linux-hardened/dm-crypt.nix

{ lib, hostPlatform, ... }:
with lib.kernel;
{
  MD = yes;
  MD_BITMAP_FILE = no;
  BLK_DEV_DM = yes;
  DM_CRYPT = yes;
  DM_UEVENT = yes;
  DM_INTEGRITY = yes;

  CRYPTO_AES = yes;
  CRYPTO_XTS = yes;
  CRYPTO_AEGIS128 = yes;
  CRYPTO_SHA256 = yes;

  CRYPTO_USER_API_HASH = yes;
  CRYPTO_USER_API_SKCIPHER = yes;
}
// lib.optionalAttrs hostPlatform.isx86_64 {
  CRYPTO_AES_NI_INTEL = yes;
  CRYPTO_AEGIS128_AESNI_SSE2 = yes;
  CRYPTO_SHA256_SSSE3 = yes;
}
// lib.optionalAttrs hostPlatform.isRiscV64 {
  CRYPTO_AES_RISCV64 = yes;
  CRYPTO_SHA256_RISCV64 = yes;
}
// lib.optionalAttrs hostPlatform.isAarch64 {
  CRYPTO_AES_ARM64 = yes;
  CRYPTO_AES_ARM64_CE = yes;
  CRYPTO_AES_ARM64_CE_BLK = yes;
  CRYPTO_AES_ARM64_NEON_BLK = yes;
  CRYPTO_AES_ARM64_BS = yes;
  CRYPTO_AEGIS128_SIMD = yes;
  CRYPTO_SHA256_ARM64 = yes;
}