src/plugins/acl/sess_mgmt_node.c

   1 /*
   2  * Copyright (c) 2016-2018 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15 #include <stddef.h>
  16 #include <netinet/in.h>
  17
  18 #include <vlib/vlib.h>
  19 #include <vnet/vnet.h>
  20 #include <vnet/pg/pg.h>
  21 #include <vppinfra/error.h>
  22
  23
  24 #include <acl/acl.h>
  25 #include <vnet/ip/icmp46_packet.h>
  26
  27 #include <plugins/acl/fa_node.h>
  28 #include <plugins/acl/acl.h>
  29 #include <plugins/acl/lookup_context.h>
  30 #include <plugins/acl/public_inlines.h>
  31 #include <plugins/acl/session_inlines.h>
  32
  33 // #include <vppinfra/bihash_40_8.h>
  34
  35
  36 static u64
  37 fa_session_get_shortest_timeout (acl_main_t * am)
  38 {
  39   int timeout_type;
  40   u64 timeout = ~0LL;
  41   for (timeout_type = 0; timeout_type <= ACL_N_USER_TIMEOUTS; timeout_type++)
  42     {
  43       if (timeout > am->session_timeout_sec[timeout_type])
  44         {
  45           timeout = am->session_timeout_sec[timeout_type];
  46         }
  47     }
  48   return timeout;
  49 }
  50
  51 static u8 *
  52 format_ip6_session_bihash_kv (u8 * s, va_list * args)
  53 {
  54   clib_bihash_kv_40_8_t *kv_40_8 = va_arg (*args, clib_bihash_kv_40_8_t *);
  55   fa_5tuple_t a5t;
  56
  57   a5t.kv_40_8 = *kv_40_8;
  58   fa_full_session_id_t *sess = (fa_full_session_id_t *) & a5t.pkt;
  59
  60   return (format (s, "l3 %U -> %U"
  61                   " l4 lsb_of_sw_if_index %d proto %d l4_is_input %d l4_slow_path %d l4_reserved0 %d port %d -> %d | sess id %d thread id %d epoch %04x",
  62                   format_ip6_address, &a5t.ip6_addr[0],
  63                   format_ip6_address, &a5t.ip6_addr[1],
  64                   a5t.l4.lsb_of_sw_if_index,
  65                   a5t.l4.proto, a5t.l4.is_input, a5t.l4.is_slowpath,
  66                   a5t.l4.reserved0, a5t.l4.port[0], a5t.l4.port[1],
  67                   sess->session_index, sess->thread_index,
  68                   sess->intf_policy_epoch));
  69 }
  70
  71 static u8 *
  72 format_ip4_session_bihash_kv (u8 * s, va_list * args)
  73 {
  74   clib_bihash_kv_16_8_t *kv_16_8 = va_arg (*args, clib_bihash_kv_16_8_t *);
  75   fa_5tuple_t a5t;
  76
  77   a5t.kv_16_8 = *kv_16_8;
  78   fa_full_session_id_t *sess = (fa_full_session_id_t *) & a5t.pkt;
  79
  80   return (format (s, "l3 %U -> %U"
  81                   " l4 lsb_of_sw_if_index %d proto %d l4_is_input %d l4_slow_path %d l4_reserved0 %d port %d -> %d | sess id %d thread id %d epoch %04x",
  82                   format_ip4_address, &a5t.ip4_addr[0],
  83                   format_ip4_address, &a5t.ip4_addr[1],
  84                   a5t.l4.lsb_of_sw_if_index,
  85                   a5t.l4.proto, a5t.l4.is_input, a5t.l4.is_slowpath,
  86                   a5t.l4.reserved0, a5t.l4.port[0], a5t.l4.port[1],
  87                   sess->session_index, sess->thread_index,
  88                   sess->intf_policy_epoch));
  89 }
  90
  91
  92 static void
  93 acl_fa_verify_init_sessions (acl_main_t * am)
  94 {
  95   if (!am->fa_sessions_hash_is_initialized)
  96     {
  97       u16 wk;
  98       /* Allocate the per-worker sessions pools */
  99       for (wk = 0; wk < vec_len (am->per_worker_data); wk++)
 100         {
 101           acl_fa_per_worker_data_t *pw = &am->per_worker_data[wk];
 102
 103           /*
 104            * // In lieu of trying to preallocate the pool and its free bitmap, rather use pool_init_fixed
 105            * pool_alloc_aligned(pw->fa_sessions_pool, am->fa_conn_table_max_entries, CLIB_CACHE_LINE_BYTES);
 106            * clib_bitmap_validate(pool_header(pw->fa_sessions_pool)->free_bitmap, am->fa_conn_table_max_entries);
 107            */
 108           pool_init_fixed (pw->fa_sessions_pool,
 109                            am->fa_conn_table_max_entries);
 110         }
 111
 112       /* ... and the interface session hash table */
 113       clib_bihash_init_40_8 (&am->fa_ip6_sessions_hash,
 114                              "ACL plugin FA IPv6 session bihash",
 115                              am->fa_conn_table_hash_num_buckets,
 116                              am->fa_conn_table_hash_memory_size);
 117       clib_bihash_set_kvp_format_fn_40_8 (&am->fa_ip6_sessions_hash,
 118                                           format_ip6_session_bihash_kv);
 119
 120       clib_bihash_init_16_8 (&am->fa_ip4_sessions_hash,
 121                              "ACL plugin FA IPv4 session bihash",
 122                              am->fa_conn_table_hash_num_buckets,
 123                              am->fa_conn_table_hash_memory_size);
 124       clib_bihash_set_kvp_format_fn_16_8 (&am->fa_ip4_sessions_hash,
 125                                           format_ip4_session_bihash_kv);
 126
 127       am->fa_sessions_hash_is_initialized = 1;
 128     }
 129 }
 130
 131
 132 /*
 133  * Get the timeout of the session in a list since its enqueue time.
