diff --git a/package/firmware/qca-nss-fw/Makefile b/package/firmware/qca-nss-fw/Makefile
new file mode 100644
index 0000000000..70c6b78be7
--- /dev/null
+++ b/package/firmware/qca-nss-fw/Makefile
@@ -0,0 +1,75 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=qca-nss-fw
+PKG_VERSION:=12.0.r1
+PKG_RELEASE:=002
+
+include $(INCLUDE_DIR)/package.mk
+
+define generate-qca-nss-fw
+
+  define Package/$(PKG_NAME)-$(1)-$(3)
+    SECTION:=firmware
+    CATEGORY:=Firmware
+    TITLE:=NSS firmware binaries for $(1) - $(3)
+    DEPENDS:=@TARGET_$(1)
+    CONFLICTS:=$($(PKG_NAME)_PREV_$(1))
+  endef
+
+  define Package/$(PKG_NAME)-$(1)-$(3)/description
+    NSS firmware binaries for $(1) - $(3)
+  endef
+
+  define Download/$(PKG_NAME)-$(1)-$(3)
+    URL:=http://qcawebsrvr.qualcomm.com/NSS/NSS.FW/$(PKG_VERSION)/$(2)/$(PKG_RELEASE)/
+    URL_FILE:=BIN-NSS.FW.$(PKG_VERSION)-$(PKG_RELEASE)-$(2).$(4).tar.bz2
+    FILE:=BIN-NSS.FW.$(PKG_VERSION)-$(PKG_RELEASE)-$(2).$(4).tar.bz2
+    HASH:=$(6)
+  endef
+  $$(if $$(CONFIG_PACKAGE_$(PKG_NAME)-$(1)-$(3)), \
+    $$(eval $$(call Download,$(PKG_NAME)-$(1)-$(3))) \
+  )
+
+  define Prepare/$(PKG_NAME)-$(1)-$(3)
+	bzcat $$(DL_DIR)/BIN-NSS.FW.$(PKG_VERSION)-$(PKG_RELEASE)-$(2).$(4).tar.bz2 \
+		| $$(HOST_TAR) -C $$(PKG_BUILD_DIR) $$(TAR_OPTIONS)
+  endef
+
+  define Package/$(PKG_NAME)-$(1)-$(3)/install
+	$$(INSTALL_DIR) $$(1)/lib/firmware/
+	$$(INSTALL_DATA) \
+		$$(PKG_BUILD_DIR)/BIN-NSS.FW.$(PKG_VERSION)-$(PKG_RELEASE)-$(2).$(4)/$(5)0.bin \
+		$$(1)/lib/firmware/qca-nss0-$(3).bin
+	-$$(INSTALL_DATA) \
+		$$(PKG_BUILD_DIR)/BIN-NSS.FW.$(PKG_VERSION)-$(PKG_RELEASE)-$(2).$(4)/$(5)1.bin \
+		$$(1)/lib/firmware/qca-nss1-$(3).bin
+  endef
+
+  $(PKG_NAME)_PREV_$(_SOC)+=$(PKG_NAME)-$(1)-$(3)
+  ALL_PACKAGE+=$(PKG_NAME)-$(1)-$(3)
+
+endef
+
+# $(eval $(call generate-qca-nss-fw,ipq50xx,MP,enterprise,E,enterprise_ap,))
+$(eval $(call generate-qca-nss-fw,ipq50xx,MP,retail,R,retail_router,ea41c576d4d18758880acc8db22d1cc721e6e294045ddf47a6bb86633309148f))
+# $(eval $(call generate-qca-nss-fw,ipq60xx,CP,enterprise,E,enterprise_ap,))
+$(eval $(call generate-qca-nss-fw,ipq60xx,CP,retail,R,retail_router,f92d840a9d14d9893eca462e9e29f5ae3b44de7b3faf01daf40eb018d93eed75))
+# $(eval $(call generate-qca-nss-fw,ipq806x,AK,enterprise,E,enterprise_ap,))
+# $(eval $(call generate-qca-nss-fw,ipq806x,AK,retail,R,retail_router,))
+# $(eval $(call generate-qca-nss-fw,ipq807x,HK,enterprise,E,enterprise_ap,))
+$(eval $(call generate-qca-nss-fw,ipq807x,HK,retail,R,retail_router,832c895835c9bb4259c238dc01ad872a853838863632801d55cb13267d296ea2))
+
+define Build/Prepare
+	$(foreach pkg, $(ALL_PACKAGE),
+		$(if $(CONFIG_PACKAGE_$(pkg)),
