diff --git a/arch/s390/kvm/gaccess.h b/arch/s390/kvm/gaccess.h
index 8608d7e6a334d145fc08f9f24ecdf7e77fd7c7c4..302e0e52b0097e7f21a30bfb3fd9a1866e8c4274 100644
--- a/arch/s390/kvm/gaccess.h
+++ b/arch/s390/kvm/gaccess.h
@@ -18,8 +18,9 @@
 #include <asm/uaccess.h>
 #include "kvm-s390.h"
 
-static inline void *__gptr_to_uptr(struct kvm_vcpu *vcpu, void *gptr,
-				   int prefixing)
+static inline void __user *__gptr_to_uptr(struct kvm_vcpu *vcpu,
+					  void __user *gptr,
+					  int prefixing)
 {
 	unsigned long prefix  = vcpu->arch.sie_block->prefix;
 	unsigned long gaddr = (unsigned long) gptr;
@@ -34,14 +35,14 @@ static inline void *__gptr_to_uptr(struct kvm_vcpu *vcpu, void *gptr,
 	uaddr = gmap_fault(gaddr, vcpu->arch.gmap);
 	if (IS_ERR_VALUE(uaddr))
 		uaddr = -EFAULT;
-	return (void *)uaddr;
+	return (void __user *)uaddr;
 }
 
 #define get_guest(vcpu, x, gptr)				\
 ({								\
 	__typeof__(gptr) __uptr = __gptr_to_uptr(vcpu, gptr, 1);\
 	int __mask = sizeof(__typeof__(*(gptr))) - 1;		\
-	int __ret = PTR_RET(__uptr);				\
+	int __ret = PTR_RET((void __force *)__uptr);		\
 								\
 	if (!__ret) {						\
 		BUG_ON((unsigned long)__uptr & __mask);		\
@@ -54,7 +55,7 @@ static inline void *__gptr_to_uptr(struct kvm_vcpu *vcpu, void *gptr,
 ({								\
 	__typeof__(gptr) __uptr = __gptr_to_uptr(vcpu, gptr, 1);\
 	int __mask = sizeof(__typeof__(*(gptr))) - 1;		\
-	int __ret = PTR_RET(__uptr);				\
+	int __ret = PTR_RET((void __force *)__uptr);		\
 								\
 	if (!__ret) {						\
 		BUG_ON((unsigned long)__uptr & __mask);		\
@@ -68,19 +69,19 @@ static inline int __copy_guest(struct kvm_vcpu *vcpu, unsigned long to,
 			       int to_guest, int prefixing)
 {
 	unsigned long _len, rc;
-	void *uptr;
+	void __user *uptr;
 
 	while (len) {
-		uptr = to_guest ? (void *)to : (void *)from;
+		uptr = to_guest ? (void __user *)to : (void __user *)from;
 		uptr = __gptr_to_uptr(vcpu, uptr, prefixing);
-		if (IS_ERR(uptr))
+		if (IS_ERR((void __force *)uptr))
 			return -EFAULT;
 		_len = PAGE_SIZE - ((unsigned long)uptr & (PAGE_SIZE - 1));
 		_len = min(_len, len);
 		if (to_guest)
-			rc = copy_to_user(uptr, (void *)from, _len);
+			rc = copy_to_user((void __user *) uptr, (void *)from, _len);
 		else
-			rc = copy_from_user((void *)to, uptr, _len);
+			rc = copy_from_user((void *)to, (void __user *)uptr, _len);
 		if (rc)
 			return -EFAULT;
 		len -= _len;
diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c
index 64744003a66ed7e2277945f15232a72a2ced152a..c6ba4dfd7f1e4c7e9cabfc83562d6b425b2017db 100644
--- a/arch/s390/kvm/intercept.c
+++ b/arch/s390/kvm/intercept.c
@@ -44,7 +44,7 @@ static int handle_lctlg(struct kvm_vcpu *vcpu)
 
