26.3 rebase

.github/ai-opt-out

@@ -0,0 +1 @@
+opt-out: true

.github/workflows/gen-matrix.py

@@ -30,7 +30,7 @@
 
 Uses all-pairs (pairwise) coverage over compiler x standard x mode x
 arch for the regular builds, plus an explicit list of special-purpose
-jobs (dpdk, cxx-modules, fuzz). All-pairs guarantees that every pair
+jobs (dual TLS, OpenSSL TLS, fuzz). All-pairs guarantees that every pair
 of parameter values is exercised by at least one job, with far fewer
 combinations than the full cartesian product. Excluded pairs (see
 EXCLUDED_PAIRS) drop out of regular coverage. The file is round-tripped
@@ -105,19 +105,17 @@ def _keep_row(row: list[Any]) -> bool:
         "compiler": "clang++-22",
         "standard": 23,
         "arch": "x86",
-        "mode": "release",
-        "enables": "--enable-dpdk",
-        "options": "--cook dpdk --dpdk-machine corei7-avx",
-        "info": "dpdk, ",
+        "mode": "debug",
+        "options": "--tls-mode=both",
+        "info": "dual TLS, ",
     },
     {
         "compiler": "clang++-22",
         "standard": 23,
         "arch": "x86",
         "mode": "debug",
-        "enables": "--enable-cxx-modules",
-        "enable-ccache": False,
-        "info": "modules, ",
+        "options": "--tls-mode=openssl",
+        "info": "OpenSSL TLS, ",
     },
     {
         "compiler": "clang++-22",

.github/workflows/tests.yaml

@@ -32,8 +32,8 @@ jobs:
           - {compiler: clang++-21, standard: 26, mode: sanitize, arch: x86}
           - {compiler: clang++-21, standard: 26, mode: debug, arch: arm}
           - {compiler: clang++-22, standard: 23, arch: x86, mode: dev}
-          - {compiler: clang++-22, standard: 23, arch: x86, mode: release, enables: --enable-dpdk, options: --cook dpdk --dpdk-machine corei7-avx, info: 'dpdk, '}
-          - {compiler: clang++-22, standard: 23, arch: x86, mode: debug, enables: --enable-cxx-modules, enable-ccache: false, info: 'modules, '}
+          - {compiler: clang++-22, standard: 23, arch: x86, mode: debug, options: --tls-mode=both, info: 'dual TLS, '}
+          - {compiler: clang++-22, standard: 23, arch: x86, mode: debug, options: --tls-mode=openssl, info: 'OpenSSL TLS, '}
           - {compiler: clang++-22, standard: 23, arch: x86, mode: fuzz, test-args: -- -R 'Seastar.fuzz.'}
     with:
       compiler: ${{ matrix.compiler }}

CMakeLists.txt

@@ -421,6 +421,35 @@ set (Seastar_GEN_BINARY_DIR ${Seastar_BINARY_DIR}/gen)
 include (SeastarDependencies)
 seastar_find_dependencies ()
 
+# unordered_dense is header-only and not reliably packaged by distributions.
+# When seastar_find_dependencies() did not locate an installed copy (e.g. in
+# CI), fetch the pinned version so the build is self-contained. This lives in
+# the Seastar build only, not in SeastarDependencies, so consumers that use
+# find_package(Seastar) never trigger a download.
+if (NOT TARGET unordered_dense::unordered_dense)
+  include (FetchContent)
+  FetchContent_Declare (unordered_dense
+    URL https://github.com/martinus/unordered_dense/archive/f30ed41b58af8c79788e8581fe57a6faf856258e.tar.gz
+    URL_HASH MD5=0370e4a35c1e573aa6639fde97f0c93f)
+  FetchContent_GetProperties (unordered_dense)
+  if (NOT unordered_dense_POPULATED)
+    # Populate (download) only; we deliberately do not add it as a subproject
+    # (see below). CMP0169 OLD keeps the bare Populate() form available.
+    if (POLICY CMP0169)
+      cmake_policy (SET CMP0169 OLD)
+    endif ()
+    FetchContent_Populate (unordered_dense)
+  endif ()
+  # Expose the fetched headers as an IMPORTED target rather than building it as
+  # a subproject, so that install(EXPORT) for Seastar (which PUBLIC-links it)
+  # does not require exporting a fetched target. Downstream consumers resolve
+  # unordered_dense themselves via SeastarDependencies.
+  add_library (unordered_dense_fetched INTERFACE IMPORTED GLOBAL)
+  set_target_properties (unordered_dense_fetched PROPERTIES
+    INTERFACE_INCLUDE_DIRECTORIES "${unordered_dense_SOURCE_DIR}/include")
+  add_library (unordered_dense::unordered_dense ALIAS unordered_dense_fetched)
+endif ()
+
 # Private build dependencies not visible to consumers
 find_package (ragel 6.10 REQUIRED)
 find_package (Threads REQUIRED)
@@ -529,11 +558,13 @@ seastar_generate_protobuf (
   IN_FILE ${CMAKE_CURRENT_SOURCE_DIR}/src/proto/metrics2.proto
   OUT_DIR ${Seastar_GEN_BINARY_DIR}/src/proto)
 
