/*
 * Copyright (c) 2006 - 2009 Intel Corporation.  All rights reserved.
 *
 * This software is available to you under a choice of one of two
 * licenses.  You may choose to be licensed under the terms of the GNU
 * General Public License (GPL) Version 2, available from the file
 * COPYING in the main directory of this source tree, or the
 * OpenIB.org BSD license below:
 *
 *     Redistribution and use in source and binary forms, with or
 *     without modification, are permitted provided that the following
 *     conditions are met:
 *
 *      - Redistributions of source code must retain the above
 *        copyright notice, this list of conditions and the following
 *        disclaimer.
 *
 *      - Redistributions in binary form must reproduce the above
 *        copyright notice, this list of conditions and the following
 *        disclaimer in the documentation and/or other materials
 *        provided with the distribution.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 * SOFTWARE.
 *
 */


#define TCPOPT_TIMESTAMP 8

#include <asm/atomic.h>
#include <linux/skbuff.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/init.h>
#include <linux/if_arp.h>
#include <linux/if_vlan.h>
#include <linux/notifier.h>
#include <linux/net.h>
#include <linux/types.h>
#include <linux/timer.h>
#include <linux/time.h>
#include <linux/delay.h>
#include <linux/etherdevice.h>
#include <linux/netdevice.h>
#include <linux/random.h>
#include <linux/list.h>
#include <linux/threads.h>
#include <linux/highmem.h>
#include <linux/slab.h>
#include <net/arp.h>
#include <net/neighbour.h>
#include <net/route.h>
#include <net/ip_fib.h>
#include <net/tcp.h>

#include "nes.h"

u32 cm_packets_sent;
u32 cm_packets_bounced;
u32 cm_packets_dropped;
u32 cm_packets_retrans;
u32 cm_packets_created;
u32 cm_packets_received;
atomic_t cm_listens_created;
atomic_t cm_listens_destroyed;
u32 cm_backlog_drops;
atomic_t cm_loopbacks;
atomic_t cm_nodes_created;
atomic_t cm_nodes_destroyed;
atomic_t cm_accel_dropped_pkts;
atomic_t cm_resets_recvd;

static inline int mini_cm_accelerated(struct nes_cm_core *,
	struct nes_cm_node *);
static struct nes_cm_listener *mini_cm_listen(struct nes_cm_core *,
	struct nes_vnic *, struct nes_cm_info *);
static int mini_cm_del_listen(struct nes_cm_core *, struct nes_cm_listener *);
static struct nes_cm_node *mini_cm_connect(struct nes_cm_core *,
	struct nes_vnic *, u16, void *, struct nes_cm_info *);
static int mini_cm_close(struct nes_cm_core *, struct nes_cm_node *);
static int mini_cm_accept(struct nes_cm_core *, struct ietf_mpa_frame *,
	struct nes_cm_node *);
static int mini_cm_reject(struct nes_cm_core *, struct ietf_mpa_frame *,
	struct nes_cm_node *);
static int mini_cm_recv_pkt(struct nes_cm_core *, struct nes_vnic *,
	struct sk_buff *);
static int mini_cm_dealloc_core(struct nes_cm_core *);
static int mini_cm_get(struct nes_cm_core *);
static int mini_cm_set(struct nes_cm_core *, u32, u32);

static void form_cm_frame(struct sk_buff *, struct nes_cm_node *,
	void *, u32, void *, u32, u8);
static int add_ref_cm_node(struct nes_cm_node *);
static int rem_ref_cm_node(struct nes_cm_core *, struct nes_cm_node *);

static int nes_cm_disconn_true(struct nes_qp *);
static int nes_cm_post_event(struct nes_cm_event *event);
static int nes_disconnect(struct nes_qp *nesqp, int abrupt);
static void nes_disconnect_worker(struct work_struct *work);

static int send_mpa_request(struct nes_cm_node *, struct sk_buff *);
static int send_mpa_reject(struct nes_cm_node *);
static int send_syn(struct nes_cm_node *, u32, struct sk_buff *);
static int send_reset(struct nes_cm_node *, struct sk_buff *);
static int send_ack(struct nes_cm_node *cm_node, struct sk_buff *skb);
static int send_fin(struct nes_cm_node *cm_node, struct sk_buff *skb);
static void process_packet(struct nes_cm_node *, struct sk_buff *,
	struct nes_cm_core *);

static void active_open_err(struct nes_cm_node *, struct sk_buff *, int);
static void passive_open_err(struct nes_cm_node *, struct sk_buff *, int);
static void cleanup_retrans_entry(struct nes_cm_node *);
static void handle_rcv_mpa(struct nes_cm_node *, struct sk_buff *);
static void free_retrans_entry(struct nes_cm_node *cm_node);
static int handle_tcp_options(struct nes_cm_node *cm_node, struct tcphdr *tcph,
	struct sk_buff *skb, int optionsize, int passive);

/* CM event handler functions */
static void cm_event_connected(struct nes_cm_event *);
static void cm_event_connect_error(struct nes_cm_event *);
static void cm_event_reset(struct nes_cm_event *);
static void cm_event_mpa_req(struct nes_cm_event *);
static void cm_event_mpa_reject(struct nes_cm_event *);
static void handle_recv_entry(struct nes_cm_node *cm_node, u32 rem_node);

static void print_core(struct nes_cm_core *core);

/* External CM API Interface */
/* instance of function pointers for client API */
/* set address of this instance to cm_core->cm_ops at cm_core alloc */
static struct nes_cm_ops nes_cm_api = {
	mini_cm_accelerated,
	mini_cm_listen,
	mini_cm_del_listen,
	mini_cm_connect,
	mini_cm_close,
	mini_cm_accept,
	mini_cm_reject,
	mini_cm_recv_pkt,
	mini_cm_dealloc_core,
	mini_cm_get,
	mini_cm_set
};

static struct nes_cm_core *g_cm_core;

atomic_t cm_connects;
atomic_t cm_accepts;
atomic_t cm_disconnects;
atomic_t cm_closes;
atomic_t cm_connecteds;
atomic_t cm_connect_reqs;
atomic_t cm_rejects;


/**
 * create_event
 */
static struct nes_cm_event *create_event(struct nes_cm_node *cm_node,
		enum nes_cm_event_type type)
{
	struct nes_cm_event *event;

	if (!cm_node->cm_id)
		return NULL;

	/* allocate an empty event */
	event = kzalloc(sizeof(*event), GFP_ATOMIC);

	if (!event)
		return NULL;

	event->type = type;
	event->cm_node = cm_node;
	event->cm_info.rem_addr = cm_node->rem_addr;
	event->cm_info.loc_addr = cm_node->loc_addr;
	event->cm_info.rem_port = cm_node->rem_port;
	event->cm_info.loc_port = cm_node->loc_port;
	event->cm_info.cm_id = cm_node->cm_id;

	nes_debug(NES_DBG_CM, "cm_node=%p Created event=%p, type=%u, "
		"dst_addr=%08x[%x], src_addr=%08x[%x]\n",
		cm_node, event, type, event->cm_info.loc_addr,
		event->cm_info.loc_port, event->cm_info.rem_addr,
		event->cm_info.rem_port);

	nes_cm_post_event(event);
	return event;
}


/**
 * send_mpa_request
 */
static int send_mpa_request(struct nes_cm_node *cm_node, struct sk_buff *skb)
{
	if (!skb) {
		nes_debug(NES_DBG_CM, "skb set to NULL\n");
		return -1;
	}

	/* send an MPA Request frame */
	form_cm_frame(skb, cm_node, NULL, 0, &cm_node->mpa_frame,
			cm_node->mpa_frame_size, SET_ACK);

	return schedule_nes_timer(cm_node, skb, NES_TIMER_TYPE_SEND, 1, 0);
}



static int send_mpa_reject(struct nes_cm_node *cm_node)
{
	struct sk_buff  *skb = NULL;

	skb = dev_alloc_skb(MAX_CM_BUFFER);
	if (!skb) {
		nes_debug(NES_DBG_CM, "Failed to get a Free pkt\n");
		return -ENOMEM;
	}

	/* send an MPA reject frame */
	form_cm_frame(skb, cm_node, NULL, 0, &cm_node->mpa_frame,
			cm_node->mpa_frame_size, SET_ACK | SET_FIN);

	cm_node->state = NES_CM_STATE_FIN_WAIT1;
	return schedule_nes_timer(cm_node, skb, NES_TIMER_TYPE_SEND, 1, 0);
}


