grpc 1.81.1 → 1.85.0

data/src/core/server/xds_server_config_fetcher.cc

@@ -16,12 +16,13 @@
 //
 //
 
+#include "src/core/server/xds_server_config_fetcher.h"
+
 #include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/slice.h>
 #include <grpc/status.h>
-#include <grpc/support/port_platform.h>
 #include <string.h>
 
 #include <algorithm>
@@ -67,6 +68,7 @@
 #include "src/core/util/sync.h"
 #include "src/core/util/unique_type_name.h"
 #include "src/core/util/uri.h"
+#include "src/core/xds/grpc/blackboard.h"
 #include "src/core/xds/grpc/certificate_provider_store.h"
 #include "src/core/xds/grpc/xds_bootstrap_grpc.h"
 #include "src/core/xds/grpc/xds_certificate_provider.h"
@@ -96,15 +98,40 @@ namespace {
 
 using ReadDelayHandle = XdsClient::ReadDelayHandle;
 
+// Some common fields needed by most of the objects below.  Refactored
+// into a separate struct with its own ref-count to simplify lock
+// annotations and save a bit of memory.
+struct FetcherState final : public RefCounted<FetcherState> {
+  RefCountedPtr<GrpcXdsClient> xds_client;
+  RefCountedPtr<XdsResourceNameGenerator> resource_name_generator;
+  WorkSerializer work_serializer;
+
+  FetcherState(
+      RefCountedPtr<GrpcXdsClient> xds_client_in,
+      RefCountedPtr<XdsResourceNameGenerator> resource_name_generator_in)
+      : xds_client(std::move(xds_client_in)),
+        resource_name_generator(std::move(resource_name_generator_in)),
+        work_serializer(
+            grpc_event_engine::experimental::GetDefaultEventEngine()) {
+    GRPC_CHECK(xds_client != nullptr);
+  }
+
+  ~FetcherState() override {
+    xds_client.reset(DEBUG_LOCATION, "XdsServerConfigFetcher");
+  }
+};
+
 // A server config fetcher that fetches the information for configuring server
 // listeners from the xDS control plane.
 class XdsServerConfigFetcher final : public ServerConfigFetcher {
  public:
-  XdsServerConfigFetcher(RefCountedPtr<GrpcXdsClient> xds_client,
-                         grpc_server_xds_status_notifier notifier);
+  XdsServerConfigFetcher(
+      RefCountedPtr<GrpcXdsClient> xds_client,
+      grpc_server_xds_status_notifier notifier,
+      RefCountedPtr<XdsResourceNameGenerator> resource_name_generator);
 
   ~XdsServerConfigFetcher() override {
-    xds_client_.reset(DEBUG_LOCATION, "XdsServerConfigFetcher");
+    fetcher_state_.reset(DEBUG_LOCATION, "XdsServerConfigFetcher");
   }
 
   void StartWatch(
@@ -115,40 +142,39 @@ class XdsServerConfigFetcher final : public ServerConfigFetcher {
 
   // Return the interested parties from the xds client so that it can be polled.
   grpc_pollset_set* interested_parties() override {
-    return xds_client_->interested_parties();
+    return fetcher_state_->xds_client->interested_parties();
   }
 
  private:
   class ListenerWatcher;
 
-  RefCountedPtr<GrpcXdsClient> xds_client_;
+  RefCountedPtr<FetcherState> fetcher_state_;
   const grpc_server_xds_status_notifier serving_status_notifier_;
-  Mutex mu_;
   std::map<ServerConfigFetcher::WatcherInterface*, ListenerWatcher*>
-      listener_watchers_ ABSL_GUARDED_BY(mu_);
+      listener_watchers_ ABSL_GUARDED_BY(&FetcherState::work_serializer);
 };
 
 // A watcher implementation for listening on LDS updates from the xDS control
 // plane. When a good LDS update is received, it creates a
-// FilterChainMatchManager object that would replace the existing (if any)
-// FilterChainMatchManager object after all referenced RDS resources are
+// XdsConnectionManager object that would replace the existing (if any)
+// XdsConnectionManager object after all referenced RDS resources are
 // fetched. Note that a good update also causes the server listener to start
 // listening if it isn't already. If an error LDS update is received (NACKed
-// resource, timeouts), the previous good FilterChainMatchManager, if any,
+// resource, timeouts), the previous good XdsConnectionManager, if any,
 // continues to be used. If there isn't any previous good update or if the
 // update received was a fatal error (resource does not exist), the server
 // listener is made to stop listening.
 class XdsServerConfigFetcher::ListenerWatcher final
     : public XdsListenerResourceType::WatcherInterface {
  public:
-  ListenerWatcher(RefCountedPtr<GrpcXdsClient> xds_client,
+  ListenerWatcher(RefCountedPtr<FetcherState> fetcher_state,
                   std::unique_ptr<ServerConfigFetcher::WatcherInterface>
                       server_config_watcher,
                   grpc_server_xds_status_notifier serving_status_notifier,
                   std::string listening_address);
 
   ~ListenerWatcher() override {
-    xds_client_.reset(DEBUG_LOCATION, "ListenerWatcher");
+    fetcher_state_.reset(DEBUG_LOCATION, "ListenerWatcher");
   }
 
   void OnResourceChanged(
@@ -161,34 +187,34 @@ class XdsServerConfigFetcher::ListenerWatcher final
 
   const std::string& listening_address() const { return listening_address_; }
 
+  std::string ResourceName() const;
+
  private:
-  class FilterChainMatchManager;
-
-  void OnFatalError(absl::Status status) ABSL_EXCLUSIVE_LOCKS_REQUIRED(mu_);
-
-  // Invoked by FilterChainMatchManager that is done fetching all referenced RDS
-  // resources. If the calling FilterChainMatchManager is the
-  // pending_filter_chain_match_manager_, it is promoted to be the
-  // filter_chain_match_manager_ in use.
-  void PendingFilterChainMatchManagerReady(
-      FilterChainMatchManager* filter_chain_match_manager) {
-    MutexLock lock(&mu_);
-    PendingFilterChainMatchManagerReadyLocked(filter_chain_match_manager);
-  }
-  void PendingFilterChainMatchManagerReadyLocked(
-      FilterChainMatchManager* filter_chain_match_manager)
-      ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_);
+  class XdsConnectionManager;
+
+  void OnFatalError(absl::Status status)
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(&FetcherState::work_serializer);
+
+  // Invoked by XdsConnectionManager that is done fetching all referenced RDS
+  // resources. If the calling XdsConnectionManager is the
+  // pending_connection_manager_, it is promoted to be the
+  // connection_manager_ in use.
+  void MaybeUpdateConnectionManager(XdsConnectionManager* connection_manager)
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(&FetcherState::work_serializer);
 
-  RefCountedPtr<GrpcXdsClient> xds_client_;
+  RefCountedPtr<FetcherState> fetcher_state_;
   const std::unique_ptr<ServerConfigFetcher::WatcherInterface>
       server_config_watcher_;
   const grpc_server_xds_status_notifier serving_status_notifier_;
   const std::string listening_address_;
-  Mutex mu_;
-  RefCountedPtr<FilterChainMatchManager> filter_chain_match_manager_
-      ABSL_GUARDED_BY(mu_);
-  RefCountedPtr<FilterChainMatchManager> pending_filter_chain_match_manager_
-      ABSL_GUARDED_BY(mu_);
+
+  RefCountedPtr<XdsConnectionManager> connection_manager_
+      ABSL_GUARDED_BY(&FetcherState::work_serializer);
+  RefCountedPtr<XdsConnectionManager> pending_connection_manager_
+      ABSL_GUARDED_BY(&FetcherState::work_serializer);
+
+  RefCountedPtr<Blackboard> blackboard_
+      ABSL_GUARDED_BY(&FetcherState::work_serializer);
 };
 
 // A connection manager used by the server listener code to inject channel args
@@ -196,164 +222,201 @@ class XdsServerConfigFetcher::ListenerWatcher final
 // appropriate filter chain from the xDS Listener resource and injects channel
 // args that configure the right mTLS certs and cause the right set of HTTP
 // filters to be injected.
-class XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager final
+class XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager final
     : public ServerConfigFetcher::ConnectionManager {
  public:
-  FilterChainMatchManager(
-      RefCountedPtr<GrpcXdsClient> xds_client,
-      XdsListenerResource::FilterChainMap filter_chain_map,
-      std::optional<XdsListenerResource::FilterChainData> default_filter_chain);
+  XdsConnectionManager(
+      RefCountedPtr<FetcherState> fetcher_state,
+      std::shared_ptr<const XdsListenerResource> listener_resource,
+      RefCountedPtr<ListenerWatcher> listener_watcher);
 
-  ~FilterChainMatchManager() override {
-    xds_client_.reset(DEBUG_LOCATION, "FilterChainMatchManager");
+  ~XdsConnectionManager() override {
+    fetcher_state_.reset(DEBUG_LOCATION, "XdsConnectionManager");
   }
 
+  void Start() ABSL_EXCLUSIVE_LOCKS_REQUIRED(&FetcherState::work_serializer);
+
   absl::StatusOr<ChannelArgs> UpdateChannelArgsForConnection(
       const ChannelArgs& args, grpc_endpoint* tcp) override;
 
-  // Invoked by ListenerWatcher to start fetching referenced RDS resources.
-  void StartRdsWatch(RefCountedPtr<ListenerWatcher> listener_watcher)
-      ABSL_EXCLUSIVE_LOCKS_REQUIRED(&ListenerWatcher::mu_);
-
-  const XdsListenerResource::FilterChainMap& filter_chain_map() const {
-    return filter_chain_map_;
-  }
-
-  const std::optional<XdsListenerResource::FilterChainData>&
-  default_filter_chain() const {
-    return default_filter_chain_;
+  const XdsListenerResource& listener_resource() const {
+    return *listener_resource_;
   }
 
  private:
-  class RouteConfigWatcher;
-  struct RdsUpdateState {
-    RouteConfigWatcher* watcher;
-    std::optional<absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>>>
-        rds_update;
-  };
-
-  class XdsServerConfigSelector;
-  class StaticXdsServerConfigSelectorProvider;
-  class DynamicXdsServerConfigSelectorProvider;
+  class L4FilterChain;
 
-  absl::StatusOr<RefCountedPtr<XdsCertificateProvider>>
-  CreateOrGetXdsCertificateProviderFromFilterChainData(
-      const XdsListenerResource::FilterChainData* filter_chain);
   void Orphaned() override;
 
