tcp: make syn-rcvd timeout configurable
[vpp.git] / src / vcl / vcl_locked.c
index 678499c..69dd15b 100644 (file)
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2019 Cisco and/or its affiliates.
+ * Copyright (c) 2021 Cisco and/or its affiliates.
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this
  * You may obtain a copy of the License at:
  * limitations under the License.
  */
 
+/**
+ * VCL Locked Sessions (VLS) is a wrapper that synchronizes access to VCL APIs
+ * which are, by construction, not thread safe. To this end, VLS uses
+ * configuration and heuristics to detect how applications use sessions in
+ * an attempt to optimize the locking strategy. The modes of operation
+ * currently supported are the following:
+ *
+ *                    1) per-process workers
+ *
+ *                  +----------+   +----------+
+ *                  |          |   |          |
+ *                  | process0 |   | process1 |
+ *                  |          |   |          |
+ *                  +-----+----+   +-----+----+
+ *                        |              |
+ *                        |              |
+ *                  +-----+----+   +-----+----+
+ *                  |          |   |          |
+ *                  | vls_wrk0 |   | vls_wrk1 |
+ *                  |          |   |          |
+ *                  +-----+----+   +-----+----+
+ *                        |              |
+ *                        |              |
+ *                  +-----+----+   +-----+----+
+ *                  |          |   |          |
+ *                  | vcl_wrk0 |   | vcl_wrk1 |
+ *                  |          |   |          |
+ *                  +----------+   +----------+
+ *
+ *     2) per-thread workers         3) single-worker multi-thread
+ *
+ *   +---------+   +---------+         +---------+   +---------+
+ *   |         |   |         |         |         |   |         |
+ *   | thread0 |   | thread1 |         | thread0 |   | thread1 |
+ *   |         |   |         |         |         |   |         |
+ *   +--------++   +-+-------+         +--------++   +-+-------+
+ *            |      |                          |      |
+ *            |      |                          |      |
+ *          +-+------+-+                      +-+------+-+
+ *          |          |                      |          |
+ *          | vls_wrk0 |                      | vls_wrk0 |
+ *          |          |                      |          |
+ *          +-+------+-+                      +----+-----+
+ *            |      |                             |
+ *            |      |                             |
+ *   +--------+-+  +-+--------+               +----+-----+
+ *   |          |  |          |               |          |
+ *   | vcl_wrk0 |  | vcl_wrk1 |               | vcl_wrk0 |
+ *   |          |  |          |               |          |
+ *   +----------+  +----------+               +----------+
+ *
+ * 1) per-process workers: intercept fork calls and assume all children
+ *    processes are new workers that must be registered with vcl. VLS
+ *    sessions are cloned and shared between workers. Only shared sessions
+ *    are locked on use and thereby only one process can interact with
+ *    them at a time (explicit sharing).
+ *
+ * 2) per-thread workers: each newly detected pthread is assumed to be a new
+ *    worker and is registered with vcl. Enabled via configuration.
+ *    When a thread tries to access a session it does not own, a clone and
+ *    share rpc request is sent to the owning thread via vcl and vpp.
+ *    Consequently, a vls session can map to multiple vcl sessions, one per
+ *    vcl worker. VLS sessions are locked on use (implicit sharing).
+ *
+ * 3) single-worker multi-thread: vls does not make any assumptions about
+ *    application threads and therefore implements an aggressive locking
+ *    strategy that limits access to underlying vcl resources based on type
+ *    of interaction and locks vls session on use (implicit sharing).
+ */
+
 #include <vcl/vcl_locked.h>
 #include <vcl/vcl_private.h>
 
 typedef struct vls_shared_data_
 {
-  clib_spinlock_t lock;
-  u32 owner_wrk_index;
-  u32 *workers_subscribed;
-  clib_bitmap_t *listeners;
+  clib_spinlock_t lock;            /**< shared data lock */
+  u32 owner_wrk_index;     /**< vcl wrk that owns session */
+  u32 *workers_subscribed;  /**< vec of wrks subscribed to session */
+  clib_bitmap_t *listeners; /**< bitmap of wrks actively listening */
 } vls_shared_data_t;
 
 typedef struct vcl_locked_session_
 {
-  clib_spinlock_t lock;
-  u32 session_index;
-  u32 worker_index;
-  u32 vls_index;
-  u32 shared_data_index;
-  /** VCL session owned by different workers because of migration */
-  u32 owner_vcl_wrk_index;
-  uword *vcl_wrk_index_to_session_index;
+  clib_spinlock_t lock;           /**< vls lock when in use */
+  u32 session_index;      /**< vcl session index */
+  u32 vcl_wrk_index;      /**< vcl worker index */
+  u32 vls_index;          /**< index in vls pool */
+  u32 shared_data_index;   /**< shared data index if any */
+  u32 owner_vcl_wrk_index; /**< vcl wrk of the vls wrk at alloc */
+  uword *vcl_wrk_index_to_session_index; /**< map vcl wrk to session */
 } vcl_locked_session_t;
 
 typedef struct vls_worker_
 {
-  vcl_locked_session_t *vls_pool;
-  uword *session_handle_to_vlsh_table;
-  u32 wrk_index;
+  clib_rwlock_t sh_to_vlsh_table_lock; /**< ht rwlock with mt workers */
+  vcl_locked_session_t *vls_pool;      /**< pool of vls session */
+  uword *sh_to_vlsh_table;            /**< map from vcl sh to vls sh */
+  u32 *pending_vcl_wrk_cleanup;               /**< child vcl wrks to cleanup */
+  u32 vcl_wrk_index;                  /**< if 1:1 map vls to vcl wrk */
 } vls_worker_t;
 
 typedef struct vls_local_
 {
-  int vls_wrk_index;
-  volatile int vls_mt_n_threads;
-  pthread_mutex_t vls_mt_mq_mlock;
-  pthread_mutex_t vls_mt_spool_mlock;
-  volatile u8 select_mp_check;
-  volatile u8 epoll_mp_check;
+  int vls_wrk_index;                 /**< vls wrk index, 1 per process */
+  volatile int vls_mt_n_threads;      /**< number of threads detected */
+  clib_rwlock_t vls_pool_lock;       /**< per process/wrk vls pool locks */
+  pthread_mutex_t vls_mt_mq_mlock;    /**< vcl mq lock */
+  pthread_mutex_t vls_mt_spool_mlock; /**< vcl select or pool lock */
+  volatile u8 select_mp_check;       /**< flag set if select checks done */
 } vls_process_local_t;
 
 static vls_process_local_t vls_local;
@@ -58,15 +129,21 @@ static vls_process_local_t *vlsl = &vls_local;
 
 typedef struct vls_main_
 {
-  vls_worker_t *workers;
-  clib_rwlock_t vls_table_lock;
-  /** Pool of data shared by sessions owned by different workers */
-  vls_shared_data_t *shared_data_pool;
-  clib_rwlock_t shared_data_lock;
+  vls_worker_t *workers;              /**< pool of vls workers */
+  vls_shared_data_t *shared_data_pool; /**< inter proc pool of shared data */
+  clib_rwlock_t shared_data_lock;      /**< shared data pool lock */
+  clib_spinlock_t worker_rpc_lock;     /**< lock for inter-worker rpcs */
 } vls_main_t;
 
 vls_main_t *vlsm;
 