/**
 * recv_mpa - process a received TCP pkt, we are expecting an
 * IETF MPA frame
 */
static int parse_mpa(struct nes_cm_node *cm_node, u8 *buffer, u32 *type,
		u32 len)
{
	struct ietf_mpa_frame *mpa_frame;

	*type = NES_MPA_REQUEST_ACCEPT;

	/* assume req frame is in tcp data payload */
	if (len < sizeof(struct ietf_mpa_frame)) {
		nes_debug(NES_DBG_CM, "The received ietf buffer was too small (%x)\n", len);
		return -EINVAL;
	}

	mpa_frame = (struct ietf_mpa_frame *)buffer;
	cm_node->mpa_frame_size = ntohs(mpa_frame->priv_data_len);
	/* make sure mpa private data len is less than 512 bytes */
	if (cm_node->mpa_frame_size > IETF_MAX_PRIV_DATA_LEN) {
		nes_debug(NES_DBG_CM, "The received Length of Private"
			" Data field exceeds 512 octets\n");
		return -EINVAL;
	}
	/*
	 * make sure MPA receiver interoperate with the
	 * received MPA version and MPA key information
	 *
	 */
	if (mpa_frame->rev != mpa_version) {
		nes_debug(NES_DBG_CM, "The received mpa version"
				" can not be interoperated\n");
		return -EINVAL;
	}
	if (cm_node->state != NES_CM_STATE_MPAREQ_SENT) {
		if (memcmp(mpa_frame->key, IEFT_MPA_KEY_REQ, IETF_MPA_KEY_SIZE)) {
			nes_debug(NES_DBG_CM, "Unexpected MPA Key received \n");
			return -EINVAL;
		}
	} else {
		if (memcmp(mpa_frame->key, IEFT_MPA_KEY_REP, IETF_MPA_KEY_SIZE)) {
			nes_debug(NES_DBG_CM, "Unexpected MPA Key received \n");
			return -EINVAL;
		}
	}

	if (cm_node->mpa_frame_size + sizeof(struct ietf_mpa_frame) != len) {
		nes_debug(NES_DBG_CM, "The received ietf buffer was not right"
				" complete (%x + %x != %x)\n",
				cm_node->mpa_frame_size,
				(u32)sizeof(struct ietf_mpa_frame), len);
		return -EINVAL;
	}
	/* make sure it does not exceed the max size */
	if (len > MAX_CM_BUFFER) {
		nes_debug(NES_DBG_CM, "The received ietf buffer was too large"
				" (%x + %x != %x)\n",
				cm_node->mpa_frame_size,
				(u32)sizeof(struct ietf_mpa_frame), len);
		return -EINVAL;
	}

	/* copy entire MPA frame to our cm_node's frame */
	memcpy(cm_node->mpa_frame_buf, buffer + sizeof(struct ietf_mpa_frame),
			cm_node->mpa_frame_size);

	if (mpa_frame->flags & IETF_MPA_FLAGS_REJECT)
		*type = NES_MPA_REQUEST_REJECT;
	return 0;
}


/**
 * form_cm_frame - get a free packet and build empty frame Use
 * node info to build.
 */
static void form_cm_frame(struct sk_buff *skb,
	struct nes_cm_node *cm_node, void *options, u32 optionsize,
	void *data, u32 datasize, u8 flags)
{
	struct tcphdr *tcph;
	struct iphdr *iph;
	struct ethhdr *ethh;
	u8 *buf;
	u16 packetsize = sizeof(*iph);

	packetsize += sizeof(*tcph);
	packetsize +=  optionsize + datasize;

	memset(skb->data, 0x00, ETH_HLEN + sizeof(*iph) + sizeof(*tcph));

	skb->len = 0;
	buf = skb_put(skb, packetsize + ETH_HLEN);

	ethh = (struct ethhdr *) buf;
	buf += ETH_HLEN;

	iph = (struct iphdr *)buf;
	buf += sizeof(*iph);
	tcph = (struct tcphdr *)buf;
	skb_reset_mac_header(skb);
	skb_set_network_header(skb, ETH_HLEN);
	skb_set_transport_header(skb, ETH_HLEN+sizeof(*iph));
	buf += sizeof(*tcph);

	skb->ip_summed = CHECKSUM_PARTIAL;
	skb->protocol = htons(0x800);
	skb->data_len = 0;
	skb->mac_len = ETH_HLEN;

	memcpy(ethh->h_dest, cm_node->rem_mac, ETH_ALEN);
	memcpy(ethh->h_source, cm_node->loc_mac, ETH_ALEN);
	ethh->h_proto = htons(0x0800);

	iph->version = IPVERSION;
	iph->ihl = 5;		/* 5 * 4Byte words, IP headr len */
	iph->tos = 0;
	iph->tot_len = htons(packetsize);
	iph->id = htons(++cm_node->tcp_cntxt.loc_id);

	iph->frag_off = htons(0x4000);
	iph->ttl = 0x40;
	iph->protocol = 0x06;	/* IPPROTO_TCP */

	iph->saddr = htonl(cm_node->loc_addr);
	iph->daddr = htonl(cm_node->rem_addr);

	tcph->source = htons(cm_node->loc_port);
	tcph->dest = htons(cm_node->rem_port);
	tcph->seq = htonl(cm_node->tcp_cntxt.loc_seq_num);

	if (flags & SET_ACK) {
		cm_node->tcp_cntxt.loc_ack_num = cm_node->tcp_cntxt.rcv_nxt;
		tcph->ack_seq = htonl(cm_node->tcp_cntxt.loc_ack_num);
		tcph->ack = 1;
	} else
		tcph->ack_seq = 0;

	if (flags & SET_SYN) {
		cm_node->tcp_cntxt.loc_seq_num++;
		tcph->syn = 1;
	} else
		cm_node->tcp_cntxt.loc_seq_num += datasize;

	if (flags & SET_FIN) {
		cm_node->tcp_cntxt.loc_seq_num++;
		tcph->fin = 1;
	}

	if (flags & SET_RST)
		tcph->rst = 1;

	tcph->doff = (u16)((sizeof(*tcph) + optionsize + 3) >> 2);
	tcph->window = htons(cm_node->tcp_cntxt.rcv_wnd);
	tcph->urg_ptr = 0;
	if (optionsize)
		memcpy(buf, options, optionsize);
	buf += optionsize;
	if (datasize)
		memcpy(buf, data, datasize);

	skb_shinfo(skb)->nr_frags = 0;
	cm_packets_created++;

}


/**
 * print_core - dump a cm core
 */
static void print_core(struct nes_cm_core *core)
{
	nes_debug(NES_DBG_CM, "---------------------------------------------\n");
	nes_debug(NES_DBG_CM, "CM Core  -- (core = %p )\n", core);
	if (!core)
		return;
	nes_debug(NES_DBG_CM, "---------------------------------------------\n");

	nes_debug(NES_DBG_CM, "State         : %u \n",  core->state);

	nes_debug(NES_DBG_CM, "Listen Nodes  : %u \n", atomic_read(&core->listen_node_cnt));
	nes_debug(NES_DBG_CM, "Active Nodes  : %u \n", atomic_read(&core->node_cnt));

	nes_debug(NES_DBG_CM, "core          : %p \n", core);

	nes_debug(NES_DBG_CM, "-------------- end core ---------------\n");
}


/**
 * schedule_nes_timer
 * note - cm_node needs to be protected before calling this. Encase in:
 *			rem_ref_cm_node(cm_core, cm_node);add_ref_cm_node(cm_node);
 */
int schedule_nes_timer(struct nes_cm_node *cm_node, struct sk_buff *skb,
		enum nes_timer_type type, int send_retrans,
		int close_when_complete)
{
	unsigned long  flags;
	struct nes_cm_core *cm_core = cm_node->cm_core;
	struct nes_timer_entry *new_send;
	int ret = 0;
	u32 was_timer_set;

	new_send = kzalloc(sizeof(*new_send), GFP_ATOMIC);
	if (!new_send)
		return -ENOMEM;

