12 files changed, 477 insertions, 59 deletions

diff --git a/net/tipc/Kconfig b/net/tipc/Kconfig
index 4f99600a5fed..c890848f9d56 100644
--- a/net/tipc/Kconfig
+++ b/net/tipc/Kconfig
@@ -31,3 +31,10 @@ config TIPC_PORTS
 
           Setting this to a smaller value saves some memory,
           setting it to higher allows for more ports.
+
+config TIPC_MEDIA_IB
+        bool "InfiniBand media type support"
+        depends on TIPC && INFINIBAND_IPOIB
+        help
+          Saying Y here will enable support for running TIPC on
+          IP-over-InfiniBand devices.
diff --git a/net/tipc/Makefile b/net/tipc/Makefile
index 6cd55d671d3a..4df8e02d9008 100644
--- a/net/tipc/Makefile
+++ b/net/tipc/Makefile
@@ -9,3 +9,5 @@ tipc-y	+= addr.o bcast.o bearer.o config.o \
            name_distr.o  subscr.o name_table.o net.o  \
            netlink.o node.o node_subscr.o port.o ref.o  \
            socket.o log.o eth_media.o
+
+tipc-$(CONFIG_TIPC_MEDIA_IB)    += ib_media.o
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index 2655c9f4ecad..e5f3da507823 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -584,8 +584,7 @@ static int tipc_bcbearer_send(struct sk_buff *buf,
 {
         int bp_index;
 
-        /*
-         * Prepare broadcast link message for reliable transmission,
+        /* Prepare broadcast link message for reliable transmission,
          * if first time trying to send it;
          * preparation is skipped for broadcast link protocol messages
          * since they are sent in an unreliable manner and don't need it
@@ -611,30 +610,43 @@ static int tipc_bcbearer_send(struct sk_buff *buf,
         for (bp_index = 0; bp_index < MAX_BEARERS; bp_index++) {
                 struct tipc_bearer *p = bcbearer->bpairs[bp_index].primary;
                 struct tipc_bearer *s = bcbearer->bpairs[bp_index].secondary;
+                struct tipc_bearer *b = p;
+                struct sk_buff *tbuf;
 
                 if (!p)
-                        break;  /* no more bearers to try */
+                        break; /* No more bearers to try */
+
+                if (tipc_bearer_blocked(p)) {
+                        if (!s || tipc_bearer_blocked(s))
+                                continue; /* Can't use either bearer */
+                        b = s;
+                }
 
-                tipc_nmap_diff(&bcbearer->remains, &p->nodes, &bcbearer->remains_new);
+                tipc_nmap_diff(&bcbearer->remains, &b->nodes,
+                               &bcbearer->remains_new);
                 if (bcbearer->remains_new.count == bcbearer->remains.count)
-                        continue;       /* bearer pair doesn't add anything */
+                        continue; /* Nothing added by bearer pair */
 
-                if (!tipc_bearer_blocked(p))
-                        tipc_bearer_send(p, buf, &p->media->bcast_addr);
-                else if (s && !tipc_bearer_blocked(s))
-                        /* unable to send on primary bearer */
-                        tipc_bearer_send(s, buf, &s->media->bcast_addr);
-                else
-                        /* unable to send on either bearer */
-                        continue;
+                if (bp_index == 0) {
+                        /* Use original buffer for first bearer */
+                        tipc_bearer_send(b, buf, &b->bcast_addr);
+                } else {
+                        /* Avoid concurrent buffer access */
+                        tbuf = pskb_copy(buf, GFP_ATOMIC);
+                        if (!tbuf)
+                                break;
+                        tipc_bearer_send(b, tbuf, &b->bcast_addr);
+                        kfree_skb(tbuf); /* Bearer keeps a clone */
+                }
 
+                /* Swap bearers for next packet */
                 if (s) {
                         bcbearer->bpairs[bp_index].primary = s;
                         bcbearer->bpairs[bp_index].secondary = p;
                 }
 
                 if (bcbearer->remains_new.count == 0)
-                        break;  /* all targets reached */
+                        break; /* All targets reached */
 
                 bcbearer->remains = bcbearer->remains_new;
         }
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index aa62f93a9127..cb29ef7ba2f0 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -39,7 +39,7 @@
 #include "bearer.h"
 #include "discover.h"
 