+typedef enum
+{
+  VLS_RPC_STATE_INIT,
+  VLS_RPC_STATE_SUCCESS,
+  VLS_RPC_STATE_SESSION_NOT_EXIST,
+} vls_rpc_state_e;
+
 typedef enum vls_rpc_msg_type_
 {
   VLS_RPC_CLONE_AND_SHARE,
@@ -97,20 +174,18 @@ typedef struct vls_sess_cleanup_msg_
 
 void vls_send_session_cleanup_rpc (vcl_worker_t * wrk,
                                   u32 dst_wrk_index, u32 dst_session_index);
-void vls_send_clone_and_share_rpc (vcl_worker_t * wrk,
-                                  vcl_locked_session_t * vls,
+void vls_send_clone_and_share_rpc (vcl_worker_t *wrk, u32 origin_vls_index,
                                   u32 session_index, u32 vls_wrk_index,
                                   u32 dst_wrk_index, u32 dst_vls_index,
                                   u32 dst_session_index);
-
+static void vls_cleanup_forked_child (vcl_worker_t *wrk,
+                                     vcl_worker_t *child_wrk);
+static void vls_handle_pending_wrk_cleanup (void);
 
 static inline u32
 vls_get_worker_index (void)
 {
-  if (vls_mt_wrk_supported ())
-    return vlsl->vls_wrk_index;
-  else
-    return vcl_get_worker_index ();
+  return vlsl->vls_wrk_index;
 }
 
 static u32
@@ -169,31 +244,31 @@ vls_shared_data_pool_runlock (void)
 }
 
 static inline void
-vls_mt_table_rlock (void)
+vls_mt_pool_rlock (void)
 {
   if (vlsl->vls_mt_n_threads > 1)
-    clib_rwlock_reader_lock (&vlsm->vls_table_lock);
+    clib_rwlock_reader_lock (&vlsl->vls_pool_lock);
 }
 
 static inline void
-vls_mt_table_runlock (void)
+vls_mt_pool_runlock (void)
 {
   if (vlsl->vls_mt_n_threads > 1)
-    clib_rwlock_reader_unlock (&vlsm->vls_table_lock);
+    clib_rwlock_reader_unlock (&vlsl->vls_pool_lock);
 }
 
 static inline void
-vls_mt_table_wlock (void)
+vls_mt_pool_wlock (void)
 {
   if (vlsl->vls_mt_n_threads > 1)
-    clib_rwlock_writer_lock (&vlsm->vls_table_lock);
+    clib_rwlock_writer_lock (&vlsl->vls_pool_lock);
 }
 
 static inline void
-vls_mt_table_wunlock (void)
+vls_mt_pool_wunlock (void)
 {
   if (vlsl->vls_mt_n_threads > 1)
-    clib_rwlock_writer_unlock (&vlsm->vls_table_lock);
+    clib_rwlock_writer_unlock (&vlsl->vls_pool_lock);
 }
 
 typedef enum
@@ -219,7 +294,10 @@ vls_mt_add (void)
    * vcl worker with vpp. Otherwise, all threads use the same vcl worker, so
    * update the vcl worker's thread local worker index variable */
   if (vls_mt_wrk_supported ())
-    vls_register_vcl_worker ();
+    {
+      if (vppcom_worker_register () != VPPCOM_OK)
+       VERR ("failed to register worker");
+    }
   else
     vcl_set_worker_index (vlsl->vls_wrk_index);
 }
@@ -286,7 +364,7 @@ vls_to_sh_tu (vcl_locked_session_t * vls)
 {
   vcl_session_handle_t sh;
   sh = vls_to_sh (vls);
-  vls_mt_table_runlock ();
+  vls_mt_pool_runlock ();
   return sh;
 }
 
@@ -302,13 +380,19 @@ vls_worker_alloc (void)
   vls_worker_t *wrk;
 
   pool_get_zero (vlsm->workers, wrk);
-  wrk->wrk_index = vcl_get_worker_index ();
+  if (vls_mt_wrk_supported ())
+    clib_rwlock_init (&wrk->sh_to_vlsh_table_lock);
+  wrk->vcl_wrk_index = vcl_get_worker_index ();
+  vec_validate (wrk->pending_vcl_wrk_cleanup, 16);
+  vec_reset_length (wrk->pending_vcl_wrk_cleanup);
 }
 
 static void
 vls_worker_free (vls_worker_t * wrk)
 {
-  hash_free (wrk->session_handle_to_vlsh_table);
+  hash_free (wrk->sh_to_vlsh_table);
+  if (vls_mt_wrk_supported ())
+    clib_rwlock_free (&wrk->sh_to_vlsh_table_lock);
   pool_free (wrk->vls_pool);
   pool_put (vlsm->workers, wrk);
 }
@@ -321,29 +405,60 @@ vls_worker_get (u32 wrk_index)
   return pool_elt_at_index (vlsm->workers, wrk_index);
 }
 
+static void
+vls_sh_to_vlsh_table_add (vls_worker_t *wrk, vcl_session_handle_t sh, u32 vlsh)
+{
+  if (vls_mt_wrk_supported ())
+    clib_rwlock_writer_lock (&wrk->sh_to_vlsh_table_lock);
+  hash_set (wrk->sh_to_vlsh_table, sh, vlsh);
+  if (vls_mt_wrk_supported ())
+    clib_rwlock_writer_unlock (&wrk->sh_to_vlsh_table_lock);
+}
+
+static void
+vls_sh_to_vlsh_table_del (vls_worker_t *wrk, vcl_session_handle_t sh)
+{
+  if (vls_mt_wrk_supported ())
+    clib_rwlock_writer_lock (&wrk->sh_to_vlsh_table_lock);
+  hash_unset (wrk->sh_to_vlsh_table, sh);
+  if (vls_mt_wrk_supported ())
+    clib_rwlock_writer_unlock (&wrk->sh_to_vlsh_table_lock);
+}
+
+static uword *
+vls_sh_to_vlsh_table_get (vls_worker_t *wrk, vcl_session_handle_t sh)
+{
+  if (vls_mt_wrk_supported ())
+    clib_rwlock_reader_lock (&wrk->sh_to_vlsh_table_lock);
+  uword *vlshp = hash_get (wrk->sh_to_vlsh_table, sh);
+  if (vls_mt_wrk_supported ())
+    clib_rwlock_reader_unlock (&wrk->sh_to_vlsh_table_lock);
+  return vlshp;
+}
+
 static vls_handle_t
 vls_alloc (vcl_session_handle_t sh)
 {
   vls_worker_t *wrk = vls_worker_get_current ();
   vcl_locked_session_t *vls;
 
-  vls_mt_table_wlock ();
+  vls_mt_pool_wlock ();
 
   pool_get_zero (wrk->vls_pool, vls);
   vls->session_index = vppcom_session_index (sh);
-  vls->worker_index = vppcom_session_worker (sh);
+  vls->vcl_wrk_index = vppcom_session_worker (sh);
   vls->vls_index = vls - wrk->vls_pool;
   vls->shared_data_index = ~0;
-  hash_set (wrk->session_handle_to_vlsh_table, sh, vls->vls_index);
+  vls_sh_to_vlsh_table_add (wrk, sh, vls->vls_index);
   if (vls_mt_wrk_supported ())
     {
-      hash_set (vls->vcl_wrk_index_to_session_index, vls->worker_index,
+      hash_set (vls->vcl_wrk_index_to_session_index, vls->vcl_wrk_index,
                vls->session_index);
-      vls->owner_vcl_wrk_index = vls->worker_index;
+      vls->owner_vcl_wrk_index = vls->vcl_wrk_index;
     }
   clib_spinlock_init (&vls->lock);
 
