grpc 1.62.0 → 1.68.1

data/src/core/ext/transport/chttp2/server/chttp2_server.cc

@@ -16,10 +16,16 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
-
 #include "src/core/ext/transport/chttp2/server/chttp2_server.h"
 
+#include <grpc/event_engine/event_engine.h>
+#include <grpc/grpc.h>
+#include <grpc/grpc_posix.h>
+#include <grpc/impl/channel_arg_names.h>
+#include <grpc/passive_listener.h>
+#include <grpc/slice_buffer.h>
+#include <grpc/support/alloc.h>
+#include <grpc/support/port_platform.h>
 #include <inttypes.h>
 #include <string.h>
 
@@ -31,6 +37,8 @@
 #include <vector>
 
 #include "absl/base/thread_annotations.h"
+#include "absl/log/check.h"
+#include "absl/log/log.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/str_cat.h"
@@ -38,33 +46,25 @@
 #include "absl/strings/string_view.h"
 #include "absl/strings/strip.h"
 #include "absl/types/optional.h"
-
-#include <grpc/event_engine/event_engine.h>
-#include <grpc/grpc.h>
-#include <grpc/grpc_posix.h>
-#include <grpc/impl/channel_arg_names.h>
-#include <grpc/slice_buffer.h>
-#include <grpc/support/alloc.h>
-#include <grpc/support/log.h>
-
+#include "src/core/channelz/channelz.h"
 #include "src/core/ext/transport/chttp2/transport/chttp2_transport.h"
 #include "src/core/ext/transport/chttp2/transport/internal.h"
 #include "src/core/ext/transport/chttp2/transport/legacy_frame.h"
+#include "src/core/handshaker/handshaker.h"
+#include "src/core/handshaker/handshaker_registry.h"
 #include "src/core/lib/address_utils/sockaddr_utils.h"
 #include "src/core/lib/channel/channel_args.h"
-#include "src/core/lib/channel/channelz.h"
 #include "src/core/lib/config/core_configuration.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/event_engine/channel_args_endpoint_config.h"
-#include "src/core/lib/gprpp/debug_location.h"
-#include "src/core/lib/gprpp/orphanable.h"
-#include "src/core/lib/gprpp/ref_counted_ptr.h"
-#include "src/core/lib/gprpp/status_helper.h"
-#include "src/core/lib/gprpp/sync.h"
-#include "src/core/lib/gprpp/time.h"
-#include "src/core/lib/gprpp/unique_type_name.h"
+#include "src/core/lib/event_engine/extensions/supports_fd.h"
+#include "src/core/lib/event_engine/query_extensions.h"
+#include "src/core/lib/event_engine/resolved_address_internal.h"
+#include "src/core/lib/event_engine/tcp_socket_utils.h"
+#include "src/core/lib/event_engine/utils.h"
 #include "src/core/lib/iomgr/closure.h"
 #include "src/core/lib/iomgr/endpoint.h"
+#include "src/core/lib/iomgr/event_engine_shims/endpoint.h"
 #include "src/core/lib/iomgr/iomgr_fwd.h"
 #include "src/core/lib/iomgr/pollset_set.h"
 #include "src/core/lib/iomgr/resolve_address.h"
@@ -72,18 +72,23 @@
 #include "src/core/lib/iomgr/tcp_server.h"
 #include "src/core/lib/iomgr/unix_sockets_posix.h"
 #include "src/core/lib/iomgr/vsock.h"
+#include "src/core/lib/resource_quota/connection_quota.h"
 #include "src/core/lib/resource_quota/memory_quota.h"
 #include "src/core/lib/resource_quota/resource_quota.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/insecure/insecure_credentials.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
-#include "src/core/lib/surface/api_trace.h"
-#include "src/core/lib/surface/server.h"
 #include "src/core/lib/transport/error_utils.h"
-#include "src/core/lib/transport/handshaker.h"
-#include "src/core/lib/transport/handshaker_registry.h"
 #include "src/core/lib/transport/transport.h"
-#include "src/core/lib/uri/uri_parser.h"
+#include "src/core/server/server.h"
+#include "src/core/util/debug_location.h"
+#include "src/core/util/orphanable.h"
+#include "src/core/util/ref_counted_ptr.h"
+#include "src/core/util/status_helper.h"
+#include "src/core/util/sync.h"
+#include "src/core/util/time.h"
+#include "src/core/util/unique_type_name.h"
+#include "src/core/util/uri.h"
 
 #ifdef GPR_SUPPORT_CHANNELS_FROM_FD
 #include "src/core/lib/iomgr/ev_posix.h"
@@ -92,17 +97,27 @@
 #endif  // GPR_SUPPORT_CHANNELS_FROM_FD
 
 namespace grpc_core {
-namespace {
 
-using ::grpc_event_engine::experimental::EventEngine;
+using grpc_event_engine::experimental::ChannelArgsEndpointConfig;
+using grpc_event_engine::experimental::EventEngine;
+using grpc_event_engine::experimental::EventEngineSupportsFdExtension;
+using grpc_event_engine::experimental::QueryExtension;
 
 const char kUnixUriPrefix[] = "unix:";
 const char kUnixAbstractUriPrefix[] = "unix-abstract:";
 const char kVSockUriPrefix[] = "vsock:";
 
+struct AcceptorDeleter {
+  void operator()(grpc_tcp_server_acceptor* acceptor) const {
+    gpr_free(acceptor);
+  }
+};
+using AcceptorPtr = std::unique_ptr<grpc_tcp_server_acceptor, AcceptorDeleter>;
+
 class Chttp2ServerListener : public Server::ListenerInterface {
  public:
-  static grpc_error_handle Create(Server* server, grpc_resolved_address* addr,
+  static grpc_error_handle Create(Server* server,
+                                  const EventEngine::ResolvedAddress& addr,
                                   const ChannelArgs& args,
                                   Chttp2ServerArgsModifier args_modifier,
                                   int* port_num);
@@ -111,14 +126,23 @@ class Chttp2ServerListener : public Server::ListenerInterface {
       Server* server, const char* name, const ChannelArgs& args,
       Chttp2ServerArgsModifier args_modifier);
 
+  static Chttp2ServerListener* CreateForPassiveListener(
+      Server* server, const ChannelArgs& args,
+      std::shared_ptr<experimental::PassiveListenerImpl> passive_listener);
+
   // Do not instantiate directly.  Use one of the factory methods above.
   Chttp2ServerListener(Server* server, const ChannelArgs& args,
-                       Chttp2ServerArgsModifier args_modifier);
+                       Chttp2ServerArgsModifier args_modifier,
+                       grpc_server_config_fetcher* config_fetcher,
+                       std::shared_ptr<experimental::PassiveListenerImpl>
+                           passive_listener = nullptr);
   ~Chttp2ServerListener() override;
 
   void Start(Server* server,
              const std::vector<grpc_pollset*>* pollsets) override;
 
+  void AcceptConnectedEndpoint(std::unique_ptr<EventEngine::Endpoint> endpoint);
+
   channelz::ListenSocketNode* channelz_listen_socket_node() const override {
     return channelz_listen_socket_.get();
   }
@@ -128,6 +152,8 @@ class Chttp2ServerListener : public Server::ListenerInterface {
   void Orphan() override;
 
  private:
+  friend class experimental::PassiveListenerImpl;
+
   class ConfigFetcherWatcher
       : public grpc_server_config_fetcher::WatcherInterface {
    public:
@@ -149,49 +175,50 @@ class Chttp2ServerListener : public Server::ListenerInterface {
     class HandshakingState : public InternallyRefCounted<HandshakingState> {
      public:
       HandshakingState(RefCountedPtr<ActiveConnection> connection_ref,
-                       grpc_pollset* accepting_pollset,
-                       grpc_tcp_server_acceptor* acceptor,
+                       grpc_pollset* accepting_pollset, AcceptorPtr acceptor,
                        const ChannelArgs& args);
 
