From 420e0e857948bb756aa11440cf5c67b291e536ca Mon Sep 17 00:00:00 2001
From: deadlineOvO <deadlineOvO@protonmail.com>
Date: Tue, 23 Jun 2020 09:39:20 +0800
Subject: [PATCH 01/28] /sbin/mtkwifi 777 to 755
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

只是认为 777 没有必要
---
 package/lean/mt/drivers/mt_wifi/files/firmware.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/lean/mt/drivers/mt_wifi/files/firmware.sh b/package/lean/mt/drivers/mt_wifi/files/firmware.sh
index abdade9c79..bcc8240ea9 100644
--- a/package/lean/mt/drivers/mt_wifi/files/firmware.sh
+++ b/package/lean/mt/drivers/mt_wifi/files/firmware.sh
@@ -1,5 +1,5 @@
 #!/bin/sh /etc/rc.common
-chmod 777 /sbin/mtkwifi
+chmod 0755 /sbin/mtkwifi
 START=15
 STOP=15
 

From 5be827d9f9eab4c449a3d3bc9e6aa012bc2110cb Mon Sep 17 00:00:00 2001
From: liuran001 <32791471+liuran001@users.noreply.github.com>
Date: Tue, 23 Jun 2020 23:12:25 +0800
Subject: [PATCH 02/28] fix baidupcs-go
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

修复baidupcs-go下载链接
---
 package/lean/baidupcs-web/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/lean/baidupcs-web/Makefile b/package/lean/baidupcs-web/Makefile
index a0fe471825..cf4caadc99 100644
--- a/package/lean/baidupcs-web/Makefile
+++ b/package/lean/baidupcs-web/Makefile
@@ -62,7 +62,7 @@ endif
 
 PKG_SOURCE:=BaiduPCS-Go-v$(PKG_VERSION)-linux-$(PKG_ARCH_BAIDUPCS-WEB).zip
 
-PKG_SOURCE_URL:=https://github.com/Erope/baidupcs-web/releases/download/$(PKG_VERSION)/
+PKG_SOURCE_URL:=https://www.shinenet.cn/down/
 
 UNZIP_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)/$(PKG_NAME)-unzip
 

From ab025ed8d3cce42d1fd77f78aa37337ad6ee97bb Mon Sep 17 00:00:00 2001
From: CN_SZTL <cnsztl@project-openwrt.eu.org>
Date: Thu, 23 Apr 2020 10:34:44 +0800
Subject: [PATCH 03/28] redsocks2: fix compatible with openssl 1.1.x, support
 reuseport

---
 package/lean/redsocks2/Makefile               |  14 +-
 ...00-fix-compatible-with-openssl-1.1.x.patch | 315 ++++++++++++++++++
 ...extract-original-destination-address.patch |  15 +
 3 files changed, 333 insertions(+), 11 deletions(-)
 create mode 100644 package/lean/redsocks2/patches/000-fix-compatible-with-openssl-1.1.x.patch
 create mode 100644 package/lean/redsocks2/patches/001-fix-redudp-failing-to-extract-original-destination-address.patch

diff --git a/package/lean/redsocks2/Makefile b/package/lean/redsocks2/Makefile
index ed9899b08a..6604da5b4b 100644
--- a/package/lean/redsocks2/Makefile
+++ b/package/lean/redsocks2/Makefile
@@ -10,14 +10,14 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=redsocks2
 PKG_VERSION:=0.67
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/semigodking/redsocks.git
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=2b8fe69e4faba9b256808bc664d4c9daedd76f70
+PKG_SOURCE_VERSION:=53cad23a14afdd5f61a0542615beb7f4d98be728
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
-PKG_MAINTAINER:=semigodking  <semigodking@gmail.com>
+PKG_MAINTAINER:=semigodking <semigodking@gmail.com>
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)/$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
 
 include $(INCLUDE_DIR)/package.mk
@@ -36,14 +36,6 @@ The name is changed to be REDSOCKS2 since this release to distinguish with origi
 This variant is useful for anti-GFW (Great Fire Wall).
 endef
 
-define Package/redsocks2/conffiles
-/etc/config/redsocks2
-endef
-
-define Build/Compile
-	$(call Build/Compile/Default,DISABLE_SHADOWSOCKS=true)
-endef
-
 define Package/redsocks2/install
 	$(INSTALL_DIR) $(1)/usr/sbin
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/redsocks2 $(1)/usr/sbin
diff --git a/package/lean/redsocks2/patches/000-fix-compatible-with-openssl-1.1.x.patch b/package/lean/redsocks2/patches/000-fix-compatible-with-openssl-1.1.x.patch
new file mode 100644
index 0000000000..aefbc21054
--- /dev/null
+++ b/package/lean/redsocks2/patches/000-fix-compatible-with-openssl-1.1.x.patch
@@ -0,0 +1,315 @@
+diff --git a/encrypt.c b/encrypt.c
+index ce04c6f..dc27754 100644
+--- a/encrypt.c
++++ b/encrypt.c
+@@ -278,7 +278,7 @@ static void enc_table_init(enc_info * info, const char *pass)
+     }
+ }
+ 
+-int cipher_iv_size(const cipher_kt_t *cipher)
++int cipher_iv_size(const cipher_t *cipher)
+ {
+ #if defined(USE_CRYPTO_OPENSSL)
+     return EVP_CIPHER_iv_length(cipher);
+@@ -290,7 +290,7 @@ int cipher_iv_size(const cipher_kt_t *cipher)
+ #endif
+ }
+ 
+-int cipher_key_size(const cipher_kt_t *cipher)
++int cipher_key_size(const cipher_t *cipher)
+ {
+ #if defined(USE_CRYPTO_OPENSSL)
+     return EVP_CIPHER_key_length(cipher);
+@@ -307,102 +307,66 @@ int cipher_key_size(const cipher_kt_t *cipher)
+ #endif
+ }
+ 
+-int bytes_to_key(const cipher_kt_t *cipher, const digest_type_t *md,
+-                 const uint8_t *pass, uint8_t *key, uint8_t *iv)
++int bytes_to_key(const cipher_t *cipher, const digest_type_t *md,
++                 const uint8_t *pass, uint8_t *key)
+ {
+     size_t datal;
+     datal = strlen((const char *)pass);
+ #if defined(USE_CRYPTO_OPENSSL)
+-    return EVP_BytesToKey(cipher, md, NULL, pass, datal, 1, key, iv);
++    MD5_CTX c;
++    unsigned char md_buf[MAX_MD_SIZE];
++    int nkey;
++    int addmd;
++    unsigned int i, j, mds;
++
++    mds   = 16;
++    if (pass == NULL) return nkey;
++    memset(&c, 0, sizeof(MD5_CTX));
++
++    for (j = 0, addmd = 0; j < nkey; addmd++) {
++        MD5_Init(&c);
++        if (addmd) {
++            MD5_Update(&c, md_buf, mds);
++        }
++        MD5_Update(&c, pass, datal);
++        MD5_Final(md_buf, &c);
++
++        for (i = 0; i < mds; i++, j++) {
++            if (j >= nkey) break;
++            key[j] = md_buf[i];
++        }
++    }
++    return nkey;
+ #elif defined(USE_CRYPTO_POLARSSL)
+     md_context_t c;
+     unsigned char md_buf[MAX_MD_SIZE];
+-    int niv;
+     int nkey;
+     int addmd;
+-    unsigned int mds;
+-    unsigned int i;
+-    int rv;
++    unsigned int i, j, mds;
+ 
+     nkey = cipher_key_size(cipher);
+-    niv = cipher_iv_size(cipher);
+-    rv = nkey;
+-    if (pass == NULL) {
+-        return nkey;
+-    }
+-
++    mds  = md_get_size(md);
+     memset(&c, 0, sizeof(md_context_t));
+-    if (md_init_ctx(&c, md)) {
+-        return 0;
+-    }
+-    addmd = 0;
+-    mds = md_get_size(md);
+-    for (;; ) {
+-        int error;
+-        do {
+-            error = 1;
+-            if (md_starts(&c)) {
+-                break;
+-            }
+-            if (addmd) {
+-                if (md_update(&c, &(md_buf[0]), mds)) {
+-                    break;
+-                }
+-            } else {
+-                addmd = 1;
+-            }
+-            if (md_update(&c, pass, datal)) {
+-                break;
+-            }
+-            if (md_finish(&c, &(md_buf[0]))) {
+-                break;
+-            }
+-            error = 0;
+-        } while (0);
+-        if (error) {
+-            md_free_ctx(&c);
+-            memset(md_buf, 0, MAX_MD_SIZE);
+-            return 0;
+-        }
+ 
+-        i = 0;
+-        if (nkey) {
+-            for (;; ) {
+-                if (nkey == 0) {
+-                    break;
+-                }
+-                if (i == mds) {
+-                    break;
+-                }
+-                if (key != NULL) {
+-                    *(key++) = md_buf[i];
+-                }
+-                nkey--;
+-                i++;
+-            }
+-        }
+-        if (niv && (i != mds)) {
+-            for (;; ) {
+-                if (niv == 0) {
+-                    break;
+-                }
+-                if (i == mds) {
+-                    break;
+-                }
+-                if (iv != NULL) {
+-                    *(iv++) = md_buf[i];
+-                }
+-                niv--;
+-                i++;
+-            }
++    if (pass == NULL) return nkey;
++    if (md_init_ctx(&c, md)) return 0;
++
++    for (j = 0, addmd = 0; j < nkey; addmd++) {
++        md_starts(&c);
++        if (addmd) {
++            md_update(&c, md_buf, mds);
+         }
+-        if ((nkey == 0) && (niv == 0)) {
+-            break;
++        md_update(&c, pass, datal);
++        md_finish(&c, md_buf);
++
++        for (i = 0; i < mds; i++, j++) {
++            if (j >= nkey) break;
++            key[j] = md_buf[i];
+         }
+     }
++
+     md_free_ctx(&c);
+-    memset(md_buf, 0, MAX_MD_SIZE);
+-    return rv;
++    return nkey;
+ #endif
+ }
+ 
+@@ -472,7 +436,7 @@ int rand_bytes(uint8_t *output, int len)
+ #endif
+ }
+ 
+-const cipher_kt_t *get_cipher_type(int method)
++const cipher_t *get_cipher_type(int method)
+ {
+     if (method <= TABLE || method >= CIPHER_NUM) {
+         //LOGE("get_cipher_type(): Illegal method");
+@@ -548,7 +512,7 @@ static int cipher_context_init(const enc_info * info, cipher_ctx_t *ctx, int enc
+ #endif
+ 
+     cipher_evp_t *evp = &ctx->evp;
+-    const cipher_kt_t *cipher = get_cipher_type(method);
++    const cipher_t *cipher = get_cipher_type(method);
+ #if defined(USE_CRYPTO_OPENSSL)
+     if (cipher == NULL) {
+         // Cipher is not found in OpenSSL library
+@@ -560,7 +524,7 @@ static int cipher_context_init(const enc_info * info, cipher_ctx_t *ctx, int enc
+         return -1; 
+     }
+     if (!EVP_CIPHER_CTX_set_key_length(evp, info->key_len)) {
+-        EVP_CIPHER_CTX_cleanup(evp);
++        EVP_CIPHER_CTX_free(ctx->evp);
+         // Invalid key length
+         return -1;
+     }
+@@ -649,7 +613,7 @@ static void cipher_context_set_iv(const enc_info * info, cipher_ctx_t *ctx, uint
+     }
+ #if defined(USE_CRYPTO_OPENSSL)
+     if (!EVP_CipherInit_ex(evp, NULL, NULL, true_key, iv, enc)) {
+-        EVP_CIPHER_CTX_cleanup(evp);
++        EVP_CIPHER_CTX_free(ctx->evp);
+         //FATAL("Cannot set key and IV");
+     }
+ #elif defined(USE_CRYPTO_POLARSSL)
+@@ -698,7 +662,7 @@ static void cipher_context_release(enc_info * info, cipher_ctx_t *ctx)
+ 
+     cipher_evp_t *evp = &ctx->evp;
+ #if defined(USE_CRYPTO_OPENSSL)
+-    EVP_CIPHER_CTX_cleanup(evp);
++    EVP_CIPHER_CTX_free(ctx->evp);
+ #elif defined(USE_CRYPTO_POLARSSL)
+     cipher_free_ctx(evp);
+ #endif
+@@ -730,7 +694,7 @@ static int cipher_context_update(cipher_ctx_t *ctx, uint8_t *output, int *olen,
+ size_t ss_calc_buffer_size(struct enc_ctx * ctx, size_t ilen)
+ {
+     int method = ctx->info->method;
+-    const cipher_kt_t *cipher = get_cipher_type(method);
++    const cipher_t *cipher = get_cipher_type(method);
+ #if defined(USE_CRYPTO_OPENSSL)
+     if (ctx->init)
+         return ilen + EVP_CIPHER_block_size(cipher); 
+@@ -913,10 +877,7 @@ static int enc_key_init(enc_info * info, int method, const char *pass)
+     OpenSSL_add_all_algorithms();
+ #endif
+ 
+-    uint8_t iv[MAX_IV_LENGTH];
+-
+-    cipher_kt_t *cipher = NULL;
+-    cipher_kt_t cipher_info;
++    cipher_t *cipher;
+ 
+ 
+     if (method == SALSA20 || method == CHACHA20) {
+@@ -924,11 +885,9 @@ static int enc_key_init(enc_info * info, int method, const char *pass)
+         if (sodium_init() == -1) {
+             //FATAL("Failed to initialize sodium");
+         }
+-        // Fake cipher
+-        cipher = (cipher_kt_t *)&cipher_info;
+ #if defined(USE_CRYPTO_OPENSSL)
+-        cipher->key_len = supported_ciphers_key_size[method];
+-        cipher->iv_len = supported_ciphers_iv_size[method];
++        cipher.key_len = supported_ciphers_key_size[method];
++        cipher.iv_len = supported_ciphers_iv_size[method];
+ #endif
+ #if defined(USE_CRYPTO_POLARSSL)
+         cipher->base = NULL;
+@@ -937,7 +896,7 @@ static int enc_key_init(enc_info * info, int method, const char *pass)
+ #endif
+ */
+     } else {
+-        cipher = (cipher_kt_t *)get_cipher_type(method);
++        cipher = (cipher_t *)get_cipher_type(method);
+     }
+ 
+     if (cipher == NULL) {
+@@ -947,7 +906,7 @@ static int enc_key_init(enc_info * info, int method, const char *pass)
+                 cipher_info.base = NULL;
+                 cipher_info.key_length = supported_ciphers_key_size[method] * 8;
+                 cipher_info.iv_size = supported_ciphers_iv_size[method];
+-                cipher = (cipher_kt_t *)&cipher_info;
++                cipher = (cipher_t *)&cipher_info;
+                 break;
+             }
+ #endif
+@@ -959,7 +918,7 @@ static int enc_key_init(enc_info * info, int method, const char *pass)
+     if (md == NULL)
+         return -1;
+ 
+-    info->key_len = bytes_to_key(cipher, md, (const uint8_t *)pass, info->key, iv);
++    info->key_len = bytes_to_key(&cipher, md, (const uint8_t *)pass, info->key);
+     if (info->key_len == 0) {
+         //FATAL("Cannot generate key and IV");
+         return -1;
+@@ -967,7 +926,7 @@ static int enc_key_init(enc_info * info, int method, const char *pass)
+     if (method == RC4_MD5) {
+         info->iv_len = 16;
+     } else {
+-        info->iv_len = cipher_iv_size(cipher);
++        info->iv_len = cipher_iv_size(&cipher);
+     }
+     info->method = method;
+     return method;
+diff --git a/encrypt.h b/encrypt.h
+index 61b3fc7..c3359d0 100644
+--- a/encrypt.h
++++ b/encrypt.h
+@@ -45,7 +45,7 @@
+ #if defined(USE_CRYPTO_OPENSSL)
+ 
+ #include <openssl/evp.h>
+-typedef EVP_CIPHER cipher_kt_t;
++typedef EVP_CIPHER cipher_t;
+ typedef EVP_CIPHER_CTX cipher_evp_t;
+ typedef EVP_MD digest_type_t;
+ #define MAX_KEY_LENGTH EVP_MAX_KEY_LENGTH
+@@ -56,7 +56,7 @@ typedef EVP_MD digest_type_t;
+ 
+ #include <polarssl/cipher.h>
+ #include <polarssl/md.h>
+-typedef cipher_info_t cipher_kt_t;
++typedef cipher_info_t cipher_t;
+ typedef cipher_context_t cipher_evp_t;
+ typedef md_info_t digest_type_t;
+ #define MAX_KEY_LENGTH 64
+@@ -89,7 +89,7 @@ typedef struct {
+ #endif
+ 
+ typedef struct {
+-    cipher_evp_t evp;
++    cipher_evp_t *evp;
+ #ifdef USE_CRYPTO_APPLECC
+     cipher_cc_t cc;
+ #endif
diff --git a/package/lean/redsocks2/patches/001-fix-redudp-failing-to-extract-original-destination-address.patch b/package/lean/redsocks2/patches/001-fix-redudp-failing-to-extract-original-destination-address.patch
new file mode 100644
index 0000000000..a55f479346
--- /dev/null
+++ b/package/lean/redsocks2/patches/001-fix-redudp-failing-to-extract-original-destination-address.patch
@@ -0,0 +1,15 @@
+diff --git a/utils.c b/utils.c
+index 9fe148e..196a04e 100644
+--- a/utils.c
++++ b/utils.c
+@@ -62,7 +62,9 @@ int red_recv_udp_pkt(int fd, char *buf, size_t buflen, struct sockaddr_in *inadd
+             if (
+                 cmsg->cmsg_level == SOL_IP &&
+                 cmsg->cmsg_type == IP_ORIGDSTADDR &&
+-                cmsg->cmsg_len >= CMSG_LEN(sizeof(*toaddr))
++                (cmsg->cmsg_len == CMSG_LEN(sizeof(struct sockaddr_in))
++                 || cmsg->cmsg_len == CMSG_LEN(sizeof(struct sockaddr_in6))) &&
++                cmsg->cmsg_len <= CMSG_LEN(sizeof(*toaddr))
+             ) {
+                 struct sockaddr_in* cmsgaddr = (struct sockaddr_in*)CMSG_DATA(cmsg);
+                 memcpy(toaddr, cmsgaddr, sizeof(*toaddr));

From b82cf78797d58f5230cd8fc4c09b27429edfc192 Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Mon, 29 Jun 2020 23:21:16 +0800
Subject: [PATCH 04/28] gmediarender: move folder

---
 package/{ => lean}/gmediarender/Makefile | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename package/{ => lean}/gmediarender/Makefile (100%)

diff --git a/package/gmediarender/Makefile b/package/lean/gmediarender/Makefile
similarity index 100%
rename from package/gmediarender/Makefile
rename to package/lean/gmediarender/Makefile

From fb6aeafd1892d0d2163f6798375ecfe7b4865c27 Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Mon, 29 Jun 2020 23:26:33 +0800
Subject: [PATCH 05/28] redsocks2: disable ss

---
 package/lean/redsocks2/Makefile | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/package/lean/redsocks2/Makefile b/package/lean/redsocks2/Makefile
index 6604da5b4b..5ca31b4964 100644
--- a/package/lean/redsocks2/Makefile
+++ b/package/lean/redsocks2/Makefile
@@ -36,6 +36,14 @@ The name is changed to be REDSOCKS2 since this release to distinguish with origi
 This variant is useful for anti-GFW (Great Fire Wall).
 endef
 
+define Package/redsocks2/conffiles
+/etc/config/redsocks2
+endef
+
+define Build/Compile
+	$(call Build/Compile/Default,DISABLE_SHADOWSOCKS=true)
+endef
+
 define Package/redsocks2/install
 	$(INSTALL_DIR) $(1)/usr/sbin
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/redsocks2 $(1)/usr/sbin

From c0f33649742e6a705fc8b38ac2406afaa80966be Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Mon, 29 Jun 2020 23:41:08 +0800
Subject: [PATCH 06/28] baidupcs-web: move to my source

---
 package/lean/baidupcs-web/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/lean/baidupcs-web/Makefile b/package/lean/baidupcs-web/Makefile
index cf4caadc99..0540b060d8 100644
--- a/package/lean/baidupcs-web/Makefile
+++ b/package/lean/baidupcs-web/Makefile
@@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=baidupcs-web
 PKG_VERSION:=3.7.1
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 include $(INCLUDE_DIR)/package.mk
 
@@ -62,7 +62,7 @@ endif
 
 PKG_SOURCE:=BaiduPCS-Go-v$(PKG_VERSION)-linux-$(PKG_ARCH_BAIDUPCS-WEB).zip
 
-PKG_SOURCE_URL:=https://www.shinenet.cn/down/
+PKG_SOURCE_URL:=https://github.com/coolsnowwolf/baidupcs-web/raw/master/
 
 UNZIP_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)/$(PKG_NAME)-unzip
 

From cdca955c8e78f3e3808ff7d3a148e6e164ad5fe4 Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Wed, 1 Jul 2020 02:56:41 +0800
Subject: [PATCH 07/28] shortcut-fe:added support for Linux kernel 4.14

---
 package/lean/fast-classifier/Makefile         |  91 ++++
 package/lean/fast-classifier/src/Makefile     |  10 +
 .../src/fast-classifier.c                     | 421 ++++++++++--------
 .../src/fast-classifier.h                     |   0
 .../src/nl_classifier_test.c                  |   0
 .../src/userspace_example.c                   |   2 +-
 package/lean/luci-app-flowoffload/Makefile    |   4 +-
 package/lean/luci-app-sfe/Makefile            |   2 +-
 package/lean/shortcut-fe/Makefile             |  86 +---
 .../shortcut-fe/files/etc/init.d/shortcut-fe  |  48 ++
 .../lean/shortcut-fe/files/usr/bin/sfe_dump   |  35 ++
 package/lean/shortcut-fe/src/Makefile         |  11 +-
 package/lean/shortcut-fe/src/README           | 122 -----
 package/lean/shortcut-fe/src/sfe.h            |  99 +++-
 package/lean/shortcut-fe/src/sfe_backport.h   |  61 ++-
 package/lean/shortcut-fe/src/sfe_cm.c         | 184 +++-----
 package/lean/shortcut-fe/src/sfe_cm.h         |  39 +-
 package/lean/shortcut-fe/src/sfe_ipv4.c       | 286 +++++++++++-
 package/lean/shortcut-fe/src/sfe_ipv6.c       | 277 +++++++++++-
 target/linux/generic/config-4.14              |   1 +
 ...-linux-kernel-to-support-shortcut-fe.patch | 236 ++++++++++
 21 files changed, 1481 insertions(+), 534 deletions(-)
 create mode 100644 package/lean/fast-classifier/Makefile
 create mode 100644 package/lean/fast-classifier/src/Makefile
 rename package/lean/{shortcut-fe => fast-classifier}/src/fast-classifier.c (83%)
 rename package/lean/{shortcut-fe => fast-classifier}/src/fast-classifier.h (100%)
 rename package/lean/{shortcut-fe => fast-classifier}/src/nl_classifier_test.c (100%)
 rename package/lean/{shortcut-fe => fast-classifier}/src/userspace_example.c (99%)
 create mode 100755 package/lean/shortcut-fe/files/etc/init.d/shortcut-fe
 create mode 100644 package/lean/shortcut-fe/files/usr/bin/sfe_dump
 delete mode 100644 package/lean/shortcut-fe/src/README
 create mode 100644 target/linux/generic/hack-4.14/999-net-patch-linux-kernel-to-support-shortcut-fe.patch

diff --git a/package/lean/fast-classifier/Makefile b/package/lean/fast-classifier/Makefile
new file mode 100644
index 0000000000..2e29898b46
--- /dev/null
+++ b/package/lean/fast-classifier/Makefile
@@ -0,0 +1,91 @@
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=fast-classifier
+PKG_RELEASE:=1
+
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/$(PKG_NAME)/Default
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Support
+  DEPENDS:=+kmod-ipt-conntrack +kmod-shortcut-fe
+  TITLE:=Kernel driver for FAST Classifier
+  FILES:=$(PKG_BUILD_DIR)/fast-classifier.ko
+  KCONFIG:=CONFIG_NF_CONNTRACK_CHAIN_EVENTS=y CONFIG_NF_CONNTRACK_MARK=y
+  PROVIDES:=$(PKG_NAME)
+endef
+
+define KernelPackage/$(PKG_NAME)
+  $(call KernelPackage/$(PKG_NAME)/Default)
+endef
+
+define KernelPackage/$(PKG_NAME)-noload
+  $(call KernelPackage/$(PKG_NAME)/Default)
+endef
+
+define KernelPackage/$(PKG_NAME)/Default/description
+FAST Classifier talks to SFE to make decisions about offloading connections
+endef
+
+define KernelPackage/$(PKG_NAME)/description
+$(call KernelPackage/$(PKG_NAME)/Default/description)
+endef
+
+define KernelPackage/$(PKG_NAME)-noload/description
+$(call KernelPackage/$(PKG_NAME)/Default/description)
+
+This package does not load $(PKG_NAME) at boot by default
+endef
+
+define Package/fast-classifier-example
+  TITLE:=Example user space program for fast-classifier
+  DEPENDS:=+libnl +kmod-fast-classifier
+endef
+
+define Package/fast-classifier-example/description
+Example user space program that communicates with fast
+classifier kernel module
+endef
+
+SFE_MAKE_OPTS:=SFE_SUPPORT_IPV6=y
+
+define Build/Compile/kmod
+	+$(MAKE) $(PKG_JOBS) -C "$(LINUX_DIR)" $(strip $(SFE_MAKE_OPTS)) \
+		$(KERNEL_MAKE_FLAGS) \
+		$(PKG_MAKE_FLAGS) \
+		SUBDIRS="$(PKG_BUILD_DIR)" \
+		CONFIG_FAST_CLASSIFIER=m \
+		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
+		modules
+endef
+
+define Build/Compile/example
+	$(TARGET_CC) -o $(PKG_BUILD_DIR)/userspace_fast_classifier \
+		-I $(PKG_BUILD_DIR) \
+		-I$(STAGING_DIR)/usr/include/libnl \
+		-I$(STAGING_DIR)/usr/include/libnl3 \
+		-lnl-genl-3 -lnl-3 \
+		$(PKG_BUILD_DIR)/nl_classifier_test.c
+endef
+
+define Build/Compile
+	$(Build/Compile/kmod)
+	$(if $(CONFIG_PACKAGE_fast-classifier-example),$(Build/Compile/example))
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include
+	$(CP) $(PKG_BUILD_DIR)/fast-classifier.h $(1)/usr/include/
+endef
+
+
+define Package/fast-classifier-example/install
+	$(INSTALL_DIR) $(1)/sbin
+	$(CP) $(PKG_BUILD_DIR)/userspace_fast_classifier $(1)/sbin/
+endef
+
+$(eval $(call KernelPackage,$(PKG_NAME)))
+$(eval $(call KernelPackage,$(PKG_NAME)-noload))
+$(eval $(call BuildPackage,fast-classifier-example))
diff --git a/package/lean/fast-classifier/src/Makefile b/package/lean/fast-classifier/src/Makefile
new file mode 100644
index 0000000000..58dd06e018
--- /dev/null
+++ b/package/lean/fast-classifier/src/Makefile
@@ -0,0 +1,10 @@
+obj-$(CONFIG_FAST_CLASSIFIER) += fast-classifier.o
+
+ifeq ($(SFE_SUPPORT_IPV6),)
+SFE_SUPPORT_IPV6=y
+endif
+ccflags-$(SFE_SUPPORT_IPV6) += -DSFE_SUPPORT_IPV6
+
+ccflags-y += -I$(obj)/../shortcut-fe
+
+obj ?= .
diff --git a/package/lean/shortcut-fe/src/fast-classifier.c b/package/lean/fast-classifier/src/fast-classifier.c
similarity index 83%
rename from package/lean/shortcut-fe/src/fast-classifier.c
rename to package/lean/fast-classifier/src/fast-classifier.c
index 48a2d27f4d..e9f3d0eb4e 100644
--- a/package/lean/shortcut-fe/src/fast-classifier.c
+++ b/package/lean/fast-classifier/src/fast-classifier.c
@@ -3,7 +3,7 @@
  *	Shortcut forwarding engine connection manager.
  *	fast-classifier
  *
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved.
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
  * above copyright notice and this permission notice appear in all copies.
@@ -29,17 +29,16 @@
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_core.h>
-#include <net/netfilter/nf_conntrack_timeout.h>
 #include <linux/netfilter/xt_dscp.h>
 #include <net/genetlink.h>
 #include <linux/spinlock.h>
 #include <linux/if_bridge.h>
 #include <linux/hashtable.h>
-#include <net/pkt_sched.h>
+#include <linux/version.h>
 
-#include "sfe_backport.h"
-#include "sfe.h"
-#include "sfe_cm.h"
+#include <sfe_backport.h>
+#include <sfe.h>
+#include <sfe_cm.h>
 #include "fast-classifier.h"
 
 typedef enum fast_classifier_exception {
@@ -111,14 +110,16 @@ struct fast_classifier {
 	u32 exceptions[FAST_CL_EXCEPTION_MAX];
 };
 
-static struct fast_classifier __fsc;
+static struct fast_classifier __sc;
 
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 2, 0))
 static struct nla_policy fast_classifier_genl_policy[FAST_CLASSIFIER_A_MAX + 1] = {
 	[FAST_CLASSIFIER_A_TUPLE] = {
 		.type = NLA_UNSPEC,
 		.len = sizeof(struct fast_classifier_tuple)
 	},
 };
+#endif /*KERNEL_VERSION(5, 2, 0)*/
 
 static struct genl_multicast_group fast_classifier_genl_mcgrp[] = {
 	{
@@ -126,14 +127,6 @@ static struct genl_multicast_group fast_classifier_genl_mcgrp[] = {
 	},
 };
 
-static struct genl_family fast_classifier_gnl_family = {
-	.id = GENL_ID_GENERATE,
-	.hdrsize = FAST_CLASSIFIER_GENL_HDRSIZE,
-	.name = FAST_CLASSIFIER_GENL_NAME,
-	.version = FAST_CLASSIFIER_GENL_VERSION,
-	.maxattr = FAST_CLASSIFIER_A_MAX,
-};
-
 static int fast_classifier_offload_genl_msg(struct sk_buff *skb, struct genl_info *info);
 static int fast_classifier_nl_genl_msg_DUMP(struct sk_buff *skb, struct netlink_callback *cb);
 
@@ -141,26 +134,48 @@ static struct genl_ops fast_classifier_gnl_ops[] = {
 	{
 		.cmd = FAST_CLASSIFIER_C_OFFLOAD,
 		.flags = 0,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 2, 0))
 		.policy = fast_classifier_genl_policy,
+#endif /*KERNEL_VERSION(5, 2, 0)*/
 		.doit = fast_classifier_offload_genl_msg,
 		.dumpit = NULL,
 	},
 	{
 		.cmd = FAST_CLASSIFIER_C_OFFLOADED,
 		.flags = 0,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 2, 0))
 		.policy = fast_classifier_genl_policy,
+#endif /*KERNEL_VERSION(5, 2, 0)*/
 		.doit = NULL,
 		.dumpit = fast_classifier_nl_genl_msg_DUMP,
 	},
 	{
 		.cmd = FAST_CLASSIFIER_C_DONE,
 		.flags = 0,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 2, 0))
 		.policy = fast_classifier_genl_policy,
+#endif /*KERNEL_VERSION(5, 2, 0)*/
 		.doit = NULL,
 		.dumpit = fast_classifier_nl_genl_msg_DUMP,
 	},
 };
 
+static struct genl_family fast_classifier_gnl_family = {
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 10, 0))
+	.id = GENL_ID_GENERATE,
+#endif /*KERNEL_VERSION(4, 10, 0)*/
+	.hdrsize = FAST_CLASSIFIER_GENL_HDRSIZE,
+	.name = FAST_CLASSIFIER_GENL_NAME,
+	.version = FAST_CLASSIFIER_GENL_VERSION,
+	.maxattr = FAST_CLASSIFIER_A_MAX,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 10, 0))
+	.ops = fast_classifier_gnl_ops,
+	.n_ops = ARRAY_SIZE(fast_classifier_gnl_ops),
+	.mcgrps = fast_classifier_genl_mcgrp,
+	.n_mcgrps = ARRAY_SIZE(fast_classifier_genl_mcgrp),
+#endif /*KERNEL_VERSION(4, 10, 0)*/
+};
+
 static atomic_t offload_msgs = ATOMIC_INIT(0);
 static atomic_t offload_no_match_msgs = ATOMIC_INIT(0);
 static atomic_t offloaded_msgs = ATOMIC_INIT(0);
@@ -189,7 +204,7 @@ static bool skip_to_bridge_ingress;
  */
 static inline void fast_classifier_incr_exceptions(fast_classifier_exception_t except)
 {
-	struct fast_classifier *sc = &__fsc;
+	struct fast_classifier *sc = &__sc;
 
 	spin_lock_bh(&sc->lock);
 	sc->exceptions[except]++;
@@ -202,7 +217,7 @@ static inline void fast_classifier_incr_exceptions(fast_classifier_exception_t e
  *
  * Returns 1 if the packet is forwarded or 0 if it isn't.
  */
-static int fast_classifier_recv(struct sk_buff *skb)
+int fast_classifier_recv(struct sk_buff *skb)
 {
 	struct net_device *dev;
 	struct net_device *master_dev = NULL;
@@ -224,22 +239,12 @@ static int fast_classifier_recv(struct sk_buff *skb)
 	    (dev->priv_flags & IFF_BRIDGE_PORT)) {
 		master_dev = sfe_dev_get_master(dev);
 		if (!master_dev) {
-			DEBUG_WARN("master dev is NULL %s\n");
+			DEBUG_WARN("master dev is NULL %s\n", dev->name);
 			goto rx_exit;
 		}
 		dev = master_dev;
 	}
 
-#ifdef CONFIG_NET_CLS_ACT
-	/*
-	 * If ingress Qdisc configured, and packet not processed by ingress Qdisc yet
-	 * We cannot accelerate this packet.
-	 */
-	if (dev->ingress_queue && !(skb->tc_verd & TC_NCLS)) {
-		goto rx_exit;
-	}
-#endif
-
 	/*
 	 * We're only interested in IPv4 and IPv6 packets.
 	 */
@@ -311,7 +316,7 @@ rx_exit:
  * structure, obtain the hardware address.  This means this function also
  * works if the neighbours are routers too.
  */
-static bool fast_classifier_find_dev_and_mac_addr(sfe_ip_addr_t *addr, struct net_device **dev, u8 *mac_addr, bool is_v4)
+static bool fast_classifier_find_dev_and_mac_addr(struct sk_buff *skb, sfe_ip_addr_t *addr, struct net_device **dev, u8 *mac_addr, bool is_v4)
 {
 	struct neighbour *neigh;
 	struct rtable *rt;
@@ -319,12 +324,21 @@ static bool fast_classifier_find_dev_and_mac_addr(sfe_ip_addr_t *addr, struct ne
 	struct dst_entry *dst;
 	struct net_device *mac_dev;
 
+	/*
+	 * If we have skb provided, use it as the original code is unable
+	 * to lookup routes that are policy routed.
+	*/
+	if (unlikely(skb)) {
+		dst = skb_dst(skb);
+		goto skip_dst_lookup;
+	}
+
 	/*
 	 * Look up the rtable entry for the IP address then get the hardware
 	 * address from its neighbour structure.  This means this works when the
 	 * neighbours are routers too.
 	 */
-	if (is_v4) {
+	if (likely(is_v4)) {
 		rt = ip_route_output(&init_net, addr->ip, 0, 0, 0);
 		if (unlikely(IS_ERR(rt))) {
 			goto ret_fail;
@@ -332,7 +346,11 @@ static bool fast_classifier_find_dev_and_mac_addr(sfe_ip_addr_t *addr, struct ne
 
 		dst = (struct dst_entry *)rt;
 	} else {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0))
+		rt6 = rt6_lookup(&init_net, (struct in6_addr *)addr->ip6, 0, 0, NULL, 0);
+#else
 		rt6 = rt6_lookup(&init_net, (struct in6_addr *)addr->ip6, 0, 0, 0);
+#endif /*KERNEL_VERSION(4, 17, 0)*/
 		if (!rt6) {
 			goto ret_fail;
 		}
@@ -340,18 +358,23 @@ static bool fast_classifier_find_dev_and_mac_addr(sfe_ip_addr_t *addr, struct ne
 		dst = (struct dst_entry *)rt6;
 	}
 
+skip_dst_lookup:
 	rcu_read_lock();
-	neigh = dst_neigh_lookup(dst, addr);
+	neigh = sfe_dst_get_neighbour(dst, addr);
 	if (unlikely(!neigh)) {
 		rcu_read_unlock();
-		dst_release(dst);
+		if (likely(!skb))
+			dst_release(dst);
+
 		goto ret_fail;
 	}
 
 	if (unlikely(!(neigh->nud_state & NUD_VALID))) {
 		rcu_read_unlock();
 		neigh_release(neigh);
-		dst_release(dst);
+		if (likely(!skb))
+			dst_release(dst);
+
 		goto ret_fail;
 	}
 
@@ -359,7 +382,9 @@ static bool fast_classifier_find_dev_and_mac_addr(sfe_ip_addr_t *addr, struct ne
 	if (!mac_dev) {
 		rcu_read_unlock();
 		neigh_release(neigh);
-		dst_release(dst);
+		if (likely(!skb))
+			dst_release(dst);
+
 		goto ret_fail;
 	}
 
@@ -369,12 +394,18 @@ static bool fast_classifier_find_dev_and_mac_addr(sfe_ip_addr_t *addr, struct ne
 	*dev = mac_dev;
 	rcu_read_unlock();
 	neigh_release(neigh);
-	dst_release(dst);
+	if (likely(!skb))
+		dst_release(dst);
 
 	return true;
 
 ret_fail:
-	DEBUG_TRACE("failed to find MAC address for IP: %pIS\n", addr);
+	if (is_v4) {
+		DEBUG_TRACE("failed to find MAC address for IP: %pI4\n", addr);
+
+	} else {
+		DEBUG_TRACE("failed to find MAC address for IP: %pI6\n", addr);
+	}
 
 	return false;
 }
@@ -439,16 +470,16 @@ static int fast_classifier_update_protocol(struct sfe_connection_create *p_sic,
 		 * state can not be SYN_SENT, SYN_RECV because connection is assured
 		 * Not managed states: FIN_WAIT, CLOSE_WAIT, LAST_ACK, TIME_WAIT, CLOSE.
 		 */
-		spin_lock_bh(&ct->lock);
+		spin_lock(&ct->lock);
 		if (ct->proto.tcp.state != TCP_CONNTRACK_ESTABLISHED) {
-			spin_unlock_bh(&ct->lock);
+			spin_unlock(&ct->lock);
 			fast_classifier_incr_exceptions(FAST_CL_EXCEPTION_TCP_NOT_ESTABLISHED);
 			DEBUG_TRACE("connection in termination state: %#x, s: %pI4:%u, d: %pI4:%u\n",
 				    ct->proto.tcp.state, &p_sic->src_ip, ntohs(p_sic->src_port),
 				    &p_sic->dest_ip, ntohs(p_sic->dest_port));
 			return 0;
 		}
-		spin_unlock_bh(&ct->lock);
+		spin_unlock(&ct->lock);
 		break;
 
 	case IPPROTO_UDP:
@@ -511,12 +542,17 @@ static void fast_classifier_send_genl_msg(int msg, struct fast_classifier_tuple
 		return;
 	}
 
-	genlmsg_end(skb, msg_head);
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3, 19 , 0))
+	rc = genlmsg_end(skb, msg_head);
 	if (rc < 0) {
 		genlmsg_cancel(skb, msg_head);
 		nlmsg_free(skb);
 		return;
 	}
+#else
+	genlmsg_end(skb, msg_head);
+
+#endif
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0))
 	rc = genlmsg_multicast(&fast_classifier_gnl_family, skb, 0, 0, GFP_ATOMIC);
@@ -525,14 +561,18 @@ static void fast_classifier_send_genl_msg(int msg, struct fast_classifier_tuple
 #endif
 	switch (msg) {
 	case FAST_CLASSIFIER_C_OFFLOADED:
-		atomic_inc(&offloaded_msgs);
-		if (rc != 0)
+		if (rc == 0) {
+			atomic_inc(&offloaded_msgs);
+		} else {
 			atomic_inc(&offloaded_fail_msgs);
+		}
 		break;
 	case FAST_CLASSIFIER_C_DONE:
-		atomic_inc(&done_msgs);
-		if (rc != 0)
+		if (rc == 0) {
+			atomic_inc(&done_msgs);
+		} else {
 			atomic_inc(&done_fail_msgs);
+		}
 		break;
 	default:
 		DEBUG_ERROR("fast-classifer: Unknown message type sent!\n");
@@ -540,7 +580,11 @@ static void fast_classifier_send_genl_msg(int msg, struct fast_classifier_tuple
 	}
 
 	DEBUG_TRACE("Notify NL message %d ", msg);
-	DEBUG_TRACE("sip=%pIS dip=%pIS ", &fc_msg->src_saddr, &fc_msg->dst_saddr);
+	if (fc_msg->ethertype == AF_INET) {
+		DEBUG_TRACE("sip=%pI4 dip=%pI4 ", &fc_msg->src_saddr, &fc_msg->dst_saddr);
+	} else {
+		DEBUG_TRACE("sip=%pI6 dip=%pI6 ", &fc_msg->src_saddr, &fc_msg->dst_saddr);
+	}
 	DEBUG_TRACE("protocol=%d sport=%d dport=%d smac=%pM dmac=%pM\n",
 		    fc_msg->proto, fc_msg->sport, fc_msg->dport, fc_msg->smac, fc_msg->dmac);
 }
@@ -558,10 +602,13 @@ fast_classifier_find_conn(sfe_ip_addr_t *saddr, sfe_ip_addr_t *daddr,
 	struct sfe_connection_create *p_sic;
 	struct sfe_connection *conn;
 	u32 key;
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0))
+	struct hlist_node *node;
+#endif
 
 	key = fc_conn_hash(saddr, daddr, sport, dport, is_v4);
 
-	sfe_hash_for_each_possible(fc_conn_ht, conn, hl, key) {
+	sfe_hash_for_each_possible(fc_conn_ht, conn, node, hl, key) {
 		if (conn->is_v4 != is_v4) {
 			continue;
 		}
@@ -595,10 +642,13 @@ fast_classifier_sb_find_conn(sfe_ip_addr_t *saddr, sfe_ip_addr_t *daddr,
 	struct sfe_connection_create *p_sic;
 	struct sfe_connection *conn;
 	u32 key;
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0))
+	struct hlist_node *node;
+#endif
 
 	key = fc_conn_hash(saddr, daddr, sport, dport, is_v4);
 
-	sfe_hash_for_each_possible(fc_conn_ht, conn, hl, key) {
+	sfe_hash_for_each_possible(fc_conn_ht, conn, node, hl, key) {
 		if (conn->is_v4 != is_v4) {
 			continue;
 		}
@@ -619,7 +669,7 @@ fast_classifier_sb_find_conn(sfe_ip_addr_t *saddr, sfe_ip_addr_t *daddr,
 	 */
 	key = fc_conn_hash(daddr, saddr, dport, sport, is_v4);
 
-	sfe_hash_for_each_possible(fc_conn_ht, conn, hl, key) {
+	sfe_hash_for_each_possible(fc_conn_ht, conn, node, hl, key) {
 		if (conn->is_v4 != is_v4) {
 			continue;
 		}
@@ -667,8 +717,13 @@ fast_classifier_add_conn(struct sfe_connection *conn)
 
 	DEBUG_TRACE(" -> adding item to sfe_connections, new size: %d\n", sfe_connections_size);
 
-	DEBUG_TRACE("new offloadable: key: %u proto: %d src_ip: %pIS dst_ip: %pIS, src_port: %d, dst_port: %d\n",
-		key, sic->protocol, &(sic->src_ip), &(sic->dest_ip), sic->src_port, sic->dest_port);
+	if (conn->is_v4) {
+		DEBUG_TRACE("new offloadable: key: %u proto: %d src_ip: %pI4 dst_ip: %pI4, src_port: %d, dst_port: %d\n",
+				key, sic->protocol, &(sic->src_ip), &(sic->dest_ip), sic->src_port, sic->dest_port);
+	} else {
+		DEBUG_TRACE("new offloadable: key: %u proto: %d src_ip: %pI6 dst_ip: %pI6, src_port: %d, dst_port: %d\n",
+				key, sic->protocol, &(sic->src_ip), &(sic->dest_ip), sic->src_port, sic->dest_port);
+	}
 
 	return conn;
 }
@@ -687,15 +742,27 @@ fast_classifier_offload_genl_msg(struct sk_buff *skb, struct genl_info *info)
 	na = info->attrs[FAST_CLASSIFIER_A_TUPLE];
 	fc_msg = nla_data(na);
 
-	DEBUG_TRACE("want to offload: %d-%d, %pIS, %pIS, %d, %d SMAC=%pM DMAC=%pM\n",
-		fc_msg->ethertype,
-		fc_msg->proto,
-		&fc_msg->src_saddr,
-		&fc_msg->dst_saddr,
-		fc_msg->sport,
-		fc_msg->dport,
-		fc_msg->smac,
-		fc_msg->dmac);
+	if (fc_msg->ethertype == AF_INET) {
+		DEBUG_TRACE("want to offload: %d-%d, %pI4, %pI4, %d, %d SMAC=%pM DMAC=%pM\n",
+			    fc_msg->ethertype,
+			    fc_msg->proto,
+			    &fc_msg->src_saddr,
+			    &fc_msg->dst_saddr,
+			    fc_msg->sport,
+			    fc_msg->dport,
+			    fc_msg->smac,
+			    fc_msg->dmac);
+	} else {
+		DEBUG_TRACE("want to offload: %d-%d, %pI6, %pI6, %d, %d SMAC=%pM DMAC=%pM\n",
+			    fc_msg->ethertype,
+			    fc_msg->proto,
+			    &fc_msg->src_saddr,
+			    &fc_msg->dst_saddr,
+			    fc_msg->sport,
+			    fc_msg->dport,
+			    fc_msg->smac,
+			    fc_msg->dmac);
+	}
 
 	spin_lock_bh(&sfe_connections_lock);
 	conn = fast_classifier_sb_find_conn((sfe_ip_addr_t *)&fc_msg->src_saddr,
@@ -747,12 +814,14 @@ static unsigned int fast_classifier_post_routing(struct sk_buff *skb, bool is_v4
 	struct net_device *dev;
 	struct net_device *src_dev;
 	struct net_device *dest_dev;
+	struct net_device *src_dev_tmp;
+	struct net_device *dest_dev_tmp;
 	struct net_device *src_br_dev = NULL;
 	struct net_device *dest_br_dev = NULL;
 	struct nf_conntrack_tuple orig_tuple;
 	struct nf_conntrack_tuple reply_tuple;
 	struct sfe_connection *conn;
-	SFE_NF_CONN_ACCT(acct);
+	struct sk_buff *tmp_skb = NULL;
 
 	/*
 	 * Don't process broadcast or multicast packets.
@@ -790,6 +859,7 @@ static unsigned int fast_classifier_post_routing(struct sk_buff *skb, bool is_v4
 		return NF_ACCEPT;
 	}
 
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 12, 0))
 	/*
 	 * Don't process untracked connections.
 	 */
@@ -798,6 +868,7 @@ static unsigned int fast_classifier_post_routing(struct sk_buff *skb, bool is_v4
 		DEBUG_TRACE("untracked connection\n");
 		return NF_ACCEPT;
 	}
+#endif /*KERNEL_VERSION(4, 12, 0)*/
 
 	/*
 	 * Unconfirmed connection may be dropped by Linux at the final step,
@@ -818,21 +889,6 @@ static unsigned int fast_classifier_post_routing(struct sk_buff *skb, bool is_v4
 		return NF_ACCEPT;
 	}
 
-	/*
-	 * Check if the acceleration of a flow could be rejected quickly.
-	 */
-	acct = nf_conn_acct_find(ct);
-	if (acct) {
-		long long packets = atomic64_read(&SFE_ACCT_COUNTER(acct)[CTINFO2DIR(ctinfo)].packets);
-		if ((packets > 0xff) && (packets & 0xff)) {
-			/*
-			 * Connection hits slow path at least 256 times, so it must be not able to accelerate.
-			 * But we also give it a chance to walk through ECM every 256 packets
-			 */
-			return NF_ACCEPT;
-		}
-	}
-
 	memset(&sic, 0, sizeof(sic));
 
 	/*
@@ -850,7 +906,7 @@ static unsigned int fast_classifier_post_routing(struct sk_buff *skb, bool is_v4
 	/*
 	 * Get addressing information, non-NAT first
 	 */
-	if (is_v4) {
+	if (likely(is_v4)) {
 		u32 dscp;
 
 		sic.src_ip.ip = (__be32)orig_tuple.src.u3.ip;
@@ -926,6 +982,21 @@ static unsigned int fast_classifier_post_routing(struct sk_buff *skb, bool is_v4
 		sic.dest_port = orig_tuple.dst.u.udp.port;
 		sic.src_port_xlate = reply_tuple.dst.u.udp.port;
 		sic.dest_port_xlate = reply_tuple.src.u.udp.port;
+
+		/*
+		 * Somehow, SFE is not playing nice with IPSec traffic.
+		 * Do not accelerate for now.
+		 */
+		if (ntohs(sic.dest_port) == 4500 || ntohs(sic.dest_port) == 500) {
+			if (likely(is_v4))
+				DEBUG_TRACE("quarkysg:: IPsec bypass: %pI4:%d(%pI4:%d) to %pI4:%d(%pI4:%d)\n",
+					&sic.src_ip.ip, ntohs(sic.src_port), &sic.src_ip_xlate.ip, ntohs(sic.src_port_xlate),
+					&sic.dest_ip.ip, ntohs(sic.dest_port), &sic.dest_ip_xlate.ip, ntohs(sic.dest_port_xlate));
+			else
+				DEBUG_TRACE("quarkysg:: IPsec bypass: %pI6:%d to %pI6:%d\n",
+					&sic.src_ip.ip6, ntohs(sic.src_port), &sic.dest_ip.ip6, ntohs(sic.dest_port));
+			return NF_ACCEPT;
+		}
 		break;
 
 	default:
@@ -948,8 +1019,13 @@ static unsigned int fast_classifier_post_routing(struct sk_buff *skb, bool is_v4
 		sic.flags |= SFE_CREATE_FLAG_REMARK_PRIORITY;
 	}
 
-	DEBUG_TRACE("POST_ROUTE: checking new connection: %d src_ip: %pIS dst_ip: %pIS, src_port: %d, dst_port: %d\n",
-		sic.protocol, &sic.src_ip, &sic.dest_ip, sic.src_port, sic.dest_port);
+	if (is_v4) {
+		DEBUG_TRACE("POST_ROUTE: checking new connection: %d src_ip: %pI4 dst_ip: %pI4, src_port: %d, dst_port: %d\n",
+			    sic.protocol, &sic.src_ip, &sic.dest_ip, sic.src_port, sic.dest_port);
+	} else {
+		DEBUG_TRACE("POST_ROUTE: checking new connection: %d src_ip: %pI6 dst_ip: %pI6, src_port: %d, dst_port: %d\n",
+			    sic.protocol, &sic.src_ip, &sic.dest_ip, sic.src_port, sic.dest_port);
+	}
 
 	/*
 	 * If we already have this connection in our list, skip it
@@ -1018,32 +1094,35 @@ static unsigned int fast_classifier_post_routing(struct sk_buff *skb, bool is_v4
 	 * Get the net device and MAC addresses that correspond to the various source and
 	 * destination host addresses.
 	 */
-	if (!fast_classifier_find_dev_and_mac_addr(&sic.src_ip, &src_dev, sic.src_mac, is_v4)) {
+	if (!fast_classifier_find_dev_and_mac_addr(NULL, &sic.src_ip, &src_dev_tmp, sic.src_mac, is_v4)) {
 		fast_classifier_incr_exceptions(FAST_CL_EXCEPTION_NO_SRC_DEV);
 		return NF_ACCEPT;
 	}
+	src_dev = src_dev_tmp;
 
-	if (!fast_classifier_find_dev_and_mac_addr(&sic.src_ip_xlate, &dev, sic.src_mac_xlate, is_v4)) {
+	if (!fast_classifier_find_dev_and_mac_addr(NULL, &sic.src_ip_xlate, &dev, sic.src_mac_xlate, is_v4)) {
 		fast_classifier_incr_exceptions(FAST_CL_EXCEPTION_NO_SRC_XLATE_DEV);
 		goto done1;
 	}
-
 	dev_put(dev);
 
-	if (!fast_classifier_find_dev_and_mac_addr(&sic.dest_ip, &dev, sic.dest_mac, is_v4)) {
+	if (unlikely(!is_v4))
+		tmp_skb = skb;
+
+	if (!fast_classifier_find_dev_and_mac_addr(tmp_skb, &sic.dest_ip, &dev, sic.dest_mac, is_v4)) {
 		fast_classifier_incr_exceptions(FAST_CL_EXCEPTION_NO_DEST_DEV);
 		goto done1;
 	}
-
 	dev_put(dev);
 
-	if (!fast_classifier_find_dev_and_mac_addr(&sic.dest_ip_xlate, &dest_dev, sic.dest_mac_xlate, is_v4)) {
+	if (!fast_classifier_find_dev_and_mac_addr(skb, &sic.dest_ip_xlate, &dest_dev_tmp, sic.dest_mac_xlate, is_v4)) {
 		fast_classifier_incr_exceptions(FAST_CL_EXCEPTION_NO_DEST_XLATE_DEV);
 		goto done1;
 	}
+	dest_dev = dest_dev_tmp;
 
 	/*
-	 * Our devices may actually be part of a bridge interface.  If that's
+	 * Our devices may actually be part of a bridge interface. If that's
 	 * the case then find the bridge interface instead.
 	 */
 	if (src_dev->priv_flags & IFF_BRIDGE_PORT) {
@@ -1053,7 +1132,6 @@ static unsigned int fast_classifier_post_routing(struct sk_buff *skb, bool is_v4
 			DEBUG_TRACE("no bridge found for: %s\n", src_dev->name);
 			goto done2;
 		}
-
 		src_dev = src_br_dev;
 	}
 
@@ -1064,7 +1142,6 @@ static unsigned int fast_classifier_post_routing(struct sk_buff *skb, bool is_v4
 			DEBUG_TRACE("no bridge found for: %s\n", dest_dev->name);
 			goto done3;
 		}
-
 		dest_dev = dest_br_dev;
 	}
 
@@ -1082,7 +1159,7 @@ static unsigned int fast_classifier_post_routing(struct sk_buff *skb, bool is_v4
 	conn = kmalloc(sizeof(*conn), GFP_ATOMIC);
 	if (!conn) {
 		printk(KERN_CRIT "ERROR: no memory for sfe\n");
-		goto done3;
+		goto done4;
 	}
 	conn->hits = 0;
 	conn->offload_permit = 0;
@@ -1096,7 +1173,7 @@ static unsigned int fast_classifier_post_routing(struct sk_buff *skb, bool is_v4
 	if (!p_sic) {
 		printk(KERN_CRIT "ERROR: no memory for sfe\n");
 		kfree(conn);
-		goto done3;
+		goto done4;
 	}
 
 	memcpy(p_sic, &sic, sizeof(sic));
@@ -1111,20 +1188,18 @@ static unsigned int fast_classifier_post_routing(struct sk_buff *skb, bool is_v4
 	/*
 	 * If we had bridge ports then release them too.
 	 */
+done4:
 	if (dest_br_dev) {
 		dev_put(dest_br_dev);
 	}
-
 done3:
 	if (src_br_dev) {
 		dev_put(src_br_dev);
 	}
-
 done2:
-	dev_put(dest_dev);
-
+	dev_put(dest_dev_tmp);
 done1:
-	dev_put(src_dev);
+	dev_put(src_dev_tmp);
 
 	return NF_ACCEPT;
 }
@@ -1198,6 +1273,7 @@ static int fast_classifier_conntrack_event(unsigned int events, struct nf_ct_eve
 		return NOTIFY_DONE;
 	}
 
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 12, 0))
 	/*
 	 * If this is an untracked connection then we can't have any state either.
 	 */
@@ -1205,6 +1281,7 @@ static int fast_classifier_conntrack_event(unsigned int events, struct nf_ct_eve
 		DEBUG_TRACE("ignoring untracked conn\n");
 		return NOTIFY_DONE;
 	}
+#endif /*KERNEL_VERSION(4, 12, 0)*/
 
 	orig_tuple = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
 	sid.protocol = (s32)orig_tuple.dst.protonum;
@@ -1267,8 +1344,13 @@ static int fast_classifier_conntrack_event(unsigned int events, struct nf_ct_eve
 		return NOTIFY_DONE;
 	}
 
-	DEBUG_TRACE("Try to clean up: proto: %d src_ip: %pIS dst_ip: %pIS, src_port: %d, dst_port: %d\n",
-		sid.protocol, &sid.src_ip, &sid.dest_ip, sid.src_port, sid.dest_port);
+	if (is_v4) {
+		DEBUG_TRACE("Try to clean up: proto: %d src_ip: %pI4 dst_ip: %pI4, src_port: %d, dst_port: %d\n",
+			    sid.protocol, &sid.src_ip, &sid.dest_ip, ntohs(sid.src_port), ntohs(sid.dest_port));
+	} else {
+		DEBUG_TRACE("Try to clean up: proto: %d src_ip: %pI6 dst_ip: %pI6, src_port: %d, dst_port: %d\n",
+			    sid.protocol, &sid.src_ip, &sid.dest_ip, ntohs(sid.src_port), ntohs(sid.dest_port));
+	}
 
 	spin_lock_bh(&sfe_connections_lock);
 
@@ -1416,7 +1498,9 @@ static void fast_classifier_sync_rule(struct sfe_connection_sync *sis)
 	}
 
 	ct = nf_ct_tuplehash_to_ctrack(h);
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 9, 0))
 	NF_CT_ASSERT(ct->timeout.data == (unsigned long)ct);
+#endif /*KERNEL_VERSION(4, 9, 0)*/
 
 	/*
 	 * Only update if this is not a fixed timeout
@@ -1427,7 +1511,7 @@ static void fast_classifier_sync_rule(struct sfe_connection_sync *sis)
 		ct->timeout += sis->delta_jiffies;
 #else
 		ct->timeout.expires += sis->delta_jiffies;
-#endif
+#endif /*KERNEL_VERSION(4, 9, 0)*/
 		spin_unlock_bh(&ct->lock);
 	}
 
@@ -1456,7 +1540,7 @@ static void fast_classifier_sync_rule(struct sfe_connection_sync *sis)
 		if (ct->proto.tcp.seen[1].td_maxwin < sis->dest_td_max_window) {
 			ct->proto.tcp.seen[1].td_maxwin = sis->dest_td_max_window;
 		}
-		if ((s32)(ct->proto.tcp.seen[1].td_end - sis->dest_td_end) < 0) { 
+		if ((s32)(ct->proto.tcp.seen[1].td_end - sis->dest_td_end) < 0) {
 			ct->proto.tcp.seen[1].td_end = sis->dest_td_end;
 		}
 		if ((s32)(ct->proto.tcp.seen[1].td_maxend - sis->dest_td_max_end) < 0) {
@@ -1464,42 +1548,6 @@ static void fast_classifier_sync_rule(struct sfe_connection_sync *sis)
 		}
 		spin_unlock_bh(&ct->lock);
 		break;
-
-	case IPPROTO_UDP:
-		/*
-		 * In Linux connection track, UDP flow has two timeout values:
-		 * /proc/sys/net/netfilter/nf_conntrack_udp_timeout:
-		 * 	this is for uni-direction UDP flow, normally its value is 60 seconds
-		 * /proc/sys/net/netfilter/nf_conntrack_udp_timeout_stream:
-		 * 	this is for bi-direction UDP flow, normally its value is 180 seconds
-		 *
-		 * Linux will update timer of UDP flow to stream timeout once it seen packets
-		 * in reply direction. But if flow is accelerated by NSS or SFE, Linux won't
-		 * see any packets. So we have to do the same thing in our stats sync message.
-		 */
-		if (!test_bit(IPS_ASSURED_BIT, &ct->status) && acct) {
-			u_int64_t reply_pkts = atomic64_read(&SFE_ACCT_COUNTER(acct)[IP_CT_DIR_REPLY].packets);
-
-			if (reply_pkts != 0) {
-				struct nf_conntrack_l4proto *l4proto;
-				unsigned int *timeouts;
-
-				set_bit(IPS_SEEN_REPLY_BIT, &ct->status);
-				set_bit(IPS_ASSURED_BIT, &ct->status);
-
-				l4proto = __nf_ct_l4proto_find((sis->is_v6 ? AF_INET6 : AF_INET), IPPROTO_UDP);
-				timeouts = nf_ct_timeout_lookup(&init_net, ct, l4proto);
-
-				spin_lock_bh(&ct->lock);
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 0)) 
-				ct->timeout = nfct_time_stamp + timeouts[UDP_CT_REPLIED];
-#else
-				ct->timeout.expires = jiffies + timeouts[UDP_CT_REPLIED];
-#endif
-				spin_unlock_bh(&ct->lock);
-			}
-		}
-		break;
 	}
 
 	/*
@@ -1590,10 +1638,13 @@ static ssize_t fast_classifier_get_debug_info(struct device *dev,
 	size_t len = 0;
 	struct sfe_connection *conn;
 	u32 i;
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0))
+	struct hlist_node *node;
+#endif
 
 	spin_lock_bh(&sfe_connections_lock);
 	len += scnprintf(buf, PAGE_SIZE - len, "size=%d offload=%d offload_no_match=%d"
-			" offloaded=%d done=%d offl_dbg_msg_fail=%d done_dbg_msg_fail=%d\n",
+			" offloaded=%d done=%d offloaded_fail=%d done_fail=%d\n",
 			sfe_connections_size,
 			atomic_read(&offload_msgs),
 			atomic_read(&offload_no_match_msgs),
@@ -1601,16 +1652,16 @@ static ssize_t fast_classifier_get_debug_info(struct device *dev,
 			atomic_read(&done_msgs),
 			atomic_read(&offloaded_fail_msgs),
 			atomic_read(&done_fail_msgs));
-	sfe_hash_for_each(fc_conn_ht, i, conn, hl) {
+	sfe_hash_for_each(fc_conn_ht, i, node, conn, hl) {
 		len += scnprintf(buf + len, PAGE_SIZE - len,
 				(conn->is_v4 ? "o=%d, p=%d [%pM]:%pI4:%u %pI4:%u:[%pM] m=%08x h=%d\n" : "o=%d, p=%d [%pM]:%pI6:%u %pI6:%u:[%pM] m=%08x h=%d\n"),
 				conn->offloaded,
 				conn->sic->protocol,
 				conn->sic->src_mac,
 				&conn->sic->src_ip,
-				conn->sic->src_port,
+				ntohs(conn->sic->src_port),
 				&conn->sic->dest_ip,
-				conn->sic->dest_port,
+				ntohs(conn->sic->dest_port),
 				conn->sic->dest_mac_xlate,
 				conn->sic->mark,
 				conn->hits);
@@ -1658,7 +1709,7 @@ static ssize_t fast_classifier_get_exceptions(struct device *dev,
 				     char *buf)
 {
 	int idx, len;
-	struct fast_classifier *sc = &__fsc;
+	struct fast_classifier *sc = &__sc;
 
 	spin_lock_bh(&sc->lock);
 	for (len = 0, idx = 0; idx < FAST_CL_EXCEPTION_MAX; idx++) {
@@ -1674,23 +1725,24 @@ static ssize_t fast_classifier_get_exceptions(struct device *dev,
 /*
  * sysfs attributes.
  */
-static const struct device_attribute fast_classifier_attrs[] = {
-	__ATTR(offload_at_pkts, S_IWUSR | S_IRUGO, fast_classifier_get_offload_at_pkts, fast_classifier_set_offload_at_pkts),
-	__ATTR(debug_info, S_IRUGO, fast_classifier_get_debug_info, NULL),
-	__ATTR(skip_to_bridge_ingress, S_IWUSR | S_IRUGO, fast_classifier_get_skip_bridge_ingress, fast_classifier_set_skip_bridge_ingress),
-	__ATTR(exceptions, S_IRUGO, fast_classifier_get_exceptions, NULL),
-};
+static const struct device_attribute fast_classifier_offload_at_pkts_attr =
+	__ATTR(offload_at_pkts, S_IWUSR | S_IRUGO, fast_classifier_get_offload_at_pkts, fast_classifier_set_offload_at_pkts);
+static const struct device_attribute fast_classifier_debug_info_attr =
+	__ATTR(debug_info, S_IRUGO, fast_classifier_get_debug_info, NULL);
+static const struct device_attribute fast_classifier_skip_bridge_ingress =
+	__ATTR(skip_to_bridge_ingress, S_IWUSR | S_IRUGO, fast_classifier_get_skip_bridge_ingress, fast_classifier_set_skip_bridge_ingress);
+static const struct device_attribute fast_classifier_exceptions_attr =
+	__ATTR(exceptions, S_IRUGO, fast_classifier_get_exceptions, NULL);
 
