ip: reassembly: remove unnecessary code
[vpp.git] / src / vnet / ip / ip6_reassembly.c
index 631556e..a5e106a 100644 (file)
 #define IP6_REASS_TIMEOUT_DEFAULT_MS 100
 #define IP6_REASS_EXPIRE_WALK_INTERVAL_DEFAULT_MS 10000        // 10 seconds default
 #define IP6_REASS_MAX_REASSEMBLIES_DEFAULT 1024
+#define IP6_REASS_MAX_REASSEMBLY_LENGTH_DEFAULT 3
 #define IP6_REASS_HT_LOAD_FACTOR (0.75)
 
 typedef enum
 {
   IP6_REASS_RC_OK,
   IP6_REASS_RC_INTERNAL_ERROR,
+  IP6_REASS_RC_TOO_MANY_FRAGMENTS,
+  IP6_REASS_RC_NO_BUF,
+  IP6_REASS_RC_HANDOFF,
 } ip6_reass_rc_t;
 
 typedef struct
@@ -55,6 +59,27 @@ typedef struct
   };
 } ip6_reass_key_t;
 
+typedef union
+{
+  struct
+  {
+    u32 reass_index;
+    u32 memory_owner_thread_index;
+  };
+  u64 as_u64;
+} ip6_reass_val_t;
+
+typedef union
+{
+  struct
+  {
+    ip6_reass_key_t k;
+    ip6_reass_val_t v;
+  };
+  clib_bihash_kv_48_8_t kv;
+} ip6_reass_kv_t;
+
+
 always_inline u32
 ip6_reass_buffer_get_data_offset (vlib_buffer_t * b)
 {
@@ -86,17 +111,25 @@ typedef struct
   u32 data_len;
   // trace operation counter
   u32 trace_op_counter;
-  // next index - used by non-feature node
-  u8 next_index;
+  // next index - used by custom apps (~0 if not set)
+  u32 next_index;
+  // error next index - used by custom apps (~0 if not set)
+  u32 error_next_index;
   // minimum fragment length for this reassembly - used to estimate MTU
   u16 min_fragment_length;
+  // number of fragments for this reassembly
+  u32 fragments_n;
+  // thread owning memory for this context (whose pool contains this ctx)
+  u32 memory_owner_thread_index;
+  // thread which received fragment with offset 0 and which sends out the
+  // completed reassembly
+  u32 sendout_thread_index;
 } ip6_reass_t;
 
 typedef struct
 {
   ip6_reass_t *pool;
   u32 reass_n;
-  u32 buffers_n;
   u32 id_counter;
   clib_spinlock_t lock;
 } ip6_reass_per_thread_t;
@@ -107,6 +140,9 @@ typedef struct
   u32 timeout_ms;
   f64 timeout;
   u32 expire_walk_interval_ms;
+  // maximum number of fragments in one reassembly
+  u32 max_reass_len;
+  // maximum number of reassemblies
   u32 max_reass_n;
 
   // IPv6 runtime
@@ -117,22 +153,30 @@ typedef struct
 
   // convenience
   vlib_main_t *vlib_main;
-  vnet_main_t *vnet_main;
 
   // node index of ip6-drop node
   u32 ip6_drop_idx;
   u32 ip6_icmp_error_idx;
   u32 ip6_reass_expire_node_idx;
 
+  /** Worker handoff */
+  u32 fq_index;
+  u32 fq_feature_index;
+
 } ip6_reass_main_t;
 
+extern ip6_reass_main_t ip6_reass_main;
+
+#ifndef CLIB_MARCH_VARIANT
 ip6_reass_main_t ip6_reass_main;
+#endif /* CLIB_MARCH_VARIANT */
 
 typedef enum
 {
   IP6_REASSEMBLY_NEXT_INPUT,
   IP6_REASSEMBLY_NEXT_DROP,
   IP6_REASSEMBLY_NEXT_ICMP_ERROR,
+  IP6_REASSEMBLY_NEXT_HANDOFF,
   IP6_REASSEMBLY_N_NEXT,
 } ip6_reass_next_t;
 
@@ -144,6 +188,7 @@ typedef enum
   ICMP_ERROR_FL_TOO_BIG,
   ICMP_ERROR_FL_NOT_MULT_8,
   FINALIZE,
+  HANDOFF,
 } ip6_reass_trace_operation_e;
 
 typedef struct
@@ -161,11 +206,12 @@ typedef struct
   ip6_reass_trace_operation_e action;
   u32 reass_id;
   ip6_reass_range_trace_t trace_range;
-  u32 size_diff;
   u32 op_id;
   u32 fragment_first;
   u32 fragment_last;
   u32 total_data_len;
+  u32 thread_id;
+  u32 thread_id_to;
 } ip6_reass_trace_t;
 
 static void
@@ -197,11 +243,15 @@ format_ip6_reass_trace (u8 * s, va_list * args)
   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
   ip6_reass_trace_t *t = va_arg (*args, ip6_reass_trace_t *);
-  s = format (s, "reass id: %u, op id: %u ", t->reass_id, t->op_id);
-  u32 indent = format_get_indent (s);
-  s = format (s, "first bi: %u, data len: %u, ip/fragment[%u, %u]",
-             t->trace_range.first_bi, t->total_data_len, t->fragment_first,
-             t->fragment_last);
+  u32 indent = 0;
+  if (~0 != t->reass_id)
+    {
+      s = format (s, "reass id: %u, op id: %u ", t->reass_id, t->op_id);
+      indent = format_get_indent (s);
+      s = format (s, "first bi: %u, data len: %u, ip/fragment[%u, %u]",
+                 t->trace_range.first_bi, t->total_data_len,
+                 t->fragment_first, t->fragment_last);
+    }
   switch (t->action)
     {
     case RANGE_NEW:
@@ -229,35 +279,34 @@ format_ip6_reass_trace (u8 * s, va_list * args)
     case FINALIZE:
       s = format (s, "\n%Ufinalize reassembly", format_white_space, indent);
       break;
+    case HANDOFF:
+      s =
+       format (s, "handoff from thread #%u to thread #%u", t->thread_id,
+               t->thread_id_to);
+      break;
     }
   return s;
 }
 
 static void
 ip6_reass_add_trace (vlib_main_t * vm, vlib_node_runtime_t * node,
-                    ip6_reass_main_t * rm, ip6_reass_t * reass,
-                    u32 bi, ip6_reass_trace_operation_e action,
-                    u32 size_diff)
+                    ip6_reass_main_t * rm, u32 reass_id, u32 op_id,
+                    u32 bi, u32 first_bi, u32 data_len,
+                    ip6_reass_trace_operation_e action, u32 thread_id_to)
 {
   vlib_buffer_t *b = vlib_get_buffer (vm, bi);
   vnet_buffer_opaque_t *vnb = vnet_buffer (b);
-  if (pool_is_free_index (vm->trace_main.trace_buffer_pool, b->trace_index))
-    {
-      // this buffer's trace is gone
-      b->flags &= ~VLIB_BUFFER_IS_TRACED;
-      return;
-    }
   ip6_reass_trace_t *t = vlib_add_trace (vm, node, b, sizeof (t[0]));
-  t->reass_id = reass->id;
+  t->reass_id = reass_id;
   t->action = action;
   ip6_reass_trace_details (vm, bi, &t->trace_range);
-  t->size_diff = size_diff;
-  t->op_id = reass->trace_op_counter;
-  ++reass->trace_op_counter;
+  t->op_id = op_id;
+  t->thread_id = vm->thread_index;
+  t->thread_id_to = thread_id_to;
   t->fragment_first = vnb->ip.reass.fragment_first;
   t->fragment_last = vnb->ip.reass.fragment_last;
-  t->trace_range.first_bi = reass->first_bi;
-  t->total_data_len = reass->data_len;
+  t->trace_range.first_bi = first_bi;
+  t->total_data_len = data_len;
 #if 0
   static u8 *s = NULL;
   s = format (s, "%U", format_ip6_reass_trace, NULL, NULL, t);
@@ -267,6 +316,13 @@ ip6_reass_add_trace (vlib_main_t * vm, vlib_node_runtime_t * node,
 #endif
 }
 