-#define MAX_ADDR_STR 32
+#define MAX_ADDR_STR 60
 
 static struct tipc_media *media_list[MAX_MEDIA];
 static u32 media_count;
@@ -89,9 +89,6 @@ int tipc_register_media(struct tipc_media *m_ptr)
 
         if ((strlen(m_ptr->name) + 1) > TIPC_MAX_MEDIA_NAME)
                 goto exit;
-        if ((m_ptr->bcast_addr.media_id != m_ptr->type_id) ||
-            !m_ptr->bcast_addr.broadcast)
-                goto exit;
         if (m_ptr->priority > TIPC_MAX_LINK_PRI)
                 goto exit;
         if ((m_ptr->tolerance < TIPC_MIN_LINK_TOL) ||
@@ -407,7 +404,7 @@ restart:
         INIT_LIST_HEAD(&b_ptr->links);
         spin_lock_init(&b_ptr->lock);
 
-        res = tipc_disc_create(b_ptr, &m_ptr->bcast_addr, disc_domain);
+        res = tipc_disc_create(b_ptr, &b_ptr->bcast_addr, disc_domain);
         if (res) {
                 bearer_disable(b_ptr);
                 pr_warn("Bearer <%s> rejected, discovery object creation failed\n",
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index 39f1192d04bf..09c869adcfcf 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -56,6 +56,7 @@
  * Identifiers of supported TIPC media types
  */
 #define TIPC_MEDIA_TYPE_ETH     1
+#define TIPC_MEDIA_TYPE_IB      2
 
 /**
  * struct tipc_media_addr - destination address used by TIPC bearers
@@ -77,7 +78,6 @@ struct tipc_bearer;
  * @enable_bearer: routine which enables a bearer
  * @disable_bearer: routine which disables a bearer
  * @addr2str: routine which converts media address to string
- * @str2addr: routine which converts media address from string
  * @addr2msg: routine which converts media address to protocol message area
  * @msg2addr: routine which converts media address from protocol message area
  * @bcast_addr: media address used in broadcasting
@@ -94,10 +94,9 @@ struct tipc_media {
         int (*enable_bearer)(struct tipc_bearer *b_ptr);
         void (*disable_bearer)(struct tipc_bearer *b_ptr);
         int (*addr2str)(struct tipc_media_addr *a, char *str_buf, int str_size);
-        int (*str2addr)(struct tipc_media_addr *a, char *str_buf);
         int (*addr2msg)(struct tipc_media_addr *a, char *msg_area);
-        int (*msg2addr)(struct tipc_media_addr *a, char *msg_area);
-        struct tipc_media_addr bcast_addr;
+        int (*msg2addr)(const struct tipc_bearer *b_ptr,
+                        struct tipc_media_addr *a, char *msg_area);
         u32 priority;
         u32 tolerance;
         u32 window;
@@ -136,6 +135,7 @@ struct tipc_bearer {
         char name[TIPC_MAX_BEARER_NAME];
         spinlock_t lock;
         struct tipc_media *media;
+        struct tipc_media_addr bcast_addr;
         u32 priority;
         u32 window;
         u32 tolerance;
@@ -175,6 +175,14 @@ int tipc_disable_bearer(const char *name);
 int  tipc_eth_media_start(void);
 void tipc_eth_media_stop(void);
 
+#ifdef CONFIG_TIPC_MEDIA_IB
+int  tipc_ib_media_start(void);
+void tipc_ib_media_stop(void);
+#else
+static inline int tipc_ib_media_start(void) { return 0; }
+static inline void tipc_ib_media_stop(void) { return; }
+#endif
+
 int tipc_media_set_priority(const char *name, u32 new_value);
 int tipc_media_set_window(const char *name, u32 new_value);
 void tipc_media_addr_printf(char *buf, int len, struct tipc_media_addr *a);
diff --git a/net/tipc/core.c b/net/tipc/core.c
index fc05cecd7481..7ec2c1eb94f1 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -82,6 +82,7 @@ static void tipc_core_stop_net(void)
 {
         tipc_net_stop();
         tipc_eth_media_stop();
+        tipc_ib_media_stop();
 }
 
