Add 11.4 NSS PPoE client

This adds the nss-clients PPoE client from QSDK11.4.

It enables PPoE offloading via NSS ECM.
Kernel patches are required.
Made for and tested on IPQ807x.

Signed-off-by: Robert Marko <robimarko@gmail.com>

qca/qca-nss-clients/Makefile

@@ -0,0 +1,59 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=qca-nss-clients
+PKG_RELEASE:=$(AUTORELEASE)
+
+PKG_SOURCE_URL:=https://source.codeaurora.org/quic/cc-qrdk/oss/lklm/nss-clients
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2021-04-29
+PKG_SOURCE_VERSION:=b93c72c1b72c591c2ddc2f0b24f0e2b457720118
+PKG_MIRROR_HASH:=9fab23da994bfbac9a3cef32cdfec31a87a03ed415f36bc926da32b7b0934259
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/qca-nss-drv-pppoe
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS (connection manager) - PPPoE
+  DEPENDS:=@TARGET_ipq807x +kmod-qca-nss-drv +kmod-pppoe
+  FILES:=$(PKG_BUILD_DIR)/pppoe/qca-nss-pppoe.ko
+  AUTOLOAD:=$(call AutoLoad,51,qca-nss-pppoe)
+endef
+
+define KernelPackage/qca-nss-drv-pppoe/Description
+Kernel modules for NSS connection manager - Support for PPPoE
+endef
+
+EXTRA_CFLAGS+= \
+	-I$(STAGING_DIR)/usr/include/qca-nss-drv \
+	-I$(STAGING_DIR)/usr/include/qca-nss-crypto \
+	-I$(STAGING_DIR)/usr/include/qca-nss-cfi \
+	-I$(STAGING_DIR)/usr/include/qca-nss-gmac \
+	-I$(STAGING_DIR)/usr/include/qca-ssdk \
+	-I$(STAGING_DIR)/usr/include/qca-ssdk/fal \
+	-I$(STAGING_DIR)/usr/include/nat46
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-pppoe),)
+NSS_CLIENTS_MAKE_OPTS+=pppoe=y
+endif
+
+ifeq ($(CONFIG_TARGET_BOARD), "ipq807x")
+    SOC="ipq807x_64"
+else ifeq ($(CONFIG_TARGET_BOARD), "ipq60xx")
+    SOC="ipq60xx_64"
+endif
+
+define Build/Compile
+	$(MAKE) -C "$(LINUX_DIR)" $(strip $(NSS_CLIENTS_MAKE_OPTS)) \
+		CROSS_COMPILE="$(TARGET_CROSS)" \
+		ARCH="$(LINUX_KARCH)" \
+		M="$(PKG_BUILD_DIR)" \
+		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
+		SoC=$(SOC) \
+		$(KERNEL_MAKE_FLAGS) \
+		modules
+endef
+
+$(eval $(call KernelPackage,qca-nss-drv-pppoe))

