--- //depot/vendor/freebsd/src/sys/netinet/tcp_input.c	2008/05/09 23:07:12
+++ //depot/user/rwatson/netisr/src/sys/netinet/tcp_input.c	2008/05/10 08:46:38
@@ -146,6 +149,31 @@
 SYSCTL_INT(_net_inet_tcp, OID_AUTO, recvbuf_max, CTLFLAG_RW,
     &tcp_autorcvbuf_max, 0, "Max size of automatic receive buffer");
 
+int	tcp_read_locking = 0;
+SYSCTL_INT(_net_inet_tcp, OID_AUTO, read_locking, CTLFLAG_RW,
+    &tcp_read_locking, 0, "Enable read locking strategy");
+
+int	tcp_rlock_atfirst;
+SYSCTL_INT(_net_inet_tcp, OID_AUTO, rlock_atfirst, CTLFLAG_RD,
+    &tcp_rlock_atfirst, 0, "");
+
+int	tcp_wlock_atfirst;
+SYSCTL_INT(_net_inet_tcp, OID_AUTO, tcp_wlock_atfirst, CTLFLAG_RD,
+    &tcp_wlock_atfirst, 0, "");
+
+int	tcp_rlock_downgraded;
+SYSCTL_INT(_net_inet_tcp, OID_AUTO, rlock_downgraded, CTLFLAG_RD,
+    &tcp_rlock_downgraded, 0, "");
+
+int	tcp_wlock_upgraded;
+SYSCTL_INT(_net_inet_tcp, OID_AUTO, wlock_upgraded, CTLFLAG_RD,
+    &tcp_wlock_upgraded, 0, "");
+
+int	tcp_wlock_looped;
+SYSCTL_INT(_net_inet_tcp, OID_AUTO, wlock_looped, CTLFLAG_RD,
+    &tcp_wlock_looped, 0, "");
+
+
 struct inpcbhead tcb;
 #define	tcb6	tcb  /* for KAME src sync over BSD*'s */
 struct inpcbinfo tcbinfo;
@@ -250,6 +317,10 @@
 #endif
 	struct tcpopt to;		/* options in this segment */
 	char *s = NULL;			/* address and port logging */
+	int ti_locked;
+#define	TI_UNLOCKED	1
+#define	TI_RLOCKED	2
+#define	TI_WLOCKED	3
 
 #ifdef TCPDEBUG
 	/*
@@ -395,11 +466,40 @@
 	drop_hdrlen = off0 + off;
 