 /**
@@ -93,8 +94,15 @@ int tipc_core_start_net(unsigned long addr)
 
         tipc_net_start(addr);
         res = tipc_eth_media_start();
-        if (res)
-                tipc_core_stop_net();
+        if (res < 0)
+                goto err;
+        res = tipc_ib_media_start();
+        if (res < 0)
+                goto err;
+        return res;
+
+err:
+        tipc_core_stop_net();
         return res;
 }
 
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index 1074b9587e81..eedff58d0387 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -129,7 +129,7 @@ void tipc_disc_recv_msg(struct sk_buff *buf, struct tipc_bearer *b_ptr)
         int link_fully_up;
 
         media_addr.broadcast = 1;
-        b_ptr->media->msg2addr(&media_addr, msg_media_addr(msg));
+        b_ptr->media->msg2addr(b_ptr, &media_addr, msg_media_addr(msg));
         kfree_skb(buf);
 
         /* Ensure message from node is valid and communication is permitted */
diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
index 2132c1ef2951..120a676a3360 100644
--- a/net/tipc/eth_media.c
+++ b/net/tipc/eth_media.c
@@ -77,12 +77,13 @@ static struct notifier_block notifier = {
  * Media-dependent "value" field stores MAC address in first 6 bytes
  * and zeroes out the remaining bytes.
  */
-static void eth_media_addr_set(struct tipc_media_addr *a, char *mac)
+static void eth_media_addr_set(const struct tipc_bearer *tb_ptr,
+                               struct tipc_media_addr *a, char *mac)
 {
         memcpy(a->value, mac, ETH_ALEN);
         memset(a->value + ETH_ALEN, 0, sizeof(a->value) - ETH_ALEN);
         a->media_id = TIPC_MEDIA_TYPE_ETH;
-        a->broadcast = !memcmp(mac, eth_media_info.bcast_addr.value, ETH_ALEN);
+        a->broadcast = !memcmp(mac, tb_ptr->bcast_addr.value, ETH_ALEN);
 }
 
 /**
@@ -110,6 +111,7 @@ static int send_msg(struct sk_buff *buf, struct tipc_bearer *tb_ptr,
 
         skb_reset_network_header(clone);
         clone->dev = dev;
+        clone->protocol = htons(ETH_P_TIPC);
         dev_hard_header(clone, dev, ETH_P_TIPC, dest->value,
                         dev->dev_addr, clone->len);
         dev_queue_xmit(clone);
@@ -201,9 +203,13 @@ static int enable_bearer(struct tipc_bearer *tb_ptr)
         /* Associate TIPC bearer with Ethernet bearer */
         eb_ptr->bearer = tb_ptr;
         tb_ptr->usr_handle = (void *)eb_ptr;
+        memset(tb_ptr->bcast_addr.value, 0, sizeof(tb_ptr->bcast_addr.value));
+        memcpy(tb_ptr->bcast_addr.value, dev->broadcast, ETH_ALEN);
+        tb_ptr->bcast_addr.media_id = TIPC_MEDIA_TYPE_ETH;
+        tb_ptr->bcast_addr.broadcast = 1;
         tb_ptr->mtu = dev->mtu;
         tb_ptr->blocked = 0;
-        eth_media_addr_set(&tb_ptr->addr, (char *)dev->dev_addr);
+        eth_media_addr_set(tb_ptr, &tb_ptr->addr, (char *)dev->dev_addr);
         return 0;
 }
 
@@ -302,25 +308,6 @@ static int eth_addr2str(struct tipc_media_addr *a, char *str_buf, int str_size)
 }
 
