src/plugins/acl/sess_mgmt_node.c

   1 /*
   2  * Copyright (c) 2016-2018 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15 #include <stddef.h>
  16 #include <netinet/in.h>
  17
  18 #include <vlib/vlib.h>
  19 #include <vnet/vnet.h>
  20 #include <vnet/pg/pg.h>
  21 #include <vppinfra/error.h>
  22
  23
  24 #include <acl/acl.h>
  25 #include <vnet/ip/icmp46_packet.h>
  26
  27 #include <plugins/acl/fa_node.h>
  28 #include <plugins/acl/acl.h>
  29 #include <plugins/acl/lookup_context.h>
  30 #include <plugins/acl/public_inlines.h>
  31 #include <plugins/acl/session_inlines.h>
  32
  33 // #include <vppinfra/bihash_40_8.h>
  34
  35
  36 static u64
  37 fa_session_get_shortest_timeout (acl_main_t * am)
  38 {
  39   int timeout_type;
  40   u64 timeout = ~0LL;
  41   for (timeout_type = 0; timeout_type < ACL_N_TIMEOUTS; timeout_type++)
  42     {
  43       if (timeout > am->session_timeout_sec[timeout_type])
  44         {
  45           timeout = am->session_timeout_sec[timeout_type];
  46         }
  47     }
  48   return timeout;
  49 }
  50
  51 static void
  52 acl_fa_verify_init_sessions (acl_main_t * am)
  53 {
  54   if (!am->fa_sessions_hash_is_initialized)
  55     {
  56       u16 wk;
  57       /* Allocate the per-worker sessions pools */
  58       for (wk = 0; wk < vec_len (am->per_worker_data); wk++)
  59         {
  60           acl_fa_per_worker_data_t *pw = &am->per_worker_data[wk];
  61
  62           /*
  63            * // In lieu of trying to preallocate the pool and its free bitmap, rather use pool_init_fixed
  64            * pool_alloc_aligned(pw->fa_sessions_pool, am->fa_conn_table_max_entries, CLIB_CACHE_LINE_BYTES);
  65            * clib_bitmap_validate(pool_header(pw->fa_sessions_pool)->free_bitmap, am->fa_conn_table_max_entries);
  66            */
  67           pool_init_fixed (pw->fa_sessions_pool,
  68                            am->fa_conn_table_max_entries);
  69         }
  70
  71       /* ... and the interface session hash table */
  72       clib_bihash_init_40_8 (&am->fa_sessions_hash,
  73                              "ACL plugin FA session bihash",
  74                              am->fa_conn_table_hash_num_buckets,
  75                              am->fa_conn_table_hash_memory_size);
  76       am->fa_sessions_hash_is_initialized = 1;
  77     }
  78 }
  79
  80
  81 /*
  82  * Get the timeout of the session in a list since its enqueue time.
  83  */
  84
  85 static u64
  86 fa_session_get_list_timeout (acl_main_t * am, fa_session_t * sess)
  87 {
  88   u64 timeout = am->vlib_main->clib_time.clocks_per_second;
  89   /*
  90    * we have the shortest possible timeout type in all the lists
  91    * (see README-multicore for the rationale)
  92    */
  93   timeout *= fa_session_get_shortest_timeout (am);
  94   return timeout;
  95 }
  96
  97 static u64
  98 acl_fa_get_list_head_expiry_time (acl_main_t * am,
  99                                   acl_fa_per_worker_data_t * pw, u64 now,
 100                                   u16 thread_index, int timeout_type)
 101 {
 102   fa_session_t *sess =
 103     get_session_ptr (am, thread_index, pw->fa_conn_list_head[timeout_type]);
 104   /*
 105    * We can not check just the index here because inbetween the worker thread might
 106    * dequeue the connection from the head just as we are about to check it.
 107    */
 108   if (!is_valid_session_ptr (am, thread_index, sess))
 109     {
 110       return ~0LL;              // infinity.
