qca-nss-clients/ipsecmgr/v2.0/nss_ipsecmgr_tunnel.c - manifest_repos/sdk - Git at Google

 /*
  **************************************************************************
  * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
  * above copyright notice and this permission notice appear in all copies.
  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  **************************************************************************
  */

 /* nss_ipsecmgr.c
  *	NSS to HLOS IPSec Manager
  */
 #include <linux/version.h>
 #include <linux/types.h>
 #include <linux/ip.h>
 #include <linux/of.h>
 #include <linux/ipv6.h>
 #include <linux/skbuff.h>
 #include <linux/module.h>
 #include <linux/bitops.h>
 #include <linux/netdevice.h>
 #include <linux/rtnetlink.h>
 #include <linux/etherdevice.h>
 #include <linux/vmalloc.h>
 #include <linux/debugfs.h>
 #include <linux/atomic.h>
 #include <net/protocol.h>
 #include <net/route.h>
 #include <net/ip6_route.h>
 #include <net/esp.h>
 #include <net/xfrm.h>
 #include <net/icmp.h>

 #include <crypto/aead.h>
 #include <crypto/skcipher.h>
 #include <crypto/internal/hash.h>

 #include <nss_api_if.h>
 #include <nss_ipsec_cmn.h>
 #include <nss_ipsecmgr.h>
 #include <nss_cryptoapi.h>

 #include "nss_ipsecmgr_ref.h"
 #include "nss_ipsecmgr_flow.h"
 #include "nss_ipsecmgr_sa.h"
 #include "nss_ipsecmgr_ctx.h"
 #include "nss_ipsecmgr_tunnel.h"
 #include "nss_ipsecmgr_priv.h"

 /*
  * nss_ipsecmgr_tunnel_open()
  *	open the tunnel for usage
  */
 static int nss_ipsecmgr_tunnel_open(struct net_device *dev)
 {
 	struct nss_ipsecmgr_tunnel *tun __attribute__((unused)) = netdev_priv(dev);

 	netif_start_queue(dev);
 	return 0;
 }

 /*
  * nss_ipsecmgr_tunnel_stop()
  *	stop the IPsec tunnel
  */
 static int nss_ipsecmgr_tunnel_stop(struct net_device *dev)
 {
 	struct nss_ipsecmgr_tunnel *tun __attribute__((unused)) = netdev_priv(dev);

 	netif_stop_queue(dev);
 	return 0;
 }

 /*
  * nss_ipsecmgr_tunnel_tx()
  *	tunnel transmit function
  */
 static netdev_tx_t nss_ipsecmgr_tunnel_tx(struct sk_buff *skb, struct net_device *dev)
 {
 	struct nss_ipsecmgr_tunnel *tun = netdev_priv(dev);
 	struct nss_ipsec_cmn_flow_tuple f_tuple = {{0}};
 	struct nss_ipsec_cmn_mdata_encap *mdata;
 	struct nss_ipsec_cmn_sa_tuple *sa_tuple;
 	struct nss_ctx_instance *nss_ctx;
 	struct nss_ipsecmgr_flow *flow;
 	struct nss_ipsecmgr_ctx *ctx;
 	struct nss_ipsecmgr_sa *sa;
 	bool expand_skb = false;
 	uint16_t data_len;
 	int nhead, ntail;
 	uint32_t ifnum;

 	nhead = dev->needed_headroom;
 	ntail = dev->needed_tailroom;

 	/*
 	 * Check if skb is shared
 	 */
 	if (unlikely(skb_shared(skb))) {
 		skb = skb_unshare(skb, in_atomic() ? GFP_ATOMIC : GFP_KERNEL);
 		if (!skb)
 			return NETDEV_TX_OK;
 	}

 	/*
 	 * Currently IPsec only supports tunnel mode hence non-IP frames are freed.
 	 * In transport mode we will encapsulate based on the skb->protocol
 	 */
 	switch (ip_hdr(skb)->version) {
 	case IPVERSION:
 		nss_ipsecmgr_flow_ipv4_inner2tuple(ip_hdr(skb), &f_tuple);
 		break;

 	case 6:
 		nss_ipsecmgr_flow_ipv6_inner2tuple(ipv6_hdr(skb), &f_tuple);
 		break;

 	default:
 		nss_ipsecmgr_warn("%px: Non-IP packet for encapsulation", dev);
 		goto free;
 	}

 	/*
 	 * Linearize the nonlinear SKB.
 	 */
 	if (skb_linearize(skb)) {
 		nss_ipsecmgr_trace("%s: unable to Linearize SKB\n", dev->name);
 		goto free;
 	}

 	/*
 	 * For all these cases
 	 * - create a writable copy of buffer
 	 * - increase the head room
 	 * - increase the tail room
 	 */
 	if (skb_cloned(skb) || (skb_headroom(skb) < nhead) || (skb_tailroom(skb) < ntail)) {
 		expand_skb = true;
 	}

 	if (expand_skb && pskb_expand_head(skb, nhead, ntail, GFP_KERNEL)) {
 		nss_ipsecmgr_trace("%s: unable to expand buffer\n", dev->name);
 		goto free;
 	}

 	/*
 	 * This packet is ready for NSS transformation. We will now insert the
 	 * metadata on top of the IP header and expand data area to cover tailroom for NSS.
 	 */
 	data_len = skb->len;
 	skb_put(skb, ntail);
 	mdata = nss_ipsecmgr_tunnel_push_mdata(skb);

 	read_lock_bh(&ipsecmgr_drv->lock);

 	ctx = nss_ipsecmgr_ctx_find(tun, NSS_IPSEC_CMN_CTX_TYPE_MDATA_INNER);
 	if (!ctx) {
 		read_unlock_bh(&ipsecmgr_drv->lock);
 		nss_ipsecmgr_warn("%px: failed to find inner metdata context for TX\n", tun);
 		goto free;
 	}

 	/*
 	 * Check if default SA is configured in tunnel. If found, fill sa_tuple in
 	 * metadata to be used for encap.
 	 */
 	sa = tun->tx_sa;
 	if (sa) {
 		sa_tuple = &sa->state.tuple;
 		goto fill_mdata;
 	}

