grpc 1.81.1 → 1.83.0

data/src/core/ext/transport/chttp2/server/chttp2_server.cc

@@ -30,11 +30,13 @@
 #include <string.h>
 
 #include <algorithm>
+#include <cstdint>
 #include <map>
 #include <memory>
 #include <optional>
 #include <string>
 #include <utility>
+#include <variant>
 #include <vector>
 
 #include "src/core/channelz/channelz.h"
@@ -43,6 +45,7 @@
 #include "src/core/credentials/transport/security_connector.h"
 #include "src/core/credentials/transport/transport_credentials.h"
 #include "src/core/ext/transport/chttp2/transport/chttp2_transport.h"
+#include "src/core/ext/transport/chttp2/transport/http2_server_transport.h"
 #include "src/core/ext/transport/chttp2/transport/internal.h"
 #include "src/core/ext/transport/chttp2/transport/legacy_frame.h"
 #include "src/core/handshaker/handshaker.h"
@@ -70,8 +73,11 @@
 #include "src/core/lib/resource_quota/connection_quota.h"
 #include "src/core/lib/resource_quota/memory_quota.h"
 #include "src/core/lib/resource_quota/resource_quota.h"
+#include "src/core/lib/surface/channel_create.h"
 #include "src/core/lib/transport/error_utils.h"
+#include "src/core/lib/transport/promise_endpoint.h"
 #include "src/core/lib/transport/transport.h"
+#include "src/core/mitigation_engine/mitigation_engine.h"
 #include "src/core/server/server.h"
 #include "src/core/util/debug_location.h"
 #include "src/core/util/grpc_check.h"
@@ -226,41 +232,97 @@ void NewChttp2ServerListener::ActiveConnection::HandshakingState::
   // code, so we can just clean up here without creating a transport.
   if (!connection_->shutdown_ && result.ok() &&
       (*result)->endpoint != nullptr) {
-    RefCountedPtr<Transport> transport =
-        grpc_create_chttp2_transport((*result)->args,
-                                     std::move((*result)->endpoint), false)
-            ->Ref();
-    grpc_error_handle channel_init_err =
-        connection_->listener_state_->server()->SetupTransport(
-            transport.get(), accepting_pollset_, (*result)->args);
-    if (channel_init_err.ok()) {
-      // Use notify_on_receive_settings callback to enforce the
-      // handshake deadline.
-      connection_->state_ =
-          DownCast<grpc_chttp2_transport*>(transport.get())->Ref();
-      grpc_closure* on_close = &connection_->on_close_;
-      // Refs held by OnClose()
-      connection_->Ref().release();
-      grpc_chttp2_transport_start_reading(
-          transport.get(), (*result)->read_buffer.c_slice_buffer(),
-          [self = Ref()](absl::StatusOr<uint32_t>) {
-            self->OnReceiveSettings();
-          },
-          nullptr, on_close);
-      timer_handle_ = connection_->listener_state_->event_engine()->RunAfter(
-          deadline_ - Timestamp::Now(), [self = Ref()]() mutable {
-            // HandshakingState deletion might require an active ExecCtx.
-            ExecCtx exec_ctx;
-            auto* self_ptr = self.get();
-            self_ptr->connection_->work_serializer_.Run(
-                [self = std::move(self)]() { self->OnTimeoutLocked(); },
-                DEBUG_LOCATION);
-          });
+    const bool is_callv3 =
+        (*result)->args.GetBool(GRPC_ARG_USE_V3_STACK).value_or(false);
+
+    if (!is_callv3) {
+      RefCountedPtr<Transport> transport =
+          grpc_create_chttp2_transport((*result)->args,
+                                       std::move((*result)->endpoint), false)
+              ->Ref();
+      grpc_error_handle channel_init_err =
+          connection_->listener_state_->server()->SetupTransport(
+              transport.get(), accepting_pollset_, (*result)->args);
+      if (channel_init_err.ok()) {
+        // Use notify_on_receive_settings callback to enforce the
+        // handshake deadline.
+        connection_->state_ =
+            DownCast<grpc_chttp2_transport*>(transport.get())->Ref();
+        grpc_closure* on_close = &connection_->on_close_;
+        // Refs held by OnClose()
+        connection_->Ref().release();
+        grpc_chttp2_transport_start_reading(
+            transport.get(), (*result)->read_buffer.c_slice_buffer(),
+            [self = Ref()](absl::StatusOr<uint32_t>) {
+              self->OnReceiveSettings();
+            },
+            nullptr, on_close);
+        timer_handle_ = connection_->listener_state_->event_engine()->RunAfter(
+            deadline_ - Timestamp::Now(), [self = Ref()]() mutable {
+              // HandshakingState deletion might require an active ExecCtx.
+              ExecCtx exec_ctx;
+              auto* self_ptr = self.get();
+              self_ptr->connection_->work_serializer_.Run(
+                  [self = std::move(self)]() { self->OnTimeoutLocked(); },
+                  DEBUG_LOCATION);
+            });
+      } else {
+        // Failed to create channel from transport. Clean up.
+        LOG(ERROR) << "Failed to create channel: "
