/*
 **************************************************************************
 * Copyright (c) 2014-2021, The Linux Foundation. All rights reserved.
 * Permission to use, copy, modify, and/or distribute this software for
 * any purpose with or without fee is hereby granted, provided that the
 * above copyright notice and this permission notice appear in all copies.
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
 * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 **************************************************************************
 */

/*
 * nss_capwapmgr.c
 *	NSS to HLOS CAPWAP manager
 */
#include <linux/types.h>
#include <linux/ip.h>
#include <linux/of.h>
#include <linux/tcp.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <net/ipv6.h>
#include <linux/version.h>

#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3,9,0))
#include <net/ipip.h>
#else
#include <net/ip_tunnels.h>
#endif

#include <linux/if_arp.h>
#include <linux/etherdevice.h>
#include <nss_api_if.h>
#include <linux/in.h>
#include <nss_cmn.h>
#include <nss_capwap.h>
#include <nss_capwapmgr.h>
#include <nss_capwap_user.h>
#include <fal/fal_qos.h>
#include <fal/fal_acl.h>

#define NSS_CAPWAPMGR_NETDEV_NAME	"nsscapwap"

/*
 * This file is responsible for interacting with qca-nss-drv's
 * CAPWAP API to manage CAPWAP tunnels.
 *
 * This driver also exposes few APIs which can be used by
 * another module to perform operations on CAPWAP tunnels. However, we create
 * one netdevice for all the CAPWAP tunnels which is done at the module's
 * init time if NSS_CAPWAPMGR_ONE_NETDEV is set in the Makefile.
 *
 * If your requirement is to create one netdevice per-CAPWAP tunnel, then
 * netdevice needs to be created before CAPWAP tunnel create. Netdevice are
 * created using nss_capwapmgr_netdev_create() API.
 *
 */

/*
 * NSS capwap mgr macros
 */
#define NSS_CAPWAPMGR_NORMAL_FRAME_MTU 1500

/*
 * Ethernet types.
 */
#define NSS_CAPWAPMGR_ETH_TYPE_MASK 0xFFFF
#define NSS_CAPWAPMGR_ETH_TYPE_TRUSTSEC 0x8909
#define NSS_CAPWAPMGR_ETH_TYPE_IPV4 ETH_P_IP
#define NSS_CAPWAPMGR_ETH_TYPE_IPV6 ETH_P_IPV6
#define NSS_CAPWAPMGR_DSCP_MAX 64

/*
 * ACL specific parameters.
 */
#define NSS_CAPWAPMGR_ETH_HDR_OFFSET 6
#define NSS_CAPWAPMGR_IPV4_OFFSET 8
#define NSS_CAPWAPMGR_DSCP_MASK_IPV4_SHIFT 2
#define NSS_CAPWAPMGR_DSCP_MASK_IPV6_SHIFT 6
#define NSS_CAPWAPMGR_DEV_ID 0
#define NSS_CAPWAPMGR_GROUP_ID 0
#define NSS_CAPWAPMGR_RULE_NR 1

/*
 * ACL rule bind bitmap for all physical ports (1 through 6)
 */
#define NSS_CAPWAPMGR_BIND_BITMAP 0x7E

/*
 * We need 4 ACL rules - 2 rules for each v4 and v6 classification.
 */
#define NSS_CAPWAPMGR_ACL_RULES_PER_LIST 4

/*
 * We currently have list-id 60 reserved for this purpose.
 * TODO: Find a better approach to reserve list-id.
 */
#define NSS_CAPWAPMGR_ACL_LIST_START 60
#define NSS_CAPWAPMGR_ACL_LIST_CNT 1

#define NSS_CAPWAPMGR_NORMAL_FRAME_MTU 1500

#if (NSS_CAPWAPMGR_DEBUG_LEVEL < 1)
#define nss_capwapmgr_assert(fmt, args...)
#else
#define nss_capwapmgr_assert(c) if (!(c)) { BUG_ON(!(c)); }
#endif /* NSS_CAPWAPMGR_DEBUG_LEVEL */

/*
 * Compile messages for dynamic enable/disable
 */
#if defined(CONFIG_DYNAMIC_DEBUG)
#define nss_capwapmgr_warn(s, ...) pr_debug("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__)
#define nss_capwapmgr_info(s, ...) pr_debug("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__)
#define nss_capwapmgr_trace(s, ...) pr_debug("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__)
#else /* CONFIG_DYNAMIC_DEBUG */
/*
 * Statically compile messages at different levels
 */
#if (NSS_CAPWAPMGR_DEBUG_LEVEL < 2)
#define nss_capwapmgr_warn(s, ...)
#else
#define nss_capwapmgr_warn(s, ...) pr_warn("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__)
#endif

#if (NSS_CAPWAPMGR_DEBUG_LEVEL < 3)
#define nss_capwapmgr_info(s, ...)
#else
#define nss_capwapmgr_info(s, ...)   pr_notice("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__)
#endif

#if (NSS_CAPWAPMGR_DEBUG_LEVEL < 4)
#define nss_capwapmgr_trace(s, ...)
#else
#define nss_capwapmgr_trace(s, ...)  pr_info("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__)
#endif
#endif /* CONFIG_DYNAMIC_DEBUG */

/*
 * nss_capwapmgr_ip_response
 *	Response structure for IPv4 and IPv6 messages
 */
static struct nss_capwapmgr_ip_response {
	struct semaphore sem;
	wait_queue_head_t wq;
	enum nss_cmn_response response;
	bool cond;
} ip_response;

/*
 * nss_capwapmgr_acl
 *	Object containing rule related info.
 */
struct nss_capwapmgr_acl {
	bool in_use;			/* Set when rule is in use. */
	uint8_t uid;			/* Unique ID for this rule object. */
	uint8_t list_id;		/* List on which this rule resides. */
	uint8_t rule_id;		/* Rule-id of this rule. */
	uint8_t dscp_value;		/* DSCP value */
	uint8_t dscp_mask;		/* DSCP mask */
};

/*
 * nss_capwapmgr_acl_list
 */
struct nss_capwapmgr_acl_list {
	struct nss_capwapmgr_acl rule[NSS_CAPWAPMGR_ACL_RULES_PER_LIST];
					/* Rules on this ACL list. */
};

/*
 * nss_capwapmgr_global
 *	Global structure for capwapmgr.
 */
static struct nss_capwapmgr_global {
	uint32_t count;				/* Counter for driver queue selection. */
	struct nss_capwap_tunnel_stats tunneld;	/* What tunnels that don't exist any more. */
	struct nss_capwapmgr_acl_list acl_list[NSS_CAPWAPMGR_ACL_LIST_CNT];
						/* Set when ACL rule is in use. */
} global;

static void nss_capwapmgr_receive_pkt(struct net_device *dev, struct sk_buff *skb, struct napi_struct *napi);

#if defined(NSS_CAPWAPMGR_ONE_NETDEV)
/*
 * If you want only one netdev for all the tunnels. If you don't want
 * to create one netdev for all the tunnels, then netdev must be
 * created using nss_capwapmgr_netdev_create() before every tunnel create
 * operation.
 */
static struct net_device *nss_capwapmgr_ndev = NULL;
#endif

/*
 * nss_capwapmgr_open()
 *	Netdev's open call.
 */
static int nss_capwapmgr_open(struct net_device *dev)
{
	netif_start_queue(dev);
	return 0;
}

/*
 * nss_capwapmgr_close()
 *	Netdev's close call.
 */
static int nss_capwapmgr_close(struct net_device *dev)
{
	netif_stop_queue(dev);
	return 0;
}

/*
 * nss_capwapmgr_decongestion_callback()
 *	Wakeup netif queue if we were stopped by start_xmit
 */
static void nss_capwapmgr_decongestion_callback(void *arg)
{
	struct net_device *dev = arg;

	if (netif_queue_stopped(dev)) {
		netif_wake_queue(dev);
	}
}

/*
 * nss_capwapmgr_start_xmit()
 *	Transmit's skb to NSS FW over CAPWAP if_num_inner.
 *
 * Please make sure to leave headroom of NSS_CAPWAP_HEADROOM with every
 * packet so that NSS can encap eth,vlan,ip,udp,capwap headers.
 * Also, skb->len must include size of metaheader. Essentially skb->len is
 * size of CAPWAP Payload (including wireless info sections) and metaheader.
 */
static netdev_tx_t nss_capwapmgr_start_xmit(struct sk_buff *skb, struct net_device *dev)
{
	struct net_device_stats *stats = &dev->stats;
	struct nss_capwapmgr_priv *priv;
	struct nss_capwap_metaheader *pre;
	uint32_t if_num_inner;
	nss_tx_status_t status;

	priv = netdev_priv(dev);
	pre = (struct nss_capwap_metaheader *)skb->data;

	if (unlikely(pre->tunnel_id > NSS_CAPWAPMGR_MAX_TUNNELS)) {
		nss_capwapmgr_warn("%px: (CAPWAP packet) tunnel-id invalid: %d\n", dev, pre->tunnel_id);
		kfree_skb(skb);
		stats->tx_dropped++;
		return NETDEV_TX_OK;
	}

	if_num_inner = priv->tunnel[pre->tunnel_id].if_num_inner;
	if (unlikely(if_num_inner == -1)) {
		nss_capwapmgr_warn("%px: (CAPWAP packet) if_num_inner in the tunnel not set pre->tunnel_id %d\n", dev,
				pre->tunnel_id);
		kfree_skb(skb);
		stats->tx_dropped++;
		return NETDEV_TX_OK;
	}

	/*
	 * We use the lowest bit in the inner flow_id to determine which Tx ring
	 * to use (drv uses queue mapping to select Tx ring).
	 *
	 * This ring distribution will in turn get used in NSS firmware
	 * for better thread distribution of encap operation.
	 */
	skb_set_queue_mapping(skb, pre->flow_id & 0x1);

	status = nss_capwap_tx_buf(priv->nss_ctx, skb, if_num_inner);
	if (unlikely(status != NSS_TX_SUCCESS)) {
		if (status == NSS_TX_FAILURE_QUEUE) {
			nss_capwapmgr_warn("%px: netdev :%px queue is full", dev, dev);
			if (!netif_queue_stopped(dev)) {
				netif_stop_queue(dev);
			}
		}

		return NETDEV_TX_BUSY;
	}

	return NETDEV_TX_OK;
}

/*
 * nss_capwapmgr_fill_up_stats()
 *	Fills up stats in netdev's stats.
 */
static void nss_capwapmgr_fill_up_stats(struct rtnl_link_stats64 *stats, struct nss_capwap_tunnel_stats *tstats)
{
	stats->rx_packets += tstats->pnode_stats.rx_packets;
	stats->rx_dropped += tstats->pnode_stats.rx_dropped;

	/* rx_fifo_errors will appear as rx overruns in ifconfig */
	stats->rx_fifo_errors += (tstats->rx_n2h_drops + tstats->rx_n2h_queue_full_drops);
	stats->rx_errors += (tstats->rx_mem_failure_drops + tstats->rx_oversize_drops + tstats->rx_frag_timeout_drops);
	stats->rx_bytes += tstats->pnode_stats.rx_bytes;

	/* tx_fifo_errors  will appear as tx overruns in ifconfig */
	stats->tx_fifo_errors += tstats->tx_queue_full_drops;
	stats->tx_errors += tstats->tx_mem_failure_drops;
	stats->tx_bytes += tstats->pnode_stats.tx_bytes;

	stats->tx_dropped += (tstats->tx_dropped_sg_ref + tstats->tx_dropped_ver_mis + tstats->tx_dropped_hroom
			 + tstats->tx_dropped_dtls + tstats->tx_dropped_nwireless);
	stats->tx_packets += tstats->pnode_stats.tx_packets;
}

/*
 * nss_capwapmgr_get_tunnel_stats()
 *	Netdev get stats function to get tunnel stats
 */
static struct rtnl_link_stats64 *nss_capwapmgr_get_tunnel_stats(struct net_device *dev, struct rtnl_link_stats64 *stats)
{
	struct nss_capwap_tunnel_stats tstats;
	int i;

	if (!stats) {
		nss_capwapmgr_warn("%px: invalid rtnl structure\n", dev);
		return stats;
	}

	/*
	 * Netdev seems to be incrementing rx_dropped because we don't give IP header.
	 * So reset it as it's of no use for us.
	 */
	atomic_long_set(&dev->rx_dropped, 0);

	memset(stats, 0, sizeof (struct rtnl_link_stats64));
	nss_capwapmgr_fill_up_stats(stats, &global.tunneld);

	for (i = NSS_DYNAMIC_IF_START; i <= (NSS_DYNAMIC_IF_START + NSS_MAX_DYNAMIC_INTERFACES); i++) {
		if (nss_capwap_get_stats(i, &tstats) == false) {
			continue;
		}

		nss_capwapmgr_fill_up_stats(stats, &tstats);
	}

	return stats;
}

#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 6, 0))
/*
 * nss_capwapmgr_dev_tunnel_stats()
 *	Netdev ops function to retrieve stats for kernel version < 4.6
 */
static struct rtnl_link_stats64 *nss_capwapmgr_dev_tunnel_stats(struct net_device *dev, struct rtnl_link_stats64 *stats)
{
	return nss_capwapmgr_get_tunnel_stats(dev, stats);
}
#else
/*
 * nss_capwapmgr_dev_tunnel_stats()
 *	Netdev ops function to retrieve stats for kernel version > 4.6
 */
static void nss_capwapmgr_dev_tunnel_stats(struct net_device *dev, struct rtnl_link_stats64 *stats)
{
	nss_capwapmgr_get_tunnel_stats(dev, stats);
}
#endif

/*
 * nss_capwapmgr_netdev_ops
 *	Netdev operations.
 */
static const struct net_device_ops nss_capwapmgr_netdev_ops = {
	.ndo_open		= nss_capwapmgr_open,
	.ndo_stop		= nss_capwapmgr_close,
	.ndo_start_xmit		= nss_capwapmgr_start_xmit,
	.ndo_set_mac_address	= eth_mac_addr,
	.ndo_change_mtu		= eth_change_mtu,
	.ndo_get_stats64	= nss_capwapmgr_dev_tunnel_stats,
};

/*
 * nss_capwapmgr_dummpy_netdev_setup()
 *	Netdev setup function.
 */
static void nss_capwapmgr_dummpy_netdev_setup(struct net_device *dev)
{
	dev->addr_len = ETH_ALEN;
	dev->mtu = ETH_DATA_LEN;
	dev->needed_headroom = NSS_CAPWAP_HEADROOM;
	dev->needed_tailroom = 4;
	dev->type = ARPHRD_VOID;
	dev->ethtool_ops = NULL;
	dev->header_ops = NULL;
	dev->netdev_ops = &nss_capwapmgr_netdev_ops;

#if (LINUX_VERSION_CODE <= KERNEL_VERSION(4, 11, 8))
	dev->destructor = NULL;
#else
	dev->priv_destructor = NULL;
#endif
	memcpy(dev->dev_addr, "\x00\x00\x00\x00\x00\x00", dev->addr_len);
	memset(dev->broadcast, 0xff, dev->addr_len);
	memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
}

/*
 * nss_capwapmgr_msg_event_receive()
 *	CAPWAP message callback for responses to commands sent to NSS FW
 *
 * This is command hanlder for all the messages since all we do is wake-up
 * the caller who is sending message to NSS FW.
 */
static void nss_capwapmgr_msg_event_receive(void *app_data, struct nss_capwap_msg *nim)
{
	struct net_device *dev = app_data;
	struct nss_cmn_msg *ncm = (struct nss_cmn_msg *)nim;
	struct nss_capwapmgr_response *r;
	struct nss_capwapmgr_priv *priv;
	uint32_t if_num;

	if (ncm->response == NSS_CMN_RESPONSE_NOTIFY) {
		return;
	}

	/*
	 * Since all CAPWAP messages are sync in nature we need to wake-up caller.
	 */
	if_num = ncm->interface - NSS_DYNAMIC_IF_START;
	dev_hold(dev);
	priv = netdev_priv(dev);
	r = &priv->resp[if_num];

	/*
	 * If somebody is waiting...
	 */
	if (atomic_read(&r->seq) != 0) {
		if (ncm->response != NSS_CMN_RESPONSE_ACK) {
			r->error = ncm->error;
		}

		r->response = ncm->response;
		atomic_dec(&r->seq);
		wake_up(&r->wq);
	}

	dev_put(dev);
}
/*
 * nss_capwapmgr_ip_common_handler()
 *	Common Callback handler for IPv4 and IPv6 messages
 */
static void nss_capwapmgr_ip_common_handler(struct nss_cmn_msg *ncm)
{
	if (ncm->response == NSS_CMN_RESPONSE_NOTIFY) {
		return;
	}

	ip_response.response = ncm->response;
	ip_response.cond = 0;
	wake_up(&ip_response.wq);
}

/*
 * nss_capwapmgr_ipv4_handler()
 *	Callback handler for IPv4 messages
 */
static void nss_capwapmgr_ipv4_handler(void *app_data, struct nss_ipv4_msg *nim)
{
	nss_capwapmgr_ip_common_handler(&nim->cm);
}

/*
 * nss_capwapmgr_ipv6_handler()
 *	Callback handler for IPv4 messages
 */
static void nss_capwapmgr_ipv6_handler(void *app_data, struct nss_ipv6_msg *nim)
{
	nss_capwapmgr_ip_common_handler(&nim->cm);
}

/*
 * nss_capwap_remap_error()
 *	Remaps NSS FW response error to nss_capwapmgr_status_t
 */
static nss_capwapmgr_status_t nss_capwap_remap_error(nss_capwap_msg_response_t error)
{
	nss_capwapmgr_status_t status;

	switch (error) {
	case NSS_CAPWAP_ERROR_MSG_INVALID_REASSEMBLY_TIMEOUT:
		status = NSS_CAPWAPMGR_FAILURE_INVALID_REASSEMBLY_TIMEOUT;
		break;
	case NSS_CAPWAP_ERROR_MSG_INVALID_PATH_MTU:
		status = NSS_CAPWAPMGR_FAILURE_INVALID_PATH_MTU;
		break;
	case NSS_CAPWAP_ERROR_MSG_INVALID_MAX_FRAGMENT:
		status = NSS_CAPWAPMGR_FAILURE_INVALID_MAX_FRAGMENT;
		break;
	case NSS_CAPWAP_ERROR_MSG_INVALID_BUFFER_SIZE:
		status = NSS_CAPWAPMGR_FAILURE_INVALID_BUFFER_SIZE;
		break;
	case NSS_CAPWAP_ERROR_MSG_INVALID_L3_PROTO:
		status = NSS_CAPWAPMGR_FAILURE_INVALID_L3_PROTO;
		break;
	case NSS_CAPWAP_ERROR_MSG_INVALID_UDP_PROTO:
		status = NSS_CAPWAPMGR_FAILURE_INVALID_UDP_PROTO;
		break;
	case NSS_CAPWAP_ERROR_MSG_INVALID_VERSION:
		status = NSS_CAPWAPMGR_FAILURE_INVALID_VERSION;
		break;
	case NSS_CAPWAP_ERROR_MSG_TUNNEL_DISABLED:
		status = NSS_CAPWAPMGR_FAILURE_TUNNEL_DISABLED;
		break;
	case NSS_CAPWAP_ERROR_MSG_TUNNEL_ENABLED:
		status = NSS_CAPWAPMGR_FAILURE_TUNNEL_ENABLED;
		break;
	case NSS_CAPWAP_ERROR_MSG_TUNNEL_NOT_CFG:
		status = NSS_CAPWAPMGR_FAILURE_TUNNEL_NOT_CFG;
		break;
	case NSS_CAPWAP_ERROR_MSG_INVALID_IP_NODE:
		status = NSS_CAPWAPMGR_FAILURE_INVALID_IP_NODE;
		break;
	case NSS_CAPWAP_ERROR_MSG_INVALID_TYPE_FLAG:
		status = NSS_CAPWAPMGR_FAILURE_INVALID_TYPE_FLAG;
		break;
	case NSS_CAPWAP_ERROR_MSG_INVALID_DTLS_CFG:
		status = NSS_CAPWAPMGR_FAILURE_INVALID_DTLS_CFG;
		break;
	default:
		status = NSS_CAPWAPMGR_FAILURE;
	}

	return status;
}

/*
 * nss_capwapmgr_verify_tunnel_param()
 *	Common function to verify tunnel_id and returns pointer to tunnel.
 *
 * The caller of the function should hold reference to the net device before calling.
 */
static struct nss_capwapmgr_tunnel *nss_capwapmgr_verify_tunnel_param(struct net_device *dev, uint8_t tunnel_id)
{
	struct nss_capwapmgr_priv *priv;
	struct nss_capwapmgr_tunnel *t;

	if (!dev) {
		nss_capwapmgr_warn("Invalid net_device\n");
		return NULL;
	}

	if (tunnel_id > NSS_CAPWAPMGR_MAX_TUNNELS) {
		nss_capwapmgr_warn("%px: tunnel_id: %d out of range (%d)\n", dev, tunnel_id, NSS_CAPWAPMGR_MAX_TUNNELS);
		return NULL;
	}

	priv = netdev_priv(dev);
	t = &priv->tunnel[tunnel_id];
	if ( (t->if_num_inner == -1) || (t->if_num_outer == -1) ) {
		return NULL;
	}

	return t;
}

/*
 * nss_capwapmgr_netdev_create()
 *	API to create a CAPWAP netdev
 */
struct net_device *nss_capwapmgr_netdev_create()
{
	struct nss_capwapmgr_priv *priv;
	struct nss_capwapmgr_response *r;
	struct net_device *ndev;
	int i;
	int err;