 	/*
 	 * We search the flow if this has been programmed prior to sending the packets. If flow
 	 * is found, we send corresponding sa_tuple as metadata for encap, else drop the packet.
 	 */
 	flow = nss_ipsecmgr_flow_find(ipsecmgr_drv->flow_db, &f_tuple);
 	if (!flow) {
 		read_unlock_bh(&ipsecmgr_drv->lock);
 		nss_ipsecmgr_trace("%px, failed to find flow for TX", tun);
 		goto free;
 	}

 	sa_tuple = &flow->state.sa;

 fill_mdata:
 	mdata->flags = 0;
 	mdata->seq_num = 0;
 	mdata->sa = *sa_tuple;
 	mdata->data_len = data_len;

 	ifnum = ctx->ifnum;
 	nss_ctx = ctx->nss_ctx;
 	read_unlock_bh(&ipsecmgr_drv->lock);

 	/*
 	 * We are not expecting the packet to host; hence scrub it.
 	 * In case of exception the packet will be encapsulated which
 	 * is different from the one that went for transformation.
 	 *
 	 * Note: The SKB will be orphaned at this point. Ideally, this should
 	 * be charged to NSS pool which allow the accounting of all such buffers.
 	 */
 	skb_scrub_packet(skb, true);

 	/*
 	 * Send the packet down;
 	 * TODO: Use stop queue and start queue to restart in case of
 	 * queue full condition
 	 */
 	if (nss_ipsec_cmn_tx_buf(nss_ctx, skb, ifnum) != 0) {
 		goto free;
 	}

 	return NETDEV_TX_OK;

 free:
 	dev_kfree_skb_any(skb);
 	return NETDEV_TX_OK;
 }

 /*
  * nss_ipsecmgr_tunnel_get_stats64()
  *	Get device statistics
  */
 static struct rtnl_link_stats64 *nss_ipsecmgr_tunnel_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
 {
 	struct nss_ipsecmgr_tunnel *tun = netdev_priv(dev);
 	struct list_head *head = &tun->ctx_db;
 	struct nss_ipsecmgr_ctx *ctx;

 	memset(stats, 0, sizeof(*stats));

 	read_lock_bh(&ipsecmgr_drv->lock);
 	list_for_each_entry(ctx, head, list) {
 		nss_ipsecmgr_ctx_stats_read(ctx, stats);
 	}

 	read_unlock_bh(&ipsecmgr_drv->lock);
 	return stats;
 }

 /*
  * nss_ipsecmgr_tunnel_stats64()
  *	Sync statistics to linux
  */
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 11, 0))
 static struct rtnl_link_stats64 *nss_ipsecmgr_tunnel_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
 {
 	return nss_ipsecmgr_tunnel_get_stats64(dev, stats);
 }
 #else
 static void nss_ipsecmgr_tunnel_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
 {
 	nss_ipsecmgr_tunnel_get_stats64(dev, stats);
 }
 #endif

 /*
  * nss_ipsecmgr_tunnel_mtu_update()
  *	Update tunnel max MTU
  */
 static void nss_ipsecmgr_tunnel_mtu_update(struct list_head *head)
 {
 	struct nss_ipsecmgr_tunnel *tun;
 	uint16_t max_mtu = 0;
 	bool update_mtu = false;

 	write_lock(&ipsecmgr_drv->lock);
 	list_for_each_entry(tun, head, list) {
 		if (tun->dev->mtu > max_mtu)
 			max_mtu = tun->dev->mtu;
 	}

 	if (ipsecmgr_drv->max_mtu != max_mtu) {
 		ipsecmgr_drv->max_mtu = max_mtu;
 		update_mtu = true;
 	}

 	write_unlock(&ipsecmgr_drv->lock);

 #ifdef NSS_IPSECMGR_PPE_SUPPORT
 	/*
 	 * Set PPE inline port's MTU.
 	 * TODO: this needs to move to Virtual Port
 	 */
 	if (ipsecmgr_drv->ipsec_inline && update_mtu) {
 		struct nss_ipsecmgr_ctx *ctx;
 		uint32_t redir_ifnum;

 		read_lock_bh(&ipsecmgr_drv->lock);
 		ctx = nss_ipsecmgr_ctx_find(netdev_priv(ipsecmgr_drv->dev), NSS_IPSEC_CMN_CTX_TYPE_REDIR);
 		if (!ctx) {
 			read_unlock_bh(&ipsecmgr_drv->lock);
 			nss_ipsecmgr_warn("Unable to find REDIR interface for %s", ipsecmgr_drv->dev->name);
 			return;
 		}
 		redir_ifnum = ctx->ifnum;
 		read_unlock_bh(&ipsecmgr_drv->lock);

 		nss_ipsecmgr_info("Updating mtu for %s as %d", ipsecmgr_drv->dev->name, max_mtu);
 		nss_ipsec_cmn_ppe_mtu_update(ipsecmgr_drv->nss_ctx, redir_ifnum, max_mtu, max_mtu);
 	}
 #endif
 }

 /*
  * nss_ipsecmgr_tunnel_mtu()
  *	Change device MTU
  */
 static int nss_ipsecmgr_tunnel_mtu(struct net_device *dev, int mtu)
 {
 	dev->mtu = mtu;
 	nss_ipsecmgr_tunnel_mtu_update(&ipsecmgr_drv->tun_db);
 	return 0;
 }

 /* NSS IPsec tunnel operation */
 static const struct net_device_ops ipsecmgr_dev_ops = {
 	.ndo_open = nss_ipsecmgr_tunnel_open,
 	.ndo_stop = nss_ipsecmgr_tunnel_stop,
 	.ndo_start_xmit = nss_ipsecmgr_tunnel_tx,
 	.ndo_get_stats64 = nss_ipsecmgr_tunnel_stats64,
 	.ndo_change_mtu = nss_ipsecmgr_tunnel_mtu,
 };

 /*
  * nss_ipsecmgr_tunnel_free()
  *	free an existing IPsec tunnel interface
  */
 static void nss_ipsecmgr_tunnel_free(struct net_device *dev)
 {
 	struct nss_ipsecmgr_tunnel *tun = netdev_priv(dev);
 	struct nss_ipsecmgr_ref *ref, *tmp;
 	struct list_head free_refs;

 	nss_ipsecmgr_info("IPsec tunnel device(%s) freed\n", dev->name);