qca/qca-nss-clients/files/qca-nss-ipsec

@@ -0,0 +1,214 @@
+#!/bin/sh  /etc/rc.common
+#
+# Copyright (c) 2018-2019, 2021 The Linux Foundation. All rights reserved.
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+NSS_IPSEC_LOG_FILE=/tmp/.nss_ipsec_log
+NSS_IPSEC_LOG_STR_ECM="ECM_Loaded"
+NSS_IPSEC_OL_FILE=/tmp/qca_nss_ipsec_ol
+
+ecm_load () {
+	if [ ! -d /sys/module/ecm ]; then
+		/etc/init.d/qca-nss-ecm start
+		if [ -d /sys/module/ecm ]; then
+			echo ${NSS_IPSEC_LOG_STR_ECM} >> ${NSS_IPSEC_LOG_FILE}
+		fi
+	fi
+}
+
+ecm_unload () {
+	if [ -f /tmp/.nss_ipsec_log ]; then
+		str=`grep ${NSS_IPSEC_LOG_STR_ECM} ${NSS_IPSEC_LOG_FILE}`
+		if [[ $str == ${NSS_IPSEC_LOG_STR_ECM} ]]; then
+			/etc/init.d/qca-nss-ecm stop
+			`sed 's/${NSS_IPSEC_LOG_STR_ECM}/ /g' $NSS_IPSEC_LOG_FILE >  $NSS_IPSEC_LOG_FILE`
+		fi
+	fi
+}
+
+ecm_disable() {
+
+	if [ ! -d /sys/module/ecm ]; then
+		return;
+	fi
+
+	echo 1 > /sys/kernel/debug/ecm/front_end_ipv4_stop
+	echo 1 > /sys/kernel/debug/ecm/front_end_ipv6_stop
+	echo 1 > /sys/kernel/debug/ecm/ecm_db/defunct_all
+	sleep 2
+}
+
+ecm_enable() {
+	if [ ! -d /sys/module/ecm ]; then
+		return;
+	fi
+
+	echo 0 > /sys/kernel/debug/ecm/ecm_db/defunct_all
+	echo 0 > /sys/kernel/debug/ecm/front_end_ipv4_stop
+	echo 0 > /sys/kernel/debug/ecm/front_end_ipv6_stop
+}
+
+kernel_version_check_5_4() {
+	major_ver=$(uname -r | awk -F '.' '{print $1}')
+	minor_ver=$(uname -r | awk -F '.' '{print $2}')
+	if [ $major_ver -lt 5 ] || ([ $major_ver -eq 5 ] && [ $minor_ver -lt 4 ] ) ; then
+		return 1
+	else
+		return 0
+	fi
+}
+
+start_klips() {
+	if kernel_version_check_5_4
+	then
+		echo "Kernel 5.4 doesn't support klips stack."
+		return $?
+	fi
+
+	touch $NSS_IPSEC_OL_FILE
+	ecm_load
+
+	local kernel_version=$(uname -r)
+
+	insmod /lib/modules/${kernel_version}/qca-nss-ipsec-klips.ko
+	if [ "$?" -gt 0 ]; then
+		echo "Failed to load plugin. Please start ecm if not done already"
+		ecm_enable
+		rm $NSS_IPSEC_OL_FILE
+		return
+	fi
+
+	/etc/init.d/ipsec start
+	sleep 2
+	ipsec eroute
+
+	ecm_enable
+}
+
+stop_klips() {
+	if kernel_version_check_5_4
+	then
+		echo "Kernel 5.4 doesn't support klips stack."
+		return $?
+	fi
+
+	ecm_disable
+
+	/etc/init.d/ipsec stop
+	rmmod qca-nss-ipsec-klips
+	rm $NSS_IPSEC_OL_FILE
+
+	ecm_unload
+}
+
+start_xfrm() {
+	touch $NSS_IPSEC_OL_FILE
+	ecm_load
+
+	local kernel_version=$(uname -r)
+
+	# load all NETKEY modules first.
+	for mod in xfrm_ipcomp ipcomp xfrm6_tunnel ipcomp6 xfrm6_mode_tunnel xfrm6_mode_beet xfrm6_mode_ro \
+		xfrm6_mode_transport xfrm4_mode_transport xfrm4_mode_tunnel \
+		xfrm4_tunnel xfrm4_mode_beet esp4 esp6 ah4 ah6 af_key
+		do
+			insmod $mod 2> /dev/null
+		done
+
+	# Now load the xfrm plugin
+	insmod /lib/modules/${kernel_version}/qca-nss-ipsec-xfrm.ko
+	if [ "$?" -gt 0 ]; then
+		echo "Failed to load plugin. Please start ecm if not done already"
+		ecm_enable
+		rm $NSS_IPSEC_OL_FILE
+		return
+	fi
+
+	/etc/init.d/ipsec start
+	sleep 2
+
+	ecm_enable
+}
+
+stop_xfrm() {
+	ecm_disable
+
+	#Shutdown Pluto first. Then only plugin can be removed.
+	plutopid=/var/run/pluto/pluto.pid
+	if [ -f $plutopid ]; then
+		pid=`cat $plutopid`
+		if [ ! -z "$pid" ]; then
+			ipsec whack --shutdown | grep -v "002";
+			if [ -s $plutopid ]; then
+				echo "Attempt to shut Pluto down failed!  Trying kill:"
+				kill $pid;
+				sleep 5;
+			fi
+		fi
+		rm -rf $plutopid
+	fi
+	ip xfrm state flush;
+	ip xfrm policy flush;
+	sleep 2
+
+	#Now we can remove the plugin
+	retries=5
+	while [ -d /sys/module/qca_nss_ipsec_xfrm ]
+	do
+		rmmod qca-nss-ipsec-xfrm
+		if [ "$?" -eq 0 ]; then
+			rm $NSS_IPSEC_OL_FILE
+			break
+		fi
+
+		if [ ${retries} -eq 0 ]; then
+			echo "Failed to unload qca-nss-ipsec-xfrm plugin!"
+			exit
+		fi
+
+		echo "XFRM plugin unload failed; retrying ${retries} times"
+		sleep 1
+		retries=`expr ${retries} - 1`
+	done
+
+	/etc/init.d/ipsec stop
+	ecm_unload
+}
+
+start() {
+	local protostack=`uci -q get ipsec.setup.protostack`
+	if [ "$protostack" = "klips" ]; then
+		start_klips
+		return $?
+	fi
+
+	start_xfrm
+	return $?
+}
+
+stop() {
+	local protostack=`uci -q get ipsec.setup.protostack`
+	if [ "$protostack" = "klips" ]; then
+		stop_klips
+		return $?
+	fi
+
+	stop_xfrm
+	return $?
+}
+
+restart() {
+	stop
+	start
+}

