diff --git a/qca/nss-firmware/Makefile b/qca/nss-firmware/Makefile
new file mode 100644
index 000000000..b56a3652f
--- /dev/null
+++ b/qca/nss-firmware/Makefile
@@ -0,0 +1,73 @@
+#
+# Copyright (C) 2021 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=nss-firmware
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2021-09-14
+PKG_SOURCE_URL:=https://github.com/quic/qca-sdk-nss-fw.git
+PKG_SOURCE_VERSION:=b06171cb0d14360c90a4b8f9f835dc1c4647ea07
+PKG_MIRROR_HASH:=e851d4f6af8aaccbc34a05bc007991a88287913f17c5d9f0172a00745aed6e48
+
+PKG_LICENSE_FILES:=LICENSE.md
+
+PKG_MAINTAINER:=Robert Marko <robimarko@gmail.com>
+
+include $(INCLUDE_DIR)/package.mk
+
+VERSION_PATH=$(PKG_BUILD_DIR)/QCA_Networking_2021.SPF_11.4/CS
+
+define Package/nss-firmware-default
+  SECTION:=firmware
+  CATEGORY:=Firmware
+  URL:=$(PKG_SOURCE_URL)
+endef
+
+define Package/nss-firmware-ipq6018
+$(Package/nss-firmware-default)
+  DEPENDS:=@TARGET_ipq60xx
+  TITLE:=NSS firmware for IPQ6018 devices
+  NSS_ARCHIVE:=$(VERSION_PATH)/IPQ6018.ATH.11.4/BIN-NSS.CP.11.4.0.5-5-R.tar.bz2
+endef
+
+define Package/nss-firmware-ipq8074
+$(Package/nss-firmware-default)
+  DEPENDS:=@TARGET_ipq807x
+  TITLE:=NSS firmware for IPQ8074 devices
+  NSS_ARCHIVE:=$(VERSION_PATH)/IPQ8074.ATH.11.4/BIN-NSS.HK.11.4.0.5-5-R.tar.bz2
+endef
+
+define Build/Compile
+	true
+endef
+
+define Package/nss-firmware-ipq6018/install
+	mkdir -p $(PKG_BUILD_DIR)/IPQ6018
+	$(TAR) -C $(PKG_BUILD_DIR)/IPQ6018 -xf $(NSS_ARCHIVE) --strip-components=1
+	$(INSTALL_DIR) $(1)/lib/firmware/
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/IPQ6018/retail_router0.bin \
+		$(1)/lib/firmware/qca-nss0.bin
+endef
+
+define Package/nss-firmware-ipq8074/install
+	mkdir -p $(PKG_BUILD_DIR)/IPQ8074
+	$(TAR) -C $(PKG_BUILD_DIR)/IPQ8074 -xf $(NSS_ARCHIVE) --strip-components=1
+	$(INSTALL_DIR) $(1)/lib/firmware/
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/IPQ8074/retail_router0.bin \
+		$(1)/lib/firmware/qca-nss0.bin
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/IPQ8074/retail_router1.bin \
+		$(1)/lib/firmware/qca-nss1.bin
+endef
+
+$(eval $(call BuildPackage,nss-firmware-ipq6018))
+$(eval $(call BuildPackage,nss-firmware-ipq8074))
diff --git a/qca/qca-nss-cfi/Makefile b/qca/qca-nss-cfi/Makefile
new file mode 100644
index 000000000..64f7bd7ab
--- /dev/null
+++ b/qca/qca-nss-cfi/Makefile
@@ -0,0 +1,71 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=qca-nss-cfi
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2021-03-22
+PKG_SOURCE_URL:=https://source.codeaurora.org/quic/qsdk/oss/lklm/nss-cfi
+PKG_SOURCE_VERSION:=73f2e5f5bf93cc244036ce5641faf9f859692cdf
+PKG_MIRROR_HASH:=8c8edc9b8d8c68fdd14640152245013a93c123957b6b338c06f266f6c9db8cbd
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/package.mk
+
+# v1.0 is for Akronite
+# v2.0 is for Hawkeye/Cypress/Maple
+ifneq (, $(findstring $(BOARD), ipq50xx ipq60xx ipq807x))
+  CFI_OCF_DIR:=ocf/v2.0
+  CFI_CRYPTOAPI_DIR:=cryptoapi/v2.0
+else
+  CFI_CRYPTOAPI_DIR:=cryptoapi/v1.1
+  CFI_OCF_DIR:=ocf/v1.0
+  CFI_IPSEC_DIR:=ipsec/v1.0
+endif
+
+define KernelPackage/qca-nss-cfi-cryptoapi
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  DEPENDS:=@TARGET_ipq60xx +kmod-crypto-authenc +kmod-qca-nss-crypto
+  TITLE:=Kernel driver for NSS cfi
+  FILES:=$(PKG_BUILD_DIR)/$(CFI_CRYPTOAPI_DIR)/qca-nss-cfi-cryptoapi.ko
+  AUTOLOAD:=$(call AutoLoad,59,qca-nss-cfi-cryptoapi)
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include/qca-nss-cfi
+	$(CP) $(PKG_BUILD_DIR)/$(CFI_CRYPTOAPI_DIR)/../exports/* $(1)/usr/include/qca-nss-cfi
+	$(CP) $(PKG_BUILD_DIR)/include/* $(1)/usr/include/qca-nss-cfi
+endef
+
+define KernelPackage/qca-nss-cfi/Description
+This package contains a NSS cfi driver for QCA chipset
+endef
+
+EXTRA_CFLAGS+= \
+	-DCONFIG_NSS_DEBUG_LEVEL=4 \
+	-I$(LINUX_DIR)/crypto/ocf \
+	-I$(STAGING_DIR)/usr/include/qca-nss-crypto \
+	-I$(STAGING_DIR)/usr/include/crypto \
+	-I$(STAGING_DIR)/usr/include/qca-nss-drv
+
+ifneq (, $(findstring $(BOARD), ipq50xx ipq60xx ipq807x))
+EXTRA_CFLAGS+= -I$(STAGING_DIR)/usr/include/qca-nss-clients
+endif
+
+define Build/Compile
+	$(MAKE) -C "$(LINUX_DIR)" \
+		CROSS_COMPILE="$(TARGET_CROSS)" \
+		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
+		CFI_CRYPTOAPI_DIR=$(CFI_CRYPTOAPI_DIR) \
+		CFI_IPSEC_DIR=$(CFI_IPSEC_DIR) \
+		CFI_OCF_DIR=$(CFI_OCF_DIR) \
+		$(KERNEL_MAKE_FLAGS) \
+		M="$(PKG_BUILD_DIR)" \
+		SoC="$(BOARD)_64" \
+		"cryptoapi=y" \
+		modules
+endef
+
+$(eval $(call KernelPackage,qca-nss-cfi-cryptoapi))
diff --git a/qca/qca-nss-cfi/patches/100-remove-noise-logs.patch b/qca/qca-nss-cfi/patches/100-remove-noise-logs.patch
new file mode 100644
index 000000000..085aeaf24
--- /dev/null
+++ b/qca/qca-nss-cfi/patches/100-remove-noise-logs.patch
@@ -0,0 +1,30 @@
+--- a/cryptoapi/v2.0/nss_cryptoapi_ahash.c
++++ b/cryptoapi/v2.0/nss_cryptoapi_ahash.c
+@@ -449,9 +449,12 @@ int nss_cryptoapi_ahash_digest(struct ahash_request *req)
+ int nss_cryptoapi_ahash_export(struct ahash_request *req, void *out)
+ {
+ 	struct nss_cryptoapi_ctx *ctx __attribute__((unused)) = crypto_tfm_ctx(req->base.tfm);
++	struct nss_cryptoapi_req_ctx *rctx = ahash_request_ctx(req);
++	struct nss_cryptoapi_req_ctx *state = out;
++
++	*state = *rctx;
+ 
+-	nss_cfi_warn("%px: ahash .export is not supported", ctx);
+-	return -ENOSYS;
++	return 0;
+ };
+ 
+ /*
+@@ -464,7 +467,10 @@ int nss_cryptoapi_ahash_export(struct ahash_request *req, void *out)
+ int nss_cryptoapi_ahash_import(struct ahash_request *req, const void *in)
+ {
+ 	struct nss_cryptoapi_ctx *ctx __attribute__((unused)) = crypto_tfm_ctx(req->base.tfm);
++	struct nss_cryptoapi_req_ctx *rctx = ahash_request_ctx(req);
++	const struct nss_cryptoapi_req_ctx *state = in;
++
++	*rctx = *state;
+ 
+-	nss_cfi_warn("%px: ahash .import is not supported", ctx);
+-	return -ENOSYS;
++	return 0;
+ }
diff --git a/qca/qca-nss-clients/Makefile b/qca/qca-nss-clients/Makefile
new file mode 100644
index 000000000..2d9b82644
--- /dev/null
+++ b/qca/qca-nss-clients/Makefile
@@ -0,0 +1,115 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=qca-nss-clients
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2021-12-01
+PKG_SOURCE_URL:=https://source.codeaurora.org/quic/qsdk/oss/lklm/nss-clients
+PKG_SOURCE_VERSION:=24fdeb3357cf4135f43add427e2b318139b6a1b9
+PKG_MIRROR_HASH:=c46b9cdf4bbd394507a92dc39f9183735a61c7ccdfed38832c525ed6d2381eb6
