13 files changed, 275 insertions, 104 deletions

diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 75a5968c2139..39744a33bd36 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -2,7 +2,7 @@
  * net/tipc/bearer.c: TIPC bearer code
  * 
  * Copyright (c) 1996-2006, Ericsson AB
- * Copyright (c) 2004-2005, Wind River Systems
+ * Copyright (c) 2004-2006, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -191,14 +191,14 @@ void tipc_media_addr_printf(struct print_buf *pb, struct tipc_media_addr *a)
         if ((i < media_count) && (m_ptr->addr2str != NULL)) {
                 char addr_str[MAX_ADDR_STR];
 
-                tipc_printf(pb, "%s(%s) ", m_ptr->name, 
+                tipc_printf(pb, "%s(%s)", m_ptr->name,
                             m_ptr->addr2str(a, addr_str, sizeof(addr_str)));
         } else {
                 unchar *addr = (unchar *)&a->dev_addr;
 
-                tipc_printf(pb, "UNKNOWN(%u):", media_type);
+                tipc_printf(pb, "UNKNOWN(%u)", media_type);
                 for (i = 0; i < (sizeof(*a) - sizeof(a->type)); i++) {
-                        tipc_printf(pb, "%02x ", addr[i]);
+                        tipc_printf(pb, "-%02x", addr[i]);
                 }
         }
 }
diff --git a/net/tipc/config.c b/net/tipc/config.c
index 285e1bc2d880..ed1351ed05e1 100644
--- a/net/tipc/config.c
+++ b/net/tipc/config.c
@@ -2,7 +2,7 @@
  * net/tipc/config.c: TIPC configuration management code
  * 
  * Copyright (c) 2002-2006, Ericsson AB
- * Copyright (c) 2004-2005, Wind River Systems
+ * Copyright (c) 2004-2006, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -613,7 +613,8 @@ struct sk_buff *tipc_cfg_do_cmd(u32 orig_node, u16 cmd, const void *request_area
                 rep_tlv_buf = tipc_cfg_reply_unsigned(tipc_net_id);
                 break;
         default:
-                rep_tlv_buf = NULL;
+                rep_tlv_buf = tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
+                                                          " (unknown command)");
                 break;
         }
 
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 0539a8362858..6f5b7ee31180 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -57,7 +57,7 @@ void tipc_socket_stop(void);
 int  tipc_netlink_start(void);
 void tipc_netlink_stop(void);
 
-#define TIPC_MOD_VER "1.6.1"
+#define TIPC_MOD_VER "1.6.2"
 
 #ifndef CONFIG_TIPC_ZONES
 #define CONFIG_TIPC_ZONES 3
@@ -90,7 +90,7 @@ int tipc_random;
 atomic_t tipc_user_count = ATOMIC_INIT(0);
 
 const char tipc_alphabet[] = 
-        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_";
+        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_.";
 
 /* configurable TIPC parameters */
 
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 762aac2572be..4638947c2326 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -65,7 +65,7 @@
 #define assert(i)  BUG_ON(!(i))
 
 struct tipc_msg;
-extern struct print_buf *TIPC_CONS, *TIPC_LOG;
+extern struct print_buf *TIPC_NULL, *TIPC_CONS, *TIPC_LOG;
 extern struct print_buf *TIPC_TEE(struct print_buf *, struct print_buf *);
 void tipc_msg_print(struct print_buf*,struct tipc_msg *,const char*);
 void tipc_printf(struct print_buf *, const char *fmt, ...);
@@ -83,9 +83,9 @@ void tipc_dump(struct print_buf*,const char *fmt, ...);
 #define warn(fmt, arg...) tipc_printf(TIPC_OUTPUT, KERN_WARNING "TIPC: " fmt, ## arg)
 #define info(fmt, arg...) tipc_printf(TIPC_OUTPUT, KERN_NOTICE "TIPC: " fmt, ## arg)
 
-#define dbg(fmt, arg...)  do {if (DBG_OUTPUT) tipc_printf(DBG_OUTPUT, fmt, ## arg);} while(0)
-#define msg_dbg(msg, txt) do {if (DBG_OUTPUT) tipc_msg_print(DBG_OUTPUT, msg, txt);} while(0)
-#define dump(fmt, arg...) do {if (DBG_OUTPUT) tipc_dump(DBG_OUTPUT, fmt, ##arg);} while(0)
+#define dbg(fmt, arg...)  do {if (DBG_OUTPUT != TIPC_NULL) tipc_printf(DBG_OUTPUT, fmt, ## arg);} while(0)
+#define msg_dbg(msg, txt) do {if (DBG_OUTPUT != TIPC_NULL) tipc_msg_print(DBG_OUTPUT, msg, txt);} while(0)
+#define dump(fmt, arg...) do {if (DBG_OUTPUT != TIPC_NULL) tipc_dump(DBG_OUTPUT, fmt, ##arg);} while(0)
 