-set_option_if_package_is_found (Seastar_GNUTLS GnuTLS)
-set_option_if_package_is_found (Seastar_OPENSSL OpenSSL)
+option (Seastar_GNUTLS "Enable the GnuTLS-based TLS backend" ON)
+option (Seastar_OPENSSL "Enable the OpenSSL-based TLS backend" OFF)
 
 if (NOT Seastar_GNUTLS AND NOT Seastar_OPENSSL)
-  message (FATAL_ERROR "At least one TLS/crypto backend is required. Install GnuTLS or OpenSSL development packages.")
+  message (FATAL_ERROR "At least one TLS backend must be enabled. "
+    "Pass -DSeastar_GNUTLS=ON and/or -DSeastar_OPENSSL=ON, "
+    "or use configure.py --tls-mode=gnutls|openssl|both.")
 endif ()
 
 add_library (seastar
@@ -552,6 +583,9 @@ add_library (seastar
   include/seastar/core/cacheline.hh
   include/seastar/core/checked_ptr.hh
   include/seastar/core/chunked_fifo.hh
+  include/seastar/core/chunked_hash_map.hh
+  include/seastar/core/chunked_vector.hh
+  include/seastar/core/chunked_vector_async.hh
   include/seastar/core/circular_buffer.hh
   include/seastar/core/circular_buffer_fixed_capacity.hh
   include/seastar/core/condition-variable.hh
@@ -725,6 +759,7 @@ add_library (seastar
   src/core/reactor_backend.cc
   src/core/thread_pool.cc
   src/core/app-template.cc
+  src/core/cpu_profiler.cc
   src/core/disk_params.cc
   src/core/dpdk_rte.cc
   src/core/exception_hacks.cc
@@ -758,6 +793,7 @@ add_library (seastar
   src/core/semaphore.cc
   src/core/condition-variable.cc
   src/core/crypto.cc
+  src/core/signal_mutex.cc
   src/http/api_docs.cc
   src/http/common.cc
   src/http/file_handler.cc
@@ -920,6 +956,8 @@ target_link_libraries (seastar
     c-ares::cares
     fmt::fmt
     lz4::lz4
+    unordered_dense::unordered_dense
+    absl::hash
   PRIVATE
     ${CMAKE_DL_LIBS}
     StdAtomic::atomic
@@ -1143,6 +1181,15 @@ if (Seastar_OPENSSL)
     PRIVATE OpenSSL::SSL OpenSSL::Crypto)
 endif ()
 
+if (Seastar_GNUTLS AND Seastar_OPENSSL)
+  # Public marker: both TLS backends are compiled in, so the active backend is
+  # selected at reactor startup. Code that needs to handle the no-reactor case
+  # (e.g. static initializers, unit tests without a reactor) can use this to
+  # distinguish from the single-backend builds where the backend is fixed at
+  # compile time and available unconditionally.
+  target_compile_definitions (seastar PUBLIC SEASTAR_TLS_DUAL_BACKEND)
+endif ()
+
 set_option_if_package_is_found (Seastar_IO_URING LibUring)
 if (Seastar_IO_URING)
   target_compile_definitions (seastar

apps/memcached/memcache.cc

@@ -893,7 +893,7 @@ class ascii_protocol {
 private:
     static void append(std::vector<temporary_buffer<char>>& bufs, const char* buf, size_t size) {
         if (size) {
-            bufs.emplace_back(const_cast<char*>(buf), size, deleter());
+            bufs.push_back(temporary_buffer<char>::maybe_unsafe_from_deleter(const_cast<char*>(buf), size, deleter()));
         }
     }
 
@@ -917,7 +917,7 @@ class ascii_protocol {
 
         append(bufs, msg_crlf);
         append(bufs, item->value());
-        bufs.emplace_back(const_cast<char*>(msg_crlf), strlen(msg_crlf), make_deleter([item = std::move(item)]{}));
+        bufs.push_back(temporary_buffer<char>::maybe_unsafe_from_deleter(const_cast<char*>(msg_crlf), strlen(msg_crlf), make_deleter([item = std::move(item)]{})));
     }
 