 	/*
-	 * Locate pcb for segment.
+	 * Locate pcb for segment, which requires a lock on tcbinfo.
+	 *
+	 * If any TCP header flags are present that suggest a global state
+	 * change may arise when processing the packet, we preemptively
+	 * acquire a write lock, and otherwise a read lock.  However, we may
+	 * be wrong and also find that we can't upgrade from a read lock to
+	 * a write lock.  When this happens, we drop and re-acquire the lock
+	 * as a write lock and loopback to findpcb.
 	 */
-	INP_INFO_WLOCK(&tcbinfo);
+	if ((thflags & (TH_SYN | TH_FIN | TH_RST)) != 0 ||
+	    tcp_read_locking == 0) {
+		INP_INFO_WLOCK(&tcbinfo);
+		ti_locked = TI_WLOCKED;
+		tcp_wlock_atfirst++;
+	} else {
+		INP_INFO_RLOCK(&tcbinfo);
+		ti_locked = TI_RLOCKED;
+		tcp_rlock_atfirst++;
+	}
+
 findpcb:
-	INP_INFO_WLOCK_ASSERT(&tcbinfo);
+	switch (ti_locked) {
+	case TI_RLOCKED:
+		INP_INFO_RLOCK_ASSERT(&tcbinfo);
+		break;
+
+	case TI_WLOCKED:
+		INP_INFO_WLOCK_ASSERT(&tcbinfo);
+		break;
+	default:
+		panic("tcp_input: findpcb ti_locked %d\n", ti_locked);
+		break;
+	}
+
 #ifdef IPFIREWALL_FORWARD
 	/*
 	 * Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain.
@@ -510,10 +610,40 @@
 	 * stray or duplicate segments arriving late.  If this segment
 	 * was a legitimate new connection attempt the old INPCB gets
 	 * removed and we can try again to find a listening socket.
+	 *
+	 * Timewait processing currently always requires a write lock, so if
+	 * we don't have one, acquire one.
+	 *
+	 * XXXRW: This duplicates logic below, and perhaps shouldn't.
 	 */
 	if (inp->inp_vflag & INP_TIMEWAIT) {
+		switch (ti_locked) {
+		case TI_RLOCKED:
+			if (rw_try_upgrade(&tcbinfo.ipi_lock) == 0) {
+				INP_WUNLOCK(inp);
+				INP_INFO_RUNLOCK(&tcbinfo);
+				INP_INFO_WLOCK(&tcbinfo);
+				ti_locked = TI_WLOCKED;
+				tcp_wlock_looped++;
+				goto findpcb;
+			}
+			ti_locked = TI_WLOCKED;
+			tcp_wlock_upgraded++;
+			break;
+
+		case TI_WLOCKED:
+			break;
+
+		default:
+			panic("tcp_input: INP_TIMEWAIT ti_locked %d",
+			    ti_locked);
+		}
+
+		INP_INFO_WLOCK_ASSERT(&tcbinfo);
+
 		if (thflags & TH_SYN)
 			tcp_dooptions(&to, optp, optlen, TO_SYN);
+
 		/*
 		 * NB: tcp_twcheck unlocks the INP and frees the mbuf.
 		 */
@@ -522,6 +652,7 @@
 		INP_INFO_WUNLOCK(&tcbinfo);
 		return;
 	}
+
 	/*
 	 * The TCPCB may no longer exist if the connection is winding
 	 * down or it is in the CLOSED state.  Either way we drop the
@@ -533,6 +664,67 @@
 		goto dropwithreset;
 	}
 
+	/*
+	 * Now that we've found an inpcb, we get to find out whether or not
+	 * we needed a write lock.  The rule we use once we have a
+	 * connection is that the packet doesn't have a SYN/FIN/RST flag set,
+	 * and that it's in the established state.  This is somewhat
+	 * conservative, but by the time we know for sure, we can no longer
+	 * restart processing.
+	 *
+	 * The inpcb lock is required in order to check the connection state,
+	 * but since it follows the pcbinfo lock, we have to try the upgrade
+	 * and, if that fails, handle failure.  Currently we do this by
+	 * dropping all locks, re-acquiring the pcbinfo lock with a write
+	 * lock, and looking up the inpcb again.  This is very expensive and
+	 * the trade-off here might not be right.
+	 */
+	if (tp->t_state != TCPS_ESTABLISHED ||
+	    (thflags & (TH_SYN | TH_FIN | TH_RST)) != 0 ||
+	    tcp_read_locking == 0) {
+		switch (ti_locked) {
+		case TI_RLOCKED:
+			if (rw_try_upgrade(&tcbinfo.ipi_lock) == 0) {
+				INP_WUNLOCK(inp);
+				INP_INFO_RUNLOCK(&tcbinfo);
+				INP_INFO_WLOCK(&tcbinfo);
+				ti_locked = TI_WLOCKED;
+				tcp_wlock_looped++;
+				goto findpcb;
+			}
+			ti_locked = TI_WLOCKED;
+			tcp_wlock_upgraded++;
+			break;
+
+		case TI_WLOCKED:
+			break;
+
+		default:
+			panic("tcp_input: upgrade check ti_locked %d",
+			    ti_locked);
+		}
+		INP_INFO_WLOCK_ASSERT(&tcbinfo);
+	} else {
+		/*
+		 * It's possible that because of looping, we may have
+		 * conservatively acquired a write lock.  If so, downgrade.
+		 */
+		switch (ti_locked) {
+		case TI_RLOCKED:
+			break;
+
+		case TI_WLOCKED:
+			tcp_rlock_downgraded++;
+			rw_downgrade(&tcbinfo.ipi_lock);
+			ti_locked = TI_RLOCKED;
+			break;
+
+		default:
+			panic("tcp_input: downgrade check ti_locked %d",
+			    ti_locked);
+		}
+	}
+
 #ifdef MAC
 	INP_WLOCK_ASSERT(inp);
 	if (mac_inpcb_check_deliver(inp, m))
@@ -848,14 +1040,39 @@
 	return;
 