 /**
- * eth_str2addr - convert string to Ethernet address
- */
-static int eth_str2addr(struct tipc_media_addr *a, char *str_buf)
-{
-        char mac[ETH_ALEN];
-        int r;
-
-        r = sscanf(str_buf, "%02x:%02x:%02x:%02x:%02x:%02x",
-                       (u32 *)&mac[0], (u32 *)&mac[1], (u32 *)&mac[2],
-                       (u32 *)&mac[3], (u32 *)&mac[4], (u32 *)&mac[5]);
-
-        if (r != ETH_ALEN)
-                return 1;
-
-        eth_media_addr_set(a, mac);
-        return 0;
-}
-
-/**
  * eth_str2addr - convert Ethernet address format to message header format
  */
 static int eth_addr2msg(struct tipc_media_addr *a, char *msg_area)
@@ -334,12 +321,13 @@ static int eth_addr2msg(struct tipc_media_addr *a, char *msg_area)
 /**
  * eth_str2addr - convert message header address format to Ethernet format
  */
-static int eth_msg2addr(struct tipc_media_addr *a, char *msg_area)
+static int eth_msg2addr(const struct tipc_bearer *tb_ptr,
+                        struct tipc_media_addr *a, char *msg_area)
 {
         if (msg_area[TIPC_MEDIA_TYPE_OFFSET] != TIPC_MEDIA_TYPE_ETH)
                 return 1;
 
-        eth_media_addr_set(a, msg_area + ETH_ADDR_OFFSET);
+        eth_media_addr_set(tb_ptr, a, msg_area + ETH_ADDR_OFFSET);
         return 0;
 }
 
