPF_S_ALU_ADD_X: /* A += X */
+                jit->seen |= SEEN_XREG;
+                /* ar %r5,%r12 */
+                EMIT2(0x1a5c);
+                break;
+        case BPF_S_ALU_ADD_K: /* A += K */
+                if (!K)
+                        break;
+                if (K <= 16383)
+                        /* ahi %r5,<K> */
+                        EMIT4_IMM(0xa75a0000, K);
+                else if (test_facility(21))
+                        /* alfi %r5,<K> */
+                        EMIT6_IMM(0xc25b0000, K);
+                else
+                        /* a %r5,<d(K)>(%r13) */
+                        EMIT4_DISP(0x5a50d000, EMIT_CONST(K));
+                break;
+        case BPF_S_ALU_SUB_X: /* A -= X */
+                jit->seen |= SEEN_XREG;
+                /* sr %r5,%r12 */
+                EMIT2(0x1b5c);
+                break;
+        case BPF_S_ALU_SUB_K: /* A -= K */
+                if (!K)
+                        break;
+                if (K <= 16384)
+                        /* ahi %r5,-K */
+                        EMIT4_IMM(0xa75a0000, -K);
+                else if (test_facility(21))
+                        /* alfi %r5,-K */
+                        EMIT6_IMM(0xc25b0000, -K);
+                else
+                        /* s %r5,<d(K)>(%r13) */
+                        EMIT4_DISP(0x5b50d000, EMIT_CONST(K));
+                break;
+        case BPF_S_ALU_MUL_X: /* A *= X */
+                jit->seen |= SEEN_XREG;
+                /* msr %r5,%r12 */
+                EMIT4(0xb252005c);
+                break;
+        case BPF_S_ALU_MUL_K: /* A *= K */
+                if (K <= 16383)
+                        /* mhi %r5,K */
+                        EMIT4_IMM(0xa75c0000, K);
+                else if (test_facility(34))
+                        /* msfi %r5,<K> */
+                        EMIT6_IMM(0xc2510000, K);
+                else
+                        /* ms %r5,<d(K)>(%r13) */
+                        EMIT4_DISP(0x7150d000, EMIT_CONST(K));
+                break;
+        case BPF_S_ALU_DIV_X: /* A /= X */
+                jit->seen |= SEEN_XREG | SEEN_RET0;
+                /* ltr %r12,%r12 */
+                EMIT2(0x12cc);
+                /* jz <ret0> */
+                EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg));
+                /* lhi %r4,0 */
+                EMIT4(0xa7480000);
+                /* dr %r4,%r12 */
+                EMIT2(0x1d4c);
+                break;
+        case BPF_S_ALU_DIV_K: /* A = reciprocal_divide(A, K) */
+                /* m %r4,<d(K)>(%r13) */
+                EMIT4_DISP(0x5c40d000, EMIT_CONST(K));
+                /* lr %r5,%r4 */
+                EMIT2(0x1854);
+                break;
+        case BPF_S_ALU_AND_X: /* A &= X */
+                jit->seen |= SEEN_XREG;
+                /* nr %r5,%r12 */
+                EMIT2(0x145c);
+                break;
+        case BPF_S_ALU_AND_K: /* A &= K */
+                if (test_facility(21))
+                        /* nilf %r5,<K> */
+                        EMIT6_IMM(0xc05b0000, K);
+                else
+                        /* n %r5,<d(K)>(%r13) */
+                        EMIT4_DISP(0x5450d000, EMIT_CONST(K));
+                break;
+        case BPF_S_ALU_OR_X: /* A |= X */
+                jit->seen |= SEEN_XREG;
+                /* or %r5,%r12 */
+                EMIT2(0x165c);
+                break;
+        case BPF_S_ALU_OR_K: /* A |= K */
+                if (test_facility(21))
+                        /* oilf %r5,<K> */
+                        EMIT6_IMM(0xc05d0000, K);
+                else
+                        /* o %r5,<d(K)>(%r13) */
+                        EMIT4_DISP(0x5650d000, EMIT_CONST(K));
+                break;
+        case BPF_S_ANC_ALU_XOR_X: /* A ^= X; */
+                jit->seen |= SEEN_XREG;
+                /* xr %r5,%r12 */
+                EMIT2(0x175c);
+                break;
+        case BPF_S_ALU_LSH_X: /* A <<= X; */
+                jit->seen |= SEEN_XREG;
+                /* sll %r5,0(%r12) */
+                EMIT4(0x8950c000);
+                break;
+        case BPF_S_ALU_LSH_K: /* A <<= K */
+                if (K == 0)
+                        break;
+                /* sll %r5,K */
+                EMIT4_DISP(0x89500000, K);
+                break;
+        case BPF_S_ALU_RSH_X: /* A >>= X; */
+                jit->seen |= SEEN_XREG;
+                /* srl %r5,0(%r12) */
+                EMIT4(0x8850c000);
+                break;
+        case BPF_S_ALU_RSH_K: /* A >>= K; */
+                if (K == 0)
+                        break;
+                /* srl %r5,K */
+                EMIT4_DISP(0x88500000, K);
+                break;
+        case BPF_S_ALU_NEG: /* A = -A */
+                /* lnr %r5,%r5 */
+                EMIT2(0x1155);
+                break;
+        case BPF_S_JMP_JA: /* ip += K */
+                offset = addrs[i + K] + jit->start - jit->prg;
+                EMIT4_PCREL(0xa7f40000, offset);
+                break;
+        case BPF_S_JMP_JGT_K: /* ip += (A > K) ? jt : jf */
+                mask = 0x200000; /* jh */
+                goto kbranch;
+        case BPF_S_JMP_JGE_K: /* ip += (A >= K) ? jt : jf */
+                mask = 0xa00000; /* jhe */
+                goto kbranch;
+        case BPF_S_JMP_JEQ_K: /* ip += (A == K) ? jt : jf */
+                mask = 0x800000; /* je */
+kbranch:        /* Emit compare if the branch targets are different */
+                if (filter->jt != filter->jf) {
+                        if (K <= 16383)
+                                /* chi %r5,<K> */
+                                EMIT4_IMM(0xa75e0000, K);
+                        else if (test_facility(21))
+                                /* clfi %r5,<K> */
+                                EMIT6_IMM(0xc25f0000, K);
+                        else
+                                /* c %r5,<d(K)>(%r13) */
+                                EMIT4_DISP(0x5950d000, EMIT_CONST(K));
+                }
+branch:         if (filter->jt == filter->jf) {
+                        if (filter->jt == 0)
+                                break;
+                        /* j <jt> */
+                        offset = addrs[i + filter->jt] + jit->start - jit->prg;
+                        EMIT4_PCREL(0xa7f40000, offset);
+                        break;
+                }
+                if (filter->jt != 0) {
+                        /* brc  <mask>,<jt> */
+                        offset = addrs[i + filter->jt] + jit->start - jit->prg;
+                        EMIT4_PCREL(0xa7040000 | mask, offset);
+                }
+                if (filter->jf != 0) {
+                        /* brc  <mask^15>,<jf> */
+                        offset = addrs[i + filter->jf] + jit->start - jit->prg;
+                        EMIT4_PCREL(0xa7040000 | (mask ^ 0xf00000), offset);
+                }
+                break;
+        case BPF_S_JMP_JSET_K: /* ip += (A & K) ? jt : jf */
+                mask = 0x700000; /* jnz */
+                /* Emit test if the branch targets are different */
+                if (filter->jt != filter->jf) {
+                        if (K > 65535) {
+                                /* lr %r4,%r5 */
+                                EMIT2(0x1845);
+                                /* n %r4,<d(K)>(%r13) */
+                                EMIT4_DISP(0x5440d000, EMIT_CONST(K));
+                        } else
+                                /* tmll %r5,K */
+                                EMIT4_IMM(0xa7510000, K);
+                }
+                goto branch;
+        case BPF_S_JMP_JGT_X: /* ip += (A > X) ? jt : jf */
+                mask = 0x200000; /* jh */
+                goto xbranch;
+        case BPF_S_JMP_JGE_X: /* ip += (A >= X) ? jt : jf */
+                mask = 0xa00000; /* jhe */
+                goto xbranch;
+        case BPF_S_JMP_JEQ_X: /* ip += (A == X) ? jt : jf */
+                mask = 0x800000; /* je */
+xbranch:        /* Emit compare if the branch targets are different */
+                if (filter->jt != filter->jf) {
+                        jit->seen |= SEEN_XREG;
+                        /* cr %r5,%r12 */
+                        EMIT2(0x195c);
+                }
+                goto branch;
+        case BPF_S_JMP_JSET_X: /* ip += (A & X) ? jt : jf */
+                mask = 0x700000; /* jnz */
+                /* Emit test if the branch targets are different */
+                if (filter->jt != filter->jf) {
+                        jit->seen |= SEEN_XREG;
+                        /* lr %r4,%r5 */
+                        EMIT2(0x1845);
+                        /* nr %r4,%r12 */
+                        EMIT2(0x144c);
+                }
+                goto branch;
+        case BPF_S_LD_W_ABS: /* A = *(u32 *) (skb->data+K) */
+                jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_WORD;
+                offset = jit->off_load_word;
+                goto load_abs;
+        case BPF_S_LD_H_ABS: /* A = *(u16 *) (skb->data+K) */
+                jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_HALF;
+                offset = jit->off_load_half;
+                goto load_abs;
+        case BPF_S_LD_B_ABS: /* A = *(u8 *) (skb->data+K) */
+                jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_BYTE;
+                offset = jit->off_load_byte;
+load_abs:       if ((int) K < 0)
+                        goto out;
+call_fn:        /* lg %r1,<d(function)>(%r13) */
+                EMIT6_DISP(0xe310d000, 0x0004, offset);
+                /* l %r3,<d(K)>(%r13) */
+                EMIT4_DISP(0x5830d000, EMIT_CONST(K));
+                /* basr %r8,%r1 */
+                EMIT2(0x0d81);
+                /* jnz <ret0> */
+                EMIT4_PCREL(0xa7740000, (jit->ret0_ip - jit->prg));
+                break;
+        case BPF_S_LD_W_IND: /* A = *(u32 *) (skb->data+K+X) */
+                jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IWORD;
+                offset = jit->off_load_iword;
+                goto call_fn;
+        case BPF_S_LD_H_IND: /* A = *(u16 *) (skb->data+K+X) */
+                jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IHALF;
+                offset = jit->off_load_ihalf;
+                goto call_fn;
+        case BPF_S_LD_B_IND: /* A = *(u8 *) (skb->data+K+X) */
+                jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IBYTE;
+                offset = jit->off_load_ibyte;
+                goto call_fn;
+        case BPF_S_LDX_B_MSH:
+                /* X = (*(u8 *)(skb->data+K) & 0xf) << 2 */
+                jit->seen |= SEEN_RET0;
+                if ((int) K < 0) {
+                        /* j <ret0> */
+                        EMIT4_PCREL(0xa7f40000, (jit->ret0_ip - jit->prg));
+                        break;
+                }
+                jit->seen |= SEEN_DATAREF | SEEN_LOAD_BMSH;
+                offset = jit->off_load_bmsh;
+                goto call_fn;
+        case BPF_S_LD_W_LEN: /* A = skb->len; */
+                BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, len) != 4);
+                /* l %r5,<d(len)>(%r2) */
+                EMIT4_DISP(0x58502000, offsetof(struct sk_buff, len));
+                break;
+        case BPF_S_LDX_W_LEN: /* X = skb->len; */
+                jit->seen |= SEEN_XREG;
+                /* l %r12,<d(len)>(%r2) */
+                EMIT4_DISP(0x58c02000, offsetof(struct sk_buff, len));
+                break;
+        case BPF_S_LD_IMM: /* A = K */
+                if (K <= 16383)
+                        /* lhi %r5,K */
+                        EMIT4_IMM(0xa7580000, K);
+                else if (test_facility(21))
+                        /* llilf %r5,<K> */
+                        EMIT6_IMM(0xc05f0000, K);
+                else
+                        /* l %r5,<d(K)>(%r13) */
+                        EMIT4_DISP(0x5850d000, EMIT_CONST(K));
+                break;
+        case BPF_S_LDX_IMM: /* X = K */
+                jit->seen |= SEEN_XREG;
+                if (K <= 16383)
+                        /* lhi %r12,<K> */
+                        EMIT4_IMM(0xa7c80000, K);
+                else if (test_facility(21))
+                        /* llilf %r12,<K> */
+                        EMIT6_IMM(0xc0cf0000, K);
+                else
+                        /* l %r12,<d(K)>(%r13) */
+                        EMIT4_DISP(0x58c0d000, EMIT_CONST(K));
+                break;
+        case BPF_S_LD_MEM: /* A = mem[K] */
+                jit->seen |= SEEN_MEM;
+                /* l %r5,<K>(%r15) */
+                EMIT4_DISP(0x5850f000,
+                           (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4);
+                break;
+        case BPF_S_LDX_MEM: /* X = mem[K] */
+                jit->seen |= SEEN_XREG | SEEN_MEM;
+                /* l %r12,<K>(%r15) */
+                EMIT4_DISP(0x58c0f000,
+                           (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4);
+                break;
+        case BPF_S_MISC_TAX: /* X = A */
+                jit->seen |= SEEN_XREG;
+                /* lr %r12,%r5 */
+                EMIT2(0x18c5);
+                break;
+        case BPF_S_MISC_TXA: /* A = X */
+                jit->seen |= SEEN_XREG;
+                /* lr %r5,%r12 */
+                EMIT2(0x185c);
+                break;
+        case BPF_S_RET_K:
+                if (K == 0) {
+                        jit->seen |= SEEN_RET0;
+                        if (last)
+                                break;
+                        /* j <ret0> */
+                        EMIT4_PCREL(0xa7f40000, jit->ret0_ip - jit->prg);
+                } else {
+                        if (K <= 16383)
+                                /* lghi %r2,K */
+                                EMIT4_IMM(0xa7290000, K);
+                        else
+                                /* llgf %r2,<K>(%r13) */
+                                EMIT6_DISP(0xe320d000, 0x0016, EMIT_CONST(K));
+                        /* j <exit> */
+                        if (last && !(jit->seen & SEEN_RET0))
+                                break;
+                        EMIT4_PCREL(0xa7f40000, jit->exit_ip - jit->prg);
+                }
+                break;
+        case BPF_S_RET_A:
+                /* llgfr %r2,%r5 */
+                EMIT4(0xb9160025);
+                /* j <exit> */
+                EMIT4_PCREL(0xa7f40000, jit->exit_ip - jit->prg);
+                break;
+        case BPF_S_ST: /* mem[K] = A */
+                jit->seen |= SEEN_MEM;
+                /* st %r5,<K>(%r15) */
+                EMIT4_DISP(0x5050f000,
+                           (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4);
+                break;
+        case BPF_S_STX: /* mem[K] = X : mov %ebx,off8(%rbp) */
+                jit->seen |= SEEN_XREG | SEEN_MEM;
+                /* st %r12,<K>(%r15) */
+                EMIT4_DISP(0x50c0f000,
+                           (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4);
+                break;
+        case BPF_S_ANC_PROTOCOL: /* A = ntohs(skb->protocol); */
+                BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, protocol) != 2);
+                /* lhi %r5,0 */
+                EMIT4(0xa7580000);
+                /* icm  %r5,3,<d(protocol)>(%r2) */
+                EMIT4_DISP(0xbf532000, offsetof(struct sk_buff, protocol));
+                break;
+        case BPF_S_ANC_IFINDEX: /* if (!skb->dev) return 0;
+                                 * A = skb->dev->ifindex */
+                BUILD_BUG_ON(FIELD_SIZEOF(struct net_device, ifindex) != 4);
+                jit->seen |= SEEN_RET0;
+                /* lg %r1,<d(dev)>(%r2) */
+                EMIT6_DISP(0xe3102000, 0x0004, offsetof(struct sk_buff, dev));
+                /* ltgr %r1,%r1 */
+                EMIT4(0xb9020011);
+                /* jz <ret0> */
+                EMIT4_PCREL(0xa7840000, jit->ret0_ip - jit->prg);
+                /* l %r5,<d(ifindex)>(%r1) */
+                EMIT4_DISP(0x58501000, offsetof(struct net_device, ifindex));
+                break;
+        case BPF_S_ANC_MARK: /* A = skb->mark */
+                BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, mark) != 4);
+                /* l %r5,<d(mark)>(%r2) */
+                EMIT4_DISP(0x58502000, offsetof(struct sk_buff, mark));
+                break;
+        case BPF_S_ANC_QUEUE: /* A = skb->queue_mapping */
+                BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, queue_mapping) != 2);
+                /* lhi %r5,0 */
+                EMIT4(0xa7580000);
+                /* icm  %r5,3,<d(queue_mapping)>(%r2) */
+                EMIT4_DISP(0xbf532000, offsetof(struct sk_buff, queue_mapping));
+                break;
+        case BPF_S_ANC_HATYPE:  /* if (!skb->dev) return 0;
+                                 * A = skb->dev->type */
+                BUILD_BUG_ON(FIELD_SIZEOF(struct net_device, type) != 2);
+                jit->seen |= SEEN_RET0;
+                /* lg %r1,<d(dev)>(%r2) */
+                EMIT6_DISP(0xe3102000, 0x0004, offsetof(struct sk_buff, dev));
+                /* ltgr %r1,%r1 */
+                EMIT4(0xb9020011);
+                /* jz <ret0> */
+                EMIT4_PCREL(0xa7840000, jit->ret0_ip - jit->prg);
+                /* lhi %r5,0 */
+                EMIT4(0xa7580000);
+                /* icm  %r5,3,<d(type)>(%r1) */
+                EMIT4_DISP(0xbf531000, offsetof(struct net_device, type));
+                break;
+        case BPF_S_ANC_RXHASH: /* A = skb->rxhash */
+                BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, rxhash) != 4);
+                /* l %r5,<d(rxhash)>(%r2) */
+                EMIT4_DISP(0x58502000, offsetof(struct sk_buff, rxhash));
+                break;
+        case BPF_S_ANC_CPU: /* A = smp_processor_id() */
+#ifdef CONFIG_SMP
+                /* l %r5,<d(cpu_nr)> */
+                EMIT4_DISP(0x58500000, offsetof(struct _lowcore, cpu_nr));
+#else
+                /* lhi %r5,0 */
+                EMIT4(0xa7580000);
+#endif
+                break;
+        default: /* too complex, give up */
+                goto out;
+        }
+        addrs[i] = jit->prg - jit->start;
+        return 0;
+out:
+        return -1;
+}
+
+void bpf_jit_compile(struct sk_filter *fp)
+{
+        unsigned long size, prg_len, lit_len;
+        struct bpf_jit jit, cjit;
+        unsigned int *addrs;
+        int pass, i;
+
+        if (!bpf_jit_enable)
+                return;
+        addrs = kmalloc(fp->len * sizeof(*addrs), GFP_KERNEL);
+        if (addrs == NULL)
+                return;
+        memset(addrs, 0, fp->len * sizeof(*addrs));
+        memset(&jit, 0, sizeof(cjit));
+        memset(&cjit, 0, sizeof(cjit));
+
+        for (pass = 0; pass < 10; pass++) {
+                jit.prg = jit.start;
+                jit.lit = jit.mid;
+
+                bpf_jit_prologue(&jit);
+                bpf_jit_noleaks(&jit, fp->insns);
+                for (i = 0; i < fp->len; i++) {
+                        if (bpf_jit_insn(&jit, fp->insns + i, addrs, i,
+                                         i == fp->len - 1))
+                                goto out;
+                }
+                bpf_jit_epilogue(&jit);
+                if (jit.start) {
+                        WARN_ON(jit.prg > cjit.prg || jit.lit > cjit.lit);
+                        if (memcmp(&jit, &cjit, sizeof(jit)) == 0)
+                                break;
+                } else if (jit.prg == cjit.prg && jit.lit == cjit.lit) {
+                        prg_len = jit.prg - jit.start;
+                        lit_len = jit.lit - jit.mid;
+                        size = max_t(unsigned long, prg_len + lit_len,
+                                     sizeof(struct work_struct));
+                        if (size >= BPF_SIZE_MAX)
+                                goto out;
+                        jit.start = module_alloc(size);
+                        if (!jit.start)
+                                goto out;
+                        jit.prg = jit.mid = jit.start + prg_len;
+                        jit.lit = jit.end = jit.start + prg_len + lit_len;
+                        jit.base_ip += (unsigned long) jit.start;
+                        jit.exit_ip += (unsigned long) jit.start;
+                        jit.ret0_ip += (unsigned long) jit.start;
+                }
+                cjit = jit;
+        }
+        if (bpf_jit_enable > 1) {
+                pr_err("flen=%d proglen=%lu pass=%d image=%p\n",
+                       fp->len, jit.end - jit.start, pass, jit.start);
+                if (jit.start) {
+                        printk(KERN_ERR "JIT code:\n");
+                        print_fn_code(jit.start, jit.mid - jit.start);
+                        print_hex_dump(KERN_ERR, "JIT literals:\n",
+                                       DUMP_PREFIX_ADDRESS, 16, 1,
+                                       jit.mid, jit.end - jit.mid, false);
+                }
+        }
+        if (jit.start)
+                fp->bpf_func = (void *) jit.start;
+out:
+        kfree(addrs);
+}
+
+static void jit_free_defer(struct work_struct *arg)
+{
+        module_free(NULL, arg);
+}
+
+/* run from softirq, we must use a work_struct to call
+ * module_free() from process context
+ */
+void bpf_jit_free(struct sk_filter *fp)
+{
+        struct work_struct *work;
+
+        if (fp->bpf_func == sk_run_filter)
+                return;
+        work = (struct work_struct *)fp->bpf_func;
+        INIT_WORK(work, jit_free_defer);
+        schedule_work(work);
+}
diff --git a/block/partitions/ibm.c b/block/partitions/ibm.c
index 1104acac780b..47a61474e795 100644
--- a/block/partitions/ibm.c
+++ b/block/partitions/ibm.c
@@ -1,9 +1,8 @@
 /*
- * File...........: linux/fs/partitions/ibm.c
  * Author(s)......: Holger Smolinski <Holger.Smolinski@de.ibm.com>
  *                  Volker Sameske <sameske@de.ibm.com>
  * Bugreports.to..: <Linux390@de.ibm.com>
- * (C) IBM Corporation, IBM Deutschland Entwicklung GmbH, 1999,2000
+ * Copyright IBM Corp. 1999, 2012
  */
 
 #include <linux/buffer_head.h>
@@ -17,17 +16,23 @@
 #include "check.h"
 #include "ibm.h"
 
+
+union label_t {
+        struct vtoc_volume_label_cdl vol;
+        struct vtoc_volume_label_ldl lnx;
+        struct vtoc_cms_label cms;
+};
+
 /*
  * compute the block number from a
  * cyl-cyl-head-head structure
  */
-static sector_t
-cchh2blk (struct vtoc_cchh *ptr, struct hd_geometry *geo) {
-
+static sector_t cchh2blk(struct vtoc_cchh *ptr, struct hd_geometry *geo)
+{
         sector_t cyl;
         __u16 head;
 
-        /*decode cylinder and heads for large volumes */
+        /* decode cylinder and heads for large volumes */
         cyl = ptr->hh & 0xFFF0;
         cyl <<= 12;
         cyl |= ptr->cc;
@@ -40,13 +45,12 @@ cchh2blk (struct vtoc_cchh *ptr, struct hd_geometry *geo) {
  * compute the block number from a
  * cyl-cyl-head-head-block structure
  */
-static sector_t
-cchhb2blk (struct vtoc_cchhb *ptr, struct hd_geometry *geo) {
-
+static sector_t cchhb2blk(struct vtoc_cchhb *ptr, struct hd_geometry *geo)
+{
         sector_t cyl;
         __u16 head;
 
-        /*decode cylinder and heads for large volumes */
+        /* decode cylinder and heads for large volumes */
         cyl = ptr->hh & 0xFFF0;
         cyl <<= 12;
         cyl |= ptr->cc;
@@ -56,26 +60,243 @@ cchhb2blk (struct vtoc_cchhb *ptr, struct hd_geometry *geo) {
                 ptr->b;
 }
 
+static int find_label(struct parsed_partitions *state,
+                      dasd_information2_t *info,
+                      struct hd_geometry *geo,
+                      int blocksize,
+                      sector_t *labelsect,
+                      char name[],
+                      char type[],
+                      union label_t *label)
+{
+        Sector sect;
+        unsigned char *data;
+        sector_t testsect[3];
+        unsigned char temp[5];
+        int found = 0;
+        int i, testcount;
+
+        /* There a three places where we may find a valid label:
+         * - on an ECKD disk it's block 2
+         * - on an FBA disk it's block 1
+         * - on an CMS formatted FBA disk it is sector 1, even if the block size
+         *   is larger than 512 bytes (possible if the DIAG discipline is used)
+         * If we have a valid info structure, then we know exactly which case we
+         * have, otherwise we just search through all possebilities.
+         */
+        if (info) {
+                if ((info->cu_type == 0x6310 && info->dev_type == 0x9336) ||
+                    (info->cu_type == 0x3880 && info->dev_type == 0x3370))
+                        testsect[0] = info->label_block;
+                else
+                        testsect[0] = info->label_block * (blocksize >> 9);
+                testcount = 1;
+        } else {
+                testsect[0] = 1;
+                testsect[1] = (blocksize >> 9);
+                testsect[2] = 2 * (blocksize >> 9);
+                testcount = 3;
+        }
+        for (i = 0; i < testcount; ++i) {
+                data = read_part_sector(state, testsect[i], &sect);
+                if (data == NULL)
+                        continue;
+                memcpy(label, data, sizeof(*label));
+                memcpy(temp, data, 4);
+                temp[4] = 0;
+                EBCASC(temp, 4);
+                put_dev_sector(sect);
+                if (!strcmp(temp, "VOL1") ||
+                    !strcmp(temp, "LNX1") ||
+                    !strcmp(temp, "CMS1")) {
+                        if (!strcmp(temp, "VOL1")) {
+                                strncpy(type, label->vol.vollbl, 4);
+                                strncpy(name, label->vol.volid, 6);
+                        } else {
+                                strncpy(type, label->lnx.vollbl, 4);
+                                strncpy(name, label->lnx.volid, 6);
+                        }
+                        EBCASC(type, 4);
+                        EBCASC(name, 6);
+                        *labelsect = testsect[i];
+                        found = 1;
+                        break;
+                }
+        }
+        if (!found)
+                memset(label, 0, sizeof(*label));
+
+        return found;
+}
+
+static int find_vol1_partitions(struct parsed_partitions *state,
+                                struct hd_geometry *geo,
+                                int blocksize,
+                                char name[],
+                                union label_t *label)
+{
+        sector_t blk;
+        int counter;
+        char tmp[64];
+        Sector sect;
+        unsigned char *data;
+        loff_t offset, size;
+        struct vtoc_format1_label f1;
+        int secperblk;
+
+        snprintf(tmp, sizeof(tmp), "VOL1/%8s:", name);
+        strlcat(state->pp_buf, tmp, PAGE_SIZE);
+        /*
+         * get start of VTOC from the disk label and then search for format1
+         * and format8 labels
+         */
+        secperblk = blocksize >> 9;
+        blk = cchhb2blk(&label->vol.vtoc, geo) + 1;
+        counter = 0;
+        data = read_part_sector(state, blk * secperblk, &sect);
+        while (data != NULL) {
+                memcpy(&f1, data, sizeof(struct vtoc_format1_label));
+                put_dev_sector(sect);
+                /* skip FMT4 / FMT5 / FMT7 labels */
+                if (f1.DS1FMTID == _ascebc['4']
+                    || f1.DS1FMTID == _ascebc['5']
+                    || f1.DS1FMTID == _ascebc['7']
+                    || f1.DS1FMTID == _ascebc['9']) {
+                        blk++;
+                        data = read_part_sector(state, blk * secperblk, &sect);
+                        continue;
+                }
+                /* only FMT1 and 8 labels valid at this point */
+                if (f1.DS1FMTID != _ascebc['1'] &&
+                    f1.DS1FMTID != _ascebc['8'])
+                        break;
+                /* OK, we got valid partition data */
+                offset = cchh2blk(&f1.DS1EXT1.llimit, geo);
+                size  = cchh2blk(&f1.DS1EXT1.ulimit, geo) -
+                        offset + geo->sectors;
+                offset *= secperblk;
+                size *= secperblk;
+                if (counter >= state->limit)
+                        break;
+                put_partition(state, counter + 1, offset, size);
+                counter++;
+                blk++;
+                data = read_part_sector(state, blk * secperblk, &sect);
+        }
+        strlcat(state->pp_buf, "\n", PAGE_SIZE);
+
+        if (!data)
+                return -1;
+
+        return 1;
+}
+
+static int find_lnx1_partitions(struct parsed_partitions *state,
+                                struct hd_geometry *geo,
+                                int blocksize,
+                                char name[],
+                                union label_t *label,
+                                sector_t labelsect,
+                                loff_t i_size,
+                                dasd_information2_t *info)
+{
+        loff_t offset, geo_size, size;
+        char tmp[64];
+        int secperblk;
+
+        snprintf(tmp, sizeof(tmp), "LNX1/%8s:", name);
+        strlcat(state->pp_buf, tmp, PAGE_SIZE);
+        secperblk = blocksize >> 9;
+        if (label->lnx.ldl_version == 0xf2) {
+                size = label->lnx.formatted_blocks * secperblk;
+        } else {
+                /*
+                 * Formated w/o large volume support. If the sanity check
+                 * 'size based on geo == size based on i_size' is true, then
+                 * we can safely assume that we know the formatted size of
+                 * the disk, otherwise we need additional information
+                 * that we can only get from a real DASD device.
+                 */
+                geo_size = geo->cylinders * geo->heads
+                        * geo->sectors * secperblk;
+                size = i_size >> 9;
+                if (size != geo_size) {
+                        if (!info) {
+                                strlcat(state->pp_buf, "\n", PAGE_SIZE);
+                                return 1;
+                        }
+                        if (!strcmp(info->type, "ECKD"))
+                                if (geo_size < size)
+                                        size = geo_size;
+                        /* else keep size based on i_size */
+                }
+        }
+        /* first and only partition starts in the first block after the label */
+        offset = labelsect + secperblk;
+        put_partition(state, 1, offset, size - offset);
+        strlcat(state->pp_buf, "\n", PAGE_SIZE);
+        return 1;
+}
+
+static int find_cms1_partitions(struct parsed_partitions *state,
+                                struct hd_geometry *geo,
+                                int blocksize,
+                                char name[],
+                                union label_t *label,
+                                sector_t labelsect)
+{
+        loff_t offset, size;
+        char tmp[64];
+        int secperblk;
+
+        /*
+         * VM style CMS1 labeled disk
+         */
+        blocksize = label->cms.block_size;
+        secperblk = blocksize >> 9;
+        if (label->cms.disk_offset != 0) {
+                snprintf(tmp, sizeof(tmp), "CMS1/%8s(MDSK):", name);
+                strlcat(state->pp_buf, tmp, PAGE_SIZE);
+                /* disk is reserved minidisk */
+                offset = label->cms.disk_offset * secperblk;
+                size = (label->cms.block_count - 1) * secperblk;
+        } else {
+                snprintf(tmp, sizeof(tmp), "CMS1/%8s:", name);
+                strlcat(state->pp_buf, tmp, PAGE_SIZE);
+                /*
+                 * Special case for FBA devices:
+                 * If an FBA device is CMS formatted with blocksize > 512 byte
+                 * and the DIAG discipline is used, then the CMS label is found
+                 * in sector 1 instead of block 1. However, the partition is
+                 * still supposed to start in block 2.
+                 */
+                if (labelsect == 1)
+                        offset = 2 * secperblk;
+                else
+                        offset = labelsect + secperblk;
+                size = label->cms.block_count * secperblk;
+        }
+
+        put_partition(state, 1, offset, size-offset);
+        strlcat(state->pp_buf, "\n", PAGE_SIZE);
+        return 1;
+}
+
+
 /*
+ * This is the main function, called by check.c
  */
 int ibm_partition(struct parsed_partitions *state)
 {
         struct block_device *bdev = state->bdev;
         int blocksize, res;
-        loff_t i_size, offset, size, fmt_size;
+        loff_t i_size, offset, size;
         dasd_information2_t *info;
         struct hd_geometry *geo;
         char type[5] = {0,};
         char name[7] = {0,};
-        union label_t {
-                struct vtoc_volume_label_cdl vol;
-                struct vtoc_volume_label_ldl lnx;
-                struct vtoc_cms_label cms;
-        } *label;
-        unsigned char *data;
-        Sector sect;
         sector_t labelsect;
-        char tmp[64];
+        union label_t *label;
 
         res = 0;
         blocksize = bdev_logical_block_size(bdev);
@@ -84,7 +305,6 @@ int ibm_partition(struct parsed_partitions *state)
         i_size = i_size_read(bdev->bd_inode);
         if (i_size == 0)
                 goto out_exit;
-
         info = kmalloc(sizeof(dasd_information2_t), GFP_KERNEL);
         if (info == NULL)
                 goto out_exit;
@@ -94,176 +314,45 @@ int ibm_partition(struct parsed_partitions *state)
         label = kmalloc(sizeof(union label_t), GFP_KERNEL);
         if (label == NULL)
                 goto out_nolab;
-
-        if (ioctl_by_bdev(bdev, BIODASDINFO2, (unsigned long)info) != 0 ||
-            ioctl_by_bdev(bdev, HDIO_GETGEO, (unsigned long)geo) != 0)
+        if (ioctl_by_bdev(bdev, HDIO_GETGEO, (unsigned long)geo) != 0)
                 goto out_freeall;
-
-        /*
-         * Special case for FBA disks: label sector does not depend on
-         * blocksize.
-         */
-        if ((info->cu_type == 0x6310 && info->dev_type == 0x9336) ||
-            (info->cu_type == 0x3880 && info->dev_type == 0x3370))
-                labelsect = info->label_block;
-        else
-                labelsect = info->label_block * (blocksize >> 9);
-
-        /*
-         * Get volume label, extract name and type.
-         */
-        data = read_part_sector(state, labelsect, &sect);
-        if (data == NULL)
-                goto out_readerr;
-
-        memcpy(label, data, sizeof(union label_t));
-        put_dev_sector(sect);
-
-        if ((!info->FBA_layout) && (!strcmp(info->type, "ECKD"))) {
-                strncpy(type, label->vol.vollbl, 4);
-                strncpy(name, label->vol.volid, 6);
-        } else {
-                strncpy(type, label->lnx.vollbl, 4);
-                strncpy(name, label->lnx.volid, 6);
+        if (ioctl_by_bdev(bdev, BIODASDINFO2, (unsigned long)info) != 0) {
+                kfree(info);
+                info = NULL;
         }
-        EBCASC(type, 4);
-        EBCASC(name, 6);
-
-        res = 1;
 