       ~HandshakingState() override;
 
       void Orphan() override;
 
-      void Start(grpc_endpoint* endpoint, const ChannelArgs& args);
+      void Start(OrphanablePtr<grpc_endpoint> endpoint,
+                 const ChannelArgs& args);
+
+      void ShutdownLocked(absl::Status status)
+          ABSL_EXCLUSIVE_LOCKS_REQUIRED(&ActiveConnection::mu_);
 
       // Needed to be able to grab an external ref in
       // ActiveConnection::Start()
       using InternallyRefCounted<HandshakingState>::Ref;
 
      private:
-      void OnTimeout() ABSL_LOCKS_EXCLUDED(&connection_->mu_);
+      void OnTimeout() ABSL_LOCKS_EXCLUDED(&ActiveConnection::mu_);
       static void OnReceiveSettings(void* arg, grpc_error_handle /* error */);
-      static void OnHandshakeDone(void* arg, grpc_error_handle error);
+      void OnHandshakeDone(absl::StatusOr<HandshakerArgs*> result);
       RefCountedPtr<ActiveConnection> const connection_;
       grpc_pollset* const accepting_pollset_;
-      grpc_tcp_server_acceptor* acceptor_;
+      AcceptorPtr acceptor_;
       RefCountedPtr<HandshakeManager> handshake_mgr_
-          ABSL_GUARDED_BY(&connection_->mu_);
+          ABSL_GUARDED_BY(&ActiveConnection::mu_);
       // State for enforcing handshake timeout on receiving HTTP/2 settings.
       Timestamp const deadline_;
       absl::optional<EventEngine::TaskHandle> timer_handle_
-          ABSL_GUARDED_BY(&connection_->mu_);
-      grpc_closure on_receive_settings_ ABSL_GUARDED_BY(&connection_->mu_);
+          ABSL_GUARDED_BY(&ActiveConnection::mu_);
+      grpc_closure on_receive_settings_ ABSL_GUARDED_BY(&ActiveConnection::mu_);
       grpc_pollset_set* const interested_parties_;
     };
 
-    ActiveConnection(grpc_pollset* accepting_pollset,
-                     grpc_tcp_server_acceptor* acceptor,
+    ActiveConnection(RefCountedPtr<Chttp2ServerListener> listener,
+                     grpc_pollset* accepting_pollset, AcceptorPtr acceptor,
                      EventEngine* event_engine, const ChannelArgs& args,
                      MemoryOwner memory_owner);
-    ~ActiveConnection() override;
 
     void Orphan() override;
 
     void SendGoAway();
 
-    void Start(RefCountedPtr<Chttp2ServerListener> listener,
-               grpc_endpoint* endpoint, const ChannelArgs& args);
+    void Start(OrphanablePtr<grpc_endpoint> endpoint, const ChannelArgs& args);
 
     // Needed to be able to grab an external ref in
     // Chttp2ServerListener::OnAccept()
@@ -203,6 +230,9 @@ class Chttp2ServerListener : public Server::ListenerInterface {
 
     RefCountedPtr<Chttp2ServerListener> listener_;
     Mutex mu_ ABSL_ACQUIRED_AFTER(&listener_->mu_);
+    // Was ActiveConnection::Start() invoked? Used to determine whether
+    // tcp_server needs to be unreffed.
+    bool connection_started_ ABSL_GUARDED_BY(&mu_) = false;
     // Set by HandshakingState before the handshaking begins and reset when
     // handshaking is done.
     OrphanablePtr<HandshakingState> handshaking_state_ ABSL_GUARDED_BY(&mu_);
@@ -234,34 +264,8 @@ class Chttp2ServerListener : public Server::ListenerInterface {
   static void DestroyListener(Server* /*server*/, void* arg,
                               grpc_closure* destroy_done);
 
-  // The interface required by RefCountedPtr<> has been manually implemented
-  // here to take a ref on tcp_server_ instead. Note that, the handshaker
-  // needs tcp_server_ to exist for the lifetime of the handshake since it's
-  // needed by acceptor. Sharing refs between the listener and tcp_server_ is
-  // just an optimization to avoid taking additional refs on the listener,
-  // since TcpServerShutdownComplete already holds a ref to the listener.
-  void IncrementRefCount() { grpc_tcp_server_ref(tcp_server_); }
-  void IncrementRefCount(const DebugLocation& /* location */,
-                         const char* /* reason */) {
-    IncrementRefCount();
-  }
-
-  GRPC_MUST_USE_RESULT RefCountedPtr<Chttp2ServerListener> Ref() {
-    IncrementRefCount();
-    return RefCountedPtr<Chttp2ServerListener>(this);
-  }
-  GRPC_MUST_USE_RESULT RefCountedPtr<Chttp2ServerListener> Ref(
-      const DebugLocation& /* location */, const char* /* reason */) {
-    return Ref();
-  }
-
-  void Unref() { grpc_tcp_server_unref(tcp_server_); }
-  void Unref(const DebugLocation& /* location */, const char* /* reason */) {
-    Unref();
-  }
-
-  Server* const server_;
-  grpc_tcp_server* tcp_server_;
+  Server* const server_ = nullptr;
+  grpc_tcp_server* tcp_server_ = nullptr;
   grpc_resolved_address resolved_address_;
   Chttp2ServerArgsModifier const args_modifier_;
   ConfigFetcherWatcher* config_fetcher_watcher_ = nullptr;
@@ -283,6 +287,11 @@ class Chttp2ServerListener : public Server::ListenerInterface {
   grpc_closure* on_destroy_done_ ABSL_GUARDED_BY(mu_) = nullptr;
   RefCountedPtr<channelz::ListenSocketNode> channelz_listen_socket_;
   MemoryQuotaRefPtr memory_quota_;
+  ConnectionQuotaRefPtr connection_quota_;
+  grpc_server_config_fetcher* config_fetcher_ = nullptr;
+  // TODO(yashykt): consider using absl::variant<> to minimize memory usage for
+  // disjoint cases where different fields are used.
+  std::shared_ptr<experimental::PassiveListenerImpl> passive_listener_;
 };
 
 //
@@ -307,7 +316,7 @@ void Chttp2ServerListener::ConfigFetcherWatcher::UpdateConnectionManager(
     void set_connections(
         std::map<ActiveConnection*, OrphanablePtr<ActiveConnection>>
             connections) {
-      GPR_ASSERT(connections_.empty());
+      CHECK(connections_.empty());
       connections_ = std::move(connections);
     }
 
@@ -329,11 +338,10 @@ void Chttp2ServerListener::ConfigFetcherWatcher::UpdateConnectionManager(
   grpc_error_handle error = grpc_tcp_server_add_port(
       listener_->tcp_server_, &listener_->resolved_address_, &port_temp);
   if (!error.ok()) {
-    gpr_log(GPR_ERROR, "Error adding port to server: %s",
-            StatusToString(error).c_str());
+    LOG(ERROR) << "Error adding port to server: " << StatusToString(error);
     // TODO(yashykt): We wouldn't need to assert here if we bound to the
     // port earlier during AddPort.
-    GPR_ASSERT(0);
+    CHECK(0);
   }
   listener_->StartListening();
   {
@@ -371,46 +379,65 @@ Timestamp GetConnectionDeadline(const ChannelArgs& args) {
 
