17 files changed, 231 insertions, 169 deletions

diff --git a/arch/s390/include/asm/Kbuild b/arch/s390/include/asm/Kbuild
index 8386a4a1f19a..57892a8a9055 100644
--- a/arch/s390/include/asm/Kbuild
+++ b/arch/s390/include/asm/Kbuild
@@ -1,6 +1,7 @@
 
 
 generic-y += clkdev.h
-generic-y += trace_clock.h
-generic-y += preempt.h
 generic-y += hash.h
+generic-y += mcs_spinlock.h
+generic-y += preempt.h
+generic-y += trace_clock.h
diff --git a/arch/s390/include/asm/bitops.h b/arch/s390/include/asm/bitops.h
index 6e6ad0680829..ec5ef891db6b 100644
--- a/arch/s390/include/asm/bitops.h
+++ b/arch/s390/include/asm/bitops.h
@@ -13,9 +13,9 @@
  *
  * The bitop functions are defined to work on unsigned longs, so for an
  * s390x system the bits end up numbered:
- *   |63..............0|127............64|191...........128|255...........196|
+ *   |63..............0|127............64|191...........128|255...........192|
  * and on s390:
- *   |31.....0|63....31|95....64|127...96|159..128|191..160|223..192|255..224|
+ *   |31.....0|63....32|95....64|127...96|159..128|191..160|223..192|255..224|
  *
  * There are a few little-endian macros used mostly for filesystem
  * bitmaps, these work on similar bit arrays layouts, but
@@ -30,7 +30,7 @@
  * on an s390x system the bits are numbered:
  *   |0..............63|64............127|128...........191|192...........255|
  * and on s390:
- *   |0.....31|31....63|64....95|96...127|128..159|160..191|192..223|224..255|
+ *   |0.....31|32....63|64....95|96...127|128..159|160..191|192..223|224..255|
  *
  * The main difference is that bit 0-63 (64b) or 0-31 (32b) in the bit
  * number field needs to be reversed compared to the LSB0 encoded bit
@@ -304,7 +304,7 @@ static inline int test_bit(unsigned long nr, const volatile unsigned long *ptr)
  * On an s390x system the bits are numbered:
  *   |0..............63|64............127|128...........191|192...........255|
  * and on s390:
- *   |0.....31|31....63|64....95|96...127|128..159|160..191|192..223|224..255|
+ *   |0.....31|32....63|64....95|96...127|128..159|160..191|192..223|224..255|
  */
 unsigned long find_first_bit_inv(const unsigned long *addr, unsigned long size);
 unsigned long find_next_bit_inv(const unsigned long *addr, unsigned long size,
diff --git a/arch/s390/include/asm/ccwdev.h b/arch/s390/include/asm/ccwdev.h
index f201af8be580..a9c2c0686177 100644
--- a/arch/s390/include/asm/ccwdev.h
+++ b/arch/s390/include/asm/ccwdev.h
@@ -219,7 +219,9 @@ extern void ccw_device_get_id(struct ccw_device *, struct ccw_dev_id *);
 #define to_ccwdev(n) container_of(n, struct ccw_device, dev)
 #define to_ccwdrv(n) container_of(n, struct ccw_driver, driver)
 
-extern struct ccw_device *ccw_device_probe_console(void);
+extern struct ccw_device *ccw_device_create_console(struct ccw_driver *);
+extern void ccw_device_destroy_console(struct ccw_device *);
+extern int ccw_device_enable_console(struct ccw_device *);
 extern void ccw_device_wait_idle(struct ccw_device *);
 extern int ccw_device_force_console(struct ccw_device *);
 
diff --git a/arch/s390/include/asm/ccwgroup.h b/arch/s390/include/asm/ccwgroup.h
index 23723ce5ca7a..6e670f88d125 100644
--- a/arch/s390/include/asm/ccwgroup.h
+++ b/arch/s390/include/asm/ccwgroup.h
@@ -23,6 +23,7 @@ struct ccwgroup_device {
         unsigned int count;
         struct device   dev;
         struct ccw_device *cdev[0];
+        struct work_struct ungroup_work;
 };
 
 /**
diff --git a/arch/s390/include/asm/checksum.h b/arch/s390/include/asm/checksum.h
index 4f57a4f3909a..740364856355 100644
--- a/arch/s390/include/asm/checksum.h
+++ b/arch/s390/include/asm/checksum.h
@@ -44,22 +44,15 @@ csum_partial(const void *buff, int len, __wsum sum)
  * here even more important to align src and dst on a 32-bit (or even
  * better 64-bit) boundary
  *
- * Copy from userspace and compute checksum.  If we catch an exception
- * then zero the rest of the buffer.
+ * Copy from userspace and compute checksum.
  */
 static inline __wsum
 csum_partial_copy_from_user(const void __user *src, void *dst,
                                           int len, __wsum sum,
                                           int *err_ptr)
 {
-        int missing;
-
-        missing = copy_from_user(dst, src, len);
-        if (missing) {
-                memset(dst + len - missing, 0, missing);
+        if (unlikely(copy_from_user(dst, src, len)))
                 *err_ptr = -EFAULT;
-        }
-                
         return csum_partial(dst, len, sum);
 }
 
diff --git a/arch/s390/include/asm/compat.h b/arch/s390/include/asm/compat.h
index 5d7e8cf83bd6..d350ed9d0fbb 100644
--- a/arch/s390/include/asm/compat.h
+++ b/arch/s390/include/asm/compat.h
@@ -8,7 +8,11 @@
 #include <linux/thread_info.h>
 