-        /*
-         * Three different formats: LDL, CDL and unformated disk
-         *
-         * identified by info->format
-         *
-         * unformated disks we do not have to care about
-         */
-        if (info->format == DASD_FORMAT_LDL) {
-                if (strncmp(type, "CMS1", 4) == 0) {
-                        /*
-                         * VM style CMS1 labeled disk
-                         */
-                        blocksize = label->cms.block_size;
-                        if (label->cms.disk_offset != 0) {
-                                snprintf(tmp, sizeof(tmp), "CMS1/%8s(MDSK):", name);
-                                strlcat(state->pp_buf, tmp, PAGE_SIZE);
-                                /* disk is reserved minidisk */
-                                offset = label->cms.disk_offset;
-                                size = (label->cms.block_count - 1)
-                                        * (blocksize >> 9);
-                        } else {
-                                snprintf(tmp, sizeof(tmp), "CMS1/%8s:", name);
-                                strlcat(state->pp_buf, tmp, PAGE_SIZE);
-                                offset = (info->label_block + 1);
-                                size = label->cms.block_count
-                                        * (blocksize >> 9);
-                        }
-                        put_partition(state, 1, offset*(blocksize >> 9),
-                                      size-offset*(blocksize >> 9));
-                } else {
-                        if (strncmp(type, "LNX1", 4) == 0) {
-                                snprintf(tmp, sizeof(tmp), "LNX1/%8s:", name);
-                                strlcat(state->pp_buf, tmp, PAGE_SIZE);
-                                if (label->lnx.ldl_version == 0xf2) {
-                                        fmt_size = label->lnx.formatted_blocks
-                                                * (blocksize >> 9);
-                                } else if (!strcmp(info->type, "ECKD")) {
-                                        /* formated w/o large volume support */
-                                        fmt_size = geo->cylinders * geo->heads
-                                              * geo->sectors * (blocksize >> 9);
-                                } else {
-                                        /* old label and no usable disk geometry
-                                         * (e.g. DIAG) */
-                                        fmt_size = i_size >> 9;
-                                }
-                                size = i_size >> 9;
-                                if (fmt_size < size)
-                                        size = fmt_size;
-                                offset = (info->label_block + 1);
-                        } else {
-                                /* unlabeled disk */
-                                strlcat(state->pp_buf, "(nonl)", PAGE_SIZE);
-                                size = i_size >> 9;
-                                offset = (info->label_block + 1);
-                        }
-                        put_partition(state, 1, offset*(blocksize >> 9),
-                                      size-offset*(blocksize >> 9));
+        if (find_label(state, info, geo, blocksize, &labelsect, name, type,
+                       label)) {
+                if (!strncmp(type, "VOL1", 4)) {
+                        res = find_vol1_partitions(state, geo, blocksize, name,
+                                                   label);
+                } else if (!strncmp(type, "LNX1", 4)) {
+                        res = find_lnx1_partitions(state, geo, blocksize, name,
+                                                   label, labelsect, i_size,
+                                                   info);
+                } else if (!strncmp(type, "CMS1", 4)) {
+                        res = find_cms1_partitions(state, geo, blocksize, name,
+                                                   label, labelsect);
                 }
-        } else if (info->format == DASD_FORMAT_CDL) {
-                /*
-                 * New style CDL formatted disk
-                 */
-                sector_t blk;
-                int counter;
-
+        } else if (info) {
                 /*
-                 * check if VOL1 label is available
-                 * if not, something is wrong, skipping partition detection
+                 * ugly but needed for backward compatibility:
+                 * If the block device is a DASD (i.e. BIODASDINFO2 works),
+                 * then we claim it in any case, even though it has no valid
+                 * label. If it has the LDL format, then we simply define a
+                 * partition as if it had an LNX1 label.
                  */
-                if (strncmp(type, "VOL1",  4) == 0) {
-                        snprintf(tmp, sizeof(tmp), "VOL1/%8s:", name);
-                        strlcat(state->pp_buf, tmp, PAGE_SIZE);
-                        /*
-                         * get block number and read then go through format1
-                         * labels
-                         */
-                        blk = cchhb2blk(&label->vol.vtoc, geo) + 1;
-                        counter = 0;
-                        data = read_part_sector(state, blk * (blocksize/512),
-                                                &sect);
-                        while (data != NULL) {
-                                struct vtoc_format1_label f1;
-
-                                memcpy(&f1, data,
-                                       sizeof(struct vtoc_format1_label));
-                                put_dev_sector(sect);
-
-                                /* skip FMT4 / FMT5 / FMT7 labels */
-                                if (f1.DS1FMTID == _ascebc['4']
-                                    || f1.DS1FMTID == _ascebc['5']
-                                    || f1.DS1FMTID == _ascebc['7']
-                                    || f1.DS1FMTID == _ascebc['9']) {
-                                        blk++;
-                                        data = read_part_sector(state,
-                                                blk * (blocksize/512), &sect);
-                                        continue;
-                                }
-
-                                /* only FMT1 and 8 labels valid at this point */
-                                if (f1.DS1FMTID != _ascebc['1'] &&
-                                    f1.DS1FMTID != _ascebc['8'])
-                                        break;
-
-                                /* OK, we got valid partition data */
-                                offset = cchh2blk(&f1.DS1EXT1.llimit, geo);
-                                size  = cchh2blk(&f1.DS1EXT1.ulimit, geo) -
-                                        offset + geo->sectors;
-                                if (counter >= state->limit)
-                                        break;
-                                put_partition(state, counter + 1,
-                                              offset * (blocksize >> 9),
-                                              size * (blocksize >> 9));
-                                counter++;
-                                blk++;
-                                data = read_part_sector(state,
-                                                blk * (blocksize/512), &sect);
-                        }
-
-                        if (!data)
-                                /* Are we not supposed to report this ? */
-                                goto out_readerr;
-                } else
-                        printk(KERN_INFO "Expected Label VOL1 not "
-                               "found, treating as CDL formated Disk");
-
-        }
-
-        strlcat(state->pp_buf, "\n", PAGE_SIZE);
-        goto out_freeall;
-
+                res = 1;
+                if (info->format == DASD_FORMAT_LDL) {
+                        strlcat(state->pp_buf, "(nonl)", PAGE_SIZE);
+                        size = i_size >> 9;
+                        offset = (info->label_block + 1) * (blocksize >> 9);
+                        put_partition(state, 1, offset, size-offset);
+                        strlcat(state->pp_buf, "\n", PAGE_SIZE);
+                }
+        } else
+                res = 0;
 
-out_readerr:
-        res = -1;
 out_freeall:
         kfree(label);
 out_nolab:
diff --git a/drivers/s390/block/Kconfig b/drivers/s390/block/Kconfig
index 8e477bb1f3f6..4a3b62326183 100644
--- a/drivers/s390/block/Kconfig
+++ b/drivers/s390/block/Kconfig
@@ -70,3 +70,21 @@ config DASD_EER
           This driver provides a character device interface to the
           DASD extended error reporting. This is only needed if you want to
           use applications written for the EER facility.
+
+config SCM_BLOCK
+        def_tristate m
+        prompt "Support for Storage Class Memory"
+        depends on S390 && BLOCK && EADM_SCH && SCM_BUS
+        help
+          Block device driver for Storage Class Memory (SCM). This driver
+          provides a block device interface for each available SCM increment.
+
+          To compile this driver as a module, choose M here: the
+          module will be called scm_block.
+
+config SCM_BLOCK_CLUSTER_WRITE
+        def_bool y
+        prompt "SCM force cluster writes"
+        depends on SCM_BLOCK
+        help
+          Force writes to Storage Class Memory (SCM) to be in done in clusters.
diff --git a/drivers/s390/block/Makefile b/drivers/s390/block/Makefile
index 0a89e080b389..c2f4e673e031 100644
--- a/drivers/s390/block/Makefile
+++ b/drivers/s390/block/Makefile
@@ -17,3 +17,9 @@ obj-$(CONFIG_DASD_ECKD) += dasd_eckd_mod.o
 obj-$(CONFIG_DASD_FBA)  += dasd_fba_mod.o
 obj-$(CONFIG_BLK_DEV_XPRAM) += xpram.o
 obj-$(CONFIG_DCSSBLK) += dcssblk.o
+
+scm_block-objs := scm_drv.o scm_blk.o
+ifdef CONFIG_SCM_BLOCK_CLUSTER_WRITE
+scm_block-objs += scm_blk_cluster.o
+endif
+obj-$(CONFIG_SCM_BLOCK) += scm_block.o
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index c48c72abbefc..108332b44d98 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -20,6 +20,7 @@
 #include <linux/compat.h>
 #include <linux/init.h>
 
+#include <asm/css_chars.h>
 #include <asm/debug.h>
 #include <asm/idals.h>
 #include <asm/ebcdic.h>
@@ -31,8 +32,6 @@
 
 #include "dasd_int.h"
 #include "dasd_eckd.h"
-#include "../cio/chsc.h"
-
 
 #ifdef PRINTK_HEADER
 #undef PRINTK_HEADER
@@ -140,6 +139,10 @@ dasd_eckd_set_online(struct ccw_device *cdev)
 static const int sizes_trk0[] = { 28, 148, 84 };
 #define LABEL_SIZE 140
 
+/* head and record addresses of count_area read in analysis ccw */
+static const int count_area_head[] = { 0, 0, 0, 0, 2 };
+static const int count_area_rec[] = { 1, 2, 3, 4, 1 };
+
 static inline unsigned int
 round_up_multiple(unsigned int no, unsigned int mult)
 {
@@ -212,7 +215,7 @@ check_XRC (struct ccw1         *de_ccw,
 
         rc = get_sync_clock(&data->ep_sys_time);
         /* Ignore return code if sync clock is switched off. */
-        if (rc == -ENOSYS || rc == -EACCES)
+        if (rc == -EOPNOTSUPP || rc == -EACCES)
                 rc = 0;
 
         de_ccw->count = sizeof(struct DE_eckd_data);
@@ -323,7 +326,7 @@ static int check_XRC_on_prefix(struct PFX_eckd_data *pfxdata,
 
         rc = get_sync_clock(&pfxdata->define_extent.ep_sys_time);
         /* Ignore return code if sync clock is switched off. */
-        if (rc == -ENOSYS || rc == -EACCES)
+        if (rc == -EOPNOTSUPP || rc == -EACCES)
                 rc = 0;
         return rc;
 }
@@ -1940,7 +1943,10 @@ static int dasd_eckd_end_analysis(struct dasd_block *block)
         count_area = NULL;
         for (i = 0; i < 3; i++) {
                 if (private->count_area[i].kl != 4 ||
-                    private->count_area[i].dl != dasd_eckd_cdl_reclen(i) - 4) {
+                    private->count_area[i].dl != dasd_eckd_cdl_reclen(i) - 4 ||
+                    private->count_area[i].cyl != 0 ||
+                    private->count_area[i].head != count_area_head[i] ||
+                    private->count_area[i].record != count_area_rec[i]) {
                         private->uses_cdl = 0;
                         break;
                 }
@@ -1952,7 +1958,10 @@ static int dasd_eckd_end_analysis(struct dasd_block *block)
                 for (i = 0; i < 5; i++) {
                         if ((private->count_area[i].kl != 0) ||
                             (private->count_area[i].dl !=
-                             private->count_area[0].dl))
+                             private->count_area[0].dl) ||
+                            private->count_area[i].cyl !=  0 ||
+                            private->count_area[i].head != count_area_head[i] ||
+                            private->count_area[i].record != count_area_rec[i])
                                 break;
                 }
                 if (i == 5)
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index 654c6921a6d4..8252f37d04ed 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -292,12 +292,12 @@ out:
 #else
 static int dasd_ioctl_reset_profile(struct dasd_block *block)
 {
-        return -ENOSYS;
+        return -ENOTTY;
 }
 
 static int dasd_ioctl_read_profile(struct dasd_block *block, void __user *argp)
 {
-        return -ENOSYS;
+        return -ENOTTY;
 }
 #endif
 
diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c
new file mode 100644
index 000000000000..9978ad4433cb
--- /dev/null
+++ b/drivers/s390/block/scm_blk.c
@@ -0,0 +1,445 @@
+/*
+ * Block driver for s390 storage class memory.
+ *
+ * Copyright IBM Corp. 2012
+ * Author(s): Sebastian Ott <sebott@linux.vnet.ibm.com>
+ */
+
+#define KMSG_COMPONENT "scm_block"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
+#include <linux/interrupt.h>
+#include <linux/spinlock.h>
+#include <linux/module.h>
+#include <linux/blkdev.h>
+#include <linux/genhd.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <asm/eadm.h>
+#include "scm_blk.h"
+
+debug_info_t *scm_debug;
+static int scm_major;
+static DEFINE_SPINLOCK(list_lock);
+static LIST_HEAD(inactive_requests);
+static unsigned int nr_requests = 64;
+static atomic_t nr_devices = ATOMIC_INIT(0);
+module_param(nr_requests, uint, S_IRUGO);
+MODULE_PARM_DESC(nr_requests, "Number of parallel requests.");
+
+MODULE_DESCRIPTION("Block driver for s390 storage class memory.");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("scm:scmdev*");
+
+static void __scm_free_rq(struct scm_request *scmrq)
+{
+        struct aob_rq_header *aobrq = to_aobrq(scmrq);
+
+        free_page((unsigned long) scmrq->aob);
+        free_page((unsigned long) scmrq->aidaw);
+        __scm_free_rq_cluster(scmrq);
+        kfree(aobrq);
+}
+
+static void scm_free_rqs(void)
+{
+        struct list_head *iter, *safe;
+        struct scm_request *scmrq;
+
+        spin_lock_irq(&list_lock);
+        list_for_each_safe(iter, safe, &inactive_requests) {
+                scmrq = list_entry(iter, struct scm_request, list);
+                list_del(&scmrq->list);
+                __scm_free_rq(scmrq);
+        }
+        spin_unlock_irq(&list_lock);
+}
+
+static int __scm_alloc_rq(void)
+{
+        struct aob_rq_header *aobrq;
+        struct scm_request *scmrq;
+
+        aobrq = kzalloc(sizeof(*aobrq) + sizeof(*scmrq), GFP_KERNEL);
+        if (!aobrq)
+                return -ENOMEM;
+
+        scmrq = (void *) aobrq->data;
+        scmrq->aidaw = (void *) get_zeroed_page(GFP_DMA);
+        scmrq->aob = (void *) get_zeroed_page(GFP_DMA);
+        if (!scmrq->aob || !scmrq->aidaw) {
+                __scm_free_rq(scmrq);
+                return -ENOMEM;
+        }
+
+        if (__scm_alloc_rq_cluster(scmrq)) {
+                __scm_free_rq(scmrq);
+                return -ENOMEM;
+        }
+
+        INIT_LIST_HEAD(&scmrq->list);
+        spin_lock_irq(&list_lock);
+        list_add(&scmrq->list, &inactive_requests);
+        spin_unlock_irq(&list_lock);
+
+        return 0;
+}
+
+static int scm_alloc_rqs(unsigned int nrqs)
+{
+        int ret = 0;
+
+        while (nrqs-- && !ret)
+                ret = __scm_alloc_rq();
+
+        return ret;
+}
+
+static struct scm_request *scm_request_fetch(void)
+{
+        struct scm_request *scmrq = NULL;
+
+        spin_lock(&list_lock);
+        if (list_empty(&inactive_requests))
+                goto out;
+        scmrq = list_first_entry(&inactive_requests, struct scm_request, list);
+        list_del(&scmrq->list);
+out:
+        spin_unlock(&list_lock);
+        return scmrq;
+}
+
+static void scm_request_done(struct scm_request *scmrq)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&list_lock, flags);
+        list_add(&scmrq->list, &inactive_requests);
+        spin_unlock_irqrestore(&list_lock, flags);
+}
+
+static int scm_open(struct block_device *blkdev, fmode_t mode)
+{
+        return scm_get_ref();
+}
+
+static int scm_release(struct gendisk *gendisk, fmode_t mode)
+{
+        scm_put_ref();
+        return 0;
+}
+
+static const struct block_device_operations scm_blk_devops = {
+        .owner = THIS_MODULE,
+        .open = scm_open,
+        .release = scm_release,
+};
+
+static void scm_request_prepare(struct scm_request *scmrq)
+{
+        struct scm_blk_dev *bdev = scmrq->bdev;
+        struct scm_device *scmdev = bdev->gendisk->private_data;
+        struct aidaw *aidaw = scmrq->aidaw;
+        struct msb *msb = &scmrq->aob->msb[0];
+        struct req_iterator iter;
+        struct bio_vec *bv;
+
+        msb->bs = MSB_BS_4K;
+        scmrq->aob->request.msb_count = 1;
+        msb->scm_addr = scmdev->address +
+                ((u64) blk_rq_pos(scmrq->request) << 9);
+        msb->oc = (rq_data_dir(scmrq->request) == READ) ?
+                MSB_OC_READ : MSB_OC_WRITE;
+        msb->flags |= MSB_FLAG_IDA;
+        msb->data_addr = (u64) aidaw;
+
+        rq_for_each_segment(bv, scmrq->request, iter) {
+                WARN_ON(bv->bv_offset);
+                msb->blk_count += bv->bv_len >> 12;
+                aidaw->data_addr = (u64) page_address(bv->bv_page);
+                aidaw++;
+        }
+}
+
+static inline void scm_request_init(struct scm_blk_dev *bdev,
+                                    struct scm_request *scmrq,
+                                    struct request *req)
+{
+        struct aob_rq_header *aobrq = to_aobrq(scmrq);
+        struct aob *aob = scmrq->aob;
+
+        memset(aob, 0, sizeof(*aob));
+        memset(scmrq->aidaw, 0, PAGE_SIZE);
+        aobrq->scmdev = bdev->scmdev;
+        aob->request.cmd_code = ARQB_CMD_MOVE;
+        aob->request.data = (u64) aobrq;
+        scmrq->request = req;
+        scmrq->bdev = bdev;
+        scmrq->retries = 4;
+        scmrq->error = 0;
+        scm_request_cluster_init(scmrq);
+}
+
+static void scm_ensure_queue_restart(struct scm_blk_dev *bdev)
+{
+        if (atomic_read(&bdev->queued_reqs)) {
+                /* Queue restart is triggered by the next interrupt. */
+                return;
+        }
+        blk_delay_queue(bdev->rq, SCM_QUEUE_DELAY);
+}
+
+void scm_request_requeue(struct scm_request *scmrq)
+{
+        struct scm_blk_dev *bdev = scmrq->bdev;
+
+        scm_release_cluster(scmrq);
+        blk_requeue_request(bdev->rq, scmrq->request);
+        scm_request_done(scmrq);
+        scm_ensure_queue_restart(bdev);
+}
+
+void scm_request_finish(struct scm_request *scmrq)
+{
+        scm_release_cluster(scmrq);
+        blk_end_request_all(scmrq->request, scmrq->error);
+        scm_request_done(scmrq);
+}
+
+static void scm_blk_request(struct request_queue *rq)
+{
+        struct scm_device *scmdev = rq->queuedata;
+        struct scm_blk_dev *bdev = dev_get_drvdata(&scmdev->dev);
+        struct scm_request *scmrq;
+        struct request *req;
+        int ret;
+
+        while ((req = blk_peek_request(rq))) {
+                if (req->cmd_type != REQ_TYPE_FS)
+                        continue;
+
+                scmrq = scm_request_fetch();
+                if (!scmrq) {
+                        SCM_LOG(5, "no request");
+                        scm_ensure_queue_restart(bdev);
+                        return;
+                }
+                scm_request_init(bdev, scmrq, req);
+                if (!scm_reserve_cluster(scmrq)) {
+                        SCM_LOG(5, "cluster busy");
+                        scm_request_done(scmrq);
+                        return;
+                }
+                if (scm_need_cluster_request(scmrq)) {
+                        blk_start_request(req);
+                        scm_initiate_cluster_request(scmrq);
+                        return;
+                }
+                scm_request_prepare(scmrq);
+                blk_start_request(req);
+
+                ret = scm_start_aob(scmrq->aob);
+                if (ret) {
+                        SCM_LOG(5, "no subchannel");
+                        scm_request_requeue(scmrq);
+                        return;
+                }
+                atomic_inc(&bdev->queued_reqs);
+        }
+}
+
+static void __scmrq_log_error(struct scm_request *scmrq)
+{
+        struct aob *aob = scmrq->aob;
+
+        if (scmrq->error == -ETIMEDOUT)
+                SCM_LOG(1, "Request timeout");
+        else {
+                SCM_LOG(1, "Request error");
+                SCM_LOG_HEX(1, &aob->response, sizeof(aob->response));
+        }
+        if (scmrq->retries)
+                SCM_LOG(1, "Retry request");
+        else
+                pr_err("An I/O operation to SCM failed with rc=%d\n",
+                       scmrq->error);
+}
+
+void scm_blk_irq(struct scm_device *scmdev, void *data, int error)
+{
+        struct scm_request *scmrq = data;
+        struct scm_blk_dev *bdev = scmrq->bdev;
+
+        scmrq->error = error;
+        if (error)
+                __scmrq_log_error(scmrq);
+
+        spin_lock(&bdev->lock);
+        list_add_tail(&scmrq->list, &bdev->finished_requests);
+        spin_unlock(&bdev->lock);
+        tasklet_hi_schedule(&bdev->tasklet);
+}
+
+static void scm_blk_tasklet(struct scm_blk_dev *bdev)
+{
+        struct scm_request *scmrq;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bdev->lock, flags);
+        while (!list_empty(&bdev->finished_requests)) {
+                scmrq = list_first_entry(&bdev->finished_requests,
+                                         struct scm_request, list);
+                list_del(&scmrq->list);
+                spin_unlock_irqrestore(&bdev->lock, flags);
+
+                if (scmrq->error && scmrq->retries-- > 0) {
+                        if (scm_start_aob(scmrq->aob)) {
+                                spin_lock_irqsave(&bdev->rq_lock, flags);
+                                scm_request_requeue(scmrq);
+                                spin_unlock_irqrestore(&bdev->rq_lock, flags);
+                        }
+                        /* Request restarted or requeued, handle next. */
+                        spin_lock_irqsave(&bdev->lock, flags);
+                        continue;
+                }
+
+                if (scm_test_cluster_request(scmrq)) {
+                        scm_cluster_request_irq(scmrq);
+                        spin_lock_irqsave(&bdev->lock, flags);
+                        continue;
+                }
+
+                scm_request_finish(scmrq);
+                atomic_dec(&bdev->queued_reqs);
+                spin_lock_irqsave(&bdev->lock, flags);
+        }
+        spin_unlock_irqrestore(&bdev->lock, flags);
+        /* Look out for more requests. */
+        blk_run_queue(bdev->rq);
+}
+
+int scm_blk_dev_setup(struct scm_blk_dev *bdev, struct scm_device *scmdev)
+{
+        struct request_queue *rq;
+        int len, ret = -ENOMEM;
+        unsigned int devindex, nr_max_blk;
+
+        devindex = atomic_inc_return(&nr_devices) - 1;
+        /* scma..scmz + scmaa..scmzz */
+        if (devindex > 701) {
+                ret = -ENODEV;
+                goto out;
+        }
+
+        bdev->scmdev = scmdev;
+        spin_lock_init(&bdev->rq_lock);
+        spin_lock_init(&bdev->lock);
+        INIT_LIST_HEAD(&bdev->finished_requests);
+        atomic_set(&bdev->queued_reqs, 0);
+        tasklet_init(&bdev->tasklet,
+                     (void (*)(unsigned long)) scm_blk_tasklet,
+                     (unsigned long) bdev);
+
+        rq = blk_init_queue(scm_blk_request, &bdev->rq_lock);
+        if (!rq)
+                goto out;
+
+        bdev->rq = rq;
+        nr_max_blk = min(scmdev->nr_max_block,
+                         (unsigned int) (PAGE_SIZE / sizeof(struct aidaw)));
+
+        blk_queue_logical_block_size(rq, 1 << 12);
+        blk_queue_max_hw_sectors(rq, nr_max_blk << 3); /* 8 * 512 = blk_size */
+        blk_queue_max_segments(rq, nr_max_blk);
+        queue_flag_set_unlocked(QUEUE_FLAG_NONROT, rq);
+        scm_blk_dev_cluster_setup(bdev);
+
+        bdev->gendisk = alloc_disk(SCM_NR_PARTS);
+        if (!bdev->gendisk)
+                goto out_queue;
+
+        rq->queuedata = scmdev;
+        bdev->gendisk->driverfs_dev = &scmdev->dev;
+        bdev->gendisk->private_data = scmdev;
+        bdev->gendisk->fops = &scm_blk_devops;
+        bdev->gendisk->queue = rq;
+        bdev->gendisk->major = scm_major;
+        bdev->gendisk->first_minor = devindex * SCM_NR_PARTS;
+
+        len = snprintf(bdev->gendisk->disk_name, DISK_NAME_LEN, "scm");
+        if (devindex > 25) {
+                len += snprintf(bdev->gendisk->disk_name + len,
+                                DISK_NAME_LEN - len, "%c",
+                                'a' + (devindex / 26) - 1);
+                devindex = devindex % 26;
+        }
+        snprintf(bdev->gendisk->disk_name + len, DISK_NAME_LEN - len, "%c",
+                 'a' + devindex);
+
+        /* 512 byte sectors */
+        set_capacity(bdev->gendisk, scmdev->size >> 9);
+        add_disk(bdev->gendisk);
+        return 0;
+
+out_queue:
+        blk_cleanup_queue(rq);
+out:
+        atomic_dec(&nr_devices);
+        return ret;
+}
+
+void scm_blk_dev_cleanup(struct scm_blk_dev *bdev)
+{
+        tasklet_kill(&bdev->tasklet);
+        del_gendisk(bdev->gendisk);
+        blk_cleanup_queue(bdev->gendisk->queue);
+        put_disk(bdev->gendisk);
+}
+
+static int __init scm_blk_init(void)
+{
+        int ret = -EINVAL;
+
+        if (!scm_cluster_size_valid())
+                goto out;
+
+        ret = register_blkdev(0, "scm");
+        if (ret < 0)
+                goto out;
+
+        scm_major = ret;
+        if (scm_alloc_rqs(nr_requests))
+                goto out_unreg;
+
+        scm_debug = debug_register("scm_log", 16, 1, 16);
+        if (!scm_debug)
+                goto out_free;
+
+        debug_register_view(scm_debug, &debug_hex_ascii_view);
+        debug_set_level(scm_debug, 2);
+
+        ret = scm_drv_init();
+        if (ret)
+                goto out_dbf;
+
+        return ret;
+
+out_dbf:
+        debug_unregister(scm_debug);
+out_free:
+        scm_free_rqs();
+out_unreg:
+        unregister_blkdev(scm_major, "scm");
+out:
+        return ret;
+}
+module_init(scm_blk_init);
+
+static void __exit scm_blk_cleanup(void)
+{
+        scm_drv_cleanup();
+        debug_unregister(scm_debug);
+        scm_free_rqs();
+        unregister_blkdev(scm_major, "scm");
+}
+module_exit(scm_blk_cleanup);
diff --git a/drivers/s390/block/scm_blk.h b/drivers/s390/block/scm_blk.h
new file mode 100644
index 000000000000..7ac6bad919ef
--- /dev/null
+++ b/drivers/s390/block/scm_blk.h
@@ -0,0 +1,117 @@
+#ifndef SCM_BLK_H
+#define SCM_BLK_H
+
+#include <linux/interrupt.h>
+#include <linux/spinlock.h>
+#include <linux/blkdev.h>
+#include <linux/genhd.h>
+#include <linux/list.h>
+
+#include <asm/debug.h>
+#include <asm/eadm.h>
+
+#define SCM_NR_PARTS 8
+#define SCM_QUEUE_DELAY 5
+
+struct scm_blk_dev {
+        struct tasklet_struct tasklet;
+        struct request_queue *rq;
+        struct gendisk *gendisk;
+        struct scm_device *scmdev;
+        spinlock_t rq_lock;     /* guard the request queue */
+        spinlock_t lock;        /* guard the rest of the blockdev */
+        atomic_t queued_reqs;
+        struct list_head finished_requests;
+#ifdef CONFIG_SCM_BLOCK_CLUSTER_WRITE
+        struct list_head cluster_list;
+#endif
+};
+
+struct scm_request {
+        struct scm_blk_dev *bdev;
+        struct request *request;
+        struct aidaw *aidaw;
+        struct aob *aob;
+        struct list_head list;
+        u8 retries;
+        int error;
+#ifdef CONFIG_SCM_BLOCK_CLUSTER_WRITE
+        struct {
+                enum {CLUSTER_NONE, CLUSTER_READ, CLUSTER_WRITE} state;
+                struct list_head list;
+                void **buf;
+        } cluster;
+#endif
+};
+
+#define to_aobrq(rq) container_of((void *) rq, struct aob_rq_header, data)
+
+int scm_blk_dev_setup(struct scm_blk_dev *, struct scm_device *);
+void scm_blk_dev_cleanup(struct scm_blk_dev *);
+void scm_blk_irq(struct scm_device *, void *, int);
+
+void scm_request_finish(struct scm_request *);
+void scm_request_requeue(struct scm_request *);
+
+int scm_drv_init(void);
+void scm_drv_cleanup(void);
+
+#ifdef CONFIG_SCM_BLOCK_CLUSTER_WRITE
+void __scm_free_rq_cluster(struct scm_request *);
+int __scm_alloc_rq_cluster(struct scm_request *);
+void scm_request_cluster_init(struct scm_request *);
+bool scm_reserve_cluster(struct scm_request *);
+void scm_release_cluster(struct scm_request *);
+void scm_blk_dev_cluster_setup(struct scm_blk_dev *);
+bool scm_need_cluster_request(struct scm_request *);
+void scm_initiate_cluster_request(struct scm_request *);
+void scm_cluster_request_irq(struct scm_request *);
+bool scm_test_cluster_request(struct scm_request *);
+bool scm_cluster_size_valid(void);
+#else
+#define __scm_free_rq_cluster(scmrq) {}
+#define __scm_alloc_rq_cluster(scmrq) 0
+#define scm_request_cluster_init(scmrq) {}
+#define scm_reserve_cluster(scmrq) true
+#define scm_release_cluster(scmrq) {}
+#define scm_blk_dev_cluster_setup(bdev) {}
+#define scm_need_cluster_request(scmrq) false
+#define scm_initiate_cluster_request(scmrq) {}
+#define scm_cluster_request_irq(scmrq) {}
+#define scm_test_cluster_request(scmrq) false
+#define scm_cluster_size_valid() true
+#endif
+
+extern debug_info_t *scm_debug;
+
+#define SCM_LOG(imp, txt) do {                                  \
+                debug_text_event(scm_debug, imp, txt);          \
+        } while (0)
+
+static inline void SCM_LOG_HEX(int level, void *data, int length)
+{
+        if (level > scm_debug->level)
+                return;
+        while (length > 0) {
+                debug_event(scm_debug, level, data, length);
+                length -= scm_debug->buf_size;
+                data += scm_debug->buf_size;
+        }
+}
+
+static inline void SCM_LOG_STATE(int level, struct scm_device *scmdev)
+{
+        struct {
+                u64 address;
+                u8 oper_state;
+                u8 rank;
+        } __packed data = {
+                .address = scmdev->address,
+                .oper_state = scmdev->attrs.oper_state,
+                .rank = scmdev->attrs.rank,
+        };
+
+        SCM_LOG_HEX(level, &data, sizeof(data));
+}
+
+#endif /* SCM_BLK_H */
diff --git a/drivers/s390/block/scm_blk_cluster.c b/drivers/s390/block/scm_blk_cluster.c
new file mode 100644
index 000000000000..f4bb61b0cea1
--- /dev/null
+++ b/drivers/s390/block/scm_blk_cluster.c
@@ -0,0 +1,228 @@
+/*
+ * Block driver for s390 storage class memory.
+ *
+ * Copyright IBM Corp. 2012
+ * Author(s): Sebastian Ott <sebott@linux.vnet.ibm.com>
+ */
+
+#include <linux/spinlock.h>
+#include <linux/module.h>
+#include <linux/blkdev.h>
+#include <linux/genhd.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <asm/eadm.h>
+#include "scm_blk.h"
+
+static unsigned int write_cluster_size = 64;
+module_param(write_cluster_size, uint, S_IRUGO);
+MODULE_PARM_DESC(write_cluster_size,
+                 "Number of pages used for contiguous writes.");
+
+#define CLUSTER_SIZE (write_cluster_size * PAGE_SIZE)
+
+void __scm_free_rq_cluster(struct scm_request *scmrq)
+{
+        int i;
+
+        if (!scmrq->cluster.buf)
+                return;
+
+        for (i = 0; i < 2 * write_cluster_size; i++)
+                free_page((unsigned long) scmrq->cluster.buf[i]);
+
+        kfree(scmrq->cluster.buf);
+}
+
+int __scm_alloc_rq_cluster(struct scm_request *scmrq)
+{
+        int i;
+
+        scmrq->cluster.buf = kzalloc(sizeof(void *) * 2 * write_cluster_size,
+                                 GFP_KERNEL);
+        if (!scmrq->cluster.buf)
+                return -ENOMEM;
+
+        for (i = 0; i < 2 * write_cluster_size; i++) {
+                scmrq->cluster.buf[i] = (void *) get_zeroed_page(GFP_DMA);
+                if (!scmrq->cluster.buf[i])
+                        return -ENOMEM;
+        }
+        INIT_LIST_HEAD(&scmrq->cluster.list);
+        return 0;
+}
+
+void scm_request_cluster_init(struct scm_request *scmrq)
+{
+        scmrq->cluster.state = CLUSTER_NONE;
+}
+
+static bool clusters_intersect(struct scm_request *A, struct scm_request *B)
+{
+        unsigned long firstA, lastA, firstB, lastB;
+
+        firstA = ((u64) blk_rq_pos(A->request) << 9) / CLUSTER_SIZE;
+        lastA = (((u64) blk_rq_pos(A->request) << 9) +
+                    blk_rq_bytes(A->request) - 1) / CLUSTER_SIZE;
+
+        firstB = ((u64) blk_rq_pos(B->request) << 9) / CLUSTER_SIZE;
+        lastB = (((u64) blk_rq_pos(B->request) << 9) +
+                    blk_rq_bytes(B->request) - 1) / CLUSTER_SIZE;
+
+        return (firstB <= lastA && firstA <= lastB);
+}
+
+bool scm_reserve_cluster(struct scm_request *scmrq)
+{
+        struct scm_blk_dev *bdev = scmrq->bdev;
+        struct scm_request *iter;
+
+        if (write_cluster_size == 0)
+                return true;
+
+        spin_lock(&bdev->lock);
+        list_for_each_entry(iter, &bdev->cluster_list, cluster.list) {
+                if (clusters_intersect(scmrq, iter) &&
+                    (rq_data_dir(scmrq->request) == WRITE ||
+                     rq_data_dir(iter->request) == WRITE)) {
+                        spin_unlock(&bdev->lock);
+                        return false;
+                }
+        }
+        list_add(&scmrq->cluster.list, &bdev->cluster_list);
+        spin_unlock(&bdev->lock);
+
+        return true;
+}
+
+void scm_release_cluster(struct scm_request *scmrq)
+{
+        struct scm_blk_dev *bdev = scmrq->bdev;
+        unsigned long flags;
+
+        if (write_cluster_size == 0)
+                return;
+
+        spin_lock_irqsave(&bdev->lock, flags);
+        list_del(&scmrq->cluster.list);
+        spin_unlock_irqrestore(&bdev->lock, flags);
+}
+
+void scm_blk_dev_cluster_setup(struct scm_blk_dev *bdev)
+{
+        INIT_LIST_HEAD(&bdev->cluster_list);
+        blk_queue_io_opt(bdev->rq, CLUSTER_SIZE);
+}
+
+static void scm_prepare_cluster_request(struct scm_request *scmrq)
+{
+        struct scm_blk_dev *bdev = scmrq->bdev;
+        struct scm_device *scmdev = bdev->gendisk->private_data;
+        struct request *req = scmrq->request;
+        struct aidaw *aidaw = scmrq->aidaw;
+        struct msb *msb = &scmrq->aob->msb[0];
+        struct req_iterator iter;
+        struct bio_vec *bv;
+        int i = 0;
+        u64 addr;
+
+        switch (scmrq->cluster.state) {
+        case CLUSTER_NONE:
+                scmrq->cluster.state = CLUSTER_READ;
+                /* fall through */
+        case CLUSTER_READ:
+                scmrq->aob->request.msb_count = 1;
+                msb->bs = MSB_BS_4K;
+                msb->oc = MSB_OC_READ;
+                msb->flags = MSB_FLAG_IDA;
+                msb->data_addr = (u64) aidaw;
+                msb->blk_count = write_cluster_size;
+
+                addr = scmdev->address + ((u64) blk_rq_pos(req) << 9);
+                msb->scm_addr = round_down(addr, CLUSTER_SIZE);
+
+                if (msb->scm_addr !=
+                    round_down(addr + (u64) blk_rq_bytes(req) - 1,
+                               CLUSTER_SIZE))
+                        msb->blk_count = 2 * write_cluster_size;
+
+                for (i = 0; i < msb->blk_count; i++) {
+                        aidaw->data_addr = (u64) scmrq->cluster.buf[i];
+                        aidaw++;
+                }
+
+                break;
+        case CLUSTER_WRITE:
+                msb->oc = MSB_OC_WRITE;
+
+                for (addr = msb->scm_addr;
+                     addr < scmdev->address + ((u64) blk_rq_pos(req) << 9);
+                     addr += PAGE_SIZE) {
+                        aidaw->data_addr = (u64) scmrq->cluster.buf[i];
+                        aidaw++;
+                        i++;
+                }
+                rq_for_each_segment(bv, req, iter) {
+                        aidaw->data_addr = (u64) page_address(bv->bv_page);
+                        aidaw++;
+                        i++;
+                }
+                for (; i < msb->blk_count; i++) {
+                        aidaw->data_addr = (u64) scmrq->cluster.buf[i];
+                        aidaw++;
+                }
+                break;
+        }
+}
+
+bool scm_need_cluster_request(struct scm_request *scmrq)
+{
+        if (rq_data_dir(scmrq->request) == READ)
+                return false;
+
+        return blk_rq_bytes(scmrq->request) < CLUSTER_SIZE;
+}
+
+/* Called with queue lock held. */
+void scm_initiate_cluster_request(struct scm_request *scmrq)
+{
+        scm_prepare_cluster_request(scmrq);
+        if (scm_start_aob(scmrq->aob))
+                scm_request_requeue(scmrq);
+}
+
+bool scm_test_cluster_request(struct scm_request *scmrq)
+{
+        return scmrq->cluster.state != CLUSTER_NONE;
+}
+
+void scm_cluster_request_irq(struct scm_request *scmrq)
+{
+        struct scm_blk_dev *bdev = scmrq->bdev;
+        unsigned long flags;
+
+        switch (scmrq->cluster.state) {
+        case CLUSTER_NONE:
+                BUG();
+                break;
+        case CLUSTER_READ:
+                if (scmrq->error) {
+                        scm_request_finish(scmrq);
+                        break;
+                }
+                scmrq->cluster.state = CLUSTER_WRITE;
+                spin_lock_irqsave(&bdev->rq_lock, flags);
+                scm_initiate_cluster_request(scmrq);
+                spin_unlock_irqrestore(&bdev->rq_lock, flags);
+                break;
+        case CLUSTER_WRITE:
+                scm_request_finish(scmrq);
+                break;
+        }
+}
+
+bool scm_cluster_size_valid(void)
+{
+        return write_cluster_size == 0 || write_cluster_size == 32 ||
+                write_cluster_size == 64 || write_cluster_size == 128;
+}
diff --git a/drivers/s390/block/scm_drv.c b/drivers/s390/block/scm_drv.c
new file mode 100644
index 000000000000..9fa0a908607b
--- /dev/null
+++ b/drivers/s390/block/scm_drv.c
@@ -0,0 +1,81 @@
+/*
+ * Device driver for s390 storage class memory.
+ *
+ * Copyright IBM Corp. 2012
+ * Author(s): Sebastian Ott <sebott@linux.vnet.ibm.com>
+ */
+
+#define KMSG_COMPONENT "scm_block"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <asm/eadm.h>
+#include "scm_blk.h"
+
+static void notify(struct scm_device *scmdev)
+{
+        pr_info("%lu: The capabilities of the SCM increment changed\n",
+                (unsigned long) scmdev->address);
+        SCM_LOG(2, "State changed");
+        SCM_LOG_STATE(2, scmdev);
+}
+
+static int scm_probe(struct scm_device *scmdev)
+{
+        struct scm_blk_dev *bdev;
+        int ret;
+
+        SCM_LOG(2, "probe");
+        SCM_LOG_STATE(2, scmdev);
+
+        if (scmdev->attrs.oper_state != OP_STATE_GOOD)
+                return -EINVAL;
+
+        bdev = kzalloc(sizeof(*bdev), GFP_KERNEL);
+        if (!bdev)
+                return -ENOMEM;
+
+        dev_set_drvdata(&scmdev->dev, bdev);
+        ret = scm_blk_dev_setup(bdev, scmdev);
+        if (ret) {
+                dev_set_drvdata(&scmdev->dev, NULL);
+                kfree(bdev);
+                goto out;
+        }
+
+out:
+        return ret;
+}
+
+static int scm_remove(struct scm_device *scmdev)
+{
+        struct scm_blk_dev *bdev = dev_get_drvdata(&scmdev->dev);
+
+        scm_blk_dev_cleanup(bdev);
+        dev_set_drvdata(&scmdev->dev, NULL);
+        kfree(bdev);
+
+        return 0;
+}
+
+static struct scm_driver scm_drv = {
+        .drv = {
+                .name = "scm_block",
+                .owner = THIS_MODULE,
+        },
+        .notify = notify,
+        .probe = scm_probe,
+        .remove = scm_remove,
+        .handler = scm_blk_irq,
+};
+
+int __init scm_drv_init(void)
+{
+        return scm_driver_register(&scm_drv);
+}
+
+void scm_drv_cleanup(void)
+{
+        scm_driver_unregister(&scm_drv);
+}
diff --git a/drivers/s390/char/con3270.c b/drivers/s390/char/con3270.c
index bb07577e8fd4..699fd3e363df 100644
--- a/drivers/s390/char/con3270.c
+++ b/drivers/s390/char/con3270.c
@@ -35,7 +35,6 @@ static struct raw3270_fn con3270_fn;
  */
 struct con3270 {
         struct raw3270_view view;
-        spinlock_t lock;
         struct list_head freemem;       /* list of free memory for strings. */
 