+                   << StatusToString(channel_init_err);
+        transport->Orphan();
+      }
     } else {
-      // Failed to create channel from transport. Clean up.
-      LOG(ERROR) << "Failed to create channel: "
-                 << StatusToString(channel_init_err);
-      transport->Orphan();
+      std::unique_ptr<EventEngine::Endpoint> event_engine_endpoint =
+          grpc_event_engine::experimental::
+              grpc_take_wrapped_event_engine_endpoint(
+                  (*result)->endpoint.release());
+      if (GPR_UNLIKELY(event_engine_endpoint == nullptr)) {
+        LOG(ERROR) << "Failed to take endpoint.";
+      } else {
+        PromiseEndpoint promise_endpoint(std::move(event_engine_endpoint),
+                                         std::move((*result)->read_buffer));
+        std::shared_ptr<EventEngine> event_engine_ptr =
+            (*result)->args.GetObjectRef<EventEngine>();
+        // TODO(akshitpatel) : [PH2][P4] : Consider making on_close_
+        // absl::AnyInvocable.
+        grpc_closure* on_close = &connection_->on_close_;
+        // Refs held by OnClose()
+        connection_->Ref().release();
+        // Use notify_on_receive_settings callback to enforce the
+        // handshake deadline.
+        auto* ph2_transport = new http2::Http2ServerTransport(
+            std::move(promise_endpoint), (*result)->args,
+            std::move(event_engine_ptr),
+            [self = Ref()](absl::StatusOr<uint32_t>) {
+              self->OnReceiveSettings();
+            },
+            on_close);
+        // SetupTransport will spawn the initial transport promises.
+        grpc_error_handle channel_init_err =
+            connection_->listener_state_->server()->SetupTransport(
+                ph2_transport, accepting_pollset_, (*result)->args);
+        if (GPR_LIKELY(channel_init_err.ok())) {
+          ph2_transport->Ref().release();
+          connection_->state_ =
+              RefCountedPtr<http2::Http2ServerTransport>(ph2_transport);
+          timer_handle_ =
+              connection_->listener_state_->event_engine()->RunAfter(
+                  deadline_ - Timestamp::Now(), [self = Ref()]() mutable {
+                    // HandshakingState deletion might require an active
+                    // ExecCtx.
+                    ExecCtx exec_ctx;
+                    auto* self_ptr = self.get();
+                    self_ptr->connection_->work_serializer_.Run(
+                        [self = std::move(self)]() { self->OnTimeoutLocked(); },
+                        DEBUG_LOCATION);
+                  });
+        } else {
+          LOG(ERROR) << "Failed to create channel: "
+                     << StatusToString(channel_init_err);
+          ph2_transport->Orphan();
+        }
+      }
     }
   }
   // Since the handshake manager is done, the connection no longer needs to
@@ -269,6 +331,8 @@ void NewChttp2ServerListener::ActiveConnection::HandshakingState::
   connection_->listener_state_->OnHandshakeDone(connection_.get());
   // Clean up if we don't have a transport
   if (!std::holds_alternative<RefCountedPtr<grpc_chttp2_transport>>(
+          connection_->state_) &&
+      !std::holds_alternative<RefCountedPtr<http2::Http2ServerTransport>>(
           connection_->state_)) {
     connection_->listener_state_->connection_quota()->ReleaseConnections(1);
     connection_->listener_state_->RemoveLogicalConnection(connection_.get());
@@ -373,6 +437,17 @@ void NewChttp2ServerListener::ActiveConnection::SendGoAwayImplLocked() {
                 static_cast<intptr_t>(Http2ErrorCode::kNoError));
             transport->PerformOp(op);
           }
+        },
+        [](const RefCountedPtr<http2::Http2ServerTransport>& transport) {
+          // Send a GOAWAY if the transport exists
+          if (transport != nullptr) {
+            grpc_transport_op* op = grpc_make_transport_op(nullptr);
+            // We send a non-ok status here to send the status message in the
+            // GOAWAY frame.
+            op->goaway_error =
+                absl::UnavailableError("Server is stopping to serve requests.");
+            transport->PerformOp(op);
+          }
         });
   }
 }
@@ -397,6 +472,15 @@ void NewChttp2ServerListener::ActiveConnection::
               "Drain grace time expired. Closing connection immediately.");
           transport->PerformOp(op);
         }
+      },
+      [](const RefCountedPtr<http2::Http2ServerTransport>& transport) {
+        // Disconnect immediately if the transport exists
+        if (transport != nullptr) {
+          grpc_transport_op* op = grpc_make_transport_op(nullptr);
+          op->disconnect_with_error = absl::UnavailableError(
+              "Drain grace time expired. Closing connection immediately.");
+          transport->PerformOp(op);
+        }
       });
 }
 