 
 /*      
@@ -94,11 +94,11 @@ void tipc_dump(struct print_buf*,const char *fmt, ...);
  * here, or on a per .c file basis, by redefining these symbols.  The following
  * print buffer options are available:
  *
- * NULL                         : Output to null print buffer (i.e. print nowhere)
- * TIPC_CONS                    : Output to system console
- * TIPC_LOG                     : Output to TIPC log buffer 
- * &buf                         : Output to user-defined buffer (struct print_buf *)
- * TIPC_TEE(&buf_a,&buf_b)      : Output to two print buffers (eg. TIPC_TEE(TIPC_CONS,TIPC_LOG) )
+ * TIPC_NULL               : null buffer (i.e. print nowhere)
+ * TIPC_CONS               : system console
+ * TIPC_LOG                : TIPC log buffer
+ * &buf                    : user-defined buffer (struct print_buf *)
+ * TIPC_TEE(&buf_a,&buf_b) : list of buffers (eg. TIPC_TEE(TIPC_CONS,TIPC_LOG))
  */
 
 #ifndef TIPC_OUTPUT
@@ -106,7 +106,7 @@ void tipc_dump(struct print_buf*,const char *fmt, ...);
 #endif
 
 #ifndef DBG_OUTPUT
-#define DBG_OUTPUT NULL
+#define DBG_OUTPUT TIPC_NULL
 #endif
 
 #else
@@ -136,7 +136,7 @@ void tipc_dump(struct print_buf*,const char *fmt, ...);
 #define TIPC_OUTPUT TIPC_CONS
 
 #undef  DBG_OUTPUT
-#define DBG_OUTPUT NULL
+#define DBG_OUTPUT TIPC_NULL
 
 #endif                    
 
@@ -275,11 +275,15 @@ static inline void k_term_timer(struct timer_list *timer)
 /*
  * TIPC message buffer code
  *
- * TIPC message buffer headroom leaves room for 14 byte Ethernet header, 
+ * TIPC message buffer headroom reserves space for a link-level header
+ * (in case the message is sent off-node),
  * while ensuring TIPC header is word aligned for quicker access
+ *
+ * The largest header currently supported is 18 bytes, which is used when
+ * the standard 14 byte Ethernet header has 4 added bytes for VLAN info
  */
 
-#define BUF_HEADROOM 16u 
+#define BUF_HEADROOM 20u
 
 struct tipc_skb_cb {
         void *handle;
diff --git a/net/tipc/dbg.c b/net/tipc/dbg.c
index 55130655e1ed..d8af4c28695d 100644
--- a/net/tipc/dbg.c
+++ b/net/tipc/dbg.c
@@ -1,8 +1,8 @@
 /*
- * net/tipc/dbg.c: TIPC print buffer routines for debuggign
+ * net/tipc/dbg.c: TIPC print buffer routines for debugging
  * 
  * Copyright (c) 1996-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
+ * Copyright (c) 2005-2006, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -38,11 +38,12 @@
 #include "config.h"
 #include "dbg.h"
 
-#define MAX_STRING 512
-
-static char print_string[MAX_STRING];
+static char print_string[TIPC_PB_MAX_STR];
 static DEFINE_SPINLOCK(print_lock);
 
+static struct print_buf null_buf = { NULL, 0, NULL, NULL };
+struct print_buf *TIPC_NULL = &null_buf;
+
 static struct print_buf cons_buf = { NULL, 0, NULL, NULL };
 struct print_buf *TIPC_CONS = &cons_buf;
 
@@ -62,68 +63,83 @@ struct print_buf *TIPC_LOG = &log_buf;
 /*
  * Locking policy when using print buffers.
  *
- * 1) Routines of the form printbuf_XXX() rely on the caller to prevent
- *    simultaneous use of the print buffer(s) being manipulated.
- * 2) tipc_printf() uses 'print_lock' to prevent simultaneous use of
- *    'print_string' and to protect its print buffer(s).
- * 3) TIPC_TEE() uses 'print_lock' to protect its print buffer(s).
- * 4) Routines of the form log_XXX() uses 'print_lock' to protect TIPC_LOG.
+ * The following routines use 'print_lock' for protection:
+ * 1) tipc_printf()  - to protect its print buffer(s) and 'print_string'
+ * 2) TIPC_TEE()     - to protect its print buffer(s)
+ * 3) tipc_dump()    - to protect its print buffer(s) and 'print_string'
+ * 4) tipc_log_XXX() - to protect TIPC_LOG
+ *
+ * All routines of the form tipc_printbuf_XXX() rely on the caller to prevent
+ * simultaneous use of the print buffer(s) being manipulated.
  */
 
