package: support qualcommax target

2025-04-16 04:13:31 +00:00 · 2023-12-08 23:29:29 +08:00 · 2023-12-08 23:29:29 +08:00 · 8bad26fbd3
commit 8bad26fbd3
parent 2feb51efeb
156 changed files with 516 additions and 12380 deletions
--- a/package/kernel/linux/modules/netsupport.mk
+++ b/package/kernel/linux/modules/netsupport.mk
@ -1559,7 +1559,7 @@ $(eval $(call KernelPackage,qrtr-tun))
 define KernelPackage/qrtr-smd
  SUBMENU:=$(NETWORK_SUPPORT_MENU)
  TITLE:=SMD IPC Router channels
-  DEPENDS:=+kmod-qrtr @(TARGET_ipq60xx||TARGET_ipq807x)
+  DEPENDS:=+kmod-qrtr @TARGET_qualcommax
  KCONFIG:=CONFIG_QRTR_SMD
  FILES:= $(LINUX_DIR)/net/qrtr/qrtr-smd.ko
  AUTOLOAD:=$(call AutoProbe,qrtr-smd)
--- a/package/kernel/linux/modules/usb.mk
+++ b/package/kernel/linux/modules/usb.mk
@ -494,7 +494,7 @@ $(eval $(call KernelPackage,usb-dwc3))
 define KernelPackage/usb-dwc3-qcom
  TITLE:=DWC3 Qualcomm USB driver
-  DEPENDS:=@(TARGET_ipq40xx||TARGET_ipq806x||TARGET_ipq807x||TARGET_ipq60xx) +kmod-usb-dwc3
+  DEPENDS:=@(TARGET_ipq40xx||TARGET_ipq806x||TARGET_qualcommax) +kmod-usb-dwc3
  KCONFIG:= CONFIG_USB_DWC3_QCOM
  FILES:= $(LINUX_DIR)/drivers/usb/dwc3/dwc3-qcom.ko
  AUTOLOAD:=$(call AutoLoad,53,dwc3-qcom,1)
--- a/package/lean/shortcut-fe/simulated-driver/patches/200-nss-qdisc-support.patch
+++ b/package/lean/shortcut-fe/simulated-driver/patches/200-nss-qdisc-support.patch
@ -1,11 +0,0 @@
 --- ./simulated-driver/sfe_drv.c.orig	2020-06-16 12:49:47.680153371 +0800
 +++ ./simulated-driver/sfe_drv.c	2020-06-16 12:50:18.540153371 +0800
@@ -1167,7 +1167,7 @@ int sfe_drv_recv(struct sk_buff *skb)
 	 * If ingress Qdisc configured, and packet not processed by ingress Qdisc yet
 	 * We can not accelerate this packet.
 	 */
 -	if (dev->ingress_queue && !(skb->tc_verd & TC_NCLS)) {
 +	if (dev->ingress_queue && !(skb->tc_verd_qca_nss & TC_NCLS)) {
 		return 0;
 	}
 #endif
--- a/package/qca/firmware/nss-firmware/Makefile
+++ b/package/qca/firmware/nss-firmware/Makefile
@ -1,70 +0,0 @@
 #
 # Copyright (C) 2021 OpenWrt.org
 #
 # This is free software, licensed under the GNU General Public License v2.
 # See /LICENSE for more information.
 #
 include $(TOPDIR)/rules.mk
 PKG_NAME:=nss-firmware
 PKG_SOURCE_DATE:=2021-03-12
 PKG_SOURCE_VERSION:=73f378d6be21a9c20a69b77000dbb54a537006a9
 PKG_MIRROR_HASH:=0c21afe29002754edf2983bc9e8543dddd722e75bd12e961e300e99a310d1f62
 PKG_RELEASE:=$(AUTORELEASE)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/quic/qca-sdk-nss-fw.git
 PKG_LICENSE_FILES:=LICENSE.md
 PKG_MAINTAINER:=Robert Marko <robimarko@gmail.com>
 include $(INCLUDE_DIR)/package.mk
 VERSION_PATH=$(PKG_BUILD_DIR)/QCA_Networking_2020.SPF_11.3/CS
 define Package/nss-firmware-default
  SECTION:=firmware
  CATEGORY:=Firmware
  URL:=$(PKG_SOURCE_URL)
  DEPENDS:=@(TARGET_ipq807x||TARGET_ipq60xx)
 endef
 define Package/nss-firmware-ipq6018
 $(Package/nss-firmware-default)
  TITLE:=NSS firmware for IPQ6018 devices
  NSS_ARCHIVE:=$(VERSION_PATH)/IPQ6018.ATH.11.3/BIN-NSS.CP.11.3-9-R.tar.bz2
 endef
 define Package/nss-firmware-ipq8074
 $(Package/nss-firmware-default)
  TITLE:=NSS firmware for IPQ8074 devices
  NSS_ARCHIVE:=$(VERSION_PATH)/IPQ8074.ATH.11.3/BIN-NSS.HK.11.3-9-R.tar.bz2
 endef
 define Build/Compile
 endef
 define Package/nss-firmware-ipq6018/install
 	$(TAR) -C $(PKG_BUILD_DIR) -xf $(NSS_ARCHIVE)
 	$(INSTALL_DIR) $(1)/lib/firmware/
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/BIN-NSS.CP.11.3-9-R/retail_router0.bin \
 		$(1)/lib/firmware/qca-nss0-retail.bin
 endef
 define Package/nss-firmware-ipq8074/install
 	$(TAR) -C $(PKG_BUILD_DIR) -xf $(NSS_ARCHIVE)
 	$(INSTALL_DIR) $(1)/lib/firmware/
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/BIN-NSS.HK.11.3-9-R/retail_router0.bin \
 		$(1)/lib/firmware/qca-nss0-retail.bin
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/BIN-NSS.HK.11.3-9-R/retail_router1.bin \
 		$(1)/lib/firmware/qca-nss1-retail.bin
 endef
 $(eval $(call BuildPackage,nss-firmware-ipq6018))
 $(eval $(call BuildPackage,nss-firmware-ipq8074))
--- a/package/qca/nss/nss-ifb/Makefile
+++ b/package/qca/nss/nss-ifb/Makefile
@ -1,49 +0,0 @@
 #
 # Copyright (C) 2008-2012 OpenWrt.org
 #
 # This is free software, licensed under the GNU General Public License v2.
 # See /LICENSE for more information.
 #
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 PKG_NAME:=nss-ifb
 PKG_RELEASE:=1
 include $(INCLUDE_DIR)/package.mk
 define KernelPackage/nss-ifb
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=NSS IFB Interface
  DEPENDS:=+kmod-qca-nss-drv @LINUX_5_4
  FILES:=$(PKG_BUILD_DIR)/nss-ifb.ko
  KCONFIG:=
 endef
 define KernelPackage/nss-ifb/description
 Kernel module to register a NSS aware IFB interface.
 endef
 EXTRA_KCONFIG:= \
 	CONFIG_NET_CLS=y
 EXTRA_CFLAGS:= \
 	-I$(STAGING_DIR)/usr/include/qca-nss-drv
 MAKE_OPTS:= \
 	$(KERNEL_MAKE_FLAGS) \
 	M="$(PKG_BUILD_DIR)" \
 	EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
 	$(EXTRA_KCONFIG)
 define Build/Compile
 	$(MAKE) -C "$(LINUX_DIR)" \
 		$(MAKE_OPTS) \
 		modules
 endef
 $(eval $(call KernelPackage,nss-ifb))
--- a/package/qca/nss/nss-ifb/README.md
+++ b/package/qca/nss/nss-ifb/README.md
@ -1,45 +0,0 @@
 NSS Physical Interface Ingress Driver
 =====================================
 This driver redirect NSS physical interface (namely GMACs) ingress traffic to itself
 and sends it back to the Linux network stack (as the source GMACs packets) as it's
 egress traffic.
 This allows the NSS QDISC drivers to manage the egress traffic of this driver's
 NSS virtual interface.
 This driver will create a single network interface named 'nssifb'.  The default
 source interface is defined as 'eth0'.  It can be changed using the following module
 parameter path:
 /sys/module/nss-ifb/parameter/nss_src_dev
 To change the source NSS physical interface to 'eth1', use the following command:
 printf eth1 > /sys/module/nss-ifb/parameter/nss_src_dev
 You need to change the source interface first before bringing up the 'nssifb'
 interface.  Changing it after the interface is up will have no effect.  You need
 to bring down the interface and bring it back up to have the changes take effect.
 CPU load imposed on the Krait CPUs appears negligible with this driver intercepting
 the physical interface's ingress traffic.  Full line speed of the GMAC interface
 could still be achieved.
 The commands below shows an example to shape ingress traffic to 500 Mbps and egress
 to 200 Mbps for the 'eth0' interface.
 # Load the module if it's not loaded
 modprobe nss-ifb
 # Bring up the nssifb interface to active ingress redirect
 ip link set up nssifb
 # Shape ingress traffic to 500 Mbit with chained NSSFQ_CODEL
 tc qdisc add dev nssifb root handle 1: nsstbl rate 500Mbit burst 1Mb
 tc qdisc add dev nssifb parent 1: handle 10: nssfq_codel limit 10240 flows 1024 quantum 1514 target 5ms interval 100ms set_default
 # Shape egress traffic to 200 Mbit with chained NSSFQ_CODEL
 tc qdisc add dev eth0 root handle 1: nsstbl rate 200Mbit burst 1Mb
 tc qdisc add dev eth0 parent 1: handle 10: nssfq_codel limit 10240 flows 1024 quantum 1514 target 5ms interval 100ms set_default
--- a/package/qca/nss/nss-ifb/src/Makefile
+++ b/package/qca/nss/nss-ifb/src/Makefile
@ -1,3 +0,0 @@
 obj-m += nss-ifb.o
 nss-ifb-objs := nss_ifb.o
--- a/package/qca/nss/nss-ifb/src/nss_ifb.c
+++ b/package/qca/nss/nss-ifb/src/nss_ifb.c
@ -1,304 +0,0 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 /*
 * This driver is adapted from the Linux /drivers/net/ifb.c file.
 *
 * Redirect QCA NSS physical interface ingress traffic to this driver's
 * virtual interface.  This will allow ingress traffic shaping using the
 * QCA NSS shaper.
 */
 #include <nss_api_if.h>
 #define TX_Q_LIMIT    32
 struct nss_ifb_dev_private {
 	struct nss_virt_if_handle *nssctx;
 	struct net_device *nss_src_dev;
 	uint32_t nss_src_if_num;
 	char nss_src_dev_name[32];
 };
 char nss_dev_name_array[32] = "eth0";
 char *nss_dev_name = nss_dev_name_array;
 module_param(nss_dev_name, charp, 0644);
 MODULE_PARM_DESC(nss_dev_name, "NSS physical interface source device name");
 /*
 * Virtual interface egress packet callback.
 *
 * We send it back to the Linux network stack.
 */
 static void nss_ifb_data_cb(struct net_device *netdev, struct sk_buff *skb, struct napi_struct *napi)
 {
 	struct nss_ifb_dev_private *dp = netdev_priv(netdev);
 	skb->protocol = eth_type_trans(skb, dp->nss_src_dev);
 	skb->ip_summed = CHECKSUM_UNNECESSARY;
 	napi_gro_receive(napi, skb);
 }
 /*
 * Virtual interface ingress packet callback.
 *
 * We just send it back to the NSS firmware to let the shaper work on it.
 */
 static void nss_ifb_xmit_cb(struct net_device *netdev, struct sk_buff *skb)
 {
 	struct nss_ifb_dev_private *dp = netdev_priv(netdev);
 	int ret;
 	ret = nss_virt_if_tx_buf(dp->nssctx, skb);
 	if (unlikely(ret)) {
 		pr_warn("Failed [%d] to send skb [len: %d, protocol: 0x%X] to NSS!\n",
 			ret, skb->len, ntohs(skb->protocol));
 	}
 }
 static void nss_ifb_stats64(struct net_device *dev,
 			struct rtnl_link_stats64 *stats)
 {
 }
 static int nss_ifb_dev_init(struct net_device *dev)
 {
 	struct nss_ifb_dev_private *dp =  netdev_priv(dev);
 	dp->nssctx = nss_virt_if_create_sync_nexthop(dev, NSS_ETH_RX_INTERFACE, NSS_ETH_RX_INTERFACE);
 	if (!dp->nssctx) {
 		dp->nssctx = NULL;
 		pr_warn("Could not create a NSS virtual interface for dev [%s]\n",
 			dev->name);
 		return -ENODEV;
 	}
 	pr_info("Created a NSS virtual interface for dev [%s]\n", dev->name);
 	nss_virt_if_register(dp->nssctx, nss_ifb_data_cb, dev);
 	pr_info("NSS IFB data callback registered\n");
 	nss_virt_if_xmit_callback_register(dp->nssctx, nss_ifb_xmit_cb);
 	pr_info("NSS IFB transmit callback registered\n");
 	return 0;
 }
 static void nss_ifb_dev_uninit(struct net_device *dev)
 {
 	struct nss_ifb_dev_private *dp = netdev_priv(dev);
 	int ret;
 	nss_virt_if_xmit_callback_unregister(dp->nssctx);
 	pr_info("NSS IFB transmit callback unregistered\n");
 	ret = nss_virt_if_destroy_sync(dp->nssctx);
 	if (ret == NSS_TX_SUCCESS) {
 		pr_info("NSS virtual interface destroyed for dev [%s]\n", dev->name);
 	}
 	else {
 		pr_warn("Unable to destroy NSS virtual interface for dev [%s], error[%d]\n",
 		dev->name, ret);
 	}
 	dp->nssctx = NULL;
 }
 static netdev_tx_t nss_ifb_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	return NETDEV_TX_OK;
 }
 static int nss_ifb_close(struct net_device *dev)
 {
 	struct nss_ifb_dev_private *dp = netdev_priv(dev);
 	struct nss_ctx_instance *nss_ctx;
 	struct net_device *src_dev;
 	uint32_t src_if_num;
 	int ret;
 	nss_ctx = dp->nssctx->nss_ctx;
 	src_dev = dp->nss_src_dev;
 	src_if_num = dp->nss_src_if_num;
 	ret = nss_phys_if_set_nexthop(nss_ctx, src_if_num, NSS_ETH_RX_INTERFACE);
 	if (ret != NSS_TX_SUCCESS) {
 		pr_warn("%p: Failed to reset next hop for net device [%s].\n",
 			nss_ctx, src_dev->name);
 	}
 	else {
 		pr_info("%p: Reset nexthop successful for net device [%s].\n",
 			nss_ctx, src_dev->name);
 	}
 	dev_put(src_dev);
 	dp->nss_src_dev = NULL;
 	dp->nss_src_if_num = -1;
 	return 0;
 }
 static int nss_ifb_open(struct net_device *dev)
 {
 	struct nss_ifb_dev_private *dp = netdev_priv(dev);
 	struct net_device *src_dev;
 	uint32_t src_if_num;
 	uint32_t nh_if_num;
 	nss_tx_status_t nss_tx_status;
 	struct nss_ctx_instance *nss_ctx;
 	nss_ctx = dp->nssctx->nss_ctx;
 	nh_if_num = dp->nssctx->if_num_n2h;
 	strcpy(dp->nss_src_dev_name, nss_dev_name);
 	src_dev = dev_get_by_name(&init_net, dp->nss_src_dev_name);
 	if (!src_dev) {
 		pr_warn("%p: Cannot find the net device [%s]\n",
 			nss_ctx, dp->nss_src_dev_name);
 		return -ENODEV;
 	}
 	pr_info("%p: Found net device [%s]\n", nss_ctx, dp->nss_src_dev_name);
 	src_if_num = nss_cmn_get_interface_number_by_dev(src_dev);
 	if (src_if_num < 0) {
 		pr_warn("%p: Invalid interface number:%d\n", nss_ctx, src_if_num);
 		dev_put(src_dev);
 		return -ENODEV;
 	}
 	pr_info("%p: Net device [%s] has NSS intf_num [%d]\n",
 		nss_ctx, dp->nss_src_dev_name, src_if_num);
 	nss_tx_status = nss_phys_if_set_nexthop(nss_ctx, src_if_num, nh_if_num);
 	if (nss_tx_status != NSS_TX_SUCCESS) {
 		pr_warn("%p: Sending message failed, cannot change nexthop for [%s]\n",
 			nss_ctx, dp->nss_src_dev_name);
 	}
 	else {
 		pr_info("Nexthop successfully set for [%s] to [%s]\n",
 			dp->nss_src_dev_name, dev->name);
 	}
 	dp->nss_src_dev = src_dev;
 	dp->nss_src_if_num = src_if_num;
 	return 0;
 }
 static const struct net_device_ops nss_ifb_netdev_ops = {
 	.ndo_open	= nss_ifb_open,
 	.ndo_stop	= nss_ifb_close,
 	.ndo_get_stats64 = nss_ifb_stats64,
 	.ndo_start_xmit	= nss_ifb_xmit,
 	.ndo_validate_addr = eth_validate_addr,
 	.ndo_init	= nss_ifb_dev_init,
 	.ndo_uninit	= nss_ifb_dev_uninit,
 };
 #define IFB_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG  | NETIF_F_FRAGLIST	| \
 		      NETIF_F_TSO_ECN | NETIF_F_TSO | NETIF_F_TSO6	| \
 		      NETIF_F_GSO_ENCAP_ALL 				| \
 		      NETIF_F_HIGHDMA | NETIF_F_HW_VLAN_CTAG_TX		| \
 		      NETIF_F_HW_VLAN_STAG_TX)
 static void nss_ifb_dev_free(struct net_device *dev)
 {
 }
 static void nss_ifb_setup(struct net_device *dev)
 {
 	/* Initialize the device structure. */
 	dev->netdev_ops = &nss_ifb_netdev_ops;
 	/* Fill in device structure with ethernet-generic values. */
 	ether_setup(dev);
 	dev->tx_queue_len = TX_Q_LIMIT;
 	dev->features |= IFB_FEATURES;
 	dev->hw_features |= dev->features;
 	dev->hw_enc_features |= dev->features;
 	dev->vlan_features |= IFB_FEATURES & ~(NETIF_F_HW_VLAN_CTAG_TX |
 					       NETIF_F_HW_VLAN_STAG_TX);
 	dev->flags |= IFF_NOARP;
 	dev->flags &= ~IFF_MULTICAST;
 	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
 	netif_keep_dst(dev);
 	eth_hw_addr_random(dev);
 	dev->needs_free_netdev = true;
 	dev->priv_destructor = nss_ifb_dev_free;
 	dev->min_mtu = 0;
 	dev->max_mtu = 0;
 }
 static int nss_ifb_validate(struct nlattr *tb[], struct nlattr *data[],
 			struct netlink_ext_ack *extack)
 {
 	if (tb[IFLA_ADDRESS]) {
 		if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
 			return -EINVAL;
 		if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS])))
 			return -EADDRNOTAVAIL;
 	}
 	return 0;
 }
 static struct rtnl_link_ops nss_ifb_link_ops __read_mostly = {
 	.kind		= "nss_ifb",
 	.priv_size	= sizeof(struct nss_ifb_dev_private),
 	.setup		= nss_ifb_setup,
 	.validate	= nss_ifb_validate,
 };
 static int __init nss_ifb_init_module(void)
 {
 	struct net_device *dev;
 	int err;
 	down_write(&pernet_ops_rwsem);
 	rtnl_lock();
 	err = __rtnl_link_register(&nss_ifb_link_ops);
 	if (err < 0)
 		goto out;
 	dev = alloc_netdev(sizeof(struct nss_ifb_dev_private), "nssifb",
 			NET_NAME_UNKNOWN, nss_ifb_setup);
 	if (dev) {
 		dev->rtnl_link_ops = &nss_ifb_link_ops;
 		err = register_netdevice(dev);
 	}
 	else {
 		err = -ENOMEM;
 	}
 	if (err)
 		__rtnl_link_unregister(&nss_ifb_link_ops);
 out:
 	rtnl_unlock();
 	up_write(&pernet_ops_rwsem);
 	if (!err)
 		pr_info("NSS IFB module loaded.\n");
 	else
 		pr_warn("Failed to load NSS IFB module.\n");
 	return err;
 }
 static void __exit nss_ifb_cleanup_module(void)
 {
 	rtnl_link_unregister(&nss_ifb_link_ops);
 	pr_info("NSS IFB module unloaded.\n");
 }
 module_init(nss_ifb_init_module);
 module_exit(nss_ifb_cleanup_module);
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_RTNL_LINK("nss_ifb");
--- a/package/qca/nss/qca-nss-cfi/Makefile
+++ b/package/qca/nss/qca-nss-cfi/Makefile
@ -1,99 +0,0 @@
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 PKG_NAME:=qca-nss-cfi
 PKG_RELEASE:=2
 PKG_SOURCE_URL:=https://git.codelinaro.org/clo/qsdk/oss/lklm/nss-cfi.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_VERSION:=8035a8ddefdcc8a2f06c96b2a82618ca6ce6406d
 PKG_MIRROR_HASH:=23316395d1346994d069eb41ef73a5505853687f8beab14f83545b3a05e52429
 include $(INCLUDE_DIR)/package.mk
 ifeq ($(CONFIG_TARGET_ipq),y)
 subtarget:=$(SUBTARGET)
 else
 subtarget:=$(CONFIG_TARGET_BOARD)
 endif
 # v1.0 is for Akronite
 # v2.0 is for Hawkeye/Cypress/Maple
 ifneq (, $(findstring $(subtarget), "ipq807x" "ipq807x_64" "ipq60xx" "ipq60xx_64"))
  CFI_OCF_DIR:=ocf/v2.0
  CFI_CRYPTOAPI_DIR:=cryptoapi/v2.0
 else
  CFI_CRYPTOAPI_DIR:=cryptoapi/v1.1
  CFI_OCF_DIR:=ocf/v1.0
  CFI_IPSEC_DIR:=ipsec/v1.0
 endif
 define KernelPackage/qca-nss-cfi-cryptoapi
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  DEPENDS:=@TARGET_ipq806x||TARGET_ipq_ipq806x||TARGET_ipq_ipq807x||TARGET_ipq_ipq807x_64||TARGET_ipq807x||TARGET_ipq807x_64||TARGET_ipq_ipq60xx||TARGET_ipq_ipq60xx_64 \
 		+kmod-qca-nss-crypto +kmod-crypto-authenc @LINUX_5_4
  TITLE:=Kernel driver for NSS cfi
  FILES:=$(PKG_BUILD_DIR)/$(CFI_CRYPTOAPI_DIR)/qca-nss-cfi-cryptoapi.ko
  AUTOLOAD:=$(call AutoLoad,59,qca-nss-cfi-cryptoapi)
 endef
 # OCF should be dropped
 # define KernelPackage/qca-nss-cfi-ocf
 #   SECTION:=kernel
 #   CATEGORY:=Kernel modules
 #   SUBMENU:=Network Devices
 #   DEPENDS:=@TARGET_ipq806x||TARGET_ipq_ipq806x||TARGET_ipq_ipq807x||TARGET_ipq_ipq807x_64||TARGET_ipq807x||TARGET_ipq807x_64||TARGET_ipq_ipq60xx||TARGET_ipq_ipq60xx_64 \
 # 		+kmod-qca-nss-crypto +PACKAGE_kmod-crypto-ocf:kmod-crypto-ocf @!LINUX_3_18
 #   TITLE:=Kernel driver for NSS cfi
 #   FILES:=$(PKG_BUILD_DIR)/$(CFI_OCF_DIR)/qca-nss-cfi-ocf.ko
 # ifdef CFI_IPSEC_DIR
 #   FILES+=$(PKG_BUILD_DIR)/$(CFI_IPSEC_DIR)/qca-nss-ipsec.ko
 #   AUTOLOAD:=$(call AutoLoad,61,qca-nss-cfi-ocf qca-nss-ipsec)
 # else
 #   AUTOLOAD:=$(call AutoLoad,61,qca-nss-cfi-ocf)
 # endif
 # endef
 define Build/InstallDev/qca-nss-cfi
 	$(INSTALL_DIR) $(1)/usr/include/qca-nss-cfi
 	$(CP) $(PKG_BUILD_DIR)/$(CFI_CRYPTOAPI_DIR)/../exports/* $(1)/usr/include/qca-nss-cfi
 	$(CP) $(PKG_BUILD_DIR)/include/* $(1)/usr/include/qca-nss-cfi
 endef
 define Build/InstallDev
 	$(call Build/InstallDev/qca-nss-cfi,$(1))
 endef
 define KernelPackage/qca-nss-cfi/Description
 This package contains a NSS cfi driver for QCA chipset
 endef
 EXTRA_CFLAGS+= \
 	-DCONFIG_NSS_DEBUG_LEVEL=4 \
 	-I$(LINUX_DIR)/crypto/ocf \
 	-I$(STAGING_DIR)/usr/include/qca-nss-crypto \
 	-I$(STAGING_DIR)/usr/include/crypto \
 	-I$(STAGING_DIR)/usr/include/qca-nss-drv
 ifneq (, $(findstring $(subtarget), "ipq807x" "ipq807x_64" "ipq60xx" "ipq60xx_64"))
 EXTRA_CFLAGS+= -I$(STAGING_DIR)/usr/include/qca-nss-clients
 endif
 define Build/Compile
 	$(MAKE) $(PKG_JOBS) -C "$(LINUX_DIR)" \
 		$(KERNEL_MAKE_FLAGS) \
 		$(PKG_MAKE_FLAGS) \
 		M="$(PKG_BUILD_DIR)" \
 		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
 		CFI_CRYPTOAPI_DIR=$(CFI_CRYPTOAPI_DIR) \
 		CFI_OCF_DIR=$(CFI_OCF_DIR) \
 		CFI_IPSEC_DIR=$(CFI_IPSEC_DIR) \
 		SoC=$(subtarget) \
 		modules
 endef
 $(eval $(call KernelPackage,qca-nss-cfi-cryptoapi))
 #$(eval $(call KernelPackage,qca-nss-cfi-ocf))
--- a/package/qca/nss/qca-nss-cfi/patches/0001-compile-only-cryptoapi.patch
+++ b/package/qca/nss/qca-nss-cfi/patches/0001-compile-only-cryptoapi.patch
@ -1,30 +0,0 @@
 From a8a573c5ce83bdddca9a60c62161638a5fd906d4 Mon Sep 17 00:00:00 2001
 From: Ansuel Smith <ansuelsmth@gmail.com>
 Date: Sat, 13 Jun 2020 12:57:14 +0200
 Subject: [PATCH 1/3] compile only cryptoapi
 ---
 Makefile | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
 diff --git a/Makefile b/Makefile
 index c42adca..36a9d3f 100644
 --- a/Makefile
 +++ b/Makefile
@@ -4,9 +4,9 @@
 export BUILD_ID = \"Build Id: $(shell date +'%m/%d/%y, %H:%M:%S')\"
 -obj-m += $(CFI_OCF_DIR)/
 +# obj-m += $(CFI_OCF_DIR)/
 obj-m += $(CFI_CRYPTOAPI_DIR)/
 -ifeq ($(SoC),$(filter $(SoC),ipq806x))
 -obj-m += $(CFI_IPSEC_DIR)/
 -endif
 +# ifeq ($(SoC),$(filter $(SoC),ipq806x))
 +# obj-m += $(CFI_IPSEC_DIR)/
 +# endif
 -- 
 2.27.0.rc0
--- a/package/qca/nss/qca-nss-cfi/patches/0002-wip-support-5.4.patch
+++ b/package/qca/nss/qca-nss-cfi/patches/0002-wip-support-5.4.patch
@ -1,78 +0,0 @@
 From 202f57bae49947a04301ac8ac9bdc00f28f09355 Mon Sep 17 00:00:00 2001
 From: Ansuel Smith <ansuelsmth@gmail.com>
 Date: Sat, 13 Jun 2020 12:58:26 +0200
 Subject: [PATCH 2/3] wip: support 5.4
 ---
 cryptoapi/v1.1/nss_cryptoapi.c      |  1 -
 cryptoapi/v1.1/nss_cryptoapi_ablk.c | 12 ++++++------
 cryptoapi/v1.1/nss_cryptoapi_aead.c |  2 +-
 3 files changed, 7 insertions(+), 8 deletions(-)
 diff --git a/cryptoapi/v1.1/nss_cryptoapi.c b/cryptoapi/v1.1/nss_cryptoapi.c
 index d1a7313..a10590e 100644
 --- a/cryptoapi/v1.1/nss_cryptoapi.c
 +++ b/cryptoapi/v1.1/nss_cryptoapi.c
@@ -231,7 +231,6 @@ static struct crypto_alg cryptoapi_ablkcipher_algs[] = {
 		.cra_u          = {
 			.ablkcipher = {
 				.ivsize         = CTR_RFC3686_IV_SIZE,
 -				.geniv          = "seqiv",
 				.min_keysize    = AES_MIN_KEY_SIZE + CTR_RFC3686_NONCE_SIZE,
 				.max_keysize    = AES_MAX_KEY_SIZE + CTR_RFC3686_NONCE_SIZE,
 				.setkey         = nss_cryptoapi_ablk_aes_setkey,
 diff --git a/cryptoapi/v1.1/nss_cryptoapi_ablk.c b/cryptoapi/v1.1/nss_cryptoapi_ablk.c
 index 223591c..9b6c65e 100644
 --- a/cryptoapi/v1.1/nss_cryptoapi_ablk.c
 +++ b/cryptoapi/v1.1/nss_cryptoapi_ablk.c
@@ -108,7 +108,7 @@ EXPORT_SYMBOL(nss_cryptoapi_skcipher_ctx2session);
 int nss_cryptoapi_ablkcipher_init(struct crypto_tfm *tfm)
 {
 	struct nss_cryptoapi_ctx *ctx = crypto_tfm_ctx(tfm);
 -	struct crypto_ablkcipher *sw_tfm;
 +	struct crypto_cipher *sw_tfm;
 	nss_cfi_assert(ctx);
@@ -122,20 +122,20 @@ int nss_cryptoapi_ablkcipher_init(struct crypto_tfm *tfm)
 	nss_cryptoapi_set_magic(ctx);
 -	if (!(crypto_tfm_alg_flags(tfm) & CRYPTO_ALG_NEED_FALLBACK))
 +	if (!(crypto_tfm_alg_type(tfm) & CRYPTO_ALG_NEED_FALLBACK))
 		return 0;
 	/* Alloc fallback transform for future use */
 -	sw_tfm = crypto_alloc_ablkcipher(crypto_tfm_alg_name(tfm), 0, CRYPTO_ALG_ASYNC |
 -									CRYPTO_ALG_NEED_FALLBACK);
 +	sw_tfm = crypto_alloc_cipher(crypto_tfm_alg_name(tfm), 0, CRYPTO_ALG_ASYNC |
 + 									CRYPTO_ALG_NEED_FALLBACK);
 	if (IS_ERR(sw_tfm)) {
 		nss_cfi_err("unable to alloc software crypto for %s\n", crypto_tfm_alg_name(tfm));
 		return -EINVAL;
 	}
 	/* set this tfm reqsize same to fallback tfm */
 -	tfm->crt_ablkcipher.reqsize = crypto_ablkcipher_reqsize(sw_tfm);
 -	ctx->sw_tfm = crypto_ablkcipher_tfm(sw_tfm);
 +	tfm->crt_ablkcipher.reqsize = sizeof(struct nss_cryptoapi_ctx);
 +	ctx->sw_tfm = crypto_cipher_tfm(sw_tfm);
 	return 0;
 }
 diff --git a/cryptoapi/v1.1/nss_cryptoapi_aead.c b/cryptoapi/v1.1/nss_cryptoapi_aead.c
 index 527936b..53e4bed 100644
 --- a/cryptoapi/v1.1/nss_cryptoapi_aead.c
 +++ b/cryptoapi/v1.1/nss_cryptoapi_aead.c
@@ -103,7 +103,7 @@ int nss_cryptoapi_aead_init(struct crypto_aead *aead)
 	nss_cryptoapi_set_magic(ctx);
 -	if (!(crypto_tfm_alg_flags(tfm) & CRYPTO_ALG_NEED_FALLBACK))
 +	if (!(crypto_tfm_alg_type(tfm) & CRYPTO_ALG_NEED_FALLBACK))
 		return 0;
 	/* Alloc fallback transform for future use */
 -- 
 2.27.0.rc0
--- a/package/qca/nss/qca-nss-cfi/patches/0003-Convert-ablkcipher-to-skcipher.patch
+++ b/package/qca/nss/qca-nss-cfi/patches/0003-Convert-ablkcipher-to-skcipher.patch
@ -1,707 +0,0 @@
 From e3a53a6d11b2c1770545a2820a58c117799bcb70 Mon Sep 17 00:00:00 2001
 From: Ansuel Smith <ansuelsmth@gmail.com>
 Date: Tue, 16 Jun 2020 18:12:34 +0200
 Subject: [PATCH 3/3] Convert ablkcipher to skcipher
 ---
 cryptoapi/v1.1/nss_cryptoapi.c         | 149 +++++++++++--------------
 cryptoapi/v1.1/nss_cryptoapi_ablk.c    | 136 +++++++++++-----------
 cryptoapi/v1.1/nss_cryptoapi_debugfs.c |   1 +
 cryptoapi/v1.1/nss_cryptoapi_private.h |  16 +--
 4 files changed, 145 insertions(+), 157 deletions(-)
 diff --git a/cryptoapi/v1.1/nss_cryptoapi.c b/cryptoapi/v1.1/nss_cryptoapi.c
 index a10590e..3a835dc 100644
 --- a/cryptoapi/v1.1/nss_cryptoapi.c
 +++ b/cryptoapi/v1.1/nss_cryptoapi.c
@@ -66,7 +66,7 @@ struct aead_alg cryptoapi_aead_algs[] = {
 			.cra_name       = "echainiv(authenc(hmac(sha1),cbc(aes)))",
 			.cra_driver_name = "nss-hmac-sha1-cbc-aes",
 			.cra_priority   = 10000,
 -			.cra_flags      = CRYPTO_ALG_ASYNC | CRYPTO_ALG_NOSUPP_SG | CRYPTO_ALG_NEED_FALLBACK,
 +			.cra_flags      = CRYPTO_ALG_ASYNC | CRYPTO_ALG_NOSUPP_SG | CRYPTO_ALG_NEED_FALLBACK | CRYPTO_ALG_KERN_DRIVER_ONLY,
 			.cra_blocksize  = AES_BLOCK_SIZE,
 			.cra_ctxsize    = sizeof(struct nss_cryptoapi_ctx),
 			.cra_alignmask  = 0,
@@ -87,7 +87,7 @@ struct aead_alg cryptoapi_aead_algs[] = {
 			.cra_name       = "seqiv(authenc(hmac(sha1),rfc3686(ctr(aes))))",
 			.cra_driver_name = "nss-hmac-sha1-rfc3686-ctr-aes",
 			.cra_priority   = 10000,
 -			.cra_flags      = CRYPTO_ALG_ASYNC | CRYPTO_ALG_NOSUPP_SG | CRYPTO_ALG_NEED_FALLBACK,
 +			.cra_flags      = CRYPTO_ALG_ASYNC | CRYPTO_ALG_NOSUPP_SG | CRYPTO_ALG_NEED_FALLBACK | CRYPTO_ALG_KERN_DRIVER_ONLY,
 			.cra_blocksize  = AES_BLOCK_SIZE,
 			.cra_ctxsize    = sizeof(struct nss_cryptoapi_ctx),
 			.cra_alignmask  = 0,
@@ -108,7 +108,7 @@ struct aead_alg cryptoapi_aead_algs[] = {
 			.cra_name       = "echainiv(authenc(hmac(sha1),cbc(des3_ede)))",
 			.cra_driver_name = "nss-hmac-sha1-cbc-3des",
 			.cra_priority   = 300,
 -			.cra_flags      = CRYPTO_ALG_ASYNC | CRYPTO_ALG_NOSUPP_SG,
 +			.cra_flags      = CRYPTO_ALG_ASYNC | CRYPTO_ALG_NOSUPP_SG | CRYPTO_ALG_KERN_DRIVER_ONLY,
 			.cra_blocksize  = DES3_EDE_BLOCK_SIZE,
 			.cra_ctxsize    = sizeof(struct nss_cryptoapi_ctx),
 			.cra_alignmask  = 0,
@@ -129,7 +129,7 @@ struct aead_alg cryptoapi_aead_algs[] = {
 			.cra_name       = "echainiv(authenc(hmac(sha256),cbc(aes)))",
 			.cra_driver_name = "nss-hmac-sha256-cbc-aes",
 			.cra_priority   = 10000,
 -			.cra_flags      = CRYPTO_ALG_ASYNC | CRYPTO_ALG_NOSUPP_SG | CRYPTO_ALG_NEED_FALLBACK,
 +			.cra_flags      = CRYPTO_ALG_ASYNC | CRYPTO_ALG_NOSUPP_SG | CRYPTO_ALG_NEED_FALLBACK | CRYPTO_ALG_KERN_DRIVER_ONLY,
 			.cra_blocksize  = AES_BLOCK_SIZE,
 			.cra_ctxsize    = sizeof(struct nss_cryptoapi_ctx),
 			.cra_alignmask  = 0,
@@ -150,7 +150,7 @@ struct aead_alg cryptoapi_aead_algs[] = {
 			.cra_name       = "seqiv(authenc(hmac(sha256),rfc3686(ctr(aes))))",
 			.cra_driver_name = "nss-hmac-sha256-rfc3686-ctr-aes",
 			.cra_priority   = 10000,
 -			.cra_flags      = CRYPTO_ALG_ASYNC | CRYPTO_ALG_NOSUPP_SG | CRYPTO_ALG_NEED_FALLBACK,
 +			.cra_flags      = CRYPTO_ALG_ASYNC | CRYPTO_ALG_NOSUPP_SG | CRYPTO_ALG_NEED_FALLBACK | CRYPTO_ALG_KERN_DRIVER_ONLY,
 			.cra_blocksize  = AES_BLOCK_SIZE,
 			.cra_ctxsize    = sizeof(struct nss_cryptoapi_ctx),
 			.cra_alignmask  = 0,
@@ -171,7 +171,7 @@ struct aead_alg cryptoapi_aead_algs[] = {
 			.cra_name       = "echainiv(authenc(hmac(sha256),cbc(des3_ede)))",
 			.cra_driver_name = "nss-hmac-sha256-cbc-3des",
 			.cra_priority   = 300,
 -			.cra_flags      = CRYPTO_ALG_ASYNC | CRYPTO_ALG_NOSUPP_SG,
 +			.cra_flags      = CRYPTO_ALG_ASYNC | CRYPTO_ALG_NOSUPP_SG | CRYPTO_ALG_KERN_DRIVER_ONLY,
 			.cra_blocksize  = DES3_EDE_BLOCK_SIZE,
 			.cra_ctxsize    = sizeof(struct nss_cryptoapi_ctx),
 			.cra_alignmask  = 0,
@@ -192,75 +192,66 @@ struct aead_alg cryptoapi_aead_algs[] = {
 /*
  * ABLK cipher algorithms
  */
 -static struct crypto_alg cryptoapi_ablkcipher_algs[] = {
 +static struct skcipher_alg cryptoapi_skcipher_algs[] = {
 	{
 -		.cra_name       = "cbc(aes)",
 -		.cra_driver_name = "nss-cbc-aes",
 -		.cra_priority   = 10000,
 -		.cra_flags      = CRYPTO_ALG_TYPE_ABLKCIPHER | CRYPTO_ALG_NOSUPP_SG | CRYPTO_ALG_ASYNC | CRYPTO_ALG_NEED_FALLBACK,
 -		.cra_blocksize  = AES_BLOCK_SIZE,
 -		.cra_ctxsize    = sizeof(struct nss_cryptoapi_ctx),
 -		.cra_alignmask  = 0,
 -		.cra_type       = &crypto_ablkcipher_type,
 -		.cra_module     = THIS_MODULE,
 -		.cra_init       = nss_cryptoapi_ablkcipher_init,
 -		.cra_exit       = nss_cryptoapi_ablkcipher_exit,
 -		.cra_u          = {
 -			.ablkcipher = {
 -				.ivsize         = AES_BLOCK_SIZE,
 -				.min_keysize    = AES_MIN_KEY_SIZE,
 -				.max_keysize    = AES_MAX_KEY_SIZE,
 -				.setkey         = nss_cryptoapi_ablk_aes_setkey,
 -				.encrypt        = nss_cryptoapi_ablk_aes_encrypt,
 -				.decrypt        = nss_cryptoapi_ablk_aes_decrypt,
 -			},
 +		.base = {
 +			.cra_name       = "cbc(aes)",
 +			.cra_driver_name = "nss-cbc-aes",
 +			.cra_priority   = 10000,
 +			.cra_flags      = CRYPTO_ALG_TYPE_SKCIPHER | CRYPTO_ALG_NOSUPP_SG | CRYPTO_ALG_ASYNC | CRYPTO_ALG_NEED_FALLBACK | CRYPTO_ALG_KERN_DRIVER_ONLY,
 +			.cra_blocksize  = AES_BLOCK_SIZE,
 +			.cra_ctxsize    = sizeof(struct nss_cryptoapi_ctx),
 +			.cra_alignmask  = 0,
 +			.cra_module     = THIS_MODULE,
 		},
 +		.init       = nss_cryptoapi_skcipher_init,
 +		.exit       = nss_cryptoapi_skcipher_exit,
 +		.ivsize         = AES_BLOCK_SIZE,
 +		.min_keysize    = AES_MIN_KEY_SIZE,
 +		.max_keysize    = AES_MAX_KEY_SIZE,
 +		.setkey         = nss_cryptoapi_ablk_aes_setkey,
 +		.encrypt        = nss_cryptoapi_ablk_aes_encrypt,
 +		.decrypt        = nss_cryptoapi_ablk_aes_decrypt,
 	},
 	{
 -		.cra_name       = "rfc3686(ctr(aes))",
 -		.cra_driver_name = "nss-rfc3686-ctr-aes",
 -		.cra_priority   = 30000,
 -		.cra_flags      = CRYPTO_ALG_TYPE_ABLKCIPHER | CRYPTO_ALG_NOSUPP_SG | CRYPTO_ALG_ASYNC | CRYPTO_ALG_NEED_FALLBACK,
 -		.cra_blocksize  = AES_BLOCK_SIZE,
 -		.cra_ctxsize    = sizeof(struct nss_cryptoapi_ctx),
 -		.cra_alignmask  = 0,
 -		.cra_type       = &crypto_ablkcipher_type,
 -		.cra_module     = THIS_MODULE,
 -		.cra_init       = nss_cryptoapi_ablkcipher_init,
 -		.cra_exit       = nss_cryptoapi_ablkcipher_exit,
 -		.cra_u          = {
 -			.ablkcipher = {
 -				.ivsize         = CTR_RFC3686_IV_SIZE,
 -				.min_keysize    = AES_MIN_KEY_SIZE + CTR_RFC3686_NONCE_SIZE,
 -				.max_keysize    = AES_MAX_KEY_SIZE + CTR_RFC3686_NONCE_SIZE,
 -				.setkey         = nss_cryptoapi_ablk_aes_setkey,
 -				.encrypt        = nss_cryptoapi_ablk_aes_encrypt,
 -				.decrypt        = nss_cryptoapi_ablk_aes_decrypt,
 -			},
 +		.base = {
 +			.cra_name       = "rfc3686(ctr(aes))",
 +			.cra_driver_name = "nss-rfc3686-ctr-aes",
 +			.cra_priority   = 30000,
 +			.cra_flags      = CRYPTO_ALG_TYPE_SKCIPHER | CRYPTO_ALG_NOSUPP_SG | CRYPTO_ALG_ASYNC | CRYPTO_ALG_NEED_FALLBACK | CRYPTO_ALG_KERN_DRIVER_ONLY,
 +			.cra_blocksize  = AES_BLOCK_SIZE,
 +			.cra_ctxsize    = sizeof(struct nss_cryptoapi_ctx),
 +			.cra_alignmask  = 0,
 +			.cra_module     = THIS_MODULE,
 		},
 +		.init       = nss_cryptoapi_skcipher_init,
 +		.exit       = nss_cryptoapi_skcipher_exit,
 +		.ivsize         = CTR_RFC3686_IV_SIZE,
 +		.min_keysize    = AES_MIN_KEY_SIZE + CTR_RFC3686_NONCE_SIZE,
 +		.max_keysize    = AES_MAX_KEY_SIZE + CTR_RFC3686_NONCE_SIZE,
 +		.setkey         = nss_cryptoapi_ablk_aes_setkey,
 +		.encrypt        = nss_cryptoapi_ablk_aes_encrypt,
 +		.decrypt        = nss_cryptoapi_ablk_aes_decrypt,
 	},
 	{
 -		.cra_name       = "cbc(des3_ede)",
 -		.cra_driver_name = "nss-cbc-3des",
 -		.cra_priority   = 1000,
 -		.cra_flags      = CRYPTO_ALG_TYPE_ABLKCIPHER | CRYPTO_ALG_NOSUPP_SG | CRYPTO_ALG_ASYNC,
 -		.cra_blocksize  = DES3_EDE_BLOCK_SIZE,
 -		.cra_ctxsize    = sizeof(struct nss_cryptoapi_ctx),
 -		.cra_alignmask  = 0,
 -		.cra_type       = &crypto_ablkcipher_type,
 -		.cra_module     = THIS_MODULE,
 -		.cra_init       = nss_cryptoapi_ablkcipher_init,
 -		.cra_exit       = nss_cryptoapi_ablkcipher_exit,
 -		.cra_u          = {
 -			.ablkcipher = {
 -				.ivsize         = DES3_EDE_BLOCK_SIZE,
 -				.min_keysize    = DES3_EDE_KEY_SIZE,
 -				.max_keysize    = DES3_EDE_KEY_SIZE,
 -				.setkey         = nss_cryptoapi_3des_cbc_setkey,
 -				.encrypt        = nss_cryptoapi_3des_cbc_encrypt,
 -				.decrypt        = nss_cryptoapi_3des_cbc_decrypt,
 -			},
 +		.base = {
 +			.cra_name       = "cbc(des3_ede)",
 +			.cra_driver_name = "nss-cbc-3des",
 +			.cra_priority   = 1000,
 +			.cra_flags      = CRYPTO_ALG_TYPE_SKCIPHER | CRYPTO_ALG_NOSUPP_SG | CRYPTO_ALG_ASYNC | CRYPTO_ALG_KERN_DRIVER_ONLY,
 +			.cra_blocksize  = DES3_EDE_BLOCK_SIZE,
 +			.cra_ctxsize    = sizeof(struct nss_cryptoapi_ctx),
 +			.cra_alignmask  = 0,
 +			.cra_module     = THIS_MODULE,
 		},
 +		.init       = nss_cryptoapi_skcipher_init,
 +		.exit       = nss_cryptoapi_skcipher_exit,
 +		.ivsize         = DES3_EDE_BLOCK_SIZE,
 +		.min_keysize    = DES3_EDE_KEY_SIZE,
 +		.max_keysize    = DES3_EDE_KEY_SIZE,
 +		.setkey         = nss_cryptoapi_3des_cbc_setkey,
 +		.encrypt        = nss_cryptoapi_3des_cbc_encrypt,
 +		.decrypt        = nss_cryptoapi_3des_cbc_decrypt,
 	},
 };
@@ -277,14 +268,14 @@ static nss_crypto_user_ctx_t nss_cryptoapi_register(nss_crypto_handle_t crypto)
 	sc->crypto = crypto;
 -	for (i = 0; i < ARRAY_SIZE(cryptoapi_ablkcipher_algs); i++) {
 -		rc = crypto_register_alg(&cryptoapi_ablkcipher_algs[i]);
 +	for (i = 0; i < ARRAY_SIZE(cryptoapi_skcipher_algs); i++) {
 +		rc = crypto_register_skcipher(&cryptoapi_skcipher_algs[i]);
 		if (rc) {
 -			nss_cfi_trace("Ablk registration failed, algo: %s\n", cryptoapi_ablkcipher_algs[i].cra_name);
 -			cryptoapi_ablkcipher_algs[i].cra_flags = 0;
 +			nss_cfi_trace("Ablk registration failed, algo: %s\n", cryptoapi_skcipher_algs[i].base.cra_name);
 +			cryptoapi_skcipher_algs[i].base.cra_flags = 0;
 			continue;
 		}
 -		nss_cfi_info("Ablk registration succeeded, algo: %s\n", cryptoapi_ablkcipher_algs[i].cra_name);
 +		nss_cfi_info("Ablk registration succeeded, algo: %s\n", cryptoapi_skcipher_algs[i].base.cra_name);
 	}
 	for (i = 0; i < ARRAY_SIZE(cryptoapi_aead_algs); i++) {
@@ -317,7 +308,7 @@ static nss_crypto_user_ctx_t nss_cryptoapi_register(nss_crypto_handle_t crypto)
 static void nss_cryptoapi_unregister(nss_crypto_user_ctx_t cfi)
 {
 	struct nss_cryptoapi *sc = &gbl_ctx;
 -	int i, ret = 0;
 +	int i;
 	nss_cfi_info("unregister nss_cryptoapi\n");
@@ -326,16 +317,12 @@ static void nss_cryptoapi_unregister(nss_crypto_user_ctx_t cfi)
 	 */
 	atomic_set(&gbl_ctx.registered, 0);
 -	for (i = 0; i < ARRAY_SIZE(cryptoapi_ablkcipher_algs); i++) {
 -		if (!cryptoapi_ablkcipher_algs[i].cra_flags) {
 -			continue;
 -		}
 -		ret = crypto_unregister_alg(&cryptoapi_ablkcipher_algs[i]);
 -		if (ret) {
 -			nss_cfi_err("Ablk unregister failed, algo: %s\n", cryptoapi_ablkcipher_algs[i].cra_name);
 +	for (i = 0; i < ARRAY_SIZE(cryptoapi_skcipher_algs); i++) {
 +		if (!cryptoapi_skcipher_algs[i].base.cra_flags) {
 			continue;
 		}
 -		nss_cfi_info("Ablk unregister succeeded, algo: %s\n", cryptoapi_ablkcipher_algs[i].cra_name);
 +		crypto_unregister_skcipher(&cryptoapi_skcipher_algs[i]);
 +		nss_cfi_info("Ablk unregister succeeded, algo: %s\n", cryptoapi_skcipher_algs[i].base.cra_name);
 	}
 	for (i = 0; i < ARRAY_SIZE(cryptoapi_aead_algs); i++) {
 diff --git a/cryptoapi/v1.1/nss_cryptoapi_ablk.c b/cryptoapi/v1.1/nss_cryptoapi_ablk.c
 index 9b6c65e..913e9cc 100644
 --- a/cryptoapi/v1.1/nss_cryptoapi_ablk.c
 +++ b/cryptoapi/v1.1/nss_cryptoapi_ablk.c
@@ -102,12 +102,12 @@ int nss_cryptoapi_skcipher_ctx2session(struct crypto_skcipher *sk, uint32_t *sid
 EXPORT_SYMBOL(nss_cryptoapi_skcipher_ctx2session);
 /*
 - * nss_cryptoapi_ablkcipher_init()
 - * 	Cryptoapi ablkcipher init function.