 Chttp2ServerListener::ActiveConnection::HandshakingState::HandshakingState(
     RefCountedPtr<ActiveConnection> connection_ref,
-    grpc_pollset* accepting_pollset, grpc_tcp_server_acceptor* acceptor,
+    grpc_pollset* accepting_pollset, AcceptorPtr acceptor,
     const ChannelArgs& args)
     : connection_(std::move(connection_ref)),
       accepting_pollset_(accepting_pollset),
-      acceptor_(acceptor),
+      acceptor_(std::move(acceptor)),
       handshake_mgr_(MakeRefCounted<HandshakeManager>()),
       deadline_(GetConnectionDeadline(args)),
       interested_parties_(grpc_pollset_set_create()) {
-  grpc_pollset_set_add_pollset(interested_parties_, accepting_pollset_);
+  if (accepting_pollset != nullptr) {
+    grpc_pollset_set_add_pollset(interested_parties_, accepting_pollset_);
+  }
   CoreConfiguration::Get().handshaker_registry().AddHandshakers(
       HANDSHAKER_SERVER, args, interested_parties_, handshake_mgr_.get());
 }
 
 Chttp2ServerListener::ActiveConnection::HandshakingState::~HandshakingState() {
-  grpc_pollset_set_del_pollset(interested_parties_, accepting_pollset_);
+  bool connection_started = false;
+  {
+    MutexLock lock(&connection_->mu_);
+    connection_started = connection_->connection_started_;
+  }
+  if (accepting_pollset_ != nullptr) {
+    grpc_pollset_set_del_pollset(interested_parties_, accepting_pollset_);
+  }
   grpc_pollset_set_destroy(interested_parties_);
-  gpr_free(acceptor_);
+  if (connection_started && connection_->listener_ != nullptr &&
+      connection_->listener_->tcp_server_ != nullptr) {
+    grpc_tcp_server_unref(connection_->listener_->tcp_server_);
+  }
 }
 
 void Chttp2ServerListener::ActiveConnection::HandshakingState::Orphan() {
   {
     MutexLock lock(&connection_->mu_);
-    if (handshake_mgr_ != nullptr) {
-      handshake_mgr_->Shutdown(GRPC_ERROR_CREATE("Listener stopped serving."));
-    }
+    ShutdownLocked(absl::UnavailableError("Listener stopped serving."));
   }
   Unref();
 }
 
 void Chttp2ServerListener::ActiveConnection::HandshakingState::Start(
-    grpc_endpoint* endpoint, const ChannelArgs& channel_args) {
-  Ref().release();  // Held by OnHandshakeDone
+    OrphanablePtr<grpc_endpoint> endpoint, const ChannelArgs& channel_args) {
   RefCountedPtr<HandshakeManager> handshake_mgr;
   {
     MutexLock lock(&connection_->mu_);
     if (handshake_mgr_ == nullptr) return;
     handshake_mgr = handshake_mgr_;
   }
-  handshake_mgr->DoHandshake(endpoint, channel_args, deadline_, acceptor_,
-                             OnHandshakeDone, this);
+  handshake_mgr->DoHandshake(
+      std::move(endpoint), channel_args, deadline_, acceptor_.get(),
+      [self = Ref()](absl::StatusOr<HandshakerArgs*> result) {
+        self->OnHandshakeDone(std::move(result));
+      });
+}
+
+void Chttp2ServerListener::ActiveConnection::HandshakingState::ShutdownLocked(
+    absl::Status status) {
+  if (handshake_mgr_ != nullptr) {
+    handshake_mgr_->Shutdown(std::move(status));
+  }
 }
 
 void Chttp2ServerListener::ActiveConnection::HandshakingState::OnTimeout() {
@@ -444,74 +471,66 @@ void Chttp2ServerListener::ActiveConnection::HandshakingState::
 }
 
 void Chttp2ServerListener::ActiveConnection::HandshakingState::OnHandshakeDone(
-    void* arg, grpc_error_handle error) {
-  auto* args = static_cast<HandshakerArgs*>(arg);
-  HandshakingState* self = static_cast<HandshakingState*>(args->user_data);
+    absl::StatusOr<HandshakerArgs*> result) {
   OrphanablePtr<HandshakingState> handshaking_state_ref;
   RefCountedPtr<HandshakeManager> handshake_mgr;
   bool cleanup_connection = false;
+  bool release_connection = false;
   {
-    MutexLock connection_lock(&self->connection_->mu_);
-    if (!error.ok() || self->connection_->shutdown_) {
-      std::string error_str = StatusToString(error);
+    MutexLock connection_lock(&connection_->mu_);
+    if (!result.ok() || connection_->shutdown_) {
       cleanup_connection = true;
-      if (error.ok() && args->endpoint != nullptr) {
-        // We were shut down or stopped serving after handshaking completed
-        // successfully, so destroy the endpoint here.
-        // TODO(ctiller): It is currently necessary to shutdown endpoints
-        // before destroying them, even if we know that there are no
-        // pending read/write callbacks.  This should be fixed, at which
-        // point this can be removed.
-        grpc_endpoint_shutdown(args->endpoint, absl::OkStatus());
-        grpc_endpoint_destroy(args->endpoint);
-        grpc_slice_buffer_destroy(args->read_buffer);
-        gpr_free(args->read_buffer);
-      }
+      release_connection = true;
     } else {
       // If the handshaking succeeded but there is no endpoint, then the
       // handshaker may have handed off the connection to some external
       // code, so we can just clean up here without creating a transport.
-      if (args->endpoint != nullptr) {
-        Transport* transport =
-            grpc_create_chttp2_transport(args->args, args->endpoint, false);
+      if ((*result)->endpoint != nullptr) {
+        RefCountedPtr<Transport> transport =
+            grpc_create_chttp2_transport((*result)->args,
+                                         std::move((*result)->endpoint), false)
+                ->Ref();
         grpc_error_handle channel_init_err =
-            self->connection_->listener_->server_->SetupTransport(
-                transport, self->accepting_pollset_, args->args,
-                grpc_chttp2_transport_get_socket_node(transport));
+            connection_->listener_->server_->SetupTransport(
+                transport.get(), accepting_pollset_, (*result)->args,
+                grpc_chttp2_transport_get_socket_node(transport.get()));
         if (channel_init_err.ok()) {
           // Use notify_on_receive_settings callback to enforce the
           // handshake deadline.
-          // Note: The reinterpret_cast<>s here are safe, because
-          // grpc_chttp2_transport is a C-style extension of
-          // Transport, so this is morally equivalent of a
-          // static_cast<> to a derived class.
-          // TODO(roth): Change to static_cast<> when we C++-ify the
-          // transport API.
-          self->connection_->transport_ =
-              reinterpret_cast<grpc_chttp2_transport*>(transport)->Ref();
-          self->Ref().release();  // Held by OnReceiveSettings().
-          GRPC_CLOSURE_INIT(&self->on_receive_settings_, OnReceiveSettings,
-                            self, grpc_schedule_on_exec_ctx);
+          connection_->transport_ =
+              DownCast<grpc_chttp2_transport*>(transport.get())->Ref();
+          Ref().release();  // Held by OnReceiveSettings().
+          GRPC_CLOSURE_INIT(&on_receive_settings_, OnReceiveSettings, this,
+                            grpc_schedule_on_exec_ctx);
           // If the listener has been configured with a config fetcher, we
           // need to watch on the transport being closed so that we can an
           // updated list of active connections.
           grpc_closure* on_close = nullptr;
-          if (self->connection_->listener_->config_fetcher_watcher_ !=
-              nullptr) {
+          if (connection_->listener_->config_fetcher_watcher_ != nullptr) {
             // Refs helds by OnClose()
-            self->connection_->Ref().release();
-            on_close = &self->connection_->on_close_;
+            connection_->Ref().release();
+            on_close = &connection_->on_close_;
           } else {
             // Remove the connection from the connections_ map since OnClose()
             // will not be invoked when a config fetcher is set.
+            auto connection_quota =
+                connection_->listener_->connection_quota_->Ref().release();
+            auto on_close_transport = [](void* arg,
+                                         grpc_error_handle /*handle*/) {
+              ConnectionQuota* connection_quota =
+                  static_cast<ConnectionQuota*>(arg);
+              connection_quota->ReleaseConnections(1);
+              connection_quota->Unref();
+            };
+            on_close = GRPC_CLOSURE_CREATE(on_close_transport, connection_quota,
+                                           grpc_schedule_on_exec_ctx_);
             cleanup_connection = true;
           }
-          grpc_chttp2_transport_start_reading(transport, args->read_buffer,
-                                              &self->on_receive_settings_,
-                                              on_close);
-          self->timer_handle_ = self->connection_->event_engine_->RunAfter(
-              self->deadline_ - Timestamp::Now(),
-              [self = self->Ref()]() mutable {
+          grpc_chttp2_transport_start_reading(
+              transport.get(), (*result)->read_buffer.c_slice_buffer(),
+              &on_receive_settings_, nullptr, on_close);
+          timer_handle_ = connection_->event_engine_->RunAfter(
+              deadline_ - Timestamp::Now(), [self = Ref()]() mutable {
                 ApplicationCallbackExecCtx callback_exec_ctx;
                 ExecCtx exec_ctx;
                 self->OnTimeout();
@@ -520,37 +539,36 @@ void Chttp2ServerListener::ActiveConnection::HandshakingState::OnHandshakeDone(
               });
         } else {
           // Failed to create channel from transport. Clean up.
-          gpr_log(GPR_ERROR, "Failed to create channel: %s",
-                  StatusToString(channel_init_err).c_str());
+          LOG(ERROR) << "Failed to create channel: "
+                     << StatusToString(channel_init_err);
           transport->Orphan();
-          grpc_slice_buffer_destroy(args->read_buffer);
-          gpr_free(args->read_buffer);
           cleanup_connection = true;
+          release_connection = true;
         }
       } else {
         cleanup_connection = true;
+        release_connection = true;
       }
     }
     // Since the handshake manager is done, the connection no longer needs to
     // shutdown the handshake when the listener needs to stop serving.
     // Avoid calling the destructor of HandshakeManager and HandshakingState
     // from within the critical region.
-    handshake_mgr = std::move(self->handshake_mgr_);
-    handshaking_state_ref = std::move(self->connection_->handshaking_state_);
+    handshake_mgr = std::move(handshake_mgr_);
+    handshaking_state_ref = std::move(connection_->handshaking_state_);
   }
-  gpr_free(self->acceptor_);
-  self->acceptor_ = nullptr;
   OrphanablePtr<ActiveConnection> connection;
   if (cleanup_connection) {
-    MutexLock listener_lock(&self->connection_->listener_->mu_);
-    auto it = self->connection_->listener_->connections_.find(
-        self->connection_.get());
-    if (it != self->connection_->listener_->connections_.end()) {
+    MutexLock listener_lock(&connection_->listener_->mu_);
+    if (release_connection) {
+      connection_->listener_->connection_quota_->ReleaseConnections(1);
+    }
+    auto it = connection_->listener_->connections_.find(connection_.get());
+    if (it != connection_->listener_->connections_.end()) {
       connection = std::move(it->second);
-      self->connection_->listener_->connections_.erase(it);
+      connection_->listener_->connections_.erase(it);
     }
   }
-  self->Unref();
 }
 
