22 files changed, 170 insertions, 144 deletions

diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index fdb2e7c14506..5905936c7c60 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1004,8 +1004,8 @@ static void dasd_handle_killed_request(struct ccw_device *cdev,
         if (device == NULL ||
             device != dasd_device_from_cdev_locked(cdev) ||
             strncmp(device->discipline->ebcname, (char *) &cqr->magic, 4)) {
-                DBF_DEV_EVENT(DBF_DEBUG, device, "invalid device in request: "
-                              "bus_id %s", dev_name(&cdev->dev));
+                DBF_EVENT_DEVID(DBF_DEBUG, cdev, "%s",
+                                "invalid device in request");
                 return;
         }
 
@@ -1078,8 +1078,8 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
         device = (struct dasd_device *) cqr->startdev;
         if (!device ||
             strncmp(device->discipline->ebcname, (char *) &cqr->magic, 4)) {
-                DBF_DEV_EVENT(DBF_DEBUG, device, "invalid device in request: "
-                              "bus_id %s", dev_name(&cdev->dev));
+                DBF_EVENT_DEVID(DBF_DEBUG, cdev, "%s",
+                                "invalid device in request");
                 return;
         }
 
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 5819dc02a143..1cca21aafaba 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -23,6 +23,7 @@
 #include <asm/debug.h>
 #include <asm/idals.h>
 #include <asm/ebcdic.h>
+#include <asm/compat.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
 #include <asm/cio.h>
@@ -2844,13 +2845,16 @@ static int dasd_symm_io(struct dasd_device *device, void __user *argp)
         rc = -EFAULT;
         if (copy_from_user(&usrparm, argp, sizeof(usrparm)))
                 goto out;
-#ifndef CONFIG_64BIT
-        /* Make sure pointers are sane even on 31 bit. */
-        if ((usrparm.psf_data >> 32) != 0 || (usrparm.rssd_result >> 32) != 0) {
+        if (is_compat_task() || sizeof(long) == 4) {
+                /* Make sure pointers are sane even on 31 bit. */
                 rc = -EINVAL;
-                goto out;
+                if ((usrparm.psf_data >> 32) != 0)
+                        goto out;
+                if ((usrparm.rssd_result >> 32) != 0)
+                        goto out;
+                usrparm.psf_data &= 0x7fffffffULL;
+                usrparm.rssd_result &= 0x7fffffffULL;
         }
-#endif
         /* alloc I/O data area */
         psf_data = kzalloc(usrparm.psf_data_len, GFP_KERNEL | GFP_DMA);
         rssd_result = kzalloc(usrparm.rssd_result_len, GFP_KERNEL | GFP_DMA);
@@ -3029,7 +3033,7 @@ static void dasd_eckd_dump_sense_ccw(struct dasd_device *device,
         len += sprintf(page + len, KERN_ERR PRINTK_HEADER
                        " in req: %p CS: 0x%02X DS: 0x%02X CC: 0x%02X RC: %d\n",
                        req, scsw_cstat(&irb->scsw), scsw_dstat(&irb->scsw),
-                       scsw_cc(&irb->scsw), req->intrc);
+                       scsw_cc(&irb->scsw), req ? req->intrc : 0);
         len += sprintf(page + len, KERN_ERR PRINTK_HEADER
                        " device %s: Failing CCW: %p\n",
                        dev_name(&device->cdev->dev),
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index 478bcdb90b6f..7039d9cf0fb4 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -17,7 +17,7 @@
 #include <linux/fs.h>
 #include <linux/blkpg.h>
 #include <linux/smp_lock.h>
-
+#include <asm/compat.h>
 #include <asm/ccwdev.h>
 #include <asm/cmb.h>
 #include <asm/uaccess.h>
@@ -260,7 +260,7 @@ static int dasd_ioctl_information(struct dasd_block *block,
         struct ccw_dev_id dev_id;
 
         base = block->base;
-        if (!base->discipline->fill_info)
+        if (!base->discipline || !base->discipline->fill_info)
                 return -EINVAL;
 
         dasd_info = kzalloc(sizeof(struct dasd_information2_t), GFP_KERNEL);
@@ -303,10 +303,7 @@ static int dasd_ioctl_information(struct dasd_block *block,
         dasd_info->features |=
                 ((base->features & DASD_FEATURE_READONLY) != 0);
 