         /* Output stuff. */
diff --git a/drivers/s390/char/monreader.c b/drivers/s390/char/monreader.c
index 5b8b8592d311..f4ff515db251 100644
--- a/drivers/s390/char/monreader.c
+++ b/drivers/s390/char/monreader.c
@@ -571,8 +571,11 @@ static int __init mon_init(void)
         if (rc)
                 goto out_iucv;
         monreader_device = kzalloc(sizeof(struct device), GFP_KERNEL);
-        if (!monreader_device)
+        if (!monreader_device) {
+                rc = -ENOMEM;
                 goto out_driver;
+        }
+
         dev_set_name(monreader_device, "monreader-dev");
         monreader_device->bus = &iucv_bus;
         monreader_device->parent = iucv_root;
diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c
index 3fcc000efc53..4fa21f7e2308 100644
--- a/drivers/s390/char/sclp.c
+++ b/drivers/s390/char/sclp.c
@@ -334,7 +334,7 @@ sclp_dispatch_evbufs(struct sccb_header *sccb)
                         reg->receiver_fn(evbuf);
                         spin_lock_irqsave(&sclp_lock, flags);
                 } else if (reg == NULL)
-                        rc = -ENOSYS;
+                        rc = -EOPNOTSUPP;
         }
         spin_unlock_irqrestore(&sclp_lock, flags);
         return rc;
diff --git a/drivers/s390/char/sclp_rw.c b/drivers/s390/char/sclp_rw.c
index 4be63be73445..3b13d58fe87b 100644
--- a/drivers/s390/char/sclp_rw.c
+++ b/drivers/s390/char/sclp_rw.c
@@ -463,7 +463,7 @@ sclp_emit_buffer(struct sclp_buffer *buffer,
                 /* Use write priority message */
                 sccb->msg_buf.header.type = EVTYP_PMSGCMD;
         else
-                return -ENOSYS;
+                return -EOPNOTSUPP;
         buffer->request.command = SCLP_CMDW_WRITE_EVENT_DATA;
         buffer->request.status = SCLP_REQ_FILLED;
         buffer->request.callback = sclp_writedata_callback;
diff --git a/drivers/s390/char/tape.h b/drivers/s390/char/tape.h
index c06be6cc2fc3..ea664dd4f56d 100644
--- a/drivers/s390/char/tape.h
+++ b/drivers/s390/char/tape.h
@@ -15,7 +15,6 @@
 #include <asm/ccwdev.h>
 #include <asm/debug.h>
 #include <asm/idals.h>
-#include <linux/blkdev.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/mtio.h>
diff --git a/drivers/s390/char/tape_std.h b/drivers/s390/char/tape_std.h
index c5816ad9ed7d..8c760c036832 100644
--- a/drivers/s390/char/tape_std.h
+++ b/drivers/s390/char/tape_std.h
@@ -100,11 +100,7 @@ struct tape_request *tape_std_read_block(struct tape_device *, size_t);
 void tape_std_read_backward(struct tape_device *device,
                             struct tape_request *request);
 struct tape_request *tape_std_write_block(struct tape_device *, size_t);
-struct tape_request *tape_std_bread(struct tape_device *, struct request *);
-void tape_std_free_bread(struct tape_request *);
 void tape_std_check_locate(struct tape_device *, struct tape_request *);
-struct tape_request *tape_std_bwrite(struct request *,
-                                     struct tape_device *, int);
 
 /* Some non-mtop commands. */
 int tape_std_assign(struct tape_device *);
diff --git a/drivers/s390/char/vmlogrdr.c b/drivers/s390/char/vmlogrdr.c
index c131bc40f962..9b3a24e8d3a0 100644
--- a/drivers/s390/char/vmlogrdr.c
+++ b/drivers/s390/char/vmlogrdr.c
@@ -321,7 +321,7 @@ static int vmlogrdr_open (struct inode *inode, struct file *filp)
          * only allow for blocking reads to be open
          */
         if (filp->f_flags & O_NONBLOCK)
-                return -ENOSYS;
+                return -EOPNOTSUPP;
 
         /* Besure this device hasn't already been opened */
         spin_lock_bh(&logptr->priv_lock);
diff --git a/drivers/s390/cio/Makefile b/drivers/s390/cio/Makefile
index e1b700a19648..8c4a386e97f6 100644
--- a/drivers/s390/cio/Makefile
+++ b/drivers/s390/cio/Makefile
@@ -8,6 +8,8 @@ ccw_device-objs += device.o device_fsm.o device_ops.o
 ccw_device-objs += device_id.o device_pgid.o device_status.o
 obj-y += ccw_device.o cmf.o
 obj-$(CONFIG_CHSC_SCH) += chsc_sch.o
+obj-$(CONFIG_EADM_SCH) += eadm_sch.o
+obj-$(CONFIG_SCM_BUS) += scm.o
 obj-$(CONFIG_CCWGROUP) += ccwgroup.o
 
 qdio-objs := qdio_main.o qdio_thinint.o qdio_debug.o qdio_setup.o
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index cfe0c087fe5c..4d51a7c4eb8b 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -52,6 +52,11 @@ int chsc_error_from_response(int response)
                 return -EINVAL;
         case 0x0004:
                 return -EOPNOTSUPP;
+        case 0x000b:
+                return -EBUSY;
+        case 0x0100:
+        case 0x0102:
+                return -ENOMEM;
         default:
                 return -EIO;
         }
@@ -393,6 +398,20 @@ static void chsc_process_sei_chp_config(struct chsc_sei_area *sei_area)
         }
 }
 
+static void chsc_process_sei_scm_change(struct chsc_sei_area *sei_area)
+{
+        int ret;
+
+        CIO_CRW_EVENT(4, "chsc: scm change notification\n");
+        if (sei_area->rs != 7)
+                return;
+
+        ret = scm_update_information();
+        if (ret)
+                CIO_CRW_EVENT(0, "chsc: updating change notification"
+                              " failed (rc=%d).\n", ret);
+}
+
 static void chsc_process_sei(struct chsc_sei_area *sei_area)
 {
         /* Check if we might have lost some information. */
@@ -414,6 +433,9 @@ static void chsc_process_sei(struct chsc_sei_area *sei_area)
         case 8: /* channel-path-configuration notification */
                 chsc_process_sei_chp_config(sei_area);
                 break;
+        case 12: /* scm change notification */
+                chsc_process_sei_scm_change(sei_area);
+                break;
         default: /* other stuff */
                 CIO_CRW_EVENT(4, "chsc: unhandled sei content code %d\n",
                               sei_area->cc);
@@ -1047,3 +1069,33 @@ out:
         return rc;
 }
 EXPORT_SYMBOL_GPL(chsc_siosl);
+
+/**
+ * chsc_scm_info() - store SCM information (SSI)
+ * @scm_area: request and response block for SSI
+ * @token: continuation token
+ *
+ * Returns 0 on success.
+ */
+int chsc_scm_info(struct chsc_scm_info *scm_area, u64 token)
+{
+        int ccode, ret;
+
+        memset(scm_area, 0, sizeof(*scm_area));
+        scm_area->request.length = 0x0020;
+        scm_area->request.code = 0x004C;
+        scm_area->reqtok = token;
+
+        ccode = chsc(scm_area);
+        if (ccode > 0) {
+                ret = (ccode == 3) ? -ENODEV : -EBUSY;
+                goto out;
+        }
+        ret = chsc_error_from_response(scm_area->response.code);
+        if (ret != 0)
+                CIO_MSG_EVENT(2, "chsc: scm info failed (rc=%04x)\n",
+                              scm_area->response.code);
+out:
+        return ret;
+}
+EXPORT_SYMBOL_GPL(chsc_scm_info);
diff --git a/drivers/s390/cio/chsc.h b/drivers/s390/cio/chsc.h
index 3f15b2aaeaea..662dab4b93e6 100644
--- a/drivers/s390/cio/chsc.h
+++ b/drivers/s390/cio/chsc.h
@@ -3,6 +3,7 @@
 
 #include <linux/types.h>
 #include <linux/device.h>
+#include <asm/css_chars.h>
 #include <asm/chpid.h>
 #include <asm/chsc.h>
 #include <asm/schid.h>
@@ -118,4 +119,46 @@ int chsc_error_from_response(int response);
 
 int chsc_siosl(struct subchannel_id schid);
 
+/* Functions and definitions to query storage-class memory. */
+struct sale {
+        u64 sa;
+        u32 p:4;
+        u32 op_state:4;
+        u32 data_state:4;
+        u32 rank:4;
+        u32 r:1;
+        u32:7;
+        u32 rid:8;
+        u32:32;
+} __packed;
+
+struct chsc_scm_info {
+        struct chsc_header request;
+        u32:32;
+        u64 reqtok;
+        u32 reserved1[4];
+        struct chsc_header response;
+        u64:56;
+        u8 rq;
+        u32 mbc;
+        u64 msa;
+        u16 is;
+        u16 mmc;
+        u32 mci;
+        u64 nr_scm_ini;
+        u64 nr_scm_unini;
+        u32 reserved2[10];
+        u64 restok;
+        struct sale scmal[248];
+} __packed;
+
+int chsc_scm_info(struct chsc_scm_info *scm_area, u64 token);
+
+#ifdef CONFIG_SCM_BUS
+int scm_update_information(void);
+#else /* CONFIG_SCM_BUS */
+#define scm_update_information() 0
+#endif /* CONFIG_SCM_BUS */
+
+
 #endif
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index 33d1ef703593..8e927b9f285f 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -1029,7 +1029,7 @@ extern void do_reipl_asm(__u32 schid);
 /* Make sure all subchannels are quiet before we re-ipl an lpar. */
 void reipl_ccw_dev(struct ccw_dev_id *devid)
 {
-        struct subchannel_id schid;
+        struct subchannel_id uninitialized_var(schid);
 
         s390_reset_system(NULL, NULL);
         if (reipl_find_schid(devid, &schid) != 0)
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 21908e67bf67..b4d572f65f07 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -445,6 +445,7 @@ void css_sched_sch_todo(struct subchannel *sch, enum sch_todo todo)
                 put_device(&sch->dev);
         }
 }
+EXPORT_SYMBOL_GPL(css_sched_sch_todo);
 
 static void css_sch_todo(struct work_struct *work)
 {
diff --git a/drivers/s390/cio/eadm_sch.c b/drivers/s390/cio/eadm_sch.c
new file mode 100644
index 000000000000..6c9673400464
--- /dev/null
+++ b/drivers/s390/cio/eadm_sch.c
@@ -0,0 +1,401 @@
+/*
+ * Driver for s390 eadm subchannels
+ *
+ * Copyright IBM Corp. 2012
+ * Author(s): Sebastian Ott <sebott@linux.vnet.ibm.com>
+ */
+
+#include <linux/kernel_stat.h>
+#include <linux/workqueue.h>
+#include <linux/spinlock.h>
+#include <linux/device.h>
+#include <linux/module.h>
+#include <linux/timer.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+
+#include <asm/css_chars.h>
+#include <asm/debug.h>
+#include <asm/isc.h>
+#include <asm/cio.h>
+#include <asm/scsw.h>
+#include <asm/eadm.h>
+
+#include "eadm_sch.h"
+#include "ioasm.h"
+#include "cio.h"
+#include "css.h"
+#include "orb.h"
+
+MODULE_DESCRIPTION("driver for s390 eadm subchannels");
+MODULE_LICENSE("GPL");
+
+#define EADM_TIMEOUT (5 * HZ)
+static DEFINE_SPINLOCK(list_lock);
+static LIST_HEAD(eadm_list);
+
+static debug_info_t *eadm_debug;
+
+#define EADM_LOG(imp, txt) do {                                 \
+                debug_text_event(eadm_debug, imp, txt);         \
+        } while (0)
+
+static void EADM_LOG_HEX(int level, void *data, int length)
+{
+        if (level > eadm_debug->level)
+                return;
+        while (length > 0) {
+                debug_event(eadm_debug, level, data, length);
+                length -= eadm_debug->buf_size;
+                data += eadm_debug->buf_size;
+        }
+}
+
+static void orb_init(union orb *orb)
+{
+        memset(orb, 0, sizeof(union orb));
+        orb->eadm.compat1 = 1;
+        orb->eadm.compat2 = 1;
+        orb->eadm.fmt = 1;
+        orb->eadm.x = 1;
+}
+
+static int eadm_subchannel_start(struct subchannel *sch, struct aob *aob)
+{
+        union orb *orb = &get_eadm_private(sch)->orb;
+        int cc;
+
+        orb_init(orb);
+        orb->eadm.aob = (u32)__pa(aob);
+        orb->eadm.intparm = (u32)(addr_t)sch;
+        orb->eadm.key = PAGE_DEFAULT_KEY >> 4;
+
+        EADM_LOG(6, "start");
+        EADM_LOG_HEX(6, &sch->schid, sizeof(sch->schid));
+
+        cc = ssch(sch->schid, orb);
+        switch (cc) {
+        case 0:
+                sch->schib.scsw.eadm.actl |= SCSW_ACTL_START_PEND;
+                break;
+        case 1:         /* status pending */
+        case 2:         /* busy */
+                return -EBUSY;
+        case 3:         /* not operational */
+                return -ENODEV;
+        }
+        return 0;
+}
+
+static int eadm_subchannel_clear(struct subchannel *sch)
+{
+        int cc;
+
+        cc = csch(sch->schid);
+        if (cc)
+                return -ENODEV;
+
+        sch->schib.scsw.eadm.actl |= SCSW_ACTL_CLEAR_PEND;
+        return 0;
+}
+
+static void eadm_subchannel_timeout(unsigned long data)
+{
+        struct subchannel *sch = (struct subchannel *) data;
+
+        spin_lock_irq(sch->lock);
+        EADM_LOG(1, "timeout");
+        EADM_LOG_HEX(1, &sch->schid, sizeof(sch->schid));
+        if (eadm_subchannel_clear(sch))
+                EADM_LOG(0, "clear failed");
+        spin_unlock_irq(sch->lock);
+}
+
+static void eadm_subchannel_set_timeout(struct subchannel *sch, int expires)
+{
+        struct eadm_private *private = get_eadm_private(sch);
+
+        if (expires == 0) {
+                del_timer(&private->timer);
+                return;
+        }
+        if (timer_pending(&private->timer)) {
+                if (mod_timer(&private->timer, jiffies + expires))
+                        return;
+        }
+        private->timer.function = eadm_subchannel_timeout;
+        private->timer.data = (unsigned long) sch;
+        private->timer.expires = jiffies + expires;
+        add_timer(&private->timer);
+}
+
+static void eadm_subchannel_irq(struct subchannel *sch)
+{
+        struct eadm_private *private = get_eadm_private(sch);
+        struct eadm_scsw *scsw = &sch->schib.scsw.eadm;
+        struct irb *irb = (struct irb *)&S390_lowcore.irb;
+        int error = 0;
+
+        EADM_LOG(6, "irq");
+        EADM_LOG_HEX(6, irb, sizeof(*irb));
+
+        kstat_cpu(smp_processor_id()).irqs[IOINT_ADM]++;
+
+        if ((scsw->stctl & (SCSW_STCTL_ALERT_STATUS | SCSW_STCTL_STATUS_PEND))
+            && scsw->eswf == 1 && irb->esw.eadm.erw.r)
+                error = -EIO;
+
+        if (scsw->fctl & SCSW_FCTL_CLEAR_FUNC)
+                error = -ETIMEDOUT;
+
+        eadm_subchannel_set_timeout(sch, 0);
+
+        if (private->state != EADM_BUSY) {
+                EADM_LOG(1, "irq unsol");
+                EADM_LOG_HEX(1, irb, sizeof(*irb));
+                private->state = EADM_NOT_OPER;
+                css_sched_sch_todo(sch, SCH_TODO_EVAL);
+                return;
+        }
+        scm_irq_handler((struct aob *)(unsigned long)scsw->aob, error);
+        private->state = EADM_IDLE;
+}
+
+static struct subchannel *eadm_get_idle_sch(void)
+{
+        struct eadm_private *private;
+        struct subchannel *sch;
+        unsigned long flags;
+
+        spin_lock_irqsave(&list_lock, flags);
+        list_for_each_entry(private, &eadm_list, head) {
+                sch = private->sch;
+                spin_lock(sch->lock);
+                if (private->state == EADM_IDLE) {
+                        private->state = EADM_BUSY;
+                        list_move_tail(&private->head, &eadm_list);
+                        spin_unlock(sch->lock);
+                        spin_unlock_irqrestore(&list_lock, flags);
+
+                        return sch;
+                }
+                spin_unlock(sch->lock);
+        }
+        spin_unlock_irqrestore(&list_lock, flags);
+
+        return NULL;
+}
+
+static int eadm_start_aob(struct aob *aob)
+{
+        struct eadm_private *private;
+        struct subchannel *sch;
+        unsigned long flags;
+        int ret;
+
+        sch = eadm_get_idle_sch();
+        if (!sch)
+                return -EBUSY;
+
+        spin_lock_irqsave(sch->lock, flags);
+        eadm_subchannel_set_timeout(sch, EADM_TIMEOUT);
+        ret = eadm_subchannel_start(sch, aob);
+        if (!ret)
+                goto out_unlock;
+
+        /* Handle start subchannel failure. */
+        eadm_subchannel_set_timeout(sch, 0);
+        private = get_eadm_private(sch);
+        private->state = EADM_NOT_OPER;
+        css_sched_sch_todo(sch, SCH_TODO_EVAL);
+
+out_unlock:
+        spin_unlock_irqrestore(sch->lock, flags);
+
+        return ret;
+}
+
+static int eadm_subchannel_probe(struct subchannel *sch)
+{
+        struct eadm_private *private;
+        int ret;
+
+        private = kzalloc(sizeof(*private), GFP_KERNEL | GFP_DMA);
+        if (!private)
+                return -ENOMEM;
+
+        INIT_LIST_HEAD(&private->head);
+        init_timer(&private->timer);
+
+        spin_lock_irq(sch->lock);
+        set_eadm_private(sch, private);
+        private->state = EADM_IDLE;
+        private->sch = sch;
+        sch->isc = EADM_SCH_ISC;
+        ret = cio_enable_subchannel(sch, (u32)(unsigned long)sch);
+        if (ret) {
+                set_eadm_private(sch, NULL);
+                spin_unlock_irq(sch->lock);
+                kfree(private);
+                goto out;
+        }
+        spin_unlock_irq(sch->lock);
+
+        spin_lock_irq(&list_lock);
+        list_add(&private->head, &eadm_list);
+        spin_unlock_irq(&list_lock);
+
+        if (dev_get_uevent_suppress(&sch->dev)) {
+                dev_set_uevent_suppress(&sch->dev, 0);
+                kobject_uevent(&sch->dev.kobj, KOBJ_ADD);
+        }
+out:
+        return ret;
+}
+
+static void eadm_quiesce(struct subchannel *sch)
+{
+        int ret;
+
+        do {
+                spin_lock_irq(sch->lock);
+                ret = cio_disable_subchannel(sch);
+                spin_unlock_irq(sch->lock);
+        } while (ret == -EBUSY);
+}
+
+static int eadm_subchannel_remove(struct subchannel *sch)
+{
+        struct eadm_private *private = get_eadm_private(sch);
+
+        spin_lock_irq(&list_lock);
+        list_del(&private->head);
+        spin_unlock_irq(&list_lock);
+
+        eadm_quiesce(sch);
+
+        spin_lock_irq(sch->lock);
+        set_eadm_private(sch, NULL);
+        spin_unlock_irq(sch->lock);
+
+        kfree(private);
+
+        return 0;
+}
+
+static void eadm_subchannel_shutdown(struct subchannel *sch)
+{
+        eadm_quiesce(sch);
+}
+
+static int eadm_subchannel_freeze(struct subchannel *sch)
+{
+        return cio_disable_subchannel(sch);
+}
+
+static int eadm_subchannel_restore(struct subchannel *sch)
+{
+        return cio_enable_subchannel(sch, (u32)(unsigned long)sch);
+}
+
+/**
+ * eadm_subchannel_sch_event - process subchannel event
+ * @sch: subchannel
+ * @process: non-zero if function is called in process context
+ *
+ * An unspecified event occurred for this subchannel. Adjust data according
+ * to the current operational state of the subchannel. Return zero when the
+ * event has been handled sufficiently or -EAGAIN when this function should
+ * be called again in process context.
+ */
+static int eadm_subchannel_sch_event(struct subchannel *sch, int process)
+{
+        struct eadm_private *private;
+        unsigned long flags;
+        int ret = 0;
+
+        spin_lock_irqsave(sch->lock, flags);
+        if (!device_is_registered(&sch->dev))
+                goto out_unlock;
+
+        if (work_pending(&sch->todo_work))
+                goto out_unlock;
+
+        if (cio_update_schib(sch)) {
+                css_sched_sch_todo(sch, SCH_TODO_UNREG);
+                goto out_unlock;
+        }
+        private = get_eadm_private(sch);
+        if (private->state == EADM_NOT_OPER)
+                private->state = EADM_IDLE;
+
+out_unlock:
+        spin_unlock_irqrestore(sch->lock, flags);
+
+        return ret;
+}
+
+static struct css_device_id eadm_subchannel_ids[] = {
+        { .match_flags = 0x1, .type = SUBCHANNEL_TYPE_ADM, },
+        { /* end of list */ },
+};
+MODULE_DEVICE_TABLE(css, eadm_subchannel_ids);
+
+static struct css_driver eadm_subchannel_driver = {
+        .drv = {
+                .name = "eadm_subchannel",
+                .owner = THIS_MODULE,
+        },
+        .subchannel_type = eadm_subchannel_ids,
+        .irq = eadm_subchannel_irq,
+        .probe = eadm_subchannel_probe,
+        .remove = eadm_subchannel_remove,
+        .shutdown = eadm_subchannel_shutdown,
+        .sch_event = eadm_subchannel_sch_event,
+        .freeze = eadm_subchannel_freeze,
+        .thaw = eadm_subchannel_restore,
+        .restore = eadm_subchannel_restore,
+};
+
+static struct eadm_ops eadm_ops = {
+        .eadm_start = eadm_start_aob,
+        .owner = THIS_MODULE,
+};
+
+static int __init eadm_sch_init(void)
+{
+        int ret;
+
+        if (!css_general_characteristics.eadm)
+                return -ENXIO;
+
+        eadm_debug = debug_register("eadm_log", 16, 1, 16);
+        if (!eadm_debug)
+                return -ENOMEM;
+
+        debug_register_view(eadm_debug, &debug_hex_ascii_view);
+        debug_set_level(eadm_debug, 2);
+
+        isc_register(EADM_SCH_ISC);
+        ret = css_driver_register(&eadm_subchannel_driver);
+        if (ret)
+                goto cleanup;
+
+        register_eadm_ops(&eadm_ops);
+        return ret;
+
+cleanup:
+        isc_unregister(EADM_SCH_ISC);
+        debug_unregister(eadm_debug);
+        return ret;
+}
+
+static void __exit eadm_sch_exit(void)
+{
+        unregister_eadm_ops(&eadm_ops);
+        css_driver_unregister(&eadm_subchannel_driver);
+        isc_unregister(EADM_SCH_ISC);
+        debug_unregister(eadm_debug);
+}
+module_init(eadm_sch_init);
+module_exit(eadm_sch_exit);
diff --git a/drivers/s390/cio/eadm_sch.h b/drivers/s390/cio/eadm_sch.h
new file mode 100644
index 000000000000..2779be093982
--- /dev/null
+++ b/drivers/s390/cio/eadm_sch.h
@@ -0,0 +1,20 @@
+#ifndef EADM_SCH_H
+#define EADM_SCH_H
+
+#include <linux/device.h>
+#include <linux/timer.h>
+#include <linux/list.h>
+#include "orb.h"
+
+struct eadm_private {
+        union orb orb;
+        enum {EADM_IDLE, EADM_BUSY, EADM_NOT_OPER} state;
+        struct timer_list timer;
+        struct list_head head;
+        struct subchannel *sch;
+} __aligned(8);
+
+#define get_eadm_private(n) ((struct eadm_private *)dev_get_drvdata(&n->dev))
+#define set_eadm_private(n, p) (dev_set_drvdata(&n->dev, p))
+
+#endif
diff --git a/drivers/s390/cio/orb.h b/drivers/s390/cio/orb.h
index 45a9865c2b36..7a640530e7f5 100644
--- a/drivers/s390/cio/orb.h
+++ b/drivers/s390/cio/orb.h
@@ -59,9 +59,33 @@ struct tm_orb {
         u32:32;
 }  __packed __aligned(4);
 
+/*
+ * eadm operation request block
+ */
+struct eadm_orb {
+        u32 intparm;
+        u32 key:4;
+        u32:4;
+        u32 compat1:1;
+        u32 compat2:1;
+        u32:21;
+        u32 x:1;
+        u32 aob;
+        u32 css_prio:8;
+        u32:8;
+        u32 scm_prio:8;
+        u32:8;
+        u32:29;
+        u32 fmt:3;
+        u32:32;
+        u32:32;
+        u32:32;
+}  __packed __aligned(4);
+
 union orb {
         struct cmd_orb cmd;
         struct tm_orb tm;
+        struct eadm_orb eadm;
 }  __packed __aligned(4);
 
 #endif /* S390_ORB_H */
diff --git a/drivers/s390/cio/qdio_debug.h b/drivers/s390/cio/qdio_debug.h
index e1f646800ddb..7f8b973da298 100644
--- a/drivers/s390/cio/qdio_debug.h
+++ b/drivers/s390/cio/qdio_debug.h
@@ -37,10 +37,14 @@ static inline int qdio_dbf_passes(debug_info_t *dbf_grp, int level)
                 debug_text_event(qdio_dbf_setup, DBF_ERR, debug_buffer); \
         } while (0)
 
-#define DBF_HEX(addr, len) \
-        do { \
-                debug_event(qdio_dbf_setup, DBF_ERR, (void*)(addr), len); \
-        } while (0)
+static inline void DBF_HEX(void *addr, int len)
+{
+        while (len > 0) {
+                debug_event(qdio_dbf_setup, DBF_ERR, addr, len);
+                len -= qdio_dbf_setup->buf_size;
+                addr += qdio_dbf_setup->buf_size;
+        }
+}
 
 #define DBF_ERROR(text...) \
         do { \
@@ -49,11 +53,14 @@ static inline int qdio_dbf_passes(debug_info_t *dbf_grp, int level)
                 debug_text_event(qdio_dbf_error, DBF_ERR, debug_buffer); \
         } while (0)
 
-#define DBF_ERROR_HEX(addr, len) \
-        do { \
-                debug_event(qdio_dbf_error, DBF_ERR, (void*)(addr), len); \
-        } while (0)
-
+static inline void DBF_ERROR_HEX(void *addr, int len)
+{
+        while (len > 0) {
+                debug_event(qdio_dbf_error, DBF_ERR, addr, len);
+                len -= qdio_dbf_error->buf_size;
+                addr += qdio_dbf_error->buf_size;
+        }
+}
 
 #define DBF_DEV_EVENT(level, device, text...) \
         do { \
@@ -64,10 +71,15 @@ static inline int qdio_dbf_passes(debug_info_t *dbf_grp, int level)
                 } \
         } while (0)
 