 + * nss_cryptoapi_skcipher_init()
 + * 	Cryptoapi skcipher init function.
  */
 -int nss_cryptoapi_ablkcipher_init(struct crypto_tfm *tfm)
 +int nss_cryptoapi_skcipher_init(struct crypto_skcipher  *tfm)
 {
 -	struct nss_cryptoapi_ctx *ctx = crypto_tfm_ctx(tfm);
 +	struct nss_cryptoapi_ctx *ctx = crypto_skcipher_ctx(tfm);
 	struct crypto_cipher *sw_tfm;
 	nss_cfi_assert(ctx);
@@ -122,31 +122,31 @@ int nss_cryptoapi_ablkcipher_init(struct crypto_tfm *tfm)
 	nss_cryptoapi_set_magic(ctx);
 -	if (!(crypto_tfm_alg_type(tfm) & CRYPTO_ALG_NEED_FALLBACK))
 +	if (!(crypto_tfm_alg_type(&tfm->base) & CRYPTO_ALG_NEED_FALLBACK))
 		return 0;
 	/* Alloc fallback transform for future use */
 -	sw_tfm = crypto_alloc_cipher(crypto_tfm_alg_name(tfm), 0, CRYPTO_ALG_ASYNC |
 +	sw_tfm = crypto_alloc_cipher(crypto_tfm_alg_name(&tfm->base), 0, CRYPTO_ALG_ASYNC |
  									CRYPTO_ALG_NEED_FALLBACK);
 	if (IS_ERR(sw_tfm)) {
 -		nss_cfi_err("unable to alloc software crypto for %s\n", crypto_tfm_alg_name(tfm));
 +		nss_cfi_err("unable to alloc software crypto for %s\n", crypto_tfm_alg_name(&tfm->base));
 		return -EINVAL;
 	}
 	/* set this tfm reqsize same to fallback tfm */
 -	tfm->crt_ablkcipher.reqsize = sizeof(struct nss_cryptoapi_ctx);
 +	crypto_skcipher_set_reqsize(tfm, sizeof(struct nss_cryptoapi_ctx));
 	ctx->sw_tfm = crypto_cipher_tfm(sw_tfm);
 	return 0;
 }
 /*
 - * nss_cryptoapi_ablkcipher_exit()
 - * 	Cryptoapi ablkcipher exit function.
 + * nss_cryptoapi_skcipher_exit()
 + * 	Cryptoapi skcipher exit function.
  */
 -void nss_cryptoapi_ablkcipher_exit(struct crypto_tfm *tfm)
 +void nss_cryptoapi_skcipher_exit(struct crypto_skcipher *tfm)
 {
 -	struct nss_cryptoapi_ctx *ctx = crypto_tfm_ctx(tfm);
 +	struct nss_cryptoapi_ctx *ctx = crypto_skcipher_ctx(tfm);
 	struct nss_cryptoapi *sc = &gbl_ctx;
 	nss_crypto_status_t status;
@@ -158,7 +158,7 @@ void nss_cryptoapi_ablkcipher_exit(struct crypto_tfm *tfm)
 	}
 	if (ctx->sw_tfm) {
 -		crypto_free_ablkcipher(__crypto_ablkcipher_cast(ctx->sw_tfm));
 +		crypto_free_skcipher(__crypto_skcipher_cast(ctx->sw_tfm));
 		ctx->sw_tfm = NULL;
 	}
@@ -183,9 +183,9 @@ void nss_cryptoapi_ablkcipher_exit(struct crypto_tfm *tfm)
  * nss_cryptoapi_ablk_aes_setkey()
  * 	Cryptoapi setkey routine for aes.
  */
 -int nss_cryptoapi_ablk_aes_setkey(struct crypto_ablkcipher *cipher, const u8 *key, unsigned int keylen)
 +int nss_cryptoapi_ablk_aes_setkey(struct crypto_skcipher *cipher, const u8 *key, unsigned int keylen)
 {
 -	struct crypto_tfm *tfm = crypto_ablkcipher_tfm(cipher);
 +	struct crypto_tfm *tfm = crypto_skcipher_tfm(cipher);
 	struct nss_cryptoapi_ctx *ctx = crypto_tfm_ctx(tfm);
 	struct nss_cryptoapi *sc = &gbl_ctx;
 	struct nss_crypto_key cip;
@@ -255,10 +255,10 @@ int nss_cryptoapi_ablk_aes_setkey(struct crypto_ablkcipher *cipher, const u8 *ke
 		/* set flag to fallback tfm */
 		crypto_tfm_clear_flags(ctx->sw_tfm, CRYPTO_TFM_REQ_MASK);
 -		crypto_tfm_set_flags(ctx->sw_tfm, crypto_ablkcipher_get_flags(cipher) & CRYPTO_TFM_REQ_MASK);
 +		crypto_tfm_set_flags(ctx->sw_tfm, crypto_skcipher_get_flags(cipher) & CRYPTO_TFM_REQ_MASK);
 		 /* Set key to the fallback tfm */
 -		ret = crypto_ablkcipher_setkey(__crypto_ablkcipher_cast(ctx->sw_tfm), key, keylen);
 +		ret = crypto_skcipher_setkey(__crypto_skcipher_cast(ctx->sw_tfm), key, keylen);
 		if (ret) {
 			nss_cfi_err("Failed to set key to the sw crypto");
@@ -266,7 +266,7 @@ int nss_cryptoapi_ablk_aes_setkey(struct crypto_ablkcipher *cipher, const u8 *ke
 			 * Set back the fallback tfm flag to the original flag one after
 			 * doing setkey
 			 */
 -			crypto_ablkcipher_set_flags(cipher, crypto_tfm_get_flags(ctx->sw_tfm));
 +			crypto_skcipher_set_flags(cipher, crypto_tfm_get_flags(ctx->sw_tfm));
 		}
 		return ret;
 	default:
@@ -289,23 +289,23 @@ int nss_cryptoapi_ablk_aes_setkey(struct crypto_ablkcipher *cipher, const u8 *ke
 	return 0;
 fail:
 -	crypto_ablkcipher_set_flags(cipher, flag);
 +	crypto_skcipher_set_flags(cipher, flag);
 	return -EINVAL;
 }
 /*
 - * nss_cryptoapi_ablkcipher_done()
 + * nss_cryptoapi_skcipher_done()
  * 	Cipher operation completion callback function
  */
 -void nss_cryptoapi_ablkcipher_done(struct nss_crypto_buf *buf)
 +void nss_cryptoapi_skcipher_done(struct nss_crypto_buf *buf)
 {
 	struct nss_cryptoapi_ctx *ctx;
 -	struct ablkcipher_request *req;
 +	struct skcipher_request *req;
 	int err = 0;
 	nss_cfi_assert(buf);
 -	req = (struct ablkcipher_request *)nss_crypto_get_cb_ctx(buf);
 +	req = (struct skcipher_request *)nss_crypto_get_cb_ctx(buf);
 	/*
 	 * check cryptoapi context magic number.
@@ -319,7 +319,7 @@ void nss_cryptoapi_ablkcipher_done(struct nss_crypto_buf *buf)
 	nss_crypto_buf_free(gbl_ctx.crypto, buf);
 	nss_cfi_dbg("after transformation\n");
 -	nss_cfi_dbg_data(sg_virt(req->dst), req->nbytes, ' ');
 +	nss_cfi_dbg_data(sg_virt(req->dst), req->cryptlen, ' ');
 	/*
 	 * Passing always pass in case of encrypt.
@@ -337,7 +337,7 @@ void nss_cryptoapi_ablkcipher_done(struct nss_crypto_buf *buf)
  * 	Cryptoapi: obtain sg to virtual address mapping.
  * 	Check for multiple sg in src and dst
  */
 -int nss_cryptoapi_ablk_checkaddr(struct ablkcipher_request *req)
 +int nss_cryptoapi_ablk_checkaddr(struct skcipher_request *req)
 {
 	/*
 	 * Currently only single sg is supported
@@ -356,7 +356,7 @@ int nss_cryptoapi_ablk_checkaddr(struct ablkcipher_request *req)
 	/*
 	 * If the size of data is more than 65K reject transformation
 	 */
 -	if (req->nbytes > NSS_CRYPTOAPI_MAX_DATA_LEN) {
 +	if (req->cryptlen > NSS_CRYPTOAPI_MAX_DATA_LEN) {
 		nss_cfi_err("Buffer length exceeded limit\n");
 		return -EINVAL;
 	}
@@ -368,10 +368,10 @@ int nss_cryptoapi_ablk_checkaddr(struct ablkcipher_request *req)
  * nss_cryptoapi_ablk_transform()
  * 	Crytoapi common routine for encryption and decryption operations.
  */
 -struct nss_crypto_buf *nss_cryptoapi_ablk_transform(struct ablkcipher_request *req, struct nss_cryptoapi_ablk_info *info)
 +struct nss_crypto_buf *nss_cryptoapi_ablk_transform(struct skcipher_request *req, struct nss_cryptoapi_ablk_info *info)
 {
 -	struct crypto_ablkcipher *cipher = crypto_ablkcipher_reqtfm(req);
 -	struct nss_cryptoapi_ctx *ctx = crypto_ablkcipher_ctx(cipher);
 +	struct crypto_skcipher *cipher = crypto_skcipher_reqtfm(req);
 +	struct nss_cryptoapi_ctx *ctx = crypto_skcipher_ctx(cipher);
 	struct nss_crypto_buf *buf;
 	struct nss_cryptoapi *sc = &gbl_ctx;
 	nss_crypto_status_t status;
@@ -382,7 +382,7 @@ struct nss_crypto_buf *nss_cryptoapi_ablk_transform(struct ablkcipher_request *r
 	nss_cfi_assert(ctx);
 	nss_cfi_dbg("src_vaddr: 0x%p, dst_vaddr: 0x%p, iv: 0x%p\n",
 -			sg_virt(req->src), sg_virt(req->dst), req->info);
 +			sg_virt(req->src), sg_virt(req->dst), req->iv);
 	info->params->cipher_skip = 0;
 	info->params->auth_skip = 0;
@@ -419,19 +419,19 @@ struct nss_crypto_buf *nss_cryptoapi_ablk_transform(struct ablkcipher_request *r
 	/*
 	 * Get IV location and memcpy the IV
 	 */
 -	iv_size = crypto_ablkcipher_ivsize(cipher);
 +	iv_size = crypto_skcipher_ivsize(cipher);
 	iv_addr = nss_crypto_get_ivaddr(buf);
 	switch (ctx->cip_alg) {
 	case NSS_CRYPTO_CIPHER_AES_CBC:
 	case NSS_CRYPTO_CIPHER_DES:
 -		memcpy(iv_addr, req->info, iv_size);
 +		memcpy(iv_addr, req->iv, iv_size);
 		break;
 	case NSS_CRYPTO_CIPHER_AES_CTR:
 		((uint32_t *)iv_addr)[0] = ctx->ctx_iv[0];
 -		((uint32_t *)iv_addr)[1] = ((uint32_t *)req->info)[0];
 -		((uint32_t *)iv_addr)[2] = ((uint32_t *)req->info)[1];
 +		((uint32_t *)iv_addr)[1] = ((uint32_t *)req->iv)[0];
 +		((uint32_t *)iv_addr)[2] = ((uint32_t *)req->iv)[1];
 		((uint32_t *)iv_addr)[3] = ctx->ctx_iv[3];
 		break;
@@ -446,7 +446,7 @@ struct nss_crypto_buf *nss_cryptoapi_ablk_transform(struct ablkcipher_request *r
 	/*
 	 * Fill Cipher and Auth len
 	 */
 -	cipher_len = req->nbytes;
 +	cipher_len = req->cryptlen;
 	auth_len = 0;
 	nss_crypto_set_data(buf, sg_virt(req->src), sg_virt(req->dst), cipher_len);
@@ -463,12 +463,12 @@ struct nss_crypto_buf *nss_cryptoapi_ablk_transform(struct ablkcipher_request *r
 }
 /*
 - * nss_cryptoapi_ablkcipher_fallback()
 - *	Cryptoapi fallback for ablkcipher algorithm.
 + * nss_cryptoapi_skcipher_fallback()
 + *	Cryptoapi fallback for skcipher algorithm.
  */
 -int nss_cryptoapi_ablkcipher_fallback(struct nss_cryptoapi_ctx *ctx, struct ablkcipher_request *req, int type)
 +int nss_cryptoapi_skcipher_fallback(struct nss_cryptoapi_ctx *ctx, struct skcipher_request *req, int type)
 {
 -	struct crypto_ablkcipher *orig_tfm = crypto_ablkcipher_reqtfm(req);
 +	struct crypto_skcipher *orig_tfm = crypto_skcipher_reqtfm(req);
 	int err;
 	if (!ctx->sw_tfm) {
@@ -476,16 +476,16 @@ int nss_cryptoapi_ablkcipher_fallback(struct nss_cryptoapi_ctx *ctx, struct ablk
 	}
 	/* Set new fallback tfm to the request */
 -	ablkcipher_request_set_tfm(req, __crypto_ablkcipher_cast(ctx->sw_tfm));
 +	skcipher_request_set_tfm(req, __crypto_skcipher_cast(ctx->sw_tfm));
 	ctx->queued++;
 	switch (type) {
 	case NSS_CRYPTOAPI_ENCRYPT:
 -		err = crypto_ablkcipher_encrypt(req);
 +		err = crypto_skcipher_encrypt(req);
 		break;
 	case NSS_CRYPTOAPI_DECRYPT:
 -		err = crypto_ablkcipher_decrypt(req);
 +		err = crypto_skcipher_decrypt(req);
 		break;
 	default:
 		err = -EINVAL;
@@ -495,7 +495,7 @@ int nss_cryptoapi_ablkcipher_fallback(struct nss_cryptoapi_ctx *ctx, struct ablk
 		ctx->completed++;
 	/* Set original tfm to the request */
 -	ablkcipher_request_set_tfm(req, orig_tfm);
 +	skcipher_request_set_tfm(req, orig_tfm);
 	return err;
 }
@@ -504,13 +504,13 @@ int nss_cryptoapi_ablkcipher_fallback(struct nss_cryptoapi_ctx *ctx, struct ablk
  * nss_cryptoapi_ablk_aes_encrypt()
  * 	Crytoapi encrypt for aes(aes-cbc/rfc3686-aes-ctr) algorithms.
  */
 -int nss_cryptoapi_ablk_aes_encrypt(struct ablkcipher_request *req)
 +int nss_cryptoapi_ablk_aes_encrypt(struct skcipher_request *req)
 {
 	struct nss_crypto_params params = { .req_type = NSS_CRYPTO_REQ_TYPE_ENCRYPT };
 -	struct nss_cryptoapi_ablk_info info = {.cb_fn = nss_cryptoapi_ablkcipher_done,
 +	struct nss_cryptoapi_ablk_info info = {.cb_fn = nss_cryptoapi_skcipher_done,
 						.params = &params};
 -	struct crypto_ablkcipher *cipher = crypto_ablkcipher_reqtfm(req);
 -	struct nss_cryptoapi_ctx *ctx = crypto_ablkcipher_ctx(cipher);
 +	struct crypto_skcipher *cipher = crypto_skcipher_reqtfm(req);
 +	struct nss_cryptoapi_ctx *ctx = crypto_skcipher_ctx(cipher);
 	struct nss_cryptoapi *sc = &gbl_ctx;
 	struct nss_crypto_buf *buf;
@@ -520,7 +520,7 @@ int nss_cryptoapi_ablk_aes_encrypt(struct ablkcipher_request *req)
 	nss_cryptoapi_verify_magic(ctx);
 	if (ctx->fallback_req)
 -		return nss_cryptoapi_ablkcipher_fallback(ctx, req, NSS_CRYPTOAPI_ENCRYPT);
 +		return nss_cryptoapi_skcipher_fallback(ctx, req, NSS_CRYPTOAPI_ENCRYPT);
 	/*
 	 * Check if previous call to setkey couldn't allocate session with core crypto.
@@ -539,9 +539,9 @@ int nss_cryptoapi_ablk_aes_encrypt(struct ablkcipher_request *req)
 	 * According to RFC3686, AES-CTR algo need not be padded if the
 	 * plaintext or ciphertext is unaligned to block size boundary.
 	 */
 -	if (nss_cryptoapi_check_unalign(req->nbytes, AES_BLOCK_SIZE) && (ctx->cip_alg != NSS_CRYPTO_CIPHER_AES_CTR)) {
 +	if (nss_cryptoapi_check_unalign(req->cryptlen, AES_BLOCK_SIZE) && (ctx->cip_alg != NSS_CRYPTO_CIPHER_AES_CTR)) {
 		nss_cfi_err("Invalid cipher len - Not aligned to algo blocksize\n");
 -		crypto_ablkcipher_set_flags(cipher, CRYPTO_TFM_RES_BAD_BLOCK_LEN);
 +		crypto_skcipher_set_flags(cipher, CRYPTO_TFM_RES_BAD_BLOCK_LEN);
 		return -EINVAL;
 	}
@@ -571,13 +571,13 @@ int nss_cryptoapi_ablk_aes_encrypt(struct ablkcipher_request *req)
  * nss_cryptoapi_ablk_aes_decrypt()
  * 	Crytoapi decrypt for aes(aes-cbc/rfc3686-aes-ctr) algorithms.
  */
 -int nss_cryptoapi_ablk_aes_decrypt(struct ablkcipher_request *req)
 +int nss_cryptoapi_ablk_aes_decrypt(struct skcipher_request *req)
 {
 	struct nss_crypto_params params = { .req_type = NSS_CRYPTO_REQ_TYPE_DECRYPT };
 -	struct nss_cryptoapi_ablk_info info = {.cb_fn = nss_cryptoapi_ablkcipher_done,
 +	struct nss_cryptoapi_ablk_info info = {.cb_fn = nss_cryptoapi_skcipher_done,
 						.params = &params};
 -	struct crypto_ablkcipher *cipher = crypto_ablkcipher_reqtfm(req);
 -	struct nss_cryptoapi_ctx *ctx = crypto_ablkcipher_ctx(cipher);
 +	struct crypto_skcipher *cipher = crypto_skcipher_reqtfm(req);
 +	struct nss_cryptoapi_ctx *ctx = crypto_skcipher_ctx(cipher);
 	struct nss_cryptoapi *sc = &gbl_ctx;
 	struct nss_crypto_buf *buf;
@@ -587,7 +587,7 @@ int nss_cryptoapi_ablk_aes_decrypt(struct ablkcipher_request *req)
 	nss_cryptoapi_verify_magic(ctx);
 	if (ctx->fallback_req)
 -		return nss_cryptoapi_ablkcipher_fallback(ctx, req, NSS_CRYPTOAPI_DECRYPT);
 +		return nss_cryptoapi_skcipher_fallback(ctx, req, NSS_CRYPTOAPI_DECRYPT);
 	/*
 	 * Check if previous call to setkey couldn't allocate session with core crypto.
@@ -606,9 +606,9 @@ int nss_cryptoapi_ablk_aes_decrypt(struct ablkcipher_request *req)
 	 * According to RFC3686, AES-CTR algo need not be padded if the
 	 * plaintext or ciphertext is unaligned to block size boundary.
 	 */
 -	if (nss_cryptoapi_check_unalign(req->nbytes, AES_BLOCK_SIZE) && (ctx->cip_alg != NSS_CRYPTO_CIPHER_AES_CTR)) {
 +	if (nss_cryptoapi_check_unalign(req->cryptlen, AES_BLOCK_SIZE) && (ctx->cip_alg != NSS_CRYPTO_CIPHER_AES_CTR)) {
 		nss_cfi_err("Invalid cipher len - Not aligned to algo blocksize\n");
 -		crypto_ablkcipher_set_flags(cipher, CRYPTO_TFM_RES_BAD_BLOCK_LEN);
 +		crypto_skcipher_set_flags(cipher, CRYPTO_TFM_RES_BAD_BLOCK_LEN);
 		return -EINVAL;
 	}
@@ -638,9 +638,9 @@ int nss_cryptoapi_ablk_aes_decrypt(struct ablkcipher_request *req)
  * nss_cryptoapi_3des_cbc_setkey()
  * 	Cryptoapi DES3 CBC setkey function.
  */
 -int nss_cryptoapi_3des_cbc_setkey(struct crypto_ablkcipher *cipher, const u8 *key, unsigned int keylen)
 +int nss_cryptoapi_3des_cbc_setkey(struct crypto_skcipher *cipher, const u8 *key, unsigned int keylen)
 {
 -	struct crypto_tfm *tfm = crypto_ablkcipher_tfm(cipher);
 +	struct crypto_tfm *tfm = crypto_skcipher_tfm(cipher);
 	struct nss_cryptoapi_ctx *ctx = crypto_tfm_ctx(tfm);
 	struct nss_cryptoapi *sc = &gbl_ctx;
 	struct nss_crypto_key cip = { .algo = NSS_CRYPTO_CIPHER_DES };
@@ -693,7 +693,7 @@ int nss_cryptoapi_3des_cbc_setkey(struct crypto_ablkcipher *cipher, const u8 *ke
 	return 0;
 fail:
 -	crypto_ablkcipher_set_flags(cipher, flag);
 +	crypto_skcipher_set_flags(cipher, flag);
 	return -EINVAL;
 }
@@ -701,7 +701,7 @@ fail:
  * nss_cryptoapi_3des_cbc_encrypt()
  * 	Cryptoapi DES3 CBC encrypt function.
  */
 -int nss_cryptoapi_3des_cbc_encrypt(struct ablkcipher_request *req)
 +int nss_cryptoapi_3des_cbc_encrypt(struct skcipher_request *req)
 {
 	struct nss_cryptoapi *sc = &gbl_ctx;
 	struct nss_cryptoapi_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
@@ -727,14 +727,14 @@ int nss_cryptoapi_3des_cbc_encrypt(struct ablkcipher_request *req)
 		return -EINVAL;
 	}
 -	if (nss_cryptoapi_check_unalign(req->nbytes, DES3_EDE_BLOCK_SIZE)) {
 +	if (nss_cryptoapi_check_unalign(req->cryptlen, DES3_EDE_BLOCK_SIZE)) {
 		nss_cfi_err("Invalid cipher len - Not aligned to algo blocksize\n");
 -		crypto_ablkcipher_set_flags(crypto_ablkcipher_reqtfm(req), CRYPTO_TFM_RES_BAD_BLOCK_LEN);
 +		crypto_skcipher_set_flags(crypto_skcipher_reqtfm(req), CRYPTO_TFM_RES_BAD_BLOCK_LEN);
 		return -EINVAL;
 	}
 	info.params = &params;
 -	info.cb_fn = nss_cryptoapi_ablkcipher_done;
 +	info.cb_fn = nss_cryptoapi_skcipher_done;
 	buf = nss_cryptoapi_ablk_transform(req, &info);
 	if (!buf) {
@@ -762,7 +762,7 @@ int nss_cryptoapi_3des_cbc_encrypt(struct ablkcipher_request *req)
  * nss_cryptoapi_3des_cbc_decrypt()
  * 	Cryptoapi DES3 CBC decrypt function.
  */
 -int nss_cryptoapi_3des_cbc_decrypt(struct ablkcipher_request *req)
 +int nss_cryptoapi_3des_cbc_decrypt(struct skcipher_request *req)
 {
 	struct nss_cryptoapi *sc = &gbl_ctx;
 	struct nss_cryptoapi_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
@@ -788,14 +788,14 @@ int nss_cryptoapi_3des_cbc_decrypt(struct ablkcipher_request *req)
 		return -EINVAL;
 	}
 -	if (nss_cryptoapi_check_unalign(req->nbytes, DES3_EDE_BLOCK_SIZE)) {
 +	if (nss_cryptoapi_check_unalign(req->cryptlen, DES3_EDE_BLOCK_SIZE)) {
 		nss_cfi_err("Invalid cipher len - Not aligned to algo blocksize\n");
 -		crypto_ablkcipher_set_flags(crypto_ablkcipher_reqtfm(req), CRYPTO_TFM_RES_BAD_BLOCK_LEN);
 +		crypto_skcipher_set_flags(crypto_skcipher_reqtfm(req), CRYPTO_TFM_RES_BAD_BLOCK_LEN);
 		return -EINVAL;
 	}
 	info.params = &params;
 -	info.cb_fn = nss_cryptoapi_ablkcipher_done;
 +	info.cb_fn = nss_cryptoapi_skcipher_done;
 	buf = nss_cryptoapi_ablk_transform(req, &info);
 	if (!buf) {
 diff --git a/cryptoapi/v1.1/nss_cryptoapi_debugfs.c b/cryptoapi/v1.1/nss_cryptoapi_debugfs.c
 index dff774c..cf4bc70 100644
 --- a/cryptoapi/v1.1/nss_cryptoapi_debugfs.c
 +++ b/cryptoapi/v1.1/nss_cryptoapi_debugfs.c
@@ -55,6 +55,7 @@
  */
 void nss_cryptoapi_debugfs_add_stats(struct dentry *parent, struct nss_cryptoapi_ctx *session_ctx)
 {
 +	pr_info("add stats");
 	debugfs_create_u64("queued", S_IRUGO, parent, &session_ctx->queued);
 	debugfs_create_u64("completed", S_IRUGO, parent, &session_ctx->completed);
 	debugfs_create_u64("queue_failed", S_IRUGO, parent, &session_ctx->queue_failed);
 diff --git a/cryptoapi/v1.1/nss_cryptoapi_private.h b/cryptoapi/v1.1/nss_cryptoapi_private.h
 index 5feb9e3..70c6714 100644
 --- a/cryptoapi/v1.1/nss_cryptoapi_private.h
 +++ b/cryptoapi/v1.1/nss_cryptoapi_private.h
@@ -141,16 +141,16 @@ int nss_cryptoapi_sha256_3des_encrypt(struct aead_request *req);
 int nss_cryptoapi_sha256_3des_decrypt(struct aead_request *req);
 /* ABLKCIPHER */
 -int nss_cryptoapi_ablkcipher_init(struct crypto_tfm *tfm);
 -void nss_cryptoapi_ablkcipher_exit(struct crypto_tfm *tfm);
 -int nss_cryptoapi_ablk_aes_setkey(struct crypto_ablkcipher *cipher, const u8 *key, unsigned int len);
 -int nss_cryptoapi_3des_cbc_setkey(struct crypto_ablkcipher *cipher, const u8 *key, unsigned int len);
 +int nss_cryptoapi_skcipher_init(struct crypto_skcipher *tfm);
 +void nss_cryptoapi_skcipher_exit(struct crypto_skcipher *tfm);
 +int nss_cryptoapi_ablk_aes_setkey(struct crypto_skcipher *cipher, const u8 *key, unsigned int len);
 +int nss_cryptoapi_3des_cbc_setkey(struct crypto_skcipher *cipher, const u8 *key, unsigned int len);
 -int nss_cryptoapi_ablk_aes_encrypt(struct ablkcipher_request *req);
 -int nss_cryptoapi_ablk_aes_decrypt(struct ablkcipher_request *req);
 +int nss_cryptoapi_ablk_aes_encrypt(struct skcipher_request *req);
 +int nss_cryptoapi_ablk_aes_decrypt(struct skcipher_request *req);
 -int nss_cryptoapi_3des_cbc_encrypt(struct ablkcipher_request *req);
 -int nss_cryptoapi_3des_cbc_decrypt(struct ablkcipher_request *req);
 +int nss_cryptoapi_3des_cbc_encrypt(struct skcipher_request *req);
 +int nss_cryptoapi_3des_cbc_decrypt(struct skcipher_request *req);
 #endif /* __NSS_CRYPTOAPI_PRIVATE_H */
 -- 
 2.27.0.rc0
--- a/package/qca/nss/qca-nss-clients-64/Makefile
+++ b/package/qca/nss/qca-nss-clients-64/Makefile
@ -1,97 +0,0 @@
 include $(TOPDIR)/rules.mk
 PKG_NAME:=qca-nss-clients-64
 PKG_RELEASE:=$(AUTORELEASE)
 PKG_SOURCE_URL:=https://git.codelinaro.org/clo/qsdk/oss/lklm/nss-clients.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_DATE:=2021-04-29
 PKG_SOURCE_VERSION:=b93c72c1b72c591c2ddc2f0b24f0e2b457720118
 PKG_MIRROR_HASH:=fbfba64a364b095ea7c9a24cd7af96b63ab0bc29c179e1628c675aa223c0d063
 include $(INCLUDE_DIR)/kernel.mk
 include $(INCLUDE_DIR)/package.mk
 define KernelPackage/qca-nss-drv-pppoe-64
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=Kernel driver for NSS (connection manager) - PPPoE
  DEPENDS:=@(TARGET_ipq60xx||TARGET_ipq807x) +kmod-qca-nss-drv-64 +kmod-ppp +kmod-pppoe +kmod-bonding
  FILES:=$(PKG_BUILD_DIR)/pppoe/qca-nss-pppoe.ko
  AUTOLOAD:=$(call AutoLoad,51,qca-nss-pppoe)
 endef
 define KernelPackage/qca-nss-drv-pppoe-64/Description
 Kernel modules for NSS connection manager - Support for PPPoE
 endef
 define KernelPackage/qca-nss-drv-bridge-mgr-64
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=Kernel driver for NSS bridge manager
  DEPENDS:=@(LINUX_5_10||LINUX_5_15) @(TARGET_ipq60xx||TARGET_ipq807x) +kmod-qca-nss-drv-64 +kmod-qca-nss-drv-vlan-mgr-64
  FILES:=$(PKG_BUILD_DIR)/bridge/qca-nss-bridge-mgr.ko
  AUTOLOAD:=$(call AutoLoad,51,qca-nss-bridge-mgr)
 endef
 define KernelPackage/qca-nss-drv-bridge-mgr-64/Description
 Kernel modules for NSS bridge manager
 endef
 define KernelPackage/qca-nss-drv-vlan-mgr-64
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=Kernel driver for NSS vlan manager
  DEPENDS:=@(LINUX_5_10||LINUX_5_15) @(TARGET_ipq60xx||TARGET_ipq807x) +kmod-qca-nss-drv-64 +kmod-bonding
  FILES:=$(PKG_BUILD_DIR)/vlan/qca-nss-vlan.ko
  AUTOLOAD:=$(call AutoLoad,51,qca-nss-vlan)
 endef
 define KernelPackage/qca-nss-drv-vlan-mgr-64/Description
 Kernel modules for NSS vlan manager
 endef
 EXTRA_CFLAGS+= \
 	-I$(STAGING_DIR)/usr/include/qca-nss-drv \
 	-I$(STAGING_DIR)/usr/include/qca-nss-crypto \
 	-I$(STAGING_DIR)/usr/include/qca-nss-cfi \
 	-I$(STAGING_DIR)/usr/include/qca-nss-gmac \
 	-I$(STAGING_DIR)/usr/include/qca-ssdk \
 	-I$(STAGING_DIR)/usr/include/qca-ssdk/fal \
 	-I$(STAGING_DIR)/usr/include/nat46
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-pppoe-64),)
 NSS_CLIENTS_MAKE_OPTS+=pppoe=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-bridge-mgr-64),)
 NSS_CLIENTS_MAKE_OPTS+=bridge-mgr=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-vlan-mgr-64),)
 NSS_CLIENTS_MAKE_OPTS+=vlan-mgr=y
 endif
 ifeq ($(CONFIG_TARGET_BOARD), "ipq807x")
    SOC="ipq807x_64"
 else ifeq ($(CONFIG_TARGET_BOARD), "ipq60xx")
    SOC="ipq60xx_64"
 endif
 define Build/Compile
 	$(MAKE) -C "$(LINUX_DIR)" $(strip $(NSS_CLIENTS_MAKE_OPTS)) \
 		CROSS_COMPILE="$(TARGET_CROSS)" \
 		ARCH="$(LINUX_KARCH)" \
 		M="$(PKG_BUILD_DIR)" \
 		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
 		SoC=$(SOC) \
 		$(KERNEL_MAKE_FLAGS) \
 		modules
 endef
 $(eval $(call KernelPackage,qca-nss-drv-pppoe-64))
 $(eval $(call KernelPackage,qca-nss-drv-bridge-mgr-64))
 $(eval $(call KernelPackage,qca-nss-drv-vlan-mgr-64))
--- a/package/qca/nss/qca-nss-clients-64/files/qca-nss-ipsec
+++ b/package/qca/nss/qca-nss-clients-64/files/qca-nss-ipsec
@ -1,214 +0,0 @@
 #!/bin/sh  /etc/rc.common
 #
 # Copyright (c) 2018-2019, 2021 The Linux Foundation. All rights reserved.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 NSS_IPSEC_LOG_FILE=/tmp/.nss_ipsec_log
 NSS_IPSEC_LOG_STR_ECM="ECM_Loaded"
 NSS_IPSEC_OL_FILE=/tmp/qca_nss_ipsec_ol
 ecm_load () {
 	if [ ! -d /sys/module/ecm ]; then
 		/etc/init.d/qca-nss-ecm start
 		if [ -d /sys/module/ecm ]; then
 			echo ${NSS_IPSEC_LOG_STR_ECM} >> ${NSS_IPSEC_LOG_FILE}
 		fi
 	fi
 }
 ecm_unload () {
 	if [ -f /tmp/.nss_ipsec_log ]; then
 		str=`grep ${NSS_IPSEC_LOG_STR_ECM} ${NSS_IPSEC_LOG_FILE}`
 		if [[ $str == ${NSS_IPSEC_LOG_STR_ECM} ]]; then
 			/etc/init.d/qca-nss-ecm stop
 			`sed 's/${NSS_IPSEC_LOG_STR_ECM}/ /g' $NSS_IPSEC_LOG_FILE >  $NSS_IPSEC_LOG_FILE`
 		fi
 	fi
 }
 ecm_disable() {
 	if [ ! -d /sys/module/ecm ]; then
 		return;
 	fi
 	echo 1 > /sys/kernel/debug/ecm/front_end_ipv4_stop
 	echo 1 > /sys/kernel/debug/ecm/front_end_ipv6_stop
 	echo 1 > /sys/kernel/debug/ecm/ecm_db/defunct_all
 	sleep 2
 }
 ecm_enable() {
 	if [ ! -d /sys/module/ecm ]; then
 		return;
 	fi
 	echo 0 > /sys/kernel/debug/ecm/ecm_db/defunct_all
 	echo 0 > /sys/kernel/debug/ecm/front_end_ipv4_stop
 	echo 0 > /sys/kernel/debug/ecm/front_end_ipv6_stop
 }
 kernel_version_check_5_4() {
 	major_ver=$(uname -r | awk -F '.' '{print $1}')
 	minor_ver=$(uname -r | awk -F '.' '{print $2}')
 	if [ $major_ver -lt 5 ] || ([ $major_ver -eq 5 ] && [ $minor_ver -lt 4 ] ) ; then
 		return 1
 	else
 		return 0
 	fi
 }
 start_klips() {
 	if kernel_version_check_5_4
 	then
 		echo "Kernel 5.4 doesn't support klips stack."
 		return $?
 	fi
 	touch $NSS_IPSEC_OL_FILE
 	ecm_load
 	local kernel_version=$(uname -r)
 	insmod /lib/modules/${kernel_version}/qca-nss-ipsec-klips.ko
 	if [ "$?" -gt 0 ]; then
 		echo "Failed to load plugin. Please start ecm if not done already"
 		ecm_enable
 		rm $NSS_IPSEC_OL_FILE
 		return
 	fi
 	/etc/init.d/ipsec start
 	sleep 2
 	ipsec eroute
 	ecm_enable
 }
 stop_klips() {
 	if kernel_version_check_5_4
 	then
 		echo "Kernel 5.4 doesn't support klips stack."
 		return $?
 	fi
 	ecm_disable
 	/etc/init.d/ipsec stop
 	rmmod qca-nss-ipsec-klips
 	rm $NSS_IPSEC_OL_FILE
 	ecm_unload
 }
 start_xfrm() {
 	touch $NSS_IPSEC_OL_FILE
 	ecm_load
 	local kernel_version=$(uname -r)
 	# load all NETKEY modules first.
 	for mod in xfrm_ipcomp ipcomp xfrm6_tunnel ipcomp6 xfrm6_mode_tunnel xfrm6_mode_beet xfrm6_mode_ro \
 		xfrm6_mode_transport xfrm4_mode_transport xfrm4_mode_tunnel \
 		xfrm4_tunnel xfrm4_mode_beet esp4 esp6 ah4 ah6 af_key
 		do
 			insmod $mod 2> /dev/null
 		done
 	# Now load the xfrm plugin
 	insmod /lib/modules/${kernel_version}/qca-nss-ipsec-xfrm.ko
 	if [ "$?" -gt 0 ]; then
 		echo "Failed to load plugin. Please start ecm if not done already"
 		ecm_enable
 		rm $NSS_IPSEC_OL_FILE
 		return
 	fi
 	/etc/init.d/ipsec start
 	sleep 2
 	ecm_enable
 }
 stop_xfrm() {
 	ecm_disable
 	#Shutdown Pluto first. Then only plugin can be removed.
 	plutopid=/var/run/pluto/pluto.pid
 	if [ -f $plutopid ]; then
 		pid=`cat $plutopid`
 		if [ ! -z "$pid" ]; then
 			ipsec whack --shutdown | grep -v "002";
 			if [ -s $plutopid ]; then
 				echo "Attempt to shut Pluto down failed!  Trying kill:"
 				kill $pid;
 				sleep 5;
 			fi
 		fi
 		rm -rf $plutopid
 	fi
 	ip xfrm state flush;
 	ip xfrm policy flush;
 	sleep 2
 	#Now we can remove the plugin
 	retries=5
 	while [ -d /sys/module/qca_nss_ipsec_xfrm ]
 	do
 		rmmod qca-nss-ipsec-xfrm
 		if [ "$?" -eq 0 ]; then
 			rm $NSS_IPSEC_OL_FILE
 			break
 		fi
 		if [ ${retries} -eq 0 ]; then
 			echo "Failed to unload qca-nss-ipsec-xfrm plugin!"
 			exit
 		fi
 		echo "XFRM plugin unload failed; retrying ${retries} times"
 		sleep 1
 		retries=`expr ${retries} - 1`
 	done
 	/etc/init.d/ipsec stop
 	ecm_unload
 }
 start() {
 	local protostack=`uci -q get ipsec.setup.protostack`
 	if [ "$protostack" = "klips" ]; then
 		start_klips
 		return $?
 	fi
 	start_xfrm
 	return $?
 }
 stop() {
 	local protostack=`uci -q get ipsec.setup.protostack`
 	if [ "$protostack" = "klips" ]; then
 		stop_klips
 		return $?
 	fi
 	stop_xfrm
 	return $?
 }
 restart() {
 	stop
 	start
 }
--- a/package/qca/nss/qca-nss-clients-64/files/qca-nss-mirred.init
+++ b/package/qca/nss/qca-nss-clients-64/files/qca-nss-mirred.init
@ -1,28 +0,0 @@
 #!/bin/sh /etc/rc.common
 ###########################################################################
 # Copyright (c) 2019, The Linux Foundation. All rights reserved.
 # Permission to use, copy, modify, and/or distribute this software for
 # any purpose with or without fee is hereby granted, provided that the
 # above copyright notice and this permission notice appear in all copies.
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
 # OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 ###########################################################################
 restart() {
 	rmmod act_nssmirred.ko
 	insmod act_nssmirred.ko
 }
 start() {
 	insmod act_nssmirred.ko
 }
 stop() {
 	rmmod act_nssmirred.ko
 }
--- a/package/qca/nss/qca-nss-clients-64/files/qca-nss-ovpn.init
+++ b/package/qca/nss/qca-nss-clients-64/files/qca-nss-ovpn.init
@ -1,69 +0,0 @@
 #!/bin/sh /etc/rc.common
 ###########################################################################
 # Copyright (c) 2019, The Linux Foundation. All rights reserved.
 # Permission to use, copy, modify, and/or distribute this software for
 # any purpose with or without fee is hereby granted, provided that the
 # above copyright notice and this permission notice appear in all copies.
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
 # OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 ###########################################################################
 ecm_disable() {
 	if [ ! -d /sys/module/ecm ]; then
 	   return
 	fi
 	echo 1 > /sys/kernel/debug/ecm/front_end_ipv4_stop
 	echo 1 > /sys/kernel/debug/ecm/front_end_ipv6_stop
 	echo 1 > /sys/kernel/debug/ecm/ecm_db/defunct_all
 	sleep 2
 }
 ecm_enable() {
 	if [ ! -d /sys/module/ecm ]; then
 	   return
 	fi
 	echo 0 > /sys/kernel/debug/ecm/ecm_db/defunct_all
 	echo 0 > /sys/kernel/debug/ecm/front_end_ipv4_stop
 	echo 0 > /sys/kernel/debug/ecm/front_end_ipv6_stop
 }
 restart() {
 	ecm_disable
 	/etc/init.d/openvpn stop
 	rmmod qca-nss-ovpn-link
 	rmmod qca-nss-ovpn-mgr
 	insmod qca-nss-ovpn-mgr
 	insmod qca-nss-ovpn-link
 	if [ "$?" -gt 0 ]; then
 		echo "Failed to load plugin. Please start ecm if not done already"
 		ecm_enable
 		return
 	fi
 	ecm_enable
 }
 start() {
 	restart
 }
 stop() {
 	ecm_disable
 	/etc/init.d/openvpn stop
 	rmmod qca-nss-ovpn-link
 	rmmod qca-nss-ovpn-mgr
 	ecm_enable
 }
--- a/package/qca/nss/qca-nss-clients/Makefile
+++ b/package/qca/nss/qca-nss-clients/Makefile
@ -1,469 +0,0 @@
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 PKG_NAME:=qca-nss-clients
 PKG_RELEASE:=2
 PKG_SOURCE_URL:=https://git.codelinaro.org/clo/qsdk/oss/lklm/nss-clients.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_VERSION:=740d0102c518cd49f30c5580982b218b480006b1
 PKG_MIRROR_HASH:=2f427d01dba69b1b89d3a081daf08b36fb345d55b9c9462eb358e5b071e2a171
 include $(INCLUDE_DIR)/package.mk
 # Keep default as ipq806x for branches that does not have subtarget framework
 ifeq ($(CONFIG_TARGET_ipq),y)
 subtarget:=$(SUBTARGET)
 else
 subtarget:=$(CONFIG_TARGET_BOARD)
 endif
 ifneq (, $(findstring $(subtarget), "ipq807x" "ipq807x_64" "ipq60xx" "ipq60xx_64"))
 # DTLS Manager v2.0 for Hawkeye/Cypress
  DTLSMGR_DIR:=v2.0
 # IPsec Manager v2.0 for Hawkeye/Cypress
  IPSECMGR_DIR:=v2.0
 # KLIPS plugin
  IPSECMGR_KLIPS:= $(PKG_BUILD_DIR)/ipsecmgr/$(IPSECMGR_DIR)/plugins/klips/qca-nss-ipsec-klips.ko