 134  */
 135
 136 static u64
 137 fa_session_get_list_timeout (acl_main_t * am, fa_session_t * sess)
 138 {
 139   u64 timeout = am->vlib_main->clib_time.clocks_per_second / 1000;
 140   /*
 141    * we have the shortest possible timeout type in all the lists
 142    * (see README-multicore for the rationale)
 143    */
 144   if (sess->link_list_id == ACL_TIMEOUT_PURGATORY)
 145     timeout = fa_session_get_timeout (am, sess);
 146   else
 147     timeout *= fa_session_get_shortest_timeout (am);
 148   return timeout;
 149 }
 150
 151 static u64
 152 acl_fa_get_list_head_expiry_time (acl_main_t * am,
 153                                   acl_fa_per_worker_data_t * pw, u64 now,
 154                                   u16 thread_index, int timeout_type)
 155 {
 156   return pw->fa_conn_list_head_expiry_time[timeout_type];
 157 }
 158
 159 static int
 160 acl_fa_conn_time_to_check (acl_main_t * am, acl_fa_per_worker_data_t * pw,
 161                            u64 now, u16 thread_index, u32 session_index)
 162 {
 163   if (session_index == FA_SESSION_BOGUS_INDEX)
 164     return 0;
 165   fa_session_t *sess = get_session_ptr (am, thread_index, session_index);
 166   u64 timeout_time =
 167     sess->link_enqueue_time + fa_session_get_list_timeout (am, sess);
 168   return (timeout_time < now)
 169     || (sess->link_enqueue_time <= pw->swipe_end_time);
 170 }
 171
 172 /*
 173  * see if there are sessions ready to be checked,
 174  * do the maintenance (requeue or delete), and
 175  * return the total number of sessions reclaimed.
 176  */
 177 static int
 178 acl_fa_check_idle_sessions (acl_main_t * am, u16 thread_index, u64 now)
 179 {
 180   acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
 181   fa_full_session_id_t fsid;
 182   fsid.thread_index = thread_index;
 183   int total_expired = 0;
 184
 185   {
 186     u8 tt = 0;
 187     int n_pending_swipes = 0;
 188     for (tt = 0; tt < ACL_N_TIMEOUTS; tt++)
 189       {
 190         int n_expired = 0;
 191         while (n_expired < am->fa_max_deleted_sessions_per_interval)
 192           {
 193             fsid.session_index = pw->fa_conn_list_head[tt];
 194             if (!acl_fa_conn_time_to_check
 195                 (am, pw, now, thread_index, pw->fa_conn_list_head[tt]))
 196               {
 197                 break;
 198               }
 199             if (am->trace_sessions > 3)
 200               {
 201                 elog_acl_maybe_trace_X3 (am,
 202                                          "acl_fa_check_idle_sessions: expire session %d in list %d on thread %d",
 203                                          "i4i4i4", (u32) fsid.session_index,
 204                                          (u32) tt, (u32) thread_index);
 205               }
 206             vec_add1 (pw->expired, fsid.session_index);
 207             n_expired++;
 208             acl_fa_conn_list_delete_session (am, fsid, now);
 209           }
 210       }
 211     for (tt = 0; tt < ACL_N_TIMEOUTS; tt++)
 212       {
 213         u32 session_index = pw->fa_conn_list_head[tt];
 214         if (session_index == FA_SESSION_BOGUS_INDEX)
 215           break;
 216         fa_session_t *sess =
 217           get_session_ptr (am, thread_index, session_index);
 218         n_pending_swipes += sess->link_enqueue_time <= pw->swipe_end_time;
 219       }
 220     if (n_pending_swipes == 0)
 221       {
 222         pw->swipe_end_time = 0;
 223       }
 224   }
 225
 226   u32 *psid = NULL;
 227   vec_foreach (psid, pw->expired)
 228   {
 229     fsid.session_index = *psid;
 230     if (!pool_is_free_index (pw->fa_sessions_pool, fsid.session_index))
 231       {
 232         fa_session_t *sess =
 233           get_session_ptr (am, thread_index, fsid.session_index);
 234         u32 sw_if_index = sess->sw_if_index;
 235         u64 sess_timeout_time =