-  // Helper functions invoked by RouteConfigWatcher when there are updates to
-  // RDS resources.
-  void OnRouteConfigChanged(
-      const std::string& resource_name,
-      absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>>
-          route_config);
-  void OnAmbientError(const std::string& resource_name, absl::Status status);
+  // Checks if all L4FilterChains have their RouteConfig.  If so,
+  // promotes this XdsConnectionManager to be the current one.
+  void MaybeUpdateConnectionManager()
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(&FetcherState::work_serializer);
 
   // Executes cb once for each unique filter chain object in the LDS resource.
   void ForEachFilterChain(
-      absl::FunctionRef<void(XdsListenerResource::FilterChainData&)> cb);
+      absl::FunctionRef<void(const XdsListenerResource::FilterChainData&)> cb)
+      const;
 
-  RefCountedPtr<GrpcXdsClient> xds_client_;
-  // This ref is only kept around till the FilterChainMatchManager becomes
-  // ready.
-  RefCountedPtr<ListenerWatcher> listener_watcher_;
-  // TODO(roth): Consider holding a ref to the LDS resource and storing
-  // a pointer to the filter chain data within that LDS resource, rather
-  // than copying the filter chain data here.
-  XdsListenerResource::FilterChainMap filter_chain_map_;
-  std::optional<XdsListenerResource::FilterChainData> default_filter_chain_;
-  Mutex mu_;
-  size_t rds_resources_yet_to_fetch_ ABSL_GUARDED_BY(mu_) = 0;
-  std::map<std::string /* resource_name */, RdsUpdateState> rds_map_
-      ABSL_GUARDED_BY(mu_);
+  RefCountedPtr<FetcherState> fetcher_state_;
+
+  std::shared_ptr<const XdsListenerResource> listener_resource_;
+
+  // TODO(roth): Consider refactoring the FilterChainMap data structure
+  // such that we construct it here rather than at config parsing time,
+  // so that we don't need to maintain two different data structures
+  // here (first we find the FilterChainData object in FilterChainMap,
+  // and then we look up that FilterChainData object in this map).
   std::map<const XdsListenerResource::FilterChainData*,
-           RefCountedPtr<XdsCertificateProvider>>
-      certificate_providers_map_ ABSL_GUARDED_BY(mu_);
+           OrphanablePtr<L4FilterChain>>
+      l4_filter_chains_;
+
+  // This ref is only kept around until the XdsConnectionManager becomes
+  // ready.
+  RefCountedPtr<ListenerWatcher> listener_watcher_
+      ABSL_GUARDED_BY(&FetcherState::work_serializer);
+
+  RefCountedPtr<Blackboard> blackboard_
+      ABSL_GUARDED_BY(&FetcherState::work_serializer);
 };
 
-// A watcher implementation for listening on RDS updates referenced to by a
-// FilterChainMatchManager object. After all referenced RDS resources are
-// fetched (errors are allowed), the FilterChainMatchManager tries to replace
-// the current object. The watcher continues to update the referenced RDS
-// resources so that new XdsServerConfigSelectorProvider objects are created
-// with the latest updates and new connections do not need to wait for the RDS
-// resources to be fetched.
-class XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    RouteConfigWatcher final
-    : public XdsRouteConfigResourceType::WatcherInterface {
+class XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::
+    L4FilterChain final : public InternallyRefCounted<L4FilterChain> {
  public:
-  RouteConfigWatcher(
-      std::string resource_name,
-      WeakRefCountedPtr<FilterChainMatchManager> filter_chain_match_manager)
-      : resource_name_(std::move(resource_name)),
-        filter_chain_match_manager_(std::move(filter_chain_match_manager)) {}
+  L4FilterChain(RefCountedPtr<FetcherState> fetcher_state,
+                WeakRefCountedPtr<XdsConnectionManager> connection_manager,
+                const XdsListenerResource::FilterChainData& filter_chain_data);
 
-  void OnResourceChanged(
+  void Orphan() override
+      // Always called within WorkSerializer, but the compiler can't tell.
+      ABSL_NO_THREAD_SAFETY_ANALYSIS;
+
+  bool HasRouteConfig() const
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(&FetcherState::work_serializer) {
+    return config_selector_provider_ != nullptr;
+  }
+
+  absl::StatusOr<ChannelArgs> UpdateChannelArgsForConnection(
+      const ChannelArgs& args) const;
+
+ private:
+  class XdsServerConfigSelector;
+  class XdsServerConfigSelectorProvider;
+  class RouteConfigWatcher;
+
+  void OnRouteConfigChanged(
       absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>>
-          route_config,
-      RefCountedPtr<ReadDelayHandle> /* read_delay_handle */) override {
-    filter_chain_match_manager_->OnRouteConfigChanged(resource_name_,
-                                                      std::move(route_config));
+          route_config)
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(&FetcherState::work_serializer);
+  void OnAmbientError(absl::Status status)
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(&FetcherState::work_serializer);
+
+  void UpdateServerConfigSelector(
+      absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>>
+          route_config)
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(&FetcherState::work_serializer);
+
+  absl::StatusOr<RefCountedPtr<ServerConfigSelector>>
+  CreateServerConfigSelector(
+      absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>>
+          route_config)
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(&FetcherState::work_serializer);
+
+  RefCountedPtr<FetcherState> fetcher_state_;
+  WeakRefCountedPtr<XdsConnectionManager> connection_manager_;
+
+  // Reference into data owned by XdsConnectionManager.
+  const XdsListenerResource::FilterChainData& filter_chain_data_;
+
+  absl::StatusOr<RefCountedPtr<XdsCertificateProvider>> certificate_provider_;
+
+  RouteConfigWatcher* watcher_ = nullptr;
+
+  // Will be null until we get the initial RouteConfiguration.
+  //
+  // The lock annotation here is a little misleading: this is actually
+  // set only once inside of the WorkSerializer, but after that it gets
+  // accessed from outside of the WorkSerializer.  We use the lock
+  // annotation just to make sure we don't accidentally modify this
+  // field anywhere else in the future, and we inhibit the lock
+  // annotation for the known-safe read from outside of the WorkSerializer.
+  RefCountedPtr<XdsServerConfigSelectorProvider> config_selector_provider_
+      ABSL_GUARDED_BY(&FetcherState::work_serializer);
+};
+
+using FilterInstance =
+    std::pair<const XdsHttpFilterFactory*, RefCountedPtr<const FilterConfig>>;
+
+struct FilterList final : public FilterChain {
+  std::vector<FilterInstance> filters;
+};
+
+class FilterListBuilder final
+    : public XdsRouting::RouteConfigFilterChainBuilder::XdsFilterChainBuilder {
+ public:
+  void AddFilter(const XdsHttpFilterFactory* factory,
+                 RefCountedPtr<const FilterConfig> config) override {
+    if (filters_ == nullptr) filters_ = MakeRefCounted<FilterList>();
+    filters_->filters.emplace_back(factory, std::move(config));
   }
 
-  void OnAmbientError(
-      absl::Status status,
-      RefCountedPtr<ReadDelayHandle> /* read_delay_handle */) override {
-    filter_chain_match_manager_->OnAmbientError(resource_name_,
-                                                std::move(status));
+  absl::StatusOr<RefCountedPtr<FilterChain>> Build() override {
+    if (filters_ == nullptr) return MakeRefCounted<FilterList>();
+    return std::move(filters_);
   }
 
- private:
-  std::string resource_name_;
-  WeakRefCountedPtr<FilterChainMatchManager> filter_chain_match_manager_;
+  RefCountedPtr<FilterList> filters_;
 };
 
-// An implementation of ServerConfigSelector used by
-// StaticXdsServerConfigSelectorProvider and
-// DynamicXdsServerConfigSelectorProvider to parse the RDS update and get
-// per-call configuration based on incoming metadata.
-class XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    XdsServerConfigSelector final : public ServerConfigSelector {
+// An implementation of ServerConfigSelector that stores parsed xDS filter
+// configs for each route, constructs filter chains for each, and
+// selects the appropriate filter chain for each RPC.
+class XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::
+    L4FilterChain::XdsServerConfigSelector final : public ServerConfigSelector {
  public:
   static absl::StatusOr<RefCountedPtr<XdsServerConfigSelector>> Create(
       const XdsHttpFilterRegistry& http_filter_registry,
-      std::shared_ptr<const XdsRouteConfigResource> rds_update,
+      XdsTransportFactory& transport_factory,
       const std::vector<XdsListenerResource::HttpConnectionManager::HttpFilter>&
-          http_filters);
-  ~XdsServerConfigSelector() override = default;
+          http_filters,
+      std::shared_ptr<const XdsRouteConfigResource> route_config,
+      Blackboard& blackboard);
+
+  std::unique_ptr<ConnectionState> BuildFilterChains(
+      FilterChainBuilder& builder) override;
 
   absl::StatusOr<CallConfig> GetCallConfig(
-      grpc_metadata_batch* metadata) override;
+      const ConnectionState* state, grpc_metadata_batch* metadata) override;
 
  private:
   struct VirtualHost {
     struct Route {
-      // true if an action other than kNonForwardingAction is configured.
+      // True if an action other than kNonForwardingAction is configured.
       bool unsupported_action;
-      // TODO(roth): Consider holding a ref to the RDS resource and storing
-      // a pointer to the matchers within that RDS resource, rather than
-      // copying the matchers here.
-      XdsRouteConfigResource::Route::Matchers matchers;
-      RefCountedPtr<ServiceConfig> method_config;
+      // Points inside of XdsServerConfigSelector::route_config_.
+      const XdsRouteConfigResource::Route::Matchers* matchers;
+      // The list of filter instances and configs to use for this route.
+      RefCountedPtr<const FilterList> filter_list;
     };
 
     class RouteListIterator final : public XdsRouting::RouteListIterator {
      public:
-      explicit RouteListIterator(const std::vector<Route>* routes)
+      explicit RouteListIterator(const std::vector<Route>& routes)
           : routes_(routes) {}
 
-      size_t Size() const override { return routes_->size(); }
+      size_t Size() const override { return routes_.size(); }
 
       const XdsRouteConfigResource::Route::Matchers& GetMatchersForRoute(
           size_t index) const override {
-        return (*routes_)[index].matchers;
+        return *routes_[index].matchers;
       }
 
      private:
-      const std::vector<Route>* routes_;
+      const std::vector<Route>& routes_;
     };
 
-    std::vector<std::string> domains;
+    // Points inside of XdsServerConfigSelector::route_config_.
+    const std::vector<std::string>* domains;
     std::vector<Route> routes;
   };
 