 else
 # DTLS Manager v1.0 for Akronite.
  DTLSMGR_DIR:=v1.0
 # IPsec Manager v1.0 for Akronite.
  IPSECMGR_DIR:=v1.0
 # KLIPS plugin not needed
  IPSECMGR_KLIPS:=
 endif
 define KernelPackage/qca-nss-drv-tun6rd
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=Kernel driver for NSS (connection manager) - tun6rd
  DEPENDS:=+kmod-qca-nss-drv +kmod-sit +6rd @!LINUX_3_18
  FILES:=$(PKG_BUILD_DIR)/qca-nss-tun6rd.ko
  AUTOLOAD:=$(call AutoLoad,60,qca-nss-tun6rd)
 endef
 define KernelPackage/qca-nss-drv-tun6rd/Description
 Kernel modules for NSS connection manager - Support for 6rd tunnel
 endef
 define KernelPackage/qca-nss-drv-dtlsmgr
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=Kernel driver for NSS (connection manager) - dtlsmgr
  DEPENDS:=+kmod-qca-nss-drv +kmod-qca-nss-cfi-cryptoapi @!LINUX_3_18
  FILES:=$(PKG_BUILD_DIR)/dtls/$(DTLSMGR_DIR)/qca-nss-dtlsmgr.ko
 endef
 define KernelPackage/qca-nss-drv-dtls/Description
 Kernel modules for NSS connection manager - Support for DTLS sessions
 endef
 define KernelPackage/qca-nss-drv-l2tpv2
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=Kernel driver for NSS (connection manager) - l2tp
  DEPENDS:=+kmod-qca-nss-drv +kmod-ppp +kmod-l2tp @!LINUX_3_18
  FILES:=$(PKG_BUILD_DIR)/l2tp/l2tpv2/qca-nss-l2tpv2.ko
  KCONFIG:=CONFIG_L2TP=y
  AUTOLOAD:=$(call AutoLoad,51,qca-nss-l2tpv2)
 endef
 define KernelPackage/qca-nss-drv-l2tpv2/Description
 Kernel modules for NSS connection manager - Support for l2tp tunnel
 endef
 define KernelPackage/qca-nss-drv-pptp
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=Kernel driver for NSS (connection manager) - PPTP
  DEPENDS:=+kmod-qca-nss-drv +kmod-pptp @!LINUX_3_18
  FILES:=$(PKG_BUILD_DIR)/pptp/qca-nss-pptp.ko
  AUTOLOAD:=$(call AutoLoad,51,qca-nss-pptp)
 endef
 define KernelPackage/qca-nss-drv-pptp/Description
 Kernel modules for NSS connection manager - Support for PPTP tunnel
 endef
 define KernelPackage/qca-nss-drv-pppoe
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=Kernel driver for NSS (connection manager) - PPPoE
  DEPENDS:=+kmod-qca-nss-drv +kmod-pppoe @!LINUX_3_18 \
 		+!(TARGET_ipq_ipq807x_QSDK_256||TARGET_ipq_ipq60xx_QSDK_256):kmod-bonding
  FILES:=$(PKG_BUILD_DIR)/pppoe/qca-nss-pppoe.ko
  AUTOLOAD:=$(call AutoLoad,51,qca-nss-pppoe)
 endef
 define KernelPackage/qca-nss-drv-pppoe/Description
 Kernel modules for NSS connection manager - Support for PPPoE
 endef
 define KernelPackage/qca-nss-drv-map-t
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=Kernel driver for NSS (connection manager) - MAP-T
  DEPENDS:=+kmod-qca-nss-drv +kmod-nat46 @!LINUX_3_18
  FILES:=$(PKG_BUILD_DIR)/map/map-t/qca-nss-map-t.ko
  AUTOLOAD:=$(call AutoLoad,51,qca-nss-map-t)
 endef
 define KernelPackage/qca-nss-drv-map-t/Description
 Kernel modules for NSS connection manager - Support for MAP-T
 endef
 define KernelPackage/qca-nss-drv-gre
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=Kernel driver for NSS (connection manager) - GRE
  DEPENDS:=@TARGET_ipq_ipq806x||TARGET_ipq806x||TARGET_ipq_ipq807x||TARGET_ipq_ipq807x_64||TARGET_ipq807x||TARGET_ipq807x_64||TARGET_ipq_ipq60xx||TARGET_ipq_ipq60xx_64||TARGET_ipq_ipq50xx||TARGET_ipq_ipq50xx_64 \
 	   +kmod-qca-nss-drv @!LINUX_3_18 +kmod-gre6
  FILES:=$(PKG_BUILD_DIR)/gre/qca-nss-gre.ko $(PKG_BUILD_DIR)/gre/test/qca-nss-gre-test.ko
  AUTOLOAD:=$(call AutoLoad,51,qca-nss-gre)
 endef
 define KernelPackage/qca-nss-drv-gre/Description
 Kernel modules for NSS connection manager - Support for GRE
 endef
 define KernelPackage/qca-nss-drv-tunipip6
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=Kernel driver for NSS (connection manager) - DS-lite and ipip6 Tunnel
  DEPENDS:=+kmod-qca-nss-drv +kmod-iptunnel6 +kmod-ip6-tunnel @!LINUX_3_18
  FILES:=$(PKG_BUILD_DIR)/qca-nss-tunipip6.ko
  AUTOLOAD:=$(call AutoLoad,60,qca-nss-tunipip6)
 endef
 define KernelPackage/qca-nss-drv-tunipip6/Description
 Kernel modules for NSS connection manager
 Add support for DS-lite and ipip6 tunnel
 endef
 define KernelPackage/qca-nss-drv-profile
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  DEPENDS:=+kmod-qca-nss-drv @!LINUX_3_18
  TITLE:=Profiler for QCA NSS driver (IPQ806x)
  FILES:=$(PKG_BUILD_DIR)/profiler/qca-nss-profile-drv.ko
 endef
 define KernelPackage/qca-nss-drv-profile/Description
 This package contains a NSS driver profiler for QCA chipset
 endef
 define KernelPackage/qca-nss-drv-ipsecmgr
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=Kernel driver for NSS (ipsec manager) - ipsecmgr
  DEPENDS:=@TARGET_ipq806x||TARGET_ipq_ipq806x||TARGET_ipq_ipq807x||TARGET_ipq_ipq807x_64||TARGET_ipq807x||TARGET_ipq807x_64||TARGET_ipq_ipq60xx||TARGET_ipq_ipq60xx_64 \
 		+kmod-qca-nss-drv +kmod-qca-nss-ecm-standard +kmod-qca-nss-cfi-cryptoapi @!LINUX_3_18
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-l2tpv2),)
  DEPENDS+=+kmod-qca-nss-drv-l2tpv2
 endif
  FILES:=$(PKG_BUILD_DIR)/ipsecmgr/$(IPSECMGR_DIR)/qca-nss-ipsecmgr.ko	$(IPSECMGR_KLIPS)
  AUTOLOAD:=$(call AutoLoad,60,qca-nss-ipsecmgr)
 endef
 define KernelPackage/qca-nss-drv-ipsecmgr/Description
 Kernel module for NSS IPsec offload manager
 endef
 define KernelPackage/qca-nss-drv-capwapmgr
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  DEPENDS:=+kmod-qca-nss-drv +kmod-qca-nss-drv-dtlsmgr @!LINUX_3_18
  TITLE:=NSS CAPWAP Manager for QCA NSS driver (IPQ806x)
  FILES:=$(PKG_BUILD_DIR)/capwapmgr/qca-nss-capwapmgr.ko
 endef
 define KernelPackage/qca-nss-drv-capwapmgr/Description
 This package contains a NSS CAPWAP Manager
 endef
 define KernelPackage/qca-nss-drv-bridge-mgr
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=Kernel driver for NSS bridge manager
  DEPENDS:=@TARGET_ipq_ipq807x||TARGET_ipq_ipq807x_64||TARGET_ipq807x||TARGET_ipq807x_64||TARGET_ipq_ipq60xx||TARGET_ipq_ipq60xx_64 \
 		+TARGET_ipq_ipq807x:kmod-qca-nss-drv-vlan-mgr \
 		+TARGET_ipq_ipq807x_64:kmod-qca-nss-drv-vlan-mgr \
 		+TARGET_ipq807x:kmod-qca-nss-drv-vlan-mgr \
 		+TARGET_ipq807x_64:kmod-qca-nss-drv-vlan-mgr \
 		+TARGET_ipq_ipq60xx:kmod-qca-nss-drv-vlan-mgr \
 		+TARGET_ipq_ipq60xx_64:kmod-qca-nss-drv-vlan-mgr @!LINUX_3_18 \
 		+!(TARGET_ipq_ipq807x_QSDK_256||TARGET_ipq_ipq60xx_QSDK_256):kmod-bonding
  FILES:=$(PKG_BUILD_DIR)/bridge/qca-nss-bridge-mgr.ko
  AUTOLOAD:=$(call AutoLoad,51,qca-nss-bridge-mgr)
 endef
 define KernelPackage/qca-nss-drv-bridge-mgr/Description
 Kernel modules for NSS bridge manager
 endef
 define KernelPackage/qca-nss-drv-vlan-mgr
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=Kernel driver for NSS vlan manager
  DEPENDS:=@TARGET_ipq806x||TARGET_ipq807x +kmod-qca-nss-drv @!LINUX_3_18 \
 		+!(TARGET_ipq_ipq807x_QSDK_256||TARGET_ipq_ipq60xx_QSDK_256):kmod-bonding
  FILES:=$(PKG_BUILD_DIR)/vlan/qca-nss-vlan.ko
  AUTOLOAD:=$(call AutoLoad,51,qca-nss-vlan)
 endef
 define KernelPackage/qca-nss-drv-vlan-mgr/Description
 Kernel modules for NSS vlan manager
 endef
 define KernelPackage/qca-nss-drv-qdisc
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Support
  TITLE:=Qdisc for configuring shapers in NSS
  DEPENDS:=+kmod-qca-nss-drv @!LINUX_3_18
  FILES:=$(PKG_BUILD_DIR)/nss_qdisc/qca-nss-qdisc.ko
  KCONFIG:=CONFIG_NET_CLS_ACT=y
  AUTOLOAD:=$(call AutoLoad,58,qca-nss-qdisc)
 endef
 define KernelPackage/qca-nss-drv-qdisc/Description
 Linux qdisc that aids in configuring shapers in the NSS
 endef
 define KernelPackage/qca-nss-drv-lag-mgr
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=Kernel driver for NSS LAG manager
  DEPENDS:=+kmod-qca-nss-drv  @!LINUX_3_18 \
 	   +TARGET_ipq_ipq807x:kmod-qca-nss-drv-vlan-mgr \
 	   +TARGET_ipq_ipq807x_64:kmod-qca-nss-drv-vlan-mgr @!LINUX_3_18 \
 	   +TARGET_ipq807x:kmod-qca-nss-drv-vlan-mgr \
 	   +TARGET_ipq807x_64:kmod-qca-nss-drv-vlan-mgr @!LINUX_3_18 \
 	   +TARGET_ipq_ipq60xx:kmod-qca-nss-drv-vlan-mgr @!LINUX_3_18 \
 	   +TARGET_ipq_ipq60xx_64:kmod-qca-nss-drv-vlan-mgr @!LINUX_3_18 \
 	   +kmod-bonding
  FILES:=$(PKG_BUILD_DIR)/lag/qca-nss-lag-mgr.ko
  AUTOLOAD:=$(call AutoLoad,51,qca-nss-lag-mgr)
 endef
 define KernelPackage/qca-nss-drv-lag-mgr/Description
 Kernel modules for NSS LAG manager
 endef
 define KernelPackage/qca-nss-drv-netlink
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  DEPENDS:=@TARGET_ipq807x||TARGET_ipq_ipq807x||TARGET_ipq807x_64||TARGET_ipq_ipq807x_64||TARGET_ipq_ipq60xx||TARGET_ipq_ipq60xx_64||TARGET_ipq_ipq50xx||TARGET_ipq_ipq50xx_64 \
 		+kmod-qca-nss-drv @!LINUX_3_18 \
 		+PACKAGE_kmod-qca-nss-drv-ipsecmgr:kmod-qca-nss-drv-ipsecmgr \
 		+PACKAGE_kmod-qca-nss-drv-dtlsmgr:kmod-qca-nss-drv-dtlsmgr \
 		+PACKAGE_kmod-qca-nss-drv-capwapmgr:kmod-qca-nss-drv-capwapmgr @!LINUX_3_18
  TITLE:=NSS NETLINK Manager for QCA NSS driver
  FILES:=$(PKG_BUILD_DIR)/netlink/qca-nss-netlink.ko
 endef
 define KernelPackage/qca-nss-drv-netlink/Description
 Kernel module for NSS netlink manager
 endef
 define KernelPackage/qca-nss-drv-ovpn-mgr
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=Kernel driver for NSS OpenVPN manager
  DEPENDS:=+kmod-qca-nss-drv +kmod-qca-nss-cfi-cryptoapi +kmod-tun +kmod-ipt-conntrack @!LINUX_3_18 \
 	  @TARGET_ipq_ipq807x||TARGET_ipq_ipq807x_64||TARGET_ipq_ipq60xx||TARGET_ipq_ipq60xx_64
  FILES:=$(PKG_BUILD_DIR)/openvpn/src/qca-nss-ovpn-mgr.ko
 endef
 define KernelPackage/qca-nss-drv-ovpn-mgr/Description
 Kernel module for NSS OpenVPN manager
 endef
 define KernelPackage/qca-nss-drv-ovpn-link
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  TITLE:=Kernel driver for interfacing NSS OpenVPN manager with ECM
  DEPENDS:=+kmod-qca-nss-drv-ovpn-mgr +@PACKAGE_kmod-qca-nss-ecm-premium @!LINUX_3_18 \
 	  @TARGET_ipq_ipq807x||TARGET_ipq_ipq807x_64||TARGET_ipq_ipq60xx||TARGET_ipq_ipq60xx_64
  FILES:=$(PKG_BUILD_DIR)/openvpn/plugins/qca-nss-ovpn-link.ko
 endef
 define KernelPackage/qca-nss-drv-ovpn-link/Description
 This module registers with ECM and communicates with NSS OpenVPN manager for supporting OpenVPN offload.
 endef
 define KernelPackage/qca-nss-drv-pvxlanmgr
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  DEPENDS:=+kmod-qca-nss-drv @!LINUX_3_18
  TITLE:=NSS PVXLAN Manager for QCA NSS driver
  FILES:=$(PKG_BUILD_DIR)/pvxlanmgr/qca-nss-pvxlanmgr.ko
 endef
 define KernelPackage/qca-nss-drv-pvxlanmgr/Description
 Kernel module for managing NSS PVxLAN
 endef
 define Build/InstallDev/qca-nss-clients
 	$(INSTALL_DIR) $(1)/usr/include/qca-nss-clients
 	$(CP) $(PKG_BUILD_DIR)/netlink/include/* $(1)/usr/include/qca-nss-clients/
 	$(CP) $(PKG_BUILD_DIR)/exports/* $(1)/usr/include/qca-nss-clients/
 endef
 define Build/InstallDev
 	$(call Build/InstallDev/qca-nss-clients,$(1))
 endef
 define KernelPackage/qca-nss-drv-ovpn-mgr/install
 	$(INSTALL_DIR) $(1)/etc/init.d
 	$(INSTALL_BIN) ./files/qca-nss-ovpn.init $(1)/etc/init.d/qca-nss-ovpn
 endef
 define KernelPackage/qca-nss-drv-ipsecmgr/install
 	$(INSTALL_DIR) $(1)/etc/init.d
 	$(INSTALL_BIN) ./files/qca-nss-ipsec $(1)/etc/init.d/qca-nss-ipsec
 endef
 EXTRA_CFLAGS+= \
 	-I$(STAGING_DIR)/usr/include/qca-nss-drv \
 	-I$(STAGING_DIR)/usr/include/qca-nss-crypto \
 	-I$(STAGING_DIR)/usr/include/qca-nss-cfi \
 	-I$(STAGING_DIR)/usr/include/qca-nss-gmac \
 	-I$(STAGING_DIR)/usr/include/qca-nss-ecm \
 	-I$(STAGING_DIR)/usr/include/qca-ssdk \
 	-I$(STAGING_DIR)/usr/include/qca-ssdk/fal \
 	-I$(STAGING_DIR)/usr/include/nat46
 # Build individual packages if selected
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-profile),)
 MAKE_OPTS+=profile=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-capwapmgr),)
 MAKE_OPTS+=capwapmgr=y
 EXTRA_CFLAGS += -DNSS_CAPWAPMGR_ONE_NETDEV
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-tun6rd),)
 MAKE_OPTS+=tun6rd=m
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-dtlsmgr),)
 MAKE_OPTS+=dtlsmgr=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-l2tpv2),)
 MAKE_OPTS+=l2tpv2=y
 EXTRA_CFLAGS += -DNSS_L2TPV2_ENABLED
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-pptp),)
 MAKE_OPTS+=pptp=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-map-t),)
 MAKE_OPTS+=map-t=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-tunipip6),)
 MAKE_OPTS+=tunipip6=m
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-qdisc),)
 MAKE_OPTS+=qdisc=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-ipsecmgr),)
 EXTRA_CFLAGS+= -I$(PKG_BUILD_DIR)/exports \
 		-I$(STAGING_DIR)/usr/include/qca-nss-ecm
 MAKE_OPTS+=ipsecmgr=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-bridge-mgr),)
 MAKE_OPTS+=bridge-mgr=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-vlan-mgr),)
 MAKE_OPTS+=vlan-mgr=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-lag-mgr),)
 MAKE_OPTS+=lag-mgr=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-gre),)
 EXTRA_CFLAGS+= -I$(PKG_BUILD_DIR)/exports
 MAKE_OPTS+=gre=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-pppoe),)
 MAKE_OPTS+=pppoe=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-netlink),)
 MAKE_OPTS+=netlink=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-ovpn-mgr),)
 MAKE_OPTS+=ovpn-mgr=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-ovpn-link),)
 MAKE_OPTS+=ovpn-link=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-pvxlanmgr),)
 MAKE_OPTS+=pvxlanmgr=y
 endif
 define Build/Compile
 	$(MAKE) $(PKG_JOBS) -C "$(LINUX_DIR)" $(strip $(MAKE_OPTS)) \
 		$(KERNEL_MAKE_FLAGS) \
 		$(PKG_MAKE_FLAGS) \
 		M="$(PKG_BUILD_DIR)" \
 		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
 		SoC="$(subtarget)" \
 		DTLSMGR_DIR="$(DTLSMGR_DIR)" \
 		IPSECMGR_DIR="$(IPSECMGR_DIR)" \
 		modules
 endef
 $(eval $(call KernelPackage,qca-nss-drv-profile))
 $(eval $(call KernelPackage,qca-nss-drv-capwapmgr))
 $(eval $(call KernelPackage,qca-nss-drv-tun6rd))
 $(eval $(call KernelPackage,qca-nss-drv-dtlsmgr))
 $(eval $(call KernelPackage,qca-nss-drv-l2tpv2))
 $(eval $(call KernelPackage,qca-nss-drv-pptp))
 $(eval $(call KernelPackage,qca-nss-drv-pppoe))
 $(eval $(call KernelPackage,qca-nss-drv-map-t))
 $(eval $(call KernelPackage,qca-nss-drv-tunipip6))
 $(eval $(call KernelPackage,qca-nss-drv-qdisc))
 $(eval $(call KernelPackage,qca-nss-drv-netlink))
 $(eval $(call KernelPackage,qca-nss-drv-ipsecmgr))
 $(eval $(call KernelPackage,qca-nss-drv-bridge-mgr))
 $(eval $(call KernelPackage,qca-nss-drv-vlan-mgr))
 $(eval $(call KernelPackage,qca-nss-drv-lag-mgr))
 $(eval $(call KernelPackage,qca-nss-drv-gre))
 $(eval $(call KernelPackage,qca-nss-drv-ovpn-mgr))
 $(eval $(call KernelPackage,qca-nss-drv-ovpn-link))
 $(eval $(call KernelPackage,qca-nss-drv-pvxlanmgr))
--- a/package/qca/nss/qca-nss-clients/files/qca-nss-ipsec
+++ b/package/qca/nss/qca-nss-clients/files/qca-nss-ipsec
@ -1,92 +0,0 @@
 #!/bin/sh  /etc/rc.common
 #
 # Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 NSS_IPSEC_LOG_FILE=/tmp/.nss_ipsec_log
 NSS_IPSEC_LOG_STR_ECM="ECM_Loaded"
 ecm_load () {
 	if [ ! -d /sys/module/ecm ]; then
 		/etc/init.d/qca-nss-ecm start
 		if [ -d /sys/module/ecm ]; then
 			echo ${NSS_IPSEC_LOG_STR_ECM} >> ${NSS_IPSEC_LOG_FILE}
 		fi
 	fi
 }
 ecm_unload () {
 	if [ -f /tmp/.nss_ipsec_log ]; then
 		str=`grep ${NSS_IPSEC_LOG_STR_ECM} ${NSS_IPSEC_LOG_FILE}`
 		if [[ $str == ${NSS_IPSEC_LOG_STR_ECM} ]]; then
 			/etc/init.d/qca-nss-ecm stop
 			`sed 's/${NSS_IPSEC_LOG_STR_ECM}/ /g' $NSS_IPSEC_LOG_FILE >  $NSS_IPSEC_LOG_FILE`
 		fi
 	fi
 }
 ecm_disable() {
 	if [ ! -d /sys/module/ecm ]; then
 		return;
 	fi
 	echo 1 > /sys/kernel/debug/ecm/front_end_ipv4_stop
 	echo 1 > /sys/kernel/debug/ecm/front_end_ipv6_stop
 	echo 1 > /sys/kernel/debug/ecm/ecm_db/defunct_all
 	sleep 2
 }
 ecm_enable() {
 	if [ ! -d /sys/module/ecm ]; then
 		return;
 	fi
 	echo 0 > /sys/kernel/debug/ecm/ecm_db/defunct_all
 	echo 0 > /sys/kernel/debug/ecm/front_end_ipv4_stop
 	echo 0 > /sys/kernel/debug/ecm/front_end_ipv6_stop
 }
 start() {
 	ecm_load
 	local kernel_version=$(uname -r)
 	insmod /lib/modules/${kernel_version}/qca-nss-ipsec-klips.ko
 	if [ "$?" -gt 0 ]; then
 		echo "Failed to load plugin. Please start ecm if not done already"
 		ecm_enable
 		return
 	fi
 	/etc/init.d/ipsec start
 	sleep 2
 	ipsec eroute
 	ecm_enable
 }
 stop() {
 	ecm_disable
 	/etc/init.d/ipsec stop
 	rmmod qca-nss-ipsec-klips
 	ecm_unload
 }
 restart() {
 	stop
 	start
 }
--- a/package/qca/nss/qca-nss-clients/files/qca-nss-mirred.init
+++ b/package/qca/nss/qca-nss-clients/files/qca-nss-mirred.init
@ -1,28 +0,0 @@
 #!/bin/sh /etc/rc.common
 ###########################################################################
 # Copyright (c) 2019, The Linux Foundation. All rights reserved.
 # Permission to use, copy, modify, and/or distribute this software for
 # any purpose with or without fee is hereby granted, provided that the
 # above copyright notice and this permission notice appear in all copies.
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
 # OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 ###########################################################################
 restart() {
 	rmmod act_nssmirred.ko
 	insmod act_nssmirred.ko
 }
 start() {
 	insmod act_nssmirred.ko
 }
 stop() {
 	rmmod act_nssmirred.ko
 }
--- a/package/qca/nss/qca-nss-clients/files/qca-nss-ovpn.init
+++ b/package/qca/nss/qca-nss-clients/files/qca-nss-ovpn.init
@ -1,69 +0,0 @@
 #!/bin/sh /etc/rc.common
 ###########################################################################
 # Copyright (c) 2019, The Linux Foundation. All rights reserved.
 # Permission to use, copy, modify, and/or distribute this software for
 # any purpose with or without fee is hereby granted, provided that the
 # above copyright notice and this permission notice appear in all copies.
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
 # OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 ###########################################################################
 ecm_disable() {
 	if [ ! -d /sys/module/ecm ]; then
 	   return
 	fi
 	echo 1 > /sys/kernel/debug/ecm/front_end_ipv4_stop
 	echo 1 > /sys/kernel/debug/ecm/front_end_ipv6_stop
 	echo 1 > /sys/kernel/debug/ecm/ecm_db/defunct_all
 	sleep 2
 }
 ecm_enable() {
 	if [ ! -d /sys/module/ecm ]; then
 	   return
 	fi
 	echo 0 > /sys/kernel/debug/ecm/ecm_db/defunct_all
 	echo 0 > /sys/kernel/debug/ecm/front_end_ipv4_stop
 	echo 0 > /sys/kernel/debug/ecm/front_end_ipv6_stop
 }
 restart() {
 	ecm_disable
 	/etc/init.d/openvpn stop
 	rmmod qca-nss-ovpn-link
 	rmmod qca-nss-ovpn-mgr
 	insmod qca-nss-ovpn-mgr
 	insmod qca-nss-ovpn-link
 	if [ "$?" -gt 0 ]; then
 		echo "Failed to load plugin. Please start ecm if not done already"
 		ecm_enable
 		return
 	fi
 	ecm_enable
 }
 start() {
 	restart
 }
 stop() {
 	ecm_disable
 	/etc/init.d/openvpn stop
 	rmmod qca-nss-ovpn-link
 	rmmod qca-nss-ovpn-mgr
 	ecm_enable
 }
--- a/package/qca/nss/qca-nss-clients/patches/100-kernel-5.4-support-qdisc.patch
+++ b/package/qca/nss/qca-nss-clients/patches/100-kernel-5.4-support-qdisc.patch
--- a/package/qca/nss/qca-nss-clients/patches/101-kernel-5.4-support-gre.patch
+++ b/package/qca/nss/qca-nss-clients/patches/101-kernel-5.4-support-gre.patch
@ -1,106 +0,0 @@
 From 7c89187ab2d165ccffed627742e7cb72cce375ef Mon Sep 17 00:00:00 2001
 From: Ansuel Smith <ansuelsmth@gmail.com>
 Date: Sun, 12 Jul 2020 22:49:30 +0200
 Subject: [PATCH] kernel-5.4-support-gre
 ---
 gre/nss_connmgr_gre.c    | 16 +++++++---------
 gre/nss_connmgr_gre_v6.c |  4 ++--
 2 files changed, 9 insertions(+), 11 deletions(-)
 diff --git a/gre/nss_connmgr_gre.c b/gre/nss_connmgr_gre.c
 index 52203b1..6de8f6e 100644
 --- a/gre/nss_connmgr_gre.c
 +++ b/gre/nss_connmgr_gre.c
@@ -88,7 +88,7 @@ static int nss_connmgr_gre_dev_init(struct net_device *dev)
 		u64_stats_init(&stats->syncp);
 	}
 -	if ((dev->priv_flags & IFF_GRE_V4_TAP) || (dev->type == ARPHRD_IPGRE)) {
 +	if ((dev->priv_flags_qca_ecm & IFF_QCA_ECM_GRE_V4_TAP) || (dev->type == ARPHRD_IPGRE)) {
 		dev->needed_headroom = sizeof(struct iphdr) + sizeof(struct ethhdr) + MAX_WIFI_HEADROOM + append;
 		dev->mtu = ETH_DATA_LEN - sizeof(struct iphdr) - append;
 		dev->features |= NETIF_F_NETNS_LOCAL | NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA;
@@ -169,7 +169,7 @@ fail:
  * nss_connmgr_gre_dev_stats64()
  *	Netdev ops function to retrieve stats.
  */
 -struct rtnl_link_stats64 *nss_connmgr_gre_dev_stats64(struct net_device *dev,
 +void nss_connmgr_gre_dev_stats64(struct net_device *dev,
 						struct rtnl_link_stats64 *tot)
 {
 	uint64_t rx_packets, rx_bytes, tx_packets, tx_bytes;
@@ -202,8 +202,6 @@ struct rtnl_link_stats64 *nss_connmgr_gre_dev_stats64(struct net_device *dev,
 		tot->rx_dropped = dev->stats.rx_dropped;
 		tot->tx_dropped = dev->stats.tx_dropped;
 	}
 -
 -	return tot;
 }
 /*
@@ -390,7 +388,7 @@ static int32_t nss_connmgr_gre_prepare_config_cmd(struct net_device *dev,
 {
 	struct nss_gre_config_msg *cmsg = &req->msg.cmsg;
 -	if ((dev->type == ARPHRD_ETHER) && (dev->priv_flags & IFF_GRE_V4_TAP)) {
 +	if ((dev->type == ARPHRD_ETHER) && (dev->priv_flags_qca_ecm & IFF_QCA_ECM_GRE_V4_TAP)) {
 		cmsg->mode = NSS_GRE_MODE_TAP;
 		cmsg->ip_type = NSS_GRE_IP_IPV4;
 		if (enable_unalign) {
@@ -399,7 +397,7 @@ static int32_t nss_connmgr_gre_prepare_config_cmd(struct net_device *dev,
 		return nss_connmgr_gre_v4_get_config(dev, req, next_dev, hold);
 	}
 -	if ((dev->type == ARPHRD_ETHER) && (dev->priv_flags & IFF_GRE_V6_TAP)) {
 +	if ((dev->type == ARPHRD_ETHER) && (dev->priv_flags_qca_ecm & IFF_QCA_ECM_GRE_V6_TAP)) {
 		cmsg->mode = NSS_GRE_MODE_TAP;
 		cmsg->ip_type = NSS_GRE_IP_IPV6;
 		if (enable_unalign) {
@@ -605,7 +603,7 @@ static bool nss_connmgr_gre_is_gre(struct net_device *dev)
 {
 	if ((dev->type == ARPHRD_IPGRE) ||
 	      (dev->type == ARPHRD_IP6GRE) || ((dev->type == ARPHRD_ETHER) &&
 -	      (dev->priv_flags & (IFF_GRE_V4_TAP | IFF_GRE_V6_TAP)))) {
 +	      (dev->priv_flags_qca_ecm & (IFF_QCA_ECM_GRE_V4_TAP | IFF_QCA_ECM_GRE_V6_TAP)))) {
 		return true;
 	}
@@ -692,10 +690,10 @@ static struct net_device *__nss_connmgr_gre_create_interface(struct nss_connmgr_
 		nss_connmgr_gre_tap_setup(dev);
 		if (cfg->is_ipv6) {
 -			dev->priv_flags |= IFF_GRE_V6_TAP;
 +			dev->priv_flags_qca_ecm |= IFF_QCA_ECM_GRE_V6_TAP;
 			ret = nss_connmgr_gre_v6_set_config(dev, cfg);
 		} else {
 -			dev->priv_flags |= IFF_GRE_V4_TAP;
 +			dev->priv_flags_qca_ecm |= IFF_QCA_ECM_GRE_V4_TAP;
 			ret = nss_connmgr_gre_v4_set_config(dev, cfg);
 		}
 		break;
 diff --git a/gre/nss_connmgr_gre_v6.c b/gre/nss_connmgr_gre_v6.c
 index f9a8e58..e93c7e4 100644
 --- a/gre/nss_connmgr_gre_v6.c
 +++ b/gre/nss_connmgr_gre_v6.c
@@ -46,7 +46,7 @@ static struct net_device *nss_connmgr_gre_v6_get_tx_dev(uint8_t *dest_ip)
 	struct net_device *dev;
 	memcpy(ipv6_addr.s6_addr, dest_ip, 16);
 -	rt = rt6_lookup(&init_net, &ipv6_addr, NULL, 0, 0);
 +	rt = rt6_lookup(&init_net, &ipv6_addr, NULL, 0, NULL, 0);
 	if (!rt) {
 		return NULL;
 	}
@@ -92,7 +92,7 @@ static int nss_connmgr_gre_v6_get_mac_address(uint8_t *src_ip, uint8_t *dest_ip,
 	 * Find dest MAC address
 	 */
 	memcpy(ipv6_addr.s6_addr, dest_ip, 16);
 -	rt = rt6_lookup(&init_net, &ipv6_addr, NULL, 0, 0);
 +	rt = rt6_lookup(&init_net, &ipv6_addr, NULL, 0, NULL, 0);
 	if (!rt) {
 		return GRE_ERR_NEIGH_LOOKUP;
 	}
 -- 
 2.27.0
--- a/package/qca/nss/qca-nss-clients/patches/102-kernel-5.4-support-ipsec.patch
+++ b/package/qca/nss/qca-nss-clients/patches/102-kernel-5.4-support-ipsec.patch
@ -1,29 +0,0 @@
 --- a/ipsecmgr/v1.0/nss_ipsecmgr.c
 +++ b/ipsecmgr/v1.0/nss_ipsecmgr.c
@@ -377,7 +377,7 @@ free:
  * nss_ipsecmgr_tunnel_stats()
  * 	get tunnel statistics
  */
 -static struct rtnl_link_stats64 *nss_ipsecmgr_tunnel_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
 +void nss_ipsecmgr_tunnel_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
 {
 	struct nss_ipsecmgr_priv *priv = netdev_priv(dev);
@@ -389,8 +389,6 @@ static struct rtnl_link_stats64 *nss_ips
 	read_lock_bh(&ipsecmgr_ctx->lock);
 	memcpy(stats, &priv->stats, sizeof(struct rtnl_link_stats64));
 	read_unlock_bh(&ipsecmgr_ctx->lock);
 -
 -	return stats;
 }
 /*
@@ -442,7 +440,7 @@ static void nss_ipsecmgr_tunnel_setup(st
 	dev->header_ops = NULL;
 	dev->netdev_ops = &nss_ipsecmgr_tunnel_ops;
 -	dev->destructor = nss_ipsecmgr_tunnel_free;
 +	dev->priv_destructor = nss_ipsecmgr_tunnel_free;
 	/*
 	 * get the MAC address from the ethernet device
--- a/package/qca/nss/qca-nss-clients/patches/103-kernel-5.4-support-dtls.patch
+++ b/package/qca/nss/qca-nss-clients/patches/103-kernel-5.4-support-dtls.patch
@ -1,11 +0,0 @@
 --- a/dtls/v1.0/nss_connmgr_dtls_netdev.c
 +++ b/dtls/v1.0/nss_connmgr_dtls_netdev.c
@@ -160,7 +160,7 @@ static void nss_dtlsmgr_dev_setup(struct
 	dev->ethtool_ops = NULL;
 	dev->header_ops = NULL;
 	dev->netdev_ops = &nss_dtlsmgr_session_ops;
 -	dev->destructor = NULL;
 +	dev->priv_destructor = NULL;
 	memcpy(dev->dev_addr, "\xaa\xbb\xcc\xdd\xee\xff", dev->addr_len);
 	memset(dev->broadcast, 0xff, dev->addr_len);
--- a/package/qca/nss/qca-nss-clients/patches/104-kernel-5.4-support-l2tp.patch
+++ b/package/qca/nss/qca-nss-clients/patches/104-kernel-5.4-support-l2tp.patch
@ -1,64 +0,0 @@
 --- a/l2tp/l2tpv2/nss_connmgr_l2tpv2.h
 +++ b/l2tp/l2tpv2/nss_connmgr_l2tpv2.h
@@ -30,10 +30,10 @@
 #define L2TP_V_2 2
 -#define tunnel_hold(tunnel) atomic_inc(&tunnel->ref_count)
 -#define tunnel_put(tunnel)  atomic_dec(&tunnel->ref_count)
 -#define session_hold(session) atomic_inc(&session->ref_count)
 -#define session_put(session)  atomic_dec(&session->ref_count)
 +#define tunnel_hold(tunnel) refcount_inc(&tunnel->ref_count)
 +#define tunnel_put(tunnel)  refcount_dec(&tunnel->ref_count)
 +#define session_hold(session) refcount_inc(&session->ref_count)
 +#define session_put(session)  refcount_dec(&session->ref_count)
  /*
   *		----------------------------------------------------------------------------------
 --- a/l2tp/l2tpv2/nss_connmgr_l2tpv2.c
 +++ b/l2tp/l2tpv2/nss_connmgr_l2tpv2.c
@@ -244,7 +244,7 @@ static struct nss_connmgr_l2tpv2_session
 	 */
 	data->l2tpv2.session.session_id = session->session_id;
 	data->l2tpv2.session.peer_session_id = session->peer_session_id;
 -	data->l2tpv2.session.offset = session->offset;
 +	data->l2tpv2.session.offset = 0;
 	data->l2tpv2.session.hdr_len = session->hdr_len;
 	data->l2tpv2.session.reorder_timeout = session->reorder_timeout;
 	data->l2tpv2.session.recv_seq = session->recv_seq;
@@ -253,7 +253,7 @@ static struct nss_connmgr_l2tpv2_session
 	nss_connmgr_l2tpv2_info("sess %u, peer=%u nr=%u ns=%u off=%u  hdr_len=%u timeout=%x"
 	       " recv_seq=%x send_seq=%x\n",
 	       session->session_id,  session->peer_session_id, session->nr,
 -	       session->ns,  session->offset, session->hdr_len,
 +	       session->ns, 0, session->hdr_len,
 	       session->reorder_timeout, session->recv_seq,
 	       session->send_seq);
 --- a/l2tp/l2tpv2/nss_l2tpv2_stats.c
 +++ b/l2tp/l2tpv2/nss_l2tpv2_stats.c
@@ -21,6 +21,7 @@
  */
 #include <linux/types.h>
 +#include <linux/netdevice.h>
 #include <linux/ppp_channel.h>
 #include <nss_api_if.h>
 #include <nss_dynamic_interface.h>
@@ -103,14 +104,14 @@ void nss_l2tpv2_update_dev_stats(struct
 	/*
 	 * Update tunnel & session stats
 	 */
 -	tunnel = l2tp_tunnel_find(dev_net(dev), data.l2tpv2.tunnel.tunnel_id);
 +	tunnel = l2tp_tunnel_get(dev_net(dev), data.l2tpv2.tunnel.tunnel_id);
 	if (!tunnel) {
 		dev_put(dev);
 		return;
 	}
 	tunnel_hold(tunnel);
 -	session = l2tp_session_find(dev_net(dev), tunnel, data.l2tpv2.session.session_id);
 +	session = l2tp_session_get(dev_net(dev), data.l2tpv2.session.session_id);
 	if (!session) {
 		tunnel_put(tunnel);
 		dev_put(dev);
--- a/package/qca/nss/qca-nss-clients/patches/200-qdisc-fix-compile-error.patch
+++ b/package/qca/nss/qca-nss-clients/patches/200-qdisc-fix-compile-error.patch
@ -1,14 +0,0 @@
 --- a/nss_qdisc/nss_qdisc.c
 +++ b/nss_qdisc/nss_qdisc.c
@@ -2708,9 +2708,11 @@ static int nss_qdisc_if_event_cb(struct
 	case NETDEV_BR_JOIN:
 		nss_qdisc_info("Reveived NETDEV_BR_JOIN on interface %s\n",
 				dev->name);
 +		goto fall_through;
 	case NETDEV_BR_LEAVE:
 		nss_qdisc_info("Reveived NETDEV_BR_LEAVE on interface %s\n",
 				dev->name);
 +fall_through:
 		br = nss_qdisc_get_dev_master(dev);
 		if_num = nss_cmn_get_interface_number(nss_qdisc_ctx, dev);
--- a/package/qca/nss/qca-nss-clients/patches/202-vlanmgr-fix-compile-error.patch
+++ b/package/qca/nss/qca-nss-clients/patches/202-vlanmgr-fix-compile-error.patch
@ -1,48 +0,0 @@
 --- a/vlan/nss_vlan_mgr.c
 +++ b/vlan/nss_vlan_mgr.c
@@ -820,8 +820,10 @@ static struct nss_vlan_pvt *nss_vlan_mgr
  */
 static void nss_vlan_mgr_instance_free(struct nss_vlan_pvt *v)
 {
 +#ifdef NSS_VLAN_MGR_PPE_SUPPORT
 	int32_t i;
 	int ret = 0;
 +#endif
 	spin_lock(&vlan_mgr_ctx.lock);
 	BUG_ON(--v->refs);
@@ -979,8 +981,11 @@ static int nss_vlan_mgr_register_event(s
 	int ret;
 #endif
 	uint32_t vlan_tag;
 +#ifdef NSS_VLAN_MGR_PPE_SUPPORT
 	struct net_device *slave;
 -	int32_t port, port_if;
 +	int32_t port;
 +#endif
 +	int32_t port_if;
 	struct vlan_dev_priv *vlan;
 	struct net_device *real_dev;
 	bool is_bond_master = false;
@@ -1354,8 +1359,10 @@ return_with_error:
 int nss_vlan_mgr_join_bridge(struct net_device *dev, uint32_t bridge_vsi)
 {
 	struct nss_vlan_pvt *v = nss_vlan_mgr_instance_find_and_ref(dev);
 +#ifdef NSS_VLAN_MGR_PPE_SUPPORT
 	struct net_device *real_dev;
 	int ret;
 +#endif
 	if (!v)
 		return 0;
@@ -1415,8 +1422,10 @@ EXPORT_SYMBOL(nss_vlan_mgr_join_bridge);
 int nss_vlan_mgr_leave_bridge(struct net_device *dev, uint32_t bridge_vsi)
 {
 	struct nss_vlan_pvt *v = nss_vlan_mgr_instance_find_and_ref(dev);
 +#ifdef NSS_VLAN_MGR_PPE_SUPPORT
 	struct net_device *real_dev;
 	int ret;
 +#endif
 	if (!v)
 		return 0;
--- a/package/qca/nss/qca-nss-crypto/Makefile
+++ b/package/qca/nss/qca-nss-crypto/Makefile
@ -1,74 +0,0 @@
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 PKG_NAME:=qca-nss-crypto
 PKG_RELEASE:=1
 PKG_SOURCE_URL:=https://git.codelinaro.org/clo/qsdk/oss/lklm/nss-crypto.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_VERSION:=e7651c2986d30b5e8ca5ad6b9a72c47febdf3cca
 PKG_MIRROR_HASH:=381ba448ccd9e0ff69fa52b3e10687b72260b7d0bf865cac10be7f159573b6c8
 include $(INCLUDE_DIR)/package.mk
 ifeq ($(CONFIG_TARGET_ipq),y)
 subtarget:=$(SUBTARGET)
 else
 subtarget:=$(CONFIG_TARGET_BOARD)
 endif
 # v1.0 is for Akronite
 # v2.0 is for Hawkeye/Cypress/Maple
 ifneq (, $(findstring $(subtarget), "ipq807x" "ipq807x_64" "ipq60xx" "ipq60xx_64" "ipq50xx" "ipq50xx_64"))
 NSS_CRYPTO_DIR:=v2.0
 else
 NSS_CRYPTO_DIR:=v1.0
 endif
 define KernelPackage/qca-nss-crypto/Default
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  DEPENDS:=@(TARGET_ipq806x||TARGET_ipq807x||TARGET_ipq50xx||TARGET_ipq60xx) +kmod-qca-nss-drv
 endef
 define KernelPackage/qca-nss-crypto
  $(call KernelPackage/qca-nss-crypto/Default)
  TITLE:=Kernel driver for NSS crypto driver
  FILES:=$(PKG_BUILD_DIR)/$(NSS_CRYPTO_DIR)/src/qca-nss-crypto.ko \
 	$(PKG_BUILD_DIR)/$(NSS_CRYPTO_DIR)/tool/qca-nss-crypto-tool.ko
  AUTOLOAD:=$(call AutoLoad,52,qca-nss-crypto)
 endef
 define KernelPackage/qca-nss-crypto/Description
 This package contains a NSS crypto driver for QCA chipset
 endef
 define Build/InstallDev/qca-nss-crypto
 	$(INSTALL_DIR) $(1)/usr/include/qca-nss-crypto
 	$(CP) $(PKG_BUILD_DIR)/$(NSS_CRYPTO_DIR)/include/* $(1)/usr/include/qca-nss-crypto
 endef
 define Build/InstallDev
 	$(call Build/InstallDev/qca-nss-crypto,$(1))
 endef
 EXTRA_CFLAGS+= \
 	-DCONFIG_NSS_DEBUG_LEVEL=4 \
 	-I$(STAGING_DIR)/usr/include/qca-nss-crypto \
 	-I$(STAGING_DIR)/usr/include/qca-nss-drv \
 	-I$(PKG_BUILD_DIR)/$(NSS_CRYPTO_DIR)/include \
 	-I$(PKG_BUILD_DIR)/$(NSS_CRYPTO_DIR)/src
 define Build/Compile
 	$(MAKE) $(PKG_JOBS) -C "$(LINUX_DIR)" \
 		$(KERNEL_MAKE_FLAGS) \
 		$(PKG_MAKE_FLAGS) \
 		M="$(PKG_BUILD_DIR)" \
 		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
 		NSS_CRYPTO_DIR=$(NSS_CRYPTO_DIR) \
 		SoC="$(subtarget)" \
 		modules
 endef
 $(eval $(call KernelPackage,qca-nss-crypto))
--- a/package/qca/nss/qca-nss-crypto/patches/100-kernel-5.4-support.patch
+++ b/package/qca/nss/qca-nss-crypto/patches/100-kernel-5.4-support.patch
@ -1,42 +0,0 @@
 --- a/v1.0/tool/nss_crypto_bench.c
 +++ b/v1.0/tool/nss_crypto_bench.c
@@ -75,8 +75,8 @@ static DECLARE_WAIT_QUEUE_HEAD(tx_comp);
 static DECLARE_WAIT_QUEUE_HEAD(tx_start);
 static struct task_struct *tx_thread = NULL;
 -static struct timeval init_time;
 -static struct timeval comp_time;
 +static struct timespec64 init_time;
 +static struct timespec64 comp_time;
 static spinlock_t op_lock;
 static nss_crypto_handle_t crypto_hdl;
@@ -782,7 +782,7 @@ static int crypto_bench_tx(void *arg)
 		crypto_bench_debug("#");
 		/* get start time */
 -		do_gettimeofday(&init_time);
 +		ktime_get_real_ts64(&init_time);
 		/**
 		 * Request submission
@@ -812,8 +812,8 @@ static int crypto_bench_tx(void *arg)
 		 * Calculate time and output the Mbps
 		 */
 -		init_usecs  = (init_time.tv_sec * 1000 * 1000) + init_time.tv_usec;
 -		comp_usecs  = (comp_time.tv_sec * 1000 * 1000) + comp_time.tv_usec;
 +		init_usecs  = (init_time.tv_sec * 1000 * 1000) + (init_time.tv_nsec / NSEC_PER_USEC);
 +		comp_usecs  = (comp_time.tv_sec * 1000 * 1000) + (comp_time.tv_nsec / NSEC_PER_USEC);
 		delta_usecs = comp_usecs - init_usecs;
 		reqs_completed = param.num_reqs - atomic_read(&tx_reqs);
@@ -870,7 +870,7 @@ static void crypto_bench_done(struct nss
 	nss_crypto_buf_free(crypto_hdl, buf);
 	if (atomic_dec_and_test(&tx_reqs)) {
 -		do_gettimeofday(&comp_time);
 +		ktime_get_real_ts64(&comp_time);
 		wake_up_interruptible(&tx_comp);
 		param.num_loops--;
--- a/package/qca/nss/qca-nss-crypto/patches/200-fix-NULL-pointer-exception.patch
+++ b/package/qca/nss/qca-nss-crypto/patches/200-fix-NULL-pointer-exception.patch
@ -1,57 +0,0 @@
 --- a/v1.0/src/nss_crypto_if.c
 +++ b/v1.0/src/nss_crypto_if.c
@@ -370,15 +370,16 @@ void nss_crypto_transform_done(struct ne
 	struct nss_crypto_buf *buf = (struct nss_crypto_buf *)skb->data;
 	struct nss_crypto_buf_node *entry;
 	void *addr;
 +	struct device *cdev = gbl_crypto_ctrl.eng[0].dev;
 	if (likely(buf->data_in == buf->data_out)) {
 -		dma_unmap_single(NULL, buf->data_in, buf->data_len, DMA_BIDIRECTIONAL);
 +		dma_unmap_single(cdev, buf->data_in, buf->data_len, DMA_BIDIRECTIONAL);
 	} else {
 -		dma_unmap_single(NULL, buf->data_in, buf->data_len, DMA_TO_DEVICE);
 -		dma_unmap_single(NULL, buf->data_out, buf->data_len, DMA_FROM_DEVICE);
 +		dma_unmap_single(cdev, buf->data_in, buf->data_len, DMA_TO_DEVICE);
 +		dma_unmap_single(cdev, buf->data_out, buf->data_len, DMA_FROM_DEVICE);
 	}
 -	dma_unmap_single(NULL, buf->iv_addr,  L1_CACHE_BYTES, DMA_BIDIRECTIONAL);
 +	dma_unmap_single(cdev, buf->iv_addr,  L1_CACHE_BYTES, DMA_BIDIRECTIONAL);
 	addr = phys_to_virt(buf->iv_addr);
 	entry = container_of(addr, struct nss_crypto_buf_node, results);
@@ -531,6 +532,7 @@ nss_crypto_status_t nss_crypto_transform
 	uint32_t paddr;
 	void *vaddr;
 	size_t len;
 +	struct device *cdev = gbl_crypto_ctrl.eng[0].dev;
 	if (!buf->cb_fn) {
 		nss_crypto_warn("%p:no buffer(%p) callback present\n", crypto, buf);
@@ -544,7 +546,7 @@ nss_crypto_status_t nss_crypto_transform
 	 */
 	vaddr = (void *)buf->data_in;
 	len = buf->data_len;
 -	paddr = dma_map_single(NULL, vaddr, len, DMA_TO_DEVICE);
 +	paddr = dma_map_single(cdev, vaddr, len, DMA_TO_DEVICE);
 	buf->data_in = paddr;
 	if (vaddr == (void *)buf->data_out) {
@@ -555,14 +557,14 @@ nss_crypto_status_t nss_crypto_transform
 		 */
 		vaddr = (void *)buf->data_out;
 		len = buf->data_len;
 -		paddr = dma_map_single(NULL, vaddr, len, DMA_FROM_DEVICE);
 +		paddr = dma_map_single(cdev, vaddr, len, DMA_FROM_DEVICE);
 		buf->data_out = paddr;
 	}
 	/*
 	 * We need to map the results into IV
 	 */
 -	paddr = dma_map_single(NULL, entry->results, L1_CACHE_BYTES, DMA_BIDIRECTIONAL);
 +	paddr = dma_map_single(cdev, entry->results, L1_CACHE_BYTES, DMA_BIDIRECTIONAL);
 	buf->hash_addr = paddr;
 	buf->iv_addr = paddr;
--- a/package/qca/nss/qca-nss-dp/patches/0002-nss_dp_main-make-phy-mode-code-compatible-with-newer.patch
+++ b/package/qca/nss/qca-nss-dp/patches/0002-nss_dp_main-make-phy-mode-code-compatible-with-newer.patch
@ -1,48 +0,0 @@
 From cef7873a2d77df13ee702d902ed4e06b2248904b Mon Sep 17 00:00:00 2001
 Message-Id: <cef7873a2d77df13ee702d902ed4e06b2248904b.1620066716.git.baruch@tkos.co.il>
 In-Reply-To: <40979666b4371012405715ffa61ab5760fcdc6b3.1620066716.git.baruch@tkos.co.il>
 References: <40979666b4371012405715ffa61ab5760fcdc6b3.1620066716.git.baruch@tkos.co.il>
 From: Baruch Siach <baruch@tkos.co.il>
 Date: Mon, 3 May 2021 20:17:22 +0300
 Subject: [PATCH 2/3] nss_dp_main: make phy mode code compatible with newer
 kernels
 ---
 include/nss_dp_dev.h | 4 ++--
 nss_dp_main.c        | 4 ++++
 2 files changed, 6 insertions(+), 2 deletions(-)
 --- a/include/nss_dp_dev.h
 +++ b/include/nss_dp_dev.h
@@ -22,7 +22,7 @@
 #include <linux/etherdevice.h>
 #include <linux/netdevice.h>
 #include <linux/platform_device.h>
 -#include <linux/switch.h>
 +#include <linux/phy.h>
 #include <linux/version.h>
 #include "nss_dp_api_if.h"
@@ -99,7 +99,7 @@ struct nss_dp_dev {
 	/* Phy related stuff */
 	struct phy_device *phydev;	/* Phy device */
 	struct mii_bus *miibus;		/* MII bus */
 -	uint32_t phy_mii_type;		/* RGMII/SGMII/QSGMII */
 +	phy_interface_t phy_mii_type;	/* RGMII/SGMII/QSGMII */
 	uint32_t phy_mdio_addr;		/* Mdio address */
 	bool link_poll;			/* Link polling enable? */
 	uint32_t forced_speed;		/* Forced speed? */
 --- a/nss_dp_main.c
 +++ b/nss_dp_main.c
@@ -584,7 +584,11 @@ static int32_t nss_dp_of_get_pdata(struc
 	hal_pdata->netdev = netdev;
 	hal_pdata->macid = dp_priv->macid;
 +#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 5, 0))
 	dp_priv->phy_mii_type = of_get_phy_mode(np);
 +#else
 +	of_get_phy_mode(np, &dp_priv->phy_mii_type);
 +#endif
 	dp_priv->link_poll = of_property_read_bool(np, "qcom,link-poll");
 	if (of_property_read_u32(np, "qcom,phy-mdio-addr",
 		&dp_priv->phy_mdio_addr) && dp_priv->link_poll) {
--- a/package/qca/nss/qca-nss-dp/patches/0003-Drop-_nocache-variants-of-ioremap.patch
+++ b/package/qca/nss/qca-nss-dp/patches/0003-Drop-_nocache-variants-of-ioremap.patch
@ -1,48 +0,0 @@
 From c8c52512ff48bee578901c381a42f027e79eadf9 Mon Sep 17 00:00:00 2001
 Message-Id: <c8c52512ff48bee578901c381a42f027e79eadf9.1620066716.git.baruch@tkos.co.il>
 In-Reply-To: <40979666b4371012405715ffa61ab5760fcdc6b3.1620066716.git.baruch@tkos.co.il>
 References: <40979666b4371012405715ffa61ab5760fcdc6b3.1620066716.git.baruch@tkos.co.il>
 From: Baruch Siach <baruch@tkos.co.il>
 Date: Mon, 3 May 2021 20:20:29 +0300
 Subject: [PATCH 3/3] Drop _nocache variants of ioremap()
 Recent kernels removed them.