-  vls_mt_table_wunlock ();
+  vls_mt_pool_wunlock ();
   return vls->vls_index;
 }
 
@@ -362,8 +477,8 @@ vls_free (vcl_locked_session_t * vls)
   vls_worker_t *wrk = vls_worker_get_current ();
 
   ASSERT (vls != 0);
-  hash_unset (wrk->session_handle_to_vlsh_table,
-             vcl_session_handle_from_index (vls->session_index));
+  vls_sh_to_vlsh_table_del (
+    wrk, vcl_session_handle_from_index (vls->session_index));
   clib_spinlock_free (&vls->lock);
   pool_put (wrk->vls_pool, vls);
 }
@@ -384,10 +499,10 @@ static vcl_locked_session_t *
 vls_get_w_dlock (vls_handle_t vlsh)
 {
   vcl_locked_session_t *vls;
-  vls_mt_table_rlock ();
+  vls_mt_pool_rlock ();
   vls = vls_get_and_lock (vlsh);
   if (!vls)
-    vls_mt_table_runlock ();
+    vls_mt_pool_runlock ();
   return vls;
 }
 
@@ -395,17 +510,17 @@ static inline void
 vls_get_and_unlock (vls_handle_t vlsh)
 {
   vcl_locked_session_t *vls;
-  vls_mt_table_rlock ();
+  vls_mt_pool_rlock ();
   vls = vls_get (vlsh);
   vls_unlock (vls);
-  vls_mt_table_runlock ();
+  vls_mt_pool_runlock ();
 }
 
 static inline void
 vls_dunlock (vcl_locked_session_t * vls)
 {
   vls_unlock (vls);
-  vls_mt_table_runlock ();
+  vls_mt_pool_runlock ();
 }
 
 static vcl_locked_session_t *
@@ -442,10 +557,10 @@ vls_handle_t
 vls_si_wi_to_vlsh (u32 session_index, u32 vcl_wrk_index)
 {
   vls_worker_t *wrk = vls_worker_get_current ();
-  uword *vlshp;
-  vlshp = hash_get (wrk->session_handle_to_vlsh_table,
-                   vcl_session_handle_from_wrk_session_index (session_index,
-                                                              vcl_wrk_index));
+  uword *vlshp = vls_sh_to_vlsh_table_get (
+    wrk,
+    vcl_session_handle_from_wrk_session_index (session_index, vcl_wrk_index));
+
   return vlshp ? *vlshp : VLS_INVALID_HANDLE;
 }
 
@@ -454,9 +569,9 @@ vls_session_index_to_vlsh (uint32_t session_index)
 {
   vls_handle_t vlsh;
 
-  vls_mt_table_rlock ();
+  vls_mt_pool_rlock ();
   vlsh = vls_si_wi_to_vlsh (session_index, vcl_get_worker_index ());
-  vls_mt_table_runlock ();
+  vls_mt_pool_runlock ();
 
   return vlsh;
 }
@@ -504,7 +619,8 @@ vls_listener_wrk_set (vcl_locked_session_t * vls, u32 wrk_index, u8 is_active)
   vls_shd = vls_shared_data_get (vls->shared_data_index);
 
   clib_spinlock_lock (&vls_shd->lock);
-  clib_bitmap_set (vls_shd->listeners, wrk_index, is_active);
+  vls_shd->listeners =
+    clib_bitmap_set (vls_shd->listeners, wrk_index, is_active);
   clib_spinlock_unlock (&vls_shd->lock);
 
   vls_shared_data_pool_runlock ();
@@ -554,8 +670,19 @@ vls_listener_wrk_is_active (vcl_locked_session_t * vls, u32 wrk_index)
 static void
 vls_listener_wrk_start_listen (vcl_locked_session_t * vls, u32 wrk_index)
 {
-  vppcom_session_listen (vls_to_sh (vls), ~0);
-  vls_listener_wrk_set (vls, wrk_index, 1 /* is_active */ );
+  vcl_worker_t *wrk;
+  vcl_session_t *ls;
+
+  wrk = vcl_worker_get (wrk_index);
+  ls = vcl_session_get (wrk, vls->session_index);
+
+  /* Listen request already sent */
+  if (ls->flags & VCL_SESSION_F_PENDING_LISTEN)
+    return;
+
+  vcl_send_session_listen (wrk, ls);
+
+  vls_listener_wrk_set (vls, wrk_index, 1 /* is_active */);
 }
 
 static void
@@ -566,10 +693,10 @@ vls_listener_wrk_stop_listen (vcl_locked_session_t * vls, u32 wrk_index)
 
   wrk = vcl_worker_get (wrk_index);
   s = vcl_session_get (wrk, vls->session_index);
-  if (s->session_state != STATE_LISTEN)
+  if (s->session_state != VCL_STATE_LISTEN)
     return;
   vcl_send_session_unlisten (wrk, s);
-  s->session_state = STATE_LISTEN_NO_MQ;
+  s->session_state = VCL_STATE_LISTEN_NO_MQ;
   vls_listener_wrk_set (vls, wrk_index, 0 /* is_active */ );
 }
 
@@ -599,7 +726,7 @@ vls_unshare_session (vcl_locked_session_t * vls, vcl_worker_t * wrk)
     return 0;
 
   s = vcl_session_get (wrk, vls->session_index);
-  if (s->session_state == STATE_LISTEN)
+  if (s->session_state == VCL_STATE_LISTEN)
     vls_listener_wrk_set (vls, wrk->wrk_index, 0 /* is_active */ );
 
   vls_shared_data_pool_rlock ();
@@ -611,7 +738,7 @@ vls_unshare_session (vcl_locked_session_t * vls, vcl_worker_t * wrk)
   if (pos < 0)
     {
       clib_warning ("worker %u not subscribed for vls %u", wrk->wrk_index,
-                   vls->worker_index);
+                   vls->vcl_wrk_index);
       goto done;
     }
 
@@ -629,7 +756,7 @@ vls_unshare_session (vcl_locked_session_t * vls, vcl_worker_t * wrk)
    * Cleanup vcl state
    */
   n_subscribers = vec_len (vls_shd->workers_subscribed);
-  do_disconnect = s->session_state == STATE_LISTEN || !n_subscribers;
+  do_disconnect = s->session_state == VCL_STATE_LISTEN || !n_subscribers;
   vcl_session_cleanup (wrk, s, vcl_session_handle (s), do_disconnect);
 
   /*
@@ -658,7 +785,8 @@ vls_unshare_session (vcl_locked_session_t * vls, vcl_worker_t * wrk)
    *  Check if we can change owner or close
    */
   vls_shd->owner_wrk_index = vls_shd->workers_subscribed[0];
-  vcl_send_session_worker_update (wrk, s, vls_shd->owner_wrk_index);
+  if (s->vpp_evt_q)
+    vcl_send_session_worker_update (wrk, s, vls_shd->owner_wrk_index);
 
