Index: head/sys/dev/cxgbe/common/common.h
===================================================================
--- head/sys/dev/cxgbe/common/common.h
+++ head/sys/dev/cxgbe/common/common.h
@@ -246,6 +246,8 @@
 
 	uint32_t vlan_pri_map;
 	uint32_t ingress_config;
+	uint32_t max_rx_pdu;
+	uint32_t max_tx_pdu;
 	uint64_t hash_filter_mask;
 	__be16 err_vec_mask;
 
Index: head/sys/dev/cxgbe/common/t4_hw.c
===================================================================
--- head/sys/dev/cxgbe/common/t4_hw.c
+++ head/sys/dev/cxgbe/common/t4_hw.c
@@ -9614,7 +9614,7 @@
 int t4_init_tp_params(struct adapter *adap, bool sleep_ok)
 {
 	int chan;
-	u32 v;
+	u32 tx_len, rx_len, r, v;
 	struct tp_params *tpp = &adap->params.tp;
 
 	v = t4_read_reg(adap, A_TP_TIMER_RESOLUTION);
@@ -9640,6 +9640,21 @@
 			    htobe16(V_T6_COMPR_RXERR_VEC(M_T6_COMPR_RXERR_VEC));
 		}
 	}
+
+	rx_len = t4_read_reg(adap, A_TP_PMM_RX_PAGE_SIZE);
+	tx_len = t4_read_reg(adap, A_TP_PMM_TX_PAGE_SIZE);
+
+	r = t4_read_reg(adap, A_TP_PARA_REG2);
+	rx_len = min(rx_len, G_MAXRXDATA(r));
+	tx_len = min(tx_len, G_MAXRXDATA(r));
+
+	r = t4_read_reg(adap, A_TP_PARA_REG7);
+	v = min(G_PMMAXXFERLEN0(r), G_PMMAXXFERLEN1(r));
+	rx_len = min(rx_len, v);
+	tx_len = min(tx_len, v);
+
+	tpp->max_tx_pdu = tx_len;
+	tpp->max_rx_pdu = rx_len;
 
 	return 0;
 }
Index: head/sys/dev/cxgbe/t4_main.c
===================================================================
--- head/sys/dev/cxgbe/t4_main.c
+++ head/sys/dev/cxgbe/t4_main.c
@@ -736,6 +736,7 @@
 static int sysctl_wcwr_stats(SYSCTL_HANDLER_ARGS);
 static int sysctl_cpus(SYSCTL_HANDLER_ARGS);
 #ifdef TCP_OFFLOAD
+static int sysctl_tls(SYSCTL_HANDLER_ARGS);
 static int sysctl_tls_rx_ports(SYSCTL_HANDLER_ARGS);
 static int sysctl_tp_tick(SYSCTL_HANDLER_ARGS);
 static int sysctl_tp_dack_timer(SYSCTL_HANDLER_ARGS);
@@ -6607,8 +6608,9 @@
 		    CTLFLAG_RW, &sc->tt.rx_coalesce, 0, "receive coalescing");
 
 		sc->tt.tls = 0;
-		SYSCTL_ADD_INT(ctx, children, OID_AUTO, "tls", CTLFLAG_RW,
-		    &sc->tt.tls, 0, "Inline TLS allowed");
+		SYSCTL_ADD_PROC(ctx, children, OID_AUTO, "tls", CTLTYPE_INT |
+		    CTLFLAG_RW | CTLFLAG_NEEDGIANT, sc, 0, sysctl_tls, "I",
+		    "Inline TLS allowed");
 
 		SYSCTL_ADD_PROC(ctx, children, OID_AUTO, "tls_rx_ports",
 		    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, sc, 0,
@@ -9699,6 +9701,37 @@
 }
 