 dropwithreset:
-	INP_INFO_WLOCK_ASSERT(&tcbinfo);
+	switch (ti_locked) {
+	case TI_RLOCKED:
+		INP_INFO_RLOCK_ASSERT(&tcbinfo);
+		break;
+
+	case TI_WLOCKED:
+		INP_INFO_WLOCK_ASSERT(&tcbinfo);
+		break;
+
+	default:
+		panic("tcp_input: dropwithreset ti_locked %d", ti_locked);
+	}
 	tcp_dropwithreset(m, th, tp, tlen, rstreason);
 	m = NULL;	/* mbuf chain got consumed. */
+
 dropunlock:
-	INP_INFO_WLOCK_ASSERT(&tcbinfo);
+	switch (ti_locked) {
+	case TI_RLOCKED:
+		INP_INFO_RLOCK_ASSERT(&tcbinfo);
+		INP_INFO_RUNLOCK(&tcbinfo);
+		break;
+
+	case TI_WLOCKED:
+		INP_INFO_WLOCK_ASSERT(&tcbinfo);
+		INP_INFO_WUNLOCK(&tcbinfo);
+		break;
+
+	default:
+		panic("tcp_input: dropunlock ti_locked %d", ti_locked);
+	}
 	if (inp != NULL)
 		INP_WUNLOCK(inp);
-	INP_INFO_WUNLOCK(&tcbinfo);
+
 drop:
 	INP_INFO_UNLOCK_ASSERT(&tcbinfo);
 	if (s != NULL)
@@ -870,10 +1087,10 @@
     struct tcpcb *tp, int drop_hdrlen, int tlen)
 {
 	int thflags, acked, ourfinisacked, needoutput = 0;
-	int headlocked = 1;
 	int rstreason, todrop, win;
 	u_long tiwin;
 	struct tcpopt to;
+	int ti_locked;
 
 #ifdef TCPDEBUG
 	/*
@@ -886,7 +1103,35 @@
 #endif
 	thflags = th->th_flags;
 
-	INP_INFO_WLOCK_ASSERT(&tcbinfo);
+	/*
+	 * If this is either a state-changing packet or current state isn't
+	 * established, we require a write lock on tcbinfo.  Otherwise, we
+	 * allow either a read lock or a write lock, as we may have acquired
+	 * a write lock due to a race.
+	 *
+	 * XXXRW: if tcp_read_locking changes during processing, then we may
+	 * reach here with a read lock even though we now want a write one,
+	 * or a write lock where we might want a read one.  We tolerate this
+	 * by checking tcp_read_locking only in the case where we might get a
+	 * read lock by accepting a write lock.  We still need to set
+	 * ti_locked so do that using rw_wowned().  This will go away once we
+	 * remove the tcp_read_locking frob.
+	 */
+	if ((thflags & (TH_SYN | TH_FIN | TH_RST)) != 0 ||
+	    tp->t_state != TCPS_ESTABLISHED) {
+		INP_INFO_WLOCK_ASSERT(&tcbinfo);
+		ti_locked = TI_WLOCKED;
+	} else {
+#if 0
+		INP_INFO_RLOCK_ASSERT(&tcbinfo);
+		ti_locked = TI_RLOCKED;
+#endif
+		if (rw_wowned(&tcbinfo.ipi_lock))
+			ti_locked = TI_WLOCKED;
+		else
+			ti_locked = TI_RLOCKED;
+
+	}
 	INP_WLOCK_ASSERT(tp->t_inpcb);
 	KASSERT(tp->t_state > TCPS_LISTEN, ("%s: TCPS_LISTEN",
 	    __func__));
@@ -986,6 +1231,20 @@
 	     TSTMP_GEQ(to.to_tsval, tp->ts_recent)) ) {
 