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/qca-nss-drv-pppoe
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS PPPoE connection manager
+  DEPENDS:=@TARGET_ipq60xx +kmod-bonding +kmod-pppoe +kmod-qca-nss-drv
+  FILES:=$(PKG_BUILD_DIR)/pppoe/qca-nss-pppoe.ko
+  AUTOLOAD:=$(call AutoLoad,51,qca-nss-pppoe)
+endef
+
+define KernelPackage/qca-nss-drv-pppoe/Description
+Kernel modules for NSS connection manager - Support for PPPoE
+endef
+
+define KernelPackage/qca-nss-drv-bridge-mgr
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS bridge manager
+  DEPENDS:=@TARGET_ipq60xx +kmod-bonding +kmod-qca-nss-drv-vlan-mgr
+  FILES:=$(PKG_BUILD_DIR)/bridge/qca-nss-bridge-mgr.ko
+  AUTOLOAD:=$(call AutoLoad,51,qca-nss-bridge-mgr)
+endef
+
+define KernelPackage/qca-nss-drv-bridge-mgr/Description
+Kernel modules for NSS bridge manager
+endef
+
+define KernelPackage/qca-nss-drv-vlan-mgr
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS vlan manager
+  DEPENDS:=@TARGET_ipq60xx +kmod-bonding +kmod-qca-nss-drv
+  FILES:=$(PKG_BUILD_DIR)/vlan/qca-nss-vlan.ko
+  AUTOLOAD:=$(call AutoLoad,51,qca-nss-vlan)
+endef
+
+define KernelPackage/qca-nss-drv-vlan-mgr/Description
+Kernel modules for NSS vlan manager
+endef
+
+define KernelPackage/qca-nss-drv-wifi-meshmgr
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  DEPENDS:=@TARGET_ipq60xx +kmod-qca-nss-drv
+  TITLE:=NSS WiFi-Mesh Manager for QCA NSS driver
+  FILES:=$(PKG_BUILD_DIR)/wifi_meshmgr/qca-nss-wifi-meshmgr.ko
+  AUTOLOAD:=$(call AutoLoad,51,qca-nss-wifi-meshmgr)
+endef
+
+define KernelPackage/qca-nss-drv-wifi-meshmgr/Description
+Kernel module for NSS WiFi Mesh manager
+endef
+
+EXTRA_CFLAGS+= \
+	-I$(STAGING_DIR)/usr/include/qca-nss-cfi \
+	-I$(STAGING_DIR)/usr/include/qca-nss-crypto \
+	-I$(STAGING_DIR)/usr/include/qca-nss-drv \
+	-I$(STAGING_DIR)/usr/include/qca-nss-gmac \
+	-I$(STAGING_DIR)/usr/include/qca-ssdk \
+	-I$(STAGING_DIR)/usr/include/qca-ssdk/fal \
+	-I$(STAGING_DIR)/usr/include/nat46
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-pppoe),)
+MAKE_OPTS+=pppoe=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-vlan-mgr),)
+MAKE_OPTS+=vlan-mgr=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-bridge-mgr),)
+MAKE_OPTS+=bridge-mgr=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-wifi-meshmgr),)
+MAKE_OPTS+=wifi-meshmgr=y
+endif
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include/qca-nss-clients
+	$(CP) $(PKG_BUILD_DIR)/netlink/include/* $(1)/usr/include/qca-nss-clients/
+	$(CP) $(PKG_BUILD_DIR)/exports/* $(1)/usr/include/qca-nss-clients/
+endef
+
+define Build/Compile
+	$(MAKE) -C "$(LINUX_DIR)" $(strip $(MAKE_OPTS)) \
+		CROSS_COMPILE="$(TARGET_CROSS)" \
+		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
+		$(KERNEL_MAKE_FLAGS) \
+		M="$(PKG_BUILD_DIR)" \
+		SoC="$(BOARD)_64" \
+		modules
+endef
+
+$(eval $(call KernelPackage,qca-nss-drv-pppoe))
+$(eval $(call KernelPackage,qca-nss-drv-vlan-mgr))
+$(eval $(call KernelPackage,qca-nss-drv-bridge-mgr))
+$(eval $(call KernelPackage,qca-nss-drv-wifi-meshmgr))
diff --git a/qca/qca-nss-clients/files/qca-nss-ipsec b/qca/qca-nss-clients/files/qca-nss-ipsec
new file mode 100644
index 000000000..bb202e8e7
--- /dev/null
+++ b/qca/qca-nss-clients/files/qca-nss-ipsec
@@ -0,0 +1,92 @@
+#!/bin/sh  /etc/rc.common
+#
+# Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+NSS_IPSEC_LOG_FILE=/tmp/.nss_ipsec_log
+NSS_IPSEC_LOG_STR_ECM="ECM_Loaded"
+
+ecm_load () {
+	if [ ! -d /sys/module/ecm ]; then
+		/etc/init.d/qca-nss-ecm start
+		if [ -d /sys/module/ecm ]; then
+			echo ${NSS_IPSEC_LOG_STR_ECM} >> ${NSS_IPSEC_LOG_FILE}
+		fi
+	fi
+}
+
+ecm_unload () {
+	if [ -f /tmp/.nss_ipsec_log ]; then
+		str=`grep ${NSS_IPSEC_LOG_STR_ECM} ${NSS_IPSEC_LOG_FILE}`
+		if [[ $str == ${NSS_IPSEC_LOG_STR_ECM} ]]; then
+			/etc/init.d/qca-nss-ecm stop
+			`sed 's/${NSS_IPSEC_LOG_STR_ECM}/ /g' $NSS_IPSEC_LOG_FILE >  $NSS_IPSEC_LOG_FILE`
+		fi
+	fi
+}
+
+ecm_disable() {
+
+	if [ ! -d /sys/module/ecm ]; then
+		return;
+	fi
+
+	echo 1 > /sys/kernel/debug/ecm/front_end_ipv4_stop
+	echo 1 > /sys/kernel/debug/ecm/front_end_ipv6_stop
+	echo 1 > /sys/kernel/debug/ecm/ecm_db/defunct_all
+	sleep 2
+}
+
+ecm_enable() {
+	if [ ! -d /sys/module/ecm ]; then
+		return;
+	fi
+
+	echo 0 > /sys/kernel/debug/ecm/ecm_db/defunct_all
+	echo 0 > /sys/kernel/debug/ecm/front_end_ipv4_stop
+	echo 0 > /sys/kernel/debug/ecm/front_end_ipv6_stop
+}
+
+start() {
+	ecm_load
+
+	local kernel_version=$(uname -r)
+
+	insmod /lib/modules/${kernel_version}/qca-nss-ipsec-klips.ko
+	if [ "$?" -gt 0 ]; then
+		echo "Failed to load plugin. Please start ecm if not done already"
+		ecm_enable
+		return
+	fi
+
+	/etc/init.d/ipsec start
+	sleep 2
+	ipsec eroute
+
+	ecm_enable
+}
+
+stop() {
+	ecm_disable
+
+	/etc/init.d/ipsec stop
+	rmmod qca-nss-ipsec-klips
+
+	ecm_unload
+}
+
+restart() {
+	stop
+	start
+}
diff --git a/qca/qca-nss-clients/files/qca-nss-mirred.init b/qca/qca-nss-clients/files/qca-nss-mirred.init
new file mode 100644
index 000000000..1f931f090
--- /dev/null
+++ b/qca/qca-nss-clients/files/qca-nss-mirred.init
@@ -0,0 +1,28 @@
+#!/bin/sh /etc/rc.common
+
+###########################################################################
+# Copyright (c) 2019, The Linux Foundation. All rights reserved.
+# Permission to use, copy, modify, and/or distribute this software for
+# any purpose with or without fee is hereby granted, provided that the
+# above copyright notice and this permission notice appear in all copies.
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+# OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+###########################################################################
+
+restart() {
+	rmmod act_nssmirred.ko
+	insmod act_nssmirred.ko
+}
+
+start() {
+	insmod act_nssmirred.ko
+}
+
+stop() {
+	rmmod act_nssmirred.ko
+}
diff --git a/qca/qca-nss-clients/files/qca-nss-ovpn.init b/qca/qca-nss-clients/files/qca-nss-ovpn.init
new file mode 100644
index 000000000..622e295ee
--- /dev/null
+++ b/qca/qca-nss-clients/files/qca-nss-ovpn.init
@@ -0,0 +1,69 @@
+#!/bin/sh /etc/rc.common
+
+###########################################################################
+# Copyright (c) 2019, The Linux Foundation. All rights reserved.
+# Permission to use, copy, modify, and/or distribute this software for
+# any purpose with or without fee is hereby granted, provided that the
+# above copyright notice and this permission notice appear in all copies.