 ---
 hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c          | 2 +-
 hal/gmac_ops/qcom/qcom_if.c     | 2 +-
 hal/gmac_ops/syn/xgmac/syn_if.c | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)
 --- a/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c
 +++ b/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c
@@ -279,7 +279,7 @@ int edma_init(void)
 	/*
 	 * Remap register resource
 	 */
 -	edma_hw.reg_base = ioremap_nocache((edma_hw.reg_resource)->start,
 +	edma_hw.reg_base = ioremap((edma_hw.reg_resource)->start,
 				resource_size(edma_hw.reg_resource));
 	if (!edma_hw.reg_base) {
 		pr_warn("Unable to remap EDMA register memory.\n");
 --- a/hal/gmac_ops/qcom/qcom_if.c
 +++ b/hal/gmac_ops/qcom/qcom_if.c
@@ -418,7 +418,7 @@ static void *qcom_init(struct nss_gmac_h
 	qhd->nghd.mac_id = gmacpdata->macid;
 	/* Populate the mac base addresses */
 -	qhd->nghd.mac_base = devm_ioremap_nocache(&dp_priv->pdev->dev,
 +	qhd->nghd.mac_base = devm_ioremap(&dp_priv->pdev->dev,
 						res->start, resource_size(res));
 	if (!qhd->nghd.mac_base) {
 		netdev_dbg(ndev, "ioremap fail.\n");
 --- a/hal/gmac_ops/syn/xgmac/syn_if.c
 +++ b/hal/gmac_ops/syn/xgmac/syn_if.c
@@ -432,7 +432,7 @@ static void *syn_init(struct nss_gmac_ha
 	/* Populate the mac base addresses */
 	shd->nghd.mac_base =
 -		devm_ioremap_nocache(&dp_priv->pdev->dev, res->start,
 +		devm_ioremap(&dp_priv->pdev->dev, res->start,
 				     resource_size(res));
 	if (!shd->nghd.mac_base) {
 		netdev_dbg(ndev, "ioremap fail.\n");
--- a/package/qca/nss/qca-nss-dp/patches/0006-NSS-DP-fix-of_get_mac_address.patch
+++ b/package/qca/nss/qca-nss-dp/patches/0006-NSS-DP-fix-of_get_mac_address.patch
@ -1,46 +0,0 @@
 From cadeb62a42296563141d6954eec58e34ef86778d Mon Sep 17 00:00:00 2001
 From: Robert Marko <robimarko@gmail.com>
 Date: Fri, 13 Aug 2021 20:12:08 +0200
 Subject: [PATCH] NSS-DP: fix of_get_mac_address()
 Recently OpenWrt backported the updated of_get_mac_address()
 function which returns and error code instead.
 So, patch the SSDK to use it and fix the compilation error.
 Signed-off-by: Robert Marko <robimarko@gmail.com>
 ---
 nss_dp_main.c | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)
 --- a/nss_dp_main.c
 +++ b/nss_dp_main.c
@@ -555,9 +555,10 @@ static int32_t nss_dp_of_get_pdata(struc
 				   struct net_device *netdev,
 				   struct nss_gmac_hal_platform_data *hal_pdata)
 {
 -	uint8_t *maddr;
 +	u8 maddr[ETH_ALEN];
 	struct nss_dp_dev *dp_priv;
 	struct resource memres_devtree = {0};
 +	int ret;
 	dp_priv = netdev_priv(netdev);
@@ -600,14 +601,8 @@ static int32_t nss_dp_of_get_pdata(struc
 	of_property_read_u32(np, "qcom,forced-speed", &dp_priv->forced_speed);
 	of_property_read_u32(np, "qcom,forced-duplex", &dp_priv->forced_duplex);
 -	maddr = (uint8_t *)of_get_mac_address(np);
 -#if (LINUX_VERSION_CODE > KERNEL_VERSION(5, 4, 0))
 -	if (IS_ERR((void *)maddr)) {
 -		maddr = NULL;
 -	}
 -#endif
 -
 -	if (maddr && is_valid_ether_addr(maddr)) {
 +	ret = of_get_mac_address(np, maddr);
 +	if (!ret && is_valid_ether_addr(maddr)) {
 		ether_addr_copy(netdev->dev_addr, maddr);
 	} else {
 		random_ether_addr(netdev->dev_addr);
--- a/package/qca/nss/qca-nss-dp/patches/0007-NSS-DP-implement-ethernet-IOCTL-s.patch
+++ b/package/qca/nss/qca-nss-dp/patches/0007-NSS-DP-implement-ethernet-IOCTL-s.patch
@ -1,29 +0,0 @@
 From 5da62ba19f554bf437752a44360fb5ae9f1a7f5e Mon Sep 17 00:00:00 2001
 From: Robert Marko <robimarko@gmail.com>
 Date: Tue, 8 Mar 2022 10:48:32 +0100
 Subject: [PATCH] NSS-DP: implement ethernet IOCTL-s
 Since kernel 5.15 ethernet/PHY related IOCTL-s have been split from the
 generic IOCTL netdev op.
 So, implement the new op instead of the generic one which is considered
 for private IOCTL-s only now for 5.15+.
 Signed-off-by: Robert Marko <robimarko@gmail.com>
 ---
 nss_dp_main.c | 4 ++++
 1 file changed, 4 insertions(+)
 --- a/nss_dp_main.c
 +++ b/nss_dp_main.c
@@ -532,7 +532,11 @@ static const struct net_device_ops nss_d
 	.ndo_set_mac_address = nss_dp_set_mac_address,
 	.ndo_validate_addr = eth_validate_addr,
 	.ndo_change_mtu = nss_dp_change_mtu,
 +#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0))
 	.ndo_do_ioctl = nss_dp_do_ioctl,
 +#else
 +	.ndo_eth_ioctl = nss_dp_do_ioctl,
 +#endif
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 5, 0))
 	.ndo_bridge_setlink = switchdev_port_bridge_setlink,
--- a/package/qca/nss/qca-nss-dp/patches/0008-switchdev-remove-the-transaction-structure.patch
+++ b/package/qca/nss/qca-nss-dp/patches/0008-switchdev-remove-the-transaction-structure.patch
@ -1,48 +0,0 @@
 From c9afdcdd2642485a6476906be9da2e811090fc7a Mon Sep 17 00:00:00 2001
 From: Robert Marko <robimarko@gmail.com>
 Date: Fri, 18 Mar 2022 18:06:03 +0100
 Subject: [PATCH] switchdev: remove the transaction structure
 Since 5.12 there is no transaction structure anymore, so drop it for
 5.12 and newer.
 Signed-off-by: Robert Marko <robimarko@gmail.com>
 ---
 nss_dp_switchdev.c | 10 ++++++++++
 1 file changed, 10 insertions(+)
 --- a/nss_dp_switchdev.c
 +++ b/nss_dp_switchdev.c
@@ -279,13 +279,19 @@ void nss_dp_switchdev_setup(struct net_d
  *	Sets attributes
  */
 static int nss_dp_port_attr_set(struct net_device *dev,
 +#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0))
 				const struct switchdev_attr *attr,
 				struct switchdev_trans *trans)
 +#else
 +				const struct switchdev_attr *attr)
 +#endif
 {
 	struct nss_dp_dev *dp_priv = (struct nss_dp_dev *)netdev_priv(dev);
 +#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0))
 	if (switchdev_trans_ph_prepare(trans))
 		return 0;
 +#endif
 	switch (attr->id) {
 	case SWITCHDEV_ATTR_ID_PORT_BRIDGE_FLAGS:
@@ -309,8 +315,12 @@ static int nss_dp_switchdev_port_attr_se
 {
 	int err;
 +#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0))
 	err = nss_dp_port_attr_set(netdev, port_attr_info->attr,
 				   port_attr_info->trans);
 +#else
 +	err = nss_dp_port_attr_set(netdev, port_attr_info->attr);
 +#endif
 	port_attr_info->handled = true;
 	return notifier_from_errno(err);
--- a/package/qca/nss/qca-nss-dp/patches/0009-switchdev-use-new-switchdev-flags.patch
+++ b/package/qca/nss/qca-nss-dp/patches/0009-switchdev-use-new-switchdev-flags.patch
@ -1,54 +0,0 @@
 From f95868d54301c0f54e968ec9d978c9caa02ee425 Mon Sep 17 00:00:00 2001
 From: Robert Marko <robimarko@gmail.com>
 Date: Fri, 18 Mar 2022 18:24:18 +0100
 Subject: [PATCH] switchdev: use new switchdev flags
 Since kernel 5.12 switched utilizes a new way of setting the flags by
 using a dedicated structure with flags and mask.
 So fix using kernels 5.12 and later.
 Signed-off-by: Robert Marko <robimarko@gmail.com>
 ---
 include/nss_dp_dev.h | 7 +++++++
 nss_dp_switchdev.c   | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)
 --- a/include/nss_dp_dev.h
 +++ b/include/nss_dp_dev.h
@@ -24,6 +24,9 @@
 #include <linux/platform_device.h>
 #include <linux/phy.h>
 #include <linux/version.h>
 +#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0))
 +#include <net/switchdev.h>
 +#endif
 #include "nss_dp_api_if.h"
 #include "nss_dp_hal_if.h"
@@ -126,7 +129,11 @@ struct nss_dp_dev {
 	/* switchdev related attributes */
 #ifdef CONFIG_NET_SWITCHDEV
 	u8 stp_state;			/* STP state of this physical port */
 +#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0))
 	unsigned long brport_flags;	/* bridge port flags */
 +#else
 +	struct switchdev_brport_flags brport_flags;	/* bridge port flags */
 +#endif
 #endif
 	uint32_t rx_page_mode;		/* page mode for Rx processing */
 	uint32_t rx_jumbo_mru;		/* Jumbo mru value for Rx processing */
 --- a/nss_dp_switchdev.c
 +++ b/nss_dp_switchdev.c
@@ -296,7 +296,11 @@ static int nss_dp_port_attr_set(struct n
 	switch (attr->id) {
 	case SWITCHDEV_ATTR_ID_PORT_BRIDGE_FLAGS:
 		dp_priv->brport_flags = attr->u.brport_flags;
 +#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0))
 		netdev_dbg(dev, "set brport_flags %lu\n", attr->u.brport_flags);
 +#else
 +		netdev_dbg(dev, "set brport_flags %lu\n", attr->u.brport_flags.val);
 +#endif
 		return 0;
 	case SWITCHDEV_ATTR_ID_PORT_STP_STATE:
 		return nss_dp_stp_state_set(dp_priv, attr->u.stp_state);
--- a/package/qca/nss/qca-nss-dp/patches/0011-treewide-fix-confusing-printing-of-registered-netdev.patch
+++ b/package/qca/nss/qca-nss-dp/patches/0011-treewide-fix-confusing-printing-of-registered-netdev.patch
@ -1,41 +0,0 @@
 From 7e4ae2d6285095794d73d2f2ce61404f61d4e633 Mon Sep 17 00:00:00 2001
 From: Ansuel Smith <ansuelsmth@gmail.com>
 Date: Tue, 17 May 2022 15:55:36 +0200
 Subject: [PATCH 11/11] treewide: fix confusing printing of registered netdev
 Net core implementation changed and now printing the netdev name cause
 confusing printing if done before register_netdev. Move the old printing
 to dbg and add an additional info log right after register_netdev to
 give the user some info on correct nss-dp probe.
 Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
 ---
 hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c | 4 ++--
 nss_dp_main.c                                | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)
 --- a/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c
 +++ b/hal/dp_ops/edma_dp/edma_v1/edma_data_plane.c
@@ -822,8 +822,8 @@ static int edma_register_netdevice(struc
 		return -EINVAL;
 	}
 -	netdev_info(netdev, "nss_dp_edma: Registering netdev %s(qcom-id:%d) with EDMA\n",
 -		netdev->name, macid);
 +	netdev_dbg(netdev, "nss_dp_edma: Registering netdev %s(qcom-id:%d) with EDMA\n",
 +		   netdev->name, macid);
 	/*
 	 * We expect 'macid' to correspond to ports numbers on
 --- a/nss_dp_main.c
 +++ b/nss_dp_main.c
@@ -875,6 +875,9 @@ static int32_t nss_dp_probe(struct platf
 		goto phy_setup_fail;
 	}
 +	netdev_info(netdev, "Registered netdev %s(qcom-id:%d)\n",
 +		    netdev->name, port_id);
 +
 	dp_global_ctx.nss_dp[dp_priv->macid - 1] = dp_priv;
 	dp_global_ctx.slowproto_acl_bm = 0;
--- a/package/qca/nss/qca-nss-drv-64/Makefile
+++ b/package/qca/nss/qca-nss-drv-64/Makefile
@ -1,119 +0,0 @@
 include $(TOPDIR)/rules.mk
 PKG_NAME:=qca-nss-drv-64
 PKG_RELEASE:=$(AUTORELEASE)
 PKG_SOURCE_URL:=https://git.codelinaro.org/clo/qsdk/oss/lklm/nss-drv.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_DATE:=2022-01-24
 PKG_SOURCE_VERSION:=4f1b8e51105bb71ebd0bb07c1ec0d8b6e5d0913e
 PKG_MIRROR_HASH:=4d32e072fb019d43adce8b1bc58c11a424aba31c3baa2d0b802141baa73d53e7
 PKG_BUILD_PARALLEL:=1
 include $(INCLUDE_DIR)/kernel.mk
 include $(INCLUDE_DIR)/package.mk
 NSS_CLIENTS_DIR:=$(TOPDIR)/qca/src/qca-nss-clients
 define KernelPackage/qca-nss-drv-64
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  DEPENDS:=@(TARGET_ipq807x||TARGET_ipq60xx) +kmod-qca-nss-dp
  TITLE:=Kernel driver for NSS (core driver)
  FILES:=$(PKG_BUILD_DIR)/qca-nss-drv.ko
  AUTOLOAD:=$(call AutoLoad,32,qca-nss-drv)
 endef
 define KernelPackage/qca-nss-drv-64/install
 	$(INSTALL_DIR) $(1)/lib/debug
 	$(INSTALL_DIR) $(1)/etc/init.d
 	$(INSTALL_DIR) $(1)/etc/sysctl.d
 	$(INSTALL_DIR) $(1)/etc/hotplug.d/firmware
 	$(INSTALL_DIR) $(1)/etc/config
 	$(INSTALL_BIN) ./files/qca-nss-drv.debug $(1)/lib/debug/qca-nss-drv
 	$(INSTALL_BIN) ./files/qca-nss-drv.init $(1)/etc/init.d/qca-nss-drv
 	$(INSTALL_BIN) ./files/qca-nss-drv.sysctl $(1)/etc/sysctl.d/qca-nss-drv.conf
 	$(INSTALL_BIN) ./files/qca-nss-drv.hotplug $(1)/etc/hotplug.d/firmware/10-qca-nss-fw
 	$(INSTALL_BIN) ./files/qca-nss-drv.conf $(1)/etc/config/nss
 endef
 define KernelPackage/qca-nss-drv-64/Description
 This package contains a NSS driver for QCA chipset
 endef
 define Build/InstallDev
 	mkdir -p $(1)/usr/include/qca-nss-drv
 	$(CP) $(PKG_BUILD_DIR)/exports/* $(1)/usr/include/qca-nss-drv/
 endef
 EXTRA_CFLAGS+= -I$(STAGING_DIR)/usr/include/qca-nss-gmac -I$(STAGING_DIR)/usr/include/qca-nss-dp -I$(STAGING_DIR)/usr/include/qca-ssdk
 ifneq (, $(findstring $(CONFIG_TARGET_BOARD), "ipq807x" "ipq60xx"))
 EXTRA_CFLAGS+= -DNSS_MEM_PROFILE_MEDIUM
 LOW_MEM_PROFILE_MAKE_OPTS=y
 endif
 ifeq ($(CONFIG_KERNEL_SKB_FIXED_SIZE_2K),y)
 EXTRA_CFLAGS+= -DNSS_SKB_FIXED_SIZE_2K
 endif
 DRV_MAKE_OPTS:=
 ifeq ($(LOW_MEM_PROFILE_MAKE_OPTS),y)
 DRV_MAKE_OPTS+=NSS_DRV_C2C_ENABLE=n \
 	NSS_DRV_CAPWAP_ENABLE=n \
 	NSS_DRV_CLMAP_ENABLE=n \
 	NSS_DRV_CRYPTO_ENABLE=n \
 	NSS_DRV_DTLS_ENABLE=n \
 	NSS_DRV_GRE_ENABLE=n \
 	NSS_DRV_GRE_REDIR_ENABLE=n \
 	NSS_DRV_GRE_TUNNEL_ENABLE=n \
 	NSS_DRV_IGS_ENABLE=n \
 	NSS_DRV_IPSEC_ENABLE=n \
 	NSS_DRV_LAG_ENABLE=n \
 	NSS_DRV_L2TP_ENABLE=n \
 	NSS_DRV_MAPT_ENABLE=n \
 	NSS_DRV_OAM_ENABLE=n \
 	NSS_DRV_PPTP_ENABLE=n \
 	NSS_DRV_PORTID_ENABLE=n \
 	NSS_DRV_PVXLAN_ENABLE=n \
 	NSS_DRV_QRFS_ENABLE=n \
 	NSS_DRV_QVPN_ENABLE=n \
 	NSS_DRV_RMNET_ENABLE=n \
 	NSS_DRV_SHAPER_ENABLE=n \
 	NSS_DRV_SJACK_ENABLE=n \
 	NSS_DRV_TLS_ENABLE=n \
 	NSS_DRV_TRUSTSEC_ENABLE=n \
 	NSS_DRV_TSTAMP_ENABLE=n \
 	NSS_DRV_TUN6RD_ENABLE=n \
 	NSS_DRV_TUNIPIP6_ENABLE=n \
 	NSS_DRV_VXLAN_ENABLE=n \
 	NSS_DRV_MATCH_ENABLE=n \
 	NSS_DRV_MIRROR_ENABLE=n
 endif
 ifeq ($(CONFIG_TARGET_BOARD), "ipq807x")
    SOC="ipq807x_64"
 else ifeq ($(CONFIG_TARGET_BOARD), "ipq60xx")
    SOC="ipq60xx_64"
 endif
 define Build/Configure
 	$(LN) arch/nss_$(SOC).h $(PKG_BUILD_DIR)/exports/nss_arch.h
 endef
 define Build/Compile
 	+$(MAKE) -C "$(LINUX_DIR)" $(strip $(DRV_MAKE_OPTS)) \
 		CROSS_COMPILE="$(TARGET_CROSS)" \
 		ARCH="$(LINUX_KARCH)" \
 		M="$(PKG_BUILD_DIR)" \
 		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" SoC=$(SOC) \
 		$(KERNEL_MAKE_FLAGS) \
 		$(PKG_JOBS) \
 		modules
 endef
 $(eval $(call KernelPackage,qca-nss-drv-64))
--- a/package/qca/nss/qca-nss-drv-64/files/qca-nss-drv.conf
+++ b/package/qca/nss/qca-nss-drv-64/files/qca-nss-drv.conf
@ -1,6 +0,0 @@
 config nss_firmware 'qca_nss_0'
 config nss_firmware 'qca_nss_1'
 config general
 	option enable_rps	'1'
--- a/package/qca/nss/qca-nss-drv-64/files/qca-nss-drv.debug
+++ b/package/qca/nss/qca-nss-drv-64/files/qca-nss-drv.debug
@ -1,26 +0,0 @@
 #!/bin/sh /sbin/sysdebug
 #
 # Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #
 log cat /sys/kernel/debug/qca-nss-drv/stats/pppoe
 log cat /sys/kernel/debug/qca-nss-drv/stats/n2h
 log cat /sys/kernel/debug/qca-nss-drv/stats/ipv6
 log cat /sys/kernel/debug/qca-nss-drv/stats/ipv4
 log cat /sys/kernel/debug/qca-nss-drv/stats/gmac
 log cat /sys/kernel/debug/qca-nss-drv/stats/drv
 log cat /sys/kernel/debug/qca-nss-drv/stats/wifi
 log cat /sys/kernel/debug/qca-nss-drv/stats/wifi_if
 log cat /sys/kernel/debug/qca-nss-drv/stats/eth_rx
--- a/package/qca/nss/qca-nss-drv-64/files/qca-nss-drv.hotplug
+++ b/package/qca/nss/qca-nss-drv-64/files/qca-nss-drv.hotplug
@ -1,70 +0,0 @@
 #!/bin/sh
 #
 # Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #
 KERNEL=`uname -r`
 case "${KERNEL}" in
 	3.4*)
 		select_or_load=load_nss_fw
 		;;
 	*)
 		select_or_load=select_nss_fw
 		;;
 esac
 load_nss_fw () {
 	ls -l $1 | awk ' { print $9,$5 } '> /dev/console
 	echo 1 > /sys/class/firmware/$DEVICENAME/loading
 	cat $1 > /sys/class/firmware/$DEVICENAME/data
 	echo 0 > /sys/class/firmware/$DEVICENAME/loading
 }
 select_nss_fw () {
 	rm -f /lib/firmware/$DEVICENAME
 	ln -s $1 /lib/firmware/$DEVICENAME
 	ls -l /lib/firmware/$DEVICENAME | awk ' { print $9,$5 } '> /dev/console
 }
 [ "$ACTION" != "add" ] && exit
 # dev name for UCI, since it doesn't let you use . or -
 SDEVNAME=$(echo ${DEVICENAME} | sed s/[.-]/_/g)
 SELECTED_FW=$(uci get nss.${SDEVNAME}.firmware 2>/dev/null)
 [ -e "${SELECTED_FW}" ] && {
 	$select_or_load ${SELECTED_FW}
 	exit
 }
 case $DEVICENAME in
        qca-nss0* | qca-nss.0*)
                if [ -e /lib/firmware/qca-nss0-enterprise.bin ] ; then
                        $select_or_load /lib/firmware/qca-nss0-enterprise.bin
                else
                        $select_or_load /lib/firmware/qca-nss0-retail.bin
                fi
                exit
                ;;
        qca-nss1* | qca-nss.1*)
                if [ -e /lib/firmware/qca-nss1-enterprise.bin ] ; then
                        $select_or_load /lib/firmware/qca-nss1-enterprise.bin
                else
                        $select_or_load /lib/firmware/qca-nss1-retail.bin
                fi
                exit
                ;;
 esac
--- a/package/qca/nss/qca-nss-drv-64/files/qca-nss-drv.init
+++ b/package/qca/nss/qca-nss-drv-64/files/qca-nss-drv.init
@ -1,50 +0,0 @@
 #!/bin/sh /etc/rc.common
 #
 # Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #
 START=70
 enable_rps() {
 	irq_nss_rps=`grep nss_queue1 /proc/interrupts | cut -d ':' -f 1 | tr -d ' '`
 	for entry in $irq_nss_rps
 	do
 		echo 2 > /proc/irq/$entry/smp_affinity
 	done
 	irq_nss_rps=`grep nss_queue2 /proc/interrupts | cut -d ':' -f 1 | tr -d ' '`
 	for entry in $irq_nss_rps
 	do
 		echo 4 > /proc/irq/$entry/smp_affinity
 	done
 	irq_nss_rps=`grep nss_queue3 /proc/interrupts | cut -d ':' -f 1 | tr -d ' '`
 	for entry in $irq_nss_rps
 	do
 		echo 8 > /proc/irq/$entry/smp_affinity
 	done
 	# Enable NSS RPS
 	sysctl -w dev.nss.rps.enable=1 >/dev/null 2>/dev/null
 }
 start() {
 	local rps_enabled="$(uci_get nss @general[0] enable_rps)"
 	if [ "$rps_enabled" -eq 1 ]; then
 		enable_rps
 	fi
 }
--- a/package/qca/nss/qca-nss-drv-64/files/qca-nss-drv.sysctl
+++ b/package/qca/nss/qca-nss-drv-64/files/qca-nss-drv.sysctl
@ -1,4 +0,0 @@
 # Default Number of connection configuration
 dev.nss.ipv4cfg.ipv4_conn=4096
 dev.nss.ipv6cfg.ipv6_conn=4096
--- a/package/qca/nss/qca-nss-drv-64/patches/0001-core-add-5.10-kernel-to-version-check.patch
+++ b/package/qca/nss/qca-nss-drv-64/patches/0001-core-add-5.10-kernel-to-version-check.patch
@ -1,25 +0,0 @@
 From 3885c752e12f74cad6c97888b797e5903ad1930d Mon Sep 17 00:00:00 2001
 From: Robert Marko <robimarko@gmail.com>
 Date: Thu, 13 May 2021 23:22:38 +0200
 Subject: [PATCH] core: add 5.10 kernel to version check
 NSS DRV has a kernel version check, so simply add
 5.10 as supported.
 Signed-off-by: Robert Marko <robimarko@gmail.com>
 ---
 nss_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 --- a/nss_core.c
 +++ b/nss_core.c
@@ -52,7 +52,8 @@
 (((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(3, 11, 0)))) || \
 (((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(3, 19, 0)))) || \
 (((LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(4, 5, 0)))) || \
 -(((LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(5, 5, 0))))))
 +(((LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(5, 5, 0)))) || \
 +(((LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(5, 11, 0))))))
 #error "Check skb recycle code in this file to match Linux version"
 #endif
--- a/package/qca/nss/qca-nss-drv-64/patches/0002-nss-drv-replace-ioremap_nocache-with-ioremap.patch
+++ b/package/qca/nss/qca-nss-drv-64/patches/0002-nss-drv-replace-ioremap_nocache-with-ioremap.patch
@ -1,164 +0,0 @@
 From b5e2a7167ca3df9fce34f0d7c05468d4f5597275 Mon Sep 17 00:00:00 2001
 From: Robert Marko <robimarko@gmail.com>
 Date: Thu, 13 May 2021 23:33:18 +0200
 Subject: [PATCH] nss-drv: replace ioremap_nocache() with ioremap()
 ioremap_nocache() does not exist anymore.
 Signed-off-by: Robert Marko <robimarko@gmail.com>
 ---
 nss_hal/ipq50xx/nss_hal_pvt.c | 6 +++---
 nss_hal/ipq60xx/nss_hal_pvt.c | 8 ++++----
 nss_hal/ipq806x/nss_hal_pvt.c | 4 ++--
 nss_hal/ipq807x/nss_hal_pvt.c | 6 +++---
 nss_hal/nss_hal.c             | 4 ++--
 nss_meminfo.c                 | 2 +-
 nss_ppe.c                     | 2 +-
 7 files changed, 16 insertions(+), 16 deletions(-)
 --- a/nss_hal/ipq50xx/nss_hal_pvt.c
 +++ b/nss_hal/ipq50xx/nss_hal_pvt.c
@@ -184,13 +184,13 @@ static struct nss_platform_data *__nss_h
 	npd->nphys = res_nphys.start;
 	npd->qgic_phys = res_qgic_phys.start;
 -	npd->nmap = ioremap_nocache(npd->nphys, resource_size(&res_nphys));
 +	npd->nmap = ioremap(npd->nphys, resource_size(&res_nphys));
 	if (!npd->nmap) {
 		nss_info_always("%px: nss%d: ioremap() fail for nphys\n", nss_ctx, nss_ctx->id);
 		goto out;
 	}
 -	npd->qgic_map = ioremap_nocache(npd->qgic_phys, resource_size(&res_qgic_phys));
 +	npd->qgic_map = ioremap(npd->qgic_phys, resource_size(&res_qgic_phys));
 	if (!npd->qgic_map) {
 		nss_info_always("%px: nss%d: ioremap() fail for qgic map\n", nss_ctx, nss_ctx->id);
 		goto out;
@@ -348,7 +348,7 @@ static int __nss_hal_common_reset(struct
 	of_node_put(cmn);
 -	nss_misc_reset = ioremap_nocache(res_nss_misc_reset.start, resource_size(&res_nss_misc_reset));
 +	nss_misc_reset = ioremap(res_nss_misc_reset.start, resource_size(&res_nss_misc_reset));
 	if (!nss_misc_reset) {
 		pr_err("%px: ioremap fail for nss_misc_reset\n", nss_dev);
 		return -EFAULT;
 --- a/nss_hal/ipq60xx/nss_hal_pvt.c
 +++ b/nss_hal/ipq60xx/nss_hal_pvt.c
@@ -207,13 +207,13 @@ static struct nss_platform_data *__nss_h
 	npd->nphys = res_nphys.start;
 	npd->qgic_phys = res_qgic_phys.start;
 -	npd->nmap = ioremap_nocache(npd->nphys, resource_size(&res_nphys));
 +	npd->nmap = ioremap(npd->nphys, resource_size(&res_nphys));
 	if (!npd->nmap) {
 		nss_info_always("%px: nss%d: ioremap() fail for nphys\n", nss_ctx, nss_ctx->id);
 		goto out;
 	}
 -	npd->qgic_map = ioremap_nocache(npd->qgic_phys, resource_size(&res_qgic_phys));
 +	npd->qgic_map = ioremap(npd->qgic_phys, resource_size(&res_qgic_phys));
 	if (!npd->qgic_map) {
 		nss_info_always("%px: nss%d: ioremap() fail for qgic map\n", nss_ctx, nss_ctx->id);
 		goto out;
@@ -433,13 +433,13 @@ static int __nss_hal_common_reset(struct
 	of_node_put(cmn);
 -	nss_misc_reset = ioremap_nocache(res_nss_misc_reset.start, resource_size(&res_nss_misc_reset));
 +	nss_misc_reset = ioremap(res_nss_misc_reset.start, resource_size(&res_nss_misc_reset));
 	if (!nss_misc_reset) {
 		pr_err("%px: ioremap fail for nss_misc_reset\n", nss_dev);
 		return -EFAULT;
 	}
 -	nss_misc_reset_flag = ioremap_nocache(res_nss_misc_reset_flag.start, resource_size(&res_nss_misc_reset_flag));
 +	nss_misc_reset_flag = ioremap(res_nss_misc_reset_flag.start, resource_size(&res_nss_misc_reset_flag));
 	if (!nss_misc_reset_flag) {
 		pr_err("%px: ioremap fail for nss_misc_reset_flag\n", nss_dev);
 		return -EFAULT;
 --- a/nss_hal/ipq806x/nss_hal_pvt.c
 +++ b/nss_hal/ipq806x/nss_hal_pvt.c
@@ -458,7 +458,7 @@ static struct nss_platform_data *__nss_h
 	npd->nphys = res_nphys.start;
 	npd->vphys = res_vphys.start;
 -	npd->nmap = ioremap_nocache(npd->nphys, resource_size(&res_nphys));
 +	npd->nmap = ioremap(npd->nphys, resource_size(&res_nphys));
 	if (!npd->nmap) {
 		nss_info_always("%px: nss%d: ioremap() fail for nphys\n", nss_ctx, nss_ctx->id);
 		goto out;
@@ -711,7 +711,7 @@ static int __nss_hal_common_reset(struct
 	}
 	of_node_put(cmn);
 -	fpb_base = ioremap_nocache(res_nss_fpb_base.start, resource_size(&res_nss_fpb_base));
 +	fpb_base = ioremap(res_nss_fpb_base.start, resource_size(&res_nss_fpb_base));
 	if (!fpb_base) {
 		pr_err("%px: ioremap fail for nss_fpb_base\n", nss_dev);
 		return -EFAULT;
 --- a/nss_hal/ipq807x/nss_hal_pvt.c
 +++ b/nss_hal/ipq807x/nss_hal_pvt.c
@@ -234,7 +234,7 @@ static struct nss_platform_data *__nss_h
 	npd->vphys = res_vphys.start;
 	npd->qgic_phys = res_qgic_phys.start;
 -	npd->nmap = ioremap_nocache(npd->nphys, resource_size(&res_nphys));
 +	npd->nmap = ioremap(npd->nphys, resource_size(&res_nphys));
 	if (!npd->nmap) {
 		nss_info_always("%px: nss%d: ioremap() fail for nphys\n", nss_ctx, nss_ctx->id);
 		goto out;
@@ -247,7 +247,7 @@ static struct nss_platform_data *__nss_h
 		goto out;
 	}
 -	npd->qgic_map = ioremap_nocache(npd->qgic_phys, resource_size(&res_qgic_phys));
 +	npd->qgic_map = ioremap(npd->qgic_phys, resource_size(&res_qgic_phys));
 	if (!npd->qgic_map) {
 		nss_info_always("%px: nss%d: ioremap() fail for qgic map\n", nss_ctx, nss_ctx->id);
 		goto out;
@@ -467,7 +467,7 @@ static int __nss_hal_common_reset(struct
 	}
 	of_node_put(cmn);
 -	nss_misc_reset = ioremap_nocache(res_nss_misc_reset.start, resource_size(&res_nss_misc_reset));
 +	nss_misc_reset = ioremap(res_nss_misc_reset.start, resource_size(&res_nss_misc_reset));
 	if (!nss_misc_reset) {
 		pr_err("%px: ioremap fail for nss_misc_reset\n", nss_dev);
 		return -EFAULT;
 --- a/nss_hal/nss_hal.c
 +++ b/nss_hal/nss_hal.c
@@ -78,9 +78,9 @@ int nss_hal_firmware_load(struct nss_ctx
 		return rc;
 	}
 -	load_mem = ioremap_nocache(npd->load_addr, nss_fw->size);
 +	load_mem = ioremap(npd->load_addr, nss_fw->size);
 	if (!load_mem) {
 -		nss_info_always("%px: ioremap_nocache failed: %x", nss_ctx, npd->load_addr);
 +		nss_info_always("%px: ioremap failed: %x", nss_ctx, npd->load_addr);
 		release_firmware(nss_fw);
 		return rc;
 	}
 --- a/nss_meminfo.c
 +++ b/nss_meminfo.c
@@ -728,7 +728,7 @@ bool nss_meminfo_init(struct nss_ctx_ins
 	/*
 	 * meminfo_start is the label where the start address of meminfo map is stored.
 	 */
 -	meminfo_start = (uint32_t *)ioremap_nocache(nss_ctx->load + NSS_MEMINFO_MAP_START_OFFSET,
 +	meminfo_start = (uint32_t *)ioremap(nss_ctx->load + NSS_MEMINFO_MAP_START_OFFSET,
 							NSS_MEMINFO_RESERVE_AREA_SIZE);
 	if (!meminfo_start) {
 		nss_info_always("%px: cannot remap meminfo start\n", nss_ctx);
 --- a/nss_ppe.c
 +++ b/nss_ppe.c
@@ -357,7 +357,7 @@ void nss_ppe_init(void)
 	/*
 	 * Get the PPE base address
 	 */
 -	ppe_pvt.ppe_base = ioremap_nocache(PPE_BASE_ADDR, PPE_REG_SIZE);
 +	ppe_pvt.ppe_base = ioremap(PPE_BASE_ADDR, PPE_REG_SIZE);
 	if (!ppe_pvt.ppe_base) {
 		nss_warning("DRV can't get PPE base address\n");
 		return;
--- a/package/qca/nss/qca-nss-drv-64/patches/0003-DMA-Fix-NULL-pointer-exceptions.patch
+++ b/package/qca/nss/qca-nss-drv-64/patches/0003-DMA-Fix-NULL-pointer-exceptions.patch
@ -1,49 +0,0 @@
 From 62e457f262aaa0db7113ad3ccbcb7ae49d4d7ea8 Mon Sep 17 00:00:00 2001
 From: Robert Marko <robimarko@gmail.com>
 Date: Tue, 8 Jun 2021 23:24:43 +0200
 Subject: [PATCH] DMA: Fix NULL pointer exceptions
 There are multiple instances that pass NULL instead
 of device to DMA functions.
 That is incorrect and will cause kernel NULL pointer
 exceptions.
 So, simply pass the device structure pointers.
 Signed-off-by: Robert Marko <robimarko@gmail.com>
 ---
 nss_core.c     | 2 +-
 nss_coredump.c | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)
 --- a/nss_core.c
 +++ b/nss_core.c
@@ -1617,7 +1617,7 @@ static int32_t nss_core_handle_cause_que
 		 *
 		 */
 		if (unlikely((buffer_type == N2H_BUFFER_CRYPTO_RESP))) {
 -			dma_unmap_single(NULL, (desc->buffer + desc->payload_offs), desc->payload_len, DMA_FROM_DEVICE);
 +			dma_unmap_single(nss_ctx->dev, (desc->buffer + desc->payload_offs), desc->payload_len, DMA_FROM_DEVICE);
 			goto consume;
 		}
 --- a/nss_coredump.c
 +++ b/nss_coredump.c
@@ -154,7 +154,7 @@ void nss_fw_coredump_notify(struct nss_c
 		dma_addr = nss_own->meminfo_ctx.logbuffer_dma;
 	}
 -	dma_sync_single_for_cpu(NULL, dma_addr, sizeof(struct nss_log_descriptor), DMA_FROM_DEVICE);
 +	dma_sync_single_for_cpu(nss_own->dev, dma_addr, sizeof(struct nss_log_descriptor), DMA_FROM_DEVICE);
 	/*
 	 * If the current entry is smaller than or equal to the number of NSS_LOG_COREDUMP_LINE_NUM,
@@ -181,7 +181,7 @@ void nss_fw_coredump_notify(struct nss_c
 		offset = (index * sizeof(struct nss_log_entry))
 			+ offsetof(struct nss_log_descriptor, log_ring_buffer);
 -		dma_sync_single_for_cpu(NULL, dma_addr + offset,
 +		dma_sync_single_for_cpu(nss_own->dev, dma_addr + offset,
 				sizeof(struct nss_log_entry), DMA_FROM_DEVICE);
 		nss_info_always("%px: %s\n", nss_own, nle_print->message);
 		nle_print++;
--- a/package/qca/nss/qca-nss-drv-64/patches/0005-nss-drv-add-support-for-kernel-5.15.patch
+++ b/package/qca/nss/qca-nss-drv-64/patches/0005-nss-drv-add-support-for-kernel-5.15.patch
@ -1,73 +0,0 @@
 From 6e65f6daecb09463688eaea0a234018a728196b8 Mon Sep 17 00:00:00 2001
 From: Ansuel Smith <ansuelsmth@gmail.com>
 Date: Tue, 5 Apr 2022 18:10:57 +0200
 Subject: [PATCH 5/8] nss-drv: add support for kernel 5.15
 - Fix coredump panic notifier include change.
 - Fix skb ZEROCOPY flag.
 - Add skb reuse support for 5.15 kernel version.
 Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
 ---
 nss_core.c        | 5 +++--
 nss_coredump.c    | 4 ++++
 nss_hal/nss_hal.c | 1 +
 3 files changed, 8 insertions(+), 2 deletions(-)
 diff --git a/nss_core.c b/nss_core.c
 index f9e6014..8cd1d4b 100644
 --- a/nss_core.c
 +++ b/nss_core.c
@@ -53,7 +53,8 @@
 (((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(3, 19, 0)))) || \
 (((LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(4, 5, 0)))) || \
 (((LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(5, 5, 0)))) || \
 -(((LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(5, 11, 0))))))
 +(((LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(5, 11, 0)))) || \
 +(((LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(5, 16, 0))))))
 #error "Check skb recycle code in this file to match Linux version"
 #endif
@@ -2623,7 +2624,11 @@ static inline bool nss_core_skb_can_reuse(struct nss_ctx_instance *nss_ctx,
 	if (unlikely(irqs_disabled()))
 		return false;
 +#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 14, 0))
 	if (unlikely(skb_shinfo(nbuf)->tx_flags & SKBTX_DEV_ZEROCOPY))
 +#else
 +	if (unlikely(skb_shinfo(nbuf)->flags & SKBFL_ZEROCOPY_ENABLE))
 +#endif
 		return false;
 	if (unlikely(skb_is_nonlinear(nbuf)))
 diff --git a/nss_coredump.c b/nss_coredump.c
 index ecad659..3ecef7e 100644
 --- a/nss_coredump.c
 +++ b/nss_coredump.c
@@ -23,7 +23,11 @@
 #include "nss_hal.h"
 #include "nss_log.h"
 #include <linux/kernel.h>
 +#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 14, 0))
 #include <linux/notifier.h>	/* for panic_notifier_list */
 +#else
 +#include <linux/panic_notifier.h>
 +#endif
 #include <linux/jiffies.h>	/* for time */
 #include "nss_tx_rx_common.h"
 diff --git a/nss_hal/nss_hal.c b/nss_hal/nss_hal.c
 index 57974c1..d8c703b 100644
 --- a/nss_hal/nss_hal.c
 +++ b/nss_hal/nss_hal.c
@@ -24,6 +24,7 @@
 #include <linux/firmware.h>
 #include <linux/of.h>
 #include <linux/irq.h>
 +#include <linux/ethtool.h>
 #include "nss_hal.h"
 #include "nss_arch.h"
 -- 
 2.34.1
--- a/package/qca/nss/qca-nss-drv-64/patches/0005-nss-drv-use-standard-skb_skip_tc_classify-instead-of.patch
+++ b/package/qca/nss/qca-nss-drv-64/patches/0005-nss-drv-use-standard-skb_skip_tc_classify-instead-of.patch
@ -1,29 +0,0 @@
 From 4dd701916186803172a9f35e7e982a953613ad55 Mon Sep 17 00:00:00 2001
 From: Ansuel Smith <ansuelsmth@gmail.com>
 Date: Mon, 11 Apr 2022 21:32:41 +0200
 Subject: [PATCH 5/9] nss-drv: use standard skb_skip_tc_classify instead of
 custom api
 Use skb_skip_tc_classify to skip classify for packet handled by nss
 instead of custom api.
 Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
 ---
 nss_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/nss_core.c b/nss_core.c
 index f9e6014..6ab8038 100644
 --- a/nss_core.c
 +++ b/nss_core.c
@@ -1075,7 +1075,7 @@ static inline void nss_core_set_skb_classify(struct sk_buff *nbuf)
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 4, 0))
 		nbuf->tc_verd = SET_TC_NCLS_NSS(nbuf->tc_verd);
 #else
 -		skb_set_tc_classify_offload(nbuf);
 +		skb_skip_tc_classify(nbuf);
 #endif
 #endif
 }
 --
 2.34.1
--- a/package/qca/nss/qca-nss-drv/Makefile
+++ b/package/qca/nss/qca-nss-drv/Makefile
@ -1,125 +0,0 @@
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 PKG_NAME:=qca-nss-drv
 PKG_RELEASE:=2
 PKG_SOURCE_URL:=https://git.codelinaro.org/clo/qsdk/oss/lklm/nss-drv.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_VERSION:=809a00deffe9f3d4ecd15965790a152757073437
 PKG_MIRROR_HASH:=9c4340561fe9d6ccaa094bbfc5c7f98c27867d2d9a3f1a3f9a7483bca9bbedf8
 NSS_CLIENTS_DIR:=$(TOPDIR)/qca/src/qca-nss-clients
 include $(INCLUDE_DIR)/package.mk
 define KernelPackage/qca-nss-drv
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Devices
  DEPENDS:=@TARGET_ipq806x||TARGET_ipq_ipq806x||TARGET_ipq_ipq807x||TARGET_ipq_ipq807x_64||TARGET_ipq807x||TARGET_ipq807x_64||TARGET_ipq_ipq60xx||TARGET_ipq_ipq60xx_64||TARGET_ipq_ipq50xx||TARGET_ipq_ipq50xx_64 \
 		+PACKAGE_kmod-qca-nss-gmac:kmod-qca-nss-gmac @LINUX_5_4
  TITLE:=Kernel driver for NSS (core driver)
  FILES:=$(PKG_BUILD_DIR)/qca-nss-drv.ko
  AUTOLOAD:=$(call AutoLoad,32,qca-nss-drv)
 endef
 define KernelPackage/qca-nss-drv/install
 	$(INSTALL_DIR) $(1)/lib/debug
 	$(INSTALL_DIR) $(1)/etc/init.d
 	$(INSTALL_DIR) $(1)/etc/sysctl.d
 	$(INSTALL_DIR) $(1)/etc/hotplug.d/firmware
 	$(INSTALL_DIR) $(1)/etc/config
 	$(INSTALL_DIR) $(1)/lib/firmware
 	$(INSTALL_BIN) ./files/qca-nss-drv.debug $(1)/lib/debug/qca-nss-drv
 	$(INSTALL_BIN) ./files/qca-nss-drv.init $(1)/etc/init.d/qca-nss-drv
 	$(INSTALL_BIN) ./files/qca-nss-drv.sysctl $(1)/etc/sysctl.d/qca-nss-drv.conf
 	$(INSTALL_BIN) ./files/qca-nss-drv.hotplug $(1)/etc/hotplug.d/firmware/10-qca-nss-fw
 	$(INSTALL_BIN) ./files/qca-nss-drv.conf $(1)/etc/config/nss
 	$(INSTALL_BIN) ./files/nss-firmware/qca-nss0-retail.bin $(1)/lib/firmware/qca-nss0.bin
 	$(INSTALL_BIN) ./files/nss-firmware/qca-nss1-retail.bin $(1)/lib/firmware/qca-nss1.bin
 endef
 define KernelPackage/qca-nss-drv/Description
 This package contains a NSS driver for QCA chipset
 endef
 define Build/InstallDev
 	mkdir -p $(1)/usr/include/qca-nss-drv
 	$(CP) $(PKG_BUILD_DIR)/exports/* $(1)/usr/include/qca-nss-drv/
 ifneq (, $(findstring $(subtarget), "ipq807x" "ipq807x_64" "ipq60xx" "ipq60xx_64" "ipq50xx" "ipq50xx_64"))
 	$(RM) $(1)/usr/include/qca-nss-drv/nss_ipsecmgr.h
 	$(INSTALL_DIR) $(1)/usr/include/qca-nss-clients
 	$(CP) $(NSS_CLIENTS_DIR)/exports/nss_ipsecmgr.h $(1)/usr/include/qca-nss-clients/.
 endif
 endef
 EXTRA_CFLAGS+= -I$(STAGING_DIR)/usr/include/qca-nss-gmac
 # Keeping default as ipq806x for branches that does not have subtarget framework
 ifeq ($(CONFIG_TARGET_ipq),y)
 subtarget:=$(SUBTARGET)
 else
 subtarget:=$(CONFIG_TARGET_BOARD)
 endif
 ifeq ($(CONFIG_KERNEL_IPQ_MEM_PROFILE),256)
 EXTRA_CFLAGS+= -DNSS_MEM_PROFILE_LOW
 endif
 ifeq ($(CONFIG_KERNEL_IPQ_MEM_PROFILE),512)
 EXTRA_CFLAGS+= -DNSS_MEM_PROFILE_MEDIUM
 endif
 ifeq ($(CONFIG_KERNEL_SKB_FIXED_SIZE_2K),y)
 EXTRA_CFLAGS+= -DNSS_SKB_FIXED_SIZE_2K
 endif
 DRV_MAKE_OPTS:=
 ifeq ($(CONFIG_KERNEL_IPQ_MEM_PROFILE),256)
 DRV_MAKE_OPTS+=NSS_DRV_C2C_ENABLE=n \
        NSS_DRV_CAPWAP_ENABLE=n \
        NSS_DRV_CLMAP_ENABLE=n \
        NSS_DRV_CRYPTO_ENABLE=n \
        NSS_DRV_DTLS_ENABLE=n \
        NSS_DRV_GRE_ENABLE=n \
        NSS_DRV_GRE_REDIR_ENABLE=n \
        NSS_DRV_GRE_TUNNEL_ENABLE=n \
        NSS_DRV_IGS_ENABLE=n \
        NSS_DRV_IPSEC_ENABLE=n \
        NSS_DRV_LAG_ENABLE=n \
        NSS_DRV_L2TP_ENABLE=n \
        NSS_DRV_MAPT_ENABLE=n \
        NSS_DRV_OAM_ENABLE=n \
        NSS_DRV_PPTP_ENABLE=n \
        NSS_DRV_PORTID_ENABLE=n \
        NSS_DRV_PVXLAN_ENABLE=n \
        NSS_DRV_QRFS_ENABLE=n \
        NSS_DRV_QVPN_ENABLE=n \
        NSS_DRV_RMNET_ENABLE=n \
        NSS_DRV_SHAPER_ENABLE=n \
        NSS_DRV_SJACK_ENABLE=n \
        NSS_DRV_TLS_ENABLE=n \
        NSS_DRV_TRUSTSEC_ENABLE=n \
        NSS_DRV_TSTAMP_ENABLE=n \
        NSS_DRV_TUN6RD_ENABLE=n \
        NSS_DRV_TUNIPIP6_ENABLE=n \
        NSS_DRV_VXLAN_ENABLE=n
 endif
 define Build/Configure
 	$(LN) arch/nss_$(subtarget).h $(PKG_BUILD_DIR)/exports/nss_arch.h
 endef
 define Build/Compile
 	$(MAKE)  $(PKG_JOBS) -C "$(LINUX_DIR)" $(strip $(DRV_MAKE_OPTS)) \
 		$(KERNEL_MAKE_FLAGS) \
 		$(PKG_MAKE_FLAGS) \
 		M="$(PKG_BUILD_DIR)" \
 		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" SoC="$(subtarget)" \
 		modules
 endef
 $(eval $(call KernelPackage,qca-nss-drv))
--- a/package/qca/nss/qca-nss-drv/files/nss-firmware/LICENSE.TXT
+++ b/package/qca/nss/qca-nss-drv/files/nss-firmware/LICENSE.TXT
@ -1,45 +0,0 @@
 Copyright (c) 2014 Qualcomm Atheros, Inc.