 //
@@ -558,18 +576,18 @@ void Chttp2ServerListener::ActiveConnection::HandshakingState::OnHandshakeDone(
 //
 
 Chttp2ServerListener::ActiveConnection::ActiveConnection(
-    grpc_pollset* accepting_pollset, grpc_tcp_server_acceptor* acceptor,
+    RefCountedPtr<Chttp2ServerListener> listener,
+    grpc_pollset* accepting_pollset, AcceptorPtr acceptor,
     EventEngine* event_engine, const ChannelArgs& args,
     MemoryOwner memory_owner)
-    : handshaking_state_(memory_owner.MakeOrphanable<HandshakingState>(
-          Ref(), accepting_pollset, acceptor, args)),
+    : listener_(std::move(listener)),
+      handshaking_state_(memory_owner.MakeOrphanable<HandshakingState>(
+          Ref(), accepting_pollset, std::move(acceptor), args)),
       event_engine_(event_engine) {
   GRPC_CLOSURE_INIT(&on_close_, ActiveConnection::OnClose, this,
                     grpc_schedule_on_exec_ctx);
 }
 
-Chttp2ServerListener::ActiveConnection::~ActiveConnection() {}
-
 void Chttp2ServerListener::ActiveConnection::Orphan() {
   OrphanablePtr<HandshakingState> handshaking_state;
   {
@@ -586,53 +604,56 @@ void Chttp2ServerListener::ActiveConnection::SendGoAway() {
   grpc_chttp2_transport* transport = nullptr;
   {
     MutexLock lock(&mu_);
-    if (transport_ != nullptr && !shutdown_) {
-      transport = transport_.get();
-      drain_grace_timer_handle_ = event_engine_->RunAfter(
-          std::max(Duration::Zero(),
-                   listener_->args_
-                       .GetDurationFromIntMillis(
-                           GRPC_ARG_SERVER_CONFIG_CHANGE_DRAIN_GRACE_TIME_MS)
-                       .value_or(Duration::Minutes(10))),
-          [self = Ref(DEBUG_LOCATION, "drain_grace_timer")]() mutable {
-            ApplicationCallbackExecCtx callback_exec_ctx;
-            ExecCtx exec_ctx;
-            self->OnDrainGraceTimeExpiry();
-            self.reset(DEBUG_LOCATION, "drain_grace_timer");
-          });
+    if (!shutdown_) {
+      // Send a GOAWAY if the transport exists
+      if (transport_ != nullptr) {
+        transport = transport_.get();
+        drain_grace_timer_handle_ = event_engine_->RunAfter(
+            std::max(Duration::Zero(),
+                     listener_->args_
+                         .GetDurationFromIntMillis(
+                             GRPC_ARG_SERVER_CONFIG_CHANGE_DRAIN_GRACE_TIME_MS)
+                         .value_or(Duration::Minutes(10))),
+            [self = Ref(DEBUG_LOCATION, "drain_grace_timer")]() mutable {
+              ApplicationCallbackExecCtx callback_exec_ctx;
+              ExecCtx exec_ctx;
+              self->OnDrainGraceTimeExpiry();
+              self.reset(DEBUG_LOCATION, "drain_grace_timer");
+            });
+      }
+      // Shutdown the handshaker if it's still in progress.
+      if (handshaking_state_ != nullptr) {
+        handshaking_state_->ShutdownLocked(
+            absl::UnavailableError("Connection going away"));
+      }
       shutdown_ = true;
     }
   }
   if (transport != nullptr) {
     grpc_transport_op* op = grpc_make_transport_op(nullptr);
-    op->goaway_error =
-        GRPC_ERROR_CREATE("Server is stopping to serve requests.");
+    // Set an HTTP2 error of NO_ERROR to do graceful GOAWAYs.
+    op->goaway_error = grpc_error_set_int(
+        GRPC_ERROR_CREATE("Server is stopping to serve requests."),
+        StatusIntProperty::kHttp2Error, GRPC_HTTP2_NO_ERROR);
     transport->PerformOp(op);
   }
 }
 