@@ -546,11 +630,21 @@ void NewChttp2ServerListener::OnAccept(
   NewChttp2ServerListener* self = static_cast<NewChttp2ServerListener*>(arg);
   OrphanablePtr<grpc_endpoint> endpoint(tcp);
   AcceptorPtr acceptor(server_acceptor);
+  absl::string_view peer = grpc_endpoint_get_peer(endpoint.get());
   if (!self->listener_state_->connection_quota()->AllowIncomingConnection(
-          self->listener_state_->memory_quota(),
-          grpc_endpoint_get_peer(endpoint.get()))) {
+          self->listener_state_->memory_quota(), peer)) {
     return;
   }
+  RefCountedPtr<MitigationEngine> mitigation_engine = self->mitigation_engine();
+  if (mitigation_engine != nullptr) {
+    auto action = mitigation_engine->EvaluateIncomingConnection(peer);
+    if (action == MitigationEngine::Action::kCloseConnection) {
+      LOG_EVERY_N_SEC(INFO, 60)
+          << "Mitigation engine rejected connection from " << peer;
+      self->listener_state_->connection_quota()->ReleaseConnections(1);
+      return;
+    }
+  }
   {
     // The ref for the tcp_server need to be taken in the critical region
     // after having made sure that the listener has not been Orphaned, so as
@@ -615,8 +709,12 @@ absl::StatusOr<int> Chttp2ServerAddPort(Server* server, const char* addr,
   if (addr == nullptr) {
     return GRPC_ERROR_CREATE("Invalid address: addr cannot be a nullptr.");
   }
+
+  ChannelArgs updated_args =
+      args.Set(GRPC_ARG_USE_V3_STACK, http2::ShouldEnablePh2Server());
   if (strncmp(addr, "external:", 9) == 0) {
-    auto r = NewChttp2ServerListener::CreateWithAcceptor(server, addr, args);
+    auto r =
+        NewChttp2ServerListener::CreateWithAcceptor(server, addr, updated_args);
     if (!r.ok()) return r;
     return -1;
   }
@@ -646,9 +744,7 @@ absl::StatusOr<int> Chttp2ServerAddPort(Server* server, const char* addr,
       resolved = grpc_resolve_vsock_address(parsed_addr_unprefixed);
       GRPC_RETURN_IF_ERROR(resolved.status());
     } else {
-      if (IsEventEngineDnsNonClientChannelEnabled() &&
-          !grpc_event_engine::experimental::
-              EventEngineExperimentDisabledForPython()) {
+      if (IsEventEngineDnsNonClientChannelEnabled()) {
         absl::StatusOr<std::unique_ptr<EventEngine::DNSResolver>> ee_resolver =
             args.GetObjectRef<EventEngine>()->GetDNSResolver(
                 EventEngine::DNSResolver::ResolverOptions());
@@ -683,7 +779,8 @@ absl::StatusOr<int> Chttp2ServerAddPort(Server* server, const char* addr,
         grpc_event_engine::experimental::ResolvedAddressSetPort(addr, port_num);
       }
       int port_temp = -1;
-      error = NewChttp2ServerListener::Create(server, addr, args, &port_temp);
+      error = NewChttp2ServerListener::Create(server, addr, updated_args,
+                                              &port_temp);
       if (!error.ok()) {
         error_list.push_back(error);
       } else {
@@ -778,7 +875,10 @@ void grpc_server_add_channel_from_fd(grpc_server* server, int fd,
   grpc_core::ExecCtx exec_ctx;
   grpc_core::Server* core_server = grpc_core::Server::FromC(server);
 
