Netdev List
 help / color / mirror / Atom feed
* Re: [PATCH net-next] octeontx2-pf: add page pool ethtool statistics
From: Joe Damato @ 2026-06-15 20:32 UTC (permalink / raw)
  To: Ratheesh Kannoth
  Cc: linux-kernel, netdev, andrew+netdev, davem, edumazet, kuba,
	pabeni, sgoutham
In-Reply-To: <20260615032141.521667-1-rkannoth@marvell.com>

On Mon, Jun 15, 2026 at 08:51:41AM +0530, Ratheesh Kannoth wrote:
> Expose page pool allocator statistics through ethtool.
> When the interface is up, aggregate stats from each
> receive queue page pool and append the common page_pool ethtool stat
> block to the driver's private statistics set.
> 
> Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
> ---
>  .../marvell/octeontx2/nic/otx2_ethtool.c      | 35 +++++++++++++++++--
>  1 file changed, 33 insertions(+), 2 deletions(-)
> 

Reviewed-by: Joe Damato <joe@dama.to>

^ permalink raw reply

* Re: [PATCH net-next v2 0/2] netdev: expose page pool order via netlink
From: patchwork-bot+netdevbpf @ 2026-06-15 20:30 UTC (permalink / raw)
  To: Dragos Tatulea
  Cc: davem, edumazet, kuba, pabeni, horms, donald.hunter,
	andrew+netdev, asml.silence, axboe, shuah, netdev, linux-kernel,
	io-uring, linux-kselftest
In-Reply-To: <20260612211709.1456966-2-dtatulea@nvidia.com>

Hello:

This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Sat, 13 Jun 2026 00:17:02 +0300 you wrote:
> This small series exposes io_uring's high order page configuration
> via the page_pool netlink interface and updates the appropriate
> selftest to check this value.
> 
> ---
> v2:
> - Switched from exposing page_pool order to rx_buf_len via nl_fill of
>   the io_uring memory provider.
> - Updated selftest to check rx_buf_len.
> - v1: https://lore.kernel.org/all/20260611161235.3807332-1-dtatulea@nvidia.com/
> 
> [...]

Here is the summary with links:
  - [net-next,v2,1/2] netdev: expose io_uring rx_page_order order via netlink
    https://git.kernel.org/netdev/net-next/c/5c4adb7fb46f
  - [net-next,v2,2/2] io_uring/zcrx: selftests: verify rx_buf_len for large chunks
    https://git.kernel.org/netdev/net-next/c/18f65355e112

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply

* Re: [PATCH] mailmap: add entry for Jesse Brandeburg
From: patchwork-bot+netdevbpf @ 2026-06-15 20:10 UTC (permalink / raw)
  To: Jesse Brandeburg; +Cc: linux-kernel, netdev, kuba, jbrandeburg
In-Reply-To: <20260612224727.141614-1-jbrandeb@kernel.org>

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 12 Jun 2026 15:47:21 -0700 you wrote:
> From: Jesse Brandeburg <jbrandeburg@cloudflare.com>
> 
> My Intel email address is no longer used, redirect it to my kernel.org
> address.
> 
> Signed-off-by: Jesse Brandeburg <jbrandeburg@cloudflare.com>
> 
> [...]

Here is the summary with links:
  - mailmap: add entry for Jesse Brandeburg
    https://git.kernel.org/netdev/net/c/f3d64e53998a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply

* Re: [PATCH v4 5/6] pds_core: add host backed memory support for firmware
From: Rao, Nikhil @ 2026-06-15 20:07 UTC (permalink / raw)
  To: Simon Horman
  Cc: netdev, brett.creeley, andrew+netdev, davem, edumazet, kuba,
	pabeni, eric.joyner, nikhil.rao
In-Reply-To: <20260615161929.780699-2-horms@kernel.org>

On 6/15/2026 9:19 AM, Simon Horman wrote:
> This is an AI-generated review of your patch. The human sending this
> email has considered the AI review valid, or at least plausible.
> Full review at:https://sashiko.dev
> ---
> pds_core: add host backed memory support for firmware
> 
> This commit adds support for host-backed DMA memory to provide additional
> memory for firmware control plane components on newer AMD/Pensando cards.
> 
>> diff --git a/drivers/net/ethernet/amd/pds_core/core.c b/drivers/net/ethernet/amd/pds_core/core.c
>> index 705cab7b07273..d1695ca95440c 100644
>> --- a/drivers/net/ethernet/amd/pds_core/core.c
>> +++ b/drivers/net/ethernet/amd/pds_core/core.c
> [ ... ]
> 
>> @@ -658,3 +660,161 @@ void pdsc_health_thread(struct work_struct *work)
>>   out_unlock:
>>        mutex_unlock(&pdsc->config_lock);
>>   }
>> +
>> +static void pdsc_host_mem_del_one(struct pdsc *pdsc, u16 tag, u8 reason)
>> +{
>> +     union pds_core_dev_comp comp = {};
>> +     union pds_core_dev_cmd cmd = {
>> +             .host_mem.opcode = PDS_CORE_CMD_HOST_MEM,
>> +             .host_mem.oper = PDS_CORE_HOST_MEM_DEL,
>> +             .host_mem.tag = cpu_to_le16(tag),
>> +             .host_mem.reason = reason,
>> +     };
> [ ... ]
> 
>> +     hm->pa = dma_map_page(pdsc->dev, hm->pg, 0, hm->size,
>> +                           DMA_BIDIRECTIONAL);
>> +     if (dma_mapping_error(pdsc->dev, hm->pa)) {
>> +             dev_err(pdsc->dev, "dma map failed for tag %d size %d\n",
>> +                     hm->tag, hm->size);
>> +             __free_pages(hm->pg, hm->order);
>> +             hm->pg = NULL;
>> +             err = -EIO;
>> +             goto err_del;
>> +     }
>> +
>> +     /* Track this allocation so pdsc_host_mem_free() can clean it up */
>> +     pdsc->num_host_mem_reqs++;
>> +
>> +     memset(&cmd, 0, sizeof(cmd));
>> +     memset(&comp, 0, sizeof(comp));
>> +     cmd.host_mem.opcode = PDS_CORE_CMD_HOST_MEM;
>> +     cmd.host_mem.oper = PDS_CORE_HOST_MEM_ADD;
>> +     cmd.host_mem.tag = cpu_to_le16(hm->tag);
>> +     cmd.host_mem.size = cpu_to_le32(hm->size);
>> +     cmd.host_mem.buf_pa = cpu_to_le64(hm->pa);
>> +
>> +     dev_dbg(pdsc->dev, "Sending devcmd for mem add tag %d size %d pa %pad\n",
>> +             hm->tag, hm->size, &hm->pa);
>> +     err = pdsc_devcmd(pdsc, &cmd, &comp, pdsc->devcmd_timeout);
>> +     if (err || comp.status != PDS_RC_SUCCESS) {
>> +             dev_err(pdsc->dev, "mem add failed err %d status %d for tag %d\n",
>> +                     err, comp.status, hm->tag);
>> +             err = err ? err : -EIO;
>> +             goto err_del;
>> +     }
>> +     dev_dbg(pdsc->dev, "mem add completed for tag %d\n", hm->tag);
>> +
>> +     return 0;
>> +
>> +err_del:
>> +     /* After MEM_QUERY succeeds, firmware expects MEM_ADD or MEM_DEL */
>> +     pdsc_host_mem_del_one(pdsc, hm->tag, PDS_RC_ENOMEM);
>> +     return err;
> [Severity: Medium]
> Does this leave the failed memory allocation mapped and wasted for the
> lifetime of the driver?
> 
> Because pdsc->num_host_mem_reqs is incremented before sending the MEM_ADD
> command, jumping to the err_del label here skips the DMA unmap and page free
> steps. The failed request is tracked and will eventually be cleaned up by
> pdsc_host_mem_free() during device teardown.
> 
> However, the caller pdsc_start() ignores the failure, so the driver operates
> normally while potentially tying up to 4MB of DMA-mapped memory until unload
> or reset.

This is intentional. In the timeout case, firmware could still be
accessing the memory (slow response, not actual failure). Freeing
immediately could cause firmware to DMA into freed memory. The memory
is freed at teardown regardless of MEM_ADD result.

> 
>> +}
> [ ... ]
> 
>> +void pdsc_host_mem_free(struct pdsc *pdsc)
>> +{
>> +     int i;
>> +
>> +     if (!pdsc->host_mem_reqs)
>> +             return;
>> +
>> +     for (i = 0; i < pdsc->num_host_mem_reqs; i++) {
>> +             dma_unmap_page(pdsc->dev, pdsc->host_mem_reqs[i].pa,
>> +                            pdsc->host_mem_reqs[i].size,
>> +                            DMA_BIDIRECTIONAL);
>> +             __free_pages(pdsc->host_mem_reqs[i].pg,
>> +                          pdsc->host_mem_reqs[i].order);
>> +     }
> [Severity: Critical]
> Is there a missing notification to the firmware that this memory is being
> unmapped?
> 
> This loop unmaps the DMA regions and frees the pages, but it doesn't send a
> PDS_CORE_HOST_MEM_DEL command. >
> For physical functions, pdsc_devcmd_reset() runs before this during
> teardown, which might clear hardware state. However, virtual functions
> explicitly bypass the reset in pdsc_teardown():
> 
> pdsc_teardown() {
>      if (!pdsc->pdev->is_virtfn)
>          pdsc_devcmd_reset(pdsc);
>      ...
> 
> If a virtual function uses host memory, skipping the MEM_DEL command means
> the firmware could be completely unaware the buffers were returned to the
> OS. Could this lead to the device performing DMA into freed memory and
> causing memory corruption or IOMMU faults?
> 
>> +
>> +     kfree(pdsc->host_mem_reqs);
>> +     pdsc->host_mem_reqs = NULL;
>> +     pdsc->num_host_mem_reqs = 0;
>> +}

For PFs: pdsc_devcmd_reset() runs before pdsc_host_mem_free() in 
teardown. The reset clears all firmware state including host memory 
state, so individual MEM_DEL commands are not needed.

For VFs: They never allocate host memory. VF init path (pdsc_init_vf())
doesn't call pdsc_setup() or pdsc_start(). pdsc_host_mem_add() is only
called from pdsc_start() in pdsc_init_pf().

Thanks,
Nikhil

^ permalink raw reply

* Re: [PATCH net-next v2 1/2] netdev: expose io_uring rx_page_order order via netlink
From: Jakub Kicinski @ 2026-06-15 20:00 UTC (permalink / raw)
  To: Pavel Begunkov
  Cc: Dragos Tatulea, Donald Hunter, David S. Miller, Eric Dumazet,
	Paolo Abeni, Simon Horman, Andrew Lunn, Jens Axboe, Yael Chemla,
	Tariq Toukan, netdev, linux-kernel, io-uring
In-Reply-To: <a773d177-82f3-4046-866d-852d0d83e08b@gmail.com>

On Mon, 15 Jun 2026 12:16:47 +0100 Pavel Begunkov wrote:
> On 6/14/26 01:02, Jakub Kicinski wrote:
> > On Sat, 13 Jun 2026 16:09:03 +0200 Dragos Tatulea wrote:  
> >> In io_pp_nl_fill() or in page_pool_nl_fill() as it was done in v1 for order?  
> > 
> > It's fine. We decided to make the "page size" a memory provider
> > property, now we're going back to making it a queue level param?
> > Like my RFC had that everyone hated so much? Sigh.  
> 
> TBH, I never cared much how nl would show it, so not opposing either
> version. My idea is that even without plumbing in per-queue non-mp size
> configuration, it'd be nice to have a common way to check it b/w
> providers.
> 
>  From the semantics and observability perspective, zcrx is probably not
> that interesting as the parameter is basically just a hint with no affect
> on uapi, and I'd assume people would rather see the page pool size or even
> the NIC's page size. But I guess it depends on what Dragos is really after
> with this patch.

Not sure what Dragos's use case is but IMO it's useful as system admin
/ vendor to be able to peek at the important params when user reports
bad perf. The netlink MP info is meant for system observability.

^ permalink raw reply

* Re: [PATCH net-next 0/2] selftests/vsock: improve vng version and quirk handling
From: patchwork-bot+netdevbpf @ 2026-06-15 20:00 UTC (permalink / raw)
  To: Bobby Eshleman
  Cc: sgarzare, shuah, virtualization, netdev, linux-kselftest,
	linux-kernel, bobbyeshleman
In-Reply-To: <20260612-vsock-test-update-v1-0-7d7eeed3ac8f@meta.com>

Hello:

This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 12 Jun 2026 12:08:40 -0700 you wrote:
> As vng has continued updating, there have been two things in our
> selftests that have been affected. One is that newer versions always
> emit the vng version warning, and two is that we have a workaround that
> is not needed in newer versions.
> 
> This series just updates the version handling to allow all newer
> versions without warning and version-gates the workaround to only those
> versions that don't have the commit that fixed the root cause.
> 
> [...]

Here is the summary with links:
  - [net-next,1/2] selftests/vsock: accept vng 1.33 or >= 1.36
    https://git.kernel.org/netdev/net-next/c/197503d5ac82
  - [net-next,2/2] selftests/vsock: skip vng setsid workaround on >= 1.41
    https://git.kernel.org/netdev/net-next/c/9361bff6bdb7

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply

* Re: [PATCH net] tipc: fix UAF in tipc_l2_send_msg()
From: patchwork-bot+netdevbpf @ 2026-06-15 20:00 UTC (permalink / raw)
  To: Eric Dumazet
  Cc: davem, kuba, pabeni, horms, netdev, eric.dumazet,
	syzbot+64ec81389cbad56a8c35, jmaloy
In-Reply-To: <20260612135949.4010482-1-edumazet@google.com>

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 12 Jun 2026 13:59:49 +0000 you wrote:
> Syzbot reported a slab-use-after-free in ipvlan_hard_header() when
> called from tipc_l2_send_msg().
> 
> The root cause is that tipc_disable_l2_media() calls synchronize_net()
> while b->media_ptr is still valid. This allows concurrent RCU readers
> to obtain the device pointer after synchronize_net() has finished.
> The pointer is cleared later in bearer_disable(), but without any
> subsequent synchronization, allowing the device to be freed while
> still in use by readers.
> 
> [...]

Here is the summary with links:
  - [net] tipc: fix UAF in tipc_l2_send_msg()
    https://git.kernel.org/netdev/net/c/f4c3d89fc986

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply

* Re: [PATCH net] tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
From: patchwork-bot+netdevbpf @ 2026-06-15 20:00 UTC (permalink / raw)
  To: Eric Dumazet
  Cc: davem, kuba, pabeni, horms, idosch, dsahern, ncardwell, kuniyu,
	netdev, eric.dumazet, syzbot+ebdb22d461c904fc3cb2,
	marcelo.leitner, lucien.xin
In-Reply-To: <20260612162517.83394-1-edumazet@google.com>

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 12 Jun 2026 16:25:17 +0000 you wrote:
> When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535).
> This is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535.
> 
> However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel.
> If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will
> be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer
> dereference because local TCP packets do not use frag_list.
> 
> [...]

Here is the summary with links:
  - [net] tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
    https://git.kernel.org/netdev/net/c/2bf43d0e2e6a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply

* Re: [PATCH v4 4/6] pds_core: add PLDM component info display
From: Rao, Nikhil @ 2026-06-15 19:58 UTC (permalink / raw)
  To: Simon Horman
  Cc: netdev, brett.creeley, andrew+netdev, davem, edumazet, kuba,
	pabeni, eric.joyner, nikhil.rao
In-Reply-To: <20260615160842.776643-4-horms@kernel.org>


On 6/15/2026 9:08 AM, Simon Horman wrote:
> This is an AI-generated review of your patch. The human sending this
> email has considered the AI review valid, or at least plausible.
> Full review at: https://netdev-ai.bots.linux.dev/sashiko/
> 
> Simon says: This review seems to be a bit of a mixed bag.
>              I've annotated the issues it raises that I'd appreciate
>              you looking over, and the rest, which I don't feel fall
>              in that category.
> ---
> pds_core: add PLDM component info display
> 
> This patch reports per-component firmware versions through devlink info on
> v2+ devices, replacing the single fw running version with names derived
> from the firmware-supplied component list and slot/flag fields.
> 
> Simon says: I'm not particularly concerned about the issue raised below -
>              I'm forwarding this review because of others raised further down.

Thanks for the review. Responding to the issues you flagged as 
warranting investigation below. I'm also addressing patch reordering and 
v2-error-handling in v5.

> Simon says: However, the issue flagged below seems to warrant
>              investigation in the context of this patch-set.
> 
> Second, pdsc->fw_components is only invalidated at the end of
> pdsc_firmware_update() ("pdsc->fw_components.num_components = 0;").
> If firmware versions change through any other path (FW recovery via
> health_work, PCI reset via pci_reset_work, side-channel upgrade) the
> cached list stays around and devlink dev info reports stale versions.
> Should those reset paths also clear pdsc->fw_components?

Valid concern. Will add a pdsc_fw_components_invalidate() helper in v5 
and call it from recovery and reset paths.


> Simon says: Likewise, the one below seems to warrant investigation too.
> 
> [Medium]
> num_components has already been bounded against
> PDS_CORE_FW_COMPONENT_LIST_LEN inside pdsc_get_component_info().
> max_fw_slots looks like a slot count (gold/main-a/main-b), but the
> component list also contains cpld/bootloader/uboot/etc.  If firmware
> reports six components on a three-slot device, this min_t() silently
> truncates legitimate component entries from the devlink output.
> 
> Is this cap intentional, and if so should truncation be logged?  If
> not, can the cap simply be dropped?

The field name max_fw_slots is misleading - firmware populates it with 
the component count, not a slot count. Will clean up the comment in v5. 
The min_t() is correct - it bounds against the number of components 
firmware reports.

> 
> Simon says: Again, the one below seems to warrant investigation.
> 
> [Medium]
> Pre-patch, devlink_info_version_stored_put() failures inside the fw
> list loop returned to the devlink layer immediately.  After this
> refactor, pdsc_dl_fw_list_info_get() returns the error but
> pdsc_dl_info_get_v1() converts it to dev_warn_once() and continues to
> append the running fw version and the ASIC fields.
> 
> Does this mean a mid-loop failure (for example -EMSGSIZE from netlink
> attribute append) is now masked, leaving a partially populated devlink
> info reply that gets reported as success?

Valid bug. The refactor unintentionally changed v1 error handling. 
Pre-patch, devlink_*() errors returned immediately. Will restore 
original v1 behavior in v5 - propagate errors from 
pdsc_dl_fw_list_info_get().

> Simon says: but this one seems to be more a question of style that substance.
> 
> [Medium]
> On v2+ devices, errors from pdsc_dl_component_info_get() are swallowed
> into dev_warn_once() and the function falls through to the ASIC
> fields.  Pre-patch behavior always reported pdsc->dev_info.fw_version
> via DEVLINK_INFO_VERSION_GENERIC_FW.
> 
> After this change, transient failures inside pdsc_get_component_info()
> (DMA mapping failure, -ENOMEM, the -ETIMEDOUT/-EAGAIN deferred-DMA
> path, the v0-firmware return-0-without-populating branch, the
> num_components > LIST_LEN -ENOMEM branch), or even firmware enumerating
> components without setting PDS_CORE_FW_COMPONENT_INFO_F_RUNNING on the
> MAIN component, cause devlink dev info to show only asic.id, asic.rev
> and the serial number with no firmware version reported at all.
> 
> Could the v2 path either retain the unconditional running fw fallback
> from dev_info.fw_version, or fall through to pdsc_dl_info_get_v1() on
> failure, so devlink info never silently loses the fw running version?
> 
> Also, since dev_warn_once() suppresses the warning across the lifetime
> of the device, callers cannot tell that the netlink reply is partial:
> a partially populated message gets the ASIC fields appended and is
> reported as success.
> 

For the v2 error handling: will propagate devlink errors (so partial 
replies are discarded) and add a fallback to dev_info.fw_version if 
component info fails.