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+# OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+###########################################################################
+
+ecm_disable() {
+	if [ ! -d /sys/module/ecm ]; then
+	   return
+	fi
+
+	echo 1 > /sys/kernel/debug/ecm/front_end_ipv4_stop
+	echo 1 > /sys/kernel/debug/ecm/front_end_ipv6_stop
+	echo 1 > /sys/kernel/debug/ecm/ecm_db/defunct_all
+	sleep 2
+}
+
+ecm_enable() {
+	if [ ! -d /sys/module/ecm ]; then
+	   return
+	fi
+
+	echo 0 > /sys/kernel/debug/ecm/ecm_db/defunct_all
+	echo 0 > /sys/kernel/debug/ecm/front_end_ipv4_stop
+	echo 0 > /sys/kernel/debug/ecm/front_end_ipv6_stop
+}
+
+restart() {
+	ecm_disable
+
+	/etc/init.d/openvpn stop
+	rmmod qca-nss-ovpn-link
+	rmmod qca-nss-ovpn-mgr
+
+	insmod qca-nss-ovpn-mgr
+	insmod qca-nss-ovpn-link
+
+	if [ "$?" -gt 0 ]; then
+		echo "Failed to load plugin. Please start ecm if not done already"
+		ecm_enable
+		return
+	fi
+
+	ecm_enable
+}
+
+start() {
+	restart
+}
+
+stop() {
+	ecm_disable
+
+	/etc/init.d/openvpn stop
+	rmmod qca-nss-ovpn-link
+	rmmod qca-nss-ovpn-mgr
+
+	ecm_enable
+}
diff --git a/qca/qca-nss-crypto/Makefile b/qca/qca-nss-crypto/Makefile
new file mode 100644
index 000000000..7b4baec25
--- /dev/null
+++ b/qca/qca-nss-crypto/Makefile
@@ -0,0 +1,62 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=qca-nss-crypto
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2021-03-22
+PKG_SOURCE_URL:=https://source.codeaurora.org/quic/qsdk/oss/lklm/nss-crypto
+PKG_SOURCE_VERSION:=2271a3a66f7e8284d42a9e787ddec6f24a1d2e15
+PKG_MIRROR_HASH:=7e70ffa2cbddc3830376f25047575db8867f2027b2ae3a7276d87ead3e95eb80
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/package.mk
+
+# v1.0 is for Akronite
+# v2.0 is for Hawkeye/Cypress/Maple
+ifneq (, $(findstring $(BOARD), ipq50xx ipq60xx ipq807x))
+NSS_CRYPTO_DIR:=v2.0
+else
+NSS_CRYPTO_DIR:=v1.0
+endif
+
+define KernelPackage/qca-nss-crypto
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS crypto driver
+  FILES:= \
+	$(PKG_BUILD_DIR)/$(NSS_CRYPTO_DIR)/src/qca-nss-crypto.ko \
+	$(PKG_BUILD_DIR)/$(NSS_CRYPTO_DIR)/tool/qca-nss-crypto-tool.ko
+  DEPENDS:=@TARGET_ipq60xx +kmod-qca-nss-drv
+  AUTOLOAD:=$(call AutoLoad,52,qca-nss-crypto)
+endef
+
+define KernelPackage/qca-nss-crypto/Description
+This package contains a NSS crypto driver for QCA chipset
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include/qca-nss-crypto
+	$(CP) $(PKG_BUILD_DIR)/$(NSS_CRYPTO_DIR)/include/* $(1)/usr/include/qca-nss-crypto
+endef
+
+EXTRA_CFLAGS+= \
+	-DCONFIG_NSS_DEBUG_LEVEL=4 \
+	-I$(STAGING_DIR)/usr/include/qca-nss-crypto \
+	-I$(STAGING_DIR)/usr/include/qca-nss-drv \
+	-I$(PKG_BUILD_DIR)/$(NSS_CRYPTO_DIR)/include \
+	-I$(PKG_BUILD_DIR)/$(NSS_CRYPTO_DIR)/src
+
+define Build/Compile
+	$(MAKE) -C "$(LINUX_DIR)" \
+		NSS_CRYPTO_DIR=$(NSS_CRYPTO_DIR) \
+		CROSS_COMPILE="$(TARGET_CROSS)" \
+		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
+		$(KERNEL_MAKE_FLAGS) \
+		M="$(PKG_BUILD_DIR)" \
+		SoC="$(BOARD)_64" \
+		modules
+endef
+
+$(eval $(call KernelPackage,qca-nss-crypto))
diff --git a/qca/qca-nss-dp/Makefile b/qca/qca-nss-dp/Makefile
new file mode 100644
index 000000000..4f85a43d1
--- /dev/null
+++ b/qca/qca-nss-dp/Makefile
@@ -0,0 +1,54 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=qca-nss-dp
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2021-03-26
+PKG_SOURCE_URL:=https://source.codeaurora.org/quic/qsdk/oss/lklm/nss-dp
+PKG_SOURCE_VERSION:=e0c89348d5ad99559ce2fbe15d37b3b5bc66aa03
+PKG_MIRROR_HASH:=f369f0c3b33b5f4ad6d0a6ad6ac5495f63c9ecaf94e4e7fa345169f3e44fcf45
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/qca-nss-dp
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  DEPENDS:=@TARGET_ipq60xx +kmod-qca-ssdk
+  TITLE:=Kernel driver for NSS data plane
+  FILES:=$(PKG_BUILD_DIR)/qca-nss-dp.ko
+  AUTOLOAD:=$(call AutoLoad,31,qca-nss-dp)
+endef
+
+define KernelPackage/qca-nss-dp/Description
+This package contains a NSS data plane driver for QCA chipset
+endef
+
+define Build/InstallDev
+	mkdir -p $(1)/usr/include/qca-nss-dp
+	$(CP) $(PKG_BUILD_DIR)/exports/* $(1)/usr/include/qca-nss-dp/
+endef
+
+EXTRA_CFLAGS+= \
+	-I$(STAGING_DIR)/usr/include/qca-ssdk
+
+NSS_DP_HAL_DIR:=$(PKG_BUILD_DIR)/hal
+
+define Build/Configure
+	$(LN) $(NSS_DP_HAL_DIR)/arch/$(BOARD)/nss_$(BOARD).h \
+		$(PKG_BUILD_DIR)/exports/nss_dp_arch.h
+endef
+
+define Build/Compile
+	$(MAKE) -C "$(LINUX_DIR)" \
+		CROSS_COMPILE="$(TARGET_CROSS)" \
+		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
+		$(KERNEL_MAKE_FLAGS) \
+		M="$(PKG_BUILD_DIR)" \
+		SoC="$(BOARD)_64" \
+		modules
+endef
+
+$(eval $(call KernelPackage,qca-nss-dp))
diff --git a/qca/qca-nss-drv/Makefile b/qca/qca-nss-drv/Makefile
new file mode 100644
index 000000000..4fce341e5
--- /dev/null
+++ b/qca/qca-nss-drv/Makefile
@@ -0,0 +1,109 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=qca-nss-drv
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2021-11-12
+PKG_SOURCE_URL:=https://source.codeaurora.org/quic/qsdk/oss/lklm/nss-drv
+PKG_SOURCE_VERSION:=5d47e4261bae9bc343ce50402011ee64729684f9
+PKG_MIRROR_HASH:=832a6f3af2d37f3e38231a3df41d5d7d9c7abc4975c0445f962146e8950a9433
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/qca-nss-drv
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  DEPENDS:=@TARGET_ipq60xx +kmod-qca-nss-dp
+  TITLE:=Kernel driver for NSS (core driver)
+  FILES:=$(PKG_BUILD_DIR)/qca-nss-drv.ko
+  AUTOLOAD:=$(call AutoLoad,32,qca-nss-drv)
+endef
+
+define KernelPackage/qca-nss-drv/install
+	$(INSTALL_DIR) $(1)/lib/debug
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_DIR) $(1)/etc/sysctl.d
+	$(INSTALL_DIR) $(1)/etc/config
+
+	$(INSTALL_BIN) ./files/qca-nss-drv.debug $(1)/lib/debug/qca-nss-drv
+	$(INSTALL_BIN) ./files/qca-nss-drv.init $(1)/etc/init.d/qca-nss-drv
+	$(INSTALL_BIN) ./files/qca-nss-drv.sysctl $(1)/etc/sysctl.d/qca-nss-drv.conf
+	$(INSTALL_BIN) ./files/qca-nss-drv.conf $(1)/etc/config/nss
+endef
+
+define KernelPackage/qca-nss-drv/Description
+This package contains a NSS driver for QCA chipset
+endef
+
+define Build/InstallDev
+	mkdir -p $(1)/usr/include/qca-nss-drv
+	$(CP) $(PKG_BUILD_DIR)/exports/* $(1)/usr/include/qca-nss-drv/
+endef
+
+EXTRA_CFLAGS+= -Wno-unused-variable \
+	-I$(STAGING_DIR)/usr/include/qca-nss-dp \
+	-I$(STAGING_DIR)/usr/include/qca-ssdk
+
+ifeq ($(CONFIG_KERNEL_IPQ_MEM_PROFILE),256)
+EXTRA_CFLAGS+= -DNSS_MEM_PROFILE_LOW
+endif
+
+ifeq ($(CONFIG_KERNEL_IPQ_MEM_PROFILE),512)