	/* new_send->timetosend = currenttime */
	new_send->retrycount = NES_DEFAULT_RETRYS;
	new_send->retranscount = NES_DEFAULT_RETRANS;
	new_send->skb = skb;
	new_send->timetosend = jiffies;
	new_send->type = type;
	new_send->netdev = cm_node->netdev;
	new_send->send_retrans = send_retrans;
	new_send->close_when_complete = close_when_complete;

	if (type == NES_TIMER_TYPE_CLOSE) {
		new_send->timetosend += (HZ/10);
		if (cm_node->recv_entry) {
			kfree(new_send);
			WARN_ON(1);
			return -EINVAL;
		}
		cm_node->recv_entry = new_send;
	}

	if (type == NES_TIMER_TYPE_SEND) {
		new_send->seq_num = ntohl(tcp_hdr(skb)->seq);
		atomic_inc(&new_send->skb->users);
		spin_lock_irqsave(&cm_node->retrans_list_lock, flags);
		cm_node->send_entry = new_send;
		add_ref_cm_node(cm_node);
		spin_unlock_irqrestore(&cm_node->retrans_list_lock, flags);
		new_send->timetosend = jiffies + NES_RETRY_TIMEOUT;

		ret = nes_nic_cm_xmit(new_send->skb, cm_node->netdev);
		if (ret != NETDEV_TX_OK) {
			nes_debug(NES_DBG_CM, "Error sending packet %p "
				"(jiffies = %lu)\n", new_send, jiffies);
			new_send->timetosend = jiffies;
			ret = NETDEV_TX_OK;
		} else {
			cm_packets_sent++;
			if (!send_retrans) {
				cleanup_retrans_entry(cm_node);
				if (close_when_complete)
					rem_ref_cm_node(cm_core, cm_node);
				return ret;
			}
		}
	}

	was_timer_set = timer_pending(&cm_core->tcp_timer);

	if (!was_timer_set) {
		cm_core->tcp_timer.expires = new_send->timetosend;
		add_timer(&cm_core->tcp_timer);
	}

	return ret;
}

static void nes_retrans_expired(struct nes_cm_node *cm_node)
{
	struct iw_cm_id *cm_id = cm_node->cm_id;
	switch (cm_node->state) {
	case NES_CM_STATE_SYN_RCVD:
	case NES_CM_STATE_CLOSING:
		rem_ref_cm_node(cm_node->cm_core, cm_node);
		break;
	case NES_CM_STATE_LAST_ACK:
	case NES_CM_STATE_FIN_WAIT1:
		if (cm_node->cm_id)
			cm_id->rem_ref(cm_id);
		cm_node->state = NES_CM_STATE_CLOSED;
		send_reset(cm_node, NULL);
		break;
	default:
		add_ref_cm_node(cm_node);
		send_reset(cm_node, NULL);
		create_event(cm_node, NES_CM_EVENT_ABORTED);
	}
}

static void handle_recv_entry(struct nes_cm_node *cm_node, u32 rem_node)
{
	struct nes_timer_entry *recv_entry = cm_node->recv_entry;
	struct iw_cm_id *cm_id = cm_node->cm_id;
	struct nes_qp *nesqp;
	unsigned long qplockflags;

	if (!recv_entry)
		return;
	nesqp = (struct nes_qp *)recv_entry->skb;
	if (nesqp) {
		spin_lock_irqsave(&nesqp->lock, qplockflags);
		if (nesqp->cm_id) {
			nes_debug(NES_DBG_CM, "QP%u: cm_id = %p, "
				"refcount = %d: HIT A "
				"NES_TIMER_TYPE_CLOSE with something "
				"to do!!!\n", nesqp->hwqp.qp_id, cm_id,
				atomic_read(&nesqp->refcount));
			nesqp->hw_tcp_state = NES_AEQE_TCP_STATE_CLOSED;
			nesqp->last_aeq = NES_AEQE_AEID_RESET_SENT;
			nesqp->ibqp_state = IB_QPS_ERR;
			spin_unlock_irqrestore(&nesqp->lock, qplockflags);
			nes_cm_disconn(nesqp);
		} else {
			spin_unlock_irqrestore(&nesqp->lock, qplockflags);
			nes_debug(NES_DBG_CM, "QP%u: cm_id = %p, "
				"refcount = %d: HIT A "
				"NES_TIMER_TYPE_CLOSE with nothing "
				"to do!!!\n", nesqp->hwqp.qp_id, cm_id,
				atomic_read(&nesqp->refcount));
		}
	} else if (rem_node) {
		/* TIME_WAIT state */
		rem_ref_cm_node(cm_node->cm_core, cm_node);
	}
	if (cm_node->cm_id)
		cm_id->rem_ref(cm_id);
	kfree(recv_entry);
	cm_node->recv_entry = NULL;
}

/**
 * nes_cm_timer_tick
 */
static void nes_cm_timer_tick(unsigned long pass)
{
	unsigned long flags;
	unsigned long nexttimeout = jiffies + NES_LONG_TIME;
	struct nes_cm_node *cm_node;
	struct nes_timer_entry *send_entry, *recv_entry;
	struct list_head *list_core_temp;
	struct list_head *list_node;
	struct nes_cm_core *cm_core = g_cm_core;
	u32 settimer = 0;
	unsigned long timetosend;
	int ret = NETDEV_TX_OK;

	struct list_head timer_list;
	INIT_LIST_HEAD(&timer_list);
	spin_lock_irqsave(&cm_core->ht_lock, flags);

	list_for_each_safe(list_node, list_core_temp,
				&cm_core->connected_nodes) {
		cm_node = container_of(list_node, struct nes_cm_node, list);
		if ((cm_node->recv_entry) || (cm_node->send_entry)) {
			add_ref_cm_node(cm_node);
			list_add(&cm_node->timer_entry, &timer_list);
		}
	}
	spin_unlock_irqrestore(&cm_core->ht_lock, flags);

	list_for_each_safe(list_node, list_core_temp, &timer_list) {
		cm_node = container_of(list_node, struct nes_cm_node,
					timer_entry);
		recv_entry = cm_node->recv_entry;

		if (recv_entry) {
			if (time_after(recv_entry->timetosend, jiffies)) {
				if (nexttimeout > recv_entry->timetosend ||
						!settimer) {
					nexttimeout = recv_entry->timetosend;
					settimer = 1;
				}
			} else
				handle_recv_entry(cm_node, 1);
		}

		spin_lock_irqsave(&cm_node->retrans_list_lock, flags);
		do {
			send_entry = cm_node->send_entry;
			if (!send_entry)
				break;
			if (time_after(send_entry->timetosend, jiffies)) {
				if (cm_node->state != NES_CM_STATE_TSA) {
					if ((nexttimeout >
						send_entry->timetosend) ||
						!settimer) {
						nexttimeout =
							send_entry->timetosend;
						settimer = 1;
					}
				} else {
					free_retrans_entry(cm_node);
				}
				break;
			}

			if ((cm_node->state == NES_CM_STATE_TSA) ||
				(cm_node->state == NES_CM_STATE_CLOSED)) {
				free_retrans_entry(cm_node);
				break;
			}

			if (!send_entry->retranscount ||
				!send_entry->retrycount) {
				cm_packets_dropped++;
				free_retrans_entry(cm_node);

				spin_unlock_irqrestore(
					&cm_node->retrans_list_lock, flags);
				nes_retrans_expired(cm_node);
				cm_node->state = NES_CM_STATE_CLOSED;
				spin_lock_irqsave(&cm_node->retrans_list_lock,
					flags);
				break;
			}
			atomic_inc(&send_entry->skb->users);
			cm_packets_retrans++;
			nes_debug(NES_DBG_CM, "Retransmitting send_entry %p "
				"for node %p, jiffies = %lu, time to send = "
				"%lu, retranscount = %u, send_entry->seq_num = "
				"0x%08X, cm_node->tcp_cntxt.rem_ack_num = "
				"0x%08X\n", send_entry, cm_node, jiffies,
				send_entry->timetosend,
				send_entry->retranscount,
				send_entry->seq_num,
				cm_node->tcp_cntxt.rem_ack_num);

