Index: sys/netinet/tcp_input.c =================================================================== --- sys/netinet/tcp_input.c +++ sys/netinet/tcp_input.c @@ -1734,7 +1734,7 @@ tp->snd_nxt == tp->snd_max && tiwin && tiwin == tp->snd_wnd && ((tp->t_flags & (TF_NEEDSYN|TF_NEEDFIN)) == 0) && - LIST_EMPTY(&tp->t_segq) && + TAILQ_EMPTY(&tp->t_segq) && ((to.to_flags & TOF_TS) == 0 || TSTMP_GEQ(to.to_tsval, tp->ts_recent)) ) { @@ -2440,7 +2440,7 @@ * later; if not, do so now to pass queued data to user. */ if (tlen == 0 && (thflags & TH_FIN) == 0) - (void) tcp_reass(tp, (struct tcphdr *)0, 0, + (void) tcp_reass(tp, (struct tcphdr *)0, NULL, 0, (struct mbuf *)0); tp->snd_wl1 = th->th_seq - 1; /* FALLTHROUGH */ @@ -3017,7 +3017,7 @@ * fast retransmit can work). */ if (th->th_seq == tp->rcv_nxt && - LIST_EMPTY(&tp->t_segq) && + TAILQ_EMPTY(&tp->t_segq) && (TCPS_HAVEESTABLISHED(tp->t_state) || tfo_syn)) { if (DELAY_ACK(tp, tlen) || tfo_syn) @@ -3042,7 +3042,7 @@ * m_adj() doesn't actually frees any mbufs * when trimming from the head. */ - thflags = tcp_reass(tp, th, &tlen, m); + thflags = tcp_reass(tp, th, &save_start, &tlen, m); tp->t_flags |= TF_ACKNOW; } if (tlen > 0 && (tp->t_flags & TF_SACK_PERMIT)) Index: sys/netinet/tcp_log_buf.h =================================================================== --- sys/netinet/tcp_log_buf.h +++ sys/netinet/tcp_log_buf.h @@ -217,7 +217,9 @@ BBR_LOG_REDUCE, /* old bbr log reduce for 4.1 and earlier 46*/ TCP_LOG_RTT, /* A rtt (in useconds) is being sampled and applied to the srtt algo 47 */ BBR_LOG_SETTINGS_CHG, /* Settings changed for loss response 48 */ - TCP_LOG_END /* End (keep at end) 49 */ + BBR_LOG_SRTT_GAIN_EVENT, /* SRTT gaining 49 */ + TCP_LOG_REASS, /* Reassembly buffer logging 50 */ + TCP_LOG_END /* End (keep at end) 51 */ }; enum tcp_log_states { Index: sys/netinet/tcp_reass.c =================================================================== --- sys/netinet/tcp_reass.c +++ sys/netinet/tcp_reass.c @@ -72,6 +72,8 @@ #include #include #include +#include +#include #include #include #ifdef TCPDEBUG @@ -78,9 +80,28 @@ #include #endif /* TCPDEBUG */ +#define TCP_R_LOG_ADD 1 +#define TCP_R_LOG_LIMIT_REACHED 2 +#define TCP_R_LOG_APPEND 3 +#define TCP_R_LOG_PREPEND 4 +#define TCP_R_LOG_REPLACE 5 +#define TCP_R_LOG_MERGE_INTO 6 +#define TCP_R_LOG_NEW_ENTRY 7 +#define TCP_R_LOG_READ 8 +#define TCP_R_LOG_ZERO 9 +#define TCP_R_LOG_DUMP 10 +#define TCP_R_LOG_TRIM 11 + +/* For debugging we want counters and BB logging */ +/*#define TCP_REASS_COUNTERS 1*/ +/*#define TCP_REASS_LOGGING 1*/ + static SYSCTL_NODE(_net_inet_tcp, OID_AUTO, reass, CTLFLAG_RW, 0, "TCP Segment Reassembly Queue"); +static SYSCTL_NODE(_net_inet_tcp_reass, OID_AUTO, stats, CTLFLAG_RW, 0, + "TCP Segment Reassembly stats"); + static int tcp_reass_maxseg = 0; SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, maxsegments, CTLFLAG_RDTUN, &tcp_reass_maxseg, 0, @@ -96,6 +117,62 @@ &tcp_reass_maxqueuelen, 0, "Maximum number of TCP Segments per Reassembly Queue"); +#ifdef TCP_REASS_COUNTERS + +counter_u64_t reass_entry; +SYSCTL_COUNTER_U64(_net_inet_tcp_reass_stats, OID_AUTO, entry, CTLFLAG_RD, + &reass_entry, "A segment entered reassembly "); + +counter_u64_t reass_path1; +SYSCTL_COUNTER_U64(_net_inet_tcp_reass_stats, OID_AUTO, path1, CTLFLAG_RD, + &reass_path1, "Took path 1"); + +counter_u64_t reass_path2; +SYSCTL_COUNTER_U64(_net_inet_tcp_reass_stats, OID_AUTO, path2, CTLFLAG_RD, + &reass_path2, "Took path 2"); + +counter_u64_t reass_path3; +SYSCTL_COUNTER_U64(_net_inet_tcp_reass_stats, OID_AUTO, path3, CTLFLAG_RD, + &reass_path3, "Took path 3"); + +counter_u64_t reass_path4; +SYSCTL_COUNTER_U64(_net_inet_tcp_reass_stats, OID_AUTO, path4, CTLFLAG_RD, + &reass_path4, "Took path 4"); + +counter_u64_t reass_path5; +SYSCTL_COUNTER_U64(_net_inet_tcp_reass_stats, OID_AUTO, path5, CTLFLAG_RD, + &reass_path5, "Took path 5"); + +counter_u64_t reass_path6; +SYSCTL_COUNTER_U64(_net_inet_tcp_reass_stats, OID_AUTO, path6, CTLFLAG_RD, + &reass_path6, "Took path 6"); + +counter_u64_t