-  grpc_core::ChannelArgs server_args = core_server->channel_args();
+  const bool is_callv3 = grpc_core::http2::ShouldEnablePh2Server();
+  grpc_core::ChannelArgs server_args =
+      core_server->channel_args().Set(GRPC_ARG_USE_V3_STACK, is_callv3);
+
   std::string name = absl::StrCat("fd:", fd);
   auto memory_quota =
       server_args.GetObject<grpc_core::ResourceQuota>()->memory_quota();
@@ -791,18 +891,46 @@ void grpc_server_add_channel_from_fd(grpc_server* server, int fd,
   for (grpc_pollset* pollset : core_server->pollsets()) {
     grpc_endpoint_add_to_pollset(server_endpoint.get(), pollset);
   }
-  grpc_core::Transport* transport = grpc_create_chttp2_transport(
-      server_args, std::move(server_endpoint), false  // is_client
-  );
-  grpc_error_handle error =
-      core_server->SetupTransport(transport, nullptr, server_args);
-  if (error.ok()) {
-    grpc_chttp2_transport_start_reading(transport, nullptr, nullptr, nullptr,
-                                        nullptr);
+
+  if (!is_callv3) {
+    grpc_core::Transport* transport = grpc_create_chttp2_transport(
+        server_args, std::move(server_endpoint), false  // is_client
+    );
+    grpc_error_handle error =
+        core_server->SetupTransport(transport, nullptr, server_args);
+    if (error.ok()) {
+      grpc_chttp2_transport_start_reading(transport, nullptr, nullptr, nullptr,
+                                          nullptr);
+    } else {
+      LOG(ERROR) << "Failed to create channel: "
+                 << grpc_core::StatusToString(error);
+      transport->Orphan();
+    }
   } else {
-    LOG(ERROR) << "Failed to create channel: "
-               << grpc_core::StatusToString(error);
-    transport->Orphan();
+    std::unique_ptr<grpc_event_engine::experimental::EventEngine::Endpoint>
+        event_engine_endpoint = grpc_event_engine::experimental::
+            grpc_take_wrapped_event_engine_endpoint(server_endpoint.release());
+    if (event_engine_endpoint != nullptr) {
+      grpc_core::PromiseEndpoint promise_endpoint(
+          std::move(event_engine_endpoint), grpc_core::SliceBuffer());
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine_ptr = server_args.GetObjectRef<grpc_core::EventEngine>();
+      grpc_core::Transport* transport =
+          new grpc_core::http2::Http2ServerTransport(
+              std::move(promise_endpoint), server_args,
+              std::move(event_engine_ptr), [](absl::StatusOr<uint32_t>) {},
+              /*on_close_callback=*/nullptr);
+      grpc_error_handle error =
+          core_server->SetupTransport(transport, nullptr, server_args);
+      // SetupTransport will spawn the initial transport promises.
+      if (!error.ok()) {
+        LOG(ERROR) << "Failed to create channel: "
+                   << grpc_core::StatusToString(error);
+        transport->Orphan();
+      }
+    } else {
+      LOG(ERROR) << "Failed to take endpoint.";
+    }
   }
 }
 
@@ -836,7 +964,9 @@ absl::Status grpc_server_add_passive_listener(
   }
   auto args = server->channel_args()
                   .SetObject(credentials->Ref())
-                  .SetObject(std::move(sc));
+                  .SetObject(std::move(sc))
+                  .Set(GRPC_ARG_USE_V3_STACK,
+                       grpc_core::http2::ShouldEnablePh2Server());
   passive_listener->listener_ =
       grpc_core::NewChttp2ServerListener::CreateForPassiveListener(
           server, args, passive_listener);