qca/qca-nss-clients/files/qca-nss-mirred.init

@@ -0,0 +1,28 @@
+#!/bin/sh /etc/rc.common
+
+###########################################################################
+# Copyright (c) 2019, The Linux Foundation. All rights reserved.
+# Permission to use, copy, modify, and/or distribute this software for
+# any purpose with or without fee is hereby granted, provided that the
+# above copyright notice and this permission notice appear in all copies.
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+# OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+###########################################################################
+
+restart() {
+	rmmod act_nssmirred.ko
+	insmod act_nssmirred.ko
+}
+
+start() {
+	insmod act_nssmirred.ko
+}
+
+stop() {
+	rmmod act_nssmirred.ko
+}

qca/qca-nss-clients/files/qca-nss-ovpn.init

@@ -0,0 +1,69 @@
+#!/bin/sh /etc/rc.common
+
+###########################################################################
+# Copyright (c) 2019, The Linux Foundation. All rights reserved.
+# Permission to use, copy, modify, and/or distribute this software for
+# any purpose with or without fee is hereby granted, provided that the
+# above copyright notice and this permission notice appear in all copies.
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+# OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+###########################################################################
+
+ecm_disable() {
+	if [ ! -d /sys/module/ecm ]; then
+	   return
+	fi
+
+	echo 1 > /sys/kernel/debug/ecm/front_end_ipv4_stop
+	echo 1 > /sys/kernel/debug/ecm/front_end_ipv6_stop
+	echo 1 > /sys/kernel/debug/ecm/ecm_db/defunct_all
+	sleep 2
+}
+
+ecm_enable() {
+	if [ ! -d /sys/module/ecm ]; then
+	   return
+	fi
+
+	echo 0 > /sys/kernel/debug/ecm/ecm_db/defunct_all
+	echo 0 > /sys/kernel/debug/ecm/front_end_ipv4_stop
+	echo 0 > /sys/kernel/debug/ecm/front_end_ipv6_stop
+}
+
+restart() {
+	ecm_disable
+
+	/etc/init.d/openvpn stop
+	rmmod qca-nss-ovpn-link
+	rmmod qca-nss-ovpn-mgr
+
+	insmod qca-nss-ovpn-mgr
+	insmod qca-nss-ovpn-link
+
+	if [ "$?" -gt 0 ]; then
+		echo "Failed to load plugin. Please start ecm if not done already"
+		ecm_enable
+		return
+	fi
+
+	ecm_enable
+}
+
+start() {
+	restart
+}
+
+stop() {
+	ecm_disable
+
+	/etc/init.d/openvpn stop
+	rmmod qca-nss-ovpn-link
+	rmmod qca-nss-ovpn-mgr
+
+	ecm_enable
+}