+			$(call Prepare/$(pkg))
+		)
+	)
+endef
+
+define Build/Compile
+endef
+
+$(foreach pkg, $(ALL_PACKAGE), \
+	$(eval $(call BuildPackage,$(pkg))) \
+)
diff --git a/package/kernel/qca/qca-nss-clients/Makefile b/package/kernel/qca/qca-nss-clients/Makefile
new file mode 100644
index 0000000000..56c3a75720
--- /dev/null
+++ b/package/kernel/qca/qca-nss-clients/Makefile
@@ -0,0 +1,691 @@
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=qca-nss-clients
+PKG_VERSION:=NHSS.QSDK.11.5.0.5
+PKG_RELEASE:=2
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://git.codelinaro.org/clo/qsdk/oss/lklm/nss-clients
+PKG_SOURCE_VERSION:=30742bb1decd5fe7b4e01be8081ab0a99c1f6888
+PKG_MIRROR_HASH:=skip
+
+PKG_BUILD_DEPENDS := PACKAGE_kmod-qca-nss-crypto:kmod-qca-nss-crypto
+MAKE_OPTS:=
+
+include $(INCLUDE_DIR)/package.mk
+
+# Keep default as ipq806x for branches that does not have subtarget framework
+ifeq ($(CONFIG_TARGET_ipq),y)
+subtarget:=$(SUBTARGET)
+else
+subtarget:=$(CONFIG_TARGET_BOARD)
+endif
+
+ifneq (, $(findstring $(subtarget), "ipq807x" "ipq807x_64" "ipq60xx" "ipq60xx_64" "ipq50xx" "ipq50xx_64"))
+# DTLS Manager v2.0 for IPQ807x/IPQ60xx/IPQ50xx
+  DTLSMGR_DIR:=v2.0
+# IPsec Manager v2.0 for IPQ807x/IPQ60xx/IPQ50xx
+  IPSECMGR_DIR:=v2.0
+else
+# DTLS Manager v1.0 for IPQ806x
+  DTLSMGR_DIR:=v1.0
+# IPsec Manager v1.0 for IPQ806x
+  IPSECMGR_DIR:=v1.0
+endif
+
+define KernelPackage/qca-nss-drv-tun6rd
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS (connection manager) - tun6rd
+  DEPENDS:=+kmod-qca-nss-drv +kmod-sit
+  FILES:=$(PKG_BUILD_DIR)/qca-nss-tun6rd.ko
+  AUTOLOAD:=$(call AutoLoad,60,qca-nss-tun6rd)
+endef
+
+define KernelPackage/qca-nss-drv-tun6rd/Description
+Kernel modules for NSS connection manager - Support for 6rd tunnel
+endef
+
+define KernelPackage/qca-nss-drv-dtlsmgr
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS (connection manager) - dtlsmgr
+  DEPENDS:=+kmod-qca-nss-drv +kmod-qca-nss-cfi-cryptoapi
+  FILES:=$(PKG_BUILD_DIR)/dtls/$(DTLSMGR_DIR)/qca-nss-dtlsmgr.ko
+endef
+
+define KernelPackage/qca-nss-drv-dtls/Description
+Kernel modules for NSS connection manager - Support for DTLS sessions
+endef
+
+define KernelPackage/qca-nss-drv-tlsmgr
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS (connection manager) - tlsmgr
+  DEPENDS:=@(TARGET_ipq60xx||TARGET_ipq807x) \
+	+kmod-qca-nss-drv +kmod-qca-nss-cfi-cryptoapi
+  FILES:=$(PKG_BUILD_DIR)/tls/qca-nss-tlsmgr.ko
+endef
+
+define KernelPackage/qca-nss-drv-tls/Description
+Kernel modules for NSS connection manager - Support for TLS sessions
+endef
+
+define KernelPackage/qca-nss-drv-l2tpv2
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS (connection manager) - l2tp