 /**
  * tipc_printbuf_init - initialize print buffer to empty
+ * @pb: pointer to print buffer structure
+ * @raw: pointer to character array used by print buffer
+ * @size: size of character array
+ *
+ * Makes the print buffer a null device that discards anything written to it
+ * if the character array is too small (or absent).
  */
 
-void tipc_printbuf_init(struct print_buf *pb, char *raw, u32 sz)
+void tipc_printbuf_init(struct print_buf *pb, char *raw, u32 size)
 {
-        if (!pb || !raw || (sz < (MAX_STRING + 1)))
-                return;
-
-        pb->crs = pb->buf = raw;
-        pb->size = sz;
+        pb->buf = raw;
+        pb->crs = raw;
+        pb->size = size;
         pb->next = NULL;
-        pb->buf[0] = 0;
-        pb->buf[sz-1] = ~0;
+
+        if (size < TIPC_PB_MIN_SIZE) {
+                pb->buf = NULL;
+        } else if (raw) {
+                pb->buf[0] = 0;
+                pb->buf[size-1] = ~0;
+        }
 }
 
 /**
  * tipc_printbuf_reset - reinitialize print buffer to empty state
+ * @pb: pointer to print buffer structure
  */
 
 void tipc_printbuf_reset(struct print_buf *pb)
 {
-        if (pb && pb->buf)
-                tipc_printbuf_init(pb, pb->buf, pb->size);
+        tipc_printbuf_init(pb, pb->buf, pb->size);
 }
 
 /**
  * tipc_printbuf_empty - test if print buffer is in empty state
+ * @pb: pointer to print buffer structure
+ *
+ * Returns non-zero if print buffer is empty.
  */
 
 int tipc_printbuf_empty(struct print_buf *pb)
 {
-        return (!pb || !pb->buf || (pb->crs == pb->buf));
+        return (!pb->buf || (pb->crs == pb->buf));
 }
 
 /**
  * tipc_printbuf_validate - check for print buffer overflow
+ * @pb: pointer to print buffer structure
  * 
  * Verifies that a print buffer has captured all data written to it. 
  * If data has been lost, linearize buffer and prepend an error message
  * 
- * Returns length of print buffer data string (including trailing NULL)
+ * Returns length of print buffer data string (including trailing NUL)
  */
 
 int tipc_printbuf_validate(struct print_buf *pb)
 {
-        char *err = "             *** PRINT BUFFER WRAPPED AROUND ***\n";
+        char *err = "\n\n*** PRINT BUFFER OVERFLOW ***\n\n";
         char *cp_buf;
         struct print_buf cb;
 
-        if (!pb || !pb->buf)
+        if (!pb->buf)
                 return 0;
 
-        if (pb->buf[pb->size - 1] == '\0') {
+        if (pb->buf[pb->size - 1] == 0) {
                 cp_buf = kmalloc(pb->size, GFP_ATOMIC);
                 if (cp_buf != NULL){
                         tipc_printbuf_init(&cb, cp_buf, pb->size);
@@ -141,6 +157,8 @@ int tipc_printbuf_validate(struct print_buf *pb)
 
 /**
  * tipc_printbuf_move - move print buffer contents to another print buffer
+ * @pb_to: pointer to destination print buffer structure
+ * @pb_from: pointer to source print buffer structure
  * 
  * Current contents of destination print buffer (if any) are discarded.
  * Source print buffer becomes empty if a successful move occurs.
@@ -152,21 +170,22 @@ void tipc_printbuf_move(struct print_buf *pb_to, struct print_buf *pb_from)
 
         /* Handle the cases where contents can't be moved */
 
-        if (!pb_to || !pb_to->buf)
+        if (!pb_to->buf)
                 return;
 
-        if (!pb_from || !pb_from->buf) {
+        if (!pb_from->buf) {
                 tipc_printbuf_reset(pb_to);
                 return;
         }
 
         if (pb_to->size < pb_from->size) {
                 tipc_printbuf_reset(pb_to);
-                tipc_printf(pb_to, "*** PRINT BUFFER OVERFLOW ***");
+                tipc_printf(pb_to, "*** PRINT BUFFER MOVE ERROR ***");
                 return;
         }
 
         /* Copy data from char after cursor to end (if used) */
+
         len = pb_from->buf + pb_from->size - pb_from->crs - 2;
         if ((pb_from->buf[pb_from->size-1] == 0) && (len > 0)) {
                 strcpy(pb_to->buf, pb_from->crs + 1);
@@ -175,6 +194,7 @@ void tipc_printbuf_move(struct print_buf *pb_to, struct print_buf *pb_from)
                 pb_to->crs = pb_to->buf;
 