data/src/core/ext/transport/chttp2/server/chttp2_server.h

@@ -26,11 +26,14 @@
 
 #include <functional>
 
+#include "src/core/ext/transport/chttp2/transport/http2_server_transport.h"
 #include "src/core/ext/transport/chttp2/transport/internal.h"
 #include "src/core/handshaker/handshaker.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/iomgr/error.h"
+#include "src/core/mitigation_engine/mitigation_engine.h"
 #include "src/core/server/server.h"
+#include "src/core/util/ref_counted_ptr.h"
 
 namespace grpc_core {
 
@@ -131,7 +134,8 @@ class NewChttp2ServerListener : public Server::ListenerInterface {
     // Set by HandshakingState before the handshaking begins and set to a valid
     // transport when handshaking is done successfully.
     std::variant<OrphanablePtr<HandshakingState>,
-                 RefCountedPtr<grpc_chttp2_transport>>
+                 RefCountedPtr<grpc_chttp2_transport>,
+                 RefCountedPtr<http2::Http2ServerTransport>>
         state_;
     grpc_closure on_close_;
     bool shutdown_ = false;
@@ -204,6 +208,11 @@ class NewChttp2ServerListener : public Server::ListenerInterface {
         .GetObject<grpc_event_engine::experimental::EventEngine>();
   }
 
+  RefCountedPtr<MitigationEngine> mitigation_engine() const {
+    auto* provider = args_.GetObject<MitigationEngineProvider>();
+    return provider != nullptr ? provider->GetEngine() : nullptr;
+  }
+
   grpc_tcp_server* tcp_server_ = nullptr;
   grpc_resolved_address resolved_address_;
   RefCountedPtr<Server::ListenerState> listener_state_;

data/src/core/ext/transport/chttp2/transport/chttp2_transport.cc

@@ -97,6 +97,7 @@
 #include "src/core/lib/transport/status_conversion.h"
 #include "src/core/lib/transport/transport.h"
 #include "src/core/lib/transport/transport_framing_endpoint_extension.h"
+#include "src/core/mitigation_engine/mitigation_engine.h"
 #include "src/core/telemetry/call_tracer.h"
 #include "src/core/telemetry/context_list_entry.h"
 #include "src/core/telemetry/default_tcp_tracer.h"
@@ -155,6 +156,8 @@ static bool g_default_client_keepalive_permit_without_calls = false;
 static bool g_default_server_keepalive_permit_without_calls = false;
 
 #define MAX_CLIENT_STREAM_ID 0x7fffffffu
+uint32_t g_pending_induced_frames_hard_limit =
+    2u * DEFAULT_MAX_PENDING_INDUCED_FRAMES;
 
 // forward declarations of various callbacks that we'll build closures around
 static void write_action_begin_locked(
@@ -500,6 +503,7 @@ static void read_channel_args(grpc_chttp2_transport* t,
           .GetDurationFromIntMillis(GRPC_ARG_HTTP_TARPIT_MAX_DURATION_MS)
           .value_or(grpc_core::Duration::Seconds(1))
           .millis();
+  GRPC_CHECK(t->min_tarpit_duration_ms <= t->max_tarpit_duration_ms);
   t->max_header_list_size_soft_limit =
       grpc_core::GetSoftLimitFromChannelArgs(channel_args);
 
@@ -541,6 +545,10 @@ static void read_channel_args(grpc_chttp2_transport* t,
 
   t->settings.mutable_local().SetAllowSecurityFrame(
       channel_args.GetBool(GRPC_ARG_SECURITY_FRAME_ALLOWED).value_or(false));
+  t->max_security_frame_size = static_cast<uint32_t>(grpc_core::Clamp(
+      channel_args.GetInt(GRPC_ARG_MAX_SECURITY_FRAME_SIZE)
+          .value_or(kMaxSecurityFrameSize),
+      kMinMaxSecurityFrameSize, static_cast<int>(kMaxSecurityFrameSize)));
 
