src/plugins/acl/sess_mgmt_node.c

   1 /*
   2  * Copyright (c) 2016-2018 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15 #include <stddef.h>
  16 #include <netinet/in.h>
  17
  18 #include <vlib/vlib.h>
  19 #include <vnet/vnet.h>
  20 #include <vnet/pg/pg.h>
  21 #include <vppinfra/error.h>
  22
  23
  24 #include <acl/acl.h>
  25 #include <vnet/ip/icmp46_packet.h>
  26
  27 #include <plugins/acl/fa_node.h>
  28 #include <plugins/acl/acl.h>
  29 #include <plugins/acl/lookup_context.h>
  30 #include <plugins/acl/public_inlines.h>
  31 #include <plugins/acl/session_inlines.h>
  32
  33 // #include <vppinfra/bihash_40_8.h>
  34
  35
  36 static u64
  37 fa_session_get_shortest_timeout (acl_main_t * am)
  38 {
  39   int timeout_type;
  40   u64 timeout = ~0LL;
  41   for (timeout_type = 0; timeout_type <= ACL_N_USER_TIMEOUTS; timeout_type++)
  42     {
  43       if (timeout > am->session_timeout_sec[timeout_type])
  44         {
  45           timeout = am->session_timeout_sec[timeout_type];
  46         }
  47     }
  48   return timeout;
  49 }
  50
  51 static u8 *
  52 format_session_bihash_5tuple (u8 * s, va_list * args)
  53 {
  54   fa_5tuple_t *p5t = va_arg (*args, fa_5tuple_t *);
  55   fa_full_session_id_t *sess = (void *) &p5t->pkt;
  56   if (is_ip6_5tuple (p5t))
  57     return (format (s, "l3 %U -> %U"
  58                     " l4 lsb_of_sw_if_index %d proto %d l4_is_input %d l4_slow_path %d l4_reserved0 %d port %d -> %d | sess id %d thread id %d epoch %04x",
  59                     format_ip6_address, &p5t->ip6_addr[0],
  60                     format_ip6_address, &p5t->ip6_addr[1],
  61                     p5t->l4.lsb_of_sw_if_index,
  62                     p5t->l4.proto, p5t->l4.is_input, p5t->l4.is_slowpath,
  63                     p5t->l4.reserved0, p5t->l4.port[0], p5t->l4.port[1],
  64                     sess->session_index, sess->thread_index,
  65                     sess->intf_policy_epoch));
  66   else
  67     return (format (s, "l3 %U -> %U"
  68                     " l4 lsb_of_sw_if_index %d proto %d l4_is_input %d l4_slow_path %d l4_reserved0 %d port %d -> %d | sess id %d thread id %d epoch %04x",
  69                     format_ip4_address, &p5t->ip4_addr[0],
  70                     format_ip4_address, &p5t->ip4_addr[1],
  71                     p5t->l4.lsb_of_sw_if_index,
  72                     p5t->l4.proto, p5t->l4.is_input, p5t->l4.is_slowpath,
  73                     p5t->l4.reserved0, p5t->l4.port[0], p5t->l4.port[1],
  74                     sess->session_index, sess->thread_index,
  75                     sess->intf_policy_epoch));
  76 }
  77
  78
  79 static void
  80 acl_fa_verify_init_sessions (acl_main_t * am)
  81 {
  82   if (!am->fa_sessions_hash_is_initialized)
  83     {
  84       u16 wk;
  85       /* Allocate the per-worker sessions pools */
  86       for (wk = 0; wk < vec_len (am->per_worker_data); wk++)
  87         {
  88           acl_fa_per_worker_data_t *pw = &am->per_worker_data[wk];
  89
  90           /*
  91            * // In lieu of trying to preallocate the pool and its free bitmap, rather use pool_init_fixed
  92            * pool_alloc_aligned(pw->fa_sessions_pool, am->fa_conn_table_max_entries, CLIB_CACHE_LINE_BYTES);
  93            * clib_bitmap_validate(pool_header(pw->fa_sessions_pool)->free_bitmap, am->fa_conn_table_max_entries);
  94            */
  95           pool_init_fixed (pw->fa_sessions_pool,
  96                            am->fa_conn_table_max_entries);
  97         }
  98
  99       /* ... and the interface session hash table */
 100       clib_bihash_init_40_8 (&am->fa_sessions_hash,
 101                              "ACL plugin FA session bihash",
 102                              am->fa_conn_table_hash_num_buckets,
 103                              am->fa_conn_table_hash_memory_size);
 104       clib_bihash_set_kvp_format_fn_40_8 (&am->fa_sessions_hash,
 105                                           format_session_bihash_5tuple);
 106       am->fa_sessions_hash_is_initialized = 1;
 107     }
 108 }
 109
 110
 111 /*
 112  * Get the timeout of the session in a list since its enqueue time.