-        if (base->discipline)
-                memcpy(dasd_info->type, base->discipline->name, 4);
-        else
-                memcpy(dasd_info->type, "none", 4);
+        memcpy(dasd_info->type, base->discipline->name, 4);
 
         if (block->request_queue->request_fn) {
                 struct list_head *l;
@@ -358,9 +355,8 @@ dasd_ioctl_set_ro(struct block_device *bdev, void __user *argp)
 }
 
 static int dasd_ioctl_readall_cmb(struct dasd_block *block, unsigned int cmd,
-                unsigned long arg)
+                                  struct cmbdata __user *argp)
 {
-        struct cmbdata __user *argp = (void __user *) arg;
         size_t size = _IOC_SIZE(cmd);
         struct cmbdata data;
         int ret;
@@ -376,7 +372,12 @@ dasd_do_ioctl(struct block_device *bdev, fmode_t mode,
               unsigned int cmd, unsigned long arg)
 {
         struct dasd_block *block = bdev->bd_disk->private_data;
-        void __user *argp = (void __user *)arg;
+        void __user *argp;
+
+        if (is_compat_task())
+                argp = compat_ptr(arg);
+        else
+                argp = (void __user *)arg;
 
         if (!block)
                 return -ENODEV;
@@ -414,7 +415,7 @@ dasd_do_ioctl(struct block_device *bdev, fmode_t mode,
         case BIODASDCMFDISABLE:
                 return disable_cmf(block->base->cdev);
         case BIODASDREADALLCMB:
-                return dasd_ioctl_readall_cmb(block, cmd, arg);
+                return dasd_ioctl_readall_cmb(block, cmd, argp);
         default:
                 /* if the discipline has an ioctl method try it. */
                 if (block->base->discipline->ioctl) {
diff --git a/drivers/s390/block/dasd_proc.c b/drivers/s390/block/dasd_proc.c
index 6315fbd8e68b..71f95f54866f 100644
--- a/drivers/s390/block/dasd_proc.c
+++ b/drivers/s390/block/dasd_proc.c
@@ -72,7 +72,7 @@ dasd_devices_show(struct seq_file *m, void *v)
         /* Print device number. */
         seq_printf(m, "%s", dev_name(&device->cdev->dev));
         /* Print discipline string. */
-        if (device != NULL && device->discipline != NULL)
+        if (device->discipline != NULL)
                 seq_printf(m, "(%s)", device->discipline->name);
         else
                 seq_printf(m, "(none)");
@@ -92,10 +92,7 @@ dasd_devices_show(struct seq_file *m, void *v)
         substr = (device->features & DASD_FEATURE_READONLY) ? "(ro)" : " ";
         seq_printf(m, "%4s: ", substr);
         /* Print device status information. */
-        switch ((device != NULL) ? device->state : -1) {
-        case -1:
-                seq_printf(m, "unknown");
-                break;
+        switch (device->state) {
         case DASD_STATE_NEW:
                 seq_printf(m, "new");
                 break;
diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
index 9d61683b5633..59ec073724bf 100644
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -1037,22 +1037,6 @@ static void tty3215_flush_buffer(struct tty_struct *tty)
 }
 
 /*
- * Currently we don't have any io controls for 3215 ttys
- */
-static int tty3215_ioctl(struct tty_struct *tty, struct file * file,
-                         unsigned int cmd, unsigned long arg)
-{
-        if (tty->flags & (1 << TTY_IO_ERROR))
-                return -EIO;
-
-        switch (cmd) {
-        default:
-                return -ENOIOCTLCMD;
-        }
-        return 0;
-}
-
-/*
  * Disable reading from a 3215 tty
  */
 static void tty3215_throttle(struct tty_struct * tty)
@@ -1117,7 +1101,6 @@ static const struct tty_operations tty3215_ops = {
         .write_room = tty3215_write_room,
         .chars_in_buffer = tty3215_chars_in_buffer,
         .flush_buffer = tty3215_flush_buffer,
-        .ioctl = tty3215_ioctl,
         .throttle = tty3215_throttle,
         .unthrottle = tty3215_unthrottle,
         .stop = tty3215_stop,
diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
index 247b2b934728..31c59b0d6df0 100644
--- a/drivers/s390/char/fs3270.c
+++ b/drivers/s390/char/fs3270.c
@@ -15,6 +15,7 @@
 #include <linux/types.h>
 #include <linux/smp_lock.h>
 