 	INIT_LIST_HEAD(&free_refs);

 	/*
 	 * Remove context(s) from the tunnel reference tree if it has been
 	 * added
 	 */
 	write_lock_bh(&ipsecmgr_drv->lock);
 	if (!nss_ipsecmgr_ref_is_empty(&tun->ref)) {
 		nss_ipsecmgr_ref_del(&tun->ref, &free_refs);
 	}

 	write_unlock_bh(&ipsecmgr_drv->lock);

 	list_for_each_entry_safe(ref, tmp, &free_refs, node) {
 		ref->free(ref);
 	}

 	free_netdev(dev);
 }

 /*
  * nss_ipsecmgr_tunnel_free_work()
  *	Drain all pending refs for free
  */
 static void nss_ipsecmgr_tunnel_free_work(struct work_struct *work)
 {
 	struct nss_ipsecmgr_tunnel *tun = container_of(work, struct nss_ipsecmgr_tunnel, free_work);
 	struct nss_ipsecmgr_ref *ref, *tmp;
 	struct list_head tmp_head;
 	bool is_locked;

 	INIT_LIST_HEAD(&tmp_head);

 	write_lock_bh(&ipsecmgr_drv->lock);
 	list_splice_tail_init(&tun->free_refs, &tmp_head);
 	write_unlock_bh(&ipsecmgr_drv->lock);

 	is_locked = rtnl_trylock();
 	list_for_each_entry_safe(ref, tmp, &tmp_head, node) {
 		ref->free(ref);
 	}

 	if (is_locked)
 		rtnl_unlock();
 }

 /*
  * nss_ipsecmgr_tunnel_free_ref()
  *	Unregister IPsec tunnel interface
  */
 static void nss_ipsecmgr_tunnel_free_ref(struct nss_ipsecmgr_ref *ref)
 {
 	struct nss_ipsecmgr_tunnel *tun = container_of(ref, struct nss_ipsecmgr_tunnel, ref);

 	/*
 	 * The unregister should start here but the expectation is that the free would
 	 * happen when the reference count goes down to '0'
 	 */
 	if (tun->dev->reg_state == NETREG_REGISTERED) {
 		nss_ipsecmgr_tunnel_mtu_update(&ipsecmgr_drv->tun_db);
 		rtnl_is_locked() ? unregister_netdevice(tun->dev) : unregister_netdev(tun->dev);
 	}
 }

 /*
  * nss_ipsecmgr_tunnel_del_ref()
  *	Delete IPsec tunnel reference
  */
 static void nss_ipsecmgr_tunnel_del_ref(struct nss_ipsecmgr_ref *ref)
 {
 	struct nss_ipsecmgr_tunnel *tun = container_of(ref, struct nss_ipsecmgr_tunnel, ref);
 	list_del(&tun->list);
 }

 /*
  * nss_ipsecmr_dev_setup()
  *	setup the IPsec tunnel
  */
 static void nss_ipsecmgr_tunnel_setup(struct net_device *dev)
 {
 	dev->addr_len = ETH_ALEN;
 	dev->mtu = NSS_IPSECMGR_TUN_MTU(ETH_DATA_LEN);

 	dev->hard_header_len = NSS_IPSECMGR_TUN_MAX_HDR_LEN;
 	dev->needed_headroom = NSS_IPSECMGR_TUN_HEADROOM;
 	dev->needed_tailroom = NSS_IPSECMGR_TUN_TAILROOM;

 	dev->type = NSS_IPSEC_CMN_ARPHRD_IPSEC;

 	dev->ethtool_ops = NULL;
 	dev->header_ops = NULL;
 	dev->netdev_ops = &ipsecmgr_dev_ops;

 #if (LINUX_VERSION_CODE <= KERNEL_VERSION(4, 11, 8))
 	dev->destructor = nss_ipsecmgr_tunnel_free;
 #else
 	dev->priv_destructor = nss_ipsecmgr_tunnel_free;
 #endif

 	/*
 	 * Get the MAC address from the ethernet device
 	 */
 	random_ether_addr(dev->dev_addr);

 	memset(dev->broadcast, 0xff, dev->addr_len);
 	memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
 }

 /*
  * nss_ipsecmgr_tunnel_del()
  *	delete an existing IPsec tunnel
  */
 void nss_ipsecmgr_tunnel_del(struct net_device *dev)
 {
 	struct nss_ipsecmgr_tunnel *tun = netdev_priv(dev);

 	debugfs_remove_recursive(tun->dentry);

 	/*
 	 * Flush all associated SA(s) and flow(s) with the tunnel
 	 */
 	write_lock_bh(&ipsecmgr_drv->lock);
 	nss_ipsecmgr_ref_del(&tun->ref, &tun->free_refs);
 	write_unlock_bh(&ipsecmgr_drv->lock);

 	schedule_work(&tun->free_work);
 	flush_work(&tun->free_work);
 }
 EXPORT_SYMBOL(nss_ipsecmgr_tunnel_del);

 /*
  * nss_ipsecmgr_tunnel_add()
  *	add a IPsec pseudo tunnel device
  */
 struct net_device *nss_ipsecmgr_tunnel_add(struct nss_ipsecmgr_callback *cb)
 {
 	struct nss_ipsecmgr_ctx *inner, *mdata_inner;
 	struct nss_ipsecmgr_ctx *outer, *mdata_outer;
 	struct nss_ipsecmgr_tunnel *tun;
 	struct net_device *skb_dev;
 	struct net_device *dev;
 	int status;

 	dev = alloc_netdev(sizeof(*tun), NSS_IPSECMGR_TUN_NAME, NET_NAME_ENUM, nss_ipsecmgr_tunnel_setup);
 	if (!dev) {
 		nss_ipsecmgr_error("unable to allocate a tunnel device\n");
 		return NULL;
 	}

 	skb_dev = cb->skb_dev;
 	tun = netdev_priv(dev);

 	tun->dev = dev;
 	nss_ipsecmgr_ref_init(&tun->ref, nss_ipsecmgr_tunnel_del_ref, nss_ipsecmgr_tunnel_free_ref);

 	INIT_LIST_HEAD(&tun->list);
 	INIT_LIST_HEAD(&tun->free_refs);
 	INIT_WORK(&tun->free_work, nss_ipsecmgr_tunnel_free_work);

 	nss_ipsecmgr_db_init(&tun->ctx_db);

 	memcpy(&tun->cb, cb, sizeof(tun->cb));

