Re: [PATCH net-next v14 0/9] tls: Add TLS 1.3 hardware offload support

[Nils Juenemann <nils.juenemann@gmail.com>]

On Tue, Jul 7, 2026 at 5:31 PM Rishikesh Jethwani <rjethwani@everpuredata.com> wrote:
>
> Could you post the disassembly [...] count how many distinct loads of
> sk+0x4f8 the compiler emitted in that region.

objdump of mlx5e_ktls_handle_rx_skb, CQE_TLS_OFFLOAD_RESYNC branch
(+0x63) through RIP+0x10a; bytes match the oops Code around the fault:

  11bd03:	48 83 82 90 01 00 00 	addq   $0x1,0x190(%rdx)
  11bd0a:	01
  11bd0b:	48 8b b6 d0 00 00 00 	mov    0xd0(%rsi),%rsi
  11bd12:	49 89 fc             	mov    %rdi,%r12
  11bd15:	4c 8b b7 00 01 00 00 	mov    0x100(%rdi),%r14
  11bd1c:	0f b7 46 0c          	movzwl 0xc(%rsi),%eax
  11bd20:	4d 8b be 08 01 00 00 	mov    0x108(%r14),%r15
  11bd27:	66 3d 81 00          	cmp    $0x81,%ax
  11bd2b:	0f 84 a4 01 00 00    	je     11bed5 <mlx5e_ktls_handle_rx_skb+0x235>
  11bd31:	66 3d 88 a8          	cmp    $0xa888,%ax
  11bd35:	0f 84 9a 01 00 00    	je     11bed5 <mlx5e_ktls_handle_rx_skb+0x235>
  11bd3b:	0f b7 43 78          	movzwl 0x78(%rbx),%eax
  11bd3f:	49 89 c5             	mov    %rax,%r13
  11bd42:	48 01 c6             	add    %rax,%rsi
  11bd45:	45 8b 8e e0 00 00 00 	mov    0xe0(%r14),%r9d
  11bd4c:	0f b6 06             	movzbl (%rsi),%eax
  11bd4f:	83 e0 f0             	and    $0xfffffff0,%eax
  11bd52:	3c 40                	cmp    $0x40,%al
  11bd54:	0f 84 a8 01 00 00    	je     11bf02 <mlx5e_ktls_handle_rx_skb+0x262>
  11bd5a:	44 0f b7 46 2a       	movzwl 0x2a(%rsi),%r8d
  11bd5f:	41 8d 45 28          	lea    0x28(%r13),%eax
  11bd63:	0f b7 56 28          	movzwl 0x28(%rsi),%edx
  11bd67:	4c 89 ff             	mov    %r15,%rdi
  11bd6a:	89 45 d4             	mov    %eax,-0x2c(%rbp)
  11bd6d:	48 8d 4e 18          	lea    0x18(%rsi),%rcx
  11bd71:	4c 8d 76 28          	lea    0x28(%rsi),%r14
  11bd75:	48 83 c6 08          	add    $0x8,%rsi
  11bd79:	6a 00                	push   $0x0
  11bd7b:	66 41 c1 c0 08       	rol    $0x8,%r8w
  11bd80:	45 0f b7 c0          	movzwl %r8w,%r8d
  11bd84:	e8 00 00 00 00       	call   11bd89 <mlx5e_ktls_handle_rx_skb+0xe9>
  11bd89:	49 89 c7             	mov    %rax,%r15
  11bd8c:	58                   	pop    %rax
  11bd8d:	4d 85 ff             	test   %r15,%r15
  11bd90:	0f 84 4a ff ff ff    	je     11bce0 <mlx5e_ktls_handle_rx_skb+0x40>
  11bd96:	41 0f b6 47 12       	movzbl 0x12(%r15),%eax
  11bd9b:	3c 06                	cmp    $0x6,%al
  11bd9d:	0f 84 cc 00 00 00    	je     11be6f <mlx5e_ktls_handle_rx_skb+0x1cf>
  11bda3:	49 8b 87 f8 04 00 00 	mov    0x4f8(%r15),%rax
  11bdaa:	48 8b 40 30          	mov    0x30(%rax),%rax

One load of sk+0x4f8 in this range, at 11bda3 (the fault). r15 only
becomes sk at 11bd89 (mov %rax,%r15), so there is no sk+0x4f8
dereference before 11bda3 in this range. The only other sk+0x4f8
load in the function is 11be20, after the fault and not reached. So my
earlier "two independent loads, second reading NULL" was wrong.

Thanks,
Nils