 113  */
 114
 115 static u64
 116 fa_session_get_list_timeout (acl_main_t * am, fa_session_t * sess)
 117 {
 118   u64 timeout = am->vlib_main->clib_time.clocks_per_second / 1000;
 119   /*
 120    * we have the shortest possible timeout type in all the lists
 121    * (see README-multicore for the rationale)
 122    */
 123   if (sess->link_list_id == ACL_TIMEOUT_PURGATORY)
 124     timeout = fa_session_get_timeout (am, sess);
 125   else
 126     timeout *= fa_session_get_shortest_timeout (am);
 127   return timeout;
 128 }
 129
 130 static u64
 131 acl_fa_get_list_head_expiry_time (acl_main_t * am,
 132                                   acl_fa_per_worker_data_t * pw, u64 now,
 133                                   u16 thread_index, int timeout_type)
 134 {
 135   return pw->fa_conn_list_head_expiry_time[timeout_type];
 136 }
 137
 138 static int
 139 acl_fa_conn_time_to_check (acl_main_t * am, acl_fa_per_worker_data_t * pw,
 140                            u64 now, u16 thread_index, u32 session_index)
 141 {
 142   if (session_index == FA_SESSION_BOGUS_INDEX)
 143     return 0;
 144   fa_session_t *sess = get_session_ptr (am, thread_index, session_index);
 145   u64 timeout_time =
 146     sess->link_enqueue_time + fa_session_get_list_timeout (am, sess);
 147   return (timeout_time < now)
 148     || (sess->link_enqueue_time <= pw->swipe_end_time);
 149 }
 150
 151 /*
 152  * see if there are sessions ready to be checked,
 153  * do the maintenance (requeue or delete), and
 154  * return the total number of sessions reclaimed.
 155  */
 156 static int
 157 acl_fa_check_idle_sessions (acl_main_t * am, u16 thread_index, u64 now)
 158 {
 159   acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
 160   fa_full_session_id_t fsid;
 161   fsid.thread_index = thread_index;
 162   int total_expired = 0;
 163
 164   {
 165     u8 tt = 0;
 166     int n_pending_swipes = 0;
 167     for (tt = 0; tt < ACL_N_TIMEOUTS; tt++)
 168       {
 169         int n_expired = 0;
 170         while (n_expired < am->fa_max_deleted_sessions_per_interval)
 171           {
 172             fsid.session_index = pw->fa_conn_list_head[tt];
 173             if (!acl_fa_conn_time_to_check
 174                 (am, pw, now, thread_index, pw->fa_conn_list_head[tt]))
 175               {
 176                 break;
 177               }
 178             if (am->trace_sessions > 3)
 179               {
 180                 elog_acl_maybe_trace_X3 (am,
 181                                          "acl_fa_check_idle_sessions: expire session %d in list %d on thread %d",
 182                                          "i4i4i4", (u32) fsid.session_index,
 183                                          (u32) tt, (u32) thread_index);
 184               }
 185             vec_add1 (pw->expired, fsid.session_index);
 186             n_expired++;
 187             acl_fa_conn_list_delete_session (am, fsid, now);
 188           }
 189       }
 190     for (tt = 0; tt < ACL_N_TIMEOUTS; tt++)
 191       {
 192         u32 session_index = pw->fa_conn_list_head[tt];
 193         if (session_index == FA_SESSION_BOGUS_INDEX)
 194           break;
 195         fa_session_t *sess =
 196           get_session_ptr (am, thread_index, session_index);
 197         n_pending_swipes += sess->link_enqueue_time <= pw->swipe_end_time;
 198       }
 199     if (n_pending_swipes == 0)
 200       {
 201         pw->swipe_end_time = 0;
 202       }
 203   }
 204
 205   u32 *psid = NULL;
 206   vec_foreach (psid, pw->expired)
 207   {
 208     fsid.session_index = *psid;
 209     if (!pool_is_free_index (pw->fa_sessions_pool, fsid.session_index))
 210       {
 211         fa_session_t *sess =
 212           get_session_ptr (am, thread_index, fsid.session_index);
 213         u32 sw_if_index = sess->sw_if_index;
 214         u64 sess_timeout_time =
 215           sess->last_active_time + fa_session_get_timeout (am, sess);
 216         int timeout_passed = (now >= sess_timeout_time);
 217         int clearing_interface =
 218           clib_bitmap_get (pw->pending_clear_sw_if_index_bitmap, sw_if_index);
 219         if (am->trace_sessions > 3)
 220           {
 221             elog_acl_maybe_trace_X4 (am,
 222                                      "acl_fa_check_idle_sessions: session %d sw_if_index %d timeout_passed %d clearing_interface %d",
 223                                      "i4i4i4i4", (u32) fsid.session_index,