 	/*
 	 * Use HLOS netdev if it is loaded in the callback context;
 	 * else use the NSS netdev
 	 */
 	if (!skb_dev)
 		tun->cb.skb_dev = dev;

 	/*
 	 * Inner context allocation
 	 */
 	inner = nss_ipsecmgr_ctx_alloc(tun,
 					NSS_IPSEC_CMN_CTX_TYPE_INNER,
 					NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_INNER,
 					nss_ipsecmgr_ctx_rx_inner,
 					nss_ipsecmgr_ctx_rx_stats,
 					NSS_IPSEC_CMN_FEATURE_INLINE_ACCEL);
 	if (!inner) {
 		nss_ipsecmgr_warn("%px: failed to allocate context inner\n", tun);
 		goto free;
 	}

 	nss_ipsecmgr_ctx_attach(&tun->ctx_db, inner);

 	/*
 	 * Inner Metadata context allocation
 	 */
 	mdata_inner = nss_ipsecmgr_ctx_alloc(tun,
 					NSS_IPSEC_CMN_CTX_TYPE_MDATA_INNER,
 					NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_MDATA_INNER,
 					nss_ipsecmgr_ctx_rx_inner,
 					nss_ipsecmgr_ctx_rx_stats,
 					0);
 	if (!mdata_inner) {
 		nss_ipsecmgr_warn("%px: failed to allocate context metadata inner\n", tun);
 		goto free;
 	}

 	nss_ipsecmgr_ctx_attach(&tun->ctx_db, mdata_inner);
 	/*
 	 * Outer context allocation
 	 */
 	outer = nss_ipsecmgr_ctx_alloc(tun,
 					NSS_IPSEC_CMN_CTX_TYPE_OUTER,
 					NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_OUTER,
 					nss_ipsecmgr_ctx_rx_outer,
 					nss_ipsecmgr_ctx_rx_stats,
 					NSS_IPSEC_CMN_FEATURE_INLINE_ACCEL);
 	if (!outer) {
 		nss_ipsecmgr_warn("%px: failed to allocate context outer\n", tun);
 		goto free;
 	}

 	nss_ipsecmgr_ctx_attach(&tun->ctx_db, outer);
 	/*
 	 * Outer metadata context allocation
 	 */
 	mdata_outer = nss_ipsecmgr_ctx_alloc(tun,
 					NSS_IPSEC_CMN_CTX_TYPE_MDATA_OUTER,
 					NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_MDATA_OUTER,
 					nss_ipsecmgr_ctx_rx_outer,
 					nss_ipsecmgr_ctx_rx_stats,
 					0);
 	if (!mdata_outer) {
 		nss_ipsecmgr_warn("%px: failed to allocate context metadata outer\n", tun);
 		goto free;
 	}

 	nss_ipsecmgr_ctx_attach(&tun->ctx_db, mdata_outer);

 	/*
 	 * We need to setup the exception interface number for inner & outer;
 	 * The exception interface is used by the NSS to send the packet back
 	 * to host when there is a rule miss after the processing (inner or outer).
 	 * In case of inner any exception after its processing must come with the
 	 * outer interface number. Similarly, for outer we have to do the opposite
 	 */
 	nss_ipsecmgr_ctx_set_except(inner, outer->ifnum);
 	nss_ipsecmgr_ctx_set_except(mdata_inner, outer->ifnum);
 	nss_ipsecmgr_ctx_set_except(outer, inner->ifnum);
 	nss_ipsecmgr_ctx_set_except(mdata_outer, inner->ifnum);

 	/*
 	 * We need to setup the sibling interface number for inner & outer;
 	 * The sibling interface is used by the NSS to configure SA on sibling.
 	 */
 	nss_ipsecmgr_ctx_set_sibling(inner, mdata_inner->ifnum);
 	nss_ipsecmgr_ctx_set_sibling(outer, mdata_outer->ifnum);

 	if (!nss_ipsecmgr_ctx_config(inner)) {
 		nss_ipsecmgr_warn("%px: failed to configure inner context\n", tun);
 		goto free;
 	}

 	if (!nss_ipsecmgr_ctx_config(mdata_inner)) {
 		nss_ipsecmgr_warn("%px: failed to configure metadata inner context\n", tun);
 		goto free;
 	}

 	if (!nss_ipsecmgr_ctx_config(outer)) {
 		nss_ipsecmgr_warn("%px: failed to configure outer context\n", tun);
 		goto free;
 	}

 	if (!nss_ipsecmgr_ctx_config(mdata_outer)) {
 		nss_ipsecmgr_warn("%px: failed to configure metadata outer context\n", tun);
 		goto free;
 	}

 	status = rtnl_is_locked() ? register_netdevice(dev) : register_netdev(dev);
 	if (status < 0) {
 		nss_ipsecmgr_warn("%px: register net dev failed :%s\n", tun, dev->name);
 #if (LINUX_VERSION_CODE <= KERNEL_VERSION(4, 11, 8))
 		goto free;
 #else
 		/*
 		 * Later kernels invoke the destructor upon failure
 		 */
 		return NULL;
 #endif
 	}

 	write_lock(&ipsecmgr_drv->lock);
 	list_add(&tun->list, &ipsecmgr_drv->tun_db);
 	write_unlock(&ipsecmgr_drv->lock);

 	nss_ipsecmgr_tunnel_mtu(dev, skb_dev ? skb_dev->mtu : dev->mtu);