Thanks,
Nikhil

^ permalink raw reply

* [PATCH net v2 2/2] net: ethernet: sunplus: spl2sw: fix multiple of_node refcount leaks in probe
From: Shitalkumar Gandhi @ 2026-06-15 19:50 UTC (permalink / raw)
  To: Wells Lu
  Cc: Andrew Lunn, Jakub Kicinski, David S. Miller, Eric Dumazet,
	Paolo Abeni, Simon Horman, netdev, linux-kernel,
	Shitalkumar Gandhi
In-Reply-To: <cover.1781552725.git.shitalkumar.gandhi@cambiumnetworks.com>

spl2sw_probe() acquires three of_node references that are never properly
released in all paths:

  - eth_ports_np from of_get_child_by_name() leaks on every probe.
  - port_np returned from spl2sw_get_eth_child_node() (which exits a
    for_each_child_of_node() loop mid-iteration) leaks per loop pass.
  - phy_np from of_parse_phandle() leaks on the -EPROBE_DEFER and
    spl2sw_init_netdev() failure goto paths, and the registered netdev's
    mac->phy_node is not released on the out_unregister_dev cleanup path.

Convert eth_ports_np and port_np to scoped __free(device_node), add
explicit of_node_put(phy_np) on the two early-error gotos where
ownership has not yet been transferred to mac->phy_node, and release
each registered ndev's mac->phy_node in the out_unregister_dev loop
before unregister_netdev().

The mac->phy_node release in the normal driver-remove path is handled
by patch 1/2.

Compile-tested only; no SP7021 hardware available.

Fixes: fd3040b9394c ("net: ethernet: Add driver for Sunplus SP7021")
Signed-off-by: Shitalkumar Gandhi <shitalkumar.gandhi@cambiumnetworks.com>
---
 drivers/net/ethernet/sunplus/spl2sw_driver.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/sunplus/spl2sw_driver.c b/drivers/net/ethernet/sunplus/spl2sw_driver.c
index 5e0e4c9ecbb0..d78bda050ee4 100644
--- a/drivers/net/ethernet/sunplus/spl2sw_driver.c
+++ b/drivers/net/ethernet/sunplus/spl2sw_driver.c
@@ -319,10 +319,8 @@ static struct device_node *spl2sw_get_eth_child_node(struct device_node *ether_n
 
 static int spl2sw_probe(struct platform_device *pdev)
 {
-	struct device_node *eth_ports_np;
-	struct device_node *port_np;
+	struct device_node *eth_ports_np __free(device_node) = NULL;
 	struct spl2sw_common *comm;
-	struct device_node *phy_np;
 	phy_interface_t phy_mode;
 	struct net_device *ndev;
 	struct spl2sw_mac *mac;
@@ -418,8 +416,10 @@ static int spl2sw_probe(struct platform_device *pdev)
 	}
 
 	for (i = 0; i < MAX_NETDEV_NUM; i++) {
-		/* Get port@i of node ethernet-ports. */
-		port_np = spl2sw_get_eth_child_node(eth_ports_np, i);
+		struct device_node *port_np __free(device_node) =
+			spl2sw_get_eth_child_node(eth_ports_np, i);
+		struct device_node *phy_np;
+
 		if (!port_np)
 			continue;
 
@@ -441,6 +441,7 @@ static int spl2sw_probe(struct platform_device *pdev)
 		/* Get mac-address from nvmem. */
 		ret = spl2sw_nvmem_get_mac_address(&pdev->dev, port_np, mac_addr);
 		if (ret == -EPROBE_DEFER) {
+			of_node_put(phy_np);
 			goto out_unregister_dev;
 		} else if (ret) {
 			dev_info(&pdev->dev, "Generate a random mac address!\n");
@@ -449,8 +450,10 @@ static int spl2sw_probe(struct platform_device *pdev)
 
 		/* Initialize the net device. */
 		ret = spl2sw_init_netdev(pdev, mac_addr, &ndev);
-		if (ret)
+		if (ret) {
+			of_node_put(phy_np);
 			goto out_unregister_dev;
+		}
 
 		ndev->irq = irq;
 		comm->ndev[i] = ndev;
@@ -500,8 +503,11 @@ static int spl2sw_probe(struct platform_device *pdev)
 
 out_unregister_dev:
 	for (i = 0; i < MAX_NETDEV_NUM; i++)
-		if (comm->ndev[i])
+		if (comm->ndev[i]) {
+			mac = netdev_priv(comm->ndev[i]);
+			of_node_put(mac->phy_node);
 			unregister_netdev(comm->ndev[i]);
+		}
 
 out_free_mdio:
 	spl2sw_mdio_remove(comm);
-- 
2.25.1


^ permalink raw reply related

* [PATCH net v2 1/2] net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove
From: Shitalkumar Gandhi @ 2026-06-15 19:50 UTC (permalink / raw)
  To: Wells Lu
  Cc: Andrew Lunn, Jakub Kicinski, David S. Miller, Eric Dumazet,
	Paolo Abeni, Simon Horman, netdev, linux-kernel,
	Shitalkumar Gandhi
In-Reply-To: <cover.1781552725.git.shitalkumar.gandhi@cambiumnetworks.com>

mac->phy_node is acquired via of_parse_phandle() in spl2sw_probe() and
stored in the mac private data, transferring ownership of the
device_node reference to mac. On driver removal, spl2sw_phy_remove()
disconnects the PHY but never drops that reference, so each
probe-then-remove cycle leaks one of_node refcount per port permanently.

Drop the reference after phy_disconnect(). While at it, remove the
redundant inner "if (ndev)" check; comm->ndev[i] was just verified
non-NULL on the line above.

Compile-tested only; no SP7021 hardware available.

Fixes: fd3040b9394c ("net: ethernet: Add driver for Sunplus SP7021")
Signed-off-by: Shitalkumar Gandhi <shitalkumar.gandhi@cambiumnetworks.com>
---
 drivers/net/ethernet/sunplus/spl2sw_phy.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/sunplus/spl2sw_phy.c b/drivers/net/ethernet/sunplus/spl2sw_phy.c
index 6f899e48f51d..a4889c52e00e 100644
--- a/drivers/net/ethernet/sunplus/spl2sw_phy.c
+++ b/drivers/net/ethernet/sunplus/spl2sw_phy.c
@@ -79,12 +79,14 @@ int spl2sw_phy_connect(struct spl2sw_common *comm)
 void spl2sw_phy_remove(struct spl2sw_common *comm)
 {
 	struct net_device *ndev;
+	struct spl2sw_mac *mac;
 	int i;
 
 	for (i = 0; i < MAX_NETDEV_NUM; i++)
 		if (comm->ndev[i]) {
 			ndev = comm->ndev[i];
-			if (ndev)
-				phy_disconnect(ndev->phydev);
+			mac = netdev_priv(ndev);
+			phy_disconnect(ndev->phydev);
+			of_node_put(mac->phy_node);
 		}
 }
-- 
2.25.1


^ permalink raw reply related

* [PATCH net v2 0/2] net: ethernet: sunplus: spl2sw: fix of_node refcount leaks
From: Shitalkumar Gandhi @ 2026-06-15 19:50 UTC (permalink / raw)
  To: Wells Lu
  Cc: Andrew Lunn, Jakub Kicinski, David S. Miller, Eric Dumazet,
	Paolo Abeni, Simon Horman, netdev, linux-kernel,
	Shitalkumar Gandhi

This series fixes of_node refcount leaks in the Sunplus SP7021 ethernet
driver, found by inspection. Compile-tested only; no SP7021 hardware
available here.

Patch 1/2 fixes the phy_node leak in the remove path.
Patch 2/2 fixes multiple leaks in the probe path and depends on the
cleanup contract from patch 1/2.

Changes since v1:
  - Combined the two related fixes into a single series with cover
    letter, per netdev convention.
  - Added "Compile-tested only" note to both commit messages
    (Andrew Lunn).
  - Dropped Cc: stable@vger.kernel.org -- the leaks only manifest on
    driver unbind/rebind, which is not a path normally exercised on
    this SoC (Andrew Lunn).
  - Fix author email to match Signed-off-by (DCO).

v1: https://lore.kernel.org/netdev/20260607193029.589736-1-shitalkumar.gandhi@cambiumnetworks.com/
    https://lore.kernel.org/netdev/20260607193711.601544-1-shitalkumar.gandhi@cambiumnetworks.com/

Shitalkumar Gandhi (2):
  net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove
  net: ethernet: sunplus: spl2sw: fix multiple of_node refcount leaks in
    probe

 drivers/net/ethernet/sunplus/spl2sw_driver.c | 20 +++++++++++++-------
 drivers/net/ethernet/sunplus/spl2sw_phy.c    |  6 ++++--
 2 files changed, 17 insertions(+), 9 deletions(-)

-- 
2.25.1


^ permalink raw reply

* Re: [PATCH] net: dsa: hellcreek: replace kcalloc with struct_size
From: patchwork-bot+netdevbpf @ 2026-06-15 19:50 UTC (permalink / raw)
  To: Rosen Penev
  Cc: netdev, kurt, andrew, olteanv, davem, edumazet, kuba, pabeni,
	linux-kernel
In-Reply-To: <20260608045640.5172-1-rosenp@gmail.com>

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Sun,  7 Jun 2026 21:56:40 -0700 you wrote:
> One fewer allocation for the priv struct.
> 
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---
>  drivers/net/dsa/hirschmann/hellcreek.c | 14 +++++---------
>  drivers/net/dsa/hirschmann/hellcreek.h |  2 +-
>  2 files changed, 6 insertions(+), 10 deletions(-)

Here is the summary with links:
  - net: dsa: hellcreek: replace kcalloc with struct_size
    https://git.kernel.org/netdev/net-next/c/e3d202a1ed7c

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply

* Re: [PATCH net-next v3] net: phy: sfp: detect presence via I2C when no MOD_DEF0 GPIO
From: patchwork-bot+netdevbpf @ 2026-06-15 19:50 UTC (permalink / raw)
  To: Greg Patrick
  Cc: linux, andrew, hkallweit1, netdev, linux-kernel, davem, edumazet,
	kuba, pabeni, maxime.chevallier, mensi
In-Reply-To: <20260611175341.2223184-1-gregspatrick@hotmail.com>

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 11 Jun 2026 17:53:41 +0000 you wrote:
> An SFP cage (compatible "sff,sfp") whose MOD_DEF0 signal is not wired to a
> GPIO currently falls back to sff_gpio_get_state(), which unconditionally
> reports the module as present. An empty cage therefore fails its probe and
> is parked in SFP_MOD_ERROR forever; because SFP_F_PRESENT never deasserts
> there is no REMOVE event to recover the state machine, so a module inserted
> after boot is never detected, and empty cages spam -EIO at boot.
> 
> [...]

Here is the summary with links:
  - [net-next,v3] net: phy: sfp: detect presence via I2C when no MOD_DEF0 GPIO
    https://git.kernel.org/netdev/net-next/c/8ac44d24c3a1

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply

* Re: [PATCH v1 net-next 0/5] ipv4: fib: Remove RTNL in fib_net_exit_batch().
From: patchwork-bot+netdevbpf @ 2026-06-15 19:50 UTC (permalink / raw)
  To: Kuniyuki Iwashima
  Cc: dsahern, idosch, davem, edumazet, kuba, pabeni, horms, kuni1840,
	netdev
In-Reply-To: <20260612063225.455191-1-kuniyu@google.com>

Hello:

This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 12 Jun 2026 06:32:03 +0000 you wrote:
> Currently, we flush all IPv4 routes at ->exit_batch() during
> netns dismantle, which requires an extra RTNL.
> 
> IPv4 routes are not added from the fast path unlike IPv6, so
> we can flush routes before default_device_exit_batch().
> 
> However, there is implicit ordering between ip_fib_net_exit()
> and default_device_exit_batch().
> 
> [...]

Here is the summary with links:
  - [v1,net-next,1/5] ipv4: fib: Flush all fib_info in fib_table_flush() during netns dismantle.
    https://git.kernel.org/netdev/net-next/c/64587e936b65
  - [v1,net-next,2/5] ipv4: fib: Call fib_proc_exit() and nl_fib_lookup_exit() at ->pre_exit().
    https://git.kernel.org/netdev/net-next/c/c993bd0102aa
  - [v1,net-next,3/5] ipv4: fib: Free net->ipv4.{fib_table_hash,notifier_ops} without RTNL.
    https://git.kernel.org/netdev/net-next/c/49374d87e839
  - [v1,net-next,4/5] ipv4: fib: Avoid calling fib_trie_table() in fib_new_table() for dying net.
    https://git.kernel.org/netdev/net-next/c/5a7fef12d931
  - [v1,net-next,5/5] ipv4: fib: Convert fib_net_exit_batch() to ->exit_rtnl().
    https://git.kernel.org/netdev/net-next/c/759923cf03b0

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply

* Re: [PATCH net-next v2 0/5] devlink: Warn on resource ID collision with PARENT_TOP
From: patchwork-bot+netdevbpf @ 2026-06-15 19:50 UTC (permalink / raw)
  To: David Yang
  Cc: netdev, florian.fainelli, jonas.gorski, andrew, olteanv, davem,
	edumazet, kuba, pabeni, kurt, jiri, horms, linux-kernel
In-Reply-To: <20260611070856.889700-1-mmyangfl@gmail.com>

Hello:

This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 11 Jun 2026 15:08:46 +0800 you wrote:
> Filter out the ambiguous case of
> 
> enum {
>     MY_RESOURCE_ID_A,  /* == DEVLINK_RESOURCE_ID_PARENT_TOP ! */
>     MY_RESOURCE_ID_B,
>     ...
> };
> 
> [...]

Here is the summary with links:
  - [net-next,v2,1/5] net: dsa: dsa_loop: avoid devlink resource IDs collision with PARENT_TOP
    https://git.kernel.org/netdev/net-next/c/b2772157e5ae
  - [net-next,v2,2/5] net: dsa: b53: avoid devlink resource IDs collision with PARENT_TOP
    https://git.kernel.org/netdev/net-next/c/89ccbd3fe837
  - [net-next,v2,3/5] net: dsa: hellcreek: avoid devlink resource IDs collision with PARENT_TOP
    https://git.kernel.org/netdev/net-next/c/31d2b61ba2cc
  - [net-next,v2,4/5] net: dsa: mv88e6xxx: Avoid devlink resource IDs collision with PARENT_TOP
    https://git.kernel.org/netdev/net-next/c/bfdf01f4d161
  - [net-next,v2,5/5] devlink: Warn on resource ID collision with PARENT_TOP
    https://git.kernel.org/netdev/net-next/c/f1e13d23e0c8

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply

* Re: [PATCH net 0/2] octeontx2: quiesce stale mailbox IRQ state before request_irq()
From: patchwork-bot+netdevbpf @ 2026-06-15 19:50 UTC (permalink / raw)
  To: Runyu Xiao
  Cc: netdev, sgoutham, gakula, sbhatta, hkelam, bbhushan2,
	andrew+netdev, davem, edumazet, kuba, pabeni, amakarov,
	tduszynski, linux-kernel, jianhao.xu
In-Reply-To: <20260611160014.3202224-1-runyu.xiao@seu.edu.cn>

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 12 Jun 2026 00:00:12 +0800 you wrote:
> Both OTX2 mailbox registration paths currently install their IRQ
> handlers before clearing stale local mailbox interrupt state, even
> though the code comments already say that the clear is needed first to
> avoid spurious interrupts.
> 
> This issue was found by our static analysis tool and manually audited on
> Linux v6.18.21. Directed QEMU no-device validation further showed that
> the real PF and VF mailbox handlers are already reachable in that
> pre-clear window and can touch the same mailbox and workqueue carrier
> before local quiesce has completed.
> 
> [...]

Here is the summary with links:
  - [net,1/2] octeontx2-pf: clear stale mailbox IRQ state before request_irq()
    https://git.kernel.org/netdev/net/c/f918554fb724
  - [net,2/2] octeontx2-vf: clear stale mailbox IRQ state before request_irq()
    https://git.kernel.org/netdev/net/c/0b352f04b9be

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply

* Re: [PATCH net 1/1] net: smc: fix splice entry lifetime imbalance in smc_rx_splice
From: Jakub Kicinski @ 2026-06-15 19:49 UTC (permalink / raw)
  To: Ren Wei
  Cc: linux-rdma, linux-s390, netdev, alibuda, dust.li, sidraya, wenjia,
	mjambigi, tonylu, guwen, ubraun, stefan.raspl, davem, yuantan098,
	zcliangcn, bird, lx24, d4n.for.sec
In-Reply-To: <192d1b44ed358ca143f44ef167d14153bccc51e9.1781097957.git.d4n.for.sec@gmail.com>

On Thu, 11 Jun 2026 01:54:11 +0800 Ren Wei wrote:
> smc_rx_splice() hands candidate pages to splice_to_pipe() without taking
> references for the lifetime of each splice entry first. That breaks the
> splice ownership contract in the VM-backed RMB path.
> 
> splice_to_pipe() drops unqueued entries through spd_release(), while
> queued entries are later dropped through the pipe buffer release
> callback. The current code only tries to take page references after the
> splice succeeds, and it derives the number of queued VM pages from a
> mutated offset value. This can underflow page refcounts and trigger a
> use-after-free. It also leaves the socket lifetime imbalanced in the
> multi-page VM case, where one sock_hold() can be followed by multiple
> sock_put() calls.
> 
> Fix this by taking the page and socket references for every candidate
> splice entry before calling splice_to_pipe(), and by releasing the
> matching private state, page reference, and socket reference from
> smc_rx_spd_release() for entries that never get queued. This makes the
> SMC splice path follow the normal splice lifetime rules and removes the
> broken post-splice VM page counting entirely.

SMC maintainers please review.

^ permalink raw reply

* Re: [PATCH net 0/2] vsock/virtio: fix MSG_PEEK calculation on bytes to copy
From: Michael S. Tsirkin @ 2026-06-15 19:48 UTC (permalink / raw)
  To: Luigi Leonardi
  Cc: Stefan Hajnoczi, Stefano Garzarella, Jason Wang, Xuan Zhuo,
	Eugenio Pérez, David S. Miller, Eric Dumazet, Jakub Kicinski,
	Paolo Abeni, Simon Horman, Arseniy Krasnov, kvm, virtualization,
	netdev, linux-kernel
In-Reply-To: <20260402-fix_peek-v1-0-ad274fcef77b@redhat.com>

On Thu, Apr 02, 2026 at 10:18:00AM +0200, Luigi Leonardi wrote:
> `virtio_transport_stream_do_peek`, when calculating the number of bytes to copy,
> didn't consider the `offset`, caused by partial reads that happend before.
> This might cause out-of-bounds read that lead to an EFAULT.
> More details in the commit.
> 
> Commit 1 introduces the fix
> Commit 2 introduces a test that checks for this bug to avoid future
> regressions.
> 
> Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

Acked-by: Michael S. Tsirkin <mst@redhat.com>

> ---
> Luigi Leonardi (2):
>       vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy
>       vsock/test: add MSG_PEEK after partial recv test
> 
>  net/vmw_vsock/virtio_transport_common.c |  5 ++-
>  tools/testing/vsock/vsock_test.c        | 64 +++++++++++++++++++++++++++++++++
>  2 files changed, 66 insertions(+), 3 deletions(-)
> ---
> base-commit: 9147566d801602c9e7fc7f85e989735735bf38ba
> change-id: 20260401-fix_peek-6837b83469e3
> 
> Best regards,
> -- 
> Luigi Leonardi <leonardi@redhat.com>


^ permalink raw reply

* [PATCH net-next v2 9/9] atm: remove orphaned uAPI for deleted drivers, protocols and SVCs
From: Jakub Kicinski @ 2026-06-15 19:44 UTC (permalink / raw)
  To: davem
  Cc: netdev, edumazet, pabeni, andrew+netdev, horms, 3chas3, mitch,
	linux-atm-general, dwmw2, Jakub Kicinski
In-Reply-To: <20260615194416.752559-1-kuba@kernel.org>

ATM removals have left a number of uAPI headers and ioctl
definitions with no in-kernel implementation behind them:

 - device headers for adapters deleted with the legacy PCI/SBUS drivers:
   atm_eni.h, atm_he.h, atm_idt77105.h, atm_nicstar.h, atm_zatm.h and
   the atmtcp pair atm_tcp.h / <linux/atm_tcp.h>
 - protocol headers for the removed CLIP, LANE and MPOA stacks:
   atmarp.h, atmclip.h, atmlec.h, atmmpc.h
 - atmsvc.h and the SVC / p2mp / local-address ioctls in atmdev.h
   (ATM_{GET,RST,ADD,DEL}ADDR, ATM_{ADD,DEL,GET}LECSADDR,
   ATM_{ADD,DROP}PARTY) left behind by the SVC and address-registry
   removals

None of these are referenced by any remaining in-tree code.
Let's try to delete all this. Chances are nobody cares about
these headers any more. I'm keeping this separate from the
kernel side code changes for ease of revert, in case I am
proven wrong...