 #ifdef TCP_OFFLOAD
+static int
+sysctl_tls(SYSCTL_HANDLER_ARGS)
+{
+	struct adapter *sc = arg1;
+	int i, j, v, rc;
+	struct vi_info *vi;
+
+	v = sc->tt.tls;
+	rc = sysctl_handle_int(oidp, &v, 0, req);
+	if (rc != 0 || req->newptr == NULL)
+		return (rc);
+
+	if (v != 0 && !(sc->cryptocaps & FW_CAPS_CONFIG_TLSKEYS))
+		return (ENOTSUP);
+
+	rc = begin_synchronized_op(sc, NULL, SLEEP_OK | INTR_OK, "t4stls");
+	if (rc)
+		return (rc);
+	sc->tt.tls = !!v;
+	for_each_port(sc, i) {
+		for_each_vi(sc->port[i], j, vi) {
+			if (vi->flags & VI_INIT_DONE)
+				t4_update_fl_bufsize(vi->ifp);
+		}
+	}
+	end_synchronized_op(sc, 0);
+
+	return (0);
+
+}
+
 static int
 sysctl_tls_rx_ports(SYSCTL_HANDLER_ARGS)
 {
Index: head/sys/dev/cxgbe/t4_sge.c
===================================================================
--- head/sys/dev/cxgbe/t4_sge.c
+++ head/sys/dev/cxgbe/t4_sge.c
@@ -1032,14 +1032,19 @@
 	return (0);
 }
 
-/* Maximum payload that can be delivered with a single iq descriptor */
+/* Maximum payload that could arrive with a single iq descriptor. */
 static inline int
-mtu_to_max_payload(struct adapter *sc, int mtu)
+max_rx_payload(struct adapter *sc, struct ifnet *ifp, const bool ofld)
 {
+	int maxp;
 
 	/* large enough even when hw VLAN extraction is disabled */
-	return (sc->params.sge.fl_pktshift + ETHER_HDR_LEN +
-	    ETHER_VLAN_ENCAP_LEN + mtu);
+	maxp = sc->params.sge.fl_pktshift + ETHER_HDR_LEN +
+	    ETHER_VLAN_ENCAP_LEN + ifp->if_mtu;
+	if (ofld && sc->tt.tls && sc->cryptocaps & FW_CAPS_CONFIG_TLSKEYS &&
+	    maxp < sc->params.tp.max_rx_pdu)
+		maxp = sc->params.tp.max_rx_pdu;
+	return (maxp);
 }
 
 int
@@ -1065,7 +1070,7 @@
 	struct ifnet *ifp = vi->ifp;
 	struct sysctl_oid *oid = device_get_sysctl_tree(vi->dev);
 	struct sysctl_oid_list *children = SYSCTL_CHILDREN(oid);
-	int maxp, mtu = ifp->if_mtu;
+	int maxp;
 
 	/* Interrupt vector to start from (when using multiple vectors) */
 	intr_idx = vi->first_intr;
@@ -1109,7 +1114,7 @@
 	 * Allocate rx queues first because a default iqid is required when
 	 * creating a tx queue.
 	 */
-	maxp = mtu_to_max_payload(sc, mtu);
+	maxp = max_rx_payload(sc, ifp, false);
 	oid = SYSCTL_ADD_NODE(&vi->ctx, children, OID_AUTO, "rxq",
 	    CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "rx queues");
 	for_each_rxq(vi, i, rxq) {
@@ -1131,6 +1136,7 @@
 		intr_idx = saved_idx + max(vi->nrxq, vi->nnmrxq);
 #endif
 #ifdef TCP_OFFLOAD
+	maxp = max_rx_payload(sc, ifp, true);
 	oid = SYSCTL_ADD_NODE(&vi->ctx, children, OID_AUTO, "ofld_rxq",
 	    CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "rx queues for offloaded TCP connections");
 	for_each_ofld_rxq(vi, i, ofld_rxq) {
@@ -2144,9 +2150,9 @@
 	struct sge_ofld_rxq *ofld_rxq;
 #endif
 	struct sge_fl *fl;
-	int i, maxp, mtu = ifp->if_mtu;
+	int i, maxp;
 
-	maxp = mtu_to_max_payload(sc, mtu);
+	maxp = max_rx_payload(sc, ifp, false);
 	for_each_rxq(vi, i, rxq) {
 		fl = &rxq->fl;
 
@@ -2156,6 +2162,7 @@
 		FL_UNLOCK(fl);
 	}
 #ifdef TCP_OFFLOAD
+	maxp = max_rx_payload(sc, ifp, true);
 	for_each_ofld_rxq(vi, i, ofld_rxq) {
 		fl = &ofld_rxq->fl;