reass_path7; +SYSCTL_COUNTER_U64(_net_inet_tcp_reass_stats, OID_AUTO, path7, CTLFLAG_RD, + &reass_path7, "Took path 7"); + +counter_u64_t reass_fullwalk; +SYSCTL_COUNTER_U64(_net_inet_tcp_reass_stats, OID_AUTO, fullwalk, CTLFLAG_RD, + &reass_fullwalk, "Took a full walk "); + +counter_u64_t reass_nospace; +SYSCTL_COUNTER_U64(_net_inet_tcp_reass_stats, OID_AUTO, nospace, CTLFLAG_RD, + &reass_nospace, "Had no mbuf capacity "); + +counter_u64_t merge_fwd; +SYSCTL_COUNTER_U64(_net_inet_tcp_reass_stats, OID_AUTO, merge_fwd, CTLFLAG_RD, + &merge_fwd, "Ran merge fwd"); + +counter_u64_t merge_into; +SYSCTL_COUNTER_U64(_net_inet_tcp_reass_stats, OID_AUTO, merge_into, CTLFLAG_RD, + &merge_into, "Ran merge into"); + +counter_u64_t tcp_bad_input; +SYSCTL_COUNTER_U64(_net_inet_tcp_reass_stats, OID_AUTO, bad_input, CTLFLAG_RD, + &tcp_bad_input, "The reassembly buffer saw bad input (zero len segment etc)"); + +#endif + /* Initialize TCP reassembly queue */ static void tcp_reass_zone_change(void *tag) @@ -107,6 +184,73 @@ tcp_reass_maxseg); } +#ifdef TCP_REASS_LOGGING + +static void +tcp_log_reassm(struct tcpcb *tp, struct tseg_qent *q, struct tseg_qent *p, + tcp_seq seq, int len, uint8_t action, int instance) +{ + uint32_t cts; + struct timeval tv; + if (tp->t_logstate != TCP_LOG_STATE_OFF) { + union tcp_log_stackspecific log; + + cts = tcp_get_usecs(&tv); + log.u_bbr.flex1 = seq; + log.u_bbr.cur_del_rate = (uint64_t)q; + log.u_bbr.delRate = (uint64_t)p; + if (q != NULL) { + log.u_bbr.flex2 = q->tqe_start; + log.u_bbr.flex3 = q->tqe_len; + log.u_bbr.flex4 = q->tqe_mbuf_cnt; + } + if (p != NULL) { + log.u_bbr.flex5 = p->tqe_start; + log.u_bbr.pkts_out = p->tqe_len; + log.u_bbr.epoch = p->tqe_mbuf_cnt; + } + log.u_bbr.flex6 = tp->t_segqmbuflen; + log.u_bbr.flex7 = instance; + log.u_bbr.flex8 = action; + log.u_bbr.timeStamp = cts; + TCP_LOG_EVENTP(tp, NULL, + &tp->t_inpcb->inp_socket->so_rcv, + &tp->t_inpcb->inp_socket->so_snd, + TCP_LOG_REASS, 0, + len, &log, false, &tv); + } +} + +static void +tcp_reass_log_dump(struct tcpcb *tp) +{ + struct tseg_qent *q; + + if (tp->t_logstate != TCP_LOG_STATE_OFF) { + TAILQ_FOREACH(q, &tp->t_segq, tqe_q) { + tcp_log_reassm(tp, q, NULL, q->tqe_start, q->tqe_len, TCP_R_LOG_DUMP, 0); + } + }; +} + +static void +tcp_reass_log_new_in(struct tcpcb *tp, tcp_seq seq, int len, struct mbuf *m, + int logval, + struct tseg_qent *q) +{ + int cnt; + struct mbuf *t; + cnt = 0; + t = m; + while (t) { + cnt += t->m_len; + t = t->m_next; + } + tcp_log_reassm(tp, q, NULL, seq, len, logval, cnt); +} + +#endif + void tcp_reass_global_init(void) { @@ -119,8 +263,24 @@ /* Set the zone limit and read back the effective value. */ tcp_reass_maxseg = uma_zone_set_max(tcp_reass_zone, tcp_reass_maxseg); +#ifdef TCP_REASS_COUNTERS + reass_path1 = counter_u64_alloc(M_WAITOK); + reass_path2 = counter_u64_alloc(M_WAITOK); + reass_path3 = counter_u64_alloc(M_WAITOK); + reass_path4 = counter_u64_alloc(M_WAITOK); + reass_path5 = counter_u64_alloc(M_WAITOK); + reass_path6 = counter_u64_alloc(M_WAITOK); + reass_path7 = counter_u64_alloc(M_WAITOK); + reass_fullwalk = counter_u64_alloc(M_WAITOK); + reass_nospace = counter_u64_alloc(M_WAITOK); + reass_entry = counter_u64_alloc(M_WAITOK); + merge_fwd = counter_u64_alloc(M_WAITOK); + merge_into = counter_u64_alloc(M_WAITOK); + tcp_bad_input = counter_u64_alloc(M_WAITOK); +#endif EVENTHANDLER_REGISTER(nmbclusters_change, tcp_reass_zone_change, NULL, EVENTHANDLER_PRI_ANY); + } void @@ -130,32 +290,247 @@ INP_WLOCK_ASSERT(tp->t_inpcb); - while ((qe = LIST_FIRST(&tp->t_segq)) != NULL) { - LIST_REMOVE(qe, tqe_q); + while ((qe = TAILQ_FIRST(&tp->t_segq)) != NULL) { + TAILQ_REMOVE(&tp->t_segq, qe, tqe_q); m_freem(qe->tqe_m); uma_zfree(tcp_reass_zone, qe); tp->t_segqlen--; } - + tp->t_segqmbuflen = 0; KASSERT((tp->t_segqlen == 0), ("TCP reass queue %p segment count is %d instead of 0 after flush.", tp, tp->t_segqlen)); } +static int +tcp_reass_setuplast(struct tseg_qent *q) +{ + /* + * We enter with q->tqe_last set + * to a mbuf, but we are not