   /* XXX is this still needed? */
   if (vec_len (vls_shd->workers_subscribed) > 1)
@@ -682,9 +810,9 @@ vls_init_share_session (vls_worker_t * vls_wrk, vcl_locked_session_t * vls)
   vls_shared_data_pool_rlock ();
 
   vls_shd = vls_shared_data_get (vls_shd_index);
-  vls_shd->owner_wrk_index = vls_wrk->wrk_index;
+  vls_shd->owner_wrk_index = vls_wrk->vcl_wrk_index;
   vls->shared_data_index = vls_shd_index;
-  vec_add1 (vls_shd->workers_subscribed, vls_wrk->wrk_index);
+  vec_add1 (vls_shd->workers_subscribed, vls_wrk->vcl_wrk_index);
 
   vls_shared_data_pool_runlock ();
 }
@@ -692,7 +820,7 @@ vls_init_share_session (vls_worker_t * vls_wrk, vcl_locked_session_t * vls)
 void
 vls_share_session (vls_worker_t * vls_wrk, vcl_locked_session_t * vls)
 {
-  vcl_worker_t *vcl_wrk = vcl_worker_get (vls_wrk->wrk_index);
+  vcl_worker_t *vcl_wrk = vcl_worker_get (vls_wrk->vcl_wrk_index);
   vls_shared_data_t *vls_shd;
   vcl_session_t *s;
 
@@ -714,19 +842,19 @@ vls_share_session (vls_worker_t * vls_wrk, vcl_locked_session_t * vls)
   vls_shd = vls_shared_data_get (vls->shared_data_index);
 
   clib_spinlock_lock (&vls_shd->lock);
-  vec_add1 (vls_shd->workers_subscribed, vls_wrk->wrk_index);
+  vec_add1 (vls_shd->workers_subscribed, vls_wrk->vcl_wrk_index);
   clib_spinlock_unlock (&vls_shd->lock);
 
   vls_shared_data_pool_runlock ();
 
-  if (s->rx_fifo)
+  if (s->session_state == VCL_STATE_LISTEN)
     {
-      svm_fifo_add_subscriber (s->rx_fifo, vcl_wrk->vpp_wrk_index);
-      svm_fifo_add_subscriber (s->tx_fifo, vcl_wrk->vpp_wrk_index);
+      s->session_state = VCL_STATE_LISTEN_NO_MQ;
+      s->rx_fifo = s->tx_fifo = 0;
     }
-  else if (s->session_state == STATE_LISTEN)
+  else if (s->rx_fifo)
     {
-      s->session_state = STATE_LISTEN_NO_MQ;
+      vcl_session_share_fifos (s, s->rx_fifo, s->tx_fifo);
     }
 }
 
@@ -735,8 +863,7 @@ vls_share_sessions (vls_worker_t * vls_parent_wrk, vls_worker_t * vls_wrk)
 {
   vcl_locked_session_t *vls, *parent_vls;
 
-  /* *INDENT-OFF* */
-  pool_foreach (vls, vls_wrk->vls_pool, ({
+  pool_foreach (vls, vls_wrk->vls_pool)  {
     /* Initialize sharing on parent session */
     if (vls->shared_data_index == ~0)
       {
@@ -745,40 +872,78 @@ vls_share_sessions (vls_worker_t * vls_parent_wrk, vls_worker_t * vls_wrk)
        vls->shared_data_index = parent_vls->shared_data_index;
       }
     vls_share_session (vls_wrk, vls);
-  }));
-  /* *INDENT-ON* */
+  }
+}
+
+static void
+vls_validate_veps (vcl_worker_t *wrk)
+{
+  vcl_session_t *s;
+  u32 session_index, wrk_index;
+
+  pool_foreach (s, wrk->sessions)
+    {
+      if (s->vep.vep_sh != ~0)
+       {
+         vcl_session_handle_parse (s->vep.vep_sh, &wrk_index, &session_index);
+         s->vep.vep_sh = vcl_session_handle_from_index (session_index);
+       }
+      if (s->vep.next_sh != ~0)
+       {
+         vcl_session_handle_parse (s->vep.next_sh, &wrk_index,
+                                   &session_index);
+         s->vep.next_sh = vcl_session_handle_from_index (session_index);
+       }
+      if (s->vep.prev_sh != ~0)
+       {
+         vcl_session_handle_parse (s->vep.prev_sh, &wrk_index,
+                                   &session_index);
+         s->vep.prev_sh = vcl_session_handle_from_index (session_index);
+       }
+    }
 }
 
 void
 vls_worker_copy_on_fork (vcl_worker_t * parent_wrk)
 {
   vls_worker_t *vls_wrk = vls_worker_get_current (), *vls_parent_wrk;
-  vcl_worker_t *wrk = vcl_worker_get_current ();
+  vcl_worker_t *vcl_wrk = vcl_worker_get_current ();
   u32 vls_index, session_index, wrk_index;
   vcl_session_handle_t sh;
+  vcl_locked_session_t *vls;
 
   /*
    * init vcl worker
    */
-  wrk->vpp_event_queues = vec_dup (parent_wrk->vpp_event_queues);
-  wrk->sessions = pool_dup (parent_wrk->sessions);
-  wrk->session_index_by_vpp_handles =
+  vcl_wrk->sessions = pool_dup (parent_wrk->sessions);
+  vcl_wrk->session_index_by_vpp_handles =
     hash_dup (parent_wrk->session_index_by_vpp_handles);
 
   /*
    * init vls worker
    */
   vls_parent_wrk = vls_worker_get (parent_wrk->wrk_index);
-  /* *INDENT-OFF* */
-  hash_foreach (sh, vls_index, vls_parent_wrk->session_handle_to_vlsh_table,
-    ({
-      vcl_session_handle_parse (sh, &wrk_index, &session_index);
-      hash_set (vls_wrk->session_handle_to_vlsh_table,
-               vcl_session_handle_from_index (session_index), vls_index);
-    }));
-  /* *INDENT-ON* */
+
+  /* clang-format off */
+  hash_foreach (sh, vls_index, vls_parent_wrk->sh_to_vlsh_table, ({
+    vcl_session_handle_parse (sh, &wrk_index, &session_index);
+    hash_set (vls_wrk->sh_to_vlsh_table,
+              vcl_session_handle_from_index (session_index), vls_index);
+  }));
+  /* clang-format on */
   vls_wrk->vls_pool = pool_dup (vls_parent_wrk->vls_pool);
 
+  /*
+   * Detach vls from parent vcl worker and attach them to child.
+   */
+  pool_foreach (vls, vls_wrk->vls_pool)
+    {
+      vls->vcl_wrk_index = vcl_wrk->wrk_index;
+    }
+
+  /* Validate vep's handle */
+  vls_validate_veps (vcl_wrk);
+
   vls_share_sessions (vls_parent_wrk, vls_wrk);
 }
 
@@ -794,7 +959,7 @@ vls_mt_acq_locks (vcl_locked_session_t * vls, vls_mt_ops_t op, int *locks_acq)
       s = vcl_session_get (wrk, vls->session_index);
       if (PREDICT_FALSE (!s))
        return;
-      is_nonblk = VCL_SESS_ATTR_TEST (s->attr, VCL_SESS_ATTR_NONBLOCK);
+      is_nonblk = vcl_session_has_attr (s, VCL_SESS_ATTR_NONBLOCK);
     }
 
   switch (op)
@@ -843,20 +1008,21 @@ vls_mt_rel_locks (int locks_acq)
 static inline u8
 vls_mt_session_should_migrate (vcl_locked_session_t * vls)
 {
-  return (vls_mt_wrk_supported ()
-         && vls->worker_index != vcl_get_worker_index ());
+  return (vls_mt_wrk_supported () &&
+         vls->vcl_wrk_index != vcl_get_worker_index ());
 }
 