 111     }
 112   else
 113     {
 114       u64 timeout_time =
 115         sess->link_enqueue_time + fa_session_get_list_timeout (am, sess);
 116       return timeout_time;
 117     }
 118 }
 119
 120 static int
 121 acl_fa_conn_time_to_check (acl_main_t * am, acl_fa_per_worker_data_t * pw,
 122                            u64 now, u16 thread_index, u32 session_index)
 123 {
 124   fa_session_t *sess = get_session_ptr (am, thread_index, session_index);
 125   u64 timeout_time =
 126     sess->link_enqueue_time + fa_session_get_list_timeout (am, sess);
 127   return (timeout_time < now)
 128     || (sess->link_enqueue_time <= pw->swipe_end_time);
 129 }
 130
 131 /*
 132  * see if there are sessions ready to be checked,
 133  * do the maintenance (requeue or delete), and
 134  * return the total number of sessions reclaimed.
 135  */
 136 static int
 137 acl_fa_check_idle_sessions (acl_main_t * am, u16 thread_index, u64 now)
 138 {
 139   acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
 140   fa_full_session_id_t fsid;
 141   fsid.thread_index = thread_index;
 142   int total_expired = 0;
 143
 144   {
 145     u8 tt = 0;
 146     for (tt = 0; tt < ACL_N_TIMEOUTS; tt++)
 147       {
 148         while ((vec_len (pw->expired) <
 149                 am->fa_max_deleted_sessions_per_interval)
 150                && (~0 != pw->fa_conn_list_head[tt])
 151                &&
 152                (acl_fa_conn_time_to_check
 153                 (am, pw, now, thread_index, pw->fa_conn_list_head[tt])))
 154           {
 155             fsid.session_index = pw->fa_conn_list_head[tt];
 156             elog_acl_maybe_trace_X2 (am,
 157                                      "acl_fa_check_idle_sessions: expire session %d on thread %d",
 158                                      "i4i4", (u32) fsid.session_index,
 159                                      (u32) thread_index);
 160             vec_add1 (pw->expired, fsid.session_index);
 161             acl_fa_conn_list_delete_session (am, fsid);
 162           }
 163       }
 164   }
 165
 166   u32 *psid = NULL;
 167   vec_foreach (psid, pw->expired)
 168   {
 169     fsid.session_index = *psid;
 170     if (!pool_is_free_index (pw->fa_sessions_pool, fsid.session_index))
 171       {
 172         fa_session_t *sess =
 173           get_session_ptr (am, thread_index, fsid.session_index);
 174         u32 sw_if_index = sess->sw_if_index;
 175         u64 sess_timeout_time =
 176           sess->last_active_time + fa_session_get_timeout (am, sess);
 177         if ((now < sess_timeout_time)
 178             && (0 ==
 179                 clib_bitmap_get (pw->pending_clear_sw_if_index_bitmap,
 180                                  sw_if_index)))
 181           {
 182 #ifdef FA_NODE_VERBOSE_DEBUG
 183             clib_warning
 184               ("ACL_FA_NODE_CLEAN: Restarting timer for session %d, sw_if_index %d",
 185                (int) fsid.session_index, sess->sw_if_index);
 186 #endif
 187             /* There was activity on the session, so the idle timeout
 188                has not passed. Enqueue for another time period. */
 189
 190             acl_fa_conn_list_add_session (am, fsid, now);
 191             pw->cnt_session_timer_restarted++;
 192           }
 193         else
 194           {
 195 #ifdef FA_NODE_VERBOSE_DEBUG
 196             clib_warning
 197               ("ACL_FA_NODE_CLEAN: Deleting session %d, sw_if_index %d",
 198                (int) fsid.session_index, sess->sw_if_index);
 199 #endif
 200             acl_fa_delete_session (am, sw_if_index, fsid);
 201             pw->cnt_deleted_sessions++;
 202           }
 203       }
 204     else
 205       {
 206         pw->cnt_already_deleted_sessions++;
 207       }
 208   }
 209   total_expired = vec_len (pw->expired);
 210   /* zero out the vector which we have acted on */
 211   if (pw->expired)
 212     _vec_len (pw->expired) = 0;
 213   /* if we were advancing and reached the end
 214    * (no more sessions to recycle), reset the fast-forward timestamp */
 215
 216   if (pw->swipe_end_time && 0 == total_expired)
 217     pw->swipe_end_time = 0;
 218   return (total_expired);
 219 }
 220
 221 /*
 222  * This process ensures the connection cleanup happens every so often
 223  * even in absence of traffic, as well as provides general orchestration
 224  * for requests like connection deletion on a given sw_if_index.