@@ -351,11 +339,8 @@ static struct tipc_media eth_media_info = {
         .enable_bearer  = enable_bearer,
         .disable_bearer = disable_bearer,
         .addr2str       = eth_addr2str,
-        .str2addr       = eth_str2addr,
         .addr2msg       = eth_addr2msg,
         .msg2addr       = eth_msg2addr,
-        .bcast_addr     = { { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
-                            TIPC_MEDIA_TYPE_ETH, 1 },
         .priority       = TIPC_DEF_LINK_PRI,
         .tolerance      = TIPC_DEF_LINK_TOL,
         .window         = TIPC_DEF_LINK_WIN,
diff --git a/net/tipc/ib_media.c b/net/tipc/ib_media.c
new file mode 100644
index 000000000000..2a2864c25e15
--- /dev/null
+++ b/net/tipc/ib_media.c
@@ -0,0 +1,387 @@
+/*
+ * net/tipc/ib_media.c: Infiniband bearer support for TIPC
+ *
+ * Copyright (c) 2013 Patrick McHardy <kaber@trash.net>
+ *
+ * Based on eth_media.c, which carries the following copyright notice:
+ *
+ * Copyright (c) 2001-2007, Ericsson AB
+ * Copyright (c) 2005-2008, 2011, Wind River Systems
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the names of the copyright holders nor the names of its
+ *    contributors may be used to endorse or promote products derived from
+ *    this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <linux/if_infiniband.h>
+#include "core.h"
+#include "bearer.h"
+
+#define MAX_IB_BEARERS          MAX_BEARERS
+
+/**
+ * struct ib_bearer - Infiniband bearer data structure
+ * @bearer: ptr to associated "generic" bearer structure
+ * @dev: ptr to associated Infiniband network device
+ * @tipc_packet_type: used in binding TIPC to Infiniband driver
+ * @cleanup: work item used when disabling bearer
+ */
+
+struct ib_bearer {
+        struct tipc_bearer *bearer;
+        struct net_device *dev;
+        struct packet_type tipc_packet_type;
+        struct work_struct setup;
+        struct work_struct cleanup;
+};
+
+static struct tipc_media ib_media_info;
+static struct ib_bearer ib_bearers[MAX_IB_BEARERS];
+static int ib_started;
+
+/**
+ * ib_media_addr_set - initialize Infiniband media address structure
+ *
+ * Media-dependent "value" field stores MAC address in first 6 bytes
+ * and zeroes out the remaining bytes.
+ */
+static void ib_media_addr_set(const struct tipc_bearer *tb_ptr,
+                              struct tipc_media_addr *a, char *mac)
+{
+        BUILD_BUG_ON(sizeof(a->value) < INFINIBAND_ALEN);
+        memcpy(a->value, mac, INFINIBAND_ALEN);
+        a->media_id = TIPC_MEDIA_TYPE_IB;
+        a->broadcast = !memcmp(mac, tb_ptr->bcast_addr.value, INFINIBAND_ALEN);
+}
+
+/**
+ * send_msg - send a TIPC message out over an InfiniBand interface
+ */
+static int send_msg(struct sk_buff *buf, struct tipc_bearer *tb_ptr,
+                    struct tipc_media_addr *dest)
+{
+        struct sk_buff *clone;
+        struct net_device *dev;
+        int delta;
+
+        clone = skb_clone(buf, GFP_ATOMIC);
+        if (!clone)
+                return 0;
+
+        dev = ((struct ib_bearer *)(tb_ptr->usr_handle))->dev;
+        delta = dev->hard_header_len - skb_headroom(buf);
+
+        if ((delta > 0) &&
+            pskb_expand_head(clone, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) {
+                kfree_skb(clone);
+                return 0;
+        }
+
+        skb_reset_network_header(clone);
+        clone->dev = dev;
+        clone->protocol = htons(ETH_P_TIPC);
+        dev_hard_header(clone, dev, ETH_P_TIPC, dest->value,
+                        dev->dev_addr, clone->len);
+        dev_queue_xmit(clone);
+        return 0;
+}
+
+/**
+ * recv_msg - handle incoming TIPC message from an InfiniBand interface
+ *
+ * Accept only packets explicitly sent to this node, or broadcast packets;
+ * ignores packets sent using InfiniBand multicast, and traffic sent to other
+ * nodes (which can happen if interface is running in promiscuous mode).
+ */
+static int recv_msg(struct sk_buff *buf, struct net_device *dev,
+                    struct packet_type *pt, struct net_device *orig_dev)
+{
+        struct ib_bearer *ib_ptr = (struct ib_bearer *)pt->af_packet_priv;
+
+        if (!net_eq(dev_net(dev), &init_net)) {
+                kfree_skb(buf);
+                return 0;
+        }
+
+        if (likely(ib_ptr->bearer)) {
+                if (likely(buf->pkt_type <= PACKET_BROADCAST)) {
+                        buf->next = NULL;
+                        tipc_recv_msg(buf, ib_ptr->bearer);
+                        return 0;
+                }
+        }
+        kfree_skb(buf);
+        return 0;
+}
+
+/**
+ * setup_bearer - setup association between InfiniBand bearer and interface
+ */
+static void setup_bearer(struct work_struct *work)
+{
+        struct ib_bearer *ib_ptr =
+                container_of(work, struct ib_bearer, setup);
+
+        dev_add_pack(&ib_ptr->tipc_packet_type);
+}
+
+/**
+ * enable_bearer - attach TIPC bearer to an InfiniBand interface
+ */
+static int enable_bearer(struct tipc_bearer *tb_ptr)
+{
+        struct net_device *dev = NULL;
+        struct net_device *pdev = NULL;
+        struct ib_bearer *ib_ptr = &ib_bearers[0];
+        struct ib_bearer *stop = &ib_bearers[MAX_IB_BEARERS];
+        char *driver_name = strchr((const char *)tb_ptr->name, ':') + 1;
+        int pending_dev = 0;
+
+        /* Find unused InfiniBand bearer structure */
+        while (ib_ptr->dev) {
+                if (!ib_ptr->bearer)
+                        pending_dev++;
+                if (++ib_ptr == stop)
+                        return pending_dev ? -EAGAIN : -EDQUOT;
+        }
+
+        /* Find device with specified name */
+        read_lock(&dev_base_lock);
+        for_each_netdev(&init_net, pdev) {
+                if (!strncmp(pdev->name, driver_name, IFNAMSIZ)) {
+                        dev = pdev;
+                        dev_hold(dev);
+                        break;
+                }
+        }
+        read_unlock(&dev_base_lock);
+        if (!dev)
+                return -ENODEV;
+
+        /* Create InfiniBand bearer for device */
+        ib_ptr->dev = dev;
+        ib_ptr->tipc_packet_type.type = htons(ETH_P_TIPC);
+        ib_ptr->tipc_packet_type.dev = dev;
+        ib_ptr->tipc_packet_type.func = recv_msg;
+        ib_ptr->tipc_packet_type.af_packet_priv = ib_ptr;
+        INIT_LIST_HEAD(&(ib_ptr->tipc_packet_type.list));
+        INIT_WORK(&ib_ptr->setup, setup_bearer);
+        schedule_work(&ib_ptr->setup);
+
+        /* Associate TIPC bearer with InfiniBand bearer */
+        ib_ptr->bearer = tb_ptr;