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 include/linux/atm_tcp.h           |  24 ------
 include/uapi/linux/atm_eni.h      |  24 ------
 include/uapi/linux/atm_he.h       |  21 -----
 include/uapi/linux/atm_idt77105.h |  29 -------
 include/uapi/linux/atm_nicstar.h  |  54 -------------
 include/uapi/linux/atm_tcp.h      |  62 ---------------
 include/uapi/linux/atm_zatm.h     |  47 -----------
 include/uapi/linux/atmarp.h       |  42 ----------
 include/uapi/linux/atmclip.h      |  22 ------
 include/uapi/linux/atmdev.h       |  18 -----
 include/uapi/linux/atmlec.h       |  92 ----------------------
 include/uapi/linux/atmmpc.h       | 127 ------------------------------
 include/uapi/linux/atmsvc.h       |  56 -------------
 net/atm/ioctl.c                   |   1 -
 14 files changed, 619 deletions(-)
 delete mode 100644 include/linux/atm_tcp.h
 delete mode 100644 include/uapi/linux/atm_eni.h
 delete mode 100644 include/uapi/linux/atm_he.h
 delete mode 100644 include/uapi/linux/atm_idt77105.h
 delete mode 100644 include/uapi/linux/atm_nicstar.h
 delete mode 100644 include/uapi/linux/atm_tcp.h
 delete mode 100644 include/uapi/linux/atm_zatm.h
 delete mode 100644 include/uapi/linux/atmarp.h
 delete mode 100644 include/uapi/linux/atmclip.h
 delete mode 100644 include/uapi/linux/atmlec.h
 delete mode 100644 include/uapi/linux/atmmpc.h
 delete mode 100644 include/uapi/linux/atmsvc.h

diff --git a/include/linux/atm_tcp.h b/include/linux/atm_tcp.h
deleted file mode 100644
index 2558439d849b..000000000000
--- a/include/linux/atm_tcp.h
+++ /dev/null
@@ -1,24 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/* atm_tcp.h - Driver-specific declarations of the ATMTCP driver (for use by
-	       driver-specific utilities) */
-
-/* Written 1997-2000 by Werner Almesberger, EPFL LRC/ICA */
-
-#ifndef LINUX_ATM_TCP_H
-#define LINUX_ATM_TCP_H
-
-#include <uapi/linux/atm_tcp.h>
-
-struct atm_vcc;
-struct module;
-
-struct atm_tcp_ops {
-	int (*attach)(struct atm_vcc *vcc,int itf);
-	int (*create_persistent)(int itf);
-	int (*remove_persistent)(int itf);
-	struct module *owner;
-};
-
-extern struct atm_tcp_ops atm_tcp_ops;
-
-#endif
diff --git a/include/uapi/linux/atm_eni.h b/include/uapi/linux/atm_eni.h
deleted file mode 100644
index cf5bfd1a2691..000000000000
--- a/include/uapi/linux/atm_eni.h
+++ /dev/null
@@ -1,24 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/* atm_eni.h - Driver-specific declarations of the ENI driver (for use by
-	       driver-specific utilities) */
-
-/* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
-
-
-#ifndef LINUX_ATM_ENI_H
-#define LINUX_ATM_ENI_H
-
-#include <linux/atmioc.h>
-
-
-struct eni_multipliers {
-	int tx,rx;	/* values are in percent and must be > 100 */
-};
-
-
-#define ENI_MEMDUMP     _IOW('a',ATMIOC_SARPRV,struct atmif_sioc)
-                                                /* printk memory map */
-#define ENI_SETMULT	_IOW('a',ATMIOC_SARPRV+7,struct atmif_sioc)
-						/* set buffer multipliers */
-
-#endif
diff --git a/include/uapi/linux/atm_he.h b/include/uapi/linux/atm_he.h
deleted file mode 100644
index 9f4b43293988..000000000000
--- a/include/uapi/linux/atm_he.h
+++ /dev/null
@@ -1,21 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/* atm_he.h */
-
-#ifndef LINUX_ATM_HE_H
-#define LINUX_ATM_HE_H
-
-#include <linux/atmioc.h>
-
-#define HE_GET_REG	_IOW('a', ATMIOC_SARPRV, struct atmif_sioc)
-
-#define HE_REGTYPE_PCI	1
-#define HE_REGTYPE_RCM	2
-#define HE_REGTYPE_TCM	3
-#define HE_REGTYPE_MBOX	4
-
-struct he_ioctl_reg {
-	unsigned addr, val;
-	char type;
-};
-
-#endif /* LINUX_ATM_HE_H */
diff --git a/include/uapi/linux/atm_idt77105.h b/include/uapi/linux/atm_idt77105.h
deleted file mode 100644
index f0fd6912a14b..000000000000
--- a/include/uapi/linux/atm_idt77105.h
+++ /dev/null
@@ -1,29 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/* atm_idt77105.h - Driver-specific declarations of the IDT77105 driver (for
- * use by driver-specific utilities) */
-
-/* Written 1999 by Greg Banks <gnb@linuxfan.com>. Copied from atm_suni.h. */
-
-
-#ifndef LINUX_ATM_IDT77105_H
-#define LINUX_ATM_IDT77105_H
-
-#include <linux/types.h>
-#include <linux/atmioc.h>
-#include <linux/atmdev.h>
-
-/*
- * Structure for IDT77105_GETSTAT and IDT77105_GETSTATZ ioctls.
- * Pointed to by `arg' in atmif_sioc.
- */
-struct idt77105_stats {
-        __u32 symbol_errors;  /* wire symbol errors */
-        __u32 tx_cells;       /* cells transmitted */
-        __u32 rx_cells;       /* cells received */
-        __u32 rx_hec_errors;  /* Header Error Check errors on receive */
-};
-
-#define IDT77105_GETSTAT	_IOW('a',ATMIOC_PHYPRV+2,struct atmif_sioc)	/* get stats */
-#define IDT77105_GETSTATZ	_IOW('a',ATMIOC_PHYPRV+3,struct atmif_sioc)	/* get stats and zero */
-
-#endif
diff --git a/include/uapi/linux/atm_nicstar.h b/include/uapi/linux/atm_nicstar.h
deleted file mode 100644
index 880d368b5b9a..000000000000
--- a/include/uapi/linux/atm_nicstar.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/******************************************************************************
- *
- * atm_nicstar.h
- *
- * Driver-specific declarations for use by NICSTAR driver specific utils.
- *
- * Author: Rui Prior
- *
- * (C) INESC 1998
- *
- ******************************************************************************/
-
-
-#ifndef LINUX_ATM_NICSTAR_H
-#define LINUX_ATM_NICSTAR_H
-
-/* Note: non-kernel programs including this file must also include
- * sys/types.h for struct timeval
- */
-
-#include <linux/atmapi.h>
-#include <linux/atmioc.h>
-
-#define NS_GETPSTAT	_IOWR('a',ATMIOC_SARPRV+1,struct atmif_sioc)
-						/* get pool statistics */
-#define NS_SETBUFLEV	_IOW('a',ATMIOC_SARPRV+2,struct atmif_sioc)
-						/* set buffer level markers */
-#define NS_ADJBUFLEV	_IO('a',ATMIOC_SARPRV+3)
-						/* adjust buffer level */
-
-typedef struct buf_nr
-{
-   unsigned min;
-   unsigned init;
-   unsigned max;
-}buf_nr;
-
-
-typedef struct pool_levels
-{
-   int buftype;
-   int count;		/* (At least for now) only used in NS_GETPSTAT */
-   buf_nr level;
-} pool_levels;
-
-/* type must be one of the following: */
-#define NS_BUFTYPE_SMALL 1
-#define NS_BUFTYPE_LARGE 2
-#define NS_BUFTYPE_HUGE 3
-#define NS_BUFTYPE_IOVEC 4
-
-
-#endif /* LINUX_ATM_NICSTAR_H */
diff --git a/include/uapi/linux/atm_tcp.h b/include/uapi/linux/atm_tcp.h
deleted file mode 100644
index 7309e1bc8867..000000000000
--- a/include/uapi/linux/atm_tcp.h
+++ /dev/null
@@ -1,62 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/* atm_tcp.h - Driver-specific declarations of the ATMTCP driver (for use by
-	       driver-specific utilities) */
-
-/* Written 1997-2000 by Werner Almesberger, EPFL LRC/ICA */
-
-
-#ifndef _UAPILINUX_ATM_TCP_H
-#define _UAPILINUX_ATM_TCP_H
-
-#include <linux/atmapi.h>
-#include <linux/atm.h>
-#include <linux/atmioc.h>
-#include <linux/types.h>
-
-
-/*
- * All values in struct atmtcp_hdr are in network byte order
- */
-
-struct atmtcp_hdr {
-	__u16	vpi;
-	__u16	vci;
-	__u32	length;		/* ... of data part */
-};
-
-/*
- * All values in struct atmtcp_command are in host byte order
- */
-
-#define ATMTCP_HDR_MAGIC	(~0)	/* this length indicates a command */
-#define ATMTCP_CTRL_OPEN	1	/* request/reply */
-#define ATMTCP_CTRL_CLOSE	2	/* request/reply */
-
-struct atmtcp_control {
-	struct atmtcp_hdr hdr;	/* must be first */
-	int type;		/* message type; both directions */
-	atm_kptr_t vcc;		/* both directions */
-	struct sockaddr_atmpvc addr; /* suggested value from kernel */
-	struct atm_qos	qos;	/* both directions */
-	int result;		/* to kernel only */
-} __ATM_API_ALIGN;
-
-/*
- * Field usage:
- * Messge type	dir.	hdr.v?i	type	addr	qos	vcc	result
- * -----------  ----	------- ----	----	---	---	------
- * OPEN		K->D	Y	Y	Y	Y	Y	0
- * OPEN		D->K	-	Y	Y	Y	Y	Y
- * CLOSE	K->D	-	-	Y	-	Y	0
- * CLOSE	D->K	-	-	-	-	Y	Y
- */
-
-#define SIOCSIFATMTCP	_IO('a',ATMIOC_ITF)	/* set ATMTCP mode */
-#define ATMTCP_CREATE	_IO('a',ATMIOC_ITF+14)	/* create persistent ATMTCP
-						   interface */
-#define ATMTCP_REMOVE	_IO('a',ATMIOC_ITF+15)	/* destroy persistent ATMTCP
-						   interface */
-
-
-
-#endif /* _UAPILINUX_ATM_TCP_H */
diff --git a/include/uapi/linux/atm_zatm.h b/include/uapi/linux/atm_zatm.h
deleted file mode 100644
index 5135027b93c1..000000000000
--- a/include/uapi/linux/atm_zatm.h
+++ /dev/null
@@ -1,47 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/* atm_zatm.h - Driver-specific declarations of the ZATM driver (for use by
-		driver-specific utilities) */
-
-/* Written 1995-1999 by Werner Almesberger, EPFL LRC/ICA */
-
-
-#ifndef LINUX_ATM_ZATM_H
-#define LINUX_ATM_ZATM_H
-
-/*
- * Note: non-kernel programs including this file must also include
- * sys/types.h for struct timeval
- */
-
-#include <linux/atmapi.h>
-#include <linux/atmioc.h>
-
-#define ZATM_GETPOOL	_IOW('a',ATMIOC_SARPRV+1,struct atmif_sioc)
-						/* get pool statistics */
-#define ZATM_GETPOOLZ	_IOW('a',ATMIOC_SARPRV+2,struct atmif_sioc)
-						/* get statistics and zero */
-#define ZATM_SETPOOL	_IOW('a',ATMIOC_SARPRV+3,struct atmif_sioc)
-						/* set pool parameters */
-
-struct zatm_pool_info {
-	int ref_count;			/* free buffer pool usage counters */
-	int low_water,high_water;	/* refill parameters */
-	int rqa_count,rqu_count;	/* queue condition counters */
-	int offset,next_off;		/* alignment optimizations: offset */
-	int next_cnt,next_thres;	/* repetition counter and threshold */
-};
-
-struct zatm_pool_req {
-	int pool_num;			/* pool number */
-	struct zatm_pool_info info;	/* actual information */
-};
-
-#define ZATM_OAM_POOL		0	/* free buffer pool for OAM cells */
-#define ZATM_AAL0_POOL		1	/* free buffer pool for AAL0 cells */
-#define ZATM_AAL5_POOL_BASE	2	/* first AAL5 free buffer pool */
-#define ZATM_LAST_POOL	ZATM_AAL5_POOL_BASE+10 /* max. 64 kB */
-
-#define ZATM_TIMER_HISTORY_SIZE	16	/* number of timer adjustments to
-					   record; must be 2^n */
-
-#endif
diff --git a/include/uapi/linux/atmarp.h b/include/uapi/linux/atmarp.h
deleted file mode 100644
index 8e44d121fde1..000000000000
--- a/include/uapi/linux/atmarp.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/* atmarp.h - ATM ARP protocol and kernel-demon interface definitions */
- 
-/* Written 1995-1999 by Werner Almesberger, EPFL LRC/ICA */
- 
-
-#ifndef _LINUX_ATMARP_H
-#define _LINUX_ATMARP_H
-
-#include <linux/types.h>
-#include <linux/atmapi.h>
-#include <linux/atmioc.h>
-
-
-#define ATMARP_RETRY_DELAY 30		/* request next resolution or forget
-					   NAK after 30 sec - should go into
-					   atmclip.h */
-#define ATMARP_MAX_UNRES_PACKETS 5	/* queue that many packets while
-					   waiting for the resolver */
-
-
-#define ATMARPD_CTRL	_IO('a',ATMIOC_CLIP+1)	/* become atmarpd ctrl sock */
-#define ATMARP_MKIP	_IO('a',ATMIOC_CLIP+2)	/* attach socket to IP */
-#define ATMARP_SETENTRY	_IO('a',ATMIOC_CLIP+3)	/* fill or hide ARP entry */
-#define ATMARP_ENCAP	_IO('a',ATMIOC_CLIP+5)	/* change encapsulation */
-
-
-enum atmarp_ctrl_type {
-	act_invalid,		/* catch uninitialized structures */
-	act_need,		/* need address resolution */
-	act_up,			/* interface is coming up */
-	act_down,		/* interface is going down */
-	act_change		/* interface configuration has changed */
-};
-
-struct atmarp_ctrl {
-	enum atmarp_ctrl_type	type;	/* message type */
-	int			itf_num;/* interface number (if present) */
-	__be32			ip;	/* IP address (act_need only) */
-};
-
-#endif
diff --git a/include/uapi/linux/atmclip.h b/include/uapi/linux/atmclip.h
deleted file mode 100644
index c818bb82b4e6..000000000000
--- a/include/uapi/linux/atmclip.h
+++ /dev/null
@@ -1,22 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/* atmclip.h - Classical IP over ATM */
- 
-/* Written 1995-1998 by Werner Almesberger, EPFL LRC/ICA */
- 
-
-#ifndef LINUX_ATMCLIP_H
-#define LINUX_ATMCLIP_H
-
-#include <linux/sockios.h>
-#include <linux/atmioc.h>
-
-
-#define RFC1483LLC_LEN	8		/* LLC+OUI+PID = 8 */
-#define RFC1626_MTU	9180		/* RFC1626 default MTU */
-
-#define CLIP_DEFAULT_IDLETIMER 1200	/* 20 minutes, see RFC1755 */
-#define CLIP_CHECK_INTERVAL	 10	/* check every ten seconds */
-
-#define	SIOCMKCLIP	_IO('a',ATMIOC_CLIP)	/* create IP interface */
-
-#endif
diff --git a/include/uapi/linux/atmdev.h b/include/uapi/linux/atmdev.h
index 20b0215084fc..a94e7b8360ee 100644
--- a/include/uapi/linux/atmdev.h
+++ b/include/uapi/linux/atmdev.h
@@ -60,14 +60,6 @@ struct atm_dev_stats {
 					/* get interface type name */
 #define ATM_GETESI	_IOW('a',ATMIOC_ITF+5,struct atmif_sioc)
 					/* get interface ESI */
-#define ATM_GETADDR	_IOW('a',ATMIOC_ITF+6,struct atmif_sioc)
-					/* get itf's local ATM addr. list */
-#define ATM_RSTADDR	_IOW('a',ATMIOC_ITF+7,struct atmif_sioc)
-					/* reset itf's ATM address list */
-#define ATM_ADDADDR	_IOW('a',ATMIOC_ITF+8,struct atmif_sioc)
-					/* add a local ATM address */
-#define ATM_DELADDR	_IOW('a',ATMIOC_ITF+9,struct atmif_sioc)
-					/* remove a local ATM address */
 #define ATM_GETCIRANGE	_IOW('a',ATMIOC_ITF+10,struct atmif_sioc)
 					/* get connection identifier range */
 #define ATM_SETCIRANGE	_IOW('a',ATMIOC_ITF+11,struct atmif_sioc)
@@ -76,12 +68,6 @@ struct atm_dev_stats {
 					/* set interface ESI */
 #define ATM_SETESIF	_IOW('a',ATMIOC_ITF+13,struct atmif_sioc)
 					/* force interface ESI */
-#define ATM_ADDLECSADDR	_IOW('a', ATMIOC_ITF+14, struct atmif_sioc)
-					/* register a LECS address */
-#define ATM_DELLECSADDR	_IOW('a', ATMIOC_ITF+15, struct atmif_sioc)
-					/* unregister a LECS address */
-#define ATM_GETLECSADDR	_IOW('a', ATMIOC_ITF+16, struct atmif_sioc)
-					/* retrieve LECS address(es) */
 
 #define ATM_GETSTAT	_IOW('a',ATMIOC_SARCOM+0,struct atmif_sioc)
 					/* get AAL layer statistics */
@@ -99,10 +85,6 @@ struct atm_dev_stats {
 					/* set backend handler */
 #define ATM_NEWBACKENDIF _IOW('a',ATMIOC_SPECIAL+3,atm_backend_t)
 					/* use backend to make new if */
-#define ATM_ADDPARTY  	_IOW('a', ATMIOC_SPECIAL+4,struct atm_iobuf)
- 					/* add party to p2mp call */
-#define ATM_DROPPARTY 	_IOW('a', ATMIOC_SPECIAL+5,int)
-					/* drop party from p2mp call */
 