+#include <asm/compat.h>
 #include <asm/ccwdev.h>
 #include <asm/cio.h>
 #include <asm/ebcdic.h>
@@ -322,6 +323,7 @@ fs3270_write(struct file *filp, const char __user *data, size_t count, loff_t *o
 static long
 fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
+        char __user *argp;
         struct fs3270 *fp;
         struct raw3270_iocb iocb;
         int rc;
@@ -329,6 +331,10 @@ fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
         fp = filp->private_data;
         if (!fp)
                 return -ENODEV;
+        if (is_compat_task())
+                argp = compat_ptr(arg);
+        else
+                argp = (char __user *)arg;
         rc = 0;
         mutex_lock(&fs3270_mutex);
         switch (cmd) {
@@ -339,10 +345,10 @@ fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 fp->write_command = arg;
                 break;
         case TUBGETI:
-                rc = put_user(fp->read_command, (char __user *) arg);
+                rc = put_user(fp->read_command, argp);
                 break;
         case TUBGETO:
-                rc = put_user(fp->write_command,(char __user *) arg);
+                rc = put_user(fp->write_command, argp);
                 break;
         case TUBGETMOD:
                 iocb.model = fp->view.model;
@@ -351,8 +357,7 @@ fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 iocb.pf_cnt = 24;
                 iocb.re_cnt = 20;
                 iocb.map = 0;
-                if (copy_to_user((char __user *) arg, &iocb,
-                                 sizeof(struct raw3270_iocb)))
+                if (copy_to_user(argp, &iocb, sizeof(struct raw3270_iocb)))
                         rc = -EFAULT;
                 break;
         }
@@ -511,8 +516,8 @@ static const struct file_operations fs3270_fops = {
         .write           = fs3270_write,        /* write */
         .unlocked_ioctl  = fs3270_ioctl,        /* ioctl */
         .compat_ioctl    = fs3270_ioctl,        /* ioctl */
-        .open           = fs3270_open,          /* open */
-        .release        = fs3270_close,         /* release */
+        .open            = fs3270_open,         /* open */
+        .release         = fs3270_close,        /* release */
 };
 
 /*
diff --git a/drivers/s390/char/sclp_vt220.c b/drivers/s390/char/sclp_vt220.c
index b9d2a007e93b..3796ffdb8479 100644
--- a/drivers/s390/char/sclp_vt220.c
+++ b/drivers/s390/char/sclp_vt220.c
@@ -495,6 +495,10 @@ sclp_vt220_open(struct tty_struct *tty, struct file *filp)
                 if (tty->driver_data == NULL)
                         return -ENOMEM;
                 tty->low_latency = 0;
+                if (!tty->winsize.ws_row && !tty->winsize.ws_col) {
+                        tty->winsize.ws_row = 24;
+                        tty->winsize.ws_col = 80;
+                }
         }
         return 0;
 }
diff --git a/drivers/s390/char/tape_block.c b/drivers/s390/char/tape_block.c
index 96816149368a..8d3d720737da 100644
--- a/drivers/s390/char/tape_block.c
+++ b/drivers/s390/char/tape_block.c
@@ -46,8 +46,6 @@
  */
 static int tapeblock_open(struct block_device *, fmode_t);
 static int tapeblock_release(struct gendisk *, fmode_t);
-static int tapeblock_ioctl(struct block_device *, fmode_t, unsigned int,
-                                unsigned long);
 static int tapeblock_medium_changed(struct gendisk *);
 static int tapeblock_revalidate_disk(struct gendisk *);
 
@@ -55,7 +53,6 @@ static const struct block_device_operations tapeblock_fops = {
         .owner           = THIS_MODULE,
         .open            = tapeblock_open,
         .release         = tapeblock_release,
-        .ioctl           = tapeblock_ioctl,
         .media_changed   = tapeblock_medium_changed,
         .revalidate_disk = tapeblock_revalidate_disk,
 };
@@ -416,42 +413,6 @@ tapeblock_release(struct gendisk *disk, fmode_t mode)
 }
 
 /*
- * Support of some generic block device IOCTLs.
- */
-static int
-tapeblock_ioctl(
-        struct block_device *   bdev,
-        fmode_t                 mode,
-        unsigned int            command,
-        unsigned long           arg
-) {
-        int rc;
-        int minor;
-        struct gendisk *disk = bdev->bd_disk;
-        struct tape_device *device;
-
-        rc     = 0;
-        BUG_ON(!disk);
-        device = disk->private_data;
-        BUG_ON(!device);
-        minor  = MINOR(bdev->bd_dev);
-
-        DBF_LH(6, "tapeblock_ioctl(0x%0x)\n", command);
-        DBF_LH(6, "device = %d:%d\n", tapeblock_major, minor);
-
-        switch (command) {
-                /* Refuse some IOCTL calls without complaining (mount). */
-                case 0x5310:            /* CDROMMULTISESSION */
-                        rc = -EINVAL;
-                        break;
-                default:
-                        rc = -EINVAL;
-        }
-
-        return rc;
-}
-
-/*
  * Initialize block device frontend.
  */
 int
diff --git a/drivers/s390/char/tape_char.c b/drivers/s390/char/tape_char.c
index 2125ec7d95f0..539045acaad4 100644
--- a/drivers/s390/char/tape_char.c
+++ b/drivers/s390/char/tape_char.c
@@ -18,6 +18,7 @@
 #include <linux/proc_fs.h>
 #include <linux/mtio.h>
 #include <linux/smp_lock.h>
+#include <linux/compat.h>
 