-static void
-vls_mt_session_migrate (vcl_locked_session_t * vls)
+static vcl_locked_session_t *
+vls_mt_session_migrate (vcl_locked_session_t *vls)
 {
   u32 wrk_index = vcl_get_worker_index ();
   vcl_worker_t *wrk;
-  u32 src_sid, sid;
+  vls_worker_t *vls_wrk = vls_worker_get_current ();
+  u32 src_sid, sid, vls_index, own_vcl_wrk_index;
   vcl_session_t *session;
   uword *p;
 
-  ASSERT (vls_mt_wrk_supported () && vls->worker_index != wrk_index);
+  ASSERT (vls_mt_wrk_supported () && vls->vcl_wrk_index != wrk_index);
 
   /*
    * VCL session on current vcl worker already allocated. Update current
@@ -864,9 +1030,9 @@ vls_mt_session_migrate (vcl_locked_session_t * vls)
    */
   if ((p = hash_get (vls->vcl_wrk_index_to_session_index, wrk_index)))
     {
-      vls->worker_index = wrk_index;
+      vls->vcl_wrk_index = wrk_index;
       vls->session_index = (u32) p[0];
-      return;
+      return vls;
     }
 
   /*
@@ -879,39 +1045,70 @@ vls_mt_session_migrate (vcl_locked_session_t * vls)
     {
       VERR ("session in owner worker(%u) is free", vls->owner_vcl_wrk_index);
       ASSERT (0);
-      return;
+      vls_unlock (vls);
+      vls_mt_pool_runlock ();
+      return 0;
     }
 
   src_sid = (u32) p[0];
   wrk = vcl_worker_get_current ();
   session = vcl_session_alloc (wrk);
   sid = session->session_index;
-  vls_send_clone_and_share_rpc (wrk, vls, sid, vls_get_worker_index (),
-                               vls->owner_vcl_wrk_index, vls->vls_index,
-                               src_sid);
-  session->session_index = sid;
-  vls->worker_index = wrk_index;
-  vls->session_index = sid;
-  hash_set (vls->vcl_wrk_index_to_session_index, wrk_index, sid);
   VDBG (1, "migrate session of worker (session): %u (%u) -> %u (%u)",
        vls->owner_vcl_wrk_index, src_sid, wrk_index, sid);
 
-  if (PREDICT_FALSE (session->is_vep && session->vep.next_sh != ~0))
+  /* Drop lock to prevent dead lock when dst wrk trying to get lock. */
+  vls_index = vls->vls_index;
+  own_vcl_wrk_index = vls->owner_vcl_wrk_index;
+  vls_unlock (vls);
+  vls_mt_pool_runlock ();
+  vls_send_clone_and_share_rpc (wrk, vls_index, sid, vls_get_worker_index (),
+                               own_vcl_wrk_index, vls_index, src_sid);
+
+  if (PREDICT_FALSE (wrk->rpc_done == VLS_RPC_STATE_SESSION_NOT_EXIST))
+    {
+      VWRN ("session %u not exist", src_sid);
+      goto err;
+    }
+  else if (PREDICT_FALSE (wrk->rpc_done == VLS_RPC_STATE_INIT))
+    {
+      VWRN ("failed to wait rpc response");
+      goto err;
+    }
+  else if (PREDICT_FALSE ((session->flags & VCL_SESSION_F_IS_VEP) &&
+                         session->vep.next_sh != ~0))
     {
-      /* TODO: rollback? */
       VERR ("can't migrate nonempty epoll session");
       ASSERT (0);
-      return;
+      goto err;
     }
-  else if (PREDICT_FALSE (!session->is_vep &&
-                         session->session_state != STATE_CLOSED))
+  else if (PREDICT_FALSE (!(session->flags & VCL_SESSION_F_IS_VEP) &&
+                         session->session_state != VCL_STATE_CLOSED))
     {
-      /* TODO: rollback? */
       VERR ("migrate NOT supported, session_status (%u)",
            session->session_state);
       ASSERT (0);
-      return;
+      goto err;
     }
+
+  vls = vls_get_w_dlock (vls_index);
+  if (PREDICT_FALSE (!vls))
+    {
+      VWRN ("failed to get vls %u", vls_index);
+      goto err;
+    }
+
+  session->session_index = sid;
+  vls->vcl_wrk_index = wrk_index;
+  vls->session_index = sid;
+  hash_set (vls->vcl_wrk_index_to_session_index, wrk_index, sid);
+  vls_sh_to_vlsh_table_add (vls_wrk, vcl_session_handle (session),
+                           vls->vls_index);
+  return vls;
+
+err:
+  vcl_session_free (wrk, session);
+  return 0;
 }
 
 static inline void
@@ -921,20 +1118,24 @@ vls_mt_detect (void)
     vls_mt_add ();
 }
 
-#define vls_mt_guard(_vls, _op)                                                \
-  int _locks_acq = 0;                                                  \
-  if (vls_mt_wrk_supported ())                                         \
-    {                                                                  \
-      if (PREDICT_FALSE (_vls                                          \
-           && ((vcl_locked_session_t *)_vls)->worker_index !=          \
-               vcl_get_worker_index ()))                               \
-         vls_mt_session_migrate (_vls);                                \
-    }                                                                  \
-  else                                                                 \
-    {                                                                  \
-      if (PREDICT_FALSE (vlsl->vls_mt_n_threads > 1))                  \
-        vls_mt_acq_locks (_vls, _op, &_locks_acq);                     \
-    }                                                                  \
+#define vls_mt_guard(_vls, _op)                                               \
+  int _locks_acq = 0;                                                         \
+  if (vls_mt_wrk_supported ())                                                \
+    {                                                                         \
+      if (PREDICT_FALSE (_vls &&                                              \
+                        ((vcl_locked_session_t *) _vls)->vcl_wrk_index !=    \
+                          vcl_get_worker_index ()))                          \
+       {                                                                     \
+         _vls = vls_mt_session_migrate (_vls);                               \
+         if (PREDICT_FALSE (!_vls))                                          \
+           return VPPCOM_EBADFD;                                             \
+       }                                                                     \
+    }                                                                         \
+  else                                                                        \
+    {                                                                         \
+      if (PREDICT_FALSE (vlsl->vls_mt_n_threads > 1))                         \
+       vls_mt_acq_locks (_vls, _op, &_locks_acq);                            \
+    }
 
 #define vls_mt_unguard()                                               \
   if (PREDICT_FALSE (_locks_acq))                                      \
@@ -1034,7 +1235,11 @@ vls_attr (vls_handle_t vlsh, uint32_t op, void *buffer, uint32_t * buflen)
   if (!(vls = vls_get_w_dlock (vlsh)))
     return VPPCOM_EBADFD;
   if (vls_mt_session_should_migrate (vls))
-    vls_mt_session_migrate (vls);
+    {
+      vls = vls_mt_session_migrate (vls);
+      if (PREDICT_FALSE (!vls))
+       return VPPCOM_EBADFD;
+    }
   rv = vppcom_session_attr (vls_to_sh_tu (vls), op, buffer, buflen);
   vls_get_and_unlock (vlsh);
   return rv;
@@ -1096,23 +1301,30 @@ vls_mp_checks (vcl_locked_session_t * vls, int is_add)
   if (vls_mt_wrk_supported ())
     return;
 
