some ciphers get locked into arm8crypto for use with .eli for encrypted swap partition

JonathanLee

Hello fellow Netgate Community Members,

I wanted to share this research after many hours of testing I also realize this is not supported on pfsense plus but if anyone else uses swap and has attempted .eli

https://redmine.pfsense.org/issues/16755

On the Netgate 2100 (and potentially other ARM-based Marvell Armada 3720 devices) running pfSense Plus (verified on 23.05.01), there is a documented race condition between the GELI (.eli) encrypted swap initialization and the SafeXcel cryptographic driver (safexcel.ko).
When GELI is enabled for swap in /etc/fstab, it often initializes before the SafeXcel driver can register its cryptographic hooks with the Open Crypto Framework (OCF). This results in the SafeXcel hardware being "attached" but "inactive" for VPN offloading, forcing the system to fall back to software encryption without notifying the user.

@stephenw10 I wanted to share this finding .eli does hijack ciphers, I think I asked you about this a couple years ago or someone. Just a for your information thing

"WARNING: Some ciphers are locked into arm8crypto for use with .eli for encrypted swap partition"

andymek

@JonathanLee

This is a very interesting observation. It looks like the issue is not just the driver itself, but the timing of when GELI for swap is initialized compared to when the SafeXcel crypto driver becomes available in OCF.

If GELI attaches early it may bind to arm8crypto by default and that choice does not get revisited later when hardware acceleration is ready. That would explain why the hardware shows as present but is not actually used.

It might be worth checking if delaying swap initialization or loading the safexcel module earlier in the boot process changes the behavior. This could help confirm whether the problem is purely initialization order.

JonathanLee

@andymek I think it does work if you were to initialize the swap and attach it as .eli after the system is booted with a script. But it's a race condition and it hijacks the ciphers if you let fstab do it all.