From 69cf816f8052f37a8faf2cc42b5267a8bfa2c4e6 Mon Sep 17 00:00:00 2001 From: JackDoan Date: Wed, 29 Jul 2026 17:19:32 -0500 Subject: [PATCH] inside: mark traffic-out once per superpacket, not per segment sendInsideEncrypt ran connectionManager.Out for every segment -- up to ~45 extra atomic stores per TSO superpacket, all inside writeLock when boring crypto serializes encryption. One mark in sendInsideMessage covers the whole superpacket on both the direct and relay paths. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_014ugV2edVqoz3tBvq9J6yWp --- inside.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/inside.go b/inside.go index c8a18b03..f484667c 100644 --- a/inside.go +++ b/inside.go @@ -126,7 +126,6 @@ func (f *Interface) sendInsideEncrypt(hostinfo *HostInfo, ci *ConnectionState, s c := ci.messageCounter.Add(1) out := header.Encode(scratch, header.Version, header.Message, 0, hostinfo.remoteIndexId, c) - f.connectionManager.Out(hostinfo) out, encErr := ci.eKey.EncryptDanger(out, out, seg, c, nb) if noiseutil.EncryptLockNeeded { @@ -159,6 +158,11 @@ func (f *Interface) sendInsideMessage(hostinfo *HostInfo, pkt tio.Packet, nb []b return } + // One traffic-out mark covers every segment of the superpacket; doing it + // per segment in sendInsideEncrypt paid an atomic store up to ~45 extra + // times per TSO packet, inside writeLock under boring crypto. + f.connectionManager.Out(hostinfo) + remote := hostinfo.GetRemote() ecnEnabled := f.ecnEnabled.Load() if hostinfo.lastRebindCount != f.rebindCount {