 224                                      (u32) sess->sw_if_index,
 225                                      (u32) timeout_passed,
 226                                      (u32) clearing_interface);
 227           }
 228         if (timeout_passed || clearing_interface)
 229           {
 230             if (acl_fa_two_stage_delete_session (am, sw_if_index, fsid, now))
 231               {
 232                 if (am->trace_sessions > 3)
 233                   {
 234                     elog_acl_maybe_trace_X2 (am,
 235                                              "acl_fa_check_idle_sessions: deleted session %d sw_if_index %d",
 236                                              "i4i4", (u32) fsid.session_index,
 237                                              (u32) sess->sw_if_index);
 238                   }
 239                 /* the session has been put */
 240                 pw->cnt_deleted_sessions++;
 241               }
 242             else
 243               {
 244                 /* the connection marked as deleted and put to purgatory */
 245                 if (am->trace_sessions > 3)
 246                   {
 247                     elog_acl_maybe_trace_X2 (am,
 248                                              "acl_fa_check_idle_sessions: session %d sw_if_index %d marked as deleted, put to purgatory",
 249                                              "i4i4", (u32) fsid.session_index,
 250                                              (u32) sess->sw_if_index);
 251                   }
 252               }
 253           }
 254         else
 255
 256           {
 257             if (am->trace_sessions > 3)
 258               {
 259                 elog_acl_maybe_trace_X2 (am,
 260                                          "acl_fa_check_idle_sessions: restart timer for session %d sw_if_index %d",
 261                                          "i4i4", (u32) fsid.session_index,
 262                                          (u32) sess->sw_if_index);
 263               }
 264             /* There was activity on the session, so the idle timeout
 265                has not passed. Enqueue for another time period. */
 266
 267             acl_fa_conn_list_add_session (am, fsid, now);
 268             pw->cnt_session_timer_restarted++;
 269           }
 270       }
 271     else
 272       {
 273         pw->cnt_already_deleted_sessions++;
 274       }
 275   }
 276   total_expired = vec_len (pw->expired);
 277   /* zero out the vector which we have acted on */
 278   if (pw->expired)
 279     _vec_len (pw->expired) = 0;
 280   /* if we were advancing and reached the end
 281    * (no more sessions to recycle), reset the fast-forward timestamp */
 282
 283   if (pw->swipe_end_time && 0 == total_expired)
 284     pw->swipe_end_time = 0;
 285
 286   elog_acl_maybe_trace_X1 (am,
 287                            "acl_fa_check_idle_sessions: done, total sessions expired: %d",
 288                            "i4", (u32) total_expired);
 289   return (total_expired);
 290 }
 291
 292 /*
 293  * This process ensures the connection cleanup happens every so often
 294  * even in absence of traffic, as well as provides general orchestration
 295  * for requests like connection deletion on a given sw_if_index.
 296  */
 297
 298
 299 /* *INDENT-OFF* */
 300 #define foreach_acl_fa_cleaner_error \
 301 _(UNKNOWN_EVENT, "unknown event received")  \
 302 /* end  of errors */
 303
 304 typedef enum
 305 {
 306 #define _(sym,str) ACL_FA_CLEANER_ERROR_##sym,
 307   foreach_acl_fa_cleaner_error
 308 #undef _
 309     ACL_FA_CLEANER_N_ERROR,
 310 } acl_fa_cleaner_error_t;
 311
 312 static char *acl_fa_cleaner_error_strings[] = {
 313 #define _(sym,string) string,
 314   foreach_acl_fa_cleaner_error
 315 #undef _
 316 };
 317
 318 /* *INDENT-ON* */
 319
 320 static vlib_node_registration_t acl_fa_session_cleaner_process_node;
 321 static vlib_node_registration_t acl_fa_worker_session_cleaner_process_node;
 322
 323 static void
 324 send_one_worker_interrupt (vlib_main_t * vm, acl_main_t * am,
 325                            int thread_index)
 326 {
 327   acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
 328   if (!pw->interrupt_is_pending)
 329     {
 330       pw->interrupt_is_pending = 1;
 331       vlib_node_set_interrupt_pending (vlib_mains[thread_index],
 332                                        acl_fa_worker_session_cleaner_process_node.index);