 		/*
+		 * By definition, the header-predicted case won't transition
+		 * states, so we shouldn't hold a global write lock here.
+		 *
+		 * XXXRW: Due to tcp_read_locking, temporarily disable
+		 * assertion.
+		 */
+#if 0
+		INP_INFO_RLOCK_ASSERT(&tcbinfo);
+		KASSERT(ti_locked == TI_RLOCKED,
+		    ("tcp_do_segment: header prediction ti_locked %d",
+		    ti_locked));
+#endif
+
+		/*
 		 * If last ACK falls within this segment's sequence numbers,
 		 * record the timestamp.
 		 * NOTE that the test is modified according to the latest
@@ -1009,14 +1268,19 @@
 			      !IN_FASTRECOVERY(tp) &&
 			      (to.to_flags & TOF_SACK) == 0 &&
 			      TAILQ_EMPTY(&tp->snd_holes)))) {
-				KASSERT(headlocked,
-				    ("%s: headlocked", __func__));
-				INP_INFO_WUNLOCK(&tcbinfo);
-				headlocked = 0;
 				/*
 				 * This is a pure ack for outstanding data.
+				 *
+				 * XXXRW: temporarily tolerate a write lock
+				 * here.
 				 */
+				if (ti_locked == TI_RLOCKED)
+					INP_INFO_RUNLOCK(&tcbinfo);
+				else
+					INP_INFO_WUNLOCK(&tcbinfo);
+				ti_locked = TI_UNLOCKED;
 				++tcpstat.tcps_predack;
+
 				/*
 				 * "bad retransmit" recovery.
 				 */
@@ -1103,14 +1367,19 @@
 		    tlen <= sbspace(&so->so_rcv)) {
 			int newsize = 0;	/* automatic sockbuf scaling */
 
-			KASSERT(headlocked, ("%s: headlocked", __func__));
-			INP_INFO_WUNLOCK(&tcbinfo);
-			headlocked = 0;
 			/*
 			 * This is a pure, in-sequence data packet
 			 * with nothing on the reassembly queue and
 			 * we have enough buffer space to take it.
+			 *
+			 * XXXRW: Temporarily tolerate write lock here.
 			 */
+			if (ti_locked == TI_RLOCKED)
+				INP_INFO_RUNLOCK(&tcbinfo);
+			else
+				INP_INFO_WUNLOCK(&tcbinfo);
+			ti_locked = TI_UNLOCKED;
+
 			/* Clean receiver SACK report if present */
 			if ((tp->t_flags & TF_SACK_PERMIT) && tp->rcv_numsacks)
 				tcp_clean_sackreport(tp);
@@ -1329,8 +1598,9 @@
 			tp->t_state = TCPS_SYN_RECEIVED;
 		}
 
-		KASSERT(headlocked, ("%s: trimthenstep6: head not locked",
-		    __func__));
+		INP_INFO_WLOCK_ASSERT(&tcbinfo);
+		KASSERT(ti_locked == TI_WLOCKED,
+		    ("trimthenstep6: ti_locked %d", ti_locked));
 		INP_WLOCK_ASSERT(tp->t_inpcb);
 
 		/*
@@ -1458,17 +1728,23 @@
 			case TCPS_CLOSE_WAIT:
 				so->so_error = ECONNRESET;
 			close:
+				KASSERT(ti_locked == TI_WLOCKED,
+				    ("tcp_do_segment: TH_RST 1 ti_locked %d",
+				    ti_locked));
+				INP_INFO_WLOCK_ASSERT(&tcbinfo);
+
 				tp->t_state = TCPS_CLOSED;
 				tcpstat.tcps_drops++;
-				KASSERT(headlocked, ("%s: trimthenstep6: "
-				    "tcp_close: head not locked", __func__));
 				tp = tcp_close(tp);
 				break;
 
 			case TCPS_CLOSING:
 			case TCPS_LAST_ACK:
-				KASSERT(headlocked, ("%s: trimthenstep6: "
-				    "tcp_close.2: head not locked", __func__));
+				KASSERT(ti_locked == TI_WLOCKED,
+				    ("tcp_do_segment: TH_RST 2 ti_locked %d",
+				    ti_locked));
+				INP_INFO_WLOCK_ASSERT(&tcbinfo);
+
 				tp = tcp_close(tp);
 				break;
 			}
@@ -1573,8 +1849,11 @@
 	    tp->t_state > TCPS_CLOSE_WAIT && tlen) {
 		char *s;
 