@@ -361,144 +424,28 @@ class XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
       : public XdsRouting::VirtualHostListIterator {
    public:
     explicit VirtualHostListIterator(
-        const std::vector<VirtualHost>* virtual_hosts)
+        const std::vector<VirtualHost>& virtual_hosts)
         : virtual_hosts_(virtual_hosts) {}
 
-    size_t Size() const override { return virtual_hosts_->size(); }
+    size_t Size() const override { return virtual_hosts_.size(); }
 
     const std::vector<std::string>& GetDomainsForVirtualHost(
         size_t index) const override {
-      return (*virtual_hosts_)[index].domains;
+      return *virtual_hosts_[index].domains;
     }
 
    private:
-    const std::vector<VirtualHost>* virtual_hosts_;
+    const std::vector<VirtualHost>& virtual_hosts_;
   };
 
-  std::vector<VirtualHost> virtual_hosts_;
-};
-
-// An XdsServerConfigSelectorProvider implementation for when the
-// RouteConfiguration is available inline.
-class XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    StaticXdsServerConfigSelectorProvider final
-    : public ServerConfigSelectorProvider {
- public:
-  StaticXdsServerConfigSelectorProvider(
-      RefCountedPtr<GrpcXdsClient> xds_client,
-      absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>>
-          static_resource,
-      std::vector<XdsListenerResource::HttpConnectionManager::HttpFilter>
-          http_filters)
-      : xds_client_(std::move(xds_client)),
-        static_resource_(std::move(static_resource)),
-        http_filters_(std::move(http_filters)) {}
-
-  ~StaticXdsServerConfigSelectorProvider() override {
-    xds_client_.reset(DEBUG_LOCATION, "StaticXdsServerConfigSelectorProvider");
-  }
-
-  absl::StatusOr<RefCountedPtr<ServerConfigSelector>> Watch(
-      std::unique_ptr<ServerConfigSelectorProvider::ServerConfigSelectorWatcher>
-          watcher) override {
-    GRPC_CHECK(watcher_ == nullptr);
-    watcher_ = std::move(watcher);
-    if (!static_resource_.ok()) {
-      return static_resource_.status();
-    }
-    return XdsServerConfigSelector::Create(
-        DownCast<const GrpcXdsBootstrap&>(xds_client_->bootstrap())
-            .http_filter_registry(),
-        static_resource_.value(), http_filters_);
-  }
-
-  void CancelWatch() override { watcher_.reset(); }
-
- private:
-  void Orphaned() override {}
-
-  RefCountedPtr<GrpcXdsClient> xds_client_;
-  absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>>
-      static_resource_;
-  // TODO(roth): Consider holding a ref to the LDS resource and storing
-  // a pointer to the HTTP filters within that LDS resource, rather than
-  // copying the HTTP filters here.
-  std::vector<XdsListenerResource::HttpConnectionManager::HttpFilter>
-      http_filters_;
-  std::unique_ptr<ServerConfigSelectorProvider::ServerConfigSelectorWatcher>
-      watcher_;
-};
-
-// An XdsServerConfigSelectorProvider implementation for when the
-// RouteConfiguration is to be fetched separately via RDS.
-class XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    DynamicXdsServerConfigSelectorProvider final
-    : public ServerConfigSelectorProvider {
- public:
-  DynamicXdsServerConfigSelectorProvider(
-      RefCountedPtr<GrpcXdsClient> xds_client, std::string resource_name,
-      absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>>
-          initial_resource,
-      std::vector<XdsListenerResource::HttpConnectionManager::HttpFilter>
-          http_filters);
-
-  ~DynamicXdsServerConfigSelectorProvider() override {
-    xds_client_.reset(DEBUG_LOCATION, "DynamicXdsServerConfigSelectorProvider");
-  }
-
-  absl::StatusOr<RefCountedPtr<ServerConfigSelector>> Watch(
-      std::unique_ptr<ServerConfigSelectorProvider::ServerConfigSelectorWatcher>
-          watcher) override;
-  void CancelWatch() override;
-
- private:
-  class RouteConfigWatcher;
-
-  void Orphaned() override;
-  void OnRouteConfigChanged(
-      absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>> rds_update);
-  void OnAmbientError(absl::Status status);
-
-  RefCountedPtr<GrpcXdsClient> xds_client_;
-  std::string resource_name_;
-  // TODO(roth): Consider holding a ref to the LDS resource and storing
-  // a pointer to the HTTP filters within that LDS resource, rather than
-  // copying the HTTP filters here.
-  std::vector<XdsListenerResource::HttpConnectionManager::HttpFilter>
-      http_filters_;
-  RouteConfigWatcher* route_config_watcher_ = nullptr;
-  Mutex mu_;
-  std::unique_ptr<ServerConfigSelectorProvider::ServerConfigSelectorWatcher>
-      watcher_ ABSL_GUARDED_BY(mu_);
-  absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>> resource_
-      ABSL_GUARDED_BY(mu_);
-};
-
-// A watcher implementation for updating the RDS resource used by
-// DynamicXdsServerConfigSelectorProvider
-class XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    DynamicXdsServerConfigSelectorProvider::RouteConfigWatcher final
-    : public XdsRouteConfigResourceType::WatcherInterface {
- public:
-  explicit RouteConfigWatcher(
-      WeakRefCountedPtr<DynamicXdsServerConfigSelectorProvider> parent)
-      : parent_(std::move(parent)) {}
-
-  void OnResourceChanged(
-      absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>>
-          route_config,
-      RefCountedPtr<ReadDelayHandle> /* read_delay_handle */) override {
-    parent_->OnRouteConfigChanged(std::move(route_config));
-  }
-
-  void OnAmbientError(
-      absl::Status status,
-      RefCountedPtr<ReadDelayHandle> /* read_delay_handle */) override {
-    parent_->OnAmbientError(std::move(status));
-  }
+  struct XdsConnectionState final : public ConnectionState {
+    absl::flat_hash_map<const VirtualHost::Route*,
+                        absl::StatusOr<RefCountedPtr<const FilterChain>>>
+        filter_chains;
+  };
 
- private:
-  WeakRefCountedPtr<DynamicXdsServerConfigSelectorProvider> parent_;
+  std::shared_ptr<const XdsRouteConfigResource> route_config_;
+  std::vector<VirtualHost> virtual_hosts_;
 };
 
 //
@@ -507,56 +454,54 @@ class XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
 
 XdsServerConfigFetcher::XdsServerConfigFetcher(
     RefCountedPtr<GrpcXdsClient> xds_client,
-    grpc_server_xds_status_notifier notifier)
-    : xds_client_(std::move(xds_client)), serving_status_notifier_(notifier) {
-  GRPC_CHECK(xds_client_ != nullptr);
-}
-
-std::string ListenerResourceName(absl::string_view resource_name_template,
-                                 absl::string_view listening_address) {
-  std::string tmp;
-  if (absl::StartsWith(resource_name_template, "xdstp:")) {
-    tmp = URI::PercentEncodePath(listening_address);
-    listening_address = tmp;
-  }
-  return absl::StrReplaceAll(resource_name_template,
-                             {{"%s", listening_address}});
-}
+    grpc_server_xds_status_notifier notifier,
+    RefCountedPtr<XdsResourceNameGenerator> resource_name_generator)
+    : fetcher_state_(MakeRefCounted<FetcherState>(
+          std::move(xds_client), std::move(resource_name_generator))),
+      serving_status_notifier_(notifier) {}
 
 void XdsServerConfigFetcher::StartWatch(
     std::string listening_address,
     std::unique_ptr<ServerConfigFetcher::WatcherInterface> watcher) {
-  ServerConfigFetcher::WatcherInterface* watcher_ptr = watcher.get();
-  auto listener_watcher = MakeRefCounted<ListenerWatcher>(
-      xds_client_.Ref(DEBUG_LOCATION, "ListenerWatcher"), std::move(watcher),
-      serving_status_notifier_, listening_address);
-  auto* listener_watcher_ptr = listener_watcher.get();
-  XdsListenerResourceType::StartWatch(
-      xds_client_.get(),
-      ListenerResourceName(
-          DownCast<const GrpcXdsBootstrap&>(xds_client_->bootstrap())
-              .server_listener_resource_name_template(),
-          listening_address),
-      std::move(listener_watcher));
-  MutexLock lock(&mu_);
-  listener_watchers_.emplace(watcher_ptr, listener_watcher_ptr);
+  fetcher_state_->work_serializer.Run(
+      [self = RefAsSubclass<XdsServerConfigFetcher>(),
+       listening_address = std::move(listening_address),
+       watcher = std::move(watcher)]()
+          ABSL_EXCLUSIVE_LOCKS_REQUIRED(
+              &FetcherState::work_serializer) mutable {
+            ServerConfigFetcher::WatcherInterface* watcher_ptr = watcher.get();
+            auto listener_watcher = MakeRefCounted<ListenerWatcher>(
+                self->fetcher_state_.Ref(DEBUG_LOCATION, "ListenerWatcher"),
+                std::move(watcher), self->serving_status_notifier_,
+                listening_address);
+            auto* listener_watcher_ptr = listener_watcher.get();
+            std::string resource_name = listener_watcher->ResourceName();
+            GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+                << "[XdsServerConfigFetcher " << self.get()
+                << "]: starting watch for LDS resource " << resource_name;
+            XdsListenerResourceType::StartWatch(
+                self->fetcher_state_->xds_client.get(), resource_name,
+                std::move(listener_watcher));
+            self->listener_watchers_.emplace(watcher_ptr, listener_watcher_ptr);
+          });
 }
 
 void XdsServerConfigFetcher::CancelWatch(
     ServerConfigFetcher::WatcherInterface* watcher) {
-  MutexLock lock(&mu_);
-  auto it = listener_watchers_.find(watcher);
-  if (it != listener_watchers_.end()) {
-    // Cancel the watch on the listener before erasing
-    XdsListenerResourceType::CancelWatch(
-        xds_client_.get(),
-        ListenerResourceName(
-            DownCast<const GrpcXdsBootstrap&>(xds_client_->bootstrap())
-                .server_listener_resource_name_template(),
-            it->second->listening_address()),
-        it->second, false /* delay_unsubscription */);
-    listener_watchers_.erase(it);
-  }
+  fetcher_state_->work_serializer.Run(
+      [self = RefAsSubclass<XdsServerConfigFetcher>(), watcher]()
+          ABSL_EXCLUSIVE_LOCKS_REQUIRED(&FetcherState::work_serializer) {
+            auto it = self->listener_watchers_.find(watcher);
+            if (it == self->listener_watchers_.end()) return;
+            std::string resource_name = it->second->ResourceName();
+            GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+                << "[XdsServerConfigFetcher " << self.get()
+                << "]: cancelling watch for LDS resource " << resource_name;
+            XdsListenerResourceType::CancelWatch(
+                self->fetcher_state_->xds_client.get(), resource_name,
+                it->second, /*delay_unsubscription=*/false);
+            self->listener_watchers_.erase(it);
+          });
 }
 