+always_inline void
+ip6_reass_free_ctx (ip6_reass_per_thread_t * rt, ip6_reass_t * reass)
+{
+  pool_put (rt->pool, reass);
+  --rt->reass_n;
+}
+
 always_inline void
 ip6_reass_free (ip6_reass_main_t * rm, ip6_reass_per_thread_t * rt,
                ip6_reass_t * reass)
@@ -279,17 +335,17 @@ ip6_reass_free (ip6_reass_main_t * rm, ip6_reass_per_thread_t * rt,
   kv.key[4] = reass->key.as_u64[4];
   kv.key[5] = reass->key.as_u64[5];
   clib_bihash_add_del_48_8 (&rm->hash, &kv, 0);
-  pool_put (rt->pool, reass);
-  --rt->reass_n;
+  ip6_reass_free_ctx (rt, reass);
 }
 
 always_inline void
-ip6_reass_drop_all (vlib_main_t * vm, ip6_reass_main_t * rm,
-                   ip6_reass_t * reass, u32 ** vec_drop_bi)
+ip6_reass_drop_all (vlib_main_t * vm, vlib_node_runtime_t * node,
+                   ip6_reass_main_t * rm, ip6_reass_t * reass)
 {
   u32 range_bi = reass->first_bi;
   vlib_buffer_t *range_b;
   vnet_buffer_opaque_t *range_vnb;
+  u32 *to_free = NULL;
   while (~0 != range_bi)
     {
       range_b = vlib_get_buffer (vm, range_bi);
@@ -297,7 +353,7 @@ ip6_reass_drop_all (vlib_main_t * vm, ip6_reass_main_t * rm,
       u32 bi = range_bi;
       while (~0 != bi)
        {
-         vec_add1 (*vec_drop_bi, bi);
+         vec_add1 (to_free, bi);
          vlib_buffer_t *b = vlib_get_buffer (vm, bi);
          if (b->flags & VLIB_BUFFER_NEXT_PRESENT)
            {
@@ -311,68 +367,110 @@ ip6_reass_drop_all (vlib_main_t * vm, ip6_reass_main_t * rm,
        }
       range_bi = range_vnb->ip.reass.next_range_bi;
     }
+  /* send to next_error_index */
+  if (~0 != reass->error_next_index)
+    {
+      u32 n_left_to_next, *to_next, next_index;
+
+      next_index = reass->error_next_index;
+      u32 bi = ~0;
+
+      while (vec_len (to_free) > 0)
+       {
+         vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+
+         while (vec_len (to_free) > 0 && n_left_to_next > 0)
+           {
+             bi = vec_pop (to_free);
+
+             if (~0 != bi)
+               {
+                 to_next[0] = bi;
+                 to_next += 1;
+                 n_left_to_next -= 1;
+               }
+           }
+         vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+       }
+    }
+  else
+    {
+      vlib_buffer_free (vm, to_free, vec_len (to_free));
+    }
+  vec_free (to_free);
 }
 
 always_inline void
 ip6_reass_on_timeout (vlib_main_t * vm, vlib_node_runtime_t * node,
-                     ip6_reass_main_t * rm, ip6_reass_per_thread_t * rt,
-                     ip6_reass_t * reass, u32 * icmp_bi, u32 ** vec_timeout)
+                     ip6_reass_main_t * rm, ip6_reass_t * reass,
+                     u32 * icmp_bi)
 {
   if (~0 == reass->first_bi)
     {
       return;
     }
-  vlib_buffer_t *b = vlib_get_buffer (vm, reass->first_bi);
-  if (0 == vnet_buffer (b)->ip.reass.fragment_first)
+  if (~0 == reass->next_index) // custom apps don't want icmp
     {
-      *icmp_bi = reass->first_bi;
-      if (PREDICT_FALSE (b->flags & VLIB_BUFFER_IS_TRACED))
-       {
-         ip6_reass_add_trace (vm, node, rm, reass, reass->first_bi,
-                              ICMP_ERROR_RT_EXCEEDED, 0);
-       }
-      // fragment with offset zero received - send icmp message back
-      if (b->flags & VLIB_BUFFER_NEXT_PRESENT)
-       {
-         // separate first buffer from chain and steer it towards icmp node
-         b->flags &= ~VLIB_BUFFER_NEXT_PRESENT;
-         reass->first_bi = b->next_buffer;
-       }
-      else
+      vlib_buffer_t *b = vlib_get_buffer (vm, reass->first_bi);
+      if (0 == vnet_buffer (b)->ip.reass.fragment_first)
        {
-         reass->first_bi = vnet_buffer (b)->ip.reass.next_range_bi;
+         *icmp_bi = reass->first_bi;
+         if (PREDICT_FALSE (b->flags & VLIB_BUFFER_IS_TRACED))
+           {
+             ip6_reass_add_trace (vm, node, rm, reass->id,
+                                  reass->trace_op_counter, reass->first_bi,
+                                  reass->first_bi, reass->data_len,
+                                  ICMP_ERROR_RT_EXCEEDED, ~0);
+             ++reass->trace_op_counter;
+           }
+         // fragment with offset zero received - send icmp message back
+         if (b->flags & VLIB_BUFFER_NEXT_PRESENT)
+           {
+             // separate first buffer from chain and steer it towards icmp node
+             b->flags &= ~VLIB_BUFFER_NEXT_PRESENT;
+             reass->first_bi = b->next_buffer;
+           }
+         else
+           {
+             reass->first_bi = vnet_buffer (b)->ip.reass.next_range_bi;
+           }
+         icmp6_error_set_vnet_buffer (b, ICMP6_time_exceeded,
+                                      ICMP6_time_exceeded_fragment_reassembly_time_exceeded,
+                                      0);
        }
-      --rt->buffers_n;
-      icmp6_error_set_vnet_buffer (b, ICMP6_time_exceeded,
-                                  ICMP6_time_exceeded_fragment_reassembly_time_exceeded,
-                                  0);
     }
-  ip6_reass_drop_all (vm, rm, reass, vec_timeout);
+  ip6_reass_drop_all (vm, node, rm, reass);
 }
 