			spin_unlock_irqrestore(&cm_node->retrans_list_lock,
				flags);
			ret = nes_nic_cm_xmit(send_entry->skb, cm_node->netdev);
			spin_lock_irqsave(&cm_node->retrans_list_lock, flags);
			if (ret != NETDEV_TX_OK) {
				nes_debug(NES_DBG_CM, "rexmit failed for "
					"node=%p\n", cm_node);
				cm_packets_bounced++;
				send_entry->retrycount--;
				nexttimeout = jiffies + NES_SHORT_TIME;
				settimer = 1;
				break;
			} else {
				cm_packets_sent++;
			}
			nes_debug(NES_DBG_CM, "Packet Sent: retrans count = "
				"%u, retry count = %u.\n",
				send_entry->retranscount,
				send_entry->retrycount);
			if (send_entry->send_retrans) {
				send_entry->retranscount--;
				timetosend = (NES_RETRY_TIMEOUT <<
					(NES_DEFAULT_RETRANS - send_entry->retranscount));

				send_entry->timetosend = jiffies +
					min(timetosend, NES_MAX_TIMEOUT);
				if (nexttimeout > send_entry->timetosend ||
					!settimer) {
					nexttimeout = send_entry->timetosend;
					settimer = 1;
				}
			} else {
				int close_when_complete;
				close_when_complete =
					send_entry->close_when_complete;
				nes_debug(NES_DBG_CM, "cm_node=%p state=%d\n",
					cm_node, cm_node->state);
				free_retrans_entry(cm_node);
				if (close_when_complete)
					rem_ref_cm_node(cm_node->cm_core,
						cm_node);
			}
		} while (0);

		spin_unlock_irqrestore(&cm_node->retrans_list_lock, flags);
		rem_ref_cm_node(cm_node->cm_core, cm_node);
	}

	if (settimer) {
		if (!timer_pending(&cm_core->tcp_timer)) {
			cm_core->tcp_timer.expires  = nexttimeout;
			add_timer(&cm_core->tcp_timer);
		}
	}
}


/**
 * send_syn
 */
static int send_syn(struct nes_cm_node *cm_node, u32 sendack,
	struct sk_buff *skb)
{
	int ret;
	int flags = SET_SYN;
	char optionsbuffer[sizeof(struct option_mss) +
		sizeof(struct option_windowscale) + sizeof(struct option_base) +
		TCP_OPTIONS_PADDING];

	int optionssize = 0;
	/* Sending MSS option */
	union all_known_options *options;

	if (!cm_node)
		return -EINVAL;

	options = (union all_known_options *)&optionsbuffer[optionssize];
	options->as_mss.optionnum = OPTION_NUMBER_MSS;
	options->as_mss.length = sizeof(struct option_mss);
	options->as_mss.mss = htons(cm_node->tcp_cntxt.mss);
	optionssize += sizeof(struct option_mss);

	options = (union all_known_options *)&optionsbuffer[optionssize];
	options->as_windowscale.optionnum = OPTION_NUMBER_WINDOW_SCALE;
	options->as_windowscale.length = sizeof(struct option_windowscale);
	options->as_windowscale.shiftcount = cm_node->tcp_cntxt.rcv_wscale;
	optionssize += sizeof(struct option_windowscale);

	if (sendack && !(NES_DRV_OPT_SUPRESS_OPTION_BC & nes_drv_opt)) {
		options = (union all_known_options *)&optionsbuffer[optionssize];
		options->as_base.optionnum = OPTION_NUMBER_WRITE0;
		options->as_base.length = sizeof(struct option_base);
		optionssize += sizeof(struct option_base);
		/* we need the size to be a multiple of 4 */
		options = (union all_known_options *)&optionsbuffer[optionssize];
		options->as_end = 1;
		optionssize += 1;
		options = (union all_known_options *)&optionsbuffer[optionssize];
		options->as_end = 1;
		optionssize += 1;
	}

	options = (union all_known_options *)&optionsbuffer[optionssize];
	options->as_end = OPTION_NUMBER_END;
	optionssize += 1;

	if (!skb)
		skb = dev_alloc_skb(MAX_CM_BUFFER);
	if (!skb) {
		nes_debug(NES_DBG_CM, "Failed to get a Free pkt\n");
		return -1;
	}

	if (sendack)
		flags |= SET_ACK;

	form_cm_frame(skb, cm_node, optionsbuffer, optionssize, NULL, 0, flags);
	ret = schedule_nes_timer(cm_node, skb, NES_TIMER_TYPE_SEND, 1, 0);

	return ret;
}


/**
 * send_reset
 */
static int send_reset(struct nes_cm_node *cm_node, struct sk_buff *skb)
{
	int ret;
	int flags = SET_RST | SET_ACK;

	if (!skb)
		skb = dev_alloc_skb(MAX_CM_BUFFER);
	if (!skb) {
		nes_debug(NES_DBG_CM, "Failed to get a Free pkt\n");
		return -ENOMEM;
	}

	form_cm_frame(skb, cm_node, NULL, 0, NULL, 0, flags);
	ret = schedule_nes_timer(cm_node, skb, NES_TIMER_TYPE_SEND, 0, 1);

	return ret;
}


/**
 * send_ack
 */
static int send_ack(struct nes_cm_node *cm_node, struct sk_buff *skb)
{
	int ret;

	if (!skb)
		skb = dev_alloc_skb(MAX_CM_BUFFER);

	if (!skb) {
		nes_debug(NES_DBG_CM, "Failed to get a Free pkt\n");
		return -1;
	}

	form_cm_frame(skb, cm_node, NULL, 0, NULL, 0, SET_ACK);
	ret = schedule_nes_timer(cm_node, skb, NES_TIMER_TYPE_SEND, 0, 0);

	return ret;
}


/**
 * send_fin
 */
static int send_fin(struct nes_cm_node *cm_node, struct sk_buff *skb)
{
	int ret;

	/* if we didn't get a frame get one */
	if (!skb)
		skb = dev_alloc_skb(MAX_CM_BUFFER);

	if (!skb) {
		nes_debug(NES_DBG_CM, "Failed to get a Free pkt\n");
		return -1;
	}

	form_cm_frame(skb, cm_node, NULL, 0, NULL, 0, SET_ACK | SET_FIN);
	ret = schedule_nes_timer(cm_node, skb, NES_TIMER_TYPE_SEND, 1, 0);

	return ret;
}


/**
 * find_node - find a cm node that matches the reference cm node
 */
static struct nes_cm_node *find_node(struct nes_cm_core *cm_core,
		u16 rem_port, nes_addr_t rem_addr, u16 loc_port, nes_addr_t loc_addr)
{
	unsigned long flags;
	struct list_head *hte;
	struct nes_cm_node *cm_node;

	/* get a handle on the hte */
	hte = &cm_core->connected_nodes;

	/* walk list and find cm_node associated with this session ID */
	spin_lock_irqsave(&cm_core->ht_lock, flags);
	list_for_each_entry(cm_node, hte, list) {
		/* compare quad, return node handle if a match */
		nes_debug(NES_DBG_CM, "finding node %x:%x =? %x:%x ^ %x:%x =? %x:%x\n",
				cm_node->loc_addr, cm_node->loc_port,
				loc_addr, loc_port,
				cm_node->rem_addr, cm_node->rem_port,
				rem_addr, rem_port);
		if ((cm_node->loc_addr == loc_addr) && (cm_node->loc_port == loc_port) &&
				(cm_node->rem_addr == rem_addr) && (cm_node->rem_port == rem_port)) {
			add_ref_cm_node(cm_node);
			spin_unlock_irqrestore(&cm_core->ht_lock, flags);
			return cm_node;
		}
	}
	spin_unlock_irqrestore(&cm_core->ht_lock, flags);

	/* no owner node */
	return NULL;
}


/**
 * find_listener - find a cm node listening on this addr-port pair
 */
static struct nes_cm_listener *find_listener(struct nes_cm_core *cm_core,
		nes_addr_t dst_addr, u16 dst_port, enum nes_cm_listener_state listener_state)
{
	unsigned long flags;
	struct nes_cm_listener *listen_node;

	/* walk list and find cm_node associated with this session ID */
	spin_lock_irqsave(&cm_core->listen_list_lock, flags);
	list_for_each_entry(listen_node, &cm_core->listen_list.list, list) {
		/* compare node pair, return node handle if a match */
		if (((listen_node->loc_addr == dst_addr) ||
				listen_node->loc_addr == 0x00000000) &&
				(listen_node->loc_port == dst_port) &&
				(listener_state & listen_node->listener_state)) {
			atomic_inc(&listen_node->ref_count);
			spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
			return listen_node;
		}
	}
	spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);