+EXTRA_CFLAGS+= -DNSS_MEM_PROFILE_MEDIUM
+endif
+
+ifeq ($(CONFIG_KERNEL_SKB_FIXED_SIZE_2K),y)
+EXTRA_CFLAGS+= -DNSS_SKB_FIXED_SIZE_2K
+endif
+
+DRV_MAKE_OPTS:=
+ifeq ($(CONFIG_KERNEL_IPQ_MEM_PROFILE),256)
+DRV_MAKE_OPTS+= \
+        NSS_DRV_C2C_ENABLE=n \
+        NSS_DRV_CAPWAP_ENABLE=n \
+        NSS_DRV_CLMAP_ENABLE=n \
+        NSS_DRV_CRYPTO_ENABLE=n \
+        NSS_DRV_DTLS_ENABLE=n \
+        NSS_DRV_GRE_ENABLE=n \
+        NSS_DRV_GRE_REDIR_ENABLE=n \
+        NSS_DRV_GRE_TUNNEL_ENABLE=n \
+        NSS_DRV_IGS_ENABLE=n \
+        NSS_DRV_IPSEC_ENABLE=n \
+        NSS_DRV_LAG_ENABLE=n \
+        NSS_DRV_L2TP_ENABLE=n \
+        NSS_DRV_MAPT_ENABLE=n \
+        NSS_DRV_OAM_ENABLE=n \
+        NSS_DRV_PPTP_ENABLE=n \
+        NSS_DRV_PORTID_ENABLE=n \
+        NSS_DRV_PVXLAN_ENABLE=n \
+        NSS_DRV_QRFS_ENABLE=n \
+        NSS_DRV_QVPN_ENABLE=n \
+        NSS_DRV_RMNET_ENABLE=n \
+        NSS_DRV_SHAPER_ENABLE=n \
+        NSS_DRV_SJACK_ENABLE=n \
+        NSS_DRV_TLS_ENABLE=n \
+        NSS_DRV_TRUSTSEC_ENABLE=n \
+        NSS_DRV_TSTAMP_ENABLE=n \
+        NSS_DRV_TUN6RD_ENABLE=n \
+        NSS_DRV_TUNIPIP6_ENABLE=n \
+        NSS_DRV_VXLAN_ENABLE=n
+endif
+
+define Build/Configure
+	$(LN) arch/nss_$(BOARD)_64.h $(PKG_BUILD_DIR)/exports/nss_arch.h
+endef
+
+define Build/Compile
+	$(MAKE) -C "$(LINUX_DIR)" $(strip $(DRV_MAKE_OPTS)) \
+		CROSS_COMPILE="$(TARGET_CROSS)" \
+		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
+		$(KERNEL_MAKE_FLAGS) \
+		M="$(PKG_BUILD_DIR)" \
+		SoC="$(BOARD)_64" \
+		modules
+endef
+
+$(eval $(call KernelPackage,qca-nss-drv))
diff --git a/qca/qca-nss-drv/files/qca-nss-drv.conf b/qca/qca-nss-drv/files/qca-nss-drv.conf
new file mode 100644
index 000000000..a8a1fbf40
--- /dev/null
+++ b/qca/qca-nss-drv/files/qca-nss-drv.conf
@@ -0,0 +1,6 @@
+config nss_firmware 'qca_nss_0'
+
+config nss_firmware 'qca_nss_1'
+
+config general
+	option enable_rps	'1'
diff --git a/qca/qca-nss-drv/files/qca-nss-drv.debug b/qca/qca-nss-drv/files/qca-nss-drv.debug
new file mode 100644
index 000000000..5d435c3a7
--- /dev/null
+++ b/qca/qca-nss-drv/files/qca-nss-drv.debug
@@ -0,0 +1,26 @@
+#!/bin/sh /sbin/sysdebug
+#
+# Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+log cat /sys/kernel/debug/qca-nss-drv/stats/pppoe
+log cat /sys/kernel/debug/qca-nss-drv/stats/n2h
+log cat /sys/kernel/debug/qca-nss-drv/stats/ipv6
+log cat /sys/kernel/debug/qca-nss-drv/stats/ipv4
+log cat /sys/kernel/debug/qca-nss-drv/stats/gmac
+log cat /sys/kernel/debug/qca-nss-drv/stats/drv
+log cat /sys/kernel/debug/qca-nss-drv/stats/wifi
+log cat /sys/kernel/debug/qca-nss-drv/stats/wifi_if
+log cat /sys/kernel/debug/qca-nss-drv/stats/eth_rx
diff --git a/qca/qca-nss-drv/files/qca-nss-drv.hotplug b/qca/qca-nss-drv/files/qca-nss-drv.hotplug
new file mode 100644
index 000000000..1e4813838
--- /dev/null
+++ b/qca/qca-nss-drv/files/qca-nss-drv.hotplug
@@ -0,0 +1,70 @@
+#!/bin/sh
+#
+# Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+KERNEL=`uname -r`
+case "${KERNEL}" in
+	3.4*)
+		select_or_load=load_nss_fw
+		;;
+	*)
+		select_or_load=select_nss_fw
+		;;
+esac
+
+load_nss_fw () {
+	ls -l $1 | awk ' { print $9,$5 } '> /dev/console
+	echo 1 > /sys/class/firmware/$DEVICENAME/loading
+	cat $1 > /sys/class/firmware/$DEVICENAME/data
+	echo 0 > /sys/class/firmware/$DEVICENAME/loading
+}
+
+select_nss_fw () {
+	rm -f /lib/firmware/$DEVICENAME
+	ln -s $1 /lib/firmware/$DEVICENAME
+	ls -l /lib/firmware/$DEVICENAME | awk ' { print $9,$5 } '> /dev/console
+}
+
+[ "$ACTION" != "add" ] && exit
+
+# dev name for UCI, since it doesn't let you use . or -
+SDEVNAME=$(echo ${DEVICENAME} | sed s/[.-]/_/g)
+
+SELECTED_FW=$(uci get nss.${SDEVNAME}.firmware 2>/dev/null)
+[ -e "${SELECTED_FW}" ] && {
+	$select_or_load ${SELECTED_FW}
+	exit
+}
+
+case $DEVICENAME in
+        qca-nss0* | qca-nss.0*)
+                if [ -e /lib/firmware/qca-nss0-enterprise.bin ] ; then
+                        $select_or_load /lib/firmware/qca-nss0-enterprise.bin
+                else
+                        $select_or_load /lib/firmware/qca-nss0-retail.bin
+                fi
+                exit
+                ;;
+        qca-nss1* | qca-nss.1*)
+                if [ -e /lib/firmware/qca-nss1-enterprise.bin ] ; then
+                        $select_or_load /lib/firmware/qca-nss1-enterprise.bin
+                else
+                        $select_or_load /lib/firmware/qca-nss1-retail.bin
+                fi
+                exit
+                ;;
+esac
+
diff --git a/qca/qca-nss-drv/files/qca-nss-drv.init b/qca/qca-nss-drv/files/qca-nss-drv.init
new file mode 100644
index 000000000..de12cb6d1
--- /dev/null
+++ b/qca/qca-nss-drv/files/qca-nss-drv.init
@@ -0,0 +1,50 @@
+#!/bin/sh /etc/rc.common
+#
+# Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+START=70
+
+enable_rps() {
+	irq_nss_rps=`grep nss_queue1 /proc/interrupts | cut -d ':' -f 1 | tr -d ' '`
+	for entry in $irq_nss_rps
+	do
+		echo 2 > /proc/irq/$entry/smp_affinity
+	done
+
+	irq_nss_rps=`grep nss_queue2 /proc/interrupts | cut -d ':' -f 1 | tr -d ' '`
+	for entry in $irq_nss_rps
+	do
+		echo 4 > /proc/irq/$entry/smp_affinity
+	done
+
+	irq_nss_rps=`grep nss_queue3 /proc/interrupts | cut -d ':' -f 1 | tr -d ' '`
+	for entry in $irq_nss_rps
+	do
+		echo 8 > /proc/irq/$entry/smp_affinity
+	done
+
+	# Enable NSS RPS
+	sysctl -w dev.nss.rps.enable=1 >/dev/null 2>/dev/null
+
+}
+
+
+start() {
+	local rps_enabled="$(uci_get nss @general[0] enable_rps)"
+	if [ "$rps_enabled" -eq 1 ]; then
+		enable_rps
+	fi
+}
diff --git a/qca/qca-nss-drv/files/qca-nss-drv.sysctl b/qca/qca-nss-drv/files/qca-nss-drv.sysctl
new file mode 100644
index 000000000..0276bba12
--- /dev/null
+++ b/qca/qca-nss-drv/files/qca-nss-drv.sysctl
@@ -0,0 +1,3 @@
+# Default Number of connection configuration
+dev.nss.ipv4cfg.ipv4_conn=4096
+dev.nss.ipv6cfg.ipv6_conn=4096
diff --git a/qca/qca-nss-ecm/Makefile b/qca/qca-nss-ecm/Makefile
new file mode 100644
index 000000000..a32cc87c5
--- /dev/null
+++ b/qca/qca-nss-ecm/Makefile
@@ -0,0 +1,90 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=qca-nss-ecm
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2021-11-09
+PKG_SOURCE_URL:=https://source.codeaurora.org/quic/qsdk/oss/lklm/qca-nss-ecm
+PKG_SOURCE_VERSION:=33122aebdd54803b5817065060289d6af5dfd3ba
+PKG_MIRROR_HASH:=a857db70804e19a20efef2d1ad519fe26bce3a45decd6ae3bb4a26d53f464a8d
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/qca-nss-ecm