+  DEPENDS:=+kmod-qca-nss-drv +kmod-ppp +kmod-l2tp
+  FILES:=$(PKG_BUILD_DIR)/l2tp/l2tpv2/qca-nss-l2tpv2.ko
+  AUTOLOAD:=$(call AutoLoad,51,qca-nss-l2tpv2)
+endef
+
+define KernelPackage/qca-nss-drv-l2tp/Description
+Kernel modules for NSS connection manager - Support for l2tp tunnel
+endef
+
+define KernelPackage/qca-nss-drv-pptp
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS (connection manager) - PPTP
+  DEPENDS:=+kmod-qca-nss-drv +kmod-pptp
+  FILES:=$(PKG_BUILD_DIR)/pptp/qca-nss-pptp.ko
+  AUTOLOAD:=$(call AutoLoad,51,qca-nss-pptp)
+endef
+
+define KernelPackage/qca-nss-drv-pptp/Description
+Kernel modules for NSS connection manager - Support for PPTP tunnel
+endef
+
+define KernelPackage/qca-nss-drv-pppoe
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS (connection manager) - PPPoE
+  DEPENDS:=+kmod-qca-nss-drv +kmod-pppoe \
+	+PACKAGE_kmod-bonding:kmod-bonding
+  FILES:=$(PKG_BUILD_DIR)/pppoe/qca-nss-pppoe.ko
+  AUTOLOAD:=$(call AutoLoad,51,qca-nss-pppoe)
+endef
+
+define KernelPackage/qca-nss-drv-pppoe/Description
+Kernel modules for NSS connection manager - Support for PPPoE
+endef
+
+define KernelPackage/qca-nss-drv-map-t
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS (connection manager) - MAP-T
+  DEPENDS:=+kmod-qca-nss-drv +kmod-nat46
+  FILES:=$(PKG_BUILD_DIR)/map/map-t/qca-nss-map-t.ko
+  AUTOLOAD:=$(call AutoLoad,51,qca-nss-map-t)
+endef
+
+define KernelPackage/qca-nss-drv-map-t/Description
+Kernel modules for NSS connection manager - Support for MAP-T
+endef
+
+define KernelPackage/qca-nss-drv-gre
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS (connection manager) - GRE
+  DEPENDS:=+kmod-qca-nss-drv +kmod-gre6
+  FILES:=$(PKG_BUILD_DIR)/gre/qca-nss-gre.ko $(PKG_BUILD_DIR)/gre/test/qca-nss-gre-test.ko
+  AUTOLOAD:=$(call AutoLoad,51,qca-nss-gre)
+endef
+
+define KernelPackage/qca-nss-drv-gre/Description
+Kernel modules for NSS connection manager - Support for GRE
+endef
+
+define KernelPackage/qca-nss-drv-tunipip6
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS (connection manager) - DS-lite and ipip6 Tunnel
+  DEPENDS:=+kmod-qca-nss-drv +kmod-iptunnel6 +kmod-ip6-tunnel
+  FILES:=$(PKG_BUILD_DIR)/tunipip6/qca-nss-tunipip6.ko
+  AUTOLOAD:=$(call AutoLoad,60,qca-nss-tunipip6)
+endef
+
+define KernelPackage/qca-nss-drv-tunipip6/Description
+Kernel modules for NSS connection manager
+Add support for DS-lite and ipip6 tunnel
+endef
+
+define KernelPackage/qca-nss-drv-profile
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  DEPENDS:=+kmod-qca-nss-drv
+  TITLE:=Profiler for QCA NSS driver (IPQ806x)
+  FILES:=$(PKG_BUILD_DIR)/profiler/qca-nss-profile-drv.ko
+endef
+