-#define DBF_DEV_HEX(level, device, addr, len) \
-        do { \
-                debug_event(device->debug_area, level, (void*)(addr), len); \
-        } while (0)
+static inline void DBF_DEV_HEX(struct qdio_irq *dev, void *addr,
+                               int len, int level)
+{
+        while (len > 0) {
+                debug_event(dev->debug_area, level, addr, len);
+                len -= dev->debug_area->buf_size;
+                addr += dev->debug_area->buf_size;
+        }
+}
 
 void qdio_allocate_dbf(struct qdio_initialize *init_data,
                        struct qdio_irq *irq_ptr);
diff --git a/drivers/s390/cio/scm.c b/drivers/s390/cio/scm.c
new file mode 100644
index 000000000000..bcf20f3aa51b
--- /dev/null
+++ b/drivers/s390/cio/scm.c
@@ -0,0 +1,317 @@
+/*
+ * Recognize and maintain s390 storage class memory.
+ *
+ * Copyright IBM Corp. 2012
+ * Author(s): Sebastian Ott <sebott@linux.vnet.ibm.com>
+ */
+
+#include <linux/device.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/init.h>
+#include <linux/err.h>
+#include <asm/eadm.h>
+#include "chsc.h"
+
+static struct device *scm_root;
+static struct eadm_ops *eadm_ops;
+static DEFINE_MUTEX(eadm_ops_mutex);
+
+#define to_scm_dev(n) container_of(n, struct scm_device, dev)
+#define to_scm_drv(d) container_of(d, struct scm_driver, drv)
+
+static int scmdev_probe(struct device *dev)
+{
+        struct scm_device *scmdev = to_scm_dev(dev);
+        struct scm_driver *scmdrv = to_scm_drv(dev->driver);
+
+        return scmdrv->probe ? scmdrv->probe(scmdev) : -ENODEV;
+}
+
+static int scmdev_remove(struct device *dev)
+{
+        struct scm_device *scmdev = to_scm_dev(dev);
+        struct scm_driver *scmdrv = to_scm_drv(dev->driver);
+
+        return scmdrv->remove ? scmdrv->remove(scmdev) : -ENODEV;
+}
+
+static int scmdev_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+        return add_uevent_var(env, "MODALIAS=scm:scmdev");
+}
+
+static struct bus_type scm_bus_type = {
+        .name  = "scm",
+        .probe = scmdev_probe,
+        .remove = scmdev_remove,
+        .uevent = scmdev_uevent,
+};
+
+/**
+ * scm_driver_register() - register a scm driver
+ * @scmdrv: driver to be registered
+ */
+int scm_driver_register(struct scm_driver *scmdrv)
+{
+        struct device_driver *drv = &scmdrv->drv;
+
+        drv->bus = &scm_bus_type;
+
+        return driver_register(drv);
+}
+EXPORT_SYMBOL_GPL(scm_driver_register);
+
+/**
+ * scm_driver_unregister() - deregister a scm driver
+ * @scmdrv: driver to be deregistered
+ */
+void scm_driver_unregister(struct scm_driver *scmdrv)
+{
+        driver_unregister(&scmdrv->drv);
+}
+EXPORT_SYMBOL_GPL(scm_driver_unregister);
+
+int scm_get_ref(void)
+{
+        int ret = 0;
+
+        mutex_lock(&eadm_ops_mutex);
+        if (!eadm_ops || !try_module_get(eadm_ops->owner))
+                ret = -ENOENT;
+        mutex_unlock(&eadm_ops_mutex);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(scm_get_ref);
+
+void scm_put_ref(void)
+{
+        mutex_lock(&eadm_ops_mutex);
+        module_put(eadm_ops->owner);
+        mutex_unlock(&eadm_ops_mutex);
+}
+EXPORT_SYMBOL_GPL(scm_put_ref);
+
+void register_eadm_ops(struct eadm_ops *ops)
+{
+        mutex_lock(&eadm_ops_mutex);
+        eadm_ops = ops;
+        mutex_unlock(&eadm_ops_mutex);
+}
+EXPORT_SYMBOL_GPL(register_eadm_ops);
+
+void unregister_eadm_ops(struct eadm_ops *ops)
+{
+        mutex_lock(&eadm_ops_mutex);
+        eadm_ops = NULL;
+        mutex_unlock(&eadm_ops_mutex);
+}
+EXPORT_SYMBOL_GPL(unregister_eadm_ops);
+
+int scm_start_aob(struct aob *aob)
+{
+        return eadm_ops->eadm_start(aob);
+}
+EXPORT_SYMBOL_GPL(scm_start_aob);
+
+void scm_irq_handler(struct aob *aob, int error)
+{
+        struct aob_rq_header *aobrq = (void *) aob->request.data;
+        struct scm_device *scmdev = aobrq->scmdev;
+        struct scm_driver *scmdrv = to_scm_drv(scmdev->dev.driver);
+
+        scmdrv->handler(scmdev, aobrq->data, error);
+}
+EXPORT_SYMBOL_GPL(scm_irq_handler);
+
+#define scm_attr(name)                                                  \
+static ssize_t show_##name(struct device *dev,                          \
+               struct device_attribute *attr, char *buf)                \
+{                                                                       \
+        struct scm_device *scmdev = to_scm_dev(dev);                    \
+        int ret;                                                        \
+                                                                        \
+        device_lock(dev);                                               \
+        ret = sprintf(buf, "%u\n", scmdev->attrs.name);                 \
+        device_unlock(dev);                                             \
+                                                                        \
+        return ret;                                                     \
+}                                                                       \
+static DEVICE_ATTR(name, S_IRUGO, show_##name, NULL);
+
+scm_attr(persistence);
+scm_attr(oper_state);
+scm_attr(data_state);
+scm_attr(rank);
+scm_attr(release);
+scm_attr(res_id);
+
+static struct attribute *scmdev_attrs[] = {
+        &dev_attr_persistence.attr,
+        &dev_attr_oper_state.attr,
+        &dev_attr_data_state.attr,
+        &dev_attr_rank.attr,
+        &dev_attr_release.attr,
+        &dev_attr_res_id.attr,
+        NULL,
+};
+
+static struct attribute_group scmdev_attr_group = {
+        .attrs = scmdev_attrs,
+};
+
+static const struct attribute_group *scmdev_attr_groups[] = {
+        &scmdev_attr_group,
+        NULL,
+};
+
+static void scmdev_release(struct device *dev)
+{
+        struct scm_device *scmdev = to_scm_dev(dev);
+
+        kfree(scmdev);
+}
+
+static void scmdev_setup(struct scm_device *scmdev, struct sale *sale,
+                         unsigned int size, unsigned int max_blk_count)
+{
+        dev_set_name(&scmdev->dev, "%016llx", (unsigned long long) sale->sa);
+        scmdev->nr_max_block = max_blk_count;
+        scmdev->address = sale->sa;
+        scmdev->size = 1UL << size;
+        scmdev->attrs.rank = sale->rank;
+        scmdev->attrs.persistence = sale->p;
+        scmdev->attrs.oper_state = sale->op_state;
+        scmdev->attrs.data_state = sale->data_state;
+        scmdev->attrs.rank = sale->rank;
+        scmdev->attrs.release = sale->r;
+        scmdev->attrs.res_id = sale->rid;
+        scmdev->dev.parent = scm_root;
+        scmdev->dev.bus = &scm_bus_type;
+        scmdev->dev.release = scmdev_release;
+        scmdev->dev.groups = scmdev_attr_groups;
+}
+
+/*
+ * Check for state-changes, notify the driver and userspace.
+ */
+static void scmdev_update(struct scm_device *scmdev, struct sale *sale)
+{
+        struct scm_driver *scmdrv;
+        bool changed;
+
+        device_lock(&scmdev->dev);
+        changed = scmdev->attrs.rank != sale->rank ||
+                  scmdev->attrs.oper_state != sale->op_state;
+        scmdev->attrs.rank = sale->rank;
+        scmdev->attrs.oper_state = sale->op_state;
+        if (!scmdev->dev.driver)
+                goto out;
+        scmdrv = to_scm_drv(scmdev->dev.driver);
+        if (changed && scmdrv->notify)
+                scmdrv->notify(scmdev);
+out:
+        device_unlock(&scmdev->dev);
+        if (changed)
+                kobject_uevent(&scmdev->dev.kobj, KOBJ_CHANGE);
+}
+
+static int check_address(struct device *dev, void *data)
+{
+        struct scm_device *scmdev = to_scm_dev(dev);
+        struct sale *sale = data;
+
+        return scmdev->address == sale->sa;
+}
+
+static struct scm_device *scmdev_find(struct sale *sale)
+{
+        struct device *dev;
+
+        dev = bus_find_device(&scm_bus_type, NULL, sale, check_address);
+
+        return dev ? to_scm_dev(dev) : NULL;
+}
+
+static int scm_add(struct chsc_scm_info *scm_info, size_t num)
+{
+        struct sale *sale, *scmal = scm_info->scmal;
+        struct scm_device *scmdev;
+        int ret;
+
+        for (sale = scmal; sale < scmal + num; sale++) {
+                scmdev = scmdev_find(sale);
+                if (scmdev) {
+                        scmdev_update(scmdev, sale);
+                        /* Release reference from scm_find(). */
+                        put_device(&scmdev->dev);
+                        continue;
+                }
+                scmdev = kzalloc(sizeof(*scmdev), GFP_KERNEL);
+                if (!scmdev)
+                        return -ENODEV;
+                scmdev_setup(scmdev, sale, scm_info->is, scm_info->mbc);
+                ret = device_register(&scmdev->dev);
+                if (ret) {
+                        /* Release reference from device_initialize(). */
+                        put_device(&scmdev->dev);
+                        return ret;
+                }
+        }
+
+        return 0;
+}
+
+int scm_update_information(void)
+{
+        struct chsc_scm_info *scm_info;
+        u64 token = 0;
+        size_t num;
+        int ret;
+
+        scm_info = (void *)__get_free_page(GFP_KERNEL | GFP_DMA);
+        if (!scm_info)
+                return -ENOMEM;
+
+        do {
+                ret = chsc_scm_info(scm_info, token);
+                if (ret)
+                        break;
+
+                num = (scm_info->response.length -
+                       (offsetof(struct chsc_scm_info, scmal) -
+                        offsetof(struct chsc_scm_info, response))
+                      ) / sizeof(struct sale);
+
+                ret = scm_add(scm_info, num);
+                if (ret)
+                        break;
+
+                token = scm_info->restok;
+        } while (token);
+
+        free_page((unsigned long)scm_info);
+
+        return ret;
+}
+
+static int __init scm_init(void)
+{
+        int ret;
+
+        ret = bus_register(&scm_bus_type);
+        if (ret)
+                return ret;
+
+        scm_root = root_device_register("scm");
+        if (IS_ERR(scm_root)) {
+                bus_unregister(&scm_bus_type);
+                return PTR_ERR(scm_root);
+        }
+
+        scm_update_information();
+        return 0;
+}
+subsys_initcall_sync(scm_init);
diff --git a/drivers/s390/crypto/Makefile b/drivers/s390/crypto/Makefile
index af3c7f16ea88..771faf7094d6 100644
--- a/drivers/s390/crypto/Makefile
+++ b/drivers/s390/crypto/Makefile
@@ -4,4 +4,5 @@
 
 ap-objs := ap_bus.o
 obj-$(CONFIG_ZCRYPT) += ap.o zcrypt_api.o zcrypt_pcicc.o zcrypt_pcixcc.o
-obj-$(CONFIG_ZCRYPT) += zcrypt_pcica.o zcrypt_cex2a.o
+obj-$(CONFIG_ZCRYPT) += zcrypt_pcica.o zcrypt_cex2a.o zcrypt_cex4.o
+obj-$(CONFIG_ZCRYPT) += zcrypt_msgtype6.o zcrypt_msgtype50.o
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index ae258a4b4e5e..7b865a7300e6 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -1,5 +1,5 @@
 /*
- * Copyright IBM Corp. 2006
+ * Copyright IBM Corp. 2006, 2012
  * Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
  *            Martin Schwidefsky <schwidefsky@de.ibm.com>
  *            Ralph Wuerthner <rwuerthn@de.ibm.com>
@@ -62,13 +62,14 @@ static void ap_interrupt_handler(void *unused1, void *unused2);
 static void ap_reset(struct ap_device *ap_dev);
 static void ap_config_timeout(unsigned long ptr);
 static int ap_select_domain(void);
+static void ap_query_configuration(void);
 
 /*
  * Module description.
  */
 MODULE_AUTHOR("IBM Corporation");
-MODULE_DESCRIPTION("Adjunct Processor Bus driver, "
-                   "Copyright IBM Corp. 2006");
+MODULE_DESCRIPTION("Adjunct Processor Bus driver, " \
+                   "Copyright IBM Corp. 2006, 2012");
 MODULE_LICENSE("GPL");
 
 /*
@@ -84,6 +85,7 @@ module_param_named(poll_thread, ap_thread_flag, int, 0000);
 MODULE_PARM_DESC(poll_thread, "Turn on/off poll thread, default is 0 (off).");
 
 static struct device *ap_root_device = NULL;
+static struct ap_config_info *ap_configuration;
 static DEFINE_SPINLOCK(ap_device_list_lock);
 static LIST_HEAD(ap_device_list);
 
@@ -158,6 +160,19 @@ static int ap_interrupts_available(void)
 }
 
 /**
+ * ap_configuration_available(): Test if AP configuration
+ * information is available.
+ *
+ * Returns 1 if AP configuration information is available.
+ */
+#ifdef CONFIG_64BIT
+static int ap_configuration_available(void)
+{
+        return test_facility(2) && test_facility(12);
+}
+#endif
+
+/**
  * ap_test_queue(): Test adjunct processor queue.
  * @qid: The AP queue number
  * @queue_depth: Pointer to queue depth value
@@ -242,6 +257,26 @@ __ap_query_functions(ap_qid_t qid, unsigned int *functions)
 }
 #endif
 
+#ifdef CONFIG_64BIT
+static inline int __ap_query_configuration(struct ap_config_info *config)
+{
+        register unsigned long reg0 asm ("0") = 0x04000000UL;
+        register unsigned long reg1 asm ("1") = -EINVAL;
+        register unsigned char *reg2 asm ("2") = (unsigned char *)config;
+
+        asm volatile(
+                ".long 0xb2af0000\n"            /* PQAP(QCI) */
+                "0: la    %1,0\n"
+                "1:\n"
+                EX_TABLE(0b, 1b)
+                : "+d" (reg0), "+d" (reg1), "+d" (reg2)
+                :
+                : "cc");
+
+        return reg1;
+}
+#endif
+
 /**
  * ap_query_functions(): Query supported functions.
  * @qid: The AP queue number
@@ -292,25 +327,6 @@ static int ap_query_functions(ap_qid_t qid, unsigned int *functions)
 }
 
 /**
- * ap_4096_commands_availablen(): Check for availability of 4096 bit RSA
- * support.
- * @qid: The AP queue number
- *
- * Returns 1 if 4096 bit RSA keys are support fo the AP, returns 0 if not.
- */
-int ap_4096_commands_available(ap_qid_t qid)
-{
-        unsigned int functions;
-
-        if (ap_query_functions(qid, &functions))
-                return 0;
-
-        return test_ap_facility(functions, 1) &&
-               test_ap_facility(functions, 2);
-}
-EXPORT_SYMBOL(ap_4096_commands_available);
-
-/**
  * ap_queue_enable_interruption(): Enable interruption on an AP.
  * @qid: The AP queue number
  * @ind: the notification indicator byte
@@ -657,6 +673,34 @@ static ssize_t ap_request_count_show(struct device *dev,
 
 static DEVICE_ATTR(request_count, 0444, ap_request_count_show, NULL);
 
+static ssize_t ap_requestq_count_show(struct device *dev,
+                                      struct device_attribute *attr, char *buf)
+{
+        struct ap_device *ap_dev = to_ap_dev(dev);
+        int rc;
+
+        spin_lock_bh(&ap_dev->lock);
+        rc = snprintf(buf, PAGE_SIZE, "%d\n", ap_dev->requestq_count);
+        spin_unlock_bh(&ap_dev->lock);
+        return rc;
+}
+
+static DEVICE_ATTR(requestq_count, 0444, ap_requestq_count_show, NULL);
+
+static ssize_t ap_pendingq_count_show(struct device *dev,
+                                      struct device_attribute *attr, char *buf)
+{
+        struct ap_device *ap_dev = to_ap_dev(dev);
+        int rc;
+
+        spin_lock_bh(&ap_dev->lock);
+        rc = snprintf(buf, PAGE_SIZE, "%d\n", ap_dev->pendingq_count);
+        spin_unlock_bh(&ap_dev->lock);
+        return rc;
+}
+
+static DEVICE_ATTR(pendingq_count, 0444, ap_pendingq_count_show, NULL);
+
 static ssize_t ap_modalias_show(struct device *dev,
                                 struct device_attribute *attr, char *buf)
 {
@@ -665,11 +709,23 @@ static ssize_t ap_modalias_show(struct device *dev,
 
 static DEVICE_ATTR(modalias, 0444, ap_modalias_show, NULL);
 
+static ssize_t ap_functions_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        struct ap_device *ap_dev = to_ap_dev(dev);
+        return snprintf(buf, PAGE_SIZE, "0x%08X\n", ap_dev->functions);
+}
+
+static DEVICE_ATTR(ap_functions, 0444, ap_functions_show, NULL);
+
 static struct attribute *ap_dev_attrs[] = {
         &dev_attr_hwtype.attr,
         &dev_attr_depth.attr,
         &dev_attr_request_count.attr,
+        &dev_attr_requestq_count.attr,
+        &dev_attr_pendingq_count.attr,
         &dev_attr_modalias.attr,
+        &dev_attr_ap_functions.attr,
         NULL
 };
 static struct attribute_group ap_dev_attr_group = {
@@ -772,6 +828,7 @@ static int ap_bus_resume(struct device *dev)
                 ap_suspend_flag = 0;
                 if (!ap_interrupts_available())
                         ap_interrupt_indicator = NULL;
+                ap_query_configuration();
                 if (!user_set_domain) {
                         ap_domain_index = -1;
                         ap_select_domain();
@@ -895,6 +952,20 @@ void ap_driver_unregister(struct ap_driver *ap_drv)
 }
 EXPORT_SYMBOL(ap_driver_unregister);
 
+void ap_bus_force_rescan(void)
+{
+        /* Delete the AP bus rescan timer. */
+        del_timer(&ap_config_timer);
+
+        /* processing a synchonuous bus rescan */
+        ap_scan_bus(NULL);
+
+        /* Setup the AP bus rescan timer again. */
+        ap_config_timer.expires = jiffies + ap_config_time * HZ;
+        add_timer(&ap_config_timer);
+}
+EXPORT_SYMBOL(ap_bus_force_rescan);
+
 /*
  * AP bus attributes.
  */
@@ -997,6 +1068,65 @@ static struct bus_attribute *const ap_bus_attrs[] = {
         NULL,
 };
 
+static inline int ap_test_config(unsigned int *field, unsigned int nr)
+{
+        if (nr > 0xFFu)
+                return 0;
+        return ap_test_bit((field + (nr >> 5)), (nr & 0x1f));
+}
+
+/*
+ * ap_test_config_card_id(): Test, whether an AP card ID is configured.
+ * @id AP card ID
+ *
+ * Returns 0 if the card is not configured
+ *         1 if the card is configured or
+ *           if the configuration information is not available
+ */
+static inline int ap_test_config_card_id(unsigned int id)
+{
+        if (!ap_configuration)
+                return 1;
+        return ap_test_config(ap_configuration->apm, id);
+}
+
+/*
+ * ap_test_config_domain(): Test, whether an AP usage domain is configured.
+ * @domain AP usage domain ID
+ *
+ * Returns 0 if the usage domain is not configured
+ *         1 if the usage domain is configured or
+ *           if the configuration information is not available
+ */
+static inline int ap_test_config_domain(unsigned int domain)
+{
+        if (!ap_configuration)
+                return 1;
+        return ap_test_config(ap_configuration->aqm, domain);
+}
+
+/**
+ * ap_query_configuration(): Query AP configuration information.
+ *
+ * Query information of installed cards and configured domains from AP.
+ */
+static void ap_query_configuration(void)
+{
+#ifdef CONFIG_64BIT
+        if (ap_configuration_available()) {
+                if (!ap_configuration)
+                        ap_configuration =
+                                kzalloc(sizeof(struct ap_config_info),
+                                        GFP_KERNEL);
+                if (ap_configuration)
+                        __ap_query_configuration(ap_configuration);
+        } else
+                ap_configuration = NULL;
+#else
+        ap_configuration = NULL;
+#endif
+}
+
 /**
  * ap_select_domain(): Select an AP domain.
  *
@@ -1005,6 +1135,7 @@ static struct bus_attribute *const ap_bus_attrs[] = {
 static int ap_select_domain(void)
 {
         int queue_depth, device_type, count, max_count, best_domain;
+        ap_qid_t qid;
         int rc, i, j;
 
         /*
@@ -1018,9 +1149,13 @@ static int ap_select_domain(void)
         best_domain = -1;
         max_count = 0;
         for (i = 0; i < AP_DOMAINS; i++) {
+                if (!ap_test_config_domain(i))
+                        continue;
                 count = 0;
                 for (j = 0; j < AP_DEVICES; j++) {
-                        ap_qid_t qid = AP_MKQID(j, i);
+                        if (!ap_test_config_card_id(j))
+                                continue;
+                        qid = AP_MKQID(j, i);
                         rc = ap_query_queue(qid, &queue_depth, &device_type);
                         if (rc)
                                 continue;
@@ -1169,6 +1304,7 @@ static void ap_scan_bus(struct work_struct *unused)
         unsigned int device_functions;
         int rc, i;
 
+        ap_query_configuration();
         if (ap_select_domain() != 0)
                 return;
         for (i = 0; i < AP_DEVICES; i++) {
@@ -1176,7 +1312,10 @@ static void ap_scan_bus(struct work_struct *unused)
                 dev = bus_find_device(&ap_bus_type, NULL,
                                       (void *)(unsigned long)qid,
                                       __ap_scan_bus);
-                rc = ap_query_queue(qid, &queue_depth, &device_type);
+                if (ap_test_config_card_id(i))
+                        rc = ap_query_queue(qid, &queue_depth, &device_type);
+                else
+                        rc = -ENODEV;
                 if (dev) {
                         if (rc == -EBUSY) {
                                 set_current_state(TASK_UNINTERRUPTIBLE);
@@ -1217,29 +1356,22 @@ static void ap_scan_bus(struct work_struct *unused)
                             (unsigned long) ap_dev);
                 switch (device_type) {
                 case 0:
+                        /* device type probing for old cards */
                         if (ap_probe_device_type(ap_dev)) {
                                 kfree(ap_dev);
                                 continue;
                         }
                         break;
-                case 10:
-                        if (ap_query_functions(qid, &device_functions)) {
-                                kfree(ap_dev);
-                                continue;
-                        }
-                        if (test_ap_facility(device_functions, 3))
-                                ap_dev->device_type = AP_DEVICE_TYPE_CEX3C;
-                        else if (test_ap_facility(device_functions, 4))
-                                ap_dev->device_type = AP_DEVICE_TYPE_CEX3A;
-                        else {
-                                kfree(ap_dev);
-                                continue;
-                        }
-                        break;
                 default:
                         ap_dev->device_type = device_type;
                 }
 
+                rc = ap_query_functions(qid, &device_functions);
+                if (!rc)
+                        ap_dev->functions = device_functions;
+                else
+                        ap_dev->functions = 0u;
+
                 ap_dev->device.bus = &ap_bus_type;
                 ap_dev->device.parent = ap_root_device;
                 if (dev_set_name(&ap_dev->device, "card%02x",
@@ -1785,6 +1917,7 @@ int __init ap_module_init(void)
                 goto out_root;
         }
 
+        ap_query_configuration();
         if (ap_select_domain() == 0)
                 ap_scan_bus(NULL);
 
diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
index 52d61995af88..685f6cc022f9 100644
--- a/drivers/s390/crypto/ap_bus.h
+++ b/drivers/s390/crypto/ap_bus.h
@@ -1,5 +1,5 @@
 /*
- * Copyright IBM Corp. 2006
+ * Copyright IBM Corp. 2006, 2012
  * Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
  *            Martin Schwidefsky <schwidefsky@de.ibm.com>
  *            Ralph Wuerthner <rwuerthn@de.ibm.com>
@@ -83,13 +83,12 @@ int ap_queue_status_invalid_test(struct ap_queue_status *status)
         return !(memcmp(status, &invalid, sizeof(struct ap_queue_status)));
 }
 
-#define MAX_AP_FACILITY 31
-
-static inline int test_ap_facility(unsigned int function, unsigned int nr)
+#define AP_MAX_BITS 31
+static inline int ap_test_bit(unsigned int *ptr, unsigned int nr)
 {
-        if (nr > MAX_AP_FACILITY)
+        if (nr > AP_MAX_BITS)
                 return 0;
-        return function & (unsigned int)(0x80000000 >> nr);
+        return (*ptr & (0x80000000u >> nr)) != 0;
 }
 
 #define AP_RESPONSE_NORMAL              0x00
@@ -117,6 +116,15 @@ static inline int test_ap_facility(unsigned int function, unsigned int nr)
 #define AP_DEVICE_TYPE_CEX2C    7
 #define AP_DEVICE_TYPE_CEX3A    8
 #define AP_DEVICE_TYPE_CEX3C    9
+#define AP_DEVICE_TYPE_CEX4     10
+
+/*
+ * Known function facilities
+ */
+#define AP_FUNC_MEX4K 1
+#define AP_FUNC_CRT4K 2
+#define AP_FUNC_COPRO 3
+#define AP_FUNC_ACCEL 4
 
 /*
  * AP reset flag states
@@ -151,6 +159,7 @@ struct ap_device {
         ap_qid_t qid;                   /* AP queue id. */
         int queue_depth;                /* AP queue depth.*/
         int device_type;                /* AP device type. */
+        unsigned int functions;         /* AP device function bitfield. */
         int unregistered;               /* marks AP device as unregistered */
         struct timer_list timeout;      /* Timer for request timeouts. */
         int reset;                      /* Reset required after req. timeout. */
@@ -183,6 +192,17 @@ struct ap_message {
                         struct ap_message *);
 };
 
+struct ap_config_info {
+        unsigned int special_command:1;
+        unsigned int ap_extended:1;
+        unsigned char reserved1:6;
+        unsigned char reserved2[15];
+        unsigned int apm[8];            /* AP ID mask */
+        unsigned int aqm[8];            /* AP queue mask */
+        unsigned int adm[8];            /* AP domain mask */
+        unsigned char reserved4[16];
+} __packed;
+
 #define AP_DEVICE(dt)                                   \
         .dev_type=(dt),                                 \
         .match_flags=AP_DEVICE_ID_MATCH_DEVICE_TYPE,
@@ -211,10 +231,9 @@ int ap_recv(ap_qid_t, unsigned long long *, void *, size_t);
 void ap_queue_message(struct ap_device *ap_dev, struct ap_message *ap_msg);
 void ap_cancel_message(struct ap_device *ap_dev, struct ap_message *ap_msg);
 void ap_flush_queue(struct ap_device *ap_dev);
+void ap_bus_force_rescan(void);
 
 int ap_module_init(void);
 void ap_module_exit(void);
 
-int ap_4096_commands_available(ap_qid_t qid);
-
 #endif /* _AP_BUS_H_ */
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 2f94132246a1..31cfaa556072 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -1,7 +1,7 @@
 /*
  *  zcrypt 2.1.0
  *
- *  Copyright IBM Corp. 2001, 2006
+ *  Copyright IBM Corp. 2001, 2012
  *  Author(s): Robert Burroughs
  *             Eric Rossman (edrossma@us.ibm.com)
  *             Cornelia Huck <cornelia.huck@de.ibm.com>
@@ -9,6 +9,7 @@
  *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
  *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
  *                                Ralph Wuerthner <rwuerthn@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -37,25 +38,39 @@
 #include <linux/atomic.h>
 #include <asm/uaccess.h>
 #include <linux/hw_random.h>
+#include <linux/debugfs.h>
+#include <asm/debug.h>
 
+#include "zcrypt_debug.h"
 #include "zcrypt_api.h"
 
 /*
  * Module description.
  */
 MODULE_AUTHOR("IBM Corporation");
-MODULE_DESCRIPTION("Cryptographic Coprocessor interface, "
-                   "Copyright IBM Corp. 2001, 2006");
+MODULE_DESCRIPTION("Cryptographic Coprocessor interface, " \
+                   "Copyright IBM Corp. 2001, 2012");
 MODULE_LICENSE("GPL");
 
 static DEFINE_SPINLOCK(zcrypt_device_lock);
 static LIST_HEAD(zcrypt_device_list);
 static int zcrypt_device_count = 0;
 static atomic_t zcrypt_open_count = ATOMIC_INIT(0);
+static atomic_t zcrypt_rescan_count = ATOMIC_INIT(0);
+
+atomic_t zcrypt_rescan_req = ATOMIC_INIT(0);
+EXPORT_SYMBOL(zcrypt_rescan_req);
 
 static int zcrypt_rng_device_add(void);
 static void zcrypt_rng_device_remove(void);
 
+static DEFINE_SPINLOCK(zcrypt_ops_list_lock);
+static LIST_HEAD(zcrypt_ops_list);
+
+static debug_info_t *zcrypt_dbf_common;
+static debug_info_t *zcrypt_dbf_devices;
+static struct dentry *debugfs_root;
+
 /*
  * Device attributes common for all crypto devices.
  */
@@ -85,6 +100,8 @@ static ssize_t zcrypt_online_store(struct device *dev,
         if (sscanf(buf, "%d\n", &online) != 1 || online < 0 || online > 1)
                 return -EINVAL;
         zdev->online = online;
+        ZCRYPT_DBF_DEV(DBF_INFO, zdev, "dev%04xo%dman", zdev->ap_dev->qid,
+                       zdev->online);
         if (!online)
                 ap_flush_queue(zdev->ap_dev);
         return count;
@@ -103,6 +120,24 @@ static struct attribute_group zcrypt_device_attr_group = {
 };
 
 /**
+ * Process a rescan of the transport layer.
+ *
+ * Returns 1, if the rescan has been processed, otherwise 0.
+ */
+static inline int zcrypt_process_rescan(void)
+{
+        if (atomic_read(&zcrypt_rescan_req)) {
+                atomic_set(&zcrypt_rescan_req, 0);
+                atomic_inc(&zcrypt_rescan_count);
+                ap_bus_force_rescan();
+                ZCRYPT_DBF_COMMON(DBF_INFO, "rescan%07d",
+                                  atomic_inc_return(&zcrypt_rescan_count));
+                return 1;
+        }
+        return 0;
+}
+
+/**
  * __zcrypt_increase_preference(): Increase preference of a crypto device.
  * @zdev: Pointer the crypto device
  *
@@ -190,6 +225,7 @@ struct zcrypt_device *zcrypt_device_alloc(size_t max_response_size)
         zdev->reply.length = max_response_size;
         spin_lock_init(&zdev->lock);
         INIT_LIST_HEAD(&zdev->list);
+        zdev->dbf_area = zcrypt_dbf_devices;
         return zdev;
 
 out_free:
@@ -215,6 +251,8 @@ int zcrypt_device_register(struct zcrypt_device *zdev)
 {
         int rc;
 
+        if (!zdev->ops)
+                return -ENODEV;
         rc = sysfs_create_group(&zdev->ap_dev->device.kobj,
                                 &zcrypt_device_attr_group);
         if (rc)
@@ -223,6 +261,8 @@ int zcrypt_device_register(struct zcrypt_device *zdev)
         kref_init(&zdev->refcount);
         spin_lock_bh(&zcrypt_device_lock);
         zdev->online = 1;       /* New devices are online by default. */
+        ZCRYPT_DBF_DEV(DBF_INFO, zdev, "dev%04xo%dreg", zdev->ap_dev->qid,
+                       zdev->online);
         list_add_tail(&zdev->list, &zcrypt_device_list);
         __zcrypt_increase_preference(zdev);
         zcrypt_device_count++;
@@ -269,6 +309,67 @@ void zcrypt_device_unregister(struct zcrypt_device *zdev)
 }
 EXPORT_SYMBOL(zcrypt_device_unregister);
 
+void zcrypt_msgtype_register(struct zcrypt_ops *zops)
+{
+        if (zops->owner) {
+                spin_lock_bh(&zcrypt_ops_list_lock);
+                list_add_tail(&zops->list, &zcrypt_ops_list);
+                spin_unlock_bh(&zcrypt_ops_list_lock);
+        }
+}
+EXPORT_SYMBOL(zcrypt_msgtype_register);
+
+void zcrypt_msgtype_unregister(struct zcrypt_ops *zops)
+{
+        spin_lock_bh(&zcrypt_ops_list_lock);
+        list_del_init(&zops->list);
+        spin_unlock_bh(&zcrypt_ops_list_lock);
+}
+EXPORT_SYMBOL(zcrypt_msgtype_unregister);
+
+static inline
+struct zcrypt_ops *__ops_lookup(unsigned char *name, int variant)
+{
+        struct zcrypt_ops *zops;
+        int found = 0;
+
+        spin_lock_bh(&zcrypt_ops_list_lock);
+        list_for_each_entry(zops, &zcrypt_ops_list, list) {
+                if ((zops->variant == variant) &&
+                    (!strncmp(zops->owner->name, name, MODULE_NAME_LEN))) {
+                        found = 1;
+                        break;
+                }
+        }
+        spin_unlock_bh(&zcrypt_ops_list_lock);
+
+        if (!found)
+                return NULL;
+        return zops;
+}
+
+struct zcrypt_ops *zcrypt_msgtype_request(unsigned char *name, int variant)
+{
+        struct zcrypt_ops *zops = NULL;
+
+        zops = __ops_lookup(name, variant);
+        if (!zops) {
+                request_module(name);
+                zops = __ops_lookup(name, variant);
+        }
+        if ((!zops) || (!try_module_get(zops->owner)))
+                return NULL;
+        return zops;
+}
+EXPORT_SYMBOL(zcrypt_msgtype_request);
+
+void zcrypt_msgtype_release(struct zcrypt_ops *zops)
+{
+        if (zops)
+                module_put(zops->owner);
+}
+EXPORT_SYMBOL(zcrypt_msgtype_release);
+
 /**
  * zcrypt_read (): Not supported beyond zcrypt 1.3.1.
  *
@@ -640,6 +741,11 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
                 do {
                         rc = zcrypt_rsa_modexpo(&mex);
                 } while (rc == -EAGAIN);
+                /* on failure: retry once again after a requested rescan */
+                if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+                        do {
+                                rc = zcrypt_rsa_modexpo(&mex);
+                        } while (rc == -EAGAIN);
                 if (rc)
                         return rc;
                 return put_user(mex.outputdatalength, &umex->outputdatalength);
@@ -652,6 +758,11 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
                 do {
                         rc = zcrypt_rsa_crt(&crt);
                 } while (rc == -EAGAIN);
+                /* on failure: retry once again after a requested rescan */
+                if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+                        do {
+                                rc = zcrypt_rsa_crt(&crt);
+                        } while (rc == -EAGAIN);
                 if (rc)
                         return rc;
                 return put_user(crt.outputdatalength, &ucrt->outputdatalength);
@@ -664,6 +775,11 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
                 do {
                         rc = zcrypt_send_cprb(&xcRB);
                 } while (rc == -EAGAIN);
+                /* on failure: retry once again after a requested rescan */
+                if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+                        do {
+                                rc = zcrypt_send_cprb(&xcRB);
+                        } while (rc == -EAGAIN);
                 if (copy_to_user(uxcRB, &xcRB, sizeof(xcRB)))
                         return -EFAULT;
                 return rc;
@@ -770,10 +886,15 @@ static long trans_modexpo32(struct file *filp, unsigned int cmd,
         do {
                 rc = zcrypt_rsa_modexpo(&mex64);
         } while (rc == -EAGAIN);
-        if (!rc)
-                rc = put_user(mex64.outputdatalength,
-                              &umex32->outputdatalength);
-        return rc;
+        /* on failure: retry once again after a requested rescan */
+        if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+                do {
+                        rc = zcrypt_rsa_modexpo(&mex64);
+                } while (rc == -EAGAIN);
+        if (rc)
+                return rc;
+        return put_user(mex64.outputdatalength,
+                        &umex32->outputdatalength);
 }
 
 struct compat_ica_rsa_modexpo_crt {
@@ -810,10 +931,15 @@ static long trans_modexpo_crt32(struct file *filp, unsigned int cmd,
         do {
                 rc = zcrypt_rsa_crt(&crt64);
         } while (rc == -EAGAIN);
-        if (!rc)
-                rc = put_user(crt64.outputdatalength,
-                              &ucrt32->outputdatalength);
-        return rc;
+        /* on failure: retry once again after a requested rescan */
+        if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+                do {
+                        rc = zcrypt_rsa_crt(&crt64);
+                } while (rc == -EAGAIN);
+        if (rc)
+                return rc;
+        return put_user(crt64.outputdatalength,
+                        &ucrt32->outputdatalength);
 }
 
 struct compat_ica_xcRB {
@@ -869,6 +995,11 @@ static long trans_xcRB32(struct file *filp, unsigned int cmd,
         do {
                 rc = zcrypt_send_cprb(&xcRB64);
         } while (rc == -EAGAIN);
+        /* on failure: retry once again after a requested rescan */
+        if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+                do {
+                        rc = zcrypt_send_cprb(&xcRB64);
+                } while (rc == -EAGAIN);
         xcRB32.reply_control_blk_length = xcRB64.reply_control_blk_length;
         xcRB32.reply_data_length = xcRB64.reply_data_length;
         xcRB32.status = xcRB64.status;
@@ -1126,6 +1257,9 @@ static int zcrypt_rng_data_read(struct hwrng *rng, u32 *data)
          */
         if (zcrypt_rng_buffer_index == 0) {
                 rc = zcrypt_rng((char *) zcrypt_rng_buffer);
+                /* on failure: retry once again after a requested rescan */
+                if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+                        rc = zcrypt_rng((char *) zcrypt_rng_buffer);
                 if (rc < 0)
                         return -EIO;
                 zcrypt_rng_buffer_index = rc / sizeof *data;
@@ -1178,6 +1312,30 @@ static void zcrypt_rng_device_remove(void)
         mutex_unlock(&zcrypt_rng_mutex);
 }
 