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Support
+  DEPENDS:=@TARGET_ipq60xx +iptables-mod-extra +iptables-mod-physdev \
+	+kmod-ipt-conntrack +kmod-ipt-physdev +kmod-pppoe +kmod-qca-nss-drv
+  TITLE:=QCA NSS Enhanced Connection Manager (ECM)
+  FILES:=$(PKG_BUILD_DIR)/*.ko
+  KCONFIG:= \
+	CONFIG_BRIDGE_NETFILTER=y \
+	CONFIG_NF_CONNTRACK_EVENTS=y \
+	CONFIG_NF_CONNTRACK_CHAIN_EVENTS=y \
+	CONFIG_NF_CONNTRACK_DSCPREMARK_EXT=n
+endef
+
+define KernelPackage/qca-nss-ecm/Description
+This package contains the QCA NSS Enhanced Connection Manager
+endef
+
+define KernelPackage/qca-nss-ecm/install
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_DATA) ./files/qca-nss-ecm.uci $(1)/etc/config/ecm
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) ./files/qca-nss-ecm.init $(1)/etc/init.d/qca-nss-ecm
+	$(INSTALL_DIR) $(1)/etc/firewall.d
+	$(INSTALL_DATA) ./files/qca-nss-ecm.firewall $(1)/etc/firewall.d/qca-nss-ecm
+	$(INSTALL_DIR) $(1)/etc/sysctl.d
+	$(INSTALL_BIN) ./files/qca-nss-ecm.sysctl $(1)/etc/sysctl.d/qca-nss-ecm.conf
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_DATA) ./files/qca-nss-ecm.defaults $(1)/etc/uci-defaults/99-qca-nss-ecm
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) ./files/ecm_dump.sh $(1)/usr/bin/
+	$(INSTALL_DIR) $(1)/lib/netifd/offload
+	$(INSTALL_BIN) ./files/on-demand-down $(1)/lib/netifd/offload/on-demand-down
+endef
+
+EXTRA_CFLAGS+=-I$(STAGING_DIR)/usr/include/qca-nss-drv
+
+ifneq (, $(findstring $(BOARD), ipq60xx ipq807x))
+ECM_MAKE_OPTS+= \
+		ECM_BAND_STEERING_ENABLE=n \
+		ECM_CLASSIFIER_DSCP_ENABLE=n \
+		ECM_CLASSIFIER_HYFI_ENABLE=n \
+		ECM_CLASSIFIER_MARK_ENABLE=n \
+		ECM_CLASSIFIER_PCC_ENABLE=n \
+		ECM_FRONT_END_NSS_ENABLE=y \
+		ECM_INTERFACE_BOND_ENABLE=n \
+		ECM_INTERFACE_GRE_TAP_ENABLE=n \
+		ECM_INTERFACE_GRE_TUN_ENABLE=n \
+		ECM_INTERFACE_IPSEC_ENABLE=n \
+		ECM_INTERFACE_L2TPV2_ENABLE=n \
+		ECM_INTERFACE_PPPOE_ENABLE=y \
+		ECM_INTERFACE_PPTP_ENABLE=n \
+		ECM_INTERFACE_RAWIP_ENABLE=n \
+		ECM_INTERFACE_SIT_ENABLE=n \
+		ECM_INTERFACE_TUNIPIP6_ENABLE=n \
+		ECM_INTERFACE_VLAN_ENABLE=n \
+		ECM_MULTICAST_ENABLE=n
+endif
+
+define Build/InstallDev
+	mkdir -p $(1)/usr/include/qca-nss-ecm
+	$(CP) $(PKG_BUILD_DIR)/exports/* $(1)/usr/include/qca-nss-ecm
+endef
+
+define Build/Compile
+	$(MAKE) -C "$(LINUX_DIR)" $(strip $(ECM_MAKE_OPTS)) \
+		CROSS_COMPILE="$(TARGET_CROSS)" \
+		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
+		$(KERNEL_MAKE_FLAGS) \
+		M="$(PKG_BUILD_DIR)" \
+		SoC="$(BOARD)_64" \
+		modules
+endef
+
+$(eval $(call KernelPackage,qca-nss-ecm))
diff --git a/qca/qca-nss-ecm/files/ecm_dump.sh b/qca/qca-nss-ecm/files/ecm_dump.sh
new file mode 100644
index 000000000..dbf7de753
--- /dev/null
+++ b/qca/qca-nss-ecm/files/ecm_dump.sh
@@ -0,0 +1,95 @@
+#!/bin/sh
+#
+# Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+ECM_MODULE=${1:-ecm_state}
+MOUNT_ROOT=/dev/ecm
+
+#
+# usage: ecm_dump.sh [module=ecm_db]
+#
+# with no parameters, ecm_dump.sh will attempt to mount the
+# ecm_db state file and cat its contents.
+#
+# example with a parameter: ecm_dump.sh ecm_classifier_default
+#
+# this will cause ecm_dump to attempt to find and mount the state
+# file for the ecm_classifier_default module, and if successful
+# cat the contents.
+#
+
+# this is one of the state files, which happens to be the
+# last module started in ecm
+ECM_STATE=/sys/kernel/debug/ecm/ecm_state/state_dev_major
+
+# tests to see if ECM is up and ready to receive commands.
+# returns 0 if ECM is fully up and ready, else 1
+ecm_is_ready() {
+	if [ ! -e "${ECM_STATE}" ]
+	then
+		return 1
+	fi
+	return 0
+}
+
+#
+# module_state_mount(module_name)
+#      Mounts the state file of the module, if supported
+#
+module_state_mount() {
+	local module_name=$1
+	local mount_dir=$2
+	local state_file="/sys/kernel/debug/ecm/${module_name}/state_dev_major"
+
+	if [ -e "${mount_dir}/${module_name}" ]
+	then
+		# already mounted
+		return 0
+	fi
+
+	#echo "Mount state file for $module_name ..."
+	if [ ! -e "$state_file" ]
+	then
+		#echo "... $module_name does not support state"
+		return 1
+	fi
+
+	local major="`cat $state_file`"
+	#echo "... Mounting state $state_file with major: $major"
+	mknod "${mount_dir}/${module_name}" c $major 0
+}
+
+#
+# main
+#
+ecm_is_ready || {
+	#echo "ECM is not running"
+	exit 1
+}
+
+# all state files are mounted under MOUNT_ROOT, so make sure it exists
+mkdir -p ${MOUNT_ROOT}
+
+#
+# attempt to mount state files for the requested module and cat it
+# if the mount succeeded
+#
+module_state_mount ${ECM_MODULE} ${MOUNT_ROOT} && {
+	cat ${MOUNT_ROOT}/${ECM_MODULE}
+	exit 0
+}
+
+exit 2
diff --git a/qca/qca-nss-ecm/files/on-demand-down b/qca/qca-nss-ecm/files/on-demand-down
new file mode 100644
index 000000000..02d708e03
--- /dev/null
+++ b/qca/qca-nss-ecm/files/on-demand-down
@@ -0,0 +1,6 @@
+#!/bin/sh
+# Copyright (c) 2016 The Linux Foundation. All rights reserved.
+
+[ -e "/sys/kernel/debug/ecm/ecm_db/defunct_all" ] && {
+	echo 1 > /sys/kernel/debug/ecm/ecm_db/defunct_all
+}
diff --git a/qca/qca-nss-ecm/files/qca-nss-ecm.defaults b/qca/qca-nss-ecm/files/qca-nss-ecm.defaults
new file mode 100644
index 000000000..308e265c9
--- /dev/null
+++ b/qca/qca-nss-ecm/files/qca-nss-ecm.defaults
@@ -0,0 +1,28 @@
+#!/bin/sh
+#
+# Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+uci -q batch << EOF
+	delete firewall.qcanssecm
+	set firewall.qcanssecm=include
+	set firewall.qcanssecm.type=script
+	set firewall.qcanssecm.path=/etc/firewall.d/qca-nss-ecm
+	set firewall.qcanssecm.family=any
+	set firewall.qcanssecm.reload=1
+	commit firewall
+EOF
+
+exit 0
diff --git a/qca/qca-nss-ecm/files/qca-nss-ecm.firewall b/qca/qca-nss-ecm/files/qca-nss-ecm.firewall
new file mode 100644
index 000000000..24c64def2
--- /dev/null
+++ b/qca/qca-nss-ecm/files/qca-nss-ecm.firewall
@@ -0,0 +1,18 @@
+#!/bin/sh
+#
+# Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+iptables -A FORWARD -m physdev --physdev-is-bridged -j ACCEPT
diff --git a/qca/qca-nss-ecm/files/qca-nss-ecm.init b/qca/qca-nss-ecm/files/qca-nss-ecm.init
new file mode 100644
index 000000000..48862dfbd
--- /dev/null
+++ b/qca/qca-nss-ecm/files/qca-nss-ecm.init
@@ -0,0 +1,139 @@
+#!/bin/sh  /etc/rc.common
+#
+# Copyright (c) 2014, 2019-2020 The Linux Foundation. All rights reserved.
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+# The shebang above has an extra space intentially to avoid having
+# openwrt build scripts automatically enable this package starting
+# at boot.