#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3, 16, 0))
	ndev = alloc_netdev(sizeof(struct nss_capwapmgr_priv),
					"nsscapwap%d", nss_capwapmgr_dummpy_netdev_setup);
#else
	ndev = alloc_netdev(sizeof(struct nss_capwapmgr_priv),
					"nsscapwap%d", NET_NAME_ENUM, nss_capwapmgr_dummpy_netdev_setup);
#endif
	if (!ndev) {
		nss_capwapmgr_warn("Error allocating netdev\n");
		return NULL;
	}

	err = register_netdev(ndev);
	if (err) {
		nss_capwapmgr_warn("register_netdev() fail with error :%d\n", err);
		free_netdev(ndev);
		return NULL;
	}

	priv = netdev_priv(ndev);
	priv->nss_ctx = nss_capwap_get_ctx();
	priv->tunnel = kmalloc(sizeof(struct nss_capwapmgr_tunnel) * NSS_CAPWAPMGR_MAX_TUNNELS, GFP_ATOMIC);
	if (!priv->tunnel) {
		nss_capwapmgr_warn("%px: failed to allocate tunnel memory\n", ndev);
		goto fail1;
	}
	memset(priv->tunnel, 0, sizeof(struct nss_capwapmgr_tunnel) * NSS_CAPWAPMGR_MAX_TUNNELS);
	for (i = 0; i < NSS_CAPWAPMGR_MAX_TUNNELS; i++) {
		priv->tunnel[i].if_num_inner = -1;
		priv->tunnel[i].if_num_outer = -1;
	}

	priv->resp = kmalloc(sizeof(struct nss_capwapmgr_response) * NSS_MAX_DYNAMIC_INTERFACES, GFP_ATOMIC);
	if (!priv->resp) {
		nss_capwapmgr_warn("%px: failed to allocate tunnel response memory\n", ndev);
		goto fail2;
	}
	for (i = 0; i < NSS_MAX_DYNAMIC_INTERFACES; i++) {
		r = &priv->resp[i];
		init_waitqueue_head(&r->wq);

		/*
		 * CAPWAP interface is limited to one command per-tunnel.
		 */
		sema_init(&r->sem, 1);
	}

	priv->if_num_to_tunnel_id = kmalloc(sizeof(uint8_t) * NSS_MAX_NET_INTERFACES, GFP_ATOMIC);
	if (!priv->if_num_to_tunnel_id) {
		nss_capwapmgr_warn("%px: failed to allocate if_num to tunnel_id memory\n", ndev);
		goto fail3;
	}
	memset(priv->if_num_to_tunnel_id, 0, sizeof(uint8_t) * NSS_MAX_NET_INTERFACES);

	if (nss_cmn_register_queue_decongestion(priv->nss_ctx, nss_capwapmgr_decongestion_callback, ndev) != NSS_CB_REGISTER_SUCCESS) {
		nss_capwapmgr_warn("%px: failed to register decongestion callback\n", ndev);
		goto fail4;
	}

	return ndev;
fail4:
	kfree(priv->if_num_to_tunnel_id);
fail3:
	kfree(priv->resp);
fail2:
	kfree(priv->tunnel);
fail1:
	unregister_netdev(ndev);
	free_netdev(ndev);
	return NULL;
}
EXPORT_SYMBOL(nss_capwapmgr_netdev_create);

/*
 * nss_capwapmgr_netdev_destroy()
 *	API for destroying a netdevice.
 *
 * All the CAPWAP tunnels must be destroyed first before netdevice.
 */
nss_capwapmgr_status_t nss_capwapmgr_netdev_destroy(struct net_device *dev)
{
	rtnl_is_locked() ? unregister_netdevice(dev) : unregister_netdev(dev);
	return NSS_CAPWAPMGR_SUCCESS;
}
EXPORT_SYMBOL(nss_capwapmgr_netdev_destroy);

/*
 * nss_capwapmgr_register_with_nss()
 *	Internal function to register with NSS FW.
 */
static nss_capwapmgr_status_t nss_capwapmgr_register_with_nss(uint32_t interface_num, struct net_device *dev)
{
	struct nss_ctx_instance *ctx;

	/* features denote the skb_types supported */
	uint32_t features = 0;

	ctx = nss_capwap_data_register(interface_num, nss_capwapmgr_receive_pkt, dev, features);
	if (!ctx) {
		nss_capwapmgr_warn("%px: %d: nss_capwapmgr_data_register failed\n", dev, interface_num);
		return NSS_CAPWAPMGR_FAILURE;
	}

	return NSS_CAPWAPMGR_SUCCESS;
}

/*
 * nss_capwapmgr_unregister_with_nss()
 *	Internal function to unregister with NSS FW
 */
static void nss_capwapmgr_unregister_with_nss(uint32_t if_num)
{
	nss_capwapmgr_trace("%d: unregister with NSS FW\n", if_num);
	nss_capwap_data_unregister(if_num);
}

/*
 * nss_capwapmgr_destroy_ipv4_rule()
 *	Destroy a given connection in the NSS
 */
static nss_tx_status_t nss_capwapmgr_destroy_ipv4_rule(void *ctx, struct nss_ipv4_destroy *unid)
{
	struct nss_ctx_instance *nss_ctx = (struct nss_ctx_instance *) ctx;
	struct nss_ipv4_msg nim;
	struct nss_ipv4_rule_destroy_msg *nirdm;
	nss_tx_status_t status;

	nss_capwapmgr_info("%px: ctx: Destroy IPv4: %pI4h:%d, %pI4h:%d, p: %d\n", nss_ctx,
		&unid->src_ip, ntohs(unid->src_port), &unid->dest_ip, ntohs(unid->dest_port), unid->protocol);

	nss_ipv4_msg_init(&nim, NSS_IPV4_RX_INTERFACE, NSS_IPV4_TX_DESTROY_RULE_MSG,
			sizeof(struct nss_ipv4_rule_destroy_msg), nss_capwapmgr_ipv4_handler, NULL);

	nirdm = &nim.msg.rule_destroy;

	nirdm->tuple.protocol = (uint8_t)unid->protocol;
	nirdm->tuple.flow_ip = unid->src_ip;
	nirdm->tuple.flow_ident = (uint32_t)unid->src_port;
	nirdm->tuple.return_ip = unid->dest_ip;
	nirdm->tuple.return_ident = (uint32_t)unid->dest_port;

	down(&ip_response.sem);
	status = nss_ipv4_tx(nss_ctx, &nim);
	if (status != NSS_TX_SUCCESS) {
		up(&ip_response.sem);
		nss_capwapmgr_warn("%px: Destroy IPv4 message failed %d\n", ctx, status);
		return status;
	}

	ip_response.cond = 1;
	if (!wait_event_timeout(ip_response.wq, ip_response.cond == 0, 5 * HZ)) {
		nss_capwapmgr_warn("%px: Destroy IPv4 command msg response timeout\n", ctx);
		status = NSS_TX_FAILURE;
	} else if (ip_response.response != NSS_CMN_RESPONSE_ACK) {
		nss_capwapmgr_warn("%px: Destroy IPv4 command msg failed with response : %d\n", ctx, ip_response.response);
		status = NSS_TX_FAILURE;
	}

	up(&ip_response.sem);
	return status;
}

/*
 * nss_capwapmgr_unconfigure_ipv4_rule()
 *	Internal function to unconfigure IPv4 rule.
 */
static nss_tx_status_t nss_capwapmgr_unconfigure_ipv4_rule(struct nss_ipv4_destroy *destroy)
{
	void *ctx;

	ctx = nss_ipv4_get_mgr();
	if (!ctx) {
		nss_capwapmgr_warn("%s: couldn't get IPv4 ctx\n", "CAPWAP");
		return NSS_TX_FAILURE_NOT_READY;
	}

	return nss_capwapmgr_destroy_ipv4_rule(ctx, destroy);
}

/*
 * nss_capwapmgr_unconfigure_ipv6_rule()
 *	Internal function to unconfigure IPv6 rule.
 */
static nss_tx_status_t nss_capwapmgr_unconfigure_ipv6_rule(struct nss_ipv6_destroy *unid)
{
	struct nss_ctx_instance *nss_ctx;
	struct nss_ipv6_msg nim;
	struct nss_ipv6_rule_destroy_msg *nirdm;
	nss_tx_status_t status;

	nss_ctx = nss_ipv6_get_mgr();
	if (!nss_ctx) {
		nss_capwapmgr_warn("%s: couldn't get IPv6 ctx\n", "CAPWAP");
		return NSS_TX_FAILURE_NOT_READY;
	}

	nss_capwapmgr_info("%px: ctx: Destroy IPv4: %x:%d, %x:%d, p: %d\n", nss_ctx,
		unid->src_ip[0], ntohs(unid->src_port), unid->dest_ip[0], ntohs(unid->dest_port), unid->protocol);

	nss_ipv6_msg_init(&nim, NSS_IPV6_RX_INTERFACE, NSS_IPV6_TX_DESTROY_RULE_MSG,
			sizeof(struct nss_ipv6_rule_destroy_msg), nss_capwapmgr_ipv6_handler, NULL);

	nirdm = &nim.msg.rule_destroy;

	nirdm->tuple.protocol = (uint8_t)unid->protocol;
	nirdm->tuple.flow_ident = (uint32_t)unid->src_port;
	nirdm->tuple.flow_ip[0] = unid->src_ip[0];
	nirdm->tuple.flow_ip[1] = unid->src_ip[1];
	nirdm->tuple.flow_ip[2] = unid->src_ip[2];
	nirdm->tuple.flow_ip[3] = unid->src_ip[3];

	nirdm->tuple.return_ident = (uint32_t)unid->dest_port;
	nirdm->tuple.return_ip[0] = unid->dest_ip[0];
	nirdm->tuple.return_ip[1] = unid->dest_ip[1];
	nirdm->tuple.return_ip[2] = unid->dest_ip[2];
	nirdm->tuple.return_ip[3] = unid->dest_ip[3];

	down(&ip_response.sem);
	status = nss_ipv6_tx(nss_ctx, &nim);
	if (status != NSS_TX_SUCCESS) {
		up(&ip_response.sem);
		nss_capwapmgr_warn("%px: Destroy IPv6 message failed %d\n", nss_ctx, status);
		return status;
	}

	ip_response.cond = 1;
	if (!wait_event_timeout(ip_response.wq, ip_response.cond == 0, 5 * HZ)) {
		nss_capwapmgr_warn("%px: Destroy IPv6 command msg response timeout\n", nss_ctx);
		status = NSS_TX_FAILURE;
	} else if (ip_response.response != NSS_CMN_RESPONSE_ACK) {
		nss_capwapmgr_warn("%px: Destroy IPv6 command msg failed with response : %d\n", nss_ctx, ip_response.response);
		status = NSS_TX_FAILURE;
	}

	up(&ip_response.sem);
	return status;
}

/*
 * nss_capwapmgr_create_ipv4_rule()
 *	Create a nss entry to accelerate the given connection
 */
static nss_tx_status_t nss_capwapmgr_create_ipv4_rule(void *ctx, struct nss_ipv4_create *unic, uint16_t rule_flags, uint16_t valid_flags)
{
	struct nss_ctx_instance *nss_ctx = (struct nss_ctx_instance *) ctx;
	struct nss_ipv4_msg nim;
	struct nss_ipv4_rule_create_msg *nircm;
	nss_tx_status_t status;

	nss_capwapmgr_info("%px: ctx: Create IPv4: %pI4h:%d (%pI4h:%d), %pI4h:%d (%pI4h:%d), p: %d\n", nss_ctx,
		&unic->src_ip, unic->src_port, &unic->src_ip_xlate, unic->src_port_xlate,
		&unic->dest_ip, unic->dest_port, &unic->dest_ip_xlate, unic->dest_port_xlate,
		unic->protocol);

	memset(&nim, 0, sizeof (struct nss_ipv4_msg));
	nss_ipv4_msg_init(&nim, NSS_IPV4_RX_INTERFACE, NSS_IPV4_TX_CREATE_RULE_MSG,
			sizeof(struct nss_ipv4_rule_create_msg), nss_capwapmgr_ipv4_handler, NULL);

	nircm = &nim.msg.rule_create;
	nircm->valid_flags = 0;
	nircm->rule_flags = 0;

	/*
	 * Copy over the 5 tuple details.
	 */
	nircm->tuple.protocol = (uint8_t)unic->protocol;
	nircm->tuple.flow_ip = unic->src_ip;
	nircm->tuple.flow_ident = (uint32_t)unic->src_port;
	nircm->tuple.return_ip = unic->dest_ip;
	nircm->tuple.return_ident = (uint32_t)unic->dest_port;

	/*
	 * Copy over the connection rules and set the CONN_VALID flag
	 */
	nircm->conn_rule.flow_interface_num = unic->src_interface_num;
	nircm->conn_rule.flow_mtu = unic->from_mtu;
	nircm->conn_rule.flow_ip_xlate = unic->src_ip_xlate;
	nircm->conn_rule.flow_ident_xlate = (uint32_t)unic->src_port_xlate;
	memcpy(nircm->conn_rule.flow_mac, unic->src_mac, 6);
	nircm->conn_rule.return_interface_num = unic->dest_interface_num;
	nircm->conn_rule.return_mtu = unic->to_mtu;
	nircm->conn_rule.return_ip_xlate = unic->dest_ip_xlate;
	nircm->conn_rule.return_ident_xlate = (uint32_t)unic->dest_port_xlate;
	if (nircm->tuple.return_ip != nircm->conn_rule.return_ip_xlate ||
		nircm->tuple.return_ident != nircm->conn_rule.return_ident_xlate) {
		memcpy(nircm->conn_rule.return_mac, unic->dest_mac_xlate, 6);
	} else {
		memcpy(nircm->conn_rule.return_mac, unic->dest_mac, 6);
	}

	/*
	 * Copy over the DSCP rule parameters
	 */
	if (unic->flags & NSS_IPV4_CREATE_FLAG_DSCP_MARKING) {
		nircm->dscp_rule.flow_dscp = unic->flow_dscp;
		nircm->dscp_rule.return_dscp = unic->return_dscp;
		nircm->rule_flags |= NSS_IPV4_RULE_CREATE_FLAG_DSCP_MARKING;
		nircm->valid_flags |= NSS_IPV4_RULE_CREATE_DSCP_MARKING_VALID;
	}

	nircm->valid_flags |= NSS_IPV4_RULE_CREATE_CONN_VALID;

	/*
	 * Copy over the pppoe rules and set the PPPOE_VALID flag.
	 */
	nircm->pppoe_rule.flow_if_exist = unic->flow_pppoe_if_exist;
	nircm->pppoe_rule.flow_if_num = unic->flow_pppoe_if_num;
	nircm->pppoe_rule.return_if_exist = unic->return_pppoe_if_exist;
	nircm->pppoe_rule.return_if_num = unic->return_pppoe_if_num;
	nircm->valid_flags |= NSS_IPV4_RULE_CREATE_PPPOE_VALID;

	/*
	 * Copy over the vlan rules and set the VLAN_VALID flag
	 */
	nircm->vlan_primary_rule.ingress_vlan_tag = unic->in_vlan_tag[0];
	nircm->vlan_primary_rule.egress_vlan_tag = unic->out_vlan_tag[0];
	nircm->vlan_secondary_rule.ingress_vlan_tag = unic->in_vlan_tag[1];
	nircm->vlan_secondary_rule.egress_vlan_tag = unic->out_vlan_tag[1];
	nircm->valid_flags |= NSS_IPV4_RULE_CREATE_VLAN_VALID;

	/*
	 * Copy over the qos rules and set the QOS_VALID flag
	 */
	if (unic->flags & NSS_IPV6_CREATE_FLAG_QOS_VALID) {
		nircm->qos_rule.flow_qos_tag = unic->flow_qos_tag;
		nircm->qos_rule.return_qos_tag = unic->return_qos_tag;
		nircm->valid_flags |= NSS_IPV4_RULE_CREATE_QOS_VALID;
	}

	if (unic->flags & NSS_IPV4_CREATE_FLAG_NO_SEQ_CHECK) {
		nircm->rule_flags |= NSS_IPV4_RULE_CREATE_FLAG_NO_SEQ_CHECK;
	}

	if (unic->flags & NSS_IPV4_CREATE_FLAG_BRIDGE_FLOW) {
		nircm->rule_flags |= NSS_IPV4_RULE_CREATE_FLAG_BRIDGE_FLOW;
	}

	if (unic->flags & NSS_IPV4_CREATE_FLAG_ROUTED) {
		nircm->rule_flags |= NSS_IPV4_RULE_CREATE_FLAG_ROUTED;
	}

	/*
	 * Set the flag NSS_IPV4_RULE_CREATE_FLAG_ICMP_NO_CME_FLUSH so that
	 * rule is not flushed when NSS FW receives ICMP errors/packets.
	 */
	nircm->rule_flags |= NSS_IPV4_RULE_CREATE_FLAG_ICMP_NO_CME_FLUSH;