 333       elog_acl_maybe_trace_X1 (am,
 334                                "send_one_worker_interrupt: send interrupt to worker %u",
 335                                "i4", ((u32) thread_index));
 336       /* if the interrupt was requested, mark that done. */
 337       /* pw->interrupt_is_needed = 0; */
 338       CLIB_MEMORY_BARRIER ();
 339     }
 340 }
 341
 342 static int
 343 purgatory_has_connections (vlib_main_t * vm, acl_main_t * am,
 344                            int thread_index)
 345 {
 346   acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
 347
 348   return (FA_SESSION_BOGUS_INDEX !=
 349           pw->fa_conn_list_head[ACL_TIMEOUT_PURGATORY]);
 350
 351 }
 352
 353
 354 /*
 355  * Per-worker thread interrupt-driven cleaner thread
 356  * to clean idle connections if there are no packets
 357  */
 358 static uword
 359 acl_fa_worker_conn_cleaner_process (vlib_main_t * vm,
 360                                     vlib_node_runtime_t * rt,
 361                                     vlib_frame_t * f)
 362 {
 363   acl_main_t *am = &acl_main;
 364   u64 now = clib_cpu_time_now ();
 365   u16 thread_index = os_get_thread_index ();
 366   acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
 367   int num_expired;
 368   elog_acl_maybe_trace_X1 (am,
 369                            "acl_fa_worker_conn_cleaner interrupt: now %lu",
 370                            "i8", now);
 371   /* allow another interrupt to be queued */
 372   pw->interrupt_is_pending = 0;
 373   if (pw->clear_in_process)
 374     {
 375       if (0 == pw->swipe_end_time)
 376         {
 377           /*
 378            * Someone has just set the flag to start clearing.
 379            * we do this by combing through the connections up to a "time T"
 380            * which is now, and requeueing everything except the expired
 381            * connections and those matching the interface(s) being cleared.
 382            */
 383
 384           /*
 385            * first filter the sw_if_index bitmap that they want from us, by
 386            * a bitmap of sw_if_index for which we actually have connections.
 387            */
 388           if ((pw->pending_clear_sw_if_index_bitmap == 0)
 389               || (pw->serviced_sw_if_index_bitmap == 0))
 390             {
 391               elog_acl_maybe_trace_X1 (am,
 392                                        "acl_fa_worker_conn_cleaner: now %lu, someone tried to call clear but one of the bitmaps are empty",
 393                                        "i8", now);
 394               clib_bitmap_zero (pw->pending_clear_sw_if_index_bitmap);
 395             }
 396           else
 397             {
 398 #ifdef FA_NODE_VERBOSE_DEBUG
 399               clib_warning
 400                 ("WORKER-CLEAR: (before and) swiping sw-if-index bitmap: %U, my serviced bitmap %U",
 401                  format_bitmap_hex, pw->pending_clear_sw_if_index_bitmap,
 402                  format_bitmap_hex, pw->serviced_sw_if_index_bitmap);
 403 #endif
 404               pw->pending_clear_sw_if_index_bitmap =
 405                 clib_bitmap_and (pw->pending_clear_sw_if_index_bitmap,
 406                                  pw->serviced_sw_if_index_bitmap);
 407             }
 408
 409           if (clib_bitmap_is_zero (pw->pending_clear_sw_if_index_bitmap))
 410             {
 411               /* if the cross-section is a zero vector, no need to do anything. */
 412               elog_acl_maybe_trace_X1 (am,
 413                                        "acl_fa_worker_conn_cleaner: now %lu, clearing done, nothing to do",
 414                                        "i8", now);
 415               pw->clear_in_process = 0;
 416               pw->swipe_end_time = 0;
 417             }
 418           else
 419             {
 420 #ifdef FA_NODE_VERBOSE_DEBUG
 421               clib_warning
 422                 ("WORKER-CLEAR: swiping sw-if-index bitmap: %U, my serviced bitmap %U",
 423                  format_bitmap_hex, pw->pending_clear_sw_if_index_bitmap,
 424                  format_bitmap_hex, pw->serviced_sw_if_index_bitmap);
 425 #endif
 426               elog_acl_maybe_trace_X1 (am,
 427                                        "acl_fa_worker_conn_cleaner: swiping until %lu",
 428                                        "i8", now);
 429               /* swipe through the connection lists until enqueue timestamps become above "now" */
 430               pw->swipe_end_time = now;