+  ASSERT (wrk->wrk_index == vls->vcl_wrk_index);
   s = vcl_session_get (wrk, vls->session_index);
   switch (s->session_state)
     {
-    case STATE_LISTEN:
+    case VCL_STATE_LISTEN:
       if (is_add)
        {
-         vls_listener_wrk_set (vls, vls->worker_index, 1 /* is_active */ );
+         vls_listener_wrk_set (vls, vls->vcl_wrk_index, 1 /* is_active */);
          break;
        }
-      vls_listener_wrk_stop_listen (vls, vls->worker_index);
+      /* Although removal from epoll means listener no longer accepts new
+       * sessions, the accept queue built by vpp cannot be drained by stopping
+       * the listener. Morover, some applications, e.g., nginx, might
+       * constantly remove and add listeners to their epfds. Removing
+       * listeners in such situations causes a lot of churn in vpp as segments
+       * and segment managers need to be recreated. */
+      /* vls_listener_wrk_stop_listen (vls, vls->vcl_wrk_index); */
       break;
-    case STATE_LISTEN_NO_MQ:
+    case VCL_STATE_LISTEN_NO_MQ:
       if (!is_add)
        break;
 
       /* Register worker as listener */
-      vls_listener_wrk_start_listen (vls, wrk->wrk_index);
+      vls_listener_wrk_start_listen (vls, vls->vcl_wrk_index);
 
       /* If owner worker did not attempt to accept/xpoll on the session,
        * force a listen stop for it, since it may not be interested in
@@ -1159,9 +1371,10 @@ vls_create (uint8_t proto, uint8_t is_nonblocking)
 {
   vcl_session_handle_t sh;
   vls_handle_t vlsh;
+  vcl_locked_session_t *vls = NULL;
 
   vls_mt_detect ();
-  vls_mt_guard (0, VLS_MT_OP_SPOOL);
+  vls_mt_guard (vls, VLS_MT_OP_SPOOL);
   sh = vppcom_session_create (proto, is_nonblocking);
   vls_mt_unguard ();
   if (sh == INVALID_SESSION_ID)
@@ -1184,13 +1397,11 @@ vls_mt_session_cleanup (vcl_locked_session_t * vls)
 
   current_vcl_wrk = vcl_get_worker_index ();
 
-  /* *INDENT-OFF* */
   hash_foreach (wrk_index, session_index, vls->vcl_wrk_index_to_session_index,
     ({
       if (current_vcl_wrk != wrk_index)
        vls_send_session_cleanup_rpc (wrk, wrk_index, session_index);
     }));
-  /* *INDENT-ON* */
   hash_free (vls->vcl_wrk_index_to_session_index);
 }
 
@@ -1201,12 +1412,12 @@ vls_close (vls_handle_t vlsh)
   int rv;
 
   vls_mt_detect ();
-  vls_mt_table_wlock ();
+  vls_mt_pool_wlock ();
 
   vls = vls_get_and_lock (vlsh);
   if (!vls)
     {
-      vls_mt_table_wunlock ();
+      vls_mt_pool_wunlock ();
       return VPPCOM_EBADFD;
     }
 
@@ -1223,7 +1434,25 @@ vls_close (vls_handle_t vlsh)
   vls_free (vls);
   vls_mt_unguard ();
 
-  vls_mt_table_wunlock ();
+  vls_mt_pool_wunlock ();
+
+  return rv;
+}
+
+int
+vls_shutdown (vls_handle_t vlsh, int how)
+{
+  vcl_locked_session_t *vls;
+  int rv;
+
+  vls_mt_detect ();
+  if (!(vls = vls_get_w_dlock (vlsh)))
+    return VPPCOM_EBADFD;
+
+  vls_mt_guard (vls, VLS_MT_OP_SPOOL);
+  rv = vppcom_session_shutdown (vls_to_sh_tu (vls), how);
+  vls_mt_unguard ();
+  vls_get_and_unlock (vlsh);
 
   return rv;
 }
@@ -1250,16 +1479,9 @@ vls_epoll_create (void)
 static void
 vls_epoll_ctl_mp_checks (vcl_locked_session_t * vls, int op)
 {
-  if (vcl_n_workers () <= 1)
-    {
-      vlsl->epoll_mp_check = 1;
-      return;
-    }
-
-  if (op == EPOLL_CTL_MOD)
+  if (vcl_n_workers () <= 1 || op == EPOLL_CTL_MOD)
     return;
 
-  vlsl->epoll_mp_check = 1;
   vls_mp_checks (vls, op == EPOLL_CTL_ADD);
 }
 
@@ -1272,29 +1494,46 @@ vls_epoll_ctl (vls_handle_t ep_vlsh, int op, vls_handle_t vlsh,
   int rv;
 
   vls_mt_detect ();
-  vls_mt_table_rlock ();
+  vls_mt_pool_rlock ();
+
   ep_vls = vls_get_and_lock (ep_vlsh);
-  vls = vls_get_and_lock (vlsh);
+  if (PREDICT_FALSE (!ep_vls))
+    {
+      vls_mt_pool_runlock ();
+      return VPPCOM_EBADFD;
+    }
 
   if (vls_mt_session_should_migrate (ep_vls))
-    vls_mt_session_migrate (ep_vls);
+    {
+      ep_vls = vls_mt_session_migrate (ep_vls);
+      if (PREDICT_FALSE (!ep_vls))
+       {
+         vls_mt_pool_runlock ();
+         return VPPCOM_EBADFD;
+       }
+    }
+
+  vls = vls_get_and_lock (vlsh);
+  if (PREDICT_FALSE (!vls))
+    {
+      vls_unlock (ep_vls);
+      vls_mt_pool_runlock ();
+      return VPPCOM_EBADFD;
+    }
 
   ep_sh = vls_to_sh (ep_vls);
   sh = vls_to_sh (vls);
 
-  if (PREDICT_FALSE (!vlsl->epoll_mp_check))
-    vls_epoll_ctl_mp_checks (vls, op);
-
-  vls_mt_table_runlock ();
-
+  vls_epoll_ctl_mp_checks (vls, op);
+  vls_mt_pool_runlock ();
   rv = vppcom_epoll_ctl (ep_sh, op, sh, event);
 
-  vls_mt_table_rlock ();
+  vls_mt_pool_rlock ();
   ep_vls = vls_get (ep_vlsh);
   vls = vls_get (vlsh);
   vls_unlock (vls);
   vls_unlock (ep_vls);
-  vls_mt_table_runlock ();
+  vls_mt_pool_runlock ();
   return rv;
 }
 
@@ -1302,17 +1541,18 @@ int
 vls_epoll_wait (vls_handle_t ep_vlsh, struct epoll_event *events,
                int maxevents, double wait_for_time)
 {
-  vcl_locked_session_t *vls;
+  vcl_locked_session_t *vls, *vls_tmp = NULL;
   int rv;
 
   vls_mt_detect ();
   if (!(vls = vls_get_w_dlock (ep_vlsh)))
     return VPPCOM_EBADFD;
-  vls_mt_guard (0, VLS_MT_OP_XPOLL);
+  vls_mt_guard (vls_tmp, VLS_MT_OP_XPOLL);
   rv = vppcom_epoll_wait (vls_to_sh_tu (vls), events, maxevents,
                          wait_for_time);
   vls_mt_unguard ();
   vls_get_and_unlock (ep_vlsh);
+  vls_handle_pending_wrk_cleanup ();
   return rv;
 }
 