 /*
  * These are backend handkers that can be set via the ATM_SETBACKEND call
diff --git a/include/uapi/linux/atmlec.h b/include/uapi/linux/atmlec.h
deleted file mode 100644
index c68346bb40e6..000000000000
--- a/include/uapi/linux/atmlec.h
+++ /dev/null
@@ -1,92 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/*
- * ATM Lan Emulation Daemon driver interface
- *
- * Marko Kiiskila <mkiiskila@yahoo.com>
- */
-
-#ifndef _ATMLEC_H_
-#define _ATMLEC_H_
-
-#include <linux/atmapi.h>
-#include <linux/atmioc.h>
-#include <linux/atm.h>
-#include <linux/if_ether.h>
-#include <linux/types.h>
-
-/* ATM lec daemon control socket */
-#define ATMLEC_CTRL	_IO('a', ATMIOC_LANE)
-#define ATMLEC_DATA	_IO('a', ATMIOC_LANE+1)
-#define ATMLEC_MCAST	_IO('a', ATMIOC_LANE+2)
-
-/* Maximum number of LEC interfaces (tweakable) */
-#define MAX_LEC_ITF 48
-
-typedef enum {
-	l_set_mac_addr,
-	l_del_mac_addr,
-	l_svc_setup,
-	l_addr_delete,
-	l_topology_change,
-	l_flush_complete,
-	l_arp_update,
-	l_narp_req,		/* LANE2 mandates the use of this */
-	l_config,
-	l_flush_tran_id,
-	l_set_lecid,
-	l_arp_xmt,
-	l_rdesc_arp_xmt,
-	l_associate_req,
-	l_should_bridge		/* should we bridge this MAC? */
-} atmlec_msg_type;
-
-#define ATMLEC_MSG_TYPE_MAX l_should_bridge
-
-struct atmlec_config_msg {
-	unsigned int maximum_unknown_frame_count;
-	unsigned int max_unknown_frame_time;
-	unsigned short max_retry_count;
-	unsigned int aging_time;
-	unsigned int forward_delay_time;
-	unsigned int arp_response_time;
-	unsigned int flush_timeout;
-	unsigned int path_switching_delay;
-	unsigned int lane_version;	/* LANE2: 1 for LANEv1, 2 for LANEv2 */
-	int mtu;
-	int is_proxy;
-};
-
-struct atmlec_msg {
-	atmlec_msg_type type;
-	int sizeoftlvs;		/* LANE2: if != 0, tlvs follow */
-	union {
-		struct {
-			unsigned char mac_addr[ETH_ALEN];
-			unsigned char atm_addr[ATM_ESA_LEN];
-			unsigned int flag;	/*
-						 * Topology_change flag,
-						 * remoteflag, permanent flag,
-						 * lecid, transaction id
-						 */
-			unsigned int targetless_le_arp;	/* LANE2 */
-			unsigned int no_source_le_narp;	/* LANE2 */
-		} normal;
-		struct atmlec_config_msg config;
-		struct {
-			__u16 lec_id;				/* requestor lec_id  */
-			__u32 tran_id;				/* transaction id    */
-			unsigned char mac_addr[ETH_ALEN];	/* dst mac addr      */
-			unsigned char atm_addr[ATM_ESA_LEN];	/* reqestor ATM addr */
-		} proxy;	/*
-				 * For mapping LE_ARP requests to responses. Filled by
-				 * zeppelin, returned by kernel. Used only when proxying
-				 */
-	} content;
-} __ATM_API_ALIGN;
-
-struct atmlec_ioc {
-	int dev_num;
-	unsigned char atm_addr[ATM_ESA_LEN];
-	unsigned char receive;	/* 1= receive vcc, 0 = send vcc */
-};
-#endif /* _ATMLEC_H_ */
diff --git a/include/uapi/linux/atmmpc.h b/include/uapi/linux/atmmpc.h
deleted file mode 100644
index cc17f4304839..000000000000
--- a/include/uapi/linux/atmmpc.h
+++ /dev/null
@@ -1,127 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-#ifndef _ATMMPC_H_
-#define _ATMMPC_H_
-
-#include <linux/atmapi.h>
-#include <linux/atmioc.h>
-#include <linux/atm.h>
-#include <linux/types.h>
-
-#define ATMMPC_CTRL _IO('a', ATMIOC_MPOA)
-#define ATMMPC_DATA _IO('a', ATMIOC_MPOA+1)
-
-#define MPC_SOCKET_INGRESS 1
-#define MPC_SOCKET_EGRESS  2
-
-struct atmmpc_ioc {
-        int dev_num;
-        __be32 ipaddr;              /* the IP address of the shortcut    */
-        int type;                     /* ingress or egress                 */
-};
-
-typedef struct in_ctrl_info {
-        __u8   Last_NHRP_CIE_code;
-        __u8   Last_Q2931_cause_value;
-        __u8   eg_MPC_ATM_addr[ATM_ESA_LEN];
-        __be32  tag;
-        __be32  in_dst_ip;      /* IP address this ingress MPC sends packets to */
-        __u16  holding_time;
-        __u32  request_id;
-} in_ctrl_info;
-
-typedef struct eg_ctrl_info {
-        __u8   DLL_header[256];
-        __u8   DH_length;
-        __be32  cache_id;
-        __be32  tag;
-        __be32  mps_ip;
-        __be32  eg_dst_ip;      /* IP address to which ingress MPC sends packets */
-        __u8   in_MPC_data_ATM_addr[ATM_ESA_LEN];
-        __u16  holding_time;
-} eg_ctrl_info;
-
-struct mpc_parameters {
-        __u16 mpc_p1;   /* Shortcut-Setup Frame Count    */
-        __u16 mpc_p2;   /* Shortcut-Setup Frame Time     */
-        __u8 mpc_p3[8]; /* Flow-detection Protocols      */
-        __u16 mpc_p4;   /* MPC Initial Retry Time        */
-        __u16 mpc_p5;   /* MPC Retry Time Maximum        */
-        __u16 mpc_p6;   /* Hold Down Time                */
-} ;
-
-struct k_message {
-        __u16 type;
-        __be32 ip_mask;
-        __u8  MPS_ctrl[ATM_ESA_LEN];
-        union {
-                in_ctrl_info in_info;
-                eg_ctrl_info eg_info;
-                struct mpc_parameters params;
-        } content;
-        struct atm_qos qos;       
-} __ATM_API_ALIGN;
-
-struct llc_snap_hdr {
-	/* RFC 1483 LLC/SNAP encapsulation for routed IP PDUs */
-        __u8  dsap;    /* Destination Service Access Point (0xAA)     */
-        __u8  ssap;    /* Source Service Access Point      (0xAA)     */
-        __u8  ui;      /* Unnumbered Information           (0x03)     */
-        __u8  org[3];  /* Organizational identification    (0x000000) */
-        __u8  type[2]; /* Ether type (for IP)              (0x0800)   */
-};
-
-/* TLVs this MPC recognizes */
-#define TLV_MPOA_DEVICE_TYPE         0x00a03e2a  
-
-/* MPOA device types in MPOA Device Type TLV */
-#define NON_MPOA    0
-#define MPS         1
-#define MPC         2
-#define MPS_AND_MPC 3
-
-
-/* MPC parameter defaults */
-
-#define MPC_P1 10  /* Shortcut-Setup Frame Count  */ 
-#define MPC_P2 1   /* Shortcut-Setup Frame Time   */
-#define MPC_P3 0   /* Flow-detection Protocols    */
-#define MPC_P4 5   /* MPC Initial Retry Time      */
-#define MPC_P5 40  /* MPC Retry Time Maximum      */
-#define MPC_P6 160 /* Hold Down Time              */
-#define HOLDING_TIME_DEFAULT 1200 /* same as MPS-p7 */
-
-/* MPC constants */
-
-#define MPC_C1 2   /* Retry Time Multiplier       */
-#define MPC_C2 60  /* Initial Keep-Alive Lifetime */
-
-/* Message types - to MPOA daemon */
-
-#define SND_MPOA_RES_RQST    201
-#define SET_MPS_CTRL_ADDR    202
-#define SND_MPOA_RES_RTRY    203 /* Different type in a retry due to req id         */
-#define STOP_KEEP_ALIVE_SM   204
-#define EGRESS_ENTRY_REMOVED 205
-#define SND_EGRESS_PURGE     206
-#define DIE                  207 /* tell the daemon to exit()                       */
-#define DATA_PLANE_PURGE     208 /* Data plane purge because of egress cache hit miss or dead MPS */
-#define OPEN_INGRESS_SVC     209
-
-/* Message types - from MPOA daemon */
-
-#define MPOA_TRIGGER_RCVD     101
-#define MPOA_RES_REPLY_RCVD   102
-#define INGRESS_PURGE_RCVD    103
-#define EGRESS_PURGE_RCVD     104
-#define MPS_DEATH             105
-#define CACHE_IMPOS_RCVD      106
-#define SET_MPC_CTRL_ADDR     107 /* Our MPC's control ATM address   */
-#define SET_MPS_MAC_ADDR      108
-#define CLEAN_UP_AND_EXIT     109
-#define SET_MPC_PARAMS        110 /* MPC configuration parameters    */
-
-/* Message types - bidirectional */       
-
-#define RELOAD                301 /* kill -HUP the daemon for reload */
-
-#endif /* _ATMMPC_H_ */
diff --git a/include/uapi/linux/atmsvc.h b/include/uapi/linux/atmsvc.h
deleted file mode 100644
index 137b5f853449..000000000000
--- a/include/uapi/linux/atmsvc.h
+++ /dev/null
@@ -1,56 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/* atmsvc.h - ATM signaling kernel-demon interface definitions */
- 
-/* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
- 
-
-#ifndef _LINUX_ATMSVC_H
-#define _LINUX_ATMSVC_H
-
-#include <linux/atmapi.h>
-#include <linux/atm.h>
-#include <linux/atmioc.h>
-
-
-#define ATMSIGD_CTRL _IO('a',ATMIOC_SPECIAL)
-				/* become ATM signaling demon control socket */
-
-enum atmsvc_msg_type { as_catch_null, as_bind, as_connect, as_accept, as_reject,
-		       as_listen, as_okay, as_error, as_indicate, as_close,
-		       as_itf_notify, as_modify, as_identify, as_terminate,
-		       as_addparty, as_dropparty };
-
-struct atmsvc_msg {
-	enum atmsvc_msg_type type;
-	atm_kptr_t vcc;
-	atm_kptr_t listen_vcc;		/* indicate */
-	int reply;			/* for okay and close:		   */
-					/*   < 0: error before active	   */
-					/*        (sigd has discarded ctx) */
-					/*   ==0: success		   */
-				        /*   > 0: error when active (still */
-					/*        need to close)	   */
-	struct sockaddr_atmpvc pvc;	/* indicate, okay (connect) */
-	struct sockaddr_atmsvc local;	/* local SVC address */
-	struct atm_qos qos;		/* QOS parameters */
-	struct atm_sap sap;		/* SAP */
-	unsigned int session;		/* for p2pm */
-	struct sockaddr_atmsvc svc;	/* SVC address */
-} __ATM_API_ALIGN;
-
-/*
- * Message contents: see ftp://icaftp.epfl.ch/pub/linux/atm/docs/isp-*.tar.gz
- */
-
-/*
- * Some policy stuff for atmsigd and for net/atm/svc.c. Both have to agree on
- * what PCR is used to request bandwidth from the device driver. net/atm/svc.c
- * tries to do better than that, but only if there's no routing decision (i.e.
- * if signaling only uses one ATM interface).
- */
-
-#define SELECT_TOP_PCR(tp) ((tp).pcr ? (tp).pcr : \
-  (tp).max_pcr && (tp).max_pcr != ATM_MAX_PCR ? (tp).max_pcr : \
-  (tp).min_pcr ? (tp).min_pcr : ATM_MAX_PCR)
-
-#endif
diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c
index 11f6d236f5d6..194587fc15e8 100644
--- a/net/atm/ioctl.c
+++ b/net/atm/ioctl.c
@@ -11,7 +11,6 @@
 #include <linux/net.h>		/* struct socket, struct proto_ops */
 #include <linux/atm.h>		/* ATM stuff */
 #include <linux/atmdev.h>
-#include <linux/atmarp.h>	/* manifest constants */
 #include <linux/capability.h>
 #include <linux/mutex.h>
 #include <asm/ioctls.h>
-- 
2.54.0


^ permalink raw reply related

* [PATCH net-next v2 8/9] atm: remove unused ATM PHY operations
From: Jakub Kicinski @ 2026-06-15 19:44 UTC (permalink / raw)
  To: davem
  Cc: netdev, edumazet, pabeni, andrew+netdev, horms, 3chas3, mitch,
	linux-atm-general, dwmw2, Jakub Kicinski
In-Reply-To: <20260615194416.752559-1-kuba@kernel.org>

The PHY operations are vestiges of the SAR/framer split used by the
removed PCI/SBUS ATM adapters:

 - atmdev_ops::phy_put / ::phy_get (register accessors) are never called
   by the core and solos-pci only listed them as NULL
 - struct atmphy_ops and atm_dev::phy have no users at all - nothing
   assigns or dereferences them

Remove all of them. atm_dev::phy_data is kept: solos-pci repurposes it
to stash its per-port channel index.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 include/linux/atmdev.h  | 12 ------------
 drivers/atm/solos-pci.c |  2 --
 2 files changed, 14 deletions(-)

diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
index 96ce36e02247..fe21d2f547b5 100644
--- a/include/linux/atmdev.h
+++ b/include/linux/atmdev.h
@@ -107,8 +107,6 @@ static inline struct sock *sk_atm(struct atm_vcc *vcc)
 
 struct atm_dev {
 	const struct atmdev_ops *ops;	/* device operations; NULL if unused */
-	const struct atmphy_ops *phy;	/* PHY operations, may be undefined */
-					/* (NULL) */
 	const char	*type;		/* device type name */
 	int		number;		/* device index */
 	void		*dev_data;	/* per-device data */
@@ -138,20 +136,10 @@ struct atmdev_ops { /* only send is required */
 			    void __user *arg);
 #endif
 	int (*send)(struct atm_vcc *vcc,struct sk_buff *skb);
-	void (*phy_put)(struct atm_dev *dev,unsigned char value,
-	    unsigned long addr);
-	unsigned char (*phy_get)(struct atm_dev *dev,unsigned long addr);
 	int (*proc_read)(struct atm_dev *dev,loff_t *pos,char *page);
 	struct module *owner;
 };
 
-struct atmphy_ops {
-	int (*start)(struct atm_dev *dev);
-	int (*ioctl)(struct atm_dev *dev,unsigned int cmd,void __user *arg);
-	void (*interrupt)(struct atm_dev *dev);
-	int (*stop)(struct atm_dev *dev);
-};
-
 struct atm_skb_data {
 	struct atm_vcc	*vcc;		/* ATM VCC */
 	unsigned long	atm_options;	/* ATM layer options */
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 9c246b956c30..fc0e91a1029e 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -1180,8 +1180,6 @@ static const struct atmdev_ops fpga_ops = {
 	.close =	pclose,
 	.ioctl =	NULL,
 	.send =		psend,
-	.phy_put =	NULL,
-	.phy_get =	NULL,
 	.proc_read =	NULL,
 	.owner =	THIS_MODULE
 };
-- 
2.54.0


^ permalink raw reply related

* [PATCH net-next v2 7/9] atm: remove the unused pre_send and send_bh device operations
From: Jakub Kicinski @ 2026-06-15 19:44 UTC (permalink / raw)
  To: davem
  Cc: netdev, edumazet, pabeni, andrew+netdev, horms, 3chas3, mitch,
	linux-atm-general, dwmw2, Jakub Kicinski
In-Reply-To: <20260615194416.752559-1-kuba@kernel.org>

atmdev_ops::pre_send (a TX pre-processing hook) and ::send_bh (a
bottom-half capable send variant) have no implementation behind them:
no remaining ATM driver sets either, so vcc_sendmsg() always skipped
pre_send and the raw AAL0/AAL5 paths always fell back to ->send().
The drivers that used these hooks were removed with the legacy ATM
adapters.

Drop both operations and the dead branches that tested for them.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 include/linux/atmdev.h | 2 --
 net/atm/common.c       | 6 ------
 net/atm/raw.c          | 7 +------
 3 files changed, 1 insertion(+), 14 deletions(-)

diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
index 218c05f2ec54..96ce36e02247 100644
--- a/include/linux/atmdev.h
+++ b/include/linux/atmdev.h
@@ -137,9 +137,7 @@ struct atmdev_ops { /* only send is required */
 	int (*compat_ioctl)(struct atm_dev *dev,unsigned int cmd,
 			    void __user *arg);
 #endif
-	int (*pre_send)(struct atm_vcc *vcc, struct sk_buff *skb);
 	int (*send)(struct atm_vcc *vcc,struct sk_buff *skb);
-	int (*send_bh)(struct atm_vcc *vcc, struct sk_buff *skb);
 	void (*phy_put)(struct atm_dev *dev,unsigned char value,
 	    unsigned long addr);
 	unsigned char (*phy_get)(struct atm_dev *dev,unsigned long addr);
diff --git a/net/atm/common.c b/net/atm/common.c
index 44a0179d4586..654cbe3c855e 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -626,12 +626,6 @@ int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t size)
 	if (eff != size)
 		memset(skb->data + size, 0, eff-size);
 
-	if (vcc->dev->ops->pre_send) {
-		error = vcc->dev->ops->pre_send(vcc, skb);
-		if (error)
-			goto free_skb;
-	}
-
 	error = vcc->dev->ops->send(vcc, skb);
 	error = error ? error : size;
 out:
diff --git a/net/atm/raw.c b/net/atm/raw.c
index 1d6ac7b0c4e5..87d136c7554b 100644
--- a/net/atm/raw.c
+++ b/net/atm/raw.c
@@ -54,8 +54,6 @@ static int atm_send_aal0(struct atm_vcc *vcc, struct sk_buff *skb)
 		kfree_skb(skb);
 		return -EADDRNOTAVAIL;
 	}
-	if (vcc->dev->ops->send_bh)
-		return vcc->dev->ops->send_bh(vcc, skb);
 	return vcc->dev->ops->send(vcc, skb);
 }
 
@@ -71,10 +69,7 @@ int atm_init_aal5(struct atm_vcc *vcc)
 {
 	vcc->push = atm_push_raw;
 	vcc->pop = atm_pop_raw;
-	if (vcc->dev->ops->send_bh)
-		vcc->send = vcc->dev->ops->send_bh;
-	else
-		vcc->send = vcc->dev->ops->send;
+	vcc->send = vcc->dev->ops->send;
 	return 0;
 }
 EXPORT_SYMBOL(atm_init_aal5);
-- 
2.54.0


^ permalink raw reply related

* [PATCH net-next v2 6/9] atm: remove the unused change_qos device operation
From: Jakub Kicinski @ 2026-06-15 19:44 UTC (permalink / raw)
  To: davem
  Cc: netdev, edumazet, pabeni, andrew+netdev, horms, 3chas3, mitch,
	linux-atm-general, dwmw2, Jakub Kicinski
In-Reply-To: <20260615194416.752559-1-kuba@kernel.org>

atmdev_ops::change_qos() was the hook for renegotiating the traffic
parameters of an already-connected VCC, driven from SO_ATMQOS on a
connected socket (and previously from the SVC as_modify path, now gone).
None of the ATM drivers left in tree implement it - solos-pci only listed
change_qos = NULL - so atm_change_qos() always returned -EOPNOTSUPP.