 236           sess->last_active_time + fa_session_get_timeout (am, sess);
 237         int timeout_passed = (now >= sess_timeout_time);
 238         int clearing_interface =
 239           clib_bitmap_get (pw->pending_clear_sw_if_index_bitmap, sw_if_index);
 240         if (am->trace_sessions > 3)
 241           {
 242             elog_acl_maybe_trace_X4 (am,
 243                                      "acl_fa_check_idle_sessions: session %d sw_if_index %d timeout_passed %d clearing_interface %d",
 244                                      "i4i4i4i4", (u32) fsid.session_index,
 245                                      (u32) sess->sw_if_index,
 246                                      (u32) timeout_passed,
 247                                      (u32) clearing_interface);
 248           }
 249         if (timeout_passed || clearing_interface)
 250           {
 251             if (acl_fa_two_stage_delete_session (am, sw_if_index, fsid, now))
 252               {
 253                 if (am->trace_sessions > 3)
 254                   {
 255                     elog_acl_maybe_trace_X2 (am,
 256                                              "acl_fa_check_idle_sessions: deleted session %d sw_if_index %d",
 257                                              "i4i4", (u32) fsid.session_index,
 258                                              (u32) sess->sw_if_index);
 259                   }
 260                 /* the session has been put */
 261                 pw->cnt_deleted_sessions++;
 262               }
 263             else
 264               {
 265                 /* the connection marked as deleted and put to purgatory */
 266                 if (am->trace_sessions > 3)
 267                   {
 268                     elog_acl_maybe_trace_X2 (am,
 269                                              "acl_fa_check_idle_sessions: session %d sw_if_index %d marked as deleted, put to purgatory",
 270                                              "i4i4", (u32) fsid.session_index,
 271                                              (u32) sess->sw_if_index);
 272                   }
 273               }
 274           }
 275         else
 276
 277           {
 278             if (am->trace_sessions > 3)
 279               {
 280                 elog_acl_maybe_trace_X2 (am,
 281                                          "acl_fa_check_idle_sessions: restart timer for session %d sw_if_index %d",
 282                                          "i4i4", (u32) fsid.session_index,
 283                                          (u32) sess->sw_if_index);
 284               }
 285             /* There was activity on the session, so the idle timeout
 286                has not passed. Enqueue for another time period. */
 287
 288             acl_fa_conn_list_add_session (am, fsid, now);
 289             pw->cnt_session_timer_restarted++;
 290           }
 291       }
 292     else
 293       {
 294         pw->cnt_already_deleted_sessions++;
 295       }
 296   }
 297   total_expired = vec_len (pw->expired);
 298   /* zero out the vector which we have acted on */
 299   if (pw->expired)
 300     _vec_len (pw->expired) = 0;
 301   /* if we were advancing and reached the end
 302    * (no more sessions to recycle), reset the fast-forward timestamp */
 303
 304   if (pw->swipe_end_time && 0 == total_expired)
 305     pw->swipe_end_time = 0;
 306
 307   elog_acl_maybe_trace_X1 (am,
 308                            "acl_fa_check_idle_sessions: done, total sessions expired: %d",
 309                            "i4", (u32) total_expired);
 310   return (total_expired);
 311 }
 312
 313 /*
 314  * This process ensures the connection cleanup happens every so often
 315  * even in absence of traffic, as well as provides general orchestration
 316  * for requests like connection deletion on a given sw_if_index.