 always_inline ip6_reass_t *
 ip6_reass_find_or_create (vlib_main_t * vm, vlib_node_runtime_t * node,
                          ip6_reass_main_t * rm, ip6_reass_per_thread_t * rt,
-                         ip6_reass_key_t * k, u32 * icmp_bi,
-                         u32 ** vec_timeout)
+                         ip6_reass_kv_t * kv, u32 * icmp_bi, u8 * do_handoff)
 {
-  ip6_reass_t *reass = NULL;
-  f64 now = vlib_time_now (rm->vlib_main);
-  clib_bihash_kv_48_8_t kv, value;
-  kv.key[0] = k->as_u64[0];
-  kv.key[1] = k->as_u64[1];
-  kv.key[2] = k->as_u64[2];
-  kv.key[3] = k->as_u64[3];
-  kv.key[4] = k->as_u64[4];
-  kv.key[5] = k->as_u64[5];
-
-  if (!clib_bihash_search_48_8 (&rm->hash, &kv, &value))
+  ip6_reass_t *reass;
+  f64 now;
+
+again:
+
+  reass = NULL;
+  now = vlib_time_now (vm);
+
+  if (!clib_bihash_search_48_8
+      (&rm->hash, (clib_bihash_kv_48_8_t *) kv, (clib_bihash_kv_48_8_t *) kv))
     {
-      reass = pool_elt_at_index (rt->pool, value.value);
+      reass =
+       pool_elt_at_index (rm->per_thread_data
+                          [kv->v.memory_owner_thread_index].pool,
+                          kv->v.reass_index);
+      if (vm->thread_index != kv->v.memory_owner_thread_index)
+       {
+         *do_handoff = 1;
+         return reass;
+       }
+
       if (now > reass->last_heard + rm->timeout)
        {
-         ip6_reass_on_timeout (vm, node, rm, rt, reass, icmp_bi,
-                               vec_timeout);
+         ip6_reass_on_timeout (vm, node, rm, reass, icmp_bi);
          ip6_reass_free (rm, rt, reass);
          reass = NULL;
        }
@@ -393,28 +491,35 @@ ip6_reass_find_or_create (vlib_main_t * vm, vlib_node_runtime_t * node,
     {
       pool_get (rt->pool, reass);
       clib_memset (reass, 0, sizeof (*reass));
-      reass->id =
-       ((u64) os_get_thread_index () * 1000000000) + rt->id_counter;
+      reass->id = ((u64) vm->thread_index * 1000000000) + rt->id_counter;
       ++rt->id_counter;
       reass->first_bi = ~0;
       reass->last_packet_octet = ~0;
       reass->data_len = 0;
+      reass->next_index = ~0;
+      reass->error_next_index = ~0;
       ++rt->reass_n;
     }
 
-  reass->key.as_u64[0] = kv.key[0] = k->as_u64[0];
-  reass->key.as_u64[1] = kv.key[1] = k->as_u64[1];
-  reass->key.as_u64[2] = kv.key[2] = k->as_u64[2];
-  reass->key.as_u64[3] = kv.key[3] = k->as_u64[3];
-  reass->key.as_u64[4] = kv.key[4] = k->as_u64[4];
-  reass->key.as_u64[5] = kv.key[5] = k->as_u64[5];
-  kv.value = reass - rt->pool;
+  reass->key.as_u64[0] = ((clib_bihash_kv_48_8_t *) kv)->key[0];
+  reass->key.as_u64[1] = ((clib_bihash_kv_48_8_t *) kv)->key[1];
+  reass->key.as_u64[2] = ((clib_bihash_kv_48_8_t *) kv)->key[2];
+  reass->key.as_u64[3] = ((clib_bihash_kv_48_8_t *) kv)->key[3];
+  reass->key.as_u64[4] = ((clib_bihash_kv_48_8_t *) kv)->key[4];
+  reass->key.as_u64[5] = ((clib_bihash_kv_48_8_t *) kv)->key[5];
+  kv->v.reass_index = (reass - rt->pool);
+  kv->v.memory_owner_thread_index = vm->thread_index;
   reass->last_heard = now;
 
-  if (clib_bihash_add_del_48_8 (&rm->hash, &kv, 1))
+  int rv =
+    clib_bihash_add_del_48_8 (&rm->hash, (clib_bihash_kv_48_8_t *) kv, 2);
+  if (rv)
     {
-      ip6_reass_free (rm, rt, reass);
+      ip6_reass_free_ctx (rt, reass);
       reass = NULL;
+      // if other worker created a context already work with the other copy
+      if (-2 == rv)
+       goto again;
     }
 
   return reass;
@@ -423,8 +528,8 @@ ip6_reass_find_or_create (vlib_main_t * vm, vlib_node_runtime_t * node,
 always_inline ip6_reass_rc_t
 ip6_reass_finalize (vlib_main_t * vm, vlib_node_runtime_t * node,
                    ip6_reass_main_t * rm, ip6_reass_per_thread_t * rt,
-                   ip6_reass_t * reass, u32 * bi0, u32 * next0,
-                   u32 * error0, u32 ** vec_drop_compress, bool is_feature)
+                   ip6_reass_t * reass, u32 * bi0, u32 * next0, u32 * error0,
+                   bool is_custom_app)
 {
   *bi0 = reass->first_bi;
   *error0 = IP6_ERROR_NONE;
@@ -434,6 +539,8 @@ ip6_reass_finalize (vlib_main_t * vm, vlib_node_runtime_t * node,
   u32 total_length = 0;
   u32 buf_cnt = 0;
   u32 dropped_cnt = 0;
+  u32 *vec_drop_compress = NULL;
+  ip6_reass_rc_t rv = IP6_REASS_RC_OK;
   do
     {
       u32 tmp_bi = sub_chain_bi;
@@ -442,7 +549,8 @@ ip6_reass_finalize (vlib_main_t * vm, vlib_node_runtime_t * node,
       if (!(vnb->ip.reass.range_first >= vnb->ip.reass.fragment_first) &&
          !(vnb->ip.reass.range_last > vnb->ip.reass.fragment_first))
        {
-         return IP6_REASS_RC_INTERNAL_ERROR;
+         rv = IP6_REASS_RC_INTERNAL_ERROR;
+         goto free_buffers_and_return;
        }
 
       u32 data_len = ip6_reass_buffer_get_data_len (tmp);
@@ -455,7 +563,8 @@ ip6_reass_finalize (vlib_main_t * vm, vlib_node_runtime_t * node,
          /* first buffer - keep ip6 header */
          if (0 != ip6_reass_buffer_get_data_offset (tmp))
            {
-             return IP6_REASS_RC_INTERNAL_ERROR;
+             rv = IP6_REASS_RC_INTERNAL_ERROR;
+             goto free_buffers_and_return;
            }
          trim_front = 0;
          trim_end = vlib_buffer_length_in_chain (vm, tmp) - data_len -
@@ -463,7 +572,8 @@ ip6_reass_finalize (vlib_main_t * vm, vlib_node_runtime_t * node,
             sizeof (*frag_hdr));
          if (!(vlib_buffer_length_in_chain (vm, tmp) - trim_end > 0))
            {
-             return IP6_REASS_RC_INTERNAL_ERROR;
+             rv = IP6_REASS_RC_INTERNAL_ERROR;
+             goto free_buffers_and_return;
            }
        }
       u32 keep_data =
@@ -476,12 +586,12 @@ ip6_reass_finalize (vlib_main_t * vm, vlib_node_runtime_t * node,
              if (trim_front > tmp->current_length)
                {
                  /* drop whole buffer */
-                 vec_add1 (*vec_drop_compress, tmp_bi);
-                 ++dropped_cnt;
+                 vec_add1 (vec_drop_compress, tmp_bi);
                  trim_front -= tmp->current_length;
                  if (!(tmp->flags & VLIB_BUFFER_NEXT_PRESENT))
                    {
-                     return IP6_REASS_RC_INTERNAL_ERROR;
+                     rv = IP6_REASS_RC_INTERNAL_ERROR;
+                     goto free_buffers_and_return;
                    }
                  tmp->flags &= ~VLIB_BUFFER_NEXT_PRESENT;
                  tmp_bi = tmp->next_buffer;
@@ -512,17 +622,19 @@ ip6_reass_finalize (vlib_main_t * vm, vlib_node_runtime_t * node,
                  keep_data -= tmp->current_length;
                  if (!(tmp->flags & VLIB_BUFFER_NEXT_PRESENT))
                    {
-                     return IP6_REASS_RC_INTERNAL_ERROR;
+                     rv = IP6_REASS_RC_INTERNAL_ERROR;
+                     goto free_buffers_and_return;
                    }
                }
              total_length += tmp->current_length;
            }
          else
            {
-             vec_add1 (*vec_drop_compress, tmp_bi);
+             vec_add1 (vec_drop_compress, tmp_bi);
              if (reass->first_bi == tmp_bi)
                {
-                 return IP6_REASS_RC_INTERNAL_ERROR;
+                 rv = IP6_REASS_RC_INTERNAL_ERROR;
+                 goto free_buffers_and_return;
                }
              ++dropped_cnt;
            }
@@ -544,13 +656,15 @@ ip6_reass_finalize (vlib_main_t * vm, vlib_node_runtime_t * node,
 
