1.\" 2.\" SPDX-License-Identifier: BSD-2-Clause 3.\" 4.\" Copyright (c) 2003 Sam Leffler, Errno Consulting 5.\" All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.Dd November 22, 2024 29.Dt SAFE 4 30.Os 31.Sh NAME 32.Nm safe 33.Nd SafeNet SafeXcel 1141/1741 crypto accelerator 34.Sh SYNOPSIS 35To compile this driver into the kernel, 36place the following lines in your 37kernel configuration file: 38.Bd -ragged -offset indent 39.Cd "device crypto" 40.Cd "device cryptodev" 41.Cd "device safe" 42.Ed 43.Pp 44Alternatively, to load the driver as a 45module at boot time, place the following line in 46.Xr loader.conf 5 : 47.Bd -literal -offset indent 48safe_load="YES" 49.Ed 50.Pp 51In 52.Xr sysctl.conf 5 : 53.Bd -ragged -offset indent 54.Cd hw.safe.debug 55.Cd hw.safe.dump 56.Cd hw.safe.rnginterval 57.Cd hw.safe.rngbufsize 58.Cd hw.safe.rngmaxalarm 59.Ed 60.Sh DESCRIPTION 61The 62.Nm 63driver supports cards containing SafeNet crypto accelerator chips. 64.Pp 65The 66.Nm 67driver registers itself to accelerate AES, 68SHA1-HMAC, and NULL operations for 69.Xr ipsec 4 70and 71.Xr crypto 4 . 72.Pp 73On all models, the driver registers itself to provide random data to the 74.Xr random 4 75subsystem. 76Periodically the driver will poll the hardware RNG and retrieve 77data for use by the system. 78If the driver detects that the hardware RNG is resonating with any local 79signal, it will reset the oscillators that generate random data. 80Three 81.Xr sysctl 8 82settings control this procedure: 83.Va hw.safe.rnginterval 84specifies the time, in seconds, between polling operations, 85.Va hw.safe.rngbufsize 86specifies the number of 32-bit words to retrieve on each poll, 87and 88.Va hw.safe.rngmaxalarm 89specifies the threshold for resetting the oscillators. 90.Pp 91When the driver is compiled with 92.Dv SAFE_DEBUG 93defined, two 94.Xr sysctl 8 95variables are provided for debugging purposes: 96.Va hw.safe.debug 97can be set to a non-zero value to enable debugging messages to be sent 98to the console for each cryptographic operation, 99.Va hw.safe.dump 100is a write-only variable that can be used to force driver state to be sent 101to the console. 102Set this variable to 103.Dq Li ring 104to dump the current state of the descriptor ring, 105to 106.Dq Li dma 107to dump the hardware DMA registers, 108or 109to 110.Dq Li int 111to dump the hardware interrupt registers. 112.Sh HARDWARE 113The 114.Nm 115driver supports the following SafeXcel chips: 116.Bl -column "SafeNet 1141" "The original chipset. Supports" -offset indent 117.It SafeNet 1141 Ta The original chipset. 118Supports DES, Triple-DES, AES, MD5, and SHA-1 119symmetric crypto operations, RNG, public key operations, and full IPsec 120packet processing. 121.It SafeNet 1741 Ta A faster version of the 1141. 122.El 123.Sh SEE ALSO 124.Xr crypt 3 , 125.Xr crypto 4 , 126.Xr intro 4 , 127.Xr ipsec 4 , 128.Xr random 4 , 129.Xr crypto 7 , 130.Xr crypto 9 131.Sh BUGS 132Public key support is not implemented. 133