diff --git a/build.sh b/build.sh
index 524cc71b..6bc391ca 100755
--- a/build.sh
+++ b/build.sh
@@ -446,6 +446,12 @@ fi
 if [ -f target/linux/generic/pending-5.4/641-netfilter-nf_flow_table-support-hw-offload-through-v.patch ]; then
 	rm -f target/linux/generic/pending-5.4/641-netfilter-nf_flow_table-support-hw-offload-through-v.patch
 fi
+if [ -f target/linux/generic/pending-5.4/642-net-8021q-support-hardware-flow-table-offload.patch ]; then
+	rm -f target/linux/generic/pending-5.4/642-net-8021q-support-hardware-flow-table-offload.patch
+fi
+if [ -f target/linux/generic/pending-5.4/643-net-bridge-support-hardware-flow-table-offload.patch ]; then
+	rm -f target/linux/generic/pending-5.4/643-net-bridge-support-hardware-flow-table-offload.patch
+fi
 if [ -f target/linux/generic/pending-5.4/644-net-pppoe-support-hardware-flow-table-offload.patch ]; then
 	rm -f target/linux/generic/pending-5.4/644-net-pppoe-support-hardware-flow-table-offload.patch
 fi
@@ -455,6 +461,9 @@ fi
 if [ -f target/linux/generic/pending-5.4/647-net-dsa-support-hardware-flow-table-offload.patch ]; then
 	rm -f target/linux/generic/pending-5.4/647-net-dsa-support-hardware-flow-table-offload.patch
 fi
+if [ -f target/linux/generic/hack-5.4/650-netfilter-add-xt_OFFLOAD-target.patch ]; then
+	rm -f target/linux/generic/hack-5.4/650-netfilter-add-xt_OFFLOAD-target.patch
+fi
 if [ -f target/linux/generic/pending-5.4/690-net-add-support-for-threaded-NAPI-polling.patch ]; then
 	rm -f target/linux/generic/pending-5.4/690-net-add-support-for-threaded-NAPI-polling.patch
 fi
@@ -467,6 +476,9 @@ fi
 if [ -f target/linux/bcm27xx/patches-5.4/950-1031-net-lan78xx-Ack-pending-PHY-ints-when-resetting.patch ]; then
 	rm -f target/linux/bcm27xx/patches-5.4/950-1031-net-lan78xx-Ack-pending-PHY-ints-when-resetting.patch
 fi
+if [ -f target/linux/generic/pending-5.4/770-16-net-ethernet-mediatek-mtk_eth_soc-add-flow-offloadin.patch ]; then
+	rm -f target/linux/generic/pending-5.4/770-16-net-ethernet-mediatek-mtk_eth_soc-add-flow-offloadin.patch
+fi
 
 if [ "$OMR_KERNEL" = "5.4" ]; then
 	echo "Set to kernel 5.4 for rpi arch"
diff --git a/root/package/kernel/linux/modules/netfilter.mk b/root/package/kernel/linux/modules/netfilter.mk
new file mode 100644
index 00000000..7d185802
--- /dev/null
+++ b/root/package/kernel/linux/modules/netfilter.mk
@@ -0,0 +1,1179 @@
+
+#
+# Copyright (C) 2006-2010 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+NF_MENU:=Netfilter Extensions
+NF_KMOD:=1
+include $(INCLUDE_DIR)/netfilter.mk
+
+
+define KernelPackage/nf-reject
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter IPv4 reject support
+  KCONFIG:= \
+	CONFIG_NETFILTER=y \
+	CONFIG_NETFILTER_ADVANCED=y \
+	$(KCONFIG_NF_REJECT)
+  FILES:=$(foreach mod,$(NF_REJECT-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_REJECT-m)))
+endef
+
+$(eval $(call KernelPackage,nf-reject))
+
+
+define KernelPackage/nf-reject6
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter IPv6 reject support
+  KCONFIG:= \
+	CONFIG_NETFILTER=y \
+	CONFIG_NETFILTER_ADVANCED=y \
+	$(KCONFIG_NF_REJECT6)
+  DEPENDS:=@IPV6
+  FILES:=$(foreach mod,$(NF_REJECT6-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_REJECT6-m)))
+endef
+
+$(eval $(call KernelPackage,nf-reject6))
+
+
+define KernelPackage/nf-ipt
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Iptables core
+  KCONFIG:=$(KCONFIG_NF_IPT)
+  FILES:=$(foreach mod,$(NF_IPT-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_IPT-m)))
+endef
+
+$(eval $(call KernelPackage,nf-ipt))
+
+
+define KernelPackage/nf-ipt6
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Ip6tables core
+  KCONFIG:=$(KCONFIG_NF_IPT6)
+  FILES:=$(foreach mod,$(NF_IPT6-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_IPT6-m)))
+  DEPENDS:=+kmod-nf-ipt
+endef
+
+$(eval $(call KernelPackage,nf-ipt6))
+
+
+
+define KernelPackage/ipt-core
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Iptables core
+  KCONFIG:=$(KCONFIG_IPT_CORE)
+  FILES:=$(foreach mod,$(IPT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CORE-m)))
+  DEPENDS:=+kmod-nf-reject +kmod-nf-ipt
+endef
+
+define KernelPackage/ipt-core/description
+ Netfilter core kernel modules
+ Includes:
+ - comment
+ - limit
+ - LOG
+ - mac
+ - multiport
+ - REJECT
+ - TCPMSS
+endef
+
+$(eval $(call KernelPackage,ipt-core))
+
+
+define KernelPackage/nf-conntrack
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter connection tracking
+  KCONFIG:= \
+        CONFIG_NETFILTER=y \
+        CONFIG_NETFILTER_ADVANCED=y \
+        CONFIG_NF_CONNTRACK_MARK=y \
+        CONFIG_NF_CONNTRACK_ZONES=y \
+	$(KCONFIG_NF_CONNTRACK)
+  FILES:=$(foreach mod,$(NF_CONNTRACK-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK-m)))
+endef
+
+define KernelPackage/nf-conntrack/install
+	$(INSTALL_DIR) $(1)/etc/sysctl.d
+	$(INSTALL_DATA) ./files/sysctl-nf-conntrack.conf $(1)/etc/sysctl.d/11-nf-conntrack.conf
+endef
+
+$(eval $(call KernelPackage,nf-conntrack))
+
+
+define KernelPackage/nf-conntrack6
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter IPv6 connection tracking
+  KCONFIG:=$(KCONFIG_NF_CONNTRACK6)
+  DEPENDS:=@IPV6 +kmod-nf-conntrack
+  FILES:=$(foreach mod,$(NF_CONNTRACK6-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK6-m)))
+endef
+
+$(eval $(call KernelPackage,nf-conntrack6))
+
+
+define KernelPackage/nf-nat
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter NAT
+  KCONFIG:=$(KCONFIG_NF_NAT)
+  DEPENDS:=+kmod-nf-conntrack
+  FILES:=$(foreach mod,$(NF_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT-m)))
+endef
+
+$(eval $(call KernelPackage,nf-nat))
+
+
+define KernelPackage/nf-nat6
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter IPV6-NAT
+  KCONFIG:=$(KCONFIG_NF_NAT6)
+  DEPENDS:=@IPV6 +kmod-nf-conntrack6 +kmod-nf-nat
+  FILES:=$(foreach mod,$(NF_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT6-m)))
+endef
+
+$(eval $(call KernelPackage,nf-nat6))
+
+
+define KernelPackage/nf-flow
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter flowtable support
+  KCONFIG:= \
+	CONFIG_NETFILTER_INGRESS=y \
+	CONFIG_NF_FLOW_TABLE
+  DEPENDS:=+kmod-nf-conntrack
+  FILES:= \
+	$(LINUX_DIR)/net/netfilter/nf_flow_table.ko
+  AUTOLOAD:=$(call AutoProbe,nf_flow_table)
+endef
+
+$(eval $(call KernelPackage,nf-flow))
+
+
+define AddDepends/ipt
+  SUBMENU:=$(NF_MENU)
+  DEPENDS+= +kmod-ipt-core $(1)
+endef
+
+
+define KernelPackage/ipt-conntrack
+  TITLE:=Basic connection tracking modules
+  KCONFIG:=$(KCONFIG_IPT_CONNTRACK)
+  FILES:=$(foreach mod,$(IPT_CONNTRACK-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK-m)))
+  $(call AddDepends/ipt,+kmod-nf-conntrack)
+endef
+
+define KernelPackage/ipt-conntrack/description
+ Netfilter (IPv4) kernel modules for connection tracking
+ Includes:
+ - conntrack
+ - defrag
+ - iptables_raw
+ - NOTRACK
+ - state
+endef
+
+$(eval $(call KernelPackage,ipt-conntrack))
+
+
+define KernelPackage/ipt-conntrack-extra
+  TITLE:=Extra connection tracking modules
+  KCONFIG:=$(KCONFIG_IPT_CONNTRACK_EXTRA)
+  FILES:=$(foreach mod,$(IPT_CONNTRACK_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK_EXTRA-m)))
+  $(call AddDepends/ipt,+kmod-ipt-conntrack)
+endef
+
+define KernelPackage/ipt-conntrack-extra/description
+ Netfilter (IPv4) extra kernel modules for connection tracking
+ Includes:
+ - connbytes
+ - connmark/CONNMARK
+ - conntrack
+ - helper
+ - recent
+endef
+
+$(eval $(call KernelPackage,ipt-conntrack-extra))
+
+define KernelPackage/ipt-conntrack-label
+  TITLE:=Module for handling connection tracking labels
+  KCONFIG:=$(KCONFIG_IPT_CONNTRACK_LABEL)
+  FILES:=$(foreach mod,$(IPT_CONNTRACK_LABEL-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK_LABEL-m)))
+  $(call AddDepends/ipt,+kmod-ipt-conntrack)
+endef
+
+define KernelPackage/ipt-conntrack-label/description
+ Netfilter (IPv4) module for handling connection tracking labels
+ Includes:
+ - connlabel
+endef
+
+$(eval $(call KernelPackage,ipt-conntrack-label))
+
+define KernelPackage/ipt-filter
+  TITLE:=Modules for packet content inspection
+  KCONFIG:=$(KCONFIG_IPT_FILTER)
+  FILES:=$(foreach mod,$(IPT_FILTER-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_FILTER-m)))
+  $(call AddDepends/ipt,+kmod-lib-textsearch +kmod-ipt-conntrack)
+endef
+
+define KernelPackage/ipt-filter/description
+ Netfilter (IPv4) kernel modules for packet content inspection
+ Includes:
+ - string
+ - bpf
+endef
+
+$(eval $(call KernelPackage,ipt-filter))
+
+
+define KernelPackage/ipt-offload
+  TITLE:=Netfilter routing/NAT offload support
+  KCONFIG:=$(KCONFIG_IPT_FLOW)
+  FILES:=$(foreach mod,$(IPT_FLOW-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_FLOW-m)))