   if (!last_b)
     {
-      return IP6_REASS_RC_INTERNAL_ERROR;
+      rv = IP6_REASS_RC_INTERNAL_ERROR;
+      goto free_buffers_and_return;
     }
   last_b->flags &= ~VLIB_BUFFER_NEXT_PRESENT;
   vlib_buffer_t *first_b = vlib_get_buffer (vm, reass->first_bi);
   if (total_length < first_b->current_length)
     {
-      return IP6_REASS_RC_INTERNAL_ERROR;
+      rv = IP6_REASS_RC_INTERNAL_ERROR;
+      goto free_buffers_and_return;
     }
   total_length -= first_b->current_length;
   first_b->flags |= VLIB_BUFFER_TOTAL_LENGTH_VALID;
@@ -572,7 +686,8 @@ ip6_reass_finalize (vlib_main_t * vm, vlib_node_runtime_t * node,
     }
   if (!((u8 *) frag_hdr - (u8 *) ip == ip6_frag_hdr_offset))
     {
-      return IP6_REASS_RC_INTERNAL_ERROR;
+      rv = IP6_REASS_RC_INTERNAL_ERROR;
+      goto free_buffers_and_return;
     }
   memmove (frag_hdr, (u8 *) frag_hdr + sizeof (*frag_hdr),
           first_b->current_length - ip6_frag_hdr_offset -
@@ -581,11 +696,18 @@ ip6_reass_finalize (vlib_main_t * vm, vlib_node_runtime_t * node,
   ip->payload_length =
     clib_host_to_net_u16 (total_length + first_b->current_length -
                          sizeof (*ip));
-  vlib_buffer_chain_compress (vm, first_b, vec_drop_compress);
-  rt->buffers_n -= buf_cnt - vec_len (*vec_drop_compress);
+  if (!vlib_buffer_chain_linearize (vm, first_b))
+    {
+      rv = IP6_REASS_RC_NO_BUF;
+      goto free_buffers_and_return;
+    }
+  first_b->flags &= ~VLIB_BUFFER_EXT_HDR_VALID;
   if (PREDICT_FALSE (first_b->flags & VLIB_BUFFER_IS_TRACED))
     {
-      ip6_reass_add_trace (vm, node, rm, reass, reass->first_bi, FINALIZE, 0);
+      ip6_reass_add_trace (vm, node, rm, reass->id, reass->trace_op_counter,
+                          reass->first_bi, reass->first_bi, reass->data_len,
+                          FINALIZE, ~0);
+      ++reass->trace_op_counter;
 #if 0
       // following code does a hexdump of packet fragments to stdout ...
       do
@@ -613,7 +735,7 @@ ip6_reass_finalize (vlib_main_t * vm, vlib_node_runtime_t * node,
       while (0);
 #endif
     }
-  if (is_feature)
+  if (!is_custom_app)
     {
       *next0 = IP6_REASSEMBLY_NEXT_INPUT;
     }
@@ -624,26 +746,10 @@ ip6_reass_finalize (vlib_main_t * vm, vlib_node_runtime_t * node,
   vnet_buffer (first_b)->ip.reass.estimated_mtu = reass->min_fragment_length;
   ip6_reass_free (rm, rt, reass);
   reass = NULL;
-  return IP6_REASS_RC_OK;
-}
-
-always_inline u32
-ip6_reass_get_buffer_chain_length (vlib_main_t * vm, vlib_buffer_t * b)
-{
-  u32 len = 0;
-  while (b)
-    {
-      ++len;
-      if (PREDICT_FALSE (b->flags & VLIB_BUFFER_NEXT_PRESENT))
-       {
-         b = vlib_get_buffer (vm, b->next_buffer);
-       }
-      else
-       {
-         break;
-       }
-    }
-  return len;
+free_buffers_and_return:
+  vlib_buffer_free (vm, vec_drop_compress, vec_len (vec_drop_compress));
+  vec_free (vec_drop_compress);
+  return rv;
 }
 
 always_inline void
@@ -671,21 +777,24 @@ ip6_reass_insert_range_in_chain (vlib_main_t * vm, ip6_reass_main_t * rm,
       reass->first_bi = new_next_bi;
     }
   reass->data_len += ip6_reass_buffer_get_data_len (new_next_b);
-  rt->buffers_n += ip6_reass_get_buffer_chain_length (vm, new_next_b);
 }
 
 always_inline ip6_reass_rc_t
 ip6_reass_update (vlib_main_t * vm, vlib_node_runtime_t * node,
                  ip6_reass_main_t * rm, ip6_reass_per_thread_t * rt,
-                 ip6_reass_t * reass, u32 * bi0, u32 * next0,
-                 u32 * error0, ip6_frag_hdr_t * frag_hdr,
-                 u32 ** vec_drop_overlap, u32 ** vec_drop_compress,
-                 bool is_feature)
+                 ip6_reass_t * reass, u32 * bi0, u32 * next0, u32 * error0,
+                 ip6_frag_hdr_t * frag_hdr, bool is_custom_app,
+                 u32 * handoff_thread_idx)
 {
   int consumed = 0;
   vlib_buffer_t *fb = vlib_get_buffer (vm, *bi0);
   vnet_buffer_opaque_t *fvnb = vnet_buffer (fb);
-  reass->next_index = fvnb->ip.reass.next_index;       // store next_index before it's overwritten
+  if (is_custom_app)
+    {
+      reass->next_index = fvnb->ip.reass.next_index;   // store next_index before it's overwritten
+      reass->error_next_index = fvnb->ip.reass.error_next_index;       // store error_next_index before it is overwritten
+    }
+
   fvnb->ip.reass.ip6_frag_hdr_offset =
     (u8 *) frag_hdr - (u8 *) vlib_buffer_get_current (fb);
   ip6_header_t *fip = vlib_buffer_get_current (fb);
@@ -718,13 +827,10 @@ ip6_reass_update (vlib_main_t * vm, vlib_node_runtime_t * node,
       // starting a new reassembly
       ip6_reass_insert_range_in_chain (vm, rm, rt, reass, prev_range_bi,
                                       *bi0);
-      if (PREDICT_FALSE (fb->flags & VLIB_BUFFER_IS_TRACED))
-       {
-         ip6_reass_add_trace (vm, node, rm, reass, *bi0, RANGE_NEW, 0);
-       }
       reass->min_fragment_length = clib_net_to_host_u16 (fip->payload_length);
-      *bi0 = ~0;
-      return IP6_REASS_RC_OK;
+      consumed = 1;
+      reass->fragments_n = 1;
+      goto check_if_done_maybe;
     }
   reass->min_fragment_length =
     clib_min (clib_net_to_host_u16 (fip->payload_length),
@@ -764,12 +870,15 @@ ip6_reass_update (vlib_main_t * vm, vlib_node_runtime_t * node,
       else
        {
          // overlapping fragment - not allowed by RFC 8200
-         ip6_reass_drop_all (vm, rm, reass, vec_drop_overlap);
+         ip6_reass_drop_all (vm, node, rm, reass);
          ip6_reass_free (rm, rt, reass);
          if (PREDICT_FALSE (fb->flags & VLIB_BUFFER_IS_TRACED))
            {
-             ip6_reass_add_trace (vm, node, rm, reass, *bi0, RANGE_OVERLAP,
-                                  0);
+             ip6_reass_add_trace (vm, node, rm, reass->id,
+                                  reass->trace_op_counter, *bi0,
+                                  reass->first_bi, reass->data_len,
+                                  RANGE_OVERLAP, ~0);
+             ++reass->trace_op_counter;
            }
          *next0 = IP6_REASSEMBLY_NEXT_DROP;
          *error0 = IP6_ERROR_REASS_OVERLAPPING_FRAGMENT;
@@ -777,24 +886,41 @@ ip6_reass_update (vlib_main_t * vm, vlib_node_runtime_t * node,
        }
       break;
     }
+  ++reass->fragments_n;
+check_if_done_maybe:
   if (consumed)
     {
       if (PREDICT_FALSE (fb->flags & VLIB_BUFFER_IS_TRACED))
        {
-         ip6_reass_add_trace (vm, node, rm, reass, *bi0, RANGE_NEW, 0);
+         ip6_reass_add_trace (vm, node, rm, reass->id,
+                              reass->trace_op_counter, *bi0, reass->first_bi,
+                              reass->data_len, RANGE_NEW, ~0);
+         ++reass->trace_op_counter;
        }
     }
   if (~0 != reass->last_packet_octet &&
       reass->data_len == reass->last_packet_octet + 1)
     {
-      return ip6_reass_finalize (vm, node, rm, rt, reass, bi0, next0, error0,
-                                vec_drop_compress, is_feature);
+      *handoff_thread_idx = reass->sendout_thread_index;
+      ip6_reass_rc_t rc =
+       ip6_reass_finalize (vm, node, rm, rt, reass, bi0, next0, error0,
+                           is_custom_app);
+      if (IP6_REASS_RC_OK == rc
+         && reass->memory_owner_thread_index != reass->sendout_thread_index)
+       {
+         return IP6_REASS_RC_HANDOFF;
+       }
+      return rc;
     }
   else
     {
       if (consumed)
        {
          *bi0 = ~0;
+         if (reass->fragments_n > rm->max_reass_len)
+           {
+             return IP6_REASS_RC_TOO_MANY_FRAGMENTS;
+           }
        }
       else
        {
@@ -873,88 +999,27 @@ ip6_reass_verify_packet_size_lt_64k (vlib_main_t * vm,
 }
 