 317  */
 318
 319
 320 /* *INDENT-OFF* */
 321 #define foreach_acl_fa_cleaner_error \
 322 _(UNKNOWN_EVENT, "unknown event received")  \
 323 /* end  of errors */
 324
 325 typedef enum
 326 {
 327 #define _(sym,str) ACL_FA_CLEANER_ERROR_##sym,
 328   foreach_acl_fa_cleaner_error
 329 #undef _
 330     ACL_FA_CLEANER_N_ERROR,
 331 } acl_fa_cleaner_error_t;
 332
 333 static char *acl_fa_cleaner_error_strings[] = {
 334 #define _(sym,string) string,
 335   foreach_acl_fa_cleaner_error
 336 #undef _
 337 };
 338
 339 /* *INDENT-ON* */
 340
 341 static vlib_node_registration_t acl_fa_session_cleaner_process_node;
 342 static vlib_node_registration_t acl_fa_worker_session_cleaner_process_node;
 343
 344 static void
 345 send_one_worker_interrupt (vlib_main_t * vm, acl_main_t * am,
 346                            int thread_index)
 347 {
 348   acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
 349   if (!pw->interrupt_is_pending)
 350     {
 351       pw->interrupt_is_pending = 1;
 352       vlib_node_set_interrupt_pending (vlib_mains[thread_index],
 353                                        acl_fa_worker_session_cleaner_process_node.index);
 354       elog_acl_maybe_trace_X1 (am,
 355                                "send_one_worker_interrupt: send interrupt to worker %u",
 356                                "i4", ((u32) thread_index));
 357       /* if the interrupt was requested, mark that done. */
 358       /* pw->interrupt_is_needed = 0; */
 359       CLIB_MEMORY_BARRIER ();
 360     }
 361 }
 362
 363 static int
 364 purgatory_has_connections (vlib_main_t * vm, acl_main_t * am,
 365                            int thread_index)
 366 {
 367   acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
 368
 369   return (FA_SESSION_BOGUS_INDEX !=
 370           pw->fa_conn_list_head[ACL_TIMEOUT_PURGATORY]);
 371
 372 }
 373
 374
 375 /*
 376  * Per-worker thread interrupt-driven cleaner thread
 377  * to clean idle connections if there are no packets
 378  */
 379 static uword
 380 acl_fa_worker_conn_cleaner_process (vlib_main_t * vm,
 381                                     vlib_node_runtime_t * rt,
 382                                     vlib_frame_t * f)
 383 {
 384   acl_main_t *am = &acl_main;
 385   u64 now = clib_cpu_time_now ();
 386   u16 thread_index = os_get_thread_index ();
 387   acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
 388   int num_expired;
 389   elog_acl_maybe_trace_X1 (am,
 390                            "acl_fa_worker_conn_cleaner interrupt: now %lu",
 391                            "i8", now);
 392   /* allow another interrupt to be queued */
 393   pw->interrupt_is_pending = 0;
 394   if (pw->clear_in_process)
 395     {
 396       if (0 == pw->swipe_end_time)
 397         {
 398           /*
 399            * Someone has just set the flag to start clearing.
 400            * we do this by combing through the connections up to a "time T"
 401            * which is now, and requeueing everything except the expired
 402            * connections and those matching the interface(s) being cleared.
 403            */
 404
 405           /*
 406            * first filter the sw_if_index bitmap that they want from us, by
 407            * a bitmap of sw_if_index for which we actually have connections.
 408            */
 409           if ((pw->pending_clear_sw_if_index_bitmap == 0)
 410               || (pw->serviced_sw_if_index_bitmap == 0))
 411             {
 412               elog_acl_maybe_trace_X1 (am,
 413                                        "acl_fa_worker_conn_cleaner: now %lu, someone tried to call clear but one of the bitmaps are empty",
 414                                        "i8", now);
 415               clib_bitmap_zero (pw->pending_clear_sw_if_index_bitmap);
 416             }
 417           else
 418             {
 419 #ifdef FA_NODE_VERBOSE_DEBUG
 420               clib_warning
 421                 ("WORKER-CLEAR: (before and) swiping sw-if-index bitmap: %U, my serviced bitmap %U",
 422                  format_bitmap_hex, pw->pending_clear_sw_if_index_bitmap,
 423                  format_bitmap_hex, pw->serviced_sw_if_index_bitmap);
 424 #endif
 425               pw->pending_clear_sw_if_index_bitmap =
 426                 clib_bitmap_and (pw->pending_clear_sw_if_index_bitmap,
 427                                  pw->serviced_sw_if_index_bitmap);
 428             }
 429
 430           if (clib_bitmap_is_zero (pw->pending_clear_sw_if_index_bitmap))
 431             {
 432               /* if the cross-section is a zero vector, no need to do anything. */
 433               elog_acl_maybe_trace_X1 (am,
 434                                        "acl_fa_worker_conn_cleaner: now %lu, clearing done, nothing to do",
 435                                        "i8", now);
 436               pw->clear_in_process = 0;
 437               pw->swipe_end_time = 0;
 438             }
 439           else
 440             {
 441 #ifdef FA_NODE_VERBOSE_DEBUG
 442               clib_warning