 #define __TYPE_IS_PTR(t) (!__builtin_types_compatible_p(typeof(0?(t)0:0ULL), u64))
-#define __SC_DELOUSE(t,v) (t)(__TYPE_IS_PTR(t) ? ((v) & 0x7fffffff) : (v))
+
+#define __SC_DELOUSE(t,v) ({ \
+        BUILD_BUG_ON(sizeof(t) > 4 && !__TYPE_IS_PTR(t)); \
+        (t)(__TYPE_IS_PTR(t) ? ((v) & 0x7fffffff) : (v)); \
+})
 
 #define PSW32_MASK_PER          0x40000000UL
 #define PSW32_MASK_DAT          0x04000000UL
diff --git a/arch/s390/include/asm/futex.h b/arch/s390/include/asm/futex.h
index 51bcaa0fdeef..fda46bd38c99 100644
--- a/arch/s390/include/asm/futex.h
+++ b/arch/s390/include/asm/futex.h
@@ -5,7 +5,10 @@
 #include <linux/uaccess.h>
 #include <asm/errno.h>
 
-static inline int futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
+int futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, u32 oldval, u32 newval);
+int __futex_atomic_op_inuser(int op, u32 __user *uaddr, int oparg, int *old);
+
+static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
 {
         int op = (encoded_op >> 28) & 7;
         int cmp = (encoded_op >> 24) & 15;
@@ -17,7 +20,7 @@ static inline int futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
                 oparg = 1 << oparg;
 
         pagefault_disable();
-        ret = uaccess.futex_atomic_op(op, uaddr, oparg, &oldval);
+        ret = __futex_atomic_op_inuser(op, uaddr, oparg, &oldval);
         pagefault_enable();
 
         if (!ret) {
@@ -34,10 +37,4 @@ static inline int futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
         return ret;
 }
 
-static inline int futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
-                                                u32 oldval, u32 newval)
-{
-        return uaccess.futex_atomic_cmpxchg(uval, uaddr, oldval, newval);
-}
-
 #endif /* _ASM_S390_FUTEX_H */
diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
index 68897fc65950..154b60089be9 100644
--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -116,7 +116,9 @@ struct kvm_s390_sie_block {
         __u64   gbea;                   /* 0x0180 */
         __u8    reserved188[24];        /* 0x0188 */
         __u32   fac;                    /* 0x01a0 */
-        __u8    reserved1a4[58];        /* 0x01a4 */
+        __u8    reserved1a4[20];        /* 0x01a4 */
+        __u64   cbrlo;                  /* 0x01b8 */
+        __u8    reserved1c0[30];        /* 0x01c0 */
         __u64   pp;                     /* 0x01de */
         __u8    reserved1e6[2];         /* 0x01e6 */
         __u64   itdba;                  /* 0x01e8 */
@@ -167,6 +169,7 @@ struct kvm_vcpu_stat {
         u32 instruction_stsi;
         u32 instruction_stfl;
         u32 instruction_tprot;
+        u32 instruction_essa;
         u32 instruction_sigp_sense;
         u32 instruction_sigp_sense_running;
         u32 instruction_sigp_external_call;
diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
index 5d1f950704dc..38149b63dc44 100644
--- a/arch/s390/include/asm/mmu_context.h
+++ b/arch/s390/include/asm/mmu_context.h
@@ -48,13 +48,42 @@ static inline void update_mm(struct mm_struct *mm, struct task_struct *tsk)
 static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
                              struct task_struct *tsk)
 {
-        cpumask_set_cpu(smp_processor_id(), mm_cpumask(next));
-        update_mm(next, tsk);
+        int cpu = smp_processor_id();
+
+        if (prev == next)
+                return;
+        if (atomic_inc_return(&next->context.attach_count) >> 16) {
+                /* Delay update_mm until all TLB flushes are done. */
+                set_tsk_thread_flag(tsk, TIF_TLB_WAIT);
+        } else {
+                cpumask_set_cpu(cpu, mm_cpumask(next));
+                update_mm(next, tsk);
+                if (next->context.flush_mm)
+                        /* Flush pending TLBs */
+                        __tlb_flush_mm(next);
+        }
         atomic_dec(&prev->context.attach_count);
         WARN_ON(atomic_read(&prev->context.attach_count) < 0);
-        atomic_inc(&next->context.attach_count);
-        /* Check for TLBs not flushed yet */
-        __tlb_flush_mm_lazy(next);
+}
+
+#define finish_arch_post_lock_switch finish_arch_post_lock_switch
+static inline void finish_arch_post_lock_switch(void)
+{
+        struct task_struct *tsk = current;
+        struct mm_struct *mm = tsk->mm;
+
+        if (!test_tsk_thread_flag(tsk, TIF_TLB_WAIT))
+                return;
+        preempt_disable();
+        clear_tsk_thread_flag(tsk, TIF_TLB_WAIT);
+        while (atomic_read(&mm->context.attach_count) >> 16)
+                cpu_relax();
+
+        cpumask_set_cpu(smp_processor_id(), mm_cpumask(mm));
+        update_mm(mm, tsk);
+        if (mm->context.flush_mm)
+                __tlb_flush_mm(mm);
+        preempt_enable();
 }
 