+
+START=19
+
+get_front_end_mode() {
+	config_load "ecm"
+	config_get front_end global acceleration_engine "auto"
+
+	case $front_end in
+	auto)
+		echo '0'
+		;;
+	nss)
+		echo '1'
+		;;
+	sfe)
+		echo '2'
+		;;
+	*)
+		echo 'uci_option_acceleration_engine is invalid'
+	esac
+}
+
+support_bridge() {
+	#NSS support bridge acceleration
+	[ -d /sys/kernel/debug/ecm/ecm_nss_ipv4 ] && return 0
+	#SFE doesn't support bridge acceleration
+	[ -d /sys/kernel/debug/ecm/ecm_sfe_ipv4 ] && return 1
+}
+
+load_sfe() {
+	local kernel_version=$(uname -r)
+
+	[ -e "/lib/modules/$kernel_version/shortcut-fe.ko" ] && {
+		[ -d /sys/module/shortcut_fe ] || insmod shortcut-fe
+	}
+
+	[ -e "/lib/modules/$kernel_version/shortcut-fe-ipv6.ko" ] && {
+		[ -d /sys/module/shortcut_fe_ipv6 ] || insmod shortcut-fe-ipv6
+	}
+
+	[ -e "/lib/modules/$kernel_version/shortcut-fe-drv.ko" ] && {
+		[ -d /sys/module/shortcut_fe_drv ] || insmod shortcut-fe-drv
+	}
+}
+
+load_ecm() {
+	[ -d /sys/module/ecm ] || {
+		[ ! -e /proc/device-tree/MP_256 ] && load_sfe
+		insmod ecm front_end_selection=$(get_front_end_mode)
+	}
+
+	support_bridge && {
+		sysctl -w net.bridge.bridge-nf-call-ip6tables=1
+		sysctl -w net.bridge.bridge-nf-call-iptables=1
+	}
+}
+
+unload_ecm() {
+	sysctl -w net.bridge.bridge-nf-call-ip6tables=0
+	sysctl -w net.bridge.bridge-nf-call-iptables=0
+
+	if [ -d /sys/module/ecm ]; then
+		#
+		# Stop ECM frontends
+		#
+		echo 1 > /sys/kernel/debug/ecm/front_end_ipv4_stop
+		echo 1 > /sys/kernel/debug/ecm/front_end_ipv6_stop
+
+		#
+		# Defunct the connections
+		#
+	        echo 1 > /sys/kernel/debug/ecm/ecm_db/defunct_all
+		sleep 5;
+
+		rmmod ecm
+		sleep 1
+	fi
+}
+
+start() {
+	# If SFE CM is loaded, return.
+	if [ -d /sys/module/shortcut_fe_cm ]; then
+		echo "shortcut_fe CM is loaded, unload it first"
+		echo "cmd: /etc/init.d/shortcut_fe stop"
+		return
+	fi
+
+	load_ecm
+
+	# If the acceleration engine is NSS, enable wifi redirect.
+	[ -d /sys/kernel/debug/ecm/ecm_nss_ipv4 ] && sysctl -w dev.nss.general.redirect=1
+
+	support_bridge && {
+		echo 'net.bridge.bridge-nf-call-ip6tables=1' >> /etc/sysctl.d/qca-nss-ecm.conf
+		echo 'net.bridge.bridge-nf-call-iptables=1' >> /etc/sysctl.d/qca-nss-ecm.conf
+	}
+
+	if [ -d /sys/module/qca_ovsmgr ]; then
+		insmod ecm_ovs
+	fi
+}
+
+stop() {
+	# If ECM is already not loaded, just return.
+	if [ ! -d /sys/module/ecm ]; then
+		return
+	fi
+
+	# If the acceleration engine is NSS, disable wifi redirect.
+	[ -d /sys/kernel/debug/ecm/ecm_nss_ipv4 ] && sysctl -w dev.nss.general.redirect=0
+
+	sed '/net.bridge.bridge-nf-call-ip6tables=1/d' -i /etc/sysctl.d/qca-nss-ecm.conf
+	sed '/net.bridge.bridge-nf-call-iptables=1/d' -i /etc/sysctl.d/qca-nss-ecm.conf
+
+	if [ -d /sys/module/ecm_ovs ]; then
+		rmmod ecm_ovs
+	fi
+
+	unload_ecm
+}
diff --git a/qca/qca-nss-ecm/files/qca-nss-ecm.sysctl b/qca/qca-nss-ecm/files/qca-nss-ecm.sysctl
new file mode 100644
index 000000000..1a3d76b18
--- /dev/null
+++ b/qca/qca-nss-ecm/files/qca-nss-ecm.sysctl
@@ -0,0 +1,2 @@
+# nf_conntrack_tcp_no_window_check is 0 by default, set it to 1
+net.netfilter.nf_conntrack_tcp_no_window_check=1
diff --git a/qca/qca-nss-ecm/files/qca-nss-ecm.uci b/qca/qca-nss-ecm/files/qca-nss-ecm.uci
new file mode 100644
index 000000000..4f2de6877
--- /dev/null
+++ b/qca/qca-nss-ecm/files/qca-nss-ecm.uci
@@ -0,0 +1,2 @@
+config ecm 'global'
+	option acceleration_engine 'auto'
diff --git a/qca/qca-nss-ecm/patches/200-resolve-high-load.patch b/qca/qca-nss-ecm/patches/200-resolve-high-load.patch
new file mode 100644
index 000000000..253b450a5
--- /dev/null
+++ b/qca/qca-nss-ecm/patches/200-resolve-high-load.patch
@@ -0,0 +1,61 @@
+From 6924b71ed809b37fffd74d6428a8ca83e5919746 Mon Sep 17 00:00:00 2001
+From: Dirk Buchwalder <buchwalder@posteo.de>
+Date: Sun, 27 Jun 2021 16:52:39 +0200
+Subject: [PATCH] qca-nss-ecm: resolve the cpu high load regarding ecm
+
+If using ECM, cpu load goes up (around 1.0) and stucks there.
+This is due to using uninterruptible sleep function,
+the patch changes this to interruptible sleep function.
+
+Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
+---
+ frontends/nss/ecm_nss_ipv4.c | 4 ++--
+ frontends/nss/ecm_nss_ipv6.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/frontends/nss/ecm_nss_ipv4.c b/frontends/nss/ecm_nss_ipv4.c
+index e00553c..94b39cd 100644
+--- a/frontends/nss/ecm_nss_ipv4.c
++++ b/frontends/nss/ecm_nss_ipv4.c
+@@ -2471,7 +2471,7 @@ static void ecm_nss_ipv4_stats_sync_req_work(struct work_struct *work)
+ 	}
+ 	spin_unlock_bh(&ecm_nss_ipv4_lock);
+ 
+-	usleep_range(ECM_NSS_IPV4_STATS_SYNC_UDELAY - 100, ECM_NSS_IPV4_STATS_SYNC_UDELAY);
++	msleep_interruptible(ECM_NSS_IPV4_STATS_SYNC_UDELAY / 1000);
+ 
+ 	/*
+ 	 * If index is 0, we are starting a new round, but if we still have time remain
+@@ -2485,7 +2485,7 @@ static void ecm_nss_ipv4_stats_sync_req_work(struct work_struct *work)
+ 		}
+ 
+ 		if (time_after(ecm_nss_ipv4_next_req_time, current_jiffies)) {
+-			msleep(jiffies_to_msecs(ecm_nss_ipv4_next_req_time - current_jiffies));
++			msleep_interruptible(jiffies_to_msecs(ecm_nss_ipv4_next_req_time - current_jiffies));
+ 		}
+ 		ecm_nss_ipv4_roll_check_jiffies = jiffies;
+ 		ecm_nss_ipv4_next_req_time = ecm_nss_ipv4_roll_check_jiffies + ECM_NSS_IPV4_STATS_SYNC_PERIOD;
+diff --git a/frontends/nss/ecm_nss_ipv6.c b/frontends/nss/ecm_nss_ipv6.c
+index 82e739f..30af050 100644
+--- a/frontends/nss/ecm_nss_ipv6.c
++++ b/frontends/nss/ecm_nss_ipv6.c
+@@ -2210,7 +2210,7 @@ static void ecm_nss_ipv6_stats_sync_req_work(struct work_struct *work)
+ 	}
+ 	spin_unlock_bh(&ecm_nss_ipv6_lock);
+ 
+-	usleep_range(ECM_NSS_IPV6_STATS_SYNC_UDELAY - 100, ECM_NSS_IPV6_STATS_SYNC_UDELAY);
++	msleep_interruptible(ECM_NSS_IPV6_STATS_SYNC_UDELAY / 1000);
+ 
+ 	/*
+ 	 * If index is 0, we are starting a new round, but if we still have time remain
+@@ -2224,7 +2224,7 @@ static void ecm_nss_ipv6_stats_sync_req_work(struct work_struct *work)
+ 		}
+ 
+ 		if (time_after(ecm_nss_ipv6_next_req_time, current_jiffies)) {
+-			msleep(jiffies_to_msecs(ecm_nss_ipv6_next_req_time - current_jiffies));
++			msleep_interruptible(jiffies_to_msecs(ecm_nss_ipv6_next_req_time - current_jiffies));
+ 		}
+ 		ecm_nss_ipv6_roll_check_jiffies = jiffies;
+ 		ecm_nss_ipv6_next_req_time = ecm_nss_ipv6_roll_check_jiffies + ECM_NSS_IPV6_STATS_SYNC_PERIOD;
+-- 
+2.31.1
diff --git a/qca/qca-nss-fw-eip/Makefile b/qca/qca-nss-fw-eip/Makefile
new file mode 100644
index 000000000..104fe5c14
--- /dev/null
+++ b/qca/qca-nss-fw-eip/Makefile
@@ -0,0 +1,25 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=nss-eip-firmware
+PKG_VERSION=2.5.7
+PKG_RELEASE:=1
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/nss-eip-firmware
+  SECTION:=firmware
+  CATEGORY:=Firmware
+  TITLE:=NSS EIP-197 firmware
+  DEPENDS:=@(TARGET_ipq60xx||TARGET_ipq807x)
+endef
+
+define Build/Compile
+	true
+endef
+
+define Package/nss-eip-firmware/install
+	$(INSTALL_DIR) $(1)/lib/firmware/
+	$(CP) ./files/$(BOARD)/* $(1)/lib/firmware/
+endef
+
+$(eval $(call BuildPackage,nss-eip-firmware))