	/*
	 * Add any other additional flags which caller has requested.
	 * For example: update MTU, update destination MAC address.
	 */
	nircm->rule_flags |= rule_flags;
	nircm->valid_flags |= valid_flags;

	down(&ip_response.sem);
	status = nss_ipv4_tx(nss_ctx, &nim);
	if (status != NSS_TX_SUCCESS) {
		up(&ip_response.sem);
		nss_capwapmgr_warn("%px: Create IPv4 message failed %d\n", ctx, status);
		return status;
	}

	ip_response.cond = 1;
	if (!wait_event_timeout(ip_response.wq, ip_response.cond == 0, 5 * HZ)) {
		nss_capwapmgr_warn("%px: Create IPv4 command msg response timeout\n", ctx);
		status = NSS_TX_FAILURE;
	} else if (ip_response.response != NSS_CMN_RESPONSE_ACK) {
		nss_capwapmgr_warn("%px: Create IPv4 command msg failed with response: %d\n", ctx, ip_response.response);
		status = NSS_TX_FAILURE;
	}

	up(&ip_response.sem);
	return status;
}

/*
 * nss_capwapmgr_create_ipv6_rule()
 *	Create a nss entry to accelerate the given connection
 */
static nss_tx_status_t nss_capwapmgr_create_ipv6_rule(void *ctx, struct nss_ipv6_create *unic, uint16_t rule_flags, uint16_t valid_flags)
{
	struct nss_ctx_instance *nss_ctx = (struct nss_ctx_instance *) ctx;
	struct nss_ipv6_msg nim;
	struct nss_ipv6_rule_create_msg *nircm;
	nss_tx_status_t status;

	nss_capwapmgr_info("%px: Create IPv6: %pI6:%d, %pI6:%d, p: %d\n", nss_ctx,
		unic->src_ip, unic->src_port, unic->dest_ip, unic->dest_port, unic->protocol);

	memset(&nim, 0, sizeof (struct nss_ipv6_msg));
	nss_ipv6_msg_init(&nim, NSS_IPV6_RX_INTERFACE, NSS_IPV6_TX_CREATE_RULE_MSG,
			sizeof(struct nss_ipv6_rule_create_msg), nss_capwapmgr_ipv6_handler, NULL);

	nircm = &nim.msg.rule_create;

	nircm->rule_flags = 0;
	nircm->valid_flags = 0;

	/*
	 * Copy over the 5 tuple information.
	 */
	nircm->tuple.protocol = (uint8_t)unic->protocol;
	nircm->tuple.flow_ip[0] = unic->src_ip[0];
	nircm->tuple.flow_ip[1] = unic->src_ip[1];
	nircm->tuple.flow_ip[2] = unic->src_ip[2];
	nircm->tuple.flow_ip[3] = unic->src_ip[3];
	nircm->tuple.flow_ident = (uint32_t)unic->src_port;

	nircm->tuple.return_ip[0] = unic->dest_ip[0];
	nircm->tuple.return_ip[1] = unic->dest_ip[1];
	nircm->tuple.return_ip[2] = unic->dest_ip[2];
	nircm->tuple.return_ip[3] = unic->dest_ip[3];
	nircm->tuple.return_ident = (uint32_t)unic->dest_port;

	/*
	 * Copy over the connection rules and set CONN_VALID flag
	 */
	nircm->conn_rule.flow_interface_num = unic->src_interface_num;
	nircm->conn_rule.flow_mtu = unic->from_mtu;
	nircm->conn_rule.return_interface_num = unic->dest_interface_num;
	nircm->conn_rule.return_mtu = unic->to_mtu;
	memcpy(nircm->conn_rule.flow_mac, unic->src_mac, 6);
	memcpy(nircm->conn_rule.return_mac, unic->dest_mac, 6);
	nircm->valid_flags |= NSS_IPV6_RULE_CREATE_CONN_VALID;

	/*
	 * Copy over the DSCP rule parameters
	 */
	if (unic->flags & NSS_IPV6_CREATE_FLAG_DSCP_MARKING) {
		nircm->dscp_rule.flow_dscp = unic->flow_dscp;
		nircm->dscp_rule.return_dscp = unic->return_dscp;
		nircm->rule_flags |= NSS_IPV6_RULE_CREATE_FLAG_DSCP_MARKING;
		nircm->valid_flags |= NSS_IPV6_RULE_CREATE_DSCP_MARKING_VALID;
	}

	/*
	 * Copy over the pppoe rules and set PPPOE_VALID flag
	 */
	nircm->pppoe_rule.flow_if_exist = unic->flow_pppoe_if_exist;
	nircm->pppoe_rule.flow_if_num = unic->flow_pppoe_if_num;
	nircm->pppoe_rule.return_if_exist = unic->return_pppoe_if_exist;
	nircm->pppoe_rule.return_if_num = unic->return_pppoe_if_num;
	nircm->valid_flags |= NSS_IPV6_RULE_CREATE_PPPOE_VALID;

	/*
	 * Copy over the tcp rules and set TCP_VALID flag
	 */
	nircm->tcp_rule.flow_window_scale = unic->flow_window_scale;
	nircm->tcp_rule.flow_max_window = unic->flow_max_window;
	nircm->tcp_rule.flow_end = unic->flow_end;
	nircm->tcp_rule.flow_max_end = unic->flow_max_end;
	nircm->tcp_rule.return_window_scale = unic->return_window_scale;
	nircm->tcp_rule.return_max_window = unic->return_max_window;
	nircm->tcp_rule.return_end = unic->return_end;
	nircm->tcp_rule.return_max_end = unic->return_max_end;
	nircm->valid_flags |= NSS_IPV6_RULE_CREATE_TCP_VALID;

	/*
	 * Copy over the vlan rules and set the VLAN_VALID flag
	 */
	nircm->vlan_primary_rule.egress_vlan_tag = unic->out_vlan_tag[0];
	nircm->vlan_primary_rule.ingress_vlan_tag = unic->in_vlan_tag[0];
	nircm->vlan_secondary_rule.egress_vlan_tag = unic->out_vlan_tag[1];
	nircm->vlan_secondary_rule.ingress_vlan_tag = unic->in_vlan_tag[1];
	nircm->valid_flags |= NSS_IPV6_RULE_CREATE_VLAN_VALID;

	/*
	 * Copy over the qos rules and set the QOS_VALID flag
	 */
	if (unic->flags & NSS_IPV6_CREATE_FLAG_QOS_VALID) {
		nircm->qos_rule.flow_qos_tag = unic->flow_qos_tag;
		nircm->qos_rule.return_qos_tag = unic->return_qos_tag;
		nircm->valid_flags |= NSS_IPV6_RULE_CREATE_QOS_VALID;
	}

	if (unic->flags & NSS_IPV6_CREATE_FLAG_NO_SEQ_CHECK) {
		nircm->rule_flags |= NSS_IPV6_RULE_CREATE_FLAG_NO_SEQ_CHECK;
	}

	if (unic->flags & NSS_IPV6_CREATE_FLAG_BRIDGE_FLOW) {
		nircm->rule_flags |= NSS_IPV6_RULE_CREATE_FLAG_BRIDGE_FLOW;
	}

	if (unic->flags & NSS_IPV6_CREATE_FLAG_ROUTED) {
		nircm->rule_flags |= NSS_IPV6_RULE_CREATE_FLAG_ROUTED;
	}

	/*
	 * Set the flag NSS_IPV6_RULE_CREATE_FLAG_ICMP_NO_CME_FLUSH so that
	 * rule is not flushed when NSS FW receives ICMP errors/packets.
	 */
	nircm->rule_flags |= NSS_IPV6_RULE_CREATE_FLAG_ICMP_NO_CME_FLUSH;

	/*
	 * Add any other additional flags which caller has requested.
	 * For example: update MTU, Update destination MAC address.
	 */
	nircm->rule_flags |= rule_flags;
	nircm->valid_flags |= valid_flags;

	down(&ip_response.sem);
	status = nss_ipv6_tx(nss_ctx, &nim);
	if (status != NSS_TX_SUCCESS) {
		up(&ip_response.sem);
		nss_capwapmgr_warn("%px: Create IPv6 message failed %d\n", ctx, status);
		return status;
	}

	ip_response.cond = 1;
	if (!wait_event_timeout(ip_response.wq, ip_response.cond == 0, 5 * HZ)) {
		nss_capwapmgr_warn("%px: Create IPv6 command msg response timeout\n", ctx);
		status = NSS_TX_FAILURE;
	} else if (ip_response.response != NSS_CMN_RESPONSE_ACK) {
		nss_capwapmgr_warn("%px: Create IPv6 command msg failed with response: %d\n", ctx, ip_response.response);
		status = NSS_TX_FAILURE;
	}

	up(&ip_response.sem);
	return status;
}

/*
 * nss_capwapmgr_configure_ipv4()
 *	Internal function for configuring IPv4 connection
 */
static nss_tx_status_t nss_capwapmgr_configure_ipv4(struct nss_ipv4_create *pcreate, uint16_t rule_flags, uint16_t valid_flags)
{
	nss_tx_status_t status;
	void *ctx;

	ctx = nss_ipv4_get_mgr();
	if (!ctx) {
		nss_capwapmgr_warn("%s couldn't get IPv4 ctx\n", "CAPWAP");
		return NSS_TX_FAILURE_NOT_READY;
	}

	status = nss_capwapmgr_create_ipv4_rule(ctx, pcreate, rule_flags, valid_flags);
	if (status != NSS_TX_SUCCESS) {
		nss_capwapmgr_warn("%px: ctx: nss_ipv4_tx() failed with %d\n", ctx, status);
		return status;
	}

	return NSS_TX_SUCCESS;
}

/*
 * nss_capwapmgr_configure_ipv6()
 *	Internal function for configuring IPv4 connection
 */
static nss_tx_status_t nss_capwapmgr_configure_ipv6(struct nss_ipv6_create *pcreate, uint16_t rule_flags, uint16_t valid_flags)
{
	nss_tx_status_t status;
	void *ctx;

	ctx = nss_ipv6_get_mgr();
	if (!ctx) {
		nss_capwapmgr_warn("%s couldn't get IPv6 ctx\n", "CAPWAP");
		return NSS_TX_FAILURE_NOT_READY;
	}

	status = nss_capwapmgr_create_ipv6_rule(ctx, pcreate, rule_flags, valid_flags);
	if (status != NSS_TX_SUCCESS) {
		nss_capwapmgr_warn("%px: ctx: nss_ipv6_tx() failed with %d\n", ctx, status);
		return status;
	}

	return NSS_TX_SUCCESS;
}

/*
 * nss_capwapmgr_tx_msg_sync()
 *	Waits for message to return.
 */
static nss_capwapmgr_status_t nss_capwapmgr_tx_msg_sync(struct nss_ctx_instance *ctx, struct net_device *dev, struct nss_capwap_msg *msg)
{
	struct nss_capwapmgr_priv *priv;
	struct nss_capwapmgr_response *r;
	uint32_t if_num;
	nss_capwapmgr_status_t status;

	if_num = msg->cm.interface - NSS_DYNAMIC_IF_START;
	dev_hold(dev);
	priv = netdev_priv(dev);
	r = &priv->resp[if_num];
	down(&r->sem);
	r->response = NSS_CMN_RESPONSE_ACK;
	atomic_set(&r->seq, 1);		/* Indicate that we are waiting */

	/*
	 * Call NSS driver
	 */
	status = nss_capwap_tx_msg(ctx, msg);
	if (status != NSS_CAPWAPMGR_SUCCESS) {
		up(&r->sem);
		dev_put(dev);
		return status;
	}

	if (!wait_event_timeout(r->wq, atomic_read(&r->seq) == 0, 5 * HZ)) {
		atomic_set(&r->seq, 0);		/* Indicate that we are no longer waiting */
		up(&r->sem);
		nss_capwapmgr_warn("%px: CAPWAP command msg response timeout\n", ctx);
		dev_put(dev);
		return NSS_CAPWAPMGR_FAILURE_CMD_TIMEOUT;
	}

	/*
	 * If NSS FW responded back with an error.
	 */
	if (r->response != NSS_CMN_RESPONSE_ACK) {
		up(&r->sem);
		nss_capwapmgr_warn("%px: CAPWAP command msg response : %d, error:%d\n", ctx,
				r->response, r->error);
		dev_put(dev);
		return nss_capwap_remap_error(r->error);
	}

	up(&r->sem);
	dev_put(dev);
	return status;
}

/*
 * nss_capwapmgr_create_capwap_rule()
 *	Internal function to create a CAPWAP rule
 */
static nss_capwapmgr_status_t nss_capwapmgr_create_capwap_rule(struct net_device *dev,
	uint32_t if_num, struct nss_capwap_rule_msg *msg, uint16_t type_flags)
{
	struct nss_ctx_instance *ctx = nss_capwap_get_ctx();
	struct nss_capwap_msg capwapmsg;
	struct nss_capwap_rule_msg *capwapcfg;
	nss_tx_status_t status;

	nss_capwapmgr_info("%px: ctx: CAPWAP Rule src_port: 0x%d dest_port:0x%d\n", ctx,
	    ntohl(msg->encap.src_port), ntohl(msg->encap.dest_port));

	/*
	 * Verify CAPWAP rule parameters.
	 */
	if (ntohl(msg->decap.reassembly_timeout) > NSS_CAPWAP_MAX_REASSEMBLY_TIMEOUT) {
		nss_capwapmgr_warn("%px: invalid reassem timeout: %d, max: %d\n",
			ctx, ntohl(msg->decap.reassembly_timeout), NSS_CAPWAP_MAX_REASSEMBLY_TIMEOUT);
		return NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
	}

	if (msg->decap.reassembly_timeout == 0) {
		msg->decap.reassembly_timeout = htonl(10);	/* 10 milli-seconds */
	}

	if (ntohl(msg->decap.max_fragments) > NSS_CAPWAP_MAX_FRAGMENTS) {
		nss_capwapmgr_warn("%px: invalid fragment setting: %d, max: %d\n",
			ctx, ntohl(msg->decap.max_fragments), NSS_CAPWAP_MAX_FRAGMENTS);
		return NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
	}

	if (msg->decap.max_fragments == 0) {
		msg->decap.max_fragments = htonl(NSS_CAPWAP_MAX_FRAGMENTS);
	}

	if (ntohl(msg->decap.max_buffer_size) > NSS_CAPWAP_MAX_BUFFER_SIZE) {
		nss_capwapmgr_warn("%px: invalid buffer size: %d, max: %d\n",
			ctx, ntohl(msg->decap.max_buffer_size), NSS_CAPWAP_MAX_BUFFER_SIZE);
		return NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
	}

	if (msg->decap.max_buffer_size == 0) {
		msg->decap.max_buffer_size = htonl(nss_capwap_get_max_buf_size(ctx));
	}

	if (ntohl(msg->encap.path_mtu) > NSS_CAPWAP_MAX_MTU) {
		nss_capwapmgr_warn("%px: invalid path_mtu: %d, max: %d\n",
			ctx, ntohl(msg->encap.path_mtu), NSS_CAPWAP_MAX_MTU);
		return NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
	}

	if (msg->encap.path_mtu == 0) {
		msg->encap.path_mtu = htonl(NSS_CAPWAPMGR_NORMAL_FRAME_MTU);
	}

	msg->type_flags = type_flags;

	/*
	 * Prepare the tunnel configuration parameter to send to NSS FW
	 */
	memset(&capwapmsg, 0, sizeof(struct nss_capwap_msg));
	capwapcfg = &capwapmsg.msg.rule;
	memcpy(capwapcfg, msg, sizeof(struct nss_capwap_rule_msg));

	/*
	 * Send CAPWAP tunnel create command to NSS
	 */
	nss_capwap_msg_init(&capwapmsg, if_num, NSS_CAPWAP_MSG_TYPE_CFG_RULE,
			sizeof(struct nss_capwap_rule_msg),
			nss_capwapmgr_msg_event_receive, dev);

	status = nss_capwapmgr_tx_msg_sync(ctx, dev, &capwapmsg);
	if (status != NSS_TX_SUCCESS) {
		nss_capwapmgr_warn("%px: ctx: create encap data tunnel error %d \n", ctx, status);
		return status;
	}

	return NSS_CAPWAPMGR_SUCCESS;
}

/*
 * nss_capwapmgr_tx_msg_enable_tunnel()
 *	Common function to send CAPWAP tunnel enable msg
 */
static nss_tx_status_t nss_capwapmgr_tx_msg_enable_tunnel(struct nss_ctx_instance *ctx, struct net_device *dev, uint32_t if_num, uint32_t sibling_if_num)
{
	struct nss_capwap_msg capwapmsg;
	nss_tx_status_t status;

	/*
	 * Prepare the tunnel configuration parameter to send to NSS FW
	 */
	memset(&capwapmsg, 0, sizeof(struct nss_capwap_msg));
	capwapmsg.msg.enable_tunnel.sibling_if_num = sibling_if_num;

	/*
	 * Send CAPWAP data tunnel command to NSS
	 */
	nss_capwap_msg_init(&capwapmsg, if_num, NSS_CAPWAP_MSG_TYPE_ENABLE_TUNNEL, sizeof(struct nss_capwap_enable_tunnel_msg), nss_capwapmgr_msg_event_receive, dev);

	status = nss_capwapmgr_tx_msg_sync(ctx, dev, &capwapmsg);
	if (status != NSS_TX_SUCCESS) {
		nss_capwapmgr_warn("%px: ctx: CMD: %d Tunnel error : %d \n", ctx, NSS_CAPWAP_MSG_TYPE_ENABLE_TUNNEL, status);
	}

	return status;
}

/*
 * nss_capwapmgr_tunnel_action()
 *	Common function for CAPWAP tunnel operation messages without
 *	any message data structures.
 */
static nss_tx_status_t nss_capwapmgr_tunnel_action(struct nss_ctx_instance *ctx, struct net_device *dev, uint32_t if_num, nss_capwap_msg_type_t cmd)
{
	struct nss_capwap_msg capwapmsg;
	nss_tx_status_t status;

	/*
	 * Prepare the tunnel configuration parameter to send to NSS FW
	 */
	memset(&capwapmsg, 0, sizeof(struct nss_capwap_msg));

	/*
	 * Send CAPWAP data tunnel command to NSS
	 */
	nss_capwap_msg_init(&capwapmsg, if_num, cmd, 0, nss_capwapmgr_msg_event_receive, dev);

	status = nss_capwapmgr_tx_msg_sync(ctx, dev, &capwapmsg);
	if (status != NSS_TX_SUCCESS) {
		nss_capwapmgr_warn("%px: ctx: CMD: %d Tunnel error : %d \n", ctx, cmd, status);
	}

	return status;
}

/*
 * nss_capwapmgr_get_dtls_netdev()
 *	API for getting the dtls netdev associated to the capwap tunnel
 *
 * The caller is expected to do a dev_put() to release the reference.
 */
struct net_device *nss_capwapmgr_get_dtls_netdev(struct net_device *capwap_dev, uint8_t tunnel_id)
{
	struct nss_capwapmgr_tunnel *t;
	struct net_device *dtls_dev;

	dev_hold(capwap_dev);
	t = nss_capwapmgr_verify_tunnel_param(capwap_dev, tunnel_id);
	if (!t) {
		nss_capwapmgr_warn("%px: can't find tunnel: %d\n", capwap_dev, tunnel_id);
		dev_put(capwap_dev);
		return NULL;
	}

	dtls_dev = t->dtls_dev;
	dev_hold(dtls_dev);

	dev_put(capwap_dev);

	return dtls_dev;
}
EXPORT_SYMBOL(nss_capwapmgr_get_dtls_netdev);