 #define enter_lazy_tlb(mm,tsk)  do { } while (0)
diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h
index e1408ddb94f8..884017cbfa9f 100644
--- a/arch/s390/include/asm/pgalloc.h
+++ b/arch/s390/include/asm/pgalloc.h
@@ -22,6 +22,7 @@ unsigned long *page_table_alloc(struct mm_struct *, unsigned long);
 void page_table_free(struct mm_struct *, unsigned long *);
 void page_table_free_rcu(struct mmu_gather *, unsigned long *);
 
+void page_table_reset_pgste(struct mm_struct *, unsigned long, unsigned long);
 int set_guest_storage_key(struct mm_struct *mm, unsigned long addr,
                           unsigned long key, bool nq);
 
@@ -91,11 +92,22 @@ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address)
 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long vmaddr)
 {
         unsigned long *table = crst_table_alloc(mm);
-        if (table)
-                crst_table_init(table, _SEGMENT_ENTRY_EMPTY);
+
+        if (!table)
+                return NULL;
+        crst_table_init(table, _SEGMENT_ENTRY_EMPTY);
+        if (!pgtable_pmd_page_ctor(virt_to_page(table))) {
+                crst_table_free(mm, table);
+                return NULL;
+        }
         return (pmd_t *) table;
 }
-#define pmd_free(mm, pmd) crst_table_free(mm, (unsigned long *) pmd)
+
+static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
+{
+        pgtable_pmd_page_dtor(virt_to_page(pmd));
+        crst_table_free(mm, (unsigned long *) pmd);
+}
 
 static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
 {
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 66101f6c6d81..50a75d96f939 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -229,6 +229,7 @@ extern unsigned long MODULES_END;
 #define _PAGE_READ      0x010           /* SW pte read bit */
 #define _PAGE_WRITE     0x020           /* SW pte write bit */
 #define _PAGE_SPECIAL   0x040           /* SW associated with special page */
+#define _PAGE_UNUSED    0x080           /* SW bit for pgste usage state */
 #define __HAVE_ARCH_PTE_SPECIAL
 
 /* Set of bits not changed in pte_modify */
@@ -394,6 +395,12 @@ extern unsigned long MODULES_END;
 
 #endif /* CONFIG_64BIT */
 
+/* Guest Page State used for virtualization */
+#define _PGSTE_GPS_ZERO         0x0000000080000000UL
+#define _PGSTE_GPS_USAGE_MASK   0x0000000003000000UL
+#define _PGSTE_GPS_USAGE_STABLE 0x0000000000000000UL
+#define _PGSTE_GPS_USAGE_UNUSED 0x0000000001000000UL
+
 /*
  * A user page table pointer has the space-switch-event bit, the
  * private-space-control bit and the storage-alteration-event-control
@@ -617,6 +624,14 @@ static inline int pte_none(pte_t pte)
         return pte_val(pte) == _PAGE_INVALID;
 }
 
+static inline int pte_swap(pte_t pte)
+{
+        /* Bit pattern: (pte & 0x603) == 0x402 */
+        return (pte_val(pte) & (_PAGE_INVALID | _PAGE_PROTECT |
+                                _PAGE_TYPE | _PAGE_PRESENT))
+                == (_PAGE_INVALID | _PAGE_TYPE);
+}
+
 static inline int pte_file(pte_t pte)
 {
         /* Bit pattern: (pte & 0x601) == 0x600 */
@@ -823,20 +838,20 @@ unsigned long gmap_translate(unsigned long address, struct gmap *);
 unsigned long __gmap_fault(unsigned long address, struct gmap *);
 unsigned long gmap_fault(unsigned long address, struct gmap *);
 void gmap_discard(unsigned long from, unsigned long to, struct gmap *);
+void __gmap_zap(unsigned long address, struct gmap *);
 
 void gmap_register_ipte_notifier(struct gmap_notifier *);
 void gmap_unregister_ipte_notifier(struct gmap_notifier *);
 int gmap_ipte_notify(struct gmap *, unsigned long start, unsigned long len);
-void gmap_do_ipte_notify(struct mm_struct *, unsigned long addr, pte_t *);
+void gmap_do_ipte_notify(struct mm_struct *, pte_t *);
 
 static inline pgste_t pgste_ipte_notify(struct mm_struct *mm,
-                                        unsigned long addr,
                                         pte_t *ptep, pgste_t pgste)
 {
 #ifdef CONFIG_PGSTE
         if (pgste_val(pgste) & PGSTE_IN_BIT) {
                 pgste_val(pgste) &= ~PGSTE_IN_BIT;
-                gmap_do_ipte_notify(mm, addr, ptep);
+                gmap_do_ipte_notify(mm, ptep);
         }
 #endif
         return pgste;
@@ -854,6 +869,7 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
 
         if (mm_has_pgste(mm)) {
                 pgste = pgste_get_lock(ptep);
+                pgste_val(pgste) &= ~_PGSTE_GPS_ZERO;
                 pgste_set_key(ptep, pgste, entry);
                 pgste_set_pte(ptep, entry);
                 pgste_set_unlock(ptep, pgste);
@@ -883,6 +899,12 @@ static inline int pte_young(pte_t pte)
         return (pte_val(pte) & _PAGE_YOUNG) != 0;
 }
 