 #include <asm/uaccess.h>
 
@@ -37,8 +38,9 @@ static ssize_t tapechar_write(struct file *, const char __user *, size_t, loff_t
 static int tapechar_open(struct inode *,struct file *);
 static int tapechar_release(struct inode *,struct file *);
 static long tapechar_ioctl(struct file *, unsigned int, unsigned long);
-static long tapechar_compat_ioctl(struct file *, unsigned int,
-                          unsigned long);
+#ifdef CONFIG_COMPAT
+static long tapechar_compat_ioctl(struct file *, unsigned int, unsigned long);
+#endif
 
 static const struct file_operations tape_fops =
 {
@@ -46,7 +48,9 @@ static const struct file_operations tape_fops =
         .read = tapechar_read,
         .write = tapechar_write,
         .unlocked_ioctl = tapechar_ioctl,
+#ifdef CONFIG_COMPAT
         .compat_ioctl = tapechar_compat_ioctl,
+#endif
         .open = tapechar_open,
         .release = tapechar_release,
 };
@@ -457,15 +461,22 @@ tapechar_ioctl(struct file *filp, unsigned int no, unsigned long data)
         return rc;
 }
 
+#ifdef CONFIG_COMPAT
 static long
 tapechar_compat_ioctl(struct file *filp, unsigned int no, unsigned long data)
 {
         struct tape_device *device = filp->private_data;
         int rval = -ENOIOCTLCMD;
+        unsigned long argp;
 
+        /* The 'arg' argument of any ioctl function may only be used for
+         * pointers because of the compat pointer conversion.
+         * Consider this when adding new ioctls.
+         */
+        argp = (unsigned long) compat_ptr(data);
         if (device->discipline->ioctl_fn) {
                 mutex_lock(&device->mutex);
-                rval = device->discipline->ioctl_fn(device, no, data);
+                rval = device->discipline->ioctl_fn(device, no, argp);
                 mutex_unlock(&device->mutex);
                 if (rval == -EINVAL)
                         rval = -ENOIOCTLCMD;
@@ -473,6 +484,7 @@ tapechar_compat_ioctl(struct file *filp, unsigned int no, unsigned long data)
 
         return rval;
 }
+#endif /* CONFIG_COMPAT */
 
 /*
  * Initialize character device frontend.
diff --git a/drivers/s390/char/vmcp.c b/drivers/s390/char/vmcp.c
index a6087cec55b4..921dcda77676 100644
--- a/drivers/s390/char/vmcp.c
+++ b/drivers/s390/char/vmcp.c
@@ -19,6 +19,7 @@
 #include <linux/kernel.h>
 #include <linux/miscdevice.h>
 #include <linux/module.h>
+#include <asm/compat.h>
 #include <asm/cpcmd.h>
 #include <asm/debug.h>
 #include <asm/uaccess.h>
@@ -139,21 +140,26 @@ vmcp_write(struct file *file, const char __user *buff, size_t count,
 static long vmcp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
         struct vmcp_session *session;
+        int __user *argp;
         int temp;
 
         session = (struct vmcp_session *)file->private_data;
+        if (is_compat_task())
+                argp = compat_ptr(arg);
+        else
+                argp = (int __user *)arg;
         if (mutex_lock_interruptible(&session->mutex))
                 return -ERESTARTSYS;
         switch (cmd) {
         case VMCP_GETCODE:
                 temp = session->resp_code;
                 mutex_unlock(&session->mutex);
-                return put_user(temp, (int __user *)arg);
+                return put_user(temp, argp);
         case VMCP_SETBUF:
                 free_pages((unsigned long)session->response,
                                 get_order(session->bufsize));
                 session->response=NULL;
-                temp = get_user(session->bufsize, (int __user *)arg);
+                temp = get_user(session->bufsize, argp);
                 if (get_order(session->bufsize) > 8) {
                         session->bufsize = PAGE_SIZE;
                         temp = -EINVAL;
@@ -163,7 +169,7 @@ static long vmcp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         case VMCP_GETSIZE:
                 temp = session->resp_size;
                 mutex_unlock(&session->mutex);
-                return put_user(temp, (int __user *)arg);
+                return put_user(temp, argp);
         default:
                 mutex_unlock(&session->mutex);
                 return -ENOIOCTLCMD;
diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c
index cc5144b6f9d9..c84ac9443079 100644
--- a/drivers/s390/cio/chsc_sch.c
+++ b/drivers/s390/cio/chsc_sch.c
@@ -12,6 +12,7 @@
 #include <linux/uaccess.h>
 #include <linux/miscdevice.h>
 