 443                 ("WORKER-CLEAR: swiping sw-if-index bitmap: %U, my serviced bitmap %U",
 444                  format_bitmap_hex, pw->pending_clear_sw_if_index_bitmap,
 445                  format_bitmap_hex, pw->serviced_sw_if_index_bitmap);
 446 #endif
 447               elog_acl_maybe_trace_X1 (am,
 448                                        "acl_fa_worker_conn_cleaner: swiping until %lu",
 449                                        "i8", now);
 450               /* swipe through the connection lists until enqueue timestamps become above "now" */
 451               pw->swipe_end_time = now;
 452             }
 453         }
 454     }
 455   num_expired = acl_fa_check_idle_sessions (am, thread_index, now);
 456   // clib_warning("WORKER-CLEAR: checked %d sessions (clear_in_progress: %d)", num_expired, pw->clear_in_process);
 457   elog_acl_maybe_trace_X2 (am,
 458                            "acl_fa_worker_conn_cleaner: checked %d sessions (clear_in_process: %d)",
 459                            "i4i4", (u32) num_expired,
 460                            (u32) pw->clear_in_process);
 461   if (pw->clear_in_process)
 462     {
 463       if (pw->swipe_end_time == 0)
 464         {
 465           /* we were clearing but we could not process any more connections. time to stop. */
 466           clib_bitmap_zero (pw->pending_clear_sw_if_index_bitmap);
 467           pw->clear_in_process = 0;
 468           elog_acl_maybe_trace_X1 (am,
 469                                    "acl_fa_worker_conn_cleaner: now %lu, clearing done - all done",
 470                                    "i8", now);
 471         }
 472       else
 473         {
 474           elog_acl_maybe_trace_X1 (am,
 475                                    "acl_fa_worker_conn_cleaner: now %lu, more work to do - requesting interrupt",
 476                                    "i8", now);
 477           /* should continue clearing.. So could they please sent an interrupt again? */
 478           send_one_worker_interrupt (vm, am, thread_index);
 479           // pw->interrupt_is_needed = 1;
 480         }
 481     }
 482   else
 483     {
 484       if (num_expired > 0)
 485         {
 486           /* there was too much work, we should get an interrupt ASAP */
 487           // pw->interrupt_is_needed = 1;
 488           send_one_worker_interrupt (vm, am, thread_index);
 489           pw->interrupt_is_unwanted = 0;
 490         }
 491       else
 492         {
 493           /* the current rate of interrupts is ok */
 494           pw->interrupt_is_needed = 0;
 495           pw->interrupt_is_unwanted = 0;
 496         }
 497       elog_acl_maybe_trace_X3 (am,
 498                                "acl_fa_worker_conn_cleaner: now %lu, interrupt needed: %u, interrupt unwanted: %u",
 499                                "i8i4i4", now, ((u32) pw->interrupt_is_needed),
 500                                ((u32) pw->interrupt_is_unwanted));
 501     }
 502   /* be persistent about quickly deleting the connections from the purgatory */
 503   if (purgatory_has_connections (vm, am, thread_index))
 504     {
 505       send_one_worker_interrupt (vm, am, thread_index);
 506     }
 507   pw->interrupt_generation = am->fa_interrupt_generation;
 508   return 0;
 509 }
 510
 511 static void
 512 send_interrupts_to_workers (vlib_main_t * vm, acl_main_t * am)
 513 {
 514   int i;
 515   /* Can't use vec_len(am->per_worker_data) since the threads might not have come up yet; */
 516   int n_threads = vec_len (vlib_mains);
 517   for (i = 0; i < n_threads; i++)
 518     {
 519       send_one_worker_interrupt (vm, am, i);
 520     }
 521 }
 522
 523 /* centralized process to drive per-worker cleaners */
 524 static uword
 525 acl_fa_session_cleaner_process (vlib_main_t * vm, vlib_node_runtime_t * rt,
 526                                 vlib_frame_t * f)
 527 {
 528   acl_main_t *am = &acl_main;
 529   u64 now;
 530   f64 cpu_cps = vm->clib_time.clocks_per_second;
 531   u64 next_expire;
 532   /* We should check if there are connections to clean up - at least twice a second */
 533   u64 max_timer_wait_interval = cpu_cps / 2;
 534   uword event_type, *event_data = 0;
 535   acl_fa_per_worker_data_t *pw0;
 536
 537   am->fa_current_cleaner_timer_wait_interval = max_timer_wait_interval;
 538   am->fa_cleaner_node_index = acl_fa_session_cleaner_process_node.index;
 539   am->fa_interrupt_generation = 1;
 540   while (1)
 541     {
 542       now = clib_cpu_time_now ();
 543       next_expire = now + am->fa_current_cleaner_timer_wait_interval;
 544       int has_pending_conns = 0;
 545       u16 ti;
 546       u8 tt;
 547
 548       /*
 549        * walk over all per-thread list heads of different timeouts,
 550        * and see if there are any connections pending.
 551        * If there aren't - we do not need to wake up until the
 552        * worker code signals that it has added a connection.
 553        *
 554        * Also, while we are at it, calculate the earliest we need to wake up.
