There are 2 classes of accelerators -- lookaside and inline. The lookaside accelerators (like QAT) sit on the PCIe bus and DMA plaintext into the accelerator,

There are 2 classes of accelerators -- lookaside and inline. The lookaside accelerators (like QAT) sit on the PCIe bus and DMA plaintext into the accelerator, and DMA encrypted data out. This offloads the CPU, but it does not help with memory bandwidth. Since memory bandwidth is our biggest bottleneck, they don't help. Inline accelerators are "smart nics". The NIC DMAs a pre-formatted TLS record in plain text inside a (series of) TCP packet(s) from the host, encrypts it, and sends it in an almost stateless way. This is what we call "NIC TLS" in FreeSD. Sadly, the inline accelerators we've tried all have fatal flaws which prevent us from using them. I cannot get into those flaws for NDA reasons, but we're hopeful that there will be one that we can use soon.