+#include <asm/compat.h>
 #include <asm/cio.h>
 #include <asm/chsc.h>
 #include <asm/isc.h>
@@ -770,24 +771,30 @@ out_free:
 static long chsc_ioctl(struct file *filp, unsigned int cmd,
                        unsigned long arg)
 {
+        void __user *argp;
+
         CHSC_MSG(2, "chsc_ioctl called, cmd=%x\n", cmd);
+        if (is_compat_task())
+                argp = compat_ptr(arg);
+        else
+                argp = (void __user *)arg;
         switch (cmd) {
         case CHSC_START:
-                return chsc_ioctl_start((void __user *)arg);
+                return chsc_ioctl_start(argp);
         case CHSC_INFO_CHANNEL_PATH:
-                return chsc_ioctl_info_channel_path((void __user *)arg);
+                return chsc_ioctl_info_channel_path(argp);
         case CHSC_INFO_CU:
-                return chsc_ioctl_info_cu((void __user *)arg);
+                return chsc_ioctl_info_cu(argp);
         case CHSC_INFO_SCH_CU:
-                return chsc_ioctl_info_sch_cu((void __user *)arg);
+                return chsc_ioctl_info_sch_cu(argp);
         case CHSC_INFO_CI:
-                return chsc_ioctl_conf_info((void __user *)arg);
+                return chsc_ioctl_conf_info(argp);
         case CHSC_INFO_CCL:
-                return chsc_ioctl_conf_comp_list((void __user *)arg);
+                return chsc_ioctl_conf_comp_list(argp);
         case CHSC_INFO_CPD:
-                return chsc_ioctl_chpd((void __user *)arg);
+                return chsc_ioctl_chpd(argp);
         case CHSC_INFO_DCAL:
-                return chsc_ioctl_dcal((void __user *)arg);
+                return chsc_ioctl_dcal(argp);
         default: /* unknown ioctl number */
                 return -ENOIOCTLCMD;
         }
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 0d4d18bdd45c..c68be24e27d9 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -393,10 +393,12 @@ static long zcrypt_rsa_crt(struct ica_rsa_modexpo_crt *crt)
                          * u_mult_inv > 128 bytes.
                          */
                         if (copied == 0) {
-                                int len;
+                                unsigned int len;
                                 spin_unlock_bh(&zcrypt_device_lock);
                                 /* len is max 256 / 2 - 120 = 8 */
                                 len = crt->inputdatalength / 2 - 120;
+                                if (len > sizeof(z1))
+                                        return -EFAULT;
                                 z1 = z2 = z3 = 0;
                                 if (copy_from_user(&z1, crt->np_prime, len) ||
                                     copy_from_user(&z2, crt->bp_key, len) ||
diff --git a/drivers/s390/crypto/zcrypt_pcicc.c b/drivers/s390/crypto/zcrypt_pcicc.c
index a23726a0735c..142f72a2ca5a 100644
--- a/drivers/s390/crypto/zcrypt_pcicc.c
+++ b/drivers/s390/crypto/zcrypt_pcicc.c
@@ -373,6 +373,8 @@ static int convert_type86(struct zcrypt_device *zdev,
                         zdev->max_mod_size = PCICC_MAX_MOD_SIZE_OLD;
                         return -EAGAIN;
                 }
+                if (service_rc == 8 && service_rs == 72)
+                        return -EINVAL;
                 zdev->online = 0;
                 return -EAGAIN; /* repeat the request on a different device. */
         }
diff --git a/drivers/s390/crypto/zcrypt_pcixcc.c b/drivers/s390/crypto/zcrypt_pcixcc.c
index 79c120578e61..68f3e6204db8 100644
--- a/drivers/s390/crypto/zcrypt_pcixcc.c
+++ b/drivers/s390/crypto/zcrypt_pcixcc.c
@@ -470,6 +470,8 @@ static int convert_type86_ica(struct zcrypt_device *zdev,
                 }
                 if (service_rc == 12 && service_rs == 769)
                         return -EINVAL;
+                if (service_rc == 8 && service_rs == 72)
+                        return -EINVAL;
                 zdev->online = 0;
                 return -EAGAIN; /* repeat the request on a different device. */
         }
diff --git a/drivers/s390/net/claw.c b/drivers/s390/net/claw.c
index 3c77bfe0764c..147bb1a69aba 100644
--- a/drivers/s390/net/claw.c
+++ b/drivers/s390/net/claw.c
@@ -3398,7 +3398,7 @@ claw_init(void)
                 goto out_err;
         }
         CLAW_DBF_TEXT(2, setup, "init_mod");
-        claw_root_dev = root_device_register("qeth");
+        claw_root_dev = root_device_register("claw");
         ret = IS_ERR(claw_root_dev) ? PTR_ERR(claw_root_dev) : 0;
         if (ret)
                 goto register_err;
diff --git a/drivers/s390/scsi/zfcp_cfdc.c b/drivers/s390/scsi/zfcp_cfdc.c
index f932400e980a..0eb6eefd2c1a 100644
--- a/drivers/s390/scsi/zfcp_cfdc.c
+++ b/drivers/s390/scsi/zfcp_cfdc.c
@@ -12,6 +12,7 @@
 