+#define __HAVE_ARCH_PTE_UNUSED
+static inline int pte_unused(pte_t pte)
+{
+        return pte_val(pte) & _PAGE_UNUSED;
+}
+
 /*
  * pgd/pmd/pte modification functions
  */
@@ -1036,30 +1058,41 @@ static inline int ptep_test_and_clear_user_young(struct mm_struct *mm,
 
 static inline void __ptep_ipte(unsigned long address, pte_t *ptep)
 {
-        if (!(pte_val(*ptep) & _PAGE_INVALID)) {
+        unsigned long pto = (unsigned long) ptep;
+
 #ifndef CONFIG_64BIT
-                /* pto must point to the start of the segment table */
-                pte_t *pto = (pte_t *) (((unsigned long) ptep) & 0x7ffffc00);
-#else
-                /* ipte in zarch mode can do the math */
-                pte_t *pto = ptep;
+        /* pto in ESA mode must point to the start of the segment table */
+        pto &= 0x7ffffc00;
 #endif
-                asm volatile(
-                        "       ipte    %2,%3"
-                        : "=m" (*ptep) : "m" (*ptep),
-                          "a" (pto), "a" (address));
-        }
+        /* Invalidation + global TLB flush for the pte */
+        asm volatile(
+                "       ipte    %2,%3"
+                : "=m" (*ptep) : "m" (*ptep), "a" (pto), "a" (address));
+}
+
+static inline void ptep_flush_direct(struct mm_struct *mm,
+                                     unsigned long address, pte_t *ptep)
+{
+        if (pte_val(*ptep) & _PAGE_INVALID)
+                return;
+        __ptep_ipte(address, ptep);
 }
 
 static inline void ptep_flush_lazy(struct mm_struct *mm,
                                    unsigned long address, pte_t *ptep)
 {
-        int active = (mm == current->active_mm) ? 1 : 0;
+        int active, count;
 
-        if (atomic_read(&mm->context.attach_count) > active)
-                __ptep_ipte(address, ptep);
-        else
+        if (pte_val(*ptep) & _PAGE_INVALID)
+                return;
+        active = (mm == current->active_mm) ? 1 : 0;
+        count = atomic_add_return(0x10000, &mm->context.attach_count);
+        if ((count & 0xffff) <= active) {
+                pte_val(*ptep) |= _PAGE_INVALID;
                 mm->context.flush_mm = 1;
+        } else
+                __ptep_ipte(address, ptep);
+        atomic_sub(0x10000, &mm->context.attach_count);
 }
 
 #define __HAVE_ARCH_PTEP_TEST_AND_CLEAR_YOUNG
@@ -1072,11 +1105,11 @@ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma,
 
         if (mm_has_pgste(vma->vm_mm)) {
                 pgste = pgste_get_lock(ptep);
-                pgste = pgste_ipte_notify(vma->vm_mm, addr, ptep, pgste);
+                pgste = pgste_ipte_notify(vma->vm_mm, ptep, pgste);
         }
 
         pte = *ptep;
-        __ptep_ipte(addr, ptep);
+        ptep_flush_direct(vma->vm_mm, addr, ptep);
         young = pte_young(pte);
         pte = pte_mkold(pte);
 
@@ -1118,7 +1151,7 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm,
 
         if (mm_has_pgste(mm)) {
                 pgste = pgste_get_lock(ptep);
-                pgste = pgste_ipte_notify(mm, address, ptep, pgste);
+                pgste = pgste_ipte_notify(mm, ptep, pgste);
         }
 
         pte = *ptep;
@@ -1142,12 +1175,11 @@ static inline pte_t ptep_modify_prot_start(struct mm_struct *mm,
 
         if (mm_has_pgste(mm)) {
                 pgste = pgste_get_lock(ptep);
-                pgste_ipte_notify(mm, address, ptep, pgste);
+                pgste_ipte_notify(mm, ptep, pgste);
         }
 
         pte = *ptep;
         ptep_flush_lazy(mm, address, ptep);
-        pte_val(*ptep) |= _PAGE_INVALID;
 
         if (mm_has_pgste(mm)) {
                 pgste = pgste_update_all(&pte, pgste);
@@ -1180,14 +1212,17 @@ static inline pte_t ptep_clear_flush(struct vm_area_struct *vma,
 