-		KASSERT(headlocked, ("%s: trimthenstep6: tcp_close.3: head "
-		    "not locked", __func__));
+		KASSERT(ti_locked == TI_WLOCKED, ("tcp_do_segment: "
+		    "SS_NOFDEREF && CLOSE_WAIT && tlen ti_locked %d",
+		    ti_locked));
+		INP_INFO_WLOCK_ASSERT(&tcbinfo);
+
 		if ((s = tcp_log_addrs(&tp->t_inpcb->inp_inc, th, NULL, NULL))) {
 			log(LOG_DEBUG, "%s; %s: %s: Received %d bytes of data after socket "
 			    "was closed, sending RST and removing tcpcb\n",
@@ -1646,8 +1925,10 @@
 	 * error and we send an RST and drop the connection.
 	 */
 	if (thflags & TH_SYN) {
-		KASSERT(headlocked, ("%s: tcp_drop: trimthenstep6: "
-		    "head not locked", __func__));
+		KASSERT(ti_locked == TI_WLOCKED,
+		    ("tcp_do_segment: TH_SYN ti_locked %d", ti_locked));
+		INP_INFO_WLOCK_ASSERT(&tcbinfo);
+
 		tp = tcp_drop(tp, ECONNRESET);
 		rstreason = BANDLIM_UNLIMITED;
 		goto drop;
@@ -1937,8 +2218,9 @@
 		}
 
 process_ACK:
-		KASSERT(headlocked, ("%s: process_ACK: head not locked",
-		    __func__));
+		INP_INFO_LOCK_ASSERT(&tcbinfo);
+		KASSERT(ti_locked == TI_RLOCKED || ti_locked == TI_WLOCKED,
+		    ("tcp_input: process_ACK ti_locked %d", ti_locked));
 		INP_WLOCK_ASSERT(tp->t_inpcb);
 
 		acked = th->th_ack - tp->snd_una;
@@ -2093,11 +2375,9 @@
 		 */
 		case TCPS_CLOSING:
 			if (ourfinisacked) {
-				KASSERT(headlocked, ("%s: process_ACK: "
-				    "head not locked", __func__));
+				INP_INFO_WLOCK_ASSERT(&tcbinfo);
 				tcp_twstart(tp);
 				INP_INFO_WUNLOCK(&tcbinfo);
-				headlocked = 0;
 				m_freem(m);
 				return;
 			}
@@ -2111,8 +2391,7 @@
 		 */
 		case TCPS_LAST_ACK:
 			if (ourfinisacked) {
-				KASSERT(headlocked, ("%s: process_ACK: "
-				    "tcp_close: head not locked", __func__));
+				INP_INFO_WLOCK_ASSERT(&tcbinfo);
 				tp = tcp_close(tp);
 				goto drop;
 			}
@@ -2121,7 +2400,9 @@
 	}
 
 step6:
-	KASSERT(headlocked, ("%s: step6: head not locked", __func__));
+	INP_INFO_LOCK_ASSERT(&tcbinfo);
+	KASSERT(ti_locked == TI_RLOCKED || ti_locked == TI_WLOCKED,
+	    ("tcp_do_segment: step6 ti_locked %d", ti_locked));
 	INP_WLOCK_ASSERT(tp->t_inpcb);
 
 	/*
@@ -2207,7 +2488,9 @@
 			tp->rcv_up = tp->rcv_nxt;
 	}
 dodata:							/* XXX */
-	KASSERT(headlocked, ("%s: dodata: head not locked", __func__));
+	INP_INFO_LOCK_ASSERT(&tcbinfo);
+	KASSERT(ti_locked == TI_RLOCKED || ti_locked == TI_WLOCKED,
+	    ("tcp_do_segment: dodata ti_locked %d", ti_locked));
 	INP_WLOCK_ASSERT(tp->t_inpcb);
 