 All rights reserved.
 Redistribution and use in binary forms, without
 modification, are permitted (subject to the limitations in the
 disclaimer below) provided that the following conditions are met:
 *Redistributions must reproduce the above copyright
 notice, this list of conditions, and the following disclaimer in the
 documentation and/or other materials provided with the distribution.
 *Neither the name of Qualcomm Atheros, Inc. nor the names of its
 contributors may be used to endorse or promote products derived
 from this software without specific prior written permission.
 *No Reverse engineering, decompiling, decrypting, or disassembling of this
 software is permitted.
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. NO LICENSES OR OTHER RIGHTS,
 WHETHER EXPRESS, IMPLIED, BASED ON ESTOPPEL OR OTHERWISE, ARE GRANTED
 TO ANY PARTY'S PATENTS, PATENT APPLICATIONS, OR PATENTABLE INVENTIONS
 BY VIRTUE OF THIS LICENSE OR THE DELIVERY OR PROVISION BY QUALCOMM
 ATHEROS, INC. OF THE SOFTWARE.
 IN NO EVENT SHALL THE COPYRIGHT OWNER OR ANY CONTRIBUTOR BE LIABLE FOR
 ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 HOWEVER CAUSED AND REGARDLESS OF ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
 OTHERWISE) ARISING IN ANY WAY OUT OF OR RESULTING FROM THE USE OF THE
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN ANY
 EVENT, THE TOTAL AGGREGATE LIABILITY THAT MAY BE IMPOSED ON QUALCOMM
 ATHEROS, INC. FOR ANY DIRECT DAMAGES ARISING UNDER OR RESULTING FROM
 THIS AGREEMENT OR IN CONNECTION WITH ANY USE OF THE SOFTWARE SHALL NOT
 EXCEED A TOTAL AMOUNT OF US$5.00.
 IF ANY OF THE ABOVE PROVISIONS ARE HELD TO BE VOID, INVALID,
 UNENFORCEABLE, OR ILLEGAL, THE OTHER PROVISIONS SHALL CONTINUE IN FULL
 FORCE AND EFFECT.
--- a/package/qca/nss/qca-nss-drv/files/nss-firmware/NOTICE.TXT
+++ b/package/qca/nss/qca-nss-drv/files/nss-firmware/NOTICE.TXT
@ -1,217 +0,0 @@
 =============================================================================
 This Notice.txt file contains certain notices of software components included
 with the software that Qualcomm Atheros, Inc. ("Qualcomm Atheros") is required
 to provide you. Except where prohibited by the open source license, the content
 of this notices file is only provided to satisfy Qualcomm Atheros's attribution
 and notice requirement; your use of these software components together with the
 Qualcomm Atheros software (Qualcomm Atheros software hereinafter referred to as
 "Software") is subject to the terms of your license from Qualcomm Atheros.
 Compliance with all copyright laws and software license agreements included in
 the notice section of this file are the responsibility of the user.  Except as
 may be granted by separate express written agreement, this file provides no
 license to any Qualcomm Atheros patents, trademarks, copyrights, or other
 intellectual property.
 Copyright (c) 2014 Qualcomm Atheros, Inc.  All rights reserved.
 Qualcomm is a trademark of Qualcomm Incorporated, registered in the United
 States and other countries.  All Qualcomm Incorporated trademarks are used with
 permission.  Atheros is a trademark of Qualcomm Atheros, Inc., registered in the
 United States and other countries.  Other products and brand names may be
 trademarks or registered trademarks of their respective owners.
 NOTICES:
 =============================================================================
 /*
 * doprint.c
 *      Formatted string print support.
 *
 * Copyright <A9> 2001-2012 Qualcomm Atheros, Inc.  All Rights Reserved.
 *
 * Qualcomm Atheros Confidential and Proprietary.
 *
 * This code originates with BSD Unix however it has been extensively
 * modified.  The original copyright is reproduced below:
 *
 * Copyright (c) 1988 Regents of the University of California.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms are permitted provided
 * that: (1) source distributions retain this entire copyright notice and
 * comment, and (2) distributions including binaries display the following
 * acknowledgement:  ``This product includes software developed by the
 * University of California, Berkeley and its contributors'' in the
 * documentation or other materials provided with the distribution and in
 * all advertising materials mentioning features or use of this software.
 * Neither the name of the University nor the names of its contributors may
 * be used to endorse or promote products derived from this software without
 * specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 */
 /*
 * math.c
 *      Support for the standard C library.
 *
 * Copyright <A9> 2006-2012 Qualcomm Atheros, Inc.  All Rights Reserved.
 *
 * Qualcomm Atheros Confidential and Proprietary.
 *
 * Software contained within this file was originally released with the
 * following
 * copyright and license statement:
 *
 * ====================================================
 * Copyright (C) 1993 by Sun Microsystems, Inc. All rights reserved.
 *
 * Developed at SunPro, a Sun Microsystems, Inc. business.
 * Permission to use, copy, modify, and distribute this
 * software is freely granted, provided that this notice
 * is preserved.
 * ====================================================
 */
 /*
 * stdlib.c
 *      Routines from stdlib.h.
 *
 * Copyright <A9> 2004-2012 Qualcomm Atheros, Inc.  All Rights Reserved.
 *
 * Qualcomm Atheros Confidential and Proprietary.
 *
 * The code for strtol() and strtoul() are also subject to the following:
 *
 * Copyright (c) 1990, 1993
 *      The Regents of the University of California. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *      This product includes software developed by the University of
 *      California, Berkeley and its contributors.
 * 4. Neither the name of the University nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */
 drr_alg_utils.h:
 /****************************************************************************/
 /*-
 * Copyright (c) 1992, 1993
 *	The Regents of the University of California.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 4. Neither the name of the University nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */
 shaper_list_utils.h:
 /****************************************************************************/
 /*-
 * Copyright (c) 1992, 1993
 *	The Regents of the University of California.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 4. Neither the name of the University nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */
 codel_alg_inv_sqrt.h
 /****************************************************************************/
 /*-
 * Copyright (c) 1992, 1993
 *	The Regents of the University of California.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 4. Neither the name of the University nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */
--- a/package/qca/nss/qca-nss-drv/files/nss-firmware/README.md
+++ b/package/qca/nss/qca-nss-drv/files/nss-firmware/README.md
@ -1,10 +0,0 @@
 NSS FIRMWARE
 ============
 This repo contains firmware files to enable the NSS MAC on QCA IPQ806x SoC.
 This product includes software developed by the University of California,
 Berkeley and its contributors.
 NSS firmware extracted from Synology RT2600ac SRM 1.2 - Version: 1.2-7742-4
--- a/package/qca/nss/qca-nss-drv/files/nss-firmware/qca-nss0-retail.bin
+++ b/package/qca/nss/qca-nss-drv/files/nss-firmware/qca-nss0-retail.bin
--- a/package/qca/nss/qca-nss-drv/files/nss-firmware/qca-nss1-retail.bin
+++ b/package/qca/nss/qca-nss-drv/files/nss-firmware/qca-nss1-retail.bin
--- a/package/qca/nss/qca-nss-drv/files/qca-nss-drv.conf
+++ b/package/qca/nss/qca-nss-drv/files/qca-nss-drv.conf
@ -1,6 +0,0 @@
 config nss_firmware 'qca_nss_0'
 config nss_firmware 'qca_nss_1'
 config general
 	option enable_rps	'1'
--- a/package/qca/nss/qca-nss-drv/files/qca-nss-drv.debug
+++ b/package/qca/nss/qca-nss-drv/files/qca-nss-drv.debug
@ -1,26 +0,0 @@
 #!/bin/sh /sbin/sysdebug
 #
 # Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #
 log cat /sys/kernel/debug/qca-nss-drv/stats/pppoe
 log cat /sys/kernel/debug/qca-nss-drv/stats/n2h
 log cat /sys/kernel/debug/qca-nss-drv/stats/ipv6
 log cat /sys/kernel/debug/qca-nss-drv/stats/ipv4
 log cat /sys/kernel/debug/qca-nss-drv/stats/gmac
 log cat /sys/kernel/debug/qca-nss-drv/stats/drv
 log cat /sys/kernel/debug/qca-nss-drv/stats/wifi
 log cat /sys/kernel/debug/qca-nss-drv/stats/wifi_if
 log cat /sys/kernel/debug/qca-nss-drv/stats/eth_rx
--- a/package/qca/nss/qca-nss-drv/files/qca-nss-drv.hotplug
+++ b/package/qca/nss/qca-nss-drv/files/qca-nss-drv.hotplug
@ -1,70 +0,0 @@
 #!/bin/sh
 #
 # Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #
 KERNEL=`uname -r`
 case "${KERNEL}" in
 	3.4*)
 		select_or_load=load_nss_fw
 		;;
 	*)
 		select_or_load=select_nss_fw
 		;;
 esac
 load_nss_fw () {
 	ls -l $1 | awk ' { print $9,$5 } '> /dev/console
 	echo 1 > /sys/class/firmware/$DEVICENAME/loading
 	cat $1 > /sys/class/firmware/$DEVICENAME/data
 	echo 0 > /sys/class/firmware/$DEVICENAME/loading
 }
 select_nss_fw () {
 	rm -f /lib/firmware/$DEVICENAME
 	ln -s $1 /lib/firmware/$DEVICENAME
 	ls -l /lib/firmware/$DEVICENAME | awk ' { print $9,$5 } '> /dev/console
 }
 [ "$ACTION" != "add" ] && exit
 # dev name for UCI, since it doesn't let you use . or -
 SDEVNAME=$(echo ${DEVICENAME} | sed s/[.-]/_/g)
 SELECTED_FW=$(uci get nss.${SDEVNAME}.firmware 2>/dev/null)
 [ -e "${SELECTED_FW}" ] && {
 	$select_or_load ${SELECTED_FW}
 	exit
 }
 case $DEVICENAME in
        qca-nss0* | qca-nss.0*)
                if [ -e /lib/firmware/qca-nss0-enterprise.bin ] ; then
                        $select_or_load /lib/firmware/qca-nss0-enterprise.bin
                else
                        $select_or_load /lib/firmware/qca-nss0-retail.bin
                fi
                exit
                ;;
        qca-nss1* | qca-nss.1*)
                if [ -e /lib/firmware/qca-nss1-enterprise.bin ] ; then
                        $select_or_load /lib/firmware/qca-nss1-enterprise.bin
                else
                        $select_or_load /lib/firmware/qca-nss1-retail.bin
                fi
                exit
                ;;
 esac
--- a/package/qca/nss/qca-nss-drv/files/qca-nss-drv.init
+++ b/package/qca/nss/qca-nss-drv/files/qca-nss-drv.init
@ -1,50 +0,0 @@
 #!/bin/sh /etc/rc.common
 #
 # Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #
 START=70
 enable_rps() {
 	irq_nss_rps=`grep nss_queue1 /proc/interrupts | cut -d ':' -f 1 | tr -d ' '`
 	for entry in $irq_nss_rps
 	do
 		echo 2 > /proc/irq/$entry/smp_affinity
 	done
 	irq_nss_rps=`grep nss_queue2 /proc/interrupts | cut -d ':' -f 1 | tr -d ' '`
 	for entry in $irq_nss_rps
 	do
 		echo 4 > /proc/irq/$entry/smp_affinity
 	done
 	irq_nss_rps=`grep nss_queue3 /proc/interrupts | cut -d ':' -f 1 | tr -d ' '`
 	for entry in $irq_nss_rps
 	do
 		echo 8 > /proc/irq/$entry/smp_affinity
 	done
 	# Enable NSS RPS
 	sysctl -w dev.nss.rps.enable=1 >/dev/null 2>/dev/null
 }
 start() {
 	local rps_enabled="$(uci_get nss @general[0] enable_rps)"
 	if [ "$rps_enabled" -eq 1 ]; then
 		enable_rps
 	fi
 }
--- a/package/qca/nss/qca-nss-drv/files/qca-nss-drv.sysctl
+++ b/package/qca/nss/qca-nss-drv/files/qca-nss-drv.sysctl
@ -1,4 +0,0 @@
 # Default Number of connection configuration
 dev.nss.ipv4cfg.ipv4_conn=4096
 dev.nss.ipv6cfg.ipv6_conn=4096
--- a/package/qca/nss/qca-nss-drv/patches/100-kernel-5.4-support.patch
+++ b/package/qca/nss/qca-nss-drv/patches/100-kernel-5.4-support.patch
@ -1,107 +0,0 @@
 diff --git a/Makefile b/Makefile
 index d998548..b1a4a83 100644
 --- a/Makefile
 +++ b/Makefile
@@ -161,7 +161,7 @@ endif
 ccflags-y += -I$(obj)/nss_hal/include -I$(obj)/nss_data_plane/include -I$(obj)/exports -DNSS_DEBUG_LEVEL=0 -DNSS_PKT_STATS_ENABLED=1
 ccflags-y += -DNSS_PM_DEBUG_LEVEL=0 -DNSS_SKB_REUSE_SUPPORT=1
 -ccflags-y += -Werror
 +# ccflags-y += -Werror
 ifneq ($(findstring 3.4, $(KERNELVERSION)),)
 NSS_CCFLAGS = -DNSS_DT_SUPPORT=0 -DNSS_FW_DBG_SUPPORT=1 -DNSS_PM_SUPPORT=1 -DNSS_EMPTY_BUFFER_SIZE=1984
 diff --git a/nss_core.c b/nss_core.c
 index 6c9716a..8956eb5 100644
 --- a/nss_core.c
 +++ b/nss_core.c
@@ -26,6 +26,7 @@
 #include <nss_hal.h>
 #include <net/dst.h>
 #include <linux/etherdevice.h>
 +#include <linux/kmemleak.h>
 #include "nss_tx_rx_common.h"
 #include "nss_data_plane.h"
@@ -45,7 +46,8 @@
 (((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(3, 15, 0)))) || \
 (((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(3, 11, 0)))) || \
 (((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(3, 19, 0)))) || \
 -(((LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(4, 5, 0))))))
 +(((LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(4, 5, 0)))) || \
 +(((LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(5, 5, 0))))))
 #error "Check skb recycle code in this file to match Linux version"
 #endif
@@ -395,7 +397,11 @@ static void nss_get_ddr_info(struct nss_mmu_ddr_info *mmu, char *name)
 	struct device_node *node;
 	si_meminfo(&vals);
 +#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 0))
 +	cached = global_zone_page_state(NR_FILE_PAGES);
 +#else
 	cached = global_page_state(NR_FILE_PAGES);
 +#endif /*KERNEL_VERSION(4, 14, 0)*/
 	avail_ddr = (vals.totalram + cached + vals.sharedram) * vals.mem_unit;
 	/*
@@ -679,7 +685,11 @@ static inline void nss_core_handle_virt_if_pkt(struct nss_ctx_instance *nss_ctx,
 	 * Mimic Linux behavior to allow multi-queue netdev choose which queue to use
 	 */
 	if (ndev->netdev_ops->ndo_select_queue) {
 +#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
 +		queue_offset = ndev->netdev_ops->ndo_select_queue(ndev, nbuf, NULL);
 +#else
 		queue_offset = ndev->netdev_ops->ndo_select_queue(ndev, nbuf, NULL, NULL);
 +#endif /*KERNEL_VERSION(5, 3, 0)*/
 	}
 	skb_set_queue_mapping(nbuf, queue_offset);
@@ -2269,7 +2279,11 @@ static inline bool nss_skb_can_reuse(struct nss_ctx_instance *nss_ctx,
 	 * This check is added to avoid deadlock from nf_conntrack
 	 * when ecm is trying to flush a rule.
 	 */
 +#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0))
 +	if (unlikely(skb_nfct(nbuf))) {
 +#else
 	if (unlikely(nbuf->nfct)) {
 +#endif /*KERNEL_VERSION(4, 11, 0)*/
 		return false;
 	}
 #endif
@@ -2279,7 +2285,11 @@ static inline bool nss_skb_can_reuse(struct nss_ctx_instance *nss_ctx,
 	 * This check is added to avoid deadlock from nf_bridge
 	 * when ecm is trying to flush a rule.
 	 */
 +#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0))
 +	if (unlikely(skb_ext_exist(nbuf, SKB_EXT_BRIDGE_NF))) {
 +#else
 	if (unlikely(nbuf->nf_bridge)) {
 +#endif /*KERNEL_VERSION(4, 11, 0)*/
 		return false;
 	}
 #endif
 diff --git a/nss_n2h.c b/nss_n2h.c
 index 781ce2b..695ac13 100644
 --- a/nss_n2h.c
 +++ b/nss_n2h.c
@@ -19,6 +19,7 @@
  *	NSS N2H node APIs
  */
 +#include <linux/kmemleak.h>
 #include "nss_tx_rx_common.h"
 #include "nss_n2h_stats.h"
 --- a/nss_data_plane/nss_data_plane_gmac.c
 +++ b/nss_data_plane/nss_data_plane_gmac.c
@@ -20,7 +20,7 @@
 #include "nss_tx_rx_common.h"
 #include <nss_gmac_api_if.h>
 -#define NSS_DP_GMAC_SUPPORTED_FEATURES (NETIF_F_HIGHDMA | NETIF_F_HW_CSUM | NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_FRAGLIST | (NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_UFO))
 +#define NSS_DP_GMAC_SUPPORTED_FEATURES (NETIF_F_HIGHDMA | NETIF_F_HW_CSUM | NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_FRAGLIST | (NETIF_F_TSO | NETIF_F_TSO6))
 #define NSS_DATA_PLANE_GMAC_MAX_INTERFACES 4
 static DEFINE_SPINLOCK(nss_data_plane_gmac_stats_lock);
--- a/package/qca/nss/qca-nss-drv/patches/101-nss-drv-Control-fab-scaling-from-package-Makefile.patch
+++ b/package/qca/nss/qca-nss-drv/patches/101-nss-drv-Control-fab-scaling-from-package-Makefile.patch
@ -1,38 +0,0 @@
 From 40d4b080f17883ac6b39c74a5feb1af384ab6a51 Mon Sep 17 00:00:00 2001
 From: Robert Marko <robert.marko@sartura.hr>
 Date: Thu, 11 Jun 2020 16:57:39 +0200
 Subject: [PATCH] nss-drv: Control fab scaling from package Makefile
 Lets control the fab scaling from the package Makefile
 instead of using kernel checks that dont work.
 Fab scaling in OpenWrt is done in a external way.
 Signed-off-by: Robert Marko <robert.marko@sartura.hr>
 ---
 Makefile | 9 ---------
 1 file changed, 9 deletions(-)
 diff --git a/Makefile b/Makefile
 index 20729ab..2567dd4 100644
 --- a/Makefile
 +++ b/Makefile
@@ -405,15 +405,8 @@ NSS_CCFLAGS = -DNSS_DT_SUPPORT=1 -DNSS_FW_DBG_SUPPORT=0 -DNSS_PM_SUPPORT=0
 ccflags-y += -I$(obj)
 endif
 -# Fabric scaling is supported in 3.14 and 4.4 only
 -ifneq ($(findstring 3.14, $(KERNELVERSION)),)
 -NSS_CCFLAGS += -DNSS_FABRIC_SCALING_SUPPORT=1
 -else ifneq ($(findstring 4.4, $(KERNELVERSION)),)
 -NSS_CCFLAGS += -DNSS_FABRIC_SCALING_SUPPORT=1
 -else
 -NSS_CCFLAGS += -DNSS_FABRIC_SCALING_SUPPORT=0
 -endif
 +NSS_CCFLAGS += -DNSS_FABRIC_SCALING_SUPPORT=0
 # Disable Frequency scaling
 ifeq "$(NSS_FREQ_SCALE_DISABLE)" "y"
 ccflags-y += -DNSS_FREQ_SCALE_SUPPORT=0
 -- 
 2.26.2
--- a/package/qca/nss/qca-nss-drv/patches/200-fix-NULL-pointer-exception.patch
+++ b/package/qca/nss/qca-nss-drv/patches/200-fix-NULL-pointer-exception.patch
@ -1,11 +0,0 @@
 --- a/nss_core.c
 +++ b/nss_core.c
@@ -1599,7 +1599,7 @@ static int32_t nss_core_handle_cause_que
 		 *
 		 */
 		if (unlikely((buffer_type == N2H_BUFFER_CRYPTO_RESP))) {
 -			dma_unmap_single(NULL, (desc->buffer + desc->payload_offs), desc->payload_len, DMA_FROM_DEVICE);
 +			dma_unmap_single(nss_ctx->dev, (desc->buffer + desc->payload_offs), desc->payload_len, DMA_FROM_DEVICE);
 			goto consume;
 		}
--- a/package/qca/nss/qca-nss-drv/patches/201-Fix-Kernel-Panic-dma-with-NULL-dev.patch
+++ b/package/qca/nss/qca-nss-drv/patches/201-Fix-Kernel-Panic-dma-with-NULL-dev.patch
@ -1,82 +0,0 @@
 From 89949decfd9a0f86427b502aae4fbc3a3ef399f0 Mon Sep 17 00:00:00 2001
 From: Ansuel Smith <ansuelsmth@gmail.com>
 Date: Tue, 23 Jun 2020 19:50:28 +0200
 Subject: [PATCH] Fix Kernel Panic dma with NULL dev
 ---
 nss_coredump.c | 4 ++--
 nss_log.c      | 8 +++++---
 2 files changed, 8 insertions(+), 6 deletions(-)
 diff --git a/nss_coredump.c b/nss_coredump.c
 index aa4ba82..957eca0 100644
 --- a/nss_coredump.c
 +++ b/nss_coredump.c
@@ -154,7 +154,7 @@ void nss_fw_coredump_notify(struct nss_ctx_instance *nss_own,
 		dma_addr = nss_own->meminfo_ctx.logbuffer_dma;
 	}
 -	dma_sync_single_for_cpu(NULL, dma_addr, sizeof(struct nss_log_descriptor), DMA_FROM_DEVICE);
 +	dma_sync_single_for_cpu(nss_own->dev, dma_addr, sizeof(struct nss_log_descriptor), DMA_FROM_DEVICE);
 	/*
 	 * If the current entry is smaller than or equal to the number of NSS_LOG_COREDUMP_LINE_NUM,
@@ -181,7 +181,7 @@ void nss_fw_coredump_notify(struct nss_ctx_instance *nss_own,
 		offset = (index * sizeof(struct nss_log_entry))
 			+ offsetof(struct nss_log_descriptor, log_ring_buffer);
 -		dma_sync_single_for_cpu(NULL, dma_addr + offset,
 +		dma_sync_single_for_cpu(nss_own->dev, dma_addr + offset,
 				sizeof(struct nss_log_entry), DMA_FROM_DEVICE);
 		nss_info_always("%p: %s\n", nss_own, nle_print->message);
 		nle_print++;
 diff --git a/nss_log.c b/nss_log.c
 index 06ebba4..f9bd6c8 100644
 --- a/nss_log.c
 +++ b/nss_log.c
@@ -44,6 +44,7 @@ struct nss_log_data {
 	uint32_t last_entry;	/* Last known sampled entry (or index) */
 	uint32_t nentries;	/* Caches the total number of entries of log buffer */
 	int nss_id;		/* NSS Core id being used */
 +	struct device *nss_dev;
 };
 struct nss_log_ring_buffer_addr nss_rbe[NSS_MAX_CORES];
@@ -125,6 +126,7 @@ static int nss_log_open(struct inode *inode, struct file *filp)
 	data->last_entry = 0;
 	data->nentries = nss_rbe[nss_id].nentries;
 	data->dma_addr = nss_rbe[nss_id].dma_addr;
 +	data->nss_dev = nss_ctx->dev;
 	/*
 	 * Increment the reference count so that we don't free
@@ -207,7 +209,7 @@ static ssize_t nss_log_read(struct file *filp, char __user *buf, size_t size, lo
 	/*
 	 * Get the current index
 	 */
 -	dma_sync_single_for_cpu(NULL, data->dma_addr, sizeof(struct nss_log_descriptor), DMA_FROM_DEVICE);
 +	dma_sync_single_for_cpu(data->nss_dev, data->dma_addr, sizeof(struct nss_log_descriptor), DMA_FROM_DEVICE);
 	entry = nss_log_current_entry(desc);
 	/*
@@ -251,7 +253,7 @@ static ssize_t nss_log_read(struct file *filp, char __user *buf, size_t size, lo
 		offset = (offset * sizeof(struct nss_log_entry))
 			 + offsetof(struct nss_log_descriptor, log_ring_buffer);
 -		dma_sync_single_for_cpu(NULL, data->dma_addr + offset,
 +		dma_sync_single_for_cpu(data->nss_dev, data->dma_addr + offset,
 			sizeof(struct nss_log_entry), DMA_FROM_DEVICE);
 		rb = &desc->log_ring_buffer[index];
@@ -510,7 +512,7 @@ bool nss_debug_log_buffer_alloc(uint8_t nss_id, uint32_t nentry)
 	return true;
 fail:
 -	dma_unmap_single(NULL, dma_addr, size, DMA_FROM_DEVICE);
 +	dma_unmap_single(nss_ctx->dev, dma_addr, size, DMA_FROM_DEVICE);
 	kfree(addr);
 	wake_up(&nss_log_wq);
 	return false;
 -- 
 2.27.0
--- a/package/qca/nss/qca-nss-drv/patches/400-Exported-set-nexthop-function.patch
+++ b/package/qca/nss/qca-nss-drv/patches/400-Exported-set-nexthop-function.patch
@ -1,47 +0,0 @@
 From f8cf061454a3707c0c84d0fca685e84455f91362 Mon Sep 17 00:00:00 2001
 From: Suruchi Suman <surusuma@codeaurora.org>
 Date: Tue, 3 Dec 2019 12:57:38 +0530
 Subject: [qca-nss-drv] Exported set nexhop function from drv.
 Change-Id: I3df6658bef72fe574ac9acfb7aac61785769766f
 Signed-off-by: Suruchi Suman <surusuma@codeaurora.org>
 ---
 nss_phys_if.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)
 diff --git a/nss_phys_if.c b/nss_phys_if.c
 index 4f9b20f..0c58d95 100644
 --- a/nss_phys_if.c
 +++ b/nss_phys_if.c
@@ -1,6 +1,6 @@
 /*
  **************************************************************************
 - * Copyright (c) 2014-2019, The Linux Foundation. All rights reserved.
 + * Copyright (c) 2014-2020, The Linux Foundation. All rights reserved.
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
  * above copyright notice and this permission notice appear in all copies.
@@ -583,6 +583,12 @@ nss_tx_status_t nss_phys_if_set_nexthop(struct nss_ctx_instance *nss_ctx, uint32
 	struct nss_phys_if_msg nim;
 	NSS_VERIFY_CTX_MAGIC(nss_ctx);
 +
 +	if (nexthop >= NSS_MAX_NET_INTERFACES) {
 +		nss_warning("%p: Invalid nexthop interface number: %d", nss_ctx, nexthop);
 +		return NSS_TX_FAILURE_BAD_PARAM;
 +	}
 +
 	nss_info("%p: Phys If nexthop will be set to %d, id:%d\n", nss_ctx, nexthop, if_num);
 	nss_cmn_msg_init(&nim.cm, if_num, NSS_PHYS_IF_SET_NEXTHOP,
@@ -591,6 +597,7 @@ nss_tx_status_t nss_phys_if_set_nexthop(struct nss_ctx_instance *nss_ctx, uint32
 	return nss_phys_if_msg_sync(nss_ctx, &nim);
 }
 +EXPORT_SYMBOL(nss_phys_if_set_nexthop);
 /*
  * nss_get_state()
 -- 
 cgit v1.1
--- a/package/qca/nss/qca-nss-ecm-64/Makefile
+++ b/package/qca/nss/qca-nss-ecm-64/Makefile
@ -1,96 +0,0 @@
 include $(TOPDIR)/rules.mk
 PKG_NAME:=qca-nss-ecm-64
 PKG_RELEASE:=$(AUTORELEASE)
 PKG_SOURCE_URL:=https://git.codelinaro.org/clo/qsdk/oss/lklm/qca-nss-ecm.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_DATE:=2021-04-29
 PKG_SOURCE_VERSION:=c115aec34867b582e2e5ea79fc5315971e0e953c
 PKG_MIRROR_HASH:=962385b45daa2e552a15018bf2930c2df1f6f575d885375bf935a142b4255da5
 PKG_BUILD_PARALLEL:=1
 include $(INCLUDE_DIR)/kernel.mk
 include $(INCLUDE_DIR)/package.mk
 define KernelPackage/qca-nss-ecm-64
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Support
  DEPENDS:=@(TARGET_ipq807x||TARGET_ipq60xx) \
 	+kmod-qca-nss-drv-64 \
 	+iptables-mod-extra \
 	+kmod-ipt-conntrack \
 	+kmod-ipt-physdev \
 	+iptables-mod-physdev \
 	+kmod-ppp \
 	+kmod-pppoe
  TITLE:=QCA NSS Enhanced Connection Manager (ECM)
  FILES:=$(PKG_BUILD_DIR)/*.ko
  KCONFIG:=CONFIG_BRIDGE_NETFILTER=y \
 	CONFIG_NF_CONNTRACK_EVENTS=y \
 	CONFIG_NF_CONNTRACK_CHAIN_EVENTS=y \
 	CONFIG_NF_CONNTRACK_DSCPREMARK_EXT=n
 endef
 define KernelPackage/qca-nss-ecm-64/Description
 This package contains the QCA NSS Enhanced Connection Manager
 endef
 define KernelPackage/qca-nss-ecm-64/install
 	$(INSTALL_DIR) $(1)/etc/firewall.d $(1)/etc/init.d $(1)/usr/bin $(1)/lib/netifd/offload $(1)/etc/config $(1)/etc/uci-defaults $(1)/etc/sysctl.d
 	$(INSTALL_DATA) ./files/qca-nss-ecm.firewall $(1)/etc/firewall.d/qca-nss-ecm
 	$(INSTALL_BIN) ./files/qca-nss-ecm.init $(1)/etc/init.d/qca-nss-ecm
 	$(INSTALL_BIN) ./files/ecm_dump.sh $(1)/usr/bin/
 	$(INSTALL_BIN) ./files/on-demand-down $(1)/lib/netifd/offload/on-demand-down
 	$(INSTALL_DATA) ./files/qca-nss-ecm.uci $(1)/etc/config/ecm
 	$(INSTALL_DATA) ./files/qca-nss-ecm.defaults $(1)/etc/uci-defaults/99-qca-nss-ecm
 	$(INSTALL_BIN) ./files/qca-nss-ecm.sysctl $(1)/etc/sysctl.d/qca-nss-ecm.conf
 endef
 EXTRA_CFLAGS+=-I$(STAGING_DIR)/usr/include/qca-nss-drv
 ifneq (, $(findstring $(CONFIG_TARGET_BOARD), "ipq807x" "ipq60xx"))
 ECM_MAKE_OPTS+= ECM_FRONT_END_NSS_ENABLE=y \
 		ECM_CLASSIFIER_HYFI_ENABLE=n \
 		ECM_MULTICAST_ENABLE=n \
 		ECM_INTERFACE_IPSEC_ENABLE=n \
 		ECM_INTERFACE_PPTP_ENABLE=n \
 		ECM_INTERFACE_L2TPV2_ENABLE=n \
 		ECM_INTERFACE_GRE_TAP_ENABLE=n \
 		ECM_INTERFACE_GRE_TUN_ENABLE=n \
 		ECM_INTERFACE_SIT_ENABLE=n \
 		ECM_INTERFACE_TUNIPIP6_ENABLE=n \
 		ECM_INTERFACE_RAWIP_ENABLE=n \
 		ECM_INTERFACE_VLAN_ENABLE=n \
 		ECM_CLASSIFIER_MARK_ENABLE=n \
 		ECM_CLASSIFIER_DSCP_ENABLE=n \
 		ECM_CLASSIFIER_PCC_ENABLE=n \
 		ECM_BAND_STEERING_ENABLE=n \
 		ECM_INTERFACE_PPPOE_ENABLE=y
 endif
 ifeq ($(CONFIG_TARGET_BOARD), "ipq807x")
    SOC="ipq807x_64"
 else ifeq ($(CONFIG_TARGET_BOARD), "ipq60xx")
    SOC="ipq60xx_64"
 endif
 define Build/InstallDev
 	mkdir -p $(1)/usr/include/qca-nss-ecm
 	$(CP) $(PKG_BUILD_DIR)/exports/* $(1)/usr/include/qca-nss-ecm
 endef
 define Build/Compile
 	+$(MAKE) -C "$(LINUX_DIR)" $(strip $(ECM_MAKE_OPTS)) \
 		CROSS_COMPILE="$(TARGET_CROSS)" \
 		ARCH="$(LINUX_KARCH)" \
 		M="$(PKG_BUILD_DIR)" \
 		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" SoC=$(SOC) \
 		$(KERNEL_MAKE_FLAGS) \
 		$(PKG_JOBS) \
 		modules
 endef
 $(eval $(call KernelPackage,qca-nss-ecm-64))
--- a/package/qca/nss/qca-nss-ecm-64/files/ecm_dump.sh
+++ b/package/qca/nss/qca-nss-ecm-64/files/ecm_dump.sh
@ -1,95 +0,0 @@
 #!/bin/sh
 #
 # Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #
 ECM_MODULE=${1:-ecm_state}
 MOUNT_ROOT=/dev/ecm
 #
 # usage: ecm_dump.sh [module=ecm_db]
 #
 # with no parameters, ecm_dump.sh will attempt to mount the
 # ecm_db state file and cat its contents.
 #
 # example with a parameter: ecm_dump.sh ecm_classifier_default
 #
 # this will cause ecm_dump to attempt to find and mount the state
 # file for the ecm_classifier_default module, and if successful
 # cat the contents.
 #
 # this is one of the state files, which happens to be the
 # last module started in ecm
 ECM_STATE=/sys/kernel/debug/ecm/ecm_state/state_dev_major
 # tests to see if ECM is up and ready to receive commands.
 # returns 0 if ECM is fully up and ready, else 1
 ecm_is_ready() {
 	if [ ! -e "${ECM_STATE}" ]
 	then
 		return 1
 	fi
 	return 0
 }
 #
 # module_state_mount(module_name)
 #      Mounts the state file of the module, if supported
 #
 module_state_mount() {
 	local module_name=$1
 	local mount_dir=$2
 	local state_file="/sys/kernel/debug/ecm/${module_name}/state_dev_major"
 	if [ -e "${mount_dir}/${module_name}" ]
 	then
 		# already mounted
 		return 0
 	fi
 	#echo "Mount state file for $module_name ..."
 	if [ ! -e "$state_file" ]
 	then
 		#echo "... $module_name does not support state"
 		return 1
 	fi
 	local major="`cat $state_file`"
 	#echo "... Mounting state $state_file with major: $major"
 	mknod "${mount_dir}/${module_name}" c $major 0
 }
 #
 # main
 #
 ecm_is_ready || {
 	#echo "ECM is not running"
 	exit 1
 }
 # all state files are mounted under MOUNT_ROOT, so make sure it exists
 mkdir -p ${MOUNT_ROOT}
 #
 # attempt to mount state files for the requested module and cat it
 # if the mount succeeded
 #
 module_state_mount ${ECM_MODULE} ${MOUNT_ROOT} && {
 	cat ${MOUNT_ROOT}/${ECM_MODULE}
 	exit 0
 }
 exit 2
--- a/package/qca/nss/qca-nss-ecm-64/files/on-demand-down
+++ b/package/qca/nss/qca-nss-ecm-64/files/on-demand-down
@ -1,6 +0,0 @@
 #!/bin/sh
 # Copyright (c) 2016 The Linux Foundation. All rights reserved.
 [ -e "/sys/kernel/debug/ecm/ecm_db/defunct_all" ] && {
 	echo 1 > /sys/kernel/debug/ecm/ecm_db/defunct_all
 }
--- a/package/qca/nss/qca-nss-ecm-64/files/qca-nss-ecm.defaults
+++ b/package/qca/nss/qca-nss-ecm-64/files/qca-nss-ecm.defaults
@ -1,28 +0,0 @@
 #!/bin/sh
 #
 # Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #
 uci -q batch << EOF
 	delete firewall.qcanssecm
 	set firewall.qcanssecm=include
 	set firewall.qcanssecm.type=script
 	set firewall.qcanssecm.path=/etc/firewall.d/qca-nss-ecm
 	set firewall.qcanssecm.family=any
 	set firewall.qcanssecm.reload=1
 	commit firewall
 EOF
 exit 0
--- a/package/qca/nss/qca-nss-ecm-64/files/qca-nss-ecm.firewall
+++ b/package/qca/nss/qca-nss-ecm-64/files/qca-nss-ecm.firewall
@ -1,18 +0,0 @@
 #!/bin/sh
 #
 # Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #
 iptables -A FORWARD -m physdev --physdev-is-bridged -j ACCEPT
--- a/package/qca/nss/qca-nss-ecm-64/files/qca-nss-ecm.init
+++ b/package/qca/nss/qca-nss-ecm-64/files/qca-nss-ecm.init
@ -1,137 +0,0 @@
 #!/bin/sh  /etc/rc.common
 #
 # Copyright (c) 2014, 2019-2020 The Linux Foundation. All rights reserved.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 # The shebang above has an extra space intentially to avoid having
 # openwrt build scripts automatically enable this package starting
 # at boot.
 START=19
 get_front_end_mode() {
 	config_load "ecm"
 	config_get front_end global acceleration_engine "auto"
 	case $front_end in
 	auto)
 		echo '0'
 		;;
 	nss)
 		echo '1'
 		;;
 	sfe)
 		echo '2'
 		;;
 	*)
 		echo 'uci_option_acceleration_engine is invalid'
 	esac
 }
 support_bridge() {
 	#NSS support bridge acceleration
 	[ -d /sys/kernel/debug/ecm/ecm_nss_ipv4 ] && return 0
 	#SFE doesn't support bridge acceleration
 	[ -d /sys/kernel/debug/ecm/ecm_sfe_ipv4 ] && return 1
 }
 load_sfe() {
 	local kernel_version=$(uname -r)
 	[ -e "/lib/modules/$kernel_version/shortcut-fe.ko" ] && {
 		[ -d /sys/module/shortcut_fe ] || insmod shortcut-fe
 	}
 	[ -e "/lib/modules/$kernel_version/shortcut-fe-ipv6.ko" ] && {
 		[ -d /sys/module/shortcut_fe_ipv6 ] || insmod shortcut-fe-ipv6
 	}
 	[ -e "/lib/modules/$kernel_version/shortcut-fe-cm.ko" ] && {
 		[ -d /sys/module/shortcut_fe_cm ] || insmod shortcut-fe-cm
 	}
 	[ -e "/lib/modules/$kernel_version/shortcut-fe-drv.ko" ] && {
 		[ -d /sys/module/shortcut_fe_drv ] || insmod shortcut-fe-drv
 	}
 }
 load_ecm() {
 	[ -d /sys/module/ecm ] || {
 		[ ! -e /proc/device-tree/MP_256 ] && load_sfe
 		insmod ecm front_end_selection=$(get_front_end_mode)
 	}
 	support_bridge && {
 		sysctl -w net.bridge.bridge-nf-call-ip6tables=1
 		sysctl -w net.bridge.bridge-nf-call-iptables=1
 	}
 }
 unload_ecm() {
 	sysctl -w net.bridge.bridge-nf-call-ip6tables=0
 	sysctl -w net.bridge.bridge-nf-call-iptables=0
 	if [ -d /sys/module/ecm ]; then
 		#
 		# Stop ECM frontends
 		#
 		echo 1 > /sys/kernel/debug/ecm/front_end_ipv4_stop
 		echo 1 > /sys/kernel/debug/ecm/front_end_ipv6_stop
 		#
 		# Defunct the connections
 		#
 	        echo 1 > /sys/kernel/debug/ecm/ecm_db/defunct_all
 		sleep 5;
 		rmmod ecm
 		sleep 1
 	fi
 }
 start() {
 	load_ecm
 	# If the acceleration engine is NSS, enable wifi redirect.
 	[ -d /sys/kernel/debug/ecm/ecm_nss_ipv4 ] && sysctl -w dev.nss.general.redirect=1
 	support_bridge && {
 		echo 'net.bridge.bridge-nf-call-ip6tables=1' >> /etc/sysctl.d/qca-nss-ecm.conf
 		echo 'net.bridge.bridge-nf-call-iptables=1' >> /etc/sysctl.d/qca-nss-ecm.conf
 	}
 	if [ -d /sys/module/qca_ovsmgr ]; then
 		insmod ecm_ovs
 	fi
 }
 stop() {
 	# If ECM is already not loaded, just return.
 	if [ ! -d /sys/module/ecm ]; then
 		return
 	fi
 	# If the acceleration engine is NSS, disable wifi redirect.
 	[ -d /sys/kernel/debug/ecm/ecm_nss_ipv4 ] && sysctl -w dev.nss.general.redirect=0
 	sed '/net.bridge.bridge-nf-call-ip6tables=1/d' -i /etc/sysctl.d/qca-nss-ecm.conf
 	sed '/net.bridge.bridge-nf-call-iptables=1/d' -i /etc/sysctl.d/qca-nss-ecm.conf
 	if [ -d /sys/module/ecm_ovs ]; then
 		rmmod ecm_ovs
 	fi
 	unload_ecm
 }
--- a/package/qca/nss/qca-nss-ecm-64/files/qca-nss-ecm.sysctl
+++ b/package/qca/nss/qca-nss-ecm-64/files/qca-nss-ecm.sysctl
@ -1,2 +0,0 @@
 # nf_conntrack_tcp_no_window_check is 0 by default, set it to 1
 net.netfilter.nf_conntrack_tcp_no_window_check=1
--- a/package/qca/nss/qca-nss-ecm-64/files/qca-nss-ecm.uci
+++ b/package/qca/nss/qca-nss-ecm-64/files/qca-nss-ecm.uci
@ -1,2 +0,0 @@
 config ecm 'global'
 	option acceleration_engine 'auto'
--- a/package/qca/nss/qca-nss-ecm-64/patches/001-treewide-componentize-the-module-even-more.patch
+++ b/package/qca/nss/qca-nss-ecm-64/patches/001-treewide-componentize-the-module-even-more.patch
@ -1,335 +0,0 @@
 From 73345c87b28a473b35b57e673f8de963c3d73da1 Mon Sep 17 00:00:00 2001
 From: Ansuel Smith <ansuelsmth@gmail.com>
 Date: Wed, 19 May 2021 02:38:53 +0200
 Subject: [PATCH] treewide: componentize the module even more
 Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
 ---
 Makefile                         | 56 +++++++++++++++++++++++++-------
 ecm_db/ecm_db_connection.c       |  8 +++++
 ecm_db/ecm_db_node.c             |  4 +++
 ecm_interface.c                  |  8 +++++
 frontends/ecm_front_end_common.c |  7 ++++
 5 files changed, 72 insertions(+), 11 deletions(-)
 --- a/Makefile
 +++ b/Makefile
@@ -82,10 +82,18 @@ ccflags-$(ECM_INTERFACE_BOND_ENABLE) +=
 # Define ECM_INTERFACE_PPPOE_ENABLE=y in order
 # to enable support for PPPoE acceleration.
 # #############################################################################
 -ECM_INTERFACE_PPPOE_ENABLE=y
 +ifndef $(ECM_INTERFACE_PPPOE_ENABLE)
 +	ECM_INTERFACE_PPPOE_ENABLE=y
 +endif
 ccflags-$(ECM_INTERFACE_PPPOE_ENABLE) += -DECM_INTERFACE_PPPOE_ENABLE
 # #############################################################################
 +# Define ECM_INTERFACE_L2TPV2_PPTP_ENABLE=y in order
 +# to enable support for l2tpv2 or PPTP detection.
 +# #############################################################################
 +ccflags-$(ECM_INTERFACE_L2TPV2_PPTP_ENABLE) += -DECM_INTERFACE_L2TPV2_PPTP_ENABLE
 +
 +# #############################################################################
 # Define ECM_INTERFACE_L2TPV2_ENABLE=y in order
 # to enable support for l2tpv2 acceleration.
 # #############################################################################
@@ -118,6 +126,12 @@ ccflags-$(ECM_INTERFACE_PPP_ENABLE) += -
 ccflags-$(ECM_INTERFACE_MAP_T_ENABLE) += -DECM_INTERFACE_MAP_T_ENABLE
 # #############################################################################
 +# Define ECM_INTERFACE_GRE_ENABLE=y in order
 +# to enable support for GRE detection.