 225  */
 226
 227
 228 /* *INDENT-OFF* */
 229 #define foreach_acl_fa_cleaner_error \
 230 _(UNKNOWN_EVENT, "unknown event received")  \
 231 /* end  of errors */
 232
 233 typedef enum
 234 {
 235 #define _(sym,str) ACL_FA_CLEANER_ERROR_##sym,
 236   foreach_acl_fa_cleaner_error
 237 #undef _
 238     ACL_FA_CLEANER_N_ERROR,
 239 } acl_fa_cleaner_error_t;
 240
 241 static char *acl_fa_cleaner_error_strings[] = {
 242 #define _(sym,string) string,
 243   foreach_acl_fa_cleaner_error
 244 #undef _
 245 };
 246
 247 /* *INDENT-ON* */
 248
 249 static vlib_node_registration_t acl_fa_session_cleaner_process_node;
 250 static vlib_node_registration_t acl_fa_worker_session_cleaner_process_node;
 251
 252 /*
 253  * Per-worker thread interrupt-driven cleaner thread
 254  * to clean idle connections if there are no packets
 255  */
 256 static uword
 257 acl_fa_worker_conn_cleaner_process (vlib_main_t * vm,
 258                                     vlib_node_runtime_t * rt,
 259                                     vlib_frame_t * f)
 260 {
 261   acl_main_t *am = &acl_main;
 262   u64 now = clib_cpu_time_now ();
 263   u16 thread_index = os_get_thread_index ();
 264   acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
 265   int num_expired;
 266   elog_acl_maybe_trace_X1 (am,
 267                            "acl_fa_worker_conn_cleaner interrupt: now %lu",
 268                            "i8", now);
 269   /* allow another interrupt to be queued */
 270   pw->interrupt_is_pending = 0;
 271   if (pw->clear_in_process)
 272     {
 273       if (0 == pw->swipe_end_time)
 274         {
 275           /*
 276            * Someone has just set the flag to start clearing.
 277            * we do this by combing through the connections up to a "time T"
 278            * which is now, and requeueing everything except the expired
 279            * connections and those matching the interface(s) being cleared.
 280            */
 281
 282           /*
 283            * first filter the sw_if_index bitmap that they want from us, by
 284            * a bitmap of sw_if_index for which we actually have connections.
 285            */
 286           if ((pw->pending_clear_sw_if_index_bitmap == 0)
 287               || (pw->serviced_sw_if_index_bitmap == 0))
 288             {
 289               elog_acl_maybe_trace_X1 (am,
 290                                        "acl_fa_worker_conn_cleaner: now %lu, someone tried to call clear but one of the bitmaps are empty",
 291                                        "i8", now);
 292               clib_bitmap_zero (pw->pending_clear_sw_if_index_bitmap);
 293             }
 294           else
 295             {
 296 #ifdef FA_NODE_VERBOSE_DEBUG
 297               clib_warning
 298                 ("WORKER-CLEAR: (before and) swiping sw-if-index bitmap: %U, my serviced bitmap %U",
 299                  format_bitmap_hex, pw->pending_clear_sw_if_index_bitmap,
 300                  format_bitmap_hex, pw->serviced_sw_if_index_bitmap);
 301 #endif
 302               pw->pending_clear_sw_if_index_bitmap =
 303                 clib_bitmap_and (pw->pending_clear_sw_if_index_bitmap,
 304                                  pw->serviced_sw_if_index_bitmap);
 305             }
 306
 307           if (clib_bitmap_is_zero (pw->pending_clear_sw_if_index_bitmap))
 308             {
 309               /* if the cross-section is a zero vector, no need to do anything. */
 310               elog_acl_maybe_trace_X1 (am,
 311                                        "acl_fa_worker_conn_cleaner: now %lu, clearing done, nothing to do",
 312                                        "i8", now);
 313               pw->clear_in_process = 0;
 314             }
 315           else
 316             {
 317 #ifdef FA_NODE_VERBOSE_DEBUG
 318               clib_warning
 319                 ("WORKER-CLEAR: swiping sw-if-index bitmap: %U, my serviced bitmap %U",
 320                  format_bitmap_hex, pw->pending_clear_sw_if_index_bitmap,
 321                  format_bitmap_hex, pw->serviced_sw_if_index_bitmap);
 322 #endif
 323               elog_acl_maybe_trace_X1 (am,
 324                                        "acl_fa_worker_conn_cleaner: swiping until %lu",
 325                                        "i8", now);
 326               /* swipe through the connection lists until enqueue timestamps become above "now" */
 327               pw->swipe_end_time = now;
 328             }
 329         }
 330     }