+  $(call AddDepends/ipt,+kmod-nf-flow)
+endef
+
+$(eval $(call KernelPackage,ipt-offload))
+
+
+define KernelPackage/ipt-ipopt
+  TITLE:=Modules for matching/changing IP packet options
+  KCONFIG:=$(KCONFIG_IPT_IPOPT)
+  FILES:=$(foreach mod,$(IPT_IPOPT-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPOPT-m)))
+  $(call AddDepends/ipt)
+endef
+
+define KernelPackage/ipt-ipopt/description
+ Netfilter (IPv4) modules for matching/changing IP packet options
+ Includes:
+ - CLASSIFY
+ - dscp/DSCP
+ - ecn/ECN
+ - hl/HL
+ - length
+ - mark/MARK
+ - statistic
+ - tcpmss
+ - time
+ - ttl/TTL
+ - unclean
+endef
+
+$(eval $(call KernelPackage,ipt-ipopt))
+
+
+define KernelPackage/ipt-ipsec
+  TITLE:=Modules for matching IPSec packets
+  KCONFIG:=$(KCONFIG_IPT_IPSEC)
+  FILES:=$(foreach mod,$(IPT_IPSEC-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPSEC-m)))
+  $(call AddDepends/ipt)
+endef
+
+define KernelPackage/ipt-ipsec/description
+ Netfilter (IPv4) modules for matching IPSec packets
+ Includes:
+ - ah
+ - esp
+ - policy
+endef
+
+$(eval $(call KernelPackage,ipt-ipsec))
+
+IPSET_MODULES:= \
+	ipset/ip_set \
+	ipset/ip_set_bitmap_ip \
+	ipset/ip_set_bitmap_ipmac \
+	ipset/ip_set_bitmap_port \
+	ipset/ip_set_hash_ip \
+	ipset/ip_set_hash_ipmark \
+	ipset/ip_set_hash_ipport \
+	ipset/ip_set_hash_ipportip \
+	ipset/ip_set_hash_ipportnet \
+	ipset/ip_set_hash_mac \
+	ipset/ip_set_hash_netportnet \
+	ipset/ip_set_hash_net \
+	ipset/ip_set_hash_netnet \
+	ipset/ip_set_hash_netport \
+	ipset/ip_set_hash_netiface \
+	ipset/ip_set_list_set \
+	xt_set
+
+define KernelPackage/ipt-ipset
+  SUBMENU:=Netfilter Extensions
+  TITLE:=IPset netfilter modules
+  DEPENDS+= +kmod-ipt-core +kmod-nfnetlink
+  KCONFIG:= \
+	CONFIG_IP_SET \
+	CONFIG_IP_SET_MAX=256 \
+	CONFIG_NETFILTER_XT_SET \
+	CONFIG_IP_SET_BITMAP_IP \
+	CONFIG_IP_SET_BITMAP_IPMAC \
+	CONFIG_IP_SET_BITMAP_PORT \
+	CONFIG_IP_SET_HASH_IP \
+	CONFIG_IP_SET_HASH_IPMAC \
+	CONFIG_IP_SET_HASH_IPMARK \
+	CONFIG_IP_SET_HASH_IPPORT \
+	CONFIG_IP_SET_HASH_IPPORTIP \
+	CONFIG_IP_SET_HASH_IPPORTNET \
+	CONFIG_IP_SET_HASH_MAC \
+	CONFIG_IP_SET_HASH_NET \
+	CONFIG_IP_SET_HASH_NETNET \
+	CONFIG_IP_SET_HASH_NETIFACE \
+	CONFIG_IP_SET_HASH_NETPORT \
+	CONFIG_IP_SET_HASH_NETPORTNET \
+	CONFIG_IP_SET_LIST_SET \
+	CONFIG_NET_EMATCH_IPSET=n
+  FILES:=$(foreach mod,$(IPSET_MODULES),$(LINUX_DIR)/net/netfilter/$(mod).ko)
+  AUTOLOAD:=$(call AutoLoad,49,$(notdir $(IPSET_MODULES)))
+endef
+$(eval $(call KernelPackage,ipt-ipset))
+
+
+IPVS_MODULES:= \
+	ipvs/ip_vs \
+	ipvs/ip_vs_lc \
+	ipvs/ip_vs_wlc \
+	ipvs/ip_vs_rr \
+	ipvs/ip_vs_wrr \
+	ipvs/ip_vs_lblc \
+	ipvs/ip_vs_lblcr \
+	ipvs/ip_vs_dh \
+	ipvs/ip_vs_sh \
+	ipvs/ip_vs_fo \
+	ipvs/ip_vs_ovf \
+	ipvs/ip_vs_nq \
+	ipvs/ip_vs_sed \
+	xt_ipvs
+
+define KernelPackage/nf-ipvs
+  SUBMENU:=Netfilter Extensions
+  TITLE:=IP Virtual Server modules
+  DEPENDS:=@IPV6 +kmod-lib-crc32c +kmod-ipt-conntrack +kmod-nf-conntrack
+  KCONFIG:= \
+	CONFIG_IP_VS \
+	CONFIG_IP_VS_IPV6=y \
+	CONFIG_IP_VS_DEBUG=n \
+	CONFIG_IP_VS_PROTO_TCP=y \
+	CONFIG_IP_VS_PROTO_UDP=y \
+	CONFIG_IP_VS_PROTO_AH_ESP=y \
+	CONFIG_IP_VS_PROTO_ESP=y \
+	CONFIG_IP_VS_PROTO_AH=y \
+	CONFIG_IP_VS_PROTO_SCTP=y \
+	CONFIG_IP_VS_TAB_BITS=12 \
+	CONFIG_IP_VS_RR \
+	CONFIG_IP_VS_WRR \
+	CONFIG_IP_VS_LC \
+	CONFIG_IP_VS_WLC \
+	CONFIG_IP_VS_FO \
+	CONFIG_IP_VS_OVF \
+	CONFIG_IP_VS_LBLC \
+	CONFIG_IP_VS_LBLCR \
+	CONFIG_IP_VS_DH \
+	CONFIG_IP_VS_SH \
+	CONFIG_IP_VS_SED \
+	CONFIG_IP_VS_NQ \
+	CONFIG_IP_VS_SH_TAB_BITS=8 \
+	CONFIG_IP_VS_NFCT=y \
+	CONFIG_NETFILTER_XT_MATCH_IPVS
+  FILES:=$(foreach mod,$(IPVS_MODULES),$(LINUX_DIR)/net/netfilter/$(mod).ko)
+  $(call AddDepends/ipt,+kmod-ipt-conntrack,+kmod-nf-conntrack)
+endef
+
+define KernelPackage/nf-ipvs/description
+ IPVS (IP Virtual Server) implements transport-layer load balancing inside
+ the Linux kernel so called Layer-4 switching.
+endef
+
+$(eval $(call KernelPackage,nf-ipvs))
+
+
+define KernelPackage/nf-ipvs-ftp
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Virtual Server FTP protocol support
+  KCONFIG:=CONFIG_IP_VS_FTP
+  DEPENDS:=kmod-nf-ipvs +kmod-nf-nat +kmod-nf-nathelper
+  FILES:=$(LINUX_DIR)/net/netfilter/ipvs/ip_vs_ftp.ko
+endef
+
+define KernelPackage/nf-ipvs-ftp/description
+  In the virtual server via Network Address Translation,
+  the IP address and port number of real servers cannot be sent to
+  clients in ftp connections directly, so FTP protocol helper is
+  required for tracking the connection and mangling it back to that of
+  virtual service.
+endef
+
+$(eval $(call KernelPackage,nf-ipvs-ftp))
+
+
+define KernelPackage/nf-ipvs-sip
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Virtual Server SIP protocol support
+  KCONFIG:=CONFIG_IP_VS_PE_SIP
+  DEPENDS:=kmod-nf-ipvs +kmod-nf-nathelper-extra
+  FILES:=$(LINUX_DIR)/net/netfilter/ipvs/ip_vs_pe_sip.ko
+endef
+
+define KernelPackage/nf-ipvs-sip/description
+  Allow persistence based on the SIP Call-ID
+endef
+
+$(eval $(call KernelPackage,nf-ipvs-sip))
+
+
+define KernelPackage/ipt-nat
+  TITLE:=Basic NAT targets
+  KCONFIG:=$(KCONFIG_IPT_NAT)
+  FILES:=$(foreach mod,$(IPT_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NAT-m)))
+  $(call AddDepends/ipt,+kmod-nf-nat)
+endef
+
+define KernelPackage/ipt-nat/description
+ Netfilter (IPv4) kernel modules for basic NAT targets
+ Includes:
+ - MASQUERADE
+endef
+
+$(eval $(call KernelPackage,ipt-nat))
+
+
+define KernelPackage/ipt-raw
+  TITLE:=Netfilter IPv4 raw table support
+  KCONFIG:=CONFIG_IP_NF_RAW
+  FILES:=$(LINUX_DIR)/net/ipv4/netfilter/iptable_raw.ko
+  AUTOLOAD:=$(call AutoProbe,iptable_raw)
+  $(call AddDepends/ipt)
+endef
+
+$(eval $(call KernelPackage,ipt-raw))
+
+
+define KernelPackage/ipt-raw6
+  TITLE:=Netfilter IPv6 raw table support
+  DEPENDS:=@IPV6
+  KCONFIG:=CONFIG_IP6_NF_RAW
+  FILES:=$(LINUX_DIR)/net/ipv6/netfilter/ip6table_raw.ko
+  AUTOLOAD:=$(call AutoProbe,ip6table_raw)
+  $(call AddDepends/ipt,+kmod-ip6tables)
+endef
+
+$(eval $(call KernelPackage,ipt-raw6))
+
+
+define KernelPackage/ipt-nat6
+  TITLE:=IPv6 NAT targets
+  DEPENDS:=@IPV6
+  KCONFIG:=$(KCONFIG_IPT_NAT6)
+  FILES:=$(foreach mod,$(IPT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_NAT6-m)))
+  $(call AddDepends/ipt,+kmod-nf-nat6)
+  $(call AddDepends/ipt,+kmod-ipt-conntrack)
+  $(call AddDepends/ipt,+kmod-ipt-nat)
+  $(call AddDepends/ipt,+kmod-ip6tables)
+endef
+
+define KernelPackage/ipt-nat6/description
+ Netfilter (IPv6) kernel modules for NAT targets
+endef
+
+$(eval $(call KernelPackage,ipt-nat6))
+
+
+define KernelPackage/ipt-nat-extra
+  TITLE:=Extra NAT targets
+  KCONFIG:=$(KCONFIG_IPT_NAT_EXTRA)
+  FILES:=$(foreach mod,$(IPT_NAT_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NAT_EXTRA-m)))
+  $(call AddDepends/ipt,+kmod-ipt-nat)
+endef
+
+define KernelPackage/ipt-nat-extra/description
+ Netfilter (IPv4) kernel modules for extra NAT targets
+ Includes:
+ - NETMAP
+ - REDIRECT
+endef
+
+$(eval $(call KernelPackage,ipt-nat-extra))
+
+
+define KernelPackage/nf-nathelper
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Basic Conntrack and NAT helpers
+  KCONFIG:=$(KCONFIG_NF_NATHELPER)
+  FILES:=$(foreach mod,$(NF_NATHELPER-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NATHELPER-m)))
+  DEPENDS:=+kmod-nf-nat
+endef
+
+define KernelPackage/nf-nathelper/description
+ Default Netfilter (IPv4) Conntrack and NAT helpers
+ Includes:
+ - ftp
+endef
+
+$(eval $(call KernelPackage,nf-nathelper))
+
+
+define KernelPackage/nf-nathelper-extra
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Extra Conntrack and NAT helpers
+  KCONFIG:=$(KCONFIG_NF_NATHELPER_EXTRA)
+  FILES:=$(foreach mod,$(NF_NATHELPER_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NATHELPER_EXTRA-m)))
+  DEPENDS:=+kmod-nf-nat +kmod-lib-textsearch +kmod-ipt-raw +kmod-asn1-decoder
+endef
+
+define KernelPackage/nf-nathelper-extra/description
+ Extra Netfilter (IPv4) Conntrack and NAT helpers
+ Includes:
+ - amanda
+ - h323
+ - irc
+ - mms
+ - pptp
+ - proto_gre
+ - sip
+ - snmp_basic
+ - tftp
+ - broadcast
+endef
+
+$(eval $(call KernelPackage,nf-nathelper-extra))
+
+
+define KernelPackage/ipt-ulog
+  TITLE:=Module for user-space packet logging
+  KCONFIG:=$(KCONFIG_IPT_ULOG)
+  FILES:=$(foreach mod,$(IPT_ULOG-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_ULOG-m)))
+  $(call AddDepends/ipt)
+endef
+
+define KernelPackage/ipt-ulog/description
+ Netfilter (IPv4) module for user-space packet logging
+ Includes:
+ - ULOG
+endef
+
+$(eval $(call KernelPackage,ipt-ulog))
+
+
+define KernelPackage/ipt-nflog