diff --git a/qca/qca-nss-fw-eip/files/ipq60xx/ifpp.bin b/qca/qca-nss-fw-eip/files/ipq60xx/ifpp.bin
new file mode 100644
index 000000000..033ad5552
Binary files /dev/null and b/qca/qca-nss-fw-eip/files/ipq60xx/ifpp.bin differ
diff --git a/qca/qca-nss-fw-eip/files/ipq60xx/ipue.bin b/qca/qca-nss-fw-eip/files/ipq60xx/ipue.bin
new file mode 100644
index 000000000..153a7b4e8
Binary files /dev/null and b/qca/qca-nss-fw-eip/files/ipq60xx/ipue.bin differ
diff --git a/qca/qca-nss-fw-eip/files/ipq60xx/ofpp.bin b/qca/qca-nss-fw-eip/files/ipq60xx/ofpp.bin
new file mode 100644
index 000000000..3d0745913
Binary files /dev/null and b/qca/qca-nss-fw-eip/files/ipq60xx/ofpp.bin differ
diff --git a/qca/qca-nss-fw-eip/files/ipq60xx/opue.bin b/qca/qca-nss-fw-eip/files/ipq60xx/opue.bin
new file mode 100644
index 000000000..80fb1a211
Binary files /dev/null and b/qca/qca-nss-fw-eip/files/ipq60xx/opue.bin differ
diff --git a/qca/qca-nss-fw-eip/files/ipq807x/ifpp.bin b/qca/qca-nss-fw-eip/files/ipq807x/ifpp.bin
new file mode 100644
index 000000000..6e5cbcada
Binary files /dev/null and b/qca/qca-nss-fw-eip/files/ipq807x/ifpp.bin differ
diff --git a/qca/qca-nss-fw-eip/files/ipq807x/ipue.bin b/qca/qca-nss-fw-eip/files/ipq807x/ipue.bin
new file mode 100644
index 000000000..9a75f9789
Binary files /dev/null and b/qca/qca-nss-fw-eip/files/ipq807x/ipue.bin differ
diff --git a/qca/qca-nss-fw-eip/files/ipq807x/ofpp.bin b/qca/qca-nss-fw-eip/files/ipq807x/ofpp.bin
new file mode 100644
index 000000000..6863d1068
Binary files /dev/null and b/qca/qca-nss-fw-eip/files/ipq807x/ofpp.bin differ
diff --git a/qca/qca-nss-fw-eip/files/ipq807x/opue.bin b/qca/qca-nss-fw-eip/files/ipq807x/opue.bin
new file mode 100644
index 000000000..82a363352
Binary files /dev/null and b/qca/qca-nss-fw-eip/files/ipq807x/opue.bin differ
diff --git a/qca/qca-ssdk-shell/Makefile b/qca/qca-ssdk-shell/Makefile
new file mode 100644
index 000000000..cd20c5b8c
--- /dev/null
+++ b/qca/qca-ssdk-shell/Makefile
@@ -0,0 +1,48 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=qca-ssdk-shell
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2021-12-01
+PKG_SOURCE_URL:=https://source.codeaurora.org/quic/qsdk/oss/ssdk-shell
+PKG_SOURCE_VERSION:=c443bebf58de61a148b35d307bf331bb349f9b8b
+PKG_MIRROR_HASH:=b48291620a90b1cfec949447bb2225da8a35fe48338412f1c50af43d9656c7c8
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/package.mk
+
+define Package/qca-ssdk-shell
+  SECTION:=utils
+  CATEGORY:=Utilities
+  TITLE:=Shell application for QCA SSDK
+  DEPENDS:=@TARGET_ipq60xx
+endef
+
+define Package/qca-ssdk-shell/Description
+  This package contains a qca-ssdk shell application for QCA chipset
+endef
+
+ifndef CONFIG_TOOLCHAIN_BIN_PATH
+CONFIG_TOOLCHAIN_BIN_PATH=$(TOOLCHAIN_DIR)/bin
+endif
+
+QCASSDK_CONFIG_OPTS+= \
+	ARCH=$(LINUX_KARCH) \
+	KVER=$(LINUX_VERSION) \
+	SYS_PATH=$(LINUX_DIR) \
+	CFLAGS="$(TARGET_CFLAGS)" \
+	LDFLAGS="$(TARGET_LDFLAGS)" \
+	TOOLPREFIX=$(TARGET_CROSS) \
+	TOOL_PATH=$(CONFIG_TOOLCHAIN_BIN_PATH)
+
+define Build/Compile
+	$(MAKE) -C $(PKG_BUILD_DIR) $(strip $(QCASSDK_CONFIG_OPTS))
+endef
+
+define Package/qca-ssdk-shell/install
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/build/bin/ssdk_sh $(1)/usr/sbin/
+endef
+
+$(eval $(call BuildPackage,qca-ssdk-shell))
diff --git a/qca/qca-ssdk/Makefile b/qca/qca-ssdk/Makefile
new file mode 100644
index 000000000..5a59425e0
--- /dev/null
+++ b/qca/qca-ssdk/Makefile
@@ -0,0 +1,98 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=qca-ssdk
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2021-12-07
+PKG_SOURCE_URL:=https://source.codeaurora.org/quic/qsdk/oss/lklm/qca-ssdk
+PKG_SOURCE_VERSION:=e7dcdd63724170465072f03ab04eab9d40b98954
+PKG_MIRROR_HASH:=8f0f33fd09821a09ef27d7e145596d80d20fb8a1d0766b9f8d7b517762daed27
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/qca-ssdk
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for QCA SSDK
+  FILES:=$(PKG_BUILD_DIR)/build/bin/qca-ssdk.ko
+  AUTOLOAD:=$(call AutoLoad,30,qca-ssdk)
+  PROVIDES:=qca-ssdk
+endef
+
+define KernelPackage/qca-ssdk/Description
+This package contains a qca-ssdk driver for QCA chipset
+endef
+
+GCC_VERSION=$(shell echo "$(CONFIG_GCC_VERSION)" | sed 's/[^0-9.]*\([0-9.]*\).*/\1/')
+
+TOOLCHAIN_BIN_PATH=$(TOOLCHAIN_DIR)/bin
+
+QCASSDK_CONFIG_OPTS+= \
+	$(KERNEL_MAKE_FLAGS) \
+	KVER=$(LINUX_VERSION) \
+	SYS_PATH=$(LINUX_DIR) \
+	GCC_VERSION=$(GCC_VERSION) \
+	TOOLPREFIX=$(TARGET_CROSS) \
+	TOOL_PATH=$(TOOLCHAIN_BIN_PATH) \
+	TARGET_SUFFIX=$(CONFIG_TARGET_SUFFIX) \
+	EXTRA_CFLAGS=-I$(STAGING_DIR)/usr/include
+
+ifeq ($(BOARD),ipq50xx)
+    QCASSDK_CONFIG_OPTS+= ISISC_ENABLE=enable
+    QCASSDK_CONFIG_OPTS+= CHIP_TYPE=MP
+else ifeq ($(BOARD),ipq60xx)
+    QCASSDK_CONFIG_OPTS+= CHIP_TYPE=CPPE
+    QCASSDK_CONFIG_OPTS+= PTP_FEATURE=enable
+else ifeq ($(BOARD),ipq807x)
+    QCASSDK_CONFIG_OPTS+= CHIP_TYPE=HPPE
+    QCASSDK_CONFIG_OPTS+= PTP_FEATURE=enable
+else ifeq ($(BOARD),ipq95xx)
+    QCASSDK_CONFIG_OPTS+= CHIP_TYPE=APPE
+else
+    QCASSDK_CONFIG_OPTS+= HK_CHIP=enable
+endif
+
+ifneq (, $(findstring $(CONFIG_KERNEL_IPQ_MEM_PROFILE), 256 512))
+    QCASSDK_CONFIG_OPTS+= MINI_SSDK=enable
+    QCASSDK_CONFIG_OPTS+= PTP_FEATURE=disable
+endif
+
+define Build/Compile
+	$(MAKE) -C $(PKG_BUILD_DIR) $(strip $(QCASSDK_CONFIG_OPTS))
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include/qca-ssdk
+	$(INSTALL_DIR) $(1)/usr/include/qca-ssdk/api
+	$(INSTALL_DIR) $(1)/usr/include/qca-ssdk/ref
+	$(INSTALL_DIR) $(1)/usr/include/qca-ssdk/fal
+	$(INSTALL_DIR) $(1)/usr/include/qca-ssdk/sal
+	$(INSTALL_DIR) $(1)/usr/include/qca-ssdk/init
+	$(CP) -rf $(PKG_BUILD_DIR)/include/api/sw_ioctl.h $(1)/usr/include/qca-ssdk/api
+	if [ -f $(PKG_BUILD_DIR)/include/ref/ref_vsi.h ]; then \
+	$(CP) -rf $(PKG_BUILD_DIR)/include/ref/ref_vsi.h $(1)/usr/include/qca-ssdk/ref/; \
+	fi
+	if [ -f $(PKG_BUILD_DIR)/include/ref/ref_fdb.h ]; then \
+	$(CP) -rf $(PKG_BUILD_DIR)/include/ref/ref_fdb.h $(1)/usr/include/qca-ssdk/ref/; \
+	fi
+	if [ -f $(PKG_BUILD_DIR)/include/ref/ref_port_ctrl.h ]; then \
+	$(CP) -rf $(PKG_BUILD_DIR)/include/ref/ref_port_ctrl.h $(1)/usr/include/qca-ssdk/ref/; \
+	fi
+	if [ -f $(PKG_BUILD_DIR)/include/init/ssdk_init.h ]; then \
+	$(CP) -rf $(PKG_BUILD_DIR)/include/init/ssdk_init.h $(1)/usr/include/qca-ssdk/init/; \
+	fi
+	$(CP) -rf $(PKG_BUILD_DIR)/include/fal $(1)/usr/include/qca-ssdk
+	$(CP) -rf $(PKG_BUILD_DIR)/include/common/*.h $(1)/usr/include/qca-ssdk
+	$(CP) -rf $(PKG_BUILD_DIR)/include/sal/os/linux/*.h $(1)/usr/include/qca-ssdk
+	$(CP) -rf $(PKG_BUILD_DIR)/include/sal/os/*.h $(1)/usr/include/qca-ssdk
+endef
+
+define KernelPackage/qca-ssdk/install
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) ./files/qca-ssdk $(1)/etc/init.d/qca-ssdk
+endef
+
+$(eval $(call KernelPackage,qca-ssdk))
diff --git a/qca/qca-ssdk/files/qca-ssdk b/qca/qca-ssdk/files/qca-ssdk
new file mode 100644
index 000000000..389279c0c
--- /dev/null
+++ b/qca/qca-ssdk/files/qca-ssdk
@@ -0,0 +1,206 @@
+#!/bin/sh /etc/rc.common
+# Copyright (c) 2018, The Linux Foundation. All rights reserved.