 331   num_expired = acl_fa_check_idle_sessions (am, thread_index, now);
 332   // clib_warning("WORKER-CLEAR: checked %d sessions (clear_in_progress: %d)", num_expired, pw->clear_in_process);
 333   elog_acl_maybe_trace_X2 (am,
 334                            "acl_fa_worker_conn_cleaner: checked %d sessions (clear_in_process: %d)",
 335                            "i4i4", (u32) num_expired,
 336                            (u32) pw->clear_in_process);
 337   if (pw->clear_in_process)
 338     {
 339       if (0 == num_expired)
 340         {
 341           /* we were clearing but we could not process any more connections. time to stop. */
 342           clib_bitmap_zero (pw->pending_clear_sw_if_index_bitmap);
 343           pw->clear_in_process = 0;
 344           elog_acl_maybe_trace_X1 (am,
 345                                    "acl_fa_worker_conn_cleaner: now %lu, clearing done - all done",
 346                                    "i8", now);
 347         }
 348       else
 349         {
 350           elog_acl_maybe_trace_X1 (am,
 351                                    "acl_fa_worker_conn_cleaner: now %lu, more work to do - requesting interrupt",
 352                                    "i8", now);
 353           /* should continue clearing.. So could they please sent an interrupt again? */
 354           pw->interrupt_is_needed = 1;
 355         }
 356     }
 357   else
 358     {
 359       if (num_expired >= am->fa_max_deleted_sessions_per_interval)
 360         {
 361           /* there was too much work, we should get an interrupt ASAP */
 362           pw->interrupt_is_needed = 1;
 363           pw->interrupt_is_unwanted = 0;
 364         }
 365       else if (num_expired <= am->fa_min_deleted_sessions_per_interval)
 366         {
 367           /* signal that they should trigger us less */
 368           pw->interrupt_is_needed = 0;
 369           pw->interrupt_is_unwanted = 1;
 370         }
 371       else
 372         {
 373           /* the current rate of interrupts is ok */
 374           pw->interrupt_is_needed = 0;
 375           pw->interrupt_is_unwanted = 0;
 376         }
 377       elog_acl_maybe_trace_X3 (am,
 378                                "acl_fa_worker_conn_cleaner: now %lu, interrupt needed: %u, interrupt unwanted: %u",
 379                                "i8i4i4", now, ((u32) pw->interrupt_is_needed),
 380                                ((u32) pw->interrupt_is_unwanted));
 381     }
 382   pw->interrupt_generation = am->fa_interrupt_generation;
 383   return 0;
 384 }
 385
 386 static void
 387 send_one_worker_interrupt (vlib_main_t * vm, acl_main_t * am,
 388                            int thread_index)
 389 {
 390   acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
 391   if (!pw->interrupt_is_pending)
 392     {
 393       pw->interrupt_is_pending = 1;
 394       vlib_node_set_interrupt_pending (vlib_mains[thread_index],
 395                                        acl_fa_worker_session_cleaner_process_node.index);
 396       elog_acl_maybe_trace_X1 (am,
 397                                "send_one_worker_interrupt: send interrupt to worker %d",
 398                                "i4", ((u32) thread_index));
 399       /* if the interrupt was requested, mark that done. */
 400       /* pw->interrupt_is_needed = 0; */
 401     }
 402 }
 403
 404 static void
 405 send_interrupts_to_workers (vlib_main_t * vm, acl_main_t * am)
 406 {
 407   int i;
 408   /* Can't use vec_len(am->per_worker_data) since the threads might not have come up yet; */
 409   int n_threads = vec_len (vlib_mains);
 410   for (i = 0; i < n_threads; i++)
 411     {
 412       send_one_worker_interrupt (vm, am, i);
 413     }
 414 }
 415
 416 /* centralized process to drive per-worker cleaners */
 417 static uword
 418 acl_fa_session_cleaner_process (vlib_main_t * vm, vlib_node_runtime_t * rt,
 419                                 vlib_frame_t * f)
 420 {
 421   acl_main_t *am = &acl_main;
 422   u64 now;
 423   f64 cpu_cps = vm->clib_time.clocks_per_second;
 424   u64 next_expire;
 425   /* We should check if there are connections to clean up - at least twice a second */
 426   u64 max_timer_wait_interval = cpu_cps / 2;
 427   uword event_type, *event_data = 0;
 428   acl_fa_per_worker_data_t *pw0;
 429
 430   am->fa_current_cleaner_timer_wait_interval = max_timer_wait_interval;
 431   am->fa_cleaner_node_index = acl_fa_session_cleaner_process_node.index;
 432   am->fa_interrupt_generation = 1;