 /*
  * fast_classifier_init()
  */
 static int __init fast_classifier_init(void)
 {
-	struct fast_classifier *sc = &__fsc;
+	struct fast_classifier *sc = &__sc;
 	int result = -1;
-	size_t i, j;
 
-	printk(KERN_ALERT "fast-classifier: starting up\n");
+	printk(KERN_ALERT "fast-classifier (PBR safe v2.1.4a): starting up\n");
 	DEBUG_INFO("SFE CM init\n");
 
 	hash_init(fc_conn_ht);
@@ -1704,13 +1756,34 @@ static int __init fast_classifier_init(void)
 		goto exit1;
 	}
 
-	for (i = 0; i < ARRAY_SIZE(fast_classifier_attrs); i++) {
-		result = sysfs_create_file(sc->sys_fast_classifier, &fast_classifier_attrs[i].attr);
-		if (result) {
-			DEBUG_ERROR("failed to register %s : %d\n",
-				    fast_classifier_attrs[i].attr.name, result);
-			goto exit2;
-		}
+	result = sysfs_create_file(sc->sys_fast_classifier, &fast_classifier_offload_at_pkts_attr.attr);
+	if (result) {
+		DEBUG_ERROR("failed to register offload at pkgs: %d\n", result);
+		goto exit2;
+	}
+
+	result = sysfs_create_file(sc->sys_fast_classifier, &fast_classifier_debug_info_attr.attr);
+	if (result) {
+		DEBUG_ERROR("failed to register debug dev: %d\n", result);
+		sysfs_remove_file(sc->sys_fast_classifier, &fast_classifier_offload_at_pkts_attr.attr);
+		goto exit2;
+	}
+
+	result = sysfs_create_file(sc->sys_fast_classifier, &fast_classifier_skip_bridge_ingress.attr);
+	if (result) {
+		DEBUG_ERROR("failed to register skip bridge on ingress: %d\n", result);
+		sysfs_remove_file(sc->sys_fast_classifier, &fast_classifier_offload_at_pkts_attr.attr);
+		sysfs_remove_file(sc->sys_fast_classifier, &fast_classifier_debug_info_attr.attr);
+		goto exit2;
+	}
+
+	result = sysfs_create_file(sc->sys_fast_classifier, &fast_classifier_exceptions_attr.attr);
+	if (result) {
+		DEBUG_ERROR("failed to register exceptions file: %d\n", result);
+		sysfs_remove_file(sc->sys_fast_classifier, &fast_classifier_offload_at_pkts_attr.attr);
+		sysfs_remove_file(sc->sys_fast_classifier, &fast_classifier_debug_info_attr.attr);
+		sysfs_remove_file(sc->sys_fast_classifier, &fast_classifier_skip_bridge_ingress.attr);
+		goto exit2;
 	}
 
 	sc->dev_notifier.notifier_call = fast_classifier_device_event;
@@ -1728,7 +1801,7 @@ static int __init fast_classifier_init(void)
 	/*
 	 * Register our netfilter hooks.
 	 */
-	result = nf_register_hooks(fast_classifier_ops_post_routing, ARRAY_SIZE(fast_classifier_ops_post_routing));
+	result = nf_register_net_hooks(&init_net, fast_classifier_ops_post_routing, ARRAY_SIZE(fast_classifier_ops_post_routing));
 	if (result < 0) {
 		DEBUG_ERROR("can't register nf post routing hook: %d\n", result);
 		goto exit3;
@@ -1737,22 +1810,21 @@ static int __init fast_classifier_init(void)
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 	/*
 	 * Register a notifier hook to get fast notifications of expired connections.
-	 * Note: In CONFIG_NF_CONNTRACK_CHAIN_EVENTS enabled case, nf_conntrack_register_notifier()
-	 * function always returns 0.
 	 */
-
-#ifdef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
-	(void)nf_conntrack_register_notifier(&init_net, &fast_classifier_conntrack_notifier);
-#else
 	result = nf_conntrack_register_notifier(&init_net, &fast_classifier_conntrack_notifier);
 	if (result < 0) {
 		DEBUG_ERROR("can't register nf notifier hook: %d\n", result);
 		goto exit4;
 	}
 #endif
-#endif
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0))
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 10, 0))
+	result = genl_register_family(&fast_classifier_gnl_family);
+	if (result) {
+		DEBUG_ERROR("failed to register genl family: %d\n", result);
+		goto exit5;
+	}
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0)
 	result = genl_register_family_with_ops_groups(&fast_classifier_gnl_family,
 						      fast_classifier_gnl_ops,
 						      fast_classifier_genl_mcgrp);
@@ -1788,8 +1860,8 @@ static int __init fast_classifier_init(void)
 	/*
 	 * Hook the receive path in the network stack.
 	 */
-	BUG_ON(fast_nat_recv);
-	RCU_INIT_POINTER(fast_nat_recv, fast_classifier_recv);
+	BUG_ON(athrs_fast_nat_recv);
+	RCU_INIT_POINTER(athrs_fast_nat_recv, fast_classifier_recv);
 
 	/*
 	 * Hook the shortcut sync callback.
@@ -1809,17 +1881,18 @@ exit5:
 
 exit4:
 #endif
-	nf_unregister_hooks(fast_classifier_ops_post_routing, ARRAY_SIZE(fast_classifier_ops_post_routing));
+	nf_unregister_net_hooks(&init_net, fast_classifier_ops_post_routing, ARRAY_SIZE(fast_classifier_ops_post_routing));
 
 exit3:
 	unregister_inetaddr_notifier(&sc->inet_notifier);
 	unregister_inet6addr_notifier(&sc->inet6_notifier);
 	unregister_netdevice_notifier(&sc->dev_notifier);
+	sysfs_remove_file(sc->sys_fast_classifier, &fast_classifier_offload_at_pkts_attr.attr);
+	sysfs_remove_file(sc->sys_fast_classifier, &fast_classifier_debug_info_attr.attr);
+	sysfs_remove_file(sc->sys_fast_classifier, &fast_classifier_skip_bridge_ingress.attr);
+	sysfs_remove_file(sc->sys_fast_classifier, &fast_classifier_exceptions_attr.attr);
 
 exit2:
-	for (j = 0; j < i; j++) {
-		sysfs_remove_file(sc->sys_fast_classifier, &fast_classifier_attrs[j].attr);
-	}
 	kobject_put(sc->sys_fast_classifier);
 
 exit1:
@@ -1831,7 +1904,7 @@ exit1:
  */
 static void __exit fast_classifier_exit(void)
 {
-	struct fast_classifier *sc = &__fsc;
+	struct fast_classifier *sc = &__sc;
 	int result = -1;
 
 	DEBUG_INFO("SFE CM exit\n");
@@ -1846,7 +1919,7 @@ static void __exit fast_classifier_exit(void)
 	/*
 	 * Unregister our receive callback.
 	 */
-	RCU_INIT_POINTER(fast_nat_recv, NULL);
+	RCU_INIT_POINTER(athrs_fast_nat_recv, NULL);
 
 	/*
 	 * Wait for all callbacks to complete.
@@ -1868,14 +1941,14 @@ static void __exit fast_classifier_exit(void)
 
 	result = genl_unregister_family(&fast_classifier_gnl_family);
 	if (result != 0) {
-		printk(KERN_CRIT "Unable to unreigster genl_family\n");
+		printk(KERN_CRIT "Unable to unregister genl_family\n");
 	}
 
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 	nf_conntrack_unregister_notifier(&init_net, &fast_classifier_conntrack_notifier);
 
 #endif
-	nf_unregister_hooks(fast_classifier_ops_post_routing, ARRAY_SIZE(fast_classifier_ops_post_routing));
+	nf_unregister_net_hooks(&init_net, fast_classifier_ops_post_routing, ARRAY_SIZE(fast_classifier_ops_post_routing));
 
 	unregister_inet6addr_notifier(&sc->inet6_notifier);
 	unregister_inetaddr_notifier(&sc->inet_notifier);
diff --git a/package/lean/shortcut-fe/src/fast-classifier.h b/package/lean/fast-classifier/src/fast-classifier.h
similarity index 100%
rename from package/lean/shortcut-fe/src/fast-classifier.h
rename to package/lean/fast-classifier/src/fast-classifier.h
diff --git a/package/lean/shortcut-fe/src/nl_classifier_test.c b/package/lean/fast-classifier/src/nl_classifier_test.c
similarity index 100%
rename from package/lean/shortcut-fe/src/nl_classifier_test.c
rename to package/lean/fast-classifier/src/nl_classifier_test.c
diff --git a/package/lean/shortcut-fe/src/userspace_example.c b/package/lean/fast-classifier/src/userspace_example.c
similarity index 99%
rename from package/lean/shortcut-fe/src/userspace_example.c
rename to package/lean/fast-classifier/src/userspace_example.c
index 8bdd4670cd..4f4113d991 100644
--- a/package/lean/shortcut-fe/src/userspace_example.c
+++ b/package/lean/fast-classifier/src/userspace_example.c
@@ -18,7 +18,7 @@
 #include <stdio.h>
 #include <arpa/inet.h>
 
-#include "fast-classifier.h"
+#include <fast-classifier.h>
 
 static struct nl_sock *sock;
 static struct nl_sock *sock_event;
diff --git a/package/lean/luci-app-flowoffload/Makefile b/package/lean/luci-app-flowoffload/Makefile
index 76d03a284a..1152828d2a 100644
--- a/package/lean/luci-app-flowoffload/Makefile
+++ b/package/lean/luci-app-flowoffload/Makefile
@@ -6,10 +6,10 @@
 include $(TOPDIR)/rules.mk
 
 LUCI_TITLE:=LuCI support for Flow Offload
-LUCI_DEPENDS:=+kmod-ipt-offload +pdnsd-alt +kmod-tcp-bbr @!LINUX_4_9
+LUCI_DEPENDS:=+kmod-ipt-offload +pdnsd-alt +kmod-tcp-bbr @LINUX_4_19
 LUCI_PKGARCH:=all
 PKG_VERSION:=1.0
-PKG_RELEASE:=15
+PKG_RELEASE:=16
 
 include $(TOPDIR)/feeds/luci/luci.mk
 
diff --git a/package/lean/luci-app-sfe/Makefile b/package/lean/luci-app-sfe/Makefile
index 210529c785..d57fc16f95 100644
--- a/package/lean/luci-app-sfe/Makefile
+++ b/package/lean/luci-app-sfe/Makefile
@@ -6,7 +6,7 @@
 include $(TOPDIR)/rules.mk
 
 LUCI_TITLE:=LuCI support for Turbo ACC (SFE)
-LUCI_DEPENDS:=+kmod-fast-classifier +pdnsd-alt +kmod-tcp-bbr @LINUX_4_9
+LUCI_DEPENDS:=+kmod-fast-classifier +pdnsd-alt +kmod-tcp-bbr @!LINUX_4_19
 LUCI_PKGARCH:=all
 PKG_VERSION:=1.0
 PKG_RELEASE:=12
diff --git a/package/lean/shortcut-fe/Makefile b/package/lean/shortcut-fe/Makefile
index 9f49cb90c5..a0111cfe25 100644
--- a/package/lean/shortcut-fe/Makefile
+++ b/package/lean/shortcut-fe/Makefile
@@ -15,7 +15,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=shortcut-fe
-PKG_RELEASE:=9
+PKG_RELEASE:=1
 
 include $(INCLUDE_DIR)/package.mk
 
@@ -23,17 +23,27 @@ define KernelPackage/shortcut-fe
   SECTION:=kernel
   CATEGORY:=Kernel modules
   SUBMENU:=Network Support
-  DEPENDS:=@IPV6 @LINUX_4_9
+  DEPENDS:=
   TITLE:=Kernel driver for SFE
   FILES:=$(PKG_BUILD_DIR)/shortcut-fe.ko $(PKG_BUILD_DIR)/shortcut-fe-ipv6.ko
-  KCONFIG:=CONFIG_NF_CONNTRACK_EVENTS=y CONFIG_SHORTCUT_FE=y
-  AUTOLOAD:=$(call AutoProbe,shortcut-fe shortcut-fe-ipv6)
+  KCONFIG:=CONFIG_NF_CONNTRACK_EVENTS=y \
+	   CONFIG_NF_CONNTRACK_TIMEOUT=y \
+	   CONFIG_SHORTCUT_FE=y \
+	   CONFIG_XFRM=y
+  AUTOLOAD:=$(call AutoLoad,09,shortcut-fe shortcut-fe-ipv6)
 endef
 
 define KernelPackage/shortcut-fe/Description
 Shortcut is an in-Linux-kernel IP packet forwarding engine.
 endef
 
+define KernelPackage/shortcut-fe/install
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) ./files/etc/init.d/shortcut-fe $(1)/etc/init.d
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) ./files/usr/bin/sfe_dump $(1)/usr/bin
+endef
+
 define KernelPackage/shortcut-fe-cm
   SECTION:=kernel
   CATEGORY:=Kernel modules
@@ -41,81 +51,31 @@ define KernelPackage/shortcut-fe-cm
   DEPENDS:=+kmod-ipt-conntrack +kmod-shortcut-fe
   TITLE:=Kernel driver for SFE
   FILES:=$(PKG_BUILD_DIR)/shortcut-fe-cm.ko
-  KCONFIG:=CONFIG_NF_CONNTRACK_CHAIN_EVENTS=y CONFIG_NF_CONNTRACK_MARK=y
-  AUTOLOAD:=$(call AutoProbe,shortcut-fe-cm)
+  KCONFIG:=CONFIG_NF_CONNTRACK_CHAIN_EVENTS=y
 endef
 
 define KernelPackage/shortcut-fe-cm/Description
 Simple connection manager for the Shortcut forwarding engine.
 endef
 
-define KernelPackage/fast-classifier
-  SECTION:=kernel
-  CATEGORY:=Kernel modules
-  SUBMENU:=Network Support
-  DEPENDS:=+kmod-ipt-conntrack +kmod-shortcut-fe
-  TITLE:=Kernel driver for FAST Classifier
-  FILES:=$(PKG_BUILD_DIR)/fast-classifier.ko
-  KCONFIG:=CONFIG_NF_CONNTRACK_CHAIN_EVENTS=y CONFIG_NF_CONNTRACK_MARK=y
-  AUTOLOAD:=$(call AutoLoad,z,fast-classifier)
-  PROVIDES:=$(PKG_NAME)
-endef
-
-define KernelPackage/fast-classifier/description
-FAST Classifier connection manager for Shortcut forwarding engine. 
-It talks to SFE to make decisions about offloading connections.
-endef
-
-define Package/fast-classifier-example
-  TITLE:=Example user space program for fast-classifier
-  DEPENDS:=+libnl +kmod-fast-classifier
-endef
-
-define Package/fast-classifier-example/description
-Example user space program that communicates with fast
-classifier kernel module
-endef
-
-MAKE_OPTS:= \
-		ARCH="$(LINUX_KARCH)" \
-		CROSS_COMPILE="$(TARGET_CROSS)" \
-		SUBDIRS="$(PKG_BUILD_DIR)" \
-		EXTRA_CFLAGS="$(EXTRA_CFLAGS)"
+EXTRA_CFLAGS+=-DSFE_SUPPORT_IPV6
 
 define Build/Compile
-	$(MAKE) -C "$(LINUX_DIR)" \
-		$(MAKE_OPTS) \
+	+$(MAKE) $(PKG_JOBS) -C "$(LINUX_DIR)" \
+		$(KERNEL_MAKE_FLAGS) \
+		$(PKG_MAKE_FLAGS) \
+		SUBDIRS="$(PKG_BUILD_DIR)" \
+		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
+		SFE_SUPPORT_IPV6=1 \
 		modules
-	$(if $(CONFIG_PACKAGE_fast-classifier-example),$(Build/Compile/fast-classifier-example))
 endef
 
-define Build/Compile/fast-classifier-example
-	$(TARGET_CC) -o $(PKG_BUILD_DIR)/userspace_fast_classifier \
-		-I $(PKG_BUILD_DIR) \
-		-I$(STAGING_DIR)/usr/include/libnl \
-		-I$(STAGING_DIR)/usr/include/libnl3 \
-		-lnl-genl-3 -lnl-3 \
-		$(PKG_BUILD_DIR)/nl_classifier_test.c
-endef
-
-ifneq ($(CONFIG_PACKAGE_kmod-shortcut-fe)$(CONFIG_PACKAGE_kmod-shortcut-fe-cm)$(CONFIG_PACKAGE_kmod-fast-classifier),)
+ifneq ($(CONFIG_PACKAGE_kmod-shortcut-fe)$(CONFIG_PACKAGE_kmod-shortcut-fe-cm),)
 define Build/InstallDev
 	$(INSTALL_DIR) $(1)/usr/include/shortcut-fe
 	$(CP) -rf $(PKG_BUILD_DIR)/sfe.h $(1)/usr/include/shortcut-fe
-ifneq ($(CONFIG_PACKAGE_kmod-fast-classifier),)
-	$(INSTALL_DIR) $(1)/usr/include
-	$(CP) $(PKG_BUILD_DIR)/fast-classifier.h $(1)/usr/include/
-endif
 endef
 endif
 
-define Package/fast-classifier-example/install
-	$(INSTALL_DIR) $(1)/sbin
-	$(CP) $(PKG_BUILD_DIR)/userspace_fast_classifier $(1)/sbin/
-endef
-
 $(eval $(call KernelPackage,shortcut-fe))
 $(eval $(call KernelPackage,shortcut-fe-cm))
-$(eval $(call KernelPackage,fast-classifier))
-#$(eval $(call BuildPackage,fast-classifier-example))
-
diff --git a/package/lean/shortcut-fe/files/etc/init.d/shortcut-fe b/package/lean/shortcut-fe/files/etc/init.d/shortcut-fe
new file mode 100755
index 0000000000..16ca758764
--- /dev/null
+++ b/package/lean/shortcut-fe/files/etc/init.d/shortcut-fe
@@ -0,0 +1,48 @@
+#!/bin/sh /etc/rc.common
+#
+# Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+# Permission to use, copy, modify, and/or distribute this software for
+# any purpose with or without fee is hereby granted, provided that the
+# above copyright notice and this permission notice appear in all copies.
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+# OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+#SFE connection manager has a lower priority, it should be started after other connection manager
+#to detect the existence of connection manager with higher priority
+START=72
+
+have_cm() {
+	[ -d "/sys/kernel/debug/ecm" ] && echo 1 && return
+
+	echo 0
+}
+
+#load shortcut-fe connection manager
+load_sfe_cm() {
+	local kernel_version=$(uname -r)
+
+	#shortcut-fe-drv.ko is not needed because other connection manager is not enabled
+	[ -d "/sys/module/shortcut_fe_drv" ] && rmmod shortcut_fe_drv
+
+	[ -e "/lib/modules/$kernel_version/shortcut-fe-cm.ko" ] && {
+		[ -d /sys/module/shortcut_fe_cm ] || insmod /lib/modules/$kernel_version/shortcut-fe-cm.ko
+	}
+	[ -e "/lib/modules/$kernel_version/fast-classifier.ko" ] && {
+		[ -d /sys/module/fast_classifier ] || insmod /lib/modules/$kernel_version/fast-classifier.ko
+	}
+}
+
+start() {
+	[ "$(have_cm)" = "1" ] || load_sfe_cm
+}
+
+stop() {
+	[ -d /sys/module/shortcut_fe_cm ] && rmmod shortcut_fe_cm
+	[ -d /sys/module/fast_classifier ] && rmmod fast_classifier
+}
diff --git a/package/lean/shortcut-fe/files/usr/bin/sfe_dump b/package/lean/shortcut-fe/files/usr/bin/sfe_dump
new file mode 100644
index 0000000000..2a224e0ca1
--- /dev/null
+++ b/package/lean/shortcut-fe/files/usr/bin/sfe_dump
@@ -0,0 +1,35 @@
+#!/bin/sh
+#
+# Copyright (c) 2015 The Linux Foundation. All rights reserved.
+# Permission to use, copy, modify, and/or distribute this software for
+# any purpose with or without fee is hereby granted, provided that the
+# above copyright notice and this permission notice appear in all copies.
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+# OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+#@sfe_dump
+#@example : sfe_dump (ipv4|ipv6)
+sfe_dump(){
+	[ -e "/dev/sfe_ipv4" ] || {
+		dev_num=$(cat /sys/sfe_ipv4/debug_dev)
+		mknod /dev/sfe_ipv4 c $dev_num 0
+	}
+	[ -e "/dev/sfe_ipv6" ] || {
+		dev_num=$(cat /sys/sfe_ipv6/debug_dev)
+		mknod /dev/sfe_ipv6 c $dev_num 0
+	}
+	cat /dev/sfe_$1
+}
+
+if [ -z "$1" ]; then
+	sfe_dump ipv4
+	sfe_dump ipv6
+else
+	sfe_dump $1
+fi
diff --git a/package/lean/shortcut-fe/src/Makefile b/package/lean/shortcut-fe/src/Makefile
index 88d95d232e..3b1ceaa44e 100644
--- a/package/lean/shortcut-fe/src/Makefile
+++ b/package/lean/shortcut-fe/src/Makefile
@@ -2,13 +2,22 @@
 # Makefile for Shortcut FE.
 #
 
-obj-m += shortcut-fe.o shortcut-fe-ipv6.o shortcut-fe-cm.o fast-classifier.o
+obj-m += shortcut-fe.o
+
+ifdef SFE_SUPPORT_IPV6
+obj-m += shortcut-fe-ipv6.o
+endif
+
+obj-m += shortcut-fe-cm.o
 
 shortcut-fe-objs := \
 	sfe_ipv4.o
 
+ifdef SFE_SUPPORT_IPV6
 shortcut-fe-ipv6-objs := \
 	sfe_ipv6.o
+endif
 
 shortcut-fe-cm-objs := \
 	sfe_cm.o
+
diff --git a/package/lean/shortcut-fe/src/README b/package/lean/shortcut-fe/src/README
deleted file mode 100644
index 1bf1cc2555..0000000000
--- a/package/lean/shortcut-fe/src/README
+++ /dev/null
@@ -1,122 +0,0 @@
-Shortcut Forwarding Engine
---------------------------
-
-Welcome to "Shortcut" :-)
-
-Here's a quick FAQ:
-
-
-Q) What is Shortcut?
-
-A) Shortcut is an in-Linux-kernel IP packet forwarding engine.  It's designed
-to offer very high speed IP packet forwarding based on IP connection tracking.
-It's dramatically faster than the standard netfilter-based NAT forwarding path
-but is designed to synchronise state back to netfilter/conntrack so that it
-doesn't need to deal with all of the complexities of special cases.
-
-
-Q) What versions of IP does it support?
-
-A) The current version only supports IPv4 but will be extended to support IPv6 in
-the future.
-
-
-Q) What transport protocols does it support?
-
-A) TCP and UDP.  It also knows enough about ICMP to spot ICMP error messages
-related to TCP and UDP and handle things accordingly.
-
-
-Q) Is there a design spec for this software?
-
-A) Not at the moment.  I'll write one when I get more time.  The code is
-intended to be a good tutorial though - it's very heavily commented.  If you
-find yourself reading something and not understanding it then I take that to
-mean I've probably not done a sufficently good job of explaining what it's
-doing in the comments.  Let me know - I will try to fix it :-)
-
-
-Q) Why was it written?
-
-A) It was written as a demonstration of what can be done to provide high
-performance forwarding inside the kernel.  There were two initial motivations:
-
-1) To provide a platform to enable research into how QoS analysis systems can
-offload work and avoid huge Linux overheads.
-
-2) To provide a tool to investigate the behaviour of various processors, SoCs
-and software sets so that we can characterize and design new network processor
-SoCs.
-
-
-Q) How much faster is it than the Linux kernel forwarding path?
-
-A) At the time of pushing this to github it's been tested on a QCA AP135.
-This has a Scorpion (QCA Scopion, not the QMC one :-)) SoC, QCA9550.  The
-SoC's processor is a MIPS74K running at 720 MHz and with a DDR2 memory
-subsystem that offers a peak of 600 MT/s (16-bit transfers).
-
-Running IPv4 NAT forwarding of UDP between the board's 2 GMAC ports and
-using a SmartBits 200 as a traffic generator Linux is able to forward 70k PPS.
-Once the SFE code is invoked this will increase to 350k PPS!
-
-There's also a slightly hacky mode which causes SFE to bypass the Linux
-bridge layer, but this isn't really ready for use because it doesn't have
-sufficient MAC address checks or integration of statistics back to the
-Ethernet bridge, but that runs at 436k PPS.
-
-
-Q) Are there any diagnostics?
-
-A) Yes, this is a research tool after all!  There's a complex way to do this
-that's more general purpose and a simple one - here's the simple one:
-
-	mknod /dev/sfe c 253 0
-
-The file /dev/sfe is an XML-ish output and provides details of all the
-network connections currently being offloaded.  It also reports the numbers
-of packets that took various "exception" paths within the code.  In addition
-it provides a summary of the number of connections, attempts to accelerate
-connections, cancel accelerations, etc.  It also reports the numbers of
-packets that were forwarded and not forwarded by the engine and has some
-stats on the effectiveness of the hashing algorithm it uses.
-
-
-Q) How does the code interact with Linux?
-
-A) There are four minor patches required to make this software run with
-Linux.  These are currently against a 3.3.8 or 3.4.0 kernel:
-
-* (net/core/dev.c) adds a hook to allow packets to be extracted out.
-
-* (net/netfilter/nf_conntrack_proto_tcp.c) exposes a state variable inside
-  netfilter that's necessary to enable TCP sequence and ACK checking within
-  the offload path.  Note that this specific patch is against the QCA QSDK
-  patched version of 3.3.8 - there's a slightly braindead "performance"
-  patch in that kernel, courtesy of the OpenWrt community that makes the
-  Linux forwarding path slightly faster at the expense of losing
-  functionality :-(
-
-* (net/Kconfig) adds the shortcut-fe option.
-
-* (net/Makefile) adds the shortcut-fe build support.
-
-Once these are applied and the module is loaded then everything else
-is automatic :-)  The patches are in this git repo.
-
-
-Q) Are any of the pieces reused from other projects?
-
-A) Yes!  Some of the forwarding concepts are reused from the Ubicom Network
-Accelerator that morphed into part of the Akronite NSS.  This code has all
-been substantially changed though to accomodate Linux's needs.
-
-There are also some pieces that I borrowed from the QCA "FastNAT" software
-written by Xiaoping Fan <xfan@qca.qualcomm.com>.  Xiaoping's code was the
-first actual demonstration within QCA that this in-kernel concept could yield
-signficant performance gains.
-
-
-Enjoy!
-Dave Hudson <dhudson@qti.qualcomm.com>
-
diff --git a/package/lean/shortcut-fe/src/sfe.h b/package/lean/shortcut-fe/src/sfe.h
index 21a1275560..279e7b3dca 100644
--- a/package/lean/shortcut-fe/src/sfe.h
+++ b/package/lean/shortcut-fe/src/sfe.h
@@ -2,7 +2,7 @@
  * sfe.h
  *	Shortcut forwarding engine.
  *
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
  * above copyright notice and this permission notice appear in all copies.
@@ -15,47 +15,100 @@
  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+
 /*
- * Debug output verbosity level.
+ * The following are debug macros used throughout the SFE.
+ *
+ * The DEBUG_LEVEL enables the followings based on its value,
+ * when dynamic debug option is disabled.
+ *
+ * 0 = OFF
+ * 1 = ASSERTS / ERRORS
+ * 2 = 1 + WARN
+ * 3 = 2 + INFO
+ * 4 = 3 + TRACE
  */
-#define DEBUG_LEVEL 0
+#define DEBUG_LEVEL 2
 
 #if (DEBUG_LEVEL < 1)
+#define DEBUG_ASSERT(s, ...)
 #define DEBUG_ERROR(s, ...)
 #else
-#define DEBUG_ERROR(s, ...) \
-do { \
-	printk("%s[%u]: ERROR:", __FILE__, __LINE__); \
-	printk(s, ##__VA_ARGS__); \
-} while (0)
+#define DEBUG_ASSERT(c, s, ...) if (!(c)) { pr_emerg("ASSERT: %s:%d:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__); BUG(); }
+#define DEBUG_ERROR(s, ...) pr_err("%s:%d:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__)
 #endif
 
+#if defined(CONFIG_DYNAMIC_DEBUG)
+/*
+ * Compile messages for dynamic enable/disable
+ */
+#define DEBUG_WARN(s, ...) pr_debug("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__)
+#define DEBUG_INFO(s, ...) pr_debug("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__)
+#define DEBUG_TRACE(s, ...) pr_debug("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__)
+#else
+
+/*
+ * Statically compile messages at different levels
+ */
 #if (DEBUG_LEVEL < 2)
 #define DEBUG_WARN(s, ...)
 #else
-#define DEBUG_WARN(s, ...) \
-do { \
-	printk("%s[%u]: WARN:", __FILE__, __LINE__); \
-	printk(s, ##__VA_ARGS__); \
-} while (0)
+#define DEBUG_WARN(s, ...) pr_warn("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__)
 #endif
 
 #if (DEBUG_LEVEL < 3)
 #define DEBUG_INFO(s, ...)
 #else
-#define DEBUG_INFO(s, ...) \
-do { \
-	printk("%s[%u]: INFO:", __FILE__, __LINE__); \
-	printk(s, ##__VA_ARGS__); \
-} while (0)
+#define DEBUG_INFO(s, ...) pr_notice("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__)
 #endif
 
 #if (DEBUG_LEVEL < 4)
 #define DEBUG_TRACE(s, ...)
 #else
-#define DEBUG_TRACE(s, ...) \
-do { \
-	printk("%s[%u]: TRACE:", __FILE__, __LINE__); \
-	printk(s, ##__VA_ARGS__); \
-} while (0)
+#define DEBUG_TRACE(s, ...) pr_info("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__)
 #endif
+#endif
+
+#ifdef CONFIG_NF_FLOW_COOKIE
+typedef int (*flow_cookie_set_func_t)(u32 protocol, __be32 src_ip, __be16 src_port,
+				      __be32 dst_ip, __be16 dst_port, u16 flow_cookie);
+/*
+ * sfe_register_flow_cookie_cb
+ *	register a function in SFE to let SFE use this function to configure flow cookie for a flow
+ *
+ * Hardware driver which support flow cookie should register a callback function in SFE. Then SFE
+ * can use this function to configure flow cookie for a flow.
+ * return: 0, success; !=0, fail
+ */
+int sfe_register_flow_cookie_cb(flow_cookie_set_func_t cb);
+
+/*
+ * sfe_unregister_flow_cookie_cb
+ *	unregister function which is used to configure flow cookie for a flow
+ *
+ * return: 0, success; !=0, fail
+ */
+int sfe_unregister_flow_cookie_cb(flow_cookie_set_func_t cb);
+
+typedef int (*sfe_ipv6_flow_cookie_set_func_t)(u32 protocol, __be32 src_ip[4], __be16 src_port,
+						__be32 dst_ip[4], __be16 dst_port, u16 flow_cookie);
+
+/*
+ * sfe_ipv6_register_flow_cookie_cb
+ *	register a function in SFE to let SFE use this function to configure flow cookie for a flow
+ *
+ * Hardware driver which support flow cookie should register a callback function in SFE. Then SFE
+ * can use this function to configure flow cookie for a flow.
+ * return: 0, success; !=0, fail
+ */
+int sfe_ipv6_register_flow_cookie_cb(sfe_ipv6_flow_cookie_set_func_t cb);
+
+/*
+ * sfe_ipv6_unregister_flow_cookie_cb
+ *	unregister function which is used to configure flow cookie for a flow
+ *
+ * return: 0, success; !=0, fail
+ */
+int sfe_ipv6_unregister_flow_cookie_cb(sfe_ipv6_flow_cookie_set_func_t cb);
+
+#endif /*CONFIG_NF_FLOW_COOKIE*/
diff --git a/package/lean/shortcut-fe/src/sfe_backport.h b/package/lean/shortcut-fe/src/sfe_backport.h
index b24f6e67e6..2f8c8ca3c1 100644
--- a/package/lean/shortcut-fe/src/sfe_backport.h
+++ b/package/lean/shortcut-fe/src/sfe_backport.h
@@ -17,6 +17,38 @@
 
 #include <linux/version.h>
 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0))
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+#include <net/netfilter/nf_conntrack_timeout.h>
+#else
+enum udp_conntrack {
+	UDP_CT_UNREPLIED,
+	UDP_CT_REPLIED,
+	UDP_CT_MAX
+};
+
+static inline unsigned int *
+nf_ct_timeout_lookup(struct net *net, struct nf_conn *ct,
+		     struct nf_conntrack_l4proto *l4proto)
+{
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+	struct nf_conn_timeout *timeout_ext;
+	unsigned int *timeouts;
+
+	timeout_ext = nf_ct_timeout_find(ct);
+	if (timeout_ext)
+		timeouts = NF_CT_TIMEOUT_EXT_DATA(timeout_ext);
+	else
+		timeouts = l4proto->get_timeouts(net);
+
+	return timeouts;
+#else
+	return l4proto->get_timeouts(net);
+#endif /*CONFIG_NF_CONNTRACK_TIMEOUT*/
+}
+#endif /*KERNEL_VERSION(3, 7, 0)*/
+#endif /*KERNEL_VERSION(3, 4, 0)*/
+
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0))
 #define sfe_define_post_routing_hook(FN_NAME, HOOKNUM, OPS, SKB, UNUSED, OUT, OKFN) \
 static unsigned int FN_NAME(void *priv, \
@@ -131,8 +163,33 @@ static inline struct net_device *sfe_dev_get_master(struct net_device *dev)
 #define SFE_ACCT_COUNTER(NM) (NM)
 #endif
 
-#define sfe_hash_for_each_possible(name, obj, member, key) \
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
+#define sfe_hash_for_each_possible(name, obj, node, member, key) \
 	hash_for_each_possible(name, obj, member, key)
+#else
+#define sfe_hash_for_each_possible(name, obj, node, member, key) \
+	hash_for_each_possible(name, obj, node, member, key)
+#endif
 
-#define sfe_hash_for_each(name, bkt, obj, member) \
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
+#define sfe_hash_for_each(name, bkt, node, obj, member) \
 	hash_for_each(name, bkt, obj, member)
+#else
+#define sfe_hash_for_each(name, bkt, node, obj, member) \
+	hash_for_each(name, bkt, node, obj, member)
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0))
+#define sfe_dst_get_neighbour(dst, daddr) dst_neigh_lookup(dst, daddr)
+#else
+static inline struct neighbour *
+sfe_dst_get_neighbour(struct dst_entry *dst, void *daddr)
+{
+	struct neighbour *neigh = dst_get_neighbour_noref(dst);
+
+	if (neigh)
+		neigh_hold(neigh);
+
+	return neigh;
+}
+#endif
diff --git a/package/lean/shortcut-fe/src/sfe_cm.c b/package/lean/shortcut-fe/src/sfe_cm.c
index 6d3e21085a..4e5a0c1841 100644
--- a/package/lean/shortcut-fe/src/sfe_cm.c
+++ b/package/lean/shortcut-fe/src/sfe_cm.c
@@ -2,7 +2,7 @@
  * sfe-cm.c
  *	Shortcut forwarding engine connection manager.
  *
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved.
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
  * above copyright notice and this permission notice appear in all copies.
@@ -29,10 +29,9 @@
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_core.h>
-#include <net/netfilter/nf_conntrack_timeout.h>
 #include <linux/netfilter/xt_dscp.h>
 #include <linux/if_bridge.h>
-#include <net/pkt_sched.h>
+#include <linux/version.h>
 
 #include "sfe.h"
 #include "sfe_cm.h"
@@ -103,7 +102,6 @@ struct sfe_cm {
 
 static struct sfe_cm __sc;
 
-
 /*
  * sfe_cm_incr_exceptions()
  *	increase an exception counter.
@@ -123,7 +121,7 @@ static inline void sfe_cm_incr_exceptions(sfe_cm_exception_t except)
  *
  * Returns 1 if the packet is forwarded or 0 if it isn't.
  */
-static int sfe_cm_recv(struct sk_buff *skb)
+int sfe_cm_recv(struct sk_buff *skb)
 {
 	struct net_device *dev;
 
@@ -136,16 +134,6 @@ static int sfe_cm_recv(struct sk_buff *skb)
 
 	dev = skb->dev;
 
-#ifdef CONFIG_NET_CLS_ACT
-	/*
-	 * If ingress Qdisc configured, and packet not processed by ingress Qdisc yet
-	 * We cannot accelerate this packet.
-	 */
-	if (dev->ingress_queue && !(skb->tc_verd & TC_NCLS)) {
-		return 0;
-	}
-#endif
-
 	/*
 	 * We're only interested in IPv4 and IPv6 packets.
 	 */
@@ -232,7 +220,11 @@ static bool sfe_cm_find_dev_and_mac_addr(sfe_ip_addr_t *addr, struct net_device
 
 		dst = (struct dst_entry *)rt;
 	} else {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0))
+		rt6 = rt6_lookup(&init_net, (struct in6_addr *)addr->ip6, 0, 0, NULL, 0);
+#else
 		rt6 = rt6_lookup(&init_net, (struct in6_addr *)addr->ip6, 0, 0, 0);
+#endif /*KERNEL_VERSION(4, 17, 0)*/
 		if (!rt6) {
 			goto ret_fail;
 		}
@@ -241,7 +233,7 @@ static bool sfe_cm_find_dev_and_mac_addr(sfe_ip_addr_t *addr, struct net_device
 	}
 
 	rcu_read_lock();
-	neigh = dst_neigh_lookup(dst, addr);
+	neigh = sfe_dst_get_neighbour(dst, addr);
 	if (unlikely(!neigh)) {
 		rcu_read_unlock();
 		dst_release(dst);
@@ -297,6 +289,8 @@ static unsigned int sfe_cm_post_routing(struct sk_buff *skb, int is_v4)
 	struct net_device *dev;
 	struct net_device *src_dev;
 	struct net_device *dest_dev;
+	struct net_device *src_dev_tmp;
+	struct net_device *dest_dev_tmp;
 	struct net_device *src_br_dev = NULL;
 	struct net_device *dest_br_dev = NULL;
 	struct nf_conntrack_tuple orig_tuple;
@@ -358,6 +352,7 @@ static unsigned int sfe_cm_post_routing(struct sk_buff *skb, int is_v4)
 		return NF_ACCEPT;
 	}
 
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 12, 0))
 	/*
 	 * Don't process untracked connections.
 	 */
@@ -366,6 +361,7 @@ static unsigned int sfe_cm_post_routing(struct sk_buff *skb, int is_v4)
 		DEBUG_TRACE("untracked connection\n");
 		return NF_ACCEPT;
 	}
+#endif /*KERNEL_VERSION(4, 12, 0)*/
 
 	/*
 	 * Unconfirmed connection may be dropped by Linux at the final step,
@@ -537,7 +533,11 @@ static unsigned int sfe_cm_post_routing(struct sk_buff *skb, int is_v4)
 	 * For packets de-capsulated from xfrm, we still can accelerate it
 	 * on the direction we just received the packet.
 	 */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0))
+	if (unlikely(skb_ext_exist(skb, SKB_EXT_SEC_PATH))) {
+#else
 	if (unlikely(skb->sp)) {
+#endif
 		if (sic.protocol == IPPROTO_TCP &&
 		    !(sic.flags & SFE_CREATE_FLAG_NO_SEQ_CHECK)) {
 			return NF_ACCEPT;
@@ -564,29 +564,29 @@ static unsigned int sfe_cm_post_routing(struct sk_buff *skb, int is_v4)
 	 * Get the net device and MAC addresses that correspond to the various source and
 	 * destination host addresses.
 	 */
-	if (!sfe_cm_find_dev_and_mac_addr(&sic.src_ip, &src_dev, sic.src_mac, is_v4)) {
+	if (!sfe_cm_find_dev_and_mac_addr(&sic.src_ip, &src_dev_tmp, sic.src_mac, is_v4)) {
 		sfe_cm_incr_exceptions(SFE_CM_EXCEPTION_NO_SRC_DEV);
 		return NF_ACCEPT;
 	}
+	src_dev = src_dev_tmp;
 
 	if (!sfe_cm_find_dev_and_mac_addr(&sic.src_ip_xlate, &dev, sic.src_mac_xlate, is_v4)) {
 		sfe_cm_incr_exceptions(SFE_CM_EXCEPTION_NO_SRC_XLATE_DEV);
 		goto done1;
 	}
-
 	dev_put(dev);
 
 	if (!sfe_cm_find_dev_and_mac_addr(&sic.dest_ip, &dev, sic.dest_mac, is_v4)) {
 		sfe_cm_incr_exceptions(SFE_CM_EXCEPTION_NO_DEST_DEV);
 		goto done1;
 	}
-
 	dev_put(dev);
 
-	if (!sfe_cm_find_dev_and_mac_addr(&sic.dest_ip_xlate, &dest_dev, sic.dest_mac_xlate, is_v4)) {
+	if (!sfe_cm_find_dev_and_mac_addr(&sic.dest_ip_xlate, &dest_dev_tmp, sic.dest_mac_xlate, is_v4)) {
 		sfe_cm_incr_exceptions(SFE_CM_EXCEPTION_NO_DEST_XLATE_DEV);
 		goto done1;
 	}
+	dest_dev = dest_dev_tmp;
 
 	/*
 	 * Our devices may actually be part of a bridge interface.  If that's
@@ -599,7 +599,6 @@ static unsigned int sfe_cm_post_routing(struct sk_buff *skb, int is_v4)
 			DEBUG_TRACE("no bridge found for: %s\n", src_dev->name);
 			goto done2;
 		}
-
 		src_dev = src_br_dev;
 	}
 
@@ -610,7 +609,6 @@ static unsigned int sfe_cm_post_routing(struct sk_buff *skb, int is_v4)
 			DEBUG_TRACE("no bridge found for: %s\n", dest_dev->name);
 			goto done3;
 		}
-
 		dest_dev = dest_br_dev;
 	}
 
@@ -619,7 +617,7 @@ static unsigned int sfe_cm_post_routing(struct sk_buff *skb, int is_v4)
 
 	sic.src_mtu = src_dev->mtu;
 	sic.dest_mtu = dest_dev->mtu;
-	sic.mark = skb->mark;
+
 	if (likely(is_v4)) {
 		sfe_ipv4_create_rule(&sic);
 	} else {
@@ -632,17 +630,14 @@ static unsigned int sfe_cm_post_routing(struct sk_buff *skb, int is_v4)
 	if (dest_br_dev) {
 		dev_put(dest_br_dev);
 	}
-
 done3:
 	if (src_br_dev) {
 		dev_put(src_br_dev);
 	}
-
 done2:
-	dev_put(dest_dev);
-
+	dev_put(dest_dev_tmp);
 done1:
-	dev_put(src_dev);
+	dev_put(src_dev_tmp);
 
 	return NF_ACCEPT;
 }
@@ -692,6 +687,7 @@ static int sfe_cm_conntrack_event(unsigned int events, struct nf_ct_event *item)
 		return NOTIFY_DONE;
 	}
 
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 12, 0))
 	/*
 	 * If this is an untracked connection then we can't have any state either.
 	 */
@@ -699,6 +695,7 @@ static int sfe_cm_conntrack_event(unsigned int events, struct nf_ct_event *item)
 		DEBUG_TRACE("ignoring untracked conn\n");
 		return NOTIFY_DONE;
 	}
+#endif /*KERNEL_VERSION(4, 12, 0)*/
 
 	/*
 	 * We're only interested in destroy events.
@@ -771,7 +768,9 @@ static struct nf_ct_event_notifier sfe_cm_conntrack_notifier = {
  */
 static struct nf_hook_ops sfe_cm_ops_post_routing[] __read_mostly = {
 	SFE_IPV4_NF_POST_ROUTING_HOOK(__sfe_cm_ipv4_post_routing_hook),
+#ifdef SFE_SUPPORT_IPV6
 	SFE_IPV6_NF_POST_ROUTING_HOOK(__sfe_cm_ipv6_post_routing_hook),
+#endif
 };
 
 /*
@@ -824,18 +823,20 @@ static void sfe_cm_sync_rule(struct sfe_connection_sync *sis)
 	}
 
 	ct = nf_ct_tuplehash_to_ctrack(h);
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 9, 0))
 	NF_CT_ASSERT(ct->timeout.data == (unsigned long)ct);
+#endif /*KERNEL_VERSION(4, 9, 0)*/
 
 	/*
 	 * Only update if this is not a fixed timeout
 	 */
 	if (!test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status)) {
 		spin_lock_bh(&ct->lock);
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 0)) 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 0))
 		ct->timeout += sis->delta_jiffies;
 #else
 		ct->timeout.expires += sis->delta_jiffies;
-#endif
+#endif /*KERNEL_VERSION(4, 9, 0)*/
 		spin_unlock_bh(&ct->lock);
 	}
 
@@ -872,6 +873,7 @@ static void sfe_cm_sync_rule(struct sfe_connection_sync *sis)
 		}
 		spin_unlock_bh(&ct->lock);
 		break;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0))
 	case IPPROTO_UDP:
 		/*
 		 * In Linux connection track, UDP flow has two timeout values:
@@ -888,25 +890,31 @@ static void sfe_cm_sync_rule(struct sfe_connection_sync *sis)
 			u_int64_t reply_pkts = atomic64_read(&SFE_ACCT_COUNTER(acct)[IP_CT_DIR_REPLY].packets);
 
 			if (reply_pkts != 0) {
-				struct nf_conntrack_l4proto *l4proto;
 				unsigned int *timeouts;
 
 				set_bit(IPS_SEEN_REPLY_BIT, &ct->status);
 				set_bit(IPS_ASSURED_BIT, &ct->status);
 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 19, 0))
+				timeouts = nf_ct_timeout_lookup(ct);
+#else
+				struct nf_conntrack_l4proto *l4proto;
+
 				l4proto = __nf_ct_l4proto_find((sis->is_v6 ? AF_INET6 : AF_INET), IPPROTO_UDP);
 				timeouts = nf_ct_timeout_lookup(&init_net, ct, l4proto);
+#endif /*KERNEL_VERSION(4, 19, 0)*/
 
 				spin_lock_bh(&ct->lock);
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 0))
-				ct->timeout = nfct_time_stamp + timeouts[UDP_CT_REPLIED];
+				ct->timeout = jiffies + timeouts[UDP_CT_REPLIED];
 #else
 				ct->timeout.expires = jiffies + timeouts[UDP_CT_REPLIED];
-#endif
+#endif /*KERNEL_VERSION(4, 9, 0)*/
 				spin_unlock_bh(&ct->lock);
 			}
 		}
 		break;
+#endif /*KERNEL_VERSION(3, 4, 0)*/
 	}
 
 	/*
@@ -918,7 +926,7 @@ static void sfe_cm_sync_rule(struct sfe_connection_sync *sis)
 /*
  * sfe_cm_device_event()
  */
-static int sfe_cm_device_event(struct notifier_block *this, unsigned long event, void *ptr)
+int sfe_cm_device_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
 	struct net_device *dev = SFE_DEV_EVENT_PTR(ptr);
 
@@ -980,80 +988,11 @@ static ssize_t sfe_cm_get_exceptions(struct device *dev,
 	return len;
 }
 
-/*
- * sfe_cm_get_stop
- * 	dump stop
- */
-static ssize_t sfe_cm_get_stop(struct device *dev,
-                               struct device_attribute *attr,
-                               char *buf)
-{
-	int (*fast_recv)(struct sk_buff *skb);
-	rcu_read_lock();
-	fast_recv = rcu_dereference(fast_nat_recv);
-	rcu_read_unlock();
-	return snprintf(buf, (ssize_t)PAGE_SIZE, "%d\n", fast_recv ? 0 : 1);
-}
-
-static ssize_t sfe_cm_set_stop(struct device *dev,
-                               struct device_attribute *attr,
-                               const char *buf, size_t count)
-{
-	int ret;
-	u32 num;
-	int (*fast_recv)(struct sk_buff *skb);
-
-	ret = kstrtou32(buf, 0, &num);
-	if (ret)
-		return ret;
-
-	/*
-	 * Hook/Unhook the receive path in the network stack.
-	 */
-	if (num) {
-		RCU_INIT_POINTER(fast_nat_recv, NULL);
-	} else {
-		rcu_read_lock();
-		fast_recv = rcu_dereference(fast_nat_recv);
-		rcu_read_unlock();
-		if (!fast_recv) {
-			BUG_ON(fast_nat_recv);
-			RCU_INIT_POINTER(fast_nat_recv, sfe_cm_recv);
-		}
-	}
-
-	DEBUG_TRACE("sfe_cm_stop = %d\n", num);
-	return count;
-}
-
-/*
- * sfe_cm_get_defunct_all
- * 	dump state of SFE
- */
-static ssize_t sfe_cm_get_defunct_all(struct device *dev,
-                                      struct device_attribute *attr,
-                                      char *buf)
-{
-	return snprintf(buf, (ssize_t)PAGE_SIZE, "%d\n", 0);
-}
-
-static ssize_t sfe_cm_set_defunct_all(struct device *dev,
-                                      struct device_attribute *attr,
-                                      const char *buf, size_t count)
-{
-	sfe_ipv4_destroy_all_rules_for_dev(NULL);
-	sfe_ipv6_destroy_all_rules_for_dev(NULL);
-	return count;
-}
-
 /*
  * sysfs attributes.
  */
-static const struct device_attribute sfe_attrs[] = {
-	__ATTR(exceptions, S_IRUGO, sfe_cm_get_exceptions, NULL),
-	__ATTR(stop, S_IWUSR | S_IRUGO, sfe_cm_get_stop, sfe_cm_set_stop),
-	__ATTR(defunct_all, S_IWUSR | S_IRUGO, sfe_cm_get_defunct_all, sfe_cm_set_defunct_all),
-};
+static const struct device_attribute sfe_cm_exceptions_attr =
+	__ATTR(exceptions, S_IRUGO, sfe_cm_get_exceptions, NULL);
 
 /*
  * sfe_cm_init()
@@ -1062,7 +1001,6 @@ static int __init sfe_cm_init(void)
 {
 	struct sfe_cm *sc = &__sc;
 	int result = -1;
-	size_t i, j;
 
 	DEBUG_INFO("SFE CM init\n");
 
@@ -1075,13 +1013,13 @@ static int __init sfe_cm_init(void)
 		goto exit1;
 	}
 
-	for (i = 0; i < ARRAY_SIZE(sfe_attrs); i++) {
-		result = sysfs_create_file(sc->sys_sfe_cm, &sfe_attrs[i].attr);
-		if (result) {
-			DEBUG_ERROR("failed to register %s : %d\n",
-				    sfe_attrs[i].attr.name, result);
-			goto exit2;
-		}
+	/*
+	 * Create sys/sfe_cm/exceptions
+	 */
+	result = sysfs_create_file(sc->sys_sfe_cm, &sfe_cm_exceptions_attr.attr);
+	if (result) {
+		DEBUG_ERROR("failed to register exceptions file: %d\n", result);
+		goto exit2;
 	}
 
 	sc->dev_notifier.notifier_call = sfe_cm_device_event;
@@ -1098,19 +1036,18 @@ static int __init sfe_cm_init(void)
 	/*
 	 * Register our netfilter hooks.
 	 */
-	result = nf_register_hooks(sfe_cm_ops_post_routing, ARRAY_SIZE(sfe_cm_ops_post_routing));
+	result = nf_register_net_hooks(&init_net, sfe_cm_ops_post_routing, ARRAY_SIZE(sfe_cm_ops_post_routing));
 	if (result < 0) {
 		DEBUG_ERROR("can't register nf post routing hook: %d\n", result);
 		goto exit3;
 	}
 
-#ifdef CONFIG_NF_CONNTRACK_EVENTS
 	/*
 	 * Register a notifier hook to get fast notifications of expired connections.
 	 * Note: In CONFIG_NF_CONNTRACK_CHAIN_EVENTS enabled case, nf_conntrack_register_notifier()
 	 * function always returns 0.
 	 */
-
+#ifdef CONFIG_NF_CONNTRACK_EVENTS
 #ifdef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
 	(void)nf_conntrack_register_notifier(&init_net, &sfe_cm_conntrack_notifier);
 #else
@@ -1124,6 +1061,12 @@ static int __init sfe_cm_init(void)
 
 	spin_lock_init(&sc->lock);
 
+	/*
+	 * Hook the receive path in the network stack.
+	 */
+	BUG_ON(athrs_fast_nat_recv);
+	RCU_INIT_POINTER(athrs_fast_nat_recv, sfe_cm_recv);
+
 	/*
 	 * Hook the shortcut sync callback.
 	 */
@@ -1134,7 +1077,7 @@ static int __init sfe_cm_init(void)
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 #ifndef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
 exit4:
-	nf_unregister_hooks(sfe_cm_ops_post_routing, ARRAY_SIZE(sfe_cm_ops_post_routing));
+	nf_unregister_net_hooks(&init_net, sfe_cm_ops_post_routing, ARRAY_SIZE(sfe_cm_ops_post_routing));
 #endif
 #endif
 exit3:
@@ -1142,9 +1085,6 @@ exit3:
 	unregister_inetaddr_notifier(&sc->inet_notifier);
 	unregister_netdevice_notifier(&sc->dev_notifier);
 exit2:
-	for (j = 0; j < i; j++) {
-		sysfs_remove_file(sc->sys_sfe_cm, &sfe_attrs[j].attr);
-	}
 	kobject_put(sc->sys_sfe_cm);
 
 exit1:
@@ -1169,7 +1109,7 @@ static void __exit sfe_cm_exit(void)
 	/*
 	 * Unregister our receive callback.
 	 */
-	RCU_INIT_POINTER(fast_nat_recv, NULL);
+	RCU_INIT_POINTER(athrs_fast_nat_recv, NULL);
 
 	/*
 	 * Wait for all callbacks to complete.
@@ -1186,7 +1126,7 @@ static void __exit sfe_cm_exit(void)
 	nf_conntrack_unregister_notifier(&init_net, &sfe_cm_conntrack_notifier);
 
 #endif
-	nf_unregister_hooks(sfe_cm_ops_post_routing, ARRAY_SIZE(sfe_cm_ops_post_routing));
+	nf_unregister_net_hooks(&init_net, sfe_cm_ops_post_routing, ARRAY_SIZE(sfe_cm_ops_post_routing));
 
 	unregister_inet6addr_notifier(&sc->inet6_notifier);
 	unregister_inetaddr_notifier(&sc->inet_notifier);
diff --git a/package/lean/shortcut-fe/src/sfe_cm.h b/package/lean/shortcut-fe/src/sfe_cm.h
index 6f2a819d12..23cbde859b 100644
--- a/package/lean/shortcut-fe/src/sfe_cm.h
+++ b/package/lean/shortcut-fe/src/sfe_cm.h
@@ -147,7 +147,7 @@ struct sfe_connection_mark {
 /*
  * Expose the hook for the receive processing.
  */
-extern int (*fast_nat_recv)(struct sk_buff *skb);
+extern int (*athrs_fast_nat_recv)(struct sk_buff *skb);
 
 /*
  * Expose what should be a static flag in the TCP connection tracker.
@@ -175,6 +175,7 @@ void sfe_ipv4_register_sync_rule_callback(sfe_sync_rule_callback_t callback);
 void sfe_ipv4_update_rule(struct sfe_connection_create *sic);
 void sfe_ipv4_mark_rule(struct sfe_connection_mark *mark);
 
+#ifdef SFE_SUPPORT_IPV6
 /*
  * IPv6 APIs used by connection manager
  */
@@ -185,6 +186,42 @@ void sfe_ipv6_destroy_all_rules_for_dev(struct net_device *dev);
 void sfe_ipv6_register_sync_rule_callback(sfe_sync_rule_callback_t callback);
 void sfe_ipv6_update_rule(struct sfe_connection_create *sic);
 void sfe_ipv6_mark_rule(struct sfe_connection_mark *mark);
+#else
+static inline int sfe_ipv6_recv(struct net_device *dev, struct sk_buff *skb)
+{
+	return 0;
+}
+
+static inline int sfe_ipv6_create_rule(struct sfe_connection_create *sic)
+{
+	return 0;
+}
+
+static inline void sfe_ipv6_destroy_rule(struct sfe_connection_destroy *sid)
+{
+	return;
+}
+
+static inline void sfe_ipv6_destroy_all_rules_for_dev(struct net_device *dev)
+{
+	return;
+}
+
+static inline void sfe_ipv6_register_sync_rule_callback(sfe_sync_rule_callback_t callback)
+{
+	return;
+}
+
+static inline void sfe_ipv6_update_rule(struct sfe_connection_create *sic)
+{
+	return;
+}
+
+static inline void sfe_ipv6_mark_rule(struct sfe_connection_mark *mark)
+{
+	return;
+}
+#endif
 
 /*
  * sfe_ipv6_addr_equal()
diff --git a/package/lean/shortcut-fe/src/sfe_ipv4.c b/package/lean/shortcut-fe/src/sfe_ipv4.c
index 34ed09b58a..531456c05f 100644
--- a/package/lean/shortcut-fe/src/sfe_ipv4.c
+++ b/package/lean/shortcut-fe/src/sfe_ipv4.c
@@ -2,7 +2,7 @@
  * sfe_ipv4.c
  *	Shortcut forwarding engine - IPv4 edition.
  *
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016, 2019, The Linux Foundation. All rights reserved.
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
  * above copyright notice and this permission notice appear in all copies.
@@ -21,7 +21,7 @@
 #include <linux/icmp.h>
 #include <net/tcp.h>
 #include <linux/etherdevice.h>
-#include <net/checksum.h>
+#include <linux/version.h>
 
 #include "sfe.h"
 #include "sfe_cm.h"
@@ -38,7 +38,7 @@
  */
 #define SFE_IPV4_UNALIGNED_IP_HEADER 1
 #if SFE_IPV4_UNALIGNED_IP_HEADER
-#define SFE_IPV4_UNALIGNED_STRUCT __attribute__((aligned(4)))
+#define SFE_IPV4_UNALIGNED_STRUCT __attribute__((packed))
 #else
 #define SFE_IPV4_UNALIGNED_STRUCT
 #endif
@@ -202,6 +202,9 @@ struct sfe_ipv4_connection_match {
 	 * Control the operations of the match.
 	 */
 	u32 flags;			/* Bit flags */
+#ifdef CONFIG_NF_FLOW_COOKIE
+	u32 flow_cookie;		/* used flow cookie, for debug */
+#endif
 #ifdef CONFIG_XFRM
 	u32 flow_accel;             /* The flow accelerated or not */
 #endif
@@ -300,6 +303,16 @@ struct sfe_ipv4_connection {
 #define SFE_IPV4_CONNECTION_HASH_SIZE (1 << SFE_IPV4_CONNECTION_HASH_SHIFT)
 #define SFE_IPV4_CONNECTION_HASH_MASK (SFE_IPV4_CONNECTION_HASH_SIZE - 1)
 
+#ifdef CONFIG_NF_FLOW_COOKIE
+#define SFE_FLOW_COOKIE_SIZE 2048
+#define SFE_FLOW_COOKIE_MASK 0x7ff
+
+struct sfe_flow_cookie_entry {
+	struct sfe_ipv4_connection_match *match;
+	unsigned long last_clean_time;
+};
+#endif
+
 enum sfe_ipv4_exception_events {
 	SFE_IPV4_EXCEPTION_EVENT_UDP_HEADER_INCOMPLETE,
 	SFE_IPV4_EXCEPTION_EVENT_UDP_NO_CONNECTION,
@@ -337,7 +350,7 @@ enum sfe_ipv4_exception_events {
 	SFE_IPV4_EXCEPTION_EVENT_DATAGRAM_INCOMPLETE,
 	SFE_IPV4_EXCEPTION_EVENT_IP_OPTIONS_INCOMPLETE,
 	SFE_IPV4_EXCEPTION_EVENT_UNHANDLED_PROTOCOL,
-	SFE_IPV4_EXCEPTION_EVENT_CSUM_ERROR,
+	SFE_IPV4_EXCEPTION_EVENT_CLONED_SKB_UNSHARE_ERROR,
 	SFE_IPV4_EXCEPTION_EVENT_LAST
 };
 
@@ -378,7 +391,7 @@ static char *sfe_ipv4_exception_events_string[SFE_IPV4_EXCEPTION_EVENT_LAST] = {
 	"DATAGRAM_INCOMPLETE",
 	"IP_OPTIONS_INCOMPLETE",
 	"UNHANDLED_PROTOCOL",
-	"CSUM_ERROR"
+	"CLONED_SKB_UNSHARE_ERROR"
 };
 
 /*
@@ -402,6 +415,14 @@ struct sfe_ipv4 {
 					/* Connection hash table */
 	struct sfe_ipv4_connection_match *conn_match_hash[SFE_IPV4_CONNECTION_HASH_SIZE];
 					/* Connection match hash table */
+#ifdef CONFIG_NF_FLOW_COOKIE
+	struct sfe_flow_cookie_entry sfe_flow_cookie_table[SFE_FLOW_COOKIE_SIZE];
+					/* flow cookie table*/
+	flow_cookie_set_func_t flow_cookie_set_func;
+					/* function used to configure flow cookie in hardware*/
+	int flow_cookie_enable;
+					/* Enable/disable flow cookie at runtime */
+#endif
 
 	/*
 	 * Stats recorded in a sync period. These stats will be added to
@@ -759,6 +780,36 @@ static inline void sfe_ipv4_insert_sfe_ipv4_connection_match(struct sfe_ipv4 *si
 
 	cm->next = prev_head;
 	*hash_head = cm;
+
+#ifdef CONFIG_NF_FLOW_COOKIE
+	if (!si->flow_cookie_enable)
+		return;
+
+	/*
+	 * Configure hardware to put a flow cookie in packet of this flow,
+	 * then we can accelerate the lookup process when we received this packet.
+	 */
+	for (conn_match_idx = 1; conn_match_idx < SFE_FLOW_COOKIE_SIZE; conn_match_idx++) {
+		struct sfe_flow_cookie_entry *entry = &si->sfe_flow_cookie_table[conn_match_idx];
+
+		if ((NULL == entry->match) && time_is_before_jiffies(entry->last_clean_time + HZ)) {
+			flow_cookie_set_func_t func;
+
+			rcu_read_lock();
+			func = rcu_dereference(si->flow_cookie_set_func);
+			if (func) {
+				if (!func(cm->match_protocol, cm->match_src_ip, cm->match_src_port,
+					 cm->match_dest_ip, cm->match_dest_port, conn_match_idx)) {
+					entry->match = cm;
+					cm->flow_cookie = conn_match_idx;
+				}
+			}
+			rcu_read_unlock();
+
+			break;
+		}
+	}
+#endif
 }
 
 /*
@@ -769,6 +820,36 @@ static inline void sfe_ipv4_insert_sfe_ipv4_connection_match(struct sfe_ipv4 *si
  */
 static inline void sfe_ipv4_remove_sfe_ipv4_connection_match(struct sfe_ipv4 *si, struct sfe_ipv4_connection_match *cm)
 {
+#ifdef CONFIG_NF_FLOW_COOKIE
+	if (si->flow_cookie_enable) {
+		/*
+		 * Tell hardware that we no longer need a flow cookie in packet of this flow
+		 */
+		unsigned int conn_match_idx;
+
+		for (conn_match_idx = 1; conn_match_idx < SFE_FLOW_COOKIE_SIZE; conn_match_idx++) {
+			struct sfe_flow_cookie_entry *entry = &si->sfe_flow_cookie_table[conn_match_idx];
+
+			if (cm == entry->match) {
+				flow_cookie_set_func_t func;
+
+				rcu_read_lock();
+				func = rcu_dereference(si->flow_cookie_set_func);
+				if (func) {
+					func(cm->match_protocol, cm->match_src_ip, cm->match_src_port,
+					     cm->match_dest_ip, cm->match_dest_port, 0);
+				}
+				rcu_read_unlock();
+
+				cm->flow_cookie = 0;
+				entry->match = NULL;
+				entry->last_clean_time = jiffies;
+				break;
+			}
+		}
+	}
+#endif
+
 	/*
 	 * Unlink the connection match entry from the hash.
 	 */
@@ -1142,7 +1223,14 @@ static int sfe_ipv4_recv_udp(struct sfe_ipv4 *si, struct sk_buff *skb, struct ne
 	/*
 	 * Look for a connection match.
 	 */
+#ifdef CONFIG_NF_FLOW_COOKIE
+	cm = si->sfe_flow_cookie_table[skb->flow_cookie & SFE_FLOW_COOKIE_MASK].match;
+	if (unlikely(!cm)) {
+		cm = sfe_ipv4_find_sfe_ipv4_connection_match(si, dev, IPPROTO_UDP, src_ip, src_port, dest_ip, dest_port);
+	}
+#else
 	cm = sfe_ipv4_find_sfe_ipv4_connection_match(si, dev, IPPROTO_UDP, src_ip, src_port, dest_ip, dest_port);
+#endif
 	if (unlikely(!cm)) {
 		si->exception_events[SFE_IPV4_EXCEPTION_EVENT_UDP_NO_CONNECTION]++;
 		si->packets_not_forwarded++;
@@ -1217,6 +1305,30 @@ static int sfe_ipv4_recv_udp(struct sfe_ipv4 *si, struct sk_buff *skb, struct ne
 	 * From this point on we're good to modify the packet.
 	 */
 
