Index: sys/kern/uipc_ktls.c
===================================================================
--- sys/kern/uipc_ktls.c
+++ sys/kern/uipc_ktls.c
@@ -95,6 +95,7 @@
 LIST_HEAD(, ktls_crypto_backend) ktls_backends;
 static struct rmlock ktls_backends_lock;
 static uma_zone_t ktls_session_zone;
+static uma_zone_t ktls_buffer_zone;
 static uint16_t ktls_cpuid_lookup[MAXCPU];
 
 SYSCTL_NODE(_kern_ipc, OID_AUTO, tls, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
@@ -116,7 +117,7 @@
     "Bind crypto threads to cores (1) or cores and domains (2) at boot");
 
 static u_int ktls_maxlen = 16384;
-SYSCTL_UINT(_kern_ipc_tls, OID_AUTO, maxlen, CTLFLAG_RWTUN,
+SYSCTL_UINT(_kern_ipc_tls, OID_AUTO, maxlen, CTLFLAG_RDTUN,
     &ktls_maxlen, 0, "Maximum TLS record size");
 
 static int ktls_number_threads;
@@ -382,8 +383,10 @@
 
 	ktls_session_zone = uma_zcreate("ktls_session",
 	    sizeof(struct ktls_session),
-	    NULL, NULL, NULL, NULL,
-	    UMA_ALIGN_CACHE, 0);
+	    NULL, NULL, NULL, NULL, UMA_ALIGN_CACHE, 0);
+
+	ktls_buffer_zone = uma_zcreate("ktls_buffers", PAGE_SIZE,
+	    NULL, NULL, NULL, NULL, PAGE_SIZE - 1, UMA_ZONE_NODUMP);
 
 	/*
 	 * Initialize the workqueues to run the TLS work.  We create a
@@ -2014,7 +2017,7 @@
 	vm_paddr_t parray[1 + btoc(TLS_MAX_MSG_SIZE_V10_2)];
 	struct iovec src_iov[1 + btoc(TLS_MAX_MSG_SIZE_V10_2)];
 	struct iovec dst_iov[1 + btoc(TLS_MAX_MSG_SIZE_V10_2)];
-	vm_page_t pg;
+	void *buf;
 	int error, i, len, npages, off, total_pages;
 	bool is_anon;
 
@@ -2080,16 +2083,10 @@
 				dst_iov[i].iov_len = src_iov[i].iov_len;
 				continue;
 			}
-retry_page:
-			pg = vm_page_alloc(NULL, 0, VM_ALLOC_NORMAL |
-			    VM_ALLOC_NOOBJ | VM_ALLOC_NODUMP | VM_ALLOC_WIRED);
-			if (pg == NULL) {
-				vm_wait(NULL);
-				goto retry_page;
-			}
-			parray[i] = VM_PAGE_TO_PHYS(pg);
-			dst_iov[i].iov_base =
-			    (char *)(void *)PHYS_TO_DMAP(parray[i]) + off;
+
+			buf = uma_zalloc(ktls_buffer_zone, M_WAITOK);
+			parray[i] = vtophys(buf);
+			dst_iov[i].iov_base = (char *)buf + off;
 			dst_iov[i].iov_len = len;
 		}