 433   while (1)
 434     {
 435       now = clib_cpu_time_now ();
 436       next_expire = now + am->fa_current_cleaner_timer_wait_interval;
 437       int has_pending_conns = 0;
 438       u16 ti;
 439       u8 tt;
 440
 441       /*
 442        * walk over all per-thread list heads of different timeouts,
 443        * and see if there are any connections pending.
 444        * If there aren't - we do not need to wake up until the
 445        * worker code signals that it has added a connection.
 446        *
 447        * Also, while we are at it, calculate the earliest we need to wake up.
 448        */
 449       for (ti = 0; ti < vec_len (vlib_mains); ti++)
 450         {
 451           if (ti >= vec_len (am->per_worker_data))
 452             {
 453               continue;
 454             }
 455           acl_fa_per_worker_data_t *pw = &am->per_worker_data[ti];
 456           for (tt = 0; tt < vec_len (pw->fa_conn_list_head); tt++)
 457             {
 458               u64 head_expiry =
 459                 acl_fa_get_list_head_expiry_time (am, pw, now, ti, tt);
 460               if ((head_expiry < next_expire) && !pw->interrupt_is_pending)
 461                 {
 462                   elog_acl_maybe_trace_X3 (am,
 463                                            "acl_fa_session_cleaner_process: now %lu, worker: %d tt: %d",
 464                                            "i8i2i2", now, ti, tt);
 465                   elog_acl_maybe_trace_X2 (am,
 466                                            "acl_fa_session_cleaner_process: head expiry: %lu, is earlier than curr next expire: %lu",
 467                                            "i8i8", head_expiry, next_expire);
 468                   next_expire = head_expiry;
 469                 }
 470               if (~0 != pw->fa_conn_list_head[tt])
 471                 {
 472                   has_pending_conns = 1;
 473                 }
 474             }
 475         }
 476
 477       /* If no pending connections and no ACL applied then no point in timing out */
 478       if (!has_pending_conns && (0 == am->fa_total_enabled_count))
 479         {
 480           am->fa_cleaner_cnt_wait_without_timeout++;
 481           elog_acl_maybe_trace_X1 (am,
 482                                    "acl_conn_cleaner: now %lu entering wait without timeout",
 483                                    "i8", now);
 484           (void) vlib_process_wait_for_event (vm);
 485           event_type = vlib_process_get_events (vm, &event_data);
 486         }
 487       else
 488         {
 489           f64 timeout = ((i64) next_expire - (i64) now) / cpu_cps;
 490           if (timeout <= 0)
 491             {
 492               /* skip waiting altogether */
 493               event_type = ~0;
 494             }
 495           else
 496             {
 497               am->fa_cleaner_cnt_wait_with_timeout++;
 498               elog_acl_maybe_trace_X2 (am,
 499                                        "acl_conn_cleaner: now %lu entering wait with timeout %.6f sec",
 500                                        "i8f8", now, timeout);
 501               (void) vlib_process_wait_for_event_or_clock (vm, timeout);
 502               event_type = vlib_process_get_events (vm, &event_data);
 503             }
 504         }
 505
 506       switch (event_type)
 507         {
 508         case ~0:
 509           /* nothing to do */
 510           break;
 511         case ACL_FA_CLEANER_RESCHEDULE:
 512           /* Nothing to do. */
 513           break;
 514         case ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX:
 515           {
 516             uword *clear_sw_if_index_bitmap = 0;
 517             uword *sw_if_index0;
 518             int clear_all = 0;
 519             now = clib_cpu_time_now ();
 520             elog_acl_maybe_trace_X1 (am,
 521                                      "acl_fa_session_cleaner_process: now %lu, received ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX",
 522                                      "i8", now);
 523             vec_foreach (sw_if_index0, event_data)
 524             {
 525               am->fa_cleaner_cnt_delete_by_sw_index++;
 526               elog_acl_maybe_trace_X1 (am,
 527                                        "acl_fa_session_cleaner_process: ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX %d",
 528                                        "i4", *sw_if_index0);
 529               if (*sw_if_index0 == ~0)