+        tb_ptr->usr_handle = (void *)ib_ptr;
+        memset(tb_ptr->bcast_addr.value, 0, sizeof(tb_ptr->bcast_addr.value));
+        memcpy(tb_ptr->bcast_addr.value, dev->broadcast, INFINIBAND_ALEN);
+        tb_ptr->bcast_addr.media_id = TIPC_MEDIA_TYPE_IB;
+        tb_ptr->bcast_addr.broadcast = 1;
+        tb_ptr->mtu = dev->mtu;
+        tb_ptr->blocked = 0;
+        ib_media_addr_set(tb_ptr, &tb_ptr->addr, (char *)dev->dev_addr);
+        return 0;
+}
+
+/**
+ * cleanup_bearer - break association between InfiniBand bearer and interface
+ *
+ * This routine must be invoked from a work queue because it can sleep.
+ */
+static void cleanup_bearer(struct work_struct *work)
+{
+        struct ib_bearer *ib_ptr =
+                container_of(work, struct ib_bearer, cleanup);
+
+        dev_remove_pack(&ib_ptr->tipc_packet_type);
+        dev_put(ib_ptr->dev);
+        ib_ptr->dev = NULL;
+}
+
+/**
+ * disable_bearer - detach TIPC bearer from an InfiniBand interface
+ *
+ * Mark InfiniBand bearer as inactive so that incoming buffers are thrown away,
+ * then get worker thread to complete bearer cleanup.  (Can't do cleanup
+ * here because cleanup code needs to sleep and caller holds spinlocks.)
+ */
+static void disable_bearer(struct tipc_bearer *tb_ptr)
+{
+        struct ib_bearer *ib_ptr = (struct ib_bearer *)tb_ptr->usr_handle;
+
+        ib_ptr->bearer = NULL;
+        INIT_WORK(&ib_ptr->cleanup, cleanup_bearer);
+        schedule_work(&ib_ptr->cleanup);
+}
+
+/**
+ * recv_notification - handle device updates from OS
+ *
+ * Change the state of the InfiniBand bearer (if any) associated with the
+ * specified device.
+ */
+static int recv_notification(struct notifier_block *nb, unsigned long evt,
+                             void *dv)
+{
+        struct net_device *dev = (struct net_device *)dv;
+        struct ib_bearer *ib_ptr = &ib_bearers[0];
+        struct ib_bearer *stop = &ib_bearers[MAX_IB_BEARERS];
+
+        if (!net_eq(dev_net(dev), &init_net))
+                return NOTIFY_DONE;
+
+        while ((ib_ptr->dev != dev)) {
+                if (++ib_ptr == stop)
+                        return NOTIFY_DONE;     /* couldn't find device */
+        }
+        if (!ib_ptr->bearer)
+                return NOTIFY_DONE;             /* bearer had been disabled */
+
+        ib_ptr->bearer->mtu = dev->mtu;
+
+        switch (evt) {
+        case NETDEV_CHANGE:
+                if (netif_carrier_ok(dev))
+                        tipc_continue(ib_ptr->bearer);
+                else
+                        tipc_block_bearer(ib_ptr->bearer->name);
+                break;
+        case NETDEV_UP:
+                tipc_continue(ib_ptr->bearer);
+                break;
+        case NETDEV_DOWN:
+                tipc_block_bearer(ib_ptr->bearer->name);
+                break;
+        case NETDEV_CHANGEMTU:
+        case NETDEV_CHANGEADDR:
+                tipc_block_bearer(ib_ptr->bearer->name);
+                tipc_continue(ib_ptr->bearer);
+                break;
+        case NETDEV_UNREGISTER:
+        case NETDEV_CHANGENAME:
+                tipc_disable_bearer(ib_ptr->bearer->name);
+                break;
+        }
+        return NOTIFY_OK;
+}
+
+static struct notifier_block notifier = {
+        .notifier_call  = recv_notification,
+        .priority       = 0,
+};
+
+/**
+ * ib_addr2str - convert InfiniBand address to string
+ */
+static int ib_addr2str(struct tipc_media_addr *a, char *str_buf, int str_size)
+{
+        if (str_size < 60)      /* 60 = 19 * strlen("xx:") + strlen("xx\0") */
+                return 1;
+
+        sprintf(str_buf, "%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:"
+                         "%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x",
+                a->value[0], a->value[1], a->value[2], a->value[3],
+                a->value[4], a->value[5], a->value[6], a->value[7],
+                a->value[8], a->value[9], a->value[10], a->value[11],
+                a->value[12], a->value[13], a->value[14], a->value[15],
+                a->value[16], a->value[17], a->value[18], a->value[19]);
+
+        return 0;
+}
+
+/**
+ * ib_addr2msg - convert InfiniBand address format to message header format
+ */
+static int ib_addr2msg(struct tipc_media_addr *a, char *msg_area)
+{
+        memset(msg_area, 0, TIPC_MEDIA_ADDR_SIZE);
+        msg_area[TIPC_MEDIA_TYPE_OFFSET] = TIPC_MEDIA_TYPE_IB;
+        memcpy(msg_area, a->value, INFINIBAND_ALEN);
+        return 0;
+}
+
+/**
+ * ib_msg2addr - convert message header address format to InfiniBand format
+ */
+static int ib_msg2addr(const struct tipc_bearer *tb_ptr,
+                       struct tipc_media_addr *a, char *msg_area)
+{
+        ib_media_addr_set(tb_ptr, a, msg_area);
+        return 0;
+}
+
+/*
+ * InfiniBand media registration info
+ */
+static struct tipc_media ib_media_info = {
+        .send_msg       = send_msg,
+        .enable_bearer  = enable_bearer,
+        .disable_bearer = disable_bearer,
+        .addr2str       = ib_addr2str,
+        .addr2msg       = ib_addr2msg,
+        .msg2addr       = ib_msg2addr,
+        .priority       = TIPC_DEF_LINK_PRI,
+        .tolerance      = TIPC_DEF_LINK_TOL,
+        .window         = TIPC_DEF_LINK_WIN,
+        .type_id        = TIPC_MEDIA_TYPE_IB,
+        .name           = "ib"
+};
+
+/**
+ * tipc_ib_media_start - activate InfiniBand bearer support
+ *
+ * Register InfiniBand media type with TIPC bearer code.  Also register
+ * with OS for notifications about device state changes.
+ */
+int tipc_ib_media_start(void)
+{
+        int res;
+
+        if (ib_started)
+                return -EINVAL;
+
+        res = tipc_register_media(&ib_media_info);
+        if (res)
+                return res;
+
+        res = register_netdevice_notifier(&notifier);
+        if (!res)
+                ib_started = 1;
+        return res;
+}
+
+/**
+ * tipc_ib_media_stop - deactivate InfiniBand bearer support
+ */
+void tipc_ib_media_stop(void)
+{
+        if (!ib_started)
+                return;
+
+        flush_scheduled_work();
+        unregister_netdevice_notifier(&notifier);
+        ib_started = 0;
+}
diff --git a/net/tipc/link.c b/net/tipc/link.c
index daa6080a2a0c..a80feee5197a 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -2306,8 +2306,11 @@ static int link_recv_changeover_msg(struct tipc_link **l_ptr,
         struct tipc_msg *tunnel_msg = buf_msg(tunnel_buf);
         u32 msg_typ = msg_type(tunnel_msg);
         u32 msg_count = msg_msgcnt(tunnel_msg);
+        u32 bearer_id = msg_bearer_id(tunnel_msg);
 