   t->ping_on_rst_stream_percent = grpc_core::Clamp(
       channel_args.GetInt(GRPC_ARG_HTTP2_PING_ON_RST_STREAM_PERCENT)
@@ -696,6 +704,7 @@ void grpc_chttp2_transport::WriteSecurityFrameLocked(
             GRPC_ERROR_CREATE("Unexpected SECURITY frame scheduled for write"),
             grpc_core::StatusIntProperty::kRpcStatus,
             GRPC_STATUS_FAILED_PRECONDITION));
+    return;
   }
   grpc_core::SliceBuffer security_frame;
   grpc_chttp2_security_frame_create(data->c_slice_buffer(), data->Length(),
@@ -736,7 +745,12 @@ grpc_chttp2_transport::grpc_chttp2_transport(
           channel_args.GetBool(GRPC_ARG_HTTP2_BDP_PROBE).value_or(true),
           &memory_owner),
       deframe_state(is_client ? GRPC_DTS_FH_0 : GRPC_DTS_CLIENT_PREFIX_0),
-      is_client(is_client) {
+      is_client(is_client),
+      mitigation_engine([&]() {
+        auto* provider =
+            channel_args.GetObject<grpc_core::MitigationEngineProvider>();
+        return provider == nullptr ? nullptr : provider->GetEngine();
+      }()) {
   context_list = new grpc_core::ContextList();
 
   if (channel_args.GetBool(GRPC_ARG_TCP_TRACING_ENABLED).value_or(false) &&
@@ -749,7 +763,8 @@ grpc_chttp2_transport::grpc_chttp2_transport(
         grpc_core::GlobalStatsPluginRegistry::StatsPluginGroup>();
     if (epte != nullptr && stats_plugin_group != nullptr) {
       epte->EnableTcpTelemetry(stats_plugin_group->GetCollectionScope(),
-                               /*is_control_endpoint=*/false);
+                               /*is_control_endpoint=*/false,
+                               /*trace_full_buffer=*/false);
       epte->SetTcpTracer(std::make_shared<grpc_core::DefaultTcpTracer>(
           std::move(stats_plugin_group)));
     }
@@ -884,7 +899,12 @@ static void close_transport_locked(grpc_chttp2_transport* t,
     connectivity_state_set(t, GRPC_CHANNEL_SHUTDOWN, absl::Status(),
                            "close_transport");
     // TODO(roth, ctiller): Provide better disconnect info here.
-    t->NotifyStateWatcherOnDisconnectLocked(t->closed_with_error, {});
+    grpc_core::Transport::StateWatcher::DisconnectInfo disconnect_info;
+    if (t->sent_goaway_state == GRPC_CHTTP2_FINAL_GOAWAY_SENT) {
+      disconnect_info.reason = grpc_core::Transport::StateWatcher::kGoaway;
+    }
+    t->NotifyStateWatcherOnDisconnectLocked(t->closed_with_error,
+                                            disconnect_info);
     if (t->keepalive_ping_timeout_handle != TaskHandle::kInvalid) {
       t->event_engine->Cancel(std::exchange(t->keepalive_ping_timeout_handle,
                                             TaskHandle::kInvalid));
@@ -1357,14 +1377,11 @@ void grpc_chttp2_add_incoming_goaway(grpc_chttp2_transport* t,
                                      uint32_t last_stream_id,
                                      absl::string_view goaway_text) {
   t->goaway_error = grpc_error_set_int(
-      grpc_error_set_int(
-          grpc_core::StatusCreate(
-              absl::StatusCode::kUnavailable,
-              absl::StrFormat("GOAWAY received; Error code: %u; Debug Text: %s",
-                              goaway_error, goaway_text),
-              DEBUG_LOCATION, {}),
-          grpc_core::StatusIntProperty::kHttp2Error,
-          static_cast<intptr_t>(goaway_error)),
+      grpc_error_set_int(absl::UnavailableError(absl::StrFormat(
+                             "GOAWAY received; Error code: %u; Debug Text: %s",
+                             goaway_error, goaway_text)),
+                         grpc_core::StatusIntProperty::kHttp2Error,
+                         static_cast<intptr_t>(goaway_error)),
       grpc_core::StatusIntProperty::kRpcStatus, GRPC_STATUS_UNAVAILABLE);
 
   GRPC_TRACE_LOG(http, INFO)
@@ -2012,6 +2029,25 @@ void grpc_chttp2_ack_ping(grpc_chttp2_transport* t, uint64_t id) {
   }
 }
 