 530                 {
 531                   clear_all = 1;
 532                 }
 533               else
 534                 {
 535                   if (!pool_is_free_index
 536                       (am->vnet_main->interface_main.sw_interfaces,
 537                        *sw_if_index0))
 538                     {
 539                       clear_sw_if_index_bitmap =
 540                         clib_bitmap_set (clear_sw_if_index_bitmap,
 541                                          *sw_if_index0, 1);
 542                     }
 543                 }
 544             }
 545 #ifdef FA_NODE_VERBOSE_DEBUG
 546             clib_warning ("ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX bitmap: %U",
 547                           format_bitmap_hex, clear_sw_if_index_bitmap);
 548 #endif
 549             vec_foreach (pw0, am->per_worker_data)
 550             {
 551               CLIB_MEMORY_BARRIER ();
 552               while (pw0->clear_in_process)
 553                 {
 554                   CLIB_MEMORY_BARRIER ();
 555                   elog_acl_maybe_trace_X1 (am,
 556                                            "ACL_FA_NODE_CLEAN: waiting previous cleaning cycle to finish on %d",
 557                                            "i4",
 558                                            (u32) (pw0 - am->per_worker_data));
 559                   vlib_process_suspend (vm, 0.0001);
 560                   if (pw0->interrupt_is_needed)
 561                     {
 562                       send_one_worker_interrupt (vm, am,
 563                                                  (pw0 - am->per_worker_data));
 564                     }
 565                 }
 566               if (pw0->clear_in_process)
 567                 {
 568                   clib_warning
 569                     ("ERROR-BUG! Could not initiate cleaning on worker because another cleanup in progress");
 570                 }
 571               else
 572                 {
 573                   if (clear_all)
 574                     {
 575                       /* if we need to clear all, then just clear the interfaces that we are servicing */
 576                       pw0->pending_clear_sw_if_index_bitmap =
 577                         clib_bitmap_dup (pw0->serviced_sw_if_index_bitmap);
 578                     }
 579                   else
 580                     {
 581                       pw0->pending_clear_sw_if_index_bitmap =
 582                         clib_bitmap_dup (clear_sw_if_index_bitmap);
 583                     }
 584                   pw0->clear_in_process = 1;
 585                 }
 586             }
 587             /* send some interrupts so they can start working */
 588             send_interrupts_to_workers (vm, am);
 589
 590             /* now wait till they all complete */
 591 #ifdef FA_NODE_VERBOSE_DEBUG
 592             clib_warning ("CLEANER mains len: %d per-worker len: %d",
 593                           vec_len (vlib_mains),
 594                           vec_len (am->per_worker_data));
 595 #endif
 596             vec_foreach (pw0, am->per_worker_data)
 597             {
 598               CLIB_MEMORY_BARRIER ();
 599               while (pw0->clear_in_process)
 600                 {
 601                   CLIB_MEMORY_BARRIER ();
 602                   elog_acl_maybe_trace_X1 (am,
 603                                            "ACL_FA_NODE_CLEAN: waiting for my cleaning cycle to finish on %d",
 604                                            "i4",
 605                                            (u32) (pw0 - am->per_worker_data));
 606                   vlib_process_suspend (vm, 0.0001);
 607                   if (pw0->interrupt_is_needed)
 608                     {
 609                       send_one_worker_interrupt (vm, am,
 610                                                  (pw0 - am->per_worker_data));
 611                     }
 612                 }
 613             }
 614 #ifdef FA_NODE_VERBOSE_DEBUG
 615             clib_warning ("ACL_FA_NODE_CLEAN: cleaning done");
 616 #endif
 617             clib_bitmap_free (clear_sw_if_index_bitmap);
 618           }
 619           break;
 620         default:
 621 #ifdef FA_NODE_VERBOSE_DEBUG
 622           clib_warning ("ACL plugin connection cleaner: unknown event %u",
 623                         event_type);
 624 #endif
 625           vlib_node_increment_counter (vm,
 626                                        acl_fa_session_cleaner_process_node.