 431             }
 432         }
 433     }
 434   num_expired = acl_fa_check_idle_sessions (am, thread_index, now);
 435   // clib_warning("WORKER-CLEAR: checked %d sessions (clear_in_progress: %d)", num_expired, pw->clear_in_process);
 436   elog_acl_maybe_trace_X2 (am,
 437                            "acl_fa_worker_conn_cleaner: checked %d sessions (clear_in_process: %d)",
 438                            "i4i4", (u32) num_expired,
 439                            (u32) pw->clear_in_process);
 440   if (pw->clear_in_process)
 441     {
 442       if (pw->swipe_end_time == 0)
 443         {
 444           /* we were clearing but we could not process any more connections. time to stop. */
 445           clib_bitmap_zero (pw->pending_clear_sw_if_index_bitmap);
 446           pw->clear_in_process = 0;
 447           elog_acl_maybe_trace_X1 (am,
 448                                    "acl_fa_worker_conn_cleaner: now %lu, clearing done - all done",
 449                                    "i8", now);
 450         }
 451       else
 452         {
 453           elog_acl_maybe_trace_X1 (am,
 454                                    "acl_fa_worker_conn_cleaner: now %lu, more work to do - requesting interrupt",
 455                                    "i8", now);
 456           /* should continue clearing.. So could they please sent an interrupt again? */
 457           send_one_worker_interrupt (vm, am, thread_index);
 458           // pw->interrupt_is_needed = 1;
 459         }
 460     }
 461   else
 462     {
 463       if (num_expired > 0)
 464         {
 465           /* there was too much work, we should get an interrupt ASAP */
 466           // pw->interrupt_is_needed = 1;
 467           send_one_worker_interrupt (vm, am, thread_index);
 468           pw->interrupt_is_unwanted = 0;
 469         }
 470       else
 471         {
 472           /* the current rate of interrupts is ok */
 473           pw->interrupt_is_needed = 0;
 474           pw->interrupt_is_unwanted = 0;
 475         }
 476       elog_acl_maybe_trace_X3 (am,
 477                                "acl_fa_worker_conn_cleaner: now %lu, interrupt needed: %u, interrupt unwanted: %u",
 478                                "i8i4i4", now, ((u32) pw->interrupt_is_needed),
 479                                ((u32) pw->interrupt_is_unwanted));
 480     }
 481   /* be persistent about quickly deleting the connections from the purgatory */
 482   if (purgatory_has_connections (vm, am, thread_index))
 483     {
 484       send_one_worker_interrupt (vm, am, thread_index);
 485     }
 486   pw->interrupt_generation = am->fa_interrupt_generation;
 487   return 0;
 488 }
 489
 490 static void
 491 send_interrupts_to_workers (vlib_main_t * vm, acl_main_t * am)
 492 {
 493   int i;
 494   /* Can't use vec_len(am->per_worker_data) since the threads might not have come up yet; */
 495   int n_threads = vec_len (vlib_mains);
 496   for (i = 0; i < n_threads; i++)
 497     {
 498       send_one_worker_interrupt (vm, am, i);
 499     }
 500 }
 501
 502 /* centralized process to drive per-worker cleaners */
 503 static uword
 504 acl_fa_session_cleaner_process (vlib_main_t * vm, vlib_node_runtime_t * rt,
 505                                 vlib_frame_t * f)
 506 {
 507   acl_main_t *am = &acl_main;
 508   u64 now;
 509   f64 cpu_cps = vm->clib_time.clocks_per_second;
 510   u64 next_expire;
 511   /* We should check if there are connections to clean up - at least twice a second */
 512   u64 max_timer_wait_interval = cpu_cps / 2;
 513   uword event_type, *event_data = 0;
 514   acl_fa_per_worker_data_t *pw0;
 515
 516   am->fa_current_cleaner_timer_wait_interval = max_timer_wait_interval;
 517   am->fa_cleaner_node_index = acl_fa_session_cleaner_process_node.index;
 518   am->fa_interrupt_generation = 1;
 519   while (1)
 520     {
 521       now = clib_cpu_time_now ();
 522       next_expire = now + am->fa_current_cleaner_timer_wait_interval;
 523       int has_pending_conns = 0;
 524       u16 ti;
 525       u8 tt;
 526
 527       /*
 528        * walk over all per-thread list heads of different timeouts,
 529        * and see if there are any connections pending.
 530        * If there aren't - we do not need to wake up until the
 531        * worker code signals that it has added a connection.
 532        *
 533        * Also, while we are at it, calculate the earliest we need to wake up.