 always_inline uword
-ip6_reassembly_inline (vlib_main_t * vm,
-                      vlib_node_runtime_t * node,
-                      vlib_frame_t * frame, bool is_feature)
+ip6_reassembly_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
+                      vlib_frame_t * frame, bool is_feature,
+                      bool is_custom_app)
 {
   u32 *from = vlib_frame_vector_args (frame);
   u32 n_left_from, n_left_to_next, *to_next, next_index;
   ip6_reass_main_t *rm = &ip6_reass_main;
-  ip6_reass_per_thread_t *rt = &rm->per_thread_data[os_get_thread_index ()];
+  ip6_reass_per_thread_t *rt = &rm->per_thread_data[vm->thread_index];
   clib_spinlock_lock (&rt->lock);
 
   n_left_from = frame->n_vectors;
   next_index = node->cached_next_index;
-  static u32 *vec_timeout = NULL;      // indexes of buffers which timed out
-  static u32 *vec_drop_overlap = NULL; // indexes of buffers dropped due to overlap
-  static u32 *vec_drop_internal_error = NULL;  // indexes of buffers dropped due to internal errors
-  static u32 *vec_drop_compress = NULL;        // indexes of buffers dropped due to buffer compression
-  while (n_left_from > 0 || vec_len (vec_timeout) > 0
-        || vec_len (vec_drop_overlap) > 0 || vec_len (vec_drop_compress) > 0
-        || vec_len (vec_drop_internal_error) > 0)
+  while (n_left_from > 0)
     {
       vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
 
-      while (vec_len (vec_timeout) > 0 && n_left_to_next > 0)
-       {
-         u32 bi = vec_pop (vec_timeout);
-         vlib_buffer_t *b = vlib_get_buffer (vm, bi);
-         b->error = node->errors[IP6_ERROR_REASS_TIMEOUT];
-         to_next[0] = bi;
-         to_next += 1;
-         n_left_to_next -= 1;
-         vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
-                                          n_left_to_next, bi,
-                                          IP6_REASSEMBLY_NEXT_DROP);
-         --rt->buffers_n;
-       }
-
-      while (vec_len (vec_drop_overlap) > 0 && n_left_to_next > 0)
-       {
-         u32 bi = vec_pop (vec_drop_overlap);
-         vlib_buffer_t *b = vlib_get_buffer (vm, bi);
-         b->error = node->errors[IP6_ERROR_REASS_OVERLAPPING_FRAGMENT];
-         to_next[0] = bi;
-         to_next += 1;
-         n_left_to_next -= 1;
-         vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
-                                          n_left_to_next, bi,
-                                          IP6_REASSEMBLY_NEXT_DROP);
-         --rt->buffers_n;
-       }
-
-      while (vec_len (vec_drop_compress) > 0 && n_left_to_next > 0)
-       {
-         u32 bi = vec_pop (vec_drop_compress);
-         vlib_buffer_t *b = vlib_get_buffer (vm, bi);
-         b->error = node->errors[IP6_ERROR_NONE];
-         to_next[0] = bi;
-         to_next += 1;
-         n_left_to_next -= 1;
-         vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
-                                          n_left_to_next, bi,
-                                          IP6_REASSEMBLY_NEXT_DROP);
-         --rt->buffers_n;
-       }
-      while (vec_len (vec_drop_internal_error) > 0 && n_left_to_next > 0)
-       {
-         u32 bi = vec_pop (vec_drop_internal_error);
-         vlib_buffer_t *b = vlib_get_buffer (vm, bi);
-         b->error = node->errors[IP6_ERROR_REASS_INTERNAL_ERROR];
-         to_next[0] = bi;
-         to_next += 1;
-         n_left_to_next -= 1;
-         vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
-                                          n_left_to_next, bi,
-                                          IP6_REASSEMBLY_NEXT_DROP);
-         --rt->buffers_n;
-       }
-
       while (n_left_from > 0 && n_left_to_next > 0)
        {
          u32 bi0;
          vlib_buffer_t *b0;
-         u32 next0;
+         u32 next0 = IP6_REASSEMBLY_NEXT_DROP;
          u32 error0 = IP6_ERROR_NONE;
          u32 icmp_bi = ~0;
 
@@ -994,32 +1059,82 @@ ip6_reassembly_inline (vlib_main_t * vm,
          vnet_buffer (b0)->ip.reass.ip6_frag_hdr_offset =
            (u8 *) frag_hdr - (u8 *) ip0;
 
-         ip6_reass_key_t k;
-         k.as_u64[0] = ip0->src_address.as_u64[0];
-         k.as_u64[1] = ip0->src_address.as_u64[1];
-         k.as_u64[2] = ip0->dst_address.as_u64[0];
-         k.as_u64[3] = ip0->dst_address.as_u64[1];
-         k.as_u64[4] =
-           (u64) vnet_buffer (b0)->
-           sw_if_index[VLIB_RX] << 32 | frag_hdr->identification;
-         k.as_u64[5] = ip0->protocol;
+         ip6_reass_kv_t kv;
+         u8 do_handoff = 0;
+
+         kv.k.as_u64[0] = ip0->src_address.as_u64[0];
+         kv.k.as_u64[1] = ip0->src_address.as_u64[1];
+         kv.k.as_u64[2] = ip0->dst_address.as_u64[0];
+         kv.k.as_u64[3] = ip0->dst_address.as_u64[1];
+         kv.k.as_u64[4] =
+           ((u64) vec_elt (ip6_main.fib_index_by_sw_if_index,
+                           vnet_buffer (b0)->sw_if_index[VLIB_RX])) << 32 |
+           (u64) frag_hdr->identification;
+         kv.k.as_u64[5] = ip0->protocol;
+
          ip6_reass_t *reass =
-           ip6_reass_find_or_create (vm, node, rm, rt, &k, &icmp_bi,
-                                     &vec_timeout);
+           ip6_reass_find_or_create (vm, node, rm, rt, &kv, &icmp_bi,
+                                     &do_handoff);
 