	/* no listener */
	return NULL;
}


/**
 * add_hte_node - add a cm node to the hash table
 */
static int add_hte_node(struct nes_cm_core *cm_core, struct nes_cm_node *cm_node)
{
	unsigned long flags;
	struct list_head *hte;

	if (!cm_node || !cm_core)
		return -EINVAL;

	nes_debug(NES_DBG_CM, "Adding Node %p to Active Connection HT\n",
		cm_node);

	spin_lock_irqsave(&cm_core->ht_lock, flags);

	/* get a handle on the hash table element (list head for this slot) */
	hte = &cm_core->connected_nodes;
	list_add_tail(&cm_node->list, hte);
	atomic_inc(&cm_core->ht_node_cnt);

	spin_unlock_irqrestore(&cm_core->ht_lock, flags);

	return 0;
}


/**
 * mini_cm_dec_refcnt_listen
 */
static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
	struct nes_cm_listener *listener, int free_hanging_nodes)
{
	int ret = -EINVAL;
	int err = 0;
	unsigned long flags;
	struct list_head *list_pos = NULL;
	struct list_head *list_temp = NULL;
	struct nes_cm_node *cm_node = NULL;
	struct list_head reset_list;

	nes_debug(NES_DBG_CM, "attempting listener= %p free_nodes= %d, "
		"refcnt=%d\n", listener, free_hanging_nodes,
		atomic_read(&listener->ref_count));
	/* free non-accelerated child nodes for this listener */
	INIT_LIST_HEAD(&reset_list);
	if (free_hanging_nodes) {
		spin_lock_irqsave(&cm_core->ht_lock, flags);
		list_for_each_safe(list_pos, list_temp,
				   &g_cm_core->connected_nodes) {
			cm_node = container_of(list_pos, struct nes_cm_node,
				list);
			if ((cm_node->listener == listener) &&
			    (!cm_node->accelerated)) {
				add_ref_cm_node(cm_node);
				list_add(&cm_node->reset_entry, &reset_list);
			}
		}
		spin_unlock_irqrestore(&cm_core->ht_lock, flags);
	}

	list_for_each_safe(list_pos, list_temp, &reset_list) {
		cm_node = container_of(list_pos, struct nes_cm_node,
				reset_entry);
		{
			struct nes_cm_node *loopback = cm_node->loopbackpartner;
			enum nes_cm_node_state old_state;
			if (NES_CM_STATE_FIN_WAIT1 <= cm_node->state) {
				rem_ref_cm_node(cm_node->cm_core, cm_node);
			} else {
				if (!loopback) {
					cleanup_retrans_entry(cm_node);
					err = send_reset(cm_node, NULL);
					if (err) {
						cm_node->state =
							 NES_CM_STATE_CLOSED;
						WARN_ON(1);
					} else {
						old_state = cm_node->state;
						cm_node->state = NES_CM_STATE_LISTENER_DESTROYED;
						if (old_state != NES_CM_STATE_MPAREQ_RCVD)
							rem_ref_cm_node(
								cm_node->cm_core,
								cm_node);
					}
				} else {
					struct nes_cm_event event;

					event.cm_node = loopback;
					event.cm_info.rem_addr =
							loopback->rem_addr;
					event.cm_info.loc_addr =
							loopback->loc_addr;
					event.cm_info.rem_port =
							loopback->rem_port;
					event.cm_info.loc_port =
							 loopback->loc_port;
					event.cm_info.cm_id = loopback->cm_id;
					add_ref_cm_node(loopback);
					loopback->state = NES_CM_STATE_CLOSED;
					cm_event_connect_error(&event);
					cm_node->state = NES_CM_STATE_LISTENER_DESTROYED;

					rem_ref_cm_node(cm_node->cm_core,
							 cm_node);

				}
			}
		}
	}

	spin_lock_irqsave(&cm_core->listen_list_lock, flags);
	if (!atomic_dec_return(&listener->ref_count)) {
		list_del(&listener->list);

		/* decrement our listen node count */
		atomic_dec(&cm_core->listen_node_cnt);

		spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);

		if (listener->nesvnic) {
			nes_manage_apbvt(listener->nesvnic, listener->loc_port,
					PCI_FUNC(listener->nesvnic->nesdev->pcidev->devfn), NES_MANAGE_APBVT_DEL);
		}

		nes_debug(NES_DBG_CM, "destroying listener (%p)\n", listener);

		kfree(listener);
		listener = NULL;
		ret = 0;
		atomic_inc(&cm_listens_destroyed);
	} else {
		spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
	}
	if (listener) {
		if (atomic_read(&listener->pend_accepts_cnt) > 0)
			nes_debug(NES_DBG_CM, "destroying listener (%p)"
					" with non-zero pending accepts=%u\n",
					listener, atomic_read(&listener->pend_accepts_cnt));
	}

	return ret;
}


/**
 * mini_cm_del_listen
 */
static int mini_cm_del_listen(struct nes_cm_core *cm_core,
		struct nes_cm_listener *listener)
{
	listener->listener_state = NES_CM_LISTENER_PASSIVE_STATE;
	listener->cm_id = NULL; /* going to be destroyed pretty soon */
	return mini_cm_dec_refcnt_listen(cm_core, listener, 1);
}


/**
 * mini_cm_accelerated
 */
static inline int mini_cm_accelerated(struct nes_cm_core *cm_core,
		struct nes_cm_node *cm_node)
{
	u32 was_timer_set;
	cm_node->accelerated = 1;

	if (cm_node->accept_pend) {
		BUG_ON(!cm_node->listener);
		atomic_dec(&cm_node->listener->pend_accepts_cnt);
		cm_node->accept_pend = 0;
		BUG_ON(atomic_read(&cm_node->listener->pend_accepts_cnt) < 0);
	}

	was_timer_set = timer_pending(&cm_core->tcp_timer);
	if (!was_timer_set) {
		cm_core->tcp_timer.expires = jiffies + NES_SHORT_TIME;
		add_timer(&cm_core->tcp_timer);
	}

	return 0;
}


/**
 * nes_addr_resolve_neigh
 */
static int nes_addr_resolve_neigh(struct nes_vnic *nesvnic, u32 dst_ip, int arpindex)
{
	struct rtable *rt;
	struct flowi fl;
	struct neighbour *neigh;
	int rc = arpindex;
	struct nes_adapter *nesadapter = nesvnic->nesdev->nesadapter;

	memset(&fl, 0, sizeof fl);
	fl.nl_u.ip4_u.daddr = htonl(dst_ip);
	if (ip_route_output_key(&init_net, &rt, &fl)) {
		printk(KERN_ERR "%s: ip_route_output_key failed for 0x%08X\n",
				__func__, dst_ip);
		return rc;
	}

	neigh = neigh_lookup(&arp_tbl, &rt->rt_gateway, nesvnic->netdev);
	if (neigh) {
		if (neigh->nud_state & NUD_VALID) {
			nes_debug(NES_DBG_CM, "Neighbor MAC address for 0x%08X"
				  " is %pM, Gateway is 0x%08X \n", dst_ip,
				  neigh->ha, ntohl(rt->rt_gateway));

			if (arpindex >= 0) {
				if (!memcmp(nesadapter->arp_table[arpindex].mac_addr,
							neigh->ha, ETH_ALEN)){
					/* Mac address same as in nes_arp_table */
					neigh_release(neigh);
					ip_rt_put(rt);
					return rc;
				}

				nes_manage_arp_cache(nesvnic->netdev,
						nesadapter->arp_table[arpindex].mac_addr,
						dst_ip, NES_ARP_DELETE);
			}

			nes_manage_arp_cache(nesvnic->netdev, neigh->ha,
					     dst_ip, NES_ARP_ADD);
			rc = nes_arp_table(nesvnic->nesdev, dst_ip, NULL,
					   NES_ARP_RESOLVE);
		}
		neigh_release(neigh);
	}

	if ((neigh == NULL) || (!(neigh->nud_state & NUD_VALID)))
		neigh_event_send(rt->u.dst.neighbour, NULL);

	ip_rt_put(rt);
	return rc;
}

/**
 * make_cm_node - create a new instance of a cm node
 */
static struct nes_cm_node *make_cm_node(struct nes_cm_core *cm_core,
		struct nes_vnic *nesvnic, struct nes_cm_info *cm_info,
		struct nes_cm_listener *listener)
{
	struct nes_cm_node *cm_node;
	struct timespec ts;
	int oldarpindex = 0;
	int arpindex = 0;
	struct nes_device *nesdev;
	struct nes_adapter *nesadapter;