/*
 * nss_capwapmgr_update_path_mtu()
 *	API for updating Path MTU
 */
nss_capwapmgr_status_t nss_capwapmgr_update_path_mtu(struct net_device *dev, uint8_t tunnel_id, uint32_t mtu)
{
	struct nss_capwapmgr_priv *priv;
	struct nss_capwap_msg capwapmsg;
	struct nss_capwapmgr_tunnel *t;
	nss_capwapmgr_status_t status;
	nss_tx_status_t nss_status;

	if (mtu > NSS_CAPWAP_MAX_MTU) {
		nss_capwapmgr_warn("%px: invalid path_mtu: %d, max: %d\n", dev, mtu, NSS_CAPWAP_MAX_MTU);
		return NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
	}

	dev_hold(dev);
	t = nss_capwapmgr_verify_tunnel_param(dev, tunnel_id);
	if (!t) {
		nss_capwapmgr_warn("%px: can't find tunnel: %d\n", dev, tunnel_id);
		dev_put(dev);
		return NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
	}

	priv = netdev_priv(dev);
	nss_capwapmgr_info("%px: %d: tunnel update MTU is being called\n", dev, t->if_num_inner);

	/*
	 * Prepare the tunnel configuration parameter to send to NSS FW
	 */
	memset(&capwapmsg, 0, sizeof(struct nss_capwap_msg));

	/*
	 * Send CAPWAP data tunnel command to NSS
	 */
	nss_capwap_msg_init(&capwapmsg, t->if_num_inner, NSS_CAPWAP_MSG_TYPE_UPDATE_PATH_MTU,
		sizeof(struct nss_capwap_path_mtu_msg), nss_capwapmgr_msg_event_receive, dev);
	capwapmsg.msg.mtu.path_mtu = htonl(mtu);
	status = nss_capwapmgr_tx_msg_sync(priv->nss_ctx, dev, &capwapmsg);
	if (status != NSS_CAPWAPMGR_SUCCESS) {
		nss_capwapmgr_warn("%px: Update Path MTU CAPWAP tunnel error : %d \n", dev, status);
		dev_put(dev);
		return NSS_CAPWAPMGR_FAILURE_CAPWAP_RULE;
	}

	/*
	 * Update the IPv4/IPv6 rule with the new MTU for flow and return
	 * TODO: Change rule flag to valid flag
	 */
	if (t->capwap_rule.l3_proto == NSS_CAPWAP_TUNNEL_IPV4) {
		struct nss_ipv4_create *v4;

		v4 = &t->ip_rule.v4;
		v4->from_mtu = v4->to_mtu = mtu;
		nss_status = nss_capwapmgr_configure_ipv4(v4, NSS_IPV4_RULE_UPDATE_FLAG_CHANGE_MTU, 0);
		if (nss_status != NSS_TX_SUCCESS) {
			v4->from_mtu = v4->to_mtu = ntohl(t->capwap_rule.encap.path_mtu);
		}
	} else {
		struct nss_ipv6_create *v6;

		v6 = &t->ip_rule.v6;
		v6->from_mtu = v6->to_mtu = mtu;
		nss_status = nss_capwapmgr_configure_ipv6(v6, NSS_IPV6_RULE_UPDATE_FLAG_CHANGE_MTU, 0);
		if (nss_status != NSS_TX_SUCCESS) {
			v6->from_mtu = v6->to_mtu = ntohl(t->capwap_rule.encap.path_mtu);
		}
	}

	if (nss_status != NSS_TX_SUCCESS) {
		nss_capwapmgr_warn("%px: Update Path MTU IP RULE tunnel error : %d \n", dev, nss_status);
		capwapmsg.msg.mtu.path_mtu = t->capwap_rule.encap.path_mtu;
		status = nss_capwapmgr_tx_msg_sync(priv->nss_ctx, dev, &capwapmsg);
		if (status != NSS_CAPWAPMGR_SUCCESS) {
			nss_capwapmgr_warn("%px: Restore Path MTU CAPWAP tunnel error : %d \n", dev, status);
		}

		dev_put(dev);
		return NSS_CAPWAPMGR_FAILURE_IP_RULE;
	}

	t->capwap_rule.encap.path_mtu = htonl(mtu);
	dev_put(dev);
	return status;
}
EXPORT_SYMBOL(nss_capwapmgr_update_path_mtu);

/*
 * nss_capwapmgr_update_dest_mac_addr()
 *	API for updating Destination Mac Addr
 */
nss_capwapmgr_status_t nss_capwapmgr_update_dest_mac_addr(struct net_device *dev, uint8_t tunnel_id, uint8_t *mac_addr)
{
	struct nss_capwapmgr_priv *priv;
	struct nss_capwapmgr_tunnel *t;
	nss_tx_status_t nss_status;
	nss_capwapmgr_status_t status = NSS_CAPWAPMGR_SUCCESS;
	struct nss_ipv6_create *v6;
	uint8_t mac_addr_old[ETH_ALEN];

	dev_hold(dev);
	t = nss_capwapmgr_verify_tunnel_param(dev, tunnel_id);
	if (!t) {
		nss_capwapmgr_warn("%px: can't find tunnel: %d\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
		goto done;
	}


	priv = netdev_priv(dev);
	nss_capwapmgr_info("%px: %d: tunnel update mac Addr is being called\n", dev, tunnel_id);

	/*
	 * Update the IPv4/IPv6 rule with the new destination mac address for flow and return.
	 * Since the encap direction is handled by the return rule, we are updating the src_mac.
	 */
	if (t->capwap_rule.l3_proto == NSS_CAPWAP_TUNNEL_IPV4) {
		struct nss_ipv4_create *v4;

		v4 = &t->ip_rule.v4;
		memcpy(mac_addr_old, v4->src_mac, ETH_ALEN);
		memcpy(v4->src_mac, mac_addr, ETH_ALEN);
		nss_status = nss_capwapmgr_configure_ipv4(v4, 0, NSS_IPV4_RULE_CREATE_DEST_MAC_VALID);

		if (nss_status != NSS_TX_SUCCESS) {
			nss_capwapmgr_warn("%px: Update Destination Mac for tunnel error : %d \n", dev, nss_status);
			memcpy(t->ip_rule.v4.src_mac, mac_addr_old, ETH_ALEN);
			status = NSS_CAPWAPMGR_FAILURE_IP_RULE;
		}

		goto done;
	}

	v6 = &t->ip_rule.v6;
	memcpy(mac_addr_old, v6->src_mac, ETH_ALEN);
	memcpy(v6->src_mac, mac_addr, ETH_ALEN);
	nss_status = nss_capwapmgr_configure_ipv6(v6, 0, NSS_IPV6_RULE_CREATE_DEST_MAC_VALID);

	if (nss_status != NSS_TX_SUCCESS) {
		nss_capwapmgr_warn("%px: Update Destination Mac for tunnel error : %d \n", dev, nss_status);
		memcpy(t->ip_rule.v6.src_mac, mac_addr_old, ETH_ALEN);
		status = NSS_CAPWAPMGR_FAILURE_IP_RULE;
	}

done:
	dev_put(dev);
	return status;
}
EXPORT_SYMBOL(nss_capwapmgr_update_dest_mac_addr);

/*
 * nss_capwapmgr_update_src_interface()
 *	API for updating Source Interface
 */
nss_capwapmgr_status_t nss_capwapmgr_update_src_interface(struct net_device *dev, uint8_t tunnel_id, uint32_t src_interface_num)
{
	struct nss_capwapmgr_priv *priv;
	struct nss_capwapmgr_tunnel *t;
	nss_tx_status_t nss_status;
	uint32_t outer_trustsec_enabled, dtls_enabled, forward_if_num, src_interface_num_temp;

	dev_hold(dev);
	t = nss_capwapmgr_verify_tunnel_param(dev, tunnel_id);
	if (!t) {
		nss_capwapmgr_warn("%px: can't find tunnel: %d\n", dev, tunnel_id);
		dev_put(dev);
		return NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
	}


	priv = netdev_priv(dev);
	nss_capwapmgr_info("%px: %d: tunnel update source interface is being called\n", dev, tunnel_id);
	outer_trustsec_enabled = t->capwap_rule.enabled_features & NSS_CAPWAPMGR_FEATURE_OUTER_TRUSTSEC_ENABLED;
	dtls_enabled = t->capwap_rule.enabled_features & NSS_CAPWAPMGR_FEATURE_DTLS_ENABLED;

	/*
	 * If trustsec is enabled, just update the next node of trustsec.
	 */
	if (outer_trustsec_enabled) {
		if (!dtls_enabled) {
			forward_if_num = nss_capwap_ifnum_with_core_id(t->if_num_outer);
		} else {
			forward_if_num = nss_dtlsmgr_get_interface(t->dtls_dev, NSS_DTLSMGR_INTERFACE_TYPE_OUTER);
		}

		nss_status = nss_trustsec_tx_update_nexthop(forward_if_num, src_interface_num, t->capwap_rule.outer_sgt_value);
		if (nss_status != NSS_TX_SUCCESS) {
			nss_capwapmgr_warn("%px: unconfigure trustsec_tx failed\n", dev);
			dev_put(dev);
			return NSS_CAPWAPMGR_FAILURE_UNCONFIGURE_TRUSTSEC_TX;
		}

		if (t->capwap_rule.l3_proto == NSS_CAPWAP_TUNNEL_IPV4) {
			t->ip_rule.v4.src_interface_num = src_interface_num;
		} else {
			t->ip_rule.v6.src_interface_num = src_interface_num;
		}
		dev_put(dev);
		return NSS_CAPWAPMGR_SUCCESS;
	}

	/*
	 * Destroy/Re-Create the IPv4/IPv6 rule with the new Interface number for flow and return
	 */
	if (t->capwap_rule.l3_proto == NSS_CAPWAP_TUNNEL_IPV4) {

		/*
		 * Destroy the IP rule only if it already exist.
		 */
		if (t->tunnel_state & NSS_CAPWAPMGR_TUNNEL_STATE_IPRULE_CONFIGURED) {
			struct nss_ipv4_destroy v4_destroy;
			v4_destroy.protocol = IPPROTO_UDP;
			v4_destroy.src_ip = t->ip_rule.v4.src_ip;
			v4_destroy.dest_ip = t->ip_rule.v4.dest_ip;
			v4_destroy.src_port = t->ip_rule.v4.src_port;
			v4_destroy.dest_port = t->ip_rule.v4.dest_port;
			nss_status = nss_capwapmgr_unconfigure_ipv4_rule(&v4_destroy);
			if (nss_status != NSS_TX_SUCCESS) {
				nss_capwapmgr_warn("%px: unconfigure ipv4 rule failed : %d\n", dev, nss_status);
				dev_put(dev);
				return NSS_CAPWAPMGR_FAILURE_IP_DESTROY_RULE;
			}

			t->tunnel_state &= ~NSS_CAPWAPMGR_TUNNEL_STATE_IPRULE_CONFIGURED;
		}

		src_interface_num_temp = t->ip_rule.v4.src_interface_num;
		t->ip_rule.v4.src_interface_num = src_interface_num;
		nss_capwapmgr_configure_ipv4(&t->ip_rule.v4, 0, 0);
		if (nss_status != NSS_TX_SUCCESS) {
			nss_capwapmgr_warn("%px: configure ipv4 rule failed : %d\n", dev, nss_status);
			t->ip_rule.v4.src_interface_num = src_interface_num_temp;
			dev_put(dev);
			return NSS_CAPWAPMGR_FAILURE_IP_RULE;
		}
	} else {
		/*
		 * Destroy the IP rule only if it already exist.
		 */
		if (t->tunnel_state & NSS_CAPWAPMGR_TUNNEL_STATE_IPRULE_CONFIGURED) {
			struct nss_ipv6_destroy v6_destroy;

			if (t->capwap_rule.which_udp == NSS_CAPWAP_TUNNEL_UDP) {
				v6_destroy.protocol = IPPROTO_UDP;
			} else {
				v6_destroy.protocol = IPPROTO_UDPLITE;
			}

			v6_destroy.src_ip[0] = t->ip_rule.v6.src_ip[0];
			v6_destroy.src_ip[1] = t->ip_rule.v6.src_ip[1];
			v6_destroy.src_ip[2] = t->ip_rule.v6.src_ip[2];
			v6_destroy.src_ip[3] = t->ip_rule.v6.src_ip[3];

			v6_destroy.dest_ip[0] = t->ip_rule.v6.dest_ip[0];
			v6_destroy.dest_ip[1] = t->ip_rule.v6.dest_ip[1];
			v6_destroy.dest_ip[2] = t->ip_rule.v6.dest_ip[2];
			v6_destroy.dest_ip[3] = t->ip_rule.v6.dest_ip[3];

			v6_destroy.src_port = t->ip_rule.v6.src_port;
			v6_destroy.dest_port = t->ip_rule.v6.dest_port;
			nss_status = nss_capwapmgr_unconfigure_ipv6_rule(&v6_destroy);
			if (nss_status != NSS_TX_SUCCESS) {
				nss_capwapmgr_warn("%px: unconfigure ipv6 rule failed : %d\n", dev, nss_status);
				dev_put(dev);
				return NSS_CAPWAPMGR_FAILURE_IP_DESTROY_RULE;
			}

			t->tunnel_state &= ~NSS_CAPWAPMGR_TUNNEL_STATE_IPRULE_CONFIGURED;
		}

		src_interface_num_temp = t->ip_rule.v6.src_interface_num;
		t->ip_rule.v6.src_interface_num = src_interface_num;
		nss_capwapmgr_configure_ipv6(&t->ip_rule.v6, 0, 0);
		if (nss_status != NSS_TX_SUCCESS) {
			nss_capwapmgr_warn("%px: configure ipv6 rule failed : %d\n", dev, nss_status);
			t->ip_rule.v6.src_interface_num = src_interface_num_temp;
			dev_put(dev);
			return NSS_CAPWAPMGR_FAILURE_IP_RULE;
		}
	}
	t->tunnel_state |= NSS_CAPWAPMGR_TUNNEL_STATE_IPRULE_CONFIGURED;
	dev_put(dev);
	return NSS_CAPWAPMGR_SUCCESS;
}
EXPORT_SYMBOL(nss_capwapmgr_update_src_interface);

/*
 * nss_capwapmgr_dscp_rule_destroy()
 *	API to destroy previously created DSCP rule.
 */
nss_capwapmgr_status_t nss_capwapmgr_dscp_rule_destroy(uint8_t id)
{
	sw_error_t rv;
	fal_qos_cosmap_t cosmap;
	struct nss_capwapmgr_acl *acl_rule;
	uint8_t dev_id = NSS_CAPWAPMGR_DEV_ID;
	uint8_t rule_nr = NSS_CAPWAPMGR_RULE_NR;
	uint8_t group_id = NSS_CAPWAPMGR_GROUP_ID;
	uint8_t i, j, list_id, v4_rule_id, v6_rule_id, dscp_value, dscp_mask;

	for (i = 0; i < NSS_CAPWAPMGR_ACL_LIST_CNT; i++) {
		for (j = 0; j < NSS_CAPWAPMGR_ACL_RULES_PER_LIST; j++) {
			if (global.acl_list[i].rule[j].uid == id) {
				acl_rule = &global.acl_list[i].rule[j];
				goto found;
			}
		}
	}

	nss_capwapmgr_warn("Invalid id: %u\n", id);
	return NSS_CAPWAPMGR_FAILURE_DSCP_RULE_ID_INVALID;

found:
	if (!acl_rule->in_use) {
		nss_capwapmgr_warn("Rule matching id: %d not in use\n", id);
		return NSS_CAPWAPMGR_FAILURE_DSCP_RULE_ID_NOT_IN_USE;
	}

	dscp_value = acl_rule->dscp_value;
	dscp_mask = acl_rule->dscp_mask;

	/*
	 * Reset all classification fields on cosmap table.
	 */
	cosmap.internal_pcp = 0;
	cosmap.internal_dei = 0;
	cosmap.internal_pri = 0;
	cosmap.internal_dscp = 0;
	cosmap.internal_dp = 0;

	for (i = 0; i < NSS_CAPWAPMGR_DSCP_MAX; i++) {
		if ((i & dscp_mask) != dscp_value) {
			continue;
		}

		nss_capwapmgr_trace("dscpmap: resetting for dscp %u\n", i);
		rv = fal_qos_cosmap_dscp_set(dev_id, group_id, i, &cosmap);
		if (rv != SW_OK) {
			nss_capwapmgr_warn("Failed to reset cosmap for dscp %d - code: %d\n", i, rv);
			return NSS_CAPWAPMGR_FAILURE_DSCP_RULE_DELETE_FAILED;
		}
	}

	/*
	 * Since we use 2 ACL entries per rule (i.e. v4/v6) we multiply by
	 * two to get rule_ids.
	 */
	v4_rule_id = acl_rule->rule_id * 2;
	v6_rule_id = v4_rule_id + 1;
	list_id = NSS_CAPWAPMGR_ACL_LIST_START + acl_rule->list_id;

	rv = fal_acl_rule_delete(dev_id, list_id, v6_rule_id, rule_nr);
	if (rv != SW_OK) {
		nss_capwapmgr_warn("Failed to del ACL v6_rule %d from list %d - code: %d\n", v6_rule_id, list_id, rv);
		return NSS_CAPWAPMGR_FAILURE_DSCP_RULE_DELETE_FAILED;
	}

	rv = fal_acl_rule_delete(dev_id, list_id, v4_rule_id, rule_nr);
	if (rv != SW_OK) {
		nss_capwapmgr_warn("Failed to del ACL v4_rule %d from list %d - code: %d\n", v4_rule_id, list_id, rv);
		return NSS_CAPWAPMGR_FAILURE_DSCP_RULE_DELETE_FAILED;
	}

	acl_rule->in_use = false;
	return NSS_CAPWAPMGR_SUCCESS;
}
EXPORT_SYMBOL(nss_capwapmgr_dscp_rule_destroy);

/*
 * nss_capwapmgr_dscp_rule_create()
 *	API to prioritize packets based on DSCP.
 */
nss_capwapmgr_status_t nss_capwapmgr_dscp_rule_create(uint8_t dscp_value, uint8_t dscp_mask, uint8_t pri, uint8_t *id)
{
	sw_error_t rv;
	fal_qos_cosmap_t cosmap;
	fal_qos_cosmap_t *orig_cosmap;
	fal_acl_rule_t *acl_rule;
	uint8_t dev_id = NSS_CAPWAPMGR_DEV_ID;
	uint8_t group_id = NSS_CAPWAPMGR_GROUP_ID;
	uint8_t rule_nr = NSS_CAPWAPMGR_RULE_NR;
	uint8_t list_id, v4_rule_id, v6_rule_id;
	uint8_t lid, rid, i, j;
	int8_t err, fail_dscp;
	int8_t uid = -1;

	nss_capwapmgr_info("Setting priority %u for dscp %u mask %u\n", pri, dscp_value, dscp_mask);

	orig_cosmap = kzalloc(NSS_CAPWAPMGR_DSCP_MAX * sizeof(*orig_cosmap), GFP_KERNEL);
	if (!orig_cosmap) {
		nss_capwapmgr_warn("Failed to alloc memory for orig_cosmap\n");
		return NSS_CAPWAPMGR_FAILURE_MEM_UNAVAILABLE;
	}

	acl_rule = kzalloc(sizeof(*acl_rule), GFP_KERNEL);
	if (!acl_rule) {
		nss_capwapmgr_warn("Failed to alloc memory for acl_rule\n");
		kfree(orig_cosmap);
		return NSS_CAPWAPMGR_FAILURE_MEM_UNAVAILABLE;
	}

	/*
	 * Get an empty acl rule.
	 */
	for (i = 0; i < NSS_CAPWAPMGR_ACL_LIST_CNT; i++) {
		for (j = 0; j < NSS_CAPWAPMGR_ACL_RULES_PER_LIST; j++) {
			if (global.acl_list[i].rule[j].in_use) {
				continue;
			}

			uid = global.acl_list[i].rule[j].uid;
			rid = global.acl_list[i].rule[j].rule_id;
			lid = global.acl_list[i].rule[j].list_id;
			goto found;
		}
	}

found:
	if (uid < 0) {
		nss_capwapmgr_warn("No free ACL rules available\n");
		err = NSS_CAPWAPMGR_FAILURE_ACL_UNAVAILABLE;
		goto fail1;
	};