+  TITLE:=Module for user-space packet logging
+  KCONFIG:=$(KCONFIG_IPT_NFLOG)
+  FILES:=$(foreach mod,$(IPT_NFLOG-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NFLOG-m)))
+  $(call AddDepends/ipt,+kmod-nfnetlink-log)
+endef
+
+define KernelPackage/ipt-nflog/description
+ Netfilter module for user-space packet logging
+ Includes:
+ - NFLOG
+endef
+
+$(eval $(call KernelPackage,ipt-nflog))
+
+
+define KernelPackage/ipt-nfqueue
+  TITLE:=Module for user-space packet queuing
+  KCONFIG:=$(KCONFIG_IPT_NFQUEUE)
+  FILES:=$(foreach mod,$(IPT_NFQUEUE-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NFQUEUE-m)))
+  $(call AddDepends/ipt,+kmod-nfnetlink-queue)
+endef
+
+define KernelPackage/ipt-nfqueue/description
+ Netfilter module for user-space packet queuing
+ Includes:
+ - NFQUEUE
+endef
+
+$(eval $(call KernelPackage,ipt-nfqueue))
+
+
+define KernelPackage/ipt-debug
+  TITLE:=Module for debugging/development
+  KCONFIG:=$(KCONFIG_IPT_DEBUG)
+  FILES:=$(foreach mod,$(IPT_DEBUG-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_DEBUG-m)))
+  $(call AddDepends/ipt,+kmod-ipt-raw +IPV6:kmod-ipt-raw6)
+endef
+
+define KernelPackage/ipt-debug/description
+ Netfilter modules for debugging/development of the firewall
+ Includes:
+ - TRACE
+endef
+
+$(eval $(call KernelPackage,ipt-debug))
+
+
+define KernelPackage/ipt-led
+  TITLE:=Module to trigger a LED with a Netfilter rule
+  KCONFIG:=$(KCONFIG_IPT_LED)
+  FILES:=$(foreach mod,$(IPT_LED-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_LED-m)))
+  $(call AddDepends/ipt)
+endef
+
+define KernelPackage/ipt-led/description
+ Netfilter target to trigger a LED when a network packet is matched.
+endef
+
+$(eval $(call KernelPackage,ipt-led))
+
+define KernelPackage/ipt-tproxy
+  TITLE:=Transparent proxying support
+  DEPENDS+=+kmod-ipt-conntrack +IPV6:kmod-nf-conntrack6 +IPV6:kmod-ip6tables
+  KCONFIG:=$(KCONFIG_IPT_TPROXY)
+  FILES:=$(foreach mod,$(IPT_TPROXY-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_TPROXY-m)))
+  $(call AddDepends/ipt)
+endef
+
+define KernelPackage/ipt-tproxy/description
+  Kernel modules for Transparent Proxying
+endef
+
+$(eval $(call KernelPackage,ipt-tproxy))
+
+define KernelPackage/ipt-tee
+  TITLE:=TEE support
+  DEPENDS:=+kmod-ipt-conntrack
+  KCONFIG:=$(KCONFIG_IPT_TEE)
+  FILES:=$(foreach mod,$(IPT_TEE-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir nf_tee $(IPT_TEE-m)))
+  $(call AddDepends/ipt)
+endef
+
+define KernelPackage/ipt-tee/description
+  Kernel modules for TEE
+endef
+
+$(eval $(call KernelPackage,ipt-tee))
+
+
+define KernelPackage/ipt-u32
+  TITLE:=U32 support
+  KCONFIG:=$(KCONFIG_IPT_U32)
+  FILES:=$(foreach mod,$(IPT_U32-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir nf_tee $(IPT_U32-m)))
+  $(call AddDepends/ipt)
+endef
+
+define KernelPackage/ipt-u32/description
+  Kernel modules for U32
+endef
+
+$(eval $(call KernelPackage,ipt-u32))
+
+define KernelPackage/ipt-checksum
+  TITLE:=CHECKSUM support
+  KCONFIG:=$(KCONFIG_IPT_CHECKSUM)
+  FILES:=$(foreach mod,$(IPT_CHECKSUM-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CHECKSUM-m)))
+  $(call AddDepends/ipt)
+endef
+
+define KernelPackage/ipt-checksum/description
+  Kernel modules for CHECKSUM fillin target
+endef
+
+$(eval $(call KernelPackage,ipt-checksum))
+
+
+define KernelPackage/ipt-iprange
+  TITLE:=Module for matching ip ranges
+  KCONFIG:=$(KCONFIG_IPT_IPRANGE)
+  FILES:=$(foreach mod,$(IPT_IPRANGE-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPRANGE-m)))
+  $(call AddDepends/ipt)
+endef
+
+define KernelPackage/ipt-iprange/description
+ Netfilter (IPv4) module for matching ip ranges
+ Includes:
+ - iprange
+endef
+
+$(eval $(call KernelPackage,ipt-iprange))
+
+define KernelPackage/ipt-cluster
+  TITLE:=Module for matching cluster
+  KCONFIG:=$(KCONFIG_IPT_CLUSTER)
+  FILES:=$(foreach mod,$(IPT_CLUSTER-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CLUSTER-m)))
+  $(call AddDepends/ipt,+kmod-nf-conntrack)
+endef
+
+define KernelPackage/ipt-cluster/description
+ Netfilter (IPv4/IPv6) module for matching cluster
+ This option allows you to build work-load-sharing clusters of
+ network servers/stateful firewalls without having a dedicated
+ load-balancing router/server/switch. Basically, this match returns
+ true when the packet must be handled by this cluster node. Thus,
+ all nodes see all packets and this match decides which node handles
+ what packets. The work-load sharing algorithm is based on source
+ address hashing.
+
+ This module is usable for ipv4 and ipv6.
+
+ To use it also enable iptables-mod-cluster
+
+ see `iptables -m cluster --help` for more information.
+endef
+
+$(eval $(call KernelPackage,ipt-cluster))
+
+define KernelPackage/ipt-clusterip
+  TITLE:=Module for CLUSTERIP
+  KCONFIG:=$(KCONFIG_IPT_CLUSTERIP)
+  FILES:=$(foreach mod,$(IPT_CLUSTERIP-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CLUSTERIP-m)))
+  $(call AddDepends/ipt,+kmod-nf-conntrack)
+endef
+
+define KernelPackage/ipt-clusterip/description
+ Netfilter (IPv4-only) module for CLUSTERIP
+ The CLUSTERIP target allows you to build load-balancing clusters of
+ network servers without having a dedicated load-balancing
+ router/server/switch.
+
+ To use it also enable iptables-mod-clusterip
+
+ see `iptables -j CLUSTERIP --help` for more information.
+endef
+
+$(eval $(call KernelPackage,ipt-clusterip))
+
+
+define KernelPackage/ipt-extra
+  TITLE:=Extra modules
+  KCONFIG:=$(KCONFIG_IPT_EXTRA)
+  FILES:=$(foreach mod,$(IPT_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_EXTRA-m)))
+  $(call AddDepends/ipt)
+endef
+
+define KernelPackage/ipt-extra/description
+ Other Netfilter (IPv4) kernel modules
+ Includes:
+ - addrtype
+ - owner
+ - pkttype
+ - quota
+endef
+
+$(eval $(call KernelPackage,ipt-extra))
+
+
+define KernelPackage/ipt-physdev
+  TITLE:=physdev module
+  KCONFIG:=$(KCONFIG_IPT_PHYSDEV)
+  FILES:=$(foreach mod,$(IPT_PHYSDEV-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_PHYSDEV-m)))
+  $(call AddDepends/ipt,+kmod-br-netfilter)
+endef
+
+define KernelPackage/ipt-physdev/description
+ The iptables physdev kernel module
+endef
+
+$(eval $(call KernelPackage,ipt-physdev))
+
+
+define KernelPackage/ip6tables
+  SUBMENU:=$(NF_MENU)
+  TITLE:=IPv6 modules
+  DEPENDS:=@IPV6 +kmod-nf-reject6 +kmod-nf-ipt6 +kmod-ipt-core
+  KCONFIG:=$(KCONFIG_IPT_IPV6)
+  FILES:=$(foreach mod,$(IPT_IPV6-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoLoad,42,$(notdir $(IPT_IPV6-m)))
+endef
+
+define KernelPackage/ip6tables/description
+ Netfilter IPv6 firewalling support
+endef
+
+$(eval $(call KernelPackage,ip6tables))
+
+define KernelPackage/ip6tables-extra
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Extra IPv6 modules
+  DEPENDS:=@IPV6 +kmod-ip6tables
+  KCONFIG:=$(KCONFIG_IPT_IPV6_EXTRA)
+  FILES:=$(foreach mod,$(IPT_IPV6_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_IPV6_EXTRA-m)))
+endef
+
+define KernelPackage/ip6tables-extra/description
+ Netfilter IPv6 extra header matching modules
+endef
+
+$(eval $(call KernelPackage,ip6tables-extra))
+
+ARP_MODULES = arp_tables arpt_mangle arptable_filter
+define KernelPackage/arptables
+  SUBMENU:=$(NF_MENU)
+  TITLE:=ARP firewalling modules
+  DEPENDS:=+kmod-ipt-core
+  FILES:=$(LINUX_DIR)/net/ipv4/netfilter/arp*.ko
+  KCONFIG:=CONFIG_IP_NF_ARPTABLES \
+    CONFIG_IP_NF_ARPFILTER \
+    CONFIG_IP_NF_ARP_MANGLE
+  AUTOLOAD:=$(call AutoProbe,$(ARP_MODULES))
+endef
+
+define KernelPackage/arptables/description
+ Kernel modules for ARP firewalling
+endef
+
+$(eval $(call KernelPackage,arptables))
+
+
+define KernelPackage/br-netfilter
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Bridge netfilter support modules
+  DEPENDS:=+kmod-ipt-core
+  FILES:=$(LINUX_DIR)/net/bridge/br_netfilter.ko
+  KCONFIG:=CONFIG_BRIDGE_NETFILTER
+  AUTOLOAD:=$(call AutoProbe,br_netfilter)
+endef
+
+define KernelPackage/br-netfilter/install
+	$(INSTALL_DIR) $(1)/etc/sysctl.d
+	$(INSTALL_DATA) ./files/sysctl-br-netfilter.conf $(1)/etc/sysctl.d/11-br-netfilter.conf
+endef
+
+$(eval $(call KernelPackage,br-netfilter))
+
+
+define KernelPackage/ebtables
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Bridge firewalling modules
+  DEPENDS:=+kmod-ipt-core
+  FILES:=$(foreach mod,$(EBTABLES-m),$(LINUX_DIR)/net/$(mod).ko)
+  KCONFIG:=$(KCONFIG_EBTABLES)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES-m)))
+endef
+
+define KernelPackage/ebtables/description
+  ebtables is a general, extensible frame/packet identification
+  framework. It provides you to do Ethernet
+  filtering/NAT/brouting on the Ethernet bridge.