         if (mm_has_pgste(vma->vm_mm)) {
                 pgste = pgste_get_lock(ptep);
-                pgste = pgste_ipte_notify(vma->vm_mm, address, ptep, pgste);
+                pgste = pgste_ipte_notify(vma->vm_mm, ptep, pgste);
         }
 
         pte = *ptep;
-        __ptep_ipte(address, ptep);
+        ptep_flush_direct(vma->vm_mm, address, ptep);
         pte_val(*ptep) = _PAGE_INVALID;
 
         if (mm_has_pgste(vma->vm_mm)) {
+                if ((pgste_val(pgste) & _PGSTE_GPS_USAGE_MASK) ==
+                    _PGSTE_GPS_USAGE_UNUSED)
+                        pte_val(pte) |= _PAGE_UNUSED;
                 pgste = pgste_update_all(&pte, pgste);
                 pgste_set_unlock(ptep, pgste);
         }
@@ -1211,7 +1246,7 @@ static inline pte_t ptep_get_and_clear_full(struct mm_struct *mm,
 
         if (!full && mm_has_pgste(mm)) {
                 pgste = pgste_get_lock(ptep);
-                pgste = pgste_ipte_notify(mm, address, ptep, pgste);
+                pgste = pgste_ipte_notify(mm, ptep, pgste);
         }
 
         pte = *ptep;
@@ -1236,7 +1271,7 @@ static inline pte_t ptep_set_wrprotect(struct mm_struct *mm,
         if (pte_write(pte)) {
                 if (mm_has_pgste(mm)) {
                         pgste = pgste_get_lock(ptep);
-                        pgste = pgste_ipte_notify(mm, address, ptep, pgste);
+                        pgste = pgste_ipte_notify(mm, ptep, pgste);
                 }
 
                 ptep_flush_lazy(mm, address, ptep);
@@ -1262,10 +1297,10 @@ static inline int ptep_set_access_flags(struct vm_area_struct *vma,
                 return 0;
         if (mm_has_pgste(vma->vm_mm)) {
                 pgste = pgste_get_lock(ptep);
-                pgste = pgste_ipte_notify(vma->vm_mm, address, ptep, pgste);
+                pgste = pgste_ipte_notify(vma->vm_mm, ptep, pgste);
         }
 
-        __ptep_ipte(address, ptep);
+        ptep_flush_direct(vma->vm_mm, address, ptep);
 
         if (mm_has_pgste(vma->vm_mm)) {
                 pgste_set_pte(ptep, entry);
@@ -1449,12 +1484,16 @@ static inline pmd_t pmd_mkwrite(pmd_t pmd)
 static inline void pmdp_flush_lazy(struct mm_struct *mm,
                                    unsigned long address, pmd_t *pmdp)
 {
-        int active = (mm == current->active_mm) ? 1 : 0;
+        int active, count;
 
-        if ((atomic_read(&mm->context.attach_count) & 0xffff) > active)
-                __pmd_idte(address, pmdp);
-        else
+        active = (mm == current->active_mm) ? 1 : 0;
+        count = atomic_add_return(0x10000, &mm->context.attach_count);
+        if ((count & 0xffff) <= active) {
+                pmd_val(*pmdp) |= _SEGMENT_ENTRY_INVALID;
                 mm->context.flush_mm = 1;
+        } else
+                __pmd_idte(address, pmdp);
+        atomic_sub(0x10000, &mm->context.attach_count);
 }
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
diff --git a/arch/s390/include/asm/ptrace.h b/arch/s390/include/asm/ptrace.h
index 9c82cebddabd..f4783c0b7b43 100644
--- a/arch/s390/include/asm/ptrace.h
+++ b/arch/s390/include/asm/ptrace.h
@@ -83,6 +83,7 @@ struct per_struct_kernel {
  * These are defined as per linux/ptrace.h, which see.
  */
 #define arch_has_single_step()  (1)
+#define arch_has_block_step()   (1)
 