         /* Copy data from start to cursor (always) */
+
         len = pb_from->crs - pb_from->buf;
         strcpy(pb_to->crs, pb_from->buf);
         pb_to->crs += len;
@@ -184,6 +204,8 @@ void tipc_printbuf_move(struct print_buf *pb_to, struct print_buf *pb_from)
 
 /**
  * tipc_printf - append formatted output to print buffer chain
+ * @pb: pointer to chain of print buffers (may be NULL)
+ * @fmt: formatted info to be printed
  */
 
 void tipc_printf(struct print_buf *pb, const char *fmt, ...)
@@ -195,8 +217,8 @@ void tipc_printf(struct print_buf *pb, const char *fmt, ...)
 
         spin_lock_bh(&print_lock);
         FORMAT(print_string, chars_to_add, fmt);
-        if (chars_to_add >= MAX_STRING)
-                strcpy(print_string, "*** STRING TOO LONG ***");
+        if (chars_to_add >= TIPC_PB_MAX_STR)
+                strcpy(print_string, "*** PRINT BUFFER STRING TOO LONG ***");
 
         while (pb) {
                 if (pb == TIPC_CONS)
@@ -206,6 +228,10 @@ void tipc_printf(struct print_buf *pb, const char *fmt, ...)
                         if (chars_to_add <= chars_left) {
                                 strcpy(pb->crs, print_string);
                                 pb->crs += chars_to_add;
+                        } else if (chars_to_add >= (pb->size - 1)) {
+                                strcpy(pb->buf, print_string + chars_to_add + 1
+                                       - pb->size);
+                                pb->crs = pb->buf + pb->size - 1;
                         } else {
                                 strcpy(pb->buf, print_string + chars_left);
                                 save_char = print_string[chars_left];
@@ -224,6 +250,10 @@ void tipc_printf(struct print_buf *pb, const char *fmt, ...)
 
 /**
  * TIPC_TEE - perform next output operation on both print buffers  
+ * @b0: pointer to chain of print buffers (may be NULL)
+ * @b1: pointer to print buffer to add to chain
+ *
+ * Returns pointer to print buffer chain.
  */
 
 struct print_buf *TIPC_TEE(struct print_buf *b0, struct print_buf *b1)
@@ -232,8 +262,6 @@ struct print_buf *TIPC_TEE(struct print_buf *b0, struct print_buf *b1)
 
         if (!b0 || (b0 == b1))
                 return b1;
-        if (!b1)
-                return b0;
 
         spin_lock_bh(&print_lock);
         while (pb->next) {
@@ -256,7 +284,7 @@ static void print_to_console(char *crs, int len)
         int rest = len;
 
         while (rest > 0) {
-                int sz = rest < MAX_STRING ? rest : MAX_STRING;
+                int sz = rest < TIPC_PB_MAX_STR ? rest : TIPC_PB_MAX_STR;
                 char c = crs[sz];
 
                 crs[sz] = 0;
@@ -275,36 +303,48 @@ static void printbuf_dump(struct print_buf *pb)
 {
         int len;
 
+        if (!pb->buf) {
+                printk("*** PRINT BUFFER NOT ALLOCATED ***");
+                return;
+        }
+
         /* Dump print buffer from char after cursor to end (if used) */
+
         len = pb->buf + pb->size - pb->crs - 2;
         if ((pb->buf[pb->size - 1] == 0) && (len > 0))
                 print_to_console(pb->crs + 1, len);
 
         /* Dump print buffer from start to cursor (always) */
+
         len = pb->crs - pb->buf;
         print_to_console(pb->buf, len);
 }
 
 /**
  * tipc_dump - dump non-console print buffer(s) to console
+ * @pb: pointer to chain of print buffers
  */
 
 void tipc_dump(struct print_buf *pb, const char *fmt, ...)
 {
+        struct print_buf *pb_next;
         int len;
 
         spin_lock_bh(&print_lock);
-        FORMAT(TIPC_CONS->buf, len, fmt);
-        printk(TIPC_CONS->buf);
+        FORMAT(print_string, len, fmt);
+        printk(print_string);
 
         for (; pb; pb = pb->next) {
-                if (pb == TIPC_CONS)
-                        continue;
-                printk("\n---- Start of dump,%s log ----\n\n", 
-                       (pb == TIPC_LOG) ? "global" : "local");
-                printbuf_dump(pb);
-                tipc_printbuf_reset(pb);
-                printk("\n-------- End of dump --------\n");
+                if (pb != TIPC_CONS) {
+                        printk("\n---- Start of %s log dump ----\n\n",
+                               (pb == TIPC_LOG) ? "global" : "local");
+                        printbuf_dump(pb);
+                        tipc_printbuf_reset(pb);
+                        printk("\n---- End of dump ----\n");
+                }
+                pb_next = pb->next;
+                pb->next = NULL;
+                pb = pb_next;
         }
         spin_unlock_bh(&print_lock);
 }
@@ -324,7 +364,8 @@ void tipc_log_stop(void)
 }
 