Drop the operation and return -EOPNOTSUPP directly.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 include/linux/atmdev.h  |  1 -
 drivers/atm/solos-pci.c |  1 -
 net/atm/common.c        | 25 ++-----------------------
 3 files changed, 2 insertions(+), 25 deletions(-)

diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
index 59477676063c..218c05f2ec54 100644
--- a/include/linux/atmdev.h
+++ b/include/linux/atmdev.h
@@ -143,7 +143,6 @@ struct atmdev_ops { /* only send is required */
 	void (*phy_put)(struct atm_dev *dev,unsigned char value,
 	    unsigned long addr);
 	unsigned char (*phy_get)(struct atm_dev *dev,unsigned long addr);
-	int (*change_qos)(struct atm_vcc *vcc,struct atm_qos *qos,int flags);
 	int (*proc_read)(struct atm_dev *dev,loff_t *pos,char *page);
 	struct module *owner;
 };
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 4ad170a858ee..9c246b956c30 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -1182,7 +1182,6 @@ static const struct atmdev_ops fpga_ops = {
 	.send =		psend,
 	.phy_put =	NULL,
 	.phy_get =	NULL,
-	.change_qos =	NULL,
 	.proc_read =	NULL,
 	.owner =	THIS_MODULE
 };
diff --git a/net/atm/common.c b/net/atm/common.c
index 650814d0a56c..44a0179d4586 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -673,28 +673,6 @@ __poll_t vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
 	return mask;
 }
 
-static int atm_change_qos(struct atm_vcc *vcc, struct atm_qos *qos)
-{
-	int error;
-
-	/*
-	 * Don't let the QoS change the already connected AAL type nor the
-	 * traffic class.
-	 */
-	if (qos->aal != vcc->qos.aal ||
-	    qos->rxtp.traffic_class != vcc->qos.rxtp.traffic_class ||
-	    qos->txtp.traffic_class != vcc->qos.txtp.traffic_class)
-		return -EINVAL;
-	error = adjust_tp(&qos->txtp, qos->aal);
-	if (!error)
-		error = adjust_tp(&qos->rxtp, qos->aal);
-	if (error)
-		return error;
-	if (!vcc->dev->ops->change_qos)
-		return -EOPNOTSUPP;
-	return vcc->dev->ops->change_qos(vcc, qos, ATM_MF_SET);
-}
-
 static int check_tp(const struct atm_trafprm *tp)
 {
 	/* @@@ Should be merged with adjust_tp */
@@ -753,8 +731,9 @@ int vcc_setsockopt(struct socket *sock, int level, int optname,
 		error = check_qos(&qos);
 		if (error)
 			return error;
+		/* QoS cannot be renegotiated on an already connected VCC. */
 		if (sock->state == SS_CONNECTED)
-			return atm_change_qos(vcc, &qos);
+			return -EOPNOTSUPP;
 		if (sock->state != SS_UNCONNECTED)
 			return -EBADFD;
 		vcc->qos = qos;
-- 
2.54.0


^ permalink raw reply related

* [PATCH net-next v2 5/9] atm: remove SVC socket support and the signaling daemon interface
From: Jakub Kicinski @ 2026-06-15 19:44 UTC (permalink / raw)
  To: davem
  Cc: netdev, edumazet, pabeni, andrew+netdev, horms, 3chas3, mitch,
	linux-atm-general, dwmw2, Jakub Kicinski
In-Reply-To: <20260615194416.752559-1-kuba@kernel.org>

ATM switched virtual circuits (SVCs) are set up and torn down by a
user-space signaling daemon (atmsigd) which the kernel talks to over
a dedicated "sigd" socket: the kernel marshals Q.2931-style requests
(as_connect, as_listen, as_accept, as_close, ...) to the daemon and
applies the results to PF_ATMSVC sockets. This is the machinery behind
classical SVC use and was the foundation for LANE / MPOA, all of which
have been removed.

DSL deployments do not use any of this. PPPoATM and BR2684 run over
permanent virtual circuits (PF_ATMPVC) with a statically configured
VPI/VCI; no atmsigd, no Q.2931. Neither remaining ATM driver
(solos-pci, the USB DSL modems) is reachable through the SVC path.

Remove the SVC socket family and the signaling interface:

 - delete net/atm/svc.c, net/atm/signaling.c and signaling.h
 - drop atmsvc_init()/atmsvc_exit() and the PF_ATMSVC registration and
   module alias
 - drop the ATMSIGD_CTRL ioctl (sigd_attach) and the /proc/net/atm/svc
   file
 - fold the SVC branch out of atm_change_qos(); all sockets are PVCs now

The obsolete ATM_SETSC ioctl stub is left in place (it already just
warns and returns 0), as is the struct atm_vcc SVC bookkeeping shared
with the queueing layer.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 net/atm/Makefile       |   2 +-
 include/linux/atmdev.h |  38 +--
 net/atm/common.h       |   5 -
 net/atm/signaling.h    |  31 --
 net/atm/br2684.c       |   3 +-
 net/atm/common.c       |  35 +--
 net/atm/ioctl.c        |  32 --
 net/atm/pppoatm.c      |   3 +-
 net/atm/proc.c         |  56 ----
 net/atm/resources.c    |   1 -
 net/atm/signaling.c    | 297 ------------------
 net/atm/svc.c          | 694 -----------------------------------------
 12 files changed, 12 insertions(+), 1185 deletions(-)
 delete mode 100644 net/atm/signaling.h
 delete mode 100644 net/atm/signaling.c
 delete mode 100644 net/atm/svc.c

diff --git a/net/atm/Makefile b/net/atm/Makefile
index 5ed48d50df35..0a14ea7d4683 100644
--- a/net/atm/Makefile
+++ b/net/atm/Makefile
@@ -3,7 +3,7 @@
 # Makefile for the ATM Protocol Families.
 #
 
-atm-y		:= pvc.o signaling.o svc.o ioctl.o common.o atm_misc.o raw.o resources.o atm_sysfs.o
+atm-y		:= pvc.o ioctl.o common.o atm_misc.o raw.o resources.o atm_sysfs.o
 
 obj-$(CONFIG_ATM) += atm.o
 obj-$(CONFIG_ATM_BR2684) += br2684.o
diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
index 7abbd23fada6..59477676063c 100644
--- a/include/linux/atmdev.h
+++ b/include/linux/atmdev.h
@@ -51,33 +51,11 @@ enum {
 				   driver, cleared by anybody. */
 	ATM_VF_PARTIAL,		/* resources are bound to PVC (partial PVC
 				   setup), controlled by socket layer */
-	ATM_VF_REGIS,		/* registered with demon, controlled by SVC
-				   socket layer */
-	ATM_VF_BOUND,		/* local SAP is set, controlled by SVC socket
-				   layer */
-	ATM_VF_RELEASED,	/* demon has indicated/requested release,
-				   controlled by SVC socket layer */
 	ATM_VF_HASQOS,		/* QOS parameters have been set */
-	ATM_VF_LISTEN,		/* socket is used for listening */
-	ATM_VF_META,		/* SVC socket isn't used for normal data
-				   traffic and doesn't depend on signaling
-				   to be available */
-	ATM_VF_SESSION,		/* VCC is p2mp session control descriptor */
-	ATM_VF_HASSAP,		/* SAP has been set */
-	ATM_VF_CLOSE,		/* asynchronous close - treat like VF_RELEASED*/
-	ATM_VF_WAITING,		/* waiting for reply from sigd */
-	ATM_VF_IS_CLIP,		/* in use by CLIP protocol */
+	ATM_VF_CLOSE,		/* asynchronous close - VC is being torn down */
 };
 
 
-#define ATM_VF2VS(flags) \
-    (test_bit(ATM_VF_READY,&(flags)) ? ATM_VS_CONNECTED : \
-     test_bit(ATM_VF_RELEASED,&(flags)) ? ATM_VS_CLOSING : \
-     test_bit(ATM_VF_LISTEN,&(flags)) ? ATM_VS_LISTEN : \
-     test_bit(ATM_VF_REGIS,&(flags)) ? ATM_VS_INUSE : \
-     test_bit(ATM_VF_BOUND,&(flags)) ? ATM_VS_BOUND : ATM_VS_IDLE)
-
-
 enum {
 	ATM_DF_REMOVED,		/* device was removed from atm_devs list */
 };
@@ -100,7 +78,6 @@ struct atm_vcc {
 	unsigned long	atm_options;	/* ATM layer options */
 	struct atm_dev	*dev;		/* device back pointer */
 	struct atm_qos	qos;		/* QOS */
-	struct atm_sap	sap;		/* SAP */
 	void (*release_cb)(struct atm_vcc *vcc); /* release_sock callback */
 	void (*push)(struct atm_vcc *vcc,struct sk_buff *skb);
 	void (*pop)(struct atm_vcc *vcc,struct sk_buff *skb); /* optional */
@@ -109,16 +86,8 @@ struct atm_vcc {
 	void		*proto_data;	/* per-protocol data */
 	struct k_atm_aal_stats *stats;	/* pointer to AAL stats group */
 	struct module *owner;		/* owner of ->push function */
-	/* SVC part --- may move later ------------------------------------- */
-	short		itf;		/* interface number */
-	struct sockaddr_atmsvc local;
-	struct sockaddr_atmsvc remote;
-	/* Multipoint part ------------------------------------------------- */
-	struct atm_vcc	*session;	/* session VCC descriptor */
-	/* Other stuff ----------------------------------------------------- */
-	void		*user_back;	/* user backlink - not touched by */
-					/* native ATM stack. Currently used */
-					/* by CLIP and sch_atm. */
+	void		*user_back;	/* user backlink - not touched by the */
+					/* native ATM stack, used by sch_atm */
 };
 
 static inline struct atm_vcc *atm_sk(struct sock *sk)
@@ -151,7 +120,6 @@ struct atm_dev {
 	char		signal;		/* signal status (ATM_PHY_SIG_*) */
 	int		link_rate;	/* link rate (default: OC3) */
 	refcount_t	refcnt;		/* reference count */
-	spinlock_t	lock;		/* protect internal members */
 #ifdef CONFIG_PROC_FS
 	struct proc_dir_entry *proc_entry; /* proc entry */
 	char *proc_name;		/* proc entry name */
diff --git a/net/atm/common.h b/net/atm/common.h
index ae4502abf028..11cb51dd7dbb 100644
--- a/net/atm/common.h
+++ b/net/atm/common.h
@@ -28,8 +28,6 @@ void vcc_process_recv_queue(struct atm_vcc *vcc);
 
 int atmpvc_init(void);
 void atmpvc_exit(void);
-int atmsvc_init(void);
-void atmsvc_exit(void);
 int atm_sysfs_init(void);
 void atm_sysfs_exit(void);
 
@@ -48,9 +46,6 @@ static inline void atm_proc_exit(void)
 }
 #endif /* CONFIG_PROC_FS */
 
-/* SVC */
-int svc_change_qos(struct atm_vcc *vcc,struct atm_qos *qos);
-
 void atm_dev_release_vccs(struct atm_dev *dev);
 
 #endif
diff --git a/net/atm/signaling.h b/net/atm/signaling.h
deleted file mode 100644
index 2df8220f7ab5..000000000000
--- a/net/atm/signaling.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/* net/atm/signaling.h - ATM signaling */
-
-/* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
-
-
-#ifndef NET_ATM_SIGNALING_H
-#define NET_ATM_SIGNALING_H
-
-#include <linux/atm.h>
-#include <linux/atmdev.h>
-#include <linux/atmsvc.h>
-
-
-extern struct atm_vcc *sigd; /* needed in svc_release */
-
-
-/*
- * sigd_enq is a wrapper for sigd_enq2, covering the more common cases, and
- * avoiding huge lists of null values.
- */
-
-void sigd_enq2(struct atm_vcc *vcc,enum atmsvc_msg_type type,
-    struct atm_vcc *listen_vcc,const struct sockaddr_atmpvc *pvc,
-    const struct sockaddr_atmsvc *svc,const struct atm_qos *qos,int reply);
-void sigd_enq(struct atm_vcc *vcc,enum atmsvc_msg_type type,
-    struct atm_vcc *listen_vcc,const struct sockaddr_atmpvc *pvc,
-    const struct sockaddr_atmsvc *svc);
-int sigd_attach(struct atm_vcc *vcc);
-
-#endif
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 6580d67c3456..05712c28386a 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -311,8 +311,7 @@ static netdev_tx_t br2684_start_xmit(struct sk_buff *skb,
 
 	bh_lock_sock(sk_atm(atmvcc));
 
-	if (test_bit(ATM_VF_RELEASED, &atmvcc->flags) ||
-	    test_bit(ATM_VF_CLOSE, &atmvcc->flags) ||
+	if (test_bit(ATM_VF_CLOSE, &atmvcc->flags) ||
 	    !test_bit(ATM_VF_READY, &atmvcc->flags)) {
 		dev->stats.tx_dropped++;
 		dev_kfree_skb(skb);
diff --git a/net/atm/common.c b/net/atm/common.c
index 7d5b7c39b80b..650814d0a56c 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -30,7 +30,6 @@
 #include "resources.h"		/* atm_find_dev */
 #include "common.h"		/* prototypes */
 #include "protocols.h"		/* atm_init_<transport> */
-#include "signaling.h"		/* for WAITING and sigd_attach */
 
 struct hlist_head vcc_hash[VCC_HTABLE_SIZE];
 EXPORT_SYMBOL(vcc_hash);
@@ -154,8 +153,6 @@ int vcc_create(struct net *net, struct socket *sock, int protocol, int family, i
 
 	vcc = atm_sk(sk);
 	vcc->dev = NULL;
-	memset(&vcc->local, 0, sizeof(struct sockaddr_atmsvc));
-	memset(&vcc->remote, 0, sizeof(struct sockaddr_atmsvc));
 	vcc->qos.txtp.max_sdu = 1 << 16; /* for meta VCs */
 	refcount_set(&sk->sk_wmem_alloc, SK_WMEM_ALLOC_BIAS);
 	atomic_set(&sk->sk_rmem_alloc, 0);
@@ -216,7 +213,6 @@ void vcc_release_async(struct atm_vcc *vcc, int reply)
 	set_bit(ATM_VF_CLOSE, &vcc->flags);
 	sk->sk_shutdown |= RCV_SHUTDOWN;
 	sk->sk_err = -reply;
-	clear_bit(ATM_VF_WAITING, &vcc->flags);
 	sk->sk_state_change(sk);
 }
 EXPORT_SYMBOL(vcc_release_async);
@@ -527,8 +523,7 @@ int vcc_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
 		return -EOPNOTSUPP;
 
 	vcc = ATM_SD(sock);
-	if (test_bit(ATM_VF_RELEASED, &vcc->flags) ||
-	    test_bit(ATM_VF_CLOSE, &vcc->flags) ||
+	if (test_bit(ATM_VF_CLOSE, &vcc->flags) ||
 	    !test_bit(ATM_VF_READY, &vcc->flags))
 		return 0;
 
@@ -575,8 +570,7 @@ int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t size)
 		goto out;
 	}
 	vcc = ATM_SD(sock);
-	if (test_bit(ATM_VF_RELEASED, &vcc->flags) ||
-	    test_bit(ATM_VF_CLOSE, &vcc->flags) ||
+	if (test_bit(ATM_VF_CLOSE, &vcc->flags) ||
 	    !test_bit(ATM_VF_READY, &vcc->flags)) {
 		error = -EPIPE;
 		send_sig(SIGPIPE, current, 0);
@@ -604,8 +598,7 @@ int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t size)
 			error = -ERESTARTSYS;
 			break;
 		}
-		if (test_bit(ATM_VF_RELEASED, &vcc->flags) ||
-		    test_bit(ATM_VF_CLOSE, &vcc->flags) ||
+		if (test_bit(ATM_VF_CLOSE, &vcc->flags) ||
 		    !test_bit(ATM_VF_READY, &vcc->flags)) {
 			error = -EPIPE;
 			send_sig(SIGPIPE, current, 0);
@@ -665,8 +658,7 @@ __poll_t vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
 	if (sk->sk_err)
 		mask = EPOLLERR;
 
-	if (test_bit(ATM_VF_RELEASED, &vcc->flags) ||
-	    test_bit(ATM_VF_CLOSE, &vcc->flags))
+	if (test_bit(ATM_VF_CLOSE, &vcc->flags))
 		mask |= EPOLLHUP;
 
 	/* readable? */
@@ -674,10 +666,6 @@ __poll_t vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
 		mask |= EPOLLIN | EPOLLRDNORM;
 
 	/* writable? */
-	if (sock->state == SS_CONNECTING &&
-	    test_bit(ATM_VF_WAITING, &vcc->flags))
-		return mask;
-
 	if (vcc->qos.txtp.traffic_class != ATM_NONE &&
 	    vcc_writable(sk))
 		mask |= EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND;
@@ -704,9 +692,7 @@ static int atm_change_qos(struct atm_vcc *vcc, struct atm_qos *qos)
 		return error;
 	if (!vcc->dev->ops->change_qos)
 		return -EOPNOTSUPP;
-	if (sk_atm(vcc)->sk_family == AF_ATMPVC)
-		return vcc->dev->ops->change_qos(vcc, qos, ATM_MF_SET);
-	return svc_change_qos(vcc, qos);
+	return vcc->dev->ops->change_qos(vcc, qos, ATM_MF_SET);
 }
 
 static int check_tp(const struct atm_trafprm *tp)
@@ -854,15 +840,10 @@ static int __init atm_init(void)
 		pr_err("atmpvc_init() failed with %d\n", error);
 		goto out_unregister_vcc_proto;
 	}
-	error = atmsvc_init();
-	if (error < 0) {
-		pr_err("atmsvc_init() failed with %d\n", error);
-		goto out_atmpvc_exit;
-	}
 	error = atm_proc_init();
 	if (error < 0) {
 		pr_err("atm_proc_init() failed with %d\n", error);
-		goto out_atmsvc_exit;
+		goto out_atmpvc_exit;
 	}
 	error = atm_sysfs_init();
 	if (error < 0) {
@@ -873,8 +854,6 @@ static int __init atm_init(void)
 	return error;
 out_atmproc_exit:
 	atm_proc_exit();
-out_atmsvc_exit:
-	atmsvc_exit();
 out_atmpvc_exit:
 	atmpvc_exit();
 out_unregister_vcc_proto:
@@ -886,7 +865,6 @@ static void __exit atm_exit(void)
 {
 	atm_proc_exit();
 	atm_sysfs_exit();
-	atmsvc_exit();
 	atmpvc_exit();
 	proto_unregister(&vcc_proto);
 }
@@ -898,4 +876,3 @@ module_exit(atm_exit);
 MODULE_DESCRIPTION("Asynchronous Transfer Mode (ATM) networking core");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_NETPROTO(PF_ATMPVC);
-MODULE_ALIAS_NETPROTO(PF_ATMSVC);
diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c
index 97f20cd051ed..11f6d236f5d6 100644
--- a/net/atm/ioctl.c
+++ b/net/atm/ioctl.c
@@ -13,13 +13,11 @@
 #include <linux/atmdev.h>
 #include <linux/atmarp.h>	/* manifest constants */
 #include <linux/capability.h>
-#include <linux/atmsvc.h>
 #include <linux/mutex.h>
 #include <asm/ioctls.h>
 #include <net/compat.h>
 
 #include "resources.h"
-#include "signaling.h"		/* for WAITING and sigd_attach */
 #include "common.h"
 
 
@@ -86,36 +84,6 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd,
 				     current->comm, task_pid_nr(current));
 		error = 0;
 		goto done;
-	case ATMSIGD_CTRL:
-		if (!capable(CAP_NET_ADMIN)) {
-			error = -EPERM;
-			goto done;
-		}
-		/*
-		 * The user/kernel protocol for exchanging signalling
-		 * info uses kernel pointers as opaque references,
-		 * so the holder of the file descriptor can scribble
-		 * on the kernel... so we should make sure that we
-		 * have the same privileges that /proc/kcore needs
-		 */
-		if (!capable(CAP_SYS_RAWIO)) {
-			error = -EPERM;
-			goto done;
-		}
-#ifdef CONFIG_COMPAT
-		/* WTF? I don't even want to _think_ about making this
-		   work for 32-bit userspace. TBH I don't really want
-		   to think about it at all. dwmw2. */
-		if (compat) {
-			net_warn_ratelimited("32-bit task cannot be atmsigd\n");
-			error = -EINVAL;
-			goto done;
-		}
-#endif
-		error = sigd_attach(vcc);
-		if (!error)
-			sock->state = SS_CONNECTED;
-		goto done;
 	case ATM_SETBACKEND:
 	case ATM_NEWBACKENDIF:
 	{
diff --git a/net/atm/pppoatm.c b/net/atm/pppoatm.c
index e3c422dc533a..6da52d12df68 100644
--- a/net/atm/pppoatm.c
+++ b/net/atm/pppoatm.c
@@ -308,8 +308,7 @@ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
 		test_and_set_bit(BLOCKED, &pvcc->blocked);
 		goto nospace;
 	}
-	if (test_bit(ATM_VF_RELEASED, &vcc->flags) ||
-	    test_bit(ATM_VF_CLOSE, &vcc->flags) ||
+	if (test_bit(ATM_VF_CLOSE, &vcc->flags) ||
 	    !test_bit(ATM_VF_READY, &vcc->flags)) {
 		bh_unlock_sock(sk_atm(vcc));
 		kfree_skb(skb);
diff --git a/net/atm/proc.c b/net/atm/proc.c
index b650da764a23..8f20b49b9c02 100644
--- a/net/atm/proc.c
+++ b/net/atm/proc.c
@@ -29,7 +29,6 @@
 #include <linux/atomic.h>
 #include "resources.h"
 #include "common.h" /* atm_proc_init prototype */
-#include "signaling.h" /* to get sigd - ugly too */
 
 static ssize_t proc_dev_atm_read(struct file *file, char __user *buf,
 				 size_t count, loff_t *pos);
@@ -156,13 +155,6 @@ static void pvc_info(struct seq_file *seq, struct atm_vcc *vcc)
 	seq_putc(seq, '\n');
 }
 