+int __init zcrypt_debug_init(void)
+{
+        debugfs_root = debugfs_create_dir("zcrypt", NULL);
+
+        zcrypt_dbf_common = debug_register("zcrypt_common", 1, 1, 16);
+        debug_register_view(zcrypt_dbf_common, &debug_hex_ascii_view);
+        debug_set_level(zcrypt_dbf_common, DBF_ERR);
+
+        zcrypt_dbf_devices = debug_register("zcrypt_devices", 1, 1, 16);
+        debug_register_view(zcrypt_dbf_devices, &debug_hex_ascii_view);
+        debug_set_level(zcrypt_dbf_devices, DBF_ERR);
+
+        return 0;
+}
+
+void zcrypt_debug_exit(void)
+{
+        debugfs_remove(debugfs_root);
+        if (zcrypt_dbf_common)
+                debug_unregister(zcrypt_dbf_common);
+        if (zcrypt_dbf_devices)
+                debug_unregister(zcrypt_dbf_devices);
+}
+
 /**
  * zcrypt_api_init(): Module initialization.
  *
@@ -1187,6 +1345,12 @@ int __init zcrypt_api_init(void)
 {
         int rc;
 
+        rc = zcrypt_debug_init();
+        if (rc)
+                goto out;
+
+        atomic_set(&zcrypt_rescan_req, 0);
+
         /* Register the request sprayer. */
         rc = misc_register(&zcrypt_misc_device);
         if (rc < 0)
@@ -1216,6 +1380,7 @@ void zcrypt_api_exit(void)
 {
         remove_proc_entry("driver/z90crypt", NULL);
         misc_deregister(&zcrypt_misc_device);
+        zcrypt_debug_exit();
 }
 
 module_init(zcrypt_api_init);
diff --git a/drivers/s390/crypto/zcrypt_api.h b/drivers/s390/crypto/zcrypt_api.h
index 7a32c4bc8ef9..89632919c993 100644
--- a/drivers/s390/crypto/zcrypt_api.h
+++ b/drivers/s390/crypto/zcrypt_api.h
@@ -1,7 +1,7 @@
 /*
  *  zcrypt 2.1.0
  *
- *  Copyright IBM Corp. 2001, 2006
+ *  Copyright IBM Corp. 2001, 2012
  *  Author(s): Robert Burroughs
  *             Eric Rossman (edrossma@us.ibm.com)
  *             Cornelia Huck <cornelia.huck@de.ibm.com>
@@ -9,6 +9,7 @@
  *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
  *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
  *                                Ralph Wuerthner <rwuerthn@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -28,8 +29,10 @@
 #ifndef _ZCRYPT_API_H_
 #define _ZCRYPT_API_H_
 
-#include "ap_bus.h"
+#include <linux/atomic.h>
+#include <asm/debug.h>
 #include <asm/zcrypt.h>
+#include "ap_bus.h"
 
 /* deprecated status calls */
 #define ICAZ90STATUS            _IOR(ZCRYPT_IOCTL_MAGIC, 0x10, struct ica_z90_status)
@@ -87,6 +90,9 @@ struct zcrypt_ops {
                                 struct ica_rsa_modexpo_crt *);
         long (*send_cprb)(struct zcrypt_device *, struct ica_xcRB *);
         long (*rng)(struct zcrypt_device *, char *);
+        struct list_head list;          /* zcrypt ops list. */
+        struct module *owner;
+        int variant;
 };
 
 struct zcrypt_device {
@@ -108,14 +114,23 @@ struct zcrypt_device {
 
         struct ap_message reply;        /* Per-device reply structure. */
         int max_exp_bit_length;
+
+        debug_info_t *dbf_area;         /* debugging */
 };
 
+/* transport layer rescanning */
+extern atomic_t zcrypt_rescan_req;
+
 struct zcrypt_device *zcrypt_device_alloc(size_t);
 void zcrypt_device_free(struct zcrypt_device *);
 void zcrypt_device_get(struct zcrypt_device *);
 int zcrypt_device_put(struct zcrypt_device *);
 int zcrypt_device_register(struct zcrypt_device *);
 void zcrypt_device_unregister(struct zcrypt_device *);
+void zcrypt_msgtype_register(struct zcrypt_ops *);
+void zcrypt_msgtype_unregister(struct zcrypt_ops *);
+struct zcrypt_ops *zcrypt_msgtype_request(unsigned char *, int);
+void zcrypt_msgtype_release(struct zcrypt_ops *);
 int zcrypt_api_init(void);
 void zcrypt_api_exit(void);
 
diff --git a/drivers/s390/crypto/zcrypt_cex2a.c b/drivers/s390/crypto/zcrypt_cex2a.c
index 744c668f586c..1e849d6e1dfe 100644
--- a/drivers/s390/crypto/zcrypt_cex2a.c
+++ b/drivers/s390/crypto/zcrypt_cex2a.c
@@ -1,13 +1,14 @@
 /*
  *  zcrypt 2.1.0
  *
- *  Copyright IBM Corp. 2001, 2006
+ *  Copyright IBM Corp. 2001, 2012
  *  Author(s): Robert Burroughs
  *             Eric Rossman (edrossma@us.ibm.com)
  *
  *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
  *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
  *                                Ralph Wuerthner <rwuerthn@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -35,6 +36,7 @@
 #include "zcrypt_api.h"
 #include "zcrypt_error.h"
 #include "zcrypt_cex2a.h"
+#include "zcrypt_msgtype50.h"
 
 #define CEX2A_MIN_MOD_SIZE        1     /*    8 bits    */
 #define CEX2A_MAX_MOD_SIZE      256     /* 2048 bits    */
@@ -63,14 +65,12 @@ static struct ap_device_id zcrypt_cex2a_ids[] = {
 
 MODULE_DEVICE_TABLE(ap, zcrypt_cex2a_ids);
 MODULE_AUTHOR("IBM Corporation");
-MODULE_DESCRIPTION("CEX2A Cryptographic Coprocessor device driver, "
-                   "Copyright IBM Corp. 2001, 2006");
+MODULE_DESCRIPTION("CEX2A Cryptographic Coprocessor device driver, " \
+                   "Copyright IBM Corp. 2001, 2012");
 MODULE_LICENSE("GPL");
 
 static int zcrypt_cex2a_probe(struct ap_device *ap_dev);
 static void zcrypt_cex2a_remove(struct ap_device *ap_dev);
-static void zcrypt_cex2a_receive(struct ap_device *, struct ap_message *,
-                                 struct ap_message *);
 
 static struct ap_driver zcrypt_cex2a_driver = {
         .probe = zcrypt_cex2a_probe,
@@ -80,344 +80,6 @@ static struct ap_driver zcrypt_cex2a_driver = {
 };
 
 /**
- * Convert a ICAMEX message to a type50 MEX message.
- *
- * @zdev: crypto device pointer
- * @zreq: crypto request pointer
- * @mex: pointer to user input data
- *
- * Returns 0 on success or -EFAULT.
- */
-static int ICAMEX_msg_to_type50MEX_msg(struct zcrypt_device *zdev,
-                                       struct ap_message *ap_msg,
-                                       struct ica_rsa_modexpo *mex)
-{
-        unsigned char *mod, *exp, *inp;
-        int mod_len;
-
-        mod_len = mex->inputdatalength;
-
-        if (mod_len <= 128) {
-                struct type50_meb1_msg *meb1 = ap_msg->message;
-                memset(meb1, 0, sizeof(*meb1));
-                ap_msg->length = sizeof(*meb1);
-                meb1->header.msg_type_code = TYPE50_TYPE_CODE;
-                meb1->header.msg_len = sizeof(*meb1);
-                meb1->keyblock_type = TYPE50_MEB1_FMT;
-                mod = meb1->modulus + sizeof(meb1->modulus) - mod_len;
-                exp = meb1->exponent + sizeof(meb1->exponent) - mod_len;
-                inp = meb1->message + sizeof(meb1->message) - mod_len;
-        } else if (mod_len <= 256) {
-                struct type50_meb2_msg *meb2 = ap_msg->message;
-                memset(meb2, 0, sizeof(*meb2));
-                ap_msg->length = sizeof(*meb2);
-                meb2->header.msg_type_code = TYPE50_TYPE_CODE;
-                meb2->header.msg_len = sizeof(*meb2);
-                meb2->keyblock_type = TYPE50_MEB2_FMT;
-                mod = meb2->modulus + sizeof(meb2->modulus) - mod_len;
-                exp = meb2->exponent + sizeof(meb2->exponent) - mod_len;
-                inp = meb2->message + sizeof(meb2->message) - mod_len;
-        } else {
-                /* mod_len > 256 = 4096 bit RSA Key */
-                struct type50_meb3_msg *meb3 = ap_msg->message;
-                memset(meb3, 0, sizeof(*meb3));
-                ap_msg->length = sizeof(*meb3);
-                meb3->header.msg_type_code = TYPE50_TYPE_CODE;
-                meb3->header.msg_len = sizeof(*meb3);
-                meb3->keyblock_type = TYPE50_MEB3_FMT;
-                mod = meb3->modulus + sizeof(meb3->modulus) - mod_len;
-                exp = meb3->exponent + sizeof(meb3->exponent) - mod_len;
-                inp = meb3->message + sizeof(meb3->message) - mod_len;
-        }
-
-        if (copy_from_user(mod, mex->n_modulus, mod_len) ||
-            copy_from_user(exp, mex->b_key, mod_len) ||
-            copy_from_user(inp, mex->inputdata, mod_len))
-                return -EFAULT;
-        return 0;
-}
-
-/**
- * Convert a ICACRT message to a type50 CRT message.
- *
- * @zdev: crypto device pointer
- * @zreq: crypto request pointer
- * @crt: pointer to user input data
- *
- * Returns 0 on success or -EFAULT.
- */
-static int ICACRT_msg_to_type50CRT_msg(struct zcrypt_device *zdev,
-                                       struct ap_message *ap_msg,
-                                       struct ica_rsa_modexpo_crt *crt)
-{
-        int mod_len, short_len, long_len, long_offset, limit;
-        unsigned char *p, *q, *dp, *dq, *u, *inp;
-
-        mod_len = crt->inputdatalength;
-        short_len = mod_len / 2;
-        long_len = mod_len / 2 + 8;
-
-        /*
-         * CEX2A cannot handle p, dp, or U > 128 bytes.
-         * If we have one of these, we need to do extra checking.
-         * For CEX3A the limit is 256 bytes.
-         */
-        if (zdev->max_mod_size == CEX3A_MAX_MOD_SIZE)
-                limit = 256;
-        else
-                limit = 128;
-
-        if (long_len > limit) {
-                /*
-                 * zcrypt_rsa_crt already checked for the leading
-                 * zeroes of np_prime, bp_key and u_mult_inc.
-                 */
-                long_offset = long_len - limit;
-                long_len = limit;
-        } else
-                long_offset = 0;
-
-        /*
-         * Instead of doing extra work for p, dp, U > 64 bytes, we'll just use
-         * the larger message structure.
-         */
-        if (long_len <= 64) {
-                struct type50_crb1_msg *crb1 = ap_msg->message;
-                memset(crb1, 0, sizeof(*crb1));
-                ap_msg->length = sizeof(*crb1);
-                crb1->header.msg_type_code = TYPE50_TYPE_CODE;
-                crb1->header.msg_len = sizeof(*crb1);
-                crb1->keyblock_type = TYPE50_CRB1_FMT;
-                p = crb1->p + sizeof(crb1->p) - long_len;
-                q = crb1->q + sizeof(crb1->q) - short_len;
-                dp = crb1->dp + sizeof(crb1->dp) - long_len;
-                dq = crb1->dq + sizeof(crb1->dq) - short_len;
-                u = crb1->u + sizeof(crb1->u) - long_len;
-                inp = crb1->message + sizeof(crb1->message) - mod_len;
-        } else if (long_len <= 128) {
-                struct type50_crb2_msg *crb2 = ap_msg->message;
-                memset(crb2, 0, sizeof(*crb2));
-                ap_msg->length = sizeof(*crb2);
-                crb2->header.msg_type_code = TYPE50_TYPE_CODE;
-                crb2->header.msg_len = sizeof(*crb2);
-                crb2->keyblock_type = TYPE50_CRB2_FMT;
-                p = crb2->p + sizeof(crb2->p) - long_len;
-                q = crb2->q + sizeof(crb2->q) - short_len;
-                dp = crb2->dp + sizeof(crb2->dp) - long_len;
-                dq = crb2->dq + sizeof(crb2->dq) - short_len;
-                u = crb2->u + sizeof(crb2->u) - long_len;
-                inp = crb2->message + sizeof(crb2->message) - mod_len;
-        } else {
-                /* long_len >= 256 */
-                struct type50_crb3_msg *crb3 = ap_msg->message;
-                memset(crb3, 0, sizeof(*crb3));
-                ap_msg->length = sizeof(*crb3);
-                crb3->header.msg_type_code = TYPE50_TYPE_CODE;
-                crb3->header.msg_len = sizeof(*crb3);
-                crb3->keyblock_type = TYPE50_CRB3_FMT;
-                p = crb3->p + sizeof(crb3->p) - long_len;
-                q = crb3->q + sizeof(crb3->q) - short_len;
-                dp = crb3->dp + sizeof(crb3->dp) - long_len;
-                dq = crb3->dq + sizeof(crb3->dq) - short_len;
-                u = crb3->u + sizeof(crb3->u) - long_len;
-                inp = crb3->message + sizeof(crb3->message) - mod_len;
-        }
-
-        if (copy_from_user(p, crt->np_prime + long_offset, long_len) ||
-            copy_from_user(q, crt->nq_prime, short_len) ||
-            copy_from_user(dp, crt->bp_key + long_offset, long_len) ||
-            copy_from_user(dq, crt->bq_key, short_len) ||
-            copy_from_user(u, crt->u_mult_inv + long_offset, long_len) ||
-            copy_from_user(inp, crt->inputdata, mod_len))
-                return -EFAULT;
-
-        return 0;
-}
-
-/**
- * Copy results from a type 80 reply message back to user space.
- *
- * @zdev: crypto device pointer
- * @reply: reply AP message.
- * @data: pointer to user output data
- * @length: size of user output data
- *
- * Returns 0 on success or -EFAULT.
- */
-static int convert_type80(struct zcrypt_device *zdev,
-                          struct ap_message *reply,
-                          char __user *outputdata,
-                          unsigned int outputdatalength)
-{
-        struct type80_hdr *t80h = reply->message;
-        unsigned char *data;
-
-        if (t80h->len < sizeof(*t80h) + outputdatalength) {
-                /* The result is too short, the CEX2A card may not do that.. */
-                zdev->online = 0;
-                return -EAGAIN; /* repeat the request on a different device. */
-        }
-        if (zdev->user_space_type == ZCRYPT_CEX2A)
-                BUG_ON(t80h->len > CEX2A_MAX_RESPONSE_SIZE);
-        else
-                BUG_ON(t80h->len > CEX3A_MAX_RESPONSE_SIZE);
-        data = reply->message + t80h->len - outputdatalength;
-        if (copy_to_user(outputdata, data, outputdatalength))
-                return -EFAULT;
-        return 0;
-}
-
-static int convert_response(struct zcrypt_device *zdev,
-                            struct ap_message *reply,
-                            char __user *outputdata,
-                            unsigned int outputdatalength)
-{
-        /* Response type byte is the second byte in the response. */
-        switch (((unsigned char *) reply->message)[1]) {
-        case TYPE82_RSP_CODE:
-        case TYPE88_RSP_CODE:
-                return convert_error(zdev, reply);
-        case TYPE80_RSP_CODE:
-                return convert_type80(zdev, reply,
-                                      outputdata, outputdatalength);
-        default: /* Unknown response type, this should NEVER EVER happen */
-                zdev->online = 0;
-                return -EAGAIN; /* repeat the request on a different device. */
-        }
-}
-
-/**
- * This function is called from the AP bus code after a crypto request
- * "msg" has finished with the reply message "reply".
- * It is called from tasklet context.
- * @ap_dev: pointer to the AP device
- * @msg: pointer to the AP message
- * @reply: pointer to the AP reply message
- */
-static void zcrypt_cex2a_receive(struct ap_device *ap_dev,
-                                 struct ap_message *msg,
-                                 struct ap_message *reply)
-{
-        static struct error_hdr error_reply = {
-                .type = TYPE82_RSP_CODE,
-                .reply_code = REP82_ERROR_MACHINE_FAILURE,
-        };
-        struct type80_hdr *t80h;
-        int length;
-
-        /* Copy the reply message to the request message buffer. */
-        if (IS_ERR(reply)) {
-                memcpy(msg->message, &error_reply, sizeof(error_reply));
-                goto out;
-        }
-        t80h = reply->message;
-        if (t80h->type == TYPE80_RSP_CODE) {
-                if (ap_dev->device_type == AP_DEVICE_TYPE_CEX2A)
-                        length = min(CEX2A_MAX_RESPONSE_SIZE, (int) t80h->len);
-                else
-                        length = min(CEX3A_MAX_RESPONSE_SIZE, (int) t80h->len);
-                memcpy(msg->message, reply->message, length);
-        } else
-                memcpy(msg->message, reply->message, sizeof error_reply);
-out:
-        complete((struct completion *) msg->private);
-}
-
-static atomic_t zcrypt_step = ATOMIC_INIT(0);
-
-/**
- * The request distributor calls this function if it picked the CEX2A
- * device to handle a modexpo request.
- * @zdev: pointer to zcrypt_device structure that identifies the
- *        CEX2A device to the request distributor
- * @mex: pointer to the modexpo request buffer
- */
-static long zcrypt_cex2a_modexpo(struct zcrypt_device *zdev,
-                                 struct ica_rsa_modexpo *mex)
-{
-        struct ap_message ap_msg;
-        struct completion work;
-        int rc;
-
-        ap_init_message(&ap_msg);
-        if (zdev->user_space_type == ZCRYPT_CEX2A)
-                ap_msg.message = kmalloc(CEX2A_MAX_MESSAGE_SIZE, GFP_KERNEL);
-        else
-                ap_msg.message = kmalloc(CEX3A_MAX_MESSAGE_SIZE, GFP_KERNEL);
-        if (!ap_msg.message)
-                return -ENOMEM;
-        ap_msg.receive = zcrypt_cex2a_receive;
-        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
-                                atomic_inc_return(&zcrypt_step);
-        ap_msg.private = &work;
-        rc = ICAMEX_msg_to_type50MEX_msg(zdev, &ap_msg, mex);
-        if (rc)
-                goto out_free;
-        init_completion(&work);
-        ap_queue_message(zdev->ap_dev, &ap_msg);
-        rc = wait_for_completion_interruptible(&work);
-        if (rc == 0)
-                rc = convert_response(zdev, &ap_msg, mex->outputdata,
-                                      mex->outputdatalength);
-        else
-                /* Signal pending. */
-                ap_cancel_message(zdev->ap_dev, &ap_msg);
-out_free:
-        kfree(ap_msg.message);
-        return rc;
-}
-
-/**
- * The request distributor calls this function if it picked the CEX2A
- * device to handle a modexpo_crt request.
- * @zdev: pointer to zcrypt_device structure that identifies the
- *        CEX2A device to the request distributor
- * @crt: pointer to the modexpoc_crt request buffer
- */
-static long zcrypt_cex2a_modexpo_crt(struct zcrypt_device *zdev,
-                                     struct ica_rsa_modexpo_crt *crt)
-{
-        struct ap_message ap_msg;
-        struct completion work;
-        int rc;
-
-        ap_init_message(&ap_msg);
-        if (zdev->user_space_type == ZCRYPT_CEX2A)
-                ap_msg.message = kmalloc(CEX2A_MAX_MESSAGE_SIZE, GFP_KERNEL);
-        else
-                ap_msg.message = kmalloc(CEX3A_MAX_MESSAGE_SIZE, GFP_KERNEL);
-        if (!ap_msg.message)
-                return -ENOMEM;
-        ap_msg.receive = zcrypt_cex2a_receive;
-        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
-                                atomic_inc_return(&zcrypt_step);
-        ap_msg.private = &work;
-        rc = ICACRT_msg_to_type50CRT_msg(zdev, &ap_msg, crt);
-        if (rc)
-                goto out_free;
-        init_completion(&work);
-        ap_queue_message(zdev->ap_dev, &ap_msg);
-        rc = wait_for_completion_interruptible(&work);
-        if (rc == 0)
-                rc = convert_response(zdev, &ap_msg, crt->outputdata,
-                                      crt->outputdatalength);
-        else
-                /* Signal pending. */
-                ap_cancel_message(zdev->ap_dev, &ap_msg);
-out_free:
-        kfree(ap_msg.message);
-        return rc;
-}
-
-/**
- * The crypto operations for a CEX2A card.
- */
-static struct zcrypt_ops zcrypt_cex2a_ops = {
-        .rsa_modexpo = zcrypt_cex2a_modexpo,
-        .rsa_modexpo_crt = zcrypt_cex2a_modexpo_crt,
-};
-
-/**
  * Probe function for CEX2A cards. It always accepts the AP device
  * since the bus_match already checked the hardware type.
  * @ap_dev: pointer to the AP device.
@@ -449,7 +111,8 @@ static int zcrypt_cex2a_probe(struct ap_device *ap_dev)
                 zdev->min_mod_size = CEX2A_MIN_MOD_SIZE;
                 zdev->max_mod_size = CEX2A_MAX_MOD_SIZE;
                 zdev->max_exp_bit_length = CEX2A_MAX_MOD_SIZE;
-                if (ap_4096_commands_available(ap_dev->qid)) {
+                if (ap_test_bit(&ap_dev->functions, AP_FUNC_MEX4K) &&
+                    ap_test_bit(&ap_dev->functions, AP_FUNC_CRT4K)) {
                         zdev->max_mod_size = CEX3A_MAX_MOD_SIZE;
                         zdev->max_exp_bit_length = CEX3A_MAX_MOD_SIZE;
                 }
@@ -457,16 +120,18 @@ static int zcrypt_cex2a_probe(struct ap_device *ap_dev)
                 zdev->speed_rating = CEX3A_SPEED_RATING;
                 break;
         }
-        if (zdev != NULL) {
-                zdev->ap_dev = ap_dev;
-                zdev->ops = &zcrypt_cex2a_ops;
-                zdev->online = 1;
-                ap_dev->reply = &zdev->reply;
-                ap_dev->private = zdev;
-                rc = zcrypt_device_register(zdev);
-        }
+        if (!zdev)
+                return -ENODEV;
+        zdev->ops = zcrypt_msgtype_request(MSGTYPE50_NAME,
+                                           MSGTYPE50_VARIANT_DEFAULT);
+        zdev->ap_dev = ap_dev;
+        zdev->online = 1;
+        ap_dev->reply = &zdev->reply;
+        ap_dev->private = zdev;
+        rc = zcrypt_device_register(zdev);
         if (rc) {
                 ap_dev->private = NULL;
+                zcrypt_msgtype_release(zdev->ops);
                 zcrypt_device_free(zdev);
         }
         return rc;
@@ -479,8 +144,10 @@ static int zcrypt_cex2a_probe(struct ap_device *ap_dev)
 static void zcrypt_cex2a_remove(struct ap_device *ap_dev)
 {
         struct zcrypt_device *zdev = ap_dev->private;
+        struct zcrypt_ops *zops = zdev->ops;
 
         zcrypt_device_unregister(zdev);
+        zcrypt_msgtype_release(zops);
 }
 
 int __init zcrypt_cex2a_init(void)
diff --git a/drivers/s390/crypto/zcrypt_cex4.c b/drivers/s390/crypto/zcrypt_cex4.c
new file mode 100644
index 000000000000..ce1226398ac9
--- /dev/null
+++ b/drivers/s390/crypto/zcrypt_cex4.c
@@ -0,0 +1,149 @@
+/*
+ *  Copyright IBM Corp. 2012
+ *  Author(s): Holger Dengler <hd@linux.vnet.ibm.com>
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/init.h>
+#include <linux/err.h>
+#include <linux/atomic.h>
+#include <linux/uaccess.h>
+
+#include "ap_bus.h"
+#include "zcrypt_api.h"
+#include "zcrypt_msgtype6.h"
+#include "zcrypt_msgtype50.h"
+#include "zcrypt_error.h"
+#include "zcrypt_cex4.h"
+
+#define CEX4A_MIN_MOD_SIZE        1     /*    8 bits    */
+#define CEX4A_MAX_MOD_SIZE_2K   256     /* 2048 bits    */
+#define CEX4A_MAX_MOD_SIZE_4K   512     /* 4096 bits    */
+
+#define CEX4C_MIN_MOD_SIZE       16     /*  256 bits    */
+#define CEX4C_MAX_MOD_SIZE      512     /* 4096 bits    */
+
+#define CEX4A_SPEED_RATING      900      /* TODO new card, new speed rating */
+#define CEX4C_SPEED_RATING      6500     /* TODO new card, new speed rating */
+
+#define CEX4A_MAX_MESSAGE_SIZE  MSGTYPE50_CRB3_MAX_MSG_SIZE
+#define CEX4C_MAX_MESSAGE_SIZE  MSGTYPE06_MAX_MSG_SIZE
+
+#define CEX4_CLEANUP_TIME       (15*HZ)
+
+static struct ap_device_id zcrypt_cex4_ids[] = {
+        { AP_DEVICE(AP_DEVICE_TYPE_CEX4)  },
+        { /* end of list */ },
+};
+
+MODULE_DEVICE_TABLE(ap, zcrypt_cex4_ids);
+MODULE_AUTHOR("IBM Corporation");
+MODULE_DESCRIPTION("CEX4 Cryptographic Card device driver, " \
+                   "Copyright IBM Corp. 2012");
+MODULE_LICENSE("GPL");
+
+static int zcrypt_cex4_probe(struct ap_device *ap_dev);
+static void zcrypt_cex4_remove(struct ap_device *ap_dev);
+
+static struct ap_driver zcrypt_cex4_driver = {
+        .probe = zcrypt_cex4_probe,
+        .remove = zcrypt_cex4_remove,
+        .ids = zcrypt_cex4_ids,
+        .request_timeout = CEX4_CLEANUP_TIME,
+};
+
+/**
+ * Probe function for CEX4 cards. It always accepts the AP device
+ * since the bus_match already checked the hardware type.
+ * @ap_dev: pointer to the AP device.
+ */
+static int zcrypt_cex4_probe(struct ap_device *ap_dev)
+{
+        struct zcrypt_device *zdev = NULL;
+        int rc = 0;
+
+        switch (ap_dev->device_type) {
+        case AP_DEVICE_TYPE_CEX4:
+                if (ap_test_bit(&ap_dev->functions, AP_FUNC_ACCEL)) {
+                        zdev = zcrypt_device_alloc(CEX4A_MAX_MESSAGE_SIZE);
+                        if (!zdev)
+                                return -ENOMEM;
+                        zdev->type_string = "CEX4A";
+                        zdev->user_space_type = ZCRYPT_CEX3A;
+                        zdev->min_mod_size = CEX4A_MIN_MOD_SIZE;
+                        if (ap_test_bit(&ap_dev->functions, AP_FUNC_MEX4K) &&
+                            ap_test_bit(&ap_dev->functions, AP_FUNC_CRT4K)) {
+                                zdev->max_mod_size =
+                                        CEX4A_MAX_MOD_SIZE_4K;
+                                zdev->max_exp_bit_length =
+                                        CEX4A_MAX_MOD_SIZE_4K;
+                        } else {
+                                zdev->max_mod_size =
+                                        CEX4A_MAX_MOD_SIZE_2K;
+                                zdev->max_exp_bit_length =
+                                        CEX4A_MAX_MOD_SIZE_2K;
+                        }
+                        zdev->short_crt = 1;
+                        zdev->speed_rating = CEX4A_SPEED_RATING;
+                        zdev->ops = zcrypt_msgtype_request(MSGTYPE50_NAME,
+                                                           MSGTYPE50_VARIANT_DEFAULT);
+                } else if (ap_test_bit(&ap_dev->functions, AP_FUNC_COPRO)) {
+                        zdev = zcrypt_device_alloc(CEX4C_MAX_MESSAGE_SIZE);
+                        if (!zdev)
+                                return -ENOMEM;
+                        zdev->type_string = "CEX4C";
+                        zdev->user_space_type = ZCRYPT_CEX3C;
+                        zdev->min_mod_size = CEX4C_MIN_MOD_SIZE;
+                        zdev->max_mod_size = CEX4C_MAX_MOD_SIZE;
+                        zdev->max_exp_bit_length = CEX4C_MAX_MOD_SIZE;
+                        zdev->short_crt = 0;
+                        zdev->speed_rating = CEX4C_SPEED_RATING;
+                        zdev->ops = zcrypt_msgtype_request(MSGTYPE06_NAME,
+                                                           MSGTYPE06_VARIANT_DEFAULT);
+                }
+                break;
+        }
+        if (!zdev)
+                return -ENODEV;
+        zdev->ap_dev = ap_dev;
+        zdev->online = 1;
+        ap_dev->reply = &zdev->reply;
+        ap_dev->private = zdev;
+        rc = zcrypt_device_register(zdev);
+        if (rc) {
+                zcrypt_msgtype_release(zdev->ops);
+                ap_dev->private = NULL;
+                zcrypt_device_free(zdev);
+        }
+        return rc;
+}
+
+/**
+ * This is called to remove the extended CEX4 driver information
+ * if an AP device is removed.
+ */
+static void zcrypt_cex4_remove(struct ap_device *ap_dev)
+{
+        struct zcrypt_device *zdev = ap_dev->private;
+        struct zcrypt_ops *zops;
+
+        if (zdev) {
+                zops = zdev->ops;
+                zcrypt_device_unregister(zdev);
+                zcrypt_msgtype_release(zops);
+        }
+}
+
+int __init zcrypt_cex4_init(void)
+{
+        return ap_driver_register(&zcrypt_cex4_driver, THIS_MODULE, "cex4");
+}
+
+void __exit zcrypt_cex4_exit(void)
+{
+        ap_driver_unregister(&zcrypt_cex4_driver);
+}
+
+module_init(zcrypt_cex4_init);
+module_exit(zcrypt_cex4_exit);
diff --git a/drivers/s390/crypto/zcrypt_cex4.h b/drivers/s390/crypto/zcrypt_cex4.h
new file mode 100644
index 000000000000..719571375ccc
--- /dev/null
+++ b/drivers/s390/crypto/zcrypt_cex4.h
@@ -0,0 +1,12 @@
+/*
+ *  Copyright IBM Corp. 2012
+ *  Author(s): Holger Dengler <hd@linux.vnet.ibm.com>
+ */
+
+#ifndef _ZCRYPT_CEX4_H_
+#define _ZCRYPT_CEX4_H_
+
+int zcrypt_cex4_init(void);
+void zcrypt_cex4_exit(void);
+
+#endif /* _ZCRYPT_CEX4_H_ */
diff --git a/drivers/s390/crypto/zcrypt_debug.h b/drivers/s390/crypto/zcrypt_debug.h
new file mode 100644
index 000000000000..841ea72e4a4e
--- /dev/null
+++ b/drivers/s390/crypto/zcrypt_debug.h
@@ -0,0 +1,59 @@
+/*
+ *  Copyright IBM Corp. 2012
+ *  Author(s): Holger Dengler (hd@linux.vnet.ibm.com)
+ */
+#ifndef ZCRYPT_DEBUG_H
+#define ZCRYPT_DEBUG_H
+
+#include <asm/debug.h>
+#include "zcrypt_api.h"
+
+/* that gives us 15 characters in the text event views */
+#define ZCRYPT_DBF_LEN  16
+
+/* sort out low debug levels early to avoid wasted sprints */
+static inline int zcrypt_dbf_passes(debug_info_t *dbf_grp, int level)
+{
+        return (level <= dbf_grp->level);
+}
+
+#define DBF_ERR         3       /* error conditions     */
+#define DBF_WARN        4       /* warning conditions   */
+#define DBF_INFO        6       /* informational        */
+
+#define RC2WARN(rc) ((rc) ? DBF_WARN : DBF_INFO)
+
+#define ZCRYPT_DBF_COMMON(level, text...) \
+        do { \
+                if (zcrypt_dbf_passes(zcrypt_dbf_common, level)) { \
+                        char debug_buffer[ZCRYPT_DBF_LEN]; \
+                        snprintf(debug_buffer, ZCRYPT_DBF_LEN, text); \
+                        debug_text_event(zcrypt_dbf_common, level, \
+                                         debug_buffer); \
+                } \
+        } while (0)
+
+#define ZCRYPT_DBF_DEVICES(level, text...) \
+        do { \
+                if (zcrypt_dbf_passes(zcrypt_dbf_devices, level)) { \
+                        char debug_buffer[ZCRYPT_DBF_LEN]; \
+                        snprintf(debug_buffer, ZCRYPT_DBF_LEN, text); \
+                        debug_text_event(zcrypt_dbf_devices, level, \
+                                         debug_buffer); \
+                } \
+        } while (0)
+
+#define ZCRYPT_DBF_DEV(level, device, text...) \
+        do { \
+                if (zcrypt_dbf_passes(device->dbf_area, level)) { \
+                        char debug_buffer[ZCRYPT_DBF_LEN]; \
+                        snprintf(debug_buffer, ZCRYPT_DBF_LEN, text); \
+                        debug_text_event(device->dbf_area, level, \
+                                         debug_buffer); \
+                } \
+        } while (0)
+
+int zcrypt_debug_init(void);
+void zcrypt_debug_exit(void);
+
+#endif /* ZCRYPT_DEBUG_H */
diff --git a/drivers/s390/crypto/zcrypt_error.h b/drivers/s390/crypto/zcrypt_error.h
index 0965e2626d18..0079b6617211 100644
--- a/drivers/s390/crypto/zcrypt_error.h
+++ b/drivers/s390/crypto/zcrypt_error.h
@@ -26,6 +26,8 @@
 #ifndef _ZCRYPT_ERROR_H_
 #define _ZCRYPT_ERROR_H_
 
+#include <linux/atomic.h>
+#include "zcrypt_debug.h"
 #include "zcrypt_api.h"
 