 #define user_mode(regs) (((regs)->psw.mask & PSW_MASK_PSTATE) != 0)
 #define instruction_pointer(regs) ((regs)->psw.addr & PSW_ADDR_INSN)
diff --git a/arch/s390/include/asm/sclp.h b/arch/s390/include/asm/sclp.h
index abaca2275c7a..2f5e9932b4de 100644
--- a/arch/s390/include/asm/sclp.h
+++ b/arch/s390/include/asm/sclp.h
@@ -46,6 +46,7 @@ int sclp_cpu_configure(u8 cpu);
 int sclp_cpu_deconfigure(u8 cpu);
 unsigned long long sclp_get_rnmax(void);
 unsigned long long sclp_get_rzm(void);
+unsigned int sclp_get_max_cpu(void);
 int sclp_sdias_blk_count(void);
 int sclp_sdias_copy(void *dest, int blk_num, int nr_blks);
 int sclp_chp_configure(struct chp_id chpid);
diff --git a/arch/s390/include/asm/setup.h b/arch/s390/include/asm/setup.h
index 94cfbe442f12..406f3a1e63ef 100644
--- a/arch/s390/include/asm/setup.h
+++ b/arch/s390/include/asm/setup.h
@@ -59,7 +59,6 @@ void create_mem_hole(struct mem_chunk mem_chunk[], unsigned long addr,
 #define MACHINE_FLAG_DIAG44     (1UL << 4)
 #define MACHINE_FLAG_IDTE       (1UL << 5)
 #define MACHINE_FLAG_DIAG9C     (1UL << 6)
-#define MACHINE_FLAG_MVCOS      (1UL << 7)
 #define MACHINE_FLAG_KVM        (1UL << 8)
 #define MACHINE_FLAG_ESOP       (1UL << 9)
 #define MACHINE_FLAG_EDAT1      (1UL << 10)
@@ -85,7 +84,6 @@ void create_mem_hole(struct mem_chunk mem_chunk[], unsigned long addr,
 #define MACHINE_HAS_IDTE        (0)
 #define MACHINE_HAS_DIAG44      (1)
 #define MACHINE_HAS_MVPG        (S390_lowcore.machine_flags & MACHINE_FLAG_MVPG)
-#define MACHINE_HAS_MVCOS       (0)
 #define MACHINE_HAS_EDAT1       (0)
 #define MACHINE_HAS_EDAT2       (0)
 #define MACHINE_HAS_LPP         (0)
@@ -98,7 +96,6 @@ void create_mem_hole(struct mem_chunk mem_chunk[], unsigned long addr,
 #define MACHINE_HAS_IDTE        (S390_lowcore.machine_flags & MACHINE_FLAG_IDTE)
 #define MACHINE_HAS_DIAG44      (S390_lowcore.machine_flags & MACHINE_FLAG_DIAG44)
 #define MACHINE_HAS_MVPG        (1)
-#define MACHINE_HAS_MVCOS       (S390_lowcore.machine_flags & MACHINE_FLAG_MVCOS)
 #define MACHINE_HAS_EDAT1       (S390_lowcore.machine_flags & MACHINE_FLAG_EDAT1)
 #define MACHINE_HAS_EDAT2       (S390_lowcore.machine_flags & MACHINE_FLAG_EDAT2)
 #define MACHINE_HAS_LPP         (S390_lowcore.machine_flags & MACHINE_FLAG_LPP)
diff --git a/arch/s390/include/asm/thread_info.h b/arch/s390/include/asm/thread_info.h
index 10e0fcd3633d..3ccd71b90345 100644
--- a/arch/s390/include/asm/thread_info.h
+++ b/arch/s390/include/asm/thread_info.h
@@ -81,6 +81,7 @@ static inline struct thread_info *current_thread_info(void)
 #define TIF_NOTIFY_RESUME       1       /* callback before returning to user */
 #define TIF_SIGPENDING          2       /* signal pending */
 #define TIF_NEED_RESCHED        3       /* rescheduling necessary */
+#define TIF_TLB_WAIT            4       /* wait for TLB flush completion */
 #define TIF_PER_TRAP            6       /* deliver sigtrap on return to user */
 #define TIF_MCCK_PENDING        7       /* machine check handling is pending */
 #define TIF_SYSCALL_TRACE       8       /* syscall trace active */
@@ -91,11 +92,13 @@ static inline struct thread_info *current_thread_info(void)
 #define TIF_MEMDIE              18      /* is terminating due to OOM killer */
 #define TIF_RESTORE_SIGMASK     19      /* restore signal mask in do_signal() */
 #define TIF_SINGLE_STEP         20      /* This task is single stepped */
+#define TIF_BLOCK_STEP          21      /* This task is block stepped */
 
 #define _TIF_SYSCALL            (1<<TIF_SYSCALL)
 #define _TIF_NOTIFY_RESUME      (1<<TIF_NOTIFY_RESUME)
 #define _TIF_SIGPENDING         (1<<TIF_SIGPENDING)
 #define _TIF_NEED_RESCHED       (1<<TIF_NEED_RESCHED)
+#define _TIF_TLB_WAIT           (1<<TIF_TLB_WAIT)
 #define _TIF_PER_TRAP           (1<<TIF_PER_TRAP)
 #define _TIF_MCCK_PENDING       (1<<TIF_MCCK_PENDING)
 #define _TIF_SYSCALL_TRACE      (1<<TIF_SYSCALL_TRACE)
diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
index 79330af9a5f8..4133b3f72fb0 100644
--- a/arch/s390/include/asm/uaccess.h
+++ b/arch/s390/include/asm/uaccess.h
@@ -92,33 +92,58 @@ static inline unsigned long extable_fixup(const struct exception_table_entry *x)
 #define ARCH_HAS_SORT_EXTABLE
 #define ARCH_HAS_SEARCH_EXTABLE
 
-struct uaccess_ops {
-        size_t (*copy_from_user)(size_t, const void __user *, void *);
-        size_t (*copy_to_user)(size_t, void __user *, const void *);
-        size_t (*copy_in_user)(size_t, void __user *, const void __user *);
-        size_t (*clear_user)(size_t, void __user *);
-        size_t (*strnlen_user)(size_t, const char __user *);
-        size_t (*strncpy_from_user)(size_t, const char __user *, char *);
-        int (*futex_atomic_op)(int op, u32 __user *, int oparg, int *old);
-        int (*futex_atomic_cmpxchg)(u32 *, u32 __user *, u32 old, u32 new);
-};
+int __handle_fault(unsigned long, unsigned long, int);
 