 void Chttp2ServerListener::ActiveConnection::Start(
-    RefCountedPtr<Chttp2ServerListener> listener, grpc_endpoint* endpoint,
-    const ChannelArgs& args) {
+    OrphanablePtr<grpc_endpoint> endpoint, const ChannelArgs& args) {
   RefCountedPtr<HandshakingState> handshaking_state_ref;
-  listener_ = std::move(listener);
   {
-    ReleasableMutexLock lock(&mu_);
-    if (shutdown_) {
-      lock.Release();
-      // If the Connection is already shutdown at this point, it implies the
-      // owning Chttp2ServerListener and all associated ActiveConnections have
-      // been orphaned. The generated endpoints need to be shutdown here to
-      // ensure the tcp connections are closed appropriately.
-      grpc_endpoint_shutdown(endpoint, absl::OkStatus());
-      grpc_endpoint_destroy(endpoint);
-      return;
-    }
+    MutexLock lock(&mu_);
+    connection_started_ = true;
+    // If the Connection is already shutdown at this point, it implies the
+    // owning Chttp2ServerListener and all associated ActiveConnections have
+    // been orphaned.
+    if (shutdown_) return;
     // Hold a ref to HandshakingState to allow starting the handshake outside
     // the critical region.
     handshaking_state_ref = handshaking_state_->Ref();
   }
-  handshaking_state_ref->Start(endpoint, args);
+  handshaking_state_ref->Start(std::move(endpoint), args);
 }
 
 void Chttp2ServerListener::ActiveConnection::OnClose(
@@ -658,6 +679,7 @@ void Chttp2ServerListener::ActiveConnection::OnClose(
       self->drain_grace_timer_handle_.reset();
     }
   }
+  self->listener_->connection_quota_->ReleaseConnections(1);
   self->Unref();
 }
 
@@ -685,105 +707,118 @@ void Chttp2ServerListener::ActiveConnection::OnDrainGraceTimeExpiry() {
 //
 
 grpc_error_handle Chttp2ServerListener::Create(
-    Server* server, grpc_resolved_address* addr, const ChannelArgs& args,
-    Chttp2ServerArgsModifier args_modifier, int* port_num) {
-  Chttp2ServerListener* listener = nullptr;
-  // The bulk of this method is inside of a lambda to make cleanup
-  // easier without using goto.
-  grpc_error_handle error = [&]() {
-    grpc_error_handle error;
-    // Create Chttp2ServerListener.
-    listener = new Chttp2ServerListener(server, args, args_modifier);
-    error = grpc_tcp_server_create(
-        &listener->tcp_server_shutdown_complete_,
-        grpc_event_engine::experimental::ChannelArgsEndpointConfig(args),
-        OnAccept, listener, &listener->tcp_server_);
+    Server* server, const EventEngine::ResolvedAddress& addr,
+    const ChannelArgs& args, Chttp2ServerArgsModifier args_modifier,
+    int* port_num) {
+  // Create Chttp2ServerListener.
+  OrphanablePtr<Chttp2ServerListener> listener =
+      MakeOrphanable<Chttp2ServerListener>(server, args, args_modifier,
+                                           server->config_fetcher());
+  // The tcp_server will be unreffed when the listener is orphaned, which could
+  // be at the end of this function if the listener was not added to the
+  // server's set of listeners.
+  grpc_error_handle error = grpc_tcp_server_create(
+      &listener->tcp_server_shutdown_complete_, ChannelArgsEndpointConfig(args),
+      OnAccept, listener.get(), &listener->tcp_server_);
+  if (!error.ok()) return error;
+  // TODO(yijiem): remove this conversion when we remove all
+  // grpc_resolved_address usages.
+  grpc_resolved_address iomgr_addr =
+      grpc_event_engine::experimental::CreateGRPCResolvedAddress(addr);
+  if (listener->config_fetcher_ != nullptr) {
+    listener->resolved_address_ = iomgr_addr;
+    // TODO(yashykt): Consider binding so as to be able to return the port
+    // number.
+  } else {
+    error =
+        grpc_tcp_server_add_port(listener->tcp_server_, &iomgr_addr, port_num);
     if (!error.ok()) return error;
-    if (server->config_fetcher() != nullptr) {
-      listener->resolved_address_ = *addr;
-      // TODO(yashykt): Consider binding so as to be able to return the port
-      // number.
-    } else {
-      error = grpc_tcp_server_add_port(listener->tcp_server_, addr, port_num);
-      if (!error.ok()) return error;
-    }
-    // Create channelz node.
-    if (args.GetBool(GRPC_ARG_ENABLE_CHANNELZ)
-            .value_or(GRPC_ENABLE_CHANNELZ_DEFAULT)) {
-      auto string_address = grpc_sockaddr_to_uri(addr);
-      if (!string_address.ok()) {
-        return GRPC_ERROR_CREATE(string_address.status().ToString());
-      }
-      listener->channelz_listen_socket_ =
-          MakeRefCounted<channelz::ListenSocketNode>(
-              *string_address,
-              absl::StrCat("chttp2 listener ", *string_address));
-    }
-    // Register with the server only upon success
-    server->AddListener(OrphanablePtr<Server::ListenerInterface>(listener));
-    return absl::OkStatus();
-  }();
-  if (!error.ok()) {
-    if (listener != nullptr) {
-      if (listener->tcp_server_ != nullptr) {
-        // listener is deleted when tcp_server_ is shutdown.
-        grpc_tcp_server_unref(listener->tcp_server_);
-      } else {
-        delete listener;
-      }
+  }
+  // Create channelz node.
+  if (args.GetBool(GRPC_ARG_ENABLE_CHANNELZ)
+          .value_or(GRPC_ENABLE_CHANNELZ_DEFAULT)) {
+    auto string_address =
+        grpc_event_engine::experimental::ResolvedAddressToURI(addr);
+    if (!string_address.ok()) {
+      return GRPC_ERROR_CREATE(string_address.status().ToString());
     }
+    listener->channelz_listen_socket_ =
+        MakeRefCounted<channelz::ListenSocketNode>(
+            *string_address, absl::StrCat("chttp2 listener ", *string_address));
   }
-  return error;
+  // Register with the server only upon success
+  server->AddListener(std::move(listener));
+  return absl::OkStatus();
 }
 
 grpc_error_handle Chttp2ServerListener::CreateWithAcceptor(
     Server* server, const char* name, const ChannelArgs& args,
     Chttp2ServerArgsModifier args_modifier) {
-  Chttp2ServerListener* listener =
-      new Chttp2ServerListener(server, args, args_modifier);
+  auto listener = MakeOrphanable<Chttp2ServerListener>(
+      server, args, args_modifier, server->config_fetcher());
   grpc_error_handle error = grpc_tcp_server_create(
-      &listener->tcp_server_shutdown_complete_,
-      grpc_event_engine::experimental::ChannelArgsEndpointConfig(args),
-      OnAccept, listener, &listener->tcp_server_);
-  if (!error.ok()) {
-    delete listener;
-    return error;
-  }
+      &listener->tcp_server_shutdown_complete_, ChannelArgsEndpointConfig(args),
+      OnAccept, listener.get(), &listener->tcp_server_);
+  if (!error.ok()) return error;
   // TODO(yangg) channelz
   TcpServerFdHandler** arg_val = args.GetPointer<TcpServerFdHandler*>(name);
   *arg_val = grpc_tcp_server_create_fd_handler(listener->tcp_server_);
-  server->AddListener(OrphanablePtr<Server::ListenerInterface>(listener));
+  server->AddListener(std::move(listener));
   return absl::OkStatus();
 }
 
