mirror of
https://github.com/breeze303/nss-packages.git
synced 2025-12-16 16:57:29 +00:00
24ae066757
This commit addresses a crash that occurs when running crypto tasks on IPQ807x devices explicitly utilizing the NSS cores. The crash was reproducible in scenarios involving cryptographic operations offloaded to the NSS cores (e.g., using cryptodev with OpenSSL or running the crypto test module). IMPORTANT: This fix should not be misunderstood as a general-purpose performance boost for all cryptographic workloads. If your goal is to accelerate AES encryption across the board (e.g., using OpenSSL for routine file encryption), this approach is **not** practical. The primary benefit of leveraging the NSS cores for cryptographic operations is within VPN-oriented use cases, such as OpenVPN or IPsec, where the offloading to NSS cores can reduce CPU load and improve throughput. It’s critical to note that this fix will **not** accelerate encryption for protocols like Wireguard. Wireguard’s design uses ChaCha20-Poly1305 rather than AES, and it cannot easily be offloaded to hardware. Additionally, Wireguard uses short-lived cryptographic keys that rotate frequently. This frequent key rotation makes it difficult to interface with hardware offloading mechanisms, which are typically optimized for long-lived sessions like those found in IPsec. Signed-off-by: Sebastian Gottschall <s.gottschall@dd-wrt.com> Signed-off-by: Sean Khan <datapronix@protonmail.com>
90 lines
2.5 KiB
Makefile
90 lines
2.5 KiB
Makefile
include $(TOPDIR)/rules.mk
|
|
|
|
PKG_NAME:=qca-nss-cfi
|
|
PKG_RELEASE:=3
|
|
|
|
PKG_SOURCE_URL:=https://git.codelinaro.org/clo/qsdk/oss/lklm/nss-cfi.git
|
|
PKG_SOURCE_PROTO:=git
|
|
PKG_SOURCE_DATE:=2022-12-15
|
|
PKG_SOURCE_VERSION:=5cd07ce
|
|
PKG_MIRROR_HASH:=852129b4bc2a14e05c8a27e9c8904f9b7647a8aeeeaa764fd3747b5b5e441a0b
|
|
QSDK_VERSION:=12.5
|
|
PKG_VERSION:=$(QSDK_VERSION).$(subst -,.,$(PKG_SOURCE_DATE))~$(PKG_SOURCE_VERSION)
|
|
|
|
PKG_BUILD_PARALLEL:=1
|
|
|
|
include $(INCLUDE_DIR)/kernel.mk
|
|
include $(INCLUDE_DIR)/package.mk
|
|
|
|
ifneq (, $(findstring $(CONFIG_TARGET_SUBTARGET), "ipq807x" "ipq60xx"))
|
|
#4.4/5.4 + ipq807x/ipq60xx/ipq50xx
|
|
CFI_OCF_DIR:=ocf/v2.0
|
|
CFI_CRYPTOAPI_DIR:=cryptoapi/v2.0
|
|
else
|
|
#4.4 Kernel + ipq806x
|
|
CFI_CRYPTOAPI_DIR:=cryptoapi/v1.1
|
|
CFI_OCF_DIR:=ocf/v1.0
|
|
CFI_IPSEC_DIR:=ipsec/v1.0
|
|
endif
|
|
|
|
define KernelPackage/qca-nss-cfi-cryptoapi
|
|
SECTION:=kernel
|
|
CATEGORY:=Kernel modules
|
|
SUBMENU:=Cryptographic API modules
|
|
DEPENDS:=@TARGET_qualcommax +kmod-qca-nss-crypto +kmod-crypto-authenc @BROKEN
|
|
TITLE:=Kernel driver for NSS cfi
|
|
FILES:=$(PKG_BUILD_DIR)/$(CFI_CRYPTOAPI_DIR)/qca-nss-cfi-cryptoapi.ko
|
|
AUTOLOAD:=$(call AutoLoad,59,qca-nss-cfi-cryptoapi)
|
|
endef
|
|
|
|
define Build/InstallDev
|
|
$(INSTALL_DIR) $(1)/usr/include/qca-nss-cfi
|
|
$(CP) $(PKG_BUILD_DIR)/$(CFI_CRYPTOAPI_DIR)/../exports/* $(1)/usr/include/qca-nss-cfi
|
|
$(CP) $(PKG_BUILD_DIR)/include/* $(1)/usr/include/qca-nss-cfi
|
|
endef
|
|
|
|
define KernelPackage/qca-nss-cfi-cryptoapi/Description
|
|
This package contains a NSS cfi driver for QCA chipset
|
|
endef
|
|
|
|
EXTRA_CFLAGS+= \
|
|
-DCONFIG_NSS_DEBUG_LEVEL=4 \
|
|
-I$(LINUX_DIR)/crypto/ocf \
|
|
-I$(STAGING_DIR)/usr/include/qca-nss-crypto \
|
|
-I$(STAGING_DIR)/usr/include/crypto \
|
|
-I$(STAGING_DIR)/usr/include/qca-nss-drv
|
|
|
|
ifneq (, $(findstring $(CONFIG_TARGET_SUBTARGET), "ipq807x"))
|
|
EXTRA_CFLAGS+= -I$(STAGING_DIR)/usr/include/qca-nss-clients
|
|
endif
|
|
|
|
# Build individual packages if selected
|
|
ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-cfi-cryptoapi),)
|
|
MAKE_OPTS+= \
|
|
cryptoapi=y \
|
|
NSS_CRYPTOAPI_ABLK=n \
|
|
NSS_CRYPTOAPI_SKCIPHER=y
|
|
endif
|
|
|
|
ifeq ($(CONFIG_TARGET_BOARD), "qualcommax")
|
|
SOC:=$(CONFIG_TARGET_SUBTARGET)
|
|
endif
|
|
|
|
define Build/Compile
|
|
+$(MAKE) -C "$(LINUX_DIR)" $(strip $(MAKE_OPTS)) \
|
|
CROSS_COMPILE="$(TARGET_CROSS)" \
|
|
ARCH="$(LINUX_KARCH)" \
|
|
M="$(PKG_BUILD_DIR)" \
|
|
EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
|
|
CC="$(TARGET_CC)" \
|
|
CFI_CRYPTOAPI_DIR=$(CFI_CRYPTOAPI_DIR) \
|
|
CFI_OCF_DIR=$(CFI_OCF_DIR) \
|
|
CFI_IPSEC_DIR=$(CFI_IPSEC_DIR) \
|
|
SoC=$(SOC) \
|
|
$(KERNEL_MAKE_FLAGS) \
|
|
$(PKG_JOBS) \
|
|
modules
|
|
endef
|
|
|
|
$(eval $(call KernelPackage,qca-nss-cfi-cryptoapi))
|