+	/*
+	 * Check if skb was cloned. If it was, unshare it. Because
+	 * the data area is going to be written in this path and we don't want to
+	 * change the cloned skb's data section.
+	 */
+	if (unlikely(skb_cloned(skb))) {
+		DEBUG_TRACE("%p: skb is a cloned skb\n", skb);
+		skb = skb_unshare(skb, GFP_ATOMIC);
+                if (!skb) {
+			DEBUG_WARN("Failed to unshare the cloned skb\n");
+			si->exception_events[SFE_IPV4_EXCEPTION_EVENT_CLONED_SKB_UNSHARE_ERROR]++;
+			si->packets_not_forwarded++;
+			spin_unlock_bh(&si->lock);
+
+			return 0;
+		}
+
+		/*
+		 * Update the iph and udph pointers with the unshared skb's data area.
+		 */
+		iph = (struct sfe_ipv4_ip_hdr *)skb->data;
+		udph = (struct sfe_ipv4_udp_hdr *)(skb->data + ihl);
+	}
+
 	/*
 	 * Update DSCP
 	 */
@@ -1502,7 +1614,14 @@ static int sfe_ipv4_recv_tcp(struct sfe_ipv4 *si, struct sk_buff *skb, struct ne
 	/*
 	 * Look for a connection match.
 	 */
+#ifdef CONFIG_NF_FLOW_COOKIE
+	cm = si->sfe_flow_cookie_table[skb->flow_cookie & SFE_FLOW_COOKIE_MASK].match;
+	if (unlikely(!cm)) {
+		cm = sfe_ipv4_find_sfe_ipv4_connection_match(si, dev, IPPROTO_TCP, src_ip, src_port, dest_ip, dest_port);
+	}
+#else
 	cm = sfe_ipv4_find_sfe_ipv4_connection_match(si, dev, IPPROTO_TCP, src_ip, src_port, dest_ip, dest_port);
+#endif
 	if (unlikely(!cm)) {
 		/*
 		 * We didn't get a connection but as TCP is connection-oriented that
@@ -1766,6 +1885,30 @@ static int sfe_ipv4_recv_tcp(struct sfe_ipv4 *si, struct sk_buff *skb, struct ne
 	 * From this point on we're good to modify the packet.
 	 */
 
+	/*
+	 * Check if skb was cloned. If it was, unshare it. Because
+	 * the data area is going to be written in this path and we don't want to
+	 * change the cloned skb's data section.
+	 */
+	if (unlikely(skb_cloned(skb))) {
+		DEBUG_TRACE("%p: skb is a cloned skb\n", skb);
+		skb = skb_unshare(skb, GFP_ATOMIC);
+                if (!skb) {
+			DEBUG_WARN("Failed to unshare the cloned skb\n");
+			si->exception_events[SFE_IPV4_EXCEPTION_EVENT_CLONED_SKB_UNSHARE_ERROR]++;
+			si->packets_not_forwarded++;
+			spin_unlock_bh(&si->lock);
+
+			return 0;
+		}
+
+		/*
+		 * Update the iph and tcph pointers with the unshared skb's data area.
+		 */
+		iph = (struct sfe_ipv4_ip_hdr *)skb->data;
+		tcph = (struct sfe_ipv4_tcp_hdr *)(skb->data + ihl);
+	}
+
 	/*
 	 * Update DSCP
 	 */
@@ -2225,16 +2368,6 @@ int sfe_ipv4_recv(struct net_device *dev, struct sk_buff *skb)
 		flush_on_find = true;
 	}
 
-	if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl))) {
-		spin_lock_bh(&si->lock);
-		si->exception_events[SFE_IPV4_EXCEPTION_EVENT_CSUM_ERROR]++;
-		si->packets_not_forwarded++;
-		spin_unlock_bh(&si->lock);
-
-		DEBUG_TRACE("checksum of ipv4 header is invalid\n");
-		return 0;
-	}
-
 	protocol = iph->protocol;
 	if (IPPROTO_UDP == protocol) {
 		return sfe_ipv4_recv_udp(si, skb, dev, len, iph, ihl, flush_on_find);
@@ -2445,6 +2578,9 @@ int sfe_ipv4_create_rule(struct sfe_connection_create *sic)
 		original_cm->dscp = sic->src_dscp << SFE_IPV4_DSCP_SHIFT;
 		original_cm->flags |= SFE_IPV4_CONNECTION_MATCH_FLAG_DSCP_REMARK;
 	}
+#ifdef CONFIG_NF_FLOW_COOKIE
+	original_cm->flow_cookie = 0;
+#endif
 #ifdef CONFIG_XFRM
 	original_cm->flow_accel = sic->original_accel;
 #endif
@@ -2501,6 +2637,9 @@ int sfe_ipv4_create_rule(struct sfe_connection_create *sic)
 		reply_cm->dscp = sic->dest_dscp << SFE_IPV4_DSCP_SHIFT;
 		reply_cm->flags |= SFE_IPV4_CONNECTION_MATCH_FLAG_DSCP_REMARK;
 	}
+#ifdef CONFIG_NF_FLOW_COOKIE
+	reply_cm->flow_cookie = 0;
+#endif
 #ifdef CONFIG_XFRM
 	reply_cm->flow_accel = sic->reply_accel;
 #endif
@@ -2719,9 +2858,17 @@ another_round:
 /*
  * sfe_ipv4_periodic_sync()
  */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0))
+static void sfe_ipv4_periodic_sync(struct timer_list *arg)
+#else
 static void sfe_ipv4_periodic_sync(unsigned long arg)
+#endif /*KERNEL_VERSION(4, 15, 0)*/
 {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0))
+	struct sfe_ipv4 *si = (struct sfe_ipv4 *)arg->cust_data;
+#else
 	struct sfe_ipv4 *si = (struct sfe_ipv4 *)arg;
+#endif /*KERNEL_VERSION(4, 15, 0)*/
 	u64 now_jiffies;
 	int quota;
 	sfe_sync_rule_callback_t sync_rule_callback;
@@ -2889,6 +3036,9 @@ static bool sfe_ipv4_debug_dev_read_connections_connection(struct sfe_ipv4 *si,
 	u64 dest_rx_bytes;
 	u64 last_sync_jiffies;
 	u32 mark, src_priority, dest_priority, src_dscp, dest_dscp;
+#ifdef CONFIG_NF_FLOW_COOKIE
+	int src_flow_cookie, dst_flow_cookie;
+#endif
 
 	spin_lock_bh(&si->lock);
 
@@ -2936,7 +3086,10 @@ static bool sfe_ipv4_debug_dev_read_connections_connection(struct sfe_ipv4 *si,
 	dest_rx_bytes = reply_cm->rx_byte_count64;
 	last_sync_jiffies = get_jiffies_64() - c->last_sync_jiffies;
 	mark = c->mark;
-
+#ifdef CONFIG_NF_FLOW_COOKIE
+	src_flow_cookie = original_cm->flow_cookie;
+	dst_flow_cookie = reply_cm->flow_cookie;
+#endif
 	spin_unlock_bh(&si->lock);
 
 	bytes_read = snprintf(msg, CHAR_DEV_MSG_SIZE, "\t\t<connection "
@@ -2951,6 +3104,9 @@ static bool sfe_ipv4_debug_dev_read_connections_connection(struct sfe_ipv4 *si,
 				"dest_port=\"%u\" dest_port_xlate=\"%u\" "
 				"dest_priority=\"%u\" dest_dscp=\"%u\" "
 				"dest_rx_pkts=\"%llu\" dest_rx_bytes=\"%llu\" "
+#ifdef CONFIG_NF_FLOW_COOKIE
+				"src_flow_cookie=\"%d\" dst_flow_cookie=\"%d\" "
+#endif
 				"last_sync=\"%llu\" "
 				"mark=\"%08x\" />\n",
 				protocol,
@@ -2964,6 +3120,9 @@ static bool sfe_ipv4_debug_dev_read_connections_connection(struct sfe_ipv4 *si,
 				ntohs(dest_port), ntohs(dest_port_xlate),
 				dest_priority, dest_dscp,
 				dest_rx_packets, dest_rx_bytes,
+#ifdef CONFIG_NF_FLOW_COOKIE
+				src_flow_cookie, dst_flow_cookie,
+#endif
 				last_sync_jiffies, mark);
 
 	if (copy_to_user(buffer + *total_read, msg, CHAR_DEV_MSG_SIZE)) {
@@ -3270,6 +3429,74 @@ static struct file_operations sfe_ipv4_debug_dev_fops = {
 	.release = sfe_ipv4_debug_dev_release
 };
 
+#ifdef CONFIG_NF_FLOW_COOKIE
+/*
+ * sfe_register_flow_cookie_cb
+ *	register a function in SFE to let SFE use this function to configure flow cookie for a flow
+ *
+ * Hardware driver which support flow cookie should register a callback function in SFE. Then SFE
+ * can use this function to configure flow cookie for a flow.
+ * return: 0, success; !=0, fail
+ */
+int sfe_register_flow_cookie_cb(flow_cookie_set_func_t cb)
+{
+	struct sfe_ipv4 *si = &__si;
+
+	BUG_ON(!cb);
+
+	if (si->flow_cookie_set_func) {
+		return -1;
+	}
+
+	rcu_assign_pointer(si->flow_cookie_set_func, cb);
+	return 0;
+}
+
+/*
+ * sfe_unregister_flow_cookie_cb
+ *	unregister function which is used to configure flow cookie for a flow
+ *
+ * return: 0, success; !=0, fail
+ */
+int sfe_unregister_flow_cookie_cb(flow_cookie_set_func_t cb)
+{
+	struct sfe_ipv4 *si = &__si;
+
+	RCU_INIT_POINTER(si->flow_cookie_set_func, NULL);
+	return 0;
+}
+
+/*
+ * sfe_ipv4_get_flow_cookie()
+ */
+static ssize_t sfe_ipv4_get_flow_cookie(struct device *dev,
+					struct device_attribute *attr,
+					char *buf)
+{
+	struct sfe_ipv4 *si = &__si;
+	return snprintf(buf, (ssize_t)PAGE_SIZE, "%d\n", si->flow_cookie_enable);
+}
+
+/*
+ * sfe_ipv4_set_flow_cookie()
+ */
+static ssize_t sfe_ipv4_set_flow_cookie(struct device *dev,
+					struct device_attribute *attr,
+					const char *buf, size_t size)
+{
+	struct sfe_ipv4 *si = &__si;
+	strict_strtol(buf, 0, (long int *)&si->flow_cookie_enable);
+
+	return size;
+}
+
+/*
+ * sysfs attributes.
+ */
+static const struct device_attribute sfe_ipv4_flow_cookie_attr =
+	__ATTR(flow_cookie_enable, S_IWUSR | S_IRUGO, sfe_ipv4_get_flow_cookie, sfe_ipv4_set_flow_cookie);
+#endif /*CONFIG_NF_FLOW_COOKIE*/
+
 /*
  * sfe_ipv4_init()
  */
@@ -3298,13 +3525,21 @@ static int __init sfe_ipv4_init(void)
 		goto exit2;
 	}
 
+#ifdef CONFIG_NF_FLOW_COOKIE
+	result = sysfs_create_file(si->sys_sfe_ipv4, &sfe_ipv4_flow_cookie_attr.attr);
+	if (result) {
+		DEBUG_ERROR("failed to register flow cookie enable file: %d\n", result);
+		goto exit3;
+	}
+#endif /* CONFIG_NF_FLOW_COOKIE */
+
 	/*
 	 * Register our debug char device.
 	 */
 	result = register_chrdev(0, "sfe_ipv4", &sfe_ipv4_debug_dev_fops);
 	if (result < 0) {
 		DEBUG_ERROR("Failed to register chrdev: %d\n", result);
-		goto exit3;
+		goto exit4;
 	}
 
 	si->debug_dev = result;
@@ -3312,14 +3547,24 @@ static int __init sfe_ipv4_init(void)
 	/*
 	 * Create a timer to handle periodic statistics.
 	 */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0))
+	timer_setup(&si->timer, sfe_ipv4_periodic_sync, 0);
+	si->timer.cust_data = (unsigned long)si;
+#else
 	setup_timer(&si->timer, sfe_ipv4_periodic_sync, (unsigned long)si);
+#endif /*KERNEL_VERSION(4, 15, 0)*/
 	mod_timer(&si->timer, jiffies + ((HZ + 99) / 100));
 
 	spin_lock_init(&si->lock);
 
 	return 0;
 
+exit4:
+#ifdef CONFIG_NF_FLOW_COOKIE
+	sysfs_remove_file(si->sys_sfe_ipv4, &sfe_ipv4_flow_cookie_attr.attr);
+
 exit3:
+#endif /* CONFIG_NF_FLOW_COOKIE */
 	sysfs_remove_file(si->sys_sfe_ipv4, &sfe_ipv4_debug_dev_attr.attr);
 
 exit2:
@@ -3347,6 +3592,9 @@ static void __exit sfe_ipv4_exit(void)
 
 	unregister_chrdev(si->debug_dev, "sfe_ipv4");
 
+#ifdef CONFIG_NF_FLOW_COOKIE
+	sysfs_remove_file(si->sys_sfe_ipv4, &sfe_ipv4_flow_cookie_attr.attr);
+#endif /* CONFIG_NF_FLOW_COOKIE */
 	sysfs_remove_file(si->sys_sfe_ipv4, &sfe_ipv4_debug_dev_attr.attr);
 
 	kobject_put(si->sys_sfe_ipv4);
@@ -3363,6 +3611,10 @@ EXPORT_SYMBOL(sfe_ipv4_destroy_all_rules_for_dev);
 EXPORT_SYMBOL(sfe_ipv4_register_sync_rule_callback);
 EXPORT_SYMBOL(sfe_ipv4_mark_rule);
 EXPORT_SYMBOL(sfe_ipv4_update_rule);
+#ifdef CONFIG_NF_FLOW_COOKIE
+EXPORT_SYMBOL(sfe_register_flow_cookie_cb);
+EXPORT_SYMBOL(sfe_unregister_flow_cookie_cb);
+#endif
 
 MODULE_DESCRIPTION("Shortcut Forwarding Engine - IPv4 edition");
 MODULE_LICENSE("Dual BSD/GPL");
diff --git a/package/lean/shortcut-fe/src/sfe_ipv6.c b/package/lean/shortcut-fe/src/sfe_ipv6.c
index 16f460723a..3c5ef12630 100644
--- a/package/lean/shortcut-fe/src/sfe_ipv6.c
+++ b/package/lean/shortcut-fe/src/sfe_ipv6.c
@@ -2,7 +2,7 @@
  * sfe_ipv6.c
  *	Shortcut forwarding engine - IPv6 support.
  *
- * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2016, 2019, The Linux Foundation. All rights reserved.
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
  * above copyright notice and this permission notice appear in all copies.
@@ -21,6 +21,7 @@
 #include <linux/icmp.h>
 #include <net/tcp.h>
 #include <linux/etherdevice.h>
+#include <linux/version.h>
 
 #include "sfe.h"
 #include "sfe_cm.h"
@@ -37,7 +38,7 @@
  */
 #define SFE_IPV6_UNALIGNED_IP_HEADER 1
 #if SFE_IPV6_UNALIGNED_IP_HEADER
-#define SFE_IPV6_UNALIGNED_STRUCT __attribute__((aligned(4)))
+#define SFE_IPV6_UNALIGNED_STRUCT __attribute__((packed))
 #else
 #define SFE_IPV6_UNALIGNED_STRUCT
 #endif
@@ -231,6 +232,9 @@ struct sfe_ipv6_connection_match {
 	 * Control the operations of the match.
 	 */
 	u32 flags;			/* Bit flags */
+#ifdef CONFIG_NF_FLOW_COOKIE
+	u32 flow_cookie;		/* used flow cookie, for debug */
+#endif
 #ifdef CONFIG_XFRM
 	u32 flow_accel;            	/* The flow accelerated or not */
 #endif
@@ -324,6 +328,16 @@ struct sfe_ipv6_connection {
 #define SFE_IPV6_CONNECTION_HASH_SIZE (1 << SFE_IPV6_CONNECTION_HASH_SHIFT)
 #define SFE_IPV6_CONNECTION_HASH_MASK (SFE_IPV6_CONNECTION_HASH_SIZE - 1)
 
+#ifdef CONFIG_NF_FLOW_COOKIE
+#define SFE_FLOW_COOKIE_SIZE 2048
+#define SFE_FLOW_COOKIE_MASK 0x7ff
+
+struct sfe_ipv6_flow_cookie_entry {
+	struct sfe_ipv6_connection_match *match;
+	unsigned long last_clean_time;
+};
+#endif
+
 enum sfe_ipv6_exception_events {
 	SFE_IPV6_EXCEPTION_EVENT_UDP_HEADER_INCOMPLETE,
 	SFE_IPV6_EXCEPTION_EVENT_UDP_NO_CONNECTION,
@@ -362,6 +376,7 @@ enum sfe_ipv6_exception_events {
 	SFE_IPV6_EXCEPTION_EVENT_IP_OPTIONS_INCOMPLETE,
 	SFE_IPV6_EXCEPTION_EVENT_UNHANDLED_PROTOCOL,
 	SFE_IPV6_EXCEPTION_EVENT_FLOW_COOKIE_ADD_FAIL,
+	SFE_IPV6_EXCEPTION_EVENT_CLONED_SKB_UNSHARE_ERROR,
 	SFE_IPV6_EXCEPTION_EVENT_LAST
 };
 
@@ -402,7 +417,8 @@ static char *sfe_ipv6_exception_events_string[SFE_IPV6_EXCEPTION_EVENT_LAST] = {
 	"DATAGRAM_INCOMPLETE",
 	"IP_OPTIONS_INCOMPLETE",
 	"UNHANDLED_PROTOCOL",
-	"FLOW_COOKIE_ADD_FAIL"
+	"FLOW_COOKIE_ADD_FAIL",
+	"CLONED_SKB_UNSHARE_ERROR"
 };
 
 /*
@@ -426,6 +442,14 @@ struct sfe_ipv6 {
 					/* Connection hash table */
 	struct sfe_ipv6_connection_match *conn_match_hash[SFE_IPV6_CONNECTION_HASH_SIZE];
 					/* Connection match hash table */
+#ifdef CONFIG_NF_FLOW_COOKIE
+	struct sfe_ipv6_flow_cookie_entry sfe_flow_cookie_table[SFE_FLOW_COOKIE_SIZE];
+					/* flow cookie table*/
+	sfe_ipv6_flow_cookie_set_func_t flow_cookie_set_func;
+					/* function used to configure flow cookie in hardware*/
+	int flow_cookie_enable;
+					/* Enable/disable flow cookie at runtime */
+#endif
 
 	/*
 	 * Stats recorded in a sync period. These stats will be added to
@@ -809,6 +833,38 @@ static inline void sfe_ipv6_insert_connection_match(struct sfe_ipv6 *si,
 
 	cm->next = prev_head;
 	*hash_head = cm;
+
+#ifdef CONFIG_NF_FLOW_COOKIE
+	if (!si->flow_cookie_enable || !(cm->flags & (SFE_IPV6_CONNECTION_MATCH_FLAG_XLATE_SRC | SFE_IPV6_CONNECTION_MATCH_FLAG_XLATE_DEST)))
+		return;
+
+	/*
+	 * Configure hardware to put a flow cookie in packet of this flow,
+	 * then we can accelerate the lookup process when we received this packet.
+	 */
+	for (conn_match_idx = 1; conn_match_idx < SFE_FLOW_COOKIE_SIZE; conn_match_idx++) {
+		struct sfe_ipv6_flow_cookie_entry *entry = &si->sfe_flow_cookie_table[conn_match_idx];
+
+		if ((NULL == entry->match) && time_is_before_jiffies(entry->last_clean_time + HZ)) {
+			sfe_ipv6_flow_cookie_set_func_t func;
+
+			rcu_read_lock();
+			func = rcu_dereference(si->flow_cookie_set_func);
+			if (func) {
+				if (!func(cm->match_protocol, cm->match_src_ip->addr, cm->match_src_port,
+					 cm->match_dest_ip->addr, cm->match_dest_port, conn_match_idx)) {
+					entry->match = cm;
+					cm->flow_cookie = conn_match_idx;
+				} else {
+					si->exception_events[SFE_IPV6_EXCEPTION_EVENT_FLOW_COOKIE_ADD_FAIL]++;
+				}
+			}
+			rcu_read_unlock();
+
+			break;
+		}
+	}
+#endif
 }
 
 /*
@@ -819,6 +875,36 @@ static inline void sfe_ipv6_insert_connection_match(struct sfe_ipv6 *si,
  */
 static inline void sfe_ipv6_remove_connection_match(struct sfe_ipv6 *si, struct sfe_ipv6_connection_match *cm)
 {
+#ifdef CONFIG_NF_FLOW_COOKIE
+	if (si->flow_cookie_enable) {
+		/*
+		 * Tell hardware that we no longer need a flow cookie in packet of this flow
+		 */
+		unsigned int conn_match_idx;
+
+		for (conn_match_idx = 1; conn_match_idx < SFE_FLOW_COOKIE_SIZE; conn_match_idx++) {
+			struct sfe_ipv6_flow_cookie_entry *entry = &si->sfe_flow_cookie_table[conn_match_idx];
+
+			if (cm == entry->match) {
+				sfe_ipv6_flow_cookie_set_func_t func;
+
+				rcu_read_lock();
+				func = rcu_dereference(si->flow_cookie_set_func);
+				if (func) {
+					func(cm->match_protocol, cm->match_src_ip->addr, cm->match_src_port,
+					     cm->match_dest_ip->addr, cm->match_dest_port, 0);
+				}
+				rcu_read_unlock();
+
+				cm->flow_cookie = 0;
+				entry->match = NULL;
+				entry->last_clean_time = jiffies;
+				break;
+			}
+		}
+	}
+#endif
+
 	/*
 	 * Unlink the connection match entry from the hash.
 	 */
@@ -1196,7 +1282,14 @@ static int sfe_ipv6_recv_udp(struct sfe_ipv6 *si, struct sk_buff *skb, struct ne
 	/*
 	 * Look for a connection match.
 	 */
+#ifdef CONFIG_NF_FLOW_COOKIE
+	cm = si->sfe_flow_cookie_table[skb->flow_cookie & SFE_FLOW_COOKIE_MASK].match;
+	if (unlikely(!cm)) {
+		cm = sfe_ipv6_find_connection_match(si, dev, IPPROTO_UDP, src_ip, src_port, dest_ip, dest_port);
+	}
+#else
 	cm = sfe_ipv6_find_connection_match(si, dev, IPPROTO_UDP, src_ip, src_port, dest_ip, dest_port);
+#endif
 	if (unlikely(!cm)) {
 		si->exception_events[SFE_IPV6_EXCEPTION_EVENT_UDP_NO_CONNECTION]++;
 		si->packets_not_forwarded++;
@@ -1270,6 +1363,30 @@ static int sfe_ipv6_recv_udp(struct sfe_ipv6 *si, struct sk_buff *skb, struct ne
 	 * From this point on we're good to modify the packet.
 	 */
 
+	/*
+	 * Check if skb was cloned. If it was, unshare it. Because
+	 * the data area is going to be written in this path and we don't want to
+	 * change the cloned skb's data section.
+	 */
+	if (unlikely(skb_cloned(skb))) {
+		DEBUG_TRACE("%p: skb is a cloned skb\n", skb);
+		skb = skb_unshare(skb, GFP_ATOMIC);
+                if (!skb) {
+			DEBUG_WARN("Failed to unshare the cloned skb\n");
+			si->exception_events[SFE_IPV6_EXCEPTION_EVENT_CLONED_SKB_UNSHARE_ERROR]++;
+			si->packets_not_forwarded++;
+			spin_unlock_bh(&si->lock);
+
+			return 0;
+		}
+
+		/*
+		 * Update the iph and udph pointers with the unshared skb's data area.
+		 */
+		iph = (struct sfe_ipv6_ip_hdr *)skb->data;
+		udph = (struct sfe_ipv6_udp_hdr *)(skb->data + ihl);
+	}
+
 	/*
 	 * Update DSCP
 	 */
@@ -1535,7 +1652,14 @@ static int sfe_ipv6_recv_tcp(struct sfe_ipv6 *si, struct sk_buff *skb, struct ne
 	/*
 	 * Look for a connection match.
 	 */
+#ifdef CONFIG_NF_FLOW_COOKIE
+	cm = si->sfe_flow_cookie_table[skb->flow_cookie & SFE_FLOW_COOKIE_MASK].match;
+	if (unlikely(!cm)) {
+		cm = sfe_ipv6_find_connection_match(si, dev, IPPROTO_TCP, src_ip, src_port, dest_ip, dest_port);
+	}
+#else
 	cm = sfe_ipv6_find_connection_match(si, dev, IPPROTO_TCP, src_ip, src_port, dest_ip, dest_port);
+#endif
 	if (unlikely(!cm)) {
 		/*
 		 * We didn't get a connection but as TCP is connection-oriented that
@@ -1799,6 +1923,30 @@ static int sfe_ipv6_recv_tcp(struct sfe_ipv6 *si, struct sk_buff *skb, struct ne
 	 * From this point on we're good to modify the packet.
 	 */
 
+	/*
+	 * Check if skb was cloned. If it was, unshare it. Because
+	 * the data area is going to be written in this path and we don't want to
+	 * change the cloned skb's data section.
+	 */
+	if (unlikely(skb_cloned(skb))) {
+		DEBUG_TRACE("%p: skb is a cloned skb\n", skb);
+		skb = skb_unshare(skb, GFP_ATOMIC);
+                if (!skb) {
+			DEBUG_WARN("Failed to unshare the cloned skb\n");
+			si->exception_events[SFE_IPV6_EXCEPTION_EVENT_CLONED_SKB_UNSHARE_ERROR]++;
+			si->packets_not_forwarded++;
+			spin_unlock_bh(&si->lock);
+
+			return 0;
+		}
+
+		/*
+		 * Update the iph and tcph pointers with the unshared skb's data area.
+		 */
+		iph = (struct sfe_ipv6_ip_hdr *)skb->data;
+		tcph = (struct sfe_ipv6_tcp_hdr *)(skb->data + ihl);
+	}
+
 	/*
 	 * Update DSCP
 	 */
@@ -2444,6 +2592,9 @@ int sfe_ipv6_create_rule(struct sfe_connection_create *sic)
 		original_cm->dscp = sic->src_dscp << SFE_IPV6_DSCP_SHIFT;
 		original_cm->flags |= SFE_IPV6_CONNECTION_MATCH_FLAG_DSCP_REMARK;
 	}
+#ifdef CONFIG_NF_FLOW_COOKIE
+	original_cm->flow_cookie = 0;
+#endif
 #ifdef CONFIG_XFRM
 	original_cm->flow_accel = sic->original_accel;
 #endif
@@ -2500,6 +2651,9 @@ int sfe_ipv6_create_rule(struct sfe_connection_create *sic)
 		reply_cm->dscp = sic->dest_dscp << SFE_IPV6_DSCP_SHIFT;
 		reply_cm->flags |= SFE_IPV6_CONNECTION_MATCH_FLAG_DSCP_REMARK;
 	}
+#ifdef CONFIG_NF_FLOW_COOKIE
+	reply_cm->flow_cookie = 0;
+#endif
 #ifdef CONFIG_XFRM
 	reply_cm->flow_accel = sic->reply_accel;
 #endif
@@ -2712,9 +2866,17 @@ another_round:
 /*
  * sfe_ipv6_periodic_sync()
  */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0))
+static void sfe_ipv6_periodic_sync(struct timer_list *arg)
+#else
 static void sfe_ipv6_periodic_sync(unsigned long arg)
+#endif /*KERNEL_VERSION(4, 15, 0)*/
 {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0))
+	struct sfe_ipv6 *si = (struct sfe_ipv6 *)arg->cust_data;
+#else
 	struct sfe_ipv6 *si = (struct sfe_ipv6 *)arg;
+#endif /*KERNEL_VERSION(4, 15, 0)*/
 	u64 now_jiffies;
 	int quota;
 	sfe_sync_rule_callback_t sync_rule_callback;
@@ -2880,6 +3042,9 @@ static bool sfe_ipv6_debug_dev_read_connections_connection(struct sfe_ipv6 *si,
 	u64 dest_rx_bytes;
 	u64 last_sync_jiffies;
 	u32 mark, src_priority, dest_priority, src_dscp, dest_dscp;
+#ifdef CONFIG_NF_FLOW_COOKIE
+	int src_flow_cookie, dst_flow_cookie;
+#endif
 
 	spin_lock_bh(&si->lock);
 
@@ -2927,7 +3092,10 @@ static bool sfe_ipv6_debug_dev_read_connections_connection(struct sfe_ipv6 *si,
 	dest_rx_bytes = reply_cm->rx_byte_count64;
 	last_sync_jiffies = get_jiffies_64() - c->last_sync_jiffies;
 	mark = c->mark;
-
+#ifdef CONFIG_NF_FLOW_COOKIE
+	src_flow_cookie = original_cm->flow_cookie;
+	dst_flow_cookie = reply_cm->flow_cookie;
+#endif
 	spin_unlock_bh(&si->lock);
 
 	bytes_read = snprintf(msg, CHAR_DEV_MSG_SIZE, "\t\t<connection "
@@ -2942,6 +3110,9 @@ static bool sfe_ipv6_debug_dev_read_connections_connection(struct sfe_ipv6 *si,
 				"dest_port=\"%u\" dest_port_xlate=\"%u\" "
 				"dest_priority=\"%u\" dest_dscp=\"%u\" "
 				"dest_rx_pkts=\"%llu\" dest_rx_bytes=\"%llu\" "
+#ifdef CONFIG_NF_FLOW_COOKIE
+				"src_flow_cookie=\"%d\" dst_flow_cookie=\"%d\" "
+#endif
 				"last_sync=\"%llu\" "
 				"mark=\"%08x\" />\n",
 				protocol,
@@ -2955,6 +3126,9 @@ static bool sfe_ipv6_debug_dev_read_connections_connection(struct sfe_ipv6 *si,
 				ntohs(dest_port), ntohs(dest_port_xlate),
 				dest_priority, dest_dscp,
 				dest_rx_packets, dest_rx_bytes,
+#ifdef CONFIG_NF_FLOW_COOKIE
+				src_flow_cookie, dst_flow_cookie,
+#endif
 				last_sync_jiffies, mark);
 
 	if (copy_to_user(buffer + *total_read, msg, CHAR_DEV_MSG_SIZE)) {
@@ -3263,6 +3437,74 @@ static struct file_operations sfe_ipv6_debug_dev_fops = {
 	.release = sfe_ipv6_debug_dev_release
 };
 
+#ifdef CONFIG_NF_FLOW_COOKIE
+/*
+ * sfe_ipv6_register_flow_cookie_cb
+ *	register a function in SFE to let SFE use this function to configure flow cookie for a flow
+ *
+ * Hardware driver which support flow cookie should register a callback function in SFE. Then SFE
+ * can use this function to configure flow cookie for a flow.
+ * return: 0, success; !=0, fail
+ */
+int sfe_ipv6_register_flow_cookie_cb(sfe_ipv6_flow_cookie_set_func_t cb)
+{
+	struct sfe_ipv6 *si = &__si6;
+
+	BUG_ON(!cb);
+
+	if (si->flow_cookie_set_func) {
+		return -1;
+	}
+
+	rcu_assign_pointer(si->flow_cookie_set_func, cb);
+	return 0;
+}
+
+/*
+ * sfe_ipv6_unregister_flow_cookie_cb
+ *	unregister function which is used to configure flow cookie for a flow
+ *
+ * return: 0, success; !=0, fail
+ */
+int sfe_ipv6_unregister_flow_cookie_cb(sfe_ipv6_flow_cookie_set_func_t cb)
+{
+	struct sfe_ipv6 *si = &__si6;
+
+	RCU_INIT_POINTER(si->flow_cookie_set_func, NULL);
+	return 0;
+}
+
+/*
+ * sfe_ipv6_get_flow_cookie()
+ */
+static ssize_t sfe_ipv6_get_flow_cookie(struct device *dev,
+					struct device_attribute *attr,
+					char *buf)
+{
+	struct sfe_ipv6 *si = &__si6;
+	return snprintf(buf, (ssize_t)PAGE_SIZE, "%d\n", si->flow_cookie_enable);
+}
+
+/*
+ * sfe_ipv6_set_flow_cookie()
+ */
+static ssize_t sfe_ipv6_set_flow_cookie(struct device *dev,
+					struct device_attribute *attr,
+					const char *buf, size_t size)
+{
+	struct sfe_ipv6 *si = &__si6;
+	strict_strtol(buf, 0, (long int *)&si->flow_cookie_enable);
+
+	return size;
+}
+
+/*
+ * sysfs attributes.
+ */
+static const struct device_attribute sfe_ipv6_flow_cookie_attr =
+	__ATTR(flow_cookie_enable, S_IWUSR | S_IRUGO, sfe_ipv6_get_flow_cookie, sfe_ipv6_set_flow_cookie);
+#endif /*CONFIG_NF_FLOW_COOKIE*/
+
 /*
  * sfe_ipv6_init()
  */
@@ -3291,13 +3533,21 @@ static int __init sfe_ipv6_init(void)
 		goto exit2;
 	}
 
+#ifdef CONFIG_NF_FLOW_COOKIE
+	result = sysfs_create_file(si->sys_sfe_ipv6, &sfe_ipv6_flow_cookie_attr.attr);
+	if (result) {
+		DEBUG_ERROR("failed to register flow cookie enable file: %d\n", result);
+		goto exit3;
+	}
+#endif /* CONFIG_NF_FLOW_COOKIE */
+
 	/*
 	 * Register our debug char device.
 	 */
 	result = register_chrdev(0, "sfe_ipv6", &sfe_ipv6_debug_dev_fops);
 	if (result < 0) {
 		DEBUG_ERROR("Failed to register chrdev: %d\n", result);
-		goto exit3;
+		goto exit4;
 	}
 
 	si->debug_dev = result;
@@ -3305,14 +3555,24 @@ static int __init sfe_ipv6_init(void)
 	/*
 	 * Create a timer to handle periodic statistics.
 	 */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0))
+	timer_setup(&si->timer, sfe_ipv6_periodic_sync, 0);
+	si->timer.cust_data = (unsigned long)si;
+#else
 	setup_timer(&si->timer, sfe_ipv6_periodic_sync, (unsigned long)si);
+#endif /*KERNEL_VERSION(4, 15, 0)*/
 	mod_timer(&si->timer, jiffies + ((HZ + 99) / 100));
 
 	spin_lock_init(&si->lock);
 
 	return 0;
 
+exit4:
+#ifdef CONFIG_NF_FLOW_COOKIE
+	sysfs_remove_file(si->sys_sfe_ipv6, &sfe_ipv6_flow_cookie_attr.attr);
+
 exit3:
+#endif /* CONFIG_NF_FLOW_COOKIE */
 	sysfs_remove_file(si->sys_sfe_ipv6, &sfe_ipv6_debug_dev_attr.attr);
 
 exit2:
@@ -3340,6 +3600,9 @@ static void __exit sfe_ipv6_exit(void)
 
 	unregister_chrdev(si->debug_dev, "sfe_ipv6");
 
+#ifdef CONFIG_NF_FLOW_COOKIE
+	sysfs_remove_file(si->sys_sfe_ipv6, &sfe_ipv6_flow_cookie_attr.attr);
+#endif /* CONFIG_NF_FLOW_COOKIE */
 	sysfs_remove_file(si->sys_sfe_ipv6, &sfe_ipv6_debug_dev_attr.attr);
 
 	kobject_put(si->sys_sfe_ipv6);
@@ -3355,6 +3618,10 @@ EXPORT_SYMBOL(sfe_ipv6_destroy_all_rules_for_dev);
 EXPORT_SYMBOL(sfe_ipv6_register_sync_rule_callback);
 EXPORT_SYMBOL(sfe_ipv6_mark_rule);
 EXPORT_SYMBOL(sfe_ipv6_update_rule);
+#ifdef CONFIG_NF_FLOW_COOKIE
+EXPORT_SYMBOL(sfe_ipv6_register_flow_cookie_cb);
+EXPORT_SYMBOL(sfe_ipv6_unregister_flow_cookie_cb);
+#endif
 
 MODULE_DESCRIPTION("Shortcut Forwarding Engine - IPv6 support");
 MODULE_LICENSE("Dual BSD/GPL");
diff --git a/target/linux/generic/config-4.14 b/target/linux/generic/config-4.14
index 85dac85d48..585a2df0bd 100644
--- a/target/linux/generic/config-4.14
+++ b/target/linux/generic/config-4.14
@@ -4354,6 +4354,7 @@ CONFIG_SERIAL_EARLYCON=y
 # CONFIG_SG_POOL is not set
 # CONFIG_SG_SPLIT is not set
 CONFIG_SHMEM=y
+# CONFIG_SHORTCUT_FE is not set
 # CONFIG_SH_ETH is not set
 # CONFIG_SH_TIMER_CMT is not set
 # CONFIG_SH_TIMER_MTU2 is not set
diff --git a/target/linux/generic/hack-4.14/999-net-patch-linux-kernel-to-support-shortcut-fe.patch b/target/linux/generic/hack-4.14/999-net-patch-linux-kernel-to-support-shortcut-fe.patch
new file mode 100644
index 0000000000..05f64b2869
--- /dev/null
+++ b/target/linux/generic/hack-4.14/999-net-patch-linux-kernel-to-support-shortcut-fe.patch
@@ -0,0 +1,236 @@
+--- a/include/linux/skbuff.h	2019-01-16 20:16:08.325745306 +0800
++++ b/include/linux/skbuff.h	2019-01-16 20:31:47.288028493 +0800
+@@ -783,6 +783,9 @@ struct sk_buff {
+ 	__u8			tc_from_ingress:1;
+ #endif
+ 	__u8			gro_skip:1;
++#ifdef CONFIG_SHORTCUT_FE
++	__u8			fast_forwarded:1;
++#endif
+ 
+ #ifdef CONFIG_NET_SCHED
+ 	__u16			tc_index;	/* traffic control index */
+--- a/include/linux/if_bridge.h	2019-01-16 20:51:47.871445535 +0800
++++ b/include/linux/if_bridge.h	2019-01-16 20:52:26.220269649 +0800
+@@ -54,6 +54,8 @@ struct br_ip_list {
+ #define BR_DEFAULT_AGEING_TIME	(300 * HZ)
+ 
+ extern void brioctl_set(int (*ioctl_hook)(struct net *, unsigned int, void __user *));
++extern void br_dev_update_stats(struct net_device *dev,
++				struct rtnl_link_stats64 *nlstats);
+ 
+ typedef int br_should_route_hook_t(struct sk_buff *skb);
+ extern br_should_route_hook_t __rcu *br_should_route_hook;
+--- a/include/linux/timer.h
++++ b/include/linux/timer.h
+@@ -20,6 +20,9 @@ struct timer_list {
+ 	void			(*function)(unsigned long);
+ 	unsigned long		data;
+ 	u32			flags;
++#ifdef CONFIG_SHORTCUT_FE
++	unsigned long		cust_data;
++#endif
+ 
+ #ifdef CONFIG_LOCKDEP
+ 	struct lockdep_map	lockdep_map;
+--- a/net/Kconfig	2019-01-16 20:36:30.266465286 +0800
++++ b/net/Kconfig	2019-01-16 20:36:41.980609067 +0800
+@@ -463,3 +463,6 @@ config HAVE_CBPF_JIT
+ # Extended BPF JIT (eBPF)
+ config HAVE_EBPF_JIT
+ 	bool
++
++config SHORTCUT_FE
++	bool "Enables kernel network stack path for Shortcut  Forwarding Engine
+--- a/net/core/dev.c	2019-01-16 20:38:37.274933833 +0800
++++ b/net/core/dev.c	2019-01-16 20:44:07.773594898 +0800
+@@ -3001,8 +3001,17 @@ static int xmit_one(struct sk_buff *skb,
+ 	unsigned int len;
+ 	int rc;
+ 
++#ifdef CONFIG_SHORTCUT_FE
++	/* If this skb has been fast forwarded then we don't want it to
++	 * go to any taps (by definition we're trying to bypass them).
++	 */
++	if (!skb->fast_forwarded) {
++#endif
+ 	if (!list_empty(&ptype_all) || !list_empty(&dev->ptype_all))
+ 		dev_queue_xmit_nit(skb, dev);
++#ifdef CONFIG_SHORTCUT_FE
++	}
++#endif
+ 
+ #ifdef CONFIG_ETHERNET_PACKET_MANGLE
+ 	if (!dev->eth_mangle_tx ||
+@@ -4315,6 +4324,11 @@ void netdev_rx_handler_unregister(struct
+ }
+ EXPORT_SYMBOL_GPL(netdev_rx_handler_unregister);
+ 
++#ifdef CONFIG_SHORTCUT_FE
++int (*athrs_fast_nat_recv)(struct sk_buff *skb) __rcu __read_mostly;
++EXPORT_SYMBOL_GPL(athrs_fast_nat_recv);
++#endif
++
+ /*
+  * Limit the use of PFMEMALLOC reserves to those protocols that implement
+  * the special handling of PFMEMALLOC skbs.
+@@ -4362,6 +4376,9 @@ static int __netif_receive_skb_core(stru
+ 	bool deliver_exact = false;
+ 	int ret = NET_RX_DROP;
+ 	__be16 type;
++#ifdef CONFIG_SHORTCUT_FE
++	int (*fast_recv)(struct sk_buff *skb);
++#endif
+ 
+ 	net_timestamp_check(!netdev_tstamp_prequeue, skb);
+ 
+@@ -4388,6 +4405,16 @@ another_round:
+ 			goto out;
+ 	}
+ 
++#ifdef CONFIG_SHORTCUT_FE
++	fast_recv = rcu_dereference(athrs_fast_nat_recv);
++	if (fast_recv) {
++		if (fast_recv(skb)) {
++			ret = NET_RX_SUCCESS;
++			goto out;
++		}
++	}
++#endif
++
+ 	if (skb_skip_tc_classify(skb))
+ 		goto skip_classify;
+ 
+--- a/net/netfilter/nf_conntrack_proto_tcp.c	2019-01-16 20:47:40.886993297 +0800
++++ b/net/netfilter/nf_conntrack_proto_tcp.c	2019-01-16 20:48:57.700570104 +0800
+@@ -35,11 +35,17 @@
+ 
+ /* Do not check the TCP window for incoming packets  */
+ static int nf_ct_tcp_no_window_check __read_mostly = 1;
++#ifdef CONFIG_SHORTCUT_FE
++EXPORT_SYMBOL_GPL(nf_ct_tcp_no_window_check);
++#endif
+ 
+ /* "Be conservative in what you do,
+     be liberal in what you accept from others."
+     If it's non-zero, we mark only out of window RST segments as INVALID. */
+ static int nf_ct_tcp_be_liberal __read_mostly = 0;
++#ifdef CONFIG_SHORTCUT_FE
++EXPORT_SYMBOL_GPL(nf_ct_tcp_be_liberal);
++#endif
+ 
+ /* If it is set to zero, we disable picking up already established
+    connections. */
+--- a/net/bridge/br_if.c	2019-01-16 20:54:51.919367044 +0800
++++ b/net/bridge/br_if.c	2019-01-16 20:55:53.812401263 +0800
+@@ -653,3 +653,26 @@ void br_port_flags_change(struct net_bri
+ 	if (mask & BR_AUTO_MASK)
+ 		nbp_update_port_count(br);
+ }
++
++/* Update bridge statistics for bridge packets processed by offload engines */
++void br_dev_update_stats(struct net_device *dev,
++			 struct rtnl_link_stats64 *nlstats)
++{
++	struct net_bridge *br;
++	struct pcpu_sw_netstats *stats;
++
++	/* Is this a bridge? */
++	if (!(dev->priv_flags & IFF_EBRIDGE))
++		return;
++
++	br = netdev_priv(dev);
++	stats = this_cpu_ptr(br->stats);
++
++	u64_stats_update_begin(&stats->syncp);
++	stats->rx_packets += nlstats->rx_packets;
++	stats->rx_bytes += nlstats->rx_bytes;
++	stats->tx_packets += nlstats->tx_packets;
++	stats->tx_bytes += nlstats->tx_bytes;
++	u64_stats_update_end(&stats->syncp);
++}
++EXPORT_SYMBOL_GPL(br_dev_update_stats);
+--- a/net/netfilter/Kconfig	2019-01-16 21:07:34.543460920 +0800
++++ b/net/netfilter/Kconfig	2019-01-16 21:08:14.739465937 +0800
+@@ -146,6 +146,14 @@ config NF_CONNTRACK_TIMEOUT
+ 
+ 	  If unsure, say `N'.
+ 
++config NF_CONNTRACK_CHAIN_EVENTS
++	bool "Register multiple callbacks to ct events"
++	depends on NF_CONNTRACK_EVENTS
++	help
++	  Support multiple registrations.
++
++	  If unsure, say `N'.
++
+ config NF_CONNTRACK_TIMESTAMP
+ 	bool  'Connection tracking timestamping'
+ 	depends on NETFILTER_ADVANCED
+--- a/net/netfilter/nf_conntrack_ecache.c	2019-01-16 21:12:22.183462975 +0800
++++ b/net/netfilter/nf_conntrack_ecache.c	2019-01-16 21:26:10.379462031 +0800
+@@ -122,13 +125,17 @@ int nf_conntrack_eventmask_report(unsign
+ {
+ 	int ret = 0;
+ 	struct net *net = nf_ct_net(ct);
++#ifndef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
+ 	struct nf_ct_event_notifier *notify;
++#endif
+ 	struct nf_conntrack_ecache *e;
+ 
+ 	rcu_read_lock();
++#ifndef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
+ 	notify = rcu_dereference(net->ct.nf_conntrack_event_cb);
+ 	if (!notify)
+ 		goto out_unlock;
++#endif
+ 
+ 	e = nf_ct_ecache_find(ct);
+ 	if (!e)
+@@ -146,7 +153,12 @@ int nf_conntrack_eventmask_report(unsign
+ 		if (!((eventmask | missed) & e->ctmask))
+ 			goto out_unlock;
+ 
++#ifdef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
++		ret = atomic_notifier_call_chain(&net->ct.nf_conntrack_chain,
++			eventmask | missed, &item);
++#else
+ 		ret = notify->fcn(eventmask | missed, &item);
++#endif
+ 		if (unlikely(ret < 0 || missed)) {
+ 			spin_lock_bh(&ct->lock);
+ 			if (ret < 0) {
+@@ -179,15 +191,19 @@ void nf_ct_deliver_cached_events(struct
+ {
+ 	struct net *net = nf_ct_net(ct);
+ 	unsigned long events, missed;
++#ifndef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
+ 	struct nf_ct_event_notifier *notify;
++#endif
+ 	struct nf_conntrack_ecache *e;
+ 	struct nf_ct_event item;
+ 	int ret;
+ 
+ 	rcu_read_lock();
++#ifndef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
+ 	notify = rcu_dereference(net->ct.nf_conntrack_event_cb);
+ 	if (notify == NULL)
+ 		goto out_unlock;
++#endif
+ 
+ 	e = nf_ct_ecache_find(ct);
+ 	if (e == NULL)
+@@ -210,7 +226,13 @@ void nf_ct_deliver_cached_events(struct
+ 	item.portid = 0;
+ 	item.report = 0;
+ 
++#ifdef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
++	ret = atomic_notifier_call_chain(&net->ct.nf_conntrack_chain,
++			events | missed,
++			&item);
++#else
+ 	ret = notify->fcn(events | missed, &item);
++#endif
+ 
+ 	if (likely(ret == 0 && !missed))
+ 		goto out_unlock;
\ No newline at end of file

From 9f8f4afe3643294414914087021936e2020ffd0a Mon Sep 17 00:00:00 2001
From: ricksuzade-maker <58425544+ricksuzade-maker@users.noreply.github.com>
Date: Wed, 1 Jul 2020 10:17:46 +0800
Subject: [PATCH 08/28] Bump v2ray-plugin to version 1.3.2

Bump v2ray-plugin to the newest version
---
 package/lean/v2ray-plugin/Makefile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/lean/v2ray-plugin/Makefile b/package/lean/v2ray-plugin/Makefile
index 8111b4e335..a7ad0f2767 100644
--- a/package/lean/v2ray-plugin/Makefile
+++ b/package/lean/v2ray-plugin/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=v2ray-plugin
-PKG_VERSION:=1.3.1
+PKG_VERSION:=1.3.2
 PKG_RELEASE:=2
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://codeload.github.com/shadowsocks/v2ray-plugin/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=86d37a8ecef82457b4750a1af9e8d093b25ae0d32ea7dcc2ad5c0068fe2d3d74
+PKG_SOURCE_URL:=https://codeload.github.com/teddysun/v2ray-plugin/tar.gz/v$(PKG_VERSION)?
+PKG_HASH:=1cc9ed8e79347da044fa2f577bc5371dcdf0b03e131f61137b5c1d2a2be11509
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE

From 0c0d41fcd74d0fb7bdc7db3f05503a808eec89cc Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Wed, 1 Jul 2020 10:51:09 +0800
Subject: [PATCH 09/28] kernel: drop kernel 4.9 support and add 5.4 placeholder

---
 include/kernel-version.mk    | 4 ++--
 target/linux/ar71xx/Makefile | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/kernel-version.mk b/include/kernel-version.mk
index ca75b2de93..b2f81c2b37 100644
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@@ -6,13 +6,13 @@ ifdef CONFIG_TESTING_KERNEL
   KERNEL_PATCHVER:=$(KERNEL_TESTING_PATCHVER)
 endif
 
-LINUX_VERSION-4.9 = .223
 LINUX_VERSION-4.14 = .180
 LINUX_VERSION-4.19 = .122
+LINUX_VERSION-5.4 = .40
 
-LINUX_KERNEL_HASH-4.9.223 = cf5300e6f5d8c66c2bed8f00d53f9c58103731809862427012e4010f5d782ae5
 LINUX_KERNEL_HASH-4.14.180 = 444ef973d9b6a6ea174e4a9086f0aea980d8575d13302e431ad688f22e27ed0e
 LINUX_KERNEL_HASH-4.19.122 = 5050268ec5cf003d96366d1611ecfa4ab6974125d6fa26cea1ccb81dd4df00a5
+LINUX_KERNEL_HASH-5.4.40 = 83563f027687ecaafb41d0d2d52056f40ec9822f8a9e43592e215349730020ab
 
 remove_uri_prefix=$(subst git://,,$(subst http://,,$(subst https://,,$(1))))
 sanitize_uri=$(call qstrip,$(subst @,_,$(subst :,_,$(subst .,_,$(subst -,_,$(subst /,_,$(1)))))))
diff --git a/target/linux/ar71xx/Makefile b/target/linux/ar71xx/Makefile
index e7ca46c7ac..93832b560e 100644
--- a/target/linux/ar71xx/Makefile
+++ b/target/linux/ar71xx/Makefile
@@ -13,7 +13,7 @@ FEATURES:=usbgadget
 CPU_TYPE:=24kc
 SUBTARGETS:=generic tiny nand mikrotik
 
-KERNEL_PATCHVER:=4.9
+KERNEL_PATCHVER:=4.14
 
 include $(INCLUDE_DIR)/target.mk
 

From d11a7c9e788040e955ff717c04811cadd7b5da36 Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Wed, 1 Jul 2020 10:52:01 +0800
Subject: [PATCH 10/28] kernel: bump 4.19 to 4.19.123

---
 include/kernel-version.mk                                     | 4 ++--
 .../950-0029-mm-Remove-the-PFN-busy-warning.patch             | 2 +-
 ...21-hid-Reduce-default-mouse-polling-interval-to-60Hz.patch | 2 +-
 ...usbhid-call-usb_fixup_endpoint-after-mangling-interv.patch | 2 +-
 ...20-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/kernel-version.mk b/include/kernel-version.mk
index b2f81c2b37..285840dbcf 100644
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@@ -7,11 +7,11 @@ ifdef CONFIG_TESTING_KERNEL
 endif
 
 LINUX_VERSION-4.14 = .180
-LINUX_VERSION-4.19 = .122
+LINUX_VERSION-4.19 = .123
 LINUX_VERSION-5.4 = .40
 
 LINUX_KERNEL_HASH-4.14.180 = 444ef973d9b6a6ea174e4a9086f0aea980d8575d13302e431ad688f22e27ed0e
-LINUX_KERNEL_HASH-4.19.122 = 5050268ec5cf003d96366d1611ecfa4ab6974125d6fa26cea1ccb81dd4df00a5
+LINUX_KERNEL_HASH-4.19.123 = a79914d31a8d8c6b0e2bb0f2b143d615fe8a6c4dd2e0f36e97aa20efd69a993f
 LINUX_KERNEL_HASH-5.4.40 = 83563f027687ecaafb41d0d2d52056f40ec9822f8a9e43592e215349730020ab
 
 remove_uri_prefix=$(subst git://,,$(subst http://,,$(subst https://,,$(1))))
diff --git a/target/linux/bcm27xx/patches-4.19/950-0029-mm-Remove-the-PFN-busy-warning.patch b/target/linux/bcm27xx/patches-4.19/950-0029-mm-Remove-the-PFN-busy-warning.patch
index ada81969b0..5cc53be0be 100644
--- a/target/linux/bcm27xx/patches-4.19/950-0029-mm-Remove-the-PFN-busy-warning.patch
+++ b/target/linux/bcm27xx/patches-4.19/950-0029-mm-Remove-the-PFN-busy-warning.patch
@@ -14,7 +14,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
 
 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
-@@ -8007,8 +8007,6 @@ int alloc_contig_range(unsigned long sta
+@@ -8008,8 +8008,6 @@ int alloc_contig_range(unsigned long sta
  
  	/* Make sure the range is really isolated. */
  	if (test_pages_isolated(outer_start, end, false)) {
diff --git a/target/linux/bcm27xx/patches-4.19/950-0121-hid-Reduce-default-mouse-polling-interval-to-60Hz.patch b/target/linux/bcm27xx/patches-4.19/950-0121-hid-Reduce-default-mouse-polling-interval-to-60Hz.patch
index 4851e066ac..794b209d29 100644
--- a/target/linux/bcm27xx/patches-4.19/950-0121-hid-Reduce-default-mouse-polling-interval-to-60Hz.patch
+++ b/target/linux/bcm27xx/patches-4.19/950-0121-hid-Reduce-default-mouse-polling-interval-to-60Hz.patch
@@ -19,7 +19,7 @@ Reduces overhead when using X
  module_param_named(mousepoll, hid_mousepoll_interval, uint, 0644);
  MODULE_PARM_DESC(mousepoll, "Polling interval of mice");
  
-@@ -1104,7 +1104,9 @@ static int usbhid_start(struct hid_devic
+@@ -1117,7 +1117,9 @@ static int usbhid_start(struct hid_devic
  		 */
  		switch (hid->collection->usage) {
  		case HID_GD_MOUSE:
diff --git a/target/linux/bcm27xx/patches-4.19/950-0574-usbhid-call-usb_fixup_endpoint-after-mangling-interv.patch b/target/linux/bcm27xx/patches-4.19/950-0574-usbhid-call-usb_fixup_endpoint-after-mangling-interv.patch
index 59263196c8..71adfaf9b6 100644
--- a/target/linux/bcm27xx/patches-4.19/950-0574-usbhid-call-usb_fixup_endpoint-after-mangling-interv.patch
+++ b/target/linux/bcm27xx/patches-4.19/950-0574-usbhid-call-usb_fixup_endpoint-after-mangling-interv.patch
@@ -13,7 +13,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
 
 --- a/drivers/hid/usbhid/hid-core.c
 +++ b/drivers/hid/usbhid/hid-core.c
-@@ -1118,6 +1118,7 @@ static int usbhid_start(struct hid_devic
+@@ -1131,6 +1131,7 @@ static int usbhid_start(struct hid_devic
  				interval = hid_kbpoll_interval;
  			break;
  		}
diff --git a/target/linux/generic/pending-4.19/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch b/target/linux/generic/pending-4.19/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch
index ec541a865c..54ae1829ee 100644
--- a/target/linux/generic/pending-4.19/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch
+++ b/target/linux/generic/pending-4.19/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch
@@ -71,7 +71,7 @@ Signed-off-by: Tobias Wolf <dev-NTEO@vplace.de>
 
 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
-@@ -6400,7 +6400,7 @@ static void __ref alloc_node_mem_map(str
+@@ -6401,7 +6401,7 @@ static void __ref alloc_node_mem_map(str
  		mem_map = NODE_DATA(0)->node_mem_map;
  #if defined(CONFIG_HAVE_MEMBLOCK_NODE_MAP) || defined(CONFIG_FLATMEM)
  		if (page_to_pfn(mem_map) != pgdat->node_start_pfn)

From 63bc209d7daadf69ef401ebf30c06d93fad21e52 Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Wed, 1 Jul 2020 11:08:42 +0800
Subject: [PATCH 11/28] Version Update to R20.7.1

---
 package/lean/default-settings/Makefile                   | 2 +-
 package/lean/default-settings/files/zzz-default-settings | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/lean/default-settings/Makefile b/package/lean/default-settings/Makefile
index 395d211df7..6bfba9d0c0 100644
--- a/package/lean/default-settings/Makefile
+++ b/package/lean/default-settings/Makefile
@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=default-settings
 PKG_VERSION:=1.1
-PKG_RELEASE:=60
+PKG_RELEASE:=61
 PKG_LICENSE:=GPLv3
 PKG_LICENSE_FILES:=LICENSE
 
diff --git a/package/lean/default-settings/files/zzz-default-settings b/package/lean/default-settings/files/zzz-default-settings
index a6904e9360..6c17d332de 100755
--- a/package/lean/default-settings/files/zzz-default-settings
+++ b/package/lean/default-settings/files/zzz-default-settings
@@ -44,7 +44,7 @@ sed -i '/option disabled/d' /etc/config/wireless
 sed -i '/set wireless.radio${devidx}.disabled/d' /lib/wifi/mac80211.sh
 
 sed -i '/DISTRIB_REVISION/d' /etc/openwrt_release
-echo "DISTRIB_REVISION='R20.6.18'" >> /etc/openwrt_release
+echo "DISTRIB_REVISION='R20.7.1'" >> /etc/openwrt_release
 sed -i '/DISTRIB_DESCRIPTION/d' /etc/openwrt_release
 echo "DISTRIB_DESCRIPTION='OpenWrt '" >> /etc/openwrt_release
 

From defe460d44b639aa865ec3afc9c647f9a6093de0 Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Wed, 1 Jul 2020 12:49:28 +0800
Subject: [PATCH 12/28] ipq40xx: import irq-balance script from
 presisco/openwrt-irq-balance

---
 target/linux/ipq40xx/Makefile                 |   2 +-
 .../base-files/etc/init.d/adjust_network      | 205 +++++++++++++++++-
 .../ipq40xx/base-files/lib/adjust_network.sh  |  86 --------
 3 files changed, 197 insertions(+), 96 deletions(-)
 delete mode 100644 target/linux/ipq40xx/base-files/lib/adjust_network.sh

diff --git a/target/linux/ipq40xx/Makefile b/target/linux/ipq40xx/Makefile
index e99d40f1f6..d2696b771c 100644
--- a/target/linux/ipq40xx/Makefile
+++ b/target/linux/ipq40xx/Makefile
@@ -20,6 +20,6 @@ DEFAULT_PACKAGES += \
 	kmod-ath10k wpad-openssl \
 	kmod-usb3 kmod-usb-dwc3 ath10k-firmware-qca4019 \
 	automount autosamba luci-app-ipsec-vpnd luci-app-unblockmusic luci-app-cpufreq luci-app-zerotier luci-app-xlnetacc \
-	htop fdisk e2fsprogs
+	htop fdisk e2fsprogs ethtool
 
 $(eval $(call BuildTarget))
diff --git a/target/linux/ipq40xx/base-files/etc/init.d/adjust_network b/target/linux/ipq40xx/base-files/etc/init.d/adjust_network
index 788b833ff4..6089259e5f 100755
--- a/target/linux/ipq40xx/base-files/etc/init.d/adjust_network
+++ b/target/linux/ipq40xx/base-files/etc/init.d/adjust_network
@@ -1,18 +1,205 @@
 #!/bin/sh /etc/rc.common
 # Copyright (C) 2006-2011 OpenWrt.org
 
-START=11
+START=99
 STOP=98
 
-adjust_smp_affinity() {
-	test -f /lib/adjust_network.sh && {
-		. /lib/adjust_network.sh
+rps_flow_cnt=4096
+core_count=$(grep -c processor /proc/cpuinfo)
+rps_sock_flow_ent=`expr $core_count \* $rps_flow_cnt`
+queue_cores="0 1 2"
+queue_irq_cores="1 2"
+wifi_core="3"
+usb_core="0"
 
-		adjust_edma_smp_affinity
-		adjust_radio_smp_affinity
-	}
+############### util functions ###############
+
+to_hex_list() {
+	local cores=$1
+	local converted=""
+	for core in $(echo $cores | awk '{print}')
+	do
+		local hex="$(gen_hex_mask "$core")"
+		converted="$converted $hex"
+	done
+	echo `echo $converted | sed 's/^ *//'`
 }
 