 627                                        index,
 628                                        ACL_FA_CLEANER_ERROR_UNKNOWN_EVENT, 1);
 629           am->fa_cleaner_cnt_unknown_event++;
 630           break;
 631         }
 632
 633       send_interrupts_to_workers (vm, am);
 634
 635       if (event_data)
 636         _vec_len (event_data) = 0;
 637
 638       /*
 639        * If the interrupts were not processed yet, ensure we wait a bit,
 640        * but up to a point.
 641        */
 642       int need_more_wait = 0;
 643       int max_wait_cycles = 100;
 644       do
 645         {
 646           need_more_wait = 0;
 647           vec_foreach (pw0, am->per_worker_data)
 648           {
 649             if (pw0->interrupt_generation != am->fa_interrupt_generation)
 650               {
 651                 need_more_wait = 1;
 652               }
 653           }
 654           if (need_more_wait)
 655             {
 656               vlib_process_suspend (vm, 0.0001);
 657             }
 658         }
 659       while (need_more_wait && (--max_wait_cycles > 0));
 660
 661       int interrupts_needed = 0;
 662       int interrupts_unwanted = 0;
 663
 664       vec_foreach (pw0, am->per_worker_data)
 665       {
 666         if (pw0->interrupt_is_needed)
 667           {
 668             interrupts_needed++;
 669             /* the per-worker value is reset when sending the interrupt */
 670           }
 671         if (pw0->interrupt_is_unwanted)
 672           {
 673             interrupts_unwanted++;
 674             pw0->interrupt_is_unwanted = 0;
 675           }
 676       }
 677       if (interrupts_needed)
 678         {
 679           /* they need more interrupts, do less waiting around next time */
 680           am->fa_current_cleaner_timer_wait_interval /= 2;
 681           /* never go into zero-wait either though - we need to give the space to others */
 682           am->fa_current_cleaner_timer_wait_interval += 1;
 683         }
 684       else if (interrupts_unwanted)
 685         {
 686           /* slowly increase the amount of sleep up to a limit */
 687           if (am->fa_current_cleaner_timer_wait_interval <
 688               max_timer_wait_interval)
 689             am->fa_current_cleaner_timer_wait_interval +=
 690               cpu_cps * am->fa_cleaner_wait_time_increment;
 691         }
 692       am->fa_cleaner_cnt_event_cycles++;
 693       am->fa_interrupt_generation++;
 694     }
 695   /* NOT REACHED */
 696   return 0;
 697 }
 698
 699
 700 void
 701 acl_fa_enable_disable (u32 sw_if_index, int is_input, int enable_disable)
 702 {
 703   acl_main_t *am = &acl_main;
 704   if (enable_disable)
 705     {
 706       acl_fa_verify_init_sessions (am);
 707       am->fa_total_enabled_count++;
 708       void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
 709       vlib_process_signal_event (am->vlib_main, am->fa_cleaner_node_index,
 710                                  ACL_FA_CLEANER_RESCHEDULE, 0);
 711       clib_mem_set_heap (oldheap);
 712     }
 713   else
 714     {
 715       am->fa_total_enabled_count--;
 716     }
 717
 718   if (is_input)
 719     {
 720       ASSERT (clib_bitmap_get (am->fa_in_acl_on_sw_if_index, sw_if_index) !=
 721               enable_disable);
 722       void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