 //
@@ -564,75 +509,107 @@ void XdsServerConfigFetcher::CancelWatch(
 //
 
 XdsServerConfigFetcher::ListenerWatcher::ListenerWatcher(
-    RefCountedPtr<GrpcXdsClient> xds_client,
+    RefCountedPtr<FetcherState> fetcher_state,
     std::unique_ptr<ServerConfigFetcher::WatcherInterface>
         server_config_watcher,
     grpc_server_xds_status_notifier serving_status_notifier,
     std::string listening_address)
-    : xds_client_(std::move(xds_client)),
+    : fetcher_state_(std::move(fetcher_state)),
       server_config_watcher_(std::move(server_config_watcher)),
       serving_status_notifier_(serving_status_notifier),
-      listening_address_(std::move(listening_address)) {}
+      listening_address_(std::move(listening_address)),
+      blackboard_(MakeRefCounted<Blackboard>()) {
+  GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+      << "[ListenerWatcher " << this << "]: created for address "
+      << listening_address_;
+}
+
+// Returns true if the listener address matches the address that the
+// server is actually listening on.
+bool ListenerAddressMatches(absl::string_view listener_address,
+                            absl::string_view server_address) {
+  if (listener_address == server_address) return true;
+  absl::string_view listener_host;
+  absl::string_view listener_port;
+  if (!SplitHostPort(listener_address, &listener_host, &listener_port)) {
+    return false;
+  }
+  absl::string_view server_host;
+  absl::string_view server_port;
+  if (!SplitHostPort(server_address, &server_host, &server_port)) {
+    return false;
+  }
+  if (listener_host != server_host) return false;
+  return listener_port == "0" || listener_port == server_port;
+}
 
 void XdsServerConfigFetcher::ListenerWatcher::OnResourceChanged(
     absl::StatusOr<std::shared_ptr<const XdsListenerResource>> listener,
-    RefCountedPtr<ReadDelayHandle> /* read_delay_handle */) {
-  if (!listener.ok()) {
-    MutexLock lock(&mu_);
-    OnFatalError(absl::Status(
-        listener.status().code(),
-        absl::StrCat("LDS resource: ", listener.status().message())));
-    return;
-  }
-  GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
-      << "[ListenerWatcher " << this << "] Received LDS update from xds client "
-      << xds_client_.get() << ": " << (*listener)->ToString();
-  auto* tcp_listener =
-      std::get_if<XdsListenerResource::TcpListener>(&(*listener)->listener);
-  if (tcp_listener == nullptr) {
-    MutexLock lock(&mu_);
-    OnFatalError(
-        absl::FailedPreconditionError("LDS resource is not a TCP listener"));
-    return;
-  }
-  if (tcp_listener->address != listening_address_) {
-    MutexLock lock(&mu_);
-    OnFatalError(absl::FailedPreconditionError(
-        "Address in LDS update does not match listening address"));
-    return;
-  }
-  auto new_filter_chain_match_manager = MakeRefCounted<FilterChainMatchManager>(
-      xds_client_.Ref(DEBUG_LOCATION, "FilterChainMatchManager"),
-      tcp_listener->filter_chain_map, tcp_listener->default_filter_chain);
-  MutexLock lock(&mu_);
-  if (filter_chain_match_manager_ == nullptr ||
-      !(new_filter_chain_match_manager->filter_chain_map() ==
-            filter_chain_match_manager_->filter_chain_map() &&
-        new_filter_chain_match_manager->default_filter_chain() ==
-            filter_chain_match_manager_->default_filter_chain())) {
-    pending_filter_chain_match_manager_ =
-        std::move(new_filter_chain_match_manager);
-    pending_filter_chain_match_manager_->StartRdsWatch(
-        RefAsSubclass<ListenerWatcher>());
-  }
+    RefCountedPtr<ReadDelayHandle> read_delay_handle) {
+  fetcher_state_->work_serializer.Run(
+      [self = RefAsSubclass<ListenerWatcher>(), listener = std::move(listener),
+       read_delay_handle = std::move(read_delay_handle)]()
+          ABSL_EXCLUSIVE_LOCKS_REQUIRED(
+              &FetcherState::work_serializer) mutable {
+            if (!listener.ok()) {
+              self->OnFatalError(AddMessagePrefix(
+                  absl::StrCat("LDS resource ", self->ResourceName()),
+                  listener.status()));
+              return;
+            }
+            GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+                << "[ListenerWatcher " << self.get()
+                << "] Received LDS update from xds client "
+                << self->fetcher_state_->xds_client.get() << ": "
+                << (*listener)->ToString();
+            auto* tcp_listener = std::get_if<XdsListenerResource::TcpListener>(
+                &(*listener)->listener);
+            if (tcp_listener == nullptr) {
+              self->OnFatalError(absl::FailedPreconditionError(
+                  absl::StrCat("LDS resource ", self->ResourceName(),
+                               " is not a TCP listener")));
+              return;
+            }
+            if (!ListenerAddressMatches(tcp_listener->address,
+                                        self->listening_address_)) {
+              self->OnFatalError(absl::FailedPreconditionError(
+                  absl::StrCat("LDS resource ", self->ResourceName(),
+                               " address does not match listening address")));
+              return;
+            }
+            if (self->connection_manager_ != nullptr &&
+                **listener == self->connection_manager_->listener_resource()) {
+              GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+                  << "[ListenerWatcher " << self.get()
+                  << "]: ignoring unchanged LDS resource for "
+                  << self->listening_address_;
+              return;
+            }
+            self->pending_connection_manager_ =
+                MakeRefCounted<XdsConnectionManager>(
+                    self->fetcher_state_.Ref(DEBUG_LOCATION,
+                                             "XdsConnectionManager"),
+                    std::move(*listener), self);
+            self->pending_connection_manager_->Start();
+          });
 }
 
 void XdsServerConfigFetcher::ListenerWatcher::OnAmbientError(
     absl::Status status, RefCountedPtr<ReadDelayHandle> /*read_delay_handle*/) {
-  LOG(ERROR) << "ListenerWatcher:" << this
-             << " XdsClient reports ambient error: " << status << " for "
-             << listening_address_
-             << "; ignoring in favor of existing resource";
+  LOG(ERROR)
+      << "[ListenerWatcher:" << this
+      << "] XdsClient reports ambient error for LDS resource for address "
+      << listening_address_ << ": " << status;
 }
 
 void XdsServerConfigFetcher::ListenerWatcher::OnFatalError(
     absl::Status status) {
-  pending_filter_chain_match_manager_.reset();
-  if (filter_chain_match_manager_ != nullptr) {
+  pending_connection_manager_.reset();
+  if (connection_manager_ != nullptr) {
     // The server has started listening already, so we need to gracefully
     // stop serving.
     server_config_watcher_->StopServing();
-    filter_chain_match_manager_.reset();
+    connection_manager_.reset();
   }
   if (serving_status_notifier_.on_serving_status_update != nullptr) {
     serving_status_notifier_.on_serving_status_update(
@@ -640,28 +617,26 @@ void XdsServerConfigFetcher::ListenerWatcher::OnFatalError(
         {static_cast<grpc_status_code>(status.raw_code()),
          std::string(status.message()).c_str()});
   } else {
-    LOG(ERROR) << "ListenerWatcher:" << this << " Encountered fatal error "
+    LOG(ERROR) << "[ListenerWatcher:" << this << "] Encountered fatal error "
                << status << "; not serving on " << listening_address_;
   }
 }
 
-void XdsServerConfigFetcher::ListenerWatcher::
-    PendingFilterChainMatchManagerReadyLocked(
-        XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager*
-            filter_chain_match_manager) {
-  if (pending_filter_chain_match_manager_ != filter_chain_match_manager) {
-    // This FilterChainMatchManager is no longer the current pending resource.
+void XdsServerConfigFetcher::ListenerWatcher::MaybeUpdateConnectionManager(
+    XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager*
+        connection_manager) {
+  if (pending_connection_manager_ != connection_manager) {
+    // This XdsConnectionManager is no longer the current pending resource.
     // It should get cleaned up eventually. Ignore this update.
     return;
   }
-  bool first_good_update = filter_chain_match_manager_ == nullptr;
-  // Promote the pending FilterChainMatchManager
-  filter_chain_match_manager_ = std::move(pending_filter_chain_match_manager_);
-  // TODO(yashykt): Right now, the server_config_watcher_ does not invoke
-  // XdsServerConfigFetcher while holding a lock, but that might change in the
-  // future in which case we would want to execute this update outside the
-  // critical region through a WorkSerializer similar to XdsClient.
-  server_config_watcher_->UpdateConnectionManager(filter_chain_match_manager_);
+  GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+      << "[ListenerWatcher " << this << "]: promoting XdsConnectionManager "
+      << connection_manager;
+  bool first_good_update = connection_manager_ == nullptr;
+  // Promote the pending XdsConnectionManager
+  connection_manager_ = std::move(pending_connection_manager_);
+  server_config_watcher_->UpdateConnectionManager(connection_manager_);
   // Let the logger know about the update if there was no previous good update.
   if (first_good_update) {
     if (serving_status_notifier_.on_serving_status_update != nullptr) {
@@ -675,29 +650,70 @@ void XdsServerConfigFetcher::ListenerWatcher::
   }
 }
 
+std::string XdsServerConfigFetcher::ListenerWatcher::ResourceName() const {
+  if (fetcher_state_->resource_name_generator != nullptr) {
+    return fetcher_state_->resource_name_generator->GetResourceName(
+        listening_address_);
+  }
+  absl::string_view resource_name_template =
+      DownCast<const GrpcXdsBootstrap&>(fetcher_state_->xds_client->bootstrap())
+          .server_listener_resource_name_template();
+  absl::string_view listening_address = listening_address_;
+  std::string tmp;
+  if (absl::StartsWith(resource_name_template, "xdstp:")) {
+    tmp = URI::PercentEncodePath(listening_address);
+    listening_address = tmp;
+  }
+  return absl::StrReplaceAll(resource_name_template,
+                             {{"%s", listening_address}});
+}
+
 //
-// XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager
+// XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager
 //
 
-XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    FilterChainMatchManager(
-        RefCountedPtr<GrpcXdsClient> xds_client,
-        XdsListenerResource::FilterChainMap filter_chain_map,
-        std::optional<XdsListenerResource::FilterChainData>
-            default_filter_chain)
-    : xds_client_(std::move(xds_client)),
-      filter_chain_map_(std::move(filter_chain_map)),
-      default_filter_chain_(std::move(default_filter_chain)) {}
-
-void XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
+XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::
+    XdsConnectionManager(
+        RefCountedPtr<FetcherState> fetcher_state,
+        std::shared_ptr<const XdsListenerResource> listener_resource,
+        RefCountedPtr<ListenerWatcher> listener_watcher)
+    : fetcher_state_(std::move(fetcher_state)),
+      listener_resource_(std::move(listener_resource)),
+      listener_watcher_(std::move(listener_watcher)),
+      blackboard_(listener_watcher_->blackboard_) {
+  GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+      << "[XdsConnectionManager " << this << "]: created";
+}
+
+void XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::Start() {
+  // Create L4FilterChain object for each L4 filter chain.
+  ForEachFilterChain(
+      [&](const XdsListenerResource::FilterChainData& filter_chain_data)
+          ABSL_EXCLUSIVE_LOCKS_REQUIRED(&FetcherState::work_serializer) {
+            auto l4_filter_chain = MakeOrphanable<L4FilterChain>(
+                fetcher_state_.Ref(DEBUG_LOCATION, "L4FilterChain"),
+                WeakRefAsSubclass<XdsConnectionManager>(), filter_chain_data);
+            l4_filter_chains_.emplace(&filter_chain_data,
+                                      std::move(l4_filter_chain));
+          });
+  // If all L4 filter chains had inline RouteConfigs, then promote this
+  // XdsConnectionManager immediately.
+  MaybeUpdateConnectionManager();
+}
+
+void XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::
     ForEachFilterChain(
-        absl::FunctionRef<void(XdsListenerResource::FilterChainData&)> cb) {
+        absl::FunctionRef<void(const XdsListenerResource::FilterChainData&)> cb)
+        const {
+  const auto& tcp_listener =
+      std::get<XdsListenerResource::TcpListener>(listener_resource_->listener);
   // A given FilterChainData object may appear more than once in the map,
   // but we want to invoke the callback exactly once for each
   // FilterChainData object.  Therefore, we start by constructing a set
   // of all FilterChainData objects by address, to weed out duplicates.
-  std::set<XdsListenerResource::FilterChainData*> filter_chain_data_set;
-  for (const auto& destination_ip : filter_chain_map_.destination_ip_vector) {
+  std::set<const XdsListenerResource::FilterChainData*> filter_chain_data_set;
+  for (const auto& destination_ip :
+       tcp_listener.filter_chain_map.destination_ip_vector) {
     for (const auto& source_type : destination_ip.source_types_array) {
       for (const auto& source_ip : source_type) {
         for (const auto& source_port_pair : source_ip.ports_map) {
@@ -712,156 +728,36 @@ void XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
     cb(*filter_chain_data);
   }
   // Also invoke the callback for the default filter chain, if present.
-  if (default_filter_chain_.has_value()) {
-    cb(*default_filter_chain_);
-  }
-}
-
-void XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    StartRdsWatch(RefCountedPtr<ListenerWatcher> listener_watcher) {
-  // Get the set of RDS resources to watch on. Also reverse the list of
-  // HTTP filters in each filter chain, since received data moves *up*
-  // the stack on the server side.
-  std::set<std::string> resource_names;
-  ForEachFilterChain(
-      [&](XdsListenerResource::FilterChainData& filter_chain_data) {
-        auto& hcm = filter_chain_data.http_connection_manager;
-        const auto* rds_name = std::get_if<std::string>(&hcm.route_config);
-        if (rds_name != nullptr) resource_names.insert(*rds_name);
-        std::reverse(hcm.http_filters.begin(), hcm.http_filters.end());
-      });
-  // Start watching referenced RDS resources.
-  struct WatcherToStart {
-    std::string resource_name;
-    RefCountedPtr<RouteConfigWatcher> watcher;
-  };
-  std::vector<WatcherToStart> watchers_to_start;
-  watchers_to_start.reserve(resource_names.size());
-  {
-    MutexLock lock(&mu_);
-    for (const auto& resource_name : resource_names) {
-      ++rds_resources_yet_to_fetch_;
-      auto route_config_watcher = MakeRefCounted<RouteConfigWatcher>(
-          resource_name, WeakRefAsSubclass<FilterChainMatchManager>());
-      rds_map_.emplace(resource_name, RdsUpdateState{route_config_watcher.get(),
-                                                     std::nullopt});
-      watchers_to_start.push_back(
-          WatcherToStart{resource_name, std::move(route_config_watcher)});
-    }
-    if (rds_resources_yet_to_fetch_ != 0) {
-      listener_watcher_ = std::move(listener_watcher);
-      listener_watcher = nullptr;
-    }
-  }
-  for (auto& watcher_to_start : watchers_to_start) {
-    XdsRouteConfigResourceType::StartWatch(xds_client_.get(),
-                                           watcher_to_start.resource_name,
-                                           std::move(watcher_to_start.watcher));
-  }
-  // Promote this filter chain match manager if all referenced resources are
-  // fetched.
-  if (listener_watcher != nullptr) {
-    listener_watcher->PendingFilterChainMatchManagerReadyLocked(this);
+  if (tcp_listener.default_filter_chain.has_value()) {
+    cb(*tcp_listener.default_filter_chain);
   }
 }
 
-void XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    Orphaned() {
-  MutexLock lock(&mu_);
-  // Cancel the RDS watches to clear up the weak refs
-  for (const auto& entry : rds_map_) {
-    XdsRouteConfigResourceType::CancelWatch(xds_client_.get(), entry.first,
-                                            entry.second.watcher,
-                                            false /* delay_unsubscription */);
-  }
-  // Also give up the ref on ListenerWatcher since it won't be needed anymore
-  listener_watcher_.reset();
+void XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::Orphaned() {
+  fetcher_state_->work_serializer.Run(
+      [self = WeakRefAsSubclass<XdsConnectionManager>()]()
+          ABSL_EXCLUSIVE_LOCKS_REQUIRED(&FetcherState::work_serializer) {
+            GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+                << "[XdsConnectionManager " << self.get() << "]: orphaned";
+            self->listener_watcher_.reset();
+            self->l4_filter_chains_.clear();
+          });
 }
 
-absl::StatusOr<RefCountedPtr<XdsCertificateProvider>>
-XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    CreateOrGetXdsCertificateProviderFromFilterChainData(
-        const XdsListenerResource::FilterChainData* filter_chain) {
-  MutexLock lock(&mu_);
-  auto it = certificate_providers_map_.find(filter_chain);
-  if (it != certificate_providers_map_.end()) return it->second;
-  // Configure root cert.
-  auto* ca_cert_provider =
-      std::get_if<CommonTlsContext::CertificateProviderPluginInstance>(
-          &filter_chain->downstream_tls_context.common_tls_context
-               .certificate_validation_context.ca_certs);
-  absl::string_view root_provider_cert_name;
-  RefCountedPtr<grpc_tls_certificate_provider> root_cert_provider;
-  if (ca_cert_provider != nullptr) {
-    root_provider_cert_name = ca_cert_provider->certificate_name;
-    root_cert_provider =
-        xds_client_->certificate_provider_store()
-            .CreateOrGetCertificateProvider(ca_cert_provider->instance_name);
-    if (root_cert_provider == nullptr) {
-      return absl::NotFoundError(
-          absl::StrCat("Certificate provider instance name: \"",
-                       ca_cert_provider->instance_name, "\" not recognized."));
-    }
-  }
-  // Configure identity cert.
-  absl::string_view identity_provider_instance_name =
-      filter_chain->downstream_tls_context.common_tls_context
-          .tls_certificate_provider_instance.instance_name;
-  absl::string_view identity_provider_cert_name =
-      filter_chain->downstream_tls_context.common_tls_context
-          .tls_certificate_provider_instance.certificate_name;
-  RefCountedPtr<grpc_tls_certificate_provider> identity_cert_provider;
-  if (!identity_provider_instance_name.empty()) {
-    identity_cert_provider =
-        xds_client_->certificate_provider_store()
-            .CreateOrGetCertificateProvider(identity_provider_instance_name);
-    if (identity_cert_provider == nullptr) {
-      return absl::NotFoundError(
-          absl::StrCat("Certificate provider instance name: \"",
-                       identity_provider_instance_name, "\" not recognized."));
-    }
-  }
-  auto xds_cert_provider = MakeRefCounted<XdsCertificateProvider>(
-      std::move(root_cert_provider), root_provider_cert_name,
-      std::move(identity_cert_provider), identity_provider_cert_name,
-      filter_chain->downstream_tls_context.require_client_certificate);
-  certificate_providers_map_.emplace(filter_chain, xds_cert_provider);
-  return xds_cert_provider;
-}
-
-void XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    OnRouteConfigChanged(
-        const std::string& resource_name,
-        absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>>
-            route_config) {
+void XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::
+    MaybeUpdateConnectionManager() {
+  if (listener_watcher_ == nullptr) return;  // Already promoted.
   RefCountedPtr<ListenerWatcher> listener_watcher;
-  {
-    MutexLock lock(&mu_);
-    auto& state = rds_map_[resource_name];
-    if (!state.rds_update.has_value()) {
-      if (--rds_resources_yet_to_fetch_ == 0) {
-        listener_watcher = std::move(listener_watcher_);
-      }
-    }
-    if (!route_config.ok()) {
-      route_config = absl::UnavailableError(
-          absl::StrCat("RDS resource ", resource_name, ": ",
-                       route_config.status().message()));
-    }
-    state.rds_update = std::move(route_config);
-  }
-  // Promote the filter chain match manager object if all the referenced
-  // resources are fetched.
-  if (listener_watcher != nullptr) {
-    listener_watcher->PendingFilterChainMatchManagerReady(this);
+  // Check if all L4 filter chains have their route configs.
+  for (const auto& [_, l4_filter_chain] : l4_filter_chains_) {
+    if (!l4_filter_chain->HasRouteConfig()) return;
   }
-}
-
-void XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    OnAmbientError(const std::string& resource_name, absl::Status status) {
-  LOG(ERROR) << "RouteConfigWatcher:" << this
-             << " XdsClient reports ambient error: " << status << " for "
-             << resource_name << "; ignoring in favor of existing resource";
+  // We have all route configs, so promote the XdsConnectionManager.
+  GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+      << "[XdsConnectionManager " << this
+      << "]: obtained all necessary RDS resources";
+  listener_watcher_->MaybeUpdateConnectionManager(this);
+  listener_watcher_.reset();
 }
 