-boot() {
-	adjust_smp_affinity
+gen_hex_mask() {
+	local cores=$1
+	local mask=0
+	for core in $(echo $cores | awk '{print}')
+	do
+		local bit="$((1 << $core))"
+		let "mask = mask + bit"
+	done
+	local hex="$(printf %x "$mask")"
+	echo "$hex"
 }
+
+val_at_index() {
+	local values=$1
+	local idx=$2
+	echo `echo $values | awk -v i=$idx '{print $i}'`
+}
+
+size_of_list() {
+	local list=$1
+	local spaces=`echo $list | grep -o ' ' | wc -l`
+	echo `expr $spaces + 1`
+}
+
+set_core_mask() {
+	local file=$1
+	local cores=$2
+	local mask="$(gen_hex_mask "$cores")"
+	echo $mask > $file
+}
+
+set_core_mask_round() {
+	local files=$1
+	local cores=$2
+	local step_size=$3
+	[ ! -n "$3" ] && step_size=1
+	
+	local core_count="$(size_of_list "$cores")"
+	local counter=0
+	local idx=1
+	local roof=`expr $core_count \* $step_size`
+	for file in $(echo $files | awk '{print}')
+	do
+		let "idx = counter / step_size + 1"
+		local core="$(val_at_index "$cores" $idx)"
+		set_core_mask $file $core
+		let "counter = counter + 1"
+		[ $counter -ge $roof ] && counter=0
+	done
+}
+
+############### assign network queues ###############
+
+set_interface_round() {
+	local interface=$1
+	local cores=$2
+	local step_size=$3
+	[ ! -n "$3" ] && step_size=1
+	
+	echo "using round mask for interface: $interface, step size: $step_size"
+	set_core_mask_round "$(ls /sys/class/net/$interface/queues/tx-*/xps_cpus)" "$cores" $step_size
+	set_core_mask_round "$(ls /sys/class/net/$interface/queues/rx-*/rps_cpus)" "$cores" $step_size
+	
+	for file in /sys/class/net/$interface/queues/rx-[0-9]*/rps_flow_cnt
+	do
+		echo $rps_flow_cnt > $file
+	done
+}
+
+set_interface() {
+	local interface=$1
+	local cores=$2
+	
+	echo "using cores: $cores for interface: $interface"
+	
+	for file in /sys/class/net/$interface/queues/rx-[0-9]*/rps_cpus
+	do
+		set_core_mask $file "$cores"
+		echo $rps_flow_cnt > `dirname $file`/rps_flow_cnt
+	done
+
+	for file in /sys/class/net/$interface/queues/tx-[0-9]*/xps_cpus
+	do
+		set_core_mask $file "$cores"
+	done
+}
+
+set_interface_queues() {
+	echo "using cpu: $queue_cores for network queues"
+	for dev in /sys/class/net/eth*
+	do
+		[ -d "$dev" ] || continue
+		
+		local interface=`basename $dev`
+		
+		set_interface $interface "$queue_cores"
+	done
+
+	for dev in /sys/class/net/wlan*
+	do
+		[ -d "$dev" ] || continue
+		
+		local interface=`basename $dev`
+		
+		set_interface $interface "$queue_cores"
+	done
+	
+	for dev in /sys/class/net/eth*
+	do
+		local eth=`basename $dev`
+		echo "enabling offload on $eth"
+		ethtool -K $eth rx-checksum on >/dev/null 2>&1
+		ethtool -K $eth tx-checksum-ip-generic on >/dev/null 2>&1 || (
+		ethtool -K $eth tx-checksum-ipv4 on >/dev/null 2>&1
+		ethtool -K $eth tx-checksum-ipv6 on >/dev/null 2>&1)
+		ethtool -K $eth tx-scatter-gather on >/dev/null 2>&1
+		ethtool -K $eth gso on >/dev/null 2>&1
+		ethtool -K $eth gro on >/dev/null 2>&1
+		ethtool -K $eth lro on >/dev/null 2>&1
+		ethtool -K $eth tso on >/dev/null 2>&1
+		ethtool -K $eth ufo on >/dev/null 2>&1
+	done
+	
+	echo $rps_sock_flow_ent > /proc/sys/net/core/rps_sock_flow_entries
+	sysctl -w net.core.rps_sock_flow_entries=$rps_sock_flow_ent
+}
+
+############### assign interrupts ###############
+set_irq_cores() {
+	local mask="$(gen_hex_mask "$2")"
+	echo "set mask $mask for irq: $1"
+	echo $mask > "/proc/irq/$1/smp_affinity"
+}
+
+set_irq_pattern() {
+	local name_pattern="$1"
+	local cores="$2"
+	
+	for irq in `grep "$name_pattern" /proc/interrupts | cut -d: -f1 | sed 's, *,,'`
+	do
+		set_irq_cores $irq "$cores"
+	done
+}
+
+set_irq_interleave() {
+	local name_pattern=$1
+	local cores=$2
+	local step_size=$3
+	
+	local files=""
+	for irq in `grep "$name_pattern" /proc/interrupts | cut -d: -f1 | sed 's, *,,'`
+	do
+		files="$files\
+		/proc/irq/$irq/smp_affinity"
+	done
+	
+	set_core_mask_round "$files" "$cores" "$step_size"
+}
+
+set_irqs() {
+	#dma
+	set_irq_pattern bam_dma "$usb_core"
+
+	#ethernet
+	set_irq_interleave eth_tx "$queue_irq_cores" 4
+	set_irq_interleave eth_rx "$queue_irq_cores" 1
+
+	#pcie
+	set_irq_pattern pcie "$wifi_core"
+
+	#usb
+	set_irq_pattern usb "$usb_core"
+}
+
+start() {
+	set_interface_queues
+	set_irqs
+}
\ No newline at end of file
diff --git a/target/linux/ipq40xx/base-files/lib/adjust_network.sh b/target/linux/ipq40xx/base-files/lib/adjust_network.sh
deleted file mode 100644
index 95ffedc04f..0000000000
--- a/target/linux/ipq40xx/base-files/lib/adjust_network.sh
+++ /dev/null
@@ -1,86 +0,0 @@
-#!/bin/sh
-# this scripts is used for adjust cpu's choice of interrupts.
-#
-
-################################################
-# Adjust smp_affinity of edma
-# Globals:
-#    None
-# Arguments:
-#    None
-# Returns:
-#    None
-# Remark:
-#    execute only once on start-up.
-################################################
-adjust_edma_smp_affinity() {
-	grep -q edma_eth_ /proc/interrupts || return 0
-	local nr=`cat /proc/cpuinfo | grep processor | wc -l`
-	local cpu=0
-	local tx_irq_num
-
-	for tx_num in `seq 0 1 15` ; do
-		cpu=`printf "%x" $((1<<((tx_num/4+3)%nr)))`
-		tx_irq_num=`grep -m1 edma_eth_tx$tx_num /proc/interrupts | cut -d ':' -f 1 | tail -n1 | tr -d ' '`
-		[ -n "$tx_irq_num" ] && echo $cpu > /proc/irq/$tx_irq_num/smp_affinity
-	done
-
-	for rx_num in `seq 0 1 7` ; do
-		cpu=`printf "%x" $((1<<((rx_num/2)%nr)))`
-		rx_irq_num=`grep -m1 edma_eth_rx$rx_num /proc/interrupts | cut -d ':' -f 1 | tail -n1 | tr -d ' '`
-		[ -n "$rx_irq_num" ] && echo $cpu > /proc/irq/$rx_irq_num/smp_affinity
-	done
-}
-
-################################################
-# Adjust smp_affinity of ath10k for 2G and 5G
-# Globals:
-#    None
-# Arguments:
-#    None
-# Returns:
-#    None
-# Remark:
-#    execute only once on start-up.
-################################################
-adjust_radio_smp_affinity() {
-	local irqs="`grep -E 'ath10k' /proc/interrupts | cut -d ':' -f 1 | tr -d ' '`"
-	local nr=`cat /proc/cpuinfo | grep processor | wc -l`
-	local idx=2
-
-	for irq in $irqs; do
-		cpu=`printf "%x" $((1<<((idx)%nr)))`
-		echo $cpu > /proc/irq/$irq/smp_affinity
-		idx=$((idx+1))
-	done
-}
-
-################################################
-# Adjust queue of eth
-# Globals:
-#    None
-# Arguments:
-#    None
-# Returns:
-#    None
-# Remark:
-#    Each network reboot needs to be executed.
-################################################
-adjust_eth_queue() {
-	local nr=`cat /proc/cpuinfo | grep processor | wc -l`
-	local cpu=`printf "%x" $(((1<<nr)-1))`
-
-	for epath in /sys/class/net/eth[0-9]*; do
-		test -e $epath || break
-		echo $epath | grep -q "\." && continue
-		eth=`basename $epath`
-		for exps in /sys/class/net/$eth/queues/rx-[0-9]*/rps_cpus; do
-			test -e $exps || break
-			echo $cpu > $exps
-			echo 256 > `dirname $exps`/rps_flow_cnt
-		done
-		which ethtool >/dev/null 2>&1 && ethtool -K $eth gro off
-	done
-
-	echo 1024 > /proc/sys/net/core/rps_sock_flow_entries
-}

From d669a371b655565764f1f0d010976c65c444e1c9 Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Wed, 1 Jul 2020 14:33:50 +0800
Subject: [PATCH 13/28] UnblockNeteaseMusicGo: using single app to proccess
 windows client unblock

---
 package/lean/UnblockNeteaseMusicGo/Makefile   | 19 ++++++++++++++++---
 .../patches/01-fix-endpoint.patch             | 13 -------------
 package/lean/luci-app-unblockmusic/Makefile   |  2 +-
 .../root/etc/init.d/unblockmusic              |  3 +--
 4 files changed, 18 insertions(+), 19 deletions(-)
 delete mode 100644 package/lean/UnblockNeteaseMusicGo/patches/01-fix-endpoint.patch

diff --git a/package/lean/UnblockNeteaseMusicGo/Makefile b/package/lean/UnblockNeteaseMusicGo/Makefile
index e86f9711f8..e8c4dce478 100644
--- a/package/lean/UnblockNeteaseMusicGo/Makefile
+++ b/package/lean/UnblockNeteaseMusicGo/Makefile
@@ -2,11 +2,11 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=UnblockNeteaseMusicGo
 PKG_VERSION:=0.2.0
-PKG_RELEASE:=3
+PKG_RELEASE:=5
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/cnsilvan/UnblockNeteaseMusic.git
-PKG_SOURCE_VERSION:=0c1c2f7ed9ae6277a10b1b1bba81101f552af509
+PKG_SOURCE_VERSION:=f70ddb140db4711f2b192b5ddcc6382829473a82
 PKG_MAINTAINER:=Silvan <cnsilvan@gmail.com>
 
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)
@@ -25,6 +25,19 @@ GO_PKG_LDFLAGS_X:= \
 include $(INCLUDE_DIR)/package.mk
 include $(TOPDIR)/feeds/packages/lang/golang/golang-package.mk
 
+define Package/$(PKG_NAME)/config
+config $(PKG_NAME)_INCLUDE_GOPROXY
+	bool "Compiling with GOPROXY proxy"
+	default n
+
+endef
+
+ifeq ($(CONFIG_$(PKG_NAME)_INCLUDE_GOPROXY),y)
+export GO111MODULE=on
+export GOPROXY=https://goproxy.io
+#export GOPROXY=https://mirrors.aliyun.com/goproxy/
+endif
+
 define Package/$(PKG_NAME)
 	SECTION:=net
 	CATEGORY:=Network
@@ -43,7 +56,7 @@ define Build/Prepare
 endef
 
 define Build/Configure
-  patch -p1 -d $(BUILD_DIR)/$(PKG_NAME) <./patches/01-fix-endpoint.patch
+  
 endef
 
 define Build/Compile
diff --git a/package/lean/UnblockNeteaseMusicGo/patches/01-fix-endpoint.patch b/package/lean/UnblockNeteaseMusicGo/patches/01-fix-endpoint.patch
deleted file mode 100644
index c67f83ef2c..0000000000
--- a/package/lean/UnblockNeteaseMusicGo/patches/01-fix-endpoint.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/processor/processor.go b/processor/processor.go
-index a35f8df..a7e3015 100644
---- a/processor/processor.go
-+++ b/processor/processor.go
-@@ -393,7 +393,7 @@
- 				//data["url"] = uri.Scheme + "://" + uri.Host + uri.EscapedPath()
- 				//data["url"] = uri.String()
- 				if *config.EndPoint {
--					data["url"] = "http://music.163.com/unblockmusic/" + uri.String()
-+					data["url"] = "https://music.163.com/unblockmusic/" + uri.String()
- 				} else {
- 					data["url"] = uri.String()
- 				}
diff --git a/package/lean/luci-app-unblockmusic/Makefile b/package/lean/luci-app-unblockmusic/Makefile
index 6340fb4677..8edacb0c14 100644
--- a/package/lean/luci-app-unblockmusic/Makefile
+++ b/package/lean/luci-app-unblockmusic/Makefile
@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-unblockmusic
 PKG_VERSION:=2.3.5
-PKG_RELEASE:=7
+PKG_RELEASE:=8
 
 PKG_CONFIG_DEPENDS := \
 	CONFIG_UnblockNeteaseMusic_Go \
diff --git a/package/lean/luci-app-unblockmusic/root/etc/init.d/unblockmusic b/package/lean/luci-app-unblockmusic/root/etc/init.d/unblockmusic
index 1020406812..b0d2fe987e 100755
--- a/package/lean/luci-app-unblockmusic/root/etc/init.d/unblockmusic
+++ b/package/lean/luci-app-unblockmusic/root/etc/init.d/unblockmusic
@@ -184,9 +184,8 @@ start()
     add_cron
     echo "$(date -R) # UnblockNeteaseMusic Nodejs Version (http:5200, https:5201)" >>/tmp/unblockmusic.log  
 	elif [ "$APPTYPE" == "go" ]; then
-    UnblockNeteaseMusic -p 5200 -sp 5202 -m 0 -c /usr/share/UnblockNeteaseMusicGo/server.crt -k /usr/share/UnblockNeteaseMusicGo/server.key -m 0 >>/tmp/unblockmusic.log 2>&1 &
+    UnblockNeteaseMusic -p 5200 -sp 5201 -m 0 -c /usr/share/UnblockNeteaseMusicGo/server.crt -k /usr/share/UnblockNeteaseMusicGo/server.key -m 0 -e >>/tmp/unblockmusic.log 2>&1 &
     echo "$(date -R) # UnblockNeteaseMusic Golang Version (http:5200, https:5201)" >>/tmp/unblockmusic.log
-    UnblockNeteaseMusic -p 5203 -sp 5201 -m 0 -c /usr/share/UnblockNeteaseMusicGo/server.crt -k /usr/share/UnblockNeteaseMusicGo/server.key -m 0 -e >>/tmp/unblockmusic.log 2>&1 &
   else
     kill -9 $(busybox ps -w | grep 'sleep 60m' | grep -v grep | awk '{print $1}') >/dev/null 2>&1
     /usr/bin/UnblockNeteaseMusicCloud >/dev/null 2>&1 &

From 689dd9a678f38426135ed9ace842da1eabdeaca3 Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Wed, 1 Jul 2020 16:10:53 +0800
Subject: [PATCH 14/28] kernel: refresh upsteam modules

---
 package/kernel/kmod-sched-cake-oot/Makefile   |  54 +++++++
 package/kernel/kmod-sched-cake/Makefile       |  42 ------
 .../linux/files/sysctl-br-netfilter.conf      |   6 +-
 .../linux/files/sysctl-nf-conntrack.conf      |   3 +-
 .../linux/files/sysctl-tcp-bbr-k4_9.conf      |   5 -
 package/kernel/linux/modules/block.mk         |   8 +-
 package/kernel/linux/modules/can.mk           |  17 +++
 package/kernel/linux/modules/crypto.mk        |  21 +--
 package/kernel/linux/modules/fs.mk            |  28 +++-
 package/kernel/linux/modules/hwmon.mk         |  62 +++++++-
 package/kernel/linux/modules/i2c.mk           |  25 ++--
 package/kernel/linux/modules/iio.mk           |  94 +++++++++---
 package/kernel/linux/modules/input.mk         |   3 +-
 package/kernel/linux/modules/lib.mk           |  23 +--
 package/kernel/linux/modules/netdevices.mk    | 138 ++++++++++++-----
 package/kernel/linux/modules/netfilter.mk     |  17 ++-
 package/kernel/linux/modules/netsupport.mk    |  77 ++++++----
 package/kernel/linux/modules/other.mk         | 139 +++++++++++++-----
 package/kernel/linux/modules/sound.mk         |   3 +-
 package/kernel/linux/modules/usb.mk           |  33 ++---
 package/kernel/linux/modules/video.mk         |  12 +-
 package/kernel/linux/modules/w1.mk            |   2 +-
 package/kernel/linux/modules/wireless.mk      |  24 +--
 package/kernel/linux/modules/wpan.mk          |  11 +-
 package/lean/automount/Makefile               |   4 +-
 target/linux/x86/Makefile                     |   3 +-
 26 files changed, 566 insertions(+), 288 deletions(-)
 create mode 100644 package/kernel/kmod-sched-cake-oot/Makefile
 delete mode 100644 package/kernel/kmod-sched-cake/Makefile
 delete mode 100644 package/kernel/linux/files/sysctl-tcp-bbr-k4_9.conf

diff --git a/package/kernel/kmod-sched-cake-oot/Makefile b/package/kernel/kmod-sched-cake-oot/Makefile
new file mode 100644
index 0000000000..65042ce1f2
--- /dev/null
+++ b/package/kernel/kmod-sched-cake-oot/Makefile
@@ -0,0 +1,54 @@
+#
+# Copyright (C) 2016 LEDE
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=sched-cake-oot
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://github.com/dtaht/sch_cake.git
+PKG_SOURCE_DATE:=2020-01-10
+PKG_SOURCE_VERSION:=aeff7a3e61ffa3159a8a95384d33e47a006211f4
+PKG_MIRROR_HASH:=5bf06a804824db36ae393fc174aeec7b12633176e05a765c0931b39df5bd34df
+PKG_MAINTAINER:=Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/sched-cake-oot
+  SUBMENU:=Network Support
+  TITLE:=OOT Cake fq_codel/blue derived shaper
+  URL:=https://github.com/dtaht/sch_cake
+  FILES:=$(PKG_BUILD_DIR)/sch_cake.ko
+  AUTOLOAD:=$(call AutoLoad,75,sch_cake)
+  DEPENDS:=@LINUX_4_14 +kmod-sched-core +kmod-ipt-conntrack
+endef
+
+define KernelPackage/sched-cake-oot/description
+  O(ut) O(f) T(ree) Common Applications Kept Enhanced fq_codel/blue derived shaper
+endef
+
+define KernelPackage/sched-cake-virtual
+  SUBMENU:=Network Support
+  TITLE:=Virtual package for sched-cake
+  URL:=https://github.com/dtaht/sch_cake
+  DEPENDS:=+!LINUX_4_14:kmod-sched-cake +LINUX_4_14:kmod-sched-cake-oot
+endef
+
+define KernelPackage/sched-cake-virtual/description
+  Virtual package for resolving sch_cake dependencies
+endef
+
+include $(INCLUDE_DIR)/kernel-defaults.mk
+
+define Build/Compile
+	$(KERNEL_MAKE) M="$(PKG_BUILD_DIR)" modules
+endef
+
+$(eval $(call KernelPackage,sched-cake-oot))
+$(eval $(call KernelPackage,sched-cake-virtual))
diff --git a/package/kernel/kmod-sched-cake/Makefile b/package/kernel/kmod-sched-cake/Makefile
deleted file mode 100644
index 35446641ab..0000000000
--- a/package/kernel/kmod-sched-cake/Makefile
+++ /dev/null
@@ -1,42 +0,0 @@
-#
-# Copyright (C) 2016 LEDE
-#
-# This is free software, licensed under the GNU General Public License v2.
-# See /LICENSE for more information.
-#
-
-include $(TOPDIR)/rules.mk
-include $(INCLUDE_DIR)/kernel.mk
-
-PKG_NAME:=sched-cake
-PKG_RELEASE:=1
-
-PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://github.com/dtaht/sch_cake.git
-PKG_SOURCE_DATE:=2019-03-12
-PKG_SOURCE_VERSION:=057c738801e9dc64e8dd72a3fc4f50734214433c
-PKG_MIRROR_HASH:=5bf06a804824db36ae393fc174aeec7b12633176e05a765c0931b39df5bd34df
-PKG_MAINTAINER:=Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
-
-include $(INCLUDE_DIR)/package.mk
-
-define KernelPackage/sched-cake
-  SUBMENU:=Network Support
-  TITLE:=Cake fq_codel/blue derived shaper
-  URL:=https://github.com/dtaht/sch_cake
-  FILES:=$(PKG_BUILD_DIR)/sch_cake.ko
-  AUTOLOAD:=$(call AutoLoad,75,sch_cake)
-  DEPENDS:=+kmod-ipt-conntrack
-endef
-
-include $(INCLUDE_DIR)/kernel-defaults.mk
-
-define KernelPackage/sched-cake/description
-  Common Applications Kept Enhanced fq_codel/blue derived shaper
-endef
-
-define Build/Compile
-	$(KERNEL_MAKE) SUBDIRS="$(PKG_BUILD_DIR)" modules
-endef
-
-$(eval $(call KernelPackage,sched-cake))
diff --git a/package/kernel/linux/files/sysctl-br-netfilter.conf b/package/kernel/linux/files/sysctl-br-netfilter.conf
index 22c24a4bfe..b10ddc0874 100644
--- a/package/kernel/linux/files/sysctl-br-netfilter.conf
+++ b/package/kernel/linux/files/sysctl-br-netfilter.conf
@@ -2,6 +2,6 @@
 # /etc/sysctl.conf can be used to customize sysctl settings
 
 # disable bridge firewalling by default
-net.bridge.bridge-nf-call-arptables=1
-net.bridge.bridge-nf-call-ip6tables=1
-net.bridge.bridge-nf-call-iptables=1
+net.bridge.bridge-nf-call-arptables=0
+net.bridge.bridge-nf-call-ip6tables=0
+net.bridge.bridge-nf-call-iptables=0
diff --git a/package/kernel/linux/files/sysctl-nf-conntrack.conf b/package/kernel/linux/files/sysctl-nf-conntrack.conf
index 2af8cfb8cb..37baf5fd6f 100644
--- a/package/kernel/linux/files/sysctl-nf-conntrack.conf
+++ b/package/kernel/linux/files/sysctl-nf-conntrack.conf
@@ -3,8 +3,7 @@
 
 net.netfilter.nf_conntrack_acct=1
 net.netfilter.nf_conntrack_checksum=0
-net.netfilter.nf_conntrack_max=65535
+net.netfilter.nf_conntrack_max=16384
 net.netfilter.nf_conntrack_tcp_timeout_established=7440
 net.netfilter.nf_conntrack_udp_timeout=60
 net.netfilter.nf_conntrack_udp_timeout_stream=180
-net.netfilter.nf_conntrack_helper=1
diff --git a/package/kernel/linux/files/sysctl-tcp-bbr-k4_9.conf b/package/kernel/linux/files/sysctl-tcp-bbr-k4_9.conf
deleted file mode 100644
index 2f63b72888..0000000000
--- a/package/kernel/linux/files/sysctl-tcp-bbr-k4_9.conf
+++ /dev/null
@@ -1,5 +0,0 @@
-# Do not edit, changes to this file will be lost on upgrades
-# /etc/sysctl.conf can be used to customize sysctl settings
-
-net.ipv4.tcp_congestion_control=bbr
-net.core.default_qdisc=fq
diff --git a/package/kernel/linux/modules/block.mk b/package/kernel/linux/modules/block.mk
index c486a433c2..b870304ad4 100644
--- a/package/kernel/linux/modules/block.mk
+++ b/package/kernel/linux/modules/block.mk
@@ -38,7 +38,7 @@ $(eval $(call KernelPackage,ata-core))
 
 define AddDepends/ata
   SUBMENU:=$(BLOCK_MENU)
-  DEPENDS+=kmod-ata-core $(1)
+  DEPENDS+=+kmod-ata-core $(1)
 endef
 
 
@@ -117,14 +117,13 @@ $(eval $(call KernelPackage,ata-nvidia-sata))
 
 
 define KernelPackage/ata-pdc202xx-old
-  SUBMENU:=$(BLOCK_MENU)
   TITLE:=Older Promise PATA controller support
-  DEPENDS:=kmod-ata-core
   KCONFIG:= \
        CONFIG_ATA_SFF=y \
        CONFIG_PATA_PDC_OLD
   FILES:=$(LINUX_DIR)/drivers/ata/pata_pdc202xx_old.ko
   AUTOLOAD:=$(call AutoLoad,41,pata_pdc202xx_old,1)
+  $(call AddDepends/ata)
 endef
 
 define KernelPackage/ata-pdc202xx-old/description
@@ -209,7 +208,6 @@ $(eval $(call KernelPackage,block2mtd))
 define KernelPackage/dax
   SUBMENU:=$(BLOCK_MENU)
   TITLE:=DAX: direct access to differentiated memory
-  DEPENDS:=@!LINUX_4_9
   KCONFIG:=CONFIG_DAX
   FILES:=$(LINUX_DIR)/drivers/dax/dax.ko
 endef
@@ -220,7 +218,7 @@ $(eval $(call KernelPackage,dax))
 define KernelPackage/dm
   SUBMENU:=$(BLOCK_MENU)
   TITLE:=Device Mapper
-  DEPENDS:=+kmod-crypto-manager +!LINUX_4_9:kmod-dax
+  DEPENDS:=+kmod-crypto-manager +kmod-dax
   # All the "=n" are unnecessary, they're only there
   # to stop the config from asking the question.
   # MIRROR is M because I've needed it for pvmove.
diff --git a/package/kernel/linux/modules/can.mk b/package/kernel/linux/modules/can.mk
index c2c7411c6e..3bf0359c11 100644
--- a/package/kernel/linux/modules/can.mk
+++ b/package/kernel/linux/modules/can.mk
@@ -146,6 +146,23 @@ endef
 $(eval $(call KernelPackage,can-gw))
 
 
+define KernelPackage/can-mcp251x
+  TITLE:=MCP251x SPI CAN controller
+  KCONFIG:=\
+	CONFIG_SPI=y \
+	CONFIG_CAN_MCP251X
+  FILES:=$(LINUX_DIR)/drivers/net/can/spi/mcp251x.ko
+  AUTOLOAD:=$(call AutoProbe,can-mcp251x)
+  $(call AddDepends/can)
+endef
+
+define KernelPackage/can-mcp251x/description
+ Microchip MCP251x SPI CAN controller
+endef
+
+$(eval $(call KernelPackage,can-mcp251x))
+
+
 define KernelPackage/can-raw
   TITLE:=Raw CAN Protcol
   KCONFIG:=CONFIG_CAN_RAW
diff --git a/package/kernel/linux/modules/crypto.mk b/package/kernel/linux/modules/crypto.mk
index 60267f3c8e..9001721792 100644
--- a/package/kernel/linux/modules/crypto.mk
+++ b/package/kernel/linux/modules/crypto.mk
@@ -132,7 +132,7 @@ $(eval $(call KernelPackage,crypto-crc32c))
 
 define KernelPackage/crypto-ctr
   TITLE:=Counter Mode CryptoAPI module
-  DEPENDS:=+kmod-crypto-manager +kmod-crypto-seqiv +kmod-crypto-iv
+  DEPENDS:=+kmod-crypto-manager +kmod-crypto-seqiv
   KCONFIG:=CONFIG_CRYPTO_CTR
   FILES:=$(LINUX_DIR)/crypto/ctr.ko
   AUTOLOAD:=$(call AutoLoad,09,ctr)
@@ -156,7 +156,7 @@ $(eval $(call KernelPackage,crypto-cts))
 
 define KernelPackage/crypto-deflate
   TITLE:=Deflate compression CryptoAPI module
-  DEPENDS:=+kmod-lib-zlib-inflate +kmod-lib-zlib-deflate +!LINUX_4_9:kmod-crypto-acompress
+  DEPENDS:=+kmod-lib-zlib-inflate +kmod-lib-zlib-deflate +kmod-crypto-acompress
   KCONFIG:=CONFIG_CRYPTO_DEFLATE
   FILES:=$(LINUX_DIR)/crypto/deflate.ko
   AUTOLOAD:=$(call AutoLoad,09,deflate)
@@ -281,7 +281,7 @@ endef
 
 KernelPackage/crypto-ghash/imx6=$(KernelPackage/crypto-ghash/arm-ce)
 KernelPackage/crypto-ghash/ipq40xx=$(KernelPackage/crypto-ghash/arm-ce)
-KernelPackage/crypto-ghash/mvebu=$(KernelPackage/crypto-ghash/arm-ce)
+KernelPackage/crypto-ghash/mvebu/cortexa9=$(KernelPackage/crypto-ghash/arm-ce)
 
 $(eval $(call KernelPackage,crypto-ghash))
 
@@ -311,7 +311,7 @@ $(eval $(call KernelPackage,crypto-hmac))
 
 define KernelPackage/crypto-hw-ccp
   TITLE:=AMD Cryptographic Coprocessor
-  DEPENDS:=+kmod-crypto-authenc +kmod-crypto-hash +kmod-crypto-manager +kmod-random-core +kmod-crypto-sha1 +kmod-crypto-sha256 +!LINUX_4_9:kmod-crypto-rsa
+  DEPENDS:=+kmod-crypto-authenc +kmod-crypto-hash +kmod-crypto-manager +kmod-random-core +kmod-crypto-sha1 +kmod-crypto-sha256 +kmod-crypto-rsa
   KCONFIG:= \
 	CONFIG_CRYPTO_HW=y \
 	CONFIG_CRYPTO_DEV_CCP=y \
@@ -416,19 +416,6 @@ endef
 
 $(eval $(call KernelPackage,crypto-hw-talitos))
 
-define KernelPackage/crypto-iv
-  TITLE:=CryptoAPI initialization vectors
-  DEPENDS:=+kmod-crypto-manager +kmod-crypto-rng +kmod-crypto-wq
-  KCONFIG:= CONFIG_CRYPTO_BLKCIPHER2
-  HIDDEN:=1
-  FILES:= \
-	$(LINUX_DIR)/crypto/eseqiv.ko@lt4.9 \
-	$(LINUX_DIR)/crypto/chainiv.ko@lt4.9
-  AUTOLOAD:=$(call AutoLoad,10,eseqiv chainiv)
-  $(call AddDepends/crypto)
-endef
-
-$(eval $(call KernelPackage,crypto-iv))
 
 define KernelPackage/crypto-kpp
   TITLE:=Key-agreement Protocol Primitives
diff --git a/package/kernel/linux/modules/fs.mk b/package/kernel/linux/modules/fs.mk
index 3ffe82cbe8..82f8685111 100644
--- a/package/kernel/linux/modules/fs.mk
+++ b/package/kernel/linux/modules/fs.mk
@@ -68,7 +68,7 @@ $(eval $(call KernelPackage,fs-autofs4))
 define KernelPackage/fs-btrfs
   SUBMENU:=$(FS_MENU)
   TITLE:=BTRFS filesystem support
-  DEPENDS:=+kmod-lib-crc32c +kmod-lib-lzo +kmod-lib-zlib-inflate +kmod-lib-zlib-deflate +kmod-lib-raid6 +kmod-lib-xor +!LINUX_4_9:kmod-lib-zstd
+  DEPENDS:=+kmod-lib-crc32c +kmod-lib-lzo +kmod-lib-zlib-inflate +kmod-lib-zlib-deflate +kmod-lib-raid6 +kmod-lib-xor +kmod-lib-zstd
   KCONFIG:=\
 	CONFIG_BTRFS_FS \
 	CONFIG_BTRFS_FS_POSIX_ACL=n \
@@ -163,6 +163,30 @@ endef
 $(eval $(call KernelPackage,fs-efivarfs))
 
 
+define KernelPackage/fs-exfat
+  SUBMENU:=$(FS_MENU)
+  TITLE:=exFAT filesystem support
+  KCONFIG:= \
+	CONFIG_EXFAT_FS \
+	CONFIG_EXFAT_DONT_MOUNT_VFAT=y \
+	CONFIG_EXFAT_DISCARD=y \
+	CONFIG_EXFAT_DELAYED_SYNC=n \
+	CONFIG_EXFAT_KERNEL_DEBUG=n \
+	CONFIG_EXFAT_DEBUG_MSG=n \
+	CONFIG_EXFAT_DEFAULT_CODEPAGE=437 \
+	CONFIG_EXFAT_DEFAULT_IOCHARSET="utf8"
+  FILES:=$(LINUX_DIR)/drivers/staging/exfat/exfat.ko
+  AUTOLOAD:=$(call AutoLoad,30,exfat,1)
+  DEPENDS:=@!(LINUX_4_14||LINUX_4_19) +kmod-nls-base
+endef
+
+define KernelPackage/fs-exfat/description
+ Kernel module for exFAT filesystem support
+endef
+
+$(eval $(call KernelPackage,fs-exfat))
+
+
 define KernelPackage/fs-exportfs
   SUBMENU:=$(FS_MENU)
   TITLE:=exportfs kernel server support
@@ -206,7 +230,7 @@ $(eval $(call KernelPackage,fs-ext4))
 define KernelPackage/fs-f2fs
   SUBMENU:=$(FS_MENU)
   TITLE:=F2FS filesystem support
-  DEPENDS:= +kmod-crypto-hash +kmod-crypto-crc32
+  DEPENDS:= +kmod-crypto-hash +kmod-crypto-crc32 +LINUX_5_4:kmod-nls-base
   KCONFIG:= \
 	CONFIG_F2FS_FS \
 	CONFIG_F2FS_STAT_FS=y \
diff --git a/package/kernel/linux/modules/hwmon.mk b/package/kernel/linux/modules/hwmon.mk
index c0a477856e..0b9e9d8b13 100644
--- a/package/kernel/linux/modules/hwmon.mk
+++ b/package/kernel/linux/modules/hwmon.mk
@@ -26,9 +26,23 @@ $(eval $(call KernelPackage,hwmon-core))
 
 define AddDepends/hwmon
   SUBMENU:=$(HWMON_MENU)
-  DEPENDS:=kmod-hwmon-core $(1)
+  DEPENDS:=+kmod-hwmon-core $(1)
 endef
 
+define KernelPackage/hwmon-ad7418
+  TITLE:=AD741x monitoring support
+  KCONFIG:=CONFIG_SENSORS_AD7418
+  FILES:=$(LINUX_DIR)/drivers/hwmon/ad7418.ko
+  AUTOLOAD:=$(call AutoLoad,60,ad7418 ad7418)
+  $(call AddDepends/hwmon,+kmod-i2c-core)
+endef
+
+define KernelPackage/hwmon-ad7418/description
+ Kernel module for Analog Devices AD7416, AD7417 and AD7418 temperature monitor chip
+endef
+
+$(eval $(call KernelPackage,hwmon-ad7418))
+
 define KernelPackage/hwmon-ads1015
   TITLE:=Texas Instruments ADS1015
   KCONFIG:= CONFIG_SENSORS_ADS1015
@@ -77,6 +91,37 @@ endef
 $(eval $(call KernelPackage,hwmon-adt7475))
 
 
+define KernelPackage/hwmon-dme1737
+  TITLE:=SMSC DME1737 and compatible monitoring support
+  KCONFIG:=CONFIG_SENSORS_DME1737
+  FILES:= \
+	$(LINUX_DIR)/drivers/hwmon/dme1737.ko
+  AUTOLOAD:=$(call AutoProbe,dme1737)
+  $(call AddDepends/hwmon,+kmod-i2c-core +kmod-hwmon-vid)
+endef
+
+define KernelPackage/hwmon-dme1737/description
+ SMSC DME1737, SCH3112, SCH3114, SCH3116, SCH5027 monitoring support
+endef
+
+$(eval $(call KernelPackage,hwmon-dme1737))
+
+
+define KernelPackage/hwmon-drivetemp
+  TITLE:=Hard disk drives with temperature sensor
+  KCONFIG:=CONFIG_SENSORS_DRIVETEMP
+  FILES:=$(LINUX_DIR)/drivers/hwmon/drivetemp.ko
+  AUTOLOAD:=$(call AutoLoad,60,drivetemp)
+  $(call AddDepends/hwmon,+kmod-ata-core +kmod-scsi-core)
+endef
+
+define KernelPackage/hwmon-drivetemp/description
+ Kernel module for Hard disk drives with temperature sensor
+endef
+
+$(eval $(call KernelPackage,hwmon-drivetemp))
+
+
 define KernelPackage/hwmon-gpiofan
   TITLE:=Generic GPIO FAN support
   KCONFIG:=CONFIG_SENSORS_GPIO_FAN
@@ -92,6 +137,21 @@ endef
 $(eval $(call KernelPackage,hwmon-gpiofan))
 
 
+define KernelPackage/hwmon-f71882fg
+  TITLE:=F71882FG compatible monitoring support
+  KCONFIG:=CONFIG_SENSORS_F71882FG
+  FILES:=$(LINUX_DIR)/drivers/hwmon/f71882fg.ko
+  AUTOLOAD:=$(call AutoProbe,f71882fg)
+  $(call AddDepends/hwmon,@TARGET_x86)
+endef
+
+define KernelPackage/hwmon-f71882fg/description
+ Kernel module for hardware monitoring via many Fintek Super-IO chips.
+endef
+
+$(eval $(call KernelPackage,hwmon-f71882fg))
+
+
 define KernelPackage/hwmon-ina209
   TITLE:=INA209 monitoring support
   KCONFIG:=CONFIG_SENSORS_INA209
diff --git a/package/kernel/linux/modules/i2c.mk b/package/kernel/linux/modules/i2c.mk
index 0b23b2439c..ca6463c81b 100644
--- a/package/kernel/linux/modules/i2c.mk
+++ b/package/kernel/linux/modules/i2c.mk
@@ -42,7 +42,7 @@ I2C_ALGOBIT_MODULES:= \
 define KernelPackage/i2c-algo-bit
   $(call i2c_defaults,$(I2C_ALGOBIT_MODULES),55)
   TITLE:=I2C bit-banging interfaces
-  DEPENDS:=kmod-i2c-core
+  DEPENDS:=+kmod-i2c-core
 endef
 
 define KernelPackage/i2c-algo-bit/description
@@ -58,7 +58,7 @@ I2C_ALGOPCA_MODULES:= \
 define KernelPackage/i2c-algo-pca
   $(call i2c_defaults,$(I2C_ALGOPCA_MODULES),55)
   TITLE:=I2C PCA 9564 interfaces
-  DEPENDS:=kmod-i2c-core
+  DEPENDS:=+kmod-i2c-core
 endef
 
 define KernelPackage/i2c-algo-pca/description
@@ -74,7 +74,7 @@ I2C_ALGOPCF_MODULES:= \
 define KernelPackage/i2c-algo-pcf
   $(call i2c_defaults,$(I2C_ALGOPCF_MODULES),55)
   TITLE:=I2C PCF 8584 interfaces
-  DEPENDS:=kmod-i2c-core
+  DEPENDS:=+kmod-i2c-core
 endef
 
 define KernelPackage/i2c-algo-pcf/description
@@ -107,7 +107,7 @@ I2C_I801_MODULES:= \
 define KernelPackage/i2c-i801
   $(call i2c_defaults,$(I2C_I801_MODULES),59)
   TITLE:=Intel I801 and compatible I2C interfaces
-  DEPENDS:=@PCI_SUPPORT @TARGET_x86 kmod-i2c-core +kmod-i2c-smbus
+  DEPENDS:=@PCI_SUPPORT @TARGET_x86 +kmod-i2c-core +kmod-i2c-smbus
 endef
 
 define KernelPackage/i2c-i801/description
@@ -132,7 +132,7 @@ I2C_MUX_MODULES:= \
 define KernelPackage/i2c-mux
   $(call i2c_defaults,$(I2C_MUX_MODULES),51)
   TITLE:=I2C bus multiplexing support
-  DEPENDS:=kmod-i2c-core
+  DEPENDS:=+kmod-i2c-core
 endef
 
 define KernelPackage/i2c-mux/description
@@ -147,7 +147,7 @@ I2C_MUX_GPIO_MODULES:= \
 define KernelPackage/i2c-mux-gpio
   $(call i2c_defaults,$(I2C_MUX_GPIO_MODULES),51)
   TITLE:=GPIO-based I2C mux/switches
-  DEPENDS:=kmod-i2c-mux
+  DEPENDS:=+kmod-i2c-mux
 endef
 
 define KernelPackage/i2c-mux-gpio/description
@@ -163,7 +163,7 @@ I2C_MUX_PCA9541_MODULES:= \
 define KernelPackage/i2c-mux-pca9541
   $(call i2c_defaults,$(I2C_MUX_PCA9541_MODULES),51)
   TITLE:=Philips PCA9541 I2C mux/switches
-  DEPENDS:=kmod-i2c-mux
+  DEPENDS:=+kmod-i2c-mux
 endef
 
 define KernelPackage/i2c-mux-pca9541/description
@@ -178,7 +178,7 @@ I2C_MUX_PCA954x_MODULES:= \
 define KernelPackage/i2c-mux-pca954x
   $(call i2c_defaults,$(I2C_MUX_PCA954x_MODULES),51)
   TITLE:=Philips PCA954x I2C mux/switches
-  DEPENDS:=kmod-i2c-mux
+  DEPENDS:=+kmod-i2c-mux
 endef
 
 define KernelPackage/i2c-mux-pca954x/description
@@ -194,7 +194,7 @@ I2C_PIIX4_MODULES:= \
 define KernelPackage/i2c-piix4
   $(call i2c_defaults,$(I2C_PIIX4_MODULES),59)
   TITLE:=Intel PIIX4 and compatible I2C interfaces
-  DEPENDS:=@PCI_SUPPORT @TARGET_x86 kmod-i2c-core
+  DEPENDS:=@PCI_SUPPORT @TARGET_x86 +kmod-i2c-core
 endef
 
 define KernelPackage/i2c-piix4/description
@@ -210,13 +210,12 @@ $(eval $(call KernelPackage,i2c-piix4))
 
 
 I2C_PXA_MODULES:= \
-  CONFIG_I2C_PXA_SLAVE=y \
   CONFIG_I2C_PXA:drivers/i2c/busses/i2c-pxa
 
 define KernelPackage/i2c-pxa
   $(call i2c_defaults,$(I2C_PXA_MODULES),50)
   TITLE:=Intel PXA I2C bus driver
-  DEPENDS:=kmod-i2c-core
+  DEPENDS:=+kmod-i2c-core
 endef
 
 define KernelPackage/i2c-pxa/description
@@ -232,7 +231,7 @@ I2C_SMBUS_MODULES:= \
 define KernelPackage/i2c-smbus
   $(call i2c_defaults,$(I2C_SMBUS_MODULES),58)
   TITLE:=SMBus-specific protocols helper
-  DEPENDS:=kmod-i2c-core
+  DEPENDS:=+kmod-i2c-core
 endef
 
 define KernelPackage/i2c-smbus/description
@@ -249,7 +248,7 @@ I2C_TINY_USB_MODULES:= \
 define KernelPackage/i2c-tiny-usb
   $(call i2c_defaults,$(I2C_TINY_USB_MODULES),59)
   TITLE:=I2C Tiny USB adaptor
-  DEPENDS:=@USB_SUPPORT kmod-i2c-core +kmod-usb-core
+  DEPENDS:=@USB_SUPPORT +kmod-i2c-core +kmod-usb-core
 endef
 
 define KernelPackage/i2c-tiny-usb/description
diff --git a/package/kernel/linux/modules/iio.mk b/package/kernel/linux/modules/iio.mk
index 17ffdc3441..ab14e97a05 100644
--- a/package/kernel/linux/modules/iio.mk
+++ b/package/kernel/linux/modules/iio.mk
@@ -328,20 +328,88 @@ endef
 $(eval $(call KernelPackage,iio-st_accel))
 
 
-define KernelPackage/iio-st_sensors-i2c
+define KernelPackage/iio-st_accel-i2c
   SUBMENU:=$(IIO_MENU)
   TITLE:=STMicroelectronics accelerometer 3-Axis Driver (I2C)
   DEPENDS:=+kmod-iio-st_accel +kmod-i2c-core +kmod-regmap-i2c
   KCONFIG:= CONFIG_IIO_ST_ACCEL_I2C_3AXIS
-  FILES:=$(LINUX_DIR)/drivers/iio/common/st_sensors/st_sensors_i2c.ko
-  AUTOLOAD:=$(call AutoLoad,56,st_sensors_i2c)
+  FILES:= \
+	$(LINUX_DIR)/drivers/iio/accel/st_accel_i2c.ko \
+	$(LINUX_DIR)/drivers/iio/common/st_sensors/st_sensors_i2c.ko
+  AUTOLOAD:=$(call AutoLoad,56,st_accel_i2c)
 endef
 
-define KernelPackage/iio-st_sensors-i2c/description
+define KernelPackage/iio-st_accel-i2c/description
  This package adds support for STMicroelectronics I2C based accelerometers
 endef
 
-$(eval $(call KernelPackage,iio-st_sensors-i2c))
+$(eval $(call KernelPackage,iio-st_accel-i2c))
+
+
+define KernelPackage/iio-st_accel-spi
+  SUBMENU:=$(IIO_MENU)
+  TITLE:=STMicroelectronics accelerometer 3-Axis Driver (SPI)
+  DEPENDS:=+kmod-iio-st_accel +kmod-regmap-spi
+  KCONFIG:= CONFIG_IIO_ST_ACCEL_SPI_3AXIS
+  FILES:= \
+	$(LINUX_DIR)/drivers/iio/accel/st_accel_spi.ko \
+	$(LINUX_DIR)/drivers/iio/common/st_sensors/st_sensors_spi.ko
+  AUTOLOAD:=$(call AutoLoad,56,st_accel_spi)
+endef
+
+define KernelPackage/iio-st_accel-spi/description
+ This package adds support for STMicroelectronics SPI based accelerometers
+endef
+
+$(eval $(call KernelPackage,iio-st_accel-spi))
+
+
+define KernelPackage/iio-lsm6dsx
+  SUBMENU:=$(IIO_MENU)
+  DEPENDS:=+kmod-iio-core +kmod-iio-kfifo-buf +kmod-regmap-core
+  TITLE:=ST LSM6DSx driver for IMU MEMS sensors
+  KCONFIG:=CONFIG_IIO_ST_LSM6DSX
+  FILES:=$(LINUX_DIR)/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.ko
+  AUTOLOAD:=$(call AutoProbe,st_lsm6dsx)
+endef
+
+define KernelPackage/iio-lsm6dsx/description
+ Support for the ST LSM6DSx and related IMU MEMS sensors.
+endef
+
+$(eval $(call KernelPackage,iio-lsm6dsx))
+
+
+define KernelPackage/iio-lsm6dsx-i2c
+  SUBMENU:=$(IIO_MENU)
+  DEPENDS:=+kmod-iio-lsm6dsx +kmod-i2c-core +kmod-regmap-i2c
+  TITLE:=ST LSM6DSx driver for IMU MEMS sensors (I2C)
+  KCONFIG:=CONFIG_IIO_ST_LSM6DSX
+  FILES:=$(LINUX_DIR)/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_i2c.ko
+  AUTOLOAD:=$(call AutoProbe,st_lsm6dsx-i2c)
+endef
+
+define KernelPackage/iio-lsm6dsx-i2c/description
+ Support for the ST LSM6DSx and related IMU MEMS I2C sensors.
+endef
+
+$(eval $(call KernelPackage,iio-lsm6dsx-i2c))
+
+
+define KernelPackage/iio-lsm6dsx-spi
+  SUBMENU:=$(IIO_MENU)
+  DEPENDS:=+kmod-iio-lsm6dsx +kmod-regmap-spi
+  TITLE:=ST LSM6DSx driver for IMU MEMS sensors (SPI)
+  KCONFIG:=CONFIG_IIO_ST_LSM6DSX
+  FILES:=$(LINUX_DIR)/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_spi.ko
+  AUTOLOAD:=$(call AutoProbe,st_lsm6dsx-spi)
+endef
+
+define KernelPackage/iio-lsm6dsx-spi/description
+ Support for the ST LSM6DSx and related IMU MEMS SPI sensors.
+endef
+
+$(eval $(call KernelPackage,iio-lsm6dsx-spi))
 
 
 define KernelPackage/iio-sps30
@@ -360,22 +428,6 @@ endef
 $(eval $(call KernelPackage,iio-sps30))
 
 
-define KernelPackage/iio-st_sensors-spi
-  SUBMENU:=$(IIO_MENU)
-  TITLE:=STMicroelectronics accelerometer 3-Axis Driver (SPI)
-  DEPENDS:=+kmod-iio-st_accel +kmod-regmap-spi
-  KCONFIG:= CONFIG_IIO_ST_ACCEL_SPI_3AXIS
-  FILES:=$(LINUX_DIR)/drivers/iio/common/st_sensors/st_sensors_spi.ko
-  AUTOLOAD:=$(call AutoLoad,56,st_sensors_spi)
-endef
-
-define KernelPackage/iio-st_sensors-spi/description
- This package adds support for STMicroelectronics SPI based accelerometers
-endef
-
-$(eval $(call KernelPackage,iio-st_sensors-spi))
-
-
 define KernelPackage/iio-tsl4531
   SUBMENU:=$(IIO_MENU)
   DEPENDS:=+kmod-i2c-core +kmod-iio-core
diff --git a/package/kernel/linux/modules/input.mk b/package/kernel/linux/modules/input.mk
index 8c5eaf5549..0f6e4d507b 100644
--- a/package/kernel/linux/modules/input.mk
+++ b/package/kernel/linux/modules/input.mk
@@ -181,7 +181,8 @@ define KernelPackage/input-touchscreen-ads7846
 	CONFIG_INPUT_TOUCHSCREEN=y \
 	CONFIG_TOUCHSCREEN_PROPERTIES=y \
 	CONFIG_TOUCHSCREEN_ADS7846
-  FILES:=$(LINUX_DIR)/drivers/input/touchscreen/ads7846.ko
+  FILES:=$(LINUX_DIR)/drivers/input/touchscreen/ads7846.ko \
+	$(LINUX_DIR)/drivers/input/touchscreen/of_touchscreen.ko@ge5.4
   AUTOLOAD:=$(call AutoProbe,ads7846)
 endef
 
diff --git a/package/kernel/linux/modules/lib.mk b/package/kernel/linux/modules/lib.mk
index 3e5a12e926..e14c6b31c0 100644
--- a/package/kernel/linux/modules/lib.mk
+++ b/package/kernel/linux/modules/lib.mk
@@ -101,17 +101,17 @@ $(eval $(call KernelPackage,lib-crc32c))
 define KernelPackage/lib-lzo
   SUBMENU:=$(LIB_MENU)
   TITLE:=LZO support
-  DEPENDS:=+!LINUX_4_9:kmod-crypto-acompress
+  DEPENDS:=+kmod-crypto-acompress
   KCONFIG:= \
-	CONFIG_CRYPTO_LZO@ge4.9 \
+	CONFIG_CRYPTO_LZO \
 	CONFIG_LZO_COMPRESS \
 	CONFIG_LZO_DECOMPRESS
   HIDDEN:=1
   FILES:= \
-	$(LINUX_DIR)/crypto/lzo.ko@ge4.9 \
+	$(LINUX_DIR)/crypto/lzo.ko \
 	$(LINUX_DIR)/lib/lzo/lzo_compress.ko \
 	$(LINUX_DIR)/lib/lzo/lzo_decompress.ko
-  AUTOLOAD:=$(call AutoProbe,lzo@ge4.9 lzo_compress lzo_decompress)
+  AUTOLOAD:=$(call AutoProbe,lzo lzo_compress lzo_decompress)
 endef
 
 define KernelPackage/lib-lzo/description
@@ -146,17 +146,17 @@ $(eval $(call KernelPackage,lib-zstd))
 define KernelPackage/lib-lz4
   SUBMENU:=$(LIB_MENU)
   TITLE:=LZ4 support
-  DEPENDS:=+!LINUX_4_9:kmod-crypto-acompress
+  DEPENDS:=+kmod-crypto-acompress
   HIDDEN:=1
   KCONFIG:= \
-	CONFIG_CRYPTO_LZ4@ge4.9 \
+	CONFIG_CRYPTO_LZ4 \
 	CONFIG_LZ4_COMPRESS \
 	CONFIG_LZ4_DECOMPRESS
   FILES:= \
-	$(LINUX_DIR)/crypto/lz4.ko@ge4.9 \
+	$(LINUX_DIR)/crypto/lz4.ko \
 	$(LINUX_DIR)/lib/lz4/lz4_compress.ko \
 	$(LINUX_DIR)/lib/lz4/lz4_decompress.ko
-  AUTOLOAD:=$(call AutoProbe,lz4@ge4.9 lz4_compress lz4_decompress)
+  AUTOLOAD:=$(call AutoProbe,lz4 lz4_compress lz4_decompress)
 endef
 
 define KernelPackage/lib-lz4/description
@@ -187,10 +187,10 @@ define KernelPackage/lib-xor
   TITLE:=XOR blocks algorithm support
   HIDDEN:=1
   KCONFIG:=CONFIG_XOR_BLOCKS
-ifneq ($(wildcard $(LINUX_DIR)/arch/arm/lib/xor-neon.ko),)
+ifneq ($(wildcard $(LINUX_DIR)/arch/$(LINUX_KARCH)/lib/xor-neon.ko),)
   FILES:= \
     $(LINUX_DIR)/crypto/xor.ko \
-    $(LINUX_DIR)/arch/arm/lib/xor-neon.ko
+    $(LINUX_DIR)/arch/$(LINUX_KARCH)/lib/xor-neon.ko
   AUTOLOAD:=$(call AutoProbe,xor-neon xor)
 else
   FILES:=$(LINUX_DIR)/crypto/xor.ko
@@ -251,7 +251,8 @@ define KernelPackage/lib-cordic
   SUBMENU:=$(LIB_MENU)
   TITLE:=Cordic function support
   KCONFIG:=CONFIG_CORDIC
-  FILES:=$(LINUX_DIR)/lib/cordic.ko
+  FILES:=$(LINUX_DIR)/lib/cordic.ko@lt5.2 \
+	  $(LINUX_DIR)/lib/math/cordic.ko@ge5.2
   AUTOLOAD:=$(call AutoProbe,cordic)
 endef
 
diff --git a/package/kernel/linux/modules/netdevices.mk b/package/kernel/linux/modules/netdevices.mk
index 271edae71f..e95d84fda8 100644
--- a/package/kernel/linux/modules/netdevices.mk
+++ b/package/kernel/linux/modules/netdevices.mk
@@ -107,6 +107,22 @@ endef
 
 $(eval $(call KernelPackage,libphy))
 
+
+define KernelPackage/phylink
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Model for MAC to optional PHY connection
+  KCONFIG:=CONFIG_PHYLINK
+  FILES:=$(LINUX_DIR)/drivers/net/phy/phylink.ko
+  AUTOLOAD:=$(call AutoLoad,15,phylink,1)
+endef
+
+define KernelPackage/phylink/description
+ Model for MAC to optional PHY connection
+endef
+
+$(eval $(call KernelPackage,phylink))
+
+
 define KernelPackage/mii
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=MII library
@@ -192,6 +208,23 @@ endef
 $(eval $(call KernelPackage,phy-broadcom))
 
 
+define KernelPackage/phy-bcm84881
+   SUBMENU:=$(NETWORK_DEVICES_MENU)
+   TITLE:=Broadcom BCM84881 PHY driver
+   KCONFIG:=CONFIG_BCM84881_PHY
+   DEPENDS:=+kmod-libphy
+   FILES:=$(LINUX_DIR)/drivers/net/phy/bcm84881.ko
+   AUTOLOAD:=$(call AutoLoad,18,bcm84881,1)
+endef
+
+define KernelPackage/phy-bcm84881/description
+   Supports the Broadcom 84881 PHY.
+endef
+
+$(eval $(call KernelPackage,phy-bcm84881))
+
+
+
 define KernelPackage/phy-realtek
    SUBMENU:=$(NETWORK_DEVICES_MENU)
    TITLE:=Realtek Ethernet PHY driver
@@ -223,6 +256,36 @@ endef
 
 $(eval $(call KernelPackage,swconfig))
 
+define KernelPackage/switch-bcm53xx
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Broadcom bcm53xx switch support
+  DEPENDS:=+kmod-swconfig
+  KCONFIG:=CONFIG_SWCONFIG_B53
+  FILES:=$(LINUX_DIR)/drivers/net/phy/b53/b53_common.ko
+  AUTOLOAD:=$(call AutoLoad,42,b53_common)
+endef
+
+define KernelPackage/switch-bcm53xx/description
+  Broadcom bcm53xx switch support
+endef
+
+$(eval $(call KernelPackage,switch-bcm53xx))
+
+define KernelPackage/switch-bcm53xx-mdio
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Broadcom bcm53xx switch MDIO support
+  DEPENDS:=+kmod-switch-bcm53xx
+  KCONFIG:=CONFIG_SWCONFIG_B53_PHY_DRIVER
+  FILES:=$(LINUX_DIR)/drivers/net/phy/b53/b53_mdio.ko
+  AUTOLOAD:=$(call AutoLoad,42,b53_mdio)
+endef
+
+define KernelPackage/switch-bcm53xx-mdio/description
+  Broadcom bcm53xx switch MDIO support
+endef
+
+$(eval $(call KernelPackage,switch-bcm53xx-mdio))
+
 define KernelPackage/switch-mvsw61xx
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Marvell 88E61xx switch support
@@ -276,7 +339,7 @@ define KernelPackage/switch-rtl8366-smi
   DEPENDS:=@GPIO_SUPPORT +kmod-swconfig +(TARGET_armvirt||TARGET_bcm27xx_bcm2708||TARGET_samsung||TARGET_tegra):kmod-of-mdio
   KCONFIG:=CONFIG_RTL8366_SMI
   FILES:=$(LINUX_DIR)/drivers/net/phy/rtl8366_smi.ko
-  AUTOLOAD:=$(call AutoLoad,42,rtl8366_smi)
+  AUTOLOAD:=$(call AutoLoad,42,rtl8366_smi,1)
 endef
 
 define KernelPackage/switch-rtl8366-smi/description
@@ -324,7 +387,7 @@ define KernelPackage/switch-rtl8367b
   DEPENDS:=+kmod-switch-rtl8366-smi
   KCONFIG:=CONFIG_RTL8367B_PHY
   FILES:=$(LINUX_DIR)/drivers/net/phy/rtl8367b.ko
-  AUTOLOAD:=$(call AutoLoad,43,rtl8367b)
+  AUTOLOAD:=$(call AutoLoad,43,rtl8367b,1)
 endef
 
 define KernelPackage/switch-rtl8367b/description
@@ -494,7 +557,7 @@ $(eval $(call KernelPackage,8139cp))
 define KernelPackage/r8169
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=RealTek RTL-8169 PCI Gigabit Ethernet Adapter kernel support
-  DEPENDS:=@PCI_SUPPORT +kmod-mii +r8169-firmware +LINUX_4_19:kmod-phy-realtek
+  DEPENDS:=@PCI_SUPPORT +kmod-mii +r8169-firmware +!LINUX_4_14:kmod-phy-realtek
   KCONFIG:=CONFIG_R8169 \
     CONFIG_R8169_NAPI=y \
     CONFIG_R8169_VLAN=n
@@ -619,7 +682,7 @@ $(eval $(call KernelPackage,igbvf))
 define KernelPackage/ixgbe
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Intel(R) 82598/82599 PCI-Express 10 Gigabit Ethernet support
-  DEPENDS:=@PCI_SUPPORT +kmod-mdio +kmod-ptp +kmod-hwmon-core
+  DEPENDS:=@PCI_SUPPORT +kmod-mdio +kmod-ptp +kmod-hwmon-core +LINUX_5_4:kmod-libphy
   KCONFIG:=CONFIG_IXGBE \
     CONFIG_IXGBE_VXLAN=n \
     CONFIG_IXGBE_HWMON=y \
@@ -653,12 +716,15 @@ endef
 
 $(eval $(call KernelPackage,ixgbevf))
 
+
 define KernelPackage/i40e
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Intel(R) Ethernet Controller XL710 Family support
-  DEPENDS:=@PCI_SUPPORT +kmod-mdio +kmod-ptp +kmod-hwmon-core
+  DEPENDS:=@PCI_SUPPORT +kmod-mdio +kmod-ptp +kmod-hwmon-core +LINUX_5_4:kmod-libphy
   KCONFIG:=CONFIG_I40E \
-    CONFIG_I40E_DCB=n
+    CONFIG_I40E_VXLAN=n \
+    CONFIG_I40E_HWMON=y \
+    CONFIG_I40E_DCA=n
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/intel/i40e/i40e.ko
   AUTOLOAD:=$(call AutoProbe,i40e)
 endef
@@ -670,26 +736,33 @@ endef
 $(eval $(call KernelPackage,i40e))
 
 
-define KernelPackage/i40evf
+define KernelPackage/iavf
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Intel(R) Ethernet Adaptive Virtual Function support
-  DEPENDS:=@PCI_SUPPORT +kmod-i40e
-  KCONFIG:=CONFIG_I40EVF
-  FILES:=$(LINUX_DIR)/drivers/net/ethernet/intel/i40evf/i40evf.ko
-  AUTOLOAD:=$(call AutoProbe,i40evf)
+  DEPENDS:=@PCI_SUPPORT
+  KCONFIG:= \
+       CONFIG_I40EVF \
+       CONFIG_IAVF
+  FILES:= \
+       $(LINUX_DIR)/drivers/net/ethernet/intel/i40evf/i40evf.ko@lt4.20 \
+       $(LINUX_DIR)/drivers/net/ethernet/intel/iavf/iavf.ko@ge4.20
+  AUTOLOAD:=$(call AutoProbe,i40evf iavf)
+  AUTOLOAD:=$(call AutoProbe,iavf)
 endef
 
-define KernelPackage/i40evf/description
- Kernel modules for Intel(R) Ethernet Controller XL710 Family Virtual Function Ethernet adapters.
+define KernelPackage/iavf/description
+ Kernel modules for Intel XL710,
+	  X710, X722, XXV710, and all devices advertising support for
+	  Intel Ethernet Adaptive Virtual Function devices.
 endef
 
-$(eval $(call KernelPackage,i40evf))
+$(eval $(call KernelPackage,iavf))
 
 
 define KernelPackage/b44
   TITLE:=Broadcom 44xx driver
   KCONFIG:=CONFIG_B44
-  DEPENDS:=@PCI_SUPPORT @!TARGET_brcm47xx_mips74k +!TARGET_brcm47xx:kmod-ssb +kmod-mii +kmod-libphy
+  DEPENDS:=@PCI_SUPPORT @!TARGET_bcm47xx_mips74k +!TARGET_bcm47xx:kmod-ssb +kmod-mii +kmod-libphy
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/broadcom/b44.ko
   AUTOLOAD:=$(call AutoLoad,19,b44,1)
@@ -744,7 +817,7 @@ define KernelPackage/tg3
   TITLE:=Broadcom Tigon3 Gigabit Ethernet
   KCONFIG:=CONFIG_TIGON3 \
 	CONFIG_TIGON3_HWMON=n
-  DEPENDS:=+!TARGET_brcm47xx:kmod-libphy +LINUX_4_9:kmod-hwmon-core +kmod-ptp
+  DEPENDS:=+!TARGET_bcm47xx:kmod-libphy +kmod-ptp
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/broadcom/tg3.ko
   AUTOLOAD:=$(call AutoLoad,19,tg3,1)
@@ -794,7 +867,7 @@ $(eval $(call KernelPackage,hfcmulti))
 define KernelPackage/gigaset
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Siemens Gigaset support for isdn4linux
-  DEPENDS:=@USB_SUPPORT +kmod-isdn4linux +kmod-lib-crc-ccitt +kmod-usb-core
+  DEPENDS:=@USB_SUPPORT +kmod-isdn4linux +kmod-lib-crc-ccitt +kmod-usb-core @!LINUX_5_4
   URL:=http://gigaset307x.sourceforge.net/
   KCONFIG:= \
     CONFIG_ISDN_DRV_GIGASET \
@@ -912,6 +985,7 @@ define KernelPackage/ifb
 	CONFIG_NET_CLS=y
   FILES:=$(LINUX_DIR)/drivers/net/ifb.ko
   AUTOLOAD:=$(call AutoLoad,34,ifb)
+  MODPARAMS.ifb:=numifbs=0
 endef
 
 define KernelPackage/ifb/description
@@ -960,7 +1034,7 @@ define KernelPackage/of-mdio
   DEPENDS:=+kmod-libphy
   KCONFIG:=CONFIG_OF_MDIO
   FILES:= \
-	$(LINUX_DIR)/drivers/net/phy/fixed_phy.ko@ge4.9 \
+	$(LINUX_DIR)/drivers/net/phy/fixed_phy.ko \
 	$(LINUX_DIR)/drivers/of/of_mdio.ko
   AUTOLOAD:=$(call AutoLoad,41,of_mdio)
 endef
@@ -1126,24 +1200,22 @@ endef
 
 $(eval $(call KernelPackage,mlx5-core))
 
-define KernelPackage/sfc
+
+define KernelPackage/sfp
   SUBMENU:=$(NETWORK_DEVICES_MENU)
-  TITLE:=Solarflare SFC9000/SFC9100-family 10Gbps NIC support
-  DEPENDS:=@PCI_SUPPORT +kmod-mdio +kmod-i2c-core +kmod-i2c-algo-bit +kmod-hwmon-core +kmod-ptp +kmod-lib-crc32c
-# add PCI_IOV
+  TITLE:=SFP cage support
+  DEPENDS:=+kmod-i2c-core +kmod-hwmon-core +kmod-phylink
   KCONFIG:= \
-    CONFIG_NET_VENDOR_SOLARFLARE=y \
-    CONFIG_SFC=y \
-    CONFIG_SFC_MTD=y \
-    CONFIG_MCDI_MON=y \
-    CONFIG_SFC_SRIOV=n \
-    CONFIG_SFC_MCDI_LOGGING=n \
-  FILES:=$(LINUX_DIR)/drivers/net/ethernet/sfc/sfc.ko
-  AUTOLOAD:=$(call AutoProbe, sfc)
+	CONFIG_SFP \
+	CONFIG_MDIO_I2C
+  FILES:= \
+	$(LINUX_DIR)/drivers/net/phy/sfp.ko \
+	$(LINUX_DIR)/drivers/net/phy/mdio-i2c.ko
+  AUTOLOAD:=$(call AutoProbe,mdio-i2c sfp)
 endef
 
-define KernelPackage/sfc/description
-  Solarflare SFC9000/SFC9100-family 10Gbps NIC support
+define KernelPackage/sfp/description
+ Kernel module to support SFP cages
 endef
 