 555        */
 556       for (ti = 0; ti < vec_len (vlib_mains); ti++)
 557         {
 558           if (ti >= vec_len (am->per_worker_data))
 559             {
 560               continue;
 561             }
 562           acl_fa_per_worker_data_t *pw = &am->per_worker_data[ti];
 563           for (tt = 0; tt < vec_len (pw->fa_conn_list_head); tt++)
 564             {
 565               u64 head_expiry =
 566                 acl_fa_get_list_head_expiry_time (am, pw, now, ti, tt);
 567               if ((head_expiry < next_expire) && !pw->interrupt_is_pending)
 568                 {
 569                   elog_acl_maybe_trace_X3 (am,
 570                                            "acl_fa_session_cleaner_process: now %lu, worker: %u tt: %u",
 571                                            "i8i2i2", now, ti, tt);
 572                   elog_acl_maybe_trace_X2 (am,
 573                                            "acl_fa_session_cleaner_process: head expiry: %lu, is earlier than curr next expire: %lu",
 574                                            "i8i8", head_expiry, next_expire);
 575                   next_expire = head_expiry;
 576                 }
 577               if (FA_SESSION_BOGUS_INDEX != pw->fa_conn_list_head[tt])
 578                 {
 579                   has_pending_conns = 1;
 580                 }
 581             }
 582         }
 583
 584       /* If no pending connections and no ACL applied then no point in timing out */
 585       if (!has_pending_conns && (0 == am->fa_total_enabled_count))
 586         {
 587           am->fa_cleaner_cnt_wait_without_timeout++;
 588           elog_acl_maybe_trace_X1 (am,
 589                                    "acl_conn_cleaner: now %lu entering wait without timeout",
 590                                    "i8", now);
 591           (void) vlib_process_wait_for_event (vm);
 592           event_type = vlib_process_get_events (vm, &event_data);
 593         }
 594       else
 595         {
 596           f64 timeout = ((i64) next_expire - (i64) now) / cpu_cps;
 597           if (timeout <= 0)
 598             {
 599               /* skip waiting altogether */
 600               event_type = ~0;
 601             }
 602           else
 603             {
 604               am->fa_cleaner_cnt_wait_with_timeout++;
 605               elog_acl_maybe_trace_X2 (am,
 606                                        "acl_conn_cleaner: now %lu entering wait with timeout %.6f sec",
 607                                        "i8f8", now, timeout);
 608               (void) vlib_process_wait_for_event_or_clock (vm, timeout);
 609               event_type = vlib_process_get_events (vm, &event_data);
 610             }
 611         }
 612
 613       switch (event_type)
 614         {
 615         case ~0:
 616           /* nothing to do */
 617           break;
 618         case ACL_FA_CLEANER_RESCHEDULE:
 619           /* Nothing to do. */
 620           break;
 621         case ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX:
 622           {
 623             uword *clear_sw_if_index_bitmap = 0;
 624             uword *sw_if_index0;
 625             int clear_all = 0;
 626             now = clib_cpu_time_now ();
 627             elog_acl_maybe_trace_X1 (am,
 628                                      "acl_fa_session_cleaner_process: now %lu, received ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX",
 629                                      "i8", now);
 630             vec_foreach (sw_if_index0, event_data)
 631             {
 632               am->fa_cleaner_cnt_delete_by_sw_index++;
 633               elog_acl_maybe_trace_X1 (am,
 634                                        "acl_fa_session_cleaner_process: ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX %u",
 635                                        "i4", *sw_if_index0);
 636               if (*sw_if_index0 == ~0)
 637                 {
 638                   clear_all = 1;
 639                 }
 640               else
 641                 {
 642                   if (!pool_is_free_index
 643                       (am->vnet_main->interface_main.sw_interfaces,
 644                        *sw_if_index0))
 645                     {
 646                       clear_sw_if_index_bitmap =
 647                         clib_bitmap_set (clear_sw_if_index_bitmap,
 648                                          *sw_if_index0, 1);
 649                     }
 650                 }
 651             }
 652             acl_log_err
 653               ("ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX bitmap: %U, clear_all: %u",
 654                format_bitmap_hex, clear_sw_if_index_bitmap, clear_all);
 655             vec_foreach (pw0, am->per_worker_data)
 656             {
 657               CLIB_MEMORY_BARRIER ();
 658               while (pw0->clear_in_process)
 659                 {
 660                   CLIB_MEMORY_BARRIER ();
 661                   elog_acl_maybe_trace_X1 (am,
 662                                            "ACL_FA_NODE_CLEAN: waiting previous cleaning cycle to finish on %u",
 663                                            "i4",