	/*
	 * Since we use 2 ACL entries per rule (i.e. v4/v6) we multiply rid by
	 * two to get rule_id.
	 */
	v4_rule_id = rid * 2;
	v6_rule_id = v4_rule_id + 1;
	list_id = NSS_CAPWAPMGR_ACL_LIST_START + lid;

	nss_capwapmgr_info("Using ACL rules: %d & %d from list: %d\n", v4_rule_id, v6_rule_id, list_id);

	/*
	 * Prioritize packets with the dscp value. For trustsec packets, we need to specify
	 * the location of the dscp value with ACL configuration.
	 * ACL rule always start from the L2 header. It will be trustsec header for our case.
	 * We need two user defined profile to set beginning of the
	 * Profile 0 is for start of the ethernet type.
	 * Profile 1 is for the start of the ip header.
	 */
	rv = fal_acl_udf_profile_set(dev_id, FAL_ACL_UDF_NON_IP, 0, FAL_ACL_UDF_TYPE_L3, NSS_CAPWAPMGR_ETH_HDR_OFFSET);
	if (rv != SW_OK) {
		nss_capwapmgr_warn("Failed to create UDF 0 Map - code: %d\n", rv);
		err = NSS_CAPWAPMGR_FAILURE_CREATE_UDF_PROFILE;
		goto fail1;
	}

	rv = fal_acl_udf_profile_set(dev_id, FAL_ACL_UDF_NON_IP, 1, FAL_ACL_UDF_TYPE_L3, NSS_CAPWAPMGR_IPV4_OFFSET);
	if (rv != SW_OK) {
		nss_capwapmgr_warn("Failed to create UDF 1 Map - code: %d\n", rv);
		err = NSS_CAPWAPMGR_FAILURE_CREATE_UDF_PROFILE;
		goto fail1;
	}

	acl_rule->rule_type = FAL_ACL_RULE_MAC;

	/*
	 * Sets valid flags for the acl rule.
	 * Following rules are valid:
	 * - Ethernet type
	 * - User defined field 0. Correspond to ethernet type (ipv4/ipv6)
	 * - User defined field 1. Correspond to DSCP value (dscp_value)
	 */
	FAL_FIELD_FLG_SET(acl_rule->field_flg, FAL_ACL_FIELD_MAC_ETHTYPE);
	FAL_FIELD_FLG_SET(acl_rule->field_flg, FAL_ACL_FIELD_UDF0);
	FAL_FIELD_FLG_SET(acl_rule->field_flg, FAL_ACL_FIELD_UDF1);
	FAL_ACTION_FLG_SET(acl_rule->action_flg, FAL_ACL_ACTION_PERMIT);
	FAL_ACTION_FLG_SET(acl_rule->action_flg, FAL_ACL_ACTION_ENQUEUE_PRI);

	/*
	 * Set common parameters for ipv4/ipv6
	 */
	acl_rule->ethtype_val = NSS_CAPWAPMGR_ETH_TYPE_TRUSTSEC;
	acl_rule->ethtype_mask = NSS_CAPWAPMGR_ETH_TYPE_MASK;
	acl_rule->udf0_op = FAL_ACL_FIELD_MASK;
	acl_rule->udf1_op = FAL_ACL_FIELD_MASK;
	acl_rule->enqueue_pri = pri;

	/*
	 * Create ACL rule for IPv4
	 */
	acl_rule->udf0_val = NSS_CAPWAPMGR_ETH_TYPE_IPV4;
	acl_rule->udf0_mask = NSS_CAPWAPMGR_ETH_TYPE_MASK;
	acl_rule->udf1_val = dscp_value << NSS_CAPWAPMGR_DSCP_MASK_IPV4_SHIFT;
	acl_rule->udf1_mask = dscp_mask << NSS_CAPWAPMGR_DSCP_MASK_IPV4_SHIFT;

	rv = fal_acl_rule_query(dev_id, list_id, v4_rule_id, acl_rule);
	if (rv != SW_NOT_FOUND) {
		nss_capwapmgr_warn("ACL rule already exist for list_id: %u, rule_id: %u - code: %d\n", list_id, v4_rule_id, rv);
		err = NSS_CAPWAPMGR_FAILURE_ACL_RULE_ALREADY_EXIST;
		goto fail1;
	}

	rv = fal_acl_list_unbind(dev_id, list_id, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORTBITMAP, NSS_CAPWAPMGR_BIND_BITMAP);
	if (rv != SW_OK) {
		nss_capwapmgr_warn("Failed to unbind list: %d - code: %d\n", list_id, rv);
		err = NSS_CAPWAPMGR_FAILURE_ADD_ACL_RULE;
		goto fail1;
	}

	rv = fal_acl_rule_add(dev_id, list_id, v4_rule_id, rule_nr, acl_rule);
	if (rv != SW_OK) {
		nss_capwapmgr_warn("Failed to add ACL v4_rule: %d - code: %d\n", rv, v4_rule_id);
		err = NSS_CAPWAPMGR_FAILURE_ADD_ACL_RULE;
		goto fail1;
	}

	/*
	 * Create ACL rule for IPv6
	 */
	acl_rule->udf0_val = NSS_CAPWAPMGR_ETH_TYPE_IPV6;
	acl_rule->udf0_mask = NSS_CAPWAPMGR_ETH_TYPE_MASK;
	acl_rule->udf1_val = dscp_value << NSS_CAPWAPMGR_DSCP_MASK_IPV6_SHIFT;
	acl_rule->udf1_mask = dscp_mask << NSS_CAPWAPMGR_DSCP_MASK_IPV6_SHIFT;

	rv = fal_acl_rule_add(dev_id, list_id, v6_rule_id, rule_nr, acl_rule);
	if (rv != SW_OK) {
		nss_capwapmgr_warn("Failed to add ACL v6_rule: %d - code: %d\n", rv, v6_rule_id);
		err = NSS_CAPWAPMGR_FAILURE_ADD_ACL_RULE;
		goto fail2;
	}

	/*
	 * Bind list to all ethernet ports
	 */
	rv = fal_acl_list_bind(dev_id, list_id, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORTBITMAP, NSS_CAPWAPMGR_BIND_BITMAP);
	if (rv != SW_OK) {
		nss_capwapmgr_warn("Failed to bind ACL list: %d - code: %d\n", list_id, rv);
		err = NSS_CAPWAPMGR_FAILURE_BIND_ACL_LIST;
		goto fail3;
	}

	/*
	 * Set ACL as in_use and save dscp value and mask.
	 */
	global.acl_list[lid].rule[rid].in_use = true;
	global.acl_list[lid].rule[rid].dscp_value = dscp_value;
	global.acl_list[lid].rule[rid].dscp_mask = dscp_mask;

	/*
	 * Prioritize packets with the dscp value is dscp_value for non trustsec packets.
	 * These packets do not require any ACL Rule.
	 */
	cosmap.internal_pcp = 0;
	cosmap.internal_dei = 0;
	cosmap.internal_pri = pri;
	cosmap.internal_dscp = 0;
	cosmap.internal_dp = 0;
	for (i = 0; i < NSS_CAPWAPMGR_DSCP_MAX; i++) {
		if ((i & dscp_mask) != dscp_value) {
			continue;
		}

		rv = fal_qos_cosmap_dscp_get(dev_id, group_id, i, &orig_cosmap[i]);
		if (rv != SW_OK) {
			nss_capwapmgr_warn("dscpmap: failed to get cosmap for dscp %d\n", i);
			err = NSS_CAPWAPMGR_FAILURE_CONFIGURE_DSCP_MAP;
			goto fail4;
		}

		nss_capwapmgr_trace("dscpmap: setting priority %u for dscp %u\n", pri, i);
		rv = fal_qos_cosmap_dscp_set(dev_id, group_id, i, &cosmap);
		if (rv != SW_OK) {
			nss_capwapmgr_warn("Failed to configure cosmap for dscp %d - code: %d\n", i, rv);
			err = NSS_CAPWAPMGR_FAILURE_CONFIGURE_DSCP_MAP;
			goto fail4;
		}
	}

	kfree(acl_rule);
	kfree(orig_cosmap);

	*id = uid;

	return NSS_CAPWAPMGR_SUCCESS;

fail4:
	fail_dscp = i;
	for (i = 0; i < fail_dscp; i++) {
		if ((i & dscp_mask) != dscp_value) {
			continue;
		}

		nss_capwapmgr_trace("dscpmap: resetting to priority %u for dscp %u\n", orig_cosmap[i].internal_pri, i);
		rv = fal_qos_cosmap_dscp_set(dev_id, group_id, i, &orig_cosmap[i]);
		if (rv != SW_OK) {
			nss_capwapmgr_warn("Failed to reset cosmap for dscp %d - code: %d\n", i, rv);
		}
	}

fail3:
	rv = fal_acl_rule_delete(dev_id, list_id, v6_rule_id, rule_nr);
	if (rv != SW_OK) {
		nss_capwapmgr_warn("Failed to del ACL v6_rule %d from list %d - code: %d\n", v6_rule_id, list_id, rv);
	}

fail2:
	rv = fal_acl_rule_delete(dev_id, list_id, v4_rule_id, rule_nr);
	if (rv != SW_OK) {
		nss_capwapmgr_warn("Failed to del ACL v4_rule %d from list %d - code: %d\n", v4_rule_id, list_id, rv);
	}

fail1:
	kfree(orig_cosmap);
	kfree(acl_rule);

	return err;
}
EXPORT_SYMBOL(nss_capwapmgr_dscp_rule_create);

/*
 * nss_capwapmgr_configure_dtls
 *	Enable or disable DTLS of a capwap tunnel
 */
nss_capwapmgr_status_t nss_capwapmgr_configure_dtls(struct net_device *dev, uint8_t tunnel_id, uint8_t enable_dtls, struct nss_dtlsmgr_config *in_data)
{
	struct nss_capwapmgr_priv *priv;
	struct nss_capwap_msg capwapmsg_inner, capwapmsg_outer;
	struct nss_capwapmgr_tunnel *t;
	struct nss_ipv4_destroy v4;
	struct nss_ipv6_destroy v6;
	nss_tx_status_t nss_status = NSS_TX_SUCCESS;
	nss_capwapmgr_status_t status;
	uint32_t ip_if_num, dtls_enabled, outer_trustsec_enabled;

	dev_hold(dev);
	t = nss_capwapmgr_verify_tunnel_param(dev, tunnel_id);
	if (!t) {
		nss_capwapmgr_warn("%px: can't find tunnel: %d\n", dev, tunnel_id);
		dev_put(dev);
		return NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
	}

	outer_trustsec_enabled = t->capwap_rule.enabled_features & NSS_CAPWAPMGR_FEATURE_OUTER_TRUSTSEC_ENABLED;
	dtls_enabled = t->capwap_rule.enabled_features & NSS_CAPWAPMGR_FEATURE_DTLS_ENABLED;
	if ((enable_dtls && dtls_enabled) || (!enable_dtls && !dtls_enabled)) {
		nss_capwapmgr_warn("%px: nothing changed for tunnel: %d\n", dev, tunnel_id);
		dev_put(dev);
		return NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
	}

	/*
	 * We don't allow configuring dtls on tunnel if it's still
	 * enabled.
	 */
	if (t->tunnel_state & NSS_CAPWAPMGR_TUNNEL_STATE_ENABLED) {
		nss_capwapmgr_warn("%px: tunnel %d is already enabled\n", dev, tunnel_id);
		dev_put(dev);
		return NSS_CAPWAPMGR_FAILURE_TUNNEL_ENABLED;
	}

	/*
	 * Prepare DTLS configure message
	 */
	memset(&capwapmsg_inner, 0, sizeof(struct nss_capwap_msg));
	nss_capwap_msg_init(&capwapmsg_inner, t->if_num_inner, NSS_CAPWAP_MSG_TYPE_DTLS,
		sizeof(struct nss_capwap_dtls_msg), nss_capwapmgr_msg_event_receive, dev);

	memset(&capwapmsg_outer, 0, sizeof(struct nss_capwap_msg));
	nss_capwap_msg_init(&capwapmsg_outer, t->if_num_outer, NSS_CAPWAP_MSG_TYPE_DTLS,
		sizeof(struct nss_capwap_dtls_msg), nss_capwapmgr_msg_event_receive, dev);


	if (!enable_dtls) {
		nss_capwapmgr_info("%px disabling DTLS for tunnel: %d\n", dev, tunnel_id);

		ip_if_num = nss_capwap_ifnum_with_core_id(t->if_num_outer);
		capwapmsg_inner.msg.dtls.enable = 0;
		capwapmsg_inner.msg.dtls.dtls_inner_if_num = t->capwap_rule.dtls_inner_if_num;
		capwapmsg_inner.msg.dtls.mtu_adjust = 0;

		capwapmsg_outer.msg.dtls.enable = 0;

		/*
		 * Unconfigure trustsec tx first
		 */
		if (outer_trustsec_enabled) {
			nss_status = nss_trustsec_tx_unconfigure_sgt(t->capwap_rule.dtls_inner_if_num, t->capwap_rule.outer_sgt_value);
			if (nss_status != NSS_TX_SUCCESS) {
				nss_capwapmgr_warn("%px: unconfigure trustsec_tx failed\n", dev);
				dev_put(dev);
				return NSS_CAPWAPMGR_FAILURE_UNCONFIGURE_TRUSTSEC_TX;
			}
		}
	} else {
		nss_capwapmgr_info("%px enabling DTLS for tunnel: %d\n", dev, tunnel_id);

		if (!t->capwap_rule.dtls_inner_if_num) {
			/*
			 * Create a DTLS node, we only validate caller is providing a DTLS
			 * configuration structure, the correctness of these settings are
			 * validated by dtlsmgr
			 */
			if (!in_data) {
				nss_capwapmgr_info("%px: dtls in_data required to create dtls tunnel\n", dev);
				dev_put(dev);
				return NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
			}

			/*
			 * We only support the METADATA mode for pure DTLS tunnels; in CAPWAP-DTLS
			 * the offload will not send the packets starting with Metadata. We need to
			 * ensure that the user does not configure this mode accidentally.
			 */
			in_data->flags &= ~NSS_DTLSMGR_ENCAP_METADATA;
			in_data->decap.nexthop_ifnum = nss_capwap_ifnum_with_core_id(t->if_num_outer);

			t->dtls_dev = nss_dtlsmgr_session_create(in_data);
			if (!t->dtls_dev) {
				nss_capwapmgr_warn("%px: cannot create DTLS session\n", dev);
				dev_put(dev);
				return NSS_CAPWAPMGR_FAILURE_DI_ALLOC_FAILED;
			}

			/* Store the DTLS encap and decap interface numbers */
			t->capwap_rule.dtls_inner_if_num = nss_dtlsmgr_get_interface(t->dtls_dev,
										     NSS_DTLSMGR_INTERFACE_TYPE_INNER);
			t->capwap_rule.mtu_adjust = t->dtls_dev->needed_headroom + t->dtls_dev->needed_tailroom;
			nss_capwapmgr_info("%px: created dtls node for tunnel: %d if_num: %d mtu_adjust: %d\n",
					   dev, tunnel_id, t->capwap_rule.dtls_inner_if_num, t->capwap_rule.mtu_adjust);
		}

		ip_if_num = nss_dtlsmgr_get_interface(t->dtls_dev, NSS_DTLSMGR_INTERFACE_TYPE_OUTER);

		capwapmsg_inner.msg.dtls.enable = 1;
		capwapmsg_inner.msg.dtls.dtls_inner_if_num = t->capwap_rule.dtls_inner_if_num;
		capwapmsg_inner.msg.dtls.mtu_adjust = t->capwap_rule.mtu_adjust;

		capwapmsg_outer.msg.dtls.enable = 1;

		/*
		 * Unconfigure trustsec tx first
		 */
		if (outer_trustsec_enabled) {
			nss_status = nss_trustsec_tx_unconfigure_sgt(t->if_num_outer, t->capwap_rule.outer_sgt_value);
			if (nss_status != NSS_TX_SUCCESS) {
				nss_capwapmgr_warn("%px: unconfigure trustsec_tx failed\n", dev);
				dev_put(dev);
				return NSS_CAPWAPMGR_FAILURE_UNCONFIGURE_TRUSTSEC_TX;
			}
		}
	}

	/*
	 * Re-configure trustsec_tx
	 */
	if (outer_trustsec_enabled) {
		nss_status = nss_trustsec_tx_configure_sgt(ip_if_num, t->capwap_rule.gmac_ifnum, t->capwap_rule.outer_sgt_value);
		if (nss_status != NSS_TX_SUCCESS) {
			nss_capwapmgr_warn("%px: configure trustsec_tx failed\n", dev);
			dev_put(dev);
			return NSS_CAPWAPMGR_FAILURE_CONFIGURE_TRUSTSEC_TX;
		}
	}

	priv = netdev_priv(dev);

	/*
	 * Recreate ipv4/v6 rules with the new interface number
	 */
	if (t->capwap_rule.l3_proto == NSS_CAPWAP_TUNNEL_IPV4) {
		if (t->tunnel_state & NSS_CAPWAPMGR_TUNNEL_STATE_IPRULE_CONFIGURED) {
			v4.protocol = IPPROTO_UDP;
			v4.src_ip = t->ip_rule.v4.src_ip;
			v4.dest_ip = t->ip_rule.v4.dest_ip;
			v4.src_port = t->ip_rule.v4.src_port;
			v4.dest_port = t->ip_rule.v4.dest_port;
			nss_status = nss_capwapmgr_unconfigure_ipv4_rule(&v4);
			if (nss_status != NSS_TX_SUCCESS) {
				nss_capwapmgr_warn("%px: unconfigure ipv4 rule failed : %d\n", dev, nss_status);
				dev_put(dev);
				return NSS_CAPWAPMGR_FAILURE_IP_DESTROY_RULE;
			}
			t->tunnel_state &= ~NSS_CAPWAPMGR_TUNNEL_STATE_IPRULE_CONFIGURED;
		}

		t->ip_rule.v4.dest_interface_num = ip_if_num;
		nss_status = nss_capwapmgr_configure_ipv4(&t->ip_rule.v4, 0, 0);
	} else {
		if (t->tunnel_state & NSS_CAPWAPMGR_TUNNEL_STATE_IPRULE_CONFIGURED) {
			if (t->capwap_rule.which_udp == NSS_CAPWAP_TUNNEL_UDP) {
				v6.protocol = IPPROTO_UDP;
			} else {
				v6.protocol = IPPROTO_UDPLITE;
			}

			v6.src_ip[0] = t->ip_rule.v6.src_ip[0];
			v6.src_ip[1] = t->ip_rule.v6.src_ip[1];
			v6.src_ip[2] = t->ip_rule.v6.src_ip[2];
			v6.src_ip[3] = t->ip_rule.v6.src_ip[3];

			v6.dest_ip[0] = t->ip_rule.v6.dest_ip[0];
			v6.dest_ip[1] = t->ip_rule.v6.dest_ip[1];
			v6.dest_ip[2] = t->ip_rule.v6.dest_ip[2];
			v6.dest_ip[3] = t->ip_rule.v6.dest_ip[3];

			v6.src_port = t->ip_rule.v6.src_port;
			v6.dest_port = t->ip_rule.v6.dest_port;
			nss_status = nss_capwapmgr_unconfigure_ipv6_rule(&v6);
			if (nss_status != NSS_TX_SUCCESS) {
				nss_capwapmgr_warn("%px: unconfigure ipv6 rule failed : %d\n", dev, nss_status);
				dev_put(dev);
				return NSS_CAPWAPMGR_FAILURE_IP_DESTROY_RULE;
			}
			t->tunnel_state &= ~NSS_CAPWAPMGR_TUNNEL_STATE_IPRULE_CONFIGURED;
		}
		t->ip_rule.v6.dest_interface_num = ip_if_num;
		nss_status = nss_capwapmgr_configure_ipv6(&t->ip_rule.v6, 0, 0);
	}

	if (nss_status != NSS_TX_SUCCESS) {
		nss_capwapmgr_warn("%px: configure ip rule failed : %d\n", dev, nss_status);
		dev_put(dev);
		return NSS_CAPWAPMGR_FAILURE_IP_RULE;
	}