 +# #############################################################################
 +ccflags-$(ECM_INTERFACE_GRE_ENABLE) += -DECM_INTERFACE_GRE_ENABLE
 +
 +# #############################################################################
 # Define ECM_INTERFACE_GRE_TAP_ENABLE=y in order
 # to enable support for GRE TAP interface.
 # #############################################################################
@@ -186,7 +200,9 @@ ccflags-$(ECM_INTERFACE_OVS_BRIDGE_ENABL
 # #############################################################################
 # Define ECM_INTERFACE_VLAN_ENABLE=y in order to enable support for VLAN
 # #############################################################################
 -ECM_INTERFACE_VLAN_ENABLE=y
 +ifndef $(ECM_INTERFACE_VLAN_ENABLE)
 +	ECM_INTERFACE_VLAN_ENABLE=y
 +endif
 ccflags-$(ECM_INTERFACE_VLAN_ENABLE) += -DECM_INTERFACE_VLAN_ENABLE
 # #############################################################################
@@ -228,7 +244,9 @@ ccflags-$(ECM_CLASSIFIER_OVS_ENABLE) +=
 # #############################################################################
 # Define ECM_CLASSIFIER_MARK_ENABLE=y in order to enable mark classifier.
 # #############################################################################
 -ECM_CLASSIFIER_MARK_ENABLE=y
 +ifndef $(ECM_CLASSIFIER_MARK_ENABLE)
 +	ECM_CLASSIFIER_MARK_ENABLE=y
 +endif
 ecm-$(ECM_CLASSIFIER_MARK_ENABLE) += ecm_classifier_mark.o
 ccflags-$(ECM_CLASSIFIER_MARK_ENABLE) += -DECM_CLASSIFIER_MARK_ENABLE
@@ -247,7 +265,9 @@ ccflags-$(ECM_CLASSIFIER_NL_ENABLE) += -
 # #############################################################################
 # Define ECM_CLASSIFIER_DSCP_ENABLE=y in order to enable DSCP classifier.
 # #############################################################################
 -ECM_CLASSIFIER_DSCP_ENABLE=y
 +ifndef $(ECM_CLASSIFIER_DSCP_ENABLE)
 +	ECM_CLASSIFIER_DSCP_ENABLE=y
 +endif
 ecm-$(ECM_CLASSIFIER_DSCP_ENABLE) += ecm_classifier_dscp.o
 ccflags-$(ECM_CLASSIFIER_DSCP_ENABLE) += -DECM_CLASSIFIER_DSCP_ENABLE
 ccflags-$(ECM_CLASSIFIER_DSCP_IGS) += -DECM_CLASSIFIER_DSCP_IGS
@@ -274,7 +294,9 @@ endif
 # the Parental Controls subsystem classifier in ECM. Currently disabled until
 # customers require it / if they need to integrate their Parental Controls with it.
 # #############################################################################
 -ECM_CLASSIFIER_PCC_ENABLE=y
 +ifndef $(ECM_CLASSIFIER_PCC_ENABLE)
 +	ECM_CLASSIFIER_PCC_ENABLE=y
 +endif
 ecm-$(ECM_CLASSIFIER_PCC_ENABLE) += ecm_classifier_pcc.o
 ccflags-$(ECM_CLASSIFIER_PCC_ENABLE) += -DECM_CLASSIFIER_PCC_ENABLE
@@ -301,28 +323,36 @@ ccflags-$(ECM_NON_PORTED_SUPPORT_ENABLE)
 # #############################################################################
 # Define ECM_STATE_OUTPUT_ENABLE=y to support XML state output
 # #############################################################################
 -ECM_STATE_OUTPUT_ENABLE=y
 +ifndef $(ECM_STATE_OUTPUT_ENABLE)
 +	ECM_STATE_OUTPUT_ENABLE=y
 +endif
 ecm-$(ECM_STATE_OUTPUT_ENABLE) += ecm_state.o
 ccflags-$(ECM_STATE_OUTPUT_ENABLE) += -DECM_STATE_OUTPUT_ENABLE
 # #############################################################################
 # Define ECM_DB_ADVANCED_STATS_ENABLE to support XML state output
 # #############################################################################
 -ECM_DB_ADVANCED_STATS_ENABLE=y
 +ifndef $(ECM_DB_ADVANCED_STATS_ENABLE)
 +	ECM_DB_ADVANCED_STATS_ENABLE=y
 +endif
 ccflags-$(ECM_DB_ADVANCED_STATS_ENABLE) += -DECM_DB_ADVANCED_STATS_ENABLE
 # #############################################################################
 # Define ECM_DB_CONNECTION_CROSS_REFERENCING_ENABLE=y in order to enable
 # the database to track relationships between objects.
 # #############################################################################
 -ECM_DB_CONNECTION_CROSS_REFERENCING_ENABLE=y
 +ifndef $(ECM_DB_CONNECTION_CROSS_REFERENCING_ENABLE)
 +	ECM_DB_CONNECTION_CROSS_REFERENCING_ENABLE=y
 +endif
 ccflags-$(ECM_DB_CONNECTION_CROSS_REFERENCING_ENABLE) += -DECM_DB_XREF_ENABLE
 # #############################################################################
 # Define ECM_TRACKER_DPI_SUPPORT_ENABLE=y in order to enable support for
 # deep packet inspection and tracking of data with the trackers.
 # #############################################################################
 -ECM_TRACKER_DPI_SUPPORT_ENABLE=y
 +ifndef $(ECM_TRACKER_DPI_SUPPORT_ENABLE)
 +	ECM_TRACKER_DPI_SUPPORT_ENABLE=y
 +endif
 ccflags-$(ECM_TRACKER_DPI_SUPPORT_ENABLE) += -DECM_TRACKER_DPI_SUPPORT_ENABLE
 # #############################################################################
@@ -330,14 +360,18 @@ ccflags-$(ECM_TRACKER_DPI_SUPPORT_ENABLE
 # support for the database keeping lists of connections that are assigned
 # on a per TYPE of classifier basis.
 # #############################################################################
 -ECM_DB_CLASSIFIER_TYPE_ASSIGNMENTS_TRACK_ENABLE=y
 +ifndef $(ECM_DB_CLASSIFIER_TYPE_ASSIGNMENTS_TRACK_ENABLE)
 +	ECM_DB_CLASSIFIER_TYPE_ASSIGNMENTS_TRACK_ENABLE=y
 +endif
 ccflags-$(ECM_DB_CLASSIFIER_TYPE_ASSIGNMENTS_TRACK_ENABLE) += -DECM_DB_CTA_TRACK_ENABLE
 # #############################################################################
 # Define ECM_BAND_STEERING_ENABLE=y in order to enable
 # band steering feature.
 # #############################################################################
 -ECM_BAND_STEERING_ENABLE=y
 +ifndef $(ECM_BAND_STEERING_ENABLE)
 +	ECM_BAND_STEERING_ENABLE=y
 +endif
 ccflags-$(ECM_BAND_STEERING_ENABLE) += -DECM_BAND_STEERING_ENABLE
 # #############################################################################
 --- a/ecm_db/ecm_db_connection.c
 +++ b/ecm_db/ecm_db_connection.c
@@ -430,7 +430,9 @@ EXPORT_SYMBOL(ecm_db_connection_make_def
  */
 void ecm_db_connection_data_totals_update(struct ecm_db_connection_instance *ci, bool is_from, uint64_t size, uint64_t packets)
 {
 +#ifdef ECM_DB_ADVANCED_STATS_ENABLE
 	int32_t i;
 +#endif
 	DEBUG_CHECK_MAGIC(ci, ECM_DB_CONNECTION_INSTANCE_MAGIC, "%px: magic failed\n", ci);
@@ -529,7 +531,9 @@ EXPORT_SYMBOL(ecm_db_connection_data_tot
  */
 void ecm_db_connection_data_totals_update_dropped(struct ecm_db_connection_instance *ci, bool is_from, uint64_t size, uint64_t packets)
 {
 +#ifdef ECM_DB_ADVANCED_STATS_ENABLE
 	int32_t i;
 +#endif
 	DEBUG_CHECK_MAGIC(ci, ECM_DB_CONNECTION_INSTANCE_MAGIC, "%px: magic failed\n", ci);
@@ -1508,6 +1512,7 @@ void ecm_db_connection_defunct_all(void)
 }
 EXPORT_SYMBOL(ecm_db_connection_defunct_all);
 +#ifdef ECM_INTERFACE_OVS_BRIDGE_ENABLE
 /*
  * ecm_db_connection_defunct_by_classifier()
  *	Make defunct based on masked fields
@@ -1667,6 +1672,7 @@ next_ci:
 				ECM_IP_ADDR_TO_OCTAL(dest_addr_mask), dest_port_mask, proto_mask, cnt);
 	}
 }
 +#endif
 /*
  * ecm_db_connection_defunct_by_port()
@@ -1956,6 +1962,7 @@ struct ecm_db_node_instance *ecm_db_conn
 }
 EXPORT_SYMBOL(ecm_db_connection_node_get_and_ref);
 +#ifdef ECM_DB_XREF_ENABLE
 /*
  * ecm_db_connection_mapping_get_and_ref_next()
  *	Return reference to next connection in the mapping chain in the specified direction.
@@ -1997,6 +2004,7 @@ struct ecm_db_connection_instance *ecm_d
 	return nci;
 }
 EXPORT_SYMBOL(ecm_db_connection_iface_get_and_ref_next);
 +#endif
 /*
  * ecm_db_connection_mapping_get_and_ref()
 --- a/ecm_db/ecm_db_node.c
 +++ b/ecm_db/ecm_db_node.c
@@ -224,9 +224,11 @@ EXPORT_SYMBOL(ecm_db_node_get_and_ref_ne
  */
 int ecm_db_node_deref(struct ecm_db_node_instance *ni)
 {
 +#ifdef ECM_DB_XREF_ENABLE
 #if (DEBUG_LEVEL >= 1)
 	int dir;
 #endif
 +#endif
 	DEBUG_CHECK_MAGIC(ni, ECM_DB_NODE_INSTANCE_MAGIC, "%px: magic failed\n", ni);
 	spin_lock_bh(&ecm_db_lock);
@@ -486,9 +488,11 @@ EXPORT_SYMBOL(ecm_db_node_iface_get_and_
 void ecm_db_node_add(struct ecm_db_node_instance *ni, struct ecm_db_iface_instance *ii, uint8_t *address,
 					ecm_db_node_final_callback_t final, void *arg)
 {
 +#ifdef ECM_DB_XREF_ENABLE
 #if (DEBUG_LEVEL >= 1)
 	int dir;
 #endif
 +#endif
 	ecm_db_node_hash_t hash_index;
 	struct ecm_db_listener_instance *li;
 --- a/ecm_interface.c
 +++ b/ecm_interface.c
@@ -1343,6 +1343,7 @@ struct neighbour *ecm_interface_ipv6_nei
  */
 bool ecm_interface_is_pptp(struct sk_buff *skb, const struct net_device *out)
 {
 +#ifdef ECM_INTERFACE_PPTP_ENABLE
 	struct net_device *in;
 	/*
@@ -1367,6 +1368,7 @@ bool ecm_interface_is_pptp(struct sk_buf
 	}
 	dev_put(in);
 +#endif
 	return false;
 }
@@ -1379,6 +1381,7 @@ bool ecm_interface_is_pptp(struct sk_buf
  */
 bool ecm_interface_is_l2tp_packet_by_version(struct sk_buff *skb, const struct net_device *out, int ver)
 {
 +#ifdef ECM_INTERFACE_L2TPV2_PPTP_ENABLE
 	uint32_t flag = 0;
 	struct net_device *in;
@@ -1411,6 +1414,7 @@ bool ecm_interface_is_l2tp_packet_by_ver
 	}
 	dev_put(in);
 +#endif
 	return false;
 }
@@ -1423,6 +1427,7 @@ bool ecm_interface_is_l2tp_packet_by_ver
  */
 bool ecm_interface_is_l2tp_pptp(struct sk_buff *skb, const struct net_device *out)
 {
 +#ifdef ECM_INTERFACE_L2TPV2_PPTP_ENABLE
 	struct net_device *in;
 	/*
@@ -1445,6 +1450,7 @@ bool ecm_interface_is_l2tp_pptp(struct s
 	}
 	dev_put(in);
 +#endif
 	return false;
 }
@@ -6630,6 +6636,7 @@ static void ecm_interface_regenerate_con
 		return;
 	}
 +#ifdef ECM_DB_XREF_ENABLE
 	for (dir = 0; dir < ECM_DB_OBJ_DIR_MAX; dir++) {
 		/*
 		 * Re-generate all connections associated with this interface
@@ -6645,6 +6652,7 @@ static void ecm_interface_regenerate_con
 			ci[dir] = cin;
 		}
 	}
 +#endif
 #ifdef ECM_MULTICAST_ENABLE
 	/*
 --- a/frontends/ecm_front_end_common.c
 +++ b/frontends/ecm_front_end_common.c
@@ -106,6 +106,7 @@ bool ecm_front_end_gre_proto_is_accel_al
 							     struct nf_conntrack_tuple *tuple,
 							     int ip_version)
 {
 +#ifdef ECM_INTERFACE_GRE_ENABLE
 	struct net_device *dev;
 	struct gre_base_hdr *greh;
@@ -117,10 +118,12 @@ bool ecm_front_end_gre_proto_is_accel_al
 		/*
 		 * Case 1: PPTP locally terminated
 		 */
 +#ifdef ECM_INTERFACE_PPTP_ENABLE
 		if (ecm_interface_is_pptp(skb, outdev)) {
 			DEBUG_TRACE("%px: PPTP GRE locally terminated - allow acceleration\n", skb);
 			return true;
 		}
 +#endif
 		/*
 		 * Case 2: PPTP pass through
@@ -223,6 +226,10 @@ bool ecm_front_end_gre_proto_is_accel_al
 	 */
 	DEBUG_TRACE("%px: GRE IPv%d pass through - allow acceleration\n", skb, ip_version);
 	return true;
 +#else
 +	DEBUG_TRACE("%px: GRE%d feature is disabled - do not allow acceleration\n", skb, ip_version);
 +	return false;
 +#endif
 }
 #ifdef ECM_CLASSIFIER_DSCP_ENABLE
--- a/package/qca/nss/qca-nss-ecm-64/patches/002-kernel-5.10-support.patch
+++ b/package/qca/nss/qca-nss-ecm-64/patches/002-kernel-5.10-support.patch
@ -1,831 +0,0 @@
 From e8b642c23af9146c973e828a7f4e0fb56cfc8d0b Mon Sep 17 00:00:00 2001
 From: Ansuel Smith <ansuelsmth@gmail.com>
 Date: Sat, 15 May 2021 03:51:14 +0200
 Subject: [PATCH] add support for kernel 5.10
 Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
 ---
 ecm_classifier_default.c                | 24 +++---------
 ecm_classifier_dscp.c                   |  8 +---
 ecm_classifier_emesh.c                  | 16 ++------
 ecm_classifier_hyfi.c                   |  7 +---
 ecm_classifier_mark.c                   |  8 +---
 ecm_classifier_ovs.c                    |  8 +---
 ecm_classifier_pcc.c                    |  8 +---
 ecm_conntrack_notifier.c                |  8 +---
 ecm_db/ecm_db_connection.c              |  7 +---
 ecm_db/ecm_db_host.c                    |  7 +---
 ecm_db/ecm_db_iface.c                   |  7 +---
 ecm_db/ecm_db_mapping.c                 |  7 +---
 ecm_db/ecm_db_node.c                    |  7 +---
 ecm_interface.c                         |  4 +-
 ecm_state.c                             | 14 ++-----
 frontends/ecm_front_end_common.c        |  4 +-
 frontends/ecm_front_end_ipv4.c          |  7 +---
 frontends/ecm_front_end_ipv6.c          |  7 +---
 frontends/nss/ecm_nss_bond_notifier.c   |  8 +---
 frontends/nss/ecm_nss_ipv4.c            | 49 +++++++------------------
 frontends/nss/ecm_nss_ipv6.c            | 49 +++++++------------------
 frontends/nss/ecm_nss_multicast_ipv4.c  |  7 +---
 frontends/nss/ecm_nss_multicast_ipv6.c  |  7 +---
 frontends/nss/ecm_nss_non_ported_ipv4.c |  7 +---
 frontends/nss/ecm_nss_non_ported_ipv6.c |  7 +---
 frontends/nss/ecm_nss_ported_ipv4.c     |  8 +---
 frontends/nss/ecm_nss_ported_ipv6.c     |  8 +---
 frontends/sfe/ecm_sfe_ipv4.c            | 49 +++++++------------------
 frontends/sfe/ecm_sfe_ipv6.c            | 49 +++++++------------------
 frontends/sfe/ecm_sfe_non_ported_ipv4.c |  7 +---
 frontends/sfe/ecm_sfe_non_ported_ipv6.c |  7 +---
 frontends/sfe/ecm_sfe_ported_ipv4.c     |  8 +---
 frontends/sfe/ecm_sfe_ported_ipv6.c     |  8 +---
 33 files changed, 122 insertions(+), 314 deletions(-)
 --- a/ecm_classifier_default.c
 +++ b/ecm_classifier_default.c
@@ -776,26 +776,14 @@ int ecm_classifier_default_init(struct d
 		return -1;
 	}
 -	if (!debugfs_create_u32("enabled", S_IRUGO | S_IWUSR, ecm_classifier_default_dentry,
 -					(u32 *)&ecm_classifier_default_enabled)) {
 -		DEBUG_ERROR("Failed to create ecm deafult classifier enabled file in debugfs\n");
 -		debugfs_remove_recursive(ecm_classifier_default_dentry);
 -		return -1;
 -	}
 +	debugfs_create_u32("enabled", S_IRUGO | S_IWUSR, ecm_classifier_default_dentry,
 +					(u32 *)&ecm_classifier_default_enabled);
 -	if (!debugfs_create_u32("accel_mode", S_IRUGO | S_IWUSR, ecm_classifier_default_dentry,
 -					(u32 *)&ecm_classifier_default_accel_mode)) {
 -		DEBUG_ERROR("Failed to create ecm deafult classifier accel_mode file in debugfs\n");
 -		debugfs_remove_recursive(ecm_classifier_default_dentry);
 -		return -1;
 -	}
 +	debugfs_create_u32("accel_mode", S_IRUGO | S_IWUSR, ecm_classifier_default_dentry,
 +					(u32 *)&ecm_classifier_default_accel_mode);
 -	if (!debugfs_create_u32("accel_delay_pkts", S_IRUGO | S_IWUSR, ecm_classifier_default_dentry,
 -					(u32 *)&ecm_classifier_accel_delay_pkts)) {
 -		DEBUG_ERROR("Failed to create accel delay packet counts in debugfs\n");
 -		debugfs_remove_recursive(ecm_classifier_default_dentry);
 -		return -1;
 -	}
 +	debugfs_create_u32("accel_delay_pkts", S_IRUGO | S_IWUSR, ecm_classifier_default_dentry,
 +					(u32 *)&ecm_classifier_accel_delay_pkts);
 	return 0;
 }
 --- a/ecm_classifier_dscp.c
 +++ b/ecm_classifier_dscp.c
@@ -747,12 +747,8 @@ int ecm_classifier_dscp_init(struct dent
 		return -1;
 	}
 -	if (!debugfs_create_u32("enabled", S_IRUGO | S_IWUSR, ecm_classifier_dscp_dentry,
 -					(u32 *)&ecm_classifier_dscp_enabled)) {
 -		DEBUG_ERROR("Failed to create dscp enabled file in debugfs\n");
 -		debugfs_remove_recursive(ecm_classifier_dscp_dentry);
 -		return -1;
 -	}
 +	debugfs_create_u32("enabled", S_IRUGO | S_IWUSR, ecm_classifier_dscp_dentry,
 +					(u32 *)&ecm_classifier_dscp_enabled);
 	return 0;
 }
 --- a/ecm_classifier_emesh.c
 +++ b/ecm_classifier_emesh.c
@@ -977,19 +977,11 @@ int ecm_classifier_emesh_init(struct den
 		return -1;
 	}
 -	if (!debugfs_create_u32("enabled", S_IRUGO | S_IWUSR, ecm_classifier_emesh_dentry,
 -				(u32 *)&ecm_classifier_emesh_enabled)) {
 -		DEBUG_ERROR("Failed to create ecm emesh classifier enabled file in debugfs\n");
 -		debugfs_remove_recursive(ecm_classifier_emesh_dentry);
 -		return -1;
 -	}
 +	debugfs_create_u32("enabled", S_IRUGO | S_IWUSR, ecm_classifier_emesh_dentry,
 +				(u32 *)&ecm_classifier_emesh_enabled);
 -	if (!debugfs_create_u32("latency_config_enabled", S_IRUGO | S_IWUSR, ecm_classifier_emesh_dentry,
 -				(u32 *)&ecm_classifier_emesh_latency_config_enabled)) {
 -		DEBUG_ERROR("Failed to create ecm emesh classifier latency config enabled file in debugfs\n");
 -		debugfs_remove_recursive(ecm_classifier_emesh_dentry);
 -		return -1;
 -	}
 +	debugfs_create_u32("latency_config_enabled", S_IRUGO | S_IWUSR, ecm_classifier_emesh_dentry,
 +				(u32 *)&ecm_classifier_emesh_latency_config_enabled);
 	/*
 	 * Register for service prioritization notification update.
 --- a/ecm_classifier_hyfi.c
 +++ b/ecm_classifier_hyfi.c
@@ -1099,11 +1099,8 @@ int ecm_classifier_hyfi_rules_init(struc
 		goto classifier_task_cleanup;
 	}
 -	if (!debugfs_create_u32("enabled", S_IRUGO | S_IWUSR, ecm_classifier_hyfi_dentry,
 -					(u32 *)&ecm_classifier_hyfi_enabled)) {
 -		DEBUG_ERROR("Failed to create ecm hyfi classifier enabled file in debugfs\n");
 -		goto classifier_task_cleanup;
 -	}
 +	debugfs_create_u32("enabled", S_IRUGO | S_IWUSR, ecm_classifier_hyfi_dentry,
 +					(u32 *)&ecm_classifier_hyfi_enabled);
 	if (!debugfs_create_file("cmd", S_IWUSR, ecm_classifier_hyfi_dentry,
 					NULL, &ecm_classifier_hyfi_cmd_fops)) {
 --- a/ecm_classifier_mark.c
 +++ b/ecm_classifier_mark.c
@@ -753,12 +753,8 @@ int ecm_classifier_mark_init(struct dent
 		return -1;
 	}
 -	if (!debugfs_create_u32("enabled", S_IRUGO | S_IWUSR, ecm_classifier_mark_dentry,
 -					(u32 *)&ecm_classifier_mark_enabled)) {
 -		DEBUG_ERROR("Failed to create mark enabled file in debugfs\n");
 -		debugfs_remove_recursive(ecm_classifier_mark_dentry);
 -		return -1;
 -	}
 +	debugfs_create_u32("enabled", S_IRUGO | S_IWUSR, ecm_classifier_mark_dentry,
 +					(u32 *)&ecm_classifier_mark_enabled);
 	return 0;
 }
 --- a/ecm_classifier_ovs.c
 +++ b/ecm_classifier_ovs.c
@@ -2200,12 +2200,8 @@ int ecm_classifier_ovs_init(struct dentr
 		return -1;
 	}
 -	if (!debugfs_create_u32("enabled", S_IRUGO | S_IWUSR, ecm_classifier_ovs_dentry,
 -					(u32 *)&ecm_classifier_ovs_enabled)) {
 -		DEBUG_ERROR("Failed to create ovs enabled file in debugfs\n");
 -		debugfs_remove_recursive(ecm_classifier_ovs_dentry);
 -		return -1;
 -	}
 +	debugfs_create_u32("enabled", S_IRUGO | S_IWUSR, ecm_classifier_ovs_dentry,
 +					(u32 *)&ecm_classifier_ovs_enabled);
 	return 0;
 }
 --- a/ecm_classifier_pcc.c
 +++ b/ecm_classifier_pcc.c
@@ -1308,12 +1308,8 @@ int ecm_classifier_pcc_init(struct dentr
 		return -1;
 	}
 -	if (!debugfs_create_u32("enabled", S_IRUGO, ecm_classifier_pcc_dentry,
 -					(u32 *)&ecm_classifier_pcc_enabled)) {
 -		DEBUG_ERROR("Failed to create pcc enabled file in debugfs\n");
 -		debugfs_remove_recursive(ecm_classifier_pcc_dentry);
 -		return -1;
 -	}
 +	debugfs_create_u32("enabled", S_IRUGO, ecm_classifier_pcc_dentry,
 +					(u32 *)&ecm_classifier_pcc_enabled);
 	return 0;
 }
 --- a/ecm_conntrack_notifier.c
 +++ b/ecm_conntrack_notifier.c
@@ -414,12 +414,8 @@ int ecm_conntrack_notifier_init(struct d
 		return -1;
 	}
 -	if (!debugfs_create_u32("stop", S_IRUGO | S_IWUSR, ecm_conntrack_notifier_dentry,
 -					(u32 *)&ecm_conntrack_notifier_stopped)) {
 -		DEBUG_ERROR("Failed to create ecm conntrack notifier stopped file in debugfs\n");
 -		debugfs_remove_recursive(ecm_conntrack_notifier_dentry);
 -		return -1;
 -	}
 +	debugfs_create_u32("stop", S_IRUGO | S_IWUSR, ecm_conntrack_notifier_dentry,
 +					(u32 *)&ecm_conntrack_notifier_stopped);
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 	/*
 --- a/ecm_db/ecm_db_connection.c
 +++ b/ecm_db/ecm_db_connection.c
@@ -3642,11 +3642,8 @@ static struct file_operations ecm_db_con
  */
 bool ecm_db_connection_init(struct dentry *dentry)
 {
 -	if (!debugfs_create_u32("connection_count", S_IRUGO, dentry,
 -					(u32 *)&ecm_db_connection_count)) {
 -		DEBUG_ERROR("Failed to create ecm db connection count file in debugfs\n");
 -		return false;
 -	}
 +	debugfs_create_u32("connection_count", S_IRUGO, dentry,
 +					(u32 *)&ecm_db_connection_count);
 	if (!debugfs_create_file("connection_count_simple", S_IRUGO, dentry,
 					NULL, &ecm_db_connection_count_simple_fops)) {
 --- a/ecm_db/ecm_db_host.c
 +++ b/ecm_db/ecm_db_host.c
@@ -770,11 +770,8 @@ EXPORT_SYMBOL(ecm_db_host_alloc);
 bool ecm_db_host_init(struct dentry *dentry)
 {
 -	if (!debugfs_create_u32("host_count", S_IRUGO, dentry,
 -					(u32 *)&ecm_db_host_count)) {
 -		DEBUG_ERROR("Failed to create ecm db host count file in debugfs\n");
 -		return false;;
 -	}
 +	debugfs_create_u32("host_count", S_IRUGO, dentry,
 +					(u32 *)&ecm_db_host_count);
 	ecm_db_host_table = vzalloc(sizeof(struct ecm_db_host_instance *) * ECM_DB_HOST_HASH_SLOTS);
 	if (!ecm_db_host_table) {
 --- a/ecm_db/ecm_db_iface.c
 +++ b/ecm_db/ecm_db_iface.c
@@ -3670,11 +3670,8 @@ EXPORT_SYMBOL(ecm_db_iface_alloc);
  */
 bool ecm_db_iface_init(struct dentry *dentry)
 {
 -	if (!debugfs_create_u32("iface_count", S_IRUGO, dentry,
 -					(u32 *)&ecm_db_iface_count)) {
 -		DEBUG_ERROR("Failed to create ecm db iface count file in debugfs\n");
 -		return false;
 -	}
 +	debugfs_create_u32("iface_count", S_IRUGO, dentry,
 +					(u32 *)&ecm_db_iface_count);
 	return true;
 }
 --- a/ecm_db/ecm_db_mapping.c
 +++ b/ecm_db/ecm_db_mapping.c
@@ -806,11 +806,8 @@ EXPORT_SYMBOL(ecm_db_mapping_alloc);
  */
 bool ecm_db_mapping_init(struct dentry *dentry)
 {
 -	if (!debugfs_create_u32("mapping_count", S_IRUGO, dentry,
 -					(u32 *)&ecm_db_mapping_count)) {
 -		DEBUG_ERROR("Failed to create ecm db mapping count file in debugfs\n");
 -		return false;
 -	}
 +	debugfs_create_u32("mapping_count", S_IRUGO, dentry,
 +					(u32 *)&ecm_db_mapping_count);
 	ecm_db_mapping_table = vzalloc(sizeof(struct ecm_db_mapping_instance *) * ECM_DB_MAPPING_HASH_SLOTS);
 	if (!ecm_db_mapping_table) {
 --- a/ecm_db/ecm_db_node.c
 +++ b/ecm_db/ecm_db_node.c
@@ -1187,11 +1187,8 @@ keep_sni_conn:
  */
 bool ecm_db_node_init(struct dentry *dentry)
 {
 -	if (!debugfs_create_u32("node_count", S_IRUGO, dentry,
 -					(u32 *)&ecm_db_node_count)) {
 -		DEBUG_ERROR("Failed to create ecm db node count file in debugfs\n");
 -		return false;
 -	}
 +	debugfs_create_u32("node_count", S_IRUGO, dentry,
 +					(u32 *)&ecm_db_node_count);
 	ecm_db_node_table = vzalloc(sizeof(struct ecm_db_node_instance *) * ECM_DB_NODE_HASH_SLOTS);
 	if (!ecm_db_node_table) {
 --- a/ecm_interface.c
 +++ b/ecm_interface.c
@@ -332,7 +332,7 @@ static struct net_device *ecm_interface_
 	struct net_device *dev;
 	ECM_IP_ADDR_TO_NIN6_ADDR(addr6, addr);
 -	dev = (struct net_device *)ipv6_dev_find(&init_net, &addr6, 1);
 +	dev = (struct net_device *)ipv6_dev_find_and_hold(&init_net, &addr6, 1);
 	return dev;
 }
 #endif
@@ -734,7 +734,7 @@ static bool ecm_interface_mac_addr_get_i
 	 * Get the MAC address that corresponds to IP address given.
 	 */
 	ECM_IP_ADDR_TO_NIN6_ADDR(daddr, addr);
 -	local_dev = ipv6_dev_find(&init_net, &daddr, 1);
 +	local_dev = ipv6_dev_find_and_hold(&init_net, &daddr, 1);
 	if (local_dev) {
 		DEBUG_TRACE("%pi6 is a local address\n", &daddr);
 		memcpy(mac_addr, dev->dev_addr, ETH_ALEN);
 --- a/ecm_state.c
 +++ b/ecm_state.c
@@ -899,17 +899,11 @@ int ecm_state_init(struct dentry *dentry
 		return -1;
 	}
 -	if (!debugfs_create_u32("state_dev_major", S_IRUGO, ecm_state_dentry,
 -					(u32 *)&ecm_state_dev_major_id)) {
 -		DEBUG_ERROR("Failed to create ecm state dev major file in debugfs\n");
 -		goto init_cleanup;
 -	}
 +	debugfs_create_u32("state_dev_major", S_IRUGO, ecm_state_dentry,
 +					(u32 *)&ecm_state_dev_major_id);
 -	if (!debugfs_create_u32("state_file_output_mask", S_IRUGO | S_IWUSR, ecm_state_dentry,
 -					(u32 *)&ecm_state_file_output_mask)) {
 -		DEBUG_ERROR("Failed to create ecm state output mask file in debugfs\n");
 -		goto init_cleanup;
 -	}
 +	debugfs_create_u32("state_file_output_mask", S_IRUGO | S_IWUSR, ecm_state_dentry,
 +					(u32 *)&ecm_state_file_output_mask);
 	/*
 	 * Register a char device that we will use to provide a dump of our state
 --- a/frontends/ecm_front_end_common.c
 +++ b/frontends/ecm_front_end_common.c
@@ -192,7 +192,7 @@ bool ecm_front_end_gre_proto_is_accel_al
 			return false;
 		}
 	} else {
 -		dev = ipv6_dev_find(&init_net, &(tuple->src.u3.in6), 1);
 +		dev = ipv6_dev_find_and_hold(&init_net, &(tuple->src.u3.in6), 1);
 		if (dev) {
 			/*
 			 * Source IP address is local
@@ -202,7 +202,7 @@ bool ecm_front_end_gre_proto_is_accel_al
 			return false;
 		}
 -		dev = ipv6_dev_find(&init_net, &(tuple->dst.u3.in6), 1);
 +		dev = ipv6_dev_find_and_hold(&init_net, &(tuple->dst.u3.in6), 1);
 		if (dev) {
 			/*
 			 * Destination IP address is local
 --- a/frontends/ecm_front_end_ipv4.c
 +++ b/frontends/ecm_front_end_ipv4.c
@@ -376,11 +376,8 @@ void ecm_front_end_ipv4_stop(int num)
  */
 int ecm_front_end_ipv4_init(struct dentry *dentry)
 {
 -	if (!debugfs_create_u32("front_end_ipv4_stop", S_IRUGO | S_IWUSR, dentry,
 -					(u32 *)&ecm_front_end_ipv4_stopped)) {
 -		DEBUG_ERROR("Failed to create ecm front end ipv4 stop file in debugfs\n");
 -		return -1;
 -	}
 +	debugfs_create_u32("front_end_ipv4_stop", S_IRUGO | S_IWUSR, dentry,
 +			   (u32 *)&ecm_front_end_ipv4_stopped);
 	switch (ecm_front_end_type_get()) {
 	case ECM_FRONT_END_TYPE_NSS:
 --- a/frontends/ecm_front_end_ipv6.c
 +++ b/frontends/ecm_front_end_ipv6.c
@@ -255,11 +255,8 @@ void ecm_front_end_ipv6_stop(int num)
  */
 int ecm_front_end_ipv6_init(struct dentry *dentry)
 {
 -	if (!debugfs_create_u32("front_end_ipv6_stop", S_IRUGO | S_IWUSR, dentry,
 -					(u32 *)&ecm_front_end_ipv6_stopped)) {
 -		DEBUG_ERROR("Failed to create ecm front end ipv6 stop file in debugfs\n");
 -		return -1;
 -	}
 +	debugfs_create_u32("front_end_ipv6_stop", S_IRUGO | S_IWUSR, dentry,
 +			   (u32 *)&ecm_front_end_ipv6_stopped);
 	switch (ecm_front_end_type_get()) {
 	case ECM_FRONT_END_TYPE_NSS:
 --- a/frontends/nss/ecm_nss_bond_notifier.c
 +++ b/frontends/nss/ecm_nss_bond_notifier.c
@@ -240,12 +240,8 @@ int ecm_nss_bond_notifier_init(struct de
 		return -1;
 	}
 -	if (!debugfs_create_u32("stop", S_IRUGO | S_IWUSR, ecm_nss_bond_notifier_dentry,
 -					(u32 *)&ecm_nss_bond_notifier_stopped)) {
 -		DEBUG_ERROR("Failed to create ecm bond notifier stopped file in debugfs\n");
 -		debugfs_remove_recursive(ecm_nss_bond_notifier_dentry);
 -		return -1;
 -	}
 +	debugfs_create_u32("stop", S_IRUGO | S_IWUSR, ecm_nss_bond_notifier_dentry,
 +					(u32 *)&ecm_nss_bond_notifier_stopped);
 	/*
 	 * Register Link Aggregation callbacks with the bonding driver
 --- a/frontends/nss/ecm_nss_ipv4.c
 +++ b/frontends/nss/ecm_nss_ipv4.c
@@ -2802,41 +2802,23 @@ int ecm_nss_ipv4_init(struct dentry *den
 		return result;
 	}
 -	if (!debugfs_create_u32("no_action_limit_default", S_IRUGO | S_IWUSR, ecm_nss_ipv4_dentry,
 -					(u32 *)&ecm_nss_ipv4_no_action_limit_default)) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv4 no_action_limit_default file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("no_action_limit_default", S_IRUGO | S_IWUSR, ecm_nss_ipv4_dentry,
 +					(u32 *)&ecm_nss_ipv4_no_action_limit_default);
 -	if (!debugfs_create_u32("driver_fail_limit_default", S_IRUGO | S_IWUSR, ecm_nss_ipv4_dentry,
 -					(u32 *)&ecm_nss_ipv4_driver_fail_limit_default)) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv4 driver_fail_limit_default file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("driver_fail_limit_default", S_IRUGO | S_IWUSR, ecm_nss_ipv4_dentry,
 +					(u32 *)&ecm_nss_ipv4_driver_fail_limit_default);
 -	if (!debugfs_create_u32("nack_limit_default", S_IRUGO | S_IWUSR, ecm_nss_ipv4_dentry,
 -					(u32 *)&ecm_nss_ipv4_nack_limit_default)) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv4 nack_limit_default file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("nack_limit_default", S_IRUGO | S_IWUSR, ecm_nss_ipv4_dentry,
 +					(u32 *)&ecm_nss_ipv4_nack_limit_default);
 -	if (!debugfs_create_u32("accelerated_count", S_IRUGO, ecm_nss_ipv4_dentry,
 -					(u32 *)&ecm_nss_ipv4_accelerated_count)) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv4 accelerated_count file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("accelerated_count", S_IRUGO, ecm_nss_ipv4_dentry,
 +					(u32 *)&ecm_nss_ipv4_accelerated_count);
 -	if (!debugfs_create_u32("pending_accel_count", S_IRUGO, ecm_nss_ipv4_dentry,
 -					(u32 *)&ecm_nss_ipv4_pending_accel_count)) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv4 pending_accel_count file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("pending_accel_count", S_IRUGO, ecm_nss_ipv4_dentry,
 +					(u32 *)&ecm_nss_ipv4_pending_accel_count);
 -	if (!debugfs_create_u32("pending_decel_count", S_IRUGO, ecm_nss_ipv4_dentry,
 -					(u32 *)&ecm_nss_ipv4_pending_decel_count)) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv4 pending_decel_count file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("pending_decel_count", S_IRUGO, ecm_nss_ipv4_dentry,
 +					(u32 *)&ecm_nss_ipv4_pending_decel_count);
 	if (!debugfs_create_file("accel_limit_mode", S_IRUGO | S_IWUSR, ecm_nss_ipv4_dentry,
 					NULL, &ecm_nss_ipv4_accel_limit_mode_fops)) {
@@ -2867,11 +2849,8 @@ int ecm_nss_ipv4_init(struct dentry *den
 		goto task_cleanup;
 	}
 -	if (!debugfs_create_u32("vlan_passthrough_set", S_IRUGO | S_IWUSR, ecm_nss_ipv4_dentry,
 -					(u32 *)&ecm_nss_ipv4_vlan_passthrough_enable)) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv4 vlan passthrough file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("vlan_passthrough_set", S_IRUGO | S_IWUSR, ecm_nss_ipv4_dentry,
 +					(u32 *)&ecm_nss_ipv4_vlan_passthrough_enable);
 #ifdef ECM_NON_PORTED_SUPPORT_ENABLE
 	if (!ecm_nss_non_ported_ipv4_debugfs_init(ecm_nss_ipv4_dentry)) {
 --- a/frontends/nss/ecm_nss_ipv6.c
 +++ b/frontends/nss/ecm_nss_ipv6.c
@@ -2542,41 +2542,23 @@ int ecm_nss_ipv6_init(struct dentry *den
 		return result;
 	}
 -	if (!debugfs_create_u32("no_action_limit_default", S_IRUGO | S_IWUSR, ecm_nss_ipv6_dentry,
 -					(u32 *)&ecm_nss_ipv6_no_action_limit_default)) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv6 no_action_limit_default file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("no_action_limit_default", S_IRUGO | S_IWUSR, ecm_nss_ipv6_dentry,
 +					(u32 *)&ecm_nss_ipv6_no_action_limit_default);
 -	if (!debugfs_create_u32("driver_fail_limit_default", S_IRUGO | S_IWUSR, ecm_nss_ipv6_dentry,
 -					(u32 *)&ecm_nss_ipv6_driver_fail_limit_default)) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv6 driver_fail_limit_default file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("driver_fail_limit_default", S_IRUGO | S_IWUSR, ecm_nss_ipv6_dentry,
 +					(u32 *)&ecm_nss_ipv6_driver_fail_limit_default);
 -	if (!debugfs_create_u32("nack_limit_default", S_IRUGO | S_IWUSR, ecm_nss_ipv6_dentry,
 -					(u32 *)&ecm_nss_ipv6_nack_limit_default)) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv6 nack_limit_default file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("nack_limit_default", S_IRUGO | S_IWUSR, ecm_nss_ipv6_dentry,
 +					(u32 *)&ecm_nss_ipv6_nack_limit_default);
 -	if (!debugfs_create_u32("accelerated_count", S_IRUGO, ecm_nss_ipv6_dentry,
 -					(u32 *)&ecm_nss_ipv6_accelerated_count)) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv6 accelerated_count file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("accelerated_count", S_IRUGO, ecm_nss_ipv6_dentry,
 +					(u32 *)&ecm_nss_ipv6_accelerated_count);
 -	if (!debugfs_create_u32("pending_accel_count", S_IRUGO, ecm_nss_ipv6_dentry,
 -					(u32 *)&ecm_nss_ipv6_pending_accel_count)) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv6 pending_accel_count file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("pending_accel_count", S_IRUGO, ecm_nss_ipv6_dentry,
 +					(u32 *)&ecm_nss_ipv6_pending_accel_count);
 -	if (!debugfs_create_u32("pending_decel_count", S_IRUGO, ecm_nss_ipv6_dentry,
 -					(u32 *)&ecm_nss_ipv6_pending_decel_count)) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv6 pending_decel_count file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("pending_decel_count", S_IRUGO, ecm_nss_ipv6_dentry,
 +					(u32 *)&ecm_nss_ipv6_pending_decel_count);
 	if (!debugfs_create_file("accel_limit_mode", S_IRUGO | S_IWUSR, ecm_nss_ipv6_dentry,
 					NULL, &ecm_nss_ipv6_accel_limit_mode_fops)) {
@@ -2607,11 +2589,8 @@ int ecm_nss_ipv6_init(struct dentry *den
 		goto task_cleanup;
 	}
 -	if (!debugfs_create_u32("vlan_passthrough_set", S_IRUGO | S_IWUSR, ecm_nss_ipv6_dentry,
 -					(u32 *)&ecm_nss_ipv6_vlan_passthrough_enable)) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv6 vlan passthrough file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("vlan_passthrough_set", S_IRUGO | S_IWUSR, ecm_nss_ipv6_dentry,
 +					(u32 *)&ecm_nss_ipv6_vlan_passthrough_enable);
 #ifdef ECM_NON_PORTED_SUPPORT_ENABLE
 	if (!ecm_nss_non_ported_ipv6_debugfs_init(ecm_nss_ipv6_dentry)) {
 --- a/frontends/nss/ecm_nss_multicast_ipv4.c
 +++ b/frontends/nss/ecm_nss_multicast_ipv4.c
@@ -4139,11 +4139,8 @@ void ecm_nss_multicast_ipv4_stop(int num
  */
 int ecm_nss_multicast_ipv4_init(struct dentry *dentry)
 {
 -	if (!debugfs_create_u32("ecm_nss_multicast_ipv4_stop", S_IRUGO | S_IWUSR, dentry,
 -					(u32 *)&ecm_front_end_ipv4_mc_stopped)) {
 -		DEBUG_ERROR("Failed to create ecm front end ipv4 mc stop file in debugfs\n");
 -		return -1;
 -	}
 +	debugfs_create_u32("ecm_nss_multicast_ipv4_stop", S_IRUGO | S_IWUSR, dentry,
 +					(u32 *)&ecm_front_end_ipv4_mc_stopped);
 	/*
 	 * Register multicast update callback to MCS snooper
 --- a/frontends/nss/ecm_nss_multicast_ipv6.c
 +++ b/frontends/nss/ecm_nss_multicast_ipv6.c
@@ -3939,11 +3939,8 @@ void ecm_nss_multicast_ipv6_stop(int num
  */
 int ecm_nss_multicast_ipv6_init(struct dentry *dentry)
 {
 -	if (!debugfs_create_u32("ecm_nss_multicast_ipv6_stop", S_IRUGO | S_IWUSR, dentry,
 -					(u32 *)&ecm_front_end_ipv6_mc_stopped)) {
 -		DEBUG_ERROR("Failed to create ecm front end ipv6 mc stop file in debugfs\n");
 -		return -1;
 -	}
 +	debugfs_create_u32("ecm_nss_multicast_ipv6_stop", S_IRUGO | S_IWUSR, dentry,
 +					(u32 *)&ecm_front_end_ipv6_mc_stopped);
 	/*
 	 * Register multicast update callback to MCS snooper
 --- a/frontends/nss/ecm_nss_non_ported_ipv4.c
 +++ b/frontends/nss/ecm_nss_non_ported_ipv4.c
@@ -2615,11 +2615,8 @@ done:
  */
 bool ecm_nss_non_ported_ipv4_debugfs_init(struct dentry *dentry)
 {
 -	if (!debugfs_create_u32("non_ported_accelerated_count", S_IRUGO, dentry,
 -					(u32 *)&ecm_nss_non_ported_ipv4_accelerated_count)) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv4 non_ported_accelerated_count file in debugfs\n");
 -		return false;
 -	}
 +	debugfs_create_u32("non_ported_accelerated_count", S_IRUGO, dentry,
 +					(u32 *)&ecm_nss_non_ported_ipv4_accelerated_count);
 	return true;
 }
 --- a/frontends/nss/ecm_nss_non_ported_ipv6.c
 +++ b/frontends/nss/ecm_nss_non_ported_ipv6.c
@@ -2329,11 +2329,8 @@ done:
  */
 bool ecm_nss_non_ported_ipv6_debugfs_init(struct dentry *dentry)
 {
 -	if (!debugfs_create_u32("non_ported_accelerated_count", S_IRUGO, dentry,
 -					(u32 *)&ecm_nss_non_ported_ipv6_accelerated_count)) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv6 non_ported_accelerated_count file in debugfs\n");
 -		return false;
 -	}
 +	debugfs_create_u32("non_ported_accelerated_count", S_IRUGO, dentry,
 +					(u32 *)&ecm_nss_non_ported_ipv6_accelerated_count);
 	return true;
 }
 --- a/frontends/nss/ecm_nss_ported_ipv4.c
 +++ b/frontends/nss/ecm_nss_ported_ipv4.c
@@ -2944,12 +2944,8 @@ bool ecm_nss_ported_ipv4_debugfs_init(st
 		return false;
 	}
 -	if (!debugfs_create_u32("tcp_accelerated_count", S_IRUGO, dentry,
 -					&ecm_nss_ported_ipv4_accelerated_count[ECM_NSS_PORTED_IPV4_PROTO_TCP])) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv4 tcp_accelerated_count file in debugfs\n");
 -		debugfs_remove(udp_dentry);
 -		return false;
 -	}
 +	debugfs_create_u32("tcp_accelerated_count", S_IRUGO, dentry,
 +					&ecm_nss_ported_ipv4_accelerated_count[ECM_NSS_PORTED_IPV4_PROTO_TCP]);
 	return true;
 }
 --- a/frontends/nss/ecm_nss_ported_ipv6.c
 +++ b/frontends/nss/ecm_nss_ported_ipv6.c
@@ -2732,12 +2732,8 @@ bool ecm_nss_ported_ipv6_debugfs_init(st
 		return false;
 	}
 -	if (!debugfs_create_u32("tcp_accelerated_count", S_IRUGO, dentry,
 -					&ecm_nss_ported_ipv6_accelerated_count[ECM_NSS_PORTED_IPV6_PROTO_TCP])) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv6 tcp_accelerated_count file in debugfs\n");
 -		debugfs_remove(udp_dentry);
 -		return false;
 -	}
 +	debugfs_create_u32("tcp_accelerated_count", S_IRUGO, dentry,
 +					&ecm_nss_ported_ipv6_accelerated_count[ECM_NSS_PORTED_IPV6_PROTO_TCP]);
 	return true;
 }
 --- a/frontends/sfe/ecm_sfe_ipv4.c
 +++ b/frontends/sfe/ecm_sfe_ipv4.c
@@ -1808,48 +1808,27 @@ int ecm_sfe_ipv4_init(struct dentry *den
 	}
 #ifdef CONFIG_XFRM
 -	if (!debugfs_create_u32("reject_acceleration_for_ipsec", S_IRUGO | S_IWUSR, ecm_sfe_ipv4_dentry,
 -					(u32 *)&ecm_sfe_ipv4_reject_acceleration_for_ipsec)) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv4 reject_acceleration_for_ipsec file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("reject_acceleration_for_ipsec", S_IRUGO | S_IWUSR, ecm_sfe_ipv4_dentry,
 +					(u32 *)&ecm_sfe_ipv4_reject_acceleration_for_ipsec);
 #endif
 -	if (!debugfs_create_u32("no_action_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv4_dentry,
 -					(u32 *)&ecm_sfe_ipv4_no_action_limit_default)) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv4 no_action_limit_default file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("no_action_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv4_dentry,
 +					(u32 *)&ecm_sfe_ipv4_no_action_limit_default);
 -	if (!debugfs_create_u32("driver_fail_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv4_dentry,
 -					(u32 *)&ecm_sfe_ipv4_driver_fail_limit_default)) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv4 driver_fail_limit_default file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("driver_fail_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv4_dentry,
 +					(u32 *)&ecm_sfe_ipv4_driver_fail_limit_default);
 -	if (!debugfs_create_u32("nack_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv4_dentry,
 -					(u32 *)&ecm_sfe_ipv4_nack_limit_default)) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv4 nack_limit_default file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("nack_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv4_dentry,
 +					(u32 *)&ecm_sfe_ipv4_nack_limit_default);
 -	if (!debugfs_create_u32("accelerated_count", S_IRUGO, ecm_sfe_ipv4_dentry,
 -					(u32 *)&ecm_sfe_ipv4_accelerated_count)) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv4 accelerated_count file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("accelerated_count", S_IRUGO, ecm_sfe_ipv4_dentry,
 +					(u32 *)&ecm_sfe_ipv4_accelerated_count);
 -	if (!debugfs_create_u32("pending_accel_count", S_IRUGO, ecm_sfe_ipv4_dentry,
 -					(u32 *)&ecm_sfe_ipv4_pending_accel_count)) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv4 pending_accel_count file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("pending_accel_count", S_IRUGO, ecm_sfe_ipv4_dentry,
 +					(u32 *)&ecm_sfe_ipv4_pending_accel_count);
 -	if (!debugfs_create_u32("pending_decel_count", S_IRUGO, ecm_sfe_ipv4_dentry,
 -					(u32 *)&ecm_sfe_ipv4_pending_decel_count)) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv4 pending_decel_count file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("pending_decel_count", S_IRUGO, ecm_sfe_ipv4_dentry,
 +					(u32 *)&ecm_sfe_ipv4_pending_decel_count);
 	if (!debugfs_create_file("accel_limit_mode", S_IRUGO | S_IWUSR, ecm_sfe_ipv4_dentry,
 					NULL, &ecm_sfe_ipv4_accel_limit_mode_fops)) {
 --- a/frontends/sfe/ecm_sfe_ipv6.c
 +++ b/frontends/sfe/ecm_sfe_ipv6.c
@@ -1532,48 +1532,27 @@ int ecm_sfe_ipv6_init(struct dentry *den
 	}
 #ifdef CONFIG_XFRM
 -	if (!debugfs_create_u32("reject_acceleration_for_ipsec", S_IRUGO | S_IWUSR, ecm_sfe_ipv6_dentry,
 -					(u32 *)&ecm_sfe_ipv6_reject_acceleration_for_ipsec)) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv6 reject_acceleration_for_ipsec file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("reject_acceleration_for_ipsec", S_IRUGO | S_IWUSR, ecm_sfe_ipv6_dentry,
 +					(u32 *)&ecm_sfe_ipv6_reject_acceleration_for_ipsec);
 #endif
 -	if (!debugfs_create_u32("no_action_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv6_dentry,
 -					(u32 *)&ecm_sfe_ipv6_no_action_limit_default)) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv6 no_action_limit_default file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("no_action_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv6_dentry,
 +					(u32 *)&ecm_sfe_ipv6_no_action_limit_default);
 -	if (!debugfs_create_u32("driver_fail_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv6_dentry,
 -					(u32 *)&ecm_sfe_ipv6_driver_fail_limit_default)) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv6 driver_fail_limit_default file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("driver_fail_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv6_dentry,
 +					(u32 *)&ecm_sfe_ipv6_driver_fail_limit_default);
 -	if (!debugfs_create_u32("nack_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv6_dentry,
 -					(u32 *)&ecm_sfe_ipv6_nack_limit_default)) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv6 nack_limit_default file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("nack_limit_default", S_IRUGO | S_IWUSR, ecm_sfe_ipv6_dentry,
 +					(u32 *)&ecm_sfe_ipv6_nack_limit_default);
 -	if (!debugfs_create_u32("accelerated_count", S_IRUGO, ecm_sfe_ipv6_dentry,
 -					(u32 *)&ecm_sfe_ipv6_accelerated_count)) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv6 accelerated_count file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("accelerated_count", S_IRUGO, ecm_sfe_ipv6_dentry,
 +					(u32 *)&ecm_sfe_ipv6_accelerated_count);
 -	if (!debugfs_create_u32("pending_accel_count", S_IRUGO, ecm_sfe_ipv6_dentry,
 -					(u32 *)&ecm_sfe_ipv6_pending_accel_count)) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv6 pending_accel_count file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("pending_accel_count", S_IRUGO, ecm_sfe_ipv6_dentry,
 +					(u32 *)&ecm_sfe_ipv6_pending_accel_count);
 -	if (!debugfs_create_u32("pending_decel_count", S_IRUGO, ecm_sfe_ipv6_dentry,
 -					(u32 *)&ecm_sfe_ipv6_pending_decel_count)) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv6 pending_decel_count file in debugfs\n");
 -		goto task_cleanup;
 -	}
 +	debugfs_create_u32("pending_decel_count", S_IRUGO, ecm_sfe_ipv6_dentry,
 +					(u32 *)&ecm_sfe_ipv6_pending_decel_count);
 	if (!debugfs_create_file("accel_limit_mode", S_IRUGO | S_IWUSR, ecm_sfe_ipv6_dentry,
 					NULL, &ecm_sfe_ipv6_accel_limit_mode_fops)) {
 --- a/frontends/sfe/ecm_sfe_non_ported_ipv4.c
 +++ b/frontends/sfe/ecm_sfe_non_ported_ipv4.c
@@ -2284,11 +2284,8 @@ done:
  */
 bool ecm_sfe_non_ported_ipv4_debugfs_init(struct dentry *dentry)
 {
 -	if (!debugfs_create_u32("non_ported_accelerated_count", S_IRUGO, dentry,
 -					(u32 *)&ecm_sfe_non_ported_ipv4_accelerated_count)) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv4 non_ported_accelerated_count file in debugfs\n");
 -		return false;
 -	}
 +	debugfs_create_u32("non_ported_accelerated_count", S_IRUGO, dentry,
 +					(u32 *)&ecm_sfe_non_ported_ipv4_accelerated_count);
 	return true;
 }
 --- a/frontends/sfe/ecm_sfe_non_ported_ipv6.c
 +++ b/frontends/sfe/ecm_sfe_non_ported_ipv6.c
@@ -2083,11 +2083,8 @@ done:
  */
 bool ecm_sfe_non_ported_ipv6_debugfs_init(struct dentry *dentry)
 {
 -	if (!debugfs_create_u32("non_ported_accelerated_count", S_IRUGO, dentry,
 -					(u32 *)&ecm_sfe_non_ported_ipv6_accelerated_count)) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv6 non_ported_accelerated_count file in debugfs\n");
 -		return false;
 -	}
 +	debugfs_create_u32("non_ported_accelerated_count", S_IRUGO, dentry,
 +					(u32 *)&ecm_sfe_non_ported_ipv6_accelerated_count);
 	return true;
 }
 --- a/frontends/sfe/ecm_sfe_ported_ipv4.c
 +++ b/frontends/sfe/ecm_sfe_ported_ipv4.c
@@ -2528,12 +2528,8 @@ bool ecm_sfe_ported_ipv4_debugfs_init(st
 		return false;
 	}
 -	if (!debugfs_create_u32("tcp_accelerated_count", S_IRUGO, dentry,
 -					&ecm_sfe_ported_ipv4_accelerated_count[ECM_SFE_PORTED_IPV4_PROTO_TCP])) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv4 tcp_accelerated_count file in debugfs\n");
 -		debugfs_remove(udp_dentry);
 -		return false;
 -	}
 +	debugfs_create_u32("tcp_accelerated_count", S_IRUGO, dentry,
 +					&ecm_sfe_ported_ipv4_accelerated_count[ECM_SFE_PORTED_IPV4_PROTO_TCP]);
 	return true;
 }
 --- a/frontends/sfe/ecm_sfe_ported_ipv6.c
 +++ b/frontends/sfe/ecm_sfe_ported_ipv6.c
@@ -2374,12 +2374,8 @@ bool ecm_sfe_ported_ipv6_debugfs_init(st
 		return false;
 	}
 -	if (!debugfs_create_u32("tcp_accelerated_count", S_IRUGO, dentry,
 -					&ecm_sfe_ported_ipv6_accelerated_count[ECM_SFE_PORTED_IPV6_PROTO_TCP])) {
 -		DEBUG_ERROR("Failed to create ecm sfe ipv6 tcp_accelerated_count file in debugfs\n");
 -		debugfs_remove(udp_dentry);
 -		return false;
 -	}
 +	debugfs_create_u32("tcp_accelerated_count", S_IRUGO, dentry,
 +					&ecm_sfe_ported_ipv6_accelerated_count[ECM_SFE_PORTED_IPV6_PROTO_TCP]);
 	return true;
 }
--- a/package/qca/nss/qca-nss-ecm-64/patches/003-rework-nfct-notification.patch
+++ b/package/qca/nss/qca-nss-ecm-64/patches/003-rework-nfct-notification.patch
@ -1,25 +0,0 @@
 --- a/ecm_conntrack_notifier.c
 +++ b/ecm_conntrack_notifier.c
@@ -421,7 +421,11 @@ int ecm_conntrack_notifier_init(struct d
 	/*
 	 * Eventing subsystem is available so we register a notifier hook to get fast notifications of expired connections
 	 */
 +#ifdef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
 +	result = nf_conntrack_register_chain_notifier(&init_net, &ecm_conntrack_notifier);
 +#else
 	result = nf_conntrack_register_notifier(&init_net, &ecm_conntrack_notifier);
 +#endif
 	if (result < 0) {
 		DEBUG_ERROR("Can't register nf notifier hook.\n");
 		debugfs_remove_recursive(ecm_conntrack_notifier_dentry);
@@ -439,7 +443,9 @@ EXPORT_SYMBOL(ecm_conntrack_notifier_ini
 void ecm_conntrack_notifier_exit(void)
 {
 	DEBUG_INFO("ECM Conntrack Notifier exit\n");
 -#ifdef CONFIG_NF_CONNTRACK_EVENTS
 +#ifdef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
 +	nf_conntrack_unregister_chain_notifier(&init_net, &ecm_conntrack_notifier);
 +#else
 	nf_conntrack_unregister_notifier(&init_net, &ecm_conntrack_notifier);
 #endif
 	/*
--- a/package/qca/nss/qca-nss-ecm-64/patches/004-More-compile-fixes.patch
+++ b/package/qca/nss/qca-nss-ecm-64/patches/004-More-compile-fixes.patch
@ -1,58 +0,0 @@
 From e6d701c0d454d841366c556b2ef07a5203ffb35d Mon Sep 17 00:00:00 2001
 From: Robert Marko <robimarko@gmail.com>
 Date: Fri, 21 May 2021 21:41:31 +0200
 Subject: [PATCH] More compile fixes
 More runtime compile fixes.