 #include <linux/types.h>
 #include <linux/miscdevice.h>
+#include <asm/compat.h>
 #include <asm/ccwdev.h>
 #include "zfcp_def.h"
 #include "zfcp_ext.h"
@@ -163,7 +164,7 @@ static void zfcp_cfdc_req_to_sense(struct zfcp_cfdc_data *data,
 }
 
 static long zfcp_cfdc_dev_ioctl(struct file *file, unsigned int command,
-                                unsigned long buffer)
+                                unsigned long arg)
 {
         struct zfcp_cfdc_data *data;
         struct zfcp_cfdc_data __user *data_user;
@@ -175,7 +176,11 @@ static long zfcp_cfdc_dev_ioctl(struct file *file, unsigned int command,
         if (command != ZFCP_CFDC_IOC)
                 return -ENOTTY;
 
-        data_user = (void __user *) buffer;
+        if (is_compat_task())
+                data_user = compat_ptr(arg);
+        else
+                data_user = (void __user *)arg;
+
         if (!data_user)
                 return -EINVAL;
 
diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
index 84450955ae11..7369c8911bcf 100644
--- a/drivers/s390/scsi/zfcp_dbf.c
+++ b/drivers/s390/scsi/zfcp_dbf.c
@@ -327,7 +327,7 @@ static void zfcp_dbf_hba_view_response(char **p,
                         break;
                 zfcp_dbf_out(p, "scsi_cmnd", "0x%0Lx", r->u.fcp.cmnd);
                 zfcp_dbf_out(p, "scsi_serial", "0x%016Lx", r->u.fcp.serial);
-                p += sprintf(*p, "\n");
+                *p += sprintf(*p, "\n");
                 break;
 
         case FSF_QTCB_OPEN_PORT_WITH_DID:
diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
index 03dec832b465..66bdb34143cb 100644
--- a/drivers/s390/scsi/zfcp_ext.h
+++ b/drivers/s390/scsi/zfcp_ext.h
@@ -108,6 +108,7 @@ extern void zfcp_fc_wka_ports_force_offline(struct zfcp_fc_wka_ports *);
 extern int zfcp_fc_gs_setup(struct zfcp_adapter *);
 extern void zfcp_fc_gs_destroy(struct zfcp_adapter *);
 extern int zfcp_fc_exec_bsg_job(struct fc_bsg_job *);
+extern int zfcp_fc_timeout_bsg_job(struct fc_bsg_job *);
 
 /* zfcp_fsf.c */
 extern int zfcp_fsf_open_port(struct zfcp_erp_action *);
@@ -129,9 +130,9 @@ extern void zfcp_fsf_req_dismiss_all(struct zfcp_adapter *);
 extern int zfcp_fsf_status_read(struct zfcp_qdio *);
 extern int zfcp_status_read_refill(struct zfcp_adapter *adapter);
 extern int zfcp_fsf_send_ct(struct zfcp_fc_wka_port *, struct zfcp_fsf_ct_els *,
-                            mempool_t *);
+                            mempool_t *, unsigned int);
 extern int zfcp_fsf_send_els(struct zfcp_adapter *, u32,
-                             struct zfcp_fsf_ct_els *);
+                             struct zfcp_fsf_ct_els *, unsigned int);
 extern int zfcp_fsf_send_fcp_command_task(struct zfcp_unit *,
                                           struct scsi_cmnd *);
 extern void zfcp_fsf_req_free(struct zfcp_fsf_req *);
diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c
index ac5e3b7a3576..0f7b493fb105 100644
--- a/drivers/s390/scsi/zfcp_fc.c
+++ b/drivers/s390/scsi/zfcp_fc.c
@@ -258,7 +258,8 @@ static int zfcp_fc_ns_gid_pn_request(struct zfcp_port *port,
         gid_pn->gid_pn_req.gid_pn.fn_wwpn = port->wwpn;
 
         ret = zfcp_fsf_send_ct(&adapter->gs->ds, &gid_pn->ct,
-                               adapter->pool.gid_pn_req);
+                               adapter->pool.gid_pn_req,
+                               ZFCP_FC_CTELS_TMO);
         if (!ret) {
                 wait_for_completion(&completion);
                 zfcp_fc_ns_gid_pn_eval(gid_pn);
@@ -421,7 +422,8 @@ static int zfcp_fc_adisc(struct zfcp_port *port)
         hton24(adisc->adisc_req.adisc_port_id,
                fc_host_port_id(adapter->scsi_host));
 
-        ret = zfcp_fsf_send_els(adapter, port->d_id, &adisc->els);
+        ret = zfcp_fsf_send_els(adapter, port->d_id, &adisc->els,
+                                ZFCP_FC_CTELS_TMO);
         if (ret)
                 kmem_cache_free(zfcp_data.adisc_cache, adisc);
 