 	/*
 	 * Create debugfs entry for tunnel and its child context(s)
 	 */
 	tun->dentry = debugfs_create_dir(dev->name, ipsecmgr_drv->dentry);
 	if (tun->dentry) {
 		debugfs_create_file("inner", S_IRUGO, tun->dentry, inner, &ipsecmgr_ctx_file_ops);
 		debugfs_create_file("mdata_inner", S_IRUGO, tun->dentry, mdata_inner, &ipsecmgr_ctx_file_ops);
 		debugfs_create_file("outer", S_IRUGO, tun->dentry, outer, &ipsecmgr_ctx_file_ops);
 		debugfs_create_file("mdata_outer", S_IRUGO, tun->dentry, mdata_outer, &ipsecmgr_ctx_file_ops);
 	}

 	return dev;
 free:
 #if (LINUX_VERSION_CODE <= KERNEL_VERSION(4, 11, 8))
 	dev->destructor(dev);
 #else
 	dev->priv_destructor(dev);
 #endif
 	return NULL;
 }
 EXPORT_SYMBOL(nss_ipsecmgr_tunnel_add);
	/*
	**************************************************************************
	* Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
	* Permission to use, copy, modify, and/or distribute this software for
	* any purpose with or without fee is hereby granted, provided that the
	* above copyright notice and this permission notice appear in all copies.
	* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
	* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
	* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
	* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
	* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
	* OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
	**************************************************************************
	*/

	/* nss_ipsecmgr.c
	* NSS to HLOS IPSec Manager
	*/
	#include <linux/version.h>
	#include <linux/types.h>
	#include <linux/ip.h>
	#include <linux/of.h>
	#include <linux/ipv6.h>
	#include <linux/skbuff.h>
	#include <linux/module.h>
	#include <linux/bitops.h>
	#include <linux/netdevice.h>
	#include <linux/rtnetlink.h>
	#include <linux/etherdevice.h>
	#include <linux/vmalloc.h>
	#include <linux/debugfs.h>
	#include <linux/atomic.h>
	#include <net/protocol.h>
	#include <net/route.h>
	#include <net/ip6_route.h>
	#include <net/esp.h>
	#include <net/xfrm.h>
	#include <net/icmp.h>

	#include <crypto/aead.h>
	#include <crypto/skcipher.h>
	#include <crypto/internal/hash.h>

	#include <nss_api_if.h>
	#include <nss_ipsec_cmn.h>
	#include <nss_ipsecmgr.h>
	#include <nss_cryptoapi.h>

	#include "nss_ipsecmgr_ref.h"
	#include "nss_ipsecmgr_flow.h"
	#include "nss_ipsecmgr_sa.h"
	#include "nss_ipsecmgr_ctx.h"
	#include "nss_ipsecmgr_tunnel.h"
	#include "nss_ipsecmgr_priv.h"

	/*
	* nss_ipsecmgr_tunnel_open()
	* open the tunnel for usage
	*/
	static int nss_ipsecmgr_tunnel_open(struct net_device *dev)
	{
	struct nss_ipsecmgr_tunnel *tun __attribute__((unused)) = netdev_priv(dev);

	netif_start_queue(dev);
	return 0;
	}

	/*
	* nss_ipsecmgr_tunnel_stop()
	* stop the IPsec tunnel
	*/
	static int nss_ipsecmgr_tunnel_stop(struct net_device *dev)
	{
	struct nss_ipsecmgr_tunnel *tun __attribute__((unused)) = netdev_priv(dev);

	netif_stop_queue(dev);
	return 0;
	}

	/*
	* nss_ipsecmgr_tunnel_tx()
	* tunnel transmit function
	*/
	static netdev_tx_t nss_ipsecmgr_tunnel_tx(struct sk_buff skb, struct net_device dev)
	{
	struct nss_ipsecmgr_tunnel *tun = netdev_priv(dev);
	struct nss_ipsec_cmn_flow_tuple f_tuple = {{0}};
	struct nss_ipsec_cmn_mdata_encap *mdata;
	struct nss_ipsec_cmn_sa_tuple *sa_tuple;
	struct nss_ctx_instance *nss_ctx;
	struct nss_ipsecmgr_flow *flow;
	struct nss_ipsecmgr_ctx *ctx;
	struct nss_ipsecmgr_sa *sa;
	bool expand_skb = false;
	uint16_t data_len;
	int nhead, ntail;
	uint32_t ifnum;

	nhead = dev->needed_headroom;
	ntail = dev->needed_tailroom;

	/*
	* Check if skb is shared
	*/
	if (unlikely(skb_shared(skb))) {
	skb = skb_unshare(skb, in_atomic() ? GFP_ATOMIC : GFP_KERNEL);
	if (!skb)
	return NETDEV_TX_OK;
	}

	/*
	* Currently IPsec only supports tunnel mode hence non-IP frames are freed.
	* In transport mode we will encapsulate based on the skb->protocol
	*/
	switch (ip_hdr(skb)->version) {
	case IPVERSION:
	nss_ipsecmgr_flow_ipv4_inner2tuple(ip_hdr(skb), &f_tuple);
	break;

	case 6:
	nss_ipsecmgr_flow_ipv6_inner2tuple(ipv6_hdr(skb), &f_tuple);
	break;

	default:
	nss_ipsecmgr_warn("%px: Non-IP packet for encapsulation", dev);
	goto free;
	}

	/*
	* Linearize the nonlinear SKB.
	*/
	if (skb_linearize(skb)) {
	nss_ipsecmgr_trace("%s: unable to Linearize SKB\n", dev->name);
	goto free;
	}

	/*
	* For all these cases
	* - create a writable copy of buffer
	* - increase the head room
	* - increase the tail room
	*/
	if (skb_cloned(skb) \|\| (skb_headroom(skb) < nhead) \|\| (skb_tailroom(skb) < ntail)) {
	expand_skb = true;
	}

	if (expand_skb && pskb_expand_head(skb, nhead, ntail, GFP_KERNEL)) {
	nss_ipsecmgr_trace("%s: unable to expand buffer\n", dev->name);
	goto free;
	}

	/*
	* This packet is ready for NSS transformation. We will now insert the
	* metadata on top of the IP header and expand data area to cover tailroom for NSS.
	*/
	data_len = skb->len;
	skb_put(skb, ntail);
	mdata = nss_ipsecmgr_tunnel_push_mdata(skb);

	read_lock_bh(&ipsecmgr_drv->lock);

	ctx = nss_ipsecmgr_ctx_find(tun, NSS_IPSEC_CMN_CTX_TYPE_MDATA_INNER);
	if (!ctx) {
	read_unlock_bh(&ipsecmgr_drv->lock);
	nss_ipsecmgr_warn("%px: failed to find inner metdata context for TX\n", tun);
	goto free;
	}

	/*
	* Check if default SA is configured in tunnel. If found, fill sa_tuple in
	* metadata to be used for encap.
	*/
	sa = tun->tx_sa;
	if (sa) {
	sa_tuple = &sa->state.tuple;
	goto fill_mdata;
	}