          if (reass)
            {
+             const u32 fragment_first = ip6_frag_hdr_offset (frag_hdr);
+             if (0 == fragment_first)
+               {
+                 reass->sendout_thread_index = vm->thread_index;
+               }
+           }
+         if (PREDICT_FALSE (do_handoff))
+           {
+             next0 = IP6_REASSEMBLY_NEXT_HANDOFF;
+             if (is_feature)
+               vnet_buffer (b0)->ip.reass.owner_feature_thread_index =
+                 kv.v.memory_owner_thread_index;
+             else
+               vnet_buffer (b0)->ip.reass.owner_thread_index =
+                 kv.v.memory_owner_thread_index;
+           }
+         else if (reass)
+           {
+             u32 handoff_thread_idx;
              switch (ip6_reass_update (vm, node, rm, rt, reass, &bi0, &next0,
-                                       &error0, frag_hdr, &vec_drop_overlap,
-                                       &vec_drop_compress, is_feature))
+                                       &error0, frag_hdr, is_custom_app,
+                                       &handoff_thread_idx))
                {
                case IP6_REASS_RC_OK:
                  /* nothing to do here */
                  break;
+               case IP6_REASS_RC_HANDOFF:
+                 next0 = IP6_REASSEMBLY_NEXT_HANDOFF;
+                 b0 = vlib_get_buffer (vm, bi0);
+                 if (is_feature)
+                   vnet_buffer (b0)->ip.reass.owner_feature_thread_index =
+                     handoff_thread_idx;
+                 else
+                   vnet_buffer (b0)->ip.reass.owner_thread_index =
+                     handoff_thread_idx;
+                 break;
+               case IP6_REASS_RC_TOO_MANY_FRAGMENTS:
+                 vlib_node_increment_counter (vm, node->node_index,
+                                              IP6_ERROR_REASS_FRAGMENT_CHAIN_TOO_LONG,
+                                              1);
+                 ip6_reass_drop_all (vm, node, rm, reass);
+                 ip6_reass_free (rm, rt, reass);
+                 goto next_packet;
+                 break;
+               case IP6_REASS_RC_NO_BUF:
+                 vlib_node_increment_counter (vm, node->node_index,
+                                              IP6_ERROR_REASS_NO_BUF, 1);
+                 ip6_reass_drop_all (vm, node, rm, reass);
+                 ip6_reass_free (rm, rt, reass);
+                 goto next_packet;
+                 break;
                case IP6_REASS_RC_INTERNAL_ERROR:
                  /* drop everything and start with a clean slate */
-                 ip6_reass_drop_all (vm, rm, reass,
-                                     &vec_drop_internal_error);
+                 vlib_node_increment_counter (vm, node->node_index,
+                                              IP6_ERROR_REASS_INTERNAL_ERROR,
+                                              1);
+                 ip6_reass_drop_all (vm, node, rm, reass);
                  ip6_reass_free (rm, rt, reass);
                  goto next_packet;
                  break;
@@ -1027,7 +1142,15 @@ ip6_reassembly_inline (vlib_main_t * vm,
            }
          else
            {
-             next0 = IP6_REASSEMBLY_NEXT_DROP;
+             if (is_feature)
+               {
+                 next0 = IP6_REASSEMBLY_NEXT_DROP;
+               }
+             else
+               {
+                 vnet_buffer_opaque_t *fvnb = vnet_buffer (b0);
+                 next0 = fvnb->ip.reass.error_next_index;
+               }
              error0 = IP6_ERROR_REASS_LIMIT_REACHED;
            }
 
@@ -1039,7 +1162,24 @@ ip6_reassembly_inline (vlib_main_t * vm,
              to_next[0] = bi0;
              to_next += 1;
              n_left_to_next -= 1;
-             if (is_feature && IP6_ERROR_NONE == error0)
+             if (next0 == IP6_REASSEMBLY_NEXT_HANDOFF)
+               {
+                 if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
+                   {
+                     if (is_feature)
+                       ip6_reass_add_trace (vm, node, rm, ~0,
+                                            ~0,
+                                            bi0, ~0, ~0, HANDOFF,
+                                            vnet_buffer (b0)->ip.
+                                            reass.owner_feature_thread_index);
+                     else
+                       ip6_reass_add_trace (vm, node, rm, ~0, ~0, bi0,
+                                            ~0, ~0, HANDOFF,
+                                            vnet_buffer (b0)->ip.
+                                            reass.owner_thread_index);
+                   }
+               }
+             else if (is_feature && IP6_ERROR_NONE == error0)
                {
                  b0 = vlib_get_buffer (vm, bi0);
                  vnet_feature_next (&next0, b0);
@@ -1076,16 +1216,15 @@ static char *ip6_reassembly_error_strings[] = {
 #undef _
 };
 
-static uword
-ip6_reassembly (vlib_main_t * vm, vlib_node_runtime_t * node,
-               vlib_frame_t * frame)
+VLIB_NODE_FN (ip6_reass_node) (vlib_main_t * vm, vlib_node_runtime_t * node,
+                              vlib_frame_t * frame)
 {
-  return ip6_reassembly_inline (vm, node, frame, false /* is_feature */ );
+  return ip6_reassembly_inline (vm, node, frame, false /* is_feature */ ,
+                               false /* is_custom_app */ );
 }
 
 /* *INDENT-OFF* */
-VLIB_REGISTER_NODE (ip6_reass_node, static) = {
-    .function = ip6_reassembly,
+VLIB_REGISTER_NODE (ip6_reass_node) = {
     .name = "ip6-reassembly",
     .vector_size = sizeof (u32),
     .format_trace = format_ip6_reass_trace,
@@ -1097,22 +1236,21 @@ VLIB_REGISTER_NODE (ip6_reass_node, static) = {
                 [IP6_REASSEMBLY_NEXT_INPUT] = "ip6-input",
                 [IP6_REASSEMBLY_NEXT_DROP] = "ip6-drop",
                 [IP6_REASSEMBLY_NEXT_ICMP_ERROR] = "ip6-icmp-error",
+                [IP6_REASSEMBLY_NEXT_HANDOFF] = "ip6-reassembly-handoff",
         },
 };
 /* *INDENT-ON* */
 
-VLIB_NODE_FUNCTION_MULTIARCH (ip6_reass_node, ip6_reassembly);
-
-static uword
-ip6_reassembly_feature (vlib_main_t * vm,
-                       vlib_node_runtime_t * node, vlib_frame_t * frame)
+VLIB_NODE_FN (ip6_reass_node_feature) (vlib_main_t * vm,
+                                      vlib_node_runtime_t * node,
+                                      vlib_frame_t * frame)
 {
-  return ip6_reassembly_inline (vm, node, frame, true /* is_feature */ );
+  return ip6_reassembly_inline (vm, node, frame, true /* is_feature */ ,
+                               false /* is_custom_app */ );
 }
 
 /* *INDENT-OFF* */
-VLIB_REGISTER_NODE (ip6_reass_node_feature, static) = {
-    .function = ip6_reassembly_feature,
+VLIB_REGISTER_NODE (ip6_reass_node_feature) = {
     .name = "ip6-reassembly-feature",
     .vector_size = sizeof (u32),
     .format_trace = format_ip6_reass_trace,
@@ -1124,21 +1262,22 @@ VLIB_REGISTER_NODE (ip6_reass_node_feature, static) = {
                 [IP6_REASSEMBLY_NEXT_INPUT] = "ip6-input",
                 [IP6_REASSEMBLY_NEXT_DROP] = "ip6-drop",
                 [IP6_REASSEMBLY_NEXT_ICMP_ERROR] = "ip6-icmp-error",
+                [IP6_REASSEMBLY_NEXT_HANDOFF] = "ip6-reass-feature-hoff",
         },
 };
 /* *INDENT-ON* */
 