+endef
+
+$(eval $(call KernelPackage,ebtables))
+
+
+define AddDepends/ebtables
+  SUBMENU:=$(NF_MENU)
+  DEPENDS+= +kmod-ebtables $(1)
+endef
+
+
+define KernelPackage/ebtables-ipv4
+  TITLE:=ebtables: IPv4 support
+  FILES:=$(foreach mod,$(EBTABLES_IP4-m),$(LINUX_DIR)/net/$(mod).ko)
+  KCONFIG:=$(KCONFIG_EBTABLES_IP4)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_IP4-m)))
+  $(call AddDepends/ebtables)
+endef
+
+define KernelPackage/ebtables-ipv4/description
+ This option adds the IPv4 support to ebtables, which allows basic
+ IPv4 header field filtering, ARP filtering as well as SNAT, DNAT targets.
+endef
+
+$(eval $(call KernelPackage,ebtables-ipv4))
+
+
+define KernelPackage/ebtables-ipv6
+  TITLE:=ebtables: IPv6 support
+  DEPENDS:=@IPV6
+  FILES:=$(foreach mod,$(EBTABLES_IP6-m),$(LINUX_DIR)/net/$(mod).ko)
+  KCONFIG:=$(KCONFIG_EBTABLES_IP6)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_IP6-m)))
+  $(call AddDepends/ebtables)
+endef
+
+define KernelPackage/ebtables-ipv6/description
+ This option adds the IPv6 support to ebtables, which allows basic
+ IPv6 header field filtering and target support.
+endef
+
+$(eval $(call KernelPackage,ebtables-ipv6))
+
+
+define KernelPackage/ebtables-watchers
+  TITLE:=ebtables: watchers support
+  FILES:=$(foreach mod,$(EBTABLES_WATCHERS-m),$(LINUX_DIR)/net/$(mod).ko)
+  KCONFIG:=$(KCONFIG_EBTABLES_WATCHERS)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_WATCHERS-m)))
+  $(call AddDepends/ebtables)
+endef
+
+define KernelPackage/ebtables-watchers/description
+ This option adds the log watchers, that you can use in any rule
+ in any ebtables table.
+endef
+
+$(eval $(call KernelPackage,ebtables-watchers))
+
+
+define KernelPackage/nfnetlink
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netlink-based userspace interface
+  FILES:=$(foreach mod,$(NFNETLINK-m),$(LINUX_DIR)/net/$(mod).ko)
+  KCONFIG:=$(KCONFIG_NFNETLINK)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK-m)))
+endef
+
+define KernelPackage/nfnetlink/description
+ Kernel modules support for a netlink-based userspace interface
+endef
+
+$(eval $(call KernelPackage,nfnetlink))
+
+
+define AddDepends/nfnetlink
+  SUBMENU:=$(NF_MENU)
+  DEPENDS+=+kmod-nfnetlink $(1)
+endef
+
+
+define KernelPackage/nfnetlink-log
+  TITLE:=Netfilter LOG over NFNETLINK interface
+  FILES:=$(foreach mod,$(NFNETLINK_LOG-m),$(LINUX_DIR)/net/$(mod).ko)
+  KCONFIG:=$(KCONFIG_NFNETLINK_LOG)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK_LOG-m)))
+  $(call AddDepends/nfnetlink)
+endef
+
+define KernelPackage/nfnetlink-log/description
+ Kernel modules support for logging packets via NFNETLINK
+ Includes:
+ - NFLOG
+endef
+
+$(eval $(call KernelPackage,nfnetlink-log))
+
+
+define KernelPackage/nfnetlink-queue
+  TITLE:=Netfilter QUEUE over NFNETLINK interface
+  FILES:=$(foreach mod,$(NFNETLINK_QUEUE-m),$(LINUX_DIR)/net/$(mod).ko)
+  KCONFIG:=$(KCONFIG_NFNETLINK_QUEUE)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK_QUEUE-m)))
+  $(call AddDepends/nfnetlink)
+endef
+
+define KernelPackage/nfnetlink-queue/description
+ Kernel modules support for queueing packets via NFNETLINK
+ Includes:
+ - NFQUEUE
+endef
+
+$(eval $(call KernelPackage,nfnetlink-queue))
+
+
+define KernelPackage/nf-conntrack-netlink
+  TITLE:=Connection tracking netlink interface
+  FILES:=$(LINUX_DIR)/net/netfilter/nf_conntrack_netlink.ko
+  KCONFIG:=CONFIG_NF_CT_NETLINK CONFIG_NF_CONNTRACK_EVENTS=y CONFIG_NETFILTER_NETLINK_GLUE_CT=y
+  AUTOLOAD:=$(call AutoProbe,nf_conntrack_netlink)
+  $(call AddDepends/nfnetlink,+kmod-ipt-conntrack)
+endef
+
+define KernelPackage/nf-conntrack-netlink/description
+ Kernel modules support for a netlink-based connection tracking
+ userspace interface
+endef
+
+$(eval $(call KernelPackage,nf-conntrack-netlink))
+
+define KernelPackage/ipt-hashlimit
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter hashlimit match
+  DEPENDS:=+kmod-ipt-core
+  KCONFIG:=$(KCONFIG_IPT_HASHLIMIT)
+  FILES:=$(LINUX_DIR)/net/netfilter/xt_hashlimit.ko
+  AUTOLOAD:=$(call AutoProbe,xt_hashlimit)
+  $(call KernelPackage/ipt)
+endef
+
+define KernelPackage/ipt-hashlimit/description
+ Kernel modules support for the hashlimit bucket match module
+endef
+
+$(eval $(call KernelPackage,ipt-hashlimit))
+
+define KernelPackage/ipt-rpfilter
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter rpfilter match
+  DEPENDS:=+kmod-ipt-core
+  KCONFIG:=$(KCONFIG_IPT_RPFILTER)
+  FILES:=$(realpath \
+	$(LINUX_DIR)/net/ipv4/netfilter/ipt_rpfilter.ko \
+	$(LINUX_DIR)/net/ipv6/netfilter/ip6t_rpfilter.ko)
+  AUTOLOAD:=$(call AutoProbe,ipt_rpfilter ip6t_rpfilter)
+  $(call KernelPackage/ipt)
+endef
+
+define KernelPackage/ipt-rpfilter/description
+ Kernel modules support for the Netfilter rpfilter match
+endef
+
+$(eval $(call KernelPackage,ipt-rpfilter))
+
+
+define KernelPackage/nft-core
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter nf_tables support
+  DEPENDS:=+kmod-nfnetlink +kmod-nf-reject +IPV6:kmod-nf-reject6 +IPV6:kmod-nf-conntrack6 +kmod-nf-nat +kmod-lib-crc32c
+  FILES:=$(foreach mod,$(NFT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_CORE-m)))
+  KCONFIG:= \
+	CONFIG_NFT_COMPAT=n \
+	CONFIG_NFT_QUEUE=n \
+	$(KCONFIG_NFT_CORE)
+endef
+
+define KernelPackage/nft-core/description
+ Kernel module support for nftables
+endef
+
+$(eval $(call KernelPackage,nft-core))
+
+
+define KernelPackage/nft-arp
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter nf_tables ARP table support
+  DEPENDS:=+kmod-nft-core
+  FILES:=$(foreach mod,$(NFT_ARP-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_ARP-m)))
+  KCONFIG:=$(KCONFIG_NFT_ARP)
+endef
+
+$(eval $(call KernelPackage,nft-arp))
+
+
+define KernelPackage/nft-bridge
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter nf_tables bridge table support
+  DEPENDS:=+kmod-nft-core
+  FILES:=$(foreach mod,$(NFT_BRIDGE-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_BRIDGE-m)))
+  KCONFIG:= \
+	CONFIG_NF_LOG_BRIDGE=n \
+	$(KCONFIG_NFT_BRIDGE)
+endef
+
+$(eval $(call KernelPackage,nft-bridge))
+
+
+define KernelPackage/nft-nat
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter nf_tables NAT support
+  DEPENDS:=+kmod-nft-core +kmod-nf-nat
+  FILES:=$(foreach mod,$(NFT_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_NAT-m)))
+  KCONFIG:=$(KCONFIG_NFT_NAT)
+endef
+
+$(eval $(call KernelPackage,nft-nat))
+
+
+define KernelPackage/nft-offload
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter nf_tables routing/NAT offload support
+  DEPENDS:=@IPV6 +kmod-nf-flow +kmod-nft-nat
+  KCONFIG:= \
+	CONFIG_NF_FLOW_TABLE_INET \
+	CONFIG_NF_FLOW_TABLE_IPV4 \
+	CONFIG_NF_FLOW_TABLE_IPV6 \
+	CONFIG_NFT_FLOW_OFFLOAD
+  FILES:= \
+	$(LINUX_DIR)/net/netfilter/nf_flow_table_inet.ko \
+	$(LINUX_DIR)/net/ipv4/netfilter/nf_flow_table_ipv4.ko \
+	$(LINUX_DIR)/net/ipv6/netfilter/nf_flow_table_ipv6.ko \