+Chttp2ServerListener* Chttp2ServerListener::CreateForPassiveListener(
+    Server* server, const ChannelArgs& args,
+    std::shared_ptr<experimental::PassiveListenerImpl> passive_listener) {
+  // TODO(hork): figure out how to handle channelz in this case
+  auto listener = MakeOrphanable<Chttp2ServerListener>(
+      server, args, /*args_modifier=*/
+      [](const ChannelArgs& args, grpc_error_handle*) { return args; }, nullptr,
+      std::move(passive_listener));
+  auto listener_ptr = listener.get();
+  server->AddListener(std::move(listener));
+  return listener_ptr;
+}
+
 Chttp2ServerListener::Chttp2ServerListener(
     Server* server, const ChannelArgs& args,
-    Chttp2ServerArgsModifier args_modifier)
+    Chttp2ServerArgsModifier args_modifier,
+    grpc_server_config_fetcher* config_fetcher,
+    std::shared_ptr<experimental::PassiveListenerImpl> passive_listener)
     : server_(server),
       args_modifier_(args_modifier),
       args_(args),
-      memory_quota_(args.GetObject<ResourceQuota>()->memory_quota()) {
+      memory_quota_(args.GetObject<ResourceQuota>()->memory_quota()),
+      connection_quota_(MakeRefCounted<ConnectionQuota>()),
+      config_fetcher_(config_fetcher),
+      passive_listener_(std::move(passive_listener)) {
+  auto max_allowed_incoming_connections =
+      args.GetInt(GRPC_ARG_MAX_ALLOWED_INCOMING_CONNECTIONS);
+  if (max_allowed_incoming_connections.has_value()) {
+    connection_quota_->SetMaxIncomingConnections(
+        max_allowed_incoming_connections.value());
+  }
   GRPC_CLOSURE_INIT(&tcp_server_shutdown_complete_, TcpServerShutdownComplete,
                     this, grpc_schedule_on_exec_ctx);
 }
 
 Chttp2ServerListener::~Chttp2ServerListener() {
-  // Flush queued work before destroying handshaker factory, since that
-  // may do a synchronous unref.
-  ExecCtx::Get()->Flush();
+  if (passive_listener_ != nullptr) {
+    passive_listener_->ListenerDestroyed();
+  }
   if (on_destroy_done_ != nullptr) {
     ExecCtx::Run(DEBUG_LOCATION, on_destroy_done_, absl::OkStatus());
-    ExecCtx::Get()->Flush();
   }
 }
 
 // Server callback: start listening on our ports
 void Chttp2ServerListener::Start(
     Server* /*server*/, const std::vector<grpc_pollset*>* /* pollsets */) {
-  if (server_->config_fetcher() != nullptr) {
-    auto watcher = std::make_unique<ConfigFetcherWatcher>(Ref());
+  if (config_fetcher_ != nullptr) {
+    auto watcher = std::make_unique<ConfigFetcherWatcher>(
+        RefAsSubclass<Chttp2ServerListener>());
     config_fetcher_watcher_ = watcher.get();
-    server_->config_fetcher()->StartWatch(
+    config_fetcher_->StartWatch(
         grpc_sockaddr_to_string(&resolved_address_, false).value(),
         std::move(watcher));
   } else {
@@ -797,7 +832,9 @@ void Chttp2ServerListener::Start(
 }
 
 void Chttp2ServerListener::StartListening() {
-  grpc_tcp_server_start(tcp_server_, &server_->pollsets());
+  if (tcp_server_ != nullptr) {
+    grpc_tcp_server_start(tcp_server_, &server_->pollsets());
+  }
 }
 
 void Chttp2ServerListener::SetOnDestroyDone(grpc_closure* on_destroy_done) {
@@ -805,71 +842,73 @@ void Chttp2ServerListener::SetOnDestroyDone(grpc_closure* on_destroy_done) {
   on_destroy_done_ = on_destroy_done;
 }
 
+void Chttp2ServerListener::AcceptConnectedEndpoint(
+    std::unique_ptr<EventEngine::Endpoint> endpoint) {
+  OnAccept(this, grpc_event_engine_endpoint_create(std::move(endpoint)),
+           /*accepting_pollset=*/nullptr, /*acceptor=*/nullptr);
+}
+
 void Chttp2ServerListener::OnAccept(void* arg, grpc_endpoint* tcp,
                                     grpc_pollset* accepting_pollset,
-                                    grpc_tcp_server_acceptor* acceptor) {
+                                    grpc_tcp_server_acceptor* server_acceptor) {
   Chttp2ServerListener* self = static_cast<Chttp2ServerListener*>(arg);
   ChannelArgs args = self->args_;
+  OrphanablePtr<grpc_endpoint> endpoint(tcp);
+  AcceptorPtr acceptor(server_acceptor);
   RefCountedPtr<grpc_server_config_fetcher::ConnectionManager>
       connection_manager;
   {
     MutexLock lock(&self->mu_);
     connection_manager = self->connection_manager_;
   }
-  auto endpoint_cleanup = [&](grpc_error_handle error) {
-    grpc_endpoint_shutdown(tcp, error);
-    grpc_endpoint_destroy(tcp);
-    gpr_free(acceptor);
-  };
-  if (self->server_->config_fetcher() != nullptr) {
+  if (!self->connection_quota_->AllowIncomingConnection(
+          self->memory_quota_, grpc_endpoint_get_peer(endpoint.get()))) {
+    return;
+  }
+  if (self->config_fetcher_ != nullptr) {
     if (connection_manager == nullptr) {
-      grpc_error_handle error = GRPC_ERROR_CREATE(
-          "No ConnectionManager configured. Closing connection.");
-      endpoint_cleanup(error);
       return;
     }
     absl::StatusOr<ChannelArgs> args_result =
         connection_manager->UpdateChannelArgsForConnection(args, tcp);
     if (!args_result.ok()) {
-      endpoint_cleanup(GRPC_ERROR_CREATE(args_result.status().ToString()));
       return;
     }
     grpc_error_handle error;
     args = self->args_modifier_(*args_result, &error);
     if (!error.ok()) {
-      endpoint_cleanup(error);
       return;
     }
   }
   auto memory_owner = self->memory_quota_->CreateMemoryOwner();
   EventEngine* const event_engine = self->args_.GetObject<EventEngine>();
   auto connection = memory_owner.MakeOrphanable<ActiveConnection>(
-      accepting_pollset, acceptor, event_engine, args, std::move(memory_owner));
-  // We no longer own acceptor
-  acceptor = nullptr;
+      self->RefAsSubclass<Chttp2ServerListener>(), accepting_pollset,
+      std::move(acceptor), event_engine, args, std::move(memory_owner));
   // Hold a ref to connection to allow starting handshake outside the
   // critical region
   RefCountedPtr<ActiveConnection> connection_ref = connection->Ref();
-  RefCountedPtr<Chttp2ServerListener> listener_ref;
   {
     MutexLock lock(&self->mu_);
     // Shutdown the the connection if listener's stopped serving or if the
     // connection manager has changed.
     if (!self->shutdown_ && self->is_serving_ &&
         connection_manager == self->connection_manager_) {
-      // This ref needs to be taken in the critical region after having made
-      // sure that the listener has not been Orphaned, so as to avoid
-      // heap-use-after-free issues where `Ref()` is invoked when the ref of
-      // tcp_server_ has already reached 0. (Ref() implementation of
-      // Chttp2ServerListener is grpc_tcp_server_ref().)
-      listener_ref = self->Ref();
+      // The ref for the tcp_server needs to be taken in the critical region
+      // after having made sure that the listener has not been Orphaned, so as
+      // to avoid heap-use-after-free issues where `Ref()` is invoked when the
+      // listener is already shutdown. Note that the listener holds a ref to the
+      // tcp_server but this ref is given away when the listener is orphaned
+      // (shutdown). A connection needs the tcp_server to outlast the handshake
+      // since the acceptor needs it.
+      if (self->tcp_server_ != nullptr) {
+        grpc_tcp_server_ref(self->tcp_server_);
+      }
       self->connections_.emplace(connection.get(), std::move(connection));
     }
   }
-  if (connection != nullptr) {
-    endpoint_cleanup(absl::OkStatus());
-  } else {
-    connection_ref->Start(std::move(listener_ref), tcp, args);
+  if (connection == nullptr) {
+    connection_ref->Start(std::move(endpoint), args);
   }
 }
 