 /**
- * tipc_log_reinit - set TIPC log print buffer to specified size
+ * tipc_log_reinit - (re)initialize TIPC log print buffer
+ * @log_size: print buffer size to use
  */
 
 void tipc_log_reinit(int log_size)
@@ -332,10 +373,11 @@ void tipc_log_reinit(int log_size)
         tipc_log_stop();
 
         if (log_size) {
-                if (log_size <= MAX_STRING)
-                        log_size = MAX_STRING + 1;
+                if (log_size < TIPC_PB_MIN_SIZE)
+                        log_size = TIPC_PB_MIN_SIZE;
                 spin_lock_bh(&print_lock);
-                tipc_printbuf_init(TIPC_LOG, kmalloc(log_size, GFP_ATOMIC), log_size);
+                tipc_printbuf_init(TIPC_LOG, kmalloc(log_size, GFP_ATOMIC),
+                                   log_size);
                 spin_unlock_bh(&print_lock);
         }
 }
diff --git a/net/tipc/dbg.h b/net/tipc/dbg.h
index 227f050d2a52..467c0bc78a79 100644
--- a/net/tipc/dbg.h
+++ b/net/tipc/dbg.h
@@ -2,7 +2,7 @@
  * net/tipc/dbg.h: Include file for TIPC print buffer routines
  * 
  * Copyright (c) 1997-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
+ * Copyright (c) 2005-2006, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -37,6 +37,14 @@
 #ifndef _TIPC_DBG_H
 #define _TIPC_DBG_H
 
+/**
+ * struct print_buf - TIPC print buffer structure
+ * @buf: pointer to character array containing print buffer contents
+ * @size: size of character array
+ * @crs: pointer to first unused space in character array (i.e. final NUL)
+ * @next: used to link print buffers when printing to more than one at a time
+ */
+
 struct print_buf {
         char *buf;
         u32 size;
@@ -44,7 +52,10 @@ struct print_buf {
         struct print_buf *next;
 };
 
-void tipc_printbuf_init(struct print_buf *pb, char *buf, u32 sz);
+#define TIPC_PB_MIN_SIZE 64     /* minimum size for a print buffer's array */
+#define TIPC_PB_MAX_STR 512     /* max printable string (with trailing NUL) */
+
+void tipc_printbuf_init(struct print_buf *pb, char *buf, u32 size);
 void tipc_printbuf_reset(struct print_buf *pb);
 int  tipc_printbuf_empty(struct print_buf *pb);
 int  tipc_printbuf_validate(struct print_buf *pb);
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index ee94de92ae99..3b0cd12f37da 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -132,6 +132,28 @@ static struct sk_buff *tipc_disc_init_msg(u32 type,
 }
 