-        dest_link = (*l_ptr)->owner->links[msg_bearer_id(tunnel_msg)];
+        if (bearer_id >= MAX_BEARERS)
+                goto exit;
+        dest_link = (*l_ptr)->owner->links[bearer_id];
         if (!dest_link)
                 goto exit;
         if (dest_link == *l_ptr) {
@@ -2521,14 +2524,16 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb,
                 struct tipc_msg *imsg = (struct tipc_msg *)msg_data(fragm);
                 u32 msg_sz = msg_size(imsg);
                 u32 fragm_sz = msg_data_sz(fragm);
-                u32 exp_fragm_cnt = msg_sz/fragm_sz + !!(msg_sz % fragm_sz);
+                u32 exp_fragm_cnt;
                 u32 max =  TIPC_MAX_USER_MSG_SIZE + NAMED_H_SIZE;
+
                 if (msg_type(imsg) == TIPC_MCAST_MSG)
                         max = TIPC_MAX_USER_MSG_SIZE + MCAST_H_SIZE;
-                if (msg_size(imsg) > max) {
+                if (fragm_sz == 0 || msg_size(imsg) > max) {
                         kfree_skb(fbuf);
                         return 0;
                 }
+                exp_fragm_cnt = msg_sz / fragm_sz + !!(msg_sz % fragm_sz);
                 pbuf = tipc_buf_acquire(msg_size(imsg));
                 if (pbuf != NULL) {
                         pbuf->next = *pending;
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index 6675914dc592..8bcd4985d0fb 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -44,7 +44,7 @@ static int handle_cmd(struct sk_buff *skb, struct genl_info *info)
         struct nlmsghdr *rep_nlh;
         struct nlmsghdr *req_nlh = info->nlhdr;
         struct tipc_genlmsghdr *req_userhdr = info->userhdr;
-        int hdr_space = NLMSG_SPACE(GENL_HDRLEN + TIPC_GENL_HDRLEN);
+        int hdr_space = nlmsg_total_size(GENL_HDRLEN + TIPC_GENL_HDRLEN);
         u16 cmd;
 