@@ -877,7 +916,7 @@ void Chttp2ServerListener::TcpServerShutdownComplete(
     void* arg, grpc_error_handle /*error*/) {
   Chttp2ServerListener* self = static_cast<Chttp2ServerListener*>(arg);
   self->channelz_listen_socket_.reset();
-  delete self;
+  self->Unref();
 }
 
 // Server callback: destroy the tcp listener (so we don't generate further
@@ -886,7 +925,8 @@ void Chttp2ServerListener::Orphan() {
   // Cancel the watch before shutting down so as to avoid holding a ref to the
   // listener in the watcher.
   if (config_fetcher_watcher_ != nullptr) {
-    server_->config_fetcher()->CancelWatch(config_fetcher_watcher_);
+    CHECK_NE(config_fetcher_, nullptr);
+    config_fetcher_->CancelWatch(config_fetcher_watcher_);
   }
   std::map<ActiveConnection*, OrphanablePtr<ActiveConnection>> connections;
   grpc_tcp_server* tcp_server;
@@ -904,12 +944,14 @@ void Chttp2ServerListener::Orphan() {
     }
     tcp_server = tcp_server_;
   }
-  grpc_tcp_server_shutdown_listeners(tcp_server);
-  grpc_tcp_server_unref(tcp_server);
+  if (tcp_server != nullptr) {
+    grpc_tcp_server_shutdown_listeners(tcp_server);
+    grpc_tcp_server_unref(tcp_server);
+  } else {
+    Unref();
+  }
 }
 
-}  // namespace
-
 //
 // Chttp2ServerAddPort()
 //
@@ -926,37 +968,68 @@ grpc_error_handle Chttp2ServerAddPort(Server* server, const char* addr,
                                                     args_modifier);
   }
   *port_num = -1;
-  absl::StatusOr<std::vector<grpc_resolved_address>> resolved_or;
+  absl::StatusOr<std::vector<grpc_resolved_address>> resolved;
+  absl::StatusOr<std::vector<EventEngine::ResolvedAddress>> results =
+      std::vector<EventEngine::ResolvedAddress>();
   std::vector<grpc_error_handle> error_list;
   std::string parsed_addr = URI::PercentDecode(addr);
   absl::string_view parsed_addr_unprefixed{parsed_addr};
   // Using lambda to avoid use of goto.
   grpc_error_handle error = [&]() {
     grpc_error_handle error;
+    // TODO(ladynana, yijiem): this code does not handle address URIs correctly:
+    // it's parsing `unix://foo/bar` as path `/foo/bar` when it should be
+    // parsing it as authority `foo` and path `/bar`. Also add API documentation
+    // on the valid URIs that grpc_server_add_http2_port accepts.
     if (absl::ConsumePrefix(&parsed_addr_unprefixed, kUnixUriPrefix)) {
-      resolved_or = grpc_resolve_unix_domain_address(parsed_addr_unprefixed);
+      resolved = grpc_resolve_unix_domain_address(parsed_addr_unprefixed);
+      GRPC_RETURN_IF_ERROR(resolved.status());
     } else if (absl::ConsumePrefix(&parsed_addr_unprefixed,
                                    kUnixAbstractUriPrefix)) {
-      resolved_or =
+      resolved =
           grpc_resolve_unix_abstract_domain_address(parsed_addr_unprefixed);
+      GRPC_RETURN_IF_ERROR(resolved.status());
     } else if (absl::ConsumePrefix(&parsed_addr_unprefixed, kVSockUriPrefix)) {
-      resolved_or = grpc_resolve_vsock_address(parsed_addr_unprefixed);
+      resolved = grpc_resolve_vsock_address(parsed_addr_unprefixed);
+      GRPC_RETURN_IF_ERROR(resolved.status());
     } else {
-      resolved_or =
-          GetDNSResolver()->LookupHostnameBlocking(parsed_addr, "https");
+      if (IsEventEngineDnsNonClientChannelEnabled()) {
+        absl::StatusOr<std::unique_ptr<EventEngine::DNSResolver>> ee_resolver =
+            args.GetObjectRef<EventEngine>()->GetDNSResolver(
+                EventEngine::DNSResolver::ResolverOptions());
+        GRPC_RETURN_IF_ERROR(ee_resolver.status());
+        results = grpc_event_engine::experimental::LookupHostnameBlocking(
+            ee_resolver->get(), parsed_addr, "https");
+      } else {
+        // TODO(yijiem): Remove this after event_engine_dns_non_client_channel
+        // is fully enabled.
+        absl::StatusOr<std::vector<grpc_resolved_address>> iomgr_results =
+            GetDNSResolver()->LookupHostnameBlocking(parsed_addr, "https");
+        GRPC_RETURN_IF_ERROR(iomgr_results.status());
+        for (const auto& addr : *iomgr_results) {
+          results->push_back(
+              grpc_event_engine::experimental::CreateResolvedAddress(addr));
+        }
+      }
     }
-    if (!resolved_or.ok()) {
-      return absl_status_to_grpc_error(resolved_or.status());
+    if (resolved.ok()) {
+      for (const auto& addr : *resolved) {
+        results->push_back(
+            grpc_event_engine::experimental::CreateResolvedAddress(addr));
+      }
     }
+    GRPC_RETURN_IF_ERROR(results.status());
     // Create a listener for each resolved address.
-    for (auto& addr : *resolved_or) {
+    for (EventEngine::ResolvedAddress& addr : *results) {
       // If address has a wildcard port (0), use the same port as a previous
       // listener.
-      if (*port_num != -1 && grpc_sockaddr_get_port(&addr) == 0) {
-        grpc_sockaddr_set_port(&addr, *port_num);
+      if (*port_num != -1 &&
+          grpc_event_engine::experimental::ResolvedAddressGetPort(addr) == 0) {
+        grpc_event_engine::experimental::ResolvedAddressSetPort(addr,
+                                                                *port_num);
       }
       int port_temp = -1;
-      error = Chttp2ServerListener::Create(server, &addr, args, args_modifier,
+      error = Chttp2ServerListener::Create(server, addr, args, args_modifier,
                                            &port_temp);
       if (!error.ok()) {
         error_list.push_back(error);
@@ -964,24 +1037,24 @@ grpc_error_handle Chttp2ServerAddPort(Server* server, const char* addr,
         if (*port_num == -1) {
           *port_num = port_temp;
         } else {
-          GPR_ASSERT(*port_num == port_temp);
+          CHECK(*port_num == port_temp);
         }
       }
     }
-    if (error_list.size() == resolved_or->size()) {
+    if (error_list.size() == results->size()) {
       std::string msg = absl::StrFormat(
           "No address added out of total %" PRIuPTR " resolved for '%s'",
-          resolved_or->size(), addr);
+          results->size(), addr);
       return GRPC_ERROR_CREATE_REFERENCING(msg.c_str(), error_list.data(),
                                            error_list.size());
     } else if (!error_list.empty()) {
-      std::string msg = absl::StrFormat(
-          "Only %" PRIuPTR " addresses added out of total %" PRIuPTR
-          " resolved",
-          resolved_or->size() - error_list.size(), resolved_or->size());
+      std::string msg =
+          absl::StrFormat("Only %" PRIuPTR
+                          " addresses added out of total %" PRIuPTR " resolved",
+                          results->size() - error_list.size(), results->size());
       error = GRPC_ERROR_CREATE_REFERENCING(msg.c_str(), error_list.data(),
                                             error_list.size());
-      gpr_log(GPR_INFO, "WARNING: %s", StatusToString(error).c_str());
+      LOG(INFO) << "WARNING: " << StatusToString(error);
       // we managed to bind some addresses: continue without error
     }
     return absl::OkStatus();
@@ -1010,6 +1083,50 @@ ChannelArgs ModifyArgsForConnection(const ChannelArgs& args,
 }
 
