diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index ac6c258300cf..b15013234c77 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -273,6 +273,23 @@ static int ap_query_queue(ap_qid_t qid, int *queue_depth, int *device_type,
 		nd = (info >> 16) & 0xff;
 		if ((info & (1UL << 57)) && nd > 0)
 			ap_max_domain_id = nd;
+		switch (*device_type) {
+			/* For CEX2 and CEX3 the available functions
+			 * are not refrected by the facilities bits.
+			 * Instead it is coded into the type. So here
+			 * modify the function bits based on the type.
+			 */
+		case AP_DEVICE_TYPE_CEX2A:
+		case AP_DEVICE_TYPE_CEX3A:
+			*facilities |= 0x08000000;
+			break;
+		case AP_DEVICE_TYPE_CEX2C:
+		case AP_DEVICE_TYPE_CEX3C:
+			*facilities |= 0x10000000;
+			break;
+		default:
+			break;
+		}
 		return 0;
 	case AP_RESPONSE_Q_NOT_AVAIL:
 	case AP_RESPONSE_DECONFIGURED:
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index c7b5e70f2938..71e298fe339f 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -257,7 +257,7 @@ static long zcrypt_rsa_modexpo(struct ica_rsa_modexpo *mex)
 			continue;
 		for_each_zcrypt_queue(zq, zc) {
 			/* check if device is online and eligible */
-			if (!zq->online)
+			if (!zq->online || !zq->ops->rsa_modexpo)
 				continue;
 			if (zcrypt_queue_compare(zq, pref_zq,
 						 weight, pref_weight))
@@ -320,7 +320,7 @@ static long zcrypt_rsa_crt(struct ica_rsa_modexpo_crt *crt)
 			continue;
 		for_each_zcrypt_queue(zq, zc) {
 			/* check if device is online and eligible */
-			if (!zq->online)
+			if (!zq->online || !zq->ops->rsa_modexpo_crt)
 				continue;
 			if (zcrypt_queue_compare(zq, pref_zq,
 						 weight, pref_weight))
@@ -377,6 +377,7 @@ static long zcrypt_send_cprb(struct ica_xcRB *xcRB)
 		for_each_zcrypt_queue(zq, zc) {
 			/* check if device is online and eligible */
 			if (!zq->online ||
+			    !zq->ops->send_cprb ||
 			    ((*domain != (unsigned short) AUTOSELECT) &&
 			     (*domain != AP_QID_QUEUE(zq->queue->qid))))
 				continue;
@@ -480,6 +481,7 @@ static long zcrypt_send_ep11_cprb(struct ep11_urb *xcrb)
 		for_each_zcrypt_queue(zq, zc) {
 			/* check if device is online and eligible */
 			if (!zq->online ||
+			    !zq->ops->send_ep11_cprb ||
 			    (targets &&
 			     !is_desired_ep11_queue(zq->queue->qid,
 						    target_num, targets)))
@@ -538,7 +540,7 @@ static long zcrypt_rng(char *buffer)
 			continue;
 		for_each_zcrypt_queue(zq, zc) {
 			/* check if device is online and eligible */
-			if (!zq->online)
+			if (!zq->online || !zq->ops->rng)
 				continue;
 			if (zcrypt_queue_compare(zq, pref_zq,
 						 weight, pref_weight))