+	$(LINUX_DIR)/net/netfilter/nft_flow_offload.ko
+  AUTOLOAD:=$(call AutoProbe,nf_flow_table_inet nf_flow_table_ipv4 nf_flow_table_ipv6 nft_flow_offload)
+endef
+
+$(eval $(call KernelPackage,nft-offload))
+
+
+define KernelPackage/nft-nat6
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter nf_tables IPv6-NAT support
+  DEPENDS:=+kmod-nft-nat +kmod-nf-nat6
+  FILES:=$(foreach mod,$(NFT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_NAT6-m)))
+  KCONFIG:=$(KCONFIG_NFT_NAT6)
+endef
+
+$(eval $(call KernelPackage,nft-nat6))
+
+define KernelPackage/nft-netdev
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter nf_tables netdev support
+  DEPENDS:=+kmod-nft-core
+  KCONFIG:= \
+	CONFIG_NETFILTER_INGRESS=y \
+	CONFIG_NF_TABLES_NETDEV \
+	CONFIG_NF_DUP_NETDEV \
+	CONFIG_NFT_DUP_NETDEV \
+	CONFIG_NFT_FWD_NETDEV
+  FILES:= \
+	$(LINUX_DIR)/net/netfilter/nf_dup_netdev.ko \
+	$(LINUX_DIR)/net/netfilter/nft_dup_netdev.ko \
+	$(LINUX_DIR)/net/netfilter/nft_fwd_netdev.ko
+  AUTOLOAD:=$(call AutoProbe,nf_tables_netdev nf_dup_netdev nft_dup_netdev nft_fwd_netdev)
+endef
+
+$(eval $(call KernelPackage,nft-netdev))
+
+
+define KernelPackage/nft-fib
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter nf_tables fib support
+  DEPENDS:=+kmod-nft-core
+  FILES:=$(foreach mod,$(NFT_FIB-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_FIB-m)))
+  KCONFIG:=$(KCONFIG_NFT_FIB)
+endef
+
+$(eval $(call KernelPackage,nft-fib))
+
+
+define KernelPackage/nft-queue
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter nf_tables queue support
+  DEPENDS:=+kmod-nft-core +kmod-nfnetlink-queue
+  FILES:=$(foreach mod,$(NFT_QUEUE-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_QUEUE-m)))
+  KCONFIG:=$(KCONFIG_NFT_QUEUE)
+endef
+
+$(eval $(call KernelPackage,nft-queue))
diff --git a/root/target/linux/generic/config-5.4 b/root/target/linux/generic/config-5.4
index fc63ff1b..c918ffb3 100644
--- a/root/target/linux/generic/config-5.4
+++ b/root/target/linux/generic/config-5.4
@@ -122,6 +122,7 @@ CONFIG_AEABI=y
 # CONFIG_AHCI_IMX is not set
 # CONFIG_AHCI_MVEBU is not set
 # CONFIG_AHCI_QORIQ is not set
+# CONFIG_AHCI_XGENE is not set
 CONFIG_AIO=y
 # CONFIG_AIRO is not set
 # CONFIG_AIRO_CS is not set
@@ -297,6 +298,7 @@ CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8
 # CONFIG_ARM64_CRYPTO is not set
 # CONFIG_ARM64_ERRATUM_1024718 is not set
 # CONFIG_ARM64_ERRATUM_1463225 is not set
+# CONFIG_ARM64_ERRATUM_1542419 is not set
 # CONFIG_ARM64_ERRATUM_819472 is not set
 # CONFIG_ARM64_ERRATUM_824069 is not set
 # CONFIG_ARM64_ERRATUM_826319 is not set
@@ -400,6 +402,7 @@ CONFIG_ATAGS_PROC=y
 # CONFIG_ATA_ACPI is not set
 CONFIG_ATA_BMDMA=y
 # CONFIG_ATA_GENERIC is not set
+# CONFIG_ATA_LEDS is not set
 # CONFIG_ATA_NONSTANDARD is not set
 # CONFIG_ATA_OVER_ETH is not set
 # CONFIG_ATA_PIIX is not set
@@ -498,6 +501,7 @@ CONFIG_BASE_SMALL=0
 # CONFIG_BATTERY_MAX17040 is not set
 # CONFIG_BATTERY_MAX17042 is not set
 # CONFIG_BATTERY_MAX1721X is not set
+# CONFIG_BATTERY_RT5033 is not set
 # CONFIG_BATTERY_SBS is not set
 # CONFIG_BAYCOM_EPP is not set
 # CONFIG_BAYCOM_PAR is not set
@@ -642,6 +646,8 @@ CONFIG_BLOCK=y
 # CONFIG_BONDING is not set
 # CONFIG_BOOKE_WDT is not set
 CONFIG_BOOKE_WDT_DEFAULT_TIMEOUT=3
+# CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set
+# CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC is not set
 # CONFIG_BOOT_PRINTK_DELAY is not set
 CONFIG_BOOT_RAW=y
 CONFIG_BPF=y
@@ -964,6 +970,12 @@ CONFIG_CRYPTO=y
 CONFIG_CRYPTO_AES=y
 # CONFIG_CRYPTO_AES_586 is not set
 # CONFIG_CRYPTO_AES_ARM is not set
+# CONFIG_CRYPTO_AES_ARM64 is not set
+# CONFIG_CRYPTO_AES_ARM64_BS is not set
+# CONFIG_CRYPTO_AES_ARM64_CE is not set
+# CONFIG_CRYPTO_AES_ARM64_CE_BLK is not set
+# CONFIG_CRYPTO_AES_ARM64_CE_CCM is not set
+# CONFIG_CRYPTO_AES_ARM64_NEON_BLK is not set
 # CONFIG_CRYPTO_AES_ARM_BS is not set
 # CONFIG_CRYPTO_AES_ARM_CE is not set
 # CONFIG_CRYPTO_AES_NI_INTEL is not set
@@ -974,6 +986,8 @@ CONFIG_CRYPTO_ALGAPI2=y
 # CONFIG_CRYPTO_ANUBIS is not set
 # CONFIG_CRYPTO_ARC4 is not set
 # CONFIG_CRYPTO_AUTHENC is not set
+# CONFIG_CRYPTO_BLAKE2S is not set
+# CONFIG_CRYPTO_BLAKE2S_X86 is not set
 CONFIG_CRYPTO_BLKCIPHER=y
 CONFIG_CRYPTO_BLKCIPHER2=y
 # CONFIG_CRYPTO_BLOWFISH is not set
@@ -986,15 +1000,21 @@ CONFIG_CRYPTO_BLKCIPHER2=y
 # CONFIG_CRYPTO_CHACHA20 is not set
 # CONFIG_CRYPTO_CHACHA20POLY1305 is not set
 # CONFIG_CRYPTO_CHACHA20_NEON is not set
+# CONFIG_CRYPTO_CHACHA_MIPS is not set
 # CONFIG_CRYPTO_CMAC is not set
 # CONFIG_CRYPTO_CRC32 is not set
 # CONFIG_CRYPTO_CRC32C is not set
 # CONFIG_CRYPTO_CRC32C_INTEL is not set
 # CONFIG_CRYPTO_CRC32_ARM_CE is not set
 # CONFIG_CRYPTO_CRCT10DIF is not set
+# CONFIG_CRYPTO_CRCT10DIF_ARM64_CE is not set
+# CONFIG_CRYPTO_CRCT10DIF_ARM_CE is not set
 # CONFIG_CRYPTO_CRYPTD is not set
 # CONFIG_CRYPTO_CTR is not set
 # CONFIG_CRYPTO_CTS is not set
+# CONFIG_CRYPTO_CURVE25519 is not set
+# CONFIG_CRYPTO_CURVE25519_NEON is not set
+# CONFIG_CRYPTO_CURVE25519_X86 is not set
 # CONFIG_CRYPTO_DEFLATE is not set
 # CONFIG_CRYPTO_DES is not set
 # CONFIG_CRYPTO_DEV_ATMEL_AES is not set
@@ -1045,6 +1065,7 @@ CONFIG_CRYPTO_BLKCIPHER2=y
 # CONFIG_CRYPTO_GCM is not set
 # CONFIG_CRYPTO_GF128MUL is not set
 # CONFIG_CRYPTO_GHASH is not set
+# CONFIG_CRYPTO_GHASH_ARM64_CE is not set
 # CONFIG_CRYPTO_GHASH_ARM_CE is not set
 # CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL is not set
 # CONFIG_CRYPTO_HASH is not set
@@ -1055,6 +1076,12 @@ CONFIG_CRYPTO_BLKCIPHER2=y
 # CONFIG_CRYPTO_KHAZAD is not set
 CONFIG_CRYPTO_LIB_AES=y
 CONFIG_CRYPTO_LIB_ARC4=y
+# CONFIG_CRYPTO_LIB_BLAKE2S is not set
+# CONFIG_CRYPTO_LIB_CHACHA is not set
+# CONFIG_CRYPTO_LIB_CHACHA20POLY1305 is not set
+# CONFIG_CRYPTO_LIB_CURVE25519 is not set
+# CONFIG_CRYPTO_LIB_POLY1305 is not set
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=9
 # CONFIG_CRYPTO_LRW is not set
 # CONFIG_CRYPTO_LZ4 is not set
 # CONFIG_CRYPTO_LZ4HC is not set
@@ -1078,8 +1105,10 @@ CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y
 # CONFIG_CRYPTO_PCOMP is not set
 # CONFIG_CRYPTO_PCOMP2 is not set
 CONFIG_CRYPTO_PCRYPT=y
-# CONFIG_CRYPTO_POLY1305_ARM is not set
 # CONFIG_CRYPTO_POLY1305 is not set
+# CONFIG_CRYPTO_POLY1305_ARM is not set
+# CONFIG_CRYPTO_POLY1305_MIPS is not set
+# CONFIG_CRYPTO_POLY1305_NEON is not set
 # CONFIG_CRYPTO_RMD128 is not set
 # CONFIG_CRYPTO_RMD160 is not set
 # CONFIG_CRYPTO_RMD256 is not set
@@ -1093,17 +1122,25 @@ CONFIG_CRYPTO_PCRYPT=y
 # CONFIG_CRYPTO_SERPENT is not set
 # CONFIG_CRYPTO_SHA1 is not set
 # CONFIG_CRYPTO_SHA1_ARM is not set
+# CONFIG_CRYPTO_SHA1_ARM64_CE is not set
 # CONFIG_CRYPTO_SHA1_ARM_CE is not set
 # CONFIG_CRYPTO_SHA1_ARM_NEON is not set
 # CONFIG_CRYPTO_SHA256 is not set
 # CONFIG_CRYPTO_SHA256_ARM is not set
+# CONFIG_CRYPTO_SHA256_ARM64 is not set
