From nobody Wed Apr 29 23:36:15 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4g5YbS5WM1z6cB5j for ; Wed, 29 Apr 2026 23:36:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4g5YbS32YZz46KF for ; Wed, 29 Apr 2026 23:36:20 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1777505780; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZG/GuedJH5O07vB7kDIA+oGW3tVTCTvBqBl6pp7dYrc=; b=u//OYEevzSaQ4K/kMYtgtMl5yeEaoYqTlFWUyZrnegHZ007SUpMKmDPfqxI+xsJsE4SfIH qamj1muXVA3ltuJt6YUCPBLz6HcxM282RChVhQduQkIw0inJpFA/S2EzazG1hSndLbhboZ SalDhQllMnytxBHqtfRPQRUxdFLf3RuYcNa80eeb0DKskvdnO37M8Ss/sMDSc/ogC5h1SS uO6ieue/9P8Cn7ll/LWPxsohMZE6XK+Yje7kZC44eE+AzYildMzHvRWwr2XXRwQBCbHkaz Hp+cCX2grXxIJr+HTY/pScEPggoXHqkofUzrK1J1tx18eks1BSdnfLuZ3zw1dw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1777505780; a=rsa-sha256; cv=none; b=tyajpuL8K2gmEyCCLYu+f/gbHU/gNfIWT13hQNhhm6QJWGHYwYsQ3L2ea8BP9eiJtQMf3j 1umvNRSxsLL+vJKJYO+Eifsk11+t4rvg66nY5caiMEhtVjUxADibIK64yplsNkUGE+GLER B3J7w2jwXu1V0SBFAJaYxGdXYv+VhYzNCa+eD8cfEmKN/ufFrLNDmtBAjozZVmMx/6IXmL 4uZVZ1l5LH134p/0lFZsWEt3i/9mq2ZNZO5ym+nlYYMozuJD9uMpAKGOAa2bLMuQ3cjbYd pWTNSr23ZfK0AqCGQ783dbXWMMNZ5c2wOexZ/9UqQ+pbcjmUSoBoK/zZcvuBxQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1777505780; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZG/GuedJH5O07vB7kDIA+oGW3tVTCTvBqBl6pp7dYrc=; b=r0rqpSvfbSSqo3Mh121h9uact96RzMKIHhtW/zYoiT28sjpuq2iw+AA9X0AOqrZo5X1XHq 6/fwYEBenjyca25j5LilgfIUlobR1f8wRWf+Btucs71SWvzQ92ETpvH2nKSSBDupTq6ePa lptjtAH16HJcTdTtbyxYuOjdVX2eePmmBcS0twa/T/akHowhwefwdVON9KtqhfSgtkB/Wa KFBuK5AM7LB0bJeyTv7kY0SLEKqz23ckgQU69ABCuAJ6oUd+NAPhfMLv4/ScgTueXN8j/t fwzB6MuD68OCNcK7nkBAKxYd3CcbLtxP2fZ+YFfcxBDhuvApVwfmiu8E7TKLyQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4g5YbS2H9Fz12TB for ; Wed, 29 Apr 2026 23:36:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 2598c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 29 Apr 2026 23:36:15 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Andrew Gallatin Subject: git: 72e2ae505c4a - main - tcp: release nic ktls send tags when entering time wait List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gallatin X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 72e2ae505c4a081d4b4759f51e25bf6e17c99442 Auto-Submitted: auto-generated Date: Wed, 29 Apr 2026 23:36:15 +0000 Message-Id: <69f295ef.2598c.6834391@gitrepo.freebsd.org> The branch main has been updated by gallatin: URL: https://cgit.FreeBSD.org/src/commit/?id=72e2ae505c4a081d4b4759f51e25bf6e17c99442 commit 72e2ae505c4a081d4b4759f51e25bf6e17c99442 Author: Andrew Gallatin AuthorDate: 2026-04-29 23:26:05 +0000 Commit: Andrew Gallatin CommitDate: 2026-04-29 23:35:47 +0000 tcp: release nic ktls send tags when entering time wait When under heavy load or churn, inline ktls offload NICs may run out of hardware resources described by ktls send tags. Rather than waiting for connections to pass through the time_wait state, reclaim the ktls send tags early, at entry to time_wait. By preventing potentially tens or hundreds of thousands of sessions from holding send tags in time_wait, this allows more ktls sessions to be offloaded to hardware. Reviewed by: glebius, kib, nickbanks_netflix.com, rrs, tuexen Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D56610 --- sys/netinet/tcp_timewait.c | 10 ++++++++++ sys/sys/ktls.h | 12 ++++++++++++ 2 files changed, 22 insertions(+) diff --git a/sys/netinet/tcp_timewait.c b/sys/netinet/tcp_timewait.c index eaa2fa336a94..4f4ca445fa46 100644 --- a/sys/netinet/tcp_timewait.c +++ b/sys/netinet/tcp_timewait.c @@ -32,11 +32,15 @@ #include "opt_inet.h" #include "opt_inet6.h" #include "opt_ipsec.h" +#include "opt_kern_tls.h" #include #include #include #include +#ifdef KERN_TLS +#include +#endif #include #include #include @@ -132,6 +136,12 @@ tcp_twstart(struct tcpcb *tp) tcp_free_sackholes(tp); soisdisconnected(inp->inp_socket); +#ifdef KERN_TLS + /* release ktls snd tag now that no more data can be sent */ + if (tptosocket(tp)->so_snd.sb_tls_info != NULL) { + ktls_release_snd_tag(tptosocket(tp)->so_snd.sb_tls_info); + } +#endif if (tp->t_flags & TF_ACKNOW) (void) tcp_output(tp); diff --git a/sys/sys/ktls.h b/sys/sys/ktls.h index 6c7e7d3c5ee3..3e3f0b77e4a2 100644 --- a/sys/sys/ktls.h +++ b/sys/sys/ktls.h @@ -28,6 +28,7 @@ #define _SYS_KTLS_H_ #ifdef _KERNEL +#include #include #include #include @@ -285,6 +286,17 @@ ktls_free(struct ktls_session *tls) ktls_destroy(tls); } +static inline void +ktls_release_snd_tag(struct ktls_session *tls) +{ + struct m_snd_tag *mst; + + mst = tls->snd_tag; + tls->snd_tag = NULL; + if (mst != NULL) + m_snd_tag_rele(mst); +} + void ktls_session_to_xktls_onedir(const struct ktls_session *ks, bool export_keys, struct xktls_session_onedir *xktls_od); void ktls_session_copy_keys(const struct ktls_session *ktls,