 723       vnet_feature_enable_disable ("ip4-unicast", "acl-plugin-in-ip4-fa",
 724                                    sw_if_index, enable_disable, 0, 0);
 725       vnet_feature_enable_disable ("ip6-unicast", "acl-plugin-in-ip6-fa",
 726                                    sw_if_index, enable_disable, 0, 0);
 727       clib_mem_set_heap (oldheap);
 728       am->fa_in_acl_on_sw_if_index =
 729         clib_bitmap_set (am->fa_in_acl_on_sw_if_index, sw_if_index,
 730                          enable_disable);
 731     }
 732   else
 733     {
 734       ASSERT (clib_bitmap_get (am->fa_out_acl_on_sw_if_index, sw_if_index) !=
 735               enable_disable);
 736       void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
 737       vnet_feature_enable_disable ("ip4-output", "acl-plugin-out-ip4-fa",
 738                                    sw_if_index, enable_disable, 0, 0);
 739       vnet_feature_enable_disable ("ip6-output", "acl-plugin-out-ip6-fa",
 740                                    sw_if_index, enable_disable, 0, 0);
 741       clib_mem_set_heap (oldheap);
 742       am->fa_out_acl_on_sw_if_index =
 743         clib_bitmap_set (am->fa_out_acl_on_sw_if_index, sw_if_index,
 744                          enable_disable);
 745     }
 746   if ((!enable_disable) && (!acl_fa_ifc_has_in_acl (am, sw_if_index))
 747       && (!acl_fa_ifc_has_out_acl (am, sw_if_index)))
 748     {
 749 #ifdef FA_NODE_VERBOSE_DEBUG
 750       clib_warning ("ENABLE-DISABLE: clean the connections on interface %d",
 751                     sw_if_index);
 752 #endif
 753       void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
 754       vlib_process_signal_event (am->vlib_main, am->fa_cleaner_node_index,
 755                                  ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX,
 756                                  sw_if_index);
 757       clib_mem_set_heap (oldheap);
 758     }
 759 }
 760
 761 void
 762 show_fa_sessions_hash (vlib_main_t * vm, u32 verbose)
 763 {
 764   acl_main_t *am = &acl_main;
 765   if (am->fa_sessions_hash_is_initialized)
 766     {
 767       vlib_cli_output (vm, "\nSession lookup hash table:\n%U\n\n",
 768                        format_bihash_40_8, &am->fa_sessions_hash, verbose);
 769     }
 770   else
 771     {
 772       vlib_cli_output (vm,
 773                        "\nSession lookup hash table is not allocated.\n\n");
 774     }
 775 }
 776
 777
 778 /* *INDENT-OFF* */
 779
 780 VLIB_REGISTER_NODE (acl_fa_worker_session_cleaner_process_node, static) = {
 781   .function = acl_fa_worker_conn_cleaner_process,
 782   .name = "acl-plugin-fa-worker-cleaner-process",
 783   .type = VLIB_NODE_TYPE_INPUT,
 784   .state = VLIB_NODE_STATE_INTERRUPT,
 785 };
 786
 787 VLIB_REGISTER_NODE (acl_fa_session_cleaner_process_node, static) = {
 788   .function = acl_fa_session_cleaner_process,
 789   .type = VLIB_NODE_TYPE_PROCESS,
 790   .name = "acl-plugin-fa-cleaner-process",
 791   .n_errors = ARRAY_LEN (acl_fa_cleaner_error_strings),
 792   .error_strings = acl_fa_cleaner_error_strings,
 793   .n_next_nodes = 0,
 794   .next_nodes = {},
 795 };
 796
 797
 798 /* *INDENT-ON* */
 799
 800 /*
 801  * fd.io coding-style-patch-verification: ON
 802  *
 803  * Local Variables:
 804  * eval: (c-set-style "gnu")
 805  * End:
 806  */