-$(eval $(call KernelPackage,sfc))
+$(eval $(call KernelPackage,sfp))
diff --git a/package/kernel/linux/modules/netfilter.mk b/package/kernel/linux/modules/netfilter.mk
index cc4c5ecb2a..5a3d490173 100644
--- a/package/kernel/linux/modules/netfilter.mk
+++ b/package/kernel/linux/modules/netfilter.mk
@@ -137,7 +137,7 @@ define KernelPackage/nf-nat6
   SUBMENU:=$(NF_MENU)
   TITLE:=Netfilter IPV6-NAT
   KCONFIG:=$(KCONFIG_NF_NAT6)
-  DEPENDS:=+kmod-nf-conntrack6 +kmod-nf-nat
+  DEPENDS:=@IPV6 +kmod-nf-conntrack6 +kmod-nf-nat
   FILES:=$(foreach mod,$(NF_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT6-m)))
 endef
@@ -152,7 +152,7 @@ define KernelPackage/nf-flow
 	CONFIG_NETFILTER_INGRESS=y \
 	CONFIG_NF_FLOW_TABLE \
 	CONFIG_NF_FLOW_TABLE_HW
-  DEPENDS:=+kmod-nf-conntrack @!LINUX_4_9
+  DEPENDS:=+kmod-nf-conntrack
   FILES:= \
 	$(LINUX_DIR)/net/netfilter/nf_flow_table.ko \
 	$(LINUX_DIR)/net/netfilter/nf_flow_table_hw.ko
@@ -471,6 +471,7 @@ $(eval $(call KernelPackage,ipt-raw))
 
 define KernelPackage/ipt-raw6
   TITLE:=Netfilter IPv6 raw table support
+  DEPENDS:=@IPV6
   KCONFIG:=CONFIG_IP6_NF_RAW
   FILES:=$(LINUX_DIR)/net/ipv6/netfilter/ip6table_raw.ko
   AUTOLOAD:=$(call AutoProbe,ip6table_raw)
@@ -482,6 +483,7 @@ $(eval $(call KernelPackage,ipt-raw6))
 
 define KernelPackage/ipt-nat6
   TITLE:=IPv6 NAT targets
+  DEPENDS:=@IPV6
   KCONFIG:=$(KCONFIG_IPT_NAT6)
   FILES:=$(foreach mod,$(IPT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_NAT6-m)))
@@ -540,7 +542,7 @@ define KernelPackage/nf-nathelper-extra
   KCONFIG:=$(KCONFIG_NF_NATHELPER_EXTRA)
   FILES:=$(foreach mod,$(NF_NATHELPER_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NATHELPER_EXTRA-m)))
-  DEPENDS:=+kmod-nf-nat +kmod-lib-textsearch +kmod-ipt-raw +LINUX_4_19:kmod-asn1-decoder
+  DEPENDS:=+kmod-nf-nat +kmod-lib-textsearch +kmod-ipt-raw +!LINUX_4_14:kmod-asn1-decoder
 endef
 
 define KernelPackage/nf-nathelper-extra/description
@@ -806,7 +808,7 @@ $(eval $(call KernelPackage,ipt-physdev))
 define KernelPackage/ip6tables
   SUBMENU:=$(NF_MENU)
   TITLE:=IPv6 modules
-  DEPENDS:=+kmod-nf-reject6 +kmod-nf-ipt6 +kmod-ipt-core
+  DEPENDS:=@IPV6 +kmod-nf-reject6 +kmod-nf-ipt6 +kmod-ipt-core
   KCONFIG:=$(KCONFIG_IPT_IPV6)
   FILES:=$(foreach mod,$(IPT_IPV6-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoLoad,42,$(notdir $(IPT_IPV6-m)))
@@ -821,7 +823,7 @@ $(eval $(call KernelPackage,ip6tables))
 define KernelPackage/ip6tables-extra
   SUBMENU:=$(NF_MENU)
   TITLE:=Extra IPv6 modules
-  DEPENDS:=+kmod-ip6tables
+  DEPENDS:=@IPV6 +kmod-ip6tables
   KCONFIG:=$(KCONFIG_IPT_IPV6_EXTRA)
   FILES:=$(foreach mod,$(IPT_IPV6_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_IPV6_EXTRA-m)))
@@ -911,6 +913,7 @@ $(eval $(call KernelPackage,ebtables-ipv4))
 
 define KernelPackage/ebtables-ipv6
   TITLE:=ebtables: IPv6 support
+  DEPENDS:=@IPV6
   FILES:=$(foreach mod,$(EBTABLES_IP6-m),$(LINUX_DIR)/net/$(mod).ko)
   KCONFIG:=$(KCONFIG_EBTABLES_IP6)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_IP6-m)))
@@ -1049,7 +1052,7 @@ $(eval $(call KernelPackage,ipt-rpfilter))
 define KernelPackage/nft-core
   SUBMENU:=$(NF_MENU)
   TITLE:=Netfilter nf_tables support
-  DEPENDS:=+kmod-nfnetlink +kmod-nf-reject +kmod-nf-reject6 +kmod-nf-conntrack6
+  DEPENDS:=+kmod-nfnetlink +kmod-nf-reject +IPV6:kmod-nf-reject6 +IPV6:kmod-nf-conntrack6 +LINUX_5_4:kmod-nf-nat
   FILES:=$(foreach mod,$(NFT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_CORE-m)))
   KCONFIG:= \
@@ -1106,7 +1109,7 @@ $(eval $(call KernelPackage,nft-nat))
 define KernelPackage/nft-offload
   SUBMENU:=$(NF_MENU)
   TITLE:=Netfilter nf_tables routing/NAT offload support
-  DEPENDS:=+kmod-nf-flow +kmod-nft-nat
+  DEPENDS:=@IPV6 +kmod-nf-flow +kmod-nft-nat
   KCONFIG:= \
 	CONFIG_NF_FLOW_TABLE_INET \
 	CONFIG_NF_FLOW_TABLE_IPV4 \
diff --git a/package/kernel/linux/modules/netsupport.mk b/package/kernel/linux/modules/netsupport.mk
index 44408a720b..73e480a549 100644
--- a/package/kernel/linux/modules/netsupport.mk
+++ b/package/kernel/linux/modules/netsupport.mk
@@ -115,8 +115,7 @@ define KernelPackage/geneve
 	+IPV6:kmod-udptunnel6
   KCONFIG:=CONFIG_GENEVE
   FILES:= \
-	$(LINUX_DIR)/net/ipv4/geneve.ko@le4.1 \
-	$(LINUX_DIR)/drivers/net/geneve.ko@ge4.2
+	$(LINUX_DIR)/drivers/net/geneve.ko
   AUTOLOAD:=$(call AutoLoad,13,geneve)
 endef
 
@@ -133,7 +132,7 @@ define KernelPackage/nsh
   TITLE:=Network Service Header (NSH) protocol
   DEPENDS:=
   KCONFIG:=CONFIG_NET_NSH
-  FILES:=$(LINUX_DIR)/net/nsh/nsh.ko@ge4.14
+  FILES:=$(LINUX_DIR)/net/nsh/nsh.ko
   AUTOLOAD:=$(call AutoLoad,13,nsh)
 endef
 
@@ -247,7 +246,7 @@ define KernelPackage/ipsec
   DEPENDS:= \
 	+kmod-crypto-authenc +kmod-crypto-cbc +kmod-crypto-deflate \
 	+kmod-crypto-des +kmod-crypto-echainiv +kmod-crypto-hmac \
-	+kmod-crypto-iv +kmod-crypto-md5 +kmod-crypto-sha1
+	+kmod-crypto-md5 +kmod-crypto-sha1
   KCONFIG:= \
 	CONFIG_NET_KEY \
 	CONFIG_XFRM_USER \
@@ -268,16 +267,14 @@ endef
 
 $(eval $(call KernelPackage,ipsec))
 
-
-IPSEC4-m:= \
+IPSEC4-m = \
 	ipv4/ah4 \
 	ipv4/esp4 \
-	ipv4/xfrm4_mode_beet \
-	ipv4/xfrm4_mode_transport \
-	ipv4/xfrm4_mode_tunnel \
 	ipv4/xfrm4_tunnel \
 	ipv4/ipcomp \
 
+IPSEC4-m += $(ifeq ($$(strip $$(call CompareKernelPatchVer,$$(KERNEL_PATCHVER),le,5.2))),ipv4/xfrm4_mode_beet ipv4/xfrm4_mode_transport ipv4/xfrm4_mode_tunnel)
+
 define KernelPackage/ipsec4
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=IPsec related modules (IPv4)
@@ -310,19 +307,18 @@ endef
 $(eval $(call KernelPackage,ipsec4))
 
 
-IPSEC6-m:= \
+IPSEC6-m = \
 	ipv6/ah6 \
 	ipv6/esp6 \
-	ipv6/xfrm6_mode_beet \
-	ipv6/xfrm6_mode_transport \
-	ipv6/xfrm6_mode_tunnel \
 	ipv6/xfrm6_tunnel \
 	ipv6/ipcomp6 \
 
+IPSEC6-m += $(ifeq ($$(strip $$(call CompareKernelPatchVer,$$(KERNEL_PATCHVER),le,5.2))),ipv6/xfrm6_mode_beet ipv6/xfrm6_mode_transport ipv6/xfrm6_mode_tunnel)
+
 define KernelPackage/ipsec6
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=IPsec related modules (IPv6)
-  DEPENDS:=kmod-ipsec +kmod-iptunnel6
+  DEPENDS:=@IPV6 kmod-ipsec +kmod-iptunnel6
   KCONFIG:= \
 	CONFIG_INET6_AH \
 	CONFIG_INET6_ESP \
@@ -387,7 +383,7 @@ $(eval $(call KernelPackage,ip-vti))
 define KernelPackage/ip6-vti
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=IPv6 VTI (Virtual Tunnel Interface)
-  DEPENDS:=+kmod-iptunnel +kmod-ip6-tunnel +kmod-ipsec6
+  DEPENDS:=@IPV6 +kmod-iptunnel +kmod-ip6-tunnel +kmod-ipsec6
   KCONFIG:=CONFIG_IPV6_VTI
   FILES:=$(LINUX_DIR)/net/ipv6/ip6_vti.ko
   AUTOLOAD:=$(call AutoLoad,33,ip6_vti)
@@ -403,7 +399,7 @@ $(eval $(call KernelPackage,ip6-vti))
 define KernelPackage/xfrm-interface
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=IPsec XFRM Interface
-  DEPENDS:=+kmod-ipsec4 +kmod-ipsec6 @!LINUX_4_14 @!LINUX_4_9
+  DEPENDS:=+kmod-ipsec4 +IPV6:kmod-ipsec6 @!LINUX_4_14
   KCONFIG:=CONFIG_XFRM_INTERFACE
   FILES:=$(LINUX_DIR)/net/xfrm/xfrm_interface.ko
   AUTOLOAD:=$(call AutoProbe,xfrm_interface)
@@ -750,7 +746,7 @@ $(eval $(call KernelPackage,mppe))
 
 SCHED_MODULES = $(patsubst $(LINUX_DIR)/net/sched/%.ko,%,$(wildcard $(LINUX_DIR)/net/sched/*.ko))
 SCHED_MODULES_CORE = sch_ingress sch_fq_codel sch_hfsc sch_htb sch_tbf cls_basic cls_fw cls_route cls_flow cls_tcindex cls_u32 em_u32 act_mirred act_skbedit cls_matchall
-SCHED_MODULES_FILTER = $(SCHED_MODULES_CORE) act_connmark act_ctinfo sch_netem sch_mqprio em_ipset cls_bpf cls_flower act_bpf act_vlan
+SCHED_MODULES_FILTER = $(SCHED_MODULES_CORE) act_connmark act_ctinfo sch_cake sch_netem sch_mqprio em_ipset cls_bpf cls_flower act_bpf act_vlan
 SCHED_MODULES_EXTRA = $(filter-out $(SCHED_MODULES_FILTER),$(SCHED_MODULES))
 SCHED_FILES = $(patsubst %,$(LINUX_DIR)/net/sched/%.ko,$(filter $(SCHED_MODULES_CORE),$(SCHED_MODULES)))
 SCHED_FILES_EXTRA = $(patsubst %,$(LINUX_DIR)/net/sched/%.ko,$(SCHED_MODULES_EXTRA))
@@ -789,6 +785,21 @@ endef
 $(eval $(call KernelPackage,sched-core))
 
 
+define KernelPackage/sched-cake
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=Cake fq_codel/blue derived shaper
+  DEPENDS:=@!LINUX_4_14 +kmod-sched-core
+  KCONFIG:=CONFIG_NET_SCH_CAKE
+  FILES:=$(LINUX_DIR)/net/sched/sch_cake.ko
+  AUTOLOAD:=$(call AutoProbe,sch_cake)
+endef
+
+define KernelPackage/sched-cake/description
+ Common Applications Kept Enhanced fq_codel/blue derived shaper
+endef
+
+$(eval $(call KernelPackage,sched-cake))
+
 define KernelPackage/sched-flower
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=Flower traffic classifier
@@ -935,10 +946,9 @@ $(eval $(call KernelPackage,sched))
 define KernelPackage/tcp-bbr
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=BBR TCP congestion control
-  DEPENDS:=+LINUX_4_9:kmod-sched
   KCONFIG:= \
 	CONFIG_TCP_CONG_ADVANCED=y \
-	CONFIG_TCP_CONG_BBR=m
+	CONFIG_TCP_CONG_BBR
   FILES:=$(LINUX_DIR)/net/ipv4/tcp_bbr.ko
   AUTOLOAD:=$(call AutoLoad,74,tcp_bbr)
 endef
@@ -949,11 +959,7 @@ define KernelPackage/tcp-bbr/description
  For kernel 4.13+, TCP internal pacing is implemented as fallback.
 endef
 
-ifdef CONFIG_LINUX_4_9
-  TCP_BBR_SYSCTL_CONF:=sysctl-tcp-bbr-k4_9.conf
-else
-  TCP_BBR_SYSCTL_CONF:=sysctl-tcp-bbr.conf
-endif
+TCP_BBR_SYSCTL_CONF:=sysctl-tcp-bbr.conf
 
 define KernelPackage/tcp-bbr/install
 	$(INSTALL_DIR) $(1)/etc/sysctl.d
@@ -1135,10 +1141,8 @@ define KernelPackage/rxrpc
 	CONFIG_RXKAD=m \
 	CONFIG_AF_RXRPC_DEBUG=n
   FILES:= \
-	$(LINUX_DIR)/net/rxrpc/af-rxrpc.ko@lt4.11 \
-	$(LINUX_DIR)/net/rxrpc/rxrpc.ko@ge4.11 \
-	$(LINUX_DIR)/net/rxrpc/rxkad.ko@lt4.7
-  AUTOLOAD:=$(call AutoLoad,30,rxkad@lt4.7 af-rxrpc.ko@lt4.11 rxrpc.ko@ge4.11)
+	$(LINUX_DIR)/net/rxrpc/rxrpc.ko
+  AUTOLOAD:=$(call AutoLoad,30,rxrpc.ko)
   DEPENDS:= +kmod-crypto-manager +kmod-crypto-pcbc +kmod-crypto-fcrypt
 endef
 
@@ -1151,7 +1155,7 @@ $(eval $(call KernelPackage,rxrpc))
 define KernelPackage/mpls
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=MPLS support
-  DEPENDS:=+LINUX_4_19:kmod-iptunnel
+  DEPENDS:=+!LINUX_4_14:kmod-iptunnel
   KCONFIG:= \
 	CONFIG_MPLS=y \
 	CONFIG_LWTUNNEL=y \
@@ -1239,3 +1243,18 @@ define KernelPackage/macsec/description
 endef
 
 $(eval $(call KernelPackage,macsec))
+
+
+define KernelPackage/netlink-diag
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=Netlink diag support for ss utility
+  KCONFIG:=CONFIG_NETLINK_DIAG
+  FILES:=$(LINUX_DIR)/net/netlink/netlink_diag.ko
+  AUTOLOAD:=$(call AutoLoad,31,netlink-diag)
+endef
+
+define KernelPackage/netlink-diag/description
+ Netlink diag is a module made for use with iproute2's ss utility
+endef
+
+$(eval $(call KernelPackage,netlink-diag))
diff --git a/package/kernel/linux/modules/other.mk b/package/kernel/linux/modules/other.mk
index deff3a6f66..15d67b4679 100644
--- a/package/kernel/linux/modules/other.mk
+++ b/package/kernel/linux/modules/other.mk
@@ -30,7 +30,7 @@ $(eval $(call KernelPackage,6lowpan))
 define KernelPackage/bluetooth
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Bluetooth support
-  DEPENDS:=@USB_SUPPORT +kmod-usb-core +kmod-crypto-hash +kmod-crypto-ecb +kmod-lib-crc16 +kmod-hid +kmod-crypto-cmac +kmod-regmap-core +!LINUX_4_9:kmod-crypto-ecdh
+  DEPENDS:=@USB_SUPPORT +kmod-usb-core +kmod-crypto-hash +kmod-crypto-ecb +kmod-lib-crc16 +kmod-hid +kmod-crypto-cmac +kmod-regmap-core +kmod-crypto-ecdh
   KCONFIG:= \
 	CONFIG_BT \
 	CONFIG_BT_BREDR=y \
@@ -53,11 +53,8 @@ define KernelPackage/bluetooth
 	$(LINUX_DIR)/net/bluetooth/bnep/bnep.ko \
 	$(LINUX_DIR)/net/bluetooth/hidp/hidp.ko \
 	$(LINUX_DIR)/drivers/bluetooth/hci_uart.ko \
-	$(LINUX_DIR)/drivers/bluetooth/btusb.ko
-ifeq ($(strip $(call CompareKernelPatchVer,$(KERNEL_PATCHVER),ge,4.1.0)),1)
-  FILES+= \
+	$(LINUX_DIR)/drivers/bluetooth/btusb.ko \
 	$(LINUX_DIR)/drivers/bluetooth/btintel.ko
-endif
   AUTOLOAD:=$(call AutoProbe,bluetooth rfcomm bnep hidp hci_uart btusb)
 endef
 
@@ -87,7 +84,7 @@ endef
 $(eval $(call KernelPackage,ath3k))
 
 
-define KernelPackage/bluetooth_6lowpan
+define KernelPackage/bluetooth-6lowpan
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Bluetooth 6LoWPAN support
   DEPENDS:=+kmod-6lowpan +kmod-bluetooth
@@ -96,11 +93,11 @@ define KernelPackage/bluetooth_6lowpan
   AUTOLOAD:=$(call AutoProbe,bluetooth_6lowpan)
 endef
 
-define KernelPackage/bluetooth_6lowpan/description
+define KernelPackage/bluetooth-6lowpan/description
  Kernel support for 6LoWPAN over Bluetooth Low Energy devices
 endef
 
-$(eval $(call KernelPackage,bluetooth_6lowpan))
+$(eval $(call KernelPackage,bluetooth-6lowpan))
 
 
 define KernelPackage/btmrvl
@@ -142,9 +139,10 @@ $(eval $(call KernelPackage,dma-buf))
 define KernelPackage/nvmem
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Non Volatile Memory support
+  DEPENDS:=@!LINUX_5_4
   KCONFIG:=CONFIG_NVMEM
   HIDDEN:=1
-  FILES:=$(LINUX_DIR)/drivers/nvmem/nvmem_core.ko@ge4.9
+  FILES:=$(LINUX_DIR)/drivers/nvmem/nvmem_core.ko
 endef
 
 define KernelPackage/nvmem/description
@@ -172,7 +170,7 @@ define KernelPackage/eeprom-at24
   SUBMENU:=$(OTHER_MENU)
   TITLE:=EEPROM AT24 support
   KCONFIG:=CONFIG_EEPROM_AT24
-  DEPENDS:=+kmod-i2c-core +kmod-nvmem +LINUX_4_19:kmod-regmap-i2c
+  DEPENDS:=+kmod-i2c-core +!LINUX_5_4:kmod-nvmem +!LINUX_4_14:kmod-regmap-i2c
   FILES:=$(LINUX_DIR)/drivers/misc/eeprom/at24.ko
   AUTOLOAD:=$(call AutoProbe,at24)
 endef
@@ -188,7 +186,7 @@ define KernelPackage/eeprom-at25
   SUBMENU:=$(OTHER_MENU)
   TITLE:=EEPROM AT25 support
   KCONFIG:=CONFIG_EEPROM_AT25
-  DEPENDS:=+kmod-nvmem
+  DEPENDS:=+!LINUX_5_4:kmod-nvmem
   FILES:=$(LINUX_DIR)/drivers/misc/eeprom/at25.ko
   AUTOLOAD:=$(call AutoProbe,at25)
 endef
@@ -216,17 +214,32 @@ endef
 $(eval $(call KernelPackage,gpio-dev))
 
 
+define KernelPackage/gpio-f7188x
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Fintek F718xx/F818xx GPIO Support
+  DEPENDS:=@GPIO_SUPPORT @TARGET_x86
+  KCONFIG:=CONFIG_GPIO_F7188X
+  FILES:=$(LINUX_DIR)/drivers/gpio/gpio-f7188x.ko
+  AUTOLOAD:=$(call AutoProbe,gpio-f7188x)
+endef
+
+define KernelPackage/gpio-f7188x/description
+  Kernel module for the GPIOs found on many Fintek Super-IO chips.
+endef
+
+$(eval $(call KernelPackage,gpio-f7188x))
+
+
 define KernelPackage/gpio-mcp23s08
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Microchip MCP23xxx I/O expander
-  DEPENDS:=@GPIO_SUPPORT +kmod-i2c-core +!LINUX_4_9:kmod-regmap-i2c
+  DEPENDS:=@GPIO_SUPPORT +kmod-i2c-core +kmod-regmap-i2c
   KCONFIG:= \
 	CONFIG_GPIO_MCP23S08 \
 	CONFIG_PINCTRL_MCP23S08
   FILES:= \
-	$(LINUX_DIR)/drivers/gpio/gpio-mcp23s08.ko@lt4.13 \
-	$(LINUX_DIR)/drivers/pinctrl/pinctrl-mcp23s08.ko@ge4.13
-  AUTOLOAD:=$(call AutoLoad,40,gpio-mcp23s08@lt4.13 pinctrl-mcp23s08@ge4.13)
+	$(LINUX_DIR)/drivers/pinctrl/pinctrl-mcp23s08.ko
+  AUTOLOAD:=$(call AutoLoad,40,pinctrl-mcp23s08)
 endef
 
 define KernelPackage/gpio-mcp23s08/description
@@ -252,7 +265,7 @@ $(eval $(call KernelPackage,gpio-nxp-74hc164))
 
 define KernelPackage/gpio-pca953x
   SUBMENU:=$(OTHER_MENU)
-  DEPENDS:=@GPIO_SUPPORT +kmod-i2c-core
+  DEPENDS:=@GPIO_SUPPORT +kmod-i2c-core +LINUX_5_4:kmod-regmap-i2c
   TITLE:=PCA95xx, TCA64xx, and MAX7310 I/O ports
   KCONFIG:=CONFIG_GPIO_PCA953X
   FILES:=$(LINUX_DIR)/drivers/gpio/gpio-pca953x.ko
@@ -282,6 +295,41 @@ endef
 $(eval $(call KernelPackage,gpio-pcf857x))
 
 
+define KernelPackage/gpio-it87
+  SUBMENU:=$(OTHER_MENU)
+  DEPENDS:=@GPIO_SUPPORT @TARGET_x86
+  TITLE:=GPIO support for IT87xx Super I/O chips
+  KCONFIG:=CONFIG_GPIO_IT87
+  FILES:=$(LINUX_DIR)/drivers/gpio/gpio-it87.ko
+  AUTOLOAD:=$(call AutoLoad,25,gpio-it87,1)
+endef
+
+define KernelPackage/gpio-it87/description
+  This driver is tested with ITE IT8728 and IT8732 Super I/O chips, and
+  supports the IT8761E, IT8613, IT8620E, and IT8628E Super I/O chips as
+  well.
+endef
+
+$(eval $(call KernelPackage,gpio-it87))
+
+
+define KernelPackage/gpio-amd-fch
+  SUBMENU:=$(OTHER_MENU)
+  DEPENDS:=@GPIO_SUPPORT @TARGET_x86
+  TITLE:=GPIO support for AMD Fusion Controller Hub (G-series SOCs)
+  KCONFIG:=CONFIG_GPIO_AMD_FCH
+  FILES:=$(LINUX_DIR)/drivers/gpio/gpio-amd-fch.ko
+  AUTOLOAD:=$(call AutoLoad,25,gpio-amd-fch,1)
+endef
+
+define KernelPackage/gpio-amd-fch/description
+  This option enables driver for GPIO on AMDs Fusion Controller Hub,
+  as found on G-series SOCs (eg. GX-412TC)
+endef
+
+$(eval $(call KernelPackage,gpio-amd-fch))
+
+
 define KernelPackage/ppdev
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Parallel port support
@@ -349,8 +397,7 @@ define KernelPackage/mmc
 	CONFIG_SDIO_UART=n
   FILES:= \
 	$(LINUX_DIR)/drivers/mmc/core/mmc_core.ko \
-	$(LINUX_DIR)/drivers/mmc/card/mmc_block.ko@lt4.10 \
-	$(LINUX_DIR)/drivers/mmc/core/mmc_block.ko@ge4.10
+	$(LINUX_DIR)/drivers/mmc/core/mmc_block.ko
   AUTOLOAD:=$(call AutoProbe,mmc_core mmc_block,1)
 endef
 
@@ -361,6 +408,23 @@ endef
 $(eval $(call KernelPackage,mmc))
 
 
+define KernelPackage/mvsdio
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Marvell MMC/SD/SDIO host driver
+  DEPENDS:=+kmod-mmc @TARGET_kirkwood
+  KCONFIG:= CONFIG_MMC_MVSDIO
+  FILES:= \
+	$(LINUX_DIR)/drivers/mmc/host/mvsdio.ko
+  AUTOLOAD:=$(call AutoProbe,mvsdio,1)
+endef
+
+define KernelPackage/mvsdio/description
+ Kernel support for the Marvell SDIO host driver.
+endef
+
+$(eval $(call KernelPackage,mvsdio))
+
+
 define KernelPackage/sdhci
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Secure Digital Host Controller Interface support
@@ -423,7 +487,7 @@ $(eval $(call KernelPackage,softdog))
 define KernelPackage/ssb
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Silicon Sonics Backplane glue code
-  DEPENDS:=@PCI_SUPPORT @!TARGET_brcm47xx @!TARGET_brcm63xx
+  DEPENDS:=@PCI_SUPPORT @!TARGET_bcm47xx @!TARGET_bcm63xx
   KCONFIG:=\
 	CONFIG_SSB \
 	CONFIG_SSB_B43_PCI_BRIDGE=y \
@@ -449,7 +513,7 @@ $(eval $(call KernelPackage,ssb))
 define KernelPackage/bcma
   SUBMENU:=$(OTHER_MENU)
   TITLE:=BCMA support
-  DEPENDS:=@PCI_SUPPORT @!TARGET_brcm47xx @!TARGET_bcm53xx
+  DEPENDS:=@PCI_SUPPORT @!TARGET_bcm47xx @!TARGET_bcm53xx
   KCONFIG:=\
 	CONFIG_BCMA \
 	CONFIG_BCMA_POSSIBLE=y \
@@ -476,7 +540,7 @@ define KernelPackage/rtc-ds1307
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Dallas/Maxim DS1307 (and compatible) RTC support
   DEFAULT:=m if ALL_KMODS && RTC_SUPPORT
-  DEPENDS:=+kmod-i2c-core +!LINUX_4_9:kmod-regmap-i2c +!LINUX_4_9:kmod-hwmon-core
+  DEPENDS:=+kmod-i2c-core +kmod-regmap-i2c +kmod-hwmon-core
   KCONFIG:=CONFIG_RTC_DRV_DS1307 \
 	CONFIG_RTC_CLASS=y
   FILES:=$(LINUX_DIR)/drivers/rtc/rtc-ds1307.ko
@@ -587,6 +651,7 @@ define KernelPackage/rtc-pcf2123
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Philips PCF2123 RTC support
   DEFAULT:=m if ALL_KMODS && RTC_SUPPORT
+  DEPENDS:=+LINUX_5_4:kmod-regmap-spi
   KCONFIG:=CONFIG_RTC_DRV_PCF2123 \
 	CONFIG_RTC_CLASS=y
   FILES:=$(LINUX_DIR)/drivers/rtc/rtc-pcf2123.ko
@@ -734,8 +799,9 @@ define KernelPackage/serial-8250
 	CONFIG_SERIAL_8250_RSA=n
   FILES:= \
 	$(LINUX_DIR)/drivers/tty/serial/8250/8250.ko \
-	$(LINUX_DIR)/drivers/tty/serial/8250/8250_base.ko@ge4.4 \
-	$(if $(CONFIG_PCI),$(LINUX_DIR)/drivers/tty/serial/8250/8250_pci.ko@ge4.4)
+	$(LINUX_DIR)/drivers/tty/serial/8250/8250_base.ko \
+	$(if $(CONFIG_PCI),$(LINUX_DIR)/drivers/tty/serial/8250/8250_pci.ko) \
+	$(if $(CONFIG_GPIOLIB),$(LINUX_DIR)/drivers/tty/serial/serial_mctrl_gpio.ko@ge5.3)
   AUTOLOAD:=$(call AutoProbe,8250 8250_base 8250_pci)
 endef
 
@@ -943,7 +1009,7 @@ $(eval $(call KernelPackage,ptp))
 define KernelPackage/ptp-gianfar
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Freescale Gianfar PTP support
-  DEPENDS:=@TARGET_mpc85xx +kmod-ptp @!LINUX_4_19
+  DEPENDS:=@TARGET_mpc85xx +kmod-ptp @LINUX_4_14
   KCONFIG:=CONFIG_PTP_1588_CLOCK_GIANFAR
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/freescale/gianfar_ptp.ko
   AUTOLOAD:=$(call AutoProbe,gianfar_ptp)
@@ -959,10 +1025,10 @@ $(eval $(call KernelPackage,ptp-gianfar))
 define KernelPackage/ptp-qoriq
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Freescale QorIQ PTP support
-  DEPENDS:=@TARGET_mpc85xx +kmod-ptp @LINUX_4_19
+  DEPENDS:=@TARGET_mpc85xx +kmod-ptp @!LINUX_4_14
   KCONFIG:=CONFIG_PTP_1588_CLOCK_QORIQ
-  FILES:=$(LINUX_DIR)/drivers/ptp/ptp_qoriq.o
-  AUTOLOAD:=$(call AutoProbe,ptp_qoriq)
+  FILES:=$(LINUX_DIR)/drivers/ptp/ptp-qoriq.ko
+  AUTOLOAD:=$(call AutoProbe,ptp-qoriq)
 endef
 
 
@@ -992,7 +1058,7 @@ define KernelPackage/random-tpm
   TITLE:=Hardware Random Number Generator TPM support
   KCONFIG:=CONFIG_HW_RANDOM_TPM
   FILES:=$(LINUX_DIR)/drivers/char/hw_random/tpm-rng.ko
-  DEPENDS:= +kmod-random-core +kmod-tpm @!LINUX_4_19
+  DEPENDS:= +kmod-random-core +kmod-tpm @LINUX_4_14
   AUTOLOAD:=$(call AutoProbe,tpm-rng)
 endef
 
@@ -1232,16 +1298,17 @@ endef
 $(eval $(call KernelPackage,it87-wdt))
 
 
-define KernelPackage/pinctrl-sx150x
+define KernelPackage/f71808e-wdt
   SUBMENU:=$(OTHER_MENU)
-  TITLE:=Semtech SX150x-series I2C GPIO expanders
-  DEPENDS:= +kmod-i2c-core @!LINUX_4_9
-  KCONFIG:=CONFIG_PINCTRL_SX150X=y
-  AUTOLOAD:=$(call AutoLoad,40,pinctrl-sx150x)
+  TITLE:=Fintek F718xx/F818xx Watchdog Timer
+  DEPENDS:=@TARGET_x86
+  KCONFIG:=CONFIG_F71808E_WDT
+  FILES:=$(LINUX_DIR)/drivers/$(WATCHDOG_DIR)/f71808e_wdt.ko
+  AUTOLOAD:=$(call AutoProbe,f71808e-wdt,1)
 endef
 
-define KernelPackage/pinctrl-sx150x/description
- This driver adds support for Semtech SX150x-series I2C GPIO expanders.
+define KernelPackage/f71808e-wdt/description
+  Kernel module for the watchdog timer found on many Fintek Super-IO chips.
 endef
 
-$(eval $(call KernelPackage,pinctrl-sx150x))
+$(eval $(call KernelPackage,f71808e-wdt))
diff --git a/package/kernel/linux/modules/sound.mk b/package/kernel/linux/modules/sound.mk
index a68595b03f..f975103e50 100644
--- a/package/kernel/linux/modules/sound.mk
+++ b/package/kernel/linux/modules/sound.mk
@@ -24,8 +24,7 @@ SOUNDCORE_FILES ?= \
 	$(LINUX_DIR)/sound/soundcore.ko \
 	$(LINUX_DIR)/sound/core/snd.ko \
 	$(LINUX_DIR)/sound/core/snd-hwdep.ko \
-	$(LINUX_DIR)/sound/core/seq/snd-seq-device.ko@lt4.13 \
-	$(LINUX_DIR)/sound/core/snd-seq-device.ko@ge4.13 \
+	$(LINUX_DIR)/sound/core/snd-seq-device.ko \
 	$(LINUX_DIR)/sound/core/snd-rawmidi.ko \
 	$(LINUX_DIR)/sound/core/snd-timer.ko \
 	$(LINUX_DIR)/sound/core/snd-pcm.ko \
diff --git a/package/kernel/linux/modules/usb.mk b/package/kernel/linux/modules/usb.mk
index c678018820..e833c139a0 100644
--- a/package/kernel/linux/modules/usb.mk
+++ b/package/kernel/linux/modules/usb.mk
@@ -72,11 +72,10 @@ $(eval $(call KernelPackage,usb-phy-nop))
 
 define KernelPackage/usb-phy-qcom-dwc3
   TITLE:=DWC3 USB QCOM PHY driver
-  DEPENDS:=@(TARGET_ipq40xx||TARGET_ipq806x) +kmod-usb-dwc3-of-simple
+  DEPENDS:=@(TARGET_ipq40xx||TARGET_ipq806x)
   KCONFIG:= CONFIG_PHY_QCOM_DWC3
   FILES:= \
-    $(LINUX_DIR)/drivers/phy/phy-qcom-dwc3.ko@lt4.13 \
-    $(LINUX_DIR)/drivers/phy/qualcomm/phy-qcom-dwc3.ko@ge4.13
+    $(LINUX_DIR)/drivers/phy/qualcomm/phy-qcom-dwc3.ko
   AUTOLOAD:=$(call AutoLoad,45,phy-qcom-dwc3,1)
   $(call AddDepends/usb)
 endef
@@ -275,8 +274,8 @@ define KernelPackage/usb-ohci
   TITLE:=Support for OHCI controllers
   DEPENDS:= \
 	+TARGET_bcm53xx:kmod-usb-bcma \
-	+TARGET_brcm47xx:kmod-usb-bcma \
-	+TARGET_brcm47xx:kmod-usb-ssb
+	+TARGET_bcm47xx:kmod-usb-bcma \
+	+TARGET_bcm47xx:kmod-usb-ssb
   KCONFIG:= \
 	CONFIG_USB_OHCI \
 	CONFIG_USB_OHCI_HCD \
@@ -323,7 +322,7 @@ $(eval $(call KernelPackage,usb-ohci-pci))
 
 define KernelPackage/usb-bcma
   TITLE:=Support for BCMA USB controllers
-  DEPENDS:=@USB_SUPPORT @TARGET_brcm47xx||TARGET_bcm53xx
+  DEPENDS:=@USB_SUPPORT @TARGET_bcm47xx||TARGET_bcm53xx
   HIDDEN:=1
   KCONFIG:=CONFIG_USB_HCD_BCMA
   FILES:= \
@@ -346,7 +345,7 @@ $(eval $(call KernelPackage,usb-fotg210))
 
 define KernelPackage/usb-ssb
   TITLE:=Support for SSB USB controllers
-  DEPENDS:=@USB_SUPPORT @TARGET_brcm47xx
+  DEPENDS:=@USB_SUPPORT @TARGET_bcm47xx
   HIDDEN:=1
   KCONFIG:=CONFIG_USB_HCD_SSB
   FILES:= \
@@ -371,8 +370,8 @@ $(eval $(call KernelPackage,usb-ehci))
 define KernelPackage/usb2
   TITLE:=Support for USB2 controllers
   DEPENDS:=\
-	+TARGET_brcm47xx:kmod-usb-bcma \
-	+TARGET_brcm47xx:kmod-usb-ssb \
+	+TARGET_bcm47xx:kmod-usb-bcma \
+	+TARGET_bcm47xx:kmod-usb-ssb \
 	+TARGET_bcm53xx:kmod-usb-bcma \
 	+TARGET_bcm53xx:kmod-phy-bcm-ns-usb2 \
 	+TARGET_ath79:kmod-phy-ath79-usb \
@@ -442,9 +441,8 @@ define KernelPackage/usb-dwc2
 	CONFIG_USB_DWC2_TRACK_MISSED_SOFS=n \
 	CONFIG_USB_DWC2_DEBUG_PERIODIC=n
   FILES:= \
-	$(LINUX_DIR)/drivers/usb/dwc2/dwc2.ko \
-	$(LINUX_DIR)/drivers/usb/dwc2/dwc2_platform.ko@lt4.3
-  AUTOLOAD:=$(call AutoLoad,54,dwc2 dwc2_platform@lt4.3,1)
+	$(LINUX_DIR)/drivers/usb/dwc2/dwc2.ko
+  AUTOLOAD:=$(call AutoLoad,54,dwc2,1)
   $(call AddDepends/usb)
 endef
 
@@ -498,7 +496,7 @@ $(eval $(call KernelPackage,usb-dwc3-of-simple))
 
 define KernelPackage/usb-dwc3-qcom
   TITLE:=DWC3 Qualcomm USB driver
-  DEPENDS:=@LINUX_4_19 @(TARGET_ipq40xx||TARGET_ipq806x) +kmod-usb-dwc3
+  DEPENDS:=@(!LINUX_4_14) @(TARGET_ipq40xx||TARGET_ipq806x) +kmod-usb-dwc3
   KCONFIG:= CONFIG_USB_DWC3_QCOM
   FILES:= $(LINUX_DIR)/drivers/usb/dwc3/dwc3-qcom.ko
   AUTOLOAD:=$(call AutoLoad,53,dwc3-qcom,1)
@@ -1604,10 +1602,10 @@ define KernelPackage/usb-chipidea
 	CONFIG_USB_CHIPIDEA_UDC=y \
 	CONFIG_USB_CHIPIDEA_DEBUG=y
   FILES:= \
-	$(LINUX_DIR)/drivers/extcon/extcon.ko@lt4.9 \
-	$(LINUX_DIR)/drivers/extcon/extcon-core.ko@ge4.9 \
+	$(LINUX_DIR)/drivers/extcon/extcon-core.ko \
 	$(LINUX_DIR)/drivers/usb/chipidea/ci_hdrc.ko \
-	$(LINUX_DIR)/drivers/usb/common/ulpi.ko@ge4.18
+	$(LINUX_DIR)/drivers/usb/common/ulpi.ko@ge4.18 \
+	$(LINUX_DIR)/drivers/usb/roles/roles.ko@ge5.0
   AUTOLOAD:=$(call AutoLoad,39,ci_hdrc,1)
   $(call AddDepends/usb)
 endef
@@ -1629,8 +1627,7 @@ define KernelPackage/usb-chipidea2
 	CONFIG_USB_CHIPIDEA_UDC=y \
 	CONFIG_USB_CHIPIDEA_DEBUG=y
   FILES:= \
-	$(LINUX_DIR)/drivers/extcon/extcon.ko@lt4.9 \
-	$(LINUX_DIR)/drivers/extcon/extcon-core.ko@ge4.9 \
+	$(LINUX_DIR)/drivers/extcon/extcon-core.ko \
 	$(LINUX_DIR)/drivers/usb/chipidea/ci_hdrc_usb2.ko
   AUTOLOAD:=$(call AutoLoad,39,ci_hdrc_usb2,1)
   $(call AddDepends/usb)
diff --git a/package/kernel/linux/modules/video.mk b/package/kernel/linux/modules/video.mk
index 5e2484cec5..c17aed7613 100644
--- a/package/kernel/linux/modules/video.mk
+++ b/package/kernel/linux/modules/video.mk
@@ -151,7 +151,7 @@ define KernelPackage/fb-sys-fops
   DEPENDS:=+kmod-fb
   KCONFIG:=CONFIG_FB_SYS_FOPS
   FILES:=$(LINUX_DIR)/drivers/video/fbdev/core/fb_sys_fops.ko
-  AUTOLOAD:=$(call AutoLoad,07,fbsysfops)
+  AUTOLOAD:=$(call AutoLoad,07,fb_sys_fops)
 endef
 
 define KernelPackage/fb-sys-fops/description
@@ -187,7 +187,7 @@ define KernelPackage/fb-tft
   SUBMENU:=$(VIDEO_MENU)
   TITLE:=Support for small TFT LCD display modules
   DEPENDS:= \
-	  @GPIO_SUPPORT @!LINUX_4_9 +kmod-backlight \
+	  @GPIO_SUPPORT +kmod-backlight \
 	  +kmod-fb +kmod-fb-sys-fops +kmod-fb-sys-ram +kmod-spi-bitbang
   KCONFIG:= \
        CONFIG_FB_BACKLIGHT=y \
@@ -285,7 +285,7 @@ define KernelPackage/drm-amdgpu
 	CONFIG_DEBUG_KERNEL_DC=n
   FILES:=$(LINUX_DIR)/drivers/gpu/drm/amd/amdgpu/amdgpu.ko \
 	$(LINUX_DIR)/drivers/gpu/drm/scheduler/gpu-sched.ko@ge4.15 \
-	$(LINUX_DIR)/drivers/gpu/drm/amd/lib/chash.ko@ge4.15
+	$(LINUX_DIR)/drivers/gpu/drm/amd/lib/chash.ko@lt5.3
   AUTOLOAD:=$(call AutoProbe,amdgpu)
 endef
 
@@ -407,7 +407,7 @@ define KernelPackage/video-core
 	CONFIG_V4L_PLATFORM_DRIVERS=y \
 	CONFIG_V4L_ISA_PARPORT_DRIVERS=y
   FILES:= \
-	$(LINUX_DIR)/drivers/media/$(V4L2_DIR)/v4l2-common.ko \
+	$(LINUX_DIR)/drivers/media/$(V4L2_DIR)/v4l2-common.ko@lt5.4 \
 	$(LINUX_DIR)/drivers/media/$(V4L2_DIR)/videodev.ko
   AUTOLOAD:=$(call AutoLoad,60, videodev v4l2-common)
 endef
@@ -447,7 +447,7 @@ define KernelPackage/video-videobuf2
 	$(LINUX_DIR)/drivers/media/common/videobuf2/videobuf2-v4l2.ko@ge4.16 \
 	$(LINUX_DIR)/drivers/media/common/videobuf2/videobuf2-memops.ko@ge4.16 \
 	$(LINUX_DIR)/drivers/media/common/videobuf2/videobuf2-vmalloc.ko@ge4.16
-  AUTOLOAD:=$(call AutoLoad,65,videobuf2-core videobuf-v4l2@ge4.4 videobuf2-memops videobuf2-vmalloc)
+  AUTOLOAD:=$(call AutoLoad,65,videobuf2-core videobuf-v4l2 videobuf2-memops videobuf2-vmalloc)
   $(call AddDepends/video)
 endef
 
@@ -511,7 +511,7 @@ $(eval $(call KernelPackage,video-uvc))
 define KernelPackage/video-gspca-core
   MENU:=1
   TITLE:=GSPCA webcam core support framework
-  DEPENDS:=@USB_SUPPORT +kmod-usb-core +kmod-input-core +LINUX_4_19:kmod-video-videobuf2
+  DEPENDS:=@USB_SUPPORT +kmod-usb-core +kmod-input-core +!LINUX_4_14:kmod-video-videobuf2
   KCONFIG:=CONFIG_USB_GSPCA
   FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_main.ko
   AUTOLOAD:=$(call AutoProbe,gspca_main)
diff --git a/package/kernel/linux/modules/w1.mk b/package/kernel/linux/modules/w1.mk
index 5055d78a18..6ac7458e42 100644
--- a/package/kernel/linux/modules/w1.mk
+++ b/package/kernel/linux/modules/w1.mk
@@ -14,7 +14,7 @@ define KernelPackage/w1
   TITLE:=Dallas's 1-wire support
   KCONFIG:=CONFIG_W1
   FILES:=$(LINUX_DIR)/drivers/w1/wire.ko
-  DEPENDS:=+!LINUX_4_9:kmod-hwmon-core
+  DEPENDS:=+kmod-hwmon-core
 endef
 
 define KernelPackage/w1/description
diff --git a/package/kernel/linux/modules/wireless.mk b/package/kernel/linux/modules/wireless.mk
index 7b1c663567..f7a40ba10a 100644
--- a/package/kernel/linux/modules/wireless.mk
+++ b/package/kernel/linux/modules/wireless.mk
@@ -13,8 +13,7 @@ define KernelPackage/net-prism54
   DEPENDS:=@PCI_SUPPORT +@DRIVER_WEXT_SUPPORT +prism54-firmware
   KCONFIG:=CONFIG_PRISM54
   FILES:= \
-	$(LINUX_DIR)/drivers/net/wireless/prism54/prism54.ko@lt4.5 \
-	$(LINUX_DIR)/drivers/net/wireless/intersil/prism54/prism54.ko@ge4.5
+	$(LINUX_DIR)/drivers/net/wireless/intersil/prism54/prism54.ko
   AUTOLOAD:=$(call AutoProbe,prism54)
 endef
 
@@ -41,24 +40,3 @@ define KernelPackage/net-rtl8192su/description
 endef
 
 $(eval $(call KernelPackage,net-rtl8192su))
-
-
-define KernelPackage/owl-loader
-  SUBMENU:=$(WIRELESS_MENU)
-  TITLE:=Owl loader for initializing Atheros PCI(e) Wifi chips
-  DEPENDS:=@PCI_SUPPORT
-  KCONFIG:=CONFIG_OWL_LOADER
-  FILES:=$(LINUX_DIR)/drivers/misc/owl-loader.ko
-  AUTOLOAD:=$(call AutoProbe,owl-loader)
-endef
-
-define KernelPackage/owl-loader/description
-  Kernel module that helps to initialize certain Qualcomm
-  Atheros' PCI(e) Wifi chips, which have the init data
-  (which contains the PCI device ID for example) stored
-  together with the calibration data in the file system.
-
-  This is necessary for devices like the Cisco Meraki Z1.
-endef
-
-$(eval $(call KernelPackage,owl-loader))
diff --git a/package/kernel/linux/modules/wpan.mk b/package/kernel/linux/modules/wpan.mk
index 1e986ee0ca..053fa1e4bf 100644
--- a/package/kernel/linux/modules/wpan.mk
+++ b/package/kernel/linux/modules/wpan.mk
@@ -15,7 +15,7 @@ define KernelPackage/ieee802154
 	CONFIG_IEEE802154_NL802154_EXPERIMENTAL=n
   FILES:= \
 	$(LINUX_DIR)/net/ieee802154/ieee802154.ko \
-	$(LINUX_DIR)/net/ieee802154/ieee802154_socket.ko@ge4.0
+	$(LINUX_DIR)/net/ieee802154/ieee802154_socket.ko
   AUTOLOAD:=$(call AutoLoad,90,ieee802154 ieee802154_socket)
 endef
 
@@ -116,19 +116,18 @@ endef
 
 $(eval $(call KernelPackage,cc2520))
 
-define KernelPackage/ieee802154_6lowpan
+define KernelPackage/ieee802154-6lowpan
   SUBMENU:=$(WPAN_MENU)
   TITLE:= 6LoWPAN support over IEEE-802.15.4
   DEPENDS:=+kmod-6lowpan +kmod-ieee802154
   KCONFIG:=CONFIG_IEEE802154_6LOWPAN
   FILES:= \
-	$(LINUX_DIR)/net/ieee802154/6lowpan/ieee802154_6lowpan.ko@ge4.0 \
-	$(LINUX_DIR)/net/ieee802154/ieee802154_6lowpan.ko@lt4.0
+	$(LINUX_DIR)/net/ieee802154/6lowpan/ieee802154_6lowpan.ko
   AUTOLOAD:=$(call AutoLoad,91,ieee802154_6lowpan)
 endef
 
-define KernelPackage/ieee802154_6lowpan/description
+define KernelPackage/ieee802154-6lowpan/description
  IPv6 compression over IEEE 802.15.4
 endef
 
-$(eval $(call KernelPackage,ieee802154_6lowpan))
+$(eval $(call KernelPackage,ieee802154-6lowpan))
diff --git a/package/lean/automount/Makefile b/package/lean/automount/Makefile
index 53d7ac56e2..2066168784 100644
--- a/package/lean/automount/Makefile
+++ b/package/lean/automount/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=automount
 PKG_VERSION:=1
-PKG_RELEASE:=31
+PKG_RELEASE:=32
 PKG_ARCH:=all
 
 include $(INCLUDE_DIR)/package.mk
@@ -17,7 +17,7 @@ include $(INCLUDE_DIR)/package.mk
 define Package/automount
   TITLE:=Mount autoconfig hotplug script.
   MAINTAINER:=Lean
-  DEPENDS:=+block-mount +kmod-usb-storage +kmod-usb-storage-extras +!TARGET_ramips:kmod-usb-storage-uas +kmod-fs-vfat +kmod-fs-ext4 +kmod-fs-exfat +ntfs-3g
+  DEPENDS:=+block-mount +kmod-usb-storage +kmod-usb-storage-extras +!TARGET_ramips:kmod-usb-storage-uas +kmod-fs-vfat +kmod-fs-ext4 +!LINUX_5_4:kmod-fs-exfat0 +LINUX_5_4:kmod-fs-exfat +ntfs-3g
 endef
 
 define Package/automount/description
diff --git a/target/linux/x86/Makefile b/target/linux/x86/Makefile
index 36610c8acb..3f2a280618 100644
--- a/target/linux/x86/Makefile
+++ b/target/linux/x86/Makefile
@@ -13,7 +13,7 @@ FEATURES:=squashfs vdi vmdk pcmcia fpu
 SUBTARGETS:=64 generic zen legacy geode 
 MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 
-KERNEL_PATCHVER:=4.19
+KERNEL_PATCHVER:=4.14
 
 KERNELNAME:=bzImage
 
@@ -22,7 +22,6 @@ include $(INCLUDE_DIR)/target.mk
 DEFAULT_PACKAGES += partx-utils mkf2fs fdisk e2fsprogs wpad kmod-usb-hid kmod-mmc-spi kmod-sdhci \
 kmod-ath5k kmod-ath9k kmod-ath9k-htc kmod-ath10k kmod-rt2800-usb kmod-e1000e kmod-igb kmod-igbvf kmod-ixgbe kmod-pcnet32 kmod-tulip kmod-vmxnet3 kmod-i40e kmod-i40evf kmod-r8125 kmod-8139cp kmod-8139too kmod-fs-f2fs \
 htop lm-sensors autocore automount autosamba luci-app-ipsec-vpnd luci-proto-bonding luci-app-unblockmusic luci-app-zerotier luci-app-xlnetacc ddns-scripts_aliyun ddns-scripts_dnspod ca-certificates \
-luci-app-airplay2 luci-app-music-remote-center luci-app-qbittorrent luci-app-amule luci-app-openvpn-server \
 ath10k-firmware-qca988x ath10k-firmware-qca9888 ath10k-firmware-qca9984 brcmfmac-firmware-43602a1-pcie \
 kmod-sound-hda-core kmod-sound-hda-codec-realtek kmod-sound-hda-codec-via kmod-sound-via82xx kmod-sound-hda-intel kmod-sound-hda-codec-hdmi kmod-sound-i8x0 kmod-usb-audio \
 kmod-usb-net kmod-usb-net-asix kmod-usb-net-asix-ax88179 kmod-usb-net-rtl8150 kmod-usb-net-rtl8152 kmod-r8168 kmod-mlx4-core kmod-mlx5-core

From 6ea19a20b786ef6b83dfd4391def7156ba7af936 Mon Sep 17 00:00:00 2001
From: AmadeusGhost <42570690+AmadeusGhost@users.noreply.github.com>
Date: Wed, 1 Jul 2020 17:05:30 +0800
Subject: [PATCH 15/28] kernel: revert some config

---
 package/kernel/linux/files/sysctl-br-netfilter.conf | 6 +++---
 package/kernel/linux/files/sysctl-nf-conntrack.conf | 3 ++-
 package/kernel/linux/modules/crypto.mk              | 2 +-
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/package/kernel/linux/files/sysctl-br-netfilter.conf b/package/kernel/linux/files/sysctl-br-netfilter.conf
index b10ddc0874..22c24a4bfe 100644
--- a/package/kernel/linux/files/sysctl-br-netfilter.conf
+++ b/package/kernel/linux/files/sysctl-br-netfilter.conf
@@ -2,6 +2,6 @@
 # /etc/sysctl.conf can be used to customize sysctl settings
 
 # disable bridge firewalling by default
-net.bridge.bridge-nf-call-arptables=0
-net.bridge.bridge-nf-call-ip6tables=0
-net.bridge.bridge-nf-call-iptables=0
+net.bridge.bridge-nf-call-arptables=1
+net.bridge.bridge-nf-call-ip6tables=1
+net.bridge.bridge-nf-call-iptables=1
diff --git a/package/kernel/linux/files/sysctl-nf-conntrack.conf b/package/kernel/linux/files/sysctl-nf-conntrack.conf
index 37baf5fd6f..2af8cfb8cb 100644
--- a/package/kernel/linux/files/sysctl-nf-conntrack.conf
+++ b/package/kernel/linux/files/sysctl-nf-conntrack.conf
@@ -3,7 +3,8 @@
 
 net.netfilter.nf_conntrack_acct=1
 net.netfilter.nf_conntrack_checksum=0
-net.netfilter.nf_conntrack_max=16384
+net.netfilter.nf_conntrack_max=65535
 net.netfilter.nf_conntrack_tcp_timeout_established=7440
 net.netfilter.nf_conntrack_udp_timeout=60
 net.netfilter.nf_conntrack_udp_timeout_stream=180
+net.netfilter.nf_conntrack_helper=1
diff --git a/package/kernel/linux/modules/crypto.mk b/package/kernel/linux/modules/crypto.mk
index 9001721792..caad018d8f 100644
--- a/package/kernel/linux/modules/crypto.mk
+++ b/package/kernel/linux/modules/crypto.mk
@@ -281,7 +281,7 @@ endef
 
 KernelPackage/crypto-ghash/imx6=$(KernelPackage/crypto-ghash/arm-ce)
 KernelPackage/crypto-ghash/ipq40xx=$(KernelPackage/crypto-ghash/arm-ce)
-KernelPackage/crypto-ghash/mvebu/cortexa9=$(KernelPackage/crypto-ghash/arm-ce)
+KernelPackage/crypto-ghash/mvebu=$(KernelPackage/crypto-ghash/arm-ce)
 
 $(eval $(call KernelPackage,crypto-ghash))
 

From e4ecf8a5c067c9b1ac2cc686ba4c015a4877feb0 Mon Sep 17 00:00:00 2001
From: AmadeusGhost <42570690+AmadeusGhost@users.noreply.github.com>
Date: Wed, 1 Jul 2020 17:12:37 +0800
Subject: [PATCH 16/28] kernel: cake: add missing backport to 4.19 patches

---
 ...-sch_cake-Make-the-dual-modes-fairer.patch | 217 ++++++++++++++++++
 ...-use-of-connmarks-as-tin-classifiers.patch | 118 ++++++++++
 ...erpret-fwmark-parameter-as-a-bitmask.patch | 102 ++++++++
 ...rop-unused-variable-tin_quantum_prio.patch | 158 +++++++++++++
 ...sing-NLA-policy-entry-TCA_CAKE_SPLIT.patch |  30 +++
 ...antage-of-skb-hash-where-appropriate.patch | 170 ++++++++++++++
 ...ry-to-reallocate-or-unshare-skb-unco.patch |  96 ++++++++
 ...all-diffserv-parsing-code-when-it-is.patch |  62 +++++
 ...98-5.8-sch_cake-fix-a-few-style-nits.patch |  40 ++++
 ...-8622-LE-PHB-support-to-CAKE-diffser.patch |  57 +++++
 ...protocol-handling-in-the-presence-of.patch | 114 +++++++++
 11 files changed, 1164 insertions(+)
 create mode 100644 target/linux/generic/backport-4.19/390-v5.1-sch_cake-Make-the-dual-modes-fairer.patch
 create mode 100644 target/linux/generic/backport-4.19/391-v5.1-sch_cake-Permit-use-of-connmarks-as-tin-classifiers.patch
 create mode 100644 target/linux/generic/backport-4.19/392-v5.1-sch_cake-Interpret-fwmark-parameter-as-a-bitmask.patch
 create mode 100644 target/linux/generic/backport-4.19/393-v5.5-sch_cake-drop-unused-variable-tin_quantum_prio.patch
 create mode 100644 target/linux/generic/backport-4.19/394-v5.4-sch_cake-Add-missing-NLA-policy-entry-TCA_CAKE_SPLIT.patch
 create mode 100644 target/linux/generic/backport-4.19/395-v5.8-net-sch_cake-Take-advantage-of-skb-hash-where-appropriate.patch
 create mode 100644 target/linux/generic/backport-4.19/396-5.8-sch_cake-don-t-try-to-reallocate-or-unshare-skb-unco.patch
 create mode 100644 target/linux/generic/backport-4.19/397-5.8-sch_cake-don-t-call-diffserv-parsing-code-when-it-is.patch
 create mode 100644 target/linux/generic/backport-4.19/398-5.8-sch_cake-fix-a-few-style-nits.patch
 create mode 100644 target/linux/generic/backport-4.19/399-5.9-sch_cake-add-RFC-8622-LE-PHB-support-to-CAKE-diffser.patch
 create mode 100644 target/linux/generic/hack-4.19/641-sch_cake-fix-IP-protocol-handling-in-the-presence-of.patch