 /**
@@ -108,16 +110,27 @@ static inline int convert_error(struct zcrypt_device *zdev,
                  * and then repeat the request.
                  */
                 WARN_ON(1);
+                atomic_set(&zcrypt_rescan_req, 1);
                 zdev->online = 0;
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
+                               zdev->ap_dev->qid,
+                               zdev->online, ehdr->reply_code);
                 return -EAGAIN;
         case REP82_ERROR_TRANSPORT_FAIL:
         case REP82_ERROR_MACHINE_FAILURE:
         //   REP88_ERROR_MODULE_FAILURE         // '10' CEX2A
                 /* If a card fails disable it and repeat the request. */
+                atomic_set(&zcrypt_rescan_req, 1);
                 zdev->online = 0;
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
+                               zdev->ap_dev->qid,
+                               zdev->online, ehdr->reply_code);
                 return -EAGAIN;
         default:
                 zdev->online = 0;
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
+                               zdev->ap_dev->qid,
+                               zdev->online, ehdr->reply_code);
                 return -EAGAIN; /* repeat the request on a different device. */
         }
 }
diff --git a/drivers/s390/crypto/zcrypt_msgtype50.c b/drivers/s390/crypto/zcrypt_msgtype50.c
new file mode 100644
index 000000000000..035b6dc31b71
--- /dev/null
+++ b/drivers/s390/crypto/zcrypt_msgtype50.c
@@ -0,0 +1,531 @@
+/*
+ *  zcrypt 2.1.0
+ *
+ *  Copyright IBM Corp. 2001, 2012
+ *  Author(s): Robert Burroughs
+ *             Eric Rossman (edrossma@us.ibm.com)
+ *
+ *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
+ *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
+ *                                Ralph Wuerthner <rwuerthn@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/init.h>
+#include <linux/err.h>
+#include <linux/atomic.h>
+#include <linux/uaccess.h>
+
+#include "ap_bus.h"
+#include "zcrypt_api.h"
+#include "zcrypt_error.h"
+#include "zcrypt_msgtype50.h"
+
+#define CEX3A_MAX_MOD_SIZE      512     /* 4096 bits    */
+
+#define CEX2A_MAX_RESPONSE_SIZE 0x110   /* max outputdatalength + type80_hdr */
+
+#define CEX3A_MAX_RESPONSE_SIZE 0x210   /* 512 bit modulus
+                                         * (max outputdatalength) +
+                                         * type80_hdr*/
+
+MODULE_AUTHOR("IBM Corporation");
+MODULE_DESCRIPTION("Cryptographic Accelerator (message type 50), " \
+                   "Copyright IBM Corp. 2001, 2012");
+MODULE_LICENSE("GPL");
+
+static void zcrypt_cex2a_receive(struct ap_device *, struct ap_message *,
+                                 struct ap_message *);
+
+/**
+ * The type 50 message family is associated with a CEX2A card.
+ *
+ * The four members of the family are described below.
+ *
+ * Note that all unsigned char arrays are right-justified and left-padded
+ * with zeroes.
+ *
+ * Note that all reserved fields must be zeroes.
+ */
+struct type50_hdr {
+        unsigned char   reserved1;
+        unsigned char   msg_type_code;  /* 0x50 */
+        unsigned short  msg_len;
+        unsigned char   reserved2;
+        unsigned char   ignored;
+        unsigned short  reserved3;
+} __packed;
+
+#define TYPE50_TYPE_CODE        0x50
+
+#define TYPE50_MEB1_FMT         0x0001
+#define TYPE50_MEB2_FMT         0x0002
+#define TYPE50_MEB3_FMT         0x0003
+#define TYPE50_CRB1_FMT         0x0011
+#define TYPE50_CRB2_FMT         0x0012
+#define TYPE50_CRB3_FMT         0x0013
+
+/* Mod-Exp, with a small modulus */
+struct type50_meb1_msg {
+        struct type50_hdr header;
+        unsigned short  keyblock_type;  /* 0x0001 */
+        unsigned char   reserved[6];
+        unsigned char   exponent[128];
+        unsigned char   modulus[128];
+        unsigned char   message[128];
+} __packed;
+
+/* Mod-Exp, with a large modulus */
+struct type50_meb2_msg {
+        struct type50_hdr header;
+        unsigned short  keyblock_type;  /* 0x0002 */
+        unsigned char   reserved[6];
+        unsigned char   exponent[256];
+        unsigned char   modulus[256];
+        unsigned char   message[256];
+} __packed;
+
+/* Mod-Exp, with a larger modulus */
+struct type50_meb3_msg {
+        struct type50_hdr header;
+        unsigned short  keyblock_type;  /* 0x0003 */
+        unsigned char   reserved[6];
+        unsigned char   exponent[512];
+        unsigned char   modulus[512];
+        unsigned char   message[512];
+} __packed;
+
+/* CRT, with a small modulus */
+struct type50_crb1_msg {
+        struct type50_hdr header;
+        unsigned short  keyblock_type;  /* 0x0011 */
+        unsigned char   reserved[6];
+        unsigned char   p[64];
+        unsigned char   q[64];
+        unsigned char   dp[64];
+        unsigned char   dq[64];
+        unsigned char   u[64];
+        unsigned char   message[128];
+} __packed;
+
+/* CRT, with a large modulus */
+struct type50_crb2_msg {
+        struct type50_hdr header;
+        unsigned short  keyblock_type;  /* 0x0012 */
+        unsigned char   reserved[6];
+        unsigned char   p[128];
+        unsigned char   q[128];
+        unsigned char   dp[128];
+        unsigned char   dq[128];
+        unsigned char   u[128];
+        unsigned char   message[256];
+} __packed;
+
+/* CRT, with a larger modulus */
+struct type50_crb3_msg {
+        struct type50_hdr header;
+        unsigned short  keyblock_type;  /* 0x0013 */
+        unsigned char   reserved[6];
+        unsigned char   p[256];
+        unsigned char   q[256];
+        unsigned char   dp[256];
+        unsigned char   dq[256];
+        unsigned char   u[256];
+        unsigned char   message[512];
+} __packed;
+
+/**
+ * The type 80 response family is associated with a CEX2A card.
+ *
+ * Note that all unsigned char arrays are right-justified and left-padded
+ * with zeroes.
+ *
+ * Note that all reserved fields must be zeroes.
+ */
+
+#define TYPE80_RSP_CODE 0x80
+
+struct type80_hdr {
+        unsigned char   reserved1;
+        unsigned char   type;           /* 0x80 */
+        unsigned short  len;
+        unsigned char   code;           /* 0x00 */
+        unsigned char   reserved2[3];
+        unsigned char   reserved3[8];
+} __packed;
+
+/**
+ * Convert a ICAMEX message to a type50 MEX message.
+ *
+ * @zdev: crypto device pointer
+ * @zreq: crypto request pointer
+ * @mex: pointer to user input data
+ *
+ * Returns 0 on success or -EFAULT.
+ */
+static int ICAMEX_msg_to_type50MEX_msg(struct zcrypt_device *zdev,
+                                       struct ap_message *ap_msg,
+                                       struct ica_rsa_modexpo *mex)
+{
+        unsigned char *mod, *exp, *inp;
+        int mod_len;
+
+        mod_len = mex->inputdatalength;
+
+        if (mod_len <= 128) {
+                struct type50_meb1_msg *meb1 = ap_msg->message;
+                memset(meb1, 0, sizeof(*meb1));
+                ap_msg->length = sizeof(*meb1);
+                meb1->header.msg_type_code = TYPE50_TYPE_CODE;
+                meb1->header.msg_len = sizeof(*meb1);
+                meb1->keyblock_type = TYPE50_MEB1_FMT;
+                mod = meb1->modulus + sizeof(meb1->modulus) - mod_len;
+                exp = meb1->exponent + sizeof(meb1->exponent) - mod_len;
+                inp = meb1->message + sizeof(meb1->message) - mod_len;
+        } else if (mod_len <= 256) {
+                struct type50_meb2_msg *meb2 = ap_msg->message;
+                memset(meb2, 0, sizeof(*meb2));
+                ap_msg->length = sizeof(*meb2);
+                meb2->header.msg_type_code = TYPE50_TYPE_CODE;
+                meb2->header.msg_len = sizeof(*meb2);
+                meb2->keyblock_type = TYPE50_MEB2_FMT;
+                mod = meb2->modulus + sizeof(meb2->modulus) - mod_len;
+                exp = meb2->exponent + sizeof(meb2->exponent) - mod_len;
+                inp = meb2->message + sizeof(meb2->message) - mod_len;
+        } else {
+                /* mod_len > 256 = 4096 bit RSA Key */
+                struct type50_meb3_msg *meb3 = ap_msg->message;
+                memset(meb3, 0, sizeof(*meb3));
+                ap_msg->length = sizeof(*meb3);
+                meb3->header.msg_type_code = TYPE50_TYPE_CODE;
+                meb3->header.msg_len = sizeof(*meb3);
+                meb3->keyblock_type = TYPE50_MEB3_FMT;
+                mod = meb3->modulus + sizeof(meb3->modulus) - mod_len;
+                exp = meb3->exponent + sizeof(meb3->exponent) - mod_len;
+                inp = meb3->message + sizeof(meb3->message) - mod_len;
+        }
+
+        if (copy_from_user(mod, mex->n_modulus, mod_len) ||
+            copy_from_user(exp, mex->b_key, mod_len) ||
+            copy_from_user(inp, mex->inputdata, mod_len))
+                return -EFAULT;
+        return 0;
+}
+
+/**
+ * Convert a ICACRT message to a type50 CRT message.
+ *
+ * @zdev: crypto device pointer
+ * @zreq: crypto request pointer
+ * @crt: pointer to user input data
+ *
+ * Returns 0 on success or -EFAULT.
+ */
+static int ICACRT_msg_to_type50CRT_msg(struct zcrypt_device *zdev,
+                                       struct ap_message *ap_msg,
+                                       struct ica_rsa_modexpo_crt *crt)
+{
+        int mod_len, short_len, long_len, long_offset, limit;
+        unsigned char *p, *q, *dp, *dq, *u, *inp;
+
+        mod_len = crt->inputdatalength;
+        short_len = mod_len / 2;
+        long_len = mod_len / 2 + 8;
+
+        /*
+         * CEX2A cannot handle p, dp, or U > 128 bytes.
+         * If we have one of these, we need to do extra checking.
+         * For CEX3A the limit is 256 bytes.
+         */
+        if (zdev->max_mod_size == CEX3A_MAX_MOD_SIZE)
+                limit = 256;
+        else
+                limit = 128;
+
+        if (long_len > limit) {
+                /*
+                 * zcrypt_rsa_crt already checked for the leading
+                 * zeroes of np_prime, bp_key and u_mult_inc.
+                 */
+                long_offset = long_len - limit;
+                long_len = limit;
+        } else
+                long_offset = 0;
+
+        /*
+         * Instead of doing extra work for p, dp, U > 64 bytes, we'll just use
+         * the larger message structure.
+         */
+        if (long_len <= 64) {
+                struct type50_crb1_msg *crb1 = ap_msg->message;
+                memset(crb1, 0, sizeof(*crb1));
+                ap_msg->length = sizeof(*crb1);
+                crb1->header.msg_type_code = TYPE50_TYPE_CODE;
+                crb1->header.msg_len = sizeof(*crb1);
+                crb1->keyblock_type = TYPE50_CRB1_FMT;
+                p = crb1->p + sizeof(crb1->p) - long_len;
+                q = crb1->q + sizeof(crb1->q) - short_len;
+                dp = crb1->dp + sizeof(crb1->dp) - long_len;
+                dq = crb1->dq + sizeof(crb1->dq) - short_len;
+                u = crb1->u + sizeof(crb1->u) - long_len;
+                inp = crb1->message + sizeof(crb1->message) - mod_len;
+        } else if (long_len <= 128) {
+                struct type50_crb2_msg *crb2 = ap_msg->message;
+                memset(crb2, 0, sizeof(*crb2));
+                ap_msg->length = sizeof(*crb2);
+                crb2->header.msg_type_code = TYPE50_TYPE_CODE;
+                crb2->header.msg_len = sizeof(*crb2);
+                crb2->keyblock_type = TYPE50_CRB2_FMT;
+                p = crb2->p + sizeof(crb2->p) - long_len;
+                q = crb2->q + sizeof(crb2->q) - short_len;
+                dp = crb2->dp + sizeof(crb2->dp) - long_len;
+                dq = crb2->dq + sizeof(crb2->dq) - short_len;
+                u = crb2->u + sizeof(crb2->u) - long_len;
+                inp = crb2->message + sizeof(crb2->message) - mod_len;
+        } else {
+                /* long_len >= 256 */
+                struct type50_crb3_msg *crb3 = ap_msg->message;
+                memset(crb3, 0, sizeof(*crb3));
+                ap_msg->length = sizeof(*crb3);
+                crb3->header.msg_type_code = TYPE50_TYPE_CODE;
+                crb3->header.msg_len = sizeof(*crb3);
+                crb3->keyblock_type = TYPE50_CRB3_FMT;
+                p = crb3->p + sizeof(crb3->p) - long_len;
+                q = crb3->q + sizeof(crb3->q) - short_len;
+                dp = crb3->dp + sizeof(crb3->dp) - long_len;
+                dq = crb3->dq + sizeof(crb3->dq) - short_len;
+                u = crb3->u + sizeof(crb3->u) - long_len;
+                inp = crb3->message + sizeof(crb3->message) - mod_len;
+        }
+
+        if (copy_from_user(p, crt->np_prime + long_offset, long_len) ||
+            copy_from_user(q, crt->nq_prime, short_len) ||
+            copy_from_user(dp, crt->bp_key + long_offset, long_len) ||
+            copy_from_user(dq, crt->bq_key, short_len) ||
+            copy_from_user(u, crt->u_mult_inv + long_offset, long_len) ||
+            copy_from_user(inp, crt->inputdata, mod_len))
+                return -EFAULT;
+
+        return 0;
+}
+
+/**
+ * Copy results from a type 80 reply message back to user space.
+ *
+ * @zdev: crypto device pointer
+ * @reply: reply AP message.
+ * @data: pointer to user output data
+ * @length: size of user output data
+ *
+ * Returns 0 on success or -EFAULT.
+ */
+static int convert_type80(struct zcrypt_device *zdev,
+                          struct ap_message *reply,
+                          char __user *outputdata,
+                          unsigned int outputdatalength)
+{
+        struct type80_hdr *t80h = reply->message;
+        unsigned char *data;
+
+        if (t80h->len < sizeof(*t80h) + outputdatalength) {
+                /* The result is too short, the CEX2A card may not do that.. */
+                zdev->online = 0;
+                return -EAGAIN; /* repeat the request on a different device. */
+        }
+        if (zdev->user_space_type == ZCRYPT_CEX2A)
+                BUG_ON(t80h->len > CEX2A_MAX_RESPONSE_SIZE);
+        else
+                BUG_ON(t80h->len > CEX3A_MAX_RESPONSE_SIZE);
+        data = reply->message + t80h->len - outputdatalength;
+        if (copy_to_user(outputdata, data, outputdatalength))
+                return -EFAULT;
+        return 0;
+}
+
+static int convert_response(struct zcrypt_device *zdev,
+                            struct ap_message *reply,
+                            char __user *outputdata,
+                            unsigned int outputdatalength)
+{
+        /* Response type byte is the second byte in the response. */
+        switch (((unsigned char *) reply->message)[1]) {
+        case TYPE82_RSP_CODE:
+        case TYPE88_RSP_CODE:
+                return convert_error(zdev, reply);
+        case TYPE80_RSP_CODE:
+                return convert_type80(zdev, reply,
+                                      outputdata, outputdatalength);
+        default: /* Unknown response type, this should NEVER EVER happen */
+                zdev->online = 0;
+                return -EAGAIN; /* repeat the request on a different device. */
+        }
+}
+
+/**
+ * This function is called from the AP bus code after a crypto request
+ * "msg" has finished with the reply message "reply".
+ * It is called from tasklet context.
+ * @ap_dev: pointer to the AP device
+ * @msg: pointer to the AP message
+ * @reply: pointer to the AP reply message
+ */
+static void zcrypt_cex2a_receive(struct ap_device *ap_dev,
+                                 struct ap_message *msg,
+                                 struct ap_message *reply)
+{
+        static struct error_hdr error_reply = {
+                .type = TYPE82_RSP_CODE,
+                .reply_code = REP82_ERROR_MACHINE_FAILURE,
+        };
+        struct type80_hdr *t80h;
+        int length;
+
+        /* Copy the reply message to the request message buffer. */
+        if (IS_ERR(reply)) {
+                memcpy(msg->message, &error_reply, sizeof(error_reply));
+                goto out;
+        }
+        t80h = reply->message;
+        if (t80h->type == TYPE80_RSP_CODE) {
+                if (ap_dev->device_type == AP_DEVICE_TYPE_CEX2A)
+                        length = min_t(int,
+                                       CEX2A_MAX_RESPONSE_SIZE, t80h->len);
+                else
+                        length = min_t(int,
+                                       CEX3A_MAX_RESPONSE_SIZE, t80h->len);
+                memcpy(msg->message, reply->message, length);
+        } else
+                memcpy(msg->message, reply->message, sizeof(error_reply));
+out:
+        complete((struct completion *) msg->private);
+}
+
+static atomic_t zcrypt_step = ATOMIC_INIT(0);
+
+/**
+ * The request distributor calls this function if it picked the CEX2A
+ * device to handle a modexpo request.
+ * @zdev: pointer to zcrypt_device structure that identifies the
+ *        CEX2A device to the request distributor
+ * @mex: pointer to the modexpo request buffer
+ */
+static long zcrypt_cex2a_modexpo(struct zcrypt_device *zdev,
+                                 struct ica_rsa_modexpo *mex)
+{
+        struct ap_message ap_msg;
+        struct completion work;
+        int rc;
+
+        ap_init_message(&ap_msg);
+        if (zdev->user_space_type == ZCRYPT_CEX2A)
+                ap_msg.message = kmalloc(MSGTYPE50_CRB2_MAX_MSG_SIZE,
+                                         GFP_KERNEL);
+        else
+                ap_msg.message = kmalloc(MSGTYPE50_CRB3_MAX_MSG_SIZE,
+                                         GFP_KERNEL);
+        if (!ap_msg.message)
+                return -ENOMEM;
+        ap_msg.receive = zcrypt_cex2a_receive;
+        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
+                                atomic_inc_return(&zcrypt_step);
+        ap_msg.private = &work;
+        rc = ICAMEX_msg_to_type50MEX_msg(zdev, &ap_msg, mex);
+        if (rc)
+                goto out_free;
+        init_completion(&work);
+        ap_queue_message(zdev->ap_dev, &ap_msg);
+        rc = wait_for_completion_interruptible(&work);
+        if (rc == 0)
+                rc = convert_response(zdev, &ap_msg, mex->outputdata,
+                                      mex->outputdatalength);
+        else
+                /* Signal pending. */
+                ap_cancel_message(zdev->ap_dev, &ap_msg);
+out_free:
+        kfree(ap_msg.message);
+        return rc;
+}
+
+/**
+ * The request distributor calls this function if it picked the CEX2A
+ * device to handle a modexpo_crt request.
+ * @zdev: pointer to zcrypt_device structure that identifies the
+ *        CEX2A device to the request distributor
+ * @crt: pointer to the modexpoc_crt request buffer
+ */
+static long zcrypt_cex2a_modexpo_crt(struct zcrypt_device *zdev,
+                                     struct ica_rsa_modexpo_crt *crt)
+{
+        struct ap_message ap_msg;
+        struct completion work;
+        int rc;
+
+        ap_init_message(&ap_msg);
+        if (zdev->user_space_type == ZCRYPT_CEX2A)
+                ap_msg.message = kmalloc(MSGTYPE50_CRB2_MAX_MSG_SIZE,
+                                         GFP_KERNEL);
+        else
+                ap_msg.message = kmalloc(MSGTYPE50_CRB3_MAX_MSG_SIZE,
+                                         GFP_KERNEL);
+        if (!ap_msg.message)
+                return -ENOMEM;
+        ap_msg.receive = zcrypt_cex2a_receive;
+        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
+                                atomic_inc_return(&zcrypt_step);
+        ap_msg.private = &work;
+        rc = ICACRT_msg_to_type50CRT_msg(zdev, &ap_msg, crt);
+        if (rc)
+                goto out_free;
+        init_completion(&work);
+        ap_queue_message(zdev->ap_dev, &ap_msg);
+        rc = wait_for_completion_interruptible(&work);
+        if (rc == 0)
+                rc = convert_response(zdev, &ap_msg, crt->outputdata,
+                                      crt->outputdatalength);
+        else
+                /* Signal pending. */
+                ap_cancel_message(zdev->ap_dev, &ap_msg);
+out_free:
+        kfree(ap_msg.message);
+        return rc;
+}
+
+/**
+ * The crypto operations for message type 50.
+ */
+static struct zcrypt_ops zcrypt_msgtype50_ops = {
+        .rsa_modexpo = zcrypt_cex2a_modexpo,
+        .rsa_modexpo_crt = zcrypt_cex2a_modexpo_crt,
+        .owner = THIS_MODULE,
+        .variant = MSGTYPE50_VARIANT_DEFAULT,
+};
+
+int __init zcrypt_msgtype50_init(void)
+{
+        zcrypt_msgtype_register(&zcrypt_msgtype50_ops);
+        return 0;
+}
+
+void __exit zcrypt_msgtype50_exit(void)
+{
+        zcrypt_msgtype_unregister(&zcrypt_msgtype50_ops);
+}
+
+module_init(zcrypt_msgtype50_init);
+module_exit(zcrypt_msgtype50_exit);
diff --git a/drivers/s390/crypto/zcrypt_msgtype50.h b/drivers/s390/crypto/zcrypt_msgtype50.h
new file mode 100644
index 000000000000..e56dc72c7733
--- /dev/null
+++ b/drivers/s390/crypto/zcrypt_msgtype50.h
@@ -0,0 +1,39 @@
+/*
+ *  zcrypt 2.1.0
+ *
+ *  Copyright IBM Corp. 2001, 2012
+ *  Author(s): Robert Burroughs
+ *             Eric Rossman (edrossma@us.ibm.com)
+ *
+ *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
+ *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef _ZCRYPT_MSGTYPE50_H_
+#define _ZCRYPT_MSGTYPE50_H_
+
+#define MSGTYPE50_NAME                  "zcrypt_msgtype50"
+#define MSGTYPE50_VARIANT_DEFAULT       0
+
+#define MSGTYPE50_CRB2_MAX_MSG_SIZE     0x390 /*sizeof(struct type50_crb2_msg)*/
+#define MSGTYPE50_CRB3_MAX_MSG_SIZE     0x710 /*sizeof(struct type50_crb3_msg)*/
+
+int zcrypt_msgtype50_init(void);
+void zcrypt_msgtype50_exit(void);
+
+#endif /* _ZCRYPT_MSGTYPE50_H_ */
diff --git a/drivers/s390/crypto/zcrypt_msgtype6.c b/drivers/s390/crypto/zcrypt_msgtype6.c
new file mode 100644
index 000000000000..7d97fa5a26d0
--- /dev/null
+++ b/drivers/s390/crypto/zcrypt_msgtype6.c
@@ -0,0 +1,856 @@
+/*
+ *  zcrypt 2.1.0
+ *
+ *  Copyright IBM Corp. 2001, 2012
+ *  Author(s): Robert Burroughs
+ *             Eric Rossman (edrossma@us.ibm.com)
+ *
+ *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
+ *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
+ *                                Ralph Wuerthner <rwuerthn@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/err.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/atomic.h>
+#include <linux/uaccess.h>
+
+#include "ap_bus.h"
+#include "zcrypt_api.h"
+#include "zcrypt_error.h"
+#include "zcrypt_msgtype6.h"
+#include "zcrypt_cca_key.h"
+
+#define PCIXCC_MIN_MOD_SIZE_OLD  64     /*  512 bits    */
+#define PCIXCC_MAX_ICA_RESPONSE_SIZE 0x77c /* max size type86 v2 reply      */
+
+#define CEIL4(x) ((((x)+3)/4)*4)
+
+struct response_type {
+        struct completion work;
+        int type;
+};
+#define PCIXCC_RESPONSE_TYPE_ICA  0
+#define PCIXCC_RESPONSE_TYPE_XCRB 1
+
+MODULE_AUTHOR("IBM Corporation");
+MODULE_DESCRIPTION("Cryptographic Coprocessor (message type 6), " \
+                   "Copyright IBM Corp. 2001, 2012");
+MODULE_LICENSE("GPL");
+
+static void zcrypt_msgtype6_receive(struct ap_device *, struct ap_message *,
+                                 struct ap_message *);
+
+/**
+ * CPRB
+ *        Note that all shorts, ints and longs are little-endian.
+ *        All pointer fields are 32-bits long, and mean nothing
+ *
+ *        A request CPRB is followed by a request_parameter_block.
+ *
+ *        The request (or reply) parameter block is organized thus:
+ *          function code
+ *          VUD block
+ *          key block
+ */
+struct CPRB {
+        unsigned short cprb_len;        /* CPRB length                   */
+        unsigned char cprb_ver_id;      /* CPRB version id.              */
+        unsigned char pad_000;          /* Alignment pad byte.           */
+        unsigned char srpi_rtcode[4];   /* SRPI return code LELONG       */
+        unsigned char srpi_verb;        /* SRPI verb type                */
+        unsigned char flags;            /* flags                         */
+        unsigned char func_id[2];       /* function id                   */
+        unsigned char checkpoint_flag;  /*                               */
+        unsigned char resv2;            /* reserved                      */
+        unsigned short req_parml;       /* request parameter buffer      */
+                                        /* length 16-bit little endian   */
+        unsigned char req_parmp[4];     /* request parameter buffer      *
+                                         * pointer (means nothing: the   *
+                                         * parameter buffer follows      *
+                                         * the CPRB).                    */
+        unsigned char req_datal[4];     /* request data buffer           */
+                                        /* length         ULELONG        */
+        unsigned char req_datap[4];     /* request data buffer           */
+                                        /* pointer                       */
+        unsigned short rpl_parml;       /* reply  parameter buffer       */
+                                        /* length 16-bit little endian   */
+        unsigned char pad_001[2];       /* Alignment pad bytes. ULESHORT */
+        unsigned char rpl_parmp[4];     /* reply parameter buffer        *
+                                         * pointer (means nothing: the   *
+                                         * parameter buffer follows      *
+                                         * the CPRB).                    */
+        unsigned char rpl_datal[4];     /* reply data buffer len ULELONG */
+        unsigned char rpl_datap[4];     /* reply data buffer             */
+                                        /* pointer                       */
+        unsigned short ccp_rscode;      /* server reason code   ULESHORT */
+        unsigned short ccp_rtcode;      /* server return code   ULESHORT */
+        unsigned char repd_parml[2];    /* replied parameter len ULESHORT*/
+        unsigned char mac_data_len[2];  /* Mac Data Length      ULESHORT */
+        unsigned char repd_datal[4];    /* replied data length  ULELONG  */
+        unsigned char req_pc[2];        /* PC identifier                 */
+        unsigned char res_origin[8];    /* resource origin               */
+        unsigned char mac_value[8];     /* Mac Value                     */
+        unsigned char logon_id[8];      /* Logon Identifier              */
+        unsigned char usage_domain[2];  /* cdx                           */
+        unsigned char resv3[18];        /* reserved for requestor        */
+        unsigned short svr_namel;       /* server name length  ULESHORT  */
+        unsigned char svr_name[8];      /* server name                   */
+} __packed;
+
+struct function_and_rules_block {
+        unsigned char function_code[2];
+        unsigned short ulen;
+        unsigned char only_rule[8];
+} __packed;
+
+/**
+ * The following is used to initialize the CPRBX passed to the PCIXCC/CEX2C
+ * card in a type6 message. The 3 fields that must be filled in at execution
+ * time are  req_parml, rpl_parml and usage_domain.
+ * Everything about this interface is ascii/big-endian, since the
+ * device does *not* have 'Intel inside'.
+ *
+ * The CPRBX is followed immediately by the parm block.
+ * The parm block contains:
+ * - function code ('PD' 0x5044 or 'PK' 0x504B)
+ * - rule block (one of:)
+ *   + 0x000A 'PKCS-1.2' (MCL2 'PD')
+ *   + 0x000A 'ZERO-PAD' (MCL2 'PK')
+ *   + 0x000A 'ZERO-PAD' (MCL3 'PD' or CEX2C 'PD')
+ *   + 0x000A 'MRP     ' (MCL3 'PK' or CEX2C 'PK')
+ * - VUD block
+ */
+static struct CPRBX static_cprbx = {
+        .cprb_len       =  0x00DC,
+        .cprb_ver_id    =  0x02,
+        .func_id        = {0x54, 0x32},
+};
+
+/**
+ * Convert a ICAMEX message to a type6 MEX message.
+ *
+ * @zdev: crypto device pointer
+ * @ap_msg: pointer to AP message
+ * @mex: pointer to user input data
+ *
+ * Returns 0 on success or -EFAULT.
+ */
+static int ICAMEX_msg_to_type6MEX_msgX(struct zcrypt_device *zdev,
+                                       struct ap_message *ap_msg,
+                                       struct ica_rsa_modexpo *mex)
+{
+        static struct type6_hdr static_type6_hdrX = {
+                .type           =  0x06,
+                .offset1        =  0x00000058,
+                .agent_id       = {'C', 'A',},
+                .function_code  = {'P', 'K'},
+        };
+        static struct function_and_rules_block static_pke_fnr = {
+                .function_code  = {'P', 'K'},
+                .ulen           = 10,
+                .only_rule      = {'M', 'R', 'P', ' ', ' ', ' ', ' ', ' '}
+        };
+        static struct function_and_rules_block static_pke_fnr_MCL2 = {
+                .function_code  = {'P', 'K'},
+                .ulen           = 10,
+                .only_rule      = {'Z', 'E', 'R', 'O', '-', 'P', 'A', 'D'}
+        };
+        struct {
+                struct type6_hdr hdr;
+                struct CPRBX cprbx;
+                struct function_and_rules_block fr;
+                unsigned short length;
+                char text[0];
+        } __packed * msg = ap_msg->message;
+        int size;
+
+        /* VUD.ciphertext */
+        msg->length = mex->inputdatalength + 2;
+        if (copy_from_user(msg->text, mex->inputdata, mex->inputdatalength))
+                return -EFAULT;
+
+        /* Set up key which is located after the variable length text. */
+        size = zcrypt_type6_mex_key_en(mex, msg->text+mex->inputdatalength, 1);
+        if (size < 0)
+                return size;
+        size += sizeof(*msg) + mex->inputdatalength;
+
+        /* message header, cprbx and f&r */
+        msg->hdr = static_type6_hdrX;
+        msg->hdr.ToCardLen1 = size - sizeof(msg->hdr);
+        msg->hdr.FromCardLen1 = PCIXCC_MAX_ICA_RESPONSE_SIZE - sizeof(msg->hdr);
+
+        msg->cprbx = static_cprbx;
+        msg->cprbx.domain = AP_QID_QUEUE(zdev->ap_dev->qid);
+        msg->cprbx.rpl_msgbl = msg->hdr.FromCardLen1;
+
+        msg->fr = (zdev->user_space_type == ZCRYPT_PCIXCC_MCL2) ?
+                static_pke_fnr_MCL2 : static_pke_fnr;
+
+        msg->cprbx.req_parml = size - sizeof(msg->hdr) - sizeof(msg->cprbx);
+
+        ap_msg->length = size;
+        return 0;
+}
+
+/**
+ * Convert a ICACRT message to a type6 CRT message.
+ *
+ * @zdev: crypto device pointer
+ * @ap_msg: pointer to AP message
+ * @crt: pointer to user input data
+ *
+ * Returns 0 on success or -EFAULT.
+ */
+static int ICACRT_msg_to_type6CRT_msgX(struct zcrypt_device *zdev,
+                                       struct ap_message *ap_msg,
+                                       struct ica_rsa_modexpo_crt *crt)
+{
+        static struct type6_hdr static_type6_hdrX = {
+                .type           =  0x06,
+                .offset1        =  0x00000058,
+                .agent_id       = {'C', 'A',},
+                .function_code  = {'P', 'D'},
+        };
+        static struct function_and_rules_block static_pkd_fnr = {
+                .function_code  = {'P', 'D'},
+                .ulen           = 10,
+                .only_rule      = {'Z', 'E', 'R', 'O', '-', 'P', 'A', 'D'}
+        };
+
+        static struct function_and_rules_block static_pkd_fnr_MCL2 = {
+                .function_code  = {'P', 'D'},
+                .ulen           = 10,
+                .only_rule      = {'P', 'K', 'C', 'S', '-', '1', '.', '2'}
+        };
+        struct {
+                struct type6_hdr hdr;
+                struct CPRBX cprbx;
+                struct function_and_rules_block fr;
+                unsigned short length;
+                char text[0];
+        } __packed * msg = ap_msg->message;
+        int size;
+
+        /* VUD.ciphertext */
+        msg->length = crt->inputdatalength + 2;
+        if (copy_from_user(msg->text, crt->inputdata, crt->inputdatalength))
+                return -EFAULT;
+
+        /* Set up key which is located after the variable length text. */
+        size = zcrypt_type6_crt_key(crt, msg->text + crt->inputdatalength, 1);
+        if (size < 0)
+                return size;
+        size += sizeof(*msg) + crt->inputdatalength;    /* total size of msg */
+
+        /* message header, cprbx and f&r */
+        msg->hdr = static_type6_hdrX;
+        msg->hdr.ToCardLen1 = size -  sizeof(msg->hdr);
+        msg->hdr.FromCardLen1 = PCIXCC_MAX_ICA_RESPONSE_SIZE - sizeof(msg->hdr);
+
+        msg->cprbx = static_cprbx;
+        msg->cprbx.domain = AP_QID_QUEUE(zdev->ap_dev->qid);
+        msg->cprbx.req_parml = msg->cprbx.rpl_msgbl =
+                size - sizeof(msg->hdr) - sizeof(msg->cprbx);
+
+        msg->fr = (zdev->user_space_type == ZCRYPT_PCIXCC_MCL2) ?
+                static_pkd_fnr_MCL2 : static_pkd_fnr;
+
+        ap_msg->length = size;
+        return 0;
+}
+
+/**
+ * Convert a XCRB message to a type6 CPRB message.
+ *
+ * @zdev: crypto device pointer
+ * @ap_msg: pointer to AP message
+ * @xcRB: pointer to user input data
+ *
+ * Returns 0 on success or -EFAULT, -EINVAL.
+ */
+struct type86_fmt2_msg {
+        struct type86_hdr hdr;
+        struct type86_fmt2_ext fmt2;
+} __packed;
+
+static int XCRB_msg_to_type6CPRB_msgX(struct zcrypt_device *zdev,
+                                       struct ap_message *ap_msg,
+                                       struct ica_xcRB *xcRB)
+{
+        static struct type6_hdr static_type6_hdrX = {
+                .type           =  0x06,
+                .offset1        =  0x00000058,
+        };
+        struct {
+                struct type6_hdr hdr;
+                struct CPRBX cprbx;
+        } __packed * msg = ap_msg->message;
+
+        int rcblen = CEIL4(xcRB->request_control_blk_length);
+        int replylen;
+        char *req_data = ap_msg->message + sizeof(struct type6_hdr) + rcblen;
+        char *function_code;
+
+        /* length checks */
+        ap_msg->length = sizeof(struct type6_hdr) +
+                CEIL4(xcRB->request_control_blk_length) +
+                xcRB->request_data_length;
+        if (ap_msg->length > MSGTYPE06_MAX_MSG_SIZE)
+                return -EINVAL;
+        replylen = sizeof(struct type86_fmt2_msg) +
+                CEIL4(xcRB->reply_control_blk_length) +
+                xcRB->reply_data_length;
+        if (replylen > MSGTYPE06_MAX_MSG_SIZE)
+                return -EINVAL;
+
+        /* prepare type6 header */
+        msg->hdr = static_type6_hdrX;
+        memcpy(msg->hdr.agent_id , &(xcRB->agent_ID), sizeof(xcRB->agent_ID));
+        msg->hdr.ToCardLen1 = xcRB->request_control_blk_length;
+        if (xcRB->request_data_length) {
+                msg->hdr.offset2 = msg->hdr.offset1 + rcblen;
+                msg->hdr.ToCardLen2 = xcRB->request_data_length;
+        }
+        msg->hdr.FromCardLen1 = xcRB->reply_control_blk_length;
+        msg->hdr.FromCardLen2 = xcRB->reply_data_length;
+
+        /* prepare CPRB */
+        if (copy_from_user(&(msg->cprbx), xcRB->request_control_blk_addr,
+                    xcRB->request_control_blk_length))
+                return -EFAULT;
+        if (msg->cprbx.cprb_len + sizeof(msg->hdr.function_code) >
+            xcRB->request_control_blk_length)
+                return -EINVAL;
+        function_code = ((unsigned char *)&msg->cprbx) + msg->cprbx.cprb_len;
+        memcpy(msg->hdr.function_code, function_code,
+               sizeof(msg->hdr.function_code));
+
+        if (memcmp(function_code, "US", 2) == 0)
+                ap_msg->special = 1;
+        else
+                ap_msg->special = 0;
+
+        /* copy data block */
+        if (xcRB->request_data_length &&
+            copy_from_user(req_data, xcRB->request_data_address,
+                xcRB->request_data_length))
+                return -EFAULT;
+        return 0;
+}
+
+/**
+ * Copy results from a type 86 ICA reply message back to user space.
+ *
+ * @zdev: crypto device pointer
+ * @reply: reply AP message.
+ * @data: pointer to user output data
+ * @length: size of user output data
+ *
+ * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
+ */
+struct type86x_reply {
+        struct type86_hdr hdr;
+        struct type86_fmt2_ext fmt2;
+        struct CPRBX cprbx;
+        unsigned char pad[4];   /* 4 byte function code/rules block ? */
+        unsigned short length;
+        char text[0];
+} __packed;
+
+static int convert_type86_ica(struct zcrypt_device *zdev,
+                          struct ap_message *reply,
+                          char __user *outputdata,
+                          unsigned int outputdatalength)
+{
+        static unsigned char static_pad[] = {
+                0x00, 0x02,
+                0x1B, 0x7B, 0x5D, 0xB5, 0x75, 0x01, 0x3D, 0xFD,
+                0x8D, 0xD1, 0xC7, 0x03, 0x2D, 0x09, 0x23, 0x57,
+                0x89, 0x49, 0xB9, 0x3F, 0xBB, 0x99, 0x41, 0x5B,
+                0x75, 0x21, 0x7B, 0x9D, 0x3B, 0x6B, 0x51, 0x39,
+                0xBB, 0x0D, 0x35, 0xB9, 0x89, 0x0F, 0x93, 0xA5,
+                0x0B, 0x47, 0xF1, 0xD3, 0xBB, 0xCB, 0xF1, 0x9D,
+                0x23, 0x73, 0x71, 0xFF, 0xF3, 0xF5, 0x45, 0xFB,
+                0x61, 0x29, 0x23, 0xFD, 0xF1, 0x29, 0x3F, 0x7F,
+                0x17, 0xB7, 0x1B, 0xA9, 0x19, 0xBD, 0x57, 0xA9,
+                0xD7, 0x95, 0xA3, 0xCB, 0xED, 0x1D, 0xDB, 0x45,
+                0x7D, 0x11, 0xD1, 0x51, 0x1B, 0xED, 0x71, 0xE9,
+                0xB1, 0xD1, 0xAB, 0xAB, 0x21, 0x2B, 0x1B, 0x9F,
+                0x3B, 0x9F, 0xF7, 0xF7, 0xBD, 0x63, 0xEB, 0xAD,
+                0xDF, 0xB3, 0x6F, 0x5B, 0xDB, 0x8D, 0xA9, 0x5D,
+                0xE3, 0x7D, 0x77, 0x49, 0x47, 0xF5, 0xA7, 0xFD,
+                0xAB, 0x2F, 0x27, 0x35, 0x77, 0xD3, 0x49, 0xC9,
+                0x09, 0xEB, 0xB1, 0xF9, 0xBF, 0x4B, 0xCB, 0x2B,
+                0xEB, 0xEB, 0x05, 0xFF, 0x7D, 0xC7, 0x91, 0x8B,
+                0x09, 0x83, 0xB9, 0xB9, 0x69, 0x33, 0x39, 0x6B,
+                0x79, 0x75, 0x19, 0xBF, 0xBB, 0x07, 0x1D, 0xBD,
+                0x29, 0xBF, 0x39, 0x95, 0x93, 0x1D, 0x35, 0xC7,
+                0xC9, 0x4D, 0xE5, 0x97, 0x0B, 0x43, 0x9B, 0xF1,
+                0x16, 0x93, 0x03, 0x1F, 0xA5, 0xFB, 0xDB, 0xF3,
+                0x27, 0x4F, 0x27, 0x61, 0x05, 0x1F, 0xB9, 0x23,
+                0x2F, 0xC3, 0x81, 0xA9, 0x23, 0x71, 0x55, 0x55,
+                0xEB, 0xED, 0x41, 0xE5, 0xF3, 0x11, 0xF1, 0x43,
+                0x69, 0x03, 0xBD, 0x0B, 0x37, 0x0F, 0x51, 0x8F,
+                0x0B, 0xB5, 0x89, 0x5B, 0x67, 0xA9, 0xD9, 0x4F,
+                0x01, 0xF9, 0x21, 0x77, 0x37, 0x73, 0x79, 0xC5,
+                0x7F, 0x51, 0xC1, 0xCF, 0x97, 0xA1, 0x75, 0xAD,
+                0x35, 0x9D, 0xD3, 0xD3, 0xA7, 0x9D, 0x5D, 0x41,
+                0x6F, 0x65, 0x1B, 0xCF, 0xA9, 0x87, 0x91, 0x09
+        };
+        struct type86x_reply *msg = reply->message;
+        unsigned short service_rc, service_rs;
+        unsigned int reply_len, pad_len;
+        char *data;
+
+        service_rc = msg->cprbx.ccp_rtcode;
+        if (unlikely(service_rc != 0)) {
+                service_rs = msg->cprbx.ccp_rscode;
+                if (service_rc == 8 && service_rs == 66)
+                        return -EINVAL;
+                if (service_rc == 8 && service_rs == 65)
+                        return -EINVAL;
+                if (service_rc == 8 && service_rs == 770)
+                        return -EINVAL;
+                if (service_rc == 8 && service_rs == 783) {
+                        zdev->min_mod_size = PCIXCC_MIN_MOD_SIZE_OLD;
+                        return -EAGAIN;
+                }
+                if (service_rc == 12 && service_rs == 769)
+                        return -EINVAL;
+                if (service_rc == 8 && service_rs == 72)
+                        return -EINVAL;
+                zdev->online = 0;
+                return -EAGAIN; /* repeat the request on a different device. */
+        }
+        data = msg->text;
+        reply_len = msg->length - 2;
+        if (reply_len > outputdatalength)
+                return -EINVAL;
+        /*
+         * For all encipher requests, the length of the ciphertext (reply_len)
+         * will always equal the modulus length. For MEX decipher requests
+         * the output needs to get padded. Minimum pad size is 10.
+         *
+         * Currently, the cases where padding will be added is for:
+         * - PCIXCC_MCL2 using a CRT form token (since PKD didn't support
+         *   ZERO-PAD and CRT is only supported for PKD requests)
+         * - PCICC, always
+         */
+        pad_len = outputdatalength - reply_len;
+        if (pad_len > 0) {
+                if (pad_len < 10)
+                        return -EINVAL;
+                /* 'restore' padding left in the PCICC/PCIXCC card. */
+                if (copy_to_user(outputdata, static_pad, pad_len - 1))
+                        return -EFAULT;
+                if (put_user(0, outputdata + pad_len - 1))
+                        return -EFAULT;
+        }
+        /* Copy the crypto response to user space. */
+        if (copy_to_user(outputdata + pad_len, data, reply_len))
+                return -EFAULT;
+        return 0;
+}
+
+/**
+ * Copy results from a type 86 XCRB reply message back to user space.
+ *
+ * @zdev: crypto device pointer
+ * @reply: reply AP message.
+ * @xcRB: pointer to XCRB
+ *
+ * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
+ */
+static int convert_type86_xcrb(struct zcrypt_device *zdev,
+                               struct ap_message *reply,
+                               struct ica_xcRB *xcRB)
+{
+        struct type86_fmt2_msg *msg = reply->message;
+        char *data = reply->message;
+
+        /* Copy CPRB to user */
+        if (copy_to_user(xcRB->reply_control_blk_addr,
+                data + msg->fmt2.offset1, msg->fmt2.count1))
+                return -EFAULT;
+        xcRB->reply_control_blk_length = msg->fmt2.count1;
+
+        /* Copy data buffer to user */
+        if (msg->fmt2.count2)
+                if (copy_to_user(xcRB->reply_data_addr,
+                        data + msg->fmt2.offset2, msg->fmt2.count2))
+                        return -EFAULT;
+        xcRB->reply_data_length = msg->fmt2.count2;
+        return 0;
+}
+
+static int convert_type86_rng(struct zcrypt_device *zdev,
+                          struct ap_message *reply,
+                          char *buffer)
+{
+        struct {
+                struct type86_hdr hdr;
+                struct type86_fmt2_ext fmt2;
+                struct CPRBX cprbx;
+        } __packed * msg = reply->message;
+        char *data = reply->message;
+
+        if (msg->cprbx.ccp_rtcode != 0 || msg->cprbx.ccp_rscode != 0)
+                return -EINVAL;
+        memcpy(buffer, data + msg->fmt2.offset2, msg->fmt2.count2);
+        return msg->fmt2.count2;
+}
+
+static int convert_response_ica(struct zcrypt_device *zdev,
+                            struct ap_message *reply,
+                            char __user *outputdata,
+                            unsigned int outputdatalength)
+{
+        struct type86x_reply *msg = reply->message;
+
+        /* Response type byte is the second byte in the response. */
+        switch (((unsigned char *) reply->message)[1]) {
+        case TYPE82_RSP_CODE:
+        case TYPE88_RSP_CODE:
+                return convert_error(zdev, reply);
+        case TYPE86_RSP_CODE:
+                if (msg->cprbx.ccp_rtcode &&
+                   (msg->cprbx.ccp_rscode == 0x14f) &&
+                   (outputdatalength > 256)) {
+                        if (zdev->max_exp_bit_length <= 17) {
+                                zdev->max_exp_bit_length = 17;
+                                return -EAGAIN;
+                        } else
+                                return -EINVAL;
+                }
+                if (msg->hdr.reply_code)
+                        return convert_error(zdev, reply);
+                if (msg->cprbx.cprb_ver_id == 0x02)
+                        return convert_type86_ica(zdev, reply,
+                                                  outputdata, outputdatalength);
+                /* Fall through, no break, incorrect cprb version is an unknown
+                 * response */
+        default: /* Unknown response type, this should NEVER EVER happen */
+                zdev->online = 0;
+                return -EAGAIN; /* repeat the request on a different device. */
+        }
+}
+
+static int convert_response_xcrb(struct zcrypt_device *zdev,
+                            struct ap_message *reply,
+                            struct ica_xcRB *xcRB)
+{
+        struct type86x_reply *msg = reply->message;
+
+        /* Response type byte is the second byte in the response. */
+        switch (((unsigned char *) reply->message)[1]) {
+        case TYPE82_RSP_CODE:
+        case TYPE88_RSP_CODE:
+                xcRB->status = 0x0008044DL; /* HDD_InvalidParm */
+                return convert_error(zdev, reply);
+        case TYPE86_RSP_CODE:
+                if (msg->hdr.reply_code) {
+                        memcpy(&(xcRB->status), msg->fmt2.apfs, sizeof(u32));
+                        return convert_error(zdev, reply);
+                }
+                if (msg->cprbx.cprb_ver_id == 0x02)
+                        return convert_type86_xcrb(zdev, reply, xcRB);
+                /* Fall through, no break, incorrect cprb version is an unknown
+                 * response */
+        default: /* Unknown response type, this should NEVER EVER happen */
+                xcRB->status = 0x0008044DL; /* HDD_InvalidParm */
+                zdev->online = 0;
+                return -EAGAIN; /* repeat the request on a different device. */
+        }
+}
+
+static int convert_response_rng(struct zcrypt_device *zdev,
+                                 struct ap_message *reply,
+                                 char *data)
+{
+        struct type86x_reply *msg = reply->message;
+
+        switch (msg->hdr.type) {
+        case TYPE82_RSP_CODE:
+        case TYPE88_RSP_CODE:
+                return -EINVAL;
+        case TYPE86_RSP_CODE:
+                if (msg->hdr.reply_code)
+                        return -EINVAL;
+                if (msg->cprbx.cprb_ver_id == 0x02)
+                        return convert_type86_rng(zdev, reply, data);
+                /* Fall through, no break, incorrect cprb version is an unknown
+                 * response */
+        default: /* Unknown response type, this should NEVER EVER happen */
+                zdev->online = 0;
+                return -EAGAIN; /* repeat the request on a different device. */
+        }
+}
+
+/**
+ * This function is called from the AP bus code after a crypto request
+ * "msg" has finished with the reply message "reply".
+ * It is called from tasklet context.
+ * @ap_dev: pointer to the AP device
+ * @msg: pointer to the AP message
+ * @reply: pointer to the AP reply message
+ */
+static void zcrypt_msgtype6_receive(struct ap_device *ap_dev,
+                                  struct ap_message *msg,
+                                  struct ap_message *reply)
+{
+        static struct error_hdr error_reply = {
+                .type = TYPE82_RSP_CODE,
+                .reply_code = REP82_ERROR_MACHINE_FAILURE,
+        };
+        struct response_type *resp_type =
+                (struct response_type *) msg->private;
+        struct type86x_reply *t86r;
+        int length;
+
+        /* Copy the reply message to the request message buffer. */
+        if (IS_ERR(reply)) {
+                memcpy(msg->message, &error_reply, sizeof(error_reply));
+                goto out;
+        }
+        t86r = reply->message;
+        if (t86r->hdr.type == TYPE86_RSP_CODE &&
+                 t86r->cprbx.cprb_ver_id == 0x02) {
+                switch (resp_type->type) {
+                case PCIXCC_RESPONSE_TYPE_ICA:
+                        length = sizeof(struct type86x_reply)
+                                + t86r->length - 2;
+                        length = min(PCIXCC_MAX_ICA_RESPONSE_SIZE, length);
+                        memcpy(msg->message, reply->message, length);
+                        break;
+                case PCIXCC_RESPONSE_TYPE_XCRB:
+                        length = t86r->fmt2.offset2 + t86r->fmt2.count2;
+                        length = min(MSGTYPE06_MAX_MSG_SIZE, length);
+                        memcpy(msg->message, reply->message, length);
+                        break;
+                default:
+                        memcpy(msg->message, &error_reply,
+                               sizeof(error_reply));
+                }
+        } else
+                memcpy(msg->message, reply->message, sizeof(error_reply));
+out:
+        complete(&(resp_type->work));
+}
+
+static atomic_t zcrypt_step = ATOMIC_INIT(0);
+
+/**
+ * The request distributor calls this function if it picked the PCIXCC/CEX2C
+ * device to handle a modexpo request.
+ * @zdev: pointer to zcrypt_device structure that identifies the
+ *        PCIXCC/CEX2C device to the request distributor
+ * @mex: pointer to the modexpo request buffer
+ */
+static long zcrypt_msgtype6_modexpo(struct zcrypt_device *zdev,
+                                  struct ica_rsa_modexpo *mex)
+{
+        struct ap_message ap_msg;
+        struct response_type resp_type = {
+                .type = PCIXCC_RESPONSE_TYPE_ICA,
+        };
+        int rc;
+
+        ap_init_message(&ap_msg);
+        ap_msg.message = (void *) get_zeroed_page(GFP_KERNEL);
+        if (!ap_msg.message)
+                return -ENOMEM;
+        ap_msg.receive = zcrypt_msgtype6_receive;
+        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
+                                atomic_inc_return(&zcrypt_step);
+        ap_msg.private = &resp_type;
+        rc = ICAMEX_msg_to_type6MEX_msgX(zdev, &ap_msg, mex);
+        if (rc)
+                goto out_free;
+        init_completion(&resp_type.work);
+        ap_queue_message(zdev->ap_dev, &ap_msg);
+        rc = wait_for_completion_interruptible(&resp_type.work);
+        if (rc == 0)
+                rc = convert_response_ica(zdev, &ap_msg, mex->outputdata,
+                                          mex->outputdatalength);
+        else
+                /* Signal pending. */
+                ap_cancel_message(zdev->ap_dev, &ap_msg);
+out_free:
+        free_page((unsigned long) ap_msg.message);
+        return rc;
+}
+
+/**
+ * The request distributor calls this function if it picked the PCIXCC/CEX2C
+ * device to handle a modexpo_crt request.
+ * @zdev: pointer to zcrypt_device structure that identifies the
+ *        PCIXCC/CEX2C device to the request distributor
+ * @crt: pointer to the modexpoc_crt request buffer
+ */
+static long zcrypt_msgtype6_modexpo_crt(struct zcrypt_device *zdev,
+                                      struct ica_rsa_modexpo_crt *crt)
+{
+        struct ap_message ap_msg;
+        struct response_type resp_type = {
+                .type = PCIXCC_RESPONSE_TYPE_ICA,
+        };
+        int rc;
+
+        ap_init_message(&ap_msg);
+        ap_msg.message = (void *) get_zeroed_page(GFP_KERNEL);
+        if (!ap_msg.message)
+                return -ENOMEM;
+        ap_msg.receive = zcrypt_msgtype6_receive;
+        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
+                                atomic_inc_return(&zcrypt_step);
+        ap_msg.private = &resp_type;
+        rc = ICACRT_msg_to_type6CRT_msgX(zdev, &ap_msg, crt);
+        if (rc)
+                goto out_free;
+        init_completion(&resp_type.work);
+        ap_queue_message(zdev->ap_dev, &ap_msg);
+        rc = wait_for_completion_interruptible(&resp_type.work);
+        if (rc == 0)
+                rc = convert_response_ica(zdev, &ap_msg, crt->outputdata,
+                                          crt->outputdatalength);
+        else
+                /* Signal pending. */
+                ap_cancel_message(zdev->ap_dev, &ap_msg);
+out_free:
+        free_page((unsigned long) ap_msg.message);
+        return rc;
+}
+
+/**
+ * The request distributor calls this function if it picked the PCIXCC/CEX2C
+ * device to handle a send_cprb request.
+ * @zdev: pointer to zcrypt_device structure that identifies the
+ *        PCIXCC/CEX2C device to the request distributor
+ * @xcRB: pointer to the send_cprb request buffer
+ */
+static long zcrypt_msgtype6_send_cprb(struct zcrypt_device *zdev,
+                                    struct ica_xcRB *xcRB)
+{
+        struct ap_message ap_msg;
+        struct response_type resp_type = {
+                .type = PCIXCC_RESPONSE_TYPE_XCRB,
+        };
+        int rc;
+
+        ap_init_message(&ap_msg);
+        ap_msg.message = kmalloc(MSGTYPE06_MAX_MSG_SIZE, GFP_KERNEL);
+        if (!ap_msg.message)
+                return -ENOMEM;
+        ap_msg.receive = zcrypt_msgtype6_receive;
+        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
+                                atomic_inc_return(&zcrypt_step);
+        ap_msg.private = &resp_type;
+        rc = XCRB_msg_to_type6CPRB_msgX(zdev, &ap_msg, xcRB);
+        if (rc)
+                goto out_free;
+        init_completion(&resp_type.work);
+        ap_queue_message(zdev->ap_dev, &ap_msg);
+        rc = wait_for_completion_interruptible(&resp_type.work);
+        if (rc == 0)
+                rc = convert_response_xcrb(zdev, &ap_msg, xcRB);
+        else
+                /* Signal pending. */
+                ap_cancel_message(zdev->ap_dev, &ap_msg);
+out_free:
+        kzfree(ap_msg.message);
+        return rc;
+}
+
+/**
+ * The request distributor calls this function if it picked the PCIXCC/CEX2C
+ * device to generate random data.
+ * @zdev: pointer to zcrypt_device structure that identifies the
+ *        PCIXCC/CEX2C device to the request distributor
+ * @buffer: pointer to a memory page to return random data
+ */
+
+static long zcrypt_msgtype6_rng(struct zcrypt_device *zdev,
+                                    char *buffer)
+{
+        struct ap_message ap_msg;
+        struct response_type resp_type = {
+                .type = PCIXCC_RESPONSE_TYPE_XCRB,
+        };
+        int rc;
+
+        ap_init_message(&ap_msg);
+        ap_msg.message = kmalloc(MSGTYPE06_MAX_MSG_SIZE, GFP_KERNEL);
+        if (!ap_msg.message)
+                return -ENOMEM;
+        ap_msg.receive = zcrypt_msgtype6_receive;
+        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
+                                atomic_inc_return(&zcrypt_step);
+        ap_msg.private = &resp_type;
+        rng_type6CPRB_msgX(zdev->ap_dev, &ap_msg, ZCRYPT_RNG_BUFFER_SIZE);
+        init_completion(&resp_type.work);
+        ap_queue_message(zdev->ap_dev, &ap_msg);
+        rc = wait_for_completion_interruptible(&resp_type.work);
+        if (rc == 0)
+                rc = convert_response_rng(zdev, &ap_msg, buffer);
+        else
+                /* Signal pending. */
+                ap_cancel_message(zdev->ap_dev, &ap_msg);
+        kfree(ap_msg.message);
+        return rc;
+}
+
+/**
+ * The crypto operations for a PCIXCC/CEX2C card.
+ */
+static struct zcrypt_ops zcrypt_msgtype6_norng_ops = {
+        .owner = THIS_MODULE,
+        .variant = MSGTYPE06_VARIANT_NORNG,
+        .rsa_modexpo = zcrypt_msgtype6_modexpo,
+        .rsa_modexpo_crt = zcrypt_msgtype6_modexpo_crt,
+        .send_cprb = zcrypt_msgtype6_send_cprb,
+};
+
+static struct zcrypt_ops zcrypt_msgtype6_ops = {
+        .owner = THIS_MODULE,
+        .variant = MSGTYPE06_VARIANT_DEFAULT,
+        .rsa_modexpo = zcrypt_msgtype6_modexpo,
+        .rsa_modexpo_crt = zcrypt_msgtype6_modexpo_crt,
+        .send_cprb = zcrypt_msgtype6_send_cprb,
+        .rng = zcrypt_msgtype6_rng,
+};
+
+int __init zcrypt_msgtype6_init(void)
+{
+        zcrypt_msgtype_register(&zcrypt_msgtype6_norng_ops);
+        zcrypt_msgtype_register(&zcrypt_msgtype6_ops);
+        return 0;
+}
+
+void __exit zcrypt_msgtype6_exit(void)
+{
+        zcrypt_msgtype_unregister(&zcrypt_msgtype6_norng_ops);
+        zcrypt_msgtype_unregister(&zcrypt_msgtype6_ops);
+}
+
+module_init(zcrypt_msgtype6_init);
+module_exit(zcrypt_msgtype6_exit);
diff --git a/drivers/s390/crypto/zcrypt_msgtype6.h b/drivers/s390/crypto/zcrypt_msgtype6.h
new file mode 100644
index 000000000000..1e500d3c0735
--- /dev/null
+++ b/drivers/s390/crypto/zcrypt_msgtype6.h
@@ -0,0 +1,169 @@
+/*
+ *  zcrypt 2.1.0
+ *
+ *  Copyright IBM Corp. 2001, 2012
+ *  Author(s): Robert Burroughs
+ *             Eric Rossman (edrossma@us.ibm.com)
+ *
+ *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
+ *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef _ZCRYPT_MSGTYPE6_H_
+#define _ZCRYPT_MSGTYPE6_H_
+
+#include <asm/zcrypt.h>
+
+#define MSGTYPE06_NAME                  "zcrypt_msgtype6"
+#define MSGTYPE06_VARIANT_DEFAULT       0
+#define MSGTYPE06_VARIANT_NORNG         1
+
+#define MSGTYPE06_MAX_MSG_SIZE          (12*1024)
+
+/**
+ * The type 6 message family is associated with PCICC or PCIXCC cards.
+ *
+ * It contains a message header followed by a CPRB, both of which
+ * are described below.
+ *
+ * Note that all reserved fields must be zeroes.
+ */
+struct type6_hdr {
+        unsigned char reserved1;        /* 0x00                         */
+        unsigned char type;             /* 0x06                         */
+        unsigned char reserved2[2];     /* 0x0000                       */
+        unsigned char right[4];         /* 0x00000000                   */
+        unsigned char reserved3[2];     /* 0x0000                       */
+        unsigned char reserved4[2];     /* 0x0000                       */
+        unsigned char apfs[4];          /* 0x00000000                   */
+        unsigned int  offset1;          /* 0x00000058 (offset to CPRB)  */
+        unsigned int  offset2;          /* 0x00000000                   */
+        unsigned int  offset3;          /* 0x00000000                   */
+        unsigned int  offset4;          /* 0x00000000                   */
+        unsigned char agent_id[16];     /* PCICC:                       */
+                                        /*    0x0100                    */
+                                        /*    0x4343412d4150504c202020  */
+                                        /*    0x010101                  */
+                                        /* PCIXCC:                      */
+                                        /*    0x4341000000000000        */
+                                        /*    0x0000000000000000        */
+        unsigned char rqid[2];          /* rqid.  internal to 603       */
+        unsigned char reserved5[2];     /* 0x0000                       */
+        unsigned char function_code[2]; /* for PKD, 0x5044 (ascii 'PD') */
+        unsigned char reserved6[2];     /* 0x0000                       */
+        unsigned int  ToCardLen1;       /* (request CPRB len + 3) & -4  */
+        unsigned int  ToCardLen2;       /* db len 0x00000000 for PKD    */
+        unsigned int  ToCardLen3;       /* 0x00000000                   */
+        unsigned int  ToCardLen4;       /* 0x00000000                   */
+        unsigned int  FromCardLen1;     /* response buffer length       */
+        unsigned int  FromCardLen2;     /* db len 0x00000000 for PKD    */
+        unsigned int  FromCardLen3;     /* 0x00000000                   */
+        unsigned int  FromCardLen4;     /* 0x00000000                   */
+} __packed;
+
+/**
+ * The type 86 message family is associated with PCICC and PCIXCC cards.
+ *
+ * It contains a message header followed by a CPRB.  The CPRB is
+ * the same as the request CPRB, which is described above.
+ *
+ * If format is 1, an error condition exists and no data beyond
+ * the 8-byte message header is of interest.
+ *
+ * The non-error message is shown below.
+ *
+ * Note that all reserved fields must be zeroes.
+ */
+struct type86_hdr {
+        unsigned char reserved1;        /* 0x00                         */
+        unsigned char type;             /* 0x86                         */
+        unsigned char format;           /* 0x01 (error) or 0x02 (ok)    */
+        unsigned char reserved2;        /* 0x00                         */
+        unsigned char reply_code;       /* reply code (see above)       */
+        unsigned char reserved3[3];     /* 0x000000                     */
+} __packed;
+
+#define TYPE86_RSP_CODE 0x86
+#define TYPE86_FMT2     0x02
+
+struct type86_fmt2_ext {
+        unsigned char     reserved[4];  /* 0x00000000                   */
+        unsigned char     apfs[4];      /* final status                 */
+        unsigned int      count1;       /* length of CPRB + parameters  */
+        unsigned int      offset1;      /* offset to CPRB               */
+        unsigned int      count2;       /* 0x00000000                   */
+        unsigned int      offset2;      /* db offset 0x00000000 for PKD */
+        unsigned int      count3;       /* 0x00000000                   */
+        unsigned int      offset3;      /* 0x00000000                   */
+        unsigned int      count4;       /* 0x00000000                   */
+        unsigned int      offset4;      /* 0x00000000                   */
+} __packed;
+
+/**
+ * Prepare a type6 CPRB message for random number generation
+ *
+ * @ap_dev: AP device pointer
+ * @ap_msg: pointer to AP message
+ */
+static inline void rng_type6CPRB_msgX(struct ap_device *ap_dev,
+                               struct ap_message *ap_msg,
+                               unsigned random_number_length)
+{
+        struct {
+                struct type6_hdr hdr;
+                struct CPRBX cprbx;
+                char function_code[2];
+                short int rule_length;
+                char rule[8];
+                short int verb_length;
+                short int key_length;
+        } __packed * msg = ap_msg->message;
+        static struct type6_hdr static_type6_hdrX = {
+                .type           = 0x06,
+                .offset1        = 0x00000058,
+                .agent_id       = {'C', 'A'},
+                .function_code  = {'R', 'L'},
+                .ToCardLen1     = sizeof(*msg) - sizeof(msg->hdr),
+                .FromCardLen1   = sizeof(*msg) - sizeof(msg->hdr),
+        };
+        static struct CPRBX local_cprbx = {
+                .cprb_len       = 0x00dc,
+                .cprb_ver_id    = 0x02,
+                .func_id        = {0x54, 0x32},
+                .req_parml      = sizeof(*msg) - sizeof(msg->hdr) -
+                                  sizeof(msg->cprbx),
+                .rpl_msgbl      = sizeof(*msg) - sizeof(msg->hdr),
+        };
+
+        msg->hdr = static_type6_hdrX;
+        msg->hdr.FromCardLen2 = random_number_length,
+        msg->cprbx = local_cprbx;
+        msg->cprbx.rpl_datal = random_number_length,
+        msg->cprbx.domain = AP_QID_QUEUE(ap_dev->qid);
+        memcpy(msg->function_code, msg->hdr.function_code, 0x02);
+        msg->rule_length = 0x0a;
+        memcpy(msg->rule, "RANDOM  ", 8);
+        msg->verb_length = 0x02;
+        msg->key_length = 0x02;
+        ap_msg->length = sizeof(*msg);
+}
+
+int zcrypt_msgtype6_init(void);
+void zcrypt_msgtype6_exit(void);
+
+#endif /* _ZCRYPT_MSGTYPE6_H_ */
diff --git a/drivers/s390/crypto/zcrypt_pcixcc.c b/drivers/s390/crypto/zcrypt_pcixcc.c
index ccb4f8b60c75..c7275e303a0d 100644
--- a/drivers/s390/crypto/zcrypt_pcixcc.c
+++ b/drivers/s390/crypto/zcrypt_pcixcc.c
@@ -1,13 +1,14 @@
 /*
  *  zcrypt 2.1.0
  *
- *  Copyright IBM Corp. 2001, 2006
+ *  Copyright IBM Corp. 2001, 2012
  *  Author(s): Robert Burroughs
  *             Eric Rossman (edrossma@us.ibm.com)
  *
  *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
  *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
  *                                Ralph Wuerthner <rwuerthn@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -35,9 +36,10 @@
 #include "ap_bus.h"
 #include "zcrypt_api.h"
 #include "zcrypt_error.h"
-#include "zcrypt_pcicc.h"
+#include "zcrypt_msgtype6.h"
 #include "zcrypt_pcixcc.h"
 #include "zcrypt_cca_key.h"
+#include "zcrypt_msgtype6.h"
 