 Signed-off-by: Robert Marko <robimarko@gmail.com>
 ---
 frontends/nss/ecm_nss_ported_ipv4.c | 12 +++---------
 frontends/nss/ecm_nss_ported_ipv6.c | 12 +++---------
 2 files changed, 6 insertions(+), 18 deletions(-)
 diff --git a/frontends/nss/ecm_nss_ported_ipv4.c b/frontends/nss/ecm_nss_ported_ipv4.c
 index 3522f0f..7f5fcd1 100644
 --- a/frontends/nss/ecm_nss_ported_ipv4.c
 +++ b/frontends/nss/ecm_nss_ported_ipv4.c
@@ -2935,14 +2935,8 @@ done:
  */
 bool ecm_nss_ported_ipv4_debugfs_init(struct dentry *dentry)
 {
 -	struct dentry *udp_dentry;
 -
 -	udp_dentry = debugfs_create_u32("udp_accelerated_count", S_IRUGO, dentry,
 +	debugfs_create_u32("udp_accelerated_count", S_IRUGO, dentry,
 						&ecm_nss_ported_ipv4_accelerated_count[ECM_NSS_PORTED_IPV4_PROTO_UDP]);
 -	if (!udp_dentry) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv4 udp_accelerated_count file in debugfs\n");
 -		return false;
 -	}
 	debugfs_create_u32("tcp_accelerated_count", S_IRUGO, dentry,
 					&ecm_nss_ported_ipv4_accelerated_count[ECM_NSS_PORTED_IPV4_PROTO_TCP]);
 diff --git a/frontends/nss/ecm_nss_ported_ipv6.c b/frontends/nss/ecm_nss_ported_ipv6.c
 index f43ac95..e0f779c 100644
 --- a/frontends/nss/ecm_nss_ported_ipv6.c
 +++ b/frontends/nss/ecm_nss_ported_ipv6.c
 /*
  * ecm_nss_ported_ipv6_connection_callback()
@@ -2723,14 +2723,8 @@ done:
  */
 bool ecm_nss_ported_ipv6_debugfs_init(struct dentry *dentry)
 {
 -	struct dentry *udp_dentry;
 -
 -	udp_dentry = debugfs_create_u32("udp_accelerated_count", S_IRUGO, dentry,
 +	debugfs_create_u32("udp_accelerated_count", S_IRUGO, dentry,
 						&ecm_nss_ported_ipv6_accelerated_count[ECM_NSS_PORTED_IPV6_PROTO_UDP]);
 -	if (!udp_dentry) {
 -		DEBUG_ERROR("Failed to create ecm nss ipv6 udp_accelerated_count file in debugfs\n");
 -		return false;
 -	}
 	debugfs_create_u32("tcp_accelerated_count", S_IRUGO, dentry,
 					&ecm_nss_ported_ipv6_accelerated_count[ECM_NSS_PORTED_IPV6_PROTO_TCP]);
 -- 
 2.31.1
--- a/package/qca/nss/qca-nss-ecm-64/patches/005-resolve-high-load.patch
+++ b/package/qca/nss/qca-nss-ecm-64/patches/005-resolve-high-load.patch
@ -1,61 +0,0 @@
 From 6924b71ed809b37fffd74d6428a8ca83e5919746 Mon Sep 17 00:00:00 2001
 From: Dirk Buchwalder <buchwalder@posteo.de>
 Date: Sun, 27 Jun 2021 16:52:39 +0200
 Subject: [PATCH] qca-nss-ecm: resolve the cpu high load regarding ecm
 If using ECM, cpu load goes up (around 1.0) and stucks there.
 This is due to using uninterruptible sleep function,
 the patch changes this to interruptible sleep function.
 Signed-off-by: Dirk Buchwalder buchwalder@posteo.de
 ---
 frontends/nss/ecm_nss_ipv4.c | 4 ++--
 frontends/nss/ecm_nss_ipv6.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)
 diff --git a/frontends/nss/ecm_nss_ipv4.c b/frontends/nss/ecm_nss_ipv4.c
 index e00553c..94b39cd 100644
 --- a/frontends/nss/ecm_nss_ipv4.c
 +++ b/frontends/nss/ecm_nss_ipv4.c
@@ -2471,7 +2471,7 @@ static void ecm_nss_ipv4_stats_sync_req_work(struct work_struct *work)
 	}
 	spin_unlock_bh(&ecm_nss_ipv4_lock);
 -	usleep_range(ECM_NSS_IPV4_STATS_SYNC_UDELAY - 100, ECM_NSS_IPV4_STATS_SYNC_UDELAY);
 +	msleep_interruptible(ECM_NSS_IPV4_STATS_SYNC_UDELAY / 1000);
 	/*
 	 * If index is 0, we are starting a new round, but if we still have time remain
@@ -2485,7 +2485,7 @@ static void ecm_nss_ipv4_stats_sync_req_work(struct work_struct *work)
 		}
 		if (time_after(ecm_nss_ipv4_next_req_time, current_jiffies)) {
 -			msleep(jiffies_to_msecs(ecm_nss_ipv4_next_req_time - current_jiffies));
 +			msleep_interruptible(jiffies_to_msecs(ecm_nss_ipv4_next_req_time - current_jiffies));
 		}
 		ecm_nss_ipv4_roll_check_jiffies = jiffies;
 		ecm_nss_ipv4_next_req_time = ecm_nss_ipv4_roll_check_jiffies + ECM_NSS_IPV4_STATS_SYNC_PERIOD;
 diff --git a/frontends/nss/ecm_nss_ipv6.c b/frontends/nss/ecm_nss_ipv6.c
 index 82e739f..30af050 100644
 --- a/frontends/nss/ecm_nss_ipv6.c
 +++ b/frontends/nss/ecm_nss_ipv6.c
@@ -2210,7 +2210,7 @@ static void ecm_nss_ipv6_stats_sync_req_work(struct work_struct *work)
 	}
 	spin_unlock_bh(&ecm_nss_ipv6_lock);
 -	usleep_range(ECM_NSS_IPV6_STATS_SYNC_UDELAY - 100, ECM_NSS_IPV6_STATS_SYNC_UDELAY);
 +	msleep_interruptible(ECM_NSS_IPV6_STATS_SYNC_UDELAY / 1000);
 	/*
 	 * If index is 0, we are starting a new round, but if we still have time remain
@@ -2224,7 +2224,7 @@ static void ecm_nss_ipv6_stats_sync_req_work(struct work_struct *work)
 		}
 		if (time_after(ecm_nss_ipv6_next_req_time, current_jiffies)) {
 -			msleep(jiffies_to_msecs(ecm_nss_ipv6_next_req_time - current_jiffies));
 +			msleep_interruptible(jiffies_to_msecs(ecm_nss_ipv6_next_req_time - current_jiffies));
 		}
 		ecm_nss_ipv6_roll_check_jiffies = jiffies;
 		ecm_nss_ipv6_next_req_time = ecm_nss_ipv6_roll_check_jiffies + ECM_NSS_IPV6_STATS_SYNC_PERIOD;
 -- 
 2.31.1
--- a/package/qca/nss/qca-nss-ecm-64/patches/006-ecm_interface-switch-to-kernel_recvmsg-api.patch
+++ b/package/qca/nss/qca-nss-ecm-64/patches/006-ecm_interface-switch-to-kernel_recvmsg-api.patch
@ -1,40 +0,0 @@
 diff --git a/ecm_interface.c b/ecm_interface.c
 index b461456..6be872a 100644
 --- a/ecm_interface.c
 +++ b/ecm_interface.c
@@ -7493,9 +7493,13 @@
 static int ecm_interface_wifi_event_rx(struct socket *sock, struct sockaddr_nl *addr, unsigned char *buf, int len)
 {
 	struct msghdr msg;
 +#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0))
 	struct iovec  iov;
 	mm_segment_t oldfs;
 	int size;
 +#else
 +  struct kvec iov;
 +#endif
 	iov.iov_base = buf;
 	iov.iov_len  = len;
@@ -7505,9 +7509,10 @@
 	msg.msg_namelen = sizeof(struct sockaddr_nl);
 	msg.msg_control = NULL;
 	msg.msg_controllen = 0;
 -	iov_iter_init(&msg.msg_iter, READ, &iov, 1, 1);
 +#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0))
 	oldfs = get_fs();
 	set_fs(KERNEL_DS);
 +	iov_iter_init(&msg.msg_iter, READ, &iov, 1, 1);
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 7, 0))
 	size = sock_recvmsg(sock, &msg, len, msg.msg_flags);
 #else
@@ -7516,6 +7521,9 @@
 	set_fs(oldfs);
 	return size;
 +#else
 +   return kernel_recvmsg(sock, &msg, &iov, 1, iov.iov_len, 0);
 +#endif
 }
 /*
--- a/package/qca/nss/qca-nss-ecm-64/patches/007-treewide-rework-notifier-changes-for-5.15.patch
+++ b/package/qca/nss/qca-nss-ecm-64/patches/007-treewide-rework-notifier-changes-for-5.15.patch
@ -1,72 +0,0 @@
 From e9073363a50a25bddd96e808f04bcf56c45da4ac Mon Sep 17 00:00:00 2001
 From: Ansuel Smith <ansuelsmth@gmail.com>
 Date: Sun, 8 May 2022 18:19:47 +0200
 Subject: [PATCH 07/12] treewide: rework notifier changes for 5.15
 Rework notifier changes for 5.15 conntrack new implementation.
 Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
 ---
 ecm_conntrack_notifier.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)
 diff --git a/ecm_conntrack_notifier.c b/ecm_conntrack_notifier.c
 index 9c8a45e..9f2cdae 100644
 --- a/ecm_conntrack_notifier.c
 +++ b/ecm_conntrack_notifier.c
@@ -322,7 +322,7 @@ EXPORT_SYMBOL(ecm_conntrack_ipv4_event);
 #ifdef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
 static int ecm_conntrack_event(struct notifier_block *this, unsigned long events, void *ptr)
 #else
 -static int ecm_conntrack_event(unsigned int events, struct nf_ct_event *item)
 +static int ecm_conntrack_event(unsigned int events, const struct nf_ct_event *item)
 #endif
 {
 #ifdef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
@@ -388,7 +388,11 @@ static struct notifier_block ecm_conntrack_notifier = {
  *	Netfilter conntrack event system to monitor connection tracking changes
  */
 static struct nf_ct_event_notifier ecm_conntrack_notifier = {
 +#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0))
 	.fcn	= ecm_conntrack_event,
 +#else
 +	.ct_event	= ecm_conntrack_event,
 +#endif
 };
 #endif
 #endif
@@ -426,13 +430,19 @@ int ecm_conntrack_notifier_init(struct dentry *dentry)
 #ifdef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
 	result = nf_conntrack_register_chain_notifier(&init_net, &ecm_conntrack_notifier);
 #else
 +#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0))
 	result = nf_conntrack_register_notifier(&init_net, &ecm_conntrack_notifier);
 +#else
 +	nf_conntrack_register_notifier(&init_net, &ecm_conntrack_notifier);
 +#endif
 #endif
 +#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0))
 	if (result < 0) {
 		DEBUG_ERROR("Can't register nf notifier hook.\n");
 		debugfs_remove_recursive(ecm_conntrack_notifier_dentry);
 		return result;
 	}
 +#endif
 #endif
 	return 0;
@@ -448,7 +458,11 @@ void ecm_conntrack_notifier_exit(void)
 #ifdef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
 	nf_conntrack_unregister_chain_notifier(&init_net, &ecm_conntrack_notifier);
 #else
 +#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0))
 	nf_conntrack_unregister_notifier(&init_net, &ecm_conntrack_notifier);
 +#else
 +	nf_conntrack_unregister_notifier(&init_net);
 +#endif
 #endif
 	/*
 	 * Remove the debugfs files recursively.
 -- 
 2.34.1
--- a/package/qca/nss/qca-nss-ecm-64/patches/008-frontends-drop-use-of-static-be_liberal-and-no_windo.patch
+++ b/package/qca/nss/qca-nss-ecm-64/patches/008-frontends-drop-use-of-static-be_liberal-and-no_windo.patch
@ -1,156 +0,0 @@
 --- a/frontends/nss/ecm_nss_ported_ipv4.c
 +++ b/frontends/nss/ecm_nss_ported_ipv4.c
@@ -125,6 +125,7 @@
 static int ecm_nss_ported_ipv4_accelerated_count[ECM_NSS_PORTED_IPV4_PROTO_MAX] = {0};
 						/* Array of Number of TCP and UDP connections currently offloaded */
 + #if LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0)
 /*
  * Expose what should be a static flag in the TCP connection tracker.
  */
@@ -132,6 +133,7 @@
 extern int nf_ct_tcp_no_window_check;
 #endif
 extern int nf_ct_tcp_be_liberal;
 +#endif
 /*
  * ecm_nss_ported_ipv4_connection_callback()
@@ -372,6 +374,10 @@
 	uint8_t dest_mac_xlate[ETH_ALEN];
 	ecm_db_direction_t ecm_dir;
 	ecm_front_end_acceleration_mode_t result_mode;
 +#if LINUX_VERSION_CODE > KERNEL_VERSION(5, 12, 0)
 +	struct net *net = nf_ct_net(ct);
 +	struct nf_tcp_net *tn = nf_tcp_pernet(net);
 +#endif
 	DEBUG_CHECK_MAGIC(npci, ECM_NSS_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%px: magic failed", npci);
@@ -1236,9 +1242,17 @@
 			nircm->tcp_rule.return_end = ct->proto.tcp.seen[return_dir].td_end;
 			nircm->tcp_rule.return_max_end = ct->proto.tcp.seen[return_dir].td_maxend;
 #ifdef ECM_OPENWRT_SUPPORT
 +#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0)
 			if (nf_ct_tcp_be_liberal || nf_ct_tcp_no_window_check
 #else
 +			if (tn->tcp_be_liberal || tn->tcp_no_window_check
 +#endif
 +#else
 +#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0)
 			if (nf_ct_tcp_be_liberal
 +#else
 +			if (tn->tcp_be_liberal
 +#endif
 #endif
 					|| (ct->proto.tcp.seen[flow_dir].flags & IP_CT_TCP_FLAG_BE_LIBERAL)
 					|| (ct->proto.tcp.seen[return_dir].flags & IP_CT_TCP_FLAG_BE_LIBERAL)) {
 --- a/frontends/nss/ecm_nss_ported_ipv6.c
 +++ b/frontends/nss/ecm_nss_ported_ipv6.c
@@ -125,6 +125,7 @@
 static int ecm_nss_ported_ipv6_accelerated_count[ECM_NSS_PORTED_IPV6_PROTO_MAX] = {0};
 						/* Array of Number of TCP and UDP connections currently offloaded */
 +#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0)
 /*
  * Expose what should be a static flag in the TCP connection tracker.
  */
@@ -132,6 +133,7 @@
 extern int nf_ct_tcp_no_window_check;
 #endif
 extern int nf_ct_tcp_be_liberal;
 +#endif
 /*
  * ecm_nss_ported_ipv6_connection_callback()
@@ -376,6 +378,10 @@
 	ip_addr_t src_ip;
 	ip_addr_t dest_ip;
 	ecm_front_end_acceleration_mode_t result_mode;
 +#if LINUX_VERSION_CODE > KERNEL_VERSION(5, 12, 0)
 +	struct net *net = nf_ct_net(ct);
 +	struct nf_tcp_net *tn = nf_tcp_pernet(net);
 +#endif
 	DEBUG_CHECK_MAGIC(npci, ECM_NSS_PORTED_IPV6_CONNECTION_INSTANCE_MAGIC, "%px: magic failed", npci);
@@ -1162,9 +1168,17 @@
 			nircm->tcp_rule.return_end = ct->proto.tcp.seen[return_dir].td_end;
 			nircm->tcp_rule.return_max_end = ct->proto.tcp.seen[return_dir].td_maxend;
 #ifdef ECM_OPENWRT_SUPPORT
 +#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0)
 			if (nf_ct_tcp_be_liberal || nf_ct_tcp_no_window_check
 #else
 +			if (tn->tcp_be_liberal || tn->tcp_no_window_check
 +#endif
 +#else
 +#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0)
 			if (nf_ct_tcp_be_liberal
 +#else
 +			if (tn->tcp_be_liberal
 +#endif
 #endif
 					|| (ct->proto.tcp.seen[flow_dir].flags & IP_CT_TCP_FLAG_BE_LIBERAL)
 					|| (ct->proto.tcp.seen[return_dir].flags & IP_CT_TCP_FLAG_BE_LIBERAL)) {
 --- a/frontends/sfe/ecm_sfe_ported_ipv4.c
 +++ b/frontends/sfe/ecm_sfe_ported_ipv4.c
@@ -422,6 +422,10 @@
 	int32_t interface_type_counts[ECM_DB_IFACE_TYPE_COUNT];
 	bool rule_invalid;
 	ecm_db_direction_t ecm_dir;
 +#if LINUX_VERSION_CODE > KERNEL_VERSION(5, 12, 0)
 +	struct net *net = nf_ct_net(ct);
 +	struct nf_tcp_net *tn = nf_tcp_pernet(net);
 +#endif
 	ecm_front_end_acceleration_mode_t result_mode;
 	DEBUG_CHECK_MAGIC(npci, ECM_SFE_PORTED_IPV4_CONNECTION_INSTANCE_MAGIC, "%px: magic failed", npci);
@@ -1333,9 +1337,17 @@
 			nircm->tcp_rule.return_end = ct->proto.tcp.seen[return_dir].td_end;
 			nircm->tcp_rule.return_max_end = ct->proto.tcp.seen[return_dir].td_maxend;
 #ifdef ECM_OPENWRT_SUPPORT
 +#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0)
 			if (nf_ct_tcp_be_liberal || nf_ct_tcp_no_window_check
 #else
 +			if (tn->tcp_be_liberal || tn->tcp_no_window_check)
 +#endif
 +#else
 +#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0)
 			if (nf_ct_tcp_be_liberal
 +#else
 +			if (tn->tcp_be_liberal)
 +#endif
 #endif
 					|| (ct->proto.tcp.seen[flow_dir].flags & IP_CT_TCP_FLAG_BE_LIBERAL)
 					|| (ct->proto.tcp.seen[return_dir].flags & IP_CT_TCP_FLAG_BE_LIBERAL)) {
 --- a/frontends/sfe/ecm_sfe_ported_ipv6.c
 +++ b/frontends/sfe/ecm_sfe_ported_ipv6.c
@@ -426,6 +426,10 @@
 	int32_t interface_type_counts[ECM_DB_IFACE_TYPE_COUNT];
 	bool rule_invalid;
 	ip_addr_t src_ip;
 +#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0)
 +	struct net *net = nf_ct_net(ct);
 +	struct nf_tcp_net *tn = nf_tcp_pernet(net);
 +#endif
 	ip_addr_t dest_ip;
 	ecm_front_end_acceleration_mode_t result_mode;
@@ -1293,9 +1297,17 @@
 			nircm->tcp_rule.return_end = ct->proto.tcp.seen[return_dir].td_end;
 			nircm->tcp_rule.return_max_end = ct->proto.tcp.seen[return_dir].td_maxend;
 #ifdef ECM_OPENWRT_SUPPORT
 +#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0)
 			if (nf_ct_tcp_be_liberal || nf_ct_tcp_no_window_check
 #else
 +			if (tn->tcp_be_liberal || tn->tcp_no_window_check)
 +#endif
 +#else
 +#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0)
 			if (nf_ct_tcp_be_liberal
 +#else
 +			if (tn->tcp_be_liberal)
 +#endif
 #endif
 					|| (ct->proto.tcp.seen[flow_dir].flags & IP_CT_TCP_FLAG_BE_LIBERAL)
 					|| (ct->proto.tcp.seen[return_dir].flags & IP_CT_TCP_FLAG_BE_LIBERAL)) {
--- a/package/qca/nss/qca-nss-ecm-64/patches/009-ecm_tracker_datagram-drop-static-for-EXPORT_SYMBOL.patch
+++ b/package/qca/nss/qca-nss-ecm-64/patches/009-ecm_tracker_datagram-drop-static-for-EXPORT_SYMBOL.patch
@ -1,55 +0,0 @@
 From 9827d8597545ecfee17eba7b08d48dbcdf55c614 Mon Sep 17 00:00:00 2001
 From: Ansuel Smith <ansuelsmth@gmail.com>
 Date: Sun, 8 May 2022 18:39:39 +0200
 Subject: [PATCH 09/12] ecm_tracker_datagram: drop static for EXPORT_SYMBOL
 EXPORT_SYMBOL should NOT be static
 Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
 ---
 ecm_tracker_datagram.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
 diff --git a/ecm_tracker_datagram.c b/ecm_tracker_datagram.c
 index 9c04d73..ae14146 100644
 --- a/ecm_tracker_datagram.c
 +++ b/ecm_tracker_datagram.c
@@ -203,7 +203,7 @@ static void ecm_tracker_datagram_datagram_discard(struct ecm_tracker_datagram_in
  * ecm_tracker_datagram_discard_all()
  *	Discard all tracked data
  */
 -static void ecm_tracker_datagram_discard_all(struct ecm_tracker_datagram_internal_instance *dtii)
 +void ecm_tracker_datagram_discard_all(struct ecm_tracker_datagram_internal_instance *dtii)
 {
 	int32_t src_count;
 	int32_t dest_count;
@@ -364,7 +364,7 @@ static void ecm_tracker_datagram_datagram_discard_callback(struct ecm_tracker_in
  * ecm_tracker_datagram_datagram_size_get()
  *	Return size in bytes of datagram at index i that was sent to the target
  */
 -static int32_t ecm_tracker_datagram_datagram_size_get(struct ecm_tracker_datagram_instance *uti, ecm_tracker_sender_type_t sender, int32_t i)
 +int32_t ecm_tracker_datagram_datagram_size_get(struct ecm_tracker_datagram_instance *uti, ecm_tracker_sender_type_t sender, int32_t i)
 {
 	struct ecm_tracker_datagram_internal_instance *dtii = (struct ecm_tracker_datagram_internal_instance *)uti;
@@ -412,7 +412,7 @@ static int32_t ecm_tracker_datagram_datagram_size_get_callback(struct ecm_tracke
  * ecm_tracker_datagram_datagram_read()
  *	Read size bytes from datagram at index i into the buffer
  */
 -static int ecm_tracker_datagram_datagram_read(struct ecm_tracker_datagram_instance *uti, ecm_tracker_sender_type_t sender, int32_t i, int32_t offset, int32_t size, void *buffer)
 +int ecm_tracker_datagram_datagram_read(struct ecm_tracker_datagram_instance *uti, ecm_tracker_sender_type_t sender, int32_t i, int32_t offset, int32_t size, void *buffer)
 {
 	struct ecm_tracker_datagram_internal_instance *dtii = (struct ecm_tracker_datagram_internal_instance *)uti;
 	int res;
@@ -466,7 +466,7 @@ static int ecm_tracker_datagram_datagram_read_callback(struct ecm_tracker_instan
  * ecm_tracker_datagram_datagram_add()
  *	Append the datagram onto the tracker queue for the given target
  */
 -static bool ecm_tracker_datagram_datagram_add(struct ecm_tracker_datagram_instance *uti, ecm_tracker_sender_type_t sender, struct sk_buff *skb)
 +bool ecm_tracker_datagram_datagram_add(struct ecm_tracker_datagram_instance *uti, ecm_tracker_sender_type_t sender, struct sk_buff *skb)
 {
 	struct ecm_tracker_datagram_internal_instance *dtii = (struct ecm_tracker_datagram_internal_instance *)uti;
 	struct sk_buff *skbc;
 -- 
 2.34.1
--- a/package/qca/nss/qca-nss-ecm-64/patches/010-frontends-drop-udp_get_timeouts-and-use-standard-ups.patch
+++ b/package/qca/nss/qca-nss-ecm-64/patches/010-frontends-drop-udp_get_timeouts-and-use-standard-ups.patch
@ -1,74 +0,0 @@
 From ef638a84405c9f6556a9d7c257ccbba74efd228e Mon Sep 17 00:00:00 2001
 From: Ansuel Smith <ansuelsmth@gmail.com>
 Date: Sat, 14 May 2022 20:15:10 +0200
 Subject: [PATCH 10/12] frontends: drop udp_get_timeouts and use standard
 upstream api
 Drop udp_get_timeouts and use nf_udp_pernet and ->timeoutrs
 instead or relying on a downstream api not present upstream.
 ---
 frontends/nss/ecm_nss_ipv4.c | 3 ++-
 frontends/nss/ecm_nss_ipv6.c | 3 ++-
 frontends/sfe/ecm_sfe_ipv4.c | 3 ++-
 frontends/sfe/ecm_sfe_ipv6.c | 3 ++-
 4 files changed, 8 insertions(+), 4 deletions(-)
 diff --git a/frontends/nss/ecm_nss_ipv4.c b/frontends/nss/ecm_nss_ipv4.c
 index 719a747..558819a 100644
 --- a/frontends/nss/ecm_nss_ipv4.c
 +++ b/frontends/nss/ecm_nss_ipv4.c
@@ -607,7 +607,8 @@ sync_conntrack:
 #else
 				timeouts = nf_ct_timeout_lookup(ct);
 				if (!timeouts) {
 -					timeouts = udp_get_timeouts(nf_ct_net(ct));
 +					struct nf_udp_net *un = nf_udp_pernet(nf_ct_net(ct));
 +					timeouts = un->timeouts;
 				}
 				spin_lock_bh(&ct->lock);
 diff --git a/frontends/nss/ecm_nss_ipv6.c b/frontends/nss/ecm_nss_ipv6.c
 index 67ee364..51eb069 100644
 --- a/frontends/nss/ecm_nss_ipv6.c
 +++ b/frontends/nss/ecm_nss_ipv6.c
@@ -586,7 +586,8 @@ sync_conntrack:
 #else
 				timeouts = nf_ct_timeout_lookup(ct);
 				if (!timeouts) {
 -					timeouts = udp_get_timeouts(nf_ct_net(ct));
 +					struct nf_udp_net *un = nf_udp_pernet(nf_ct_net(ct));
 +					timeouts = un->timeouts;
 				}
 				spin_lock_bh(&ct->lock);
 diff --git a/frontends/sfe/ecm_sfe_ipv4.c b/frontends/sfe/ecm_sfe_ipv4.c
 index 3f30821..931af5d 100644
 --- a/frontends/sfe/ecm_sfe_ipv4.c
 +++ b/frontends/sfe/ecm_sfe_ipv4.c
@@ -527,7 +527,8 @@ sync_conntrack:
 #else
 				timeouts = nf_ct_timeout_lookup(ct);
 				if (!timeouts) {
 -					timeouts = udp_get_timeouts(nf_ct_net(ct));
 +					struct nf_udp_net *un = nf_udp_pernet(nf_ct_net(ct));
 +					timeouts = un->timeouts;
 				}
 				spin_lock_bh(&ct->lock);
 diff --git a/frontends/sfe/ecm_sfe_ipv6.c b/frontends/sfe/ecm_sfe_ipv6.c
 index 54fdbf3..63d8888 100644
 --- a/frontends/sfe/ecm_sfe_ipv6.c
 +++ b/frontends/sfe/ecm_sfe_ipv6.c
@@ -516,7 +516,8 @@ sync_conntrack:
 #else
 				timeouts = nf_ct_timeout_lookup(ct);
 				if (!timeouts) {
 -					timeouts = udp_get_timeouts(nf_ct_net(ct));
 +					struct nf_udp_net *un = nf_udp_pernet(nf_ct_net(ct));
 +					timeouts = un->timeouts;
 				}
 				spin_lock_bh(&ct->lock);
 -- 
 2.34.1
--- a/package/qca/nss/qca-nss-ecm-64/patches/901-qca-nss-ecm-fix-a-memcpy-overflow-in-ecm_db.patch
+++ b/package/qca/nss/qca-nss-ecm-64/patches/901-qca-nss-ecm-fix-a-memcpy-overflow-in-ecm_db.patch
@ -1,67 +0,0 @@
 From 1958e34c4c1b8b4fb62eba693fbd7693536947b9 Mon Sep 17 00:00:00 2001
 From: flebourse <francis.lebourse@sfr.fr>
 Date: Thu, 23 Dec 2021 16:11:06 +0100
 Subject: [PATCH] qca-nss-ecm: fix a memcpy overflow in ecm_db
 Calls to ipv6_addr_prefix() trigger a memcpy overflow if the prefix len
 argument is greater than 128, cap it at this value.
 stack bactrace:
 detected buffer overflow in memcpy
 Kernel BUG at fortify_panic+0x20/0x24
 Internal error: Oops - BUG: 0 [#1] SMP
 CPU: 2 PID: 2592 Comm: netifd Not tainted 5.10.80 #0
 Hardware name: Xiaomi AX9000 (DT)
 Call trace:
 fortify_panic+0x20/0x24
 ecm_db_exit+0x42c/0x49c [ecm]
 ecm_db_exit+0x464/0x49c [ecm]
 atomic_notifier_call_chain+0x5c/0x90
 ip6_route_add+0x13c/0x1a4
 inet6_rtm_newroute+0x98/0xa0
 rtnetlink_rcv_msg+0x10c/0x34c
 netlink_rcv_skb+0x5c/0x130
 rtnetlink_rcv+0x1c/0x2c
 netlink_unicast+0x1ec/0x2e0
 netlink_sendmsg+0x1a4/0x394
 ____sys_sendmsg+0x270/0x2b4
 ___sys_sendmsg+0x7c/0xc0
 __sys_sendmsg+0x5c/0xb0
 __arm64_sys_sendmsg+0x28/0x34
 el0_svc_common.constprop.0+0x88/0x190
 do_el0_svc+0x74/0x94
 el0_svc+0x14/0x20
 el0_sync_handler+0xa8/0x130
 el0_sync+0x184/0x1c0
 Code: aa0003e1 912b4040 910003fd 97fff56c (d4210000)
 Signed-off-By: Francis Le Bourse <francis.lebourse@sfr.fr>
 ---
 ecm_db/ecm_db.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/ecm_db/ecm_db.c b/ecm_db/ecm_db.c
 index c6f408d..df04afd 100644
 --- a/ecm_db/ecm_db.c
 +++ b/ecm_db/ecm_db.c
@@ -298,7 +298,7 @@ static int ecm_db_ipv6_route_table_update_event(struct notifier_block *nb,
 		 * Compute ECM connection's prefix destination address by masking it with the
 		 * route config's destination address prefix length.
 		 */
 -		ipv6_addr_prefix(&prefix_addr, &ecm_in6, cfg->fc_dst_len);
 +		ipv6_addr_prefix(&prefix_addr, &ecm_in6, min(128, cfg->fc_dst_len));
 		DEBUG_TRACE("dest addr prefix: %pI6 prefix_len: %d ecm_in6: %pI6\n", &prefix_addr, cfg->fc_dst_len, &ecm_in6);
@@ -326,7 +326,7 @@ static int ecm_db_ipv6_route_table_update_event(struct notifier_block *nb,
 			 * Compute ECM connection's prefix source address by masking it with the
 			 * route config's destination address prefix length.
 			 */
 -			ipv6_addr_prefix(&prefix_addr, &ecm_in6, cfg->fc_dst_len);
 +			ipv6_addr_prefix(&prefix_addr, &ecm_in6, min(128, cfg->fc_dst_len));
 			DEBUG_TRACE("src addr prefix: %pI6 prefix_len: %d ecm_in6: %pI6\n", &prefix_addr, cfg->fc_dst_len, &ecm_in6);
 -- 
 2.1.4
--- a/package/qca/nss/qca-nss-ecm/Makefile
+++ b/package/qca/nss/qca-nss-ecm/Makefile
@ -1,278 +0,0 @@
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 PKG_NAME:=qca-nss-ecm
 PKG_RELEASE:=1
 PKG_SOURCE_URL:=https://git.codelinaro.org/clo/qsdk/oss/lklm/qca-nss-ecm.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_VERSION:=9228212b4238c0d8c296f795948ede8f2ca0242e
 PKG_MIRROR_HASH:=02fe4c86c8c88fb15704b1b253ab756a2658f24ce5db64a7909cb60bf9c1cdff
 LOCAL_VARIANT=$(patsubst qca-nss-ecm-%,%,$(patsubst qca-nss-ecm-%,%,$(BUILD_VARIANT)))
 include $(INCLUDE_DIR)/package.mk
 ifeq ($(CONFIG_QCA_NSS_ECM_EXAMPLES_PCC),y)
       FILES_EXAMPLES=$(PKG_BUILD_DIR)/examples/ecm_pcc_test.ko
 endif
 ifeq ($(CONFIG_QCA_NSS_ECM_EXAMPLES_MARK),y)
       FILES_EXAMPLES+=$(PKG_BUILD_DIR)/examples/ecm_mark_test.ko
 endif
 #Explicitly enable OVS external module, if ovsmgr is enabled.
 ifneq ($(CONFIG_PACKAGE_kmod-qca-ovsmgr),)
 CONFIG_QCA_NSS_ECM_OVS=y
 endif
 ifeq ($(CONFIG_QCA_NSS_ECM_OVS),y)
       FILES_EXAMPLES+=$(PKG_BUILD_DIR)/examples/ecm_ovs.ko
 endif
 define KernelPackage/qca-nss-ecm/Default
  SECTION:=kernel
  CATEGORY:=Kernel modules
  SUBMENU:=Network Support
  DEPENDS:=+TARGET_ipq806x:kmod-qca-nss-drv \
 	+TARGET_ipq_ipq806x:kmod-qca-nss-drv \
 	+TARGET_ipq_ipq807x:kmod-qca-nss-drv \
 	+TARGET_ipq_ipq807x_64:kmod-qca-nss-drv \
 	+TARGET_ipq807x:kmod-qca-nss-drv \
 	+TARGET_ipq807x_64:kmod-qca-nss-drv \
 	+TARGET_ipq_ipq60xx:kmod-qca-nss-drv \
 	+TARGET_ipq_ipq60xx_64:kmod-qca-nss-drv \
 	+TARGET_ipq_ipq50xx:kmod-qca-nss-drv \
 	+TARGET_ipq_ipq50xx_64:kmod-qca-nss-drv \
 	+iptables-mod-extra +kmod-ipt-conntrack \
 	+kmod-pppoe @LINUX_5_4 \
 	+kmod-ipsec
  TITLE:=QCA NSS Enhanced Connection Manager (ECM)
  FILES:=$(PKG_BUILD_DIR)/*.ko $(FILES_EXAMPLES)
  KCONFIG:=CONFIG_BRIDGE_NETFILTER=y \
 	CONFIG_NF_CONNTRACK_EVENTS=y \
 	CONFIG_NF_CONNTRACK_CHAIN_EVENTS=y \
 	CONFIG_NF_CONNTRACK_DSCPREMARK_EXT=y
  MENU:=1
  PROVIDES:=kmod-qca-nss-ecm
 endef
 define KernelPackage/qca-nss-ecm/Description/Default
 This package contains the QCA NSS Enhanced Connection Manager
 endef
 define KernelPackage/qca-nss-ecm/Default/install
 	$(INSTALL_DIR) $(1)/etc/firewall.d $(1)/etc/init.d $(1)/usr/bin $(1)/lib/netifd/offload $(1)/etc/config $(1)/etc/uci-defaults $(1)/etc/sysctl.d
 	$(INSTALL_DATA) ./files/qca-nss-ecm.firewall $(1)/etc/firewall.d/qca-nss-ecm
 	$(INSTALL_BIN) ./files/qca-nss-ecm.init $(1)/etc/init.d/qca-nss-ecm
 	$(INSTALL_BIN) ./files/ecm_dump.sh $(1)/usr/bin/
 	$(INSTALL_BIN) ./files/on-demand-down $(1)/lib/netifd/offload/on-demand-down
 	$(INSTALL_DATA) ./files/qca-nss-ecm.uci $(1)/etc/config/ecm
 	$(INSTALL_DATA) ./files/qca-nss-ecm.defaults $(1)/etc/uci-defaults/99-qca-nss-ecm
 	$(INSTALL_BIN) ./files/qca-nss-ecm.sysctl $(1)/etc/sysctl.d/qca-nss-ecm.conf
 ifeq ($(CONFIG_KERNEL_IPQ_MEM_PROFILE),256)
 	echo 'net.netfilter.nf_conntrack_max=2048' >> $(1)/etc/sysctl.d/qca-nss-ecm.conf
 endif
 ifeq ($(CONFIG_KERNEL_IPQ_MEM_PROFILE),512)
 	echo 'net.netfilter.nf_conntrack_max=8192' >> $(1)/etc/sysctl.d/qca-nss-ecm.conf
 endif
 endef
 define KernelPackage/qca-nss-ecm-standard
  $(call KernelPackage/qca-nss-ecm/Default)
  VARIANT:=standard
  DEPENDS+=+PACKAGE_kmod-qca-mcs:kmod-qca-mcs
 endef
 define KernelPackage/qca-nss-ecm-standard/Description
  $(call KernelPackage/qca-nss-ecm/Description/Default)
 endef
 define KernelPackage/qca-nss-ecm-standard/install
 $(call KernelPackage/qca-nss-ecm/Default/install, $(1))
 endef
 # Variant with additional features enabled for premium profile
 define KernelPackage/qca-nss-ecm-premium/Default
 $(call KernelPackage/qca-nss-ecm/Default)
  TITLE+= (with premium features)
  VARIANT:=premium
  DEPENDS+=+kmod-nat46 \
 	+kmod-l2tp +kmod-pppol2tp +kmod-pptp \
 	+kmod-bonding
 endef
 define KernelPackage/qca-nss-ecm-premium/Description/Default
 $(call KernelPackage/qca-nss-ecm/Description/Default)
 with the premium features enabled
 endef
 define KernelPackage/qca-nss-ecm-premium/Default/install
 $(call KernelPackage/qca-nss-ecm/install)
 endef
 define KernelPackage/qca-nss-ecm-premium
 $(call KernelPackage/qca-nss-ecm-premium/Default)
 endef
 define KernelPackage/qca-nss-ecm-premium/Description
 $(call KernelPackage/qca-nss-ecm-premium/Description/Default)
 endef
 define KernelPackage/qca-nss-ecm-premium/install
 $(call KernelPackage/qca-nss-ecm-standard/install, $(1))
 endef
 # Variant with additional features enabled for noload profile
 define KernelPackage/qca-nss-ecm-noload
  $(call KernelPackage/qca-nss-ecm/Default)
  TITLE+= (with noload features)
  PROVIDES:=kmod-qca-nss-ecm
  VARIANT:=noload
  DEPENDS+=+kmod-l2tp +kmod-pppol2tp +kmod-pptp \
 	   +kmod-bonding
 endef
 define KernelPackage/qca-nss-ecm-noload/Description
  $(call KernelPackage/qca-nss-ecm/Description/Default)
  When selected, this package installs the driver but does not load it at init.
 endef
 define KernelPackage/qca-nss-ecm-noload/install
 $(call KernelPackage/qca-nss-ecm/Default/install, $(1))
 	#
 	# Remove the START line from the init script, so that the symlink
 	# in the /etc/rc.d directory is not created.
 	#
 	sed -i '/START=/d' $(1)/etc/init.d/qca-nss-ecm
 endef
 define KernelPackage/qca-nss-ecm-premium-noload
  $(call KernelPackage/qca-nss-ecm-premium/Default)
  PROVIDES:=kmod-qca-nss-ecm-premium
 endef
 define KernelPackage/qca-nss-ecm-premium-noload/Description
  $(call KernelPackage/qca-nss-ecm-premium/Description/Default)
  When selected, this package installs the driver but does not load it at init.