@@ -1336,16 +1576,14 @@ vls_select_mp_checks (vcl_si_set * read_map)
   vlsl->select_mp_check = 1;
   wrk = vcl_worker_get_current ();
 
-  /* *INDENT-OFF* */
-  clib_bitmap_foreach (si, read_map, ({
+  clib_bitmap_foreach (si, read_map)  {
     s = vcl_session_get (wrk, si);
-    if (s->session_state == STATE_LISTEN)
+    if (s->session_state == VCL_STATE_LISTEN)
       {
        vls = vls_get (vls_session_index_to_vlsh (si));
        vls_mp_checks (vls, 1 /* is_add */);
       }
-  }));
-  /* *INDENT-ON* */
+  }
 }
 
 int
@@ -1353,13 +1591,15 @@ vls_select (int n_bits, vcl_si_set * read_map, vcl_si_set * write_map,
            vcl_si_set * except_map, double wait_for_time)
 {
   int rv;
+  vcl_locked_session_t *vls = NULL;
 
   vls_mt_detect ();
-  vls_mt_guard (0, VLS_MT_OP_XPOLL);
+  vls_mt_guard (vls, VLS_MT_OP_XPOLL);
   if (PREDICT_FALSE (!vlsl->select_mp_check))
     vls_select_mp_checks (read_map);
   rv = vppcom_select (n_bits, read_map, write_map, except_map, wait_for_time);
   vls_mt_unguard ();
+  vls_handle_pending_wrk_cleanup ();
   return rv;
 }
 
@@ -1376,13 +1616,11 @@ vls_unshare_vcl_worker_sessions (vcl_worker_t * wrk)
   current_wrk = vcl_get_worker_index ();
   is_current = current_wrk == wrk->wrk_index;
 
-  /* *INDENT-OFF* */
-  pool_foreach (s, wrk->sessions, ({
+  pool_foreach (s, wrk->sessions)  {
     vls = vls_get (vls_si_wi_to_vlsh (s->session_index, wrk->wrk_index));
     if (vls && (is_current || vls_is_shared_by_wrk (vls, current_wrk)))
       vls_unshare_session (vls, wrk);
-  }));
-  /* *INDENT-ON* */
+  }
 }
 
 static void
@@ -1393,7 +1631,11 @@ vls_cleanup_vcl_worker (vcl_worker_t * wrk)
   /* Unshare sessions and also cleanup worker since child may have
    * called _exit () and therefore vcl may not catch the event */
   vls_unshare_vcl_worker_sessions (wrk);
-  vcl_worker_cleanup (wrk, 1 /* notify vpp */ );
+
+  /* Since child may have exited and thereforce fd of vpp_app_socket_api
+   * may have been closed, so DONOT notify VPP.
+   */
+  vcl_worker_cleanup (wrk, vcm->cfg.vpp_app_socket_api ? 0 : 1);
 
   vls_worker_free (vls_wrk);
 }
@@ -1421,12 +1663,34 @@ vls_cleanup_forked_child (vcl_worker_t * wrk, vcl_worker_t * child_wrk)
   wrk->forked_child = ~0;
 }
 
+static void
+vls_handle_pending_wrk_cleanup (void)
+{
+  u32 *wip;
+  vcl_worker_t *child_wrk, *wrk;
+  vls_worker_t *vls_wrk = vls_worker_get_current ();
+
+  if (PREDICT_TRUE (vec_len (vls_wrk->pending_vcl_wrk_cleanup) == 0))
+    return;
+
+  wrk = vcl_worker_get_current ();
+  vec_foreach (wip, vls_wrk->pending_vcl_wrk_cleanup)
+    {
+      child_wrk = vcl_worker_get_if_valid (*wip);
+      if (!child_wrk)
+       continue;
+      vls_cleanup_forked_child (wrk, child_wrk);
+    }
+  vec_reset_length (vls_wrk->pending_vcl_wrk_cleanup);
+}
+
 static struct sigaction old_sa;
 
 static void
 vls_intercept_sigchld_handler (int signum, siginfo_t * si, void *uc)
 {
   vcl_worker_t *wrk, *child_wrk;
+  vls_worker_t *vls_wrk;
 
   if (vcl_get_worker_index () == ~0)
     return;
@@ -1450,7 +1714,14 @@ vls_intercept_sigchld_handler (int signum, siginfo_t * si, void *uc)
       VDBG (0, "unexpected child pid %u", si->si_pid);
       goto done;
     }
-  vls_cleanup_forked_child (wrk, child_wrk);
+
+  /* Parent process may enter sighandler with a lock, such as lock in localtime
+   * or in mspace_free, and child wrk cleanup may try to get such locks and
+   * cause deadlock.
+   * So move child wrk cleanup from sighandler to vls_epoll_wait/vls_select.
+   */
+  vls_wrk = vls_worker_get_current ();
+  vec_add1 (vls_wrk->pending_vcl_wrk_cleanup, child_wrk->wrk_index);
 
 done:
   if (old_sa.sa_flags & SA_SIGINFO)
@@ -1470,6 +1741,11 @@ static void
 vls_incercept_sigchld ()
 {
   struct sigaction sa;
+  if (old_sa.sa_sigaction)
+    {
+      VDBG (0, "have intercepted sigchld");
+      return;
+    }
   clib_memset (&sa, 0, sizeof (sa));
   sa.sa_sigaction = vls_intercept_sigchld_handler;
   sa.sa_flags = SA_SIGINFO;
@@ -1515,17 +1791,18 @@ vls_app_fork_child_handler (void)
    * Allocate/initialize vls worker and share sessions
    */
   vls_worker_alloc ();
-  parent_wrk = vcl_worker_get (parent_wrk_index);
-  vls_worker_copy_on_fork (parent_wrk);
-  parent_wrk->forked_child = vcl_get_worker_index ();
 
   /* Reset number of threads and set wrk index */
   vlsl->vls_mt_n_threads = 0;
   vlsl->vls_wrk_index = vcl_get_worker_index ();
   vlsl->select_mp_check = 0;
-  vlsl->epoll_mp_check = 0;
+  clib_rwlock_init (&vlsl->vls_pool_lock);
   vls_mt_locks_init ();
 
+  parent_wrk = vcl_worker_get (parent_wrk_index);
+  vls_worker_copy_on_fork (parent_wrk);
+  parent_wrk->forked_child = vcl_get_worker_index ();
+
   VDBG (0, "forked child main worker initialized");
   vcm->forking = 0;
 }
@@ -1543,6 +1820,9 @@ vls_app_exit (void)
 {
   vls_worker_t *wrk = vls_worker_get_current ();
 
+  /* Handle pending wrk cleanup */
+  vls_handle_pending_wrk_cleanup ();
+
   /* Unshare the sessions. VCL will clean up the worker */
   vls_unshare_vcl_worker_sessions (vcl_worker_get_current ());
   vls_worker_free (wrk);
@@ -1557,24 +1837,33 @@ vls_clone_and_share_rpc_handler (void *args)
   vcl_worker_t *vcl_wrk = vcl_worker_get_current (), *dst_vcl_wrk;
   vcl_session_t *s, *dst_s;
 
-  vls = vls_session_get (wrk, msg->vls_index);
-
-  if (!vls_mt_wrk_supported ())
-    vls_init_share_session (wrk, vls);
+  VDBG (1, "process session clone of worker (session): %u (%u) -> %u (%u)",
+       vcl_wrk->wrk_index, msg->session_index, msg->origin_vcl_wrk,
+       msg->origin_session_index);
 