+grpc_error_handle grpc_chttp2_increase_num_pending_induced_frames(
+    grpc_chttp2_transport* t) {
+  t->num_pending_induced_frames++;
+  if (grpc_core::IsMemoryOptimization01Enabled()) {
+    if (GPR_UNLIKELY(t->num_pending_induced_frames >=
+                     g_pending_induced_frames_hard_limit)) {
+      LOG(ERROR) << "Too many pending induced frames. Closing transport.";
+      return GRPC_ERROR_CREATE("Too many pending induced frames");
+    }
+  }
+
+  return absl::OkStatus();
+}
+
+void grpc_chttp2_close_transport_locked(grpc_chttp2_transport* t,
+                                        grpc_error_handle error) {
+  close_transport_locked(t, error);
+}
+
 void grpc_chttp2_keepalive_timeout(
     grpc_core::RefCountedPtr<grpc_chttp2_transport> t) {
   t->combiner->Run(
@@ -2508,8 +2544,12 @@ void grpc_chttp2_cancel_stream(
             if (t->is_client && !sent_initial_metadata) {
               return;
             }
-            grpc_chttp2_add_rst_stream_to_next_write(
+            grpc_error_handle error = grpc_chttp2_add_rst_stream_to_next_write(
                 t, id, static_cast<uint32_t>(http_error), nullptr);
+            if (GPR_UNLIKELY(!error.ok())) {
+              grpc_chttp2_close_transport_locked(t, error);
+              return;
+            }
             grpc_chttp2_initiate_write(t,
                                        GRPC_CHTTP2_INITIATE_WRITE_RST_STREAM);
           });
@@ -2855,9 +2895,12 @@ static void close_from_api(
           grpc_slice_buffer_add(&t->qbuf, message_slice.TakeCSlice());
         }
         grpc_chttp2_reset_ping_clock(t);
-        grpc_chttp2_add_rst_stream_to_next_write(
+        grpc_error_handle error = grpc_chttp2_add_rst_stream_to_next_write(
             t, id, static_cast<intptr_t>(Http2ErrorCode::kNoError), nullptr);
-
+        if (GPR_UNLIKELY(!error.ok())) {
+          grpc_chttp2_close_transport_locked(t, error);
+          return;
+        }
         grpc_chttp2_initiate_write(t,
                                    GRPC_CHTTP2_INITIATE_WRITE_CLOSE_FROM_API);
       });
@@ -2979,6 +3022,7 @@ static void read_action_parse_loop_locked(
     grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
     grpc_error_handle error) {
   GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("read_action_parse_loop_locked");
+  bool should_reset_buffer = true;
   if (t->closed_with_error.ok()) {
     grpc_error_handle errors[3] = {error, absl::OkStatus(), absl::OkStatus()};
     size_t requests_started = 0;
@@ -3004,6 +3048,19 @@ static void read_action_parse_loop_locked(
       } else {
         errors[1] = std::move(std::get<absl::Status>(r));
       }
+
+      if (grpc_core::IsMemoryOptimization02Enabled()) {
+        if (errors[1].ok() && (i + 1 < t->read_buffer.count) &&
+            t->num_pending_induced_frames >=
+                DEFAULT_MAX_PENDING_INDUCED_FRAMES) {
+          for (size_t j = 0; j <= i; j++) {
+            grpc_core::CSliceUnref(
+                grpc_slice_buffer_take_first(&t->read_buffer));
+          }
+          should_reset_buffer = false;
+          break;
+        }
+      }
     }
     if (errors[1] != absl::OkStatus()) {
       errors[2] = try_http_parsing(t.get());
@@ -3045,7 +3102,9 @@ static void read_action_parse_loop_locked(
       maybe_reset_keepalive_ping_timer_locked(t.get());
     }
   }
-  grpc_slice_buffer_reset_and_unref(&t->read_buffer);
+  if (should_reset_buffer) {
+    grpc_slice_buffer_reset_and_unref(&t->read_buffer);
+  }
 
   if (keep_reading) {
     if (t->num_pending_induced_frames >= DEFAULT_MAX_PENDING_INDUCED_FRAMES) {
@@ -3084,6 +3143,16 @@ static void read_action_locked(
 
 static void continue_read_action_locked(
     grpc_core::RefCountedPtr<grpc_chttp2_transport> t) {
+  if (grpc_core::IsMemoryOptimization02Enabled()) {
+    if (t->read_buffer.count > 0) {
+      auto* tp = t.get();
+      tp->combiner->Run(
+          grpc_core::InitTransportClosure<read_action_parse_loop_locked>(
+              std::move(t), &tp->read_action_locked),
+          absl::OkStatus());
+      return;
+    }
+  }
   const bool urgent = !t->goaway_error.ok();
   auto* tp = t.get();
   grpc_endpoint_read(tp->ep.get(), &tp->read_buffer,