         if ((req_userhdr->cmd & 0xC000) && (!capable(CAP_NET_ADMIN)))
@@ -53,8 +53,8 @@ static int handle_cmd(struct sk_buff *skb, struct genl_info *info)
                 cmd = req_userhdr->cmd;
 
         rep_buf = tipc_cfg_do_cmd(req_userhdr->dest, cmd,
-                        NLMSG_DATA(req_nlh) + GENL_HDRLEN + TIPC_GENL_HDRLEN,
-                        NLMSG_PAYLOAD(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN),
+                        nlmsg_data(req_nlh) + GENL_HDRLEN + TIPC_GENL_HDRLEN,
+                        nlmsg_attrlen(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN),
                         hdr_space);
 
         if (rep_buf) {
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index a9622b6cd916..515ce38e4f4c 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -790,6 +790,7 @@ static void set_orig_addr(struct msghdr *m, struct tipc_msg *msg)
         if (addr) {
                 addr->family = AF_TIPC;
                 addr->addrtype = TIPC_ADDR_ID;
+                memset(&addr->addr, 0, sizeof(addr->addr));
                 addr->addr.id.ref = msg_origport(msg);
                 addr->addr.id.node = msg_orignode(msg);
                 addr->addr.name.domain = 0;     /* could leave uninitialized */
@@ -904,6 +905,9 @@ static int recv_msg(struct kiocb *iocb, struct socket *sock,
                 goto exit;
         }
 
+        /* will be updated in set_orig_addr() if needed */
+        m->msg_namelen = 0;
+
         timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 restart:
 
@@ -1013,6 +1017,9 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
                 goto exit;
         }
 
+        /* will be updated in set_orig_addr() if needed */
+        m->msg_namelen = 0;
+
         target = sock_rcvlowat(sk, flags & MSG_WAITALL, buf_len);
         timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);