 }  // namespace
+
+namespace experimental {
+
+absl::Status PassiveListenerImpl::AcceptConnectedEndpoint(
+    std::unique_ptr<EventEngine::Endpoint> endpoint) {
+  CHECK_NE(server_.get(), nullptr);
+  RefCountedPtr<Chttp2ServerListener> listener;
+  {
+    MutexLock lock(&mu_);
+    if (listener_ != nullptr) {
+      listener =
+          listener_->RefIfNonZero().TakeAsSubclass<Chttp2ServerListener>();
+    }
+  }
+  if (listener == nullptr) {
+    return absl::UnavailableError("passive listener already shut down");
+  }
+  ExecCtx exec_ctx;
+  listener->AcceptConnectedEndpoint(std::move(endpoint));
+  return absl::OkStatus();
+}
+
+absl::Status PassiveListenerImpl::AcceptConnectedFd(int fd) {
+  CHECK_NE(server_.get(), nullptr);
+  ExecCtx exec_ctx;
+  auto& args = server_->channel_args();
+  auto* supports_fd = QueryExtension<EventEngineSupportsFdExtension>(
+      /*engine=*/args.GetObjectRef<EventEngine>().get());
+  if (supports_fd == nullptr) {
+    return absl::UnimplementedError(
+        "The server's EventEngine does not support adding endpoints from "
+        "connected file descriptors.");
+  }
+  auto endpoint =
+      supports_fd->CreateEndpointFromFd(fd, ChannelArgsEndpointConfig(args));
+  return AcceptConnectedEndpoint(std::move(endpoint));
+}
+
+void PassiveListenerImpl::ListenerDestroyed() {
+  MutexLock lock(&mu_);
+  listener_ = nullptr;
+}
+
+}  // namespace experimental
 }  // namespace grpc_core
 
 int grpc_server_add_http2_port(grpc_server* server, const char* addr,
@@ -1020,8 +1137,8 @@ int grpc_server_add_http2_port(grpc_server* server, const char* addr,
   int port_num = 0;
   grpc_core::Server* core_server = grpc_core::Server::FromC(server);
   grpc_core::ChannelArgs args = core_server->channel_args();
-  GRPC_API_TRACE("grpc_server_add_http2_port(server=%p, addr=%s, creds=%p)", 3,
-                 (server, addr, creds));
+  GRPC_TRACE_LOG(api, INFO) << "grpc_server_add_http2_port(server=" << server
+                            << ", addr=" << addr << ", creds=" << creds << ")";
   // Create security context.
   if (creds == nullptr) {
     err = GRPC_ERROR_CREATE(
@@ -1057,7 +1174,7 @@ int grpc_server_add_http2_port(grpc_server* server, const char* addr,
 done:
   sc.reset(DEBUG_LOCATION, "server");
   if (!err.ok()) {
-    gpr_log(GPR_ERROR, "%s", grpc_core::StatusToString(err).c_str());
+    LOG(ERROR) << grpc_core::StatusToString(err);
   }
   return port_num;
 }
@@ -1068,7 +1185,7 @@ void grpc_server_add_channel_from_fd(grpc_server* server, int fd,
   // For now, we only support insecure server credentials
   if (creds == nullptr ||
       creds->type() != grpc_core::InsecureServerCredentials::Type()) {
-    gpr_log(GPR_ERROR, "Failed to create channel due to invalid creds");
+    LOG(ERROR) << "Failed to create channel due to invalid creds";
     return;
   }
   grpc_core::ExecCtx exec_ctx;
@@ -1078,23 +1195,26 @@ void grpc_server_add_channel_from_fd(grpc_server* server, int fd,
   std::string name = absl::StrCat("fd:", fd);
   auto memory_quota =
       server_args.GetObject<grpc_core::ResourceQuota>()->memory_quota();
-  grpc_endpoint* server_endpoint = grpc_tcp_create_from_fd(
-      grpc_fd_create(fd, name.c_str(), true),
-      grpc_event_engine::experimental::ChannelArgsEndpointConfig(server_args),
-      name);
+  grpc_core::OrphanablePtr<grpc_endpoint> server_endpoint(
+      grpc_tcp_create_from_fd(
+          grpc_fd_create(fd, name.c_str(), true),
+          grpc_event_engine::experimental::ChannelArgsEndpointConfig(
+              server_args),
+          name));
+  for (grpc_pollset* pollset : core_server->pollsets()) {
+    grpc_endpoint_add_to_pollset(server_endpoint.get(), pollset);
+  }
   grpc_core::Transport* transport = grpc_create_chttp2_transport(
-      server_args, server_endpoint, false  // is_client
+      server_args, std::move(server_endpoint), false  // is_client
   );
   grpc_error_handle error =
       core_server->SetupTransport(transport, nullptr, server_args, nullptr);
   if (error.ok()) {
-    for (grpc_pollset* pollset : core_server->pollsets()) {
-      grpc_endpoint_add_to_pollset(server_endpoint, pollset);
-    }
-    grpc_chttp2_transport_start_reading(transport, nullptr, nullptr, nullptr);
+    grpc_chttp2_transport_start_reading(transport, nullptr, nullptr, nullptr,
+                                        nullptr);
   } else {
-    gpr_log(GPR_ERROR, "Failed to create channel: %s",
-            grpc_core::StatusToString(error).c_str());
+    LOG(ERROR) << "Failed to create channel: "
+               << grpc_core::StatusToString(error);
     transport->Orphan();
   }
 }
@@ -1103,7 +1223,36 @@ void grpc_server_add_channel_from_fd(grpc_server* server, int fd,
 
 void grpc_server_add_channel_from_fd(grpc_server* /* server */, int /* fd */,
                                      grpc_server_credentials* /* creds */) {
-  GPR_ASSERT(0);
+  CHECK(0);
 }
 
 #endif  // GPR_SUPPORT_CHANNELS_FROM_FD
+
+absl::Status grpc_server_add_passive_listener(
+    grpc_core::Server* server, grpc_server_credentials* credentials,
+    std::shared_ptr<grpc_core::experimental::PassiveListenerImpl>
+        passive_listener) {
+  grpc_core::ExecCtx exec_ctx;
+  GRPC_TRACE_LOG(api, INFO)
+      << "grpc_server_add_passive_listener(server=" << server
+      << ", credentials=" << credentials << ")";
+  // Create security context.
+  if (credentials == nullptr) {
+    return absl::UnavailableError(
+        "No credentials specified for passive listener");
+  }
+  auto sc = credentials->create_security_connector(grpc_core::ChannelArgs());
+  if (sc == nullptr) {
+    return absl::UnavailableError(
+        absl::StrCat("Unable to create secure server with credentials of type ",
+                     credentials->type().name()));
+  }
+  auto args = server->channel_args()
+                  .SetObject(credentials->Ref())
+                  .SetObject(std::move(sc));
+  passive_listener->listener_ =
+      grpc_core::Chttp2ServerListener::CreateForPassiveListener(
+          server, args, passive_listener);
+  passive_listener->server_ = server->Ref();
+  return absl::OkStatus();
+}