	/*
	 * Now configure capwap dtls
	 */
	t->tunnel_state |= NSS_CAPWAPMGR_TUNNEL_STATE_IPRULE_CONFIGURED;
	status = nss_capwapmgr_tx_msg_sync(priv->nss_ctx, dev, &capwapmsg_inner);
	if (status != NSS_CAPWAPMGR_SUCCESS) {
		nss_capwapmgr_warn("%px: configure DTLS failed for inner node: %d\n", dev, status);
		dev_put(dev);
		return status;
	}

	status = nss_capwapmgr_tx_msg_sync(priv->nss_ctx, dev, &capwapmsg_outer);
	if (status != NSS_CAPWAPMGR_SUCCESS) {
		nss_capwapmgr_warn("%px: configure DTLS failed for outer node: %d\n", dev, status);
		dev_put(dev);
		return status;
	}

	if (enable_dtls) {
		t->capwap_rule.enabled_features |= NSS_CAPWAPMGR_FEATURE_DTLS_ENABLED;
	} else {
		t->capwap_rule.enabled_features &= ~NSS_CAPWAPMGR_FEATURE_DTLS_ENABLED;
	}
	dev_put(dev);
	return NSS_CAPWAPMGR_SUCCESS;
}
EXPORT_SYMBOL(nss_capwapmgr_configure_dtls);

/*
 * nss_capwapmgr_verify_dtls_rekey_param()
 *	Validate the rekey param for a DTLS tunnel and return the DTLS netdevice
 *
 *  The caller should hold the reference on the net device before calling.
 */
static inline struct net_device *nss_capwapmgr_verify_dtls_rekey_param(struct net_device *dev, uint8_t tunnel_id,
								 struct nss_dtlsmgr_config_update *udata)
{
	struct nss_capwapmgr_tunnel *t;

	if (!udata) {
		nss_capwapmgr_info("%px: dtls session update data required\n", dev);
		return NULL;
	}

	t = nss_capwapmgr_verify_tunnel_param(dev, tunnel_id);
	if (!t) {
		nss_capwapmgr_warn("%px: can't find tunnel: %d\n", dev, tunnel_id);
		return NULL;
	}

	if (!(t->capwap_rule.enabled_features & NSS_CAPWAPMGR_FEATURE_DTLS_ENABLED)) {
		nss_capwapmgr_warn("%px: tunnel does not enable DTLS: %d\n", dev, tunnel_id);
		return NULL;
	}

	return t->dtls_dev;
}

/*
 * nss_capwapmgr_dtls_rekey_rx_cipher_update()
 *	Update the rx cipher key for an DTLS tunnel
 */
nss_capwapmgr_status_t nss_capwapmgr_dtls_rekey_rx_cipher_update(struct net_device *dev, uint8_t tunnel_id,
								 struct nss_dtlsmgr_config_update *udata)
{
	struct net_device *dtls_ndev;

	dev_hold(dev);
	dtls_ndev = nss_capwapmgr_verify_dtls_rekey_param(dev, tunnel_id, udata);
	dev_put(dev);

	if (!dtls_ndev) {
		goto fail;
	}

	/*
	 * Calling dtlsmgr for rekey
	 */
	if (nss_dtlsmgr_session_update_decap(dtls_ndev, udata) != NSS_DTLSMGR_OK) {
		goto fail;
	}
	return NSS_CAPWAPMGR_SUCCESS;

fail:
	nss_capwapmgr_warn("%px: tunnel: %d rekey rx cipher update failed\n", dtls_ndev, tunnel_id);
	return NSS_CAPWAPMGR_FAILURE_INVALID_DTLS_CFG;
}
EXPORT_SYMBOL(nss_capwapmgr_dtls_rekey_rx_cipher_update);

/*
 * nss_capwapmgr_dtls_rekey_tx_cipher_update()
 *	Update the tx cipher key for an DTLS tunnel
 */
nss_capwapmgr_status_t nss_capwapmgr_dtls_rekey_tx_cipher_update(struct net_device *dev, uint8_t tunnel_id,
								 struct nss_dtlsmgr_config_update *udata)
{
	struct net_device *dtls_ndev;

	dev_hold(dev);
	dtls_ndev = nss_capwapmgr_verify_dtls_rekey_param(dev, tunnel_id, udata);
	dev_put(dev);

	if (!dtls_ndev) {
		goto fail;
	}

	/*
	 * Calling dtlsmgr for rekey
	 */
	if (nss_dtlsmgr_session_update_encap(dtls_ndev, udata) != NSS_DTLSMGR_OK) {
		goto fail;
	}
	return NSS_CAPWAPMGR_SUCCESS;

fail:
	nss_capwapmgr_warn("%px: tunnel: %d rekey rx cipher update failed\n", dtls_ndev, tunnel_id);
	return NSS_CAPWAPMGR_FAILURE_INVALID_DTLS_CFG;
}
EXPORT_SYMBOL(nss_capwapmgr_dtls_rekey_tx_cipher_update);

/*
 * nss_capwapmgr_dtls_rekey_rx_cipher_switch()
 *	Switch the rx cipher key for an DTLS tunnel
 */
nss_capwapmgr_status_t nss_capwapmgr_dtls_rekey_rx_cipher_switch(struct net_device *dev, uint8_t tunnel_id)
{
	struct nss_capwapmgr_tunnel *t;
	nss_capwapmgr_status_t status = NSS_CAPWAPMGR_SUCCESS;

	dev_hold(dev);
	t = nss_capwapmgr_verify_tunnel_param(dev, tunnel_id);
	if (!t) {
		nss_capwapmgr_warn("%px: can't find tunnel: %d\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
		goto done;
	}

	if (!(t->capwap_rule.enabled_features & NSS_CAPWAPMGR_FEATURE_DTLS_ENABLED)) {
		nss_capwapmgr_warn("%px: tunnel does not enable DTLS: %d\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
		goto done;
	}

	/*
	 * Calling dtlsmgr for rekey switch
	 */
	if (!nss_dtlsmgr_session_switch_decap(t->dtls_dev)) {
		nss_capwapmgr_warn("%px: tunnel: %d rekey rx cipher switch failed\n", t->dtls_dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_INVALID_DTLS_CFG;
	}

done:
	dev_put(dev);
	return status;
}
EXPORT_SYMBOL(nss_capwapmgr_dtls_rekey_rx_cipher_switch);

/*
 * nss_capwapmgr_dtls_rekey_tx_cipher_switch()
 *	Switch the tx cipher key for an DTLS tunnel
 */
nss_capwapmgr_status_t nss_capwapmgr_dtls_rekey_tx_cipher_switch(struct net_device *dev, uint8_t tunnel_id)
{
	struct nss_capwapmgr_tunnel *t;
	nss_capwapmgr_status_t status = NSS_CAPWAPMGR_SUCCESS;

	dev_hold(dev);
	t = nss_capwapmgr_verify_tunnel_param(dev, tunnel_id);
	if (!t) {
		nss_capwapmgr_warn("%px: can't find tunnel: %d\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
		goto done;
	}

	if (!(t->capwap_rule.enabled_features & NSS_CAPWAPMGR_FEATURE_DTLS_ENABLED)) {
		nss_capwapmgr_warn("%px: tunnel does not enable DTLS: %d\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
		goto done;
	}

	/*
	 * Calling dtlsmgr for rekey switch
	 */
	if (!nss_dtlsmgr_session_switch_encap(t->dtls_dev)) {
		nss_capwapmgr_warn("%px: tunnel: %d rekey tx cipher switch failed\n", t->dtls_dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_INVALID_DTLS_CFG;
	}

done:
	dev_put(dev);
	return status;
}
EXPORT_SYMBOL(nss_capwapmgr_dtls_rekey_tx_cipher_switch);

/*
 * nss_capwapmgr_change_version()
 *	Change CAPWAP version
 */

nss_capwapmgr_status_t nss_capwapmgr_change_version(struct net_device *dev, uint8_t tunnel_id, uint8_t ver)
{
	struct nss_capwapmgr_priv *priv;
	struct nss_capwap_msg capwapmsg;
	struct nss_capwapmgr_tunnel *t;
	nss_capwapmgr_status_t status = NSS_CAPWAPMGR_SUCCESS;

	dev_hold(dev);
	t = nss_capwapmgr_verify_tunnel_param(dev, tunnel_id);
	if (!t) {
		nss_capwapmgr_warn("%px: can't find tunnel: %d\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
		goto done;
	}

	if (ver > NSS_CAPWAP_VERSION_V2) {
		nss_capwapmgr_warn("%px: un-supported Version: %d\n", dev, ver);
		status = NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
		goto done;
	}

	priv = netdev_priv(dev);

	/*
	 * Prepare the tunnel configuration parameter to send to NSS FW
	 */
	memset(&capwapmsg, 0, sizeof(struct nss_capwap_msg));

	/*
	 * Send CAPWAP data tunnel command to NSS
	 */
	nss_capwap_msg_init(&capwapmsg, t->if_num_inner, NSS_CAPWAP_MSG_TYPE_VERSION,
		sizeof(struct nss_capwap_version_msg), nss_capwapmgr_msg_event_receive, dev);
	capwapmsg.msg.version.version = ver;
	status = nss_capwapmgr_tx_msg_sync(priv->nss_ctx, dev, &capwapmsg);
	if (status != NSS_CAPWAPMGR_SUCCESS) {
		nss_capwapmgr_warn("%px: Update Path MTU Tunnel error : %d \n", dev, status);
	}

done:
	dev_put(dev);
	return status;
}
EXPORT_SYMBOL(nss_capwapmgr_change_version);

/*
 * nss_capwapmgr_enable_tunnel()
 *	API for enabling a data tunnel
 */
nss_capwapmgr_status_t nss_capwapmgr_enable_tunnel(struct net_device *dev, uint8_t tunnel_id)
{
	struct nss_capwapmgr_priv *priv;
	struct nss_capwapmgr_tunnel *t;
	nss_capwapmgr_status_t status = NSS_CAPWAPMGR_SUCCESS;

	dev_hold(dev);
	t = nss_capwapmgr_verify_tunnel_param(dev, tunnel_id);
	if (!t) {
		nss_capwapmgr_warn("%px: can't find tunnel: %d\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
		goto done;
	}

	if (t->tunnel_state & NSS_CAPWAPMGR_TUNNEL_STATE_ENABLED) {
		nss_capwapmgr_warn("%px: tunnel %d is already enabled\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_TUNNEL_ENABLED;
		goto done;
	}

	priv = netdev_priv(dev);
	nss_capwapmgr_info("%px: Inner:%d Outer:%d. Tunnel enable is being called\n", dev, t->if_num_inner, t->if_num_outer);

	status = nss_capwapmgr_tx_msg_enable_tunnel(priv->nss_ctx, dev, t->if_num_inner,t->if_num_outer);
	if (status != NSS_CAPWAPMGR_SUCCESS) {
		goto done;
	}

	status = nss_capwapmgr_tx_msg_enable_tunnel(priv->nss_ctx, dev, t->if_num_outer,t->if_num_inner);
	if(status != NSS_CAPWAPMGR_SUCCESS) {
		nss_capwapmgr_tunnel_action(priv->nss_ctx, dev, t->if_num_inner,NSS_CAPWAP_MSG_TYPE_DISABLE_TUNNEL);
		goto done;
	}

	t->tunnel_state |= NSS_CAPWAPMGR_TUNNEL_STATE_ENABLED;

done:
	dev_put(dev);
	return status;
}
EXPORT_SYMBOL(nss_capwapmgr_enable_tunnel);

/*
 * nss_capwapmgr_disable_tunnel()
 *	API for disabling a data tunnel
 */
nss_capwapmgr_status_t nss_capwapmgr_disable_tunnel(struct net_device *dev, uint8_t tunnel_id)
{
	struct nss_capwapmgr_priv *priv;
	struct nss_capwapmgr_tunnel *t;
	nss_capwapmgr_status_t status = NSS_CAPWAPMGR_SUCCESS;

	dev_hold(dev);
	t = nss_capwapmgr_verify_tunnel_param(dev, tunnel_id);
	if (!t) {
		nss_capwapmgr_warn("%px: can't find tunnel: %d\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
		goto done;
	}

	if (!(t->tunnel_state & NSS_CAPWAPMGR_TUNNEL_STATE_ENABLED)) {
		nss_capwapmgr_warn("%px: tunnel %d is already disabled\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_TUNNEL_DISABLED;
		goto done;
	}

	priv = netdev_priv(dev);
	nss_capwapmgr_info("%px: Inner:%d Outer:%d. Tunnel disable is being called\n", dev, t->if_num_inner, t->if_num_outer);

	status = nss_capwapmgr_tunnel_action(priv->nss_ctx, dev, t->if_num_inner,NSS_CAPWAP_MSG_TYPE_DISABLE_TUNNEL);
	if (status != NSS_CAPWAPMGR_SUCCESS) {
		status = NSS_CAPWAPMGR_FAILURE_TUNNEL_DISABLED;
		nss_capwapmgr_warn("%px: tunnel %d disable failed\n", dev, tunnel_id);
		goto done;
	}

	status = nss_capwapmgr_tunnel_action(priv->nss_ctx, dev, t->if_num_outer,NSS_CAPWAP_MSG_TYPE_DISABLE_TUNNEL);
	if (status != NSS_CAPWAPMGR_SUCCESS) {
		nss_capwapmgr_warn("%px: tunnel %d disable failed\n", dev, tunnel_id);
		nss_capwapmgr_tx_msg_enable_tunnel(priv->nss_ctx, dev, t->if_num_inner, t->if_num_outer);
		goto done;
	}

	t->tunnel_state &= ~NSS_CAPWAPMGR_TUNNEL_STATE_ENABLED;

done:
	dev_put(dev);
	return status;
}
EXPORT_SYMBOL(nss_capwapmgr_disable_tunnel);

/*
 * nss_capwapmgr_tunnel_create_common()
 *	Common handling for creating IPv4 or IPv6 tunnel
 */
static nss_capwapmgr_status_t nss_capwapmgr_tunnel_create_common(struct net_device *dev, uint8_t tunnel_id,
	struct nss_ipv4_create *v4, struct nss_ipv6_create *v6, struct nss_capwap_rule_msg *capwap_rule, struct nss_dtlsmgr_config *in_data)
{
	struct nss_capwapmgr_priv *priv;
	struct nss_capwapmgr_tunnel *t;
	nss_capwapmgr_status_t status = NSS_CAPWAPMGR_SUCCESS;
	int32_t capwap_if_num_inner, capwap_if_num_outer, forward_if_num;
	uint16_t type_flags = 0;
	nss_tx_status_t nss_status = NSS_TX_SUCCESS;
	uint32_t dtls_enabled = capwap_rule->enabled_features & NSS_CAPWAPMGR_FEATURE_DTLS_ENABLED;
	uint32_t outer_trustsec_enabled = capwap_rule->enabled_features & NSS_CAPWAPMGR_FEATURE_OUTER_TRUSTSEC_ENABLED;

	if (!v4 && !v6) {
		nss_capwapmgr_warn("%px: invalid ip create rule for tunnel: %d\n", dev, tunnel_id);
		return NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
	}

	if (tunnel_id > NSS_CAPWAPMGR_MAX_TUNNELS) {
		nss_capwapmgr_warn("%px: invalid tunnel_id: %d max: NSS_CAPWAPMGR_MAX_TUNNELS\n", dev, tunnel_id);
		return NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
	}

	if (!(capwap_rule->l3_proto == NSS_CAPWAP_TUNNEL_IPV4 ||
		capwap_rule->l3_proto == NSS_CAPWAP_TUNNEL_IPV6)) {
		nss_capwapmgr_warn("%px: tunnel %d: wrong argument for l3_proto\n", dev, tunnel_id);
		return NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
	}

	if (!(capwap_rule->which_udp == NSS_CAPWAP_TUNNEL_UDP ||
		capwap_rule->which_udp == NSS_CAPWAP_TUNNEL_UDPLite)) {
		nss_capwapmgr_warn("%px: tunnel %d: wrong argument for which_udp\n", dev, tunnel_id);
		return NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
	}

	if (dtls_enabled && !in_data) {
		nss_capwapmgr_warn("%px: need to supply in_data if DTLS is enabled\n", dev);
		return NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
	}

	dev_hold(dev);
	t = nss_capwapmgr_verify_tunnel_param(dev, tunnel_id);
	if (t) {
		nss_capwapmgr_warn("%px: tunnel: %d already created\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_TUNNEL_EXISTS;
		goto done;
	}

	capwap_if_num_inner = nss_dynamic_interface_alloc_node(NSS_DYNAMIC_INTERFACE_TYPE_CAPWAP_HOST_INNER);
	if (capwap_if_num_inner < 0) {
		nss_capwapmgr_warn("%px: di returned error : %d\n", dev, capwap_if_num_inner);
		status = NSS_CAPWAPMGR_FAILURE_DI_ALLOC_FAILED;
		goto done;
	}

	if (nss_capwapmgr_register_with_nss(capwap_if_num_inner, dev) != NSS_CAPWAPMGR_SUCCESS) {
		nss_capwapmgr_warn("%d: NSS CAPWAP register with NSS failed", capwap_if_num_inner);
		status = NSS_CAPWAPMGR_FAILURE_REGISTER_NSS;
		goto fail1;
	}

	capwap_if_num_outer = nss_dynamic_interface_alloc_node(NSS_DYNAMIC_INTERFACE_TYPE_CAPWAP_OUTER);
	if (capwap_if_num_outer < 0) {
		nss_capwapmgr_warn("%px: di returned error : %d\n", dev, capwap_if_num_outer);
		status = NSS_CAPWAPMGR_FAILURE_DI_ALLOC_FAILED;
		goto fail2;
	}

	if (nss_capwapmgr_register_with_nss(capwap_if_num_outer, dev) != NSS_CAPWAPMGR_SUCCESS) {
		nss_capwapmgr_warn("%d: NSS CAPWAP register with NSS failed", capwap_if_num_outer);
		status = NSS_CAPWAPMGR_FAILURE_REGISTER_NSS;
		goto fail3;
	}

	if (!dtls_enabled) {
		capwap_rule->mtu_adjust = 0;
		capwap_rule->dtls_inner_if_num = 0;
		forward_if_num = nss_capwap_ifnum_with_core_id(capwap_if_num_outer);
	} else {
		/*
		 * We only support the METADATA mode for pure DTLS tunnels; in CAPWAP-DTLS
		 * the offload will not send the packets starting with Metadata. We need to
		 * ensure that the user does not configure this mode accidentally.
		 */
		in_data->flags &= ~NSS_DTLSMGR_ENCAP_METADATA;
		in_data->decap.nexthop_ifnum = nss_capwap_ifnum_with_core_id(capwap_if_num_outer);

		t->dtls_dev = nss_dtlsmgr_session_create(in_data);
		if (!t->dtls_dev) {
			nss_capwapmgr_warn("%px: NSS DTLS node alloc failed\n", dev);
			status = NSS_CAPWAPMGR_FAILURE_DI_ALLOC_FAILED;
			goto fail4;
		}
		capwap_rule->dtls_inner_if_num = nss_dtlsmgr_get_interface(t->dtls_dev, NSS_DTLSMGR_INTERFACE_TYPE_INNER);
		forward_if_num = nss_dtlsmgr_get_interface(t->dtls_dev, NSS_DTLSMGR_INTERFACE_TYPE_OUTER);
		capwap_rule->mtu_adjust = t->dtls_dev->needed_headroom + t->dtls_dev->needed_tailroom;
	}

	if (outer_trustsec_enabled) {
		nss_capwapmgr_info("%px: configure TrustsecTx with sgt value: %x\n", dev, capwap_rule->outer_sgt_value);
		if (v4) {
			capwap_rule->gmac_ifnum = v4->src_interface_num;
			nss_status = nss_trustsec_tx_configure_sgt(forward_if_num, v4->src_interface_num, capwap_rule->outer_sgt_value);
			v4->src_interface_num = NSS_TRUSTSEC_TX_INTERFACE;
		} else {
			capwap_rule->gmac_ifnum = v6->src_interface_num;
			nss_status = nss_trustsec_tx_configure_sgt(forward_if_num, v6->src_interface_num, capwap_rule->outer_sgt_value);
			v6->src_interface_num = NSS_TRUSTSEC_TX_INTERFACE;
		}
		if (nss_status != NSS_TX_SUCCESS) {
			nss_capwapmgr_warn("%px: configure trustsectx node failed\n", dev);
			status = NSS_CAPWAPMGR_FAILURE_CONFIGURE_TRUSTSEC_TX;
			goto fail5;
		}
	}