diff --git a/target/linux/generic/backport-4.19/390-v5.1-sch_cake-Make-the-dual-modes-fairer.patch b/target/linux/generic/backport-4.19/390-v5.1-sch_cake-Make-the-dual-modes-fairer.patch
new file mode 100644
index 0000000000..cd94600152
--- /dev/null
+++ b/target/linux/generic/backport-4.19/390-v5.1-sch_cake-Make-the-dual-modes-fairer.patch
@@ -0,0 +1,217 @@
+From 712639929912c5eefb09facccb48d55b3f72c9f8 Mon Sep 17 00:00:00 2001
+From: George Amanakis <gamanakis@gmail.com>
+Date: Fri, 1 Mar 2019 16:04:05 +0100
+Subject: [PATCH] sch_cake: Make the dual modes fairer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+CAKE host fairness does not work well with TCP flows in dual-srchost and
+dual-dsthost setup. The reason is that ACKs generated by TCP flows are
+classified as sparse flows, and affect flow isolation from other hosts. Fix
+this by calculating host_load based only on the bulk flows a host
+generates. In a hash collision the host_bulk_flow_count values must be
+decremented on the old hosts and incremented on the new ones *if* the queue
+is in the bulk set.
+
+Reported-by: Pete Heist <peteheist@gmail.com>
+Signed-off-by: George Amanakis <gamanakis@gmail.com>
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+---
+ net/sched/sch_cake.c | 92 ++++++++++++++++++++++++++++++--------------
+ 1 file changed, 63 insertions(+), 29 deletions(-)
+
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -138,8 +138,8 @@ struct cake_flow {
+ struct cake_host {
+ 	u32 srchost_tag;
+ 	u32 dsthost_tag;
+-	u16 srchost_refcnt;
+-	u16 dsthost_refcnt;
++	u16 srchost_bulk_flow_count;
++	u16 dsthost_bulk_flow_count;
+ };
+ 
+ struct cake_heap_entry {
+@@ -746,8 +746,10 @@ skip_hash:
+ 		 * queue, accept the collision, update the host tags.
+ 		 */
+ 		q->way_collisions++;
+-		q->hosts[q->flows[reduced_hash].srchost].srchost_refcnt--;
+-		q->hosts[q->flows[reduced_hash].dsthost].dsthost_refcnt--;
++		if (q->flows[outer_hash + k].set == CAKE_SET_BULK) {
++			q->hosts[q->flows[reduced_hash].srchost].srchost_bulk_flow_count--;
++			q->hosts[q->flows[reduced_hash].dsthost].dsthost_bulk_flow_count--;
++		}
+ 		allocate_src = cake_dsrc(flow_mode);
+ 		allocate_dst = cake_ddst(flow_mode);
+ found:
+@@ -767,13 +769,14 @@ found:
+ 			}
+ 			for (i = 0; i < CAKE_SET_WAYS;
+ 				i++, k = (k + 1) % CAKE_SET_WAYS) {
+-				if (!q->hosts[outer_hash + k].srchost_refcnt)
++				if (!q->hosts[outer_hash + k].srchost_bulk_flow_count)
+ 					break;
+ 			}
+ 			q->hosts[outer_hash + k].srchost_tag = srchost_hash;
+ found_src:
+ 			srchost_idx = outer_hash + k;
+-			q->hosts[srchost_idx].srchost_refcnt++;
++			if (q->flows[reduced_hash].set == CAKE_SET_BULK)
++				q->hosts[srchost_idx].srchost_bulk_flow_count++;
+ 			q->flows[reduced_hash].srchost = srchost_idx;
+ 		}
+ 
+@@ -789,13 +792,14 @@ found_src:
+ 			}
+ 			for (i = 0; i < CAKE_SET_WAYS;
+ 			     i++, k = (k + 1) % CAKE_SET_WAYS) {
+-				if (!q->hosts[outer_hash + k].dsthost_refcnt)
++				if (!q->hosts[outer_hash + k].dsthost_bulk_flow_count)
+ 					break;
+ 			}
+ 			q->hosts[outer_hash + k].dsthost_tag = dsthost_hash;
+ found_dst:
+ 			dsthost_idx = outer_hash + k;
+-			q->hosts[dsthost_idx].dsthost_refcnt++;
++			if (q->flows[reduced_hash].set == CAKE_SET_BULK)
++				q->hosts[dsthost_idx].dsthost_bulk_flow_count++;
+ 			q->flows[reduced_hash].dsthost = dsthost_idx;
+ 		}
+ 	}
+@@ -1793,20 +1797,30 @@ static s32 cake_enqueue(struct sk_buff *
+ 		b->sparse_flow_count++;
+ 
+ 		if (cake_dsrc(q->flow_mode))
+-			host_load = max(host_load, srchost->srchost_refcnt);
++			host_load = max(host_load, srchost->srchost_bulk_flow_count);
+ 
+ 		if (cake_ddst(q->flow_mode))
+-			host_load = max(host_load, dsthost->dsthost_refcnt);
++			host_load = max(host_load, dsthost->dsthost_bulk_flow_count);
+ 
+ 		flow->deficit = (b->flow_quantum *
+ 				 quantum_div[host_load]) >> 16;
+ 	} else if (flow->set == CAKE_SET_SPARSE_WAIT) {
++		struct cake_host *srchost = &b->hosts[flow->srchost];
++		struct cake_host *dsthost = &b->hosts[flow->dsthost];
++
+ 		/* this flow was empty, accounted as a sparse flow, but actually
+ 		 * in the bulk rotation.
+ 		 */
+ 		flow->set = CAKE_SET_BULK;
+ 		b->sparse_flow_count--;
+ 		b->bulk_flow_count++;
++
++		if (cake_dsrc(q->flow_mode))
++			srchost->srchost_bulk_flow_count++;
++
++		if (cake_ddst(q->flow_mode))
++			dsthost->dsthost_bulk_flow_count++;
++
+ 	}
+ 
+ 	if (q->buffer_used > q->buffer_max_used)
+@@ -1974,23 +1988,8 @@ retry:
+ 	dsthost = &b->hosts[flow->dsthost];
+ 	host_load = 1;
+ 
+-	if (cake_dsrc(q->flow_mode))
+-		host_load = max(host_load, srchost->srchost_refcnt);
+-
+-	if (cake_ddst(q->flow_mode))
+-		host_load = max(host_load, dsthost->dsthost_refcnt);
+-
+-	WARN_ON(host_load > CAKE_QUEUES);
+-
+ 	/* flow isolation (DRR++) */
+ 	if (flow->deficit <= 0) {
+-		/* The shifted prandom_u32() is a way to apply dithering to
+-		 * avoid accumulating roundoff errors
+-		 */
+-		flow->deficit += (b->flow_quantum * quantum_div[host_load] +
+-				  (prandom_u32() >> 16)) >> 16;
+-		list_move_tail(&flow->flowchain, &b->old_flows);
+-
+ 		/* Keep all flows with deficits out of the sparse and decaying
+ 		 * rotations.  No non-empty flow can go into the decaying
+ 		 * rotation, so they can't get deficits
+@@ -1999,6 +1998,13 @@ retry:
+ 			if (flow->head) {
+ 				b->sparse_flow_count--;
+ 				b->bulk_flow_count++;
++
++				if (cake_dsrc(q->flow_mode))
++					srchost->srchost_bulk_flow_count++;
++
++				if (cake_ddst(q->flow_mode))
++					dsthost->dsthost_bulk_flow_count++;
++
+ 				flow->set = CAKE_SET_BULK;
+ 			} else {
+ 				/* we've moved it to the bulk rotation for
+@@ -2008,6 +2014,22 @@ retry:
+ 				flow->set = CAKE_SET_SPARSE_WAIT;
+ 			}
+ 		}
++
++		if (cake_dsrc(q->flow_mode))
++			host_load = max(host_load, srchost->srchost_bulk_flow_count);
++
++		if (cake_ddst(q->flow_mode))
++			host_load = max(host_load, dsthost->dsthost_bulk_flow_count);
++
++		WARN_ON(host_load > CAKE_QUEUES);
++
++		/* The shifted prandom_u32() is a way to apply dithering to
++		 * avoid accumulating roundoff errors
++		 */
++		flow->deficit += (b->flow_quantum * quantum_div[host_load] +
++				  (prandom_u32() >> 16)) >> 16;
++		list_move_tail(&flow->flowchain, &b->old_flows);
++
+ 		goto retry;
+ 	}
+ 
+@@ -2028,6 +2050,13 @@ retry:
+ 					       &b->decaying_flows);
+ 				if (flow->set == CAKE_SET_BULK) {
+ 					b->bulk_flow_count--;
++
++					if (cake_dsrc(q->flow_mode))
++						srchost->srchost_bulk_flow_count--;
++
++					if (cake_ddst(q->flow_mode))
++						dsthost->dsthost_bulk_flow_count--;
++
+ 					b->decaying_flow_count++;
+ 				} else if (flow->set == CAKE_SET_SPARSE ||
+ 					   flow->set == CAKE_SET_SPARSE_WAIT) {
+@@ -2041,14 +2070,19 @@ retry:
+ 				if (flow->set == CAKE_SET_SPARSE ||
+ 				    flow->set == CAKE_SET_SPARSE_WAIT)
+ 					b->sparse_flow_count--;
+-				else if (flow->set == CAKE_SET_BULK)
++				else if (flow->set == CAKE_SET_BULK) {
+ 					b->bulk_flow_count--;
+-				else
++
++					if (cake_dsrc(q->flow_mode))
++						srchost->srchost_bulk_flow_count--;
++
++					if (cake_ddst(q->flow_mode))
++						dsthost->dsthost_bulk_flow_count--;
++
++				} else
+ 					b->decaying_flow_count--;
+ 
+ 				flow->set = CAKE_SET_NONE;
+-				srchost->srchost_refcnt--;
+-				dsthost->dsthost_refcnt--;
+ 			}
+ 			goto begin;
+ 		}
diff --git a/target/linux/generic/backport-4.19/391-v5.1-sch_cake-Permit-use-of-connmarks-as-tin-classifiers.patch b/target/linux/generic/backport-4.19/391-v5.1-sch_cake-Permit-use-of-connmarks-as-tin-classifiers.patch
new file mode 100644
index 0000000000..9ac1388c98
--- /dev/null
+++ b/target/linux/generic/backport-4.19/391-v5.1-sch_cake-Permit-use-of-connmarks-as-tin-classifiers.patch
@@ -0,0 +1,118 @@
+From 0b5c7efdfc6e389ec6840579fe90bdb6f42b08dc Mon Sep 17 00:00:00 2001
+From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+Date: Fri, 1 Mar 2019 16:04:05 +0100
+Subject: [PATCH] sch_cake: Permit use of connmarks as tin classifiers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Add flag 'FWMARK' to enable use of firewall connmarks as tin selector.
+The connmark (skbuff->mark) needs to be in the range 1->tin_cnt ie.
+for diffserv3 the mark needs to be 1->3.
+
+Background
+
+Typically CAKE uses DSCP as the basis for tin selection.  DSCP values
+are relatively easily changed as part of the egress path, usually with
+iptables & the mangle table, ingress is more challenging.  CAKE is often
+used on the WAN interface of a residential gateway where passthrough of
+DSCP from the ISP is either missing or set to unhelpful values thus use
+of ingress DSCP values for tin selection isn't helpful in that
+environment.
+
+An approach to solving the ingress tin selection problem is to use
+CAKE's understanding of tc filters.  Naive tc filters could match on
+source/destination port numbers and force tin selection that way, but
+multiple filters don't scale particularly well as each filter must be
+traversed whether it matches or not. e.g. a simple example to map 3
+firewall marks to tins:
+
+MAJOR=$( tc qdisc show dev $DEV | head -1 | awk '{print $3}' )
+tc filter add dev $DEV parent $MAJOR protocol all handle 0x01 fw action skbedit priority ${MAJOR}1
+tc filter add dev $DEV parent $MAJOR protocol all handle 0x02 fw action skbedit priority ${MAJOR}2
+tc filter add dev $DEV parent $MAJOR protocol all handle 0x03 fw action skbedit priority ${MAJOR}3
+
+Another option is to use eBPF cls_act with tc filters e.g.
+
+MAJOR=$( tc qdisc show dev $DEV | head -1 | awk '{print $3}' )
+tc filter add dev $DEV parent $MAJOR bpf da obj my-bpf-fwmark-to-class.o
+
+This has the disadvantages of a) needing someone to write & maintain
+the bpf program, b) a bpf toolchain to compile it and c) needing to
+hardcode the major number in the bpf program so it matches the cake
+instance (or forcing the cake instance to a particular major number)
+since the major number cannot be passed to the bpf program via tc
+command line.
+
+As already hinted at by the previous examples, it would be helpful
+to associate tins with something that survives the Internet path and
+ideally allows tin selection on both egress and ingress.  Netfilter's
+conntrack permits setting an identifying mark on a connection which
+can also be restored to an ingress packet with tc action connmark e.g.
+
+tc filter add dev eth0 parent ffff: protocol all prio 10 u32 \
+	match u32 0 0 flowid 1:1 action connmark action mirred egress redirect dev ifb1
+
+Since tc's connmark action has restored any connmark into skb->mark,
+any of the previous solutions are based upon it and in one form or
+another copy that mark to the skb->priority field where again CAKE
+picks this up.
+
+This change cuts out at least one of the (less intuitive &
+non-scalable) middlemen and permit direct access to skb->mark.
+
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/uapi/linux/pkt_sched.h |  1 +
+ net/sched/sch_cake.c           | 34 +++++++++++++++++++++++++++-------
+ 2 files changed, 28 insertions(+), 7 deletions(-)
+
+--- a/include/uapi/linux/pkt_sched.h
++++ b/include/uapi/linux/pkt_sched.h
+@@ -991,6 +991,7 @@ enum {
+ 	TCA_CAKE_INGRESS,
+ 	TCA_CAKE_ACK_FILTER,
+ 	TCA_CAKE_SPLIT_GSO,
++	TCA_CAKE_FWMARK,
+ 	__TCA_CAKE_MAX
+ };
+ #define TCA_CAKE_MAX	(__TCA_CAKE_MAX - 1)
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -258,7 +258,8 @@ enum {
+ 	CAKE_FLAG_AUTORATE_INGRESS = BIT(1),
+ 	CAKE_FLAG_INGRESS	   = BIT(2),
+ 	CAKE_FLAG_WASH		   = BIT(3),
+-	CAKE_FLAG_SPLIT_GSO	   = BIT(4)
++	CAKE_FLAG_SPLIT_GSO	   = BIT(4),
++	CAKE_FLAG_FWMARK	   = BIT(5)
+ };
+ 
+ /* COBALT operates the Codel and BLUE algorithms in parallel, in order to
+@@ -2623,6 +2624,13 @@ static int cake_change(struct Qdisc *sch
+ 			q->rate_flags &= ~CAKE_FLAG_SPLIT_GSO;
+ 	}
+ 
++	if (tb[TCA_CAKE_FWMARK]) {
++		if (!!nla_get_u32(tb[TCA_CAKE_FWMARK]))
++			q->rate_flags |= CAKE_FLAG_FWMARK;
++		else
++			q->rate_flags &= ~CAKE_FLAG_FWMARK;
++	}
++
+ 	if (q->tins) {
+ 		sch_tree_lock(sch);
+ 		cake_reconfigure(sch);
+@@ -2782,6 +2790,10 @@ static int cake_dump(struct Qdisc *sch,
+ 			!!(q->rate_flags & CAKE_FLAG_SPLIT_GSO)))
+ 		goto nla_put_failure;
+ 
++	if (nla_put_u32(skb, TCA_CAKE_FWMARK,
++			!!(q->rate_flags & CAKE_FLAG_FWMARK)))
++		goto nla_put_failure;
++
+ 	return nla_nest_end(skb, opts);
+ 
+ nla_put_failure:
diff --git a/target/linux/generic/backport-4.19/392-v5.1-sch_cake-Interpret-fwmark-parameter-as-a-bitmask.patch b/target/linux/generic/backport-4.19/392-v5.1-sch_cake-Interpret-fwmark-parameter-as-a-bitmask.patch
new file mode 100644
index 0000000000..325f5719d7
--- /dev/null
+++ b/target/linux/generic/backport-4.19/392-v5.1-sch_cake-Interpret-fwmark-parameter-as-a-bitmask.patch
@@ -0,0 +1,102 @@
+From eab2fc822af38f31fd5f4e731b5d10b94904d919 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@redhat.com>
+Date: Thu, 14 Mar 2019 23:08:22 +0100
+Subject: [PATCH] sch_cake: Interpret fwmark parameter as a bitmask
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We initially interpreted the fwmark parameter as a flag that simply turned
+on the feature, using the whole skb->mark field as the index into the CAKE
+tin_order array. However, it is quite common for different applications to
+use different parts of the mask field for their own purposes, each using a
+different mask.
+
+Support this use of subsets of the mark by interpreting the TCA_CAKE_FWMARK
+parameter as a bitmask to apply to the fwmark field when reading it. The
+result will be right-shifted by the number of unset lower bits of the mask
+before looking up the tin.
+
+In the original commit message we also failed to credit Felix Resch with
+originally suggesting the fwmark feature back in 2017; so the Suggested-By
+in this commit covers the whole fwmark feature.
+
+Fixes: 0b5c7efdfc6e ("sch_cake: Permit use of connmarks as tin classifiers")
+Suggested-by: Felix Resch <fuller@beif.de>
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+---
+ net/sched/sch_cake.c | 25 ++++++++++++-------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -211,6 +211,9 @@ struct cake_sched_data {
+ 	u8		ack_filter;
+ 	u8		atm_mode;
+ 
++	u32		fwmark_mask;
++	u16		fwmark_shft;
++
+ 	/* time_next = time_this + ((len * rate_ns) >> rate_shft) */
+ 	u16		rate_shft;
+ 	ktime_t		time_next_packet;
+@@ -258,8 +261,7 @@ enum {
+ 	CAKE_FLAG_AUTORATE_INGRESS = BIT(1),
+ 	CAKE_FLAG_INGRESS	   = BIT(2),
+ 	CAKE_FLAG_WASH		   = BIT(3),
+-	CAKE_FLAG_SPLIT_GSO	   = BIT(4),
+-	CAKE_FLAG_FWMARK	   = BIT(5)
++	CAKE_FLAG_SPLIT_GSO	   = BIT(4)
+ };
+ 
+ /* COBALT operates the Codel and BLUE algorithms in parallel, in order to
+@@ -1554,7 +1556,7 @@ static struct cake_tin_data *cake_select
+ 					     struct sk_buff *skb)
+ {
+ 	struct cake_sched_data *q = qdisc_priv(sch);
+-	u32 tin;
++	u32 tin, mark;
+ 	u8 dscp;
+ 
+ 	/* Tin selection: Default to diffserv-based selection, allow overriding
+@@ -1562,6 +1564,7 @@ static struct cake_tin_data *cake_select
+ 	 */
+ 	dscp = cake_handle_diffserv(skb,
+ 				    q->rate_flags & CAKE_FLAG_WASH);
++	mark = (skb->mark & q->fwmark_mask) >> q->fwmark_shft;
+ 
+ 	if (q->tin_mode == CAKE_DIFFSERV_BESTEFFORT)
+ 		tin = 0;
+@@ -2178,6 +2181,7 @@ static const struct nla_policy cake_poli
+ 	[TCA_CAKE_MPU]		 = { .type = NLA_U32 },
+ 	[TCA_CAKE_INGRESS]	 = { .type = NLA_U32 },
+ 	[TCA_CAKE_ACK_FILTER]	 = { .type = NLA_U32 },
++	[TCA_CAKE_FWMARK]	 = { .type = NLA_U32 },
+ };
+ 
+ static void cake_set_rate(struct cake_tin_data *b, u64 rate, u32 mtu,
+@@ -2625,10 +2629,8 @@ static int cake_change(struct Qdisc *sch
+ 	}
+ 
+ 	if (tb[TCA_CAKE_FWMARK]) {
+-		if (!!nla_get_u32(tb[TCA_CAKE_FWMARK]))
+-			q->rate_flags |= CAKE_FLAG_FWMARK;
+-		else
+-			q->rate_flags &= ~CAKE_FLAG_FWMARK;
++		q->fwmark_mask = nla_get_u32(tb[TCA_CAKE_FWMARK]);
++		q->fwmark_shft = q->fwmark_mask ? __ffs(q->fwmark_mask) : 0;
+ 	}
+ 
+ 	if (q->tins) {
+@@ -2790,8 +2792,7 @@ static int cake_dump(struct Qdisc *sch,
+ 			!!(q->rate_flags & CAKE_FLAG_SPLIT_GSO)))
+ 		goto nla_put_failure;
+ 
+-	if (nla_put_u32(skb, TCA_CAKE_FWMARK,
+-			!!(q->rate_flags & CAKE_FLAG_FWMARK)))
++	if (nla_put_u32(skb, TCA_CAKE_FWMARK, q->fwmark_mask))
+ 		goto nla_put_failure;
+ 
+ 	return nla_nest_end(skb, opts);
diff --git a/target/linux/generic/backport-4.19/393-v5.5-sch_cake-drop-unused-variable-tin_quantum_prio.patch b/target/linux/generic/backport-4.19/393-v5.5-sch_cake-drop-unused-variable-tin_quantum_prio.patch
new file mode 100644
index 0000000000..33e5c54b8c
--- /dev/null
+++ b/target/linux/generic/backport-4.19/393-v5.5-sch_cake-drop-unused-variable-tin_quantum_prio.patch
@@ -0,0 +1,158 @@
+From d7e1738f0a0b0573ac93cf570ba3df9dee61b68e Mon Sep 17 00:00:00 2001
+From: Kevin 'ldir' Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+Date: Wed, 18 Dec 2019 14:05:13 +0000
+Subject: [PATCH 2/2] sch_cake: drop unused variable tin_quantum_prio
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Turns out tin_quantum_prio isn't used anymore and is a leftover from a
+previous implementation of diffserv tins.  Since the variable isn't used
+in any calculations it can be eliminated.
+
+Drop variable and places where it was set.  Rename remaining variable
+and consolidate naming of intermediate variables that set it.
+
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/sched/sch_cake.c | 59 ++++++++++++++------------------------------
+ 1 file changed, 18 insertions(+), 41 deletions(-)
+
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -173,8 +173,7 @@ struct cake_tin_data {
+ 	u64	tin_rate_bps;
+ 	u16	tin_rate_shft;
+ 
+-	u16	tin_quantum_prio;
+-	u16	tin_quantum_band;
++	u16	tin_quantum;
+ 	s32	tin_deficit;
+ 	u32	tin_backlog;
+ 	u32	tin_dropped;
+@@ -1916,7 +1915,7 @@ begin:
+ 		while (b->tin_deficit < 0 ||
+ 		       !(b->sparse_flow_count + b->bulk_flow_count)) {
+ 			if (b->tin_deficit <= 0)
+-				b->tin_deficit += b->tin_quantum_band;
++				b->tin_deficit += b->tin_quantum;
+ 			if (b->sparse_flow_count + b->bulk_flow_count)
+ 				empty = false;
+ 
+@@ -2237,8 +2236,7 @@ static int cake_config_besteffort(struct
+ 
+ 	cake_set_rate(b, rate, mtu,
+ 		      us_to_ns(q->target), us_to_ns(q->interval));
+-	b->tin_quantum_band = 65535;
+-	b->tin_quantum_prio = 65535;
++	b->tin_quantum = 65535;
+ 
+ 	return 0;
+ }
+@@ -2249,8 +2247,7 @@ static int cake_config_precedence(struct
+ 	struct cake_sched_data *q = qdisc_priv(sch);
+ 	u32 mtu = psched_mtu(qdisc_dev(sch));
+ 	u64 rate = q->rate_bps;
+-	u32 quantum1 = 256;
+-	u32 quantum2 = 256;
++	u32 quantum = 256;
+ 	u32 i;
+ 
+ 	q->tin_cnt = 8;
+@@ -2263,18 +2260,14 @@ static int cake_config_precedence(struct
+ 		cake_set_rate(b, rate, mtu, us_to_ns(q->target),
+ 			      us_to_ns(q->interval));
+ 
+-		b->tin_quantum_prio = max_t(u16, 1U, quantum1);
+-		b->tin_quantum_band = max_t(u16, 1U, quantum2);
++		b->tin_quantum = max_t(u16, 1U, quantum);
+ 
+ 		/* calculate next class's parameters */
+ 		rate  *= 7;
+ 		rate >>= 3;
+ 
+-		quantum1  *= 3;
+-		quantum1 >>= 1;
+-
+-		quantum2  *= 7;
+-		quantum2 >>= 3;
++		quantum  *= 7;
++		quantum >>= 3;
+ 	}
+ 
+ 	return 0;
+@@ -2343,8 +2336,7 @@ static int cake_config_diffserv8(struct
+ 	struct cake_sched_data *q = qdisc_priv(sch);
+ 	u32 mtu = psched_mtu(qdisc_dev(sch));
+ 	u64 rate = q->rate_bps;
+-	u32 quantum1 = 256;
+-	u32 quantum2 = 256;
++	u32 quantum = 256;
+ 	u32 i;
+ 
+ 	q->tin_cnt = 8;
+@@ -2360,18 +2352,14 @@ static int cake_config_diffserv8(struct
+ 		cake_set_rate(b, rate, mtu, us_to_ns(q->target),
+ 			      us_to_ns(q->interval));
+ 
+-		b->tin_quantum_prio = max_t(u16, 1U, quantum1);
+-		b->tin_quantum_band = max_t(u16, 1U, quantum2);
++		b->tin_quantum = max_t(u16, 1U, quantum);
+ 
+ 		/* calculate next class's parameters */
+ 		rate  *= 7;
+ 		rate >>= 3;
+ 
+-		quantum1  *= 3;
+-		quantum1 >>= 1;
+-
+-		quantum2  *= 7;
+-		quantum2 >>= 3;
++		quantum  *= 7;
++		quantum >>= 3;
+ 	}
+ 
+ 	return 0;
+@@ -2410,17 +2398,11 @@ static int cake_config_diffserv4(struct
+ 	cake_set_rate(&q->tins[3], rate >> 2, mtu,
+ 		      us_to_ns(q->target), us_to_ns(q->interval));
+ 
+-	/* priority weights */
+-	q->tins[0].tin_quantum_prio = quantum;
+-	q->tins[1].tin_quantum_prio = quantum >> 4;
+-	q->tins[2].tin_quantum_prio = quantum << 2;
+-	q->tins[3].tin_quantum_prio = quantum << 4;
+-
+ 	/* bandwidth-sharing weights */
+-	q->tins[0].tin_quantum_band = quantum;
+-	q->tins[1].tin_quantum_band = quantum >> 4;
+-	q->tins[2].tin_quantum_band = quantum >> 1;
+-	q->tins[3].tin_quantum_band = quantum >> 2;
++	q->tins[0].tin_quantum = quantum;
++	q->tins[1].tin_quantum = quantum >> 4;
++	q->tins[2].tin_quantum = quantum >> 1;
++	q->tins[3].tin_quantum = quantum >> 2;
+ 
+ 	return 0;
+ }
+@@ -2451,15 +2433,10 @@ static int cake_config_diffserv3(struct
+ 	cake_set_rate(&q->tins[2], rate >> 2, mtu,
+ 		      us_to_ns(q->target), us_to_ns(q->interval));
+ 
+-	/* priority weights */
+-	q->tins[0].tin_quantum_prio = quantum;
+-	q->tins[1].tin_quantum_prio = quantum >> 4;
+-	q->tins[2].tin_quantum_prio = quantum << 4;
+-
+ 	/* bandwidth-sharing weights */
+-	q->tins[0].tin_quantum_band = quantum;
+-	q->tins[1].tin_quantum_band = quantum >> 4;
+-	q->tins[2].tin_quantum_band = quantum >> 2;
++	q->tins[0].tin_quantum = quantum;
++	q->tins[1].tin_quantum = quantum >> 4;
++	q->tins[2].tin_quantum = quantum >> 2;
+ 
+ 	return 0;
+ }
diff --git a/target/linux/generic/backport-4.19/394-v5.4-sch_cake-Add-missing-NLA-policy-entry-TCA_CAKE_SPLIT.patch b/target/linux/generic/backport-4.19/394-v5.4-sch_cake-Add-missing-NLA-policy-entry-TCA_CAKE_SPLIT.patch
new file mode 100644
index 0000000000..32f0e1ae89
--- /dev/null
+++ b/target/linux/generic/backport-4.19/394-v5.4-sch_cake-Add-missing-NLA-policy-entry-TCA_CAKE_SPLIT.patch
@@ -0,0 +1,30 @@
+From b3c424eb6a1a3c485de64619418a471dee6ce849 Mon Sep 17 00:00:00 2001
+From: Victorien Molle <victorien.molle@wifirst.fr>
+Date: Mon, 2 Dec 2019 15:11:38 +0100
+Subject: [PATCH] sch_cake: Add missing NLA policy entry TCA_CAKE_SPLIT_GSO
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This field has never been checked since introduction in mainline kernel
+
+Signed-off-by: Victorien Molle <victorien.molle@wifirst.fr>
+Signed-off-by: Florent Fourcot <florent.fourcot@wifirst.fr>
+Fixes: 2db6dc2662ba "sch_cake: Make gso-splitting configurable from userspace"
+Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+---
+ net/sched/sch_cake.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -2180,6 +2180,7 @@ static const struct nla_policy cake_poli
+ 	[TCA_CAKE_MPU]		 = { .type = NLA_U32 },
+ 	[TCA_CAKE_INGRESS]	 = { .type = NLA_U32 },
+ 	[TCA_CAKE_ACK_FILTER]	 = { .type = NLA_U32 },
++	[TCA_CAKE_SPLIT_GSO]	 = { .type = NLA_U32 },
+ 	[TCA_CAKE_FWMARK]	 = { .type = NLA_U32 },
+ };
+ 
diff --git a/target/linux/generic/backport-4.19/395-v5.8-net-sch_cake-Take-advantage-of-skb-hash-where-appropriate.patch b/target/linux/generic/backport-4.19/395-v5.8-net-sch_cake-Take-advantage-of-skb-hash-where-appropriate.patch
new file mode 100644
index 0000000000..12962135d0
--- /dev/null
+++ b/target/linux/generic/backport-4.19/395-v5.8-net-sch_cake-Take-advantage-of-skb-hash-where-appropriate.patch
@@ -0,0 +1,170 @@
+From b0c19ed6088ab41dd2a727b60594b7297c15d6ce Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@redhat.com>
+Date: Fri, 29 May 2020 14:43:44 +0200
+Subject: [PATCH] sch_cake: Take advantage of skb->hash where appropriate
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+While the other fq-based qdiscs take advantage of skb->hash and doesn't
+recompute it if it is already set, sch_cake does not.
+
+This was a deliberate choice because sch_cake hashes various parts of the
+packet header to support its advanced flow isolation modes. However,
+foregoing the use of skb->hash entirely loses a few important benefits:
+
+- When skb->hash is set by hardware, a few CPU cycles can be saved by not
+  hashing again in software.
+
+- Tunnel encapsulations will generally preserve the value of skb->hash from
+  before the encapsulation, which allows flow-based qdiscs to distinguish
+  between flows even though the outer packet header no longer has flow
+  information.
+
+It turns out that we can preserve these desirable properties in many cases,
+while still supporting the advanced flow isolation properties of sch_cake.
+This patch does so by reusing the skb->hash value as the flow_hash part of
+the hashing procedure in cake_hash() only in the following conditions:
+
+- If the skb->hash is marked as covering the flow headers (skb->l4_hash is
+  set)
+
+AND
+
+- NAT header rewriting is either disabled, or did not change any values
+  used for hashing. The latter is important to match local-origin packets
+  such as those of a tunnel endpoint.
+
+The immediate motivation for fixing this was the recent patch to WireGuard
+to preserve the skb->hash on encapsulation. As such, this is also what I
+tested against; with this patch, added latency under load for competing
+flows drops from ~8 ms to sub-1ms on an RRUL test over a WireGuard tunnel
+going through a virtual link shaped to 1Gbps using sch_cake. This matches
+the results we saw with a similar setup using sch_fq_codel when testing the
+WireGuard patch.
+
+Fixes: 046f6fd5daef ("sched: Add Common Applications Kept Enhanced (cake) qdisc")
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+---
+ net/sched/sch_cake.c | 65 ++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 51 insertions(+), 14 deletions(-)
+
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -584,26 +584,48 @@ static bool cobalt_should_drop(struct co
+ 	return drop;
+ }
+ 
+-static void cake_update_flowkeys(struct flow_keys *keys,
++static bool cake_update_flowkeys(struct flow_keys *keys,
+ 				 const struct sk_buff *skb)
+ {
+ #if IS_ENABLED(CONFIG_NF_CONNTRACK)
+ 	struct nf_conntrack_tuple tuple = {};
+-	bool rev = !skb->_nfct;
++	bool rev = !skb->_nfct, upd = false;
++	__be32 ip;
+ 
+ 	if (tc_skb_protocol(skb) != htons(ETH_P_IP))
+-		return;
++		return false;
+ 
+ 	if (!nf_ct_get_tuple_skb(&tuple, skb))
+-		return;
++		return false;
+ 
+-	keys->addrs.v4addrs.src = rev ? tuple.dst.u3.ip : tuple.src.u3.ip;
+-	keys->addrs.v4addrs.dst = rev ? tuple.src.u3.ip : tuple.dst.u3.ip;
++	ip = rev ? tuple.dst.u3.ip : tuple.src.u3.ip;
++	if (ip != keys->addrs.v4addrs.src) {
++		keys->addrs.v4addrs.src = ip;
++		upd = true;
++	}
++	ip = rev ? tuple.src.u3.ip : tuple.dst.u3.ip;
++	if (ip != keys->addrs.v4addrs.dst) {
++		keys->addrs.v4addrs.dst = ip;
++		upd = true;
++	}
+ 
+ 	if (keys->ports.ports) {
+-		keys->ports.src = rev ? tuple.dst.u.all : tuple.src.u.all;
+-		keys->ports.dst = rev ? tuple.src.u.all : tuple.dst.u.all;
++		__be16 port;
++
++		port = rev ? tuple.dst.u.all : tuple.src.u.all;
++		if (port != keys->ports.src) {
++			keys->ports.src = port;
++			upd = true;
++		}
++		port = rev ? tuple.src.u.all : tuple.dst.u.all;
++		if (port != keys->ports.dst) {
++			port = keys->ports.dst;
++			upd = true;
++		}
+ 	}
++	return upd;
++#else
++	return false;
+ #endif
+ }
+ 
+@@ -624,23 +646,36 @@ static bool cake_ddst(int flow_mode)
+ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb,
+ 		     int flow_mode, u16 flow_override, u16 host_override)
+ {
++	bool hash_flows = (!flow_override && !!(flow_mode & CAKE_FLOW_FLOWS));
++	bool hash_hosts = (!host_override && !!(flow_mode & CAKE_FLOW_HOSTS));
++	bool nat_enabled = !!(flow_mode & CAKE_FLOW_NAT_FLAG);
+ 	u32 flow_hash = 0, srchost_hash = 0, dsthost_hash = 0;
+ 	u16 reduced_hash, srchost_idx, dsthost_idx;
+ 	struct flow_keys keys, host_keys;
++	bool use_skbhash = skb->l4_hash;
+ 
+ 	if (unlikely(flow_mode == CAKE_FLOW_NONE))
+ 		return 0;
+ 
+-	/* If both overrides are set we can skip packet dissection entirely */
+-	if ((flow_override || !(flow_mode & CAKE_FLOW_FLOWS)) &&
+-	    (host_override || !(flow_mode & CAKE_FLOW_HOSTS)))
++	/* If both overrides are set, or we can use the SKB hash and nat mode is
++	 * disabled, we can skip packet dissection entirely. If nat mode is
++	 * enabled there's another check below after doing the conntrack lookup.
++	 */
++	if ((!hash_flows || (use_skbhash && !nat_enabled)) && !hash_hosts)
+ 		goto skip_hash;
+ 
+ 	skb_flow_dissect_flow_keys(skb, &keys,
+ 				   FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
+ 
+-	if (flow_mode & CAKE_FLOW_NAT_FLAG)
+-		cake_update_flowkeys(&keys, skb);
++	/* Don't use the SKB hash if we change the lookup keys from conntrack */
++	if (nat_enabled && cake_update_flowkeys(&keys, skb))
++		use_skbhash = false;
++
++	/* If we can still use the SKB hash and don't need the host hash, we can
++	 * skip the rest of the hashing procedure
++	 */
++	if (use_skbhash && !hash_hosts)
++		goto skip_hash;
+ 
+ 	/* flow_hash_from_keys() sorts the addresses by value, so we have
+ 	 * to preserve their order in a separate data structure to treat
+@@ -679,12 +714,14 @@ static u32 cake_hash(struct cake_tin_dat
+ 	/* This *must* be after the above switch, since as a
+ 	 * side-effect it sorts the src and dst addresses.
+ 	 */
+-	if (flow_mode & CAKE_FLOW_FLOWS)
++	if (hash_flows && !use_skbhash)
+ 		flow_hash = flow_hash_from_keys(&keys);
+ 
+ skip_hash:
+ 	if (flow_override)
+ 		flow_hash = flow_override - 1;
++	else if (use_skbhash)
++		flow_hash = skb->hash;
+ 	if (host_override) {
+ 		dsthost_hash = host_override - 1;
+ 		srchost_hash = host_override - 1;
diff --git a/target/linux/generic/backport-4.19/396-5.8-sch_cake-don-t-try-to-reallocate-or-unshare-skb-unco.patch b/target/linux/generic/backport-4.19/396-5.8-sch_cake-don-t-try-to-reallocate-or-unshare-skb-unco.patch
new file mode 100644
index 0000000000..a36095c26c
--- /dev/null
+++ b/target/linux/generic/backport-4.19/396-5.8-sch_cake-don-t-try-to-reallocate-or-unshare-skb-unco.patch
@@ -0,0 +1,96 @@
+From 9208d2863ac689a563b92f2161d8d1e7127d0add Mon Sep 17 00:00:00 2001
+From: Ilya Ponetayev <i.ponetaev@ndmsystems.com>
+Date: Thu, 25 Jun 2020 22:12:07 +0200
+Subject: [PATCH] sch_cake: don't try to reallocate or unshare skb
+ unconditionally
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+cake_handle_diffserv() tries to linearize mac and network header parts of
+skb and to make it writable unconditionally. In some cases it leads to full
+skb reallocation, which reduces throughput and increases CPU load. Some
+measurements of IPv4 forward + NAPT on MIPS router with 580 MHz single-core
+CPU was conducted. It appears that on kernel 4.9 skb_try_make_writable()
+reallocates skb, if skb was allocated in ethernet driver via so-called
+'build skb' method from page cache (it was discovered by strange increase
+of kmalloc-2048 slab at first).
+
+Obtain DSCP value via read-only skb_header_pointer() call, and leave
+linearization only for DSCP bleaching or ECN CE setting. And, as an
+additional optimisation, skip diffserv parsing entirely if it is not needed
+by the current configuration.
+
+Fixes: c87b4ecdbe8d ("sch_cake: Make sure we can write the IP header before changing DSCP bits")
+Signed-off-by: Ilya Ponetayev <i.ponetaev@ndmsystems.com>
+[ fix a few style issues, reflow commit message ]
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+---
+ net/sched/sch_cake.c | 41 ++++++++++++++++++++++++++++++-----------
+ 1 file changed, 30 insertions(+), 11 deletions(-)
+
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -1553,30 +1553,49 @@ static unsigned int cake_drop(struct Qdi
+ 
+ static u8 cake_handle_diffserv(struct sk_buff *skb, u16 wash)
+ {
+-	int wlen = skb_network_offset(skb);
++	const int offset = skb_network_offset(skb);
++	u16 *buf, buf_;
+ 	u8 dscp;
+ 
+ 	switch (tc_skb_protocol(skb)) {
+ 	case htons(ETH_P_IP):
+-		wlen += sizeof(struct iphdr);
+-		if (!pskb_may_pull(skb, wlen) ||
+-		    skb_try_make_writable(skb, wlen))
++		buf = skb_header_pointer(skb, offset, sizeof(buf_), &buf_);
++		if (unlikely(!buf))
+ 			return 0;
+ 
+-		dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2;
+-		if (wash && dscp)
++		/* ToS is in the second byte of iphdr */
++		dscp = ipv4_get_dsfield((struct iphdr *)buf) >> 2;
++
++		if (wash && dscp) {
++			const int wlen = offset + sizeof(struct iphdr);
++
++			if (!pskb_may_pull(skb, wlen) ||
++			    skb_try_make_writable(skb, wlen))
++				return 0;
++
+ 			ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, 0);
++		}
++
+ 		return dscp;
+ 
+ 	case htons(ETH_P_IPV6):
+-		wlen += sizeof(struct ipv6hdr);
+-		if (!pskb_may_pull(skb, wlen) ||
+-		    skb_try_make_writable(skb, wlen))
++		buf = skb_header_pointer(skb, offset, sizeof(buf_), &buf_);
++		if (unlikely(!buf))
+ 			return 0;
+ 
+-		dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2;
+-		if (wash && dscp)
++		/* Traffic class is in the first and second bytes of ipv6hdr */
++		dscp = ipv6_get_dsfield((struct ipv6hdr *)buf) >> 2;
++
++		if (wash && dscp) {
++			const int wlen = offset + sizeof(struct ipv6hdr);
++
++			if (!pskb_may_pull(skb, wlen) ||
++			    skb_try_make_writable(skb, wlen))
++				return 0;
++
+ 			ipv6_change_dsfield(ipv6_hdr(skb), INET_ECN_MASK, 0);
++		}
++
+ 		return dscp;
+ 
+ 	case htons(ETH_P_ARP):
diff --git a/target/linux/generic/backport-4.19/397-5.8-sch_cake-don-t-call-diffserv-parsing-code-when-it-is.patch b/target/linux/generic/backport-4.19/397-5.8-sch_cake-don-t-call-diffserv-parsing-code-when-it-is.patch
new file mode 100644
index 0000000000..b40bb36c74
--- /dev/null
+++ b/target/linux/generic/backport-4.19/397-5.8-sch_cake-don-t-call-diffserv-parsing-code-when-it-is.patch
@@ -0,0 +1,62 @@
+From 8c95eca0bb8c4bd2231a0d581f1ad0d50c90488c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@redhat.com>
+Date: Thu, 25 Jun 2020 22:12:08 +0200
+Subject: [PATCH] sch_cake: don't call diffserv parsing code when it is not
+ needed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+As a further optimisation of the diffserv parsing codepath, we can skip it
+entirely if CAKE is configured to neither use diffserv-based
+classification, nor to zero out the diffserv bits.
+
+Fixes: c87b4ecdbe8d ("sch_cake: Make sure we can write the IP header before changing DSCP bits")
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+---
+ net/sched/sch_cake.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -1551,7 +1551,7 @@ static unsigned int cake_drop(struct Qdi
+ 	return idx + (tin << 16);
+ }
+ 
+-static u8 cake_handle_diffserv(struct sk_buff *skb, u16 wash)
++static u8 cake_handle_diffserv(struct sk_buff *skb, bool wash)
+ {
+ 	const int offset = skb_network_offset(skb);
+ 	u16 *buf, buf_;
+@@ -1612,14 +1612,17 @@ static struct cake_tin_data *cake_select
+ {
+ 	struct cake_sched_data *q = qdisc_priv(sch);
+ 	u32 tin, mark;
++	bool wash;
+ 	u8 dscp;
+ 
+ 	/* Tin selection: Default to diffserv-based selection, allow overriding
+-	 * using firewall marks or skb->priority.
++	 * using firewall marks or skb->priority. Call DSCP parsing early if
++	 * wash is enabled, otherwise defer to below to skip unneeded parsing.
+ 	 */
+-	dscp = cake_handle_diffserv(skb,
+-				    q->rate_flags & CAKE_FLAG_WASH);
+ 	mark = (skb->mark & q->fwmark_mask) >> q->fwmark_shft;
++	wash = !!(q->rate_flags & CAKE_FLAG_WASH);
++	if (wash)
++		dscp = cake_handle_diffserv(skb, wash);
+ 
+ 	if (q->tin_mode == CAKE_DIFFSERV_BESTEFFORT)
+ 		tin = 0;
+@@ -1630,6 +1633,8 @@ static struct cake_tin_data *cake_select
+ 		tin = q->tin_order[TC_H_MIN(skb->priority) - 1];
+ 
+ 	else {
++		if (!wash)
++			dscp = cake_handle_diffserv(skb, wash);
+ 		tin = q->tin_index[dscp];
+ 
+ 		if (unlikely(tin >= q->tin_cnt))
diff --git a/target/linux/generic/backport-4.19/398-5.8-sch_cake-fix-a-few-style-nits.patch b/target/linux/generic/backport-4.19/398-5.8-sch_cake-fix-a-few-style-nits.patch
new file mode 100644
index 0000000000..a1d72113b7
--- /dev/null
+++ b/target/linux/generic/backport-4.19/398-5.8-sch_cake-fix-a-few-style-nits.patch
@@ -0,0 +1,40 @@
+From 3f608f0c41360b11b04c763f348b712f651c8bac Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@redhat.com>
+Date: Thu, 25 Jun 2020 22:12:09 +0200
+Subject: [PATCH] sch_cake: fix a few style nits
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+I spotted a few nits when comparing the in-tree version of sch_cake with
+the out-of-tree one: A redundant error variable declaration shadowing an
+outer declaration, and an indentation alignment issue. Fix both of these.
+
+Fixes: 046f6fd5daef ("sched: Add Common Applications Kept Enhanced (cake) qdisc")
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+---
+ net/sched/sch_cake.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -2713,7 +2713,7 @@ static int cake_init(struct Qdisc *sch,
+ 	qdisc_watchdog_init(&q->watchdog, sch);
+ 
+ 	if (opt) {
+-		int err = cake_change(sch, opt, extack);
++		err = cake_change(sch, opt, extack);
+ 
+ 		if (err)
+ 			return err;
+@@ -3030,7 +3030,7 @@ static int cake_dump_class_stats(struct
+ 			PUT_STAT_S32(BLUE_TIMER_US,
+ 				     ktime_to_us(
+ 					     ktime_sub(now,
+-						     flow->cvars.blue_timer)));
++						       flow->cvars.blue_timer)));
+ 		}
+ 		if (flow->cvars.dropping) {
+ 			PUT_STAT_S32(DROP_NEXT_US,
diff --git a/target/linux/generic/backport-4.19/399-5.9-sch_cake-add-RFC-8622-LE-PHB-support-to-CAKE-diffser.patch b/target/linux/generic/backport-4.19/399-5.9-sch_cake-add-RFC-8622-LE-PHB-support-to-CAKE-diffser.patch
new file mode 100644
index 0000000000..e171b4cec7
--- /dev/null
+++ b/target/linux/generic/backport-4.19/399-5.9-sch_cake-add-RFC-8622-LE-PHB-support-to-CAKE-diffser.patch
@@ -0,0 +1,57 @@
+From b8392808eb3fc28e523e28cb258c81ca246deb9b Mon Sep 17 00:00:00 2001
+From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+Date: Thu, 25 Jun 2020 22:18:00 +0200
+Subject: [PATCH] sch_cake: add RFC 8622 LE PHB support to CAKE diffserv
+ handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Change tin mapping on diffserv3, 4 & 8 for LE PHB support, in essence
+making LE a member of the Bulk tin.
+
+Bulk has the least priority and minimum of 1/16th total bandwidth in the
+face of higher priority traffic.
+
+NB: Diffserv 3 & 4 swap tin 0 & 1 priorities from the default order as
+found in diffserv8, in case anyone is wondering why it looks a bit odd.
+
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+[ reword commit message slightly ]
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/sched/sch_cake.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -312,8 +312,8 @@ static const u8 precedence[] = {
+ };
+ 
+ static const u8 diffserv8[] = {
+-	2, 5, 1, 2, 4, 2, 2, 2,
+-	0, 2, 1, 2, 1, 2, 1, 2,
++	2, 0, 1, 2, 4, 2, 2, 2,
++	1, 2, 1, 2, 1, 2, 1, 2,
+ 	5, 2, 4, 2, 4, 2, 4, 2,
+ 	3, 2, 3, 2, 3, 2, 3, 2,
+ 	6, 2, 3, 2, 3, 2, 3, 2,
+@@ -323,7 +323,7 @@ static const u8 diffserv8[] = {
+ };
+ 
+ static const u8 diffserv4[] = {
+-	0, 2, 0, 0, 2, 0, 0, 0,
++	0, 1, 0, 0, 2, 0, 0, 0,
+ 	1, 0, 0, 0, 0, 0, 0, 0,
+ 	2, 0, 2, 0, 2, 0, 2, 0,
+ 	2, 0, 2, 0, 2, 0, 2, 0,
+@@ -334,7 +334,7 @@ static const u8 diffserv4[] = {
+ };
+ 
+ static const u8 diffserv3[] = {
+-	0, 0, 0, 0, 2, 0, 0, 0,
++	0, 1, 0, 0, 2, 0, 0, 0,
+ 	1, 0, 0, 0, 0, 0, 0, 0,
+ 	0, 0, 0, 0, 0, 0, 0, 0,
+ 	0, 0, 0, 0, 0, 0, 0, 0,
diff --git a/target/linux/generic/hack-4.19/641-sch_cake-fix-IP-protocol-handling-in-the-presence-of.patch b/target/linux/generic/hack-4.19/641-sch_cake-fix-IP-protocol-handling-in-the-presence-of.patch
new file mode 100644
index 0000000000..e651743c1d
--- /dev/null
+++ b/target/linux/generic/hack-4.19/641-sch_cake-fix-IP-protocol-handling-in-the-presence-of.patch
@@ -0,0 +1,114 @@
+From a00590d570212c3c633bd463cef8ec7377cc7993 Mon Sep 17 00:00:00 2001
+From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+Date: Tue, 30 Jun 2020 12:07:44 +0100
+Subject: [PATCH] sch_cake: fix IP protocol handling in the presence of VLAN
+ tags
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilya Ponetayev <i.ponetaev@ndmsystems.com>
+
+CAKE was using the return value of tc_skb_protocol() and expecting it to be
+the IP protocol type. This can fail in the presence of QinQ VLAN tags,
+making CAKE unable to handle ECN marking and diffserv parsing in this case.
+Fix this by implementing our own version of tc_skb_protocol(), which will
+use skb->protocol directly, but also parse and skip over any VLAN tags and
+return the inner protocol number instead.
+
+Also fix CE marking by implementing a version of INET_ECN_set_ce() that
+uses the same parsing routine.
+
+Fixes: ea82511518f4 ("sch_cake: Add NAT awareness to packet classifier")
+Fixes: b2100cc56fca ("sch_cake: Use tc_skb_protocol() helper for getting packet protocol")
+Fixes: 046f6fd5daef ("sched: Add Common Applications Kept Enhanced (cake) qdisc")
+Signed-off-by: Ilya Ponetayev <i.ponetaev@ndmsystems.com>
+[ squash original two patches, rewrite commit message ]
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+---
+ net/sched/sch_cake.c | 52 +++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 49 insertions(+), 3 deletions(-)
+
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -497,6 +497,52 @@ static bool cobalt_queue_empty(struct co
+ 	return down;
+ }
+ 
++static __be16 cake_skb_proto(const struct sk_buff *skb)
++{
++	unsigned int offset = skb_mac_offset(skb) + sizeof(struct ethhdr);
++	__be16 proto = skb->protocol;
++	struct vlan_hdr vhdr, *vh;
++
++	while (proto == htons(ETH_P_8021Q) || proto == htons(ETH_P_8021AD)) {
++		vh = skb_header_pointer(skb, offset, sizeof(vhdr), &vhdr);
++		if (!vh)
++			break;
++
++		proto = vh->h_vlan_encapsulated_proto;
++		offset += sizeof(vhdr);
++	}
++
++	return proto;
++}
++
++static int cake_set_ce(struct sk_buff *skb)
++{
++	int wlen = skb_network_offset(skb);
++
++	switch (cake_skb_proto(skb)) {
++	case htons(ETH_P_IP):
++		wlen += sizeof(struct iphdr);
++		if (!pskb_may_pull(skb, wlen) ||
++		    skb_try_make_writable(skb, wlen))
++			return 0;
++
++		return IP_ECN_set_ce(ip_hdr(skb));
++
++	case htons(ETH_P_IPV6):
++		wlen += sizeof(struct ipv6hdr);
++		if (!pskb_may_pull(skb, wlen) ||
++		    skb_try_make_writable(skb, wlen))
++			return 0;
++
++		return IP6_ECN_set_ce(skb, ipv6_hdr(skb));
++
++	default:
++		return 0;
++	}
++
++	return 0;
++}
++
+ /* Call this with a freshly dequeued packet for possible congestion marking.
+  * Returns true as an instruction to drop the packet, false for delivery.
+  */
+@@ -549,7 +595,7 @@ static bool cobalt_should_drop(struct co
+ 
+ 	if (next_due && vars->dropping) {
+ 		/* Use ECN mark if possible, otherwise drop */
+-		drop = !(vars->ecn_marked = INET_ECN_set_ce(skb));
++		drop = !(vars->ecn_marked = cake_set_ce(skb));
+ 
+ 		vars->count++;
+ 		if (!vars->count)
+@@ -592,7 +638,7 @@ static bool cake_update_flowkeys(struct
+ 	bool rev = !skb->_nfct, upd = false;
+ 	__be32 ip;
+ 
+-	if (tc_skb_protocol(skb) != htons(ETH_P_IP))
++	if (cake_skb_proto(skb) != htons(ETH_P_IP))
+ 		return false;
+ 
+ 	if (!nf_ct_get_tuple_skb(&tuple, skb))
+@@ -1557,7 +1603,7 @@ static u8 cake_handle_diffserv(struct sk
+ 	u16 *buf, buf_;
+ 	u8 dscp;
+ 
+-	switch (tc_skb_protocol(skb)) {
++	switch (cake_skb_proto(skb)) {
+ 	case htons(ETH_P_IP):
+ 		buf = skb_header_pointer(skb, offset, sizeof(buf_), &buf_);
+ 		if (unlikely(!buf))

From 8d7204e1ea8f3cce40fac0ff139cc0f4490b24f9 Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Wed, 1 Jul 2020 17:14:56 +0800
Subject: [PATCH 17/28] linux-firmware: add support for AMD Zen2 APU (renoir)
 firmware 20.10

---
 package/firmware/linux-firmware/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/firmware/linux-firmware/Makefile b/package/firmware/linux-firmware/Makefile
index 085cce422d..b50a025409 100644
--- a/package/firmware/linux-firmware/Makefile
+++ b/package/firmware/linux-firmware/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=linux-firmware
-PKG_VERSION:=20191215
+PKG_VERSION:=20200619
 PKG_RELEASE:=1
 
 PKG_SOURCE_URL:=@KERNEL/linux/kernel/firmware
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-PKG_HASH:=c2068ff4a797c0f2c3edbb9488f82a48bca8a995855ea21310a8346195c0ae56
+PKG_HASH:=962d3ae197d226c8259f9cc7746f7ef12a9d23787cd56bd27302021ba6339722
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 

From de00eff01a10f3a86ebdc0b905bba63997bb8a4d Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Wed, 1 Jul 2020 17:16:50 +0800
Subject: [PATCH 18/28] x64:add support for AMD Zen2 APU (renoir) DRM video
 engine

---
 target/linux/x86/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/linux/x86/Makefile b/target/linux/x86/Makefile
index 3f2a280618..5fa110684d 100644
--- a/target/linux/x86/Makefile
+++ b/target/linux/x86/Makefile
@@ -24,7 +24,7 @@ kmod-ath5k kmod-ath9k kmod-ath9k-htc kmod-ath10k kmod-rt2800-usb kmod-e1000e kmo
 htop lm-sensors autocore automount autosamba luci-app-ipsec-vpnd luci-proto-bonding luci-app-unblockmusic luci-app-zerotier luci-app-xlnetacc ddns-scripts_aliyun ddns-scripts_dnspod ca-certificates \
 ath10k-firmware-qca988x ath10k-firmware-qca9888 ath10k-firmware-qca9984 brcmfmac-firmware-43602a1-pcie \
 kmod-sound-hda-core kmod-sound-hda-codec-realtek kmod-sound-hda-codec-via kmod-sound-via82xx kmod-sound-hda-intel kmod-sound-hda-codec-hdmi kmod-sound-i8x0 kmod-usb-audio \
-kmod-usb-net kmod-usb-net-asix kmod-usb-net-asix-ax88179 kmod-usb-net-rtl8150 kmod-usb-net-rtl8152 kmod-r8168 kmod-mlx4-core kmod-mlx5-core
+kmod-usb-net kmod-usb-net-asix kmod-usb-net-asix-ax88179 kmod-usb-net-rtl8150 kmod-usb-net-rtl8152 kmod-r8168 kmod-mlx4-core kmod-mlx5-core kmod-drm-amdgpu
 
 $(eval $(call BuildTarget))
 

From 6e14ee33cdc71dd756609fa635c6fa2140fec09c Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Wed, 1 Jul 2020 18:29:47 +0800
Subject: [PATCH 19/28] kernel: Remove chash.ko from kmod-drm-amdgpu

---
 package/kernel/linux/modules/video.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/kernel/linux/modules/video.mk b/package/kernel/linux/modules/video.mk
index c17aed7613..363000e821 100644
--- a/package/kernel/linux/modules/video.mk
+++ b/package/kernel/linux/modules/video.mk
@@ -285,7 +285,7 @@ define KernelPackage/drm-amdgpu
 	CONFIG_DEBUG_KERNEL_DC=n
   FILES:=$(LINUX_DIR)/drivers/gpu/drm/amd/amdgpu/amdgpu.ko \
 	$(LINUX_DIR)/drivers/gpu/drm/scheduler/gpu-sched.ko@ge4.15 \
-	$(LINUX_DIR)/drivers/gpu/drm/amd/lib/chash.ko@lt5.3
+	$(LINUX_DIR)/drivers/gpu/drm/amd/lib/chash.ko@ge4.15
   AUTOLOAD:=$(call AutoProbe,amdgpu)
 endef
 

From 77a8d007cf682ea0ff88538520218d304993248f Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Wed, 1 Jul 2020 19:26:58 +0800
Subject: [PATCH 20/28] shortcut-fe:added support for Linux kernel 4.19

---
 package/kernel/linux/modules/video.mk         |   1 +
 package/lean/luci-app-flowoffload/Makefile    |   4 +-
 package/lean/luci-app-sfe/Makefile            |   4 +-
 target/linux/generic/config-4.19              |   1 +
 ...-linux-kernel-to-support-shortcut-fe.patch | 236 ++++++++++++++++++
 target/linux/ipq40xx/Makefile                 |   2 +-
 target/linux/x86/Makefile                     |   2 +-
 7 files changed, 244 insertions(+), 6 deletions(-)
 create mode 100644 target/linux/generic/hack-4.19/999-net-patch-linux-kernel-to-support-shortcut-fe.patch

diff --git a/package/kernel/linux/modules/video.mk b/package/kernel/linux/modules/video.mk
index 363000e821..a04ed351a0 100644
--- a/package/kernel/linux/modules/video.mk
+++ b/package/kernel/linux/modules/video.mk
@@ -282,6 +282,7 @@ define KernelPackage/drm-amdgpu
 	CONFIG_DRM_AMDGPU_SI=y \
 	CONFIG_DRM_AMDGPU_CIK=y \
 	CONFIG_DRM_AMD_DC=y \
+	CONFIG_HSA_AMD=y \
 	CONFIG_DEBUG_KERNEL_DC=n
   FILES:=$(LINUX_DIR)/drivers/gpu/drm/amd/amdgpu/amdgpu.ko \
 	$(LINUX_DIR)/drivers/gpu/drm/scheduler/gpu-sched.ko@ge4.15 \
diff --git a/package/lean/luci-app-flowoffload/Makefile b/package/lean/luci-app-flowoffload/Makefile
index 1152828d2a..a58f5c106a 100644
--- a/package/lean/luci-app-flowoffload/Makefile
+++ b/package/lean/luci-app-flowoffload/Makefile
@@ -6,10 +6,10 @@
 include $(TOPDIR)/rules.mk
 
 LUCI_TITLE:=LuCI support for Flow Offload
-LUCI_DEPENDS:=+kmod-ipt-offload +pdnsd-alt +kmod-tcp-bbr @LINUX_4_19
+LUCI_DEPENDS:=+kmod-ipt-offload +pdnsd-alt +kmod-tcp-bbr @LINUX_5_4
 LUCI_PKGARCH:=all
 PKG_VERSION:=1.0
-PKG_RELEASE:=16
+PKG_RELEASE:=19
 
 include $(TOPDIR)/feeds/luci/luci.mk
 
diff --git a/package/lean/luci-app-sfe/Makefile b/package/lean/luci-app-sfe/Makefile
index d57fc16f95..7320a83664 100644
--- a/package/lean/luci-app-sfe/Makefile
+++ b/package/lean/luci-app-sfe/Makefile
@@ -6,10 +6,10 @@
 include $(TOPDIR)/rules.mk
 
 LUCI_TITLE:=LuCI support for Turbo ACC (SFE)
-LUCI_DEPENDS:=+kmod-fast-classifier +pdnsd-alt +kmod-tcp-bbr @!LINUX_4_19
+LUCI_DEPENDS:=+kmod-fast-classifier +pdnsd-alt +kmod-tcp-bbr
 LUCI_PKGARCH:=all
 PKG_VERSION:=1.0
-PKG_RELEASE:=12
+PKG_RELEASE:=13
 
 include $(TOPDIR)/feeds/luci/luci.mk
 
diff --git a/target/linux/generic/config-4.19 b/target/linux/generic/config-4.19
index 864e082ebd..6bca820381 100644
--- a/target/linux/generic/config-4.19
+++ b/target/linux/generic/config-4.19
@@ -4577,6 +4577,7 @@ CONFIG_SERIAL_EARLYCON=y
 # CONFIG_SG_POOL is not set
 # CONFIG_SG_SPLIT is not set
 CONFIG_SHMEM=y
+# CONFIG_SHORTCUT_FE is not set
 # CONFIG_SH_ETH is not set
 # CONFIG_SH_TIMER_CMT is not set
 # CONFIG_SH_TIMER_MTU2 is not set
diff --git a/target/linux/generic/hack-4.19/999-net-patch-linux-kernel-to-support-shortcut-fe.patch b/target/linux/generic/hack-4.19/999-net-patch-linux-kernel-to-support-shortcut-fe.patch
new file mode 100644
index 0000000000..05f64b2869
--- /dev/null
+++ b/target/linux/generic/hack-4.19/999-net-patch-linux-kernel-to-support-shortcut-fe.patch
@@ -0,0 +1,236 @@
+--- a/include/linux/skbuff.h	2019-01-16 20:16:08.325745306 +0800
++++ b/include/linux/skbuff.h	2019-01-16 20:31:47.288028493 +0800
+@@ -783,6 +783,9 @@ struct sk_buff {
+ 	__u8			tc_from_ingress:1;
+ #endif
+ 	__u8			gro_skip:1;
++#ifdef CONFIG_SHORTCUT_FE
++	__u8			fast_forwarded:1;
++#endif
+ 
+ #ifdef CONFIG_NET_SCHED
+ 	__u16			tc_index;	/* traffic control index */
+--- a/include/linux/if_bridge.h	2019-01-16 20:51:47.871445535 +0800
++++ b/include/linux/if_bridge.h	2019-01-16 20:52:26.220269649 +0800
+@@ -54,6 +54,8 @@ struct br_ip_list {
+ #define BR_DEFAULT_AGEING_TIME	(300 * HZ)
+ 
+ extern void brioctl_set(int (*ioctl_hook)(struct net *, unsigned int, void __user *));
++extern void br_dev_update_stats(struct net_device *dev,
++				struct rtnl_link_stats64 *nlstats);
+ 
+ typedef int br_should_route_hook_t(struct sk_buff *skb);
+ extern br_should_route_hook_t __rcu *br_should_route_hook;
+--- a/include/linux/timer.h
++++ b/include/linux/timer.h
+@@ -20,6 +20,9 @@ struct timer_list {
+ 	void			(*function)(unsigned long);
+ 	unsigned long		data;
+ 	u32			flags;
++#ifdef CONFIG_SHORTCUT_FE
++	unsigned long		cust_data;
++#endif
+ 
+ #ifdef CONFIG_LOCKDEP
+ 	struct lockdep_map	lockdep_map;
+--- a/net/Kconfig	2019-01-16 20:36:30.266465286 +0800
++++ b/net/Kconfig	2019-01-16 20:36:41.980609067 +0800
+@@ -463,3 +463,6 @@ config HAVE_CBPF_JIT
+ # Extended BPF JIT (eBPF)
+ config HAVE_EBPF_JIT
+ 	bool
++
++config SHORTCUT_FE
++	bool "Enables kernel network stack path for Shortcut  Forwarding Engine
+--- a/net/core/dev.c	2019-01-16 20:38:37.274933833 +0800
++++ b/net/core/dev.c	2019-01-16 20:44:07.773594898 +0800
+@@ -3001,8 +3001,17 @@ static int xmit_one(struct sk_buff *skb,
+ 	unsigned int len;
+ 	int rc;
+ 
++#ifdef CONFIG_SHORTCUT_FE
++	/* If this skb has been fast forwarded then we don't want it to
++	 * go to any taps (by definition we're trying to bypass them).
++	 */
++	if (!skb->fast_forwarded) {
++#endif
+ 	if (!list_empty(&ptype_all) || !list_empty(&dev->ptype_all))
+ 		dev_queue_xmit_nit(skb, dev);
++#ifdef CONFIG_SHORTCUT_FE
++	}
++#endif
+ 
+ #ifdef CONFIG_ETHERNET_PACKET_MANGLE
+ 	if (!dev->eth_mangle_tx ||
+@@ -4315,6 +4324,11 @@ void netdev_rx_handler_unregister(struct
+ }
+ EXPORT_SYMBOL_GPL(netdev_rx_handler_unregister);
+ 
++#ifdef CONFIG_SHORTCUT_FE
++int (*athrs_fast_nat_recv)(struct sk_buff *skb) __rcu __read_mostly;
++EXPORT_SYMBOL_GPL(athrs_fast_nat_recv);
++#endif
++
+ /*
+  * Limit the use of PFMEMALLOC reserves to those protocols that implement
+  * the special handling of PFMEMALLOC skbs.
+@@ -4362,6 +4376,9 @@ static int __netif_receive_skb_core(stru
+ 	bool deliver_exact = false;
+ 	int ret = NET_RX_DROP;
+ 	__be16 type;
++#ifdef CONFIG_SHORTCUT_FE
++	int (*fast_recv)(struct sk_buff *skb);
++#endif
+ 
+ 	net_timestamp_check(!netdev_tstamp_prequeue, skb);
+ 
+@@ -4388,6 +4405,16 @@ another_round:
+ 			goto out;
+ 	}
+ 
++#ifdef CONFIG_SHORTCUT_FE
++	fast_recv = rcu_dereference(athrs_fast_nat_recv);
++	if (fast_recv) {
++		if (fast_recv(skb)) {
++			ret = NET_RX_SUCCESS;
++			goto out;
++		}
++	}
++#endif
++
+ 	if (skb_skip_tc_classify(skb))
+ 		goto skip_classify;
+ 
+--- a/net/netfilter/nf_conntrack_proto_tcp.c	2019-01-16 20:47:40.886993297 +0800
++++ b/net/netfilter/nf_conntrack_proto_tcp.c	2019-01-16 20:48:57.700570104 +0800
+@@ -35,11 +35,17 @@
+ 
+ /* Do not check the TCP window for incoming packets  */
+ static int nf_ct_tcp_no_window_check __read_mostly = 1;
++#ifdef CONFIG_SHORTCUT_FE
++EXPORT_SYMBOL_GPL(nf_ct_tcp_no_window_check);
++#endif
+ 
+ /* "Be conservative in what you do,
+     be liberal in what you accept from others."
+     If it's non-zero, we mark only out of window RST segments as INVALID. */
+ static int nf_ct_tcp_be_liberal __read_mostly = 0;
++#ifdef CONFIG_SHORTCUT_FE
++EXPORT_SYMBOL_GPL(nf_ct_tcp_be_liberal);
++#endif
+ 
+ /* If it is set to zero, we disable picking up already established
+    connections. */
+--- a/net/bridge/br_if.c	2019-01-16 20:54:51.919367044 +0800
++++ b/net/bridge/br_if.c	2019-01-16 20:55:53.812401263 +0800
+@@ -653,3 +653,26 @@ void br_port_flags_change(struct net_bri
+ 	if (mask & BR_AUTO_MASK)
+ 		nbp_update_port_count(br);
+ }
++
++/* Update bridge statistics for bridge packets processed by offload engines */
++void br_dev_update_stats(struct net_device *dev,
++			 struct rtnl_link_stats64 *nlstats)
++{
++	struct net_bridge *br;
++	struct pcpu_sw_netstats *stats;
++
++	/* Is this a bridge? */
++	if (!(dev->priv_flags & IFF_EBRIDGE))
++		return;
++
++	br = netdev_priv(dev);
++	stats = this_cpu_ptr(br->stats);
++
++	u64_stats_update_begin(&stats->syncp);
++	stats->rx_packets += nlstats->rx_packets;
++	stats->rx_bytes += nlstats->rx_bytes;
++	stats->tx_packets += nlstats->tx_packets;
++	stats->tx_bytes += nlstats->tx_bytes;
++	u64_stats_update_end(&stats->syncp);
++}
++EXPORT_SYMBOL_GPL(br_dev_update_stats);
+--- a/net/netfilter/Kconfig	2019-01-16 21:07:34.543460920 +0800
++++ b/net/netfilter/Kconfig	2019-01-16 21:08:14.739465937 +0800
+@@ -146,6 +146,14 @@ config NF_CONNTRACK_TIMEOUT
+ 
+ 	  If unsure, say `N'.
+ 
++config NF_CONNTRACK_CHAIN_EVENTS
++	bool "Register multiple callbacks to ct events"
++	depends on NF_CONNTRACK_EVENTS
++	help
++	  Support multiple registrations.
++
++	  If unsure, say `N'.
++
+ config NF_CONNTRACK_TIMESTAMP
+ 	bool  'Connection tracking timestamping'
+ 	depends on NETFILTER_ADVANCED
+--- a/net/netfilter/nf_conntrack_ecache.c	2019-01-16 21:12:22.183462975 +0800
++++ b/net/netfilter/nf_conntrack_ecache.c	2019-01-16 21:26:10.379462031 +0800
+@@ -122,13 +125,17 @@ int nf_conntrack_eventmask_report(unsign
+ {
+ 	int ret = 0;
+ 	struct net *net = nf_ct_net(ct);
++#ifndef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
+ 	struct nf_ct_event_notifier *notify;
++#endif
+ 	struct nf_conntrack_ecache *e;
+ 
+ 	rcu_read_lock();
++#ifndef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
+ 	notify = rcu_dereference(net->ct.nf_conntrack_event_cb);
+ 	if (!notify)
+ 		goto out_unlock;
++#endif
+ 
+ 	e = nf_ct_ecache_find(ct);
+ 	if (!e)
+@@ -146,7 +153,12 @@ int nf_conntrack_eventmask_report(unsign
+ 		if (!((eventmask | missed) & e->ctmask))
+ 			goto out_unlock;
+ 
++#ifdef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
++		ret = atomic_notifier_call_chain(&net->ct.nf_conntrack_chain,
++			eventmask | missed, &item);
++#else
+ 		ret = notify->fcn(eventmask | missed, &item);
++#endif
+ 		if (unlikely(ret < 0 || missed)) {
+ 			spin_lock_bh(&ct->lock);
+ 			if (ret < 0) {
+@@ -179,15 +191,19 @@ void nf_ct_deliver_cached_events(struct
+ {
+ 	struct net *net = nf_ct_net(ct);
+ 	unsigned long events, missed;
++#ifndef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
+ 	struct nf_ct_event_notifier *notify;
++#endif
+ 	struct nf_conntrack_ecache *e;
+ 	struct nf_ct_event item;
+ 	int ret;
+ 
+ 	rcu_read_lock();
++#ifndef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
+ 	notify = rcu_dereference(net->ct.nf_conntrack_event_cb);
+ 	if (notify == NULL)
+ 		goto out_unlock;
++#endif
+ 
+ 	e = nf_ct_ecache_find(ct);
+ 	if (e == NULL)
+@@ -210,7 +226,13 @@ void nf_ct_deliver_cached_events(struct
+ 	item.portid = 0;
+ 	item.report = 0;
+ 
++#ifdef CONFIG_NF_CONNTRACK_CHAIN_EVENTS
++	ret = atomic_notifier_call_chain(&net->ct.nf_conntrack_chain,
++			events | missed,
++			&item);
++#else
+ 	ret = notify->fcn(events | missed, &item);
++#endif
+ 
+ 	if (likely(ret == 0 && !missed))
+ 		goto out_unlock;
\ No newline at end of file
diff --git a/target/linux/ipq40xx/Makefile b/target/linux/ipq40xx/Makefile
index d2696b771c..48a4bb9fe4 100644
--- a/target/linux/ipq40xx/Makefile
+++ b/target/linux/ipq40xx/Makefile
@@ -9,7 +9,7 @@ CPU_SUBTYPE:=neon-vfpv4
 MAINTAINER:=John Crispin <john@phrozen.org>
 