 /**
+ * disc_dupl_alert - issue node address duplication alert
+ * @b_ptr: pointer to bearer detecting duplication
+ * @node_addr: duplicated node address
+ * @media_addr: media address advertised by duplicated node
+ */
+
+static void disc_dupl_alert(struct bearer *b_ptr, u32 node_addr,
+                            struct tipc_media_addr *media_addr)
+{
+        char node_addr_str[16];
+        char media_addr_str[64];
+        struct print_buf pb;
+
+        addr_string_fill(node_addr_str, node_addr);
+        tipc_printbuf_init(&pb, media_addr_str, sizeof(media_addr_str));
+        tipc_media_addr_printf(&pb, media_addr);
+        tipc_printbuf_validate(&pb);
+        warn("Duplicate %s using %s seen on <%s>\n",
+             node_addr_str, media_addr_str, b_ptr->publ.name);
+}
+
+/**
  * tipc_disc_recv_msg - handle incoming link setup message (request or response)
  * @buf: buffer containing message
  */
@@ -157,8 +179,11 @@ void tipc_disc_recv_msg(struct sk_buff *buf)
                 return;
         if (!tipc_addr_node_valid(orig))
                 return;
-        if (orig == tipc_own_addr)
+        if (orig == tipc_own_addr) {
+                if (memcmp(&media_addr, &b_ptr->publ.addr, sizeof(media_addr)))
+                        disc_dupl_alert(b_ptr, tipc_own_addr, &media_addr);
                 return;
+        }
         if (!in_scope(dest, tipc_own_addr))
                 return;
         if (is_slave(tipc_own_addr) && is_slave(orig))
@@ -170,7 +195,8 @@ void tipc_disc_recv_msg(struct sk_buff *buf)
                 struct sk_buff *rbuf;
                 struct tipc_media_addr *addr;
                 struct node *n_ptr = tipc_node_find(orig);
-                int link_up;
+                int link_fully_up;
+
                 dbg(" in own cluster\n");
                 if (n_ptr == NULL) {
                         n_ptr = tipc_node_create(orig);
@@ -190,14 +216,19 @@ void tipc_disc_recv_msg(struct sk_buff *buf)
                 }
                 addr = &link->media_addr;
                 if (memcmp(addr, &media_addr, sizeof(*addr))) {
+                        if (tipc_link_is_up(link) || (!link->started)) {
+                                disc_dupl_alert(b_ptr, orig, &media_addr);
+                                spin_unlock_bh(&n_ptr->lock);
+                                return;
+                        }
                         warn("Resetting link <%s>, peer interface address changed\n",
                              link->name);
                         memcpy(addr, &media_addr, sizeof(*addr));
                         tipc_link_reset(link);     
                 }
-                link_up = tipc_link_is_up(link);
+                link_fully_up = (link->state == WORKING_WORKING);
                 spin_unlock_bh(&n_ptr->lock);                
-                if ((type == DSC_RESP_MSG) || link_up)
+                if ((type == DSC_RESP_MSG) || link_fully_up)
                         return;
                 rbuf = tipc_disc_init_msg(DSC_RESP_MSG, 1, orig, b_ptr);
                 if (rbuf != NULL) {
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 53bc8cb5adbc..1bb983c8130b 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -132,7 +132,7 @@ static void link_print(struct link *l_ptr, struct print_buf *buf,
  * allow the output from multiple links to be intermixed.  For this reason
  * routines of the form "dbg_link_XXX()" have been created that will capture
  * debug info into a link's personal print buffer, which can then be dumped
- * into the TIPC system log (LOG) upon request.
+ * into the TIPC system log (TIPC_LOG) upon request.
  *
  * To enable per-link debugging, use LINK_LOG_BUF_SIZE to specify the size
  * of the print buffer used by each link.  If LINK_LOG_BUF_SIZE is set to 0,
@@ -141,7 +141,7 @@ static void link_print(struct link *l_ptr, struct print_buf *buf,
  * when there is only a single link in the system being debugged.
  *
  * Notes:
- * - When enabled, LINK_LOG_BUF_SIZE should be set to at least 1000 (bytes)
+ * - When enabled, LINK_LOG_BUF_SIZE should be set to at least TIPC_PB_MIN_SIZE
  * - "l_ptr" must be valid when using dbg_link_XXX() macros  
  */
 
@@ -159,13 +159,13 @@ static void link_print(struct link *l_ptr, struct print_buf *buf,
 
 static void dbg_print_link(struct link *l_ptr, const char *str)
 {
-        if (DBG_OUTPUT)
+        if (DBG_OUTPUT != TIPC_NULL)
                 link_print(l_ptr, DBG_OUTPUT, str);
 }
 
 static void dbg_print_buf_chain(struct sk_buff *root_buf)
 {
-        if (DBG_OUTPUT) {
+        if (DBG_OUTPUT != TIPC_NULL) {
                 struct sk_buff *buf = root_buf;
 
                 while (buf) {
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index f0b063bcc2a9..03bd659c43ca 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -122,7 +122,7 @@ void tipc_named_publish(struct publication *publ)
         struct sk_buff *buf;
         struct distr_item *item;
 
-        list_add(&publ->local_list, &publ_root);
+        list_add_tail(&publ->local_list, &publ_root);
         publ_cnt++;
 
         buf = named_prepare_buf(PUBLICATION, ITEM_SIZE, 0);
diff --git a/net/tipc/node.c b/net/tipc/node.c
index fc6d09630ccd..886bda5e88db 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -648,7 +648,7 @@ struct sk_buff *tipc_node_get_links(const void *req_tlv_area, int req_tlv_space)
                 return tipc_cfg_reply_error_string(TIPC_CFG_INVALID_VALUE
                                                    " (network address)");
 
-        if (!tipc_nodes)
+        if (tipc_mode != TIPC_NET_MODE)
                 return tipc_cfg_reply_none();
         
         /* Get space for all unicast links + multicast link */
diff --git a/net/tipc/port.c b/net/tipc/port.c
index b9c8c6b9e94f..b7f3199523ca 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -505,8 +505,13 @@ static void port_timeout(unsigned long ref)
         struct port *p_ptr = tipc_port_lock(ref);
         struct sk_buff *buf = NULL;
 
-        if (!p_ptr || !p_ptr->publ.connected)
+        if (!p_ptr)
+                return;
+
+        if (!p_ptr->publ.connected) {
+                tipc_port_unlock(p_ptr);
                 return;
+        }
 
