PH30197: ACTIVATE HEAPPOOLS64 OPTION FOR TLS PROCESSING

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• The performance of SSL/TLS processing can be significantly
  impacted by contention on the LE heap latch.  The situation can
  be made worse when there are a flood of new requests that all
  require a handshake to take place and the cipher selected is
  implemented in software rather than hardware.
  
  In this situation it is possible that some CWXN transactions
  are dispatched for an extended period of time.  The task will
  report high USRDISPT and KY8DISPT values and low USRCPUT and
  KY8CPUT values.
  
  Currently CICS uses an LE enclave for the TLS processing.  The
  runtime options specify HEAPPOOLS64(OFF).
  
  This APAR will change the HEAPPOOLS64 option to be ON.  This
  will remove the contention on the heap latch and avoid the
  performance degradation.
  
  Additional Keywords:
  CEEOGLAT  CELQVFHP  CELQVGHP
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS users.                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: Excessive CPU usage and response times  *
  *                      when processing TLS handshakes due to   *
  *                      contention on the LE heap latch.        *
  ****************************************************************
  CICS is processing a large volume of TLS handshakes.  This
  requires System SSL to get and free large amounts of relatively
  small storage areas as part of each handshake.  CICS does not
  specify the HEAPPOOLS64=(ON) LE runtime option, so every get and
  free requires the LE heap latch to be obtained.  Additionally,
  every get request requires the entire heap to be searched to
  locate a suitable free area.  The time and CPU required for this
  search increases as the heap grows in response to the workload.
  
  A secondary issue is that the queue of waiters for the LE heap
  latch is managed as a LIFO queue.  This means that when a flood
  of requests arrive the latch can end up being swapped between a
  few active tasks and some task can wait for an extended period
  of time before they can acquire the lock.
  

Problem conclusion

• CICS has been changed to use HEAPPOOLS64 for the LE enclave
  used for TLS processing.  The following option has been added;
  
  HEAPPOOLS64=(ON,
               16,4000,
               32,2000,
               64,1000,
               128,500,
               192,250,
               328,250,
               568,100,
               832,100,
               1120,50,
               1592,50,
               3344,50,
               4800,50)
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI72702 UI72703 UI72704

Modules/Macros

• DFHLEPTO
  

Fix information

• Fixed component name

  CICS TS Z/OS V5

• Fixed component ID

  5655Y0400

Applicable component levels

• R100 PSY UI72704

     UP20/11/24 P F011 ¢

• R200 PSY UI72703

     UP20/11/24 P F011 ¢

• R300 PSY UI72702

     UP20/11/24 P F011 ¢

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.