-extern struct uaccess_ops uaccess;
-extern struct uaccess_ops uaccess_mvcos;
-extern struct uaccess_ops uaccess_pt;
+/**
+ * __copy_from_user: - Copy a block of data from user space, with less checking.
+ * @to:   Destination address, in kernel space.
+ * @from: Source address, in user space.
+ * @n:    Number of bytes to copy.
+ *
+ * Context: User context only.  This function may sleep.
+ *
+ * Copy data from user space to kernel space.  Caller must check
+ * the specified block with access_ok() before calling this function.
+ *
+ * Returns number of bytes that could not be copied.
+ * On success, this will be zero.
+ *
+ * If some data could not be copied, this function will pad the copied
+ * data to the requested size using zero bytes.
+ */
+unsigned long __must_check __copy_from_user(void *to, const void __user *from,
+                                            unsigned long n);
+
+/**
+ * __copy_to_user: - Copy a block of data into user space, with less checking.
+ * @to:   Destination address, in user space.
+ * @from: Source address, in kernel space.
+ * @n:    Number of bytes to copy.
+ *
+ * Context: User context only.  This function may sleep.
+ *
+ * Copy data from kernel space to user space.  Caller must check
+ * the specified block with access_ok() before calling this function.
+ *
+ * Returns number of bytes that could not be copied.
+ * On success, this will be zero.
+ */
+unsigned long __must_check __copy_to_user(void __user *to, const void *from,
+                                          unsigned long n);
 
-extern int __handle_fault(unsigned long, unsigned long, int);
+#define __copy_to_user_inatomic __copy_to_user
+#define __copy_from_user_inatomic __copy_from_user
 
-static inline int __put_user_fn(size_t size, void __user *ptr, void *x)
+static inline int __put_user_fn(void *x, void __user *ptr, unsigned long size)
 {
-        size = uaccess.copy_to_user(size, ptr, x);
-        return size ? -EFAULT : size;
+        size = __copy_to_user(ptr, x, size);
+        return size ? -EFAULT : 0;
 }
 
-static inline int __get_user_fn(size_t size, const void __user *ptr, void *x)
+static inline int __get_user_fn(void *x, const void __user *ptr, unsigned long size)
 {
-        size = uaccess.copy_from_user(size, ptr, x);
-        return size ? -EFAULT : size;
+        size = __copy_from_user(x, ptr, size);
+        return size ? -EFAULT : 0;
 }
 
 /*
@@ -135,8 +160,8 @@ static inline int __get_user_fn(size_t size, const void __user *ptr, void *x)
         case 2:                                                 \
         case 4:                                                 \
         case 8:                                                 \
-                __pu_err = __put_user_fn(sizeof (*(ptr)),       \
-                                         ptr, &__x);            \
+                __pu_err = __put_user_fn(&__x, ptr,             \
+                                         sizeof(*(ptr)));       \
                 break;                                          \
         default:                                                \
                 __put_user_bad();                               \
@@ -152,7 +177,7 @@ static inline int __get_user_fn(size_t size, const void __user *ptr, void *x)
 })
 
 
-extern int __put_user_bad(void) __attribute__((noreturn));
+int __put_user_bad(void) __attribute__((noreturn));
 
 #define __get_user(x, ptr)                                      \
 ({                                                              \
@@ -161,29 +186,29 @@ extern int __put_user_bad(void) __attribute__((noreturn));
         switch (sizeof(*(ptr))) {                               \
         case 1: {                                               \
                 unsigned char __x;                              \
-                __gu_err = __get_user_fn(sizeof (*(ptr)),       \
-                                         ptr, &__x);            \
+                __gu_err = __get_user_fn(&__x, ptr,             \
+                                         sizeof(*(ptr)));       \
                 (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 2: {                                               \
                 unsigned short __x;                             \
-                __gu_err = __get_user_fn(sizeof (*(ptr)),       \
-                                         ptr, &__x);            \
+                __gu_err = __get_user_fn(&__x, ptr,             \
+                                         sizeof(*(ptr)));       \
                 (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 4: {                                               \
                 unsigned int __x;                               \
-                __gu_err = __get_user_fn(sizeof (*(ptr)),       \
-                                         ptr, &__x);            \
+                __gu_err = __get_user_fn(&__x, ptr,             \
+                                         sizeof(*(ptr)));       \
                 (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 8: {                                               \
                 unsigned long long __x;                         \
-                __gu_err = __get_user_fn(sizeof (*(ptr)),       \
-                                         ptr, &__x);            \
+                __gu_err = __get_user_fn(&__x, ptr,             \
+                                         sizeof(*(ptr)));       \
                 (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
@@ -200,35 +225,12 @@ extern int __put_user_bad(void) __attribute__((noreturn));
         __get_user(x, ptr);                                     \
 })
 
-extern int __get_user_bad(void) __attribute__((noreturn));
+int __get_user_bad(void) __attribute__((noreturn));
 