 	/*
@@ -2326,15 +2609,32 @@
 		 * standard timers.
 		 */
 		case TCPS_FIN_WAIT_2:
-			KASSERT(headlocked == 1, ("%s: dodata: "
-			    "TCP_FIN_WAIT_2: head not locked", __func__));
+			INP_INFO_WLOCK_ASSERT(&tcbinfo);
+			KASSERT(ti_locked == TI_WLOCKED, ("tcp_do_segment: "
+			    "dodata TCP_FIN_WAIT_2 ti_locked: %d",
+			    ti_locked));
+
 			tcp_twstart(tp);
 			INP_INFO_WUNLOCK(&tcbinfo);
 			return;
 		}
 	}
-	INP_INFO_WUNLOCK(&tcbinfo);
-	headlocked = 0;
+	switch (ti_locked) {
+	case TI_RLOCKED:
+		INP_INFO_RLOCK_ASSERT(&tcbinfo);
+		INP_INFO_RUNLOCK(&tcbinfo);
+		break;
+
+	case TI_WLOCKED:
+		INP_INFO_WLOCK_ASSERT(&tcbinfo);
+		INP_INFO_WUNLOCK(&tcbinfo);
+		break;
+
+	default:
+		panic("tco_do_setment: dodata epilogue ti_locked %d",
+		    ti_locked);
+	}
+	ti_locked = TI_UNLOCKED;
 #ifdef TCPDEBUG
 	if (so->so_options & SO_DEBUG)
 		tcp_trace(TA_INPUT, ostate, tp, (void *)tcp_saveipgen,
@@ -2348,10 +2648,11 @@
 		(void) tcp_output(tp);
 
 check_delack:
-	KASSERT(headlocked == 0, ("%s: check_delack: head locked",
-	    __func__));
+	KASSERT(ti_locked == TI_UNLOCKED, ("tcp_do_segment: check_delack "
+	    "ti_locked %d", ti_locked));
 	INP_INFO_UNLOCK_ASSERT(&tcbinfo);
 	INP_WLOCK_ASSERT(tp->t_inpcb);
+
 	if (tp->t_flags & TF_DELACK) {
 		tp->t_flags &= ~TF_DELACK;
 		tcp_timer_activate(tp, TT_DELACK, tcp_delacktime);
@@ -2360,7 +2661,9 @@
 	return;
 
 dropafterack:
-	KASSERT(headlocked, ("%s: dropafterack: head not locked", __func__));
+	KASSERT(ti_locked == TI_RLOCKED || ti_locked == TI_WLOCKED,
+	    ("tcp_do_segment: dropafterack ti_locked %d", ti_locked));
+
 	/*
 	 * Generate an ACK dropping incoming segment if it occupies
 	 * sequence space, where the ACK reflects our state.
@@ -2387,8 +2690,22 @@
 		tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
 			  &tcp_savetcp, 0);
 #endif
-	KASSERT(headlocked, ("%s: headlocked should be 1", __func__));
-	INP_INFO_WUNLOCK(&tcbinfo);
+	switch (ti_locked) {
+	case TI_RLOCKED:
+		INP_INFO_RLOCK_ASSERT(&tcbinfo);
+		INP_INFO_RUNLOCK(&tcbinfo);
+		break;
+
+	case TI_WLOCKED:
+		INP_INFO_WLOCK_ASSERT(&tcbinfo);
+		INP_INFO_WUNLOCK(&tcbinfo);
+		break;
+
+	default:
+		panic("tcp_do_sgement: dropafterack epilogue ti_locked %d",
+		    ti_locked);
+	}
+	ti_locked = TI_UNLOCKED;
 	tp->t_flags |= TF_ACKNOW;
 	(void) tcp_output(tp);
 	INP_WUNLOCK(tp->t_inpcb);
@@ -2396,17 +2713,45 @@
 	return;
 