+# CONFIG_CRYPTO_SHA2_ARM64_CE is not set
 # CONFIG_CRYPTO_SHA2_ARM_CE is not set
 # CONFIG_CRYPTO_SHA3 is not set
+# CONFIG_CRYPTO_SHA3_ARM64 is not set
 # CONFIG_CRYPTO_SHA512 is not set
 # CONFIG_CRYPTO_SHA512_ARM is not set
+# CONFIG_CRYPTO_SHA512_ARM64 is not set
+# CONFIG_CRYPTO_SHA512_ARM64_CE is not set
 # CONFIG_CRYPTO_SIMD is not set
 # CONFIG_CRYPTO_SM3 is not set
+# CONFIG_CRYPTO_SM3_ARM64_CE is not set
 # CONFIG_CRYPTO_SM4 is not set
+# CONFIG_CRYPTO_SM4_ARM64_CE is not set
 # CONFIG_CRYPTO_SPECK is not set
 # CONFIG_CRYPTO_STATS is not set
 # CONFIG_CRYPTO_STREEBOG is not set
@@ -1148,6 +1185,7 @@ CONFIG_CRYPTO_PCRYPT=y
 # CONFIG_DEBUG_CREDENTIALS is not set
 # CONFIG_DEBUG_DEVRES is not set
 # CONFIG_DEBUG_DRIVER is not set
+# CONFIG_DEBUG_EFI is not set
 # CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_GPIO is not set
@@ -1211,12 +1249,14 @@ CONFIG_DEBUG_KERNEL=y
 CONFIG_DEFAULT_CUBIC=y
 CONFIG_DEFAULT_DEADLINE=y
 CONFIG_DEFAULT_HOSTNAME="(none)"
+CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120
 CONFIG_DEFAULT_IOSCHED="deadline"
 CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
 # CONFIG_DEFAULT_NOOP is not set
 # CONFIG_DEFAULT_RENO is not set
 CONFIG_DEFAULT_SECURITY=""
 CONFIG_DEFAULT_SECURITY_DAC=y
+# CONFIG_DEFAULT_SECURITY_SELINUX is not set
 CONFIG_DEFAULT_TCP_CONG="cubic"
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 # CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set
@@ -1349,10 +1389,12 @@ CONFIG_DQL=y
 # CONFIG_DRM_NXP_PTN3460 is not set
 # CONFIG_DRM_OMAP is not set
 # CONFIG_DRM_PANEL_ARM_VERSATILE is not set
+# CONFIG_DRM_PANEL_FEIYANG_FY07024DI26A30D is not set
 # CONFIG_DRM_PANEL_ILITEK_IL9322 is not set
 # CONFIG_DRM_PANEL_ILITEK_ILI9881C is not set
 # CONFIG_DRM_PANEL_INNOLUX_P079ZCA is not set
 # CONFIG_DRM_PANEL_JDI_LT070ME05000 is not set
+# CONFIG_DRM_PANEL_KINGDISPLAY_KD097D04 is not set
 # CONFIG_DRM_PANEL_LG_LB035Q02 is not set
 # CONFIG_DRM_PANEL_LG_LG4573 is not set
 # CONFIG_DRM_PANEL_LVDS is not set
@@ -1360,10 +1402,15 @@ CONFIG_DQL=y
 # CONFIG_DRM_PANEL_NOVATEK_NT39016 is not set
 # CONFIG_DRM_PANEL_OLIMEX_LCD_OLINUXINO is not set
 # CONFIG_DRM_PANEL_ORISETECH_OTM8009A is not set
+# CONFIG_DRM_PANEL_OSD_OSD101T2587_53TS is not set
 # CONFIG_DRM_PANEL_PANASONIC_VVX10F034N00 is not set
 # CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN is not set
+# CONFIG_DRM_PANEL_RAYDIUM_RM67191 is not set
 # CONFIG_DRM_PANEL_RAYDIUM_RM68200 is not set
+# CONFIG_DRM_PANEL_ROCKTECH_JH057N00900 is not set
+# CONFIG_DRM_PANEL_RONBO_RB070D30 is not set
 # CONFIG_DRM_PANEL_SAMSUNG_LD9040 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6D16D0 is not set
 # CONFIG_DRM_PANEL_SAMSUNG_S6E3HA2 is not set
 # CONFIG_DRM_PANEL_SAMSUNG_S6E63J0X03 is not set
 # CONFIG_DRM_PANEL_SAMSUNG_S6E63M0 is not set
@@ -1372,11 +1419,14 @@ CONFIG_DQL=y
 # CONFIG_DRM_PANEL_SHARP_LQ101R1SX01 is not set
 # CONFIG_DRM_PANEL_SHARP_LS037V7DW01 is not set
 # CONFIG_DRM_PANEL_SHARP_LS043T1LE01 is not set
+# CONFIG_DRM_PANEL_SIMPLE is not set
+# CONFIG_DRM_PANEL_SITRONIX_ST7701 is not set
 # CONFIG_DRM_PANEL_SITRONIX_ST7789V is not set
 # CONFIG_DRM_PANEL_SONY_ACX565AKM is not set
-# CONFIG_DRM_PANEL_TPO_TD043MTEA1 is not set
 # CONFIG_DRM_PANEL_TPO_TD028TTEC1 is not set
+# CONFIG_DRM_PANEL_TPO_TD043MTEA1 is not set
 # CONFIG_DRM_PANEL_TPO_TPG110 is not set
+# CONFIG_DRM_PANEL_TRULY_NT35597_WQXGA is not set
 # CONFIG_DRM_PANFROST is not set
 # CONFIG_DRM_PARADE_PS8622 is not set
 # CONFIG_DRM_PL111 is not set
@@ -1398,8 +1448,10 @@ CONFIG_DQL=y
 # CONFIG_DRM_TI_TFP410 is not set
 # CONFIG_DRM_TOSHIBA_TC358764 is not set
 # CONFIG_DRM_TOSHIBA_TC358767 is not set
+# CONFIG_DRM_TVE200 is not set
 # CONFIG_DRM_UDL is not set
 # CONFIG_DRM_VBOXVIDEO is not set
+# CONFIG_DRM_VC4_HDMI_CEC is not set
 # CONFIG_DRM_VGEM is not set
 # CONFIG_DRM_VIRTIO_GPU is not set
 # CONFIG_DRM_VKMS is not set
@@ -1481,12 +1533,19 @@ CONFIG_EPOLL=y
 CONFIG_ETHERNET=y
 # CONFIG_ETHOC is not set
 CONFIG_EVENTFD=y
+# CONFIG_EVM is not set
+# CONFIG_EXFAT_DEBUG_MSG is not set
+CONFIG_EXFAT_DEFAULT_CODEPAGE=437
+# CONFIG_EXFAT_DELAYED_SYNC is not set
+CONFIG_EXFAT_DISCARD=y
+CONFIG_EXFAT_DONT_MOUNT_VFAT=y
 # CONFIG_EXFAT_FS is not set
+# CONFIG_EXFAT_KERNEL_DEBUG is not set
 CONFIG_EXPERT=y
 CONFIG_EXPORTFS=y
 # CONFIG_EXPORTFS_BLOCK_OPS is not set
 # CONFIG_EXT2_FS is not set
-# CONFIG_EXT2_FS_XATTR is not set
+CONFIG_EXT2_FS_XATTR=y
 # CONFIG_EXT3_FS is not set
 # CONFIG_EXT4_DEBUG is not set
 # CONFIG_EXT4_ENCRYPTION is not set
@@ -1519,10 +1578,13 @@ CONFIG_EXTRA_TARGETS=""
 # CONFIG_F2FS_FS_ENCRYPTION is not set
 # CONFIG_F2FS_FS_POSIX_ACL is not set
 # CONFIG_F2FS_FS_SECURITY is not set
+CONFIG_F2FS_FS_XATTR=y
 # CONFIG_F2FS_IO_TRACE is not set
+CONFIG_F2FS_STAT_FS=y
 # CONFIG_FAILOVER is not set
 # CONFIG_FAIR_GROUP_SCHED is not set
 # CONFIG_FANOTIFY is not set
+# CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set
 CONFIG_FAT_DEFAULT_CODEPAGE=437
 CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
 # CONFIG_FAT_DEFAULT_UTF8 is not set
@@ -2028,8 +2090,8 @@ CONFIG_HW_RANDOM_TPM=y
 # CONFIG_HYPERV is not set
 # CONFIG_HYPERV_TSCPAGE is not set
 # CONFIG_HYSDN is not set
-# CONFIG_HZ is not set
-# CONFIG_HZ_100 is not set
+CONFIG_HZ=100
+CONFIG_HZ_100=y
 # CONFIG_HZ_1000 is not set
 # CONFIG_HZ_1024 is not set
 # CONFIG_HZ_128 is not set
@@ -2064,6 +2126,7 @@ CONFIG_HW_RANDOM_TPM=y
 # CONFIG_I2C_DEMUX_PINCTRL is not set
 # CONFIG_I2C_DESIGNWARE_PCI is not set
 # CONFIG_I2C_DESIGNWARE_PLATFORM is not set
+# CONFIG_I2C_DESIGNWARE_SLAVE is not set
 # CONFIG_I2C_DIOLAN_U2C is not set
 # CONFIG_I2C_EG20T is not set
 # CONFIG_I2C_ELEKTOR is not set
@@ -2101,6 +2164,7 @@ CONFIG_HW_RANDOM_TPM=y
 # CONFIG_I2C_PCA_PLATFORM is not set
 # CONFIG_I2C_PIIX4 is not set
 # CONFIG_I2C_PXA_PCI is not set
+# CONFIG_I2C_PXA_SLAVE is not set
 # CONFIG_I2C_RCAR is not set
 # CONFIG_I2C_RK3X is not set
 # CONFIG_I2C_ROBOTFUZZ_OSIF is not set
@@ -2112,6 +2176,7 @@ CONFIG_HW_RANDOM_TPM=y
 # CONFIG_I2C_SIS630 is not set
 # CONFIG_I2C_SIS96X is not set
 # CONFIG_I2C_SLAVE is not set
+# CONFIG_I2C_SLAVE_EEPROM is not set
 # CONFIG_I2C_SMBUS is not set
 # CONFIG_I2C_STUB is not set
 # CONFIG_I2C_TAOS_EVM is not set
@@ -2181,6 +2246,7 @@ CONFIG_IIO_CONSUMERS_PER_TRIGGER=2
 # CONFIG_IKCONFIG is not set
 # CONFIG_IKCONFIG_PROC is not set
 # CONFIG_IKHEADERS is not set
+# CONFIG_IMA is not set
 # CONFIG_IMAGE_CMDLINE_HACK is not set
 # CONFIG_IMGPDC_WDT is not set
 # CONFIG_IMG_MDC_DMA is not set
@@ -2313,6 +2379,9 @@ CONFIG_INPUT_MISC=y
 # CONFIG_INPUT_WISTRON_BTNS is not set
 # CONFIG_INPUT_YEALINK is not set
 # CONFIG_INT340X_THERMAL is not set
+# CONFIG_INTEGRITY is not set
+# CONFIG_INTEGRITY_AUDIT is not set
+# CONFIG_INTEGRITY_SIGNATURE is not set
 # CONFIG_INTEL_ATOMISP2_PM is not set
 # CONFIG_INTEL_CHT_INT33FE is not set
 # CONFIG_INTEL_HID_EVENT is not set
@@ -2343,6 +2412,7 @@ CONFIG_INPUT_MISC=y