	/* create an hte and cm_node for this instance */
	cm_node = kzalloc(sizeof(*cm_node), GFP_ATOMIC);
	if (!cm_node)
		return NULL;

	/* set our node specific transport info */
	cm_node->loc_addr = cm_info->loc_addr;
	cm_node->rem_addr = cm_info->rem_addr;
	cm_node->loc_port = cm_info->loc_port;
	cm_node->rem_port = cm_info->rem_port;
	cm_node->send_write0 = send_first;
	nes_debug(NES_DBG_CM, "Make node addresses : loc = %pI4:%x, rem = %pI4:%x\n",
		  &cm_node->loc_addr, cm_node->loc_port,
		  &cm_node->rem_addr, cm_node->rem_port);
	cm_node->listener = listener;
	cm_node->netdev = nesvnic->netdev;
	cm_node->cm_id = cm_info->cm_id;
	memcpy(cm_node->loc_mac, nesvnic->netdev->dev_addr, ETH_ALEN);

	nes_debug(NES_DBG_CM, "listener=%p, cm_id=%p\n", cm_node->listener,
			cm_node->cm_id);

	spin_lock_init(&cm_node->retrans_list_lock);

	cm_node->loopbackpartner = NULL;
	atomic_set(&cm_node->ref_count, 1);
	/* associate our parent CM core */
	cm_node->cm_core = cm_core;
	cm_node->tcp_cntxt.loc_id = NES_CM_DEF_LOCAL_ID;
	cm_node->tcp_cntxt.rcv_wscale = NES_CM_DEFAULT_RCV_WND_SCALE;
	cm_node->tcp_cntxt.rcv_wnd = NES_CM_DEFAULT_RCV_WND_SCALED >>
			NES_CM_DEFAULT_RCV_WND_SCALE;
	ts = current_kernel_time();
	cm_node->tcp_cntxt.loc_seq_num = htonl(ts.tv_nsec);
	cm_node->tcp_cntxt.mss = nesvnic->max_frame_size - sizeof(struct iphdr) -
			sizeof(struct tcphdr) - ETH_HLEN - VLAN_HLEN;
	cm_node->tcp_cntxt.rcv_nxt = 0;
	/* get a unique session ID , add thread_id to an upcounter to handle race */
	atomic_inc(&cm_core->node_cnt);
	cm_node->conn_type = cm_info->conn_type;
	cm_node->apbvt_set = 0;
	cm_node->accept_pend = 0;

	cm_node->nesvnic = nesvnic;
	/* get some device handles, for arp lookup */
	nesdev = nesvnic->nesdev;
	nesadapter = nesdev->nesadapter;

	cm_node->loopbackpartner = NULL;

	/* get the mac addr for the remote node */
	if (ipv4_is_loopback(htonl(cm_node->rem_addr)))
		arpindex = nes_arp_table(nesdev, ntohl(nesvnic->local_ipaddr), NULL, NES_ARP_RESOLVE);
	else {
		oldarpindex = nes_arp_table(nesdev, cm_node->rem_addr, NULL, NES_ARP_RESOLVE);
		arpindex = nes_addr_resolve_neigh(nesvnic, cm_info->rem_addr, oldarpindex);

	}
	if (arpindex < 0) {
		kfree(cm_node);
		return NULL;
	}

	/* copy the mac addr to node context */
	memcpy(cm_node->rem_mac, nesadapter->arp_table[arpindex].mac_addr, ETH_ALEN);
	nes_debug(NES_DBG_CM, "Remote mac addr from arp table: %pM\n",
		  cm_node->rem_mac);

	add_hte_node(cm_core, cm_node);
	atomic_inc(&cm_nodes_created);

	return cm_node;
}


/**
 * add_ref_cm_node - destroy an instance of a cm node
 */
static int add_ref_cm_node(struct nes_cm_node *cm_node)
{
	atomic_inc(&cm_node->ref_count);
	return 0;
}


/**
 * rem_ref_cm_node - destroy an instance of a cm node
 */
static int rem_ref_cm_node(struct nes_cm_core *cm_core,
	struct nes_cm_node *cm_node)
{
	unsigned long flags;
	struct nes_qp *nesqp;

	if (!cm_node)
		return -EINVAL;

	spin_lock_irqsave(&cm_node->cm_core->ht_lock, flags);
	if (atomic_dec_return(&cm_node->ref_count)) {
		spin_unlock_irqrestore(&cm_node->cm_core->ht_lock, flags);
		return 0;
	}
	list_del(&cm_node->list);
	atomic_dec(&cm_core->ht_node_cnt);
	spin_unlock_irqrestore(&cm_node->cm_core->ht_lock, flags);

	/* if the node is destroyed before connection was accelerated */
	if (!cm_node->accelerated && cm_node->accept_pend) {
		BUG_ON(!cm_node->listener);
		atomic_dec(&cm_node->listener->pend_accepts_cnt);
		BUG_ON(atomic_read(&cm_node->listener->pend_accepts_cnt) < 0);
	}
	WARN_ON(cm_node->send_entry);
	if (cm_node->recv_entry)
		handle_recv_entry(cm_node, 0);
	if (cm_node->listener) {
		mini_cm_dec_refcnt_listen(cm_core, cm_node->listener, 0);
	} else {
		if (cm_node->apbvt_set && cm_node->nesvnic) {
			nes_manage_apbvt(cm_node->nesvnic, cm_node->loc_port,
				PCI_FUNC(
				cm_node->nesvnic->nesdev->pcidev->devfn),
				NES_MANAGE_APBVT_DEL);
		}
	}

	atomic_dec(&cm_core->node_cnt);
	atomic_inc(&cm_nodes_destroyed);
	nesqp = cm_node->nesqp;
	if (nesqp) {
		nesqp->cm_node = NULL;
		nes_rem_ref(&nesqp->ibqp);
		cm_node->nesqp = NULL;
	}

	kfree(cm_node);
	return 0;
}

/**
 * process_options
 */
static int process_options(struct nes_cm_node *cm_node, u8 *optionsloc,
	u32 optionsize, u32 syn_packet)
{
	u32 tmp;
	u32 offset = 0;
	union all_known_options *all_options;
	char got_mss_option = 0;

	while (offset < optionsize) {
		all_options = (union all_known_options *)(optionsloc + offset);
		switch (all_options->as_base.optionnum) {
		case OPTION_NUMBER_END:
			offset = optionsize;
			break;
		case OPTION_NUMBER_NONE:
			offset += 1;
			continue;
		case OPTION_NUMBER_MSS:
			nes_debug(NES_DBG_CM, "%s: MSS Length: %d Offset: %d "
				"Size: %d\n", __func__,
				all_options->as_mss.length, offset, optionsize);
			got_mss_option = 1;
			if (all_options->as_mss.length != 4) {
				return 1;
			} else {
				tmp = ntohs(all_options->as_mss.mss);
				if (tmp > 0 && tmp <
					cm_node->tcp_cntxt.mss)
					cm_node->tcp_cntxt.mss = tmp;
			}
			break;
		case OPTION_NUMBER_WINDOW_SCALE:
			cm_node->tcp_cntxt.snd_wscale =
				all_options->as_windowscale.shiftcount;
			break;
		case OPTION_NUMBER_WRITE0:
			cm_node->send_write0 = 1;
			break;
		default:
			nes_debug(NES_DBG_CM, "TCP Option not understood: %x\n",
				all_options->as_base.optionnum);
			break;
		}
		offset += all_options->as_base.length;
	}
	if ((!got_mss_option) && (syn_packet))
		cm_node->tcp_cntxt.mss = NES_CM_DEFAULT_MSS;
	return 0;
}

static void drop_packet(struct sk_buff *skb)
{
	atomic_inc(&cm_accel_dropped_pkts);
	dev_kfree_skb_any(skb);
}