 	do {
 		rc = get_guest(vcpu, vcpu->arch.sie_block->gcr[reg],
-			       (u64 *) useraddr);
+			       (u64 __user *) useraddr);
 		if (rc) {
 			kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
 			break;
@@ -78,7 +78,7 @@ static int handle_lctl(struct kvm_vcpu *vcpu)
 
 	reg = reg1;
 	do {
-		rc = get_guest(vcpu, val, (u32 *) useraddr);
+		rc = get_guest(vcpu, val, (u32 __user *) useraddr);
 		if (rc) {
 			kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
 			break;
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index d78824b18e9d91679f5a56c71559decbd8ce6372..5c948177529e281ca7138a1b9bd7ef0186f4cec9 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -188,9 +188,9 @@ static void __do_deliver_interrupt(struct kvm_vcpu *vcpu,
 		vcpu->stat.deliver_emergency_signal++;
 		trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, inti->type,
 						 inti->emerg.code, 0);
-		rc  = put_guest(vcpu, 0x1201, (u16 *)__LC_EXT_INT_CODE);
+		rc  = put_guest(vcpu, 0x1201, (u16 __user *)__LC_EXT_INT_CODE);
 		rc |= put_guest(vcpu, inti->emerg.code,
-				(u16 *)__LC_EXT_CPU_ADDR);
+				(u16 __user *)__LC_EXT_CPU_ADDR);
 		rc |= copy_to_guest(vcpu, __LC_EXT_OLD_PSW,
 				    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
 		rc |= copy_from_guest(vcpu, &vcpu->arch.sie_block->gpsw,
@@ -201,9 +201,9 @@ static void __do_deliver_interrupt(struct kvm_vcpu *vcpu,
 		vcpu->stat.deliver_external_call++;
 		trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, inti->type,
 						 inti->extcall.code, 0);
-		rc  = put_guest(vcpu, 0x1202, (u16 *)__LC_EXT_INT_CODE);
+		rc  = put_guest(vcpu, 0x1202, (u16 __user *)__LC_EXT_INT_CODE);
 		rc |= put_guest(vcpu, inti->extcall.code,
-				(u16 *)__LC_EXT_CPU_ADDR);
+				(u16 __user *)__LC_EXT_CPU_ADDR);
 		rc |= copy_to_guest(vcpu, __LC_EXT_OLD_PSW,
 				    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
 		rc |= copy_from_guest(vcpu, &vcpu->arch.sie_block->gpsw,
@@ -215,13 +215,13 @@ static void __do_deliver_interrupt(struct kvm_vcpu *vcpu,
 		vcpu->stat.deliver_service_signal++;
 		trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, inti->type,
 						 inti->ext.ext_params, 0);
-		rc  = put_guest(vcpu, 0x2401, (u16 *)__LC_EXT_INT_CODE);
+		rc  = put_guest(vcpu, 0x2401, (u16 __user *)__LC_EXT_INT_CODE);
 		rc |= copy_to_guest(vcpu, __LC_EXT_OLD_PSW,
 				    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
 		rc |= copy_from_guest(vcpu, &vcpu->arch.sie_block->gpsw,
 				      __LC_EXT_NEW_PSW, sizeof(psw_t));
 		rc |= put_guest(vcpu, inti->ext.ext_params,
-				(u32 *)__LC_EXT_PARAMS);
+				(u32 __user *)__LC_EXT_PARAMS);
 		break;
 	case KVM_S390_INT_VIRTIO:
 		VCPU_EVENT(vcpu, 4, "interrupt: virtio parm:%x,parm64:%llx",
@@ -230,16 +230,16 @@ static void __do_deliver_interrupt(struct kvm_vcpu *vcpu,
 		trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, inti->type,
 						 inti->ext.ext_params,
 						 inti->ext.ext_params2);
-		rc  = put_guest(vcpu, 0x2603, (u16 *)__LC_EXT_INT_CODE);
-		rc |= put_guest(vcpu, 0x0d00, (u16 *)__LC_EXT_CPU_ADDR);
+		rc  = put_guest(vcpu, 0x2603, (u16 __user *)__LC_EXT_INT_CODE);
+		rc |= put_guest(vcpu, 0x0d00, (u16 __user *)__LC_EXT_CPU_ADDR);