-static const char *vcc_state(struct atm_vcc *vcc)
-{
-	static const char *const map[] = { ATM_VS2TXT_MAP };
-
-	return map[ATM_VF2VS(vcc->flags)];
-}
-
 static void vcc_info(struct seq_file *seq, struct atm_vcc *vcc)
 {
 	struct sock *sk = sk_atm(vcc);
@@ -177,9 +169,6 @@ static void vcc_info(struct seq_file *seq, struct atm_vcc *vcc)
 	case AF_ATMPVC:
 		seq_printf(seq, "PVC");
 		break;
-	case AF_ATMSVC:
-		seq_printf(seq, "SVC");
-		break;
 	default:
 		seq_printf(seq, "%3d", sk->sk_family);
 	}
@@ -190,26 +179,6 @@ static void vcc_info(struct seq_file *seq, struct atm_vcc *vcc)
 		   refcount_read(&sk->sk_refcnt));
 }
 
-static void svc_info(struct seq_file *seq, struct atm_vcc *vcc)
-{
-	if (!vcc->dev)
-		seq_printf(seq, sizeof(void *) == 4 ?
-			   "N/A@%pK%10s" : "N/A@%pK%2s", vcc, "");
-	else
-		seq_printf(seq, "%3d %3d %5d         ",
-			   vcc->dev->number, vcc->vpi, vcc->vci);
-	seq_printf(seq, "%-10s ", vcc_state(vcc));
-	seq_printf(seq, "%s%s", vcc->remote.sas_addr.pub,
-	    *vcc->remote.sas_addr.pub && *vcc->remote.sas_addr.prv ? "+" : "");
-	if (*vcc->remote.sas_addr.prv) {
-		int i;
-
-		for (i = 0; i < ATM_ESA_LEN; i++)
-			seq_printf(seq, "%02x", vcc->remote.sas_addr.prv[i]);
-	}
-	seq_putc(seq, '\n');
-}
-
 static int atm_dev_seq_show(struct seq_file *seq, void *v)
 {
 	static char atm_dev_banner[] =
@@ -278,29 +247,6 @@ static const struct seq_operations vcc_seq_ops = {
 	.show	= vcc_seq_show,
 };
 
-static int svc_seq_show(struct seq_file *seq, void *v)
-{
-	static const char atm_svc_banner[] =
-		"Itf VPI VCI           State      Remote\n";
-
-	if (v == SEQ_START_TOKEN)
-		seq_puts(seq, atm_svc_banner);
-	else {
-		struct vcc_state *state = seq->private;
-		struct atm_vcc *vcc = atm_sk(state->sk);
-
-		svc_info(seq, vcc);
-	}
-	return 0;
-}
-
-static const struct seq_operations svc_seq_ops = {
-	.start	= vcc_seq_start,
-	.next	= vcc_seq_next,
-	.stop	= vcc_seq_stop,
-	.show	= svc_seq_show,
-};
-
 static ssize_t proc_dev_atm_read(struct file *file, char __user *buf,
 				 size_t count, loff_t *pos)
 {
@@ -376,8 +322,6 @@ int __init atm_proc_init(void)
 	proc_create_seq("devices", 0444, atm_proc_root, &atm_dev_seq_ops);
 	proc_create_seq_private("pvc", 0444, atm_proc_root, &pvc_seq_ops,
 			sizeof(struct vcc_state), (void *)(uintptr_t)PF_ATMPVC);
-	proc_create_seq_private("svc", 0444, atm_proc_root, &svc_seq_ops,
-			sizeof(struct vcc_state), (void *)(uintptr_t)PF_ATMSVC);
 	proc_create_seq_private("vc", 0444, atm_proc_root, &vcc_seq_ops,
 			sizeof(struct vcc_state), NULL);
 	return 0;
diff --git a/net/atm/resources.c b/net/atm/resources.c
index 12aef5542263..d94dc8221ea1 100644
--- a/net/atm/resources.c
+++ b/net/atm/resources.c
@@ -40,7 +40,6 @@ static struct atm_dev *__alloc_atm_dev(const char *type)
 	dev->type = type;
 	dev->signal = ATM_PHY_SIG_UNKNOWN;
 	dev->link_rate = ATM_OC3_PCR;
-	spin_lock_init(&dev->lock);
 