static void handle_fin_pkt(struct nes_cm_node *cm_node)
{
	nes_debug(NES_DBG_CM, "Received FIN, cm_node = %p, state = %u. "
		"refcnt=%d\n", cm_node, cm_node->state,
		atomic_read(&cm_node->ref_count));
	switch (cm_node->state) {
	case NES_CM_STATE_SYN_RCVD:
	case NES_CM_STATE_SYN_SENT:
	case NES_CM_STATE_ESTABLISHED:
	case NES_CM_STATE_MPAREJ_RCVD:
		cm_node->tcp_cntxt.rcv_nxt++;
		cleanup_retrans_entry(cm_node);
		cm_node->state = NES_CM_STATE_LAST_ACK;
		send_fin(cm_node, NULL);
		break;
	case NES_CM_STATE_MPAREQ_SENT:
		create_event(cm_node, NES_CM_EVENT_ABORTED);
		cm_node->tcp_cntxt.rcv_nxt++;
		cleanup_retrans_entry(cm_node);
		cm_node->state = NES_CM_STATE_CLOSED;
		add_ref_cm_node(cm_node);
		send_reset(cm_node, NULL);
		break;
	case NES_CM_STATE_FIN_WAIT1:
		cm_node->tcp_cntxt.rcv_nxt++;
		cleanup_retrans_entry(cm_node);
		cm_node->state = NES_CM_STATE_CLOSING;
		send_ack(cm_node, NULL);
		/* Wait for ACK as this is simultanous close..
		* After we receive ACK, do not send anything..
		* Just rm the node.. Done.. */
		break;
	case NES_CM_STATE_FIN_WAIT2:
		cm_node->tcp_cntxt.rcv_nxt++;
		cleanup_retrans_entry(cm_node);
		cm_node->state = NES_CM_STATE_TIME_WAIT;
		send_ack(cm_node, NULL);
		schedule_nes_timer(cm_node, NULL,  NES_TIMER_TYPE_CLOSE, 1, 0);
		break;
	case NES_CM_STATE_TIME_WAIT:
		cm_node->tcp_cntxt.rcv_nxt++;
		cleanup_retrans_entry(cm_node);
		cm_node->state = NES_CM_STATE_CLOSED;
		rem_ref_cm_node(cm_node->cm_core, cm_node);
		break;
	case NES_CM_STATE_TSA:
	default:
		nes_debug(NES_DBG_CM, "Error Rcvd FIN for node-%p state = %d\n",
			cm_node, cm_node->state);
		break;
	}
}


static void handle_rst_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
	struct tcphdr *tcph)
{

	int	reset = 0;	/* whether to send reset in case of err.. */
	int	passive_state;
	atomic_inc(&cm_resets_recvd);
	nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
			" refcnt=%d\n", cm_node, cm_node->state,
			atomic_read(&cm_node->ref_count));
	cleanup_retrans_entry(cm_node);
	switch (cm_node->state) {
	case NES_CM_STATE_SYN_SENT:
	case NES_CM_STATE_MPAREQ_SENT:
		nes_debug(NES_DBG_CM, "%s[%u] create abort for cm_node=%p "
			"listener=%p state=%d\n", __func__, __LINE__, cm_node,
			cm_node->listener, cm_node->state);
		active_open_err(cm_node, skb, reset);
		break;
	case NES_CM_STATE_MPAREQ_RCVD:
		passive_state = atomic_add_return(1, &cm_node->passive_state);
		if (passive_state ==  NES_SEND_RESET_EVENT)
			create_event(cm_node, NES_CM_EVENT_RESET);
		cm_node->state = NES_CM_STATE_CLOSED;
		dev_kfree_skb_any(skb);
		break;
	case NES_CM_STATE_ESTABLISHED:
	case NES_CM_STATE_SYN_RCVD:
	case NES_CM_STATE_LISTENING:
		nes_debug(NES_DBG_CM, "Bad state %s[%u]\n", __func__, __LINE__);
		passive_open_err(cm_node, skb, reset);
		break;
	case NES_CM_STATE_TSA:
		active_open_err(cm_node, skb, reset);
		break;
	case NES_CM_STATE_CLOSED:
		drop_packet(skb);
		break;
	case NES_CM_STATE_FIN_WAIT1:
	case NES_CM_STATE_LAST_ACK:
		cm_node->cm_id->rem_ref(cm_node->cm_id);
	case NES_CM_STATE_TIME_WAIT:
		cm_node->state = NES_CM_STATE_CLOSED;
		rem_ref_cm_node(cm_node->cm_core, cm_node);
		drop_packet(skb);
		break;
	default:
		drop_packet(skb);
		break;
	}
}


static void handle_rcv_mpa(struct nes_cm_node *cm_node, struct sk_buff *skb)
{

	int	ret = 0;
	int datasize = skb->len;
	u8 *dataloc = skb->data;

	enum nes_cm_event_type type = NES_CM_EVENT_UNKNOWN;
	u32     res_type;
	ret = parse_mpa(cm_node, dataloc, &res_type, datasize);
	if (ret) {
		nes_debug(NES_DBG_CM, "didn't like MPA Request\n");
		if (cm_node->state == NES_CM_STATE_MPAREQ_SENT) {
			nes_debug(NES_DBG_CM, "%s[%u] create abort for "
				"cm_node=%p listener=%p state=%d\n", __func__,
				__LINE__, cm_node, cm_node->listener,
				cm_node->state);
			active_open_err(cm_node, skb, 1);
		} else {
			passive_open_err(cm_node, skb, 1);
		}
		return;
	}

	switch (cm_node->state) {
	case NES_CM_STATE_ESTABLISHED:
		if (res_type == NES_MPA_REQUEST_REJECT) {
			/*BIG problem as we are receiving the MPA.. So should
			* not be REJECT.. This is Passive Open.. We can
			* only receive it Reject for Active Open...*/
			WARN_ON(1);
		}
		cm_node->state = NES_CM_STATE_MPAREQ_RCVD;
		type = NES_CM_EVENT_MPA_REQ;
		atomic_set(&cm_node->passive_state,
				NES_PASSIVE_STATE_INDICATED);
		break;
	case NES_CM_STATE_MPAREQ_SENT:
		cleanup_retrans_entry(cm_node);
		if (res_type == NES_MPA_REQUEST_REJECT) {
			type = NES_CM_EVENT_MPA_REJECT;
			cm_node->state = NES_CM_STATE_MPAREJ_RCVD;
		} else {
			type = NES_CM_EVENT_CONNECTED;
			cm_node->state = NES_CM_STATE_TSA;
		}

		break;
	default:
		WARN_ON(1);
		break;
	}
	dev_kfree_skb_any(skb);
	create_event(cm_node, type);
}

static void indicate_pkt_err(struct nes_cm_node *cm_node, struct sk_buff *skb)
{
	switch (cm_node->state) {
	case NES_CM_STATE_SYN_SENT:
	case NES_CM_STATE_MPAREQ_SENT:
		nes_debug(NES_DBG_CM, "%s[%u] create abort for cm_node=%p "
			"listener=%p state=%d\n", __func__, __LINE__, cm_node,
			cm_node->listener, cm_node->state);
		active_open_err(cm_node, skb, 1);
		break;
	case NES_CM_STATE_ESTABLISHED:
	case NES_CM_STATE_SYN_RCVD:
		passive_open_err(cm_node, skb, 1);
		break;
	case NES_CM_STATE_TSA:
	default:
		drop_packet(skb);
	}
}

static int check_syn(struct nes_cm_node *cm_node, struct tcphdr *tcph,
	struct sk_buff *skb)
{
	int err;

	err = ((ntohl(tcph->ack_seq) == cm_node->tcp_cntxt.loc_seq_num))? 0 : 1;
	if (err)
		active_open_err(cm_node, skb, 1);

	return err;
}

static int check_seq(struct nes_cm_node *cm_node, struct tcphdr *tcph,
	struct sk_buff *skb)
{
	int err = 0;
	u32 seq;
	u32 ack_seq;
	u32 loc_seq_num = cm_node->tcp_cntxt.loc_seq_num;
	u32 rcv_nxt = cm_node->tcp_cntxt.rcv_nxt;
	u32 rcv_wnd;
	seq = ntohl(tcph->seq);
	ack_seq = ntohl(tcph->ack_seq);
	rcv_wnd = cm_node->tcp_cntxt.rcv_wnd;
	if (ack_seq != loc_seq_num)
		err = 1;
	else if (!between(seq, rcv_nxt, (rcv_nxt+rcv_wnd)))
		err = 1;
	if (err) {
		nes_debug(NES_DBG_CM, "%s[%u] create abort for cm_node=%p "
			"listener=%p state=%d\n", __func__, __LINE__, cm_node,
			cm_node->listener, cm_node->state);
		indicate_pkt_err(cm_node, skb);
		nes_debug(NES_DBG_CM, "seq ERROR cm_node =%p seq=0x%08X "
			"rcv_nxt=0x%08X rcv_wnd=0x%x\n", cm_node, seq, rcv_nxt,
			rcv_wnd);
	}
	return err;
}