	/*
	* We search the flow if this has been programmed prior to sending the packets. If flow
	* is found, we send corresponding sa_tuple as metadata for encap, else drop the packet.
	*/
	flow = nss_ipsecmgr_flow_find(ipsecmgr_drv->flow_db, &f_tuple);
	if (!flow) {
	read_unlock_bh(&ipsecmgr_drv->lock);
	nss_ipsecmgr_trace("%px, failed to find flow for TX", tun);
	goto free;
	}

	sa_tuple = &flow->state.sa;

	fill_mdata:
	mdata->flags = 0;
	mdata->seq_num = 0;
	mdata->sa = *sa_tuple;
	mdata->data_len = data_len;

	ifnum = ctx->ifnum;
	nss_ctx = ctx->nss_ctx;
	read_unlock_bh(&ipsecmgr_drv->lock);

	/*
	* We are not expecting the packet to host; hence scrub it.
	* In case of exception the packet will be encapsulated which
	* is different from the one that went for transformation.
	*
	* Note: The SKB will be orphaned at this point. Ideally, this should
	* be charged to NSS pool which allow the accounting of all such buffers.
	*/
	skb_scrub_packet(skb, true);

	/*
	* Send the packet down;
	* TODO: Use stop queue and start queue to restart in case of
	* queue full condition
	*/
	if (nss_ipsec_cmn_tx_buf(nss_ctx, skb, ifnum) != 0) {
	goto free;
	}

	return NETDEV_TX_OK;

	free:
	dev_kfree_skb_any(skb);
	return NETDEV_TX_OK;
	}

	/*
	* nss_ipsecmgr_tunnel_get_stats64()
	* Get device statistics
	*/
	static struct rtnl_link_stats64 nss_ipsecmgr_tunnel_get_stats64(struct net_device dev, struct rtnl_link_stats64 *stats)
	{
	struct nss_ipsecmgr_tunnel *tun = netdev_priv(dev);
	struct list_head *head = &tun->ctx_db;
	struct nss_ipsecmgr_ctx *ctx;

	memset(stats, 0, sizeof(*stats));

	read_lock_bh(&ipsecmgr_drv->lock);
	list_for_each_entry(ctx, head, list) {
	nss_ipsecmgr_ctx_stats_read(ctx, stats);
	}

	read_unlock_bh(&ipsecmgr_drv->lock);
	return stats;
	}

	/*
	* nss_ipsecmgr_tunnel_stats64()
	* Sync statistics to linux
	*/
	#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 11, 0))
	static struct rtnl_link_stats64 nss_ipsecmgr_tunnel_stats64(struct net_device dev, struct rtnl_link_stats64 *stats)
	{
	return nss_ipsecmgr_tunnel_get_stats64(dev, stats);
	}
	#else
	static void nss_ipsecmgr_tunnel_stats64(struct net_device dev, struct rtnl_link_stats64 stats)
	{
	nss_ipsecmgr_tunnel_get_stats64(dev, stats);
	}
	#endif

	/*
	* nss_ipsecmgr_tunnel_mtu_update()
	* Update tunnel max MTU
	*/
	static void nss_ipsecmgr_tunnel_mtu_update(struct list_head *head)
	{
	struct nss_ipsecmgr_tunnel *tun;
	uint16_t max_mtu = 0;
	bool update_mtu = false;

	write_lock(&ipsecmgr_drv->lock);
	list_for_each_entry(tun, head, list) {
	if (tun->dev->mtu > max_mtu)
	max_mtu = tun->dev->mtu;
	}

	if (ipsecmgr_drv->max_mtu != max_mtu) {
	ipsecmgr_drv->max_mtu = max_mtu;
	update_mtu = true;
	}

	write_unlock(&ipsecmgr_drv->lock);

	#ifdef NSS_IPSECMGR_PPE_SUPPORT
	/*
	* Set PPE inline port's MTU.
	* TODO: this needs to move to Virtual Port
	*/
	if (ipsecmgr_drv->ipsec_inline && update_mtu) {
	struct nss_ipsecmgr_ctx *ctx;
	uint32_t redir_ifnum;

	read_lock_bh(&ipsecmgr_drv->lock);
	ctx = nss_ipsecmgr_ctx_find(netdev_priv(ipsecmgr_drv->dev), NSS_IPSEC_CMN_CTX_TYPE_REDIR);
	if (!ctx) {
	read_unlock_bh(&ipsecmgr_drv->lock);
	nss_ipsecmgr_warn("Unable to find REDIR interface for %s", ipsecmgr_drv->dev->name);
	return;
	}
	redir_ifnum = ctx->ifnum;
	read_unlock_bh(&ipsecmgr_drv->lock);

	nss_ipsecmgr_info("Updating mtu for %s as %d", ipsecmgr_drv->dev->name, max_mtu);
	nss_ipsec_cmn_ppe_mtu_update(ipsecmgr_drv->nss_ctx, redir_ifnum, max_mtu, max_mtu);
	}
	#endif
	}

	/*
	* nss_ipsecmgr_tunnel_mtu()
	* Change device MTU
	*/
	static int nss_ipsecmgr_tunnel_mtu(struct net_device *dev, int mtu)
	{
	dev->mtu = mtu;
	nss_ipsecmgr_tunnel_mtu_update(&ipsecmgr_drv->tun_db);
	return 0;
	}

	/* NSS IPsec tunnel operation */
	static const struct net_device_ops ipsecmgr_dev_ops = {
	.ndo_open = nss_ipsecmgr_tunnel_open,
	.ndo_stop = nss_ipsecmgr_tunnel_stop,
	.ndo_start_xmit = nss_ipsecmgr_tunnel_tx,
	.ndo_get_stats64 = nss_ipsecmgr_tunnel_stats64,
	.ndo_change_mtu = nss_ipsecmgr_tunnel_mtu,
	};

	/*
	* nss_ipsecmgr_tunnel_free()
	* free an existing IPsec tunnel interface
	*/
	static void nss_ipsecmgr_tunnel_free(struct net_device *dev)
	{
	struct nss_ipsecmgr_tunnel *tun = netdev_priv(dev);
	struct nss_ipsecmgr_ref ref, tmp;
	struct list_head free_refs;

	nss_ipsecmgr_info("IPsec tunnel device(%s) freed\n", dev->name);