 664                                            (u32) (pw0 - am->per_worker_data));
 665                   vlib_process_suspend (vm, 0.0001);
 666                   if (pw0->interrupt_is_needed)
 667                     {
 668                       send_one_worker_interrupt (vm, am,
 669                                                  (pw0 - am->per_worker_data));
 670                     }
 671                 }
 672               if (pw0->clear_in_process)
 673                 {
 674                   acl_log_err
 675                     ("ERROR-BUG! Could not initiate cleaning on worker because another cleanup in progress");
 676                 }
 677               else
 678                 {
 679                   if (clear_all)
 680                     {
 681                       /* if we need to clear all, then just clear the interfaces that we are servicing */
 682                       pw0->pending_clear_sw_if_index_bitmap =
 683                         clib_bitmap_dup (pw0->serviced_sw_if_index_bitmap);
 684                     }
 685                   else
 686                     {
 687                       pw0->pending_clear_sw_if_index_bitmap =
 688                         clib_bitmap_dup (clear_sw_if_index_bitmap);
 689                     }
 690                   acl_log_err
 691                     ("ACL_FA_CLEANER: thread %u, pending clear bitmap: %U",
 692                      (am->per_worker_data - pw0), format_bitmap_hex,
 693                      pw0->pending_clear_sw_if_index_bitmap);
 694                   pw0->clear_in_process = 1;
 695                 }
 696             }
 697             /* send some interrupts so they can start working */
 698             send_interrupts_to_workers (vm, am);
 699
 700             /* now wait till they all complete */
 701             acl_log_err ("CLEANER mains len: %u per-worker len: %d",
 702                          vec_len (vlib_mains), vec_len (am->per_worker_data));
 703             vec_foreach (pw0, am->per_worker_data)
 704             {
 705               CLIB_MEMORY_BARRIER ();
 706               while (pw0->clear_in_process)
 707                 {
 708                   CLIB_MEMORY_BARRIER ();
 709                   elog_acl_maybe_trace_X1 (am,
 710                                            "ACL_FA_NODE_CLEAN: waiting for my cleaning cycle to finish on %u",
 711                                            "i4",
 712                                            (u32) (pw0 - am->per_worker_data));
 713                   vlib_process_suspend (vm, 0.0001);
 714                   if (pw0->interrupt_is_needed)
 715                     {
 716                       send_one_worker_interrupt (vm, am,
 717                                                  (pw0 - am->per_worker_data));
 718                     }
 719                 }
 720             }
 721             acl_log_err ("ACL_FA_NODE_CLEAN: cleaning done");
 722             clib_bitmap_free (clear_sw_if_index_bitmap);
 723           }
 724           am->fa_cleaner_cnt_delete_by_sw_index_ok++;
 725           break;
 726         default:
 727 #ifdef FA_NODE_VERBOSE_DEBUG
 728           clib_warning ("ACL plugin connection cleaner: unknown event %u",
 729                         event_type);
 730 #endif
 731           vlib_node_increment_counter (vm,
 732                                        acl_fa_session_cleaner_process_node.
 733                                        index,
 734                                        ACL_FA_CLEANER_ERROR_UNKNOWN_EVENT, 1);
 735           am->fa_cleaner_cnt_unknown_event++;
 736           break;
 737         }
 738
 739       send_interrupts_to_workers (vm, am);
 740
 741       if (event_data)
 742         _vec_len (event_data) = 0;
 743
 744       /*
 745        * If the interrupts were not processed yet, ensure we wait a bit,
 746        * but up to a point.
 747        */
 748       int need_more_wait = 0;
 749       int max_wait_cycles = 100;
 750       do
 751         {
 752           need_more_wait = 0;
 753           vec_foreach (pw0, am->per_worker_data)
 754           {
 755             if (pw0->interrupt_generation != am->fa_interrupt_generation)
 756               {
 757                 need_more_wait = 1;
 758               }
 759           }
 760           if (need_more_wait)
 761             {
 762               vlib_process_suspend (vm, 0.0001);
 763             }
 764         }
 765       while (need_more_wait && (--max_wait_cycles > 0));
 766
 767       int interrupts_needed = 0;
 768       int interrupts_unwanted = 0;
 769
 770       vec_foreach (pw0, am->per_worker_data)
 771       {
 772         if (pw0->interrupt_is_needed)
 773           {
 774             interrupts_needed++;
 775             /* the per-worker value is reset when sending the interrupt */
 776           }
 777         if (pw0->interrupt_is_unwanted)
 778           {
 779             interrupts_unwanted++;
 780             pw0->interrupt_is_unwanted = 0;
 781           }
 782       }
 783       if (interrupts_needed)
 784         {
 785           /* they need more interrupts, do less waiting around next time */