     template <bool WithVersion>

cmake/SeastarDependencies.cmake

@@ -99,6 +99,11 @@ macro (seastar_find_dependencies)
       "to build a newer fmt locally.")
   endif ()
   seastar_find_dep (lz4 1.7.3 REQUIRED)
+  # Not REQUIRED: unordered_dense is header-only and not reliably packaged by
+  # distributions. When it is not installed, Seastar's own build fetches it
+  # (see CMakeLists.txt); consumers that lack it must provide it themselves.
+  seastar_find_dep (unordered_dense)
+  seastar_find_dep (absl CONFIG REQUIRED)
   seastar_find_dep (GnuTLS 3.7.4)
   seastar_find_dep (OpenSSL 3.0)
   if (Seastar_IO_URING)

configure.py

@@ -173,6 +173,9 @@ def resolve_compilers_for_compiler_cache(args, compiler_cache):
 arg_parser.add_argument('--verbose', dest='verbose', action='store_true', help='Make configure output more verbose.')
 arg_parser.add_argument('--scheduling-groups-count', action='store', dest='scheduling_groups_count', default='16',
                         help='Number of available scheduling groups in the reactor')
+arg_parser.add_argument('--tls-mode', action='store', dest='tls_mode',
+                        choices=['gnutls', 'openssl', 'both'], default='gnutls',
+                        help='TLS backend(s) to enable: gnutls (default), openssl, or both')
 
 add_tristate(
     arg_parser,
@@ -294,6 +297,8 @@ def configure_mode(mode):
         '-DBUILD_SHARED_LIBS={}'.format('yes' if mode in ('debug', 'dev') else 'no'),
         '-DSeastar_API_LEVEL={}'.format(args.api_level),
         '-DSeastar_SCHEDULING_GROUPS_COUNT={}'.format(args.scheduling_groups_count),
+        '-DSeastar_GNUTLS={}'.format('ON' if args.tls_mode in ('gnutls', 'both') else 'OFF'),
+        '-DSeastar_OPENSSL={}'.format('ON' if args.tls_mode in ('openssl', 'both') else 'OFF'),
         tr(args.exclude_tests, 'EXCLUDE_TESTS_FROM_ALL'),
         tr(args.exclude_apps, 'EXCLUDE_APPS_FROM_ALL'),
         tr(args.exclude_demos, 'EXCLUDE_DEMOS_FROM_ALL'),

cooking_recipe.cmake

@@ -336,3 +336,21 @@ cooking_ingredient (lz4
     CONFIGURE_COMMAND <DISABLE>
     BUILD_COMMAND <DISABLE>
     INSTALL_COMMAND ${make_command} PREFIX=<INSTALL_DIR> install)
+
+# Header-only library used by chunked_hash_map. Pinned to the same commit
+# (v4.4.0) consumed by Redpanda.
+cooking_ingredient (unordered_dense
+  EXTERNAL_PROJECT_ARGS
+    URL https://github.com/martinus/unordered_dense/archive/f30ed41b58af8c79788e8581fe57a6faf856258e.tar.gz
+    URL_MD5 0370e4a35c1e573aa6639fde97f0c93f)
+
+# Used by chunked_hash_map for absl::Hash support. Pinned to the same LTS
+# release (20250814.1) consumed by Redpanda.
+cooking_ingredient (absl
+  EXTERNAL_PROJECT_ARGS
+    URL https://github.com/abseil/abseil-cpp/releases/download/20250814.1/abseil-cpp-20250814.1.tar.gz
+    URL_MD5 d4d3c25f78e28d61ad83e54cd1116933
+  CMAKE_ARGS
+    -DABSL_PROPAGATE_CXX_STD=ON
+    -DABSL_ENABLE_INSTALL=ON
+    -DBUILD_TESTING=OFF)

demos/line_count_demo.cc

@@ -42,14 +42,14 @@ struct reader {
     size_t count = 0;
 
     // for input_stream::consume():
-    using unconsumed_remainder = std::optional<temporary_buffer<char>>;
-    future<unconsumed_remainder> operator()(temporary_buffer<char> data) {
+    using consumption_result_type = consumption_result<char>;
+    future<consumption_result_type> operator()(temporary_buffer<char> data) {
         if (data.empty()) {
-            return make_ready_future<unconsumed_remainder>(std::move(data));
+            return make_ready_future<consumption_result_type>(stop_consuming<char>{std::move(data)});
         } else {
             count += std::count(data.begin(), data.end(), '\n');
             // FIXME: last line without \n?
-            return make_ready_future<unconsumed_remainder>();
+            return make_ready_future<consumption_result_type>(continue_consuming{});
         }
     }
 };

demos/udp_zero_copy_demo.cc

@@ -107,7 +107,7 @@ class server {
                     if (_copy) {
                         bufs.emplace_back(temporary_buffer<char>(chunk, _chunk_size));
                     } else {
-                        bufs.emplace_back(temporary_buffer<char>(chunk, _chunk_size, deleter()));
+                        bufs.emplace_back(temporary_buffer<char>::maybe_unsafe_from_deleter(chunk, _chunk_size, deleter()));
                     }
                     chunk += _chunk_size;
                 }