 const XdsListenerResource::FilterChainData* FindFilterChainDataForSourcePort(
@@ -1023,147 +919,394 @@ const XdsListenerResource::FilterChainData* FindFilterChainDataForDestinationIp(
 }
 
 absl::StatusOr<ChannelArgs> XdsServerConfigFetcher::ListenerWatcher::
-    FilterChainMatchManager::UpdateChannelArgsForConnection(
-        const ChannelArgs& input_args, grpc_endpoint* tcp) {
-  ChannelArgs args = input_args;
+    XdsConnectionManager::UpdateChannelArgsForConnection(
+        const ChannelArgs& args, grpc_endpoint* tcp) {
+  GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+      << "[XdsConnectionManager " << this
+      << "]: choosing L4 filter chain for connection";
+  const auto& tcp_listener =
+      std::get<XdsListenerResource::TcpListener>(listener_resource_->listener);
   const auto* filter_chain = FindFilterChainDataForDestinationIp(
-      filter_chain_map_.destination_ip_vector, tcp);
-  if (filter_chain == nullptr && default_filter_chain_.has_value()) {
-    filter_chain = &default_filter_chain_.value();
+      tcp_listener.filter_chain_map.destination_ip_vector, tcp);
+  if (filter_chain == nullptr &&
+      tcp_listener.default_filter_chain.has_value()) {
+    filter_chain = &*tcp_listener.default_filter_chain;
   }
   if (filter_chain == nullptr) {
     return absl::UnavailableError("No matching filter chain found");
   }
-  RefCountedPtr<ServerConfigSelectorProvider> server_config_selector_provider;
-  RefCountedPtr<XdsChannelStackModifier> channel_stack_modifier;
-  RefCountedPtr<XdsCertificateProvider> xds_certificate_provider;
-  // Iterate the list of HTTP filters in reverse since in Core, received data
-  // flows *up* the stack.
-  std::vector<const grpc_channel_filter*> filters;
-  const auto& http_filter_registry =
-      DownCast<const GrpcXdsBootstrap&>(xds_client_->bootstrap())
-          .http_filter_registry();
-  for (const auto& http_filter :
-       filter_chain->http_connection_manager.http_filters) {
-    // Find filter.  This is guaranteed to succeed, because it's checked
-    // at config validation time in the XdsApi code.
-    const XdsHttpFilterImpl* filter_impl =
-        http_filter_registry.GetFilterForTopLevelType(
-            http_filter.config_proto_type);
-    GRPC_CHECK_NE(filter_impl, nullptr);
-    // Some filters like the router filter are no-op filters and do not have
-    // an implementation.
-    if (filter_impl->channel_filter() != nullptr) {
-      filters.push_back(filter_impl->channel_filter());
+  // Find the corresponding L4FilterChain.
+  auto it = l4_filter_chains_.find(filter_chain);
+  if (it == l4_filter_chains_.end()) {
+    // Should never happen.
+    return absl::InternalError("could not find L4FilterChain");
+  }
+  GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+      << "[XdsConnectionManager " << this << "]: selected L4 filter chain "
+      << it->second.get();
+  return it->second->UpdateChannelArgsForConnection(args);
+}
+
+//
+// XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::L4FilterChain::XdsServerConfigSelectorProvider
+//
+
+class XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::
+    L4FilterChain::XdsServerConfigSelectorProvider final
+    : public ServerConfigSelectorProvider {
+ public:
+  XdsServerConfigSelectorProvider(
+      RefCountedPtr<FetcherState> fetcher_state,
+      absl::StatusOr<RefCountedPtr<ServerConfigSelector>> config_selector)
+      : fetcher_state_(std::move(fetcher_state)),
+        config_selector_(std::move(config_selector)) {}
+
+  void SetServerConfigSelector(
+      absl::StatusOr<RefCountedPtr<ServerConfigSelector>> config_selector)
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(&FetcherState::work_serializer) {
+    if (GRPC_TRACE_FLAG_ENABLED(xds_server_config_fetcher)) {
+      if (config_selector.ok()) {
+        LOG(INFO) << "[XdsServerConfigSelectorProvider " << this
+                  << "]: sending new XdsServerConfigSelector "
+                  << config_selector->get();
+      } else {
+        LOG(INFO) << "[XdsServerConfigSelectorProvider " << this
+                  << "]: sending new XdsServerConfigSelector "
+                  << config_selector.status();
+      }
+    }
+    config_selector_ = std::move(config_selector);
+    for (const auto& watcher : watchers_) {
+      watcher->OnServerConfigSelectorUpdate(config_selector_);
+    }
+  }
+
+  absl::StatusOr<RefCountedPtr<ServerConfigSelector>> Watch(
+      std::shared_ptr<ServerConfigSelectorWatcher> watcher) override {
+    fetcher_state_->work_serializer.Run(
+        [self = WeakRefAsSubclass<XdsServerConfigSelectorProvider>(),
+         watcher = std::move(watcher)]()
+            ABSL_EXCLUSIVE_LOCKS_REQUIRED(
+                &FetcherState::work_serializer) mutable {
+              watcher->OnServerConfigSelectorUpdate(self->config_selector_);
+              self->watchers_.insert(std::move(watcher));
+            });
+    return nullptr;
+  }
+
+  void CancelWatch(
+      std::shared_ptr<ServerConfigSelectorWatcher> watcher) override {
+    fetcher_state_->work_serializer.Run(
+        [self = WeakRefAsSubclass<XdsServerConfigSelectorProvider>(),
+         watcher = std::move(watcher)]()
+            ABSL_EXCLUSIVE_LOCKS_REQUIRED(&FetcherState::work_serializer) {
+              self->watchers_.erase(watcher);
+            });
+  }
+
+ private:
+  void Orphaned() override {
+    GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+        << "[XdsServerConfigSelectorProvider " << this << "]: orphaned";
+  }
+
+  RefCountedPtr<FetcherState> fetcher_state_;
+
+  absl::StatusOr<RefCountedPtr<ServerConfigSelector>> config_selector_
+      ABSL_GUARDED_BY(&FetcherState::work_serializer);
+  absl::flat_hash_set<std::shared_ptr<ServerConfigSelectorWatcher>> watchers_
+      ABSL_GUARDED_BY(&FetcherState::work_serializer);
+};
+
+//
+// XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::L4FilterChain::RouteConfigWatcher
+//
+
+class XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::
+    L4FilterChain::RouteConfigWatcher final
+    : public XdsRouteConfigResourceType::WatcherInterface {
+ public:
+  explicit RouteConfigWatcher(RefCountedPtr<L4FilterChain> l4_filter_chain)
+      : l4_filter_chain_(std::move(l4_filter_chain)) {}
+
+  void OnResourceChanged(
+      absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>>
+          route_config,
+      RefCountedPtr<ReadDelayHandle> read_delay_handle) override {
+    l4_filter_chain_->fetcher_state_->work_serializer.Run(
+        [l4_filter_chain = l4_filter_chain_,
+         route_config = std::move(route_config),
+         read_delay_handle = std::move(read_delay_handle)]()
+            ABSL_EXCLUSIVE_LOCKS_REQUIRED(
+                &FetcherState::work_serializer) mutable {
+              l4_filter_chain->OnRouteConfigChanged(std::move(route_config));
+            });
+  }
+
+  void OnAmbientError(
+      absl::Status status,
+      RefCountedPtr<ReadDelayHandle> read_delay_handle) override {
+    l4_filter_chain_->fetcher_state_->work_serializer.Run(
+        [l4_filter_chain = l4_filter_chain_, status = std::move(status),
+         read_delay_handle = std::move(read_delay_handle)]()
+            ABSL_EXCLUSIVE_LOCKS_REQUIRED(
+                &FetcherState::work_serializer) mutable {
+              l4_filter_chain->OnAmbientError(std::move(status));
+            });
+  }
+
+ private:
+  RefCountedPtr<L4FilterChain> l4_filter_chain_;
+};
+
+//
+// XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::L4FilterChain
+//
+
+absl::StatusOr<RefCountedPtr<XdsCertificateProvider>>
+CreateCertificateProviderForFilterChain(
+    const XdsListenerResource::FilterChainData& filter_chain,
+    CertificateProviderStore& certificate_provider_store) {
+  // Configure root cert.
+  auto* ca_cert_provider =
+      std::get_if<CommonTlsContext::CertificateProviderPluginInstance>(
+          &filter_chain.downstream_tls_context.common_tls_context
+               .certificate_validation_context.ca_certs);
+  absl::string_view root_provider_cert_name;
+  RefCountedPtr<grpc_tls_certificate_provider> root_cert_provider;
+  if (ca_cert_provider != nullptr) {
+    root_provider_cert_name = ca_cert_provider->certificate_name;
+    root_cert_provider =
+        certificate_provider_store.CreateOrGetCertificateProvider(
+            ca_cert_provider->instance_name);
+    if (root_cert_provider == nullptr) {
+      return absl::NotFoundError(
+          absl::StrCat("Certificate provider instance name: \"",
+                       ca_cert_provider->instance_name, "\" not recognized."));
     }
   }
-  // Add config selector filter.
-  filters.push_back(&kServerConfigSelectorFilter);
-  channel_stack_modifier =
-      MakeRefCounted<XdsChannelStackModifier>(std::move(filters));
+  // Configure identity cert.
+  absl::string_view identity_provider_instance_name =
+      filter_chain.downstream_tls_context.common_tls_context
+          .tls_certificate_provider_instance.instance_name;
+  absl::string_view identity_provider_cert_name =
+      filter_chain.downstream_tls_context.common_tls_context
+          .tls_certificate_provider_instance.certificate_name;
+  RefCountedPtr<grpc_tls_certificate_provider> identity_cert_provider;
+  if (!identity_provider_instance_name.empty()) {
+    identity_cert_provider =
+        certificate_provider_store.CreateOrGetCertificateProvider(
+            identity_provider_instance_name);
+    if (identity_cert_provider == nullptr) {
+      return absl::NotFoundError(
+          absl::StrCat("Certificate provider instance name: \"",
+                       identity_provider_instance_name, "\" not recognized."));
+    }
+  }
+  return MakeRefCounted<XdsCertificateProvider>(
+      std::move(root_cert_provider), root_provider_cert_name,
+      std::move(identity_cert_provider), identity_provider_cert_name,
+      filter_chain.downstream_tls_context.require_client_certificate);
+}
+
+XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::L4FilterChain::
+    L4FilterChain(RefCountedPtr<FetcherState> fetcher_state,
+                  WeakRefCountedPtr<XdsConnectionManager> connection_manager,
+                  const XdsListenerResource::FilterChainData& filter_chain_data)
+    : fetcher_state_(std::move(fetcher_state)),
+      connection_manager_(std::move(connection_manager)),
+      filter_chain_data_(filter_chain_data),
+      certificate_provider_(CreateCertificateProviderForFilterChain(
+          filter_chain_data,
+          fetcher_state_->xds_client->certificate_provider_store())) {
+  GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+      << "[L4FilterChain " << this << "]: created";
+  auto& hcm = filter_chain_data_.http_connection_manager;
   Match(
-      filter_chain->http_connection_manager.route_config,
-      // RDS resource name
-      [&](const std::string& rds_name) {
-        absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>>
-            initial_resource;
-        {
-          MutexLock lock(&mu_);
-          initial_resource = rds_map_[rds_name].rds_update.value();
-        }
-        server_config_selector_provider =
-            MakeRefCounted<DynamicXdsServerConfigSelectorProvider>(
-                xds_client_.Ref(DEBUG_LOCATION,
-                                "DynamicXdsServerConfigSelectorProvider"),
-                rds_name, std::move(initial_resource),
-                filter_chain->http_connection_manager.http_filters);
+      hcm.route_config,
+      [&](const std::string& rds_resource_name) {
+        // Start RDS watch.
+        GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+            << "[L4FilterChain " << this << "]: starting RDS watch for "
+            << rds_resource_name;
+        auto watcher = MakeRefCounted<RouteConfigWatcher>(Ref());
+        watcher_ = watcher.get();
+        XdsRouteConfigResourceType::StartWatch(fetcher_state_->xds_client.get(),
+                                               rds_resource_name,
+                                               std::move(watcher));
       },
-      // inline RouteConfig
-      [&](const std::shared_ptr<const XdsRouteConfigResource>& route_config) {
-        server_config_selector_provider =
-            MakeRefCounted<StaticXdsServerConfigSelectorProvider>(
-                xds_client_.Ref(DEBUG_LOCATION,
-                                "StaticXdsServerConfigSelectorProvider"),
-                route_config,
-                filter_chain->http_connection_manager.http_filters);
-      });
-  args = args.SetObject(server_config_selector_provider)
-             .SetObject(channel_stack_modifier);
-  // Add XdsCertificateProvider if credentials are xDS.
-  auto* server_creds = args.GetObject<grpc_server_credentials>();
-  if (server_creds != nullptr &&
-      server_creds->type() == XdsServerCredentials::Type()) {
-    absl::StatusOr<RefCountedPtr<XdsCertificateProvider>> result =
-        CreateOrGetXdsCertificateProviderFromFilterChainData(filter_chain);
-    if (!result.ok()) {
-      return result.status();
-    }
-    xds_certificate_provider = std::move(*result);
-    GRPC_CHECK(xds_certificate_provider != nullptr);
-    args = args.SetObject(xds_certificate_provider);
+      [&](const std::shared_ptr<const XdsRouteConfigResource>& route_config)
+          ABSL_EXCLUSIVE_LOCKS_REQUIRED(&FetcherState::work_serializer) {
+            // RouteConfig was inlined in LDS.
+            GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+                << "[L4FilterChain " << this << "]: got RouteConfig from LDS";
+            UpdateServerConfigSelector(route_config);
+          });
+}
+
+void XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::
+    L4FilterChain::Orphan() {
+  GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+      << "[L4FilterChain " << this << "]: orphaned";
+  if (watcher_ != nullptr) {
+    auto& hcm = filter_chain_data_.http_connection_manager;
+    auto& rds_resource_name = std::get<std::string>(hcm.route_config);
+    XdsRouteConfigResourceType::CancelWatch(fetcher_state_->xds_client.get(),
+                                            rds_resource_name, watcher_);
+    watcher_ = nullptr;
+  }
+  connection_manager_.reset();
+  Unref();
+}
+
+absl::StatusOr<ChannelArgs> XdsServerConfigFetcher::ListenerWatcher::
+    XdsConnectionManager::L4FilterChain::UpdateChannelArgsForConnection(
+        const ChannelArgs& args) const {
+  if (!certificate_provider_.ok()) return certificate_provider_.status();
+  return args.SetObject(*certificate_provider_)
+      .SetObject(
+          // This is the only place where the provider is accessed from outside
+          // of the WorkSerializer, and it will always be set before this
+          // happens, so this read is safe even though the compiler can't tell.
+          ABSL_TS_UNCHECKED_READ(config_selector_provider_));
+}
+
+absl::StatusOr<RefCountedPtr<ServerConfigSelector>>
+XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::L4FilterChain::
+    CreateServerConfigSelector(
+        absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>>
+            route_config) {
+  if (!route_config.ok()) return route_config.status();
+  return XdsServerConfigSelector::Create(
+      DownCast<const GrpcXdsBootstrap&>(fetcher_state_->xds_client->bootstrap())
+          .http_filter_registry(),
+      *fetcher_state_->xds_client->transport_factory(),
+      filter_chain_data_.http_connection_manager.http_filters,
+      std::move(*route_config), *connection_manager_->blackboard_);
+}
+
+void XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::
+    L4FilterChain::UpdateServerConfigSelector(
+        absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>>
+            route_config) {
+  GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+      << "[L4FilterChain " << this << "]: creating new XdsServerConfigSelector";
+  absl::StatusOr<RefCountedPtr<ServerConfigSelector>> config_selector =
+      CreateServerConfigSelector(std::move(route_config));
+  if (config_selector_provider_ == nullptr) {
+    GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+        << "[L4FilterChain " << this
+        << "]: initial update; creating new XdsServerConfigSelectorProvider";
+    config_selector_provider_ = MakeRefCounted<XdsServerConfigSelectorProvider>(
+        fetcher_state_, std::move(config_selector));
+  } else {
+    // Provider already exists, so just update it.
+    config_selector_provider_->SetServerConfigSelector(
+        std::move(config_selector));
   }
-  return args;
+}
+
+void XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::
+    L4FilterChain::OnRouteConfigChanged(
+        absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>>
+            route_config) {
+  GRPC_TRACE_LOG(xds_server_config_fetcher, INFO)
+      << "[L4FilterChain " << this << "]: received RDS update";
+  if (connection_manager_ == nullptr) return;
+  if (!route_config.ok()) {
+    auto& hcm = filter_chain_data_.http_connection_manager;
+    auto& rds_resource_name = std::get<std::string>(hcm.route_config);
+    route_config = absl::UnavailableError(
+        absl::StrCat("RDS resource ", rds_resource_name, ": ",
+                     route_config.status().message()));
+  }
+  UpdateServerConfigSelector(std::move(route_config));
+  connection_manager_->MaybeUpdateConnectionManager();
+}
+
+void XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::
+    L4FilterChain::OnAmbientError(absl::Status status) {
+  auto& hcm = filter_chain_data_.http_connection_manager;
+  auto& rds_resource_name = std::get<std::string>(hcm.route_config);
+  LOG(ERROR) << "XdsClient reports ambient error for RDS resource "
+             << rds_resource_name << ": " << status;
 }
 