         /* Last probe answered ? */
         if (p_ptr->probing_state == PROBING) {
@@ -1131,11 +1136,12 @@ int tipc_publish(u32 ref, unsigned int scope, struct tipc_name_seq const *seq)
         int res = -EINVAL;
 
         p_ptr = tipc_port_lock(ref);
+        if (!p_ptr)
+                return -EINVAL;
+
         dbg("tipc_publ %u, p_ptr = %x, conn = %x, scope = %x, "
             "lower = %u, upper = %u\n",
             ref, p_ptr, p_ptr->publ.connected, scope, seq->lower, seq->upper);
-        if (!p_ptr)
-                return -EINVAL;
         if (p_ptr->publ.connected)
                 goto exit;
         if (seq->lower > seq->upper)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 32d778448a00..2a6a5a6b4c12 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2,7 +2,7 @@
  * net/tipc/socket.c: TIPC socket API
  * 
  * Copyright (c) 2001-2006, Ericsson AB
- * Copyright (c) 2004-2005, Wind River Systems
+ * Copyright (c) 2004-2006, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -629,6 +629,9 @@ static int send_stream(struct kiocb *iocb, struct socket *sock,
                         return -ENOTCONN;
         }
 
+        if (unlikely(m->msg_name))
+                return -EISCONN;
+
         /* 
          * Send each iovec entry using one or more messages
          *
@@ -641,6 +644,8 @@ static int send_stream(struct kiocb *iocb, struct socket *sock,
         curr_iovlen = m->msg_iovlen;
         my_msg.msg_iov = &my_iov;
         my_msg.msg_iovlen = 1;
+        my_msg.msg_flags = m->msg_flags;
+        my_msg.msg_name = NULL;
         bytes_sent = 0;
 
         while (curr_iovlen--) {
@@ -941,7 +946,7 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
         int sz_to_copy;
         int sz_copied = 0;
         int needed;
-        char *crs = m->msg_iov->iov_base;
+        char __user *crs = m->msg_iov->iov_base;
         unsigned char *buf_crs;
         u32 err;
         int res;
@@ -1203,7 +1208,8 @@ static u32 dispatch(struct tipc_port *tport, struct sk_buff *buf)
         atomic_inc(&tipc_queue_size);
         skb_queue_tail(&sock->sk->sk_receive_queue, buf);
 
-        wake_up_interruptible(sock->sk->sk_sleep);
+        if (waitqueue_active(sock->sk->sk_sleep))
+                wake_up_interruptible(sock->sk->sk_sleep);
         return TIPC_OK;
 }
 
@@ -1218,7 +1224,8 @@ static void wakeupdispatch(struct tipc_port *tport)
 {
         struct tipc_sock *tsock = (struct tipc_sock *)tport->usr_handle;
 
-        wake_up_interruptible(tsock->sk.sk_sleep);
+        if (waitqueue_active(tsock->sk.sk_sleep))
+                wake_up_interruptible(tsock->sk.sk_sleep);
 }
 
 /**
@@ -1496,7 +1503,7 @@ static int setsockopt(struct socket *sock,
                 return -ENOPROTOOPT;
         if (ol < sizeof(value))
                 return -EINVAL;
-        if ((res = get_user(value, (u32 *)ov)))
+        if ((res = get_user(value, (u32 __user *)ov)))
                 return res;
 
         if (down_interruptible(&tsock->sem)) 
@@ -1541,7 +1548,7 @@ static int setsockopt(struct socket *sock,
  */
 
 static int getsockopt(struct socket *sock, 
-                      int lvl, int opt, char __user *ov, int *ol)
+                      int lvl, int opt, char __user *ov, int __user *ol)
 {
         struct tipc_sock *tsock = tipc_sk(sock->sk);
         int len;
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index c51600ba5f4a..7a918f12a5df 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -155,7 +155,7 @@ void tipc_subscr_report_overlap(struct subscription *sub,
             sub->seq.upper, found_lower, found_upper);
         if (!tipc_subscr_overlap(sub, found_lower, found_upper))
                 return;
-        if (!must && (sub->filter != TIPC_SUB_PORTS))
+        if (!must && !(sub->filter & TIPC_SUB_PORTS))
                 return;
         subscr_send_event(sub, found_lower, found_upper, event, port_ref, node);
 }
@@ -176,6 +176,13 @@ static void subscr_timeout(struct subscription *sub)
         if (subscriber == NULL)
                 return;
 
+        /* Validate timeout (in case subscription is being cancelled) */
+
+        if (sub->timeout == TIPC_WAIT_FOREVER) {
+                tipc_ref_unlock(subscriber_ref);
+                return;
+        }
+
         /* Unlink subscription from name table */
 
         tipc_nametbl_unsubscribe(sub);
@@ -199,6 +206,20 @@ static void subscr_timeout(struct subscription *sub)
 }
 