sure it is + * the last. We run though and move it + * to the last mbuf. Keeping track + * of the mbuf sizing which we + * return aftre setting up last. + */ + struct mbuf *m; + int cnt=0; + + m = q->tqe_last; + cnt += MSIZE; + if (m->m_flags & M_EXT) + cnt += m->m_ext.ext_size; + while (m->m_next != NULL) { + m = m->m_next; + cnt += MSIZE; + if (m->m_flags & M_EXT) + cnt += m->m_ext.ext_size; + } + /* M is now the last */ + q->tqe_last = m; + return(cnt); +} + + +static void +tcp_reass_append(struct tcpcb *tp, struct tseg_qent *last, struct mbuf *m, struct tcphdr *th, + int *tlenp, int in, struct mbuf *mlast, int lenofoh) +{ + +#ifdef TCP_REASS_LOGGING + tcp_log_reassm(tp, last, NULL, th->th_seq, *tlenp, TCP_R_LOG_APPEND, in); +#endif + last->tqe_len += *tlenp; + last->tqe_m->m_pkthdr.len += *tlenp; + /* Preserve the FIN bit if its there */ + last->tqe_flags |= (th->th_flags & TH_FIN); + last->tqe_last->m_next = m; + last->tqe_last = mlast; + last->tqe_mbuf_cnt += lenofoh; +#ifdef TCP_REASS_LOGGING + tcp_reass_log_new_in(tp, last->tqe_start, lenofoh, last->tqe_m, + TCP_R_LOG_APPEND, + last); +#endif +} + +static void +tcp_reass_prepend(struct tcpcb *tp, struct tseg_qent *first, struct mbuf *m, struct tcphdr *th, + int *tlenp, int in, struct mbuf *mlast, int lenofoh) +{ + int i; + +#ifdef TCP_REASS_LOGGING + tcp_log_reassm(tp, first, NULL, th->th_seq, *tlenp, TCP_R_LOG_PREPEND, in); +#endif + if (SEQ_GT((th->th_seq + *tlenp), first->tqe_start)) { + /* The new data overlaps into the old */ + i = (th->th_seq + *tlenp) - first->tqe_start; +#ifdef TCP_REASS_LOGGING + tcp_log_reassm(tp, first, NULL, 0, i, TCP_R_LOG_TRIM, 1); +#endif + m_adj(first->tqe_m, i); + first->tqe_len -= i; + first->tqe_start += i; + } + /* Ok now setup our chain to point to the old first */ + mlast->m_next = first->tqe_m; + first->tqe_m = m; + first->tqe_len += *tlenp; + first->tqe_start = th->th_seq; + first->tqe_m->m_pkthdr.len = first->tqe_len; + first->tqe_mbuf_cnt += lenofoh; +#ifdef TCP_REASS_LOGGING + tcp_reass_log_new_in(tp, first->tqe_start, lenofoh, first->tqe_m, + TCP_R_LOG_PREPEND, + first); +#endif +} + +static void +tcp_reas_replace(struct tcpcb *tp, struct tseg_qent *q, struct mbuf *m, + tcp_seq seq, int len, struct mbuf *mlast, int mbufoh) +{ + /* + * Free the data in q, and replace + * it with the new segment. + */ + +#ifdef TCP_REASS_LOGGING + tcp_log_reassm(tp, q, NULL, seq, len, TCP_R_LOG_REPLACE, 0); +#endif + m_freem(q->tqe_m); + KASSERT(tp->t_segqmbuflen >= q->tqe_mbuf_cnt, + ("Tp:%p seg queue goes negative", tp)); + tp->t_segqmbuflen -= q->tqe_mbuf_cnt; + q->tqe_mbuf_cnt = mbufoh; + q->tqe_m = m; + q->tqe_last = mlast; + q->tqe_start = seq; + q->tqe_len = len; + q->tqe_m->m_pkthdr.len = q->tqe_len; + tp->t_segqmbuflen += mbufoh; +} + +static void +tcp_reas_merge_into(struct tcpcb *tp, struct tseg_qent *ent, struct tseg_qent *q) +{ + /* + * Merge q into ent and free q from the list. + */ +#ifdef TCP_REASS_LOGGING + tcp_log_reassm(tp, q, ent, 0, 0, TCP_R_LOG_MERGE_INTO, 0); +#endif +#ifdef TCP_REASS_COUNTERS + counter_u64_add(merge_into, 1); +#endif + ent->tqe_last->m_next = q->tqe_m; + ent->tqe_last = q->tqe_last; + ent->tqe_len += q->tqe_len; + ent->tqe_mbuf_cnt += q->tqe_mbuf_cnt; + ent->tqe_m->m_pkthdr.len += q->tqe_len; + ent->tqe_flags |= (q->tqe_flags & TH_FIN); + TAILQ_REMOVE(&tp->t_segq, q, tqe_q); + uma_zfree(tcp_reass_zone, q); + tp->t_segqlen--; + +} + +static void +tcp_reas_merge_forward(struct tcpcb *tp, struct tseg_qent *ent) +{ + struct tseg_qent *q, *qtmp; + int i; + tcp_seq max; + /* + * Given an entry merge forward anyplace + * that ent overlaps forward. + */ + + max = ent->tqe_start + ent->tqe_len; + q = TAILQ_NEXT(ent, tqe_q); + if (q == NULL) { + /* Nothing left */ + return; + } + TAILQ_FOREACH_FROM_SAFE(q, &tp->t_segq, tqe_q, qtmp) { + if (SEQ_GT(q->tqe_start, max)) { + /* Beyond q */ + break; + } + /* We have some or all that are overlapping */ + if (SEQ_GEQ(max, (q->tqe_start + q->tqe_len))) { + /* It consumes it all */ + tp->t_segqmbuflen -= q->tqe_mbuf_cnt; + m_freem(q->tqe_m); + TAILQ_REMOVE(&tp->t_segq, q, tqe_q); + uma_zfree(tcp_reass_zone, q); + tp->t_segqlen--; + continue; + } + /* + * Trim the q entry to dovetail to this one + * and then merge q into ent updating max + * in the process. + */ + i = max - q->tqe_start; +#ifdef TCP_REASS_LOGGING + tcp_log_reassm(tp, q, NULL, 0, i, TCP_R_LOG_TRIM, 2); +#endif + m_adj(q->tqe_m, i); + q->tqe_len -= i; + q->tqe_start += i; + tcp_reas_merge_into(tp, ent, q); + max = ent->tqe_start + ent->tqe_len; + } +#ifdef TCP_REASS_COUNTERS + counter_u64_add(merge_fwd, 1); +#endif +} + +static int +tcp_reass_overhead_of_chain(struct mbuf *m, struct mbuf **mlast) +{ + int len = 0; + + if (m->m_flags & M_EXT) + len += m->m_ext.ext_size; + while (m->m_next != NULL) { + m = m->m_next; + len += MSIZE; + if (m->m_flags & M_EXT) + len += m->m_ext.ext_size; + } + *mlast = m; + return (len); +} + + +/* + * NOTE!!! the new tcp-reassembly code *must not* use + * m_adj() with a negative index. That alters the chain + * of mbufs (by possibly chopping trailing mbufs). At + * the front of tcp_reass we count the mbuf overhead + * and setup the tail pointer. If we use m_adj(m, -5) + * we could corrupt the tail pointer. Currently the + * code only uses m_adj(m, postive-num). If this + * changes appropriate changes to update mlast would + * be needed. + */ int -tcp_reass(struct tcpcb *tp, struct tcphdr *th, int *tlenp, struct mbuf *m) +tcp_reass(struct tcpcb *tp, struct tcphdr *th, tcp_seq *seq_start, int *tlenp, struct mbuf *m) { - struct tseg_qent *q; + struct tseg_qent *q, *last, *first; struct tseg_qent *p = NULL; - struct tseg_qent *nq; + struct tseg_qent *nq = NULL; struct tseg_qent *te = NULL; + struct mbuf *mlast=NULL; + struct sockbuf *sb; struct socket *so = tp->t_inpcb->inp_socket; char *s = NULL; - int flags; - struct tseg_qent tqs; + int flags, i, lenofoh; INP_WLOCK_ASSERT(tp->t_inpcb); - /* * XXX: tcp_reass() is rather inefficient with its data structures * and should be rewritten (see NetBSD for optimizations). @@ -167,8 +542,356 @@ */ if (th == NULL) goto present; + KASSERT(SEQ_GEQ(th->th_seq, tp->rcv_nxt), + ("Attempt to add old entry to reassembly queue (th=%p, tp=%p)", + th, tp)); +#ifdef TCP_REASS_LOGGING + tcp_reass_log_new_in(tp, th->th_seq, *tlenp, m, TCP_R_LOG_ADD, NULL); +#endif +#ifdef TCP_REASS_COUNTERS + counter_u64_add(reass_entry, 1); +#endif + /* + * Check for bad input. + */ + if (*tlenp == 0) { + /* + * A zero length segment does no + * one any good. We could check + * the rcv_nxt <-> rcv_wnd but thats + * already done for us by the caller. + */ +#ifdef TCP_REASS_COUNTERS + counter_u64_add(tcp_bad_input, 1); +#endif + m_freem(m); + *tlenp = 0; +#ifdef TCP_REASS_LOGGING + tcp_reass_log_dump(tp); +#endif + return (0); + } + /* + * Will it fit? + */ + lenofoh = tcp_reass_overhead_of_chain(m, &mlast); + sb = &tp->t_inpcb->inp_socket->so_rcv; + if ((sb->sb_mbcnt + tp->t_segqmbuflen + lenofoh) > sb->sb_mbmax) { + /* No room */ + TCPSTAT_INC(tcps_rcvreassfull); +#ifdef TCP_REASS_COUNTERS + counter_u64_add(reass_nospace, 1); +#endif +#ifdef TCP_REASS_LOGGING + tcp_log_reassm(tp, NULL, NULL, th->th_seq, lenofoh, TCP_R_LOG_LIMIT_REACHED, 0); +#endif + m_freem(m); + *tlenp = 0; +#ifdef TCP_REASS_LOGGING + tcp_reass_log_dump(tp); +#endif + return (0); + } + /* + * First lets deal with two common cases, the + * segment appends to the back of our collected + * segments. Or the segment is the next in line. + */ + last = TAILQ_LAST_FAST(&tp->t_segq, tseg_qent, tqe_q); + if (last) { + if ((SEQ_GEQ(th->th_seq, last->tqe_start)) && + (SEQ_GEQ((last->tqe_start + last->tqe_len), th->th_seq))) { + /* Common case, trailing segment is added */ + /** + * +--last + * v + * reassembly buffer |---| |---| |---| + * new segment |---| + */ +#ifdef TCP_REASS_COUNTERS + counter_u64_add(reass_path1, 1); +#endif + if (SEQ_GT((last->tqe_start + last->tqe_len), th->th_seq)) { + i = (last->tqe_start + last->tqe_len) - th->th_seq; + if (i < *tlenp) { +#ifdef TCP_REASS_LOGGING + tcp_log_reassm(tp, last, NULL, 