 //
-// XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::XdsServerConfigSelector
+// XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::L4FilterChain::XdsServerConfigSelector
 //
 
-absl::StatusOr<
-    RefCountedPtr<XdsServerConfigFetcher::ListenerWatcher::
-                      FilterChainMatchManager::XdsServerConfigSelector>>
-XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
+absl::StatusOr<RefCountedPtr<
+    XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::
+        L4FilterChain::XdsServerConfigSelector>>
+XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::L4FilterChain::
     XdsServerConfigSelector::Create(
         const XdsHttpFilterRegistry& http_filter_registry,
-        std::shared_ptr<const XdsRouteConfigResource> rds_update,
+        XdsTransportFactory& transport_factory,
         const std::vector<
             XdsListenerResource::HttpConnectionManager::HttpFilter>&
-            http_filters) {
+            http_filters,
+        std::shared_ptr<const XdsRouteConfigResource> route_config,
+        Blackboard& blackboard) {
   auto config_selector = MakeRefCounted<XdsServerConfigSelector>();
-  for (auto& vhost : rds_update->virtual_hosts) {
-    config_selector->virtual_hosts_.emplace_back();
-    auto& virtual_host = config_selector->virtual_hosts_.back();
-    virtual_host.domains = vhost.domains;
+  FilterListBuilder filter_list_builder;
+  XdsRouting::RouteConfigFilterChainBuilder route_config_builder(
+      http_filters, http_filter_registry, filter_list_builder,
+      transport_factory, blackboard);
+  for (auto& vhost : route_config->virtual_hosts) {
+    auto vhost_builder =
+        route_config_builder.MakeVirtualHostFilterChainBuilder(vhost);
+    auto& virtual_host = config_selector->virtual_hosts_.emplace_back();
+    virtual_host.domains = &vhost.domains;
     for (auto& route : vhost.routes) {
-      virtual_host.routes.emplace_back();
-      auto& config_selector_route = virtual_host.routes.back();
-      config_selector_route.matchers = route.matchers;
+      auto& config_selector_route = virtual_host.routes.emplace_back();
+      config_selector_route.matchers = &route.matchers;
       config_selector_route.unsupported_action =
           std::get_if<XdsRouteConfigResource::Route::NonForwardingAction>(
               &route.action) == nullptr;
-      auto result = XdsRouting::GeneratePerHTTPFilterConfigsForMethodConfig(
-          http_filter_registry, http_filters, vhost, route, nullptr,
-          ChannelArgs());
-      if (!result.ok()) return result.status();
-      std::vector<std::string> fields;
-      fields.reserve(result->per_filter_configs.size());
-      for (const auto& p : result->per_filter_configs) {
-        fields.emplace_back(absl::StrCat("    \"", p.first, "\": [\n",
-                                         absl::StrJoin(p.second, ",\n"),
-                                         "\n    ]"));
-      }
-      if (!fields.empty()) {
-        std::string json = absl::StrCat(
-            "{\n"
-            "  \"methodConfig\": [ {\n"
-            "    \"name\": [\n"
-            "      {}\n"
-            "    ],\n"
-            "    ",
-            absl::StrJoin(fields, ",\n"),
-            "\n  } ]\n"
-            "}");
-        config_selector_route.method_config =
-            ServiceConfigImpl::Create(result->args, json.c_str()).value();
-      }
+      auto filter_list = vhost_builder.BuildFilterChainForRoute(route);
+      if (!filter_list.ok()) return filter_list.status();
+      config_selector_route.filter_list =
+          filter_list->TakeAsSubclass<const FilterList>();
     }
   }
+  config_selector->route_config_ = std::move(route_config);
   return config_selector;
 }
 