 534        */
 535       for (ti = 0; ti < vec_len (vlib_mains); ti++)
 536         {
 537           if (ti >= vec_len (am->per_worker_data))
 538             {
 539               continue;
 540             }
 541           acl_fa_per_worker_data_t *pw = &am->per_worker_data[ti];
 542           for (tt = 0; tt < vec_len (pw->fa_conn_list_head); tt++)
 543             {
 544               u64 head_expiry =
 545                 acl_fa_get_list_head_expiry_time (am, pw, now, ti, tt);
 546               if ((head_expiry < next_expire) && !pw->interrupt_is_pending)
 547                 {
 548                   elog_acl_maybe_trace_X3 (am,
 549                                            "acl_fa_session_cleaner_process: now %lu, worker: %u tt: %u",
 550                                            "i8i2i2", now, ti, tt);
 551                   elog_acl_maybe_trace_X2 (am,
 552                                            "acl_fa_session_cleaner_process: head expiry: %lu, is earlier than curr next expire: %lu",
 553                                            "i8i8", head_expiry, next_expire);
 554                   next_expire = head_expiry;
 555                 }
 556               if (FA_SESSION_BOGUS_INDEX != pw->fa_conn_list_head[tt])
 557                 {
 558                   has_pending_conns = 1;
 559                 }
 560             }
 561         }
 562
 563       /* If no pending connections and no ACL applied then no point in timing out */
 564       if (!has_pending_conns && (0 == am->fa_total_enabled_count))
 565         {
 566           am->fa_cleaner_cnt_wait_without_timeout++;
 567           elog_acl_maybe_trace_X1 (am,
 568                                    "acl_conn_cleaner: now %lu entering wait without timeout",
 569                                    "i8", now);
 570           (void) vlib_process_wait_for_event (vm);
 571           event_type = vlib_process_get_events (vm, &event_data);
 572         }
 573       else
 574         {
 575           f64 timeout = ((i64) next_expire - (i64) now) / cpu_cps;
 576           if (timeout <= 0)
 577             {
 578               /* skip waiting altogether */
 579               event_type = ~0;
 580             }
 581           else
 582             {
 583               am->fa_cleaner_cnt_wait_with_timeout++;
 584               elog_acl_maybe_trace_X2 (am,
 585                                        "acl_conn_cleaner: now %lu entering wait with timeout %.6f sec",
 586                                        "i8f8", now, timeout);
 587               (void) vlib_process_wait_for_event_or_clock (vm, timeout);
 588               event_type = vlib_process_get_events (vm, &event_data);
 589             }
 590         }
 591
 592       switch (event_type)
 593         {
 594         case ~0:
 595           /* nothing to do */
 596           break;
 597         case ACL_FA_CLEANER_RESCHEDULE:
 598           /* Nothing to do. */
 599           break;
 600         case ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX:
 601           {
 602             uword *clear_sw_if_index_bitmap = 0;
 603             uword *sw_if_index0;
 604             int clear_all = 0;
 605             now = clib_cpu_time_now ();
 606             elog_acl_maybe_trace_X1 (am,
 607                                      "acl_fa_session_cleaner_process: now %lu, received ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX",
 608                                      "i8", now);
 609             vec_foreach (sw_if_index0, event_data)
 610             {
 611               am->fa_cleaner_cnt_delete_by_sw_index++;
 612               elog_acl_maybe_trace_X1 (am,
 613                                        "acl_fa_session_cleaner_process: ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX %u",
 614                                        "i4", *sw_if_index0);
 615               if (*sw_if_index0 == ~0)
 616                 {
 617                   clear_all = 1;
 618                 }
 619               else
 620                 {
 621                   if (!pool_is_free_index
 622                       (am->vnet_main->interface_main.sw_interfaces,
 623                        *sw_if_index0))
 624                     {
 625                       clear_sw_if_index_bitmap =
 626                         clib_bitmap_set (clear_sw_if_index_bitmap,
 627                                          *sw_if_index0, 1);
 628                     }
 629                 }
 630             }
 631             acl_log_err
 632               ("ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX bitmap: %U, clear_all: %u",
 633                format_bitmap_hex, clear_sw_if_index_bitmap, clear_all);
 634             vec_foreach (pw0, am->per_worker_data)
 635             {
 636               CLIB_MEMORY_BARRIER ();
 637               while (pw0->clear_in_process)
 638                 {
 639                   CLIB_MEMORY_BARRIER ();
 640                   elog_acl_maybe_trace_X1 (am,
 641                                            "ACL_FA_NODE_CLEAN: waiting previous cleaning cycle to finish on %u",