-VLIB_NODE_FUNCTION_MULTIARCH (ip6_reass_node_feature, ip6_reassembly_feature);
-
 /* *INDENT-OFF* */
 VNET_FEATURE_INIT (ip6_reassembly_feature, static) = {
     .arc_name = "ip6-unicast",
     .node_name = "ip6-reassembly-feature",
-    .runs_before = VNET_FEATURES ("ip6-lookup"),
+    .runs_before = VNET_FEATURES ("ip6-lookup",
+                                  "ipsec6-input-feature"),
     .runs_after = 0,
 };
 /* *INDENT-ON* */
 
+#ifndef CLIB_MARCH_VARIANT
 static u32
 ip6_reass_get_nbuckets ()
 {
@@ -1155,12 +1294,14 @@ ip6_reass_get_nbuckets ()
 
   return nbuckets;
 }
+#endif /* CLIB_MARCH_VARIANT */
 
 typedef enum
 {
   IP6_EVENT_CONFIG_CHANGED = 1,
 } ip6_reass_event_t;
 
+#ifndef CLIB_MARCH_VARIANT
 typedef struct
 {
   int failure;
@@ -1179,20 +1320,21 @@ ip6_rehash_cb (clib_bihash_kv_48_8_t * kv, void *_ctx)
 
 static void
 ip6_reass_set_params (u32 timeout_ms, u32 max_reassemblies,
-                     u32 expire_walk_interval_ms)
+                     u32 max_reassembly_length, u32 expire_walk_interval_ms)
 {
   ip6_reass_main.timeout_ms = timeout_ms;
   ip6_reass_main.timeout = (f64) timeout_ms / (f64) MSEC_PER_SEC;
   ip6_reass_main.max_reass_n = max_reassemblies;
+  ip6_reass_main.max_reass_len = max_reassembly_length;
   ip6_reass_main.expire_walk_interval_ms = expire_walk_interval_ms;
 }
 
 vnet_api_error_t
 ip6_reass_set (u32 timeout_ms, u32 max_reassemblies,
-              u32 expire_walk_interval_ms)
+              u32 max_reassembly_length, u32 expire_walk_interval_ms)
 {
   u32 old_nbuckets = ip6_reass_get_nbuckets ();
-  ip6_reass_set_params (timeout_ms, max_reassemblies,
+  ip6_reass_set_params (timeout_ms, max_reassemblies, max_reassembly_length,
                        expire_walk_interval_ms);
   vlib_process_signal_event (ip6_reass_main.vlib_main,
                             ip6_reass_main.ip6_reass_expire_node_idx,
@@ -1219,6 +1361,7 @@ ip6_reass_set (u32 timeout_ms, u32 max_reassemblies,
          clib_bihash_free_48_8 (&ip6_reass_main.hash);
          clib_memcpy_fast (&ip6_reass_main.hash, &new_hash,
                            sizeof (ip6_reass_main.hash));
+         clib_bihash_copied (&ip6_reass_main.hash, &new_hash);
        }
     }
   return 0;
@@ -1243,7 +1386,6 @@ ip6_reass_init_function (vlib_main_t * vm)
   vlib_node_t *node;
 
   rm->vlib_main = vm;
-  rm->vnet_main = vnet_get_main ();
 
   vec_validate (rm->per_thread_data, vlib_num_workers ());
   ip6_reass_per_thread_t *rt;
@@ -1259,6 +1401,7 @@ ip6_reass_init_function (vlib_main_t * vm)
 
   ip6_reass_set_params (IP6_REASS_TIMEOUT_DEFAULT_MS,
                        IP6_REASS_MAX_REASSEMBLIES_DEFAULT,
+                       IP6_REASS_MAX_REASSEMBLY_LENGTH_DEFAULT,
                        IP6_REASS_EXPIRE_WALK_INTERVAL_DEFAULT_MS);
 
   nbuckets = ip6_reass_get_nbuckets ();
@@ -1276,10 +1419,15 @@ ip6_reass_init_function (vlib_main_t * vm)
   ip6_register_protocol (IP_PROTOCOL_IPV6_FRAGMENTATION,
                         ip6_reass_node.index);
 
+  rm->fq_index = vlib_frame_queue_main_init (ip6_reass_node.index, 0);
+  rm->fq_feature_index =
+    vlib_frame_queue_main_init (ip6_reass_node_feature.index, 0);
+
   return error;
 }
 
 VLIB_INIT_FUNCTION (ip6_reass_init_function);
+#endif /* CLIB_MARCH_VARIANT */
 
 static uword
 ip6_reass_walk_expired (vlib_main_t * vm,
@@ -1309,7 +1457,6 @@ ip6_reass_walk_expired (vlib_main_t * vm,
       f64 now = vlib_time_now (vm);
 
       ip6_reass_t *reass;
-      u32 *vec_timeout = NULL;
       int *pool_indexes_to_free = NULL;
 
       uword thread_index = 0;
@@ -1337,24 +1484,10 @@ ip6_reass_walk_expired (vlib_main_t * vm,
           {
             ip6_reass_t *reass = pool_elt_at_index (rt->pool, i[0]);
             u32 icmp_bi = ~0;
-            u32 before = vec_len (vec_timeout);
-            vlib_buffer_t *b = vlib_get_buffer (vm, reass->first_bi);
-            if (PREDICT_FALSE (b->flags & VLIB_BUFFER_IS_TRACED))
-              {
-                if (pool_is_free_index (vm->trace_main.trace_buffer_pool,
-                                        b->trace_index))
-                  {
-                    /* the trace is gone, don't trace this buffer anymore */
-                    b->flags &= ~VLIB_BUFFER_IS_TRACED;
-                  }
-              }
-            ip6_reass_on_timeout (vm, node, rm, rt, reass, &icmp_bi, &vec_timeout);
-            u32 after = vec_len (vec_timeout);
-            rt->buffers_n -= (after - before);
+            ip6_reass_on_timeout (vm, node, rm, reass, &icmp_bi);
             if (~0 != icmp_bi)
-              {
-                vec_add1 (vec_icmp_bi, icmp_bi);
-              }
+              vec_add1 (vec_icmp_bi, icmp_bi);
+
             ip6_reass_free (rm, rt, reass);
           }
           /* *INDENT-ON* */
@@ -1362,39 +1495,6 @@ ip6_reass_walk_expired (vlib_main_t * vm,
          clib_spinlock_unlock (&rt->lock);
        }
 