+define KernelPackage/qca-nss-drv-profile/Description
+This package contains a NSS driver profiler for QCA chipset
+endef
+
+define KernelPackage/qca-nss-drv-ipsecmgr
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS (ipsec manager) - ipsecmgr
+  DEPENDS:=@(TARGET_ipq50xx||TARGET_ipq60xx||TARGET_ipq806x||TARGET_ipq807x) \
+	+kmod-qca-nss-drv +kmod-qca-nss-cfi-cryptoapi \
+	+!LINUX_5_4:kmod-qca-nss-cfi-ocf \
+	+PACKAGE_kmod-qca-nss-drv-l2tpv2:kmod-qca-nss-drv-l2tpv2
+  FILES:=$(PKG_BUILD_DIR)/ipsecmgr/$(IPSECMGR_DIR)/qca-nss-ipsecmgr.ko
+  AUTOLOAD:=$(call AutoLoad,60,qca-nss-ipsecmgr)
+endef
+
+define KernelPackage/qca-nss-drv-ipsecmgr/Description
+Kernel module for NSS IPsec offload manager
+endef
+
+define KernelPackage/qca-nss-drv-ipsecmgr-klips
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS (ipsec klips)
+  DEPENDS:=@(TARGET_ipq50xx||TARGET_ipq60xx||TARGET_ipq807x) \
+	kmod-qca-nss-ecm \
+	+kmod-qca-nss-drv-ipsecmgr +kmod-qca-nss-cfi-ocf \
+	+PACKAGE_kmod-qca-nss-drv-vxlanmgr:kmod-qca-nss-drv-vxlanmgr
+  FILES:=$(PKG_BUILD_DIR)/ipsecmgr/$(IPSECMGR_DIR)/plugins/klips/qca-nss-ipsec-klips.ko
+endef
+
+define KernelPackage/qca-nss-drv-ipsecmgr-klips/Description
+NSS Kernel module for IPsec klips offload
+endef
+
+define KernelPackage/qca-nss-drv-ipsecmgr-xfrm
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS (ipsec xfrm)
+  DEPENDS:=@(TARGET_ipq50xx||TARGET_ipq60xx||TARGET_ipq807x) \
+	kmod-qca-nss-ecm \
+	+kmod-ipsec +kmod-qca-nss-drv-ipsecmgr \
+	+PACKAGE_kmod-qca-nss-drv-vxlanmgr:kmod-qca-nss-drv-vxlanmgr
+  FILES:=$(PKG_BUILD_DIR)/ipsecmgr/$(IPSECMGR_DIR)/plugins/xfrm/qca-nss-ipsec-xfrm.ko
+endef
+
+define KernelPackage/qca-nss-drv-ipsecmgr-xfrm/Description
+NSS Kernel module for IPsec xfrm offload
+endef
+
+define KernelPackage/qca-nss-drv-capwapmgr
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  DEPENDS:=+kmod-qca-nss-drv +kmod-qca-nss-drv-dtlsmgr
+  TITLE:=NSS CAPWAP Manager for QCA NSS driver (IPQ806x)
+  FILES:=$(PKG_BUILD_DIR)/capwapmgr/qca-nss-capwapmgr.ko
+endef
+
+define KernelPackage/qca-nss-drv-capwapmgr/Description
+This package contains a NSS CAPWAP Manager
+endef
+
+define KernelPackage/qca-nss-drv-bridge-mgr
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS bridge manager
+  DEPENDS:=@(TARGET_ipq60xx||TARGET_ipq807x) \
+	+(TARGET_ipq60xx||TARGET_ipq807x):kmod-qca-nss-drv-vlan-mgr \
+	+PACKAGE_kmod-bonding:kmod-bonding \
+	+PACKAGE_kmod-qca-ovsmgr:kmod-qca-ovsmgr
+  FILES:=$(PKG_BUILD_DIR)/bridge/qca-nss-bridge-mgr.ko
+  AUTOLOAD:=$(call AutoLoad,51,qca-nss-bridge-mgr)
+endef
+
+define KernelPackage/qca-nss-drv-bridge-mgr/Description
+Kernel modules for NSS bridge manager
+endef
+
+define KernelPackage/qca-nss-drv-vlan-mgr