 	return dev;
 }
diff --git a/net/atm/signaling.c b/net/atm/signaling.c
deleted file mode 100644
index b991d937205a..000000000000
--- a/net/atm/signaling.c
+++ /dev/null
@@ -1,297 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/* net/atm/signaling.c - ATM signaling */
-
-/* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
-
-#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
-
-#include <linux/errno.h>	/* error codes */
-#include <linux/kernel.h>	/* printk */
-#include <linux/skbuff.h>
-#include <linux/wait.h>
-#include <linux/sched.h>	/* jiffies and HZ */
-#include <linux/atm.h>		/* ATM stuff */
-#include <linux/atmsap.h>
-#include <linux/atmsvc.h>
-#include <linux/atmdev.h>
-#include <linux/bitops.h>
-#include <linux/slab.h>
-
-#include "resources.h"
-#include "signaling.h"
-
-struct atm_vcc *sigd = NULL;
-
-/*
- * find_get_vcc - validate and get a reference to a vcc pointer
- * @vcc: the vcc pointer to validate
- *
- * This function validates that @vcc points to a registered VCC in vcc_hash.
- * If found, it increments the socket reference count and returns the vcc.
- * The caller must call sock_put(sk_atm(vcc)) when done.
- *
- * Returns the vcc pointer if valid, NULL otherwise.
- */
-static struct atm_vcc *find_get_vcc(struct atm_vcc *vcc)
-{
-	int i;
-
-	read_lock(&vcc_sklist_lock);
-	for (i = 0; i < VCC_HTABLE_SIZE; i++) {
-		struct sock *s;
-
-		sk_for_each(s, &vcc_hash[i]) {
-			if (atm_sk(s) == vcc) {
-				sock_hold(s);
-				read_unlock(&vcc_sklist_lock);
-				return vcc;
-			}
-		}
-	}
-	read_unlock(&vcc_sklist_lock);
-	return NULL;
-}
-
-static void sigd_put_skb(struct sk_buff *skb)
-{
-	if (!sigd) {
-		pr_debug("atmsvc: no signaling daemon\n");
-		kfree_skb(skb);
-		return;
-	}
-	atm_force_charge(sigd, skb->truesize);
-	skb_queue_tail(&sk_atm(sigd)->sk_receive_queue, skb);
-	sk_atm(sigd)->sk_data_ready(sk_atm(sigd));
-}
-
-static void modify_qos(struct atm_vcc *vcc, struct atmsvc_msg *msg)
-{
-	struct sk_buff *skb;
-
-	if (test_bit(ATM_VF_RELEASED, &vcc->flags) ||
-	    !test_bit(ATM_VF_READY, &vcc->flags))
-		return;
-	msg->type = as_error;
-	if (!vcc->dev->ops->change_qos)
-		msg->reply = -EOPNOTSUPP;
-	else {
-		/* should lock VCC */
-		msg->reply = vcc->dev->ops->change_qos(vcc, &msg->qos,
-						       msg->reply);
-		if (!msg->reply)
-			msg->type = as_okay;
-	}
-	/*
-	 * Should probably just turn around the old skb. But then, the buffer
-	 * space accounting needs to follow the change too. Maybe later.
-	 */
-	while (!(skb = alloc_skb(sizeof(struct atmsvc_msg), GFP_KERNEL)))
-		schedule();
-	*(struct atmsvc_msg *)skb_put(skb, sizeof(struct atmsvc_msg)) = *msg;
-	sigd_put_skb(skb);
-}
-
-static int sigd_send(struct atm_vcc *vcc, struct sk_buff *skb)
-{
-	struct atmsvc_msg *msg;
-	struct atm_vcc *session_vcc;
-	struct sock *sk;
-
-	msg = (struct atmsvc_msg *) skb->data;
-	WARN_ON(refcount_sub_and_test(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc));
-
-	vcc = find_get_vcc(*(struct atm_vcc **)&msg->vcc);
-	if (!vcc) {
-		pr_debug("invalid vcc pointer in msg\n");
-		dev_kfree_skb(skb);
-		return -EINVAL;
-	}
-
-	pr_debug("%d (0x%lx)\n", (int)msg->type, (unsigned long)vcc);
-	sk = sk_atm(vcc);
-
-	switch (msg->type) {
-	case as_okay:
-		sk->sk_err = -msg->reply;
-		clear_bit(ATM_VF_WAITING, &vcc->flags);
-		if (!*vcc->local.sas_addr.prv && !*vcc->local.sas_addr.pub) {
-			vcc->local.sas_family = AF_ATMSVC;
-			memcpy(vcc->local.sas_addr.prv,
-			       msg->local.sas_addr.prv, ATM_ESA_LEN);
-			memcpy(vcc->local.sas_addr.pub,
-			       msg->local.sas_addr.pub, ATM_E164_LEN + 1);
-		}
-		session_vcc = vcc->session ? vcc->session : vcc;
-		if (session_vcc->vpi || session_vcc->vci)
-			break;
-		session_vcc->itf = msg->pvc.sap_addr.itf;
-		session_vcc->vpi = msg->pvc.sap_addr.vpi;
-		session_vcc->vci = msg->pvc.sap_addr.vci;
-		if (session_vcc->vpi || session_vcc->vci)
-			session_vcc->qos = msg->qos;
-		break;
-	case as_error:
-		clear_bit(ATM_VF_REGIS, &vcc->flags);
-		clear_bit(ATM_VF_READY, &vcc->flags);
-		sk->sk_err = -msg->reply;
-		clear_bit(ATM_VF_WAITING, &vcc->flags);
-		break;
-	case as_indicate:
-		/* Release the reference from msg->vcc, we'll use msg->listen_vcc instead */
-		sock_put(sk);
-
-		vcc = find_get_vcc(*(struct atm_vcc **)&msg->listen_vcc);
-		if (!vcc) {
-			pr_debug("invalid listen_vcc pointer in msg\n");
-			dev_kfree_skb(skb);
-			return -EINVAL;
-		}
-
-		sk = sk_atm(vcc);
-		pr_debug("as_indicate!!!\n");
-		lock_sock(sk);
-		if (sk_acceptq_is_full(sk)) {
-			sigd_enq(NULL, as_reject, vcc, NULL, NULL);
-			dev_kfree_skb(skb);
-			goto as_indicate_complete;
-		}
-		sk_acceptq_added(sk);
-		skb_queue_tail(&sk->sk_receive_queue, skb);
-		pr_debug("waking sk_sleep(sk) 0x%p\n", sk_sleep(sk));
-		sk->sk_state_change(sk);
-as_indicate_complete:
-		release_sock(sk);
-		/* Paired with find_get_vcc(msg->listen_vcc) above */
-		sock_put(sk);
-		return 0;
-	case as_close:
-		set_bit(ATM_VF_RELEASED, &vcc->flags);
-		vcc_release_async(vcc, msg->reply);
-		goto out;
-	case as_modify:
-		modify_qos(vcc, msg);
-		break;
-	case as_addparty:
-	case as_dropparty:
-		WRITE_ONCE(sk->sk_err_soft, -msg->reply);
-					/* < 0 failure, otherwise ep_ref */
-		clear_bit(ATM_VF_WAITING, &vcc->flags);
-		break;
-	default:
-		pr_alert("bad message type %d\n", (int)msg->type);
-		dev_kfree_skb(skb);
-		/* Paired with find_get_vcc(msg->vcc) above */
-		sock_put(sk);
-		return -EINVAL;
-	}
-	sk->sk_state_change(sk);
-out:
-	dev_kfree_skb(skb);
-	/* Paired with find_get_vcc(msg->vcc) above */
-	sock_put(sk);
-	return 0;
-}
-
-void sigd_enq2(struct atm_vcc *vcc, enum atmsvc_msg_type type,
-	       struct atm_vcc *listen_vcc, const struct sockaddr_atmpvc *pvc,
-	       const struct sockaddr_atmsvc *svc, const struct atm_qos *qos,
-	       int reply)
-{
-	struct sk_buff *skb;
-	struct atmsvc_msg *msg;
-	static unsigned int session = 0;
-
-	pr_debug("%d (0x%p)\n", (int)type, vcc);
-	while (!(skb = alloc_skb(sizeof(struct atmsvc_msg), GFP_KERNEL)))
-		schedule();
-	msg = skb_put_zero(skb, sizeof(struct atmsvc_msg));
-	msg->type = type;
-	*(struct atm_vcc **) &msg->vcc = vcc;
-	*(struct atm_vcc **) &msg->listen_vcc = listen_vcc;
-	msg->reply = reply;
-	if (qos)
-		msg->qos = *qos;
-	if (vcc)
-		msg->sap = vcc->sap;
-	if (svc)
-		msg->svc = *svc;
-	if (vcc)
-		msg->local = vcc->local;
-	if (pvc)
-		msg->pvc = *pvc;
-	if (vcc) {
-		if (type == as_connect && test_bit(ATM_VF_SESSION, &vcc->flags))
-			msg->session = ++session;
-			/* every new pmp connect gets the next session number */
-	}
-	sigd_put_skb(skb);
-	if (vcc)
-		set_bit(ATM_VF_REGIS, &vcc->flags);
-}
-
-void sigd_enq(struct atm_vcc *vcc, enum atmsvc_msg_type type,
-	      struct atm_vcc *listen_vcc, const struct sockaddr_atmpvc *pvc,
-	      const struct sockaddr_atmsvc *svc)
-{
-	sigd_enq2(vcc, type, listen_vcc, pvc, svc, vcc ? &vcc->qos : NULL, 0);
-	/* other ISP applications may use "reply" */
-}
-
-static void purge_vcc(struct atm_vcc *vcc)
-{
-	if (sk_atm(vcc)->sk_family == PF_ATMSVC &&
-	    !test_bit(ATM_VF_META, &vcc->flags)) {
-		set_bit(ATM_VF_RELEASED, &vcc->flags);
-		clear_bit(ATM_VF_REGIS, &vcc->flags);
-		vcc_release_async(vcc, -EUNATCH);
-	}
-}
-
-static void sigd_close(struct atm_vcc *vcc)
-{
-	struct sock *s;
-	int i;
-
-	pr_debug("\n");
-	sigd = NULL;
-	if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
-		pr_err("closing with requests pending\n");
-	skb_queue_purge(&sk_atm(vcc)->sk_receive_queue);
-
-	read_lock(&vcc_sklist_lock);
-	for (i = 0; i < VCC_HTABLE_SIZE; ++i) {
-		struct hlist_head *head = &vcc_hash[i];
-
-		sk_for_each(s, head) {
-			vcc = atm_sk(s);
-
-			purge_vcc(vcc);
-		}
-	}
-	read_unlock(&vcc_sklist_lock);
-}
-
-static const struct atmdev_ops sigd_dev_ops = {
-	.close = sigd_close,
-	.send =	sigd_send
-};
-
-static struct atm_dev sigd_dev = {
-	.ops =		&sigd_dev_ops,
-	.type =		"sig",
-	.number =	999,
-	.lock =		__SPIN_LOCK_UNLOCKED(sigd_dev.lock)
-};
-
-int sigd_attach(struct atm_vcc *vcc)
-{
-	if (sigd)
-		return -EADDRINUSE;
-	pr_debug("\n");
-	sigd = vcc;
-	vcc->dev = &sigd_dev;
-	vcc_insert_socket(sk_atm(vcc));
-	set_bit(ATM_VF_META, &vcc->flags);
-	set_bit(ATM_VF_READY, &vcc->flags);
-	return 0;
-}
diff --git a/net/atm/svc.c b/net/atm/svc.c
deleted file mode 100644
index 270e95154a2b..000000000000
--- a/net/atm/svc.c
+++ /dev/null
@@ -1,694 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/* net/atm/svc.c - ATM SVC sockets */
-
-/* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
-
-#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
-
-#include <linux/string.h>
-#include <linux/net.h>		/* struct socket, struct proto_ops */
-#include <linux/errno.h>	/* error codes */
-#include <linux/kernel.h>	/* printk */
-#include <linux/skbuff.h>
-#include <linux/wait.h>
-#include <linux/sched/signal.h>
-#include <linux/fcntl.h>	/* O_NONBLOCK */
-#include <linux/init.h>
-#include <linux/atm.h>		/* ATM stuff */
-#include <linux/atmsap.h>
-#include <linux/atmsvc.h>
-#include <linux/atmdev.h>
-#include <linux/bitops.h>
-#include <net/sock.h>		/* for sock_no_* */
-#include <linux/uaccess.h>
-#include <linux/uio.h>
-#include <linux/export.h>
-
-#include "resources.h"
-#include "common.h"		/* common for PVCs and SVCs */
-#include "signaling.h"
-
-#ifdef CONFIG_COMPAT
-/* It actually takes struct sockaddr_atmsvc, not struct atm_iobuf */
-#define COMPAT_ATM_ADDPARTY _IOW('a', ATMIOC_SPECIAL + 4, struct compat_atm_iobuf)
-#endif
-
-static int svc_create(struct net *net, struct socket *sock, int protocol,
-		      int kern);
-
-/*
- * Note: since all this is still nicely synchronized with the signaling demon,
- *       there's no need to protect sleep loops with clis. If signaling is
- *       moved into the kernel, that would change.
- */
-
-
-static int svc_shutdown(struct socket *sock, int how)
-{
-	return 0;
-}
-
-static void svc_disconnect(struct atm_vcc *vcc)
-{
-	DEFINE_WAIT(wait);
-	struct sk_buff *skb;
-	struct sock *sk = sk_atm(vcc);
-
-	pr_debug("%p\n", vcc);
-	if (test_bit(ATM_VF_REGIS, &vcc->flags)) {
-		sigd_enq(vcc, as_close, NULL, NULL, NULL);
-		for (;;) {
-			prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
-			if (test_bit(ATM_VF_RELEASED, &vcc->flags) || !sigd)
-				break;
-			schedule();
-		}
-		finish_wait(sk_sleep(sk), &wait);
-	}
-	/* beware - socket is still in use by atmsigd until the last
-	   as_indicate has been answered */
-	while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
-		atm_return(vcc, skb->truesize);
-		pr_debug("LISTEN REL\n");
-		sigd_enq2(NULL, as_reject, vcc, NULL, NULL, &vcc->qos, 0);
-		dev_kfree_skb(skb);
-	}
-	clear_bit(ATM_VF_REGIS, &vcc->flags);
-	/* ... may retry later */
-}
-
-static int svc_release(struct socket *sock)
-{
-	struct sock *sk = sock->sk;
-	struct atm_vcc *vcc;
-
-	if (sk) {
-		vcc = ATM_SD(sock);
-		pr_debug("%p\n", vcc);
-		clear_bit(ATM_VF_READY, &vcc->flags);
-		/*
-		 * VCC pointer is used as a reference,
-		 * so we must not free it (thereby subjecting it to re-use)
-		 * before all pending connections are closed
-		 */
-		svc_disconnect(vcc);
-		vcc_release(sock);
-	}
-	return 0;
-}
-
-static int svc_bind(struct socket *sock, struct sockaddr_unsized *sockaddr,
-		    int sockaddr_len)
-{
-	DEFINE_WAIT(wait);
-	struct sock *sk = sock->sk;
-	struct sockaddr_atmsvc *addr;
-	struct atm_vcc *vcc;
-	int error;
-
-	if (sockaddr_len != sizeof(struct sockaddr_atmsvc))
-		return -EINVAL;
-	lock_sock(sk);
-	if (sock->state == SS_CONNECTED) {
-		error = -EISCONN;
-		goto out;
-	}
-	if (sock->state != SS_UNCONNECTED) {
-		error = -EINVAL;
-		goto out;
-	}
-	vcc = ATM_SD(sock);
-	addr = (struct sockaddr_atmsvc *) sockaddr;
-	if (addr->sas_family != AF_ATMSVC) {
-		error = -EAFNOSUPPORT;
-		goto out;
-	}
-	clear_bit(ATM_VF_BOUND, &vcc->flags);
-	    /* failing rebind will kill old binding */
-	/* @@@ check memory (de)allocation on rebind */
-	if (!test_bit(ATM_VF_HASQOS, &vcc->flags)) {
-		error = -EBADFD;
-		goto out;
-	}
-	vcc->local = *addr;
-	set_bit(ATM_VF_WAITING, &vcc->flags);
-	sigd_enq(vcc, as_bind, NULL, NULL, &vcc->local);
-	for (;;) {
-		prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
-		if (!test_bit(ATM_VF_WAITING, &vcc->flags) || !sigd)
-			break;
-		schedule();
-	}
-	finish_wait(sk_sleep(sk), &wait);
-	clear_bit(ATM_VF_REGIS, &vcc->flags); /* doesn't count */
-	if (!sigd) {
-		error = -EUNATCH;
-		goto out;
-	}
-	if (!sk->sk_err)
-		set_bit(ATM_VF_BOUND, &vcc->flags);
-	error = -sk->sk_err;
-out:
-	release_sock(sk);
-	return error;
-}
-
-static int svc_connect(struct socket *sock, struct sockaddr_unsized *sockaddr,
-		       int sockaddr_len, int flags)
-{
-	DEFINE_WAIT(wait);
-	struct sock *sk = sock->sk;
-	struct sockaddr_atmsvc *addr;
-	struct atm_vcc *vcc = ATM_SD(sock);
-	int error;
-
-	pr_debug("%p\n", vcc);
-	lock_sock(sk);
-	if (sockaddr_len != sizeof(struct sockaddr_atmsvc)) {
-		error = -EINVAL;
-		goto out;
-	}
-
-	switch (sock->state) {
-	default:
-		error = -EINVAL;
-		goto out;
-	case SS_CONNECTED:
-		error = -EISCONN;
-		goto out;
-	case SS_CONNECTING:
-		if (test_bit(ATM_VF_WAITING, &vcc->flags)) {
-			error = -EALREADY;
-			goto out;
-		}
-		sock->state = SS_UNCONNECTED;
-		if (sk->sk_err) {
-			error = -sk->sk_err;
-			goto out;
-		}
-		break;
-	case SS_UNCONNECTED:
-		addr = (struct sockaddr_atmsvc *) sockaddr;
-		if (addr->sas_family != AF_ATMSVC) {
-			error = -EAFNOSUPPORT;
-			goto out;
-		}
-		if (!test_bit(ATM_VF_HASQOS, &vcc->flags)) {
-			error = -EBADFD;
-			goto out;
-		}
-		if (vcc->qos.txtp.traffic_class == ATM_ANYCLASS ||
-		    vcc->qos.rxtp.traffic_class == ATM_ANYCLASS) {
-			error = -EINVAL;
-			goto out;
-		}
-		if (!vcc->qos.txtp.traffic_class &&
-		    !vcc->qos.rxtp.traffic_class) {
-			error = -EINVAL;
-			goto out;
-		}
-		vcc->remote = *addr;
-		set_bit(ATM_VF_WAITING, &vcc->flags);
-		sigd_enq(vcc, as_connect, NULL, NULL, &vcc->remote);
-		if (flags & O_NONBLOCK) {
-			sock->state = SS_CONNECTING;
-			error = -EINPROGRESS;
-			goto out;
-		}
-		error = 0;
-		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
-		while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
-			schedule();
-			if (!signal_pending(current)) {
-				prepare_to_wait(sk_sleep(sk), &wait,
-						TASK_INTERRUPTIBLE);
-				continue;
-			}
-			pr_debug("*ABORT*\n");
-			/*
-			 * This is tricky:
-			 *   Kernel ---close--> Demon
-			 *   Kernel <--close--- Demon
-			 * or
-			 *   Kernel ---close--> Demon
-			 *   Kernel <--error--- Demon
-			 * or
-			 *   Kernel ---close--> Demon
-			 *   Kernel <--okay---- Demon
-			 *   Kernel <--close--- Demon
-			 */
-			sigd_enq(vcc, as_close, NULL, NULL, NULL);
-			while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
-				prepare_to_wait(sk_sleep(sk), &wait,
-						TASK_INTERRUPTIBLE);
-				schedule();
-			}
-			if (!sk->sk_err)
-				while (!test_bit(ATM_VF_RELEASED, &vcc->flags) &&
-				       sigd) {
-					prepare_to_wait(sk_sleep(sk), &wait,
-							TASK_INTERRUPTIBLE);
-					schedule();
-				}
-			clear_bit(ATM_VF_REGIS, &vcc->flags);
-			clear_bit(ATM_VF_RELEASED, &vcc->flags);
-			clear_bit(ATM_VF_CLOSE, &vcc->flags);
-			    /* we're gone now but may connect later */
-			error = -EINTR;
-			break;
-		}
-		finish_wait(sk_sleep(sk), &wait);
-		if (error)
-			goto out;
-		if (!sigd) {
-			error = -EUNATCH;
-			goto out;
-		}
-		if (sk->sk_err) {
-			error = -sk->sk_err;
-			goto out;
-		}
-	}
-
-	vcc->qos.txtp.max_pcr = SELECT_TOP_PCR(vcc->qos.txtp);
-	vcc->qos.txtp.pcr = 0;
-	vcc->qos.txtp.min_pcr = 0;
-
-	error = vcc_connect(sock, vcc->itf, vcc->vpi, vcc->vci);
-	if (!error)
-		sock->state = SS_CONNECTED;
-	else
-		(void)svc_disconnect(vcc);
-out:
-	release_sock(sk);
-	return error;
-}
-
-static int svc_listen(struct socket *sock, int backlog)
-{
-	DEFINE_WAIT(wait);
-	struct sock *sk = sock->sk;
-	struct atm_vcc *vcc = ATM_SD(sock);
-	int error;
-
-	pr_debug("%p\n", vcc);
-	lock_sock(sk);
-	/* let server handle listen on unbound sockets */
-	if (test_bit(ATM_VF_SESSION, &vcc->flags)) {
-		error = -EINVAL;
-		goto out;
-	}
-	if (test_bit(ATM_VF_LISTEN, &vcc->flags)) {
-		error = -EADDRINUSE;
-		goto out;
-	}
-	set_bit(ATM_VF_WAITING, &vcc->flags);
-	sigd_enq(vcc, as_listen, NULL, NULL, &vcc->local);
-	for (;;) {
-		prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
-		if (!test_bit(ATM_VF_WAITING, &vcc->flags) || !sigd)
-			break;
-		schedule();
-	}
-	finish_wait(sk_sleep(sk), &wait);
-	if (!sigd) {
-		error = -EUNATCH;
-		goto out;
-	}
-	set_bit(ATM_VF_LISTEN, &vcc->flags);
-	vcc_insert_socket(sk);
-	sk->sk_max_ack_backlog = backlog > 0 ? backlog : ATM_BACKLOG_DEFAULT;
-	error = -sk->sk_err;
-out:
-	release_sock(sk);
-	return error;
-}
-
-static int svc_accept(struct socket *sock, struct socket *newsock,
-		      struct proto_accept_arg *arg)
-{
-	struct sock *sk = sock->sk;
-	struct sk_buff *skb;
-	struct atmsvc_msg *msg;
-	struct atm_vcc *old_vcc = ATM_SD(sock);
-	struct atm_vcc *new_vcc;
-	int error;
-
-	lock_sock(sk);
-
-	error = svc_create(sock_net(sk), newsock, 0, arg->kern);
-	if (error)
-		goto out;
-
-	new_vcc = ATM_SD(newsock);
-
-	pr_debug("%p -> %p\n", old_vcc, new_vcc);
-	while (1) {
-		DEFINE_WAIT(wait);
-
-		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
-		while (!(skb = skb_dequeue(&sk->sk_receive_queue)) &&
-		       sigd) {
-			if (test_bit(ATM_VF_RELEASED, &old_vcc->flags))
-				break;
-			if (test_bit(ATM_VF_CLOSE, &old_vcc->flags)) {
-				error = -sk->sk_err;
-				break;
-			}
-			if (arg->flags & O_NONBLOCK) {
-				error = -EAGAIN;
-				break;
-			}
-			release_sock(sk);
-			schedule();
-			lock_sock(sk);
-			if (signal_pending(current)) {
-				error = -ERESTARTSYS;
-				break;
-			}
-			prepare_to_wait(sk_sleep(sk), &wait,
-					TASK_INTERRUPTIBLE);
-		}
-		finish_wait(sk_sleep(sk), &wait);
-		if (error)
-			goto out;
-		if (!skb) {
-			error = -EUNATCH;
-			goto out;
-		}
-		msg = (struct atmsvc_msg *)skb->data;
-		new_vcc->qos = msg->qos;
-		set_bit(ATM_VF_HASQOS, &new_vcc->flags);
-		new_vcc->remote = msg->svc;
-		new_vcc->local = msg->local;
-		new_vcc->sap = msg->sap;
-		error = vcc_connect(newsock, msg->pvc.sap_addr.itf,
-				    msg->pvc.sap_addr.vpi,
-				    msg->pvc.sap_addr.vci);
-		dev_kfree_skb(skb);
-		sk_acceptq_removed(sk);
-		if (error) {
-			sigd_enq2(NULL, as_reject, old_vcc, NULL, NULL,
-				  &old_vcc->qos, error);
-			error = error == -EAGAIN ? -EBUSY : error;
-			goto out;
-		}
-		/* wait should be short, so we ignore the non-blocking flag */
-		set_bit(ATM_VF_WAITING, &new_vcc->flags);
-		sigd_enq(new_vcc, as_accept, old_vcc, NULL, NULL);
-		for (;;) {
-			prepare_to_wait(sk_sleep(sk_atm(new_vcc)), &wait,
-					TASK_UNINTERRUPTIBLE);
-			if (!test_bit(ATM_VF_WAITING, &new_vcc->flags) || !sigd)
-				break;
-			release_sock(sk);
-			schedule();
-			lock_sock(sk);
-		}
-		finish_wait(sk_sleep(sk_atm(new_vcc)), &wait);
-		if (!sigd) {
-			error = -EUNATCH;
-			goto out;
-		}
-		if (!sk_atm(new_vcc)->sk_err)
-			break;
-		if (sk_atm(new_vcc)->sk_err != ERESTARTSYS) {
-			error = -sk_atm(new_vcc)->sk_err;
-			goto out;
-		}
-	}
-	newsock->state = SS_CONNECTED;
-out:
-	release_sock(sk);
-	return error;
-}
-
-static int svc_getname(struct socket *sock, struct sockaddr *sockaddr,
-		       int peer)
-{
-	struct sockaddr_atmsvc *addr;
-
-	addr = (struct sockaddr_atmsvc *) sockaddr;
-	memcpy(addr, peer ? &ATM_SD(sock)->remote : &ATM_SD(sock)->local,
-	       sizeof(struct sockaddr_atmsvc));
-	return sizeof(struct sockaddr_atmsvc);
-}
-
-int svc_change_qos(struct atm_vcc *vcc, struct atm_qos *qos)
-{
-	struct sock *sk = sk_atm(vcc);
-	DEFINE_WAIT(wait);
-
-	set_bit(ATM_VF_WAITING, &vcc->flags);
-	sigd_enq2(vcc, as_modify, NULL, NULL, &vcc->local, qos, 0);
-	for (;;) {
-		prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
-		if (!test_bit(ATM_VF_WAITING, &vcc->flags) ||
-		    test_bit(ATM_VF_RELEASED, &vcc->flags) || !sigd) {
-			break;
-		}
-		schedule();
-	}
-	finish_wait(sk_sleep(sk), &wait);
-	if (!sigd)
-		return -EUNATCH;
-	return -sk->sk_err;
-}
-
-static int svc_setsockopt(struct socket *sock, int level, int optname,
-			  sockptr_t optval, unsigned int optlen)
-{
-	struct sock *sk = sock->sk;
-	struct atm_vcc *vcc = ATM_SD(sock);
-	int value, error = 0;
-
-	lock_sock(sk);
-	switch (optname) {
-	case SO_ATMSAP:
-		if (level != SOL_ATM || optlen != sizeof(struct atm_sap)) {
-			error = -EINVAL;
-			goto out;
-		}
-		if (copy_from_sockptr(&vcc->sap, optval, optlen)) {
-			error = -EFAULT;
-			goto out;
-		}
-		set_bit(ATM_VF_HASSAP, &vcc->flags);
-		break;
-	case SO_MULTIPOINT:
-		if (level != SOL_ATM || optlen != sizeof(int)) {
-			error = -EINVAL;
-			goto out;
-		}
-		if (copy_from_sockptr(&value, optval, sizeof(int))) {
-			error = -EFAULT;
-			goto out;
-		}
-		if (value == 1)
-			set_bit(ATM_VF_SESSION, &vcc->flags);
-		else if (value == 0)
-			clear_bit(ATM_VF_SESSION, &vcc->flags);
-		else
-			error = -EINVAL;
-		break;
-	default:
-		error = vcc_setsockopt(sock, level, optname, optval, optlen);
-	}
-
-out:
-	release_sock(sk);
-	return error;
-}
-
-static int svc_getsockopt(struct socket *sock, int level, int optname,
-			  sockopt_t *opt)
-{
-	struct sock *sk = sock->sk;
-	int error = 0, len;
-
-	lock_sock(sk);
-	if (!__SO_LEVEL_MATCH(optname, level) || optname != SO_ATMSAP) {
-		error = vcc_getsockopt(sock, level, optname, opt);
-		goto out;
-	}
-	len = opt->optlen;
-	if (len != sizeof(struct atm_sap)) {
-		error = -EINVAL;
-		goto out;
-	}
-	if (copy_to_iter(&ATM_SD(sock)->sap, sizeof(struct atm_sap),
-			 &opt->iter_out) != sizeof(struct atm_sap)) {
-		error = -EFAULT;
-		goto out;
-	}
-out:
-	release_sock(sk);
-	return error;
-}
-
-static int svc_addparty(struct socket *sock, struct sockaddr *sockaddr,
-			int sockaddr_len, int flags)
-{
-	DEFINE_WAIT(wait);
-	struct sock *sk = sock->sk;
-	struct atm_vcc *vcc = ATM_SD(sock);
-	int error;
-
-	lock_sock(sk);
-	set_bit(ATM_VF_WAITING, &vcc->flags);
-	sigd_enq(vcc, as_addparty, NULL, NULL,
-		 (struct sockaddr_atmsvc *) sockaddr);
-	if (flags & O_NONBLOCK) {
-		error = -EINPROGRESS;
-		goto out;
-	}
-	pr_debug("added wait queue\n");
-	for (;;) {
-		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
-		if (!test_bit(ATM_VF_WAITING, &vcc->flags) || !sigd)
-			break;
-		schedule();
-	}
-	finish_wait(sk_sleep(sk), &wait);
-	error = -xchg(&sk->sk_err_soft, 0);
-out:
-	release_sock(sk);
-	return error;
-}
-
-static int svc_dropparty(struct socket *sock, int ep_ref)
-{
-	DEFINE_WAIT(wait);
-	struct sock *sk = sock->sk;
-	struct atm_vcc *vcc = ATM_SD(sock);
-	int error;
-
-	lock_sock(sk);
-	set_bit(ATM_VF_WAITING, &vcc->flags);
-	sigd_enq2(vcc, as_dropparty, NULL, NULL, NULL, NULL, ep_ref);
-	for (;;) {
-		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
-		if (!test_bit(ATM_VF_WAITING, &vcc->flags) || !sigd)
-			break;
-		schedule();
-	}
-	finish_wait(sk_sleep(sk), &wait);
-	if (!sigd) {
-		error = -EUNATCH;
-		goto out;
-	}
-	error = -xchg(&sk->sk_err_soft, 0);
-out:
-	release_sock(sk);
-	return error;
-}
-
-static int svc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
-{
-	int error, ep_ref;
-	struct sockaddr_atmsvc sa;
-	struct atm_vcc *vcc = ATM_SD(sock);
-
-	switch (cmd) {
-	case ATM_ADDPARTY:
-		if (!test_bit(ATM_VF_SESSION, &vcc->flags))
-			return -EINVAL;
-		if (copy_from_user(&sa, (void __user *) arg, sizeof(sa)))
-			return -EFAULT;
-		error = svc_addparty(sock, (struct sockaddr *)&sa, sizeof(sa),
-				     0);
-		break;
-	case ATM_DROPPARTY:
-		if (!test_bit(ATM_VF_SESSION, &vcc->flags))
-			return -EINVAL;
-		if (copy_from_user(&ep_ref, (void __user *) arg, sizeof(int)))
-			return -EFAULT;
-		error = svc_dropparty(sock, ep_ref);
-		break;
-	default:
-		error = vcc_ioctl(sock, cmd, arg);
-	}
-
-	return error;
-}
-
-#ifdef CONFIG_COMPAT
-static int svc_compat_ioctl(struct socket *sock, unsigned int cmd,
-			    unsigned long arg)
-{
-	/* The definition of ATM_ADDPARTY uses the size of struct atm_iobuf.
-	   But actually it takes a struct sockaddr_atmsvc, which doesn't need
-	   compat handling. So all we have to do is fix up cmd... */
-	if (cmd == COMPAT_ATM_ADDPARTY)
-		cmd = ATM_ADDPARTY;
-
-	if (cmd == ATM_ADDPARTY || cmd == ATM_DROPPARTY)
-		return svc_ioctl(sock, cmd, arg);
-	else
-		return vcc_compat_ioctl(sock, cmd, arg);
-}
-#endif /* CONFIG_COMPAT */
-
-static const struct proto_ops svc_proto_ops = {
-	.family =	PF_ATMSVC,
-	.owner =	THIS_MODULE,
-
-	.release =	svc_release,
-	.bind =		svc_bind,
-	.connect =	svc_connect,
-	.socketpair =	sock_no_socketpair,
-	.accept =	svc_accept,
-	.getname =	svc_getname,
-	.poll =		vcc_poll,
-	.ioctl =	svc_ioctl,
-#ifdef CONFIG_COMPAT
-	.compat_ioctl =	svc_compat_ioctl,
-#endif
-	.gettstamp =	sock_gettstamp,
-	.listen =	svc_listen,
-	.shutdown =	svc_shutdown,
-	.setsockopt =	svc_setsockopt,
-	.getsockopt_iter = svc_getsockopt,
-	.sendmsg =	vcc_sendmsg,
-	.recvmsg =	vcc_recvmsg,
-	.mmap =		sock_no_mmap,
-};
-
-
-static int svc_create(struct net *net, struct socket *sock, int protocol,
-		      int kern)
-{
-	int error;
-
-	if (!net_eq(net, &init_net))
-		return -EAFNOSUPPORT;
-
-	sock->ops = &svc_proto_ops;
-	error = vcc_create(net, sock, protocol, AF_ATMSVC, kern);
-	if (error)
-		return error;
-	ATM_SD(sock)->local.sas_family = AF_ATMSVC;
-	ATM_SD(sock)->remote.sas_family = AF_ATMSVC;
-	return 0;
-}
-
-static const struct net_proto_family svc_family_ops = {
-	.family = PF_ATMSVC,
-	.create = svc_create,
-	.owner = THIS_MODULE,
-};
-
-
-/*
- *	Initialize the ATM SVC protocol family
- */
-
-int __init atmsvc_init(void)
-{
-	return sock_register(&svc_family_ops);
-}
-
-void atmsvc_exit(void)
-{
-	sock_unregister(PF_ATMSVC);
-}
-- 
2.54.0


^ permalink raw reply related

* [PATCH net-next v2 4/9] atm: remove the local ATM (NSAP) address registry
From: Jakub Kicinski @ 2026-06-15 19:44 UTC (permalink / raw)
  To: davem
  Cc: netdev, edumazet, pabeni, andrew+netdev, horms, 3chas3, mitch,
	linux-atm-general, dwmw2, Jakub Kicinski
In-Reply-To: <20260615194416.752559-1-kuba@kernel.org>

net/atm/addr.c maintained the per-device lists of local NSAP addresses
(dev->local) and ILMI-learned LECS addresses (dev->lecs). These exist
solely to serve SVC signaling: the lists are populated through the
ATM_{ADD,DEL,RST}ADDR / ATM_{ADD,DEL,GET}LECSADDR ioctls used by the
atmsigd / ILMI daemons, and consumed when registering addresses with the
signaling daemon. The LECS list belonged to LAN Emulation, which has
been removed.