 # CONFIG_INV_MPU6050_IIO is not set
 # CONFIG_INV_MPU6050_SPI is not set
 # CONFIG_IOMMU_SUPPORT is not set
+# CONFIG_IONIC is not set
 # CONFIG_IOSCHED_BFQ is not set
 # CONFIG_IOSCHED_CFQ is not set
 CONFIG_IOSCHED_DEADLINE=y
@@ -2367,10 +2437,12 @@ CONFIG_IO_STRICT_DEVMEM=y
 # CONFIG_IP6_NF_RAW is not set
 # CONFIG_IP6_NF_SECURITY is not set
 # CONFIG_IP6_NF_TARGET_HL is not set
+# CONFIG_IP6_NF_TARGET_MASQUERADE is not set
 # CONFIG_IP6_NF_TARGET_REJECT is not set
 # CONFIG_IP6_NF_TARGET_SYNPROXY is not set
 # CONFIG_IPACK_BUS is not set
 # CONFIG_IPC_NS is not set
+# CONFIG_IPMB_DEVICE_INTERFACE is not set
 # CONFIG_IPMI_HANDLER is not set
 # CONFIG_IPV6 is not set
 # CONFIG_IPV6_FOU is not set
@@ -2391,6 +2463,7 @@ CONFIG_IPV6_NDISC_NODETYPE=y
 # CONFIG_IPV6_TUNNEL is not set
 # CONFIG_IPV6_VTI is not set
 # CONFIG_IPVLAN is not set
+# CONFIG_IPVTAP is not set
 # CONFIG_IPW2100 is not set
 # CONFIG_IPW2100_DEBUG is not set
 CONFIG_IPW2100_MONITOR=y
@@ -2582,6 +2655,7 @@ CONFIG_KERNFS=y
 # CONFIG_KGDB is not set
 # CONFIG_KMEMCHECK is not set
 # CONFIG_KMX61 is not set
+# CONFIG_KPC2000 is not set
 # CONFIG_KPROBES is not set
 # CONFIG_KPROBES_SANITY_TEST is not set
 # CONFIG_KS7010 is not set
@@ -2592,6 +2666,7 @@ CONFIG_KERNFS=y
 # CONFIG_KSZ884X_PCI is not set
 CONFIG_KUSER_HELPERS=y
 # CONFIG_KVM_AMD is not set
+# CONFIG_KVM_AMD_SEV is not set
 # CONFIG_KVM_GUEST is not set
 # CONFIG_KVM_INTEL is not set
 # CONFIG_KXCJK1013 is not set
@@ -2677,8 +2752,7 @@ CONFIG_LEDS_TRIGGERS=y
 CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
 # CONFIG_LEDS_TRIGGER_DISK is not set
 # CONFIG_LEDS_TRIGGER_GPIO is not set
-# CONFIG_LEDS_TRIGGER_HEARTBEAT is not set
-# CONFIG_LEDS_TRIGGER_IDE_DISK is not set
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
 # CONFIG_LEDS_TRIGGER_MTD is not set
 CONFIG_LEDS_TRIGGER_NETDEV=y
 # CONFIG_LEDS_TRIGGER_ONESHOT is not set
@@ -2735,6 +2809,7 @@ CONFIG_LOG_CPU_MAX_BUF_SHIFT=12
 # CONFIG_LP_CONSOLE is not set
 # CONFIG_LSI_ET1011C_PHY is not set
 CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity"
+CONFIG_LSM_MMAP_MIN_ADDR=65536
 # CONFIG_LTC1660 is not set
 # CONFIG_LTC2471 is not set
 # CONFIG_LTC2485 is not set
@@ -2974,6 +3049,7 @@ CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4
 # CONFIG_MICROSEMI_PHY is not set
 # CONFIG_MIGRATION is not set
 CONFIG_MII=y
+# CONFIG_MIKROTIK is not set
 # CONFIG_MIKROTIK_RB532 is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_MINIX_FS_NATIVE_ENDIAN is not set
@@ -3056,6 +3132,7 @@ CONFIG_MMC_BLOCK_MINORS=8
 # CONFIG_MMC_SPI is not set
 # CONFIG_MMC_STM32_SDMMC is not set
 # CONFIG_MMC_TEST is not set
+# CONFIG_MMC_TIFM_SD is not set
 # CONFIG_MMC_TOSHIBA_PCI is not set
 # CONFIG_MMC_USDHI6ROL0 is not set
 # CONFIG_MMC_USHC is not set
@@ -3225,6 +3302,7 @@ CONFIG_MTD_REDBOOT_DIRECTORY_BLOCK=-1
 # CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED is not set
 # CONFIG_MTD_ROM is not set
 CONFIG_MTD_ROOTFS_ROOT_DEV=y
+# CONFIG_MTD_ROUTERBOOT_PARTS is not set
 # CONFIG_MTD_SLRAM is not set
 # CONFIG_MTD_SM_COMMON is not set
 # CONFIG_MTD_SPINAND_MT29F is not set
@@ -3233,7 +3311,10 @@ CONFIG_MTD_ROOTFS_ROOT_DEV=y
 # CONFIG_MTD_SPI_NOR_USE_4K_SECTORS is not set
 CONFIG_MTD_SPI_NOR_USE_4K_SECTORS_LIMIT=4096
 CONFIG_MTD_SPLIT=y
+# CONFIG_MTD_SPLIT_BCM63XX_FW is not set
+# CONFIG_MTD_SPLIT_BCM_WFI_FW is not set
 # CONFIG_MTD_SPLIT_BRNIMAGE_FW is not set
+# CONFIG_MTD_SPLIT_ELF_FW is not set
 # CONFIG_MTD_SPLIT_EVA_FW is not set
 # CONFIG_MTD_SPLIT_FIRMWARE is not set
 CONFIG_MTD_SPLIT_FIRMWARE_NAME="firmware"
@@ -3252,6 +3333,8 @@ CONFIG_MTD_SPLIT_SUPPORT=y
 # CONFIG_MTD_SWAP is not set
 # CONFIG_MTD_TESTS is not set
 # CONFIG_MTD_UBI is not set
+# CONFIG_MTD_UBI_FASTMAP is not set
+# CONFIG_MTD_UBI_GLUEBI is not set
 # CONFIG_MTD_UIMAGE_SPLIT is not set
 # CONFIG_MTD_VIRT_CONCAT is not set
 # CONFIG_MTK_MMC is not set
@@ -3357,11 +3440,13 @@ CONFIG_NETDEVICES=y
 # CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set
 # CONFIG_NETFILTER_XT_TARGET_RATEEST is not set
 # CONFIG_NETFILTER_XT_TARGET_REDIRECT is not set
+# CONFIG_NETFILTER_XT_TARGET_SECMARK is not set
 # CONFIG_NETFILTER_XT_TARGET_TCPMSS is not set
 # CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set
 # CONFIG_NETFILTER_XT_TARGET_TEE is not set
 # CONFIG_NETFILTER_XT_TARGET_TPROXY is not set
 # CONFIG_NETFILTER_XT_TARGET_TRACE is not set
+# CONFIG_NETLABEL is not set
 # CONFIG_NETLINK_DIAG is not set
 # CONFIG_NETLINK_MMAP is not set
 # CONFIG_NETPOLL is not set
@@ -3422,6 +3507,7 @@ CONFIG_NET_CORE=y
 # CONFIG_NET_DSA_MV88E6352 is not set
 # CONFIG_NET_DSA_MV88E6XXX is not set
 # CONFIG_NET_DSA_MV88E6XXX_NEED_PPU is not set
+# CONFIG_NET_DSA_MV88E6XXX_PTP is not set
 # CONFIG_NET_DSA_QCA8K is not set
 # CONFIG_NET_DSA_REALTEK_SMI is not set
 # CONFIG_NET_DSA_SJA1105 is not set
@@ -3437,6 +3523,7 @@ CONFIG_NET_CORE=y
 # CONFIG_NET_DSA_TAG_LAN9303 is not set
 # CONFIG_NET_DSA_TAG_MTK is not set
 # CONFIG_NET_DSA_TAG_QCA is not set
+# CONFIG_NET_DSA_TAG_RTL4_A is not set
 # CONFIG_NET_DSA_TAG_SJA1105 is not set
 # CONFIG_NET_DSA_TAG_TRAILER is not set
 # CONFIG_NET_DSA_VITESSE_VSC73XX is not set
@@ -3641,6 +3728,7 @@ CONFIG_NFS_V3=y
 CONFIG_NF_CONNTRACK_PROCFS=y
 # CONFIG_NF_CONNTRACK_PROC_COMPAT is not set
 # CONFIG_NF_CONNTRACK_SANE is not set
+# CONFIG_NF_CONNTRACK_SECMARK is not set
 # CONFIG_NF_CONNTRACK_SIP is not set
 # CONFIG_NF_CONNTRACK_SNMP is not set
 # CONFIG_NF_CONNTRACK_TFTP is not set
@@ -3648,6 +3736,7 @@ CONFIG_NF_CONNTRACK_PROCFS=y
 # CONFIG_NF_CONNTRACK_TIMESTAMP is not set
 # CONFIG_NF_CONNTRACK_ZONES is not set
 # CONFIG_NF_CT_NETLINK is not set
+# CONFIG_NF_CT_NETLINK_HELPER is not set
 # CONFIG_NF_CT_NETLINK_TIMEOUT is not set
 # CONFIG_NF_CT_PROTO_DCCP is not set
 # CONFIG_NF_CT_PROTO_GRE is not set
@@ -3660,6 +3749,7 @@ CONFIG_NF_CONNTRACK_PROCFS=y
 # CONFIG_NF_LOG_ARP is not set
 # CONFIG_NF_LOG_BRIDGE is not set
 # CONFIG_NF_LOG_IPV4 is not set
+# CONFIG_NF_LOG_IPV6 is not set
 # CONFIG_NF_LOG_NETDEV is not set
 # CONFIG_NF_NAT is not set
 # CONFIG_NF_NAT_AMANDA is not set
@@ -3777,6 +3867,7 @@ CONFIG_NMI_LOG_BUF_SHIFT=13
 # CONFIG_NVMEM_SYSFS is not set
 # CONFIG_NVME_FC is not set
 # CONFIG_NVME_TARGET is not set
+# CONFIG_NVME_TCP is not set
 # CONFIG_NVRAM is not set
 # CONFIG_NV_TCO is not set
 # CONFIG_NXP_STB220 is not set
@@ -3786,6 +3877,7 @@ CONFIG_NMI_LOG_BUF_SHIFT=13
 # CONFIG_OABI_COMPAT is not set
 # CONFIG_OBS600 is not set
 # CONFIG_OCFS2_FS is not set
+# CONFIG_OCTEONTX2_AF is not set
 # CONFIG_OF_OVERLAY is not set
 CONFIG_OF_RESERVED_MEM=y
 # CONFIG_OF_UNITTEST is not set
@@ -3899,9 +3991,11 @@ CONFIG_PARTITION_ADVANCED=y
 # CONFIG_PCH_PHUB is not set
 # CONFIG_PCI is not set
 # CONFIG_PCI200SYN is not set
+# CONFIG_PCIEAER is not set