	INIT_LIST_HEAD(&free_refs);

	/*
	* Remove context(s) from the tunnel reference tree if it has been
	* added
	*/
	write_lock_bh(&ipsecmgr_drv->lock);
	if (!nss_ipsecmgr_ref_is_empty(&tun->ref)) {
	nss_ipsecmgr_ref_del(&tun->ref, &free_refs);
	}

	write_unlock_bh(&ipsecmgr_drv->lock);

	list_for_each_entry_safe(ref, tmp, &free_refs, node) {
	ref->free(ref);
	}

	free_netdev(dev);
	}

	/*
	* nss_ipsecmgr_tunnel_free_work()
	* Drain all pending refs for free
	*/
	static void nss_ipsecmgr_tunnel_free_work(struct work_struct *work)
	{
	struct nss_ipsecmgr_tunnel *tun = container_of(work, struct nss_ipsecmgr_tunnel, free_work);
	struct nss_ipsecmgr_ref ref, tmp;
	struct list_head tmp_head;
	bool is_locked;

	INIT_LIST_HEAD(&tmp_head);

	write_lock_bh(&ipsecmgr_drv->lock);
	list_splice_tail_init(&tun->free_refs, &tmp_head);
	write_unlock_bh(&ipsecmgr_drv->lock);

	is_locked = rtnl_trylock();
	list_for_each_entry_safe(ref, tmp, &tmp_head, node) {
	ref->free(ref);
	}

	if (is_locked)
	rtnl_unlock();
	}

	/*
	* nss_ipsecmgr_tunnel_free_ref()
	* Unregister IPsec tunnel interface
	*/
	static void nss_ipsecmgr_tunnel_free_ref(struct nss_ipsecmgr_ref *ref)
	{
	struct nss_ipsecmgr_tunnel *tun = container_of(ref, struct nss_ipsecmgr_tunnel, ref);

	/*
	* The unregister should start here but the expectation is that the free would
	* happen when the reference count goes down to '0'
	*/
	if (tun->dev->reg_state == NETREG_REGISTERED) {
	nss_ipsecmgr_tunnel_mtu_update(&ipsecmgr_drv->tun_db);
	rtnl_is_locked() ? unregister_netdevice(tun->dev) : unregister_netdev(tun->dev);
	}
	}

	/*
	* nss_ipsecmgr_tunnel_del_ref()
	* Delete IPsec tunnel reference
	*/
	static void nss_ipsecmgr_tunnel_del_ref(struct nss_ipsecmgr_ref *ref)
	{
	struct nss_ipsecmgr_tunnel *tun = container_of(ref, struct nss_ipsecmgr_tunnel, ref);
	list_del(&tun->list);
	}

	/*
	* nss_ipsecmr_dev_setup()
	* setup the IPsec tunnel
	*/
	static void nss_ipsecmgr_tunnel_setup(struct net_device *dev)
	{
	dev->addr_len = ETH_ALEN;
	dev->mtu = NSS_IPSECMGR_TUN_MTU(ETH_DATA_LEN);

	dev->hard_header_len = NSS_IPSECMGR_TUN_MAX_HDR_LEN;
	dev->needed_headroom = NSS_IPSECMGR_TUN_HEADROOM;
	dev->needed_tailroom = NSS_IPSECMGR_TUN_TAILROOM;

	dev->type = NSS_IPSEC_CMN_ARPHRD_IPSEC;

	dev->ethtool_ops = NULL;
	dev->header_ops = NULL;
	dev->netdev_ops = &ipsecmgr_dev_ops;

	#if (LINUX_VERSION_CODE <= KERNEL_VERSION(4, 11, 8))
	dev->destructor = nss_ipsecmgr_tunnel_free;
	#else
	dev->priv_destructor = nss_ipsecmgr_tunnel_free;
	#endif

	/*
	* Get the MAC address from the ethernet device
	*/
	random_ether_addr(dev->dev_addr);

	memset(dev->broadcast, 0xff, dev->addr_len);
	memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
	}

	/*
	* nss_ipsecmgr_tunnel_del()
	* delete an existing IPsec tunnel
	*/
	void nss_ipsecmgr_tunnel_del(struct net_device *dev)
	{
	struct nss_ipsecmgr_tunnel *tun = netdev_priv(dev);

	debugfs_remove_recursive(tun->dentry);

	/*
	* Flush all associated SA(s) and flow(s) with the tunnel
	*/
	write_lock_bh(&ipsecmgr_drv->lock);
	nss_ipsecmgr_ref_del(&tun->ref, &tun->free_refs);
	write_unlock_bh(&ipsecmgr_drv->lock);

	schedule_work(&tun->free_work);
	flush_work(&tun->free_work);
	}
	EXPORT_SYMBOL(nss_ipsecmgr_tunnel_del);

	/*
	* nss_ipsecmgr_tunnel_add()
	* add a IPsec pseudo tunnel device
	*/
	struct net_device nss_ipsecmgr_tunnel_add(struct nss_ipsecmgr_callback cb)
	{
	struct nss_ipsecmgr_ctx inner, mdata_inner;
	struct nss_ipsecmgr_ctx outer, mdata_outer;
	struct nss_ipsecmgr_tunnel *tun;
	struct net_device *skb_dev;
	struct net_device *dev;
	int status;

	dev = alloc_netdev(sizeof(*tun), NSS_IPSECMGR_TUN_NAME, NET_NAME_ENUM, nss_ipsecmgr_tunnel_setup);
	if (!dev) {
	nss_ipsecmgr_error("unable to allocate a tunnel device\n");
	return NULL;
	}

	skb_dev = cb->skb_dev;
	tun = netdev_priv(dev);

	tun->dev = dev;
	nss_ipsecmgr_ref_init(&tun->ref, nss_ipsecmgr_tunnel_del_ref, nss_ipsecmgr_tunnel_free_ref);

	INIT_LIST_HEAD(&tun->list);
	INIT_LIST_HEAD(&tun->free_refs);
	INIT_WORK(&tun->free_work, nss_ipsecmgr_tunnel_free_work);

	nss_ipsecmgr_db_init(&tun->ctx_db);

	memcpy(&tun->cb, cb, sizeof(tun->cb));