 #define __put_user_unaligned __put_user
 #define __get_user_unaligned __get_user
 
 /**
- * __copy_to_user: - Copy a block of data into user space, with less checking.
- * @to:   Destination address, in user space.
- * @from: Source address, in kernel space.
- * @n:    Number of bytes to copy.
- *
- * Context: User context only.  This function may sleep.
- *
- * Copy data from kernel space to user space.  Caller must check
- * the specified block with access_ok() before calling this function.
- *
- * Returns number of bytes that could not be copied.
- * On success, this will be zero.
- */
-static inline unsigned long __must_check
-__copy_to_user(void __user *to, const void *from, unsigned long n)
-{
-        return uaccess.copy_to_user(n, to, from);
-}
-
-#define __copy_to_user_inatomic __copy_to_user
-#define __copy_from_user_inatomic __copy_from_user
-
-/**
  * copy_to_user: - Copy a block of data into user space.
  * @to:   Destination address, in user space.
  * @from: Source address, in kernel space.
@@ -248,30 +250,7 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
         return __copy_to_user(to, from, n);
 }
 
-/**
- * __copy_from_user: - Copy a block of data from user space, with less checking.
- * @to:   Destination address, in kernel space.
- * @from: Source address, in user space.
- * @n:    Number of bytes to copy.
- *
- * Context: User context only.  This function may sleep.
- *
- * Copy data from user space to kernel space.  Caller must check
- * the specified block with access_ok() before calling this function.
- *
- * Returns number of bytes that could not be copied.
- * On success, this will be zero.
- *
- * If some data could not be copied, this function will pad the copied
- * data to the requested size using zero bytes.
- */
-static inline unsigned long __must_check
-__copy_from_user(void *to, const void __user *from, unsigned long n)
-{
-        return uaccess.copy_from_user(n, from, to);
-}
-
-extern void copy_from_user_overflow(void)
+void copy_from_user_overflow(void)
 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
 __compiletime_warning("copy_from_user() buffer size is not provably correct")
 #endif
@@ -306,11 +285,8 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
         return __copy_from_user(to, from, n);
 }
 
-static inline unsigned long __must_check
-__copy_in_user(void __user *to, const void __user *from, unsigned long n)
-{
-        return uaccess.copy_in_user(n, to, from);
-}
+unsigned long __must_check
+__copy_in_user(void __user *to, const void __user *from, unsigned long n);
 
 static inline unsigned long __must_check
 copy_in_user(void __user *to, const void __user *from, unsigned long n)
@@ -322,18 +298,22 @@ copy_in_user(void __user *to, const void __user *from, unsigned long n)
 /*
  * Copy a null terminated string from userspace.
  */
+
+long __strncpy_from_user(char *dst, const char __user *src, long count);
+
 static inline long __must_check
 strncpy_from_user(char *dst, const char __user *src, long count)
 {
         might_fault();
-        return uaccess.strncpy_from_user(count, src, dst);
+        return __strncpy_from_user(dst, src, count);
 }
 
-static inline unsigned long
-strnlen_user(const char __user * src, unsigned long n)
+unsigned long __must_check __strnlen_user(const char __user *src, unsigned long count);
+
+static inline unsigned long strnlen_user(const char __user *src, unsigned long n)
 {
         might_fault();
-        return uaccess.strnlen_user(n, src);
+        return __strnlen_user(src, n);
 }
 
 /**
@@ -355,21 +335,14 @@ strnlen_user(const char __user * src, unsigned long n)
 /*
  * Zero Userspace
  */
+unsigned long __must_check __clear_user(void __user *to, unsigned long size);
 
-static inline unsigned long __must_check
-__clear_user(void __user *to, unsigned long n)
-{
-        return uaccess.clear_user(n, to);
-}
-
-static inline unsigned long __must_check
-clear_user(void __user *to, unsigned long n)
+static inline unsigned long __must_check clear_user(void __user *to, unsigned long n)
 {
         might_fault();
-        return uaccess.clear_user(n, to);
+        return __clear_user(to, n);
 }
 
-extern int copy_to_user_real(void __user *dest, void *src, size_t count);
-extern int copy_from_user_real(void *dest, void __user *src, size_t count);
+int copy_to_user_real(void __user *dest, void *src, unsigned long count);
 
 #endif /* __S390_UACCESS_H */
diff --git a/arch/s390/include/uapi/asm/ptrace.h b/arch/s390/include/uapi/asm/ptrace.h
index 7e0b498a2c2b..a150f4fabe43 100644
--- a/arch/s390/include/uapi/asm/ptrace.h
+++ b/arch/s390/include/uapi/asm/ptrace.h
@@ -403,6 +403,12 @@ typedef struct
 #define PTRACE_TE_ABORT_RAND          0x5011
 
 /*
+ * The numbers chosen here are somewhat arbitrary but absolutely MUST
+ * not overlap with any of the number assigned in <linux/ptrace.h>.
+ */
+#define PTRACE_SINGLEBLOCK      12      /* resume execution until next branch */
+
+/*
  * PT_PROT definition is loosely based on hppa bsd definition in
  * gdb/hppab-nat.c
  */