 #define PCIXCC_MIN_MOD_SIZE      16     /*  128 bits    */
 #define PCIXCC_MIN_MOD_SIZE_OLD  64     /*  512 bits    */
@@ -75,14 +77,12 @@ static struct ap_device_id zcrypt_pcixcc_ids[] = {
 
 MODULE_DEVICE_TABLE(ap, zcrypt_pcixcc_ids);
 MODULE_AUTHOR("IBM Corporation");
-MODULE_DESCRIPTION("PCIXCC Cryptographic Coprocessor device driver, "
-                   "Copyright IBM Corp. 2001, 2006");
+MODULE_DESCRIPTION("PCIXCC Cryptographic Coprocessor device driver, " \
+                   "Copyright IBM Corp. 2001, 2012");
 MODULE_LICENSE("GPL");
 
 static int zcrypt_pcixcc_probe(struct ap_device *ap_dev);
 static void zcrypt_pcixcc_remove(struct ap_device *ap_dev);
-static void zcrypt_pcixcc_receive(struct ap_device *, struct ap_message *,
-                                 struct ap_message *);
 
 static struct ap_driver zcrypt_pcixcc_driver = {
         .probe = zcrypt_pcixcc_probe,
@@ -92,766 +92,6 @@ static struct ap_driver zcrypt_pcixcc_driver = {
 };
 
