SafeXcel EIP-97 Full OCF Registration Needed for 26.x - SG-2100

JonathanLee

SafeXcel EIP-97 Full OCF Registration Needed for 26.x - SG-2100

Hi devs,

I've been doing extensive debugging of the SafeXcel EIP-97 crypto accelerator on my SG-2100 Max running pfSense Plus 24.03 and wanted to document the issues clearly for the 26.x development cycle.

Hardware

Device: Netgate SG-2100 Max
Chip: Inside Secure SafeXcel EIP-97
Kernel: FreeBSD 15.0-CURRENT plus-RELENG_24_03-n256311-e71f834dd81
kern.osreldate: 1500012

Issue 1 — SafeXcel Only Registering AES-CBC with OCF

The SafeXcel driver attaches successfully but only registers AES-CBC variants with the Open Crypto Framework:

Cipher AES-128-CBC, driver=safexcel0 (hw accelerated)
Cipher AES-192-CBC, driver=safexcel0 (hw accelerated)
Cipher AES-256-CBC, driver=safexcel0 (hw accelerated)

The EIP-97 hardware is capable of accelerating:

AES-CBC, AES-GCM, AES-XTS, AES-CTR, AES-CCM
SHA1, SHA256, SHA384, SHA512
HMAC-SHA256, HMAC-SHA512
3DES-CBC
ChaCha20-Poly1305

Confirmed via strings /boot/kernel/safexcel.ko — GCM, XTS, CTR, CCM algorithm strings are absent from the compiled driver. Only HMAC-SHA256/512 and AES-CBC are present.

The OCF hooks are present in 24.03:

cryptodev_probesession_desc
cryptodev_newsession_desc
cryptodev_process_desc

But the algorithm registration is incomplete.

Issue 2 — armv8crypto Competing with SafeXcel

armv8crypto is compiled directly into the kernel (not a loadable module) and registers AES-CBC, AES-XTS, and AES-GCM before SafeXcel can claim them:

armv8crypto0: <AES-CBC,AES-XTS,AES-GCM>
safexcel0: <SafeXcel EIP-97 crypto accelerator>  ← no algorithms listed

Workaround found: Adding hint.armv8crypto.0.disabled="1" to /boot/loader.conf.local successfully disables armv8crypto at boot, allowing SafeXcel to own AES-CBC. However SafeXcel still only registers AES-CBC due to Issue 1.

Issue 3 — GELI Encrypted Swap Triggering armv8crypto Race

Having .eli in /etc/fstab for encrypted swap causes GELI to initialize AES-XTS via armv8crypto very early in boot before SafeXcel can register. This was confirmed to be a contributing factor to the algorithm registration race condition.

Fix: Remove .eli from fstab and disable armv8crypto via loader hint.

Issue 4 — Upstream FreeBSD safexcel.ko Incompatible

Attempted to build upstream FreeBSD safexcel.c (which has full OCF registration including AES-GCM, AES-XTS, SHA, HMAC) against the pfSense Plus kernel. The module compiled successfully for aarch64 but crashed on load:

Fatal data abort:
simplebus_alloc_resource() at simplebus_alloc_resource+0x70
safexcel_attach() at safexcel_attach+0xcc
panic: vm_fault failed: 0xffff00000024c5e0 error 1

Identified and fixed bus_release_resource_old symbol mismatch (Netgate kernel uses newer 2-argument signature). However the crash persisted at simplebus_alloc_resource+0x70 — a null pointer dereference during resource allocation that we were unable to resolve without Netgate's private kernel headers.

All struct layouts verified identical between upstream and Netgate kernel via DWARF debug symbols from pfSense-kernel-debug-pfSense-24.03.pkg.

What's Needed for 26.x

Full SafeXcel OCF registration — AES-GCM, AES-XTS, AES-CTR, SHA256, SHA512, HMAC registered with OCF so they offload to hardware
armv8crypto priority resolution — Either remove armv8crypto from kernel config when SafeXcel is present, or implement proper driver priority so SafeXcel wins
Confirmation — Stephen mentioned 25.11 has this fixed — can this be confirmed and carried forward to 26.x?

Why This Matters

The SG-2100 was marketed with hardware crypto acceleration. Without full SafeXcel registration, IPsec and OpenVPN tunnels using AES-GCM (the most common modern cipher) fall back to cryptosoft — burning CPU cycles on dedicated silicon that should be handling it.

For a device running Squid SSL inspection, Snort IDS, OpenVPN, and IPsec simultaneously, having AES-GCM hardware offloaded to SafeXcel would make a significant real-world performance difference.

References

strings /boot/kernel/safexcel.ko — confirms GCM/XTS absent
kern.osreldate: 1500012
Kernel: plus-RELENG_24_03-n256311-e71f834dd81
Debug symbols analyzed from pfSense-kernel-debug-pfSense-24.03.pkg
Stephen (stephenw10) I think he confirmed fix in 25.11 but SG-2100 has pcie driver issues preventing my upgrade

Thank you for considering this for 26.x.

JonathanLee

I do know its a bit slower... its ok I am able to do teams and alot of other things when the safexcel is working it creates a resource allotment adjustment where I can watch movies be on a teams call and have the vpn accessing the nas without issues with it running

marcosm

It sounds like some of these things could have already been resolved upstream. Testing on something recent, preferably 26.03, would help reduce scope and help towards resolution.