 # TODO: drop kmod-usb-dwc3-of-simple when migrating to 4.19
-KERNEL_PATCHVER:=4.14
+KERNEL_PATCHVER:=4.19
 
 KERNELNAME:=zImage Image dtbs
 
diff --git a/target/linux/x86/Makefile b/target/linux/x86/Makefile
index 5fa110684d..b95965f37d 100644
--- a/target/linux/x86/Makefile
+++ b/target/linux/x86/Makefile
@@ -13,7 +13,7 @@ FEATURES:=squashfs vdi vmdk pcmcia fpu
 SUBTARGETS:=64 generic zen legacy geode 
 MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 
-KERNEL_PATCHVER:=4.14
+KERNEL_PATCHVER:=4.19
 
 KERNELNAME:=bzImage
 

From 0c7fe2ad2540e842601693194f9f7fdc24feb118 Mon Sep 17 00:00:00 2001
From: asushugo <429632952@163.com>
Date: Wed, 1 Jul 2020 20:57:18 +0800
Subject: [PATCH 21/28] Bump redsocks2 to lastest version fix config error

---
 package/lean/redsocks2/Makefile               |   2 +-
 ...00-fix-compatible-with-openssl-1.1.x.patch | 315 ------------------
 ...extract-original-destination-address.patch |  15 -
 3 files changed, 1 insertion(+), 331 deletions(-)
 delete mode 100644 package/lean/redsocks2/patches/000-fix-compatible-with-openssl-1.1.x.patch
 delete mode 100644 package/lean/redsocks2/patches/001-fix-redudp-failing-to-extract-original-destination-address.patch

diff --git a/package/lean/redsocks2/Makefile b/package/lean/redsocks2/Makefile
index 5ca31b4964..51b73dff6a 100644
--- a/package/lean/redsocks2/Makefile
+++ b/package/lean/redsocks2/Makefile
@@ -15,7 +15,7 @@ PKG_RELEASE:=4
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/semigodking/redsocks.git
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=53cad23a14afdd5f61a0542615beb7f4d98be728
+PKG_SOURCE_VERSION:=d94c245ea47859cda5b4b7373308589206b97bdc
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MAINTAINER:=semigodking <semigodking@gmail.com>
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)/$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
diff --git a/package/lean/redsocks2/patches/000-fix-compatible-with-openssl-1.1.x.patch b/package/lean/redsocks2/patches/000-fix-compatible-with-openssl-1.1.x.patch
deleted file mode 100644
index aefbc21054..0000000000
--- a/package/lean/redsocks2/patches/000-fix-compatible-with-openssl-1.1.x.patch
+++ /dev/null
@@ -1,315 +0,0 @@
-diff --git a/encrypt.c b/encrypt.c
-index ce04c6f..dc27754 100644
---- a/encrypt.c
-+++ b/encrypt.c
-@@ -278,7 +278,7 @@ static void enc_table_init(enc_info * info, const char *pass)
-     }
- }
- 
--int cipher_iv_size(const cipher_kt_t *cipher)
-+int cipher_iv_size(const cipher_t *cipher)
- {
- #if defined(USE_CRYPTO_OPENSSL)
-     return EVP_CIPHER_iv_length(cipher);
-@@ -290,7 +290,7 @@ int cipher_iv_size(const cipher_kt_t *cipher)
- #endif
- }
- 
--int cipher_key_size(const cipher_kt_t *cipher)
-+int cipher_key_size(const cipher_t *cipher)
- {
- #if defined(USE_CRYPTO_OPENSSL)
-     return EVP_CIPHER_key_length(cipher);
-@@ -307,102 +307,66 @@ int cipher_key_size(const cipher_kt_t *cipher)
- #endif
- }
- 
--int bytes_to_key(const cipher_kt_t *cipher, const digest_type_t *md,
--                 const uint8_t *pass, uint8_t *key, uint8_t *iv)
-+int bytes_to_key(const cipher_t *cipher, const digest_type_t *md,
-+                 const uint8_t *pass, uint8_t *key)
- {
-     size_t datal;
-     datal = strlen((const char *)pass);
- #if defined(USE_CRYPTO_OPENSSL)
--    return EVP_BytesToKey(cipher, md, NULL, pass, datal, 1, key, iv);
-+    MD5_CTX c;
-+    unsigned char md_buf[MAX_MD_SIZE];
-+    int nkey;
-+    int addmd;
-+    unsigned int i, j, mds;
-+
-+    mds   = 16;
-+    if (pass == NULL) return nkey;
-+    memset(&c, 0, sizeof(MD5_CTX));
-+
-+    for (j = 0, addmd = 0; j < nkey; addmd++) {
-+        MD5_Init(&c);
-+        if (addmd) {
-+            MD5_Update(&c, md_buf, mds);
-+        }
-+        MD5_Update(&c, pass, datal);
-+        MD5_Final(md_buf, &c);
-+
-+        for (i = 0; i < mds; i++, j++) {
-+            if (j >= nkey) break;
-+            key[j] = md_buf[i];
-+        }
-+    }
-+    return nkey;
- #elif defined(USE_CRYPTO_POLARSSL)
-     md_context_t c;
-     unsigned char md_buf[MAX_MD_SIZE];
--    int niv;
-     int nkey;
-     int addmd;
--    unsigned int mds;
--    unsigned int i;
--    int rv;
-+    unsigned int i, j, mds;
- 
-     nkey = cipher_key_size(cipher);
--    niv = cipher_iv_size(cipher);
--    rv = nkey;
--    if (pass == NULL) {
--        return nkey;
--    }
--
-+    mds  = md_get_size(md);
-     memset(&c, 0, sizeof(md_context_t));
--    if (md_init_ctx(&c, md)) {
--        return 0;
--    }
--    addmd = 0;
--    mds = md_get_size(md);
--    for (;; ) {
--        int error;
--        do {
--            error = 1;
--            if (md_starts(&c)) {
--                break;
--            }
--            if (addmd) {
--                if (md_update(&c, &(md_buf[0]), mds)) {
--                    break;
--                }
--            } else {
--                addmd = 1;
--            }
--            if (md_update(&c, pass, datal)) {
--                break;
--            }
--            if (md_finish(&c, &(md_buf[0]))) {
--                break;
--            }
--            error = 0;
--        } while (0);
--        if (error) {
--            md_free_ctx(&c);
--            memset(md_buf, 0, MAX_MD_SIZE);
--            return 0;
--        }
- 
--        i = 0;
--        if (nkey) {
--            for (;; ) {
--                if (nkey == 0) {
--                    break;
--                }
--                if (i == mds) {
--                    break;
--                }
--                if (key != NULL) {
--                    *(key++) = md_buf[i];
--                }
--                nkey--;
--                i++;
--            }
--        }
--        if (niv && (i != mds)) {
--            for (;; ) {
--                if (niv == 0) {
--                    break;
--                }
--                if (i == mds) {
--                    break;
--                }
--                if (iv != NULL) {
--                    *(iv++) = md_buf[i];
--                }
--                niv--;
--                i++;
--            }
-+    if (pass == NULL) return nkey;
-+    if (md_init_ctx(&c, md)) return 0;
-+
-+    for (j = 0, addmd = 0; j < nkey; addmd++) {
-+        md_starts(&c);
-+        if (addmd) {
-+            md_update(&c, md_buf, mds);
-         }
--        if ((nkey == 0) && (niv == 0)) {
--            break;
-+        md_update(&c, pass, datal);
-+        md_finish(&c, md_buf);
-+
-+        for (i = 0; i < mds; i++, j++) {
-+            if (j >= nkey) break;
-+            key[j] = md_buf[i];
-         }
-     }
-+
-     md_free_ctx(&c);
--    memset(md_buf, 0, MAX_MD_SIZE);
--    return rv;
-+    return nkey;
- #endif
- }
- 
-@@ -472,7 +436,7 @@ int rand_bytes(uint8_t *output, int len)
- #endif
- }
- 
--const cipher_kt_t *get_cipher_type(int method)
-+const cipher_t *get_cipher_type(int method)
- {
-     if (method <= TABLE || method >= CIPHER_NUM) {
-         //LOGE("get_cipher_type(): Illegal method");
-@@ -548,7 +512,7 @@ static int cipher_context_init(const enc_info * info, cipher_ctx_t *ctx, int enc
- #endif
- 
-     cipher_evp_t *evp = &ctx->evp;
--    const cipher_kt_t *cipher = get_cipher_type(method);
-+    const cipher_t *cipher = get_cipher_type(method);
- #if defined(USE_CRYPTO_OPENSSL)
-     if (cipher == NULL) {
-         // Cipher is not found in OpenSSL library
-@@ -560,7 +524,7 @@ static int cipher_context_init(const enc_info * info, cipher_ctx_t *ctx, int enc
-         return -1; 
-     }
-     if (!EVP_CIPHER_CTX_set_key_length(evp, info->key_len)) {
--        EVP_CIPHER_CTX_cleanup(evp);
-+        EVP_CIPHER_CTX_free(ctx->evp);
-         // Invalid key length
-         return -1;
-     }
-@@ -649,7 +613,7 @@ static void cipher_context_set_iv(const enc_info * info, cipher_ctx_t *ctx, uint
-     }
- #if defined(USE_CRYPTO_OPENSSL)
-     if (!EVP_CipherInit_ex(evp, NULL, NULL, true_key, iv, enc)) {
--        EVP_CIPHER_CTX_cleanup(evp);
-+        EVP_CIPHER_CTX_free(ctx->evp);
-         //FATAL("Cannot set key and IV");
-     }
- #elif defined(USE_CRYPTO_POLARSSL)
-@@ -698,7 +662,7 @@ static void cipher_context_release(enc_info * info, cipher_ctx_t *ctx)
- 
-     cipher_evp_t *evp = &ctx->evp;
- #if defined(USE_CRYPTO_OPENSSL)
--    EVP_CIPHER_CTX_cleanup(evp);
-+    EVP_CIPHER_CTX_free(ctx->evp);
- #elif defined(USE_CRYPTO_POLARSSL)
-     cipher_free_ctx(evp);
- #endif
-@@ -730,7 +694,7 @@ static int cipher_context_update(cipher_ctx_t *ctx, uint8_t *output, int *olen,
- size_t ss_calc_buffer_size(struct enc_ctx * ctx, size_t ilen)
- {
-     int method = ctx->info->method;
--    const cipher_kt_t *cipher = get_cipher_type(method);
-+    const cipher_t *cipher = get_cipher_type(method);
- #if defined(USE_CRYPTO_OPENSSL)
-     if (ctx->init)
-         return ilen + EVP_CIPHER_block_size(cipher); 
-@@ -913,10 +877,7 @@ static int enc_key_init(enc_info * info, int method, const char *pass)
-     OpenSSL_add_all_algorithms();
- #endif
- 
--    uint8_t iv[MAX_IV_LENGTH];
--
--    cipher_kt_t *cipher = NULL;
--    cipher_kt_t cipher_info;
-+    cipher_t *cipher;
- 
- 
-     if (method == SALSA20 || method == CHACHA20) {
-@@ -924,11 +885,9 @@ static int enc_key_init(enc_info * info, int method, const char *pass)
-         if (sodium_init() == -1) {
-             //FATAL("Failed to initialize sodium");
-         }
--        // Fake cipher
--        cipher = (cipher_kt_t *)&cipher_info;
- #if defined(USE_CRYPTO_OPENSSL)
--        cipher->key_len = supported_ciphers_key_size[method];
--        cipher->iv_len = supported_ciphers_iv_size[method];
-+        cipher.key_len = supported_ciphers_key_size[method];
-+        cipher.iv_len = supported_ciphers_iv_size[method];
- #endif
- #if defined(USE_CRYPTO_POLARSSL)
-         cipher->base = NULL;
-@@ -937,7 +896,7 @@ static int enc_key_init(enc_info * info, int method, const char *pass)
- #endif
- */
-     } else {
--        cipher = (cipher_kt_t *)get_cipher_type(method);
-+        cipher = (cipher_t *)get_cipher_type(method);
-     }
- 
-     if (cipher == NULL) {
-@@ -947,7 +906,7 @@ static int enc_key_init(enc_info * info, int method, const char *pass)
-                 cipher_info.base = NULL;
-                 cipher_info.key_length = supported_ciphers_key_size[method] * 8;
-                 cipher_info.iv_size = supported_ciphers_iv_size[method];
--                cipher = (cipher_kt_t *)&cipher_info;
-+                cipher = (cipher_t *)&cipher_info;
-                 break;
-             }
- #endif
-@@ -959,7 +918,7 @@ static int enc_key_init(enc_info * info, int method, const char *pass)
-     if (md == NULL)
-         return -1;
- 
--    info->key_len = bytes_to_key(cipher, md, (const uint8_t *)pass, info->key, iv);
-+    info->key_len = bytes_to_key(&cipher, md, (const uint8_t *)pass, info->key);
-     if (info->key_len == 0) {
-         //FATAL("Cannot generate key and IV");
-         return -1;
-@@ -967,7 +926,7 @@ static int enc_key_init(enc_info * info, int method, const char *pass)
-     if (method == RC4_MD5) {
-         info->iv_len = 16;
-     } else {
--        info->iv_len = cipher_iv_size(cipher);
-+        info->iv_len = cipher_iv_size(&cipher);
-     }
-     info->method = method;
-     return method;
-diff --git a/encrypt.h b/encrypt.h
-index 61b3fc7..c3359d0 100644
---- a/encrypt.h
-+++ b/encrypt.h
-@@ -45,7 +45,7 @@
- #if defined(USE_CRYPTO_OPENSSL)
- 
- #include <openssl/evp.h>
--typedef EVP_CIPHER cipher_kt_t;
-+typedef EVP_CIPHER cipher_t;
- typedef EVP_CIPHER_CTX cipher_evp_t;
- typedef EVP_MD digest_type_t;
- #define MAX_KEY_LENGTH EVP_MAX_KEY_LENGTH
-@@ -56,7 +56,7 @@ typedef EVP_MD digest_type_t;
- 
- #include <polarssl/cipher.h>
- #include <polarssl/md.h>
--typedef cipher_info_t cipher_kt_t;
-+typedef cipher_info_t cipher_t;
- typedef cipher_context_t cipher_evp_t;
- typedef md_info_t digest_type_t;
- #define MAX_KEY_LENGTH 64
-@@ -89,7 +89,7 @@ typedef struct {
- #endif
- 
- typedef struct {
--    cipher_evp_t evp;
-+    cipher_evp_t *evp;
- #ifdef USE_CRYPTO_APPLECC
-     cipher_cc_t cc;
- #endif
diff --git a/package/lean/redsocks2/patches/001-fix-redudp-failing-to-extract-original-destination-address.patch b/package/lean/redsocks2/patches/001-fix-redudp-failing-to-extract-original-destination-address.patch
deleted file mode 100644
index a55f479346..0000000000
--- a/package/lean/redsocks2/patches/001-fix-redudp-failing-to-extract-original-destination-address.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/utils.c b/utils.c
-index 9fe148e..196a04e 100644
---- a/utils.c
-+++ b/utils.c
-@@ -62,7 +62,9 @@ int red_recv_udp_pkt(int fd, char *buf, size_t buflen, struct sockaddr_in *inadd
-             if (
-                 cmsg->cmsg_level == SOL_IP &&
-                 cmsg->cmsg_type == IP_ORIGDSTADDR &&
--                cmsg->cmsg_len >= CMSG_LEN(sizeof(*toaddr))
-+                (cmsg->cmsg_len == CMSG_LEN(sizeof(struct sockaddr_in))
-+                 || cmsg->cmsg_len == CMSG_LEN(sizeof(struct sockaddr_in6))) &&
-+                cmsg->cmsg_len <= CMSG_LEN(sizeof(*toaddr))
-             ) {
-                 struct sockaddr_in* cmsgaddr = (struct sockaddr_in*)CMSG_DATA(cmsg);
-                 memcpy(toaddr, cmsgaddr, sizeof(*toaddr));

From fce9e709ac13a71d8f8d6439f98573542d340bf1 Mon Sep 17 00:00:00 2001
From: Shimin Xiong <xsm19973@gmail.com>
Date: Wed, 1 Jul 2020 23:02:57 +0800
Subject: [PATCH 22/28] UnblockNeteaseMusicGo: bump version to 0.2.1

---
 package/lean/UnblockNeteaseMusicGo/Makefile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/lean/UnblockNeteaseMusicGo/Makefile b/package/lean/UnblockNeteaseMusicGo/Makefile
index e8c4dce478..cccc70ab93 100644
--- a/package/lean/UnblockNeteaseMusicGo/Makefile
+++ b/package/lean/UnblockNeteaseMusicGo/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=UnblockNeteaseMusicGo
-PKG_VERSION:=0.2.0
-PKG_RELEASE:=5
+PKG_VERSION:=0.2.1
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/cnsilvan/UnblockNeteaseMusic.git
-PKG_SOURCE_VERSION:=f70ddb140db4711f2b192b5ddcc6382829473a82
+PKG_SOURCE_VERSION:=7664b2b5c5dbe8e1ff7fde0c0051b4feabc0e0ba
 PKG_MAINTAINER:=Silvan <cnsilvan@gmail.com>
 
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)

From 36204c7110ea6365767722b55107ddbff7d0eaf6 Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Thu, 2 Jul 2020 00:55:25 +0800
Subject: [PATCH 23/28] IPSec: fix kernel modules

---
 package/kernel/kmod-sched-cake/Makefile       |  42 ++++++
 .../linux/files/sysctl-tcp-bbr-k4_9.conf      |   5 +
 package/kernel/linux/modules/block.mk         |   8 +-
 package/kernel/linux/modules/can.mk           |  17 ---
 package/kernel/linux/modules/crypto.mk        |  19 ++-
 package/kernel/linux/modules/fs.mk            |   4 +-
 package/kernel/linux/modules/hwmon.mk         |  62 +-------
 package/kernel/linux/modules/i2c.mk           |  25 ++--
 package/kernel/linux/modules/iio.mk           |  94 +++---------
 package/kernel/linux/modules/input.mk         |   3 +-
 package/kernel/linux/modules/lib.mk           |  23 ++-
 package/kernel/linux/modules/netdevices.mk    | 138 +++++------------
 package/kernel/linux/modules/netfilter.mk     |  17 +--
 package/kernel/linux/modules/netsupport.mk    |  77 ++++------
 package/kernel/linux/modules/other.mk         | 139 +++++-------------
 package/kernel/linux/modules/sound.mk         |   3 +-
 package/kernel/linux/modules/usb.mk           |  33 +++--
 package/kernel/linux/modules/video.mk         |  11 +-
 package/kernel/linux/modules/w1.mk            |   2 +-
 package/kernel/linux/modules/wireless.mk      |  24 ++-
 package/kernel/linux/modules/wpan.mk          |  11 +-
 21 files changed, 277 insertions(+), 480 deletions(-)
 create mode 100644 package/kernel/kmod-sched-cake/Makefile
 create mode 100644 package/kernel/linux/files/sysctl-tcp-bbr-k4_9.conf

diff --git a/package/kernel/kmod-sched-cake/Makefile b/package/kernel/kmod-sched-cake/Makefile
new file mode 100644
index 0000000000..91609637b5
--- /dev/null
+++ b/package/kernel/kmod-sched-cake/Makefile
@@ -0,0 +1,42 @@
+#
+# Copyright (C) 2016 LEDE
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=sched-cake
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://github.com/dtaht/sch_cake.git
+PKG_SOURCE_DATE:=2019-03-12
+PKG_SOURCE_VERSION:=057c738801e9dc64e8dd72a3fc4f50734214433c
+PKG_MIRROR_HASH:=5bf06a804824db36ae393fc174aeec7b12633176e05a765c0931b39df5bd34df
+PKG_MAINTAINER:=Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/sched-cake
+  SUBMENU:=Network Support
+  TITLE:=Cake fq_codel/blue derived shaper
+  URL:=https://github.com/dtaht/sch_cake
+  FILES:=$(PKG_BUILD_DIR)/sch_cake.ko
+  AUTOLOAD:=$(call AutoLoad,75,sch_cake)
+  DEPENDS:=+kmod-ipt-conntrack
+endef
+
+include $(INCLUDE_DIR)/kernel-defaults.mk
+
+define KernelPackage/sched-cake/description
+  Common Applications Kept Enhanced fq_codel/blue derived shaper
+endef
+
+define Build/Compile
+	$(KERNEL_MAKE) SUBDIRS="$(PKG_BUILD_DIR)" modules
+endef
+
+$(eval $(call KernelPackage,sched-cake))
\ No newline at end of file
diff --git a/package/kernel/linux/files/sysctl-tcp-bbr-k4_9.conf b/package/kernel/linux/files/sysctl-tcp-bbr-k4_9.conf
new file mode 100644
index 0000000000..2f63b72888
--- /dev/null
+++ b/package/kernel/linux/files/sysctl-tcp-bbr-k4_9.conf
@@ -0,0 +1,5 @@
+# Do not edit, changes to this file will be lost on upgrades
+# /etc/sysctl.conf can be used to customize sysctl settings
+
+net.ipv4.tcp_congestion_control=bbr
+net.core.default_qdisc=fq
diff --git a/package/kernel/linux/modules/block.mk b/package/kernel/linux/modules/block.mk
index b870304ad4..c486a433c2 100644
--- a/package/kernel/linux/modules/block.mk
+++ b/package/kernel/linux/modules/block.mk
@@ -38,7 +38,7 @@ $(eval $(call KernelPackage,ata-core))
 
 define AddDepends/ata
   SUBMENU:=$(BLOCK_MENU)
-  DEPENDS+=+kmod-ata-core $(1)
+  DEPENDS+=kmod-ata-core $(1)
 endef
 
 
@@ -117,13 +117,14 @@ $(eval $(call KernelPackage,ata-nvidia-sata))
 
 
 define KernelPackage/ata-pdc202xx-old
+  SUBMENU:=$(BLOCK_MENU)
   TITLE:=Older Promise PATA controller support
+  DEPENDS:=kmod-ata-core
   KCONFIG:= \
        CONFIG_ATA_SFF=y \
        CONFIG_PATA_PDC_OLD
   FILES:=$(LINUX_DIR)/drivers/ata/pata_pdc202xx_old.ko
   AUTOLOAD:=$(call AutoLoad,41,pata_pdc202xx_old,1)
-  $(call AddDepends/ata)
 endef
 
 define KernelPackage/ata-pdc202xx-old/description
@@ -208,6 +209,7 @@ $(eval $(call KernelPackage,block2mtd))
 define KernelPackage/dax
   SUBMENU:=$(BLOCK_MENU)
   TITLE:=DAX: direct access to differentiated memory
+  DEPENDS:=@!LINUX_4_9
   KCONFIG:=CONFIG_DAX
   FILES:=$(LINUX_DIR)/drivers/dax/dax.ko
 endef
@@ -218,7 +220,7 @@ $(eval $(call KernelPackage,dax))
 define KernelPackage/dm
   SUBMENU:=$(BLOCK_MENU)
   TITLE:=Device Mapper
-  DEPENDS:=+kmod-crypto-manager +kmod-dax
+  DEPENDS:=+kmod-crypto-manager +!LINUX_4_9:kmod-dax
   # All the "=n" are unnecessary, they're only there
   # to stop the config from asking the question.
   # MIRROR is M because I've needed it for pvmove.
diff --git a/package/kernel/linux/modules/can.mk b/package/kernel/linux/modules/can.mk
index 3bf0359c11..c2c7411c6e 100644
--- a/package/kernel/linux/modules/can.mk
+++ b/package/kernel/linux/modules/can.mk
@@ -146,23 +146,6 @@ endef
 $(eval $(call KernelPackage,can-gw))
 
 
-define KernelPackage/can-mcp251x
-  TITLE:=MCP251x SPI CAN controller
-  KCONFIG:=\
-	CONFIG_SPI=y \
-	CONFIG_CAN_MCP251X
-  FILES:=$(LINUX_DIR)/drivers/net/can/spi/mcp251x.ko
-  AUTOLOAD:=$(call AutoProbe,can-mcp251x)
-  $(call AddDepends/can)
-endef
-
-define KernelPackage/can-mcp251x/description
- Microchip MCP251x SPI CAN controller
-endef
-
-$(eval $(call KernelPackage,can-mcp251x))
-
-
 define KernelPackage/can-raw
   TITLE:=Raw CAN Protcol
   KCONFIG:=CONFIG_CAN_RAW
diff --git a/package/kernel/linux/modules/crypto.mk b/package/kernel/linux/modules/crypto.mk
index caad018d8f..60267f3c8e 100644
--- a/package/kernel/linux/modules/crypto.mk
+++ b/package/kernel/linux/modules/crypto.mk
@@ -132,7 +132,7 @@ $(eval $(call KernelPackage,crypto-crc32c))
 
 define KernelPackage/crypto-ctr
   TITLE:=Counter Mode CryptoAPI module
-  DEPENDS:=+kmod-crypto-manager +kmod-crypto-seqiv
+  DEPENDS:=+kmod-crypto-manager +kmod-crypto-seqiv +kmod-crypto-iv
   KCONFIG:=CONFIG_CRYPTO_CTR
   FILES:=$(LINUX_DIR)/crypto/ctr.ko
   AUTOLOAD:=$(call AutoLoad,09,ctr)
@@ -156,7 +156,7 @@ $(eval $(call KernelPackage,crypto-cts))
 
 define KernelPackage/crypto-deflate
   TITLE:=Deflate compression CryptoAPI module
-  DEPENDS:=+kmod-lib-zlib-inflate +kmod-lib-zlib-deflate +kmod-crypto-acompress
+  DEPENDS:=+kmod-lib-zlib-inflate +kmod-lib-zlib-deflate +!LINUX_4_9:kmod-crypto-acompress
   KCONFIG:=CONFIG_CRYPTO_DEFLATE
   FILES:=$(LINUX_DIR)/crypto/deflate.ko
   AUTOLOAD:=$(call AutoLoad,09,deflate)
@@ -311,7 +311,7 @@ $(eval $(call KernelPackage,crypto-hmac))
 
 define KernelPackage/crypto-hw-ccp
   TITLE:=AMD Cryptographic Coprocessor
-  DEPENDS:=+kmod-crypto-authenc +kmod-crypto-hash +kmod-crypto-manager +kmod-random-core +kmod-crypto-sha1 +kmod-crypto-sha256 +kmod-crypto-rsa
+  DEPENDS:=+kmod-crypto-authenc +kmod-crypto-hash +kmod-crypto-manager +kmod-random-core +kmod-crypto-sha1 +kmod-crypto-sha256 +!LINUX_4_9:kmod-crypto-rsa
   KCONFIG:= \
 	CONFIG_CRYPTO_HW=y \
 	CONFIG_CRYPTO_DEV_CCP=y \
@@ -416,6 +416,19 @@ endef
 
 $(eval $(call KernelPackage,crypto-hw-talitos))
 
+define KernelPackage/crypto-iv
+  TITLE:=CryptoAPI initialization vectors
+  DEPENDS:=+kmod-crypto-manager +kmod-crypto-rng +kmod-crypto-wq
+  KCONFIG:= CONFIG_CRYPTO_BLKCIPHER2
+  HIDDEN:=1
+  FILES:= \
+	$(LINUX_DIR)/crypto/eseqiv.ko@lt4.9 \
+	$(LINUX_DIR)/crypto/chainiv.ko@lt4.9
+  AUTOLOAD:=$(call AutoLoad,10,eseqiv chainiv)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-iv))
 
 define KernelPackage/crypto-kpp
   TITLE:=Key-agreement Protocol Primitives
diff --git a/package/kernel/linux/modules/fs.mk b/package/kernel/linux/modules/fs.mk
index 82f8685111..e0c33eed2a 100644
--- a/package/kernel/linux/modules/fs.mk
+++ b/package/kernel/linux/modules/fs.mk
@@ -68,7 +68,7 @@ $(eval $(call KernelPackage,fs-autofs4))
 define KernelPackage/fs-btrfs
   SUBMENU:=$(FS_MENU)
   TITLE:=BTRFS filesystem support
-  DEPENDS:=+kmod-lib-crc32c +kmod-lib-lzo +kmod-lib-zlib-inflate +kmod-lib-zlib-deflate +kmod-lib-raid6 +kmod-lib-xor +kmod-lib-zstd
+  DEPENDS:=+kmod-lib-crc32c +kmod-lib-lzo +kmod-lib-zlib-inflate +kmod-lib-zlib-deflate +kmod-lib-raid6 +kmod-lib-xor +!LINUX_4_9:kmod-lib-zstd
   KCONFIG:=\
 	CONFIG_BTRFS_FS \
 	CONFIG_BTRFS_FS_POSIX_ACL=n \
@@ -230,7 +230,7 @@ $(eval $(call KernelPackage,fs-ext4))
 define KernelPackage/fs-f2fs
   SUBMENU:=$(FS_MENU)
   TITLE:=F2FS filesystem support
-  DEPENDS:= +kmod-crypto-hash +kmod-crypto-crc32 +LINUX_5_4:kmod-nls-base
+  DEPENDS:= +kmod-crypto-hash +kmod-crypto-crc32
   KCONFIG:= \
 	CONFIG_F2FS_FS \
 	CONFIG_F2FS_STAT_FS=y \
diff --git a/package/kernel/linux/modules/hwmon.mk b/package/kernel/linux/modules/hwmon.mk
index 0b9e9d8b13..c0a477856e 100644
--- a/package/kernel/linux/modules/hwmon.mk
+++ b/package/kernel/linux/modules/hwmon.mk
@@ -26,23 +26,9 @@ $(eval $(call KernelPackage,hwmon-core))
 
 define AddDepends/hwmon
   SUBMENU:=$(HWMON_MENU)
-  DEPENDS:=+kmod-hwmon-core $(1)
+  DEPENDS:=kmod-hwmon-core $(1)
 endef
 
-define KernelPackage/hwmon-ad7418
-  TITLE:=AD741x monitoring support
-  KCONFIG:=CONFIG_SENSORS_AD7418
-  FILES:=$(LINUX_DIR)/drivers/hwmon/ad7418.ko
-  AUTOLOAD:=$(call AutoLoad,60,ad7418 ad7418)
-  $(call AddDepends/hwmon,+kmod-i2c-core)
-endef
-
-define KernelPackage/hwmon-ad7418/description
- Kernel module for Analog Devices AD7416, AD7417 and AD7418 temperature monitor chip
-endef
-
-$(eval $(call KernelPackage,hwmon-ad7418))
-
 define KernelPackage/hwmon-ads1015
   TITLE:=Texas Instruments ADS1015
   KCONFIG:= CONFIG_SENSORS_ADS1015
@@ -91,37 +77,6 @@ endef
 $(eval $(call KernelPackage,hwmon-adt7475))
 
 
-define KernelPackage/hwmon-dme1737
-  TITLE:=SMSC DME1737 and compatible monitoring support
-  KCONFIG:=CONFIG_SENSORS_DME1737
-  FILES:= \
-	$(LINUX_DIR)/drivers/hwmon/dme1737.ko
-  AUTOLOAD:=$(call AutoProbe,dme1737)
-  $(call AddDepends/hwmon,+kmod-i2c-core +kmod-hwmon-vid)
-endef
-
-define KernelPackage/hwmon-dme1737/description
- SMSC DME1737, SCH3112, SCH3114, SCH3116, SCH5027 monitoring support
-endef
-
-$(eval $(call KernelPackage,hwmon-dme1737))
-
-
-define KernelPackage/hwmon-drivetemp
-  TITLE:=Hard disk drives with temperature sensor
-  KCONFIG:=CONFIG_SENSORS_DRIVETEMP
-  FILES:=$(LINUX_DIR)/drivers/hwmon/drivetemp.ko
-  AUTOLOAD:=$(call AutoLoad,60,drivetemp)
-  $(call AddDepends/hwmon,+kmod-ata-core +kmod-scsi-core)
-endef
-
-define KernelPackage/hwmon-drivetemp/description
- Kernel module for Hard disk drives with temperature sensor
-endef
-
-$(eval $(call KernelPackage,hwmon-drivetemp))
-
-
 define KernelPackage/hwmon-gpiofan
   TITLE:=Generic GPIO FAN support
   KCONFIG:=CONFIG_SENSORS_GPIO_FAN
@@ -137,21 +92,6 @@ endef
 $(eval $(call KernelPackage,hwmon-gpiofan))
 
 
-define KernelPackage/hwmon-f71882fg
-  TITLE:=F71882FG compatible monitoring support
-  KCONFIG:=CONFIG_SENSORS_F71882FG
-  FILES:=$(LINUX_DIR)/drivers/hwmon/f71882fg.ko
-  AUTOLOAD:=$(call AutoProbe,f71882fg)
-  $(call AddDepends/hwmon,@TARGET_x86)
-endef
-
-define KernelPackage/hwmon-f71882fg/description
- Kernel module for hardware monitoring via many Fintek Super-IO chips.
-endef
-
-$(eval $(call KernelPackage,hwmon-f71882fg))
-
-
 define KernelPackage/hwmon-ina209
   TITLE:=INA209 monitoring support
   KCONFIG:=CONFIG_SENSORS_INA209
diff --git a/package/kernel/linux/modules/i2c.mk b/package/kernel/linux/modules/i2c.mk
index ca6463c81b..0b23b2439c 100644
--- a/package/kernel/linux/modules/i2c.mk
+++ b/package/kernel/linux/modules/i2c.mk
@@ -42,7 +42,7 @@ I2C_ALGOBIT_MODULES:= \
 define KernelPackage/i2c-algo-bit
   $(call i2c_defaults,$(I2C_ALGOBIT_MODULES),55)
   TITLE:=I2C bit-banging interfaces
-  DEPENDS:=+kmod-i2c-core
+  DEPENDS:=kmod-i2c-core
 endef
 
 define KernelPackage/i2c-algo-bit/description
@@ -58,7 +58,7 @@ I2C_ALGOPCA_MODULES:= \
 define KernelPackage/i2c-algo-pca
   $(call i2c_defaults,$(I2C_ALGOPCA_MODULES),55)
   TITLE:=I2C PCA 9564 interfaces
-  DEPENDS:=+kmod-i2c-core
+  DEPENDS:=kmod-i2c-core
 endef
 
 define KernelPackage/i2c-algo-pca/description
@@ -74,7 +74,7 @@ I2C_ALGOPCF_MODULES:= \
 define KernelPackage/i2c-algo-pcf
   $(call i2c_defaults,$(I2C_ALGOPCF_MODULES),55)
   TITLE:=I2C PCF 8584 interfaces
-  DEPENDS:=+kmod-i2c-core
+  DEPENDS:=kmod-i2c-core
 endef
 
 define KernelPackage/i2c-algo-pcf/description
@@ -107,7 +107,7 @@ I2C_I801_MODULES:= \
 define KernelPackage/i2c-i801
   $(call i2c_defaults,$(I2C_I801_MODULES),59)
   TITLE:=Intel I801 and compatible I2C interfaces
-  DEPENDS:=@PCI_SUPPORT @TARGET_x86 +kmod-i2c-core +kmod-i2c-smbus
+  DEPENDS:=@PCI_SUPPORT @TARGET_x86 kmod-i2c-core +kmod-i2c-smbus
 endef
 
 define KernelPackage/i2c-i801/description
@@ -132,7 +132,7 @@ I2C_MUX_MODULES:= \
 define KernelPackage/i2c-mux
   $(call i2c_defaults,$(I2C_MUX_MODULES),51)
   TITLE:=I2C bus multiplexing support
-  DEPENDS:=+kmod-i2c-core
+  DEPENDS:=kmod-i2c-core
 endef
 
 define KernelPackage/i2c-mux/description
@@ -147,7 +147,7 @@ I2C_MUX_GPIO_MODULES:= \
 define KernelPackage/i2c-mux-gpio
   $(call i2c_defaults,$(I2C_MUX_GPIO_MODULES),51)
   TITLE:=GPIO-based I2C mux/switches
-  DEPENDS:=+kmod-i2c-mux
+  DEPENDS:=kmod-i2c-mux
 endef
 
 define KernelPackage/i2c-mux-gpio/description
@@ -163,7 +163,7 @@ I2C_MUX_PCA9541_MODULES:= \
 define KernelPackage/i2c-mux-pca9541
   $(call i2c_defaults,$(I2C_MUX_PCA9541_MODULES),51)
   TITLE:=Philips PCA9541 I2C mux/switches
-  DEPENDS:=+kmod-i2c-mux
+  DEPENDS:=kmod-i2c-mux
 endef
 
 define KernelPackage/i2c-mux-pca9541/description
@@ -178,7 +178,7 @@ I2C_MUX_PCA954x_MODULES:= \
 define KernelPackage/i2c-mux-pca954x
   $(call i2c_defaults,$(I2C_MUX_PCA954x_MODULES),51)
   TITLE:=Philips PCA954x I2C mux/switches
-  DEPENDS:=+kmod-i2c-mux
+  DEPENDS:=kmod-i2c-mux
 endef
 
 define KernelPackage/i2c-mux-pca954x/description
@@ -194,7 +194,7 @@ I2C_PIIX4_MODULES:= \
 define KernelPackage/i2c-piix4
   $(call i2c_defaults,$(I2C_PIIX4_MODULES),59)
   TITLE:=Intel PIIX4 and compatible I2C interfaces
-  DEPENDS:=@PCI_SUPPORT @TARGET_x86 +kmod-i2c-core
+  DEPENDS:=@PCI_SUPPORT @TARGET_x86 kmod-i2c-core
 endef
 
 define KernelPackage/i2c-piix4/description
@@ -210,12 +210,13 @@ $(eval $(call KernelPackage,i2c-piix4))
 
 
 I2C_PXA_MODULES:= \
+  CONFIG_I2C_PXA_SLAVE=y \
   CONFIG_I2C_PXA:drivers/i2c/busses/i2c-pxa
 
 define KernelPackage/i2c-pxa
   $(call i2c_defaults,$(I2C_PXA_MODULES),50)
   TITLE:=Intel PXA I2C bus driver
-  DEPENDS:=+kmod-i2c-core
+  DEPENDS:=kmod-i2c-core
 endef
 
 define KernelPackage/i2c-pxa/description
@@ -231,7 +232,7 @@ I2C_SMBUS_MODULES:= \
 define KernelPackage/i2c-smbus
   $(call i2c_defaults,$(I2C_SMBUS_MODULES),58)
   TITLE:=SMBus-specific protocols helper
-  DEPENDS:=+kmod-i2c-core
+  DEPENDS:=kmod-i2c-core
 endef
 
 define KernelPackage/i2c-smbus/description
@@ -248,7 +249,7 @@ I2C_TINY_USB_MODULES:= \
 define KernelPackage/i2c-tiny-usb
   $(call i2c_defaults,$(I2C_TINY_USB_MODULES),59)
   TITLE:=I2C Tiny USB adaptor
-  DEPENDS:=@USB_SUPPORT +kmod-i2c-core +kmod-usb-core
+  DEPENDS:=@USB_SUPPORT kmod-i2c-core +kmod-usb-core
 endef
 
 define KernelPackage/i2c-tiny-usb/description
diff --git a/package/kernel/linux/modules/iio.mk b/package/kernel/linux/modules/iio.mk
index ab14e97a05..17ffdc3441 100644
--- a/package/kernel/linux/modules/iio.mk
+++ b/package/kernel/linux/modules/iio.mk
@@ -328,88 +328,20 @@ endef
 $(eval $(call KernelPackage,iio-st_accel))
 
 
-define KernelPackage/iio-st_accel-i2c
+define KernelPackage/iio-st_sensors-i2c
   SUBMENU:=$(IIO_MENU)
   TITLE:=STMicroelectronics accelerometer 3-Axis Driver (I2C)
   DEPENDS:=+kmod-iio-st_accel +kmod-i2c-core +kmod-regmap-i2c
   KCONFIG:= CONFIG_IIO_ST_ACCEL_I2C_3AXIS
-  FILES:= \
-	$(LINUX_DIR)/drivers/iio/accel/st_accel_i2c.ko \
-	$(LINUX_DIR)/drivers/iio/common/st_sensors/st_sensors_i2c.ko
-  AUTOLOAD:=$(call AutoLoad,56,st_accel_i2c)
+  FILES:=$(LINUX_DIR)/drivers/iio/common/st_sensors/st_sensors_i2c.ko
+  AUTOLOAD:=$(call AutoLoad,56,st_sensors_i2c)
 endef
 
-define KernelPackage/iio-st_accel-i2c/description
+define KernelPackage/iio-st_sensors-i2c/description
  This package adds support for STMicroelectronics I2C based accelerometers
 endef
 
-$(eval $(call KernelPackage,iio-st_accel-i2c))
-
-
-define KernelPackage/iio-st_accel-spi
-  SUBMENU:=$(IIO_MENU)
-  TITLE:=STMicroelectronics accelerometer 3-Axis Driver (SPI)
-  DEPENDS:=+kmod-iio-st_accel +kmod-regmap-spi
-  KCONFIG:= CONFIG_IIO_ST_ACCEL_SPI_3AXIS
-  FILES:= \
-	$(LINUX_DIR)/drivers/iio/accel/st_accel_spi.ko \
-	$(LINUX_DIR)/drivers/iio/common/st_sensors/st_sensors_spi.ko
-  AUTOLOAD:=$(call AutoLoad,56,st_accel_spi)
-endef
-
-define KernelPackage/iio-st_accel-spi/description
- This package adds support for STMicroelectronics SPI based accelerometers
-endef
-
-$(eval $(call KernelPackage,iio-st_accel-spi))
-
-
-define KernelPackage/iio-lsm6dsx
-  SUBMENU:=$(IIO_MENU)
-  DEPENDS:=+kmod-iio-core +kmod-iio-kfifo-buf +kmod-regmap-core
-  TITLE:=ST LSM6DSx driver for IMU MEMS sensors
-  KCONFIG:=CONFIG_IIO_ST_LSM6DSX
-  FILES:=$(LINUX_DIR)/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.ko
-  AUTOLOAD:=$(call AutoProbe,st_lsm6dsx)
-endef
-
-define KernelPackage/iio-lsm6dsx/description
- Support for the ST LSM6DSx and related IMU MEMS sensors.
-endef
-
-$(eval $(call KernelPackage,iio-lsm6dsx))
-
-
-define KernelPackage/iio-lsm6dsx-i2c
-  SUBMENU:=$(IIO_MENU)
-  DEPENDS:=+kmod-iio-lsm6dsx +kmod-i2c-core +kmod-regmap-i2c
-  TITLE:=ST LSM6DSx driver for IMU MEMS sensors (I2C)
-  KCONFIG:=CONFIG_IIO_ST_LSM6DSX
-  FILES:=$(LINUX_DIR)/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_i2c.ko
-  AUTOLOAD:=$(call AutoProbe,st_lsm6dsx-i2c)
-endef
-
-define KernelPackage/iio-lsm6dsx-i2c/description
- Support for the ST LSM6DSx and related IMU MEMS I2C sensors.
-endef
-
-$(eval $(call KernelPackage,iio-lsm6dsx-i2c))
-
-
-define KernelPackage/iio-lsm6dsx-spi
-  SUBMENU:=$(IIO_MENU)
-  DEPENDS:=+kmod-iio-lsm6dsx +kmod-regmap-spi
-  TITLE:=ST LSM6DSx driver for IMU MEMS sensors (SPI)
-  KCONFIG:=CONFIG_IIO_ST_LSM6DSX
-  FILES:=$(LINUX_DIR)/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_spi.ko
-  AUTOLOAD:=$(call AutoProbe,st_lsm6dsx-spi)
-endef
-
-define KernelPackage/iio-lsm6dsx-spi/description
- Support for the ST LSM6DSx and related IMU MEMS SPI sensors.
-endef
-
-$(eval $(call KernelPackage,iio-lsm6dsx-spi))
+$(eval $(call KernelPackage,iio-st_sensors-i2c))
 
 
 define KernelPackage/iio-sps30
@@ -428,6 +360,22 @@ endef
 $(eval $(call KernelPackage,iio-sps30))
 
 
+define KernelPackage/iio-st_sensors-spi
+  SUBMENU:=$(IIO_MENU)
+  TITLE:=STMicroelectronics accelerometer 3-Axis Driver (SPI)
+  DEPENDS:=+kmod-iio-st_accel +kmod-regmap-spi
+  KCONFIG:= CONFIG_IIO_ST_ACCEL_SPI_3AXIS
+  FILES:=$(LINUX_DIR)/drivers/iio/common/st_sensors/st_sensors_spi.ko
+  AUTOLOAD:=$(call AutoLoad,56,st_sensors_spi)
+endef
+
+define KernelPackage/iio-st_sensors-spi/description
+ This package adds support for STMicroelectronics SPI based accelerometers
+endef
+
+$(eval $(call KernelPackage,iio-st_sensors-spi))
+
+
 define KernelPackage/iio-tsl4531
   SUBMENU:=$(IIO_MENU)
   DEPENDS:=+kmod-i2c-core +kmod-iio-core
diff --git a/package/kernel/linux/modules/input.mk b/package/kernel/linux/modules/input.mk
index 0f6e4d507b..8c5eaf5549 100644
--- a/package/kernel/linux/modules/input.mk
+++ b/package/kernel/linux/modules/input.mk
@@ -181,8 +181,7 @@ define KernelPackage/input-touchscreen-ads7846
 	CONFIG_INPUT_TOUCHSCREEN=y \
 	CONFIG_TOUCHSCREEN_PROPERTIES=y \
 	CONFIG_TOUCHSCREEN_ADS7846
-  FILES:=$(LINUX_DIR)/drivers/input/touchscreen/ads7846.ko \
-	$(LINUX_DIR)/drivers/input/touchscreen/of_touchscreen.ko@ge5.4
+  FILES:=$(LINUX_DIR)/drivers/input/touchscreen/ads7846.ko
   AUTOLOAD:=$(call AutoProbe,ads7846)
 endef
 
diff --git a/package/kernel/linux/modules/lib.mk b/package/kernel/linux/modules/lib.mk
index e14c6b31c0..3e5a12e926 100644
--- a/package/kernel/linux/modules/lib.mk
+++ b/package/kernel/linux/modules/lib.mk
@@ -101,17 +101,17 @@ $(eval $(call KernelPackage,lib-crc32c))
 define KernelPackage/lib-lzo
   SUBMENU:=$(LIB_MENU)
   TITLE:=LZO support
-  DEPENDS:=+kmod-crypto-acompress
+  DEPENDS:=+!LINUX_4_9:kmod-crypto-acompress
   KCONFIG:= \
-	CONFIG_CRYPTO_LZO \
+	CONFIG_CRYPTO_LZO@ge4.9 \
 	CONFIG_LZO_COMPRESS \
 	CONFIG_LZO_DECOMPRESS
   HIDDEN:=1
   FILES:= \
-	$(LINUX_DIR)/crypto/lzo.ko \
+	$(LINUX_DIR)/crypto/lzo.ko@ge4.9 \
 	$(LINUX_DIR)/lib/lzo/lzo_compress.ko \
 	$(LINUX_DIR)/lib/lzo/lzo_decompress.ko
-  AUTOLOAD:=$(call AutoProbe,lzo lzo_compress lzo_decompress)
+  AUTOLOAD:=$(call AutoProbe,lzo@ge4.9 lzo_compress lzo_decompress)
 endef
 
 define KernelPackage/lib-lzo/description
@@ -146,17 +146,17 @@ $(eval $(call KernelPackage,lib-zstd))
 define KernelPackage/lib-lz4
   SUBMENU:=$(LIB_MENU)
   TITLE:=LZ4 support
-  DEPENDS:=+kmod-crypto-acompress
+  DEPENDS:=+!LINUX_4_9:kmod-crypto-acompress
   HIDDEN:=1
   KCONFIG:= \
-	CONFIG_CRYPTO_LZ4 \
+	CONFIG_CRYPTO_LZ4@ge4.9 \
 	CONFIG_LZ4_COMPRESS \
 	CONFIG_LZ4_DECOMPRESS
   FILES:= \
-	$(LINUX_DIR)/crypto/lz4.ko \
+	$(LINUX_DIR)/crypto/lz4.ko@ge4.9 \
 	$(LINUX_DIR)/lib/lz4/lz4_compress.ko \
 	$(LINUX_DIR)/lib/lz4/lz4_decompress.ko
-  AUTOLOAD:=$(call AutoProbe,lz4 lz4_compress lz4_decompress)
+  AUTOLOAD:=$(call AutoProbe,lz4@ge4.9 lz4_compress lz4_decompress)
 endef
 
 define KernelPackage/lib-lz4/description
@@ -187,10 +187,10 @@ define KernelPackage/lib-xor
   TITLE:=XOR blocks algorithm support
   HIDDEN:=1
   KCONFIG:=CONFIG_XOR_BLOCKS
-ifneq ($(wildcard $(LINUX_DIR)/arch/$(LINUX_KARCH)/lib/xor-neon.ko),)
+ifneq ($(wildcard $(LINUX_DIR)/arch/arm/lib/xor-neon.ko),)
   FILES:= \
     $(LINUX_DIR)/crypto/xor.ko \
-    $(LINUX_DIR)/arch/$(LINUX_KARCH)/lib/xor-neon.ko
+    $(LINUX_DIR)/arch/arm/lib/xor-neon.ko
   AUTOLOAD:=$(call AutoProbe,xor-neon xor)
 else
   FILES:=$(LINUX_DIR)/crypto/xor.ko
@@ -251,8 +251,7 @@ define KernelPackage/lib-cordic
   SUBMENU:=$(LIB_MENU)
   TITLE:=Cordic function support
   KCONFIG:=CONFIG_CORDIC
-  FILES:=$(LINUX_DIR)/lib/cordic.ko@lt5.2 \
-	  $(LINUX_DIR)/lib/math/cordic.ko@ge5.2
+  FILES:=$(LINUX_DIR)/lib/cordic.ko
   AUTOLOAD:=$(call AutoProbe,cordic)
 endef
 
diff --git a/package/kernel/linux/modules/netdevices.mk b/package/kernel/linux/modules/netdevices.mk
index e95d84fda8..271edae71f 100644
--- a/package/kernel/linux/modules/netdevices.mk
+++ b/package/kernel/linux/modules/netdevices.mk
@@ -107,22 +107,6 @@ endef
 
 $(eval $(call KernelPackage,libphy))
 
-
-define KernelPackage/phylink
-  SUBMENU:=$(NETWORK_DEVICES_MENU)
-  TITLE:=Model for MAC to optional PHY connection
-  KCONFIG:=CONFIG_PHYLINK
-  FILES:=$(LINUX_DIR)/drivers/net/phy/phylink.ko
-  AUTOLOAD:=$(call AutoLoad,15,phylink,1)
-endef
-
-define KernelPackage/phylink/description
- Model for MAC to optional PHY connection
-endef
-
-$(eval $(call KernelPackage,phylink))
-
-
 define KernelPackage/mii
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=MII library
@@ -208,23 +192,6 @@ endef
 $(eval $(call KernelPackage,phy-broadcom))
 
 
-define KernelPackage/phy-bcm84881
-   SUBMENU:=$(NETWORK_DEVICES_MENU)
-   TITLE:=Broadcom BCM84881 PHY driver
-   KCONFIG:=CONFIG_BCM84881_PHY
-   DEPENDS:=+kmod-libphy
-   FILES:=$(LINUX_DIR)/drivers/net/phy/bcm84881.ko
-   AUTOLOAD:=$(call AutoLoad,18,bcm84881,1)
-endef
-
-define KernelPackage/phy-bcm84881/description
-   Supports the Broadcom 84881 PHY.
-endef
-
-$(eval $(call KernelPackage,phy-bcm84881))
-
-
-
 define KernelPackage/phy-realtek
    SUBMENU:=$(NETWORK_DEVICES_MENU)
    TITLE:=Realtek Ethernet PHY driver
@@ -256,36 +223,6 @@ endef
 
 $(eval $(call KernelPackage,swconfig))
 
-define KernelPackage/switch-bcm53xx
-  SUBMENU:=$(NETWORK_DEVICES_MENU)
-  TITLE:=Broadcom bcm53xx switch support
-  DEPENDS:=+kmod-swconfig
-  KCONFIG:=CONFIG_SWCONFIG_B53
-  FILES:=$(LINUX_DIR)/drivers/net/phy/b53/b53_common.ko
-  AUTOLOAD:=$(call AutoLoad,42,b53_common)
-endef
-
-define KernelPackage/switch-bcm53xx/description
-  Broadcom bcm53xx switch support
-endef
-
-$(eval $(call KernelPackage,switch-bcm53xx))
-
-define KernelPackage/switch-bcm53xx-mdio
-  SUBMENU:=$(NETWORK_DEVICES_MENU)
-  TITLE:=Broadcom bcm53xx switch MDIO support
-  DEPENDS:=+kmod-switch-bcm53xx
-  KCONFIG:=CONFIG_SWCONFIG_B53_PHY_DRIVER
-  FILES:=$(LINUX_DIR)/drivers/net/phy/b53/b53_mdio.ko
-  AUTOLOAD:=$(call AutoLoad,42,b53_mdio)
-endef
-
-define KernelPackage/switch-bcm53xx-mdio/description
-  Broadcom bcm53xx switch MDIO support
-endef
-
-$(eval $(call KernelPackage,switch-bcm53xx-mdio))
-
 define KernelPackage/switch-mvsw61xx
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Marvell 88E61xx switch support
@@ -339,7 +276,7 @@ define KernelPackage/switch-rtl8366-smi
   DEPENDS:=@GPIO_SUPPORT +kmod-swconfig +(TARGET_armvirt||TARGET_bcm27xx_bcm2708||TARGET_samsung||TARGET_tegra):kmod-of-mdio
   KCONFIG:=CONFIG_RTL8366_SMI
   FILES:=$(LINUX_DIR)/drivers/net/phy/rtl8366_smi.ko
-  AUTOLOAD:=$(call AutoLoad,42,rtl8366_smi,1)
+  AUTOLOAD:=$(call AutoLoad,42,rtl8366_smi)
 endef
 
 define KernelPackage/switch-rtl8366-smi/description
@@ -387,7 +324,7 @@ define KernelPackage/switch-rtl8367b
   DEPENDS:=+kmod-switch-rtl8366-smi
   KCONFIG:=CONFIG_RTL8367B_PHY
   FILES:=$(LINUX_DIR)/drivers/net/phy/rtl8367b.ko
-  AUTOLOAD:=$(call AutoLoad,43,rtl8367b,1)
+  AUTOLOAD:=$(call AutoLoad,43,rtl8367b)
 endef
 
 define KernelPackage/switch-rtl8367b/description
@@ -557,7 +494,7 @@ $(eval $(call KernelPackage,8139cp))
 define KernelPackage/r8169
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=RealTek RTL-8169 PCI Gigabit Ethernet Adapter kernel support
-  DEPENDS:=@PCI_SUPPORT +kmod-mii +r8169-firmware +!LINUX_4_14:kmod-phy-realtek
+  DEPENDS:=@PCI_SUPPORT +kmod-mii +r8169-firmware +LINUX_4_19:kmod-phy-realtek
   KCONFIG:=CONFIG_R8169 \
     CONFIG_R8169_NAPI=y \
     CONFIG_R8169_VLAN=n
@@ -682,7 +619,7 @@ $(eval $(call KernelPackage,igbvf))
 define KernelPackage/ixgbe
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Intel(R) 82598/82599 PCI-Express 10 Gigabit Ethernet support
-  DEPENDS:=@PCI_SUPPORT +kmod-mdio +kmod-ptp +kmod-hwmon-core +LINUX_5_4:kmod-libphy
+  DEPENDS:=@PCI_SUPPORT +kmod-mdio +kmod-ptp +kmod-hwmon-core
   KCONFIG:=CONFIG_IXGBE \
     CONFIG_IXGBE_VXLAN=n \
     CONFIG_IXGBE_HWMON=y \
@@ -716,15 +653,12 @@ endef
 
 $(eval $(call KernelPackage,ixgbevf))
 
-
 define KernelPackage/i40e
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Intel(R) Ethernet Controller XL710 Family support
-  DEPENDS:=@PCI_SUPPORT +kmod-mdio +kmod-ptp +kmod-hwmon-core +LINUX_5_4:kmod-libphy
+  DEPENDS:=@PCI_SUPPORT +kmod-mdio +kmod-ptp +kmod-hwmon-core
   KCONFIG:=CONFIG_I40E \
-    CONFIG_I40E_VXLAN=n \
-    CONFIG_I40E_HWMON=y \
-    CONFIG_I40E_DCA=n
+    CONFIG_I40E_DCB=n
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/intel/i40e/i40e.ko
   AUTOLOAD:=$(call AutoProbe,i40e)
 endef
@@ -736,33 +670,26 @@ endef
 $(eval $(call KernelPackage,i40e))
 
 
-define KernelPackage/iavf
+define KernelPackage/i40evf
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Intel(R) Ethernet Adaptive Virtual Function support
-  DEPENDS:=@PCI_SUPPORT
-  KCONFIG:= \
-       CONFIG_I40EVF \
-       CONFIG_IAVF
-  FILES:= \
-       $(LINUX_DIR)/drivers/net/ethernet/intel/i40evf/i40evf.ko@lt4.20 \
-       $(LINUX_DIR)/drivers/net/ethernet/intel/iavf/iavf.ko@ge4.20
-  AUTOLOAD:=$(call AutoProbe,i40evf iavf)
-  AUTOLOAD:=$(call AutoProbe,iavf)
+  DEPENDS:=@PCI_SUPPORT +kmod-i40e
+  KCONFIG:=CONFIG_I40EVF
+  FILES:=$(LINUX_DIR)/drivers/net/ethernet/intel/i40evf/i40evf.ko
+  AUTOLOAD:=$(call AutoProbe,i40evf)
 endef
 
-define KernelPackage/iavf/description
- Kernel modules for Intel XL710,
-	  X710, X722, XXV710, and all devices advertising support for
-	  Intel Ethernet Adaptive Virtual Function devices.
+define KernelPackage/i40evf/description
+ Kernel modules for Intel(R) Ethernet Controller XL710 Family Virtual Function Ethernet adapters.
 endef
 
-$(eval $(call KernelPackage,iavf))
+$(eval $(call KernelPackage,i40evf))
 
 
 define KernelPackage/b44
   TITLE:=Broadcom 44xx driver
   KCONFIG:=CONFIG_B44
-  DEPENDS:=@PCI_SUPPORT @!TARGET_bcm47xx_mips74k +!TARGET_bcm47xx:kmod-ssb +kmod-mii +kmod-libphy
+  DEPENDS:=@PCI_SUPPORT @!TARGET_brcm47xx_mips74k +!TARGET_brcm47xx:kmod-ssb +kmod-mii +kmod-libphy
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/broadcom/b44.ko
   AUTOLOAD:=$(call AutoLoad,19,b44,1)
@@ -817,7 +744,7 @@ define KernelPackage/tg3
   TITLE:=Broadcom Tigon3 Gigabit Ethernet
   KCONFIG:=CONFIG_TIGON3 \
 	CONFIG_TIGON3_HWMON=n
-  DEPENDS:=+!TARGET_bcm47xx:kmod-libphy +kmod-ptp
+  DEPENDS:=+!TARGET_brcm47xx:kmod-libphy +LINUX_4_9:kmod-hwmon-core +kmod-ptp
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/broadcom/tg3.ko
   AUTOLOAD:=$(call AutoLoad,19,tg3,1)
@@ -867,7 +794,7 @@ $(eval $(call KernelPackage,hfcmulti))
 define KernelPackage/gigaset
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Siemens Gigaset support for isdn4linux
-  DEPENDS:=@USB_SUPPORT +kmod-isdn4linux +kmod-lib-crc-ccitt +kmod-usb-core @!LINUX_5_4
+  DEPENDS:=@USB_SUPPORT +kmod-isdn4linux +kmod-lib-crc-ccitt +kmod-usb-core
   URL:=http://gigaset307x.sourceforge.net/
   KCONFIG:= \
     CONFIG_ISDN_DRV_GIGASET \
@@ -985,7 +912,6 @@ define KernelPackage/ifb
 	CONFIG_NET_CLS=y
   FILES:=$(LINUX_DIR)/drivers/net/ifb.ko
   AUTOLOAD:=$(call AutoLoad,34,ifb)
-  MODPARAMS.ifb:=numifbs=0
 endef
 
 define KernelPackage/ifb/description
@@ -1034,7 +960,7 @@ define KernelPackage/of-mdio
   DEPENDS:=+kmod-libphy
   KCONFIG:=CONFIG_OF_MDIO
   FILES:= \
-	$(LINUX_DIR)/drivers/net/phy/fixed_phy.ko \
+	$(LINUX_DIR)/drivers/net/phy/fixed_phy.ko@ge4.9 \
 	$(LINUX_DIR)/drivers/of/of_mdio.ko
   AUTOLOAD:=$(call AutoLoad,41,of_mdio)
 endef
@@ -1200,22 +1126,24 @@ endef
 
 $(eval $(call KernelPackage,mlx5-core))
 
-
-define KernelPackage/sfp
+define KernelPackage/sfc
   SUBMENU:=$(NETWORK_DEVICES_MENU)
-  TITLE:=SFP cage support
-  DEPENDS:=+kmod-i2c-core +kmod-hwmon-core +kmod-phylink
+  TITLE:=Solarflare SFC9000/SFC9100-family 10Gbps NIC support
+  DEPENDS:=@PCI_SUPPORT +kmod-mdio +kmod-i2c-core +kmod-i2c-algo-bit +kmod-hwmon-core +kmod-ptp +kmod-lib-crc32c
+# add PCI_IOV
   KCONFIG:= \
-	CONFIG_SFP \
-	CONFIG_MDIO_I2C
-  FILES:= \
-	$(LINUX_DIR)/drivers/net/phy/sfp.ko \
-	$(LINUX_DIR)/drivers/net/phy/mdio-i2c.ko
-  AUTOLOAD:=$(call AutoProbe,mdio-i2c sfp)
+    CONFIG_NET_VENDOR_SOLARFLARE=y \
+    CONFIG_SFC=y \
+    CONFIG_SFC_MTD=y \
+    CONFIG_MCDI_MON=y \
+    CONFIG_SFC_SRIOV=n \
+    CONFIG_SFC_MCDI_LOGGING=n \
+  FILES:=$(LINUX_DIR)/drivers/net/ethernet/sfc/sfc.ko
+  AUTOLOAD:=$(call AutoProbe, sfc)
 endef
 
-define KernelPackage/sfp/description
- Kernel module to support SFP cages
+define KernelPackage/sfc/description
+  Solarflare SFC9000/SFC9100-family 10Gbps NIC support
 endef
 