-  s = vcl_session_get (vcl_wrk, msg->session_index);
-  dst_wrk = vls_worker_get (msg->origin_vls_wrk);
+  /* VCL locked session can't been protected, so DONT touch it.
+   * VCL session may been free, check it.
+   */
   dst_vcl_wrk = vcl_worker_get (msg->origin_vcl_wrk);
-  dst_vls = vls_session_get (dst_wrk, msg->origin_vls_index);
-  dst_vls->shared_data_index = vls->shared_data_index;
+  s = vcl_session_get (vcl_wrk, msg->session_index);
+  if (PREDICT_FALSE (!s))
+    {
+      dst_vcl_wrk->rpc_done = VLS_RPC_STATE_SESSION_NOT_EXIST;
+      return;
+    }
+
+  if (!vls_mt_wrk_supported ())
+    {
+      vls = vls_session_get (wrk, msg->vls_index);
+      vls_init_share_session (wrk, vls);
+      dst_wrk = vls_worker_get (msg->origin_vls_wrk);
+      dst_vls = vls_session_get (dst_wrk, msg->origin_vls_index);
+      dst_vls->shared_data_index = vls->shared_data_index;
+    }
   dst_s = vcl_session_get (dst_vcl_wrk, msg->origin_session_index);
   clib_memcpy (dst_s, s, sizeof (*s));
 
-  dst_vcl_wrk->rpc_done = 1;
-
-  VDBG (1, "proces session clone of worker (session): %u (%u) -> %u (%u)",
-       vcl_wrk->wrk_index, msg->session_index, dst_vcl_wrk->wrk_index,
-       msg->origin_session_index);
+  dst_vcl_wrk->rpc_done = VLS_RPC_STATE_SUCCESS;
 }
 
 static void
@@ -1582,14 +1871,14 @@ vls_session_cleanup_rpc_handler (void *args)
 {
   vls_sess_cleanup_msg_t *msg = (vls_sess_cleanup_msg_t *) args;
   vcl_worker_t *wrk = vcl_worker_get_current ();
-  vcl_worker_t *dst_wrk = vcl_worker_get (msg->origin_vcl_wrk);
-
-  vppcom_session_close (vcl_session_handle_from_index (msg->session_index));
+  vls_worker_t *vls_wrk = vls_worker_get_current ();
+  vcl_session_handle_t sh = vcl_session_handle_from_index (msg->session_index);
 
-  dst_wrk->rpc_done = 1;
+  VDBG (1, "process session cleanup of worker (session): %u (%u) from %u ()",
+       wrk->wrk_index, msg->session_index, msg->origin_vcl_wrk);
 
-  VDBG (1, "proces session cleanup of worker (session): %u (%u) from %u ()",
-       wrk->wrk_index, msg->session_index, dst_wrk->wrk_index);
+  vppcom_session_close (sh);
+  vls_sh_to_vlsh_table_del (vls_wrk, sh);
 }
 
 static void
@@ -1610,34 +1899,42 @@ vls_rpc_handler (void *args)
 }
 
 void
-vls_send_clone_and_share_rpc (vcl_worker_t * wrk,
-                             vcl_locked_session_t * vls, u32 session_index,
-                             u32 vls_wrk_index, u32 dst_wrk_index,
-                             u32 dst_vls_index, u32 dst_session_index)
+vls_send_clone_and_share_rpc (vcl_worker_t *wrk, u32 origin_vls_index,
+                             u32 session_index, u32 vls_wrk_index,
+                             u32 dst_wrk_index, u32 dst_vls_index,
+                             u32 dst_session_index)
 {
   u8 data[sizeof (u8) + sizeof (vls_clone_and_share_msg_t)];
   vls_clone_and_share_msg_t *msg;
   vls_rpc_msg_t *rpc;
   int ret;
+  f64 timeout = clib_time_now (&wrk->clib_time) + VLS_WORKER_RPC_TIMEOUT;
 
   rpc = (vls_rpc_msg_t *) & data;
   rpc->type = VLS_RPC_CLONE_AND_SHARE;
   msg = (vls_clone_and_share_msg_t *) & rpc->data;
   msg->origin_vls_wrk = vls_wrk_index;
-  msg->origin_vls_index = vls->vls_index;
+  msg->origin_vls_index = origin_vls_index;
   msg->origin_vcl_wrk = wrk->wrk_index;
   msg->origin_session_index = session_index;
   msg->vls_index = dst_vls_index;
   msg->session_index = dst_session_index;
 
-  wrk->rpc_done = 0;
+  /* Try lock and handle rpcs if two threads send each other
+   * clone requests at the same time.
+   */
+  wrk->rpc_done = VLS_RPC_STATE_INIT;
+  while (!clib_spinlock_trylock (&vlsm->worker_rpc_lock))
+    vcl_flush_mq_events ();
   ret = vcl_send_worker_rpc (dst_wrk_index, rpc, sizeof (data));
 
   VDBG (1, "send session clone to wrk (session): %u (%u) -> %u (%u), ret=%d",
        dst_wrk_index, msg->session_index, msg->origin_vcl_wrk,
        msg->origin_session_index, ret);
-  while (!ret && !wrk->rpc_done)
+  while (!ret && wrk->rpc_done == VLS_RPC_STATE_INIT &&
+        clib_time_now (&wrk->clib_time) < timeout)
     ;
+  clib_spinlock_unlock (&vlsm->worker_rpc_lock);
 }
 
 void
@@ -1655,13 +1952,10 @@ vls_send_session_cleanup_rpc (vcl_worker_t * wrk,
   msg->origin_vcl_wrk = wrk->wrk_index;
   msg->session_index = dst_session_index;
 
-  wrk->rpc_done = 0;
   ret = vcl_send_worker_rpc (dst_wrk_index, rpc, sizeof (data));
 
   VDBG (1, "send session cleanup to wrk (session): %u (%u) from %u, ret=%d",
        dst_wrk_index, msg->session_index, msg->origin_vcl_wrk, ret);
-  while (!ret && !wrk->rpc_done)
-    ;
 }
 
 int
@@ -1674,8 +1968,8 @@ vls_app_create (char *app_name)
 
   vlsm = clib_mem_alloc (sizeof (vls_main_t));
   clib_memset (vlsm, 0, sizeof (*vlsm));
-  clib_rwlock_init (&vlsm->vls_table_lock);
   clib_rwlock_init (&vlsm->shared_data_lock);
+  clib_spinlock_init (&vlsm->worker_rpc_lock);
   pool_alloc (vlsm->workers, vcm->cfg.max_workers);
 
   pthread_atfork (vls_app_pre_fork, vls_app_fork_parent_handler,
@@ -1683,6 +1977,7 @@ vls_app_create (char *app_name)
   atexit (vls_app_exit);
   vls_worker_alloc ();
   vlsl->vls_wrk_index = vcl_get_worker_index ();
+  clib_rwlock_init (&vlsl->vls_pool_lock);
   vls_mt_locks_init ();
   vcm->wrk_rpc_fn = vls_rpc_handler;
   return VPPCOM_OK;
@@ -1712,11 +2007,7 @@ vls_use_real_epoll (void)
 void
 vls_register_vcl_worker (void)
 {
-  if (vppcom_worker_register () != VPPCOM_OK)
-    {
-      VERR ("failed to register worker");
-      return;
-    }
+  vls_mt_add ();
 }
 
 /*