-      while (vec_len (vec_timeout) > 0)
-       {
-         vlib_frame_t *f = vlib_get_frame_to_node (vm, rm->ip6_drop_idx);
-         u32 *to_next = vlib_frame_vector_args (f);
-         u32 n_left_to_next = VLIB_FRAME_SIZE - f->n_vectors;
-         int trace_frame = 0;
-         while (vec_len (vec_timeout) > 0 && n_left_to_next > 0)
-           {
-             u32 bi = vec_pop (vec_timeout);
-             vlib_buffer_t *b = vlib_get_buffer (vm, bi);
-             if (PREDICT_FALSE (b->flags & VLIB_BUFFER_IS_TRACED))
-               {
-                 if (pool_is_free_index (vm->trace_main.trace_buffer_pool,
-                                         b->trace_index))
-                   {
-                     /* the trace is gone, don't trace this buffer anymore */
-                     b->flags &= ~VLIB_BUFFER_IS_TRACED;
-                   }
-                 else
-                   {
-                     trace_frame = 1;
-                   }
-               }
-             b->error = node->errors[IP6_ERROR_REASS_TIMEOUT];
-             to_next[0] = bi;
-             ++f->n_vectors;
-             to_next += 1;
-             n_left_to_next -= 1;
-           }
-         f->frame_flags |= (trace_frame * VLIB_FRAME_TRACE);
-         vlib_put_frame_to_node (vm, rm->ip6_drop_idx, f);
-       }
-
       while (vec_len (vec_icmp_bi) > 0)
        {
          vlib_frame_t *f =
@@ -1407,18 +1507,7 @@ ip6_reass_walk_expired (vlib_main_t * vm,
              u32 bi = vec_pop (vec_icmp_bi);
              vlib_buffer_t *b = vlib_get_buffer (vm, bi);
              if (PREDICT_FALSE (b->flags & VLIB_BUFFER_IS_TRACED))
-               {
-                 if (pool_is_free_index (vm->trace_main.trace_buffer_pool,
-                                         b->trace_index))
-                   {
-                     /* the trace is gone, don't trace this buffer anymore */
-                     b->flags &= ~VLIB_BUFFER_IS_TRACED;
-                   }
-                 else
-                   {
-                     trace_frame = 1;
-                   }
-               }
+               trace_frame = 1;
              b->error = node->errors[IP6_ERROR_REASS_TIMEOUT];
              to_next[0] = bi;
              ++f->n_vectors;
@@ -1430,7 +1519,6 @@ ip6_reass_walk_expired (vlib_main_t * vm,
        }
 
       vec_free (pool_indexes_to_free);
-      vec_free (vec_timeout);
       vec_free (vec_icmp_bi);
       if (event_data)
        {
@@ -1441,8 +1529,6 @@ ip6_reass_walk_expired (vlib_main_t * vm,
   return 0;
 }
 
-static vlib_node_registration_t ip6_reass_expire_node;
-
 /* *INDENT-OFF* */
 VLIB_REGISTER_NODE (ip6_reass_expire_node, static) = {
     .function = ip6_reass_walk_expired,
@@ -1535,7 +1621,6 @@ show_ip6_reass (vlib_main_t * vm, unformat_input_t * input,
           /* *INDENT-ON* */
        }
       sum_reass_n += rt->reass_n;
-      sum_buffers_n += rt->buffers_n;
       clib_spinlock_unlock (&rt->lock);
     }
   vlib_cli_output (vm, "---------------------");
@@ -1556,12 +1641,150 @@ VLIB_CLI_COMMAND (show_ip6_reassembly_cmd, static) = {
 };
 /* *INDENT-ON* */
 
+#ifndef CLIB_MARCH_VARIANT
 vnet_api_error_t
 ip6_reass_enable_disable (u32 sw_if_index, u8 enable_disable)
 {
   return vnet_feature_enable_disable ("ip6-unicast", "ip6-reassembly-feature",
                                      sw_if_index, enable_disable, 0, 0);
 }
+#endif /* CLIB_MARCH_VARIANT */
+
+#define foreach_ip6_reassembly_handoff_error                       \
+_(CONGESTION_DROP, "congestion drop")
+
+
+typedef enum
+{
+#define _(sym,str) IP6_REASSEMBLY_HANDOFF_ERROR_##sym,
+  foreach_ip6_reassembly_handoff_error
+#undef _
+    IP6_REASSEMBLY_HANDOFF_N_ERROR,
+} ip6_reassembly_handoff_error_t;
+
+static char *ip6_reassembly_handoff_error_strings[] = {
+#define _(sym,string) string,
+  foreach_ip6_reassembly_handoff_error
+#undef _
+};
+
+typedef struct
+{
+  u32 next_worker_index;
+} ip6_reassembly_handoff_trace_t;
+
+static u8 *
+format_ip6_reassembly_handoff_trace (u8 * s, va_list * args)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+  ip6_reassembly_handoff_trace_t *t =
+    va_arg (*args, ip6_reassembly_handoff_trace_t *);
+
+  s =
+    format (s, "ip6-reassembly-handoff: next-worker %d",
+           t->next_worker_index);
+
+  return s;
+}
+
+always_inline uword
+ip6_reassembly_handoff_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
+                              vlib_frame_t * frame, bool is_feature)
+{
+  ip6_reass_main_t *rm = &ip6_reass_main;
+
+  vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
+  u32 n_enq, n_left_from, *from;
+  u16 thread_indices[VLIB_FRAME_SIZE], *ti;
+  u32 fq_index;
+
+  from = vlib_frame_vector_args (frame);
+  n_left_from = frame->n_vectors;
+  vlib_get_buffers (vm, from, bufs, n_left_from);
+
+  b = bufs;
+  ti = thread_indices;
+
+  fq_index = (is_feature) ? rm->fq_feature_index : rm->fq_index;
+
+  while (n_left_from > 0)
+    {
+      ti[0] =
+       (is_feature) ? vnet_buffer (b[0])->ip.
+       reass.owner_feature_thread_index : vnet_buffer (b[0])->ip.
+       reass.owner_thread_index;
+
+      if (PREDICT_FALSE
+         ((node->flags & VLIB_NODE_FLAG_TRACE)
+          && (b[0]->flags & VLIB_BUFFER_IS_TRACED)))
+       {
+         ip6_reassembly_handoff_trace_t *t =
+           vlib_add_trace (vm, node, b[0], sizeof (*t));
+         t->next_worker_index = ti[0];
+       }
+
+      n_left_from -= 1;
+      ti += 1;
+      b += 1;
+    }
+  n_enq =
+    vlib_buffer_enqueue_to_thread (vm, fq_index, from, thread_indices,
+                                  frame->n_vectors, 1);
+
+  if (n_enq < frame->n_vectors)
+    vlib_node_increment_counter (vm, node->node_index,
+                                IP6_REASSEMBLY_HANDOFF_ERROR_CONGESTION_DROP,
+                                frame->n_vectors - n_enq);
+  return frame->n_vectors;
+}
+
+VLIB_NODE_FN (ip6_reassembly_handoff_node) (vlib_main_t * vm,
+                                           vlib_node_runtime_t * node,
+                                           vlib_frame_t * frame)
+{
+  return ip6_reassembly_handoff_inline (vm, node, frame,
+                                       false /* is_feature */ );
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (ip6_reassembly_handoff_node) = {
+  .name = "ip6-reassembly-handoff",
+  .vector_size = sizeof (u32),
+  .n_errors = ARRAY_LEN(ip6_reassembly_handoff_error_strings),
+  .error_strings = ip6_reassembly_handoff_error_strings,
+  .format_trace = format_ip6_reassembly_handoff_trace,
+
+  .n_next_nodes = 1,
+
+  .next_nodes = {
+    [0] = "error-drop",
+  },
+};
+
+
+VLIB_NODE_FN (ip6_reassembly_feature_handoff_node) (vlib_main_t * vm,
+                               vlib_node_runtime_t * node, vlib_frame_t * frame)
+{
+  return ip6_reassembly_handoff_inline (vm, node, frame, true /* is_feature */ );
+}
+
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (ip6_reassembly_feature_handoff_node) = {
+  .name = "ip6-reass-feature-hoff",
+  .vector_size = sizeof (u32),
+  .n_errors = ARRAY_LEN(ip6_reassembly_handoff_error_strings),
+  .error_strings = ip6_reassembly_handoff_error_strings,
+  .format_trace = format_ip6_reassembly_handoff_trace,
+
+  .n_next_nodes = 1,
+
+  .next_nodes = {
+    [0] = "error-drop",
+  },
+};
+/* *INDENT-ON* */
 
 /*
  * fd.io coding-style-patch-verification: ON