 # CONFIG_PCIEAER_INJECT is not set
 # CONFIG_PCIEASPM is not set
 # CONFIG_PCIEPORTBUS is not set
+# CONFIG_PCIE_AL is not set
 # CONFIG_PCIE_ALTERA is not set
 # CONFIG_PCIE_ARMADA_8K is not set
 # CONFIG_PCIE_BW is not set
@@ -4100,7 +4194,7 @@ CONFIG_PRINT_STACK_DEPTH=64
 CONFIG_PROC_FS=y
 # CONFIG_PROC_KCORE is not set
 # CONFIG_PROC_PAGE_MONITOR is not set
-CONFIG_PROC_STRIPPED=y
+# CONFIG_PROC_STRIPPED is not set
 CONFIG_PROC_SYSCTL=y
 # CONFIG_PROC_VMCORE_DEVICE_DUMP is not set
 # CONFIG_PROFILE_ALL_BRANCHES is not set
@@ -4108,6 +4202,7 @@ CONFIG_PROC_SYSCTL=y
 # CONFIG_PROFILING is not set
 # CONFIG_PROVE_LOCKING is not set
 # CONFIG_PROVE_RCU is not set
+# CONFIG_PROVE_RCU_LIST is not set
 # CONFIG_PROVE_RCU_REPEATEDLY is not set
 # CONFIG_PSAMPLE is not set
 # CONFIG_PSB6970_PHY is not set
@@ -4183,16 +4278,14 @@ CONFIG_PWRSEQ_SIMPLE=y
 # CONFIG_RAW_DRIVER is not set
 # CONFIG_RBTREE_TEST is not set
 # CONFIG_RCU_BOOST is not set
-CONFIG_RCU_CPU_STALL_TIMEOUT=60
+CONFIG_RCU_CPU_STALL_TIMEOUT=21
 # CONFIG_RCU_EQS_DEBUG is not set
 # CONFIG_RCU_EXPEDITE_BOOT is not set
-CONFIG_RCU_EXPERT=y
-CONFIG_RCU_FANOUT=32
-CONFIG_RCU_FANOUT_LEAF=16
-# CONFIG_RCU_FAST_NO_HZ is not set
+# CONFIG_RCU_EXPERT is not set
 CONFIG_RCU_KTHREAD_PRIO=0
-# CONFIG_RCU_NOCB_CPU is not set
+CONFIG_RCU_NEED_SEGCBLIST=y
 # CONFIG_RCU_PERF_TEST is not set
+CONFIG_RCU_STALL_COMMON=y
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_RCU_TORTURE_TEST_SLOW_INIT_DELAY=3
 # CONFIG_RCU_TRACE is not set
@@ -4209,6 +4302,7 @@ CONFIG_RCU_TORTURE_TEST_SLOW_INIT_DELAY=3
 # CONFIG_RD_LZO is not set
 # CONFIG_RD_XZ is not set
 # CONFIG_READABLE_ASM is not set
+# CONFIG_READ_ONLY_THP_FOR_FS is not set
 # CONFIG_REALTEK_PHY is not set
 # CONFIG_REDWOOD is not set
 # CONFIG_REED_SOLOMON_TEST is not set
@@ -4237,6 +4331,7 @@ CONFIG_RCU_TORTURE_TEST_SLOW_INIT_DELAY=3
 # CONFIG_REGULATOR_LTC3589 is not set
 # CONFIG_REGULATOR_LTC3676 is not set
 # CONFIG_REGULATOR_MAX1586 is not set
+# CONFIG_REGULATOR_MAX77620 is not set
 # CONFIG_REGULATOR_MAX8649 is not set
 # CONFIG_REGULATOR_MAX8660 is not set
 # CONFIG_REGULATOR_MAX8952 is not set
@@ -4265,7 +4360,7 @@ CONFIG_RCU_TORTURE_TEST_SLOW_INIT_DELAY=3
 # CONFIG_REISERFS_FS is not set
 # CONFIG_REISERFS_FS_POSIX_ACL is not set
 # CONFIG_REISERFS_FS_SECURITY is not set
-# CONFIG_REISERFS_FS_XATTR is not set
+CONFIG_REISERFS_FS_XATTR=y
 # CONFIG_REISERFS_PROC_INFO is not set
 # CONFIG_RELAY is not set
 # CONFIG_RELOCATABLE is not set
@@ -4347,6 +4442,7 @@ CONFIG_RTC_DRV_CMOS=y
 # CONFIG_RTC_DRV_ISL12026 is not set
 # CONFIG_RTC_DRV_ISL12057 is not set
 # CONFIG_RTC_DRV_ISL1208 is not set
+# CONFIG_RTC_DRV_JZ4740 is not set
 # CONFIG_RTC_DRV_M41T80 is not set
 # CONFIG_RTC_DRV_M41T93 is not set
 # CONFIG_RTC_DRV_M41T94 is not set
@@ -4561,7 +4657,21 @@ CONFIG_SCSI_PROC_FS=y
 CONFIG_SECTION_MISMATCH_WARN_ONLY=y
 # CONFIG_SECURITY is not set
 # CONFIG_SECURITYFS is not set
+# CONFIG_SECURITY_APPARMOR is not set
 CONFIG_SECURITY_DMESG_RESTRICT=y
+# CONFIG_SECURITY_LOADPIN is not set
+# CONFIG_SECURITY_LOCKDOWN_LSM is not set
+# CONFIG_SECURITY_NETWORK_XFRM is not set
+# CONFIG_SECURITY_PATH is not set
+# CONFIG_SECURITY_SAFESETID is not set
+# CONFIG_SECURITY_SELINUX_AVC_STATS is not set
+# CONFIG_SECURITY_SELINUX_BOOTPARAM is not set
+CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=0
+# CONFIG_SECURITY_SELINUX_DEVELOP is not set
+# CONFIG_SECURITY_SELINUX_DISABLE is not set
+# CONFIG_SECURITY_SMACK is not set
+# CONFIG_SECURITY_TOMOYO is not set
+# CONFIG_SECURITY_YAMA is not set
 CONFIG_SELECT_MEMORY_MODEL=y
 # CONFIG_SENSIRION_SGP30 is not set
 # CONFIG_SENSORS_ABITUGURU is not set
@@ -5139,6 +5249,7 @@ CONFIG_SND_PROC_FS=y
 CONFIG_SND_SOC_INTEL_SST_TOPLEVEL=y
 # CONFIG_SND_SOC_JZ4725B_CODEC is not set
 # CONFIG_SND_SOC_JZ4740_CODEC is not set
+# CONFIG_SND_SOC_MA120X0P is not set
 # CONFIG_SND_SOC_MAX9759 is not set
 # CONFIG_SND_SOC_MAX98088 is not set
 # CONFIG_SND_SOC_MAX98357A is not set
@@ -5678,6 +5789,7 @@ CONFIG_TMPFS_XATTR=y
 # CONFIG_TOUCHSCREEN_PENMOUNT is not set
 # CONFIG_TOUCHSCREEN_PIXCIR is not set
 # CONFIG_TOUCHSCREEN_PROPERTIES is not set
+# CONFIG_TOUCHSCREEN_RASPBERRYPI_FW is not set
 # CONFIG_TOUCHSCREEN_RM_TS is not set
 # CONFIG_TOUCHSCREEN_ROHM_BU21023 is not set
 # CONFIG_TOUCHSCREEN_RPI_FT5406 is not set
@@ -5778,11 +5890,14 @@ CONFIG_TTY=y
 # CONFIG_TYPHOON is not set
 # CONFIG_UACCESS_WITH_MEMCPY is not set
 # CONFIG_UBIFS_ATIME_SUPPORT is not set
+# CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
 # CONFIG_UBIFS_FS_AUTHENTICATION is not set
 # CONFIG_UBIFS_FS_ENCRYPTION is not set
-CONFIG_UBIFS_FS_FORMAT4=y
+CONFIG_UBIFS_FS_LZO=y
 # CONFIG_UBIFS_FS_SECURITY is not set
-# CONFIG_UBIFS_FS_XATTR is not set
+CONFIG_UBIFS_FS_XATTR=y
+CONFIG_UBIFS_FS_ZLIB=y
+CONFIG_UBIFS_FS_ZSTD=y
 # CONFIG_UBSAN is not set
 CONFIG_UBSAN_ALIGNMENT=y
 # CONFIG_UCB1400_CORE is not set
@@ -5861,6 +5976,7 @@ CONFIG_USB_DEFAULT_PERSIST=y
 # CONFIG_USB_EG20T is not set
 # CONFIG_USB_EHCI_ATH79 is not set
 # CONFIG_USB_EHCI_FSL is not set
+# CONFIG_USB_EHCI_HCD is not set
 # CONFIG_USB_EHCI_HCD_AT91 is not set
 # CONFIG_USB_EHCI_HCD_OMAP is not set
 # CONFIG_USB_EHCI_HCD_PPC_OF is not set
@@ -6043,6 +6159,7 @@ CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 # CONFIG_USB_RCAR_PHY is not set
 # CONFIG_USB_RENESAS_USBHS is not set
 # CONFIG_USB_RIO500 is not set
+# CONFIG_USB_ROLES_INTEL_XHCI is not set
 # CONFIG_USB_ROLE_SWITCH is not set
 # CONFIG_USB_RTL8150 is not set
 # CONFIG_USB_RTL8152 is not set
@@ -6165,6 +6282,7 @@ CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV=y
 # CONFIG_USB_ZR364XX is not set
 # CONFIG_USELIB is not set
 # CONFIG_USERFAULTFD is not set
+# CONFIG_USERIO is not set
 # CONFIG_USE_OF is not set
 # CONFIG_UTS_NS is not set
 # CONFIG_UWB is not set
@@ -6175,13 +6293,14 @@ CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV=y
 # CONFIG_VBOXGUEST is not set
 # CONFIG_VCNL4000 is not set
 # CONFIG_VCNL4035 is not set
-# CONFIG_VDSO is not set
+CONFIG_VDSO=y
 # CONFIG_VEML6070 is not set
 # CONFIG_VETH is not set
 # CONFIG_VEXPRESS_CONFIG is not set
 # CONFIG_VF610_ADC is not set
 # CONFIG_VF610_DAC is not set
 # CONFIG_VFAT_FS is not set
+# CONFIG_VFIO is not set
 # CONFIG_VGASTATE is not set
 # CONFIG_VGA_ARB is not set
 # CONFIG_VGA_SWITCHEROO is not set
@@ -6292,6 +6411,7 @@ CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV=y
 # CONFIG_VIRTIO_INPUT is not set
 CONFIG_VIRTIO_MENU=y
 # CONFIG_VIRTIO_MMIO is not set
+# CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES is not set
 # CONFIG_VIRTIO_PCI is not set
 # CONFIG_VIRTUALIZATION is not set
 # CONFIG_VIRT_CPU_ACCOUNTING_GEN is not set
@@ -6369,6 +6489,7 @@ CONFIG_WEXT_PROC=y
 CONFIG_WEXT_SPY=y
 CONFIG_WILINK_PLATFORM_DATA=y
 # CONFIG_WIMAX is not set
+# CONFIG_WIREGUARD is not set
 CONFIG_WIRELESS=y
 CONFIG_WIRELESS_EXT=y
 # CONFIG_WIRELESS_WDS is not set