	/*
	 * We use type_flags to determine the correct header sizes
	 * for a frame when encaping. CAPWAP processing node in the
	 * NSS FW does not know anything about IP rule information.
	 */
	if (v4) {
		if ((v4->out_vlan_tag[0] & 0xFFF) != 0xFFF) {
			type_flags |= NSS_CAPWAP_RULE_CREATE_VLAN_CONFIGURED;
		}

		if (v4->flow_pppoe_if_exist) {
			type_flags |= NSS_CAPWAP_RULE_CREATE_PPPOE_CONFIGURED;
		}
	} else {
		if ((v6->out_vlan_tag[0] & 0xFFF) != 0xFFF) {
			type_flags |= NSS_CAPWAP_RULE_CREATE_VLAN_CONFIGURED;
		}

		if (v6->flow_pppoe_if_exist) {
			type_flags |= NSS_CAPWAP_RULE_CREATE_PPPOE_CONFIGURED;
		}
	}

	if (capwap_rule->l3_proto == NSS_CAPWAP_TUNNEL_IPV6 && capwap_rule->which_udp == NSS_CAPWAP_TUNNEL_UDPLite) {
		type_flags |= NSS_CAPWAP_ENCAP_UDPLITE_HDR_CSUM;
	}

	/*
	 * Copy over the IP rule information to capwap rule for encap side.
	 * This will avoid any confusions because IP rule direction is AC->AP and
	 * capwap encap rule direction is AP->AC.
	 */
	if (v4) {
		capwap_rule->encap.src_port = htonl(v4->dest_port);
		capwap_rule->encap.src_ip.ip.ipv4 = htonl(v4->dest_ip);

		capwap_rule->encap.dest_port = htonl(v4->src_port);
		capwap_rule->encap.dest_ip.ip.ipv4 = htonl(v4->src_ip);
	} else {
		capwap_rule->encap.src_port = htonl(v6->dest_port);
		capwap_rule->encap.src_ip.ip.ipv6[0] = htonl(v6->dest_ip[0]);
		capwap_rule->encap.src_ip.ip.ipv6[1] = htonl(v6->dest_ip[1]);
		capwap_rule->encap.src_ip.ip.ipv6[2] = htonl(v6->dest_ip[2]);
		capwap_rule->encap.src_ip.ip.ipv6[3] = htonl(v6->dest_ip[3]);

		capwap_rule->encap.dest_port = htonl(v6->src_port);
		capwap_rule->encap.dest_ip.ip.ipv6[0] = htonl(v6->src_ip[0]);
		capwap_rule->encap.dest_ip.ip.ipv6[1] = htonl(v6->src_ip[1]);
		capwap_rule->encap.dest_ip.ip.ipv6[2] = htonl(v6->src_ip[2]);
		capwap_rule->encap.dest_ip.ip.ipv6[3] = htonl(v6->src_ip[3]);
	}

	status = nss_capwapmgr_create_capwap_rule(dev, capwap_if_num_inner, capwap_rule, type_flags);
	nss_capwapmgr_info("%px: dynamic interface if_num is :%d and capwap tunnel status:%d\n", dev, capwap_if_num_inner, status);
	if (status != NSS_CAPWAPMGR_SUCCESS) {
		nss_capwapmgr_warn("%px: %d: CAPWAP rule create failed with status: %d", dev, capwap_if_num_inner, status);
		status = NSS_CAPWAPMGR_FAILURE_CAPWAP_RULE;
		goto fail5;
	}

	status = nss_capwapmgr_create_capwap_rule(dev, capwap_if_num_outer, capwap_rule, type_flags);
	nss_capwapmgr_info("%px: dynamic interface if_num is :%d and capwap tunnel status:%d\n", dev, capwap_if_num_outer, status);
	if (status != NSS_CAPWAPMGR_SUCCESS) {
		nss_capwapmgr_warn("%px: %d: CAPWAP rule create failed with status: %d", dev, capwap_if_num_outer, status);
		status = NSS_CAPWAPMGR_FAILURE_CAPWAP_RULE;
		goto fail5;
	}

	if (v4) {
		v4->dest_interface_num = forward_if_num;
		nss_status = nss_capwapmgr_configure_ipv4(v4, 0, 0);
	} else {
		v6->dest_interface_num = forward_if_num;
		nss_status = nss_capwapmgr_configure_ipv6(v6, 0, 0);
	}

	if (nss_status != NSS_TX_SUCCESS) {
		nss_capwapmgr_warn("%px: %d: IPv4/IPv6 rule create failed with status: %d", dev, forward_if_num, nss_status);
		status = NSS_CAPWAPMGR_FAILURE_IP_RULE;
		goto fail5;
	}

	priv = netdev_priv(dev);
	t = &priv->tunnel[tunnel_id];
	nss_capwapmgr_info("%px: %d: %d: CAPWAP TUNNEL CREATE DONE tunnel_id:%d (%px)\n", dev, capwap_if_num_inner, capwap_if_num_outer, tunnel_id, t);

	/*
	 * Keep a copy of rule information.
	 */
	if (v4) {
		memcpy(&t->ip_rule.v4, v4, sizeof (struct nss_ipv4_create));
	} else {
		memcpy(&t->ip_rule.v6, v6, sizeof (struct nss_ipv6_create));
	}

	memcpy(&t->capwap_rule, capwap_rule, sizeof (struct nss_capwap_rule_msg));

	/*
	 * Make it globally visible inside the netdev.
	 */
	t->if_num_inner = capwap_if_num_inner;
	t->if_num_outer = capwap_if_num_outer;
	priv->if_num_to_tunnel_id[capwap_if_num_inner] = tunnel_id;
	priv->if_num_to_tunnel_id[capwap_if_num_outer] = tunnel_id;
	t->tunnel_state |= NSS_CAPWAPMGR_TUNNEL_STATE_CONFIGURED;
	t->tunnel_state |= NSS_CAPWAPMGR_TUNNEL_STATE_IPRULE_CONFIGURED;
	t->type_flags = type_flags;

	goto done;

fail5:
	if (dtls_enabled) {
		if (nss_dtlsmgr_session_destroy(t->dtls_dev) != NSS_DTLSMGR_OK) {
			nss_capwapmgr_warn("%px: failed to destroy DTLS session", t->dtls_dev);
		}
	}
fail4:
	nss_capwapmgr_unregister_with_nss(capwap_if_num_outer);
fail3:
	(void)nss_dynamic_interface_dealloc_node(capwap_if_num_outer, NSS_DYNAMIC_INTERFACE_TYPE_CAPWAP_OUTER);
fail2:
	nss_capwapmgr_unregister_with_nss(capwap_if_num_inner);
fail1:
	(void)nss_dynamic_interface_dealloc_node(capwap_if_num_inner, NSS_DYNAMIC_INTERFACE_TYPE_CAPWAP_HOST_INNER);

done:
	dev_put(dev);
	return status;
}

/*
 * nss_capwapmgr_ipv4_tunnel_create()
 *	API for creating IPv4 and CAPWAP rule.
 */
nss_capwapmgr_status_t nss_capwapmgr_ipv4_tunnel_create(struct net_device *dev, uint8_t tunnel_id,
			struct nss_ipv4_create *ip_rule, struct nss_capwap_rule_msg *capwap_rule, struct nss_dtlsmgr_config *in_data)
{
	return nss_capwapmgr_tunnel_create_common(dev, tunnel_id, ip_rule, NULL, capwap_rule, in_data);
}
EXPORT_SYMBOL(nss_capwapmgr_ipv4_tunnel_create);

/*
 * nss_capwapmgr_ipv6_tunnel_create()
 *	API for creating IPv6 and CAPWAP rule.
 */
nss_capwapmgr_status_t nss_capwapmgr_ipv6_tunnel_create(struct net_device *dev, uint8_t tunnel_id,
			struct nss_ipv6_create *ip_rule, struct nss_capwap_rule_msg *capwap_rule, struct nss_dtlsmgr_config *in_data)
{
	return nss_capwapmgr_tunnel_create_common(dev, tunnel_id, NULL, ip_rule, capwap_rule, in_data);
}
EXPORT_SYMBOL(nss_capwapmgr_ipv6_tunnel_create);

/*
 * nss_capwapmgr_tunnel_save_stats()
 *	Internal function to save tunnel stats when a tunnel is being
 *	destroyed.
 */
static void nss_capwapmgr_tunnel_save_stats(struct nss_capwap_tunnel_stats *save, struct nss_capwap_tunnel_stats *fstats)
{
	save->dtls_pkts += fstats->dtls_pkts;

	save->rx_segments += fstats->rx_segments;
	save->rx_dup_frag += fstats->rx_dup_frag;
	save->rx_oversize_drops += fstats->rx_oversize_drops;
	save->rx_frag_timeout_drops += fstats->rx_frag_timeout_drops;
	save->rx_n2h_drops += fstats->rx_n2h_drops;
	save->rx_n2h_queue_full_drops += fstats->rx_n2h_queue_full_drops;
	save->rx_mem_failure_drops += fstats->rx_mem_failure_drops;
	save->rx_csum_drops += fstats->rx_csum_drops;
	save->rx_malformed += fstats->rx_malformed;
	save->rx_frag_gap_drops += fstats->rx_frag_gap_drops;

	save->tx_segments += fstats->tx_segments;
	save->tx_queue_full_drops += fstats->tx_queue_full_drops;
	save->tx_mem_failure_drops += fstats->tx_mem_failure_drops;
	save->tx_dropped_sg_ref += fstats->tx_dropped_sg_ref;
	save->tx_dropped_ver_mis += fstats->tx_dropped_ver_mis;
	save->tx_dropped_hroom += fstats->tx_dropped_hroom;
	save->tx_dropped_dtls += fstats->tx_dropped_dtls;
	save->tx_dropped_nwireless += fstats->tx_dropped_nwireless;

	/*
	 * add pnode stats now.
	 */
	save->pnode_stats.rx_packets += fstats->pnode_stats.rx_packets;
	save->pnode_stats.rx_bytes += fstats->pnode_stats.rx_bytes;
	save->pnode_stats.rx_dropped += fstats->pnode_stats.rx_dropped;
	save->pnode_stats.tx_packets += fstats->pnode_stats.tx_packets;
	save->pnode_stats.tx_bytes += fstats->pnode_stats.tx_bytes;
}

/*
 * nss_capwapmgr_tunnel_destroy()
 *	API for destroying a tunnel. CAPWAP tunnel must be first disabled.
 */
nss_capwapmgr_status_t nss_capwapmgr_tunnel_destroy(struct net_device *dev, uint8_t tunnel_id)
{
	struct nss_capwap_tunnel_stats stats;
	struct nss_ipv4_destroy v4;
	struct nss_ipv6_destroy v6;
	struct nss_capwapmgr_priv *priv;
	struct nss_capwapmgr_tunnel *t;
	nss_tx_status_t nss_status = NSS_TX_SUCCESS;
	uint32_t if_num_inner, if_num_outer;
	nss_capwapmgr_status_t status = NSS_CAPWAPMGR_SUCCESS;

	dev_hold(dev);
	t = nss_capwapmgr_verify_tunnel_param(dev, tunnel_id);
	if (!t) {
		nss_capwapmgr_warn("%px: tunnel %d: wrong argument for tunnel destroy\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
		goto done;
	}

	if (!(t->tunnel_state & NSS_CAPWAPMGR_TUNNEL_STATE_CONFIGURED)) {
		nss_capwapmgr_warn("%px: tunnel %d is not configured yet\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_TUNNEL_NOT_CFG;
		goto done;
	}

	/*
	 * We don't allow destroy operation on tunnel if it's still enabled.
	 */
	if (t->tunnel_state & NSS_CAPWAPMGR_TUNNEL_STATE_ENABLED) {
		nss_capwapmgr_warn("%px: no destroy alloed for an eanbled tunnel: %d\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_TUNNEL_ENABLED;
		goto done;
	}

	if (!(t->capwap_rule.l3_proto == NSS_CAPWAP_TUNNEL_IPV4 ||
		t->capwap_rule.l3_proto == NSS_CAPWAP_TUNNEL_IPV6)) {
		nss_capwapmgr_warn("%px: tunnel %d: wrong argument for l3_proto\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
		goto done;
	}

	if (!(t->capwap_rule.which_udp == NSS_CAPWAP_TUNNEL_UDP ||
		t->capwap_rule.which_udp == NSS_CAPWAP_TUNNEL_UDPLite)) {
		nss_capwapmgr_warn("%px: tunnel %d: wrong argument for which_udp(%d)\n", dev, tunnel_id, t->capwap_rule.which_udp);
		status = NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
		goto done;
	}

	priv = netdev_priv(dev);
	nss_capwapmgr_info("%px: %d: tunnel destroy is being called\n", dev, tunnel_id);

	if_num_inner = t->if_num_inner;
	if_num_outer = t->if_num_outer;

	if (priv->if_num_to_tunnel_id[if_num_inner] != tunnel_id) {
		nss_capwapmgr_warn("%px: %d: tunnel_id %d didn't match with tunnel_id :%d\n",
			dev, if_num_inner, tunnel_id, priv->if_num_to_tunnel_id[if_num_inner]);
		status = NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
		goto done;
	}

	if (priv->if_num_to_tunnel_id[if_num_outer] != tunnel_id) {
		nss_capwapmgr_warn("%px: %d: tunnel_id %d didn't match with tunnel_id :%d\n",
			dev, if_num_outer, tunnel_id, priv->if_num_to_tunnel_id[if_num_outer]);
		status = NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
		goto done;
	}

	if (nss_capwap_get_stats(if_num_inner, &stats) == true) {
		nss_capwapmgr_tunnel_save_stats(&global.tunneld, &stats);
	}

	if (nss_capwap_get_stats(if_num_outer, &stats) == true) {
		nss_capwapmgr_tunnel_save_stats(&global.tunneld, &stats);
	}

	/*
	 * Destroy IP rule first.
	 */
	if (t->tunnel_state & NSS_CAPWAPMGR_TUNNEL_STATE_IPRULE_CONFIGURED) {
		if (t->capwap_rule.l3_proto == NSS_CAPWAP_TUNNEL_IPV4) {
			memset(&v4, 0, sizeof (struct nss_ipv4_destroy));
			v4.protocol = IPPROTO_UDP;
			v4.src_ip = t->ip_rule.v4.src_ip;
			v4.dest_ip = t->ip_rule.v4.dest_ip;
			v4.src_port = t->ip_rule.v4.src_port;
			v4.dest_port = t->ip_rule.v4.dest_port;
			nss_status = nss_capwapmgr_unconfigure_ipv4_rule(&v4);
		} else {
			memset(&v6, 0, sizeof (struct nss_ipv6_destroy));
			if (t->capwap_rule.which_udp == NSS_CAPWAP_TUNNEL_UDP) {
				v6.protocol = IPPROTO_UDP;
			} else {
				v6.protocol = IPPROTO_UDPLITE;
			}

			v6.src_ip[0] = t->ip_rule.v6.src_ip[0];
			v6.src_ip[1] = t->ip_rule.v6.src_ip[1];
			v6.src_ip[2] = t->ip_rule.v6.src_ip[2];
			v6.src_ip[3] = t->ip_rule.v6.src_ip[3];

			v6.dest_ip[0] = t->ip_rule.v6.dest_ip[0];
			v6.dest_ip[1] = t->ip_rule.v6.dest_ip[1];
			v6.dest_ip[2] = t->ip_rule.v6.dest_ip[2];
			v6.dest_ip[3] = t->ip_rule.v6.dest_ip[3];

			v6.src_port = t->ip_rule.v6.src_port;
			v6.dest_port = t->ip_rule.v6.dest_port;
			nss_status = nss_capwapmgr_unconfigure_ipv6_rule(&v6);
		}

		if (nss_status != NSS_TX_SUCCESS) {
			nss_capwapmgr_warn("%px: Unconfigure IP rule failed for tunnel : %d\n",
				dev, tunnel_id);
			status = NSS_CAPWAPMGR_FAILURE_IP_DESTROY_RULE;
			goto done;
		}
		t->tunnel_state &= ~NSS_CAPWAPMGR_TUNNEL_STATE_IPRULE_CONFIGURED;
	}

	/*
	 * Destroy CAPWAP rule now.
	 */
	status = nss_capwapmgr_tunnel_action(priv->nss_ctx, dev, if_num_outer, NSS_CAPWAP_MSG_TYPE_UNCFG_RULE);
	if (status != NSS_CAPWAPMGR_SUCCESS) {
		nss_capwapmgr_warn("%px: %d: Unconfigure CAPWAP rule failed for tunnel : %d\n",
			dev, if_num_outer, tunnel_id);
		goto fail;

	}

	status = nss_capwapmgr_tunnel_action(priv->nss_ctx, dev, if_num_inner, NSS_CAPWAP_MSG_TYPE_UNCFG_RULE);
	if (status != NSS_CAPWAPMGR_SUCCESS) {
		nss_capwapmgr_warn("%px: %d: Unconfigure CAPWAP rule failed for tunnel : %d\n",
			dev, if_num_inner, tunnel_id);
		status = nss_capwapmgr_create_capwap_rule(dev, if_num_outer, &(t->capwap_rule), t->type_flags);
			if (status != NSS_CAPWAPMGR_SUCCESS) {
				nss_capwapmgr_warn("%px: %d: re creating the CAPWAP rule failed for tunnel : %d\n",
			dev, if_num_inner, tunnel_id);
				goto done;
			}

		goto fail;

	}

	nss_capwapmgr_unregister_with_nss(if_num_outer);
	nss_capwapmgr_unregister_with_nss(if_num_inner);