 		rc |= copy_to_guest(vcpu, __LC_EXT_OLD_PSW,
 				    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
 		rc |= copy_from_guest(vcpu, &vcpu->arch.sie_block->gpsw,
 				      __LC_EXT_NEW_PSW, sizeof(psw_t));
 		rc |= put_guest(vcpu, inti->ext.ext_params,
-				(u32 *)__LC_EXT_PARAMS);
+				(u32 __user *)__LC_EXT_PARAMS);
 		rc |= put_guest(vcpu, inti->ext.ext_params2,
-				(u64 *)__LC_EXT_PARAMS2);
+				(u64 __user *)__LC_EXT_PARAMS2);
 		break;
 	case KVM_S390_SIGP_STOP:
 		VCPU_EVENT(vcpu, 4, "%s", "interrupt: cpu stop");
@@ -278,9 +278,9 @@ static void __do_deliver_interrupt(struct kvm_vcpu *vcpu,
 		vcpu->stat.deliver_program_int++;
 		trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, inti->type,
 						 inti->pgm.code, 0);
-		rc  = put_guest(vcpu, inti->pgm.code, (u16 *)__LC_PGM_INT_CODE);
+		rc  = put_guest(vcpu, inti->pgm.code, (u16 __user *)__LC_PGM_INT_CODE);
 		rc |= put_guest(vcpu, table[vcpu->arch.sie_block->ipa >> 14],
-				(u16 *)__LC_PGM_ILC);
+				(u16 __user *)__LC_PGM_ILC);
 		rc |= copy_to_guest(vcpu, __LC_PGM_OLD_PSW,
 				    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
 		rc |= copy_from_guest(vcpu, &vcpu->arch.sie_block->gpsw,
@@ -295,7 +295,7 @@ static void __do_deliver_interrupt(struct kvm_vcpu *vcpu,
 						 inti->mchk.mcic);
 		rc  = kvm_s390_vcpu_store_status(vcpu,
 						 KVM_S390_STORE_STATUS_PREFIXED);
-		rc |= put_guest(vcpu, inti->mchk.mcic, (u64 *) __LC_MCCK_CODE);
+		rc |= put_guest(vcpu, inti->mchk.mcic, (u64 __user *) __LC_MCCK_CODE);
 		rc |= copy_to_guest(vcpu, __LC_MCK_OLD_PSW,
 				    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
 		rc |= copy_from_guest(vcpu, &vcpu->arch.sie_block->gpsw,
@@ -313,13 +313,13 @@ static void __do_deliver_interrupt(struct kvm_vcpu *vcpu,
 		trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, inti->type,
 						 param0, param1);
 		rc  = put_guest(vcpu, inti->io.subchannel_id,
-				(u16 *) __LC_SUBCHANNEL_ID);
+				(u16 __user *) __LC_SUBCHANNEL_ID);
 		rc |= put_guest(vcpu, inti->io.subchannel_nr,
-				(u16 *) __LC_SUBCHANNEL_NR);
+				(u16 __user *) __LC_SUBCHANNEL_NR);
 		rc |= put_guest(vcpu, inti->io.io_int_parm,
-				(u32 *) __LC_IO_INT_PARM);
+				(u32 __user *) __LC_IO_INT_PARM);
 		rc |= put_guest(vcpu, inti->io.io_int_word,
-				(u32 *) __LC_IO_INT_WORD);
+				(u32 __user *) __LC_IO_INT_WORD);
 		rc |= copy_to_guest(vcpu, __LC_IO_OLD_PSW,
 				    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
 		rc |= copy_from_guest(vcpu, &vcpu->arch.sie_block->gpsw,
@@ -344,7 +344,7 @@ static int __try_deliver_ckc_interrupt(struct kvm_vcpu *vcpu)
 		return 0;
 	if (!(vcpu->arch.sie_block->gcr[0] & 0x800ul))
 		return 0;
-	rc  = put_guest(vcpu, 0x1004, (u16 *)__LC_EXT_INT_CODE);
+	rc  = put_guest(vcpu, 0x1004, (u16 __user *)__LC_EXT_INT_CODE);
 	rc |= copy_to_guest(vcpu, __LC_EXT_OLD_PSW,
 			    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
 	rc |= copy_from_guest(vcpu, &vcpu->arch.sie_block->gpsw,
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index d64382c1ed6112238a34623e2d516c4f59a8f244..7db2ad076f313ce28840a9fa1d75d84999c59441 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -42,7 +42,7 @@ static int handle_set_prefix(struct kvm_vcpu *vcpu)
 	}
 