 dropwithreset:
-	KASSERT(headlocked, ("%s: dropwithreset: head not locked", __func__));
+	switch (ti_locked) {
+	case TI_RLOCKED:
+		INP_INFO_RLOCK_ASSERT(&tcbinfo);
+		INP_INFO_RUNLOCK(&tcbinfo);
+		break;
+
+	case TI_WLOCKED:
+		INP_INFO_WLOCK_ASSERT(&tcbinfo);
+		INP_INFO_WUNLOCK(&tcbinfo);
+		break;
+
+	default:
+		panic("tcp_do_segment: dropwithreset ti_locked %d",
+		    ti_locked);
+	}
 
 	tcp_dropwithreset(m, th, tp, tlen, rstreason);
 
 	if (tp != NULL)
 		INP_WUNLOCK(tp->t_inpcb);
-	if (headlocked)
-		INP_INFO_WUNLOCK(&tcbinfo);
 	return;
 
 drop:
+	switch (ti_locked) {
+	case TI_RLOCKED:
+		INP_INFO_RLOCK_ASSERT(&tcbinfo);
+		INP_INFO_RUNLOCK(&tcbinfo);
+		break;
+
+	case TI_WLOCKED:
+		INP_INFO_WLOCK_ASSERT(&tcbinfo);
+		INP_INFO_WUNLOCK(&tcbinfo);
+		break;
+
+	case TI_UNLOCKED:
+		INP_INFO_UNLOCK_ASSERT(&tcbinfo);
+		break;
+	}
+
 	/*
 	 * Drop space held by incoming segment and return.
 	 */
@@ -2417,8 +2762,6 @@
 #endif
 	if (tp != NULL)
 		INP_WUNLOCK(tp->t_inpcb);
-	if (headlocked)
-		INP_INFO_WUNLOCK(&tcbinfo);
 	m_freem(m);
 	return;
 }
@@ -2590,7 +2933,7 @@
 			char *cp = mtod(m, caddr_t) + cnt;
 			struct tcpcb *tp = sototcpcb(so);
 
-			INP_WLOCK_ASSERT(tp->t_inpcb);
+			INP_LOCK_ASSERT(tp->t_inpcb);
 
 			tp->t_iobc = *cp;
 			tp->t_oobflags |= TCPOOB_HAVEDATA;
@@ -2737,7 +3080,7 @@
 	const size_t min_protoh = sizeof(struct tcpiphdr);
 #endif
 
-	INP_WLOCK_ASSERT(tp->t_inpcb);
+	INP_LOCK_ASSERT(tp->t_inpcb);
 
 	/* Initialize. */
 #ifdef INET6
@@ -3007,7 +3350,7 @@
 	tcp_seq onxt = tp->snd_nxt;
 	u_long  ocwnd = tp->snd_cwnd;
 
-	INP_WLOCK_ASSERT(tp->t_inpcb);
+	INP_LOCK_ASSERT(tp->t_inpcb);
 
 	tcp_timer_activate(tp, TT_REXMT, 0);
 	tp->t_rtttime = 0;
--- //depot/vendor/freebsd/src/sys/netinet/tcp_subr.c	2008/06/02 14:25:14
+++ //depot/user/rwatson/netisr/src/sys/netinet/tcp_subr.c	2008/06/30 14:07:40
@@ -332,7 +332,10 @@
 {
 	struct tcphdr *th = (struct tcphdr *)tcp_ptr;
 
-	INP_WLOCK_ASSERT(inp);
+	/*
+	 * XXXRW: A read lock here is fine, but that won't ever happen.
+	 */
+	INP_LOCK_ASSERT(inp);
 
 #ifdef INET6
 	if ((inp->inp_vflag & INP_IPV6) != 0) {
@@ -525,7 +528,7 @@
 		 * Packet is associated with a socket, so allow the
 		 * label of the response to reflect the socket label.
 		 */
-		INP_WLOCK_ASSERT(inp);
+		INP_LOCK_ASSERT(inp);
 		mac_inpcb_create_mbuf(inp, m);
 	} else {
 		/*