-$(eval $(call KernelPackage,sfp))
+$(eval $(call KernelPackage,sfc))
diff --git a/package/kernel/linux/modules/netfilter.mk b/package/kernel/linux/modules/netfilter.mk
index 5a3d490173..cc4c5ecb2a 100644
--- a/package/kernel/linux/modules/netfilter.mk
+++ b/package/kernel/linux/modules/netfilter.mk
@@ -137,7 +137,7 @@ define KernelPackage/nf-nat6
   SUBMENU:=$(NF_MENU)
   TITLE:=Netfilter IPV6-NAT
   KCONFIG:=$(KCONFIG_NF_NAT6)
-  DEPENDS:=@IPV6 +kmod-nf-conntrack6 +kmod-nf-nat
+  DEPENDS:=+kmod-nf-conntrack6 +kmod-nf-nat
   FILES:=$(foreach mod,$(NF_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT6-m)))
 endef
@@ -152,7 +152,7 @@ define KernelPackage/nf-flow
 	CONFIG_NETFILTER_INGRESS=y \
 	CONFIG_NF_FLOW_TABLE \
 	CONFIG_NF_FLOW_TABLE_HW
-  DEPENDS:=+kmod-nf-conntrack
+  DEPENDS:=+kmod-nf-conntrack @!LINUX_4_9
   FILES:= \
 	$(LINUX_DIR)/net/netfilter/nf_flow_table.ko \
 	$(LINUX_DIR)/net/netfilter/nf_flow_table_hw.ko
@@ -471,7 +471,6 @@ $(eval $(call KernelPackage,ipt-raw))
 
 define KernelPackage/ipt-raw6
   TITLE:=Netfilter IPv6 raw table support
-  DEPENDS:=@IPV6
   KCONFIG:=CONFIG_IP6_NF_RAW
   FILES:=$(LINUX_DIR)/net/ipv6/netfilter/ip6table_raw.ko
   AUTOLOAD:=$(call AutoProbe,ip6table_raw)
@@ -483,7 +482,6 @@ $(eval $(call KernelPackage,ipt-raw6))
 
 define KernelPackage/ipt-nat6
   TITLE:=IPv6 NAT targets
-  DEPENDS:=@IPV6
   KCONFIG:=$(KCONFIG_IPT_NAT6)
   FILES:=$(foreach mod,$(IPT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_NAT6-m)))
@@ -542,7 +540,7 @@ define KernelPackage/nf-nathelper-extra
   KCONFIG:=$(KCONFIG_NF_NATHELPER_EXTRA)
   FILES:=$(foreach mod,$(NF_NATHELPER_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NATHELPER_EXTRA-m)))
-  DEPENDS:=+kmod-nf-nat +kmod-lib-textsearch +kmod-ipt-raw +!LINUX_4_14:kmod-asn1-decoder
+  DEPENDS:=+kmod-nf-nat +kmod-lib-textsearch +kmod-ipt-raw +LINUX_4_19:kmod-asn1-decoder
 endef
 
 define KernelPackage/nf-nathelper-extra/description
@@ -808,7 +806,7 @@ $(eval $(call KernelPackage,ipt-physdev))
 define KernelPackage/ip6tables
   SUBMENU:=$(NF_MENU)
   TITLE:=IPv6 modules
-  DEPENDS:=@IPV6 +kmod-nf-reject6 +kmod-nf-ipt6 +kmod-ipt-core
+  DEPENDS:=+kmod-nf-reject6 +kmod-nf-ipt6 +kmod-ipt-core
   KCONFIG:=$(KCONFIG_IPT_IPV6)
   FILES:=$(foreach mod,$(IPT_IPV6-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoLoad,42,$(notdir $(IPT_IPV6-m)))
@@ -823,7 +821,7 @@ $(eval $(call KernelPackage,ip6tables))
 define KernelPackage/ip6tables-extra
   SUBMENU:=$(NF_MENU)
   TITLE:=Extra IPv6 modules
-  DEPENDS:=@IPV6 +kmod-ip6tables
+  DEPENDS:=+kmod-ip6tables
   KCONFIG:=$(KCONFIG_IPT_IPV6_EXTRA)
   FILES:=$(foreach mod,$(IPT_IPV6_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_IPV6_EXTRA-m)))
@@ -913,7 +911,6 @@ $(eval $(call KernelPackage,ebtables-ipv4))
 
 define KernelPackage/ebtables-ipv6
   TITLE:=ebtables: IPv6 support
-  DEPENDS:=@IPV6
   FILES:=$(foreach mod,$(EBTABLES_IP6-m),$(LINUX_DIR)/net/$(mod).ko)
   KCONFIG:=$(KCONFIG_EBTABLES_IP6)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_IP6-m)))
@@ -1052,7 +1049,7 @@ $(eval $(call KernelPackage,ipt-rpfilter))
 define KernelPackage/nft-core
   SUBMENU:=$(NF_MENU)
   TITLE:=Netfilter nf_tables support
-  DEPENDS:=+kmod-nfnetlink +kmod-nf-reject +IPV6:kmod-nf-reject6 +IPV6:kmod-nf-conntrack6 +LINUX_5_4:kmod-nf-nat
+  DEPENDS:=+kmod-nfnetlink +kmod-nf-reject +kmod-nf-reject6 +kmod-nf-conntrack6
   FILES:=$(foreach mod,$(NFT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_CORE-m)))
   KCONFIG:= \
@@ -1109,7 +1106,7 @@ $(eval $(call KernelPackage,nft-nat))
 define KernelPackage/nft-offload
   SUBMENU:=$(NF_MENU)
   TITLE:=Netfilter nf_tables routing/NAT offload support
-  DEPENDS:=@IPV6 +kmod-nf-flow +kmod-nft-nat
+  DEPENDS:=+kmod-nf-flow +kmod-nft-nat
   KCONFIG:= \
 	CONFIG_NF_FLOW_TABLE_INET \
 	CONFIG_NF_FLOW_TABLE_IPV4 \
diff --git a/package/kernel/linux/modules/netsupport.mk b/package/kernel/linux/modules/netsupport.mk
index 73e480a549..44408a720b 100644
--- a/package/kernel/linux/modules/netsupport.mk
+++ b/package/kernel/linux/modules/netsupport.mk
@@ -115,7 +115,8 @@ define KernelPackage/geneve
 	+IPV6:kmod-udptunnel6
   KCONFIG:=CONFIG_GENEVE
   FILES:= \
-	$(LINUX_DIR)/drivers/net/geneve.ko
+	$(LINUX_DIR)/net/ipv4/geneve.ko@le4.1 \
+	$(LINUX_DIR)/drivers/net/geneve.ko@ge4.2
   AUTOLOAD:=$(call AutoLoad,13,geneve)
 endef
 
@@ -132,7 +133,7 @@ define KernelPackage/nsh
   TITLE:=Network Service Header (NSH) protocol
   DEPENDS:=
   KCONFIG:=CONFIG_NET_NSH
-  FILES:=$(LINUX_DIR)/net/nsh/nsh.ko
+  FILES:=$(LINUX_DIR)/net/nsh/nsh.ko@ge4.14
   AUTOLOAD:=$(call AutoLoad,13,nsh)
 endef
 
@@ -246,7 +247,7 @@ define KernelPackage/ipsec
   DEPENDS:= \
 	+kmod-crypto-authenc +kmod-crypto-cbc +kmod-crypto-deflate \
 	+kmod-crypto-des +kmod-crypto-echainiv +kmod-crypto-hmac \
-	+kmod-crypto-md5 +kmod-crypto-sha1
+	+kmod-crypto-iv +kmod-crypto-md5 +kmod-crypto-sha1
   KCONFIG:= \
 	CONFIG_NET_KEY \
 	CONFIG_XFRM_USER \
@@ -267,14 +268,16 @@ endef
 
 $(eval $(call KernelPackage,ipsec))
 
-IPSEC4-m = \
+
+IPSEC4-m:= \
 	ipv4/ah4 \
 	ipv4/esp4 \
+	ipv4/xfrm4_mode_beet \
+	ipv4/xfrm4_mode_transport \
+	ipv4/xfrm4_mode_tunnel \
 	ipv4/xfrm4_tunnel \
 	ipv4/ipcomp \
 
-IPSEC4-m += $(ifeq ($$(strip $$(call CompareKernelPatchVer,$$(KERNEL_PATCHVER),le,5.2))),ipv4/xfrm4_mode_beet ipv4/xfrm4_mode_transport ipv4/xfrm4_mode_tunnel)
-
 define KernelPackage/ipsec4
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=IPsec related modules (IPv4)
@@ -307,18 +310,19 @@ endef
 $(eval $(call KernelPackage,ipsec4))
 
 
-IPSEC6-m = \
+IPSEC6-m:= \
 	ipv6/ah6 \
 	ipv6/esp6 \
+	ipv6/xfrm6_mode_beet \
+	ipv6/xfrm6_mode_transport \
+	ipv6/xfrm6_mode_tunnel \
 	ipv6/xfrm6_tunnel \
 	ipv6/ipcomp6 \
 
-IPSEC6-m += $(ifeq ($$(strip $$(call CompareKernelPatchVer,$$(KERNEL_PATCHVER),le,5.2))),ipv6/xfrm6_mode_beet ipv6/xfrm6_mode_transport ipv6/xfrm6_mode_tunnel)
-
 define KernelPackage/ipsec6
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=IPsec related modules (IPv6)
-  DEPENDS:=@IPV6 kmod-ipsec +kmod-iptunnel6
+  DEPENDS:=kmod-ipsec +kmod-iptunnel6
   KCONFIG:= \
 	CONFIG_INET6_AH \
 	CONFIG_INET6_ESP \
@@ -383,7 +387,7 @@ $(eval $(call KernelPackage,ip-vti))
 define KernelPackage/ip6-vti
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=IPv6 VTI (Virtual Tunnel Interface)
-  DEPENDS:=@IPV6 +kmod-iptunnel +kmod-ip6-tunnel +kmod-ipsec6
+  DEPENDS:=+kmod-iptunnel +kmod-ip6-tunnel +kmod-ipsec6
   KCONFIG:=CONFIG_IPV6_VTI
   FILES:=$(LINUX_DIR)/net/ipv6/ip6_vti.ko
   AUTOLOAD:=$(call AutoLoad,33,ip6_vti)
@@ -399,7 +403,7 @@ $(eval $(call KernelPackage,ip6-vti))
 define KernelPackage/xfrm-interface
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=IPsec XFRM Interface
-  DEPENDS:=+kmod-ipsec4 +IPV6:kmod-ipsec6 @!LINUX_4_14
+  DEPENDS:=+kmod-ipsec4 +kmod-ipsec6 @!LINUX_4_14 @!LINUX_4_9
   KCONFIG:=CONFIG_XFRM_INTERFACE
   FILES:=$(LINUX_DIR)/net/xfrm/xfrm_interface.ko
   AUTOLOAD:=$(call AutoProbe,xfrm_interface)
@@ -746,7 +750,7 @@ $(eval $(call KernelPackage,mppe))
 
 SCHED_MODULES = $(patsubst $(LINUX_DIR)/net/sched/%.ko,%,$(wildcard $(LINUX_DIR)/net/sched/*.ko))
 SCHED_MODULES_CORE = sch_ingress sch_fq_codel sch_hfsc sch_htb sch_tbf cls_basic cls_fw cls_route cls_flow cls_tcindex cls_u32 em_u32 act_mirred act_skbedit cls_matchall
-SCHED_MODULES_FILTER = $(SCHED_MODULES_CORE) act_connmark act_ctinfo sch_cake sch_netem sch_mqprio em_ipset cls_bpf cls_flower act_bpf act_vlan
+SCHED_MODULES_FILTER = $(SCHED_MODULES_CORE) act_connmark act_ctinfo sch_netem sch_mqprio em_ipset cls_bpf cls_flower act_bpf act_vlan
 SCHED_MODULES_EXTRA = $(filter-out $(SCHED_MODULES_FILTER),$(SCHED_MODULES))
 SCHED_FILES = $(patsubst %,$(LINUX_DIR)/net/sched/%.ko,$(filter $(SCHED_MODULES_CORE),$(SCHED_MODULES)))
 SCHED_FILES_EXTRA = $(patsubst %,$(LINUX_DIR)/net/sched/%.ko,$(SCHED_MODULES_EXTRA))
@@ -785,21 +789,6 @@ endef
 $(eval $(call KernelPackage,sched-core))
 
 
-define KernelPackage/sched-cake
-  SUBMENU:=$(NETWORK_SUPPORT_MENU)
-  TITLE:=Cake fq_codel/blue derived shaper
-  DEPENDS:=@!LINUX_4_14 +kmod-sched-core
-  KCONFIG:=CONFIG_NET_SCH_CAKE
-  FILES:=$(LINUX_DIR)/net/sched/sch_cake.ko
-  AUTOLOAD:=$(call AutoProbe,sch_cake)
-endef
-
-define KernelPackage/sched-cake/description
- Common Applications Kept Enhanced fq_codel/blue derived shaper
-endef
-
-$(eval $(call KernelPackage,sched-cake))
-
 define KernelPackage/sched-flower
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=Flower traffic classifier
@@ -946,9 +935,10 @@ $(eval $(call KernelPackage,sched))
 define KernelPackage/tcp-bbr
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=BBR TCP congestion control
+  DEPENDS:=+LINUX_4_9:kmod-sched
   KCONFIG:= \
 	CONFIG_TCP_CONG_ADVANCED=y \
-	CONFIG_TCP_CONG_BBR
+	CONFIG_TCP_CONG_BBR=m
   FILES:=$(LINUX_DIR)/net/ipv4/tcp_bbr.ko
   AUTOLOAD:=$(call AutoLoad,74,tcp_bbr)
 endef
@@ -959,7 +949,11 @@ define KernelPackage/tcp-bbr/description
  For kernel 4.13+, TCP internal pacing is implemented as fallback.
 endef
 
-TCP_BBR_SYSCTL_CONF:=sysctl-tcp-bbr.conf
+ifdef CONFIG_LINUX_4_9
+  TCP_BBR_SYSCTL_CONF:=sysctl-tcp-bbr-k4_9.conf
+else
+  TCP_BBR_SYSCTL_CONF:=sysctl-tcp-bbr.conf
+endif
 
 define KernelPackage/tcp-bbr/install
 	$(INSTALL_DIR) $(1)/etc/sysctl.d
@@ -1141,8 +1135,10 @@ define KernelPackage/rxrpc
 	CONFIG_RXKAD=m \
 	CONFIG_AF_RXRPC_DEBUG=n
   FILES:= \
-	$(LINUX_DIR)/net/rxrpc/rxrpc.ko
-  AUTOLOAD:=$(call AutoLoad,30,rxrpc.ko)
+	$(LINUX_DIR)/net/rxrpc/af-rxrpc.ko@lt4.11 \
+	$(LINUX_DIR)/net/rxrpc/rxrpc.ko@ge4.11 \
+	$(LINUX_DIR)/net/rxrpc/rxkad.ko@lt4.7
+  AUTOLOAD:=$(call AutoLoad,30,rxkad@lt4.7 af-rxrpc.ko@lt4.11 rxrpc.ko@ge4.11)
   DEPENDS:= +kmod-crypto-manager +kmod-crypto-pcbc +kmod-crypto-fcrypt
 endef
 
@@ -1155,7 +1151,7 @@ $(eval $(call KernelPackage,rxrpc))
 define KernelPackage/mpls
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=MPLS support
-  DEPENDS:=+!LINUX_4_14:kmod-iptunnel
+  DEPENDS:=+LINUX_4_19:kmod-iptunnel
   KCONFIG:= \
 	CONFIG_MPLS=y \
 	CONFIG_LWTUNNEL=y \
@@ -1243,18 +1239,3 @@ define KernelPackage/macsec/description
 endef
 
 $(eval $(call KernelPackage,macsec))
-
-
-define KernelPackage/netlink-diag
-  SUBMENU:=$(NETWORK_SUPPORT_MENU)
-  TITLE:=Netlink diag support for ss utility
-  KCONFIG:=CONFIG_NETLINK_DIAG
-  FILES:=$(LINUX_DIR)/net/netlink/netlink_diag.ko
-  AUTOLOAD:=$(call AutoLoad,31,netlink-diag)
-endef
-
-define KernelPackage/netlink-diag/description
- Netlink diag is a module made for use with iproute2's ss utility
-endef
-
-$(eval $(call KernelPackage,netlink-diag))
diff --git a/package/kernel/linux/modules/other.mk b/package/kernel/linux/modules/other.mk
index 15d67b4679..deff3a6f66 100644
--- a/package/kernel/linux/modules/other.mk
+++ b/package/kernel/linux/modules/other.mk
@@ -30,7 +30,7 @@ $(eval $(call KernelPackage,6lowpan))
 define KernelPackage/bluetooth
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Bluetooth support
-  DEPENDS:=@USB_SUPPORT +kmod-usb-core +kmod-crypto-hash +kmod-crypto-ecb +kmod-lib-crc16 +kmod-hid +kmod-crypto-cmac +kmod-regmap-core +kmod-crypto-ecdh
+  DEPENDS:=@USB_SUPPORT +kmod-usb-core +kmod-crypto-hash +kmod-crypto-ecb +kmod-lib-crc16 +kmod-hid +kmod-crypto-cmac +kmod-regmap-core +!LINUX_4_9:kmod-crypto-ecdh
   KCONFIG:= \
 	CONFIG_BT \
 	CONFIG_BT_BREDR=y \
@@ -53,8 +53,11 @@ define KernelPackage/bluetooth
 	$(LINUX_DIR)/net/bluetooth/bnep/bnep.ko \
 	$(LINUX_DIR)/net/bluetooth/hidp/hidp.ko \
 	$(LINUX_DIR)/drivers/bluetooth/hci_uart.ko \
-	$(LINUX_DIR)/drivers/bluetooth/btusb.ko \
+	$(LINUX_DIR)/drivers/bluetooth/btusb.ko
+ifeq ($(strip $(call CompareKernelPatchVer,$(KERNEL_PATCHVER),ge,4.1.0)),1)
+  FILES+= \
 	$(LINUX_DIR)/drivers/bluetooth/btintel.ko
+endif
   AUTOLOAD:=$(call AutoProbe,bluetooth rfcomm bnep hidp hci_uart btusb)
 endef
 
@@ -84,7 +87,7 @@ endef
 $(eval $(call KernelPackage,ath3k))
 
 
-define KernelPackage/bluetooth-6lowpan
+define KernelPackage/bluetooth_6lowpan
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Bluetooth 6LoWPAN support
   DEPENDS:=+kmod-6lowpan +kmod-bluetooth
@@ -93,11 +96,11 @@ define KernelPackage/bluetooth-6lowpan
   AUTOLOAD:=$(call AutoProbe,bluetooth_6lowpan)
 endef
 
-define KernelPackage/bluetooth-6lowpan/description
+define KernelPackage/bluetooth_6lowpan/description
  Kernel support for 6LoWPAN over Bluetooth Low Energy devices
 endef
 
-$(eval $(call KernelPackage,bluetooth-6lowpan))
+$(eval $(call KernelPackage,bluetooth_6lowpan))
 
 
 define KernelPackage/btmrvl
@@ -139,10 +142,9 @@ $(eval $(call KernelPackage,dma-buf))
 define KernelPackage/nvmem
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Non Volatile Memory support
-  DEPENDS:=@!LINUX_5_4
   KCONFIG:=CONFIG_NVMEM
   HIDDEN:=1
-  FILES:=$(LINUX_DIR)/drivers/nvmem/nvmem_core.ko
+  FILES:=$(LINUX_DIR)/drivers/nvmem/nvmem_core.ko@ge4.9
 endef
 
 define KernelPackage/nvmem/description
@@ -170,7 +172,7 @@ define KernelPackage/eeprom-at24
   SUBMENU:=$(OTHER_MENU)
   TITLE:=EEPROM AT24 support
   KCONFIG:=CONFIG_EEPROM_AT24
-  DEPENDS:=+kmod-i2c-core +!LINUX_5_4:kmod-nvmem +!LINUX_4_14:kmod-regmap-i2c
+  DEPENDS:=+kmod-i2c-core +kmod-nvmem +LINUX_4_19:kmod-regmap-i2c
   FILES:=$(LINUX_DIR)/drivers/misc/eeprom/at24.ko
   AUTOLOAD:=$(call AutoProbe,at24)
 endef
@@ -186,7 +188,7 @@ define KernelPackage/eeprom-at25
   SUBMENU:=$(OTHER_MENU)
   TITLE:=EEPROM AT25 support
   KCONFIG:=CONFIG_EEPROM_AT25
-  DEPENDS:=+!LINUX_5_4:kmod-nvmem
+  DEPENDS:=+kmod-nvmem
   FILES:=$(LINUX_DIR)/drivers/misc/eeprom/at25.ko
   AUTOLOAD:=$(call AutoProbe,at25)
 endef
@@ -214,32 +216,17 @@ endef
 $(eval $(call KernelPackage,gpio-dev))
 
 
-define KernelPackage/gpio-f7188x
-  SUBMENU:=$(OTHER_MENU)
-  TITLE:=Fintek F718xx/F818xx GPIO Support
-  DEPENDS:=@GPIO_SUPPORT @TARGET_x86
-  KCONFIG:=CONFIG_GPIO_F7188X
-  FILES:=$(LINUX_DIR)/drivers/gpio/gpio-f7188x.ko
-  AUTOLOAD:=$(call AutoProbe,gpio-f7188x)
-endef
-
-define KernelPackage/gpio-f7188x/description
-  Kernel module for the GPIOs found on many Fintek Super-IO chips.
-endef
-
-$(eval $(call KernelPackage,gpio-f7188x))
-
-
 define KernelPackage/gpio-mcp23s08
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Microchip MCP23xxx I/O expander
-  DEPENDS:=@GPIO_SUPPORT +kmod-i2c-core +kmod-regmap-i2c
+  DEPENDS:=@GPIO_SUPPORT +kmod-i2c-core +!LINUX_4_9:kmod-regmap-i2c
   KCONFIG:= \
 	CONFIG_GPIO_MCP23S08 \
 	CONFIG_PINCTRL_MCP23S08
   FILES:= \
-	$(LINUX_DIR)/drivers/pinctrl/pinctrl-mcp23s08.ko
-  AUTOLOAD:=$(call AutoLoad,40,pinctrl-mcp23s08)
+	$(LINUX_DIR)/drivers/gpio/gpio-mcp23s08.ko@lt4.13 \
+	$(LINUX_DIR)/drivers/pinctrl/pinctrl-mcp23s08.ko@ge4.13
+  AUTOLOAD:=$(call AutoLoad,40,gpio-mcp23s08@lt4.13 pinctrl-mcp23s08@ge4.13)
 endef
 
 define KernelPackage/gpio-mcp23s08/description
@@ -265,7 +252,7 @@ $(eval $(call KernelPackage,gpio-nxp-74hc164))
 
 define KernelPackage/gpio-pca953x
   SUBMENU:=$(OTHER_MENU)
-  DEPENDS:=@GPIO_SUPPORT +kmod-i2c-core +LINUX_5_4:kmod-regmap-i2c
+  DEPENDS:=@GPIO_SUPPORT +kmod-i2c-core
   TITLE:=PCA95xx, TCA64xx, and MAX7310 I/O ports
   KCONFIG:=CONFIG_GPIO_PCA953X
   FILES:=$(LINUX_DIR)/drivers/gpio/gpio-pca953x.ko
@@ -295,41 +282,6 @@ endef
 $(eval $(call KernelPackage,gpio-pcf857x))
 
 
-define KernelPackage/gpio-it87
-  SUBMENU:=$(OTHER_MENU)
-  DEPENDS:=@GPIO_SUPPORT @TARGET_x86
-  TITLE:=GPIO support for IT87xx Super I/O chips
-  KCONFIG:=CONFIG_GPIO_IT87
-  FILES:=$(LINUX_DIR)/drivers/gpio/gpio-it87.ko
-  AUTOLOAD:=$(call AutoLoad,25,gpio-it87,1)
-endef
-
-define KernelPackage/gpio-it87/description
-  This driver is tested with ITE IT8728 and IT8732 Super I/O chips, and
-  supports the IT8761E, IT8613, IT8620E, and IT8628E Super I/O chips as
-  well.
-endef
-
-$(eval $(call KernelPackage,gpio-it87))
-
-
-define KernelPackage/gpio-amd-fch
-  SUBMENU:=$(OTHER_MENU)
-  DEPENDS:=@GPIO_SUPPORT @TARGET_x86
-  TITLE:=GPIO support for AMD Fusion Controller Hub (G-series SOCs)
-  KCONFIG:=CONFIG_GPIO_AMD_FCH
-  FILES:=$(LINUX_DIR)/drivers/gpio/gpio-amd-fch.ko
-  AUTOLOAD:=$(call AutoLoad,25,gpio-amd-fch,1)
-endef
-
-define KernelPackage/gpio-amd-fch/description
-  This option enables driver for GPIO on AMDs Fusion Controller Hub,
-  as found on G-series SOCs (eg. GX-412TC)
-endef
-
-$(eval $(call KernelPackage,gpio-amd-fch))
-
-
 define KernelPackage/ppdev
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Parallel port support
@@ -397,7 +349,8 @@ define KernelPackage/mmc
 	CONFIG_SDIO_UART=n
   FILES:= \
 	$(LINUX_DIR)/drivers/mmc/core/mmc_core.ko \
-	$(LINUX_DIR)/drivers/mmc/core/mmc_block.ko
+	$(LINUX_DIR)/drivers/mmc/card/mmc_block.ko@lt4.10 \
+	$(LINUX_DIR)/drivers/mmc/core/mmc_block.ko@ge4.10
   AUTOLOAD:=$(call AutoProbe,mmc_core mmc_block,1)
 endef
 
@@ -408,23 +361,6 @@ endef
 $(eval $(call KernelPackage,mmc))
 
 
-define KernelPackage/mvsdio
-  SUBMENU:=$(OTHER_MENU)
-  TITLE:=Marvell MMC/SD/SDIO host driver
-  DEPENDS:=+kmod-mmc @TARGET_kirkwood
-  KCONFIG:= CONFIG_MMC_MVSDIO
-  FILES:= \
-	$(LINUX_DIR)/drivers/mmc/host/mvsdio.ko
-  AUTOLOAD:=$(call AutoProbe,mvsdio,1)
-endef
-
-define KernelPackage/mvsdio/description
- Kernel support for the Marvell SDIO host driver.
-endef
-
-$(eval $(call KernelPackage,mvsdio))
-
-
 define KernelPackage/sdhci
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Secure Digital Host Controller Interface support
@@ -487,7 +423,7 @@ $(eval $(call KernelPackage,softdog))
 define KernelPackage/ssb
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Silicon Sonics Backplane glue code
-  DEPENDS:=@PCI_SUPPORT @!TARGET_bcm47xx @!TARGET_bcm63xx
+  DEPENDS:=@PCI_SUPPORT @!TARGET_brcm47xx @!TARGET_brcm63xx
   KCONFIG:=\
 	CONFIG_SSB \
 	CONFIG_SSB_B43_PCI_BRIDGE=y \
@@ -513,7 +449,7 @@ $(eval $(call KernelPackage,ssb))
 define KernelPackage/bcma
   SUBMENU:=$(OTHER_MENU)
   TITLE:=BCMA support
-  DEPENDS:=@PCI_SUPPORT @!TARGET_bcm47xx @!TARGET_bcm53xx
+  DEPENDS:=@PCI_SUPPORT @!TARGET_brcm47xx @!TARGET_bcm53xx
   KCONFIG:=\
 	CONFIG_BCMA \
 	CONFIG_BCMA_POSSIBLE=y \
@@ -540,7 +476,7 @@ define KernelPackage/rtc-ds1307
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Dallas/Maxim DS1307 (and compatible) RTC support
   DEFAULT:=m if ALL_KMODS && RTC_SUPPORT
-  DEPENDS:=+kmod-i2c-core +kmod-regmap-i2c +kmod-hwmon-core
+  DEPENDS:=+kmod-i2c-core +!LINUX_4_9:kmod-regmap-i2c +!LINUX_4_9:kmod-hwmon-core
   KCONFIG:=CONFIG_RTC_DRV_DS1307 \
 	CONFIG_RTC_CLASS=y
   FILES:=$(LINUX_DIR)/drivers/rtc/rtc-ds1307.ko
@@ -651,7 +587,6 @@ define KernelPackage/rtc-pcf2123
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Philips PCF2123 RTC support
   DEFAULT:=m if ALL_KMODS && RTC_SUPPORT
-  DEPENDS:=+LINUX_5_4:kmod-regmap-spi
   KCONFIG:=CONFIG_RTC_DRV_PCF2123 \
 	CONFIG_RTC_CLASS=y
   FILES:=$(LINUX_DIR)/drivers/rtc/rtc-pcf2123.ko
@@ -799,9 +734,8 @@ define KernelPackage/serial-8250
 	CONFIG_SERIAL_8250_RSA=n
   FILES:= \
 	$(LINUX_DIR)/drivers/tty/serial/8250/8250.ko \
-	$(LINUX_DIR)/drivers/tty/serial/8250/8250_base.ko \
-	$(if $(CONFIG_PCI),$(LINUX_DIR)/drivers/tty/serial/8250/8250_pci.ko) \
-	$(if $(CONFIG_GPIOLIB),$(LINUX_DIR)/drivers/tty/serial/serial_mctrl_gpio.ko@ge5.3)
+	$(LINUX_DIR)/drivers/tty/serial/8250/8250_base.ko@ge4.4 \
+	$(if $(CONFIG_PCI),$(LINUX_DIR)/drivers/tty/serial/8250/8250_pci.ko@ge4.4)
   AUTOLOAD:=$(call AutoProbe,8250 8250_base 8250_pci)
 endef
 
@@ -1009,7 +943,7 @@ $(eval $(call KernelPackage,ptp))
 define KernelPackage/ptp-gianfar
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Freescale Gianfar PTP support
-  DEPENDS:=@TARGET_mpc85xx +kmod-ptp @LINUX_4_14
+  DEPENDS:=@TARGET_mpc85xx +kmod-ptp @!LINUX_4_19
   KCONFIG:=CONFIG_PTP_1588_CLOCK_GIANFAR
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/freescale/gianfar_ptp.ko
   AUTOLOAD:=$(call AutoProbe,gianfar_ptp)
@@ -1025,10 +959,10 @@ $(eval $(call KernelPackage,ptp-gianfar))
 define KernelPackage/ptp-qoriq
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Freescale QorIQ PTP support
-  DEPENDS:=@TARGET_mpc85xx +kmod-ptp @!LINUX_4_14
+  DEPENDS:=@TARGET_mpc85xx +kmod-ptp @LINUX_4_19
   KCONFIG:=CONFIG_PTP_1588_CLOCK_QORIQ
-  FILES:=$(LINUX_DIR)/drivers/ptp/ptp-qoriq.ko
-  AUTOLOAD:=$(call AutoProbe,ptp-qoriq)
+  FILES:=$(LINUX_DIR)/drivers/ptp/ptp_qoriq.o
+  AUTOLOAD:=$(call AutoProbe,ptp_qoriq)
 endef
 
 
@@ -1058,7 +992,7 @@ define KernelPackage/random-tpm
   TITLE:=Hardware Random Number Generator TPM support
   KCONFIG:=CONFIG_HW_RANDOM_TPM
   FILES:=$(LINUX_DIR)/drivers/char/hw_random/tpm-rng.ko
-  DEPENDS:= +kmod-random-core +kmod-tpm @LINUX_4_14
+  DEPENDS:= +kmod-random-core +kmod-tpm @!LINUX_4_19
   AUTOLOAD:=$(call AutoProbe,tpm-rng)
 endef
 
@@ -1298,17 +1232,16 @@ endef
 $(eval $(call KernelPackage,it87-wdt))
 
 
-define KernelPackage/f71808e-wdt
+define KernelPackage/pinctrl-sx150x
   SUBMENU:=$(OTHER_MENU)
-  TITLE:=Fintek F718xx/F818xx Watchdog Timer
-  DEPENDS:=@TARGET_x86
-  KCONFIG:=CONFIG_F71808E_WDT
-  FILES:=$(LINUX_DIR)/drivers/$(WATCHDOG_DIR)/f71808e_wdt.ko
-  AUTOLOAD:=$(call AutoProbe,f71808e-wdt,1)
+  TITLE:=Semtech SX150x-series I2C GPIO expanders
+  DEPENDS:= +kmod-i2c-core @!LINUX_4_9
+  KCONFIG:=CONFIG_PINCTRL_SX150X=y
+  AUTOLOAD:=$(call AutoLoad,40,pinctrl-sx150x)
 endef
 
-define KernelPackage/f71808e-wdt/description
-  Kernel module for the watchdog timer found on many Fintek Super-IO chips.
+define KernelPackage/pinctrl-sx150x/description
+ This driver adds support for Semtech SX150x-series I2C GPIO expanders.
 endef
 
-$(eval $(call KernelPackage,f71808e-wdt))
+$(eval $(call KernelPackage,pinctrl-sx150x))
diff --git a/package/kernel/linux/modules/sound.mk b/package/kernel/linux/modules/sound.mk
index f975103e50..a68595b03f 100644
--- a/package/kernel/linux/modules/sound.mk
+++ b/package/kernel/linux/modules/sound.mk
@@ -24,7 +24,8 @@ SOUNDCORE_FILES ?= \
 	$(LINUX_DIR)/sound/soundcore.ko \
 	$(LINUX_DIR)/sound/core/snd.ko \
 	$(LINUX_DIR)/sound/core/snd-hwdep.ko \
-	$(LINUX_DIR)/sound/core/snd-seq-device.ko \
+	$(LINUX_DIR)/sound/core/seq/snd-seq-device.ko@lt4.13 \
+	$(LINUX_DIR)/sound/core/snd-seq-device.ko@ge4.13 \
 	$(LINUX_DIR)/sound/core/snd-rawmidi.ko \
 	$(LINUX_DIR)/sound/core/snd-timer.ko \
 	$(LINUX_DIR)/sound/core/snd-pcm.ko \
diff --git a/package/kernel/linux/modules/usb.mk b/package/kernel/linux/modules/usb.mk
index e833c139a0..c678018820 100644
--- a/package/kernel/linux/modules/usb.mk
+++ b/package/kernel/linux/modules/usb.mk
@@ -72,10 +72,11 @@ $(eval $(call KernelPackage,usb-phy-nop))
 
 define KernelPackage/usb-phy-qcom-dwc3
   TITLE:=DWC3 USB QCOM PHY driver
-  DEPENDS:=@(TARGET_ipq40xx||TARGET_ipq806x)
+  DEPENDS:=@(TARGET_ipq40xx||TARGET_ipq806x) +kmod-usb-dwc3-of-simple
   KCONFIG:= CONFIG_PHY_QCOM_DWC3
   FILES:= \
-    $(LINUX_DIR)/drivers/phy/qualcomm/phy-qcom-dwc3.ko
+    $(LINUX_DIR)/drivers/phy/phy-qcom-dwc3.ko@lt4.13 \
+    $(LINUX_DIR)/drivers/phy/qualcomm/phy-qcom-dwc3.ko@ge4.13
   AUTOLOAD:=$(call AutoLoad,45,phy-qcom-dwc3,1)
   $(call AddDepends/usb)
 endef
@@ -274,8 +275,8 @@ define KernelPackage/usb-ohci
   TITLE:=Support for OHCI controllers
   DEPENDS:= \
 	+TARGET_bcm53xx:kmod-usb-bcma \
-	+TARGET_bcm47xx:kmod-usb-bcma \
-	+TARGET_bcm47xx:kmod-usb-ssb
+	+TARGET_brcm47xx:kmod-usb-bcma \
+	+TARGET_brcm47xx:kmod-usb-ssb
   KCONFIG:= \
 	CONFIG_USB_OHCI \
 	CONFIG_USB_OHCI_HCD \
@@ -322,7 +323,7 @@ $(eval $(call KernelPackage,usb-ohci-pci))
 
 define KernelPackage/usb-bcma
   TITLE:=Support for BCMA USB controllers
-  DEPENDS:=@USB_SUPPORT @TARGET_bcm47xx||TARGET_bcm53xx
+  DEPENDS:=@USB_SUPPORT @TARGET_brcm47xx||TARGET_bcm53xx
   HIDDEN:=1
   KCONFIG:=CONFIG_USB_HCD_BCMA
   FILES:= \
@@ -345,7 +346,7 @@ $(eval $(call KernelPackage,usb-fotg210))
 
 define KernelPackage/usb-ssb
   TITLE:=Support for SSB USB controllers
-  DEPENDS:=@USB_SUPPORT @TARGET_bcm47xx
+  DEPENDS:=@USB_SUPPORT @TARGET_brcm47xx
   HIDDEN:=1
   KCONFIG:=CONFIG_USB_HCD_SSB
   FILES:= \
@@ -370,8 +371,8 @@ $(eval $(call KernelPackage,usb-ehci))
 define KernelPackage/usb2
   TITLE:=Support for USB2 controllers
   DEPENDS:=\
-	+TARGET_bcm47xx:kmod-usb-bcma \
-	+TARGET_bcm47xx:kmod-usb-ssb \
+	+TARGET_brcm47xx:kmod-usb-bcma \
+	+TARGET_brcm47xx:kmod-usb-ssb \
 	+TARGET_bcm53xx:kmod-usb-bcma \
 	+TARGET_bcm53xx:kmod-phy-bcm-ns-usb2 \
 	+TARGET_ath79:kmod-phy-ath79-usb \
@@ -441,8 +442,9 @@ define KernelPackage/usb-dwc2
 	CONFIG_USB_DWC2_TRACK_MISSED_SOFS=n \
 	CONFIG_USB_DWC2_DEBUG_PERIODIC=n
   FILES:= \
-	$(LINUX_DIR)/drivers/usb/dwc2/dwc2.ko
-  AUTOLOAD:=$(call AutoLoad,54,dwc2,1)
+	$(LINUX_DIR)/drivers/usb/dwc2/dwc2.ko \
+	$(LINUX_DIR)/drivers/usb/dwc2/dwc2_platform.ko@lt4.3
+  AUTOLOAD:=$(call AutoLoad,54,dwc2 dwc2_platform@lt4.3,1)
   $(call AddDepends/usb)
 endef
 
@@ -496,7 +498,7 @@ $(eval $(call KernelPackage,usb-dwc3-of-simple))
 
 define KernelPackage/usb-dwc3-qcom
   TITLE:=DWC3 Qualcomm USB driver
-  DEPENDS:=@(!LINUX_4_14) @(TARGET_ipq40xx||TARGET_ipq806x) +kmod-usb-dwc3
+  DEPENDS:=@LINUX_4_19 @(TARGET_ipq40xx||TARGET_ipq806x) +kmod-usb-dwc3
   KCONFIG:= CONFIG_USB_DWC3_QCOM
   FILES:= $(LINUX_DIR)/drivers/usb/dwc3/dwc3-qcom.ko
   AUTOLOAD:=$(call AutoLoad,53,dwc3-qcom,1)
@@ -1602,10 +1604,10 @@ define KernelPackage/usb-chipidea
 	CONFIG_USB_CHIPIDEA_UDC=y \
 	CONFIG_USB_CHIPIDEA_DEBUG=y
   FILES:= \
-	$(LINUX_DIR)/drivers/extcon/extcon-core.ko \
+	$(LINUX_DIR)/drivers/extcon/extcon.ko@lt4.9 \
+	$(LINUX_DIR)/drivers/extcon/extcon-core.ko@ge4.9 \
 	$(LINUX_DIR)/drivers/usb/chipidea/ci_hdrc.ko \
-	$(LINUX_DIR)/drivers/usb/common/ulpi.ko@ge4.18 \
-	$(LINUX_DIR)/drivers/usb/roles/roles.ko@ge5.0
+	$(LINUX_DIR)/drivers/usb/common/ulpi.ko@ge4.18
   AUTOLOAD:=$(call AutoLoad,39,ci_hdrc,1)
   $(call AddDepends/usb)
 endef
@@ -1627,7 +1629,8 @@ define KernelPackage/usb-chipidea2
 	CONFIG_USB_CHIPIDEA_UDC=y \
 	CONFIG_USB_CHIPIDEA_DEBUG=y
   FILES:= \
-	$(LINUX_DIR)/drivers/extcon/extcon-core.ko \
+	$(LINUX_DIR)/drivers/extcon/extcon.ko@lt4.9 \
+	$(LINUX_DIR)/drivers/extcon/extcon-core.ko@ge4.9 \
 	$(LINUX_DIR)/drivers/usb/chipidea/ci_hdrc_usb2.ko
   AUTOLOAD:=$(call AutoLoad,39,ci_hdrc_usb2,1)
   $(call AddDepends/usb)
diff --git a/package/kernel/linux/modules/video.mk b/package/kernel/linux/modules/video.mk
index a04ed351a0..5e2484cec5 100644
--- a/package/kernel/linux/modules/video.mk
+++ b/package/kernel/linux/modules/video.mk
@@ -151,7 +151,7 @@ define KernelPackage/fb-sys-fops
   DEPENDS:=+kmod-fb
   KCONFIG:=CONFIG_FB_SYS_FOPS
   FILES:=$(LINUX_DIR)/drivers/video/fbdev/core/fb_sys_fops.ko
-  AUTOLOAD:=$(call AutoLoad,07,fb_sys_fops)
+  AUTOLOAD:=$(call AutoLoad,07,fbsysfops)
 endef
 
 define KernelPackage/fb-sys-fops/description
@@ -187,7 +187,7 @@ define KernelPackage/fb-tft
   SUBMENU:=$(VIDEO_MENU)
   TITLE:=Support for small TFT LCD display modules
   DEPENDS:= \
-	  @GPIO_SUPPORT +kmod-backlight \
+	  @GPIO_SUPPORT @!LINUX_4_9 +kmod-backlight \
 	  +kmod-fb +kmod-fb-sys-fops +kmod-fb-sys-ram +kmod-spi-bitbang
   KCONFIG:= \
        CONFIG_FB_BACKLIGHT=y \
@@ -282,7 +282,6 @@ define KernelPackage/drm-amdgpu
 	CONFIG_DRM_AMDGPU_SI=y \
 	CONFIG_DRM_AMDGPU_CIK=y \
 	CONFIG_DRM_AMD_DC=y \
-	CONFIG_HSA_AMD=y \
 	CONFIG_DEBUG_KERNEL_DC=n
   FILES:=$(LINUX_DIR)/drivers/gpu/drm/amd/amdgpu/amdgpu.ko \
 	$(LINUX_DIR)/drivers/gpu/drm/scheduler/gpu-sched.ko@ge4.15 \
@@ -408,7 +407,7 @@ define KernelPackage/video-core
 	CONFIG_V4L_PLATFORM_DRIVERS=y \
 	CONFIG_V4L_ISA_PARPORT_DRIVERS=y
   FILES:= \
-	$(LINUX_DIR)/drivers/media/$(V4L2_DIR)/v4l2-common.ko@lt5.4 \
+	$(LINUX_DIR)/drivers/media/$(V4L2_DIR)/v4l2-common.ko \
 	$(LINUX_DIR)/drivers/media/$(V4L2_DIR)/videodev.ko
   AUTOLOAD:=$(call AutoLoad,60, videodev v4l2-common)
 endef
@@ -448,7 +447,7 @@ define KernelPackage/video-videobuf2
 	$(LINUX_DIR)/drivers/media/common/videobuf2/videobuf2-v4l2.ko@ge4.16 \
 	$(LINUX_DIR)/drivers/media/common/videobuf2/videobuf2-memops.ko@ge4.16 \
 	$(LINUX_DIR)/drivers/media/common/videobuf2/videobuf2-vmalloc.ko@ge4.16
-  AUTOLOAD:=$(call AutoLoad,65,videobuf2-core videobuf-v4l2 videobuf2-memops videobuf2-vmalloc)
+  AUTOLOAD:=$(call AutoLoad,65,videobuf2-core videobuf-v4l2@ge4.4 videobuf2-memops videobuf2-vmalloc)
   $(call AddDepends/video)
 endef
 
@@ -512,7 +511,7 @@ $(eval $(call KernelPackage,video-uvc))
 define KernelPackage/video-gspca-core
   MENU:=1
   TITLE:=GSPCA webcam core support framework
-  DEPENDS:=@USB_SUPPORT +kmod-usb-core +kmod-input-core +!LINUX_4_14:kmod-video-videobuf2
+  DEPENDS:=@USB_SUPPORT +kmod-usb-core +kmod-input-core +LINUX_4_19:kmod-video-videobuf2
   KCONFIG:=CONFIG_USB_GSPCA
   FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_main.ko
   AUTOLOAD:=$(call AutoProbe,gspca_main)
diff --git a/package/kernel/linux/modules/w1.mk b/package/kernel/linux/modules/w1.mk
index 6ac7458e42..5055d78a18 100644
--- a/package/kernel/linux/modules/w1.mk
+++ b/package/kernel/linux/modules/w1.mk
@@ -14,7 +14,7 @@ define KernelPackage/w1
   TITLE:=Dallas's 1-wire support
   KCONFIG:=CONFIG_W1
   FILES:=$(LINUX_DIR)/drivers/w1/wire.ko
-  DEPENDS:=+kmod-hwmon-core
+  DEPENDS:=+!LINUX_4_9:kmod-hwmon-core
 endef
 
 define KernelPackage/w1/description
diff --git a/package/kernel/linux/modules/wireless.mk b/package/kernel/linux/modules/wireless.mk
index f7a40ba10a..7b1c663567 100644
--- a/package/kernel/linux/modules/wireless.mk
+++ b/package/kernel/linux/modules/wireless.mk
@@ -13,7 +13,8 @@ define KernelPackage/net-prism54
   DEPENDS:=@PCI_SUPPORT +@DRIVER_WEXT_SUPPORT +prism54-firmware
   KCONFIG:=CONFIG_PRISM54
   FILES:= \
-	$(LINUX_DIR)/drivers/net/wireless/intersil/prism54/prism54.ko
+	$(LINUX_DIR)/drivers/net/wireless/prism54/prism54.ko@lt4.5 \
+	$(LINUX_DIR)/drivers/net/wireless/intersil/prism54/prism54.ko@ge4.5
   AUTOLOAD:=$(call AutoProbe,prism54)
 endef
 
@@ -40,3 +41,24 @@ define KernelPackage/net-rtl8192su/description
 endef
 
 $(eval $(call KernelPackage,net-rtl8192su))
+
+
+define KernelPackage/owl-loader
+  SUBMENU:=$(WIRELESS_MENU)
+  TITLE:=Owl loader for initializing Atheros PCI(e) Wifi chips
+  DEPENDS:=@PCI_SUPPORT
+  KCONFIG:=CONFIG_OWL_LOADER
+  FILES:=$(LINUX_DIR)/drivers/misc/owl-loader.ko
+  AUTOLOAD:=$(call AutoProbe,owl-loader)
+endef
+
+define KernelPackage/owl-loader/description
+  Kernel module that helps to initialize certain Qualcomm
+  Atheros' PCI(e) Wifi chips, which have the init data
+  (which contains the PCI device ID for example) stored
+  together with the calibration data in the file system.
+
+  This is necessary for devices like the Cisco Meraki Z1.
+endef
+
+$(eval $(call KernelPackage,owl-loader))
diff --git a/package/kernel/linux/modules/wpan.mk b/package/kernel/linux/modules/wpan.mk
index 053fa1e4bf..1e986ee0ca 100644
--- a/package/kernel/linux/modules/wpan.mk
+++ b/package/kernel/linux/modules/wpan.mk
@@ -15,7 +15,7 @@ define KernelPackage/ieee802154
 	CONFIG_IEEE802154_NL802154_EXPERIMENTAL=n
   FILES:= \
 	$(LINUX_DIR)/net/ieee802154/ieee802154.ko \
-	$(LINUX_DIR)/net/ieee802154/ieee802154_socket.ko
+	$(LINUX_DIR)/net/ieee802154/ieee802154_socket.ko@ge4.0
   AUTOLOAD:=$(call AutoLoad,90,ieee802154 ieee802154_socket)
 endef
 
@@ -116,18 +116,19 @@ endef
 
 $(eval $(call KernelPackage,cc2520))
 
-define KernelPackage/ieee802154-6lowpan
+define KernelPackage/ieee802154_6lowpan
   SUBMENU:=$(WPAN_MENU)
   TITLE:= 6LoWPAN support over IEEE-802.15.4
   DEPENDS:=+kmod-6lowpan +kmod-ieee802154
   KCONFIG:=CONFIG_IEEE802154_6LOWPAN
   FILES:= \
-	$(LINUX_DIR)/net/ieee802154/6lowpan/ieee802154_6lowpan.ko
+	$(LINUX_DIR)/net/ieee802154/6lowpan/ieee802154_6lowpan.ko@ge4.0 \
+	$(LINUX_DIR)/net/ieee802154/ieee802154_6lowpan.ko@lt4.0
   AUTOLOAD:=$(call AutoLoad,91,ieee802154_6lowpan)
 endef
 
-define KernelPackage/ieee802154-6lowpan/description
+define KernelPackage/ieee802154_6lowpan/description
  IPv6 compression over IEEE 802.15.4
 endef
 
-$(eval $(call KernelPackage,ieee802154-6lowpan))
+$(eval $(call KernelPackage,ieee802154_6lowpan))

From f0aa5e27f1f7a0299d74ae78afd97cdc41324976 Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Thu, 2 Jul 2020 00:57:44 +0800
Subject: [PATCH 24/28] vidio: enable HSA_AMD

---
 package/kernel/linux/modules/video.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package/kernel/linux/modules/video.mk b/package/kernel/linux/modules/video.mk
index 5e2484cec5..246c087d1d 100644
--- a/package/kernel/linux/modules/video.mk
+++ b/package/kernel/linux/modules/video.mk
@@ -282,6 +282,7 @@ define KernelPackage/drm-amdgpu
 	CONFIG_DRM_AMDGPU_SI=y \
 	CONFIG_DRM_AMDGPU_CIK=y \
 	CONFIG_DRM_AMD_DC=y \
+	CONFIG_HSA_AMD=y \
 	CONFIG_DEBUG_KERNEL_DC=n
   FILES:=$(LINUX_DIR)/drivers/gpu/drm/amd/amdgpu/amdgpu.ko \
 	$(LINUX_DIR)/drivers/gpu/drm/scheduler/gpu-sched.ko@ge4.15 \

From 6b2e7c13fd8edf14bc5a7d1a1a91b50d8afdf468 Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Thu, 2 Jul 2020 01:09:35 +0800
Subject: [PATCH 25/28] enable GOPROXY by default for Golang

---
 package/lean/UnblockNeteaseMusicGo/Makefile | 4 ++--
 package/lean/v2ray-plugin/Makefile          | 4 ++--
 package/lean/v2ray/Config.in                | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package/lean/UnblockNeteaseMusicGo/Makefile b/package/lean/UnblockNeteaseMusicGo/Makefile
index cccc70ab93..8f39ea837b 100644
--- a/package/lean/UnblockNeteaseMusicGo/Makefile
+++ b/package/lean/UnblockNeteaseMusicGo/Makefile
@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=UnblockNeteaseMusicGo
 PKG_VERSION:=0.2.1
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/cnsilvan/UnblockNeteaseMusic.git
@@ -28,7 +28,7 @@ include $(TOPDIR)/feeds/packages/lang/golang/golang-package.mk
 define Package/$(PKG_NAME)/config
 config $(PKG_NAME)_INCLUDE_GOPROXY
 	bool "Compiling with GOPROXY proxy"
-	default n
+	default y
 
 endef
 
diff --git a/package/lean/v2ray-plugin/Makefile b/package/lean/v2ray-plugin/Makefile
index a7ad0f2767..a9d284815d 100644
--- a/package/lean/v2ray-plugin/Makefile
+++ b/package/lean/v2ray-plugin/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=v2ray-plugin
 PKG_VERSION:=1.3.2
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
@@ -34,7 +34,7 @@ include $(TOPDIR)/feeds/packages/lang/golang/golang-package.mk
 define Package/$(PKG_NAME)/config
 config $(PKG_NAME)_INCLUDE_GOPROXY
 	bool "Compiling with GOPROXY proxy"
-	default n
+	default y
 
 endef
 
diff --git a/package/lean/v2ray/Config.in b/package/lean/v2ray/Config.in
index 60700ede5b..3f13ba2057 100644
--- a/package/lean/v2ray/Config.in
+++ b/package/lean/v2ray/Config.in
@@ -3,7 +3,7 @@ menu "V2Ray Configuration"
 
 config V2RAY_COMPRESS_GOPROXY
 	bool "Compiling with GOPROXY proxy"
-	default n
+	default y
 
 choice
 	prompt "JSON Config Support"

From f053883d08757467a642a1615b71a31107d9b223 Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Thu, 2 Jul 2020 01:28:20 +0800
Subject: [PATCH 26/28] Revert "ipq40xx: import irq-balance script from
 presisco/openwrt-irq-balance"

This reverts commit defe460d44b639aa865ec3afc9c647f9a6093de0.
---
 target/linux/ipq40xx/Makefile                 |   2 +-
 .../base-files/etc/init.d/adjust_network      | 205 +-----------------
 .../ipq40xx/base-files/lib/adjust_network.sh  |  86 ++++++++
 3 files changed, 96 insertions(+), 197 deletions(-)
 create mode 100644 target/linux/ipq40xx/base-files/lib/adjust_network.sh

diff --git a/target/linux/ipq40xx/Makefile b/target/linux/ipq40xx/Makefile
index 48a4bb9fe4..3b6496859f 100644
--- a/target/linux/ipq40xx/Makefile
+++ b/target/linux/ipq40xx/Makefile
@@ -20,6 +20,6 @@ DEFAULT_PACKAGES += \
 	kmod-ath10k wpad-openssl \
 	kmod-usb3 kmod-usb-dwc3 ath10k-firmware-qca4019 \
 	automount autosamba luci-app-ipsec-vpnd luci-app-unblockmusic luci-app-cpufreq luci-app-zerotier luci-app-xlnetacc \
-	htop fdisk e2fsprogs ethtool
+	htop fdisk e2fsprogs
 
 $(eval $(call BuildTarget))
diff --git a/target/linux/ipq40xx/base-files/etc/init.d/adjust_network b/target/linux/ipq40xx/base-files/etc/init.d/adjust_network
index 6089259e5f..788b833ff4 100755
--- a/target/linux/ipq40xx/base-files/etc/init.d/adjust_network
+++ b/target/linux/ipq40xx/base-files/etc/init.d/adjust_network
@@ -1,205 +1,18 @@
 #!/bin/sh /etc/rc.common
 # Copyright (C) 2006-2011 OpenWrt.org
 
-START=99
+START=11
 STOP=98
 
-rps_flow_cnt=4096
-core_count=$(grep -c processor /proc/cpuinfo)
-rps_sock_flow_ent=`expr $core_count \* $rps_flow_cnt`
-queue_cores="0 1 2"
-queue_irq_cores="1 2"
-wifi_core="3"
-usb_core="0"
+adjust_smp_affinity() {
+	test -f /lib/adjust_network.sh && {
+		. /lib/adjust_network.sh
 
-############### util functions ###############
-
-to_hex_list() {
-	local cores=$1
-	local converted=""
-	for core in $(echo $cores | awk '{print}')
-	do
-		local hex="$(gen_hex_mask "$core")"
-		converted="$converted $hex"
-	done
-	echo `echo $converted | sed 's/^ *//'`
+		adjust_edma_smp_affinity
+		adjust_radio_smp_affinity
+	}
 }
 
-gen_hex_mask() {
-	local cores=$1
-	local mask=0
-	for core in $(echo $cores | awk '{print}')
-	do
-		local bit="$((1 << $core))"
-		let "mask = mask + bit"
-	done
-	local hex="$(printf %x "$mask")"
-	echo "$hex"
+boot() {
+	adjust_smp_affinity
 }
-
-val_at_index() {
-	local values=$1
-	local idx=$2
-	echo `echo $values | awk -v i=$idx '{print $i}'`
-}
-
-size_of_list() {
-	local list=$1
-	local spaces=`echo $list | grep -o ' ' | wc -l`
-	echo `expr $spaces + 1`
-}
-
-set_core_mask() {
-	local file=$1
-	local cores=$2
-	local mask="$(gen_hex_mask "$cores")"
-	echo $mask > $file
-}
-
-set_core_mask_round() {
-	local files=$1
-	local cores=$2
-	local step_size=$3
-	[ ! -n "$3" ] && step_size=1
-	
-	local core_count="$(size_of_list "$cores")"
-	local counter=0
-	local idx=1
-	local roof=`expr $core_count \* $step_size`
-	for file in $(echo $files | awk '{print}')
-	do
-		let "idx = counter / step_size + 1"
-		local core="$(val_at_index "$cores" $idx)"
-		set_core_mask $file $core
-		let "counter = counter + 1"
-		[ $counter -ge $roof ] && counter=0
-	done
-}
-
-############### assign network queues ###############
-
-set_interface_round() {
-	local interface=$1
-	local cores=$2
-	local step_size=$3
-	[ ! -n "$3" ] && step_size=1
-	
-	echo "using round mask for interface: $interface, step size: $step_size"
-	set_core_mask_round "$(ls /sys/class/net/$interface/queues/tx-*/xps_cpus)" "$cores" $step_size
-	set_core_mask_round "$(ls /sys/class/net/$interface/queues/rx-*/rps_cpus)" "$cores" $step_size
-	
-	for file in /sys/class/net/$interface/queues/rx-[0-9]*/rps_flow_cnt
-	do
-		echo $rps_flow_cnt > $file
-	done
-}
-
-set_interface() {
-	local interface=$1
-	local cores=$2
-	
-	echo "using cores: $cores for interface: $interface"
-	
-	for file in /sys/class/net/$interface/queues/rx-[0-9]*/rps_cpus
-	do
-		set_core_mask $file "$cores"
-		echo $rps_flow_cnt > `dirname $file`/rps_flow_cnt
-	done
-
-	for file in /sys/class/net/$interface/queues/tx-[0-9]*/xps_cpus
-	do
-		set_core_mask $file "$cores"
-	done
-}
-
-set_interface_queues() {
-	echo "using cpu: $queue_cores for network queues"
-	for dev in /sys/class/net/eth*
-	do
-		[ -d "$dev" ] || continue
-		
-		local interface=`basename $dev`
-		
-		set_interface $interface "$queue_cores"
-	done
-
-	for dev in /sys/class/net/wlan*
-	do
-		[ -d "$dev" ] || continue
-		
-		local interface=`basename $dev`
-		
-		set_interface $interface "$queue_cores"
-	done
-	
-	for dev in /sys/class/net/eth*
-	do
-		local eth=`basename $dev`
-		echo "enabling offload on $eth"
-		ethtool -K $eth rx-checksum on >/dev/null 2>&1
-		ethtool -K $eth tx-checksum-ip-generic on >/dev/null 2>&1 || (
-		ethtool -K $eth tx-checksum-ipv4 on >/dev/null 2>&1
-		ethtool -K $eth tx-checksum-ipv6 on >/dev/null 2>&1)
-		ethtool -K $eth tx-scatter-gather on >/dev/null 2>&1
-		ethtool -K $eth gso on >/dev/null 2>&1
-		ethtool -K $eth gro on >/dev/null 2>&1
-		ethtool -K $eth lro on >/dev/null 2>&1
-		ethtool -K $eth tso on >/dev/null 2>&1
-		ethtool -K $eth ufo on >/dev/null 2>&1
-	done
-	
-	echo $rps_sock_flow_ent > /proc/sys/net/core/rps_sock_flow_entries
-	sysctl -w net.core.rps_sock_flow_entries=$rps_sock_flow_ent
-}
-
-############### assign interrupts ###############
-set_irq_cores() {
-	local mask="$(gen_hex_mask "$2")"
-	echo "set mask $mask for irq: $1"
-	echo $mask > "/proc/irq/$1/smp_affinity"
-}
-
-set_irq_pattern() {
-	local name_pattern="$1"
-	local cores="$2"
-	
-	for irq in `grep "$name_pattern" /proc/interrupts | cut -d: -f1 | sed 's, *,,'`
-	do
-		set_irq_cores $irq "$cores"
-	done
-}
-
-set_irq_interleave() {
-	local name_pattern=$1
-	local cores=$2
-	local step_size=$3
-	
-	local files=""
-	for irq in `grep "$name_pattern" /proc/interrupts | cut -d: -f1 | sed 's, *,,'`
-	do
-		files="$files\
-		/proc/irq/$irq/smp_affinity"
-	done
-	
-	set_core_mask_round "$files" "$cores" "$step_size"
-}
-
-set_irqs() {
-	#dma
-	set_irq_pattern bam_dma "$usb_core"
-
-	#ethernet
-	set_irq_interleave eth_tx "$queue_irq_cores" 4
-	set_irq_interleave eth_rx "$queue_irq_cores" 1
-
-	#pcie
-	set_irq_pattern pcie "$wifi_core"
-
-	#usb
-	set_irq_pattern usb "$usb_core"
-}
-
-start() {
-	set_interface_queues
-	set_irqs
-}
\ No newline at end of file
diff --git a/target/linux/ipq40xx/base-files/lib/adjust_network.sh b/target/linux/ipq40xx/base-files/lib/adjust_network.sh
new file mode 100644
index 0000000000..95ffedc04f
--- /dev/null
+++ b/target/linux/ipq40xx/base-files/lib/adjust_network.sh
@@ -0,0 +1,86 @@
+#!/bin/sh
+# this scripts is used for adjust cpu's choice of interrupts.
+#
+
+################################################
+# Adjust smp_affinity of edma
+# Globals:
+#    None
+# Arguments:
+#    None
+# Returns:
+#    None
+# Remark:
+#    execute only once on start-up.
+################################################
+adjust_edma_smp_affinity() {
+	grep -q edma_eth_ /proc/interrupts || return 0
+	local nr=`cat /proc/cpuinfo | grep processor | wc -l`
+	local cpu=0
+	local tx_irq_num
+
+	for tx_num in `seq 0 1 15` ; do
+		cpu=`printf "%x" $((1<<((tx_num/4+3)%nr)))`
+		tx_irq_num=`grep -m1 edma_eth_tx$tx_num /proc/interrupts | cut -d ':' -f 1 | tail -n1 | tr -d ' '`
+		[ -n "$tx_irq_num" ] && echo $cpu > /proc/irq/$tx_irq_num/smp_affinity
+	done
+
+	for rx_num in `seq 0 1 7` ; do
+		cpu=`printf "%x" $((1<<((rx_num/2)%nr)))`
+		rx_irq_num=`grep -m1 edma_eth_rx$rx_num /proc/interrupts | cut -d ':' -f 1 | tail -n1 | tr -d ' '`
+		[ -n "$rx_irq_num" ] && echo $cpu > /proc/irq/$rx_irq_num/smp_affinity
+	done
+}
+
+################################################
+# Adjust smp_affinity of ath10k for 2G and 5G
+# Globals:
+#    None
+# Arguments:
+#    None
+# Returns:
+#    None
+# Remark:
+#    execute only once on start-up.
+################################################
+adjust_radio_smp_affinity() {
+	local irqs="`grep -E 'ath10k' /proc/interrupts | cut -d ':' -f 1 | tr -d ' '`"
+	local nr=`cat /proc/cpuinfo | grep processor | wc -l`
+	local idx=2
+
+	for irq in $irqs; do
+		cpu=`printf "%x" $((1<<((idx)%nr)))`
+		echo $cpu > /proc/irq/$irq/smp_affinity
+		idx=$((idx+1))
+	done
+}
+
+################################################
+# Adjust queue of eth
+# Globals:
+#    None
+# Arguments:
+#    None
+# Returns:
+#    None
+# Remark:
+#    Each network reboot needs to be executed.
+################################################
+adjust_eth_queue() {
+	local nr=`cat /proc/cpuinfo | grep processor | wc -l`
+	local cpu=`printf "%x" $(((1<<nr)-1))`
+
+	for epath in /sys/class/net/eth[0-9]*; do
+		test -e $epath || break
+		echo $epath | grep -q "\." && continue
+		eth=`basename $epath`
+		for exps in /sys/class/net/$eth/queues/rx-[0-9]*/rps_cpus; do
+			test -e $exps || break
+			echo $cpu > $exps
+			echo 256 > `dirname $exps`/rps_flow_cnt
+		done
+		which ethtool >/dev/null 2>&1 && ethtool -K $eth gro off
+	done
+
+	echo 1024 > /proc/sys/net/core/rps_sock_flow_entries
+}

From ed735bab753e96862cba2d465f72a34000db10ca Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Thu, 2 Jul 2020 01:29:53 +0800
Subject: [PATCH 27/28] ipq40xx: switch to kernel 4.14

---
 target/linux/ipq40xx/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/linux/ipq40xx/Makefile b/target/linux/ipq40xx/Makefile
index 3b6496859f..d2696b771c 100644
--- a/target/linux/ipq40xx/Makefile
+++ b/target/linux/ipq40xx/Makefile
@@ -9,7 +9,7 @@ CPU_SUBTYPE:=neon-vfpv4
 MAINTAINER:=John Crispin <john@phrozen.org>
 
 # TODO: drop kmod-usb-dwc3-of-simple when migrating to 4.19
-KERNEL_PATCHVER:=4.19
+KERNEL_PATCHVER:=4.14
 
 KERNELNAME:=zImage Image dtbs
 
@@ -20,6 +20,6 @@ DEFAULT_PACKAGES += \
 	kmod-ath10k wpad-openssl \
 	kmod-usb3 kmod-usb-dwc3 ath10k-firmware-qca4019 \
 	automount autosamba luci-app-ipsec-vpnd luci-app-unblockmusic luci-app-cpufreq luci-app-zerotier luci-app-xlnetacc \
-	htop fdisk e2fsprogs
+	htop fdisk e2fsprogs ethtool
 
 $(eval $(call BuildTarget))

From beb94a6f37ea2fca7102e1b26ddb737df5e71619 Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Thu, 2 Jul 2020 02:10:32 +0800
Subject: [PATCH 28/28] UnblockNeteaseMusicGo: revert version

---
 package/lean/UnblockNeteaseMusicGo/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/lean/UnblockNeteaseMusicGo/Makefile b/package/lean/UnblockNeteaseMusicGo/Makefile
index 8f39ea837b..218afa7980 100644
--- a/package/lean/UnblockNeteaseMusicGo/Makefile
+++ b/package/lean/UnblockNeteaseMusicGo/Makefile
@@ -2,11 +2,11 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=UnblockNeteaseMusicGo
 PKG_VERSION:=0.2.1
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/cnsilvan/UnblockNeteaseMusic.git
-PKG_SOURCE_VERSION:=7664b2b5c5dbe8e1ff7fde0c0051b4feabc0e0ba
+PKG_SOURCE_VERSION:=f70ddb140db4711f2b192b5ddcc6382829473a82
 PKG_MAINTAINER:=Silvan <cnsilvan@gmail.com>
 
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)