0, i, TCP_R_LOG_TRIM, 3); +#endif + m_adj(m, i); + *tlenp -= i; + th->th_seq += i; + } else { + /* Complete overlap */ + TCPSTAT_INC(tcps_rcvduppack); + TCPSTAT_ADD(tcps_rcvdupbyte, *tlenp); + m_freem(m); + goto present; + } + } + tcp_reass_append(tp, last, m, th, tlenp, 1, mlast, lenofoh); + tp->t_segqmbuflen += lenofoh; + *seq_start = last->tqe_start; + *tlenp = last->tqe_len; + goto present; + } else if (SEQ_GEQ(th->th_seq, (last->tqe_start + last->tqe_len))) { + /* + * Second common case, we missed + * another one and have something more + * for the end. + */ + /** + * +--last + * v + * reassembly buffer |---| |---| |---| + * new segment |---| + */ +#ifdef TCP_REASS_COUNTERS + counter_u64_add(reass_path2, 1); +#endif + p = last; + q = NULL; + goto new_entry; + } + } else if (last == NULL) { + /* First one in */ + q = NULL; + goto new_entry; + } + first = TAILQ_FIRST(&tp->t_segq); + if (first && + (SEQ_LT(th->th_seq, first->tqe_start)) && + ((th->th_seq + *tlenp) == first->tqe_start)) { + /* + * The head of the queue is prepended by this and + * it may be the one I want most. + */ + /** + * first-------+ + * v + * reassembly buffer |---| |---| |---| + * new segment |---| + */ + struct mbuf *foobar; +#ifdef TCP_REASS_COUNTERS + counter_u64_add(reass_path3, 1); +#endif + if (SEQ_LT(th->th_seq, tp->rcv_nxt)) { + /* + * The resend was even before + * what we have. We need to trim it. + * Note TSNH (it should be trimmed + * before the call to tcp_reass()). + */ + i = tp->rcv_nxt - th->th_seq; +#ifdef TCP_REASS_LOGGING + tcp_log_reassm(tp, first, NULL, 0, i, TCP_R_LOG_TRIM, 4); +#endif + m_adj(first->tqe_m, i); + first->tqe_len -= i; + *tlenp -= i; + first->tqe_m->m_pkthdr.len -= i; + first->tqe_start = tp->rcv_nxt; + } + foobar = first->tqe_m; + tcp_reass_prepend(tp, first, m, th, tlenp, 1, mlast, lenofoh); + if (foobar == first->tqe_m) { + panic("First stayed same m:%p foobar:%p first->tqe_m:%p tp:%p first:%p", + m, foobar, first->tqe_m, tp, first); + } else if (first->tqe_m != m) { + panic("First did not change to m:%p foobar:%p first->tqe_m:%p tp:%p first:%p", + m, foobar, first->tqe_m, tp, first); + } + tp->t_segqmbuflen += lenofoh; + *seq_start = first->tqe_start; + *tlenp = first->tqe_len; + goto present; + } else if (first == last) { + /* Second one in */ + if (SEQ_GT(th->th_seq, (first->tqe_start + first->tqe_len))) { + /* first is behind us (p) */ + /** + * first---->+<----last + * v + * reassembly buffer |---| + * new segment |---| + */ + p = first; + q = NULL; + goto new_entry; + } else if (SEQ_LT((th->th_seq + *tlenp), first->tqe_start)) { + /* first is ahead of us (q) with no overlap */ + /** + * first---->+<----last + * v + * reassembly buffer |---| + * new segment |---| + */ + p = NULL; + q = first; + goto new_entry; + } + } /* + * Find a segment which begins after this one does. + */ +#ifdef TCP_REASS_COUNTERS + counter_u64_add(reass_fullwalk, 1); +#endif + TAILQ_FOREACH(q, &tp->t_segq, tqe_q) { + if (SEQ_GT(q->tqe_start, th->th_seq)) + break; + p = q; + } + /* + * If there is a preceding segment, it may provide some of + * our data already. If so, drop the data from the incoming + * segment. If it provides all of our data, drop the + * entire mbuf. + */ + if (p != NULL) { + int i; + /* conversion to int (in i) handles seq wraparound */ + i = p->tqe_start + p->tqe_len - th->th_seq; + if (i >= 0) { + if (i >= *tlenp) { + /** + * prev seg---->+ + * v + * reassembly buffer |---| + * new segment |-| + */ + TCPSTAT_INC(tcps_rcvduppack); + TCPSTAT_ADD(tcps_rcvdupbyte, *tlenp); + m_freem(m); + /* + * Try to present any queued data + * at the left window edge to the user. + * This is needed after the 3-WHS + * completes. Note this probably + * will not work and we will return. + */ + goto present; + } + if (i > 0) { + /** + * prev seg---->+ + * v + * reassembly buffer |---| + * new segment |-----| + */ +#ifdef TCP_REASS_LOGGING + tcp_log_reassm(tp, p, NULL, 0, i, TCP_R_LOG_TRIM, 5); +#endif + m_adj(m, i); + *tlenp -= i; + th->th_seq += i; + } + } + } + if (q && + SEQ_GT((th->th_seq + *tlenp), q->tqe_start)) { + /* + * The new data runs over the + * top of previously sack'd data. It + * may be partially overlapping, or + * it may overlap the entire segment. + */ + if (SEQ_GEQ((th->th_seq + *tlenp), (q->tqe_start + q->tqe_len))) { + /* It consumes it all */ + /** + * next seg---->+ + * v + * reassembly buffer |--| |---| + * new segment |----------| + */ +#ifdef TCP_REASS_COUNTERS + counter_u64_add(reass_path4, 1); +#endif + tcp_reas_replace(tp, q, m, th->th_seq, *tlenp, mlast, lenofoh); + /* Now does it go further than that? */ + tcp_reas_merge_forward(tp, q); + } else { + /* + * We just need to prepend the data + * to this. It does not overrun + * the end. + */ + /** + * next seg---->+ + * v + * reassembly buffer |--| |---| + * new segment |----------| + */ +#ifdef TCP_REASS_COUNTERS + counter_u64_add(reass_path5, 1); +#endif + tcp_reass_prepend(tp, q, m, th, tlenp, 2, mlast, lenofoh); + tp->t_segqmbuflen += lenofoh; + } + /* + * Now if there is a previous we may be + * able to merge them. + */ + if ((p) && + ((p->tqe_start + p->tqe_len) == q->tqe_start)) { + /* + * For the sack update below we need to update + * q to point to p. + */ + /** + * + * reassembly buffer |--|---| + */ +#ifdef TCP_REASS_COUNTERS + counter_u64_add(reass_path6, 1); +#endif + tcp_reas_merge_into(tp, p, q); + q = p; + } + *seq_start = q->tqe_start; + *tlenp = q->tqe_len; + goto present; + } + if (p && + (th->th_seq == (p->tqe_start + p->tqe_len))) { + /* + * If dovetails in with this one + * append it. + */ + /** + * prev seg---->+ + * v + * reassembly buffer |--| |---| + * new segment |--| + * (note: it was trimmed above if it overlapped) + */ +#ifdef TCP_REASS_COUNTERS + counter_u64_add(reass_path7, 1); +#endif + tcp_reass_append(tp, p, m, th, tlenp, 2, mlast, lenofoh); + tp->t_segqmbuflen += lenofoh; + /* + * Does it now dovetail with next if there is + * one? + */ + if (q && + ((p->tqe_start + p->tqe_len) == q->tqe_start)) { + /* Yep we can coalesce further */ + /** + * + * reassembly buffer |--|---| + */ + tcp_reas_merge_into(tp, p, q); + } + *seq_start = p->tqe_start; + *tlenp = p->tqe_len; + goto present; + } + /* + * When we reach here we can't combine it + * with any existing segment. + * * Limit the number of segments that can be queued to reduce the * potential for mbuf exhaustion. For best performance, we want to be * able to queue a full window's worth of segments. The size of the @@ -188,9 +911,10 @@ * Investigate why and re-evaluate the below limit after the behaviour * is understood. */ - if ((th->th_seq != tp->rcv_nxt || !TCPS_HAVEESTABLISHED(tp->t_state)) && +new_entry: + if ((!TCPS_HAVEESTABLISHED(tp->t_state)) && tp->t_segqlen >= min((so->so_rcv.sb_hiwat / tp->t_maxseg) + 1, - tcp_reass_maxqueuelen)) { + tcp_reass_maxqueuelen)) { TCPSTAT_INC(tcps_rcvreassfull); *tlenp = 0; if ((s = tcp_log_addrs(&tp->t_inpcb->inp_inc, th, NULL, NULL))) { @@ -199,122 +923,48 @@ free(s, M_TCPLOG); } m_freem(m); +#ifdef TCP_REASS_LOGGING + tcp_reass_log_dump(tp); +#endif return (0); } - /* * Allocate a new queue entry. If we can't, or hit the zone limit * just drop the pkt. - * - * Use a temporary structure on the stack for the missing segment - * when the zone is exhausted. Otherwise we may get stuck. */ te = uma_zalloc(tcp_reass_zone, M_NOWAIT); if (te == NULL) { - if (th->th_seq != tp->rcv_nxt || !TCPS_HAVEESTABLISHED(tp->t_state)) { - TCPSTAT_INC(tcps_rcvmemdrop); - m_freem(m); - *tlenp = 0; - if ((s = tcp_log_addrs(&tp->t_inpcb->inp_inc, th, NULL, - NULL))) { - log(LOG_DEBUG, "%s; %s: global zone limit " - "reached, segment dropped\n", s, __func__); - free(s, M_TCPLOG); - } - return (0); - } else { - bzero(&tqs, sizeof(struct tseg_qent)); - te = &tqs; - if ((s = tcp_log_addrs(&tp->t_inpcb->inp_inc, th, NULL, - NULL))) { - log(LOG_DEBUG, - "%s; %s: global zone limit reached, using " - "stack for missing segment\n", s, __func__); - free(s, M_TCPLOG); - } + TCPSTAT_INC(tcps_rcvmemdrop); + m_freem(m); + *tlenp = 0; + if ((s = tcp_log_addrs(&tp->t_inpcb->inp_inc, th, NULL, + NULL))) { + log(LOG_DEBUG, "%s; %s: global zone limit " + "reached, segment dropped\n", s, __func__); + free(s, M_TCPLOG); } + return (0); } tp->t_segqlen++; - - /* - * Find a segment which begins after this one does. - */ - LIST_FOREACH(q, &tp->t_segq, tqe_q) { - if (SEQ_GT(q->tqe_th->th_seq, th->th_seq)) - break; - p = q; - } - - /* - * If there is a preceding segment, it may provide some of - * our data already. If so, drop the data from the incoming - * segment. If it provides all of our data, drop us. - */ - if (p != NULL) { - int i; - /* conversion to int (in i) handles seq wraparound */ - i = p->tqe_th->th_seq + p->tqe_len - th->th_seq; - if (i > 0) { - if (i >= *tlenp) { - TCPSTAT_INC(tcps_rcvduppack); - TCPSTAT_ADD(tcps_rcvdupbyte, *tlenp); - m_freem(m); - if (te != &tqs) - uma_zfree(tcp_reass_zone, te); - tp->t_segqlen--; - /* - * Try to present any queued data - * at the left window edge to the user. - * This is needed after the 3-WHS - * completes. - */ - goto present; /* ??? */ - } - m_adj(m, i); - *tlenp -= i; - th->th_seq += i; - } - } tp->t_rcvoopack++; TCPSTAT_INC(tcps_rcvoopack); TCPSTAT_ADD(tcps_rcvoobyte, *tlenp); - - /* - * While we overlap succeeding segments trim them or, - * if they are completely covered, dequeue them. - */ - while (q) { - int i = (th->th_seq + *tlenp) - q->tqe_th->th_seq; - if (i <= 0) - break; - if (i < q->tqe_len) { - q->tqe_th->th_seq += i; - q->tqe_len -= i; - m_adj(q->tqe_m, i); - break; - } - - nq = LIST_NEXT(q, tqe_q); - LIST_REMOVE(q, tqe_q); - m_freem(q->tqe_m); - uma_zfree(tcp_reass_zone, q); - tp->t_segqlen--; - q = nq; - } - /* Insert the new segment queue entry into place. */ te->tqe_m = m; - te->tqe_th = th; + te->tqe_flags = th->th_flags; te->tqe_len = *tlenp; - + te->tqe_start = th->th_seq; + te->tqe_last = m; + te->tqe_mbuf_cnt = tcp_reass_setuplast(te); + tp->t_segqmbuflen += te->tqe_mbuf_cnt; if (p == NULL) { - LIST_INSERT_HEAD(&tp->t_segq, te, tqe_q); + TAILQ_INSERT_HEAD(&tp->t_segq, te, tqe_q); } else { - KASSERT(te != &tqs, ("%s: temporary stack based entry not " - "first element in queue", __func__)); - LIST_INSERT_AFTER(p, te, tqe_q); + TAILQ_INSERT_AFTER(&tp->t_segq, p, te, tqe_q); } - +#ifdef TCP_REASS_LOGGING + tcp_reass_log_new_in(tp, th->th_seq, *tlenp, m, TCP_R_LOG_NEW_ENTRY, te); +#endif present: /* * Present data to user, advancing rcv_nxt through @@ -322,24 +972,55 @@ */ if (!TCPS_HAVEESTABLISHED(tp->t_state)) return (0); - q = LIST_FIRST(&tp->t_segq); - if (!q || q->tqe_th->th_seq != tp->rcv_nxt) + q = TAILQ_FIRST(&tp->t_segq); + KASSERT(q == NULL || SEQ_GEQ(q->tqe_start, tp->rcv_nxt), + ("Reassembly queue for %p has stale entry at head", tp)); + if (!q || q->tqe_start != tp->rcv_nxt) { +#ifdef TCP_REASS_LOGGING + tcp_reass_log_dump(tp); +#endif return (0); + } SOCKBUF_LOCK(&so->so_rcv); do { tp->rcv_nxt += q->tqe_len; - flags = q->tqe_th->th_flags & TH_FIN; - nq = LIST_NEXT(q, tqe_q); - LIST_REMOVE(q, tqe_q); - if (so->so_rcv.sb_state & SBS_CANTRCVMORE) + flags = q->tqe_flags & TH_FIN; + nq = TAILQ_NEXT(q, tqe_q); + TAILQ_REMOVE(&tp->t_segq, q, tqe_q); + if (so->so_rcv.sb_state & SBS_CANTRCVMORE) { m_freem(q->tqe_m); - else + } else { +#ifdef TCP_REASS_LOGGING + tcp_reass_log_new_in(tp, q->tqe_start, q->tqe_len, q->tqe_m, TCP_R_LOG_READ, q); + tcp_log_reassm(tp, q, NULL, th->th_seq, *tlenp, TCP_R_LOG_READ, 1); +#endif sbappendstream_locked(&so->so_rcv, q->tqe_m, 0); - if (q != &tqs) - uma_zfree(tcp_reass_zone, q); + } +#ifdef TCP_REASS_LOGGING + tcp_log_reassm(tp, q, NULL, th->th_seq, *tlenp, TCP_R_LOG_READ, 2); +#endif + KASSERT(tp->t_segqmbuflen >= q->tqe_mbuf_cnt, + ("tp:%p seg queue goes negative", tp)); + tp->t_segqmbuflen -= q->tqe_mbuf_cnt; + uma_zfree(tcp_reass_zone, q); tp->t_segqlen--; q = nq; - } while (q && q->tqe_th->th_seq == tp->rcv_nxt); + } while (q && q->tqe_start == tp->rcv_nxt); + if (TAILQ_EMPTY(&tp->t_segq) && + (tp->t_segqmbuflen != 0)) { +#ifdef INVARIANTS + panic("tp:%p segq:%p len:%d queue empty", + tp, &tp->t_segq, tp->t_segqmbuflen); +#else +#ifdef TCP_REASS_LOGGING + tcp_log_reassm(tp, NULL, NULL, th->th_seq, *tlenp, TCP_R_LOG_ZERO, 0); +#endif + tp->t_segqmbuflen = 0; +#endif + } +#ifdef TCP_REASS_LOGGING + tcp_reass_log_dump(tp); +#endif sorwakeup_locked(so); return (flags); } Index: sys/netinet/tcp_stacks/rack.c =================================================================== --- sys/netinet/tcp_stacks/rack.c +++ sys/netinet/tcp_stacks/rack.c @@ -4780,7 +4780,7 @@ * segments are out of order (so fast retransmit can work). */ if (th->th_seq == tp->rcv_nxt && - LIST_EMPTY(&tp->t_segq) && + TAILQ_EMPTY(&tp->t_segq) && (TCPS_HAVEESTABLISHED(tp->t_state) || tfo_syn)) { if (DELAY_ACK(tp, tlen) || tfo_syn) { @@ -4808,7 +4808,7 @@ * m_adj() doesn't actually frees any mbufs when * trimming from the head. */ - thflags = tcp_reass(tp, th, &tlen, m); + thflags = tcp_reass(tp, th, &save_start, &tlen, m); tp->t_flags |= TF_ACKNOW; } if (tlen > 0) @@ -5509,7 +5509,7 @@ * not, do so now to pass queued data to user. */ if (tlen == 0 && (thflags & TH_FIN) == 0) - (void)tcp_reass(tp, (struct tcphdr *)0, 0, + (void) tcp_reass(tp, (struct tcphdr *)0, NULL, 0, (struct mbuf *)0); tp->snd_wl1 = th->th_seq - 1; if (rack_process_ack(m, th, so, tp, to, tiwin, tlen, &ourfinisacked, thflags, &ret_val)) { @@ -5574,7 +5574,7 @@ */ if (__predict_true(((to->to_flags & TOF_SACK) == 0)) && __predict_true((thflags & (TH_SYN | TH_FIN | TH_RST | TH_URG | TH_ACK)) == TH_ACK) && - __predict_true(LIST_EMPTY(&tp->t_segq)) && + __predict_true(TAILQ_EMPTY(&tp->t_segq)) && __predict_true(th->th_seq == tp->rcv_nxt)) { struct tcp_rack *rack; Index: sys/netinet/tcp_subr.c =================================================================== --- sys/netinet/tcp_subr.c +++ sys/netinet/tcp_subr.c @@ -1622,7 +1622,7 @@ tp->t_vnet = inp->inp_vnet; #endif tp->t_timers = &tm->tt; - /* LIST_INIT(&tp->t_segq); */ /* XXX covered by M_ZERO */ + TAILQ_INIT(&tp->t_segq); tp->t_maxseg = #ifdef INET6 isipv6 ? V_tcp_v6mssdflt : Index: sys/netinet/tcp_usrreq.c =================================================================== --- sys/netinet/tcp_usrreq.c +++ sys/netinet/tcp_usrreq.c @@ -2521,7 +2521,7 @@ db_print_indent(indent); db_printf("t_segq first: %p t_segqlen: %d t_dupacks: %d\n", - LIST_FIRST(&tp->t_segq), tp->t_segqlen, tp->t_dupacks); + TAILQ_FIRST(&tp->t_segq), tp->t_segqlen, tp->t_dupacks); db_print_indent(indent); db_printf("tt_rexmt: %p tt_persist: %p tt_keep: %p\n", Index: sys/netinet/tcp_var.h =================================================================== --- sys/netinet/tcp_var.h +++ sys/netinet/tcp_var.h @@ -46,12 +46,15 @@ #if defined(_KERNEL) || defined(_WANT_TCPCB) /* TCP segment queue entry */ struct tseg_qent { - LIST_ENTRY(tseg_qent) tqe_q; + TAILQ_ENTRY(tseg_qent) tqe_q; + struct mbuf *tqe_m; /* mbuf contains packet */ + struct mbuf *tqe_last; /* last mbuf in chain */ + tcp_seq tqe_start; /* TCP Sequence number start */ int tqe_len; /* TCP segment data length */ - struct tcphdr *tqe_th; /* a pointer to tcp header */ - struct mbuf *tqe_m; /* mbuf contains packet */ + uint32_t tqe_flags; /* The flags from the th->th_flags */ + uint32_t tqe_mbuf_cnt; /* Count of mbuf overhead */ }; -LIST_HEAD(tsegqe_head, tseg_qent); +TAILQ_HEAD(tsegqe_head, tseg_qent); struct sackblk { tcp_seq start; /* start seq no. of sack block */ @@ -131,6 +134,7 @@ /* Cache line 3 */ tcp_seq rcv_up; /* receive urgent pointer */ int t_segqlen; /* segment reassembly queue length */ + uint32_t t_segqmbuflen; /* Count of bytes mbufs on all entries */ struct tsegqe_head t_segq; /* segment reassembly queue */ struct mbuf *t_in_pkt; struct mbuf *t_tail_pkt; @@ -837,7 +841,7 @@ const void *); char *tcp_log_vain(struct in_conninfo *, struct tcphdr *, void *, const void *); -int tcp_reass(struct tcpcb *, struct tcphdr *, int *, struct mbuf *); +int tcp_reass(struct tcpcb *, struct tcphdr *, tcp_seq *, int *, struct mbuf *); void tcp_reass_global_init(void); void tcp_reass_flush(struct tcpcb *); void tcp_dooptions(struct tcpopt *, u_char *, int, int);