data/src/core/ext/transport/chttp2/transport/chttp2_transport.h

@@ -28,6 +28,7 @@
 
 #include "src/core/channelz/channelz.h"
 #include "src/core/ext/transport/chttp2/transport/flow_control.h"
+#include "src/core/ext/transport/chttp2/transport/http2_status.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/iomgr/buffer_list.h"

data/src/core/ext/transport/chttp2/transport/flow_control.cc

@@ -119,12 +119,12 @@ std::string FlowControlAction::ImmediateUpdateReasons() const {
   return result;
 }
 
-TransportFlowControl::TransportFlowControl(absl::string_view name,
+TransportFlowControl::TransportFlowControl(absl::string_view peer_name,
                                            bool enable_bdp_probe,
                                            MemoryOwner* memory_owner)
     : memory_owner_(memory_owner),
       enable_bdp_probe_(enable_bdp_probe),
-      bdp_estimator_(name) {}
+      bdp_estimator_(peer_name) {}
 
 uint32_t TransportFlowControl::DesiredAnnounceSize(bool writing_anyway) const {
   const uint32_t target_announced_window =
@@ -315,7 +315,7 @@ FlowControlAction TransportFlowControl::PeriodicUpdate() {
                         Http2Settings::max_max_frame_size()),
                   &action, &FlowControlAction::set_send_max_frame_size_update);
 
-    if (IsTcpFrameSizeTuningEnabled()) {
+    if (IsTcpFrameSizeTuningEnabled() && ph2_enable_rx_crypto_) {
       // Advertise PREFERRED_RECEIVE_CRYPTO_FRAME_SIZE to peer. By advertising
       // PREFERRED_RECEIVE_CRYPTO_FRAME_SIZE to the peer, we are informing the
       // peer that we have tcp frame size tuning enabled and we inform it of our

data/src/core/ext/transport/chttp2/transport/flow_control.h

@@ -201,11 +201,16 @@ std::ostream& operator<<(std::ostream& out, const FlowControlAction& action);
 // This class manages the flow control at a connection level.
 class TransportFlowControl final {
  public:
-  explicit TransportFlowControl(absl::string_view name, bool enable_bdp_probe,
+  explicit TransportFlowControl(absl::string_view peer_name,
+                                bool enable_bdp_probe,
                                 MemoryOwner* memory_owner);
   ~TransportFlowControl() {}
 
   bool bdp_probe() const { return enable_bdp_probe_; }
+  bool ph2_enable_rx_crypto() const { return ph2_enable_rx_crypto_; }
+  void set_ph2_enable_rx_crypto(const bool enable) {
+    ph2_enable_rx_crypto_ = enable;
+  }
 
   // Returns a non-zero announce if we should send a transport update to our
   // peer, else returns zero; writing_anyway indicates if a write would happen
@@ -314,7 +319,7 @@ class TransportFlowControl final {
   // Call periodically (at a low-ish rate, 100ms - 10s makes sense)
   // to perform more complex flow control calculations and return an action
   // to let the transport change its parameters.
-  // TODO(tjagtap) [PH2][P2] Plumb with PH2 flow control.
+  // TODO(tjagtap) [PH2][P2][FCV3] Plumb with PH2 flow control.
   FlowControlAction PeriodicUpdate();
 
   int64_t test_only_target_window() const { return target_window(); }
@@ -471,6 +476,13 @@ class TransportFlowControl final {
   uint32_t acked_init_window_ = kDefaultWindow;
   uint32_t sent_init_window_ = kDefaultWindow;
   absl::flat_hash_set<uint32_t> window_update_list_;
+
+  // Preferred_rx_crypto_frame_sizes are advertised to the peer
+  // For CHTTP2, this is always true.
+  // For PH2, this is set by the transport based on the channel arg
+  // GRPC_ARG_EXPERIMENTAL_HTTP2_PREFERRED_CRYPTO_FRAME_SIZE.
+  // TODO(tjagtap) [PH2][CHTTP2] Edit comment when CHTTP2 is getting deleted.
+  bool ph2_enable_rx_crypto_ = true;
 };
 
 // Implementation of flow control that abides to HTTP/2 spec and attempts