 endef
 define KernelPackage/qca-nss-ecm-premium-noload/install
 $(call KernelPackage/qca-nss-ecm-premium/Default/install, $(1))
 endef
 define Build/InstallDev/qca-nss-ecm
 	$(INSTALL_DIR) $(1)/usr/include/qca-nss-ecm
 	$(CP) $(PKG_BUILD_DIR)/exports/* $(1)/usr/include/qca-nss-ecm/
 endef
 define Build/InstallDev
 	$(call Build/InstallDev/qca-nss-ecm,$(1))
 endef
 EXTRA_CFLAGS+= \
 	-I$(STAGING_DIR)/usr/include/hyfibr \
 	-I$(STAGING_DIR)/usr/include/qca-mcs \
 	-I$(STAGING_DIR)/usr/include/qca-nss-drv \
 	-I$(STAGING_DIR)/usr/include/shortcut-fe \
 	-I$(STAGING_DIR)/usr/include/nat46
 ECM_MAKE_OPTS:=ECM_CLASSIFIER_HYFI_ENABLE=y
 ifneq ($(LOCAL_VARIANT),standard)
 ECM_MAKE_OPTS+=ECM_MULTICAST_ENABLE=y \
 		ECM_INTERFACE_IPSEC_ENABLE=y \
 		# ECM_INTERFACE_PPTP_ENABLE=y \
 		ECM_INTERFACE_L2TPV2_ENABLE=y \
 		ECM_INTERFACE_GRE_TAP_ENABLE=y \
 		ECM_INTERFACE_GRE_TUN_ENABLE=y \
 		ECM_INTERFACE_SIT_ENABLE=y \
 		ECM_INTERFACE_TUNIPIP6_ENABLE=y \
 		ECM_INTERFACE_RAWIP_ENABLE=y
 ifeq ($(CONFIG_TARGET_ipq_ipq40xx)$(CONFIG_TARGET_ipq40xx),)
 ECM_MAKE_OPTS+=ECM_INTERFACE_BOND_ENABLE=y
 endif
 endif
 ifeq ($(filter $(CONFIG_KERNEL_IPQ_MEM_PROFILE), 256),)
 ECM_MAKE_OPTS+=ECM_XFRM_ENABLE=y
 endif
 # ifneq ($(CONFIG_PACKAGE_kmod-nat46),)
 # ECM_MAKE_OPTS+=ECM_INTERFACE_MAP_T_ENABLE=y
 # endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-mcs),)
 ECM_MAKE_OPTS+=ECM_MULTICAST_ENABLE=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-ovpn-link),)
 ECM_MAKE_OPTS+=ECM_INTERFACE_OVPN_ENABLE=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-vxlanmgr),)
 ECM_MAKE_OPTS+=ECM_INTERFACE_VXLAN_ENABLE=y
 endif
 ifneq ($(CONFIG_PACKAGE_kmod-qca-ovsmgr),)
 ECM_MAKE_OPTS+=ECM_INTERFACE_OVS_BRIDGE_ENABLE=y \
 		ECM_CLASSIFIER_OVS_ENABLE=y
 EXTRA_CFLAGS+= -I$(STAGING_DIR)/usr/include/qca-ovsmgr
 endif
 # Keeping default as ipq806x for branches that does not have subtarget framework
 ifeq ($(CONFIG_TARGET_ipq),y)
 subtarget:=$(SUBTARGET)
 else
 subtarget:=$(CONFIG_TARGET_BOARD)
 endif
 define Build/InstallDev
 	$(INSTALL_DIR) $(1)/usr/include/qca-nss-ecm
 	$(CP) $(PKG_BUILD_DIR)/exports/* $(1)/usr/include/qca-nss-ecm
 endef
 define Build/Compile
 	$(MAKE) $(PKG_JOBS) -C "$(LINUX_DIR)" $(strip $(ECM_MAKE_OPTS)) \
 		$(KERNEL_MAKE_FLAGS) \
 		$(PKG_MAKE_FLAGS) \
 		M="$(PKG_BUILD_DIR)" \
 		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" SoC="$(subtarget)" \
 		EXAMPLES_BUILD_PCC="$(CONFIG_QCA_NSS_ECM_EXAMPLES_PCC)" \
 		EXAMPLES_BUILD_MARK="$(CONFIG_QCA_NSS_ECM_EXAMPLES_MARK)" \
 		EXAMPLES_BUILD_OVS="$(CONFIG_QCA_NSS_ECM_OVS)" \
 		ECM_FRONT_END_SFE_ENABLE="$(CONFIG_QCA_ECM_SFE_SUPPORT)" \
 		modules
 endef
 define KernelPackage/qca-nss-ecm-premium/config
 menu "ECM Configuration"
  depends on PACKAGE_kmod_qca-nss-ecm-premium
 	config QCA_NSS_ECM_EXAMPLES_PCC
 		bool "Build PCC usage example"
 		help
 			Selecting this will build the PCC classifier usage example module.
 		default n
 	config QCA_NSS_ECM_EXAMPLES_MARK
 		bool "Build Mark classifier usage example"
 		help
 			Selecting this will build the Mark classifier usage example module.
 		default n
 	config QCA_NSS_ECM_OVS
 		bool "Build OVS classifier external module"
 		help
 			Selecting this will build the OVS classifier external module.
 		default n
 	config QCA_ECM_SFE_SUPPORT
 		bool "Add SFE support to ECM driver"
 		default n
 endmenu
 endef
 $(eval $(call KernelPackage,qca-nss-ecm-noload))
 $(eval $(call KernelPackage,qca-nss-ecm-standard))
 $(eval $(call KernelPackage,qca-nss-ecm-premium-noload))
 $(eval $(call KernelPackage,qca-nss-ecm-premium))
--- a/package/qca/nss/qca-nss-ecm/files/ecm_dump.sh
+++ b/package/qca/nss/qca-nss-ecm/files/ecm_dump.sh
@ -1,95 +0,0 @@
 #!/bin/sh
 #
 # Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #
 ECM_MODULE=${1:-ecm_state}
 MOUNT_ROOT=/dev/ecm
 #
 # usage: ecm_dump.sh [module=ecm_db]
 #
 # with no parameters, ecm_dump.sh will attempt to mount the
 # ecm_db state file and cat its contents.
 #
 # example with a parameter: ecm_dump.sh ecm_classifier_default
 #
 # this will cause ecm_dump to attempt to find and mount the state
 # file for the ecm_classifier_default module, and if successful
 # cat the contents.
 #
 # this is one of the state files, which happens to be the
 # last module started in ecm
 ECM_STATE=/sys/kernel/debug/ecm/ecm_state/state_dev_major
 # tests to see if ECM is up and ready to receive commands.
 # returns 0 if ECM is fully up and ready, else 1
 ecm_is_ready() {
 	if [ ! -e "${ECM_STATE}" ]
 	then
 		return 1
 	fi
 	return 0
 }
 #
 # module_state_mount(module_name)
 #      Mounts the state file of the module, if supported
 #
 module_state_mount() {
 	local module_name=$1
 	local mount_dir=$2
 	local state_file="/sys/kernel/debug/ecm/${module_name}/state_dev_major"
 	if [ -e "${mount_dir}/${module_name}" ]
 	then
 		# already mounted
 		return 0
 	fi
 	#echo "Mount state file for $module_name ..."
 	if [ ! -e "$state_file" ]
 	then
 		#echo "... $module_name does not support state"
 		return 1
 	fi
 	local major="`cat $state_file`"
 	#echo "... Mounting state $state_file with major: $major"
 	mknod "${mount_dir}/${module_name}" c $major 0
 }
 #
 # main
 #
 ecm_is_ready || {
 	#echo "ECM is not running"
 	exit 1
 }
 # all state files are mounted under MOUNT_ROOT, so make sure it exists
 mkdir -p ${MOUNT_ROOT}
 #
 # attempt to mount state files for the requested module and cat it
 # if the mount succeeded
 #
 module_state_mount ${ECM_MODULE} ${MOUNT_ROOT} && {
 	cat ${MOUNT_ROOT}/${ECM_MODULE}
 	exit 0
 }
 exit 2
--- a/package/qca/nss/qca-nss-ecm/files/on-demand-down
+++ b/package/qca/nss/qca-nss-ecm/files/on-demand-down
@ -1,6 +0,0 @@
 #!/bin/sh
 # Copyright (c) 2016 The Linux Foundation. All rights reserved.
 [ -e "/sys/kernel/debug/ecm/ecm_db/defunct_all" ] && {
 	echo 1 > /sys/kernel/debug/ecm/ecm_db/defunct_all
 }
--- a/package/qca/nss/qca-nss-ecm/files/qca-nss-ecm.defaults
+++ b/package/qca/nss/qca-nss-ecm/files/qca-nss-ecm.defaults
@ -1,28 +0,0 @@
 #!/bin/sh
 #
 # Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #
 uci -q batch << EOF
 	delete firewall.qcanssecm
 	set firewall.qcanssecm=include
 	set firewall.qcanssecm.type=script
 	set firewall.qcanssecm.path=/etc/firewall.d/qca-nss-ecm
 	set firewall.qcanssecm.family=any
 	set firewall.qcanssecm.reload=1
 	commit firewall
 EOF
 exit 0
--- a/package/qca/nss/qca-nss-ecm/files/qca-nss-ecm.firewall
+++ b/package/qca/nss/qca-nss-ecm/files/qca-nss-ecm.firewall
@ -1,18 +0,0 @@
 #!/bin/sh
 #
 # Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #
 iptables -A FORWARD -m physdev --physdev-is-bridged -j ACCEPT
--- a/package/qca/nss/qca-nss-ecm/files/qca-nss-ecm.init
+++ b/package/qca/nss/qca-nss-ecm/files/qca-nss-ecm.init
@ -1,133 +0,0 @@
 #!/bin/sh  /etc/rc.common
 #
 # Copyright (c) 2014, 2019 The Linux Foundation. All rights reserved.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 # The shebang above has an extra space intentially to avoid having
 # openwrt build scripts automatically enable this package starting
 # at boot.
 START=19
 get_front_end_mode() {
 	config_load "ecm"
 	config_get front_end global acceleration_engine "auto"
 	case $front_end in
 	auto)
 		echo '0'
 		;;
 	nss)
 		echo '1'
 		;;
 	sfe)
 		echo '2'
 		;;
 	*)
 		echo 'uci_option_acceleration_engine is invalid'
 	esac
 }
 support_bridge() {
 	#NSS support bridge acceleration
 	[ -d /sys/kernel/debug/ecm/ecm_nss_ipv4 ] && return 0
 	#SFE doesn't support bridge acceleration
 	[ -d /sys/kernel/debug/ecm/ecm_sfe_ipv4 ] && return 1
 }
 load_sfe() {
 	local kernel_version=$(uname -r)
 	[ -e "/lib/modules/$kernel_version/shortcut-fe.ko" ] && {
 		[ -d /sys/module/shortcut_fe ] || insmod shortcut-fe
 	}
 	[ -e "/lib/modules/$kernel_version/shortcut-fe-ipv6.ko" ] && {
 		[ -d /sys/module/shortcut_fe_ipv6 ] || insmod shortcut-fe-ipv6
 	}
 	[ -e "/lib/modules/$kernel_version/shortcut-fe-cm.ko" ] && {
 		[ -d /sys/module/shortcut_fe_cm ] || insmod shortcut-fe-cm
 	}
 	[ -e "/lib/modules/$kernel_version/shortcut-fe-drv.ko" ] && {
 		[ -d /sys/module/shortcut_fe_drv ] || insmod shortcut-fe-drv
 	}
 }
 load_ecm() {
 	[ -d /sys/module/ecm ] || {
 		[ ! -e /proc/device-tree/MP_256 ] && load_sfe
 		insmod ecm front_end_selection=$(get_front_end_mode)
 	}
 	support_bridge && {
 		sysctl -w net.bridge.bridge-nf-call-ip6tables=1
 		sysctl -w net.bridge.bridge-nf-call-iptables=1
 	}
 }
 unload_ecm() {
 	sysctl -w net.bridge.bridge-nf-call-ip6tables=0
 	sysctl -w net.bridge.bridge-nf-call-iptables=0
 	if [ -d /sys/module/ecm ]; then
 		#
 		# Stop ECM frontends
 		#
 		echo 1 > /sys/kernel/debug/ecm/front_end_ipv4_stop
 		echo 1 > /sys/kernel/debug/ecm/front_end_ipv6_stop
 		#
 		# Defunct the connections
 		#
 	        echo 1 > /sys/kernel/debug/ecm/ecm_db/defunct_all
 		sleep 5;
 		rmmod ecm
 		sleep 1
 	fi
 }
 start() {
 	load_ecm
 	# If the acceleration engine is NSS, enable wifi redirect.
 	[ -d /sys/kernel/debug/ecm/ecm_nss_ipv4 ] && sysctl -w dev.nss.general.redirect=1
 	support_bridge && {
 		echo 'net.bridge.bridge-nf-call-ip6tables=1' >> /etc/sysctl.d/qca-nss-ecm.conf
 		echo 'net.bridge.bridge-nf-call-iptables=1' >> /etc/sysctl.d/qca-nss-ecm.conf
 	}
 	if [ -d /sys/module/qca_ovsmgr ]; then
 		insmod ecm_ovs
 	fi
 }
 stop() {
 	# If the acceleration engine is NSS, disable wifi redirect.
 	[ -d /sys/kernel/debug/ecm/ecm_nss_ipv4 ] && sysctl -w dev.nss.general.redirect=0
 	sed '/net.bridge.bridge-nf-call-ip6tables=1/d' -i /etc/sysctl.d/qca-nss-ecm.conf
 	sed '/net.bridge.bridge-nf-call-iptables=1/d' -i /etc/sysctl.d/qca-nss-ecm.conf
 	if [ -d /sys/module/ecm_ovs ]; then
 		rmmod ecm_ovs
 	fi
 	unload_ecm
 }
--- a/package/qca/nss/qca-nss-ecm/files/qca-nss-ecm.sysctl
+++ b/package/qca/nss/qca-nss-ecm/files/qca-nss-ecm.sysctl
@ -1,2 +0,0 @@
 # nf_conntrack_tcp_no_window_check is 0 by default, set it to 1
 net.netfilter.nf_conntrack_tcp_no_window_check=1
--- a/package/qca/nss/qca-nss-ecm/files/qca-nss-ecm.uci
+++ b/package/qca/nss/qca-nss-ecm/files/qca-nss-ecm.uci
@ -1,2 +0,0 @@
 config ecm 'global'
 	option acceleration_engine 'auto'
--- a/package/qca/nss/qca-nss-ecm/patches/001-Drop_SFE_from_ecm.patch
+++ b/package/qca/nss/qca-nss-ecm/patches/001-Drop_SFE_from_ecm.patch
@ -1,12 +0,0 @@
 --- a/Makefile
 +++ b/Makefile
@@ -66,8 +66,7 @@ endif
 # Define ECM_FRONT_END_SFE_ENABLE=y in order to select
 # sfe as ECM's front end.
 # #############################################################################
 -ifeq ($(SoC),$(filter $(SoC),ipq806x ipq40xx))
 -ECM_FRONT_END_SFE_ENABLE=y
 +ifeq ($(ECM_FRONT_END_SFE_ENABLE), y)
 ecm-$(ECM_FRONT_END_SFE_ENABLE) += frontends/sfe/ecm_sfe_ipv4.o
 ecm-$(ECM_FRONT_END_SFE_ENABLE) += frontends/sfe/ecm_sfe_ported_ipv4.o
 ccflags-$(ECM_FRONT_END_SFE_ENABLE) += -DECM_FRONT_END_SFE_ENABLE
--- a/package/qca/nss/qca-nss-ecm/patches/100-kernel-5.4-support.patch
+++ b/package/qca/nss/qca-nss-ecm/patches/100-kernel-5.4-support.patch
--- a/package/qca/nss/qca-nss-ecm/patches/101-Fix_Kern_Panic_on_UDP_CONNTRACK.patch
+++ b/package/qca/nss/qca-nss-ecm/patches/101-Fix_Kern_Panic_on_UDP_CONNTRACK.patch
@ -1,60 +0,0 @@
 diff --git a/frontends/nss/ecm_nss_ipv4.c b/frontends/nss/ecm_nss_ipv4.c
 index 1ce4b61..29e70ba 100644
 --- a/frontends/nss/ecm_nss_ipv4.c
 +++ b/frontends/nss/ecm_nss_ipv4.c
@@ -2171,6 +2171,10 @@ sync_conntrack:
 				timeouts = nf_ct_timeout_lookup(ct);
 +				/* Copy of udp_get_timeouts in kernel */
 +				if (!timeouts)
 +					timeouts = nf_udp_pernet(nf_ct_net(ct))->timeouts;
 +
 				spin_lock_bh(&ct->lock);
 				ct->timeout = jiffies + timeouts[UDP_CT_REPLIED];
 				spin_unlock_bh(&ct->lock);
 diff --git a/frontends/nss/ecm_nss_ipv6.c b/frontends/nss/ecm_nss_ipv6.c
 index 2adc5ec..08253b6 100644
 --- a/frontends/nss/ecm_nss_ipv6.c
 +++ b/frontends/nss/ecm_nss_ipv6.c
@@ -1883,6 +1883,10 @@ sync_conntrack:
 				timeouts = nf_ct_timeout_lookup(ct);
 +				/* Copy of udp_get_timeouts in kernel */
 +				if (!timeouts)
 +					timeouts = nf_udp_pernet(nf_ct_net(ct))->timeouts;
 +
 				spin_lock_bh(&ct->lock);
 				ct->timeout = jiffies + timeouts[UDP_CT_REPLIED];
 				spin_unlock_bh(&ct->lock);
 diff --git a/frontends/sfe/ecm_sfe_ipv4.c b/frontends/sfe/ecm_sfe_ipv4.c
 index 7cfe4fc..8f525ee 100644
 --- a/frontends/sfe/ecm_sfe_ipv4.c
 +++ b/frontends/sfe/ecm_sfe_ipv4.c
@@ -1608,6 +1608,10 @@ sync_conntrack:
 				timeouts = nf_ct_timeout_lookup(ct);
 +				/* Copy of udp_get_timeouts in kernel */
 +				if (!timeouts)
 +					timeouts = nf_udp_pernet(nf_ct_net(ct))->timeouts;
 +
 				spin_lock_bh(&ct->lock);
 				ct->timeout = jiffies + timeouts[UDP_CT_REPLIED];
 				spin_unlock_bh(&ct->lock);
 diff --git a/frontends/sfe/ecm_sfe_ipv6.c b/frontends/sfe/ecm_sfe_ipv6.c
 index dfde309..47c531a 100644
 --- a/frontends/sfe/ecm_sfe_ipv6.c
 +++ b/frontends/sfe/ecm_sfe_ipv6.c
@@ -1321,6 +1321,10 @@ sync_conntrack:
 				timeouts = nf_ct_timeout_lookup(ct);
 +				/* Copy of udp_get_timeouts in kernel */
 +				if (!timeouts)
 +					timeouts = nf_udp_pernet(nf_ct_net(ct))->timeouts;
 +
 				spin_lock_bh(&ct->lock);
 				ct->timeout = jiffies + timeouts[UDP_CT_REPLIED];
 				spin_unlock_bh(&ct->lock);
--- a/package/qca/nss/qca-nss-ecm/patches/200-resolve-high-load.patch
+++ b/package/qca/nss/qca-nss-ecm/patches/200-resolve-high-load.patch
@ -1,44 +0,0 @@
 The sync update work queue tasks is calling uninterruptible sleep function, which is
 causing high CPU load.  Changed to interruptible sleep function.  The stats update
 task should be interruptible.
 --- a/frontends/nss/ecm_nss_ipv4.c
 +++ b.frontends/nss/ecm_nss_ipv4.c
@@ -2411,7 +2411,7 @@ static void ecm_nss_ipv4_stats_sync_req_
 	}
 	spin_unlock_bh(&ecm_nss_ipv4_lock);
 -	usleep_range(ECM_NSS_IPV4_STATS_SYNC_UDELAY - 100, ECM_NSS_IPV4_STATS_SYNC_UDELAY);
 +	msleep_interruptible(ECM_NSS_IPV4_STATS_SYNC_UDELAY / 1000);
 	/*
 	 * If index is 0, we are starting a new round, but if we still have time remain
@@ -2425,7 +2425,7 @@ static void ecm_nss_ipv4_stats_sync_req_
 		}
 		if (ecm_nss_ipv4_next_req_time > current_jiffies) {
 -			msleep(jiffies_to_msecs(ecm_nss_ipv4_next_req_time - current_jiffies));
 +			msleep_interruptible(jiffies_to_msecs(ecm_nss_ipv4_next_req_time - current_jiffies));
 		}
 		ecm_nss_ipv4_roll_check_jiffies = jiffies;
 		ecm_nss_ipv4_next_req_time = ecm_nss_ipv4_roll_check_jiffies + ECM_NSS_IPV4_STATS_SYNC_PERIOD;
 --- a/frontends/nss/ecm_nss_ipv6.c
 +++ b.frontends/nss/ecm_nss_ipv6.c
@@ -2128,7 +2128,7 @@ static void ecm_nss_ipv6_stats_sync_req_
 	}
 	spin_unlock_bh(&ecm_nss_ipv6_lock);
 -	usleep_range(ECM_NSS_IPV6_STATS_SYNC_UDELAY - 100, ECM_NSS_IPV6_STATS_SYNC_UDELAY);
 +	msleep_interruptible(ECM_NSS_IPV6_STATS_SYNC_UDELAY / 1000);
 	/*
 	 * If index is 0, we are starting a new round, but if we still have time remain
@@ -2142,7 +2142,7 @@ static void ecm_nss_ipv6_stats_sync_req_
 		}
 		if (ecm_nss_ipv6_next_req_time > current_jiffies) {
 -			msleep(jiffies_to_msecs(ecm_nss_ipv6_next_req_time - current_jiffies));
 +			msleep_interruptible(jiffies_to_msecs(ecm_nss_ipv6_next_req_time - current_jiffies));
 		}
 		ecm_nss_ipv6_roll_check_jiffies = jiffies;
 		ecm_nss_ipv6_next_req_time = ecm_nss_ipv6_roll_check_jiffies + ECM_NSS_IPV6_STATS_SYNC_PERIOD;
--- a/package/qca/nss/qca-nss-ecm/patches/203-rework-nfct-notification.patch
+++ b/package/qca/nss/qca-nss-ecm/patches/203-rework-nfct-notification.patch
@ -1,20 +0,0 @@
 --- a/ecm_conntrack_notifier.c
 +++ b/ecm_conntrack_notifier.c
@@ -411,7 +411,7 @@ int ecm_conntrack_notifier_init(struct d
 	/*
 	 * Eventing subsystem is available so we register a notifier hook to get fast notifications of expired connections
 	 */
 -	result = nf_conntrack_register_notifier(&init_net, &ecm_conntrack_notifier);
 +	result = nf_conntrack_register_chain_notifier(&init_net, &ecm_conntrack_notifier);
 	if (result < 0) {
 		DEBUG_ERROR("Can't register nf notifier hook.\n");
 		debugfs_remove_recursive(ecm_conntrack_notifier_dentry);
@@ -430,7 +430,7 @@ void ecm_conntrack_notifier_exit(void)
 {
 	DEBUG_INFO("ECM Conntrack Notifier exit\n");
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 -	nf_conntrack_unregister_notifier(&init_net, &ecm_conntrack_notifier);
 +	nf_conntrack_unregister_chain_notifier(&init_net, &ecm_conntrack_notifier);
 #endif
 	/*
 	 * Remove the debugfs files recursively.
--- a/package/qca/nss/qca-nss-ecm/patches/400-Check-TCP_UDP-conntrack-state-earlier.patch
+++ b/package/qca/nss/qca-nss-ecm/patches/400-Check-TCP_UDP-conntrack-state-earlier.patch
@ -1,236 +0,0 @@
 From 90cace88a342e77ee8ca1e961cf7b7a7930d4c89 Mon Sep 17 00:00:00 2001
 From: Murat Sezgin <msezgin@codeaurora.org>
 Date: Mon, 9 Mar 2020 12:51:03 -0700
 Subject: [qca-nss-ecm] Check TCP/UDP conntrack state earlier
 Check the conntrack state before processing the flow
 and adding it to the database. The unconfirmed
 connections can be changed after the confirmation.
 Changed the TCP tracker connection state matrix to set the
 state of the connection as ESTABLISHED when any of the src or
 dest side is set as ESTABLISHED. With this change ECM will not
 handle the SYN and SYN-ACK packets of the TCP handshake. Only the
 ACK and FIN flaged packets will be used during the creation and
 closing the connection respectively.
 Signed-off-by: Murat Sezgin <msezgin@codeaurora.org>
 Change-Id: I3e0a58d604df4c6a85478ca9c05f24d50cd8c894
 ---
 ecm_classifier_default.c            | 36 ++++++++----------------------------
 ecm_tracker_tcp.c                   |  4 ++--
 frontends/nss/ecm_nss_ported_ipv4.c | 17 +++++++++++++++++
 frontends/nss/ecm_nss_ported_ipv6.c | 17 +++++++++++++++++
 frontends/sfe/ecm_sfe_ported_ipv4.c | 17 +++++++++++++++++
 frontends/sfe/ecm_sfe_ported_ipv6.c | 17 +++++++++++++++++
 6 files changed, 78 insertions(+), 30 deletions(-)
 diff --git a/ecm_classifier_default.c b/ecm_classifier_default.c
 index 22c4bec..d04cdfa 100644
 --- a/ecm_classifier_default.c
 +++ b/ecm_classifier_default.c
@@ -1,6 +1,6 @@
 /*
  **************************************************************************
 - * Copyright (c) 2014-2016, The Linux Foundation.  All rights reserved.
 + * Copyright (c) 2014-2016, 2020, The Linux Foundation.  All rights reserved.
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
  * above copyright notice and this permission notice appear in all copies.
@@ -285,12 +285,12 @@ static void ecm_classifier_default_process(struct ecm_classifier_instance *aci,
 	}
 	/*
 -	 * Check the TCP connection state.
 +	 * Check the TCP connection state, when the ct is NULL.
 +	 * ct valid case was already checked in the ecm_nss{sfe}_ported_ipv4{6}_process functions.
 	 * If we are not established then we deny acceleration.
 -	 * Take lead from conntrack if exists.
 	 */
 	ct = nf_ct_get(skb, &ctinfo);
 -	if (ct == NULL) {
 +	if (!ct) {
 		DEBUG_TRACE("%p: No Conntrack found for packet, using ECM tracker state\n", cdii);
 		if (unlikely(prevailing_state != ECM_TRACKER_CONNECTION_STATE_ESTABLISHED)) {
 			cdii->process_response.accel_mode = ECM_CLASSIFIER_ACCELERATION_MODE_NO;
@@ -298,29 +298,10 @@ static void ecm_classifier_default_process(struct ecm_classifier_instance *aci,
 		}
 	} else {
 		/*
 -		 * Unconfirmed connection may be dropped by Linux at the final step,
 -		 * So we don't allow acceleration for the unconfirmed connections.
 -		 */
 -		if (!nf_ct_is_confirmed(ct)) {
 -			DEBUG_TRACE("%p: Unconfirmed connection\n", ct);
 -			cdii->process_response.accel_mode = ECM_CLASSIFIER_ACCELERATION_MODE_NO;
 -			goto return_response;
 -		}
 -
 -		/*
 -		 * Don't try to manage a non-established connection.
 -		 */
 -		if (!test_bit(IPS_ASSURED_BIT, &ct->status)) {
 -			DEBUG_TRACE("%p: Non-established connection\n", ct);
 -			cdii->process_response.accel_mode = ECM_CLASSIFIER_ACCELERATION_MODE_NO;
 -			goto return_response;
 -		}
 -
 -		/*
 -		 * If the connection is shutting down do not manage it.
 -		 * state can not be SYN_SENT, SYN_RECV because connection is assured
 -		 * Not managed states: FIN_WAIT, CLOSE_WAIT, LAST_ACK, TIME_WAIT, CLOSE.
 -		 */
 +		* If the connection is shutting down do not manage it.
 +		* state can not be SYN_SENT, SYN_RECV because connection is assured
 +		* Not managed states: FIN_WAIT, CLOSE_WAIT, LAST_ACK, TIME_WAIT, CLOSE.
 +		*/
 		spin_lock_bh(&ct->lock);
 		if (ct->proto.tcp.state != TCP_CONNTRACK_ESTABLISHED) {
 			spin_unlock_bh(&ct->lock);
@@ -333,7 +314,6 @@ static void ecm_classifier_default_process(struct ecm_classifier_instance *aci,
 return_response:
 	;
 -
 	/*
 	 * Return the process response
 	 */
 diff --git a/ecm_tracker_tcp.c b/ecm_tracker_tcp.c
 index f073c36..e5b327a 100644
 --- a/ecm_tracker_tcp.c
 +++ b/ecm_tracker_tcp.c
@@ -257,9 +257,9 @@ static  DEFINE_SPINLOCK(ecm_tracker_tcp_lock);	/* Global lock for the tracker gl
  */
 static ecm_tracker_connection_state_t ecm_tracker_tcp_connection_state_matrix[ECM_TRACKER_SENDER_STATE_MAX][ECM_TRACKER_SENDER_STATE_MAX] =
 {	/* 			Unknown						Establishing					Established					Closing					Closed					Fault */
 -	/* Unknown */		{ECM_TRACKER_CONNECTION_STATE_ESTABLISHING,	ECM_TRACKER_CONNECTION_STATE_ESTABLISHING,	ECM_TRACKER_CONNECTION_STATE_ESTABLISHING,	ECM_TRACKER_CONNECTION_STATE_FAULT,	ECM_TRACKER_CONNECTION_STATE_FAULT,	ECM_TRACKER_CONNECTION_STATE_FAULT},
 +	/* Unknown */		{ECM_TRACKER_CONNECTION_STATE_ESTABLISHING,	ECM_TRACKER_CONNECTION_STATE_ESTABLISHING,	ECM_TRACKER_CONNECTION_STATE_ESTABLISHED,	ECM_TRACKER_CONNECTION_STATE_FAULT,	ECM_TRACKER_CONNECTION_STATE_FAULT,	ECM_TRACKER_CONNECTION_STATE_FAULT},
 	/* Establishing */	{ECM_TRACKER_CONNECTION_STATE_ESTABLISHING,	ECM_TRACKER_CONNECTION_STATE_ESTABLISHING,	ECM_TRACKER_CONNECTION_STATE_ESTABLISHING,	ECM_TRACKER_CONNECTION_STATE_FAULT,	ECM_TRACKER_CONNECTION_STATE_FAULT,	ECM_TRACKER_CONNECTION_STATE_FAULT},
 -	/* Established */	{ECM_TRACKER_CONNECTION_STATE_ESTABLISHING,	ECM_TRACKER_CONNECTION_STATE_ESTABLISHING,	ECM_TRACKER_CONNECTION_STATE_ESTABLISHED,	ECM_TRACKER_CONNECTION_STATE_CLOSING,	ECM_TRACKER_CONNECTION_STATE_CLOSING,	ECM_TRACKER_CONNECTION_STATE_FAULT},
 +	/* Established */	{ECM_TRACKER_CONNECTION_STATE_ESTABLISHED,	ECM_TRACKER_CONNECTION_STATE_ESTABLISHING,	ECM_TRACKER_CONNECTION_STATE_ESTABLISHED,	ECM_TRACKER_CONNECTION_STATE_CLOSING,	ECM_TRACKER_CONNECTION_STATE_CLOSING,	ECM_TRACKER_CONNECTION_STATE_FAULT},
 	/* Closing */		{ECM_TRACKER_CONNECTION_STATE_FAULT,		ECM_TRACKER_CONNECTION_STATE_FAULT,		ECM_TRACKER_CONNECTION_STATE_CLOSING,		ECM_TRACKER_CONNECTION_STATE_CLOSING,	ECM_TRACKER_CONNECTION_STATE_CLOSING,	ECM_TRACKER_CONNECTION_STATE_FAULT},
 	/* Closed */		{ECM_TRACKER_CONNECTION_STATE_FAULT,		ECM_TRACKER_CONNECTION_STATE_FAULT,		ECM_TRACKER_CONNECTION_STATE_CLOSING,		ECM_TRACKER_CONNECTION_STATE_CLOSING,	ECM_TRACKER_CONNECTION_STATE_CLOSED, 	ECM_TRACKER_CONNECTION_STATE_FAULT},
 	/* Fault */		{ECM_TRACKER_CONNECTION_STATE_FAULT,		ECM_TRACKER_CONNECTION_STATE_FAULT,		ECM_TRACKER_CONNECTION_STATE_FAULT,		ECM_TRACKER_CONNECTION_STATE_FAULT,	ECM_TRACKER_CONNECTION_STATE_FAULT,	ECM_TRACKER_CONNECTION_STATE_FAULT},
 diff --git a/frontends/nss/ecm_nss_ported_ipv4.c b/frontends/nss/ecm_nss_ported_ipv4.c
 index 1435ec0..34c056f 100644
 --- a/frontends/nss/ecm_nss_ported_ipv4.c
 +++ b/frontends/nss/ecm_nss_ported_ipv4.c
@@ -2002,8 +2002,25 @@ unsigned int ecm_nss_ported_ipv4_process(struct net_device *out_dev, struct net_
 	int protocol = (int)orig_tuple->dst.protonum;
 	__be16 *layer4hdr = NULL;
 +	/*
 +	 * Unconfirmed connection may be dropped by Linux at the final step,
 +	 * So we don't allow acceleration for the unconfirmed connections.
 +	 */
 +	if (likely(ct) && !nf_ct_is_confirmed(ct)) {
 +		DEBUG_WARN("%p: Unconfirmed connection\n", ct);
 +		return NF_ACCEPT;
 +	}
 +
 	if (protocol == IPPROTO_TCP) {
 		/*
 +		 * Don't try to manage a non-established connection.
 +		 */
 +		if (likely(ct) && !test_bit(IPS_ASSURED_BIT, &ct->status)) {
 +			DEBUG_WARN("%p: Non-established TCP connection\n", ct);
 +			return NF_ACCEPT;
 +		}
 +
 +		/*
 		 * Extract TCP header to obtain port information
 		 */
 		tcp_hdr = ecm_tracker_tcp_check_header_and_read(skb, iph, &tcp_hdr_buff);
 diff --git a/frontends/nss/ecm_nss_ported_ipv6.c b/frontends/nss/ecm_nss_ported_ipv6.c
 index 4c154a6..bd6349b 100644
 --- a/frontends/nss/ecm_nss_ported_ipv6.c
 +++ b/frontends/nss/ecm_nss_ported_ipv6.c
@@ -1914,8 +1914,25 @@ unsigned int ecm_nss_ported_ipv6_process(struct net_device *out_dev,
 	int protocol = (int)orig_tuple->dst.protonum;
 	__be16 *layer4hdr = NULL;
 +	/*
 +	 * Unconfirmed connection may be dropped by Linux at the final step,
 +	 * So we don't allow acceleration for the unconfirmed connections.
 +	 */
 +	if (likely(ct) && !nf_ct_is_confirmed(ct)) {
 +		DEBUG_WARN("%p: Unconfirmed connection\n", ct);
 +		return NF_ACCEPT;
 +	}
 +
 	if (protocol == IPPROTO_TCP) {
 		/*
 +		 * Don't try to manage a non-established connection.
 +		 */
 +		if (likely(ct) && !test_bit(IPS_ASSURED_BIT, &ct->status)) {
 +			DEBUG_WARN("%p: Non-established TCP connection\n", ct);
 +			return NF_ACCEPT;
 +		}
 +
 +		/*
 		 * Extract TCP header to obtain port information
 		 */
 		tcp_hdr = ecm_tracker_tcp_check_header_and_read(skb, iph, &tcp_hdr_buff);
 diff --git a/frontends/sfe/ecm_sfe_ported_ipv4.c b/frontends/sfe/ecm_sfe_ported_ipv4.c
 index e034cde..df1ce57 100644
 --- a/frontends/sfe/ecm_sfe_ported_ipv4.c
 +++ b/frontends/sfe/ecm_sfe_ported_ipv4.c
@@ -1805,8 +1805,25 @@ unsigned int ecm_sfe_ported_ipv4_process(struct net_device *out_dev, struct net_
 	int protocol = (int)orig_tuple->dst.protonum;
 	__be16 *layer4hdr = NULL;
 +	/*
 +	 * Unconfirmed connection may be dropped by Linux at the final step,
 +	 * So we don't allow acceleration for the unconfirmed connections.
 +	 */
 +	if (likely(ct) && !nf_ct_is_confirmed(ct)) {
 +		DEBUG_WARN("%p: Unconfirmed connection\n", ct);
 +		return NF_ACCEPT;
 +	}
 +
 	if (protocol == IPPROTO_TCP) {
 		/*
 +		 * Don't try to manage a non-established connection.
 +		 */
 +		if (likely(ct) && !test_bit(IPS_ASSURED_BIT, &ct->status)) {
 +			DEBUG_WARN("%p: Non-established TCP connection\n", ct);
 +			return NF_ACCEPT;
 +		}
 +
 +		/*
 		 * Extract TCP header to obtain port information
 		 */
 		tcp_hdr = ecm_tracker_tcp_check_header_and_read(skb, iph, &tcp_hdr_buff);
 diff --git a/frontends/sfe/ecm_sfe_ported_ipv6.c b/frontends/sfe/ecm_sfe_ported_ipv6.c
 index 6ac05ad..657a1c7 100644
 --- a/frontends/sfe/ecm_sfe_ported_ipv6.c
 +++ b/frontends/sfe/ecm_sfe_ported_ipv6.c
@@ -1746,8 +1746,25 @@ unsigned int ecm_sfe_ported_ipv6_process(struct net_device *out_dev,
 	int protocol = (int)orig_tuple->dst.protonum;
 	__be16 *layer4hdr = NULL;
 +	/*
 +	 * Unconfirmed connection may be dropped by Linux at the final step,
 +	 * So we don't allow acceleration for the unconfirmed connections.
 +	 */
 +	if (likely(ct) && !nf_ct_is_confirmed(ct)) {
 +		DEBUG_WARN("%p: Unconfirmed connection\n", ct);
 +		return NF_ACCEPT;
 +	}
 +
 	if (protocol == IPPROTO_TCP) {
 		/*
 +		 * Don't try to manage a non-established connection.
 +		 */
 +		if (likely(ct) && !test_bit(IPS_ASSURED_BIT, &ct->status)) {
 +			DEBUG_WARN("%p: Non-established TCP connection\n", ct);
 +			return NF_ACCEPT;
 +		}
 +
 +		/*
 		 * Extract TCP header to obtain port information
 		 */
 		tcp_hdr = ecm_tracker_tcp_check_header_and_read(skb, iph, &tcp_hdr_buff);
 -- 
 cgit v1.1
--- a/package/qca/nss/qca-nss-ecm/patches/401-Fix-NSS-stats-request-roll-over-issue.patch
+++ b/package/qca/nss/qca-nss-ecm/patches/401-Fix-NSS-stats-request-roll-over-issue.patch
@ -1,52 +0,0 @@
 From 9ad19ffdcfdf77baf3abd4fcc933fd3dc8e791a5 Mon Sep 17 00:00:00 2001
 From: Murat Sezgin <msezgin@codeaurora.org>
 Date: Sat, 20 Jun 2020 09:41:01 -0700
 Subject: [qca-nss-ecm] Fix NSS stats request roll over issue
 Use the correct timer API to check the next request time
 when jiffies wrap happens.
 Signed-off-by: Murat Sezgin <msezgin@codeaurora.org>
 Change-Id: I18646d28df7e17daeff2986dfe4bd73866d47668
 ---
 frontends/nss/ecm_nss_ipv4.c | 4 ++--
 frontends/nss/ecm_nss_ipv6.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)
 diff --git a/frontends/nss/ecm_nss_ipv4.c b/frontends/nss/ecm_nss_ipv4.c
 index 3eaf5d8..80e1aee 100644
 --- a/frontends/nss/ecm_nss_ipv4.c
 +++ b/frontends/nss/ecm_nss_ipv4.c
@@ -2421,10 +2421,10 @@ static void ecm_nss_ipv4_stats_sync_req_work(struct work_struct *work)
 		current_jiffies = jiffies;
 		if (time_is_after_jiffies(ecm_nss_ipv4_roll_check_jiffies))  {
 -			ecm_nss_ipv4_next_req_time = 0;
 +			ecm_nss_ipv4_next_req_time = jiffies + ECM_NSS_IPV4_STATS_SYNC_PERIOD;
 		}
 -		if (ecm_nss_ipv4_next_req_time > current_jiffies) {
 +		if (time_after(ecm_nss_ipv4_next_req_time, current_jiffies)) {
 			msleep_interruptible(jiffies_to_msecs(ecm_nss_ipv4_next_req_time - current_jiffies));
 		}
 		ecm_nss_ipv4_roll_check_jiffies = jiffies;
 diff --git a/frontends/nss/ecm_nss_ipv6.c b/frontends/nss/ecm_nss_ipv6.c
 index 288dc55..483421e 100644
 --- a/frontends/nss/ecm_nss_ipv6.c
 +++ b/frontends/nss/ecm_nss_ipv6.c
@@ -2135,10 +2135,10 @@ static void ecm_nss_ipv6_stats_sync_req_work(struct work_struct *work)
 		current_jiffies = jiffies;
 		if (time_is_after_jiffies(ecm_nss_ipv6_roll_check_jiffies))  {
 -			ecm_nss_ipv6_next_req_time = 0;
 +			ecm_nss_ipv6_next_req_time = jiffies + ECM_NSS_IPV6_STATS_SYNC_PERIOD;
 		}
 -		if (ecm_nss_ipv6_next_req_time > current_jiffies) {
 +		if (time_after(ecm_nss_ipv6_next_req_time, current_jiffies)) {
 			msleep_interruptible(jiffies_to_msecs(ecm_nss_ipv6_next_req_time - current_jiffies));
 		}
 		ecm_nss_ipv6_roll_check_jiffies = jiffies;
 -- 
 cgit v1.1
--- a/package/qca/nss/qca-nss-ecm/patches/401-Fix-for-ref-leak-during-multicast.patch
+++ b/package/qca/nss/qca-nss-ecm/patches/401-Fix-for-ref-leak-during-multicast.patch
@ -1,112 +0,0 @@
 From 4b41703a181b7187d9ff8cb744eb96d09997387c Mon Sep 17 00:00:00 2001
 From: Suman Ghosh <sumaghos@codeaurora.org>
 Date: Wed, 19 Feb 2020 15:09:19 +0530
 Subject: [qca-nss-ecm] Fix for ref leak during multicast 'to' hierarchy
 creation
 Change-Id: I89df9dbe5ea054cf3b87d55ce68a751cb1d6c24f
 Signed-off-by: Suman Ghosh <sumaghos@codeaurora.org>
 ---
 ecm_interface.c | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)
 diff --git a/ecm_interface.c b/ecm_interface.c
 index 4f7a886..2a0ca5b 100644
 --- a/ecm_interface.c
 +++ b/ecm_interface.c
@@ -3885,13 +3885,13 @@ int32_t ecm_interface_multicast_heirarchy_construct_routed(struct ecm_front_end_
 		dest_dev = dev_get_by_index(&init_net, *dst_if_index);
 		if (!dest_dev) {
 			if (!src_dev_is_bridge) {
 -				int i;
 -
 				/*
 				 * If already constructed any interface heirarchies before hitting
 				 * this error condition then Deref all interface heirarchies.
 				 */
 				if (valid_if > 0) {
 +					int i;
 +
 					for (i = 0; i < valid_if; i++) {
 						ifaces = ecm_db_multicast_if_heirarchy_get(interfaces, i);
 						ecm_db_multicast_copy_if_heirarchy(to_list_single, ifaces);
@@ -3902,11 +3902,14 @@ int32_t ecm_interface_multicast_heirarchy_construct_routed(struct ecm_front_end_
 				/*
 				 * If valid netdev not found, Return 0
 				 */
 +				if (br_dev_src) {
 +					dev_put(br_dev_src);
 +				}
 +
 				return 0;
 			}
 			dest_dev = br_dev_src;
 -
 		}
 		dest_dev_type = dest_dev->type;
@@ -3945,6 +3948,10 @@ int32_t ecm_interface_multicast_heirarchy_construct_routed(struct ecm_front_end_
 					}
 				}
 +				if (br_dev_src && (dest_dev != br_dev_src)) {
 +					dev_put(br_dev_src);
 +				}
 +
 				dev_put(dest_dev);
 				return 0;
 			}
@@ -3972,6 +3979,10 @@ int32_t ecm_interface_multicast_heirarchy_construct_routed(struct ecm_front_end_
 						ecm_db_connection_interfaces_deref(to_list_single, interface_first_base[i]);
 					}
 +					if (br_dev_src && (dest_dev != br_dev_src)) {
 +						dev_put(br_dev_src);
 +					}
 +
 					dev_put(dest_dev);
 					dev_put(mc_br_slave_dev);
 					return 0;
@@ -3997,6 +4008,10 @@ int32_t ecm_interface_multicast_heirarchy_construct_routed(struct ecm_front_end_
 						}
 					}
 +					if (br_dev_src && (dest_dev != br_dev_src)) {
 +						dev_put(br_dev_src);
 +					}
 +
 					dev_put(dest_dev);
 					dev_put(mc_br_slave_dev);
 					return 0;
@@ -4032,6 +4047,10 @@ int32_t ecm_interface_multicast_heirarchy_construct_routed(struct ecm_front_end_
 					}
 				}
 +				if (br_dev_src && (dest_dev != br_dev_src)) {
 +					dev_put(br_dev_src);
 +				}
 +
 				dev_put(dest_dev);
 				return 0;
 			}
@@ -4042,8 +4061,15 @@ int32_t ecm_interface_multicast_heirarchy_construct_routed(struct ecm_front_end_
 			valid_if++;
 		}
 -		dev_put(dest_dev);
 +		if (dest_dev != br_dev_src) {
 +			dev_put(dest_dev);
 +		}
 	}
 +
 +	if (br_dev_src) {
 +		dev_put(br_dev_src);
 +	}
 +
 	return total_ii_count;
 }
 EXPORT_SYMBOL(ecm_interface_multicast_heirarchy_construct_routed);
 -- 
 cgit v1.1
--- a/package/qca/nss/qca-nss-ecm/patches/401-Fix-neighbour-solicitation-send-function.patch
+++ b/package/qca/nss/qca-nss-ecm/patches/401-Fix-neighbour-solicitation-send-function.patch
@ -1,33 +0,0 @@
 From 72e3ae508906553e7bc982bf3c0d99bb1cbe9008 Mon Sep 17 00:00:00 2001
 From: Murat Sezgin <msezgin@codeaurora.org>
 Date: Wed, 20 Nov 2019 16:23:06 -0800
 Subject: [qca-nss-ecm] Fix neighbour solicitation send function.
 dst_ops->neigh_lookup function pointer is set to the
 ip6_neigh_lookup function. This function returns an
 error pointer with the ERR_PTR() macro. So, we should
 check the return value of this function pointer with
 the IS_ERR() macro.
 Change-Id: I188a6e53278faaa68f1854524f612efc1f7451fe
 Signed-off-by: Murat Sezgin <msezgin@codeaurora.org>
 ---
 ecm_interface.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/ecm_interface.c b/ecm_interface.c
 index 3f8554b..36509f0 100644
 --- a/ecm_interface.c
 +++ b/ecm_interface.c
@@ -1100,7 +1100,7 @@ void ecm_interface_send_neighbour_solicitation(struct net_device *dev, ip_addr_t
 #else
 	neigh = rt6i->dst.ops->neigh_lookup(&rt6i->dst, NULL, &dst_addr);
 #endif
 -	if (neigh == NULL) {
 +	if (IS_ERR(neigh)) {
 		DEBUG_TRACE("Neighbour lookup failure for destination IPv6 address " ECM_IP_ADDR_OCTAL_FMT "\n", ECM_IP_ADDR_TO_OCTAL(addr));
 		dst_release(&rt6i->dst);
 		return;
 -- 
 cgit v1.1
--- a/Show More
+++ b/Show More
		`@ -1,3 +0,0 @@`
			`obj-m += nss-ifb.o`

			`nss-ifb-objs := nss_ifb.o`
		`@ -1,2 +0,0 @@`
			`# nf_conntrack_tcp_no_window_check is 0 by default, set it to 1`
			`net.netfilter.nf_conntrack_tcp_no_window_check=1`
		`@ -1,2 +0,0 @@`
			`config ecm 'global'`
			`option acceleration_engine 'auto'`