@@ -532,7 +534,8 @@ static int zfcp_fc_send_gpn_ft(struct zfcp_fc_gpn_ft *gpn_ft,
         ct->req = &gpn_ft->sg_req;
         ct->resp = gpn_ft->sg_resp;
 
-        ret = zfcp_fsf_send_ct(&adapter->gs->ds, ct, NULL);
+        ret = zfcp_fsf_send_ct(&adapter->gs->ds, ct, NULL,
+                               ZFCP_FC_CTELS_TMO);
         if (!ret)
                 wait_for_completion(&completion);
         return ret;
@@ -677,6 +680,44 @@ static void zfcp_fc_ct_els_job_handler(void *data)
         job->job_done(job);
 }
 
+static struct zfcp_fc_wka_port *zfcp_fc_job_wka_port(struct fc_bsg_job *job)
+{
+        u32 preamble_word1;
+        u8 gs_type;
+        struct zfcp_adapter *adapter;
+
+        preamble_word1 = job->request->rqst_data.r_ct.preamble_word1;
+        gs_type = (preamble_word1 & 0xff000000) >> 24;
+
+        adapter = (struct zfcp_adapter *) job->shost->hostdata[0];
+
+        switch (gs_type) {
+        case FC_FST_ALIAS:
+                return &adapter->gs->as;
+        case FC_FST_MGMT:
+                return &adapter->gs->ms;
+        case FC_FST_TIME:
+                return &adapter->gs->ts;
+                break;
+        case FC_FST_DIR:
+                return &adapter->gs->ds;
+                break;
+        default:
+                return NULL;
+        }
+}
+
+static void zfcp_fc_ct_job_handler(void *data)
+{
+        struct fc_bsg_job *job = data;
+        struct zfcp_fc_wka_port *wka_port;
+
+        wka_port = zfcp_fc_job_wka_port(job);
+        zfcp_fc_wka_port_put(wka_port);
+
+        zfcp_fc_ct_els_job_handler(data);
+}
+
 static int zfcp_fc_exec_els_job(struct fc_bsg_job *job,
                                 struct zfcp_adapter *adapter)
 {
@@ -695,43 +736,27 @@ static int zfcp_fc_exec_els_job(struct fc_bsg_job *job,
         } else
                 d_id = ntoh24(job->request->rqst_data.h_els.port_id);
 
-        return zfcp_fsf_send_els(adapter, d_id, els);
+        els->handler = zfcp_fc_ct_els_job_handler;
+        return zfcp_fsf_send_els(adapter, d_id, els, job->req->timeout / HZ);
 }
 
 static int zfcp_fc_exec_ct_job(struct fc_bsg_job *job,
                                struct zfcp_adapter *adapter)
 {
         int ret;
-        u8 gs_type;
         struct zfcp_fsf_ct_els *ct = job->dd_data;
         struct zfcp_fc_wka_port *wka_port;
-        u32 preamble_word1;
 
-        preamble_word1 = job->request->rqst_data.r_ct.preamble_word1;
-        gs_type = (preamble_word1 & 0xff000000) >> 24;
-
-        switch (gs_type) {
-        case FC_FST_ALIAS:
-                wka_port = &adapter->gs->as;
-                break;
-        case FC_FST_MGMT:
-                wka_port = &adapter->gs->ms;
-                break;
-        case FC_FST_TIME:
-                wka_port = &adapter->gs->ts;
-                break;
-        case FC_FST_DIR:
-                wka_port = &adapter->gs->ds;
-                break;
-        default:
-                return -EINVAL; /* no such service */
-        }
+        wka_port = zfcp_fc_job_wka_port(job);
+        if (!wka_port)
+                return -EINVAL;
 
         ret = zfcp_fc_wka_port_get(wka_port);
         if (ret)
                 return ret;
 
-        ret = zfcp_fsf_send_ct(wka_port, ct, NULL);
+        ct->handler = zfcp_fc_ct_job_handler;
+        ret = zfcp_fsf_send_ct(wka_port, ct, NULL, job->req->timeout / HZ);
         if (ret)
                 zfcp_fc_wka_port_put(wka_port);
 
@@ -752,7 +777,6 @@ int zfcp_fc_exec_bsg_job(struct fc_bsg_job *job)
 
         ct_els->req = job->request_payload.sg_list;
         ct_els->resp = job->reply_payload.sg_list;
-        ct_els->handler = zfcp_fc_ct_els_job_handler;
         ct_els->handler_data = job;
 
         switch (job->request->msgcode) {
@@ -767,6 +791,12 @@ int zfcp_fc_exec_bsg_job(struct fc_bsg_job *job)
         }
 }
 