 	/* get the value */
-	if (get_guest(vcpu, address, (u32 *) operand2)) {
+	if (get_guest(vcpu, address, (u32 __user *) operand2)) {
 		kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
 		goto out;
 	}
@@ -83,7 +83,7 @@ static int handle_store_prefix(struct kvm_vcpu *vcpu)
 	address = address & 0x7fffe000u;
 
 	/* get the value */
-	if (put_guest(vcpu, address, (u32 *)operand2)) {
+	if (put_guest(vcpu, address, (u32 __user *)operand2)) {
 		kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
 		goto out;
 	}
@@ -108,7 +108,7 @@ static int handle_store_cpu_address(struct kvm_vcpu *vcpu)
 		goto out;
 	}
 
-	rc = put_guest(vcpu, vcpu->vcpu_id, (u16 *)useraddr);
+	rc = put_guest(vcpu, vcpu->vcpu_id, (u16 __user *)useraddr);
 	if (rc) {
 		kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
 		goto out;
@@ -149,18 +149,18 @@ static int handle_tpi(struct kvm_vcpu *vcpu)
 		 * Store the two-word I/O interruption code into the
 		 * provided area.
 		 */
-		put_guest(vcpu, inti->io.subchannel_id, (u16 *) addr);
-		put_guest(vcpu, inti->io.subchannel_nr, (u16 *) (addr + 2));
-		put_guest(vcpu, inti->io.io_int_parm, (u32 *) (addr + 4));
+		put_guest(vcpu, inti->io.subchannel_id, (u16 __user *) addr);
+		put_guest(vcpu, inti->io.subchannel_nr, (u16 __user *) (addr + 2));
+		put_guest(vcpu, inti->io.io_int_parm, (u32 __user *) (addr + 4));
 	} else {
 		/*
 		 * Store the three-word I/O interruption code into
 		 * the appropriate lowcore area.
 		 */
-		put_guest(vcpu, inti->io.subchannel_id, (u16 *) __LC_SUBCHANNEL_ID);
-		put_guest(vcpu, inti->io.subchannel_nr, (u16 *) __LC_SUBCHANNEL_NR);
-		put_guest(vcpu, inti->io.io_int_parm, (u32 *) __LC_IO_INT_PARM);
-		put_guest(vcpu, inti->io.io_int_word, (u32 *) __LC_IO_INT_WORD);
+		put_guest(vcpu, inti->io.subchannel_id, (u16 __user *) __LC_SUBCHANNEL_ID);
+		put_guest(vcpu, inti->io.subchannel_nr, (u16 __user *) __LC_SUBCHANNEL_NR);
+		put_guest(vcpu, inti->io.io_int_parm, (u32 __user *) __LC_IO_INT_PARM);
+		put_guest(vcpu, inti->io.io_int_word, (u32 __user *) __LC_IO_INT_WORD);
 	}
 	kfree(inti);
 no_interrupt:
@@ -353,7 +353,7 @@ static int handle_stidp(struct kvm_vcpu *vcpu)
 		goto out;
 	}
 
-	rc = put_guest(vcpu, vcpu->arch.stidp_data, (u64 *)operand2);
+	rc = put_guest(vcpu, vcpu->arch.stidp_data, (u64 __user *)operand2);
 	if (rc) {
 		kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
 		goto out;