	/*
	 * Deallocate dynamic interface
	 */
	nss_status = nss_dynamic_interface_dealloc_node(if_num_outer, NSS_DYNAMIC_INTERFACE_TYPE_CAPWAP_OUTER);
	if (nss_status != NSS_TX_SUCCESS) {
		nss_capwapmgr_warn("%px: %d: Dealloc of dynamic interface failed for tunnel : %d\n",
			dev, if_num_outer, tunnel_id);
	}

	nss_status = nss_dynamic_interface_dealloc_node(if_num_inner, NSS_DYNAMIC_INTERFACE_TYPE_CAPWAP_HOST_INNER);
	if (nss_status != NSS_TX_SUCCESS) {
		nss_capwapmgr_warn("%px: %d: Dealloc of dynamic interface failed for tunnel : %d\n",
			dev, if_num_inner, tunnel_id);
	}

	/*
	 * Unconfigure Trustsec Tx
	 */
	 if (t->capwap_rule.enabled_features & NSS_CAPWAPMGR_FEATURE_OUTER_TRUSTSEC_ENABLED) {
		if (t->capwap_rule.enabled_features & NSS_CAPWAPMGR_FEATURE_DTLS_ENABLED) {
			nss_status = nss_trustsec_tx_unconfigure_sgt(t->capwap_rule.dtls_inner_if_num, t->capwap_rule.outer_sgt_value);
		} else {
			nss_status = nss_trustsec_tx_unconfigure_sgt(t->if_num_outer, t->capwap_rule.outer_sgt_value);
		}

		if (nss_status != NSS_TX_SUCCESS) {
			nss_capwapmgr_warn("%px: unconfigure trustsec_tx failed\n", dev);
		}
	 }

	/*
	 * Destroy DTLS node if there is one associated to this tunnel
	 */
	if (t->capwap_rule.dtls_inner_if_num) {
		if (nss_dtlsmgr_session_destroy(t->dtls_dev) != NSS_DTLSMGR_OK) {
			nss_capwapmgr_warn("%px: failed to destroy DTLS session", t->dtls_dev);
		}
	}

	t->tunnel_state &= ~NSS_CAPWAPMGR_TUNNEL_STATE_CONFIGURED;
	priv->if_num_to_tunnel_id[if_num_inner] = -1;
	priv->if_num_to_tunnel_id[if_num_outer] = -1;

	memset(t, 0, sizeof(struct nss_capwapmgr_tunnel));

	t->if_num_inner = -1;
	t->if_num_outer = -1;

	nss_capwapmgr_info("%px: Tunnel %d is completely destroyed\n", dev , tunnel_id);
	status = NSS_CAPWAPMGR_SUCCESS;
	goto done;

fail:
	if (t->capwap_rule.l3_proto == NSS_CAPWAP_TUNNEL_IPV4) {
		nss_status = nss_capwapmgr_configure_ipv4(&t->ip_rule.v4, 0, 0);
	} else {
		nss_status = nss_capwapmgr_configure_ipv6(&t->ip_rule.v6, 0, 0);
	}

	if (nss_status == NSS_TX_SUCCESS) {
		t->tunnel_state |= NSS_CAPWAPMGR_TUNNEL_STATE_IPRULE_CONFIGURED;
	}

	status = NSS_CAPWAPMGR_FAILURE_CAPWAP_DESTROY_RULE;

done:
	dev_put(dev);
	return status;
}
EXPORT_SYMBOL(nss_capwapmgr_tunnel_destroy);

/*
 * nss_capwapmgr_flow_rule_action()
 */
static inline nss_capwapmgr_status_t nss_capwapmgr_flow_rule_action(struct net_device *dev, uint8_t tunnel_id,
						nss_capwap_msg_type_t cmd, uint16_t ip_version,
						uint16_t protocol, uint32_t *src_ip, uint32_t *dst_ip,
						uint16_t src_port, uint16_t dst_port, uint32_t flow_id)
{
	struct nss_capwapmgr_priv *priv;
	struct nss_capwap_msg capwapmsg;
	struct nss_capwap_flow_rule_msg *ncfrm;
	struct nss_capwapmgr_tunnel *t;
	nss_capwapmgr_status_t status;

	dev_hold(dev);
	t = nss_capwapmgr_verify_tunnel_param(dev, tunnel_id);
	if (!t) {
		nss_capwapmgr_warn("%px: can't find tunnel: %d\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
		goto done;
	}

	priv = netdev_priv(dev);

	memset(&capwapmsg, 0, sizeof(struct nss_capwap_msg));
	nss_capwap_msg_init(&capwapmsg, t->if_num_outer, cmd,
		sizeof(struct nss_capwap_flow_rule_msg), nss_capwapmgr_msg_event_receive, dev);

	/*
	 * Set flow rule message
	 */
	if (cmd == NSS_CAPWAP_MSG_TYPE_FLOW_RULE_ADD) {
		ncfrm = &capwapmsg.msg.flow_rule_add;
	} else {
		ncfrm = &capwapmsg.msg.flow_rule_del;
	}
	ncfrm->protocol = protocol;
	ncfrm->src_port = src_port;
	ncfrm->dst_port = dst_port;
	ncfrm->ip_version = ip_version;
	memcpy(ncfrm->src_ip, src_ip, sizeof(struct in6_addr));
	memcpy(ncfrm->dst_ip, dst_ip, sizeof(struct in6_addr));
	ncfrm->flow_id = flow_id;

	/*
	 * Send flow rule message to NSS core
	 */
	status = nss_capwapmgr_tx_msg_sync(priv->nss_ctx, dev, &capwapmsg);
	if (status != NSS_CAPWAPMGR_SUCCESS) {
		nss_capwapmgr_warn("%px: send flow rule message failed with error: %d\n", dev, status);
	}

done:
	dev_put(dev);
	return status;
}

/*
 * nss_capwapmgr_add_flow_rule()
 *	Send a capwap flow rule add message to NSS core.
 */
nss_capwapmgr_status_t nss_capwapmgr_add_flow_rule(struct net_device *dev, uint8_t tunnel_id, uint16_t ip_version,
						uint16_t protocol, uint32_t *src_ip, uint32_t *dst_ip,
						uint16_t src_port, uint16_t dst_port, uint32_t flow_id)
{
	return nss_capwapmgr_flow_rule_action(dev, tunnel_id, NSS_CAPWAP_MSG_TYPE_FLOW_RULE_ADD, ip_version,
											protocol, src_ip, dst_ip, src_port, dst_port, flow_id);
}
EXPORT_SYMBOL(nss_capwapmgr_add_flow_rule);

/*
 * nss_capwapmgr_del_flow_rule()
 *	Send a capwap flow rule del message to NSS core.
 */
nss_capwapmgr_status_t nss_capwapmgr_del_flow_rule(struct net_device *dev, uint8_t tunnel_id, uint16_t ip_version,
						uint16_t protocol, uint32_t *src_ip, uint32_t *dst_ip,
						uint16_t src_port, uint16_t dst_port)
{
	return nss_capwapmgr_flow_rule_action(dev, tunnel_id, NSS_CAPWAP_MSG_TYPE_FLOW_RULE_DEL, ip_version,
											protocol, src_ip, dst_ip, src_port, dst_port, 0);
}
EXPORT_SYMBOL(nss_capwapmgr_del_flow_rule);

/*
 * nss_capwapmgr_tunnel_stats()
 *	Gets tunnel stats from netdev
 */
nss_capwapmgr_status_t nss_capwapmgr_tunnel_stats(struct net_device *dev,
		uint8_t tunnel_id, struct nss_capwap_tunnel_stats *stats)
{
	struct nss_capwapmgr_tunnel *t;
	struct nss_capwap_tunnel_stats stats_temp;
	nss_capwapmgr_status_t status = NSS_CAPWAPMGR_SUCCESS;

	if (!stats) {
		nss_capwapmgr_warn("%px: invalid rtnl structure\n", dev);
		return NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
	}

	dev_hold(dev);
	t = nss_capwapmgr_verify_tunnel_param(dev, tunnel_id);
	if (!t) {
		nss_capwapmgr_trace("%px: can't find tunnel: %d\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_BAD_PARAM;
		goto done;
	}

	if (!(t->tunnel_state & NSS_CAPWAPMGR_TUNNEL_STATE_CONFIGURED)) {
		nss_capwapmgr_trace("%px: tunnel: %d not configured yet\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_TUNNEL_NOT_CFG;
		goto done;
	}

	/*
	 * Copy the inner interface stats.
	 */
	if (nss_capwap_get_stats(t->if_num_inner, &stats_temp) == false) {
		nss_capwapmgr_warn("%px: tunnel %d not ready yet\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_NOT_READY;
		goto done;
	}

	stats->dtls_pkts += stats_temp.dtls_pkts;
	stats->tx_segments += stats_temp.tx_segments;
	stats->tx_queue_full_drops += stats_temp.tx_queue_full_drops;
	stats->tx_mem_failure_drops += stats_temp.tx_mem_failure_drops;
	stats->tx_dropped_sg_ref += stats_temp.tx_dropped_sg_ref;
	stats->tx_dropped_ver_mis += stats_temp.tx_dropped_ver_mis;
	stats->tx_dropped_hroom += stats_temp.tx_dropped_hroom;
	stats->tx_dropped_dtls += stats_temp.tx_dropped_dtls;
	stats->tx_dropped_nwireless += stats_temp.tx_dropped_nwireless;

	/*
	 * Pnode tx stats for Inner node.
	 */
	stats->pnode_stats.tx_packets += stats_temp.pnode_stats.tx_packets;
	stats->pnode_stats.tx_bytes += stats_temp.pnode_stats.tx_bytes;
	stats->tx_dropped_inner += stats_temp.tx_dropped_inner;

	/*
	 * Copy the outer interface stats.
	 */
	if (nss_capwap_get_stats(t->if_num_outer, &stats_temp) == false) {
		nss_capwapmgr_warn("%px: tunnel %d not ready yet\n", dev, tunnel_id);
		status = NSS_CAPWAPMGR_FAILURE_NOT_READY;
		goto done;
	}

	stats->rx_segments += stats_temp.rx_segments;
	stats->dtls_pkts += stats_temp.dtls_pkts;
	stats->rx_dup_frag += stats_temp.rx_dup_frag;
	stats->rx_oversize_drops += stats_temp.rx_oversize_drops;
	stats->rx_frag_timeout_drops += stats_temp.rx_frag_timeout_drops;
	stats->rx_n2h_drops += stats_temp.rx_n2h_drops;
	stats->rx_n2h_queue_full_drops += stats_temp.rx_n2h_queue_full_drops;
	stats->rx_mem_failure_drops += stats_temp.rx_mem_failure_drops;
	stats->rx_csum_drops += stats_temp.rx_csum_drops;
	stats->rx_malformed += stats_temp.rx_malformed;
	stats->rx_frag_gap_drops += stats_temp.rx_frag_gap_drops;

	/*
	 * Pnode rx stats for outer node.
	 */
	stats->pnode_stats.rx_packets += stats_temp.pnode_stats.rx_packets;
	stats->pnode_stats.rx_bytes += stats_temp.pnode_stats.rx_bytes;
	stats->pnode_stats.rx_dropped += stats_temp.pnode_stats.rx_dropped;

done:
	dev_put(dev);
	return status;
}
EXPORT_SYMBOL(nss_capwapmgr_tunnel_stats);

/*
 * nss_capwapmgr_receive_pkt()
 *	Receives a pkt from NSS
 */
static void nss_capwapmgr_receive_pkt(struct net_device *dev, struct sk_buff *skb, struct napi_struct *napi)
{
	struct nss_capwapmgr_priv *priv;
	struct nss_capwap_metaheader *pre = (struct nss_capwap_metaheader *)skb->data;
	int32_t if_num;

	if (unlikely(skb->len < sizeof(struct nss_capwap_metaheader))) {
		nss_capwapmgr_warn("%px: skb len is short :%d", dev, skb->len);
		dev_kfree_skb_any(skb);
		return;
	}

	/* SKB NETIF START */
	dev_hold(dev);
	priv = netdev_priv(dev);
	if_num = pre->tunnel_id;	/* NSS FW sends interface number */
	if (unlikely(if_num > NSS_MAX_NET_INTERFACES)) {
		nss_capwapmgr_warn("%px: if_num %d is wrong for skb\n", dev, if_num);
		pre->tunnel_id = 0xFF;
	} else {
		/*
		 * Remap interface number to tunnel_id.
		 */
		pre->tunnel_id = priv->if_num_to_tunnel_id[if_num];
	}

	skb->dev = dev;
	skb->pkt_type = PACKET_HOST;
	skb->skb_iif = dev->ifindex;
	skb_reset_mac_header(skb);
	skb_reset_transport_header(skb);
	(void)netif_receive_skb(skb);
	/* SKB NETIF END */
	dev_put(dev);
}

/*
 * nss_capwapmgr_acl_init()
 *	Initializes ACL related tables and objects.
 */
bool nss_capwapmgr_acl_init(void)
{
	sw_error_t rv;
	int i, j, uid = 0;

	/*
	 * Create and bind the ACL list we will be using for dscp prioritization.
	 */
	for (i = 0; i < NSS_CAPWAPMGR_ACL_LIST_CNT; i++) {
		int list_id = NSS_CAPWAPMGR_ACL_LIST_START + i;
		rv = fal_acl_list_creat(0, list_id, 0);
		if (rv != SW_OK) {
			nss_capwapmgr_warn("Failed to create ACL list err:%d\n", rv);
			return false;
		}

		rv = fal_acl_list_bind(0, list_id, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORTBITMAP, NSS_CAPWAPMGR_BIND_BITMAP);
		if (rv != SW_OK) {
			nss_capwapmgr_warn("Failed to bind ACL list err:%d\n", rv);
			return false;
		}
	}

	/*
	 * Initialize the globacl ACL table.
	 */
	for (i = 0; i < NSS_CAPWAPMGR_ACL_LIST_CNT; i++) {
		for (j = 0; j < NSS_CAPWAPMGR_ACL_RULES_PER_LIST; j++) {
			global.acl_list[i].rule[j].uid = uid++;
			global.acl_list[i].rule[j].rule_id = j;
			global.acl_list[i].rule[j].list_id = i;
		}
	}

	return true;
}

#if defined(NSS_CAPWAPMGR_ONE_NETDEV)
/*
 * nss_capwapmgr_get_netdev()
 *	Returns net device used.
 */
struct net_device *nss_capwapmgr_get_netdev(void)
{
	return nss_capwapmgr_ndev;
}
EXPORT_SYMBOL(nss_capwapmgr_get_netdev);
#endif

/*
 * nss_capwapmgr_netdev_up()
 *	NSS CAPWAP Tunnel device i/f up handler
 */
static int nss_capwapmgr_netdev_up(struct net_device *netdev)
{
	uint8_t i;
	for (i = 0; i < NSS_CAPWAPMGR_MAX_TUNNELS; i++) {
		(void)nss_capwapmgr_enable_tunnel(nss_capwapmgr_ndev, i);
	}

	return NOTIFY_DONE;
}

/*
 * nss_capwapmgr_netdev_down()
 *	NSS CAPWAP Tunnel device i/f up handler
 */
static int nss_capwapmgr_netdev_down(struct net_device *netdev)
{
	uint8_t i;
	for (i = 0; i < NSS_CAPWAPMGR_MAX_TUNNELS; i++) {
		(void)nss_capwapmgr_disable_tunnel(nss_capwapmgr_ndev, i);
	}

	return NOTIFY_DONE;
}

/*
 * nss_capwapmgr_netdev_event()
 *	Net device notifier for NSS CAPWAP manager module
 */
static int nss_capwapmgr_netdev_event(struct notifier_block *nb, unsigned long event, void *dev)
{
	struct net_device *netdev = (struct net_device *)dev;

	if (strstr(netdev->name, NSS_CAPWAPMGR_NETDEV_NAME) == NULL) {
		return NOTIFY_DONE;
	}

	switch (event) {
	case NETDEV_UP:
		nss_capwapmgr_trace("%px: NETDEV_UP: event %lu name %s\n", netdev, event, netdev->name);
		return nss_capwapmgr_netdev_up(netdev);

	case NETDEV_DOWN:
		nss_capwapmgr_trace("%px: NETDEV_DOWN: event %lu name %s\n", netdev, event, netdev->name);
		return nss_capwapmgr_netdev_down(netdev);

	default:
		nss_capwapmgr_trace("%px: Unhandled notifier event %lu name %s\n", netdev, event, netdev->name);
		break;
	}

	return NOTIFY_DONE;
}

/*
 * Linux netdev event function.
 */
static int nss_capwapmgr_netdev_event(struct notifier_block  *nb, unsigned long event, void  *dev);

/*
 * Linux Net device Notifier
 */
struct notifier_block nss_capwapmgr_netdev_notifier = {
	.notifier_call = nss_capwapmgr_netdev_event,
};

/*
 * nss_capwapmgr_init_module()
 *	Tunnel CAPWAP module init function
 */
int __init nss_capwapmgr_init_module(void)
{
#ifdef CONFIG_OF
	/*
	 * If the node is not compatible, don't do anything.
	 */
	if (!of_find_node_by_name(NULL, "nss-common")) {
		return 0;
	}
#endif
	nss_capwapmgr_info("module (platform - IPQ806x, %s) loaded\n",
			   NSS_CLIENT_BUILD_ID);

	register_netdevice_notifier(&nss_capwapmgr_netdev_notifier);

#if defined(NSS_CAPWAPMGR_ONE_NETDEV)
	/*
	 * In this code, we create a single netdev for all the CAPWAP
	 * tunnels.
	 */
	nss_capwapmgr_ndev = nss_capwapmgr_netdev_create();
	if (!nss_capwapmgr_ndev) {
		nss_capwapmgr_warn("Couldn't create capwap interface\n");
		return -1;
	}
#endif

	memset(&global.tunneld, 0, sizeof(struct nss_capwap_tunnel_stats));

	/*
	 * Initialize ACL related objects and tables.
	 */
	if (!nss_capwapmgr_acl_init()) {
		nss_capwapmgr_warn("Couldn't initialize ACL objects/tables\n");
		return -1;
	}

	sema_init(&ip_response.sem, 1);
	init_waitqueue_head(&ip_response.wq);

	return 0;
}

/*
 * nss_capwapmgr_exit_module()
 *	Tunnel CAPWAP module exit function
 */
void __exit nss_capwapmgr_exit_module(void)
{
#if defined(NSS_CAPWAPMGR_ONE_NETDEV)
	struct nss_capwapmgr_priv *priv;
	uint8_t i;
#endif

#ifdef CONFIG_OF
	/*
	 * If the node is not compatible, don't do anything.
	 */
	if (!of_find_node_by_name(NULL, "nss-common")) {
		return;
	}
#endif

#if defined(NSS_CAPWAPMGR_ONE_NETDEV)
	priv = netdev_priv(nss_capwapmgr_ndev);
	for (i = 0; i < NSS_CAPWAPMGR_MAX_TUNNELS; i++) {
		(void) nss_capwapmgr_disable_tunnel(nss_capwapmgr_ndev, i);
		(void) nss_capwapmgr_tunnel_destroy(nss_capwapmgr_ndev, i);
	}
	kfree(priv->if_num_to_tunnel_id);
	kfree(priv->resp);
	kfree(priv->tunnel);
	unregister_netdev(nss_capwapmgr_ndev);
	nss_capwapmgr_ndev = NULL;
#endif
	unregister_netdevice_notifier(&nss_capwapmgr_netdev_notifier);

	nss_capwapmgr_info("module unloaded\n");
}

module_init(nss_capwapmgr_init_module);
module_exit(nss_capwapmgr_exit_module);

MODULE_LICENSE("Dual BSD/GPL");
MODULE_DESCRIPTION("NSS CAPWAP manager");