 642                                            "i4",
 643                                            (u32) (pw0 - am->per_worker_data));
 644                   vlib_process_suspend (vm, 0.0001);
 645                   if (pw0->interrupt_is_needed)
 646                     {
 647                       send_one_worker_interrupt (vm, am,
 648                                                  (pw0 - am->per_worker_data));
 649                     }
 650                 }
 651               if (pw0->clear_in_process)
 652                 {
 653                   acl_log_err
 654                     ("ERROR-BUG! Could not initiate cleaning on worker because another cleanup in progress");
 655                 }
 656               else
 657                 {
 658                   if (clear_all)
 659                     {
 660                       /* if we need to clear all, then just clear the interfaces that we are servicing */
 661                       pw0->pending_clear_sw_if_index_bitmap =
 662                         clib_bitmap_dup (pw0->serviced_sw_if_index_bitmap);
 663                     }
 664                   else
 665                     {
 666                       pw0->pending_clear_sw_if_index_bitmap =
 667                         clib_bitmap_dup (clear_sw_if_index_bitmap);
 668                     }
 669                   acl_log_err
 670                     ("ACL_FA_CLEANER: thread %u, pending clear bitmap: %U",
 671                      (am->per_worker_data - pw0), format_bitmap_hex,
 672                      pw0->pending_clear_sw_if_index_bitmap);
 673                   pw0->clear_in_process = 1;
 674                 }
 675             }
 676             /* send some interrupts so they can start working */
 677             send_interrupts_to_workers (vm, am);
 678
 679             /* now wait till they all complete */
 680             acl_log_err ("CLEANER mains len: %u per-worker len: %d",
 681                          vec_len (vlib_mains), vec_len (am->per_worker_data));
 682             vec_foreach (pw0, am->per_worker_data)
 683             {
 684               CLIB_MEMORY_BARRIER ();
 685               while (pw0->clear_in_process)
 686                 {
 687                   CLIB_MEMORY_BARRIER ();
 688                   elog_acl_maybe_trace_X1 (am,
 689                                            "ACL_FA_NODE_CLEAN: waiting for my cleaning cycle to finish on %u",
 690                                            "i4",
 691                                            (u32) (pw0 - am->per_worker_data));
 692                   vlib_process_suspend (vm, 0.0001);
 693                   if (pw0->interrupt_is_needed)
 694                     {
 695                       send_one_worker_interrupt (vm, am,
 696                                                  (pw0 - am->per_worker_data));
 697                     }
 698                 }
 699             }
 700             acl_log_err ("ACL_FA_NODE_CLEAN: cleaning done");
 701             clib_bitmap_free (clear_sw_if_index_bitmap);
 702           }
 703           am->fa_cleaner_cnt_delete_by_sw_index_ok++;
 704           break;
 705         default:
 706 #ifdef FA_NODE_VERBOSE_DEBUG
 707           clib_warning ("ACL plugin connection cleaner: unknown event %u",
 708                         event_type);
 709 #endif
 710           vlib_node_increment_counter (vm,
 711                                        acl_fa_session_cleaner_process_node.
 712                                        index,
 713                                        ACL_FA_CLEANER_ERROR_UNKNOWN_EVENT, 1);
 714           am->fa_cleaner_cnt_unknown_event++;
 715           break;
 716         }
 717
 718       send_interrupts_to_workers (vm, am);
 719
 720       if (event_data)
 721         _vec_len (event_data) = 0;
 722
 723       /*
 724        * If the interrupts were not processed yet, ensure we wait a bit,
 725        * but up to a point.
 726        */
 727       int need_more_wait = 0;
 728       int max_wait_cycles = 100;
 729       do
 730         {
 731           need_more_wait = 0;
 732           vec_foreach (pw0, am->per_worker_data)
 733           {
 734             if (pw0->interrupt_generation != am->fa_interrupt_generation)
 735               {
 736                 need_more_wait = 1;
 737               }
 738           }
 739           if (need_more_wait)
 740             {
 741               vlib_process_suspend (vm, 0.0001);
 742             }
 743         }
 744       while (need_more_wait && (--max_wait_cycles > 0));
 745
 746       int interrupts_needed = 0;
 747       int interrupts_unwanted = 0;
 748
 749       vec_foreach (pw0, am->per_worker_data)
 750       {
 751         if (pw0->interrupt_is_needed)
 752           {
 753             interrupts_needed++;
 754             /* the per-worker value is reset when sending the interrupt */
 755           }
 756         if (pw0->interrupt_is_unwanted)
 757           {
 758             interrupts_unwanted++;
 759             pw0->interrupt_is_unwanted = 0;