+int zfcp_fc_timeout_bsg_job(struct fc_bsg_job *job)
+{
+        /* hardware tracks timeout, reset bsg timeout to not interfere */
+        return -EAGAIN;
+}
+
 int zfcp_fc_gs_setup(struct zfcp_adapter *adapter)
 {
         struct zfcp_fc_wka_ports *wka_ports;
diff --git a/drivers/s390/scsi/zfcp_fc.h b/drivers/s390/scsi/zfcp_fc.h
index cb2a3669a384..0747b087390d 100644
--- a/drivers/s390/scsi/zfcp_fc.h
+++ b/drivers/s390/scsi/zfcp_fc.h
@@ -27,6 +27,8 @@
 #define ZFCP_FC_GPN_FT_MAX_ENT    (ZFCP_FC_GPN_FT_NUM_BUFS * \
                                         (ZFCP_FC_GPN_FT_ENT_PAGE + 1))
 
+#define ZFCP_FC_CTELS_TMO       (2 * FC_DEF_R_A_TOV / 1000)
+
 /**
  * struct zfcp_fc_gid_pn_req - container for ct header plus gid_pn request
  * @ct_hdr: FC GS common transport header
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index 482dcd97aa5d..e8fb4d9baa8b 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -1068,20 +1068,20 @@ static int zfcp_fsf_setup_ct_els_sbals(struct zfcp_fsf_req *req,
 static int zfcp_fsf_setup_ct_els(struct zfcp_fsf_req *req,
                                  struct scatterlist *sg_req,
                                  struct scatterlist *sg_resp,
-                                 int max_sbals)
+                                 int max_sbals, unsigned int timeout)
 {
         int ret;
-        unsigned int fcp_chan_timeout;
 
         ret = zfcp_fsf_setup_ct_els_sbals(req, sg_req, sg_resp, max_sbals);
         if (ret)
                 return ret;
 
         /* common settings for ct/gs and els requests */
-        fcp_chan_timeout = 2 * FC_DEF_R_A_TOV / 1000;
+        if (timeout > 255)
+                timeout = 255; /* max value accepted by hardware */
         req->qtcb->bottom.support.service_class = FSF_CLASS_3;
-        req->qtcb->bottom.support.timeout = fcp_chan_timeout;
-        zfcp_fsf_start_timer(req, (fcp_chan_timeout + 10) * HZ);
+        req->qtcb->bottom.support.timeout = timeout;
+        zfcp_fsf_start_timer(req, (timeout + 10) * HZ);
 
         return 0;
 }
@@ -1092,7 +1092,8 @@ static int zfcp_fsf_setup_ct_els(struct zfcp_fsf_req *req,
  * @pool: if non-null this mempool is used to allocate struct zfcp_fsf_req
  */
 int zfcp_fsf_send_ct(struct zfcp_fc_wka_port *wka_port,
-                     struct zfcp_fsf_ct_els *ct, mempool_t *pool)
+                     struct zfcp_fsf_ct_els *ct, mempool_t *pool,
+                     unsigned int timeout)
 {
         struct zfcp_qdio *qdio = wka_port->adapter->qdio;
         struct zfcp_fsf_req *req;
@@ -1111,7 +1112,7 @@ int zfcp_fsf_send_ct(struct zfcp_fc_wka_port *wka_port,
 
         req->status |= ZFCP_STATUS_FSFREQ_CLEANUP;
         ret = zfcp_fsf_setup_ct_els(req, ct->req, ct->resp,
-                                    FSF_MAX_SBALS_PER_REQ);
+                                    FSF_MAX_SBALS_PER_REQ, timeout);
         if (ret)
                 goto failed_send;
 
@@ -1188,7 +1189,7 @@ skip_fsfstatus:
  * @els: pointer to struct zfcp_send_els with data for the command
  */
 int zfcp_fsf_send_els(struct zfcp_adapter *adapter, u32 d_id,
-                      struct zfcp_fsf_ct_els *els)
+                      struct zfcp_fsf_ct_els *els, unsigned int timeout)
 {
         struct zfcp_fsf_req *req;
         struct zfcp_qdio *qdio = adapter->qdio;
@@ -1206,7 +1207,7 @@ int zfcp_fsf_send_els(struct zfcp_adapter *adapter, u32 d_id,
         }
 
         req->status |= ZFCP_STATUS_FSFREQ_CLEANUP;
-        ret = zfcp_fsf_setup_ct_els(req, els->req, els->resp, 2);
+        ret = zfcp_fsf_setup_ct_els(req, els->req, els->resp, 2, timeout);
 
         if (ret)
                 goto failed_send;
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 771cc536a989..8e6fc68d6bd4 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -652,6 +652,7 @@ struct fc_function_template zfcp_transport_functions = {
         .show_host_port_state = 1,
         .show_host_active_fc4s = 1,
         .bsg_request = zfcp_fc_exec_bsg_job,
+        .bsg_timeout = zfcp_fc_timeout_bsg_job,
         /* no functions registered for following dynamic attributes but
            directly set by LLDD */
         .show_host_port_type = 1,