 786           am->fa_current_cleaner_timer_wait_interval /= 2;
 787           /* never go into zero-wait either though - we need to give the space to others */
 788           am->fa_current_cleaner_timer_wait_interval += 1;
 789         }
 790       else if (interrupts_unwanted)
 791         {
 792           /* slowly increase the amount of sleep up to a limit */
 793           if (am->fa_current_cleaner_timer_wait_interval <
 794               max_timer_wait_interval)
 795             am->fa_current_cleaner_timer_wait_interval +=
 796               cpu_cps * am->fa_cleaner_wait_time_increment;
 797         }
 798       am->fa_cleaner_cnt_event_cycles++;
 799       am->fa_interrupt_generation++;
 800     }
 801   /* NOT REACHED */
 802   return 0;
 803 }
 804
 805
 806 void
 807 acl_fa_enable_disable (u32 sw_if_index, int is_input, int enable_disable)
 808 {
 809   acl_main_t *am = &acl_main;
 810   if (enable_disable)
 811     {
 812       acl_fa_verify_init_sessions (am);
 813       am->fa_total_enabled_count++;
 814       void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
 815       vlib_process_signal_event (am->vlib_main, am->fa_cleaner_node_index,
 816                                  ACL_FA_CLEANER_RESCHEDULE, 0);
 817       clib_mem_set_heap (oldheap);
 818     }
 819   else
 820     {
 821       am->fa_total_enabled_count--;
 822     }
 823
 824   if (is_input)
 825     {
 826       ASSERT (clib_bitmap_get (am->fa_in_acl_on_sw_if_index, sw_if_index) !=
 827               enable_disable);
 828       void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
 829       vnet_feature_enable_disable ("ip4-unicast", "acl-plugin-in-ip4-fa",
 830                                    sw_if_index, enable_disable, 0, 0);
 831       vnet_feature_enable_disable ("ip6-unicast", "acl-plugin-in-ip6-fa",
 832                                    sw_if_index, enable_disable, 0, 0);
 833       clib_mem_set_heap (oldheap);
 834       am->fa_in_acl_on_sw_if_index =
 835         clib_bitmap_set (am->fa_in_acl_on_sw_if_index, sw_if_index,
 836                          enable_disable);
 837     }
 838   else
 839     {
 840       ASSERT (clib_bitmap_get (am->fa_out_acl_on_sw_if_index, sw_if_index) !=
 841               enable_disable);
 842       void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
 843       vnet_feature_enable_disable ("ip4-output", "acl-plugin-out-ip4-fa",
 844                                    sw_if_index, enable_disable, 0, 0);
 845       vnet_feature_enable_disable ("ip6-output", "acl-plugin-out-ip6-fa",
 846                                    sw_if_index, enable_disable, 0, 0);
 847       clib_mem_set_heap (oldheap);
 848       am->fa_out_acl_on_sw_if_index =
 849         clib_bitmap_set (am->fa_out_acl_on_sw_if_index, sw_if_index,
 850                          enable_disable);
 851     }
 852   if ((!enable_disable) && (!acl_fa_ifc_has_in_acl (am, sw_if_index))
 853       && (!acl_fa_ifc_has_out_acl (am, sw_if_index)))
 854     {
 855 #ifdef FA_NODE_VERBOSE_DEBUG
 856       clib_warning ("ENABLE-DISABLE: clean the connections on interface %d",
 857                     sw_if_index);
 858 #endif
 859       void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
 860       vlib_process_signal_event (am->vlib_main, am->fa_cleaner_node_index,
 861                                  ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX,
 862                                  sw_if_index);
 863       clib_mem_set_heap (oldheap);
 864     }
 865 }
 866
 867 void
 868 show_fa_sessions_hash (vlib_main_t * vm, u32 verbose)
 869 {
 870   acl_main_t *am = &acl_main;
 871   if (am->fa_sessions_hash_is_initialized)
 872     {
 873       vlib_cli_output (vm, "\nIPv6 Session lookup hash table:\n%U\n\n",
 874                        format_bihash_40_8, &am->fa_ip6_sessions_hash,
 875                        verbose);
 876
 877       vlib_cli_output (vm, "\nIPv4 Session lookup hash table:\n%U\n\n",
 878                        format_bihash_16_8, &am->fa_ip4_sessions_hash,
 879                        verbose);
 880     }
 881   else
 882     {
 883       vlib_cli_output (vm,
 884                        "\nSession lookup hash table is not allocated.\n\n");
 885     }
 886 }
 887
 888
 889 /* *INDENT-OFF* */
 890
 891 VLIB_REGISTER_NODE (acl_fa_worker_session_cleaner_process_node, static) = {
 892   .function = acl_fa_worker_conn_cleaner_process,
 893   .name = "acl-plugin-fa-worker-cleaner-process",
 894   .type = VLIB_NODE_TYPE_INPUT,
 895   .state = VLIB_NODE_STATE_INTERRUPT,
 896 };
 897
 898 VLIB_REGISTER_NODE (acl_fa_session_cleaner_process_node, static) = {
 899   .function = acl_fa_session_cleaner_process,
 900   .type = VLIB_NODE_TYPE_PROCESS,
 901   .name = "acl-plugin-fa-cleaner-process",
 902   .n_errors = ARRAY_LEN (acl_fa_cleaner_error_strings),
 903   .error_strings = acl_fa_cleaner_error_strings,
 904   .n_next_nodes = 0,
 905   .next_nodes = {},
 906 };
 907
 908
 909 /* *INDENT-ON* */
 910
 911 /*
 912  * fd.io coding-style-patch-verification: ON
 913  *
 914  * Local Variables:
 915  * eval: (c-set-style "gnu")
 916  * End:
 917  */