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS vlan manager
+  DEPENDS:=@(TARGET_ipq60xx||TARGET_ipq807x) \
+	+kmod-qca-nss-drv \
+	+PACKAGE_kmod-bonding:kmod-bonding
+  FILES:=$(PKG_BUILD_DIR)/vlan/qca-nss-vlan.ko
+  AUTOLOAD:=$(call AutoLoad,51,qca-nss-vlan)
+endef
+
+define KernelPackage/qca-nss-drv-vlan-mgr/Description
+Kernel modules for NSS vlan manager
+endef
+
+define KernelPackage/qca-nss-drv-qdisc
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Support
+  TITLE:=Qdisc for configuring shapers in NSS
+  DEPENDS:=+kmod-qca-nss-drv
+  FILES:=$(PKG_BUILD_DIR)/nss_qdisc/qca-nss-qdisc.ko
+  AUTOLOAD:=$(call AutoLoad,58,qca-nss-qdisc)
+endef
+
+define KernelPackage/qca-nss-drv-qdisc/Description
+Linux qdisc that aids in configuring shapers in the NSS
+endef
+
+define KernelPackage/qca-nss-drv-igs
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Support
+  TITLE:=Action for offloading traffic to an IFB interface to perform ingress shaping.
+  DEPENDS:=@(TARGET_ipq50xx||TARGET_ipq60xx||TARGET_ipq807x) \
+	+kmod-qca-nss-drv +kmod-sched-core +kmod-ifb +kmod-qca-nss-drv-qdisc
+  FILES:=$(PKG_BUILD_DIR)/nss_qdisc/igs/act_nssmirred.ko
+endef
+
+define KernelPackage/qca-nss-drv-igs/Description
+Linux action that helps in offloading traffic to an IFB interface to perform ingress shaping.
+endef
+
+define KernelPackage/qca-nss-drv-lag-mgr
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS LAG manager
+  DEPENDS:=+kmod-qca-nss-drv +kmod-bonding \
+	+(TARGET_ipq60xx||TARGET_ipq807x):kmod-qca-nss-drv-vlan-mgr
+  FILES:=$(PKG_BUILD_DIR)/lag/qca-nss-lag-mgr.ko
+  AUTOLOAD:=$(call AutoLoad,51,qca-nss-lag-mgr)
+endef
+
+define KernelPackage/qca-nss-drv-lag-mgr/Description
+Kernel modules for NSS LAG manager
+endef
+
+define KernelPackage/qca-nss-drv-netlink
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  DEPENDS:=@(TARGET_ipq50xx||TARGET_ipq60xx||TARGET_ipq807x) \
+	+kmod-qca-nss-drv \
+	+PACKAGE_kmod-qca-nss-drv-ipsecmgr:kmod-qca-nss-drv-ipsecmgr \
+	+PACKAGE_kmod-qca-nss-drv-dtlsmgr:kmod-qca-nss-drv-dtlsmgr \
+	+PACKAGE_kmod-qca-nss-drv-capwapmgr:kmod-qca-nss-drv-capwapmgr
+  TITLE:=NSS NETLINK Manager for QCA NSS driver
+  FILES:=$(PKG_BUILD_DIR)/netlink/qca-nss-netlink.ko
+endef
+
+define KernelPackage/qca-nss-drv-netlink/Description
+Kernel module for NSS netlink manager
+endef
+
+define KernelPackage/qca-nss-drv-ovpn-mgr
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for NSS OpenVPN manager
+  DEPENDS:=@(TARGET_ipq60xx||TARGET_ipq807x) \
+	+kmod-qca-nss-drv +kmod-qca-nss-cfi-cryptoapi +kmod-tun +kmod-ipt-conntrack
+  FILES:=$(PKG_BUILD_DIR)/openvpn/src/qca-nss-ovpn-mgr.ko
+endef
+
+define KernelPackage/qca-nss-drv-