+std::unique_ptr<ServerConfigSelector::ConnectionState>
+XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::L4FilterChain::
+    XdsServerConfigSelector::BuildFilterChains(FilterChainBuilder& builder) {
+  auto connection_state = std::make_unique<XdsConnectionState>();
+  // It's likely that multiple routes have the same filter list, so we
+  // reuse filter chains if possible.
+  absl::flat_hash_map<const FilterList*,
+                      absl::StatusOr<RefCountedPtr<const FilterChain>>>
+      cache;
+  for (const auto& vhost : virtual_hosts_) {
+    for (const auto& route : vhost.routes) {
+      absl::StatusOr<RefCountedPtr<const FilterChain>> filter_chain;
+      auto it = cache.find(route.filter_list.get());
+      if (it == cache.end()) {
+        // Not found in cache, so construct a new filter chain.
+        for (const auto& [factory, config] : route.filter_list->filters) {
+          factory->AddFilter(builder, config);
+        }
+        filter_chain = builder.Build();
+        cache.emplace(route.filter_list.get(), filter_chain);
+      } else {
+        filter_chain = it->second;
+      }
+      connection_state->filter_chains.emplace(&route, std::move(filter_chain));
+    }
+  }
+  return connection_state;
+}
+
 absl::StatusOr<ServerConfigSelector::CallConfig>
-XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    XdsServerConfigSelector::GetCallConfig(grpc_metadata_batch* metadata) {
+XdsServerConfigFetcher::ListenerWatcher::XdsConnectionManager::L4FilterChain::
+    XdsServerConfigSelector::GetCallConfig(const ConnectionState* state,
+                                           grpc_metadata_batch* metadata) {
   CallConfig call_config;
   if (metadata->get_pointer(HttpPathMetadata()) == nullptr) {
     return absl::InternalError("no path found");
@@ -1176,7 +1319,7 @@ XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
   absl::string_view authority =
       metadata->get_pointer(HttpAuthorityMetadata())->as_string_view();
   auto vhost_index = XdsRouting::FindVirtualHostForDomain(
-      VirtualHostListIterator(&virtual_hosts_), authority);
+      VirtualHostListIterator(virtual_hosts_), authority);
   if (!vhost_index.has_value()) {
     return absl::UnavailableError(
         absl::StrCat("could not find VirtualHost for ", authority,
@@ -1184,125 +1327,40 @@ XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
   }
   auto& virtual_host = virtual_hosts_[vhost_index.value()];
   auto route_index = XdsRouting::GetRouteForRequest(
-      VirtualHost::RouteListIterator(&virtual_host.routes), path, metadata);
-  if (route_index.has_value()) {
-    auto& route = virtual_host.routes[route_index.value()];
-    // Found the matching route
-    if (route.unsupported_action) {
-      return absl::UnavailableError("matching route has unsupported action");
-    }
-    if (route.method_config != nullptr) {
-      call_config.method_configs =
-          route.method_config->GetMethodParsedConfigVector(grpc_empty_slice());
-      call_config.service_config = route.method_config;
-    }
-    return call_config;
-  }
-  return absl::UnavailableError("no route matched");
-}
-
-//
-// XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::DynamicXdsServerConfigSelectorProvider
-//
-
-XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    DynamicXdsServerConfigSelectorProvider::
-        DynamicXdsServerConfigSelectorProvider(
-            RefCountedPtr<GrpcXdsClient> xds_client, std::string resource_name,
-            absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>>
-                initial_resource,
-            std::vector<XdsListenerResource::HttpConnectionManager::HttpFilter>
-                http_filters)
-    : xds_client_(std::move(xds_client)),
-      resource_name_(std::move(resource_name)),
-      http_filters_(std::move(http_filters)),
-      resource_(std::move(initial_resource)) {
-  GRPC_CHECK(!resource_name_.empty());
-  // RouteConfigWatcher is being created here instead of in Watch() to avoid
-  // deadlocks from invoking XdsRouteConfigResourceType::StartWatch whilst in a
-  // critical region.
-  auto route_config_watcher = MakeRefCounted<RouteConfigWatcher>(
-      WeakRefAsSubclass<DynamicXdsServerConfigSelectorProvider>());
-  route_config_watcher_ = route_config_watcher.get();
-  XdsRouteConfigResourceType::StartWatch(xds_client_.get(), resource_name_,
-                                         std::move(route_config_watcher));
-}
-
-void XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    DynamicXdsServerConfigSelectorProvider::Orphaned() {
-  XdsRouteConfigResourceType::CancelWatch(xds_client_.get(), resource_name_,
-                                          route_config_watcher_,
-                                          false /* delay_unsubscription */);
-}
-
-absl::StatusOr<RefCountedPtr<ServerConfigSelector>>
-XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    DynamicXdsServerConfigSelectorProvider::Watch(
-        std::unique_ptr<
-            ServerConfigSelectorProvider::ServerConfigSelectorWatcher>
-            watcher) {
-  absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>> resource;
-  {
-    MutexLock lock(&mu_);
-    GRPC_CHECK(watcher_ == nullptr);
-    watcher_ = std::move(watcher);
-    resource = resource_;
-  }
-  if (!resource.ok()) {
-    return resource.status();
-  }
-  return XdsServerConfigSelector::Create(
-      DownCast<const GrpcXdsBootstrap&>(xds_client_->bootstrap())
-          .http_filter_registry(),
-      resource.value(), http_filters_);
-}
-
-void XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    DynamicXdsServerConfigSelectorProvider::CancelWatch() {
-  MutexLock lock(&mu_);
-  watcher_.reset();
-}
-
-void XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    DynamicXdsServerConfigSelectorProvider::OnRouteConfigChanged(
-        absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>>
-            rds_update) {
-  MutexLock lock(&mu_);
-  if (!rds_update.ok()) {
-    rds_update = absl::UnavailableError(absl::StrCat(
-        "RDS resource ", resource_name_, ": ", rds_update.status().message()));
-  }
-  resource_ = std::move(rds_update);
-  if (watcher_ == nullptr) {
-    return;
-  }
-  // Currently server_config_selector_filter does not call into
-  // DynamicXdsServerConfigSelectorProvider while holding a lock, but if that
-  // ever changes, we would want to invoke the update outside the critical
-  // region with the use of a WorkSerializer.
-  if (!resource_.ok()) {
-    watcher_->OnServerConfigSelectorUpdate(resource_.status());
+      VirtualHost::RouteListIterator(virtual_host.routes), path, metadata);
+  if (!route_index.has_value()) {
+    return absl::UnavailableError("no route matched");
+  }
+  auto& route = virtual_host.routes[*route_index];
+  // Found the matching route
+  if (route.unsupported_action) {
+    return absl::UnavailableError("matching route has unsupported action");
+  }
+  // Find filter chain.
+  const auto& filter_chains =
+      DownCast<const XdsConnectionState*>(state)->filter_chains;
+  auto it = filter_chains.find(&route);
+  if (it == filter_chains.end()) {
+    // Should never happen.
+    call_config.filter_chain =
+        absl::InternalError("no filter chain found for route");
   } else {
-    watcher_->OnServerConfigSelectorUpdate(XdsServerConfigSelector::Create(
-        DownCast<const GrpcXdsBootstrap&>(xds_client_->bootstrap())
-            .http_filter_registry(),
-        *resource_, http_filters_));
+    call_config.filter_chain = it->second;
   }
-}
-
-void XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    DynamicXdsServerConfigSelectorProvider::OnAmbientError(
-        absl::Status status) {
-  LOG(ERROR) << "RouteConfigWatcher:" << this
-             << " XdsClient reports ambient error: " << status << " for "
-             << resource_name_ << "; ignoring in favor of existing resource";
+  return call_config;
 }
 
 }  // namespace
 }  // namespace grpc_core
 
+grpc_server_config_fetcher* grpc_server_config_fetcher_xds_create_legacy(
+    grpc_server_xds_status_notifier notifier, const grpc_channel_args* args);
+
 grpc_server_config_fetcher* grpc_server_config_fetcher_xds_create(
     grpc_server_xds_status_notifier notifier, const grpc_channel_args* args) {
+  if (!grpc_core::IsXdsServerFilterChainPerRouteEnabled()) {
+    return grpc_server_config_fetcher_xds_create_legacy(notifier, args);
+  }
   grpc_core::ExecCtx exec_ctx;
   grpc_core::ChannelArgs channel_args = grpc_core::CoreConfiguration::Get()
                                             .channel_args_preconditioning()
@@ -1319,15 +1377,19 @@ grpc_server_config_fetcher* grpc_server_config_fetcher_xds_create(
     LOG(ERROR) << "Failed to create xds client: " << xds_client.status();
     return nullptr;
   }
-  if (grpc_core::DownCast<const grpc_core::GrpcXdsBootstrap&>(
-          (*xds_client)->bootstrap())
-          .server_listener_resource_name_template()
-          .empty()) {
-    LOG(ERROR) << "server_listener_resource_name_template not provided in "
-                  "bootstrap file.";
-    return nullptr;
+  auto generator =
+      channel_args.GetObjectRef<grpc_core::XdsResourceNameGenerator>();
+  if (generator == nullptr) {
+    if (grpc_core::DownCast<const grpc_core::GrpcXdsBootstrap&>(
+            (*xds_client)->bootstrap())
+            .server_listener_resource_name_template()
+            .empty()) {
+      LOG(ERROR) << "server_listener_resource_name_template not provided in "
+                    "bootstrap file.";
+      return nullptr;
+    }
   }
   return (new grpc_core::XdsServerConfigFetcher(std::move(*xds_client),
-                                                notifier))
+                                                notifier, std::move(generator)))
       ->c_ptr();
 }