 /**
- * The following is used to initialize the CPRBX passed to the PCIXCC/CEX2C
- * card in a type6 message. The 3 fields that must be filled in at execution
- * time are  req_parml, rpl_parml and usage_domain.
- * Everything about this interface is ascii/big-endian, since the
- * device does *not* have 'Intel inside'.
- *
- * The CPRBX is followed immediately by the parm block.
- * The parm block contains:
- * - function code ('PD' 0x5044 or 'PK' 0x504B)
- * - rule block (one of:)
- *   + 0x000A 'PKCS-1.2' (MCL2 'PD')
- *   + 0x000A 'ZERO-PAD' (MCL2 'PK')
- *   + 0x000A 'ZERO-PAD' (MCL3 'PD' or CEX2C 'PD')
- *   + 0x000A 'MRP     ' (MCL3 'PK' or CEX2C 'PK')
- * - VUD block
- */
-static struct CPRBX static_cprbx = {
-        .cprb_len       =  0x00DC,
-        .cprb_ver_id    =  0x02,
-        .func_id        = {0x54,0x32},
-};
-
-/**
- * Convert a ICAMEX message to a type6 MEX message.
- *
- * @zdev: crypto device pointer
- * @ap_msg: pointer to AP message
- * @mex: pointer to user input data
- *
- * Returns 0 on success or -EFAULT.
- */
-static int ICAMEX_msg_to_type6MEX_msgX(struct zcrypt_device *zdev,
-                                       struct ap_message *ap_msg,
-                                       struct ica_rsa_modexpo *mex)
-{
-        static struct type6_hdr static_type6_hdrX = {
-                .type           =  0x06,
-                .offset1        =  0x00000058,
-                .agent_id       = {'C','A',},
-                .function_code  = {'P','K'},
-        };
-        static struct function_and_rules_block static_pke_fnr = {
-                .function_code  = {'P','K'},
-                .ulen           = 10,
-                .only_rule      = {'M','R','P',' ',' ',' ',' ',' '}
-        };
-        static struct function_and_rules_block static_pke_fnr_MCL2 = {
-                .function_code  = {'P','K'},
-                .ulen           = 10,
-                .only_rule      = {'Z','E','R','O','-','P','A','D'}
-        };
-        struct {
-                struct type6_hdr hdr;
-                struct CPRBX cprbx;
-                struct function_and_rules_block fr;
-                unsigned short length;
-                char text[0];
-        } __attribute__((packed)) *msg = ap_msg->message;
-        int size;
-
-        /* VUD.ciphertext */
-        msg->length = mex->inputdatalength + 2;
-        if (copy_from_user(msg->text, mex->inputdata, mex->inputdatalength))
-                return -EFAULT;
-
-        /* Set up key which is located after the variable length text. */
-        size = zcrypt_type6_mex_key_en(mex, msg->text+mex->inputdatalength, 1);
-        if (size < 0)
-                return size;
-        size += sizeof(*msg) + mex->inputdatalength;
-
-        /* message header, cprbx and f&r */
-        msg->hdr = static_type6_hdrX;
-        msg->hdr.ToCardLen1 = size - sizeof(msg->hdr);
-        msg->hdr.FromCardLen1 = PCIXCC_MAX_ICA_RESPONSE_SIZE - sizeof(msg->hdr);
-
-        msg->cprbx = static_cprbx;
-        msg->cprbx.domain = AP_QID_QUEUE(zdev->ap_dev->qid);
-        msg->cprbx.rpl_msgbl = msg->hdr.FromCardLen1;
-
-        msg->fr = (zdev->user_space_type == ZCRYPT_PCIXCC_MCL2) ?
-                static_pke_fnr_MCL2 : static_pke_fnr;
-
-        msg->cprbx.req_parml = size - sizeof(msg->hdr) - sizeof(msg->cprbx);
-
-        ap_msg->length = size;
-        return 0;
-}
-
-/**
- * Convert a ICACRT message to a type6 CRT message.
- *
- * @zdev: crypto device pointer
- * @ap_msg: pointer to AP message
- * @crt: pointer to user input data
- *
- * Returns 0 on success or -EFAULT.
- */
-static int ICACRT_msg_to_type6CRT_msgX(struct zcrypt_device *zdev,
-                                       struct ap_message *ap_msg,
-                                       struct ica_rsa_modexpo_crt *crt)
-{
-        static struct type6_hdr static_type6_hdrX = {
-                .type           =  0x06,
-                .offset1        =  0x00000058,
-                .agent_id       = {'C','A',},
-                .function_code  = {'P','D'},
-        };
-        static struct function_and_rules_block static_pkd_fnr = {
-                .function_code  = {'P','D'},
-                .ulen           = 10,
-                .only_rule      = {'Z','E','R','O','-','P','A','D'}
-        };
-
-        static struct function_and_rules_block static_pkd_fnr_MCL2 = {
-                .function_code  = {'P','D'},
-                .ulen           = 10,
-                .only_rule      = {'P','K','C','S','-','1','.','2'}
-        };
-        struct {
-                struct type6_hdr hdr;
-                struct CPRBX cprbx;
-                struct function_and_rules_block fr;
-                unsigned short length;
-                char text[0];
-        } __attribute__((packed)) *msg = ap_msg->message;
-        int size;
-
-        /* VUD.ciphertext */
-        msg->length = crt->inputdatalength + 2;
-        if (copy_from_user(msg->text, crt->inputdata, crt->inputdatalength))
-                return -EFAULT;
-
-        /* Set up key which is located after the variable length text. */
-        size = zcrypt_type6_crt_key(crt, msg->text + crt->inputdatalength, 1);
-        if (size < 0)
-                return size;
-        size += sizeof(*msg) + crt->inputdatalength;    /* total size of msg */
-
-        /* message header, cprbx and f&r */
-        msg->hdr = static_type6_hdrX;
-        msg->hdr.ToCardLen1 = size -  sizeof(msg->hdr);
-        msg->hdr.FromCardLen1 = PCIXCC_MAX_ICA_RESPONSE_SIZE - sizeof(msg->hdr);
-
-        msg->cprbx = static_cprbx;
-        msg->cprbx.domain = AP_QID_QUEUE(zdev->ap_dev->qid);
-        msg->cprbx.req_parml = msg->cprbx.rpl_msgbl =
-                size - sizeof(msg->hdr) - sizeof(msg->cprbx);
-
-        msg->fr = (zdev->user_space_type == ZCRYPT_PCIXCC_MCL2) ?
-                static_pkd_fnr_MCL2 : static_pkd_fnr;
-
-        ap_msg->length = size;
-        return 0;
-}
-
-/**
- * Convert a XCRB message to a type6 CPRB message.
- *
- * @zdev: crypto device pointer
- * @ap_msg: pointer to AP message
- * @xcRB: pointer to user input data
- *
- * Returns 0 on success or -EFAULT, -EINVAL.
- */
-struct type86_fmt2_msg {
-        struct type86_hdr hdr;
-        struct type86_fmt2_ext fmt2;
-} __attribute__((packed));
-
-static int XCRB_msg_to_type6CPRB_msgX(struct zcrypt_device *zdev,
-                                       struct ap_message *ap_msg,
-                                       struct ica_xcRB *xcRB)
-{
-        static struct type6_hdr static_type6_hdrX = {
-                .type           =  0x06,
-                .offset1        =  0x00000058,
-        };
-        struct {
-                struct type6_hdr hdr;
-                struct CPRBX cprbx;
-        } __attribute__((packed)) *msg = ap_msg->message;
-
-        int rcblen = CEIL4(xcRB->request_control_blk_length);
-        int replylen;
-        char *req_data = ap_msg->message + sizeof(struct type6_hdr) + rcblen;
-        char *function_code;
-
-        /* length checks */
-        ap_msg->length = sizeof(struct type6_hdr) +
-                CEIL4(xcRB->request_control_blk_length) +
-                xcRB->request_data_length;
-        if (ap_msg->length > PCIXCC_MAX_XCRB_MESSAGE_SIZE)
-                return -EINVAL;
-        replylen = sizeof(struct type86_fmt2_msg) +
-                CEIL4(xcRB->reply_control_blk_length) +
-                xcRB->reply_data_length;
-        if (replylen > PCIXCC_MAX_XCRB_MESSAGE_SIZE)
-                return -EINVAL;
-
-        /* prepare type6 header */
-        msg->hdr = static_type6_hdrX;
-        memcpy(msg->hdr.agent_id , &(xcRB->agent_ID), sizeof(xcRB->agent_ID));
-        msg->hdr.ToCardLen1 = xcRB->request_control_blk_length;
-        if (xcRB->request_data_length) {
-                msg->hdr.offset2 = msg->hdr.offset1 + rcblen;
-                msg->hdr.ToCardLen2 = xcRB->request_data_length;
-        }
-        msg->hdr.FromCardLen1 = xcRB->reply_control_blk_length;
-        msg->hdr.FromCardLen2 = xcRB->reply_data_length;
-
-        /* prepare CPRB */
-        if (copy_from_user(&(msg->cprbx), xcRB->request_control_blk_addr,
-                    xcRB->request_control_blk_length))
-                return -EFAULT;
-        if (msg->cprbx.cprb_len + sizeof(msg->hdr.function_code) >
-            xcRB->request_control_blk_length)
-                return -EINVAL;
-        function_code = ((unsigned char *)&msg->cprbx) + msg->cprbx.cprb_len;
-        memcpy(msg->hdr.function_code, function_code, sizeof(msg->hdr.function_code));
-
-        if (memcmp(function_code, "US", 2) == 0)
-                ap_msg->special = 1;
-        else
-                ap_msg->special = 0;
-
-        /* copy data block */
-        if (xcRB->request_data_length &&
-            copy_from_user(req_data, xcRB->request_data_address,
-                xcRB->request_data_length))
-                return -EFAULT;
-        return 0;
-}
-
-/**
- * Prepare a type6 CPRB message for random number generation
- *
- * @ap_dev: AP device pointer
- * @ap_msg: pointer to AP message
- */
-static void rng_type6CPRB_msgX(struct ap_device *ap_dev,
-                               struct ap_message *ap_msg,
-                               unsigned random_number_length)
-{
-        struct {
-                struct type6_hdr hdr;
-                struct CPRBX cprbx;
-                char function_code[2];
-                short int rule_length;
-                char rule[8];
-                short int verb_length;
-                short int key_length;
-        } __attribute__((packed)) *msg = ap_msg->message;
-        static struct type6_hdr static_type6_hdrX = {
-                .type           = 0x06,
-                .offset1        = 0x00000058,
-                .agent_id       = {'C', 'A'},
-                .function_code  = {'R', 'L'},
-                .ToCardLen1     = sizeof *msg - sizeof(msg->hdr),
-                .FromCardLen1   = sizeof *msg - sizeof(msg->hdr),
-        };
-        static struct CPRBX local_cprbx = {
-                .cprb_len       = 0x00dc,
-                .cprb_ver_id    = 0x02,
-                .func_id        = {0x54, 0x32},
-                .req_parml      = sizeof *msg - sizeof(msg->hdr) -
-                                  sizeof(msg->cprbx),
-                .rpl_msgbl      = sizeof *msg - sizeof(msg->hdr),
-        };
-
-        msg->hdr = static_type6_hdrX;
-        msg->hdr.FromCardLen2 = random_number_length,
-        msg->cprbx = local_cprbx;
-        msg->cprbx.rpl_datal = random_number_length,
-        msg->cprbx.domain = AP_QID_QUEUE(ap_dev->qid);
-        memcpy(msg->function_code, msg->hdr.function_code, 0x02);
-        msg->rule_length = 0x0a;
-        memcpy(msg->rule, "RANDOM  ", 8);
-        msg->verb_length = 0x02;
-        msg->key_length = 0x02;
-        ap_msg->length = sizeof *msg;
-}
-
-/**
- * Copy results from a type 86 ICA reply message back to user space.
- *
- * @zdev: crypto device pointer
- * @reply: reply AP message.
- * @data: pointer to user output data
- * @length: size of user output data
- *
- * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
- */
-struct type86x_reply {
-        struct type86_hdr hdr;
-        struct type86_fmt2_ext fmt2;
-        struct CPRBX cprbx;
-        unsigned char pad[4];   /* 4 byte function code/rules block ? */
-        unsigned short length;
-        char text[0];
-} __attribute__((packed));
-
-static int convert_type86_ica(struct zcrypt_device *zdev,
-                          struct ap_message *reply,
-                          char __user *outputdata,
-                          unsigned int outputdatalength)
-{
-        static unsigned char static_pad[] = {
-                0x00,0x02,
-                0x1B,0x7B,0x5D,0xB5,0x75,0x01,0x3D,0xFD,
-                0x8D,0xD1,0xC7,0x03,0x2D,0x09,0x23,0x57,
-                0x89,0x49,0xB9,0x3F,0xBB,0x99,0x41,0x5B,
-                0x75,0x21,0x7B,0x9D,0x3B,0x6B,0x51,0x39,
-                0xBB,0x0D,0x35,0xB9,0x89,0x0F,0x93,0xA5,
-                0x0B,0x47,0xF1,0xD3,0xBB,0xCB,0xF1,0x9D,
-                0x23,0x73,0x71,0xFF,0xF3,0xF5,0x45,0xFB,
-                0x61,0x29,0x23,0xFD,0xF1,0x29,0x3F,0x7F,
-                0x17,0xB7,0x1B,0xA9,0x19,0xBD,0x57,0xA9,
-                0xD7,0x95,0xA3,0xCB,0xED,0x1D,0xDB,0x45,
-                0x7D,0x11,0xD1,0x51,0x1B,0xED,0x71,0xE9,
-                0xB1,0xD1,0xAB,0xAB,0x21,0x2B,0x1B,0x9F,
-                0x3B,0x9F,0xF7,0xF7,0xBD,0x63,0xEB,0xAD,
-                0xDF,0xB3,0x6F,0x5B,0xDB,0x8D,0xA9,0x5D,
-                0xE3,0x7D,0x77,0x49,0x47,0xF5,0xA7,0xFD,
-                0xAB,0x2F,0x27,0x35,0x77,0xD3,0x49,0xC9,
-                0x09,0xEB,0xB1,0xF9,0xBF,0x4B,0xCB,0x2B,
-                0xEB,0xEB,0x05,0xFF,0x7D,0xC7,0x91,0x8B,
-                0x09,0x83,0xB9,0xB9,0x69,0x33,0x39,0x6B,
-                0x79,0x75,0x19,0xBF,0xBB,0x07,0x1D,0xBD,
-                0x29,0xBF,0x39,0x95,0x93,0x1D,0x35,0xC7,
-                0xC9,0x4D,0xE5,0x97,0x0B,0x43,0x9B,0xF1,
-                0x16,0x93,0x03,0x1F,0xA5,0xFB,0xDB,0xF3,
-                0x27,0x4F,0x27,0x61,0x05,0x1F,0xB9,0x23,
-                0x2F,0xC3,0x81,0xA9,0x23,0x71,0x55,0x55,
-                0xEB,0xED,0x41,0xE5,0xF3,0x11,0xF1,0x43,
-                0x69,0x03,0xBD,0x0B,0x37,0x0F,0x51,0x8F,
-                0x0B,0xB5,0x89,0x5B,0x67,0xA9,0xD9,0x4F,
-                0x01,0xF9,0x21,0x77,0x37,0x73,0x79,0xC5,
-                0x7F,0x51,0xC1,0xCF,0x97,0xA1,0x75,0xAD,
-                0x35,0x9D,0xD3,0xD3,0xA7,0x9D,0x5D,0x41,
-                0x6F,0x65,0x1B,0xCF,0xA9,0x87,0x91,0x09
-        };
-        struct type86x_reply *msg = reply->message;
-        unsigned short service_rc, service_rs;
-        unsigned int reply_len, pad_len;
-        char *data;
-
-        service_rc = msg->cprbx.ccp_rtcode;
-        if (unlikely(service_rc != 0)) {
-                service_rs = msg->cprbx.ccp_rscode;
-                if (service_rc == 8 && service_rs == 66)
-                        return -EINVAL;
-                if (service_rc == 8 && service_rs == 65)
-                        return -EINVAL;
-                if (service_rc == 8 && service_rs == 770)
-                        return -EINVAL;
-                if (service_rc == 8 && service_rs == 783) {
-                        zdev->min_mod_size = PCIXCC_MIN_MOD_SIZE_OLD;
-                        return -EAGAIN;
-                }
-                if (service_rc == 12 && service_rs == 769)
-                        return -EINVAL;
-                if (service_rc == 8 && service_rs == 72)
-                        return -EINVAL;
-                zdev->online = 0;
-                return -EAGAIN; /* repeat the request on a different device. */
-        }
-        data = msg->text;
-        reply_len = msg->length - 2;
-        if (reply_len > outputdatalength)
-                return -EINVAL;
-        /*
-         * For all encipher requests, the length of the ciphertext (reply_len)
-         * will always equal the modulus length. For MEX decipher requests
-         * the output needs to get padded. Minimum pad size is 10.
-         *
-         * Currently, the cases where padding will be added is for:
-         * - PCIXCC_MCL2 using a CRT form token (since PKD didn't support
-         *   ZERO-PAD and CRT is only supported for PKD requests)
-         * - PCICC, always
-         */
-        pad_len = outputdatalength - reply_len;
-        if (pad_len > 0) {
-                if (pad_len < 10)
-                        return -EINVAL;
-                /* 'restore' padding left in the PCICC/PCIXCC card. */
-                if (copy_to_user(outputdata, static_pad, pad_len - 1))
-                        return -EFAULT;
-                if (put_user(0, outputdata + pad_len - 1))
-                        return -EFAULT;
-        }
-        /* Copy the crypto response to user space. */
-        if (copy_to_user(outputdata + pad_len, data, reply_len))
-                return -EFAULT;
-        return 0;
-}
-
-/**
- * Copy results from a type 86 XCRB reply message back to user space.
- *
- * @zdev: crypto device pointer
- * @reply: reply AP message.
- * @xcRB: pointer to XCRB
- *
- * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
- */
-static int convert_type86_xcrb(struct zcrypt_device *zdev,
-                               struct ap_message *reply,
-                               struct ica_xcRB *xcRB)
-{
-        struct type86_fmt2_msg *msg = reply->message;
-        char *data = reply->message;
-
-        /* Copy CPRB to user */
-        if (copy_to_user(xcRB->reply_control_blk_addr,
-                data + msg->fmt2.offset1, msg->fmt2.count1))
-                return -EFAULT;
-        xcRB->reply_control_blk_length = msg->fmt2.count1;
-
-        /* Copy data buffer to user */
-        if (msg->fmt2.count2)
-                if (copy_to_user(xcRB->reply_data_addr,
-                        data + msg->fmt2.offset2, msg->fmt2.count2))
-                        return -EFAULT;
-        xcRB->reply_data_length = msg->fmt2.count2;
-        return 0;
-}
-
-static int convert_type86_rng(struct zcrypt_device *zdev,
-                          struct ap_message *reply,
-                          char *buffer)
-{
-        struct {
-                struct type86_hdr hdr;
-                struct type86_fmt2_ext fmt2;
-                struct CPRBX cprbx;
-        } __attribute__((packed)) *msg = reply->message;
-        char *data = reply->message;
-
-        if (msg->cprbx.ccp_rtcode != 0 || msg->cprbx.ccp_rscode != 0)
-                return -EINVAL;
-        memcpy(buffer, data + msg->fmt2.offset2, msg->fmt2.count2);
-        return msg->fmt2.count2;
-}
-
-static int convert_response_ica(struct zcrypt_device *zdev,
-                            struct ap_message *reply,
-                            char __user *outputdata,
-                            unsigned int outputdatalength)
-{
-        struct type86x_reply *msg = reply->message;
-
-        /* Response type byte is the second byte in the response. */
-        switch (((unsigned char *) reply->message)[1]) {
-        case TYPE82_RSP_CODE:
-        case TYPE88_RSP_CODE:
-                return convert_error(zdev, reply);
-        case TYPE86_RSP_CODE:
-                if (msg->cprbx.ccp_rtcode &&
-                   (msg->cprbx.ccp_rscode == 0x14f) &&
-                   (outputdatalength > 256)) {
-                        if (zdev->max_exp_bit_length <= 17) {
-                                zdev->max_exp_bit_length = 17;
-                                return -EAGAIN;
-                        } else
-                                return -EINVAL;
-                }
-                if (msg->hdr.reply_code)
-                        return convert_error(zdev, reply);
-                if (msg->cprbx.cprb_ver_id == 0x02)
-                        return convert_type86_ica(zdev, reply,
-                                                  outputdata, outputdatalength);
-                /* Fall through, no break, incorrect cprb version is an unknown
-                 * response */
-        default: /* Unknown response type, this should NEVER EVER happen */
-                zdev->online = 0;
-                return -EAGAIN; /* repeat the request on a different device. */
-        }
-}
-
-static int convert_response_xcrb(struct zcrypt_device *zdev,
-                            struct ap_message *reply,
-                            struct ica_xcRB *xcRB)
-{
-        struct type86x_reply *msg = reply->message;
-
-        /* Response type byte is the second byte in the response. */
-        switch (((unsigned char *) reply->message)[1]) {
-        case TYPE82_RSP_CODE:
-        case TYPE88_RSP_CODE:
-                xcRB->status = 0x0008044DL; /* HDD_InvalidParm */
-                return convert_error(zdev, reply);
-        case TYPE86_RSP_CODE:
-                if (msg->hdr.reply_code) {
-                        memcpy(&(xcRB->status), msg->fmt2.apfs, sizeof(u32));
-                        return convert_error(zdev, reply);
-                }
-                if (msg->cprbx.cprb_ver_id == 0x02)
-                        return convert_type86_xcrb(zdev, reply, xcRB);
-                /* Fall through, no break, incorrect cprb version is an unknown
-                 * response */
-        default: /* Unknown response type, this should NEVER EVER happen */
-                xcRB->status = 0x0008044DL; /* HDD_InvalidParm */
-                zdev->online = 0;
-                return -EAGAIN; /* repeat the request on a different device. */
-        }
-}
-
-static int convert_response_rng(struct zcrypt_device *zdev,
-                                 struct ap_message *reply,
-                                 char *data)
-{
-        struct type86x_reply *msg = reply->message;
-
-        switch (msg->hdr.type) {
-        case TYPE82_RSP_CODE:
-        case TYPE88_RSP_CODE:
-                return -EINVAL;
-        case TYPE86_RSP_CODE:
-                if (msg->hdr.reply_code)
-                        return -EINVAL;
-                if (msg->cprbx.cprb_ver_id == 0x02)
-                        return convert_type86_rng(zdev, reply, data);
-                /* Fall through, no break, incorrect cprb version is an unknown
-                 * response */
-        default: /* Unknown response type, this should NEVER EVER happen */
-                zdev->online = 0;
-                return -EAGAIN; /* repeat the request on a different device. */
-        }
-}
-
-/**
- * This function is called from the AP bus code after a crypto request
- * "msg" has finished with the reply message "reply".
- * It is called from tasklet context.
- * @ap_dev: pointer to the AP device
- * @msg: pointer to the AP message
- * @reply: pointer to the AP reply message
- */
-static void zcrypt_pcixcc_receive(struct ap_device *ap_dev,
-                                  struct ap_message *msg,
-                                  struct ap_message *reply)
-{
-        static struct error_hdr error_reply = {
-                .type = TYPE82_RSP_CODE,
-                .reply_code = REP82_ERROR_MACHINE_FAILURE,
-        };
-        struct response_type *resp_type =
-                (struct response_type *) msg->private;
-        struct type86x_reply *t86r;
-        int length;
-
-        /* Copy the reply message to the request message buffer. */
-        if (IS_ERR(reply)) {
-                memcpy(msg->message, &error_reply, sizeof(error_reply));
-                goto out;
-        }
-        t86r = reply->message;
-        if (t86r->hdr.type == TYPE86_RSP_CODE &&
-                 t86r->cprbx.cprb_ver_id == 0x02) {
-                switch (resp_type->type) {
-                case PCIXCC_RESPONSE_TYPE_ICA:
-                        length = sizeof(struct type86x_reply)
-                                + t86r->length - 2;
-                        length = min(PCIXCC_MAX_ICA_RESPONSE_SIZE, length);
-                        memcpy(msg->message, reply->message, length);
-                        break;
-                case PCIXCC_RESPONSE_TYPE_XCRB:
-                        length = t86r->fmt2.offset2 + t86r->fmt2.count2;
-                        length = min(PCIXCC_MAX_XCRB_MESSAGE_SIZE, length);
-                        memcpy(msg->message, reply->message, length);
-                        break;
-                default:
-                        memcpy(msg->message, &error_reply, sizeof error_reply);
-                }
-        } else
-                memcpy(msg->message, reply->message, sizeof error_reply);
-out:
-        complete(&(resp_type->work));
-}
-
-static atomic_t zcrypt_step = ATOMIC_INIT(0);
-
-/**
- * The request distributor calls this function if it picked the PCIXCC/CEX2C
- * device to handle a modexpo request.
- * @zdev: pointer to zcrypt_device structure that identifies the
- *        PCIXCC/CEX2C device to the request distributor
- * @mex: pointer to the modexpo request buffer
- */
-static long zcrypt_pcixcc_modexpo(struct zcrypt_device *zdev,
-                                  struct ica_rsa_modexpo *mex)
-{
-        struct ap_message ap_msg;
-        struct response_type resp_type = {
-                .type = PCIXCC_RESPONSE_TYPE_ICA,
-        };
-        int rc;
-
-        ap_init_message(&ap_msg);
-        ap_msg.message = (void *) get_zeroed_page(GFP_KERNEL);
-        if (!ap_msg.message)
-                return -ENOMEM;
-        ap_msg.receive = zcrypt_pcixcc_receive;
-        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
-                                atomic_inc_return(&zcrypt_step);
-        ap_msg.private = &resp_type;
-        rc = ICAMEX_msg_to_type6MEX_msgX(zdev, &ap_msg, mex);
-        if (rc)
-                goto out_free;
-        init_completion(&resp_type.work);
-        ap_queue_message(zdev->ap_dev, &ap_msg);
-        rc = wait_for_completion_interruptible(&resp_type.work);
-        if (rc == 0)
-                rc = convert_response_ica(zdev, &ap_msg, mex->outputdata,
-                                          mex->outputdatalength);
-        else
-                /* Signal pending. */
-                ap_cancel_message(zdev->ap_dev, &ap_msg);
-out_free:
-        free_page((unsigned long) ap_msg.message);
-        return rc;
-}
-
-/**
- * The request distributor calls this function if it picked the PCIXCC/CEX2C
- * device to handle a modexpo_crt request.
- * @zdev: pointer to zcrypt_device structure that identifies the
- *        PCIXCC/CEX2C device to the request distributor
- * @crt: pointer to the modexpoc_crt request buffer
- */
-static long zcrypt_pcixcc_modexpo_crt(struct zcrypt_device *zdev,
-                                      struct ica_rsa_modexpo_crt *crt)
-{
-        struct ap_message ap_msg;
-        struct response_type resp_type = {
-                .type = PCIXCC_RESPONSE_TYPE_ICA,
-        };
-        int rc;
-
-        ap_init_message(&ap_msg);
-        ap_msg.message = (void *) get_zeroed_page(GFP_KERNEL);
-        if (!ap_msg.message)
-                return -ENOMEM;
-        ap_msg.receive = zcrypt_pcixcc_receive;
-        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
-                                atomic_inc_return(&zcrypt_step);
-        ap_msg.private = &resp_type;
-        rc = ICACRT_msg_to_type6CRT_msgX(zdev, &ap_msg, crt);
-        if (rc)
-                goto out_free;
-        init_completion(&resp_type.work);
-        ap_queue_message(zdev->ap_dev, &ap_msg);
-        rc = wait_for_completion_interruptible(&resp_type.work);
-        if (rc == 0)
-                rc = convert_response_ica(zdev, &ap_msg, crt->outputdata,
-                                          crt->outputdatalength);
-        else
-                /* Signal pending. */
-                ap_cancel_message(zdev->ap_dev, &ap_msg);
-out_free:
-        free_page((unsigned long) ap_msg.message);
-        return rc;
-}
-
-/**
- * The request distributor calls this function if it picked the PCIXCC/CEX2C
- * device to handle a send_cprb request.
- * @zdev: pointer to zcrypt_device structure that identifies the
- *        PCIXCC/CEX2C device to the request distributor
- * @xcRB: pointer to the send_cprb request buffer
- */
-static long zcrypt_pcixcc_send_cprb(struct zcrypt_device *zdev,
-                                    struct ica_xcRB *xcRB)
-{
-        struct ap_message ap_msg;
-        struct response_type resp_type = {
-                .type = PCIXCC_RESPONSE_TYPE_XCRB,
-        };
-        int rc;
-
-        ap_init_message(&ap_msg);
-        ap_msg.message = kmalloc(PCIXCC_MAX_XCRB_MESSAGE_SIZE, GFP_KERNEL);
-        if (!ap_msg.message)
-                return -ENOMEM;
-        ap_msg.receive = zcrypt_pcixcc_receive;
-        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
-                                atomic_inc_return(&zcrypt_step);
-        ap_msg.private = &resp_type;
-        rc = XCRB_msg_to_type6CPRB_msgX(zdev, &ap_msg, xcRB);
-        if (rc)
-                goto out_free;
-        init_completion(&resp_type.work);
-        ap_queue_message(zdev->ap_dev, &ap_msg);
-        rc = wait_for_completion_interruptible(&resp_type.work);
-        if (rc == 0)
-                rc = convert_response_xcrb(zdev, &ap_msg, xcRB);
-        else
-                /* Signal pending. */
-                ap_cancel_message(zdev->ap_dev, &ap_msg);
-out_free:
-        kzfree(ap_msg.message);
-        return rc;
-}
-
-/**
- * The request distributor calls this function if it picked the PCIXCC/CEX2C
- * device to generate random data.
- * @zdev: pointer to zcrypt_device structure that identifies the
- *        PCIXCC/CEX2C device to the request distributor
- * @buffer: pointer to a memory page to return random data
- */
-
-static long zcrypt_pcixcc_rng(struct zcrypt_device *zdev,
-                                    char *buffer)
-{
-        struct ap_message ap_msg;
-        struct response_type resp_type = {
-                .type = PCIXCC_RESPONSE_TYPE_XCRB,
-        };
-        int rc;
-
-        ap_init_message(&ap_msg);
-        ap_msg.message = kmalloc(PCIXCC_MAX_XCRB_MESSAGE_SIZE, GFP_KERNEL);
-        if (!ap_msg.message)
-                return -ENOMEM;
-        ap_msg.receive = zcrypt_pcixcc_receive;
-        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
-                                atomic_inc_return(&zcrypt_step);
-        ap_msg.private = &resp_type;
-        rng_type6CPRB_msgX(zdev->ap_dev, &ap_msg, ZCRYPT_RNG_BUFFER_SIZE);
-        init_completion(&resp_type.work);
-        ap_queue_message(zdev->ap_dev, &ap_msg);
-        rc = wait_for_completion_interruptible(&resp_type.work);
-        if (rc == 0)
-                rc = convert_response_rng(zdev, &ap_msg, buffer);
-        else
-                /* Signal pending. */
-                ap_cancel_message(zdev->ap_dev, &ap_msg);
-        kfree(ap_msg.message);
-        return rc;
-}
-
-/**
- * The crypto operations for a PCIXCC/CEX2C card.
- */
-static struct zcrypt_ops zcrypt_pcixcc_ops = {
-        .rsa_modexpo = zcrypt_pcixcc_modexpo,
-        .rsa_modexpo_crt = zcrypt_pcixcc_modexpo_crt,
-        .send_cprb = zcrypt_pcixcc_send_cprb,
-};
-
-static struct zcrypt_ops zcrypt_pcixcc_with_rng_ops = {
-        .rsa_modexpo = zcrypt_pcixcc_modexpo,
-        .rsa_modexpo_crt = zcrypt_pcixcc_modexpo_crt,
-        .send_cprb = zcrypt_pcixcc_send_cprb,
-        .rng = zcrypt_pcixcc_rng,
-};
-
-/**
  * Micro-code detection function. Its sends a message to a pcixcc card
  * to find out the microcode level.
  * @ap_dev: pointer to the AP device.
@@ -1083,9 +323,11 @@ static int zcrypt_pcixcc_probe(struct ap_device *ap_dev)
                 return rc;
         }
         if (rc)
-                zdev->ops = &zcrypt_pcixcc_with_rng_ops;
+                zdev->ops = zcrypt_msgtype_request(MSGTYPE06_NAME,
+                                                   MSGTYPE06_VARIANT_DEFAULT);
         else
-                zdev->ops = &zcrypt_pcixcc_ops;
+                zdev->ops = zcrypt_msgtype_request(MSGTYPE06_NAME,
+                                                   MSGTYPE06_VARIANT_NORNG);
         ap_dev->reply = &zdev->reply;
         ap_dev->private = zdev;
         rc = zcrypt_device_register(zdev);
@@ -1095,6 +337,7 @@ static int zcrypt_pcixcc_probe(struct ap_device *ap_dev)
 
  out_free:
         ap_dev->private = NULL;
+        zcrypt_msgtype_release(zdev->ops);
         zcrypt_device_free(zdev);
         return rc;
 }
@@ -1106,8 +349,10 @@ static int zcrypt_pcixcc_probe(struct ap_device *ap_dev)
 static void zcrypt_pcixcc_remove(struct ap_device *ap_dev)
 {
         struct zcrypt_device *zdev = ap_dev->private;
+        struct zcrypt_ops *zops = zdev->ops;
 
         zcrypt_device_unregister(zdev);
+        zcrypt_msgtype_release(zops);
 }
 
 int __init zcrypt_pcixcc_init(void)
diff --git a/drivers/s390/crypto/zcrypt_pcixcc.h b/drivers/s390/crypto/zcrypt_pcixcc.h
index c7cdf599e46b..eacafc8962f2 100644
--- a/drivers/s390/crypto/zcrypt_pcixcc.h
+++ b/drivers/s390/crypto/zcrypt_pcixcc.h
@@ -1,12 +1,13 @@
 /*
  *  zcrypt 2.1.0
  *
- *  Copyright IBM Corp. 2001, 2006
+ *  Copyright IBM Corp. 2001, 2012
  *  Author(s): Robert Burroughs
  *             Eric Rossman (edrossma@us.ibm.com)
  *
  *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
  *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 7a8b09612c41..cf6da7fafe54 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -2993,7 +2993,7 @@ static void qeth_get_trap_id(struct qeth_card *card, struct qeth_trap_id *tid)
         struct sysinfo_2_2_2 *info222 = (struct sysinfo_2_2_2 *)info;
         struct sysinfo_3_2_2 *info322 = (struct sysinfo_3_2_2 *)info;
         struct ccw_dev_id ccwid;
-        int level, rc;
+        int level;
 
         tid->chpid = card->info.chpid;
         ccw_device_get_id(CARD_RDEV(card), &ccwid);
@@ -3001,17 +3001,10 @@ static void qeth_get_trap_id(struct qeth_card *card, struct qeth_trap_id *tid)
         tid->devno = ccwid.devno;
         if (!info)
                 return;
-
-        rc = stsi(NULL, 0, 0, 0);
-        if (rc == -ENOSYS)
-                level = rc;
-        else
-                level = (((unsigned int) rc) >> 28);
-
-        if ((level >= 2) && (stsi(info222, 2, 2, 2) != -ENOSYS))
+        level = stsi(NULL, 0, 0, 0);
+        if ((level >= 2) && (stsi(info222, 2, 2, 2) == 0))
                 tid->lparnr = info222->lpar_number;
-
-        if ((level >= 3) && (stsi(info322, 3, 2, 2) != -ENOSYS)) {
+        if ((level >= 3) && (stsi(info322, 3, 2, 2) == 0)) {
                 EBCASC(info322->vm[0].name, sizeof(info322->vm[0].name));
                 memcpy(tid->vmname, info322->vm[0].name, sizeof(tid->vmname));
         }
diff --git a/include/linux/elf.h b/include/linux/elf.h
index 999b4f52e8e5..f930b1a390ab 100644
--- a/include/linux/elf.h
+++ b/include/linux/elf.h
@@ -387,6 +387,7 @@ typedef struct elf64_shdr {
 #define NT_S390_PREFIX  0x305           /* s390 prefix register */
 #define NT_S390_LAST_BREAK      0x306   /* s390 breaking event address */
 #define NT_S390_SYSTEM_CALL     0x307   /* s390 system call restart data */
+#define NT_S390_TDB     0x308           /* s390 transaction diagnostic block */
 #define NT_ARM_VFP      0x400           /* ARM VFP/NEON registers */
 
 
diff --git a/scripts/sortextable.c b/scripts/sortextable.c
index 6acf83449105..f19ddc47304c 100644
--- a/scripts/sortextable.c
+++ b/scripts/sortextable.c
@@ -161,7 +161,7 @@ typedef void (*table_sort_t)(char *, int);
 #define SORTEXTABLE_64
 #include "sortextable.h"
 
-static int compare_x86_table(const void *a, const void *b)
+static int compare_relative_table(const void *a, const void *b)
 {
         int32_t av = (int32_t)r(a);
         int32_t bv = (int32_t)r(b);
@@ -173,7 +173,7 @@ static int compare_x86_table(const void *a, const void *b)
         return 0;
 }
 
-static void sort_x86_table(char *extab_image, int image_size)
+static void sort_relative_table(char *extab_image, int image_size)
 {
         int i;
 
@@ -188,7 +188,7 @@ static void sort_x86_table(char *extab_image, int image_size)
                 i += 4;
         }
 
-        qsort(extab_image, image_size / 8, 8, compare_x86_table);
+        qsort(extab_image, image_size / 8, 8, compare_relative_table);
 
         /* Now denormalize. */
         i = 0;
@@ -245,9 +245,9 @@ do_file(char const *const fname)
                 break;
         case EM_386:
         case EM_X86_64:
-                custom_sort = sort_x86_table;
-                break;
         case EM_S390:
+                custom_sort = sort_relative_table;
+                break;
         case EM_MIPS:
                 break;
         }  /* end switch */