 760           }
 761       }
 762       if (interrupts_needed)
 763         {
 764           /* they need more interrupts, do less waiting around next time */
 765           am->fa_current_cleaner_timer_wait_interval /= 2;
 766           /* never go into zero-wait either though - we need to give the space to others */
 767           am->fa_current_cleaner_timer_wait_interval += 1;
 768         }
 769       else if (interrupts_unwanted)
 770         {
 771           /* slowly increase the amount of sleep up to a limit */
 772           if (am->fa_current_cleaner_timer_wait_interval <
 773               max_timer_wait_interval)
 774             am->fa_current_cleaner_timer_wait_interval +=
 775               cpu_cps * am->fa_cleaner_wait_time_increment;
 776         }
 777       am->fa_cleaner_cnt_event_cycles++;
 778       am->fa_interrupt_generation++;
 779     }
 780   /* NOT REACHED */
 781   return 0;
 782 }
 783
 784
 785 void
 786 acl_fa_enable_disable (u32 sw_if_index, int is_input, int enable_disable)
 787 {
 788   acl_main_t *am = &acl_main;
 789   if (enable_disable)
 790     {
 791       acl_fa_verify_init_sessions (am);
 792       am->fa_total_enabled_count++;
 793       void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
 794       vlib_process_signal_event (am->vlib_main, am->fa_cleaner_node_index,
 795                                  ACL_FA_CLEANER_RESCHEDULE, 0);
 796       clib_mem_set_heap (oldheap);
 797     }
 798   else
 799     {
 800       am->fa_total_enabled_count--;
 801     }
 802
 803   if (is_input)
 804     {
 805       ASSERT (clib_bitmap_get (am->fa_in_acl_on_sw_if_index, sw_if_index) !=
 806               enable_disable);
 807       void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
 808       vnet_feature_enable_disable ("ip4-unicast", "acl-plugin-in-ip4-fa",
 809                                    sw_if_index, enable_disable, 0, 0);
 810       vnet_feature_enable_disable ("ip6-unicast", "acl-plugin-in-ip6-fa",
 811                                    sw_if_index, enable_disable, 0, 0);
 812       clib_mem_set_heap (oldheap);
 813       am->fa_in_acl_on_sw_if_index =
 814         clib_bitmap_set (am->fa_in_acl_on_sw_if_index, sw_if_index,
 815                          enable_disable);
 816     }
 817   else
 818     {
 819       ASSERT (clib_bitmap_get (am->fa_out_acl_on_sw_if_index, sw_if_index) !=
 820               enable_disable);
 821       void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
 822       vnet_feature_enable_disable ("ip4-output", "acl-plugin-out-ip4-fa",
 823                                    sw_if_index, enable_disable, 0, 0);
 824       vnet_feature_enable_disable ("ip6-output", "acl-plugin-out-ip6-fa",
 825                                    sw_if_index, enable_disable, 0, 0);
 826       clib_mem_set_heap (oldheap);
 827       am->fa_out_acl_on_sw_if_index =
 828         clib_bitmap_set (am->fa_out_acl_on_sw_if_index, sw_if_index,
 829                          enable_disable);
 830     }
 831   if ((!enable_disable) && (!acl_fa_ifc_has_in_acl (am, sw_if_index))
 832       && (!acl_fa_ifc_has_out_acl (am, sw_if_index)))
 833     {
 834 #ifdef FA_NODE_VERBOSE_DEBUG
 835       clib_warning ("ENABLE-DISABLE: clean the connections on interface %d",
 836                     sw_if_index);
 837 #endif
 838       void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
 839       vlib_process_signal_event (am->vlib_main, am->fa_cleaner_node_index,
 840                                  ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX,
 841                                  sw_if_index);
 842       clib_mem_set_heap (oldheap);
 843     }
 844 }
 845
 846 void
 847 show_fa_sessions_hash (vlib_main_t * vm, u32 verbose)
 848 {
 849   acl_main_t *am = &acl_main;
 850   if (am->fa_sessions_hash_is_initialized)
 851     {
 852       vlib_cli_output (vm, "\nSession lookup hash table:\n%U\n\n",
 853                        format_bihash_40_8, &am->fa_sessions_hash, verbose);
 854     }
 855   else
 856     {
 857       vlib_cli_output (vm,
 858                        "\nSession lookup hash table is not allocated.\n\n");
 859     }
 860 }
 861
 862
 863 /* *INDENT-OFF* */
 864
 865 VLIB_REGISTER_NODE (acl_fa_worker_session_cleaner_process_node, static) = {
 866   .function = acl_fa_worker_conn_cleaner_process,
 867   .name = "acl-plugin-fa-worker-cleaner-process",
 868   .type = VLIB_NODE_TYPE_INPUT,
 869   .state = VLIB_NODE_STATE_INTERRUPT,
 870 };
 871
 872 VLIB_REGISTER_NODE (acl_fa_session_cleaner_process_node, static) = {
 873   .function = acl_fa_session_cleaner_process,
 874   .type = VLIB_NODE_TYPE_PROCESS,
 875   .name = "acl-plugin-fa-cleaner-process",
 876   .n_errors = ARRAY_LEN (acl_fa_cleaner_error_strings),
 877   .error_strings = acl_fa_cleaner_error_strings,
 878   .n_next_nodes = 0,
 879   .next_nodes = {},
 880 };
 881
 882
 883 /* *INDENT-ON* */
 884
 885 /*
 886  * fd.io coding-style-patch-verification: ON
 887  *
 888  * Local Variables:
 889  * eval: (c-set-style "gnu")
 890  * End:
 891  */