	/*
	* Use HLOS netdev if it is loaded in the callback context;
	* else use the NSS netdev
	*/
	if (!skb_dev)
	tun->cb.skb_dev = dev;

	/*
	* Inner context allocation
	*/
	inner = nss_ipsecmgr_ctx_alloc(tun,
	NSS_IPSEC_CMN_CTX_TYPE_INNER,
	NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_INNER,
	nss_ipsecmgr_ctx_rx_inner,
	nss_ipsecmgr_ctx_rx_stats,
	NSS_IPSEC_CMN_FEATURE_INLINE_ACCEL);
	if (!inner) {
	nss_ipsecmgr_warn("%px: failed to allocate context inner\n", tun);
	goto free;
	}

	nss_ipsecmgr_ctx_attach(&tun->ctx_db, inner);

	/*
	* Inner Metadata context allocation
	*/
	mdata_inner = nss_ipsecmgr_ctx_alloc(tun,
	NSS_IPSEC_CMN_CTX_TYPE_MDATA_INNER,
	NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_MDATA_INNER,
	nss_ipsecmgr_ctx_rx_inner,
	nss_ipsecmgr_ctx_rx_stats,
	0);
	if (!mdata_inner) {
	nss_ipsecmgr_warn("%px: failed to allocate context metadata inner\n", tun);
	goto free;
	}

	nss_ipsecmgr_ctx_attach(&tun->ctx_db, mdata_inner);
	/*
	* Outer context allocation
	*/
	outer = nss_ipsecmgr_ctx_alloc(tun,
	NSS_IPSEC_CMN_CTX_TYPE_OUTER,
	NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_OUTER,
	nss_ipsecmgr_ctx_rx_outer,
	nss_ipsecmgr_ctx_rx_stats,
	NSS_IPSEC_CMN_FEATURE_INLINE_ACCEL);
	if (!outer) {
	nss_ipsecmgr_warn("%px: failed to allocate context outer\n", tun);
	goto free;
	}

	nss_ipsecmgr_ctx_attach(&tun->ctx_db, outer);
	/*
	* Outer metadata context allocation
	*/
	mdata_outer = nss_ipsecmgr_ctx_alloc(tun,
	NSS_IPSEC_CMN_CTX_TYPE_MDATA_OUTER,
	NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_MDATA_OUTER,
	nss_ipsecmgr_ctx_rx_outer,
	nss_ipsecmgr_ctx_rx_stats,
	0);
	if (!mdata_outer) {
	nss_ipsecmgr_warn("%px: failed to allocate context metadata outer\n", tun);
	goto free;
	}

	nss_ipsecmgr_ctx_attach(&tun->ctx_db, mdata_outer);

	/*
	* We need to setup the exception interface number for inner & outer;
	* The exception interface is used by the NSS to send the packet back
	* to host when there is a rule miss after the processing (inner or outer).
	* In case of inner any exception after its processing must come with the
	* outer interface number. Similarly, for outer we have to do the opposite
	*/
	nss_ipsecmgr_ctx_set_except(inner, outer->ifnum);
	nss_ipsecmgr_ctx_set_except(mdata_inner, outer->ifnum);
	nss_ipsecmgr_ctx_set_except(outer, inner->ifnum);
	nss_ipsecmgr_ctx_set_except(mdata_outer, inner->ifnum);

	/*
	* We need to setup the sibling interface number for inner & outer;
	* The sibling interface is used by the NSS to configure SA on sibling.
	*/
	nss_ipsecmgr_ctx_set_sibling(inner, mdata_inner->ifnum);
	nss_ipsecmgr_ctx_set_sibling(outer, mdata_outer->ifnum);

	if (!nss_ipsecmgr_ctx_config(inner)) {
	nss_ipsecmgr_warn("%px: failed to configure inner context\n", tun);
	goto free;
	}

	if (!nss_ipsecmgr_ctx_config(mdata_inner)) {
	nss_ipsecmgr_warn("%px: failed to configure metadata inner context\n", tun);
	goto free;
	}

	if (!nss_ipsecmgr_ctx_config(outer)) {
	nss_ipsecmgr_warn("%px: failed to configure outer context\n", tun);
	goto free;
	}

	if (!nss_ipsecmgr_ctx_config(mdata_outer)) {
	nss_ipsecmgr_warn("%px: failed to configure metadata outer context\n", tun);
	goto free;
	}

	status = rtnl_is_locked() ? register_netdevice(dev) : register_netdev(dev);
	if (status < 0) {
	nss_ipsecmgr_warn("%px: register net dev failed :%s\n", tun, dev->name);
	#if (LINUX_VERSION_CODE <= KERNEL_VERSION(4, 11, 8))
	goto free;
	#else
	/*
	* Later kernels invoke the destructor upon failure
	*/
	return NULL;
	#endif
	}

	write_lock(&ipsecmgr_drv->lock);
	list_add(&tun->list, &ipsecmgr_drv->tun_db);
	write_unlock(&ipsecmgr_drv->lock);

	nss_ipsecmgr_tunnel_mtu(dev, skb_dev ? skb_dev->mtu : dev->mtu);

	/*
	* Create debugfs entry for tunnel and its child context(s)
	*/
	tun->dentry = debugfs_create_dir(dev->name, ipsecmgr_drv->dentry);
	if (tun->dentry) {
	debugfs_create_file("inner", S_IRUGO, tun->dentry, inner, &ipsecmgr_ctx_file_ops);
	debugfs_create_file("mdata_inner", S_IRUGO, tun->dentry, mdata_inner, &ipsecmgr_ctx_file_ops);
	debugfs_create_file("outer", S_IRUGO, tun->dentry, outer, &ipsecmgr_ctx_file_ops);
	debugfs_create_file("mdata_outer", S_IRUGO, tun->dentry, mdata_outer, &ipsecmgr_ctx_file_ops);
	}

	return dev;
	free:
	#if (LINUX_VERSION_CODE <= KERNEL_VERSION(4, 11, 8))
	dev->destructor(dev);
	#else
	dev->priv_destructor(dev);
	#endif
	return NULL;
	}
	EXPORT_SYMBOL(nss_ipsecmgr_tunnel_add);