With no SVC users in a DSL-only configuration these lists are always
empty, so drop the registry entirely:

 - remove the ADDR/LECSADDR/RSTADDR ioctls
 - drop the now-always-empty "atmaddress" sysfs attribute
 - remove the dev->local / dev->lecs lists, structs and enums
 - delete net/atm/addr.c and net/atm/addr.h

The device ESI ("MAC" address) and its ATM_{G,S}ETESI ioctls and
"address" sysfs attribute are retained - the USB DSL modems populate
the ESI.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
v2:
 - delete the get_user(sioc_len), technically this is a behavior change
   since we no longer validate the access to sioc_len before executing
   the ioctl, but I suspect this level of bug-wards compatibility is
   theoretical
v1: https://lore.kernel.org/20260613201032.77274-5-kuba@kernel.org
---
 net/atm/Makefile       |   2 +-
 include/linux/atmdev.h |   9 ---
 net/atm/addr.h         |  21 ------
 net/atm/addr.c         | 162 -----------------------------------------
 net/atm/atm_sysfs.c    |  25 -------
 net/atm/common.c       |   1 -
 net/atm/ioctl.c        |  12 ---
 net/atm/resources.c    |  53 +-------------
 net/atm/svc.c          |   1 -
 9 files changed, 2 insertions(+), 284 deletions(-)
 delete mode 100644 net/atm/addr.h
 delete mode 100644 net/atm/addr.c

diff --git a/net/atm/Makefile b/net/atm/Makefile
index 484a1b1552cc..5ed48d50df35 100644
--- a/net/atm/Makefile
+++ b/net/atm/Makefile
@@ -3,7 +3,7 @@
 # Makefile for the ATM Protocol Families.
 #
 
-atm-y		:= addr.o pvc.o signaling.o svc.o ioctl.o common.o atm_misc.o raw.o resources.o atm_sysfs.o
+atm-y		:= pvc.o signaling.o svc.o ioctl.o common.o atm_misc.o raw.o resources.o atm_sysfs.o
 
 obj-$(CONFIG_ATM) += atm.o
 obj-$(CONFIG_ATM_BR2684) += br2684.o
diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
index 71c5bf6950e3..7abbd23fada6 100644
--- a/include/linux/atmdev.h
+++ b/include/linux/atmdev.h
@@ -136,13 +136,6 @@ static inline struct sock *sk_atm(struct atm_vcc *vcc)
 	return (struct sock *)vcc;
 }
 
-struct atm_dev_addr {
-	struct sockaddr_atmsvc addr;	/* ATM address */
-	struct list_head entry;		/* next address */
-};
-
-enum atm_addr_type_t { ATM_ADDR_LOCAL, ATM_ADDR_LECS };
-
 struct atm_dev {
 	const struct atmdev_ops *ops;	/* device operations; NULL if unused */
 	const struct atmphy_ops *phy;	/* PHY operations, may be undefined */
@@ -152,8 +145,6 @@ struct atm_dev {
 	void		*dev_data;	/* per-device data */
 	void		*phy_data;	/* private PHY data */
 	unsigned long	flags;		/* device flags (ATM_DF_*) */
-	struct list_head local;		/* local ATM addresses */
-	struct list_head lecs;		/* LECS ATM addresses learned via ILMI */
 	unsigned char	esi[ESI_LEN];	/* ESI ("MAC" addr) */
 	struct atm_cirange ci_range;	/* VPI/VCI range */
 	struct k_atm_dev_stats stats;	/* statistics */
diff --git a/net/atm/addr.h b/net/atm/addr.h
deleted file mode 100644
index da3f848411a0..000000000000
--- a/net/atm/addr.h
+++ /dev/null
@@ -1,21 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/* net/atm/addr.h - Local ATM address registry */
-
-/* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
-
-
-#ifndef NET_ATM_ADDR_H
-#define NET_ATM_ADDR_H
-
-#include <linux/atm.h>
-#include <linux/atmdev.h>
-
-void atm_reset_addr(struct atm_dev *dev, enum atm_addr_type_t type);
-int atm_add_addr(struct atm_dev *dev, const struct sockaddr_atmsvc *addr,
-		 enum atm_addr_type_t type);
-int atm_del_addr(struct atm_dev *dev, const struct sockaddr_atmsvc *addr,
-		 enum atm_addr_type_t type);
-int atm_get_addr(struct atm_dev *dev, struct sockaddr_atmsvc __user *buf,
-		 size_t size, enum atm_addr_type_t type);
-
-#endif
diff --git a/net/atm/addr.c b/net/atm/addr.c
deleted file mode 100644
index 938f360ae230..000000000000
--- a/net/atm/addr.c
+++ /dev/null
@@ -1,162 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/* net/atm/addr.c - Local ATM address registry */
-
-/* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
-
-#include <linux/atm.h>
-#include <linux/atmdev.h>
-#include <linux/slab.h>
-#include <linux/uaccess.h>
-
-#include "signaling.h"
-#include "addr.h"
-
-static int check_addr(const struct sockaddr_atmsvc *addr)
-{
-	int i;
-
-	if (addr->sas_family != AF_ATMSVC)
-		return -EAFNOSUPPORT;
-	if (!*addr->sas_addr.pub)
-		return *addr->sas_addr.prv ? 0 : -EINVAL;
-	for (i = 1; i < ATM_E164_LEN + 1; i++)	/* make sure it's \0-terminated */
-		if (!addr->sas_addr.pub[i])
-			return 0;
-	return -EINVAL;
-}
-
-static int identical(const struct sockaddr_atmsvc *a, const struct sockaddr_atmsvc *b)
-{
-	if (*a->sas_addr.prv)
-		if (memcmp(a->sas_addr.prv, b->sas_addr.prv, ATM_ESA_LEN))
-			return 0;
-	if (!*a->sas_addr.pub)
-		return !*b->sas_addr.pub;
-	if (!*b->sas_addr.pub)
-		return 0;
-	return !strcmp(a->sas_addr.pub, b->sas_addr.pub);
-}
-
-static void notify_sigd(const struct atm_dev *dev)
-{
-	struct sockaddr_atmpvc pvc;
-
-	pvc.sap_addr.itf = dev->number;
-	sigd_enq(NULL, as_itf_notify, NULL, &pvc, NULL);
-}
-
-void atm_reset_addr(struct atm_dev *dev, enum atm_addr_type_t atype)
-{
-	unsigned long flags;
-	struct atm_dev_addr *this, *p;
-	struct list_head *head;
-
-	spin_lock_irqsave(&dev->lock, flags);
-	if (atype == ATM_ADDR_LECS)
-		head = &dev->lecs;
-	else
-		head = &dev->local;
-	list_for_each_entry_safe(this, p, head, entry) {
-		list_del(&this->entry);
-		kfree(this);
-	}
-	spin_unlock_irqrestore(&dev->lock, flags);
-	if (head == &dev->local)
-		notify_sigd(dev);
-}
-
-int atm_add_addr(struct atm_dev *dev, const struct sockaddr_atmsvc *addr,
-		 enum atm_addr_type_t atype)
-{
-	unsigned long flags;
-	struct atm_dev_addr *this;
-	struct list_head *head;
-	int error;
-
-	error = check_addr(addr);
-	if (error)
-		return error;
-	spin_lock_irqsave(&dev->lock, flags);
-	if (atype == ATM_ADDR_LECS)
-		head = &dev->lecs;
-	else
-		head = &dev->local;
-	list_for_each_entry(this, head, entry) {
-		if (identical(&this->addr, addr)) {
-			spin_unlock_irqrestore(&dev->lock, flags);
-			return -EEXIST;
-		}
-	}
-	this = kmalloc_obj(struct atm_dev_addr, GFP_ATOMIC);
-	if (!this) {
-		spin_unlock_irqrestore(&dev->lock, flags);
-		return -ENOMEM;
-	}
-	this->addr = *addr;
-	list_add(&this->entry, head);
-	spin_unlock_irqrestore(&dev->lock, flags);
-	if (head == &dev->local)
-		notify_sigd(dev);
-	return 0;
-}
-
-int atm_del_addr(struct atm_dev *dev, const struct sockaddr_atmsvc *addr,
-		 enum atm_addr_type_t atype)
-{
-	unsigned long flags;
-	struct atm_dev_addr *this;
-	struct list_head *head;
-	int error;
-
-	error = check_addr(addr);
-	if (error)
-		return error;
-	spin_lock_irqsave(&dev->lock, flags);
-	if (atype == ATM_ADDR_LECS)
-		head = &dev->lecs;
-	else
-		head = &dev->local;
-	list_for_each_entry(this, head, entry) {
-		if (identical(&this->addr, addr)) {
-			list_del(&this->entry);
-			spin_unlock_irqrestore(&dev->lock, flags);
-			kfree(this);
-			if (head == &dev->local)
-				notify_sigd(dev);
-			return 0;
-		}
-	}
-	spin_unlock_irqrestore(&dev->lock, flags);
-	return -ENOENT;
-}
-
-int atm_get_addr(struct atm_dev *dev, struct sockaddr_atmsvc __user * buf,
-		 size_t size, enum atm_addr_type_t atype)
-{
-	unsigned long flags;
-	struct atm_dev_addr *this;
-	struct list_head *head;
-	int total = 0, error;
-	struct sockaddr_atmsvc *tmp_buf, *tmp_bufp;
-
-	spin_lock_irqsave(&dev->lock, flags);
-	if (atype == ATM_ADDR_LECS)
-		head = &dev->lecs;
-	else
-		head = &dev->local;
-	list_for_each_entry(this, head, entry)
-	    total += sizeof(struct sockaddr_atmsvc);
-	tmp_buf = tmp_bufp = kmalloc(total, GFP_ATOMIC);
-	if (!tmp_buf) {
-		spin_unlock_irqrestore(&dev->lock, flags);
-		return -ENOMEM;
-	}
-	list_for_each_entry(this, head, entry)
-	    memcpy(tmp_bufp++, &this->addr, sizeof(struct sockaddr_atmsvc));
-	spin_unlock_irqrestore(&dev->lock, flags);
-	error = total > size ? -E2BIG : total;
-	if (copy_to_user(buf, tmp_buf, total < size ? total : size))
-		error = -EFAULT;
-	kfree(tmp_buf);
-	return error;
-}
diff --git a/net/atm/atm_sysfs.c b/net/atm/atm_sysfs.c
index 54e7fb1a4ee5..0676a9c333ff 100644
--- a/net/atm/atm_sysfs.c
+++ b/net/atm/atm_sysfs.c
@@ -27,29 +27,6 @@ static ssize_t address_show(struct device *cdev,
 	return scnprintf(buf, PAGE_SIZE, "%pM\n", adev->esi);
 }
 
-static ssize_t atmaddress_show(struct device *cdev,
-			       struct device_attribute *attr, char *buf)
-{
-	unsigned long flags;
-	struct atm_dev *adev = to_atm_dev(cdev);
-	struct atm_dev_addr *aaddr;
-	int count = 0;
-
-	spin_lock_irqsave(&adev->lock, flags);
-	list_for_each_entry(aaddr, &adev->local, entry) {
-		count += scnprintf(buf + count, PAGE_SIZE - count,
-				   "%1phN.%2phN.%10phN.%6phN.%1phN\n",
-				   &aaddr->addr.sas_addr.prv[0],
-				   &aaddr->addr.sas_addr.prv[1],
-				   &aaddr->addr.sas_addr.prv[3],
-				   &aaddr->addr.sas_addr.prv[13],
-				   &aaddr->addr.sas_addr.prv[19]);
-	}
-	spin_unlock_irqrestore(&adev->lock, flags);
-
-	return count;
-}
-
 static ssize_t atmindex_show(struct device *cdev,
 			     struct device_attribute *attr, char *buf)
 {
@@ -91,14 +68,12 @@ static ssize_t link_rate_show(struct device *cdev,
 }
 
 static DEVICE_ATTR_RO(address);
-static DEVICE_ATTR_RO(atmaddress);
 static DEVICE_ATTR_RO(atmindex);
 static DEVICE_ATTR_RO(carrier);
 static DEVICE_ATTR_RO(type);
 static DEVICE_ATTR_RO(link_rate);
 
 static struct device_attribute *atm_attrs[] = {
-	&dev_attr_atmaddress,
 	&dev_attr_address,
 	&dev_attr_atmindex,
 	&dev_attr_carrier,
diff --git a/net/atm/common.c b/net/atm/common.c
index c6e87fc9bbfc..7d5b7c39b80b 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -30,7 +30,6 @@
 #include "resources.h"		/* atm_find_dev */
 #include "common.h"		/* prototypes */
 #include "protocols.h"		/* atm_init_<transport> */
-#include "addr.h"		/* address registry */
 #include "signaling.h"		/* for WAITING and sigd_attach */
 
 struct hlist_head vcc_hash[VCC_HTABLE_SIZE];
diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c
index 4f2d185bf2f0..97f20cd051ed 100644
--- a/net/atm/ioctl.c
+++ b/net/atm/ioctl.c
@@ -220,10 +220,6 @@ int vcc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 #define ATM_GETNAMES32    _IOW('a', ATMIOC_ITF+3, struct compat_atm_iobuf)
 #define ATM_GETTYPE32     _IOW('a', ATMIOC_ITF+4, struct compat_atmif_sioc)
 #define ATM_GETESI32	  _IOW('a', ATMIOC_ITF+5, struct compat_atmif_sioc)
-#define ATM_GETADDR32	  _IOW('a', ATMIOC_ITF+6, struct compat_atmif_sioc)
-#define ATM_RSTADDR32	  _IOW('a', ATMIOC_ITF+7, struct compat_atmif_sioc)
-#define ATM_ADDADDR32	  _IOW('a', ATMIOC_ITF+8, struct compat_atmif_sioc)
-#define ATM_DELADDR32	  _IOW('a', ATMIOC_ITF+9, struct compat_atmif_sioc)
 #define ATM_GETCIRANGE32  _IOW('a', ATMIOC_ITF+10, struct compat_atmif_sioc)
 #define ATM_SETCIRANGE32  _IOW('a', ATMIOC_ITF+11, struct compat_atmif_sioc)
 #define ATM_SETESI32      _IOW('a', ATMIOC_ITF+12, struct compat_atmif_sioc)
@@ -242,10 +238,6 @@ static struct {
 	{ ATM_GETNAMES32,    ATM_GETNAMES },
 	{ ATM_GETTYPE32,     ATM_GETTYPE },
 	{ ATM_GETESI32,	     ATM_GETESI },
-	{ ATM_GETADDR32,     ATM_GETADDR },
-	{ ATM_RSTADDR32,     ATM_RSTADDR },
-	{ ATM_ADDADDR32,     ATM_ADDADDR },
-	{ ATM_DELADDR32,     ATM_DELADDR },
 	{ ATM_GETCIRANGE32,  ATM_GETCIRANGE },
 	{ ATM_SETCIRANGE32,  ATM_SETCIRANGE },
 	{ ATM_SETESI32,	     ATM_SETESI },
@@ -305,10 +297,6 @@ static int do_atm_ioctl(struct socket *sock, unsigned int cmd32,
 	case ATM_GETLINKRATE:
 	case ATM_GETTYPE:
 	case ATM_GETESI:
-	case ATM_GETADDR:
-	case ATM_RSTADDR:
-	case ATM_ADDADDR:
-	case ATM_DELADDR:
 	case ATM_GETCIRANGE:
 	case ATM_SETCIRANGE:
 	case ATM_SETESI:
diff --git a/net/atm/resources.c b/net/atm/resources.c
index 7aac25e917b4..12aef5542263 100644
--- a/net/atm/resources.c
+++ b/net/atm/resources.c
@@ -25,7 +25,6 @@
 
 #include "common.h"
 #include "resources.h"
-#include "addr.h"
 
 
 LIST_HEAD(atm_devs);
@@ -42,8 +41,6 @@ static struct atm_dev *__alloc_atm_dev(const char *type)
 	dev->signal = ATM_PHY_SIG_UNKNOWN;
 	dev->link_rate = ATM_OC3_PCR;
 	spin_lock_init(&dev->lock);
-	INIT_LIST_HEAD(&dev->local);
-	INIT_LIST_HEAD(&dev->lecs);
 
 	return dev;
 }
@@ -227,11 +224,8 @@ int atm_getnames(void __user *buf, int __user *iobuf_len)
 int atm_dev_ioctl(unsigned int cmd, void __user *buf, int __user *sioc_len,
 		  int number, int compat)
 {
-	int error, len, size = 0;
 	struct atm_dev *dev;
-
-	if (get_user(len, sioc_len))
-		return -EFAULT;
+	int error, size = 0;
 
 	dev = try_then_request_module(atm_dev_lookup(number), "atm-device-%d",
 				      number);
@@ -306,51 +300,6 @@ int atm_dev_ioctl(unsigned int cmd, void __user *buf, int __user *sioc_len,
 			goto done;
 		}
 		break;
-	case ATM_RSTADDR:
-		if (!capable(CAP_NET_ADMIN)) {
-			error = -EPERM;
-			goto done;
-		}
-		atm_reset_addr(dev, ATM_ADDR_LOCAL);
-		break;
-	case ATM_ADDADDR:
-	case ATM_DELADDR:
-	case ATM_ADDLECSADDR:
-	case ATM_DELLECSADDR:
-	{
-		struct sockaddr_atmsvc addr;
-
-		if (!capable(CAP_NET_ADMIN)) {
-			error = -EPERM;
-			goto done;
-		}
-
-		if (copy_from_user(&addr, buf, sizeof(addr))) {
-			error = -EFAULT;
-			goto done;
-		}
-		if (cmd == ATM_ADDADDR || cmd == ATM_ADDLECSADDR)
-			error = atm_add_addr(dev, &addr,
-					     (cmd == ATM_ADDADDR ?
-					      ATM_ADDR_LOCAL : ATM_ADDR_LECS));
-		else
-			error = atm_del_addr(dev, &addr,
-					     (cmd == ATM_DELADDR ?
-					      ATM_ADDR_LOCAL : ATM_ADDR_LECS));
-		goto done;
-	}
-	case ATM_GETADDR:
-	case ATM_GETLECSADDR:
-		error = atm_get_addr(dev, buf, len,
-				     (cmd == ATM_GETADDR ?
-				      ATM_ADDR_LOCAL : ATM_ADDR_LECS));
-		if (error < 0)
-			goto done;
-		size = error;
-		/* may return 0, but later on size == 0 means "don't
-		   write the length" */
-		error = put_user(size, sioc_len) ? -EFAULT : 0;
-		goto done;
 	case ATM_SETLOOP:
 		if (__ATM_LM_XTRMT((int) (unsigned long) buf) &&
 		    __ATM_LM_XTLOC((int) (unsigned long) buf) >
diff --git a/net/atm/svc.c b/net/atm/svc.c
index 7c5559f50a99..270e95154a2b 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -27,7 +27,6 @@
 #include "resources.h"
 #include "common.h"		/* common for PVCs and SVCs */
 #include "signaling.h"
-#include "addr.h"
 
 #ifdef CONFIG_COMPAT
 /* It actually takes struct sockaddr_atmsvc, not struct atm_iobuf */
-- 
2.54.0


^ permalink raw reply related


This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox