NAT: move session and user lookup tables to per thread data (VPP-986)

Change-Id: I41a51bb36e31e05c76fef0b34fe006afbee27729
Signed-off-by: Matus Fabian <matfabia@cisco.com>

5 files changed, 151 insertions, 110 deletions

diff --git a/src/plugins/nat/in2out.c b/src/plugins/nat/in2out.c
index 9196ccbb..8b658302 100755
--- a/src/plugins/nat/in2out.c
+++ b/src/plugins/nat/in2out.c
@@ -191,7 +191,7 @@ snat_not_translate_fast (snat_main_t * sm, vlib_node_runtime_t *node,
 static inline int
 snat_not_translate (snat_main_t * sm, vlib_node_runtime_t *node,
                     u32 sw_if_index0, ip4_header_t * ip0, u32 proto0,
-                    u32 rx_fib_index0)
+                    u32 rx_fib_index0, u32 thread_index)
 {
   udp_header_t * udp0 = ip4_next_header (ip0);
   snat_session_key_t key0, sm0;
@@ -205,7 +205,8 @@ snat_not_translate (snat_main_t * sm, vlib_node_runtime_t *node,
 
   /* NAT packet aimed at external address if */
   /* has active sessions */
-  if (clib_bihash_search_8_8 (&sm->out2in, &kv0, &value0))
+  if (clib_bihash_search_8_8 (&sm->per_thread_data[thread_index].out2in, &kv0,
+                              &value0))
     {
       /* or is static mappings */
       if (!snat_static_mapping_match(sm, key0, &sm0, 1, 0))
@@ -256,7 +257,8 @@ static u32 slow_path (snat_main_t *sm, vlib_buffer_t *b0,
   kv0.key = user_key.as_u64;
 
   /* Ever heard of the "user" = src ip4 address before? */
-  if (clib_bihash_search_8_8 (&sm->user_hash, &kv0, &value0))
+  if (clib_bihash_search_8_8 (&sm->per_thread_data[thread_index].user_hash,
+                              &kv0, &value0))
     {
       /* no, make a new one */
       pool_get (sm->per_thread_data[thread_index].users, u);
@@ -275,7 +277,8 @@ static u32 slow_path (snat_main_t *sm, vlib_buffer_t *b0,
       kv0.value = u - sm->per_thread_data[thread_index].users;
 
       /* add user */
-      clib_bihash_add_del_8_8 (&sm->user_hash, &kv0, 1 /* is_add */);
+      clib_bihash_add_del_8_8 (&sm->per_thread_data[thread_index].user_hash,
+                               &kv0, 1 /* is_add */);
     }
   else
     {
@@ -339,10 +342,12 @@ static u32 slow_path (snat_main_t *sm, vlib_buffer_t *b0,
         {
           /* Remove in2out, out2in keys */
           kv0.key = s->in2out.as_u64;
-          if (clib_bihash_add_del_8_8 (&sm->in2out, &kv0, 0 /* is_add */))
+          if (clib_bihash_add_del_8_8 (&sm->per_thread_data[thread_index].in2out,
+                                       &kv0, 0 /* is_add */))
               clib_warning ("in2out key delete failed");
           kv0.key = s->out2in.as_u64;
-          if (clib_bihash_add_del_8_8 (&sm->out2in, &kv0, 0 /* is_add */))
+          if (clib_bihash_add_del_8_8 (&sm->per_thread_data[thread_index].out2in,
+                                       &kv0, 0 /* is_add */))
               clib_warning ("out2in key delete failed");
 
           /* log NAT event */
@@ -431,13 +436,15 @@ static u32 slow_path (snat_main_t *sm, vlib_buffer_t *b0,
   /* Add to translation hashes */
   kv0.key = s->in2out.as_u64;
   kv0.value = s - sm->per_thread_data[thread_index].sessions;
-  if (clib_bihash_add_del_8_8 (&sm->in2out, &kv0, 1 /* is_add */))
+  if (clib_bihash_add_del_8_8 (&sm->per_thread_data[thread_index].in2out, &kv0,
+                               1 /* is_add */))
       clib_warning ("in2out key add failed");
 
   kv0.key = s->out2in.as_u64;
   kv0.value = s - sm->per_thread_data[thread_index].sessions;
 
-  if (clib_bihash_add_del_8_8 (&sm->out2in, &kv0, 1 /* is_add */))
+  if (clib_bihash_add_del_8_8 (&sm->per_thread_data[thread_index].out2in, &kv0,
+                               1 /* is_add */))
       clib_warning ("out2in key add failed");
 
   /* Add to translated packets worker lookup */
@@ -554,10 +561,11 @@ u32 icmp_match_in2out_slow(snat_main_t *sm, vlib_node_runtime_t *node,
 
   kv0.key = key0.as_u64;
 
-  if (clib_bihash_search_8_8 (&sm->in2out, &kv0, &value0))
+  if (clib_bihash_search_8_8 (&sm->per_thread_data[thread_index].in2out, &kv0,
+                              &value0))
     {
       if (PREDICT_FALSE(snat_not_translate(sm, node, sw_if_index0, ip0,
-          IP_PROTOCOL_ICMP, rx_fib_index0) &&
+          IP_PROTOCOL_ICMP, rx_fib_index0, thread_index) &&
           vnet_buffer(b0)->sw_if_index[VLIB_TX] == ~0))
         {
           dont_translate = 1;
@@ -841,8 +849,22 @@ snat_hairpinning (snat_main_t *sm,
   key0.fib_index = sm->outside_fib_index;
   kv0.key = key0.as_u64;
 
+  if (sm->num_workers > 1)
+    {
+      k0.addr = ip0->dst_address;
+      k0.port = udp0->dst_port;
+      k0.fib_index = sm->outside_fib_index;
+      kv0.key = k0.as_u64;
+      if (clib_bihash_search_8_8 (&sm->worker_by_out, &kv0, &value0))
+        return;
+      else
+        ti = value0.value;
+    }
+  else
+    ti = sm->num_workers;
+
   /* Check if destination is in active sessions */
-  if (clib_bihash_search_8_8 (&sm->out2in, &kv0, &value0))
+  if (clib_bihash_search_8_8 (&sm->per_thread_data[ti].out2in, &kv0, &value0))
     {
       /* or static mappings */
       if (!snat_static_mapping_match(sm, key0, &sm0, 1, 0))
@@ -855,19 +877,6 @@ snat_hairpinning (snat_main_t *sm,
   else
     {
       si = value0.value;
-      if (sm->num_workers > 1)
-        {
-          k0.addr = ip0->dst_address;
-          k0.port = udp0->dst_port;
-          k0.fib_index = sm->outside_fib_index;
-          kv0.key = k0.as_u64;
-          if (clib_bihash_search_8_8 (&sm->worker_by_out, &kv0, &value0))
-            ASSERT(0);
-          else
-            ti = value0.value;
-        }
-      else
-        ti = sm->num_workers;
 
       s0 = pool_elt_at_index (sm->per_thread_data[ti].sessions, si);
       new_dst_addr0 = s0->in2out.addr.as_u32;
@@ -940,8 +949,23 @@ snat_icmp_hairpinning (snat_main_t *sm,
       key0.fib_index = sm->outside_fib_index;
       kv0.key = key0.as_u64;
 
+      if (sm->num_workers > 1)
+        {
+          k0.addr = ip0->dst_address;
+          k0.port = icmp_id0;
+          k0.fib_index = sm->outside_fib_index;
+          kv0.key = k0.as_u64;
+          if (clib_bihash_search_8_8 (&sm->worker_by_out, &kv0, &value0))
+            return;
+          else
+            ti = value0.value;
+        }
+      else
+        ti = sm->num_workers;
+
       /* Check if destination is in active sessions */
-      if (clib_bihash_search_8_8 (&sm->out2in, &kv0, &value0))
+      if (clib_bihash_search_8_8 (&sm->per_thread_data[ti].out2in, &kv0,
+                                  &value0))
         {
           /* or static mappings */
           if (!snat_static_mapping_match(sm, key0, &sm0, 1, 0))
@@ -953,19 +977,6 @@ snat_icmp_hairpinning (snat_main_t *sm,
       else
         {
           si = value0.value;
-          if (sm->num_workers > 1)
-            {
-              k0.addr = ip0->dst_address;
-              k0.port = icmp_id0;
-              k0.fib_index = sm->outside_fib_index;
-              kv0.key = k0.as_u64;
-              if (clib_bihash_search_8_8 (&sm->worker_by_out, &kv0, &value0))
-                ASSERT(0);
-              else
-                ti = value0.value;
-            }
-          else
-            ti = sm->num_workers;
 
           s0 = pool_elt_at_index (sm->per_thread_data[ti].sessions, si);
           new_dst_addr0 = s0->in2out.addr.as_u32;
@@ -1141,7 +1152,7 @@ snat_in2out_unknown_proto (snat_main_t *sm,
       kv.key = u_key.as_u64;
 
       /* Ever heard of the "user" = src ip4 address before? */
-      if (clib_bihash_search_8_8 (&sm->user_hash, &kv, &value))
+      if (clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
         {
           /* no, make a new one */
           pool_get (tsm->users, u);
@@ -1158,7 +1169,7 @@ snat_in2out_unknown_proto (snat_main_t *sm,
           kv.value = u - tsm->users;
 
           /* add user */
-          clib_bihash_add_del_8_8 (&sm->user_hash, &kv, 1);
+          clib_bihash_add_del_8_8 (&tsm->user_hash, &kv, 1);
         }
       else
         {
@@ -1183,7 +1194,7 @@ snat_in2out_unknown_proto (snat_main_t *sm,
       else
         {
           /* Choose same out address as for TCP/UDP session to same destination */
-          if (!clib_bihash_search_8_8 (&sm->user_hash, &kv, &value))
+          if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
             {
               head_index = u->sessions_per_user_list_head_index;
               head = pool_elt_at_index (tsm->list_pool, head_index);
@@ -1288,10 +1299,12 @@ create_ses:
 
               /* Remove in2out, out2in keys */
               kv.key = s->in2out.as_u64;
-              if (clib_bihash_add_del_8_8 (&sm->in2out, &kv, 0))
+              if (clib_bihash_add_del_8_8 (
+                    &sm->per_thread_data[thread_index].in2out, &kv, 0))
                 clib_warning ("in2out key del failed");
               kv.key = s->out2in.as_u64;
-              if (clib_bihash_add_del_8_8 (&sm->out2in, &kv, 0))
+              if (clib_bihash_add_del_8_8 (
+                    &sm->per_thread_data[thread_index].out2in, &kv, 0))
                 clib_warning ("out2in key del failed");
             }
         }
@@ -1424,7 +1437,7 @@ snat_in2out_lb (snat_main_t *sm,
       kv.key = u_key.as_u64;
 
       /* Ever heard of the "user" = src ip4 address before? */
-      if (clib_bihash_search_8_8 (&sm->user_hash, &kv, &value))
+      if (clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
         {
           /* no, make a new one */
           pool_get (tsm->users, u);
@@ -1441,7 +1454,7 @@ snat_in2out_lb (snat_main_t *sm,
           kv.value = u - tsm->users;
 
           /* add user */
-          if (clib_bihash_add_del_8_8 (&sm->user_hash, &kv, 1))
+          if (clib_bihash_add_del_8_8 (&tsm->user_hash, &kv, 1))
             clib_warning ("user key add failed");
         }
       else
@@ -1653,12 +1666,13 @@ snat_in2out_node_fn_inline (vlib_main_t * vm,
 
           kv0.key = key0.as_u64;
 
-          if (PREDICT_FALSE (clib_bihash_search_8_8 (&sm->in2out, &kv0, &value0) != 0))
+          if (PREDICT_FALSE (clib_bihash_search_8_8 (
+              &sm->per_thread_data[thread_index].in2out, &kv0, &value0) != 0))
             {
               if (is_slow_path)
                 {
                   if (PREDICT_FALSE(snat_not_translate(sm, node, sw_if_index0,
-                      ip0, proto0, rx_fib_index0)) && !is_output_feature)
+                      ip0, proto0, rx_fib_index0, thread_index)) && !is_output_feature)
                     goto trace00;
 
                   next0 = slow_path (sm, b0, ip0, rx_fib_index0, &key0,
@@ -1824,12 +1838,13 @@ snat_in2out_node_fn_inline (vlib_main_t * vm,
 
           kv1.key = key1.as_u64;
 
-            if (PREDICT_FALSE(clib_bihash_search_8_8 (&sm->in2out, &kv1, &value1) != 0))
+            if (PREDICT_FALSE(clib_bihash_search_8_8 (
+                &sm->per_thread_data[thread_index].in2out, &kv1, &value1) != 0))
             {
               if (is_slow_path)
                 {
                   if (PREDICT_FALSE(snat_not_translate(sm, node, sw_if_index1,
-                      ip1, proto1, rx_fib_index1)) && !is_output_feature)
+                      ip1, proto1, rx_fib_index1, thread_index)) && !is_output_feature)
                     goto trace01;
 
                   next1 = slow_path (sm, b1, ip1, rx_fib_index1, &key1,
@@ -2031,12 +2046,13 @@ snat_in2out_node_fn_inline (vlib_main_t * vm,
 
           kv0.key = key0.as_u64;
 
-          if (clib_bihash_search_8_8 (&sm->in2out, &kv0, &value0))
+          if (clib_bihash_search_8_8 (&sm->per_thread_data[thread_index].in2out,
+                                      &kv0, &value0))
             {
               if (is_slow_path)
                 {
                   if (PREDICT_FALSE(snat_not_translate(sm, node, sw_if_index0,
-                      ip0, proto0, rx_fib_index0)) && !is_output_feature)
+                      ip0, proto0, rx_fib_index0, thread_index)) && !is_output_feature)
                     goto trace0;
 
                   next0 = slow_path (sm, b0, ip0, rx_fib_index0, &key0,
diff --git a/src/plugins/nat/nat.c b/src/plugins/nat/nat.c
index 36b72664..876b6aad 100644
--- a/src/plugins/nat/nat.c
+++ b/src/plugins/nat/nat.c
@@ -483,13 +483,13 @@ int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
           u_key.addr = m->local_addr;
           u_key.fib_index = m->fib_index;
           kv.key = u_key.as_u64;
-          if (!clib_bihash_search_8_8 (&sm->user_hash, &kv, &value))
+          if (!clib_bihash_search_8_8 (&sm->worker_by_in, &kv, &value))
+            tsm = vec_elt_at_index (sm->per_thread_data, value.value);
+          else
+            tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
+          if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
             {
               user_index = value.value;
-              if (!clib_bihash_search_8_8 (&sm->worker_by_in, &kv, &value))
-                tsm = vec_elt_at_index (sm->per_thread_data, value.value);
-              else
-                tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
               u = pool_elt_at_index (tsm->users, user_index);
               if (u->nstaticsessions)
                 {
@@ -548,10 +548,10 @@ int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
                                                           s->in2out.fib_index);
 
                       value.key = s->in2out.as_u64;
-                      if (clib_bihash_add_del_8_8 (&sm->in2out, &value, 0))
+                      if (clib_bihash_add_del_8_8 (&tsm->in2out, &value, 0))
                         clib_warning ("in2out key del failed");
                       value.key = s->out2in.as_u64;
-                      if (clib_bihash_add_del_8_8 (&sm->out2in, &value, 0))
+                      if (clib_bihash_add_del_8_8 (&tsm->out2in, &value, 0))
                         clib_warning ("out2in key del failed");
 delete:
                       pool_put (tsm->sessions, s);
@@ -566,7 +566,7 @@ delete:
                   if (addr_only)
                     {
                       pool_put (tsm->users, u);
-                      clib_bihash_add_del_8_8 (&sm->user_hash, &kv, 0);
+                      clib_bihash_add_del_8_8 (&tsm->user_hash, &kv, 0);
                     }
                 }
             }
@@ -615,6 +615,7 @@ int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
   snat_user_key_t w_key0;
   snat_worker_key_t w_key1;
   u32 worker_index = 0;
+  snat_main_per_thread_data_t *tsm;
 
   m_key.addr = e_addr;
   m_key.port = e_port;
@@ -695,16 +696,6 @@ int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
           clib_warning ("static_mapping_by_external key add failed");
           return VNET_API_ERROR_UNSPECIFIED;
         }
-      m_key.port = clib_host_to_net_u16 (m->external_port);
-      kv.key = m_key.as_u64;
-      kv.value = ~0ULL;
-      if (clib_bihash_add_del_8_8(&sm->out2in, &kv, 1))
-        {
-          clib_warning ("static_mapping_by_local key add failed");
-          return VNET_API_ERROR_UNSPECIFIED;
-        }
-
-      m_key.fib_index = m->fib_index;
 
       /* Assign worker */
       if (sm->workers)
@@ -729,8 +720,21 @@ int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
               clib_warning ("worker-by-out add key failed");
               return VNET_API_ERROR_UNSPECIFIED;
             }
+          tsm = vec_elt_at_index (sm->per_thread_data, worker_index);
+        }
+      else
+        tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
+
+      m_key.port = clib_host_to_net_u16 (m->external_port);
+      kv.key = m_key.as_u64;
+      kv.value = ~0ULL;
+      if (clib_bihash_add_del_8_8(&tsm->out2in, &kv, 1))
+        {
+          clib_warning ("static_mapping_by_local key add failed");
+          return VNET_API_ERROR_UNSPECIFIED;
         }
 
+      m_key.fib_index = m->fib_index;
       for (i = 0; i < vec_len (locals); i++)
         {
           m_key.addr = locals[i].addr;
@@ -744,7 +748,7 @@ int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
           m_key.port = clib_host_to_net_u16 (locals[i].port);
           kv.key = m_key.as_u64;
           kv.value = ~0ULL;
-          if (clib_bihash_add_del_8_8(&sm->in2out, &kv, 1))
+          if (clib_bihash_add_del_8_8(&tsm->in2out, &kv, 1))
             {
               clib_warning ("in2out key add failed");
               return VNET_API_ERROR_UNSPECIFIED;
@@ -801,6 +805,15 @@ int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
             }
         }
 
+      w_key1.addr = m->external_addr;
+      w_key1.port = clib_host_to_net_u16 (m->external_port);
+      w_key1.fib_index = sm->outside_fib_index;
+      kv.key = w_key1.as_u64;
+      if (!clib_bihash_search_8_8 (&sm->worker_by_out, &kv, &value))
+        tsm = vec_elt_at_index (sm->per_thread_data, value.value);
+      else
+        tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
+
       m_key.addr = m->external_addr;
       m_key.port = m->external_port;
       m_key.protocol = m->proto;
@@ -813,7 +826,7 @@ int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
         }
       m_key.port = clib_host_to_net_u16 (m->external_port);
       kv.key = m_key.as_u64;
-      if (clib_bihash_add_del_8_8(&sm->out2in, &kv, 0))
+      if (clib_bihash_add_del_8_8(&tsm->out2in, &kv, 0))
         {
           clib_warning ("outi2in key del failed");
           return VNET_API_ERROR_UNSPECIFIED;
@@ -832,7 +845,7 @@ int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
             }
           m_key.port = clib_host_to_net_u16 (local->port);
           kv.key = m_key.as_u64;
-          if (clib_bihash_add_del_8_8(&sm->in2out, &kv, 0))
+          if (clib_bihash_add_del_8_8(&tsm->in2out, &kv, 0))
             {
               clib_warning ("in2out key del failed");
               return VNET_API_ERROR_UNSPECIFIED;
@@ -938,16 +951,16 @@ int snat_del_address (snat_main_t *sm, ip4_address_t addr, u8 delete_sm)
                                                         ses->out2in.port,
                                                         ses->in2out.fib_index);
                     kv.key = ses->in2out.as_u64;
-                    clib_bihash_add_del_8_8 (&sm->in2out, &kv, 0);
+                    clib_bihash_add_del_8_8 (&tsm->in2out, &kv, 0);
                     kv.key = ses->out2in.as_u64;
-                    clib_bihash_add_del_8_8 (&sm->out2in, &kv, 0);
+                    clib_bihash_add_del_8_8 (&tsm->out2in, &kv, 0);
                   }
                 vec_add1 (ses_to_be_removed, ses - tsm->sessions);
                 clib_dlist_remove (tsm->list_pool, ses->per_user_index);
                 user_key.addr = ses->in2out.addr;
                 user_key.fib_index = ses->in2out.fib_index;
                 kv.key = user_key.as_u64;
-                if (!clib_bihash_search_8_8 (&sm->user_hash, &kv, &value))
+                if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
                   {
                     u = pool_elt_at_index (tsm->users, value.value);
                     u->nsessions--;
@@ -2130,6 +2143,7 @@ snat_config (vlib_main_t * vm, unformat_input_t * input)
   u32 static_mapping_memory_size = 64<<20;
   u8 static_mapping_only = 0;
   u8 static_mapping_connection_tracking = 0;
+  snat_main_per_thread_data_t *tsm;
 
   sm->deterministic = 0;
 
@@ -2204,21 +2218,24 @@ snat_config (vlib_main_t * vm, unformat_input_t * input)
           sm->icmp_match_in2out_cb = icmp_match_in2out_slow;
           sm->icmp_match_out2in_cb = icmp_match_out2in_slow;
 
-          clib_bihash_init_8_8 (&sm->worker_by_in, "worker-by-in", user_buckets,
-                                user_memory_size);
-
-          clib_bihash_init_8_8 (&sm->worker_by_out, "worker-by-out", user_buckets,
-                                user_memory_size);
+          vec_foreach (tsm, sm->per_thread_data)
+            {
+              clib_bihash_init_8_8 (&tsm->in2out, "in2out", translation_buckets,
+                                    translation_memory_size);
 
-          clib_bihash_init_8_8 (&sm->in2out, "in2out", translation_buckets,
-                                translation_memory_size);
+              clib_bihash_init_8_8 (&tsm->out2in, "out2in", translation_buckets,
+                                    translation_memory_size);
 
-          clib_bihash_init_8_8 (&sm->out2in, "out2in", translation_buckets,
-                                translation_memory_size);
+              clib_bihash_init_8_8 (&tsm->user_hash, "users", user_buckets,
+                                    user_memory_size);
+            }
 
-          clib_bihash_init_8_8 (&sm->user_hash, "users", user_buckets,
+          clib_bihash_init_8_8 (&sm->worker_by_in, "worker-by-in", user_buckets,
                                 user_memory_size);
 
+          clib_bihash_init_8_8 (&sm->worker_by_out, "worker-by-out",
+                                translation_buckets, translation_memory_size);
+
           clib_bihash_init_16_8 (&sm->in2out_ed, "in2out-ed",
                                  translation_buckets, translation_memory_size);
 
@@ -2595,10 +2612,6 @@ show_snat_command_fn (vlib_main_t * vm,
 
           if (verbose > 0)
             {
-              vlib_cli_output (vm, "%U", format_bihash_8_8, &sm->in2out,
-                               verbose - 1);
-              vlib_cli_output (vm, "%U", format_bihash_8_8, &sm->out2in,
-                               verbose - 1);
               vlib_cli_output (vm, "%U", format_bihash_16_8, &sm->in2out_ed,
                                verbose - 1);
               vlib_cli_output (vm, "%U", format_bihash_16_8, &sm->out2in_ed,
@@ -2617,6 +2630,10 @@ show_snat_command_fn (vlib_main_t * vm,
                   vlib_worker_thread_t *w = vlib_worker_threads + j;
                   vlib_cli_output (vm, "Thread %d (%s at lcore %u):", j, w->name,
                                    w->lcore_id);
+                  vlib_cli_output (vm, "  %U", format_bihash_8_8, &tsm->in2out,
+                                   verbose - 1);
+                  vlib_cli_output (vm, "  %U", format_bihash_8_8, &tsm->out2in,
+                                   verbose - 1);
                   vlib_cli_output (vm, "  %d list pool elements",
                                    pool_elts (tsm->list_pool));
 
diff --git a/src/plugins/nat/nat.h b/src/plugins/nat/nat.h
index d1ba5d55..f970821b 100644
--- a/src/plugins/nat/nat.h
+++ b/src/plugins/nat/nat.h
@@ -244,6 +244,13 @@ typedef struct {
 } snat_static_map_resolve_t;
 
 typedef struct {
+  /* Main lookup tables */
+  clib_bihash_8_8_t out2in;
+  clib_bihash_8_8_t in2out;
+
+  /* Find-a-user => src address lookup */
+  clib_bihash_8_8_t user_hash;
+
   /* User pool */
   snat_user_t * users;
 
@@ -271,17 +278,10 @@ typedef u32 snat_icmp_match_function_t (struct snat_main_s *sm,
 typedef u32 (snat_get_worker_function_t) (ip4_header_t * ip, u32 rx_fib_index);
 
 typedef struct snat_main_s {
-  /* Main lookup tables */
-  clib_bihash_8_8_t out2in;
-  clib_bihash_8_8_t in2out;
-
   /* Endpoint address dependent sessions lookup tables */
   clib_bihash_16_8_t out2in_ed;
   clib_bihash_16_8_t in2out_ed;
 
-  /* Find-a-user => src address lookup */
-  clib_bihash_8_8_t user_hash;
-
   /* Non-translated packets worker lookup => src address + VRF */
   clib_bihash_8_8_t worker_by_in;
 
diff --git a/src/plugins/nat/nat_api.c b/src/plugins/nat/nat_api.c
index fa20f2cc..50b4a9ae 100644
--- a/src/plugins/nat/nat_api.c
+++ b/src/plugins/nat/nat_api.c
@@ -870,7 +870,7 @@ static void
     tsm = vec_elt_at_index (sm->per_thread_data, value.value);
   else
     tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
-  if (clib_bihash_search_8_8 (&sm->user_hash, &key, &value))
+  if (clib_bihash_search_8_8 (&tsm->user_hash, &key, &value))
     return;
   u = pool_elt_at_index (tsm->users, value.value);
   if (!u->nsessions && !u->nstaticsessions)
@@ -2105,7 +2105,7 @@ vl_api_nat44_user_session_dump_t_handler (vl_api_nat44_user_session_dump_t *
     tsm = vec_elt_at_index (sm->per_thread_data, value.value);
   else
     tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
-  if (clib_bihash_search_8_8 (&sm->user_hash, &key, &value))
+  if (clib_bihash_search_8_8 (&tsm->user_hash, &key, &value))
     return;
   u = pool_elt_at_index (tsm->users, value.value);
   if (!u->nsessions && !u->nstaticsessions)
diff --git a/src/plugins/nat/out2in.c b/src/plugins/nat/out2in.c
index 52adc8a8..6472e7ff 100755
--- a/src/plugins/nat/out2in.c
+++ b/src/plugins/nat/out2in.c
@@ -146,7 +146,8 @@ create_session_for_static_mapping (snat_main_t *sm,
   kv0.key = user_key.as_u64;
 
   /* Ever heard of the "user" = inside ip4 address before? */
-  if (clib_bihash_search_8_8 (&sm->user_hash, &kv0, &value0))
+  if (clib_bihash_search_8_8 (&sm->per_thread_data[thread_index].user_hash,
+                              &kv0, &value0))
     {
       /* no, make a new one */
       pool_get (sm->per_thread_data[thread_index].users, u);
@@ -166,7 +167,8 @@ create_session_for_static_mapping (snat_main_t *sm,
       kv0.value = u - sm->per_thread_data[thread_index].users;
 
       /* add user */
-      clib_bihash_add_del_8_8 (&sm->user_hash, &kv0, 1 /* is_add */);
+      clib_bihash_add_del_8_8 (&sm->per_thread_data[thread_index].user_hash,
+                               &kv0, 1 /* is_add */);
 
       /* add non-traslated packets worker lookup */
       kv0.value = thread_index;
@@ -211,13 +213,15 @@ create_session_for_static_mapping (snat_main_t *sm,
   /* Add to translation hashes */
   kv0.key = s->in2out.as_u64;
   kv0.value = s - sm->per_thread_data[thread_index].sessions;
-  if (clib_bihash_add_del_8_8 (&sm->in2out, &kv0, 1 /* is_add */))
+  if (clib_bihash_add_del_8_8 (&sm->per_thread_data[thread_index].in2out, &kv0,
+                               1 /* is_add */))
       clib_warning ("in2out key add failed");
 
   kv0.key = s->out2in.as_u64;
   kv0.value = s - sm->per_thread_data[thread_index].sessions;
 
-  if (clib_bihash_add_del_8_8 (&sm->out2in, &kv0, 1 /* is_add */))
+  if (clib_bihash_add_del_8_8 (&sm->per_thread_data[thread_index].out2in, &kv0,
+                               1 /* is_add */))
       clib_warning ("out2in key add failed");
 
   /* log NAT event */
@@ -325,7 +329,8 @@ u32 icmp_match_out2in_slow(snat_main_t *sm, vlib_node_runtime_t *node,
 
   kv0.key = key0.as_u64;
 
-  if (clib_bihash_search_8_8 (&sm->out2in, &kv0, &value0))
+  if (clib_bihash_search_8_8 (&sm->per_thread_data[thread_index].out2in, &kv0,
+                              &value0))
     {
       /* Try to match static mapping by external address and port,
          destination address and port in packet */
@@ -672,7 +677,7 @@ snat_out2in_unknown_proto (snat_main_t *sm,
       kv.key = u_key.as_u64;
 
       /* Ever heard of the "user" = src ip4 address before? */
-      if (clib_bihash_search_8_8 (&sm->user_hash, &kv, &value))
+      if (clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
         {
           /* no, make a new one */
           pool_get (tsm->users, u);
@@ -689,7 +694,7 @@ snat_out2in_unknown_proto (snat_main_t *sm,
           kv.value = u - tsm->users;
 
           /* add user */
-          clib_bihash_add_del_8_8 (&sm->user_hash, &kv, 1);
+          clib_bihash_add_del_8_8 (&tsm->user_hash, &kv, 1);
         }
       else
         {
@@ -804,7 +809,7 @@ snat_out2in_lb (snat_main_t *sm,
       kv.key = u_key.as_u64;
 
       /* Ever heard of the "user" = src ip4 address before? */
-      if (clib_bihash_search_8_8 (&sm->user_hash, &kv, &value))
+      if (clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
         {
           /* no, make a new one */
           pool_get (tsm->users, u);
@@ -821,7 +826,7 @@ snat_out2in_lb (snat_main_t *sm,
           kv.value = u - tsm->users;
 
           /* add user */
-          if (clib_bihash_add_del_8_8 (&sm->user_hash, &kv, 1))
+          if (clib_bihash_add_del_8_8 (&tsm->user_hash, &kv, 1))
             clib_warning ("user key add failed");
         }
       else
@@ -1013,7 +1018,8 @@ snat_out2in_node_fn (vlib_main_t * vm,
 
           kv0.key = key0.as_u64;
 
-          if (clib_bihash_search_8_8 (&sm->out2in, &kv0, &value0))
+          if (clib_bihash_search_8_8 (&sm->per_thread_data[thread_index].out2in,
+                                      &kv0, &value0))
             {
               /* Try to match static mapping by external address and port,
                  destination address and port in packet */
@@ -1164,7 +1170,8 @@ snat_out2in_node_fn (vlib_main_t * vm,
 
           kv1.key = key1.as_u64;
 
-          if (clib_bihash_search_8_8 (&sm->out2in, &kv1, &value1))
+          if (clib_bihash_search_8_8 (&sm->per_thread_data[thread_index].out2in,
+                                      &kv1, &value1))
             {
               /* Try to match static mapping by external address and port,
                  destination address and port in packet */
@@ -1351,7 +1358,8 @@ snat_out2in_node_fn (vlib_main_t * vm,
 
           kv0.key = key0.as_u64;
 
-          if (clib_bihash_search_8_8 (&sm->out2in, &kv0, &value0))
+          if (clib_bihash_search_8_8 (&sm->per_thread_data[thread_index].out2in,
+                                      &kv0, &value0))
             {
               /* Try to match static mapping by external address and port,
                  destination address and port in packet */