 /**
+ * subscr_del - delete a subscription within a subscription list
+ *
+ * Called with subscriber locked.
+ */
+
+static void subscr_del(struct subscription *sub)
+{
+        tipc_nametbl_unsubscribe(sub);
+        list_del(&sub->subscription_list);
+        kfree(sub);
+        atomic_dec(&topsrv.subscription_count);
+}
+
+/**
  * subscr_terminate - terminate communication with a subscriber
  * 
  * Called with subscriber locked.  Routine must temporarily release this lock
@@ -227,12 +248,9 @@ static void subscr_terminate(struct subscriber *subscriber)
                         k_cancel_timer(&sub->timer);
                         k_term_timer(&sub->timer);
                 }
-                tipc_nametbl_unsubscribe(sub);
-                list_del(&sub->subscription_list);
-                dbg("Term: Removed sub %u,%u,%u from subscriber %x list\n",
+                dbg("Term: Removing sub %u,%u,%u from subscriber %x list\n",
                     sub->seq.type, sub->seq.lower, sub->seq.upper, subscriber);
-                kfree(sub);
-                atomic_dec(&topsrv.subscription_count);
+                subscr_del(sub);
         }
 
         /* Sever connection to subscriber */
@@ -253,6 +271,49 @@ static void subscr_terminate(struct subscriber *subscriber)
 }
 
 /**
+ * subscr_cancel - handle subscription cancellation request
+ *
+ * Called with subscriber locked.  Routine must temporarily release this lock
+ * to enable the subscription timeout routine to finish without deadlocking;
+ * the lock is then reclaimed to allow caller to release it upon return.
+ *
+ * Note that fields of 's' use subscriber's endianness!
+ */
+
+static void subscr_cancel(struct tipc_subscr *s,
+                          struct subscriber *subscriber)
+{
+        struct subscription *sub;
+        struct subscription *sub_temp;
+        int found = 0;
+
+        /* Find first matching subscription, exit if not found */
+
+        list_for_each_entry_safe(sub, sub_temp, &subscriber->subscription_list,
+                                 subscription_list) {
+                if (!memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr))) {
+                        found = 1;
+                        break;
+                }
+        }
+        if (!found)
+                return;
+
+        /* Cancel subscription timer (if used), then delete subscription */
+
+        if (sub->timeout != TIPC_WAIT_FOREVER) {
+                sub->timeout = TIPC_WAIT_FOREVER;
+                spin_unlock_bh(subscriber->lock);
+                k_cancel_timer(&sub->timer);
+                k_term_timer(&sub->timer);
+                spin_lock_bh(subscriber->lock);
+        }
+        dbg("Cancel: removing sub %u,%u,%u from subscriber %x list\n",
+            sub->seq.type, sub->seq.lower, sub->seq.upper, subscriber);
+        subscr_del(sub);
+}
+
+/**
  * subscr_subscribe - create subscription for subscriber
  * 
  * Called with subscriber locked
@@ -263,6 +324,21 @@ static void subscr_subscribe(struct tipc_subscr *s,
 {
         struct subscription *sub;
 
+        /* Determine/update subscriber's endianness */
+
+        if (s->filter & (TIPC_SUB_PORTS | TIPC_SUB_SERVICE))
+                subscriber->swap = 0;
+        else
+                subscriber->swap = 1;
+
+        /* Detect & process a subscription cancellation request */
+
+        if (s->filter & htohl(TIPC_SUB_CANCEL, subscriber->swap)) {
+                s->filter &= ~htohl(TIPC_SUB_CANCEL, subscriber->swap);
+                subscr_cancel(s, subscriber);
+                return;
+        }
+
         /* Refuse subscription if global limit exceeded */
 
         if (atomic_read(&topsrv.subscription_count) >= tipc_max_subscriptions) {
@@ -281,13 +357,6 @@ static void subscr_subscribe(struct tipc_subscr *s,
                 return;
         }
 
-        /* Determine/update subscriber's endianness */
-
-        if ((s->filter == TIPC_SUB_PORTS) || (s->filter == TIPC_SUB_SERVICE))
-                subscriber->swap = 0;
-        else
-                subscriber->swap = 1;
-
         /* Initialize subscription object */
 
         memset(sub, 0, sizeof(*sub));
@@ -296,8 +365,8 @@ static void subscr_subscribe(struct tipc_subscr *s,
         sub->seq.upper = htohl(s->seq.upper, subscriber->swap);
         sub->timeout = htohl(s->timeout, subscriber->swap);
         sub->filter = htohl(s->filter, subscriber->swap);
-        if ((((sub->filter != TIPC_SUB_PORTS) 
-              && (sub->filter != TIPC_SUB_SERVICE)))
+        if ((!(sub->filter & TIPC_SUB_PORTS)
+             == !(sub->filter & TIPC_SUB_SERVICE))
             || (sub->seq.lower > sub->seq.upper)) {
                 warn("Subscription rejected, illegal request\n");
                 kfree(sub);