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+START=16
+
+#!/bin/sh
+ruletype="ip4 ip6"
+side="wan lan"
+qwan="1 3 2 0 5 7 6 4"
+qlan="0 1 2 3 4 5 6 7"
+
+function create_war_acl_rules(){
+	for lw in $side
+	do
+		#echo $lw
+		if [ "$lw" == "wan" ];then
+			listid=254
+			queue=$qwan
+			portmap=0x20
+		else
+			listid=255
+			queue=$qlan
+			portmap=0x1e
+		fi
+		#echo $queue
+		#echo "creating list $listid"
+		ssdk_sh acl list create $listid 255
+		ruleid=0
+		for rt in $ruletype
+		do
+			for qid in $queue
+			do
+				cmd="ssdk_sh acl rule add $listid $ruleid  1 n 0 0"
+				#echo $cmd
+				if [ "$rt" == "ip4" ];then
+					cmd="$cmd ip4 n n n n n n n n n n n n n n n n n n n n n n n n n n n n n"
+					#echo $cmd
+				else
+					cmd="$cmd ip6 n n n n n n n n n n n n n n n n n n n n n n n n n n n n n n n"
+					#echo $cmd
+				fi
+				if [ $ruleid -le 3 ];then
+					#non-zero dscp
+					cmd="$cmd y 0x0 0xff"
+				elif [ $ruleid -le 7 ];then
+					#zero dscp
+					cmd="$cmd n"
+				elif [ $ruleid -le 11 ];then
+					#non-zero dscp
+					cmd="$cmd y 0x0 0xff"
+				else
+					#zero dscp
+					cmd="$cmd n"
+				fi
+				p=$((ruleid/2))
+				cmd="$cmd y mask $((ruleid%2)) 0x1 y mask $((p%2)) 0x1 n n n n n n n n n n n n n n n y n n n n n n n y $qid n n 0 0 n n n n n n n n n n n n n n n n n n n n 0"
+				#echo $cmd
+				$cmd
+				ruleid=`expr $ruleid + 1`
+			done
+		done
+		ssdk_sh acl list bind $listid 0 1 $portmap
+	done
+}
+
+function create_war_cosmap(){
+	ssdk_sh cosmap pri2q set 0 0
+	ssdk_sh cosmap pri2q set 1 0
+	ssdk_sh cosmap pri2q set 2 0
+	ssdk_sh cosmap pri2q set 3 0
+	ssdk_sh cosmap pri2q set 4 1
+	ssdk_sh cosmap pri2q set 5 1
+	ssdk_sh cosmap pri2q set 6 1
+	ssdk_sh cosmap pri2q set 7 1
+	ssdk_sh cosmap pri2ehq set 0 0
+	ssdk_sh cosmap pri2ehq set 1 0
+	ssdk_sh cosmap pri2ehq set 2 0
+	ssdk_sh cosmap pri2ehq set 3 0
+	ssdk_sh cosmap pri2ehq set 4 1
+	ssdk_sh cosmap pri2ehq set 5 1
+	ssdk_sh cosmap pri2ehq set 6 1
+	ssdk_sh cosmap pri2ehq set 7 1
+}
+
+function create_acl_byp_egstp_rules(){
+	ssdk_sh debug module_func set servcode 0xf 0x0 0x0
+	ssdk_sh servcode config set 1 n 0 0xfffefc7f 0xffbdff 0 0 0 0 0 0
+	ssdk_sh debug module_func set servcode 0x0 0x0 0x0
+	ssdk_sh acl list create 56 48
+	ssdk_sh acl rule add 56 0 1 n 0 0 mac n n n n n y 01-80-c2-00-00-00 ff-ff-ff-ff-ff-ff n n n n n n n n n n n n n n n n n n n n n n n y n n n n n n n n n n 0 0 n n n n n n n n n n n n n y n n n n n n n n n n n n y n n n n n n n n n n n n 0
+	ssdk_sh acl rule add 56 1 1 n 0 0 mac n n n n n n n yes 0x8809 0xffff n n n n n n n n n n n n n n n n n n n n n y n n n n n n n n n n 0 0 n n n n n n n n n n n n n y n n n n n n n n n n n n y n n n n n n n n n n n n 0
+	ssdk_sh acl rule add 56 2 1 n 0 0 mac n n n n n n n yes 0x888e 0xffff n n n n n n n n n n n n n n n n n n n n n y n n n n n n n n n n 0 0 n n n n n n n n n n n n n y n n n n n n n n n n n n y n n n n n n n n n n n n 0
+	ssdk_sh acl list bind 56 0 2 1
+}
+
+function delete_war_acl_rules(){
+	for lw in $side
+	do
+		#echo $lw
+		if [ "$lw" == "wan" ];then
+			listid=254
+			queue=$qwan
+			portmap=0x20
+		else
+			listid=255
+			queue=$qlan
+			portmap=0x1e
+		fi
+		ssdk_sh acl list unbind $listid 0 1 $portmap
+		for rt in $ruletype
+		do
+			for qid in $queue
+			do
+				cmd="ssdk_sh acl rule del $listid 0 1"
+				echo $cmd
+				$cmd
+			done
+		done
+		#echo "deleting list $listid"
+		ssdk_sh acl list destroy $listid
+	done
+}
+
+function delete_war_cosmap(){
+	ssdk_sh cosmap pri2q set 0 0
+	ssdk_sh cosmap pri2q set 1 0
+	ssdk_sh cosmap pri2q set 2 1
+	ssdk_sh cosmap pri2q set 3 1
+	ssdk_sh cosmap pri2q set 4 2
+	ssdk_sh cosmap pri2q set 5 2
+	ssdk_sh cosmap pri2q set 6 3
+	ssdk_sh cosmap pri2q set 7 3
+	ssdk_sh cosmap pri2ehq set 0 1
+	ssdk_sh cosmap pri2ehq set 1 0
+	ssdk_sh cosmap pri2ehq set 2 2
+	ssdk_sh cosmap pri2ehq set 3 2
+	ssdk_sh cosmap pri2ehq set 4 3
+	ssdk_sh cosmap pri2ehq set 5 3
+	ssdk_sh cosmap pri2ehq set 6 4
+	ssdk_sh cosmap pri2ehq set 7 5
+}
+
+function delete_acl_byp_egstp_rules(){
+	ssdk_sh debug module_func set servcode 0xf 0x0 0x0
+	ssdk_sh servcode config set 1 n 0 0xfffefcff 0xffbfff 0 0 0 0 0 0
+	ssdk_sh debug module_func set servcode 0x0 0x0 0x0
+	ssdk_sh acl list unbind 56 0 2 1
+	ssdk_sh acl rule del 56 0 1
+	ssdk_sh acl rule del 56 1 1
+	ssdk_sh acl rule del 56 2 1
+	ssdk_sh acl list destroy 56
+}
+
+function edma_war_config_add(){
+	create_war_cosmap
+	ssdk_sh acl status set enable
+	create_war_acl_rules
+}
+
+function edma_war_config_del(){
+	delete_war_acl_rules
+	delete_war_cosmap
+}
+
+start() {
+	chip_ver=`ssdk_sh debug reg get 0 4 | grep Data | tr -d 'SSDK Init OK![Data]:'`
+	#The following commands should be uncommented to enable EDMA WAR
+	if [ "$chip_ver" = "0x1401" ]; then
+		#edma_war_config_add
+		echo ''
+	fi
+	#The following commands should be uncommented to add acl egress stp bypass rules
+	if [ "$chip_ver" = "0x1500" ] || [ "$chip_ver" = "0x1501" ]; then
+		#create_acl_byp_egstp_rules
+		echo ''
+	fi
+	echo starting
+}
+
+stop() {
+	chip_ver=`ssdk_sh debug reg get 0 4 | grep Data | tr -d 'SSDK Init OK![Data]:'`
+	#The following commands should be uncommented to disable EDMA WAR
+	if [ "$chip_ver" = "0x1401" ]; then
+		#edma_war_config_del
+		echo ''
+	fi
+	#The following commands should be uncommented to delete acl egress stp bypass rules
+	if [ "$chip_ver" = "0x1500" ] || [ "$chip_ver" = "0x1501" ]; then
+		#delete_acl_byp_egstp_rules
+		echo ''
+	fi
+	echo stoping
+}