/*
 * handle_syn_pkt() is for Passive node. The syn packet is received when a node
 * is created with a listener or it may comein as rexmitted packet which in
 * that case will be just dropped.
 */

static void handle_syn_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
	struct tcphdr *tcph)
{
	int ret;
	u32 inc_sequence;
	int optionsize;

	optionsize = (tcph->doff << 2) - sizeof(struct tcphdr);
	skb_trim(skb, 0);
	inc_sequence = ntohl(tcph->seq);

	switch (cm_node->state) {
	case NES_CM_STATE_SYN_SENT:
	case NES_CM_STATE_MPAREQ_SENT:
		/* Rcvd syn on active open connection*/
		active_open_err(cm_node, skb, 1);
		break;
	case NES_CM_STATE_LISTENING:
		/* Passive OPEN */
		if (atomic_read(&cm_node->listener->pend_accepts_cnt) >
				cm_node->listener->backlog) {
			nes_debug(NES_DBG_CM, "drop syn due to backlog "
				"pressure \n");
			cm_backlog_drops++;
			passive_open_err(cm_node, skb, 0);
			break;
		}
		ret = handle_tcp_options(cm_node, tcph, skb, optionsize,
			1);
		if (ret) {
			passive_open_err(cm_node, skb, 0);
			/* drop pkt */
			break;
		}
		cm_node->tcp_cntxt.rcv_nxt = inc_sequence + 1;
		BUG_ON(cm_node->send_entry);
		cm_node->accept_pend = 1;
		atomic_inc(&cm_node->listener->pend_accepts_cnt);

		cm_node->state = NES_CM_STATE_SYN_RCVD;
		send_syn(cm_node, 1, skb);
		break;
	case NES_CM_STATE_CLOSED:
		cleanup_retrans_entry(cm_node);
		add_ref_cm_node(cm_node);
		send_reset(cm_node, skb);
		break;
	case NES_CM_STATE_TSA:
	case NES_CM_STATE_ESTABLISHED:
	case NES_CM_STATE_FIN_WAIT1:
	case NES_CM_STATE_FIN_WAIT2:
	case NES_CM_STATE_MPAREQ_RCVD:
	case NES_CM_STATE_LAST_ACK:
	case NES_CM_STATE_CLOSING:
	case NES_CM_STATE_UNKNOWN:
	default:
		drop_packet(skb);
		break;
	}
}

static void handle_synack_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
	struct tcphdr *tcph)
{

	int ret;
	u32 inc_sequence;
	int optionsize;

	optionsize = (tcph->doff << 2) - sizeof(struct tcphdr);
	skb_trim(skb, 0);
	inc_sequence = ntohl(tcph->seq);
	switch (cm_node->state) {
	case NES_CM_STATE_SYN_SENT:
		cleanup_retrans_entry(cm_node);
		/* active open */
		if (check_syn(cm_node, tcph, skb))
			return;
		cm_node->tcp_cntxt.rem_ack_num = ntohl(tcph->ack_seq);
		/* setup options */
		ret = handle_tcp_options(cm_node, tcph, skb, optionsize, 0);
		if (ret) {
			nes_debug(NES_DBG_CM, "cm_node=%p tcp_options failed\n",
				cm_node);
			break;
		}
		cleanup_retrans_entry(cm_node);
		cm_node->tcp_cntxt.rcv_nxt = inc_sequence + 1;
		send_mpa_request(cm_node, skb);
		cm_node->state = NES_CM_STATE_MPAREQ_SENT;
		break;
	case NES_CM_STATE_MPAREQ_RCVD:
		/* passive open, so should not be here */
		passive_open_err(cm_node, skb, 1);
		break;
	case NES_CM_STATE_LISTENING:
		cm_node->tcp_cntxt.loc_seq_num = ntohl(tcph->ack_seq);
		cleanup_retrans_entry(cm_node);
		cm_node->state = NES_CM_STATE_CLOSED;
		send_reset(cm_node, skb);
		break;
	case NES_CM_STATE_CLOSED:
		cm_node->tcp_cntxt.loc_seq_num = ntohl(tcph->ack_seq);
		cleanup_retrans_entry(cm_node);
		add_ref_cm_node(cm_node);
		send_reset(cm_node, skb);
		break;
	case NES_CM_STATE_ESTABLISHED:
	case NES_CM_STATE_FIN_WAIT1:
	case NES_CM_STATE_FIN_WAIT2:
	case NES_CM_STATE_LAST_ACK:
	case NES_CM_STATE_TSA:
	case NES_CM_STATE_CLOSING:
	case NES_CM_STATE_UNKNOWN:
	case NES_CM_STATE_MPAREQ_SENT:
	default:
		drop_packet(skb);
		break;
	}
}

static int handle_ack_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
	struct tcphdr *tcph)
{
	int datasize = 0;
	u32 inc_sequence;
	u32 rem_seq_ack;
	u32 rem_seq;
	int ret = 0;
	int optionsize;
	optionsize = (tcph->doff << 2) - sizeof(struct tcphdr);

	if (check_seq(cm_node, tcph, skb))
		return -EINVAL;

	skb_pull(skb, tcph->doff << 2);
	inc_sequence = ntohl(tcph->seq);
	rem_seq = ntohl(tcph->seq);
	rem_seq_ack =  ntohl(tcph->ack_seq);
	datasize = skb->len;
	switch (cm_node->state) {
	case NES_CM_STATE_SYN_RCVD:
		/* Passive OPEN */
		cleanup_retrans_entry(cm_node);
		ret = handle_tcp_options(cm_node, tcph, skb, optionsize, 1);
		if (ret)
			break;
		cm_node->tcp_cntxt.rem_ack_num = ntohl(tcph->ack_seq);
		cm_node->state = NES_CM_STATE_ESTABLISHED;
		if (datasize) {
			cm_node->tcp_cntxt.rcv_nxt = inc_sequence + datasize;
			handle_rcv_mpa(cm_node, skb);
		} else  /* rcvd ACK only */
			dev_kfree_skb_any(skb);
		break;
	case NES_CM_STATE_ESTABLISHED:
		/* Passive OPEN */
		cleanup_retrans_entry(cm_node);
		if (datasize) {
			cm_node->tcp_cntxt.rcv_nxt = inc_sequence + datasize;
			handle_rcv_mpa(cm_node, skb);
		} else
			drop_packet(skb);
		break;
	case NES_CM_STATE_MPAREQ_SENT:
		cm_node->tcp_cntxt.rem_ack_num = ntohl(tcph->ack_seq);
		if (datasize) {
			cm_node->tcp_cntxt.rcv_nxt = inc_sequence + datasize;
			handle_rcv_mpa(cm_node, skb);
		} else  /* Could be just an ack pkt.. */
			dev_kfree_skb_any(skb);
		break;
	case NES_CM_STATE_LISTENING:
		cleanup_retrans_entry(cm_node);
		cm_node->state = NES_CM_STATE_CLOSED;
		send_reset(cm_node, skb);
		break;
	case NES_CM_STATE_CLOSED:
		cleanup_retrans_entry(cm_node);
		add_ref_cm_node(cm_node);
		send_reset(cm_node, skb);
		break;
	case NES_CM_STATE_LAST_ACK:
	case NES_CM_STATE_CLOSING:
		cleanup_retrans_entry(cm_node);
		cm_node->state = NES_CM_STATE_CLOSED;
		cm_node->cm_id->rem_ref(cm_node->cm_id);
		rem_ref_cm_node(cm_node->cm_core, cm_node);
		drop_packet(skb);
		break;
	case NES_CM_STATE_FIN_WAIT1:
		cleanup_retrans_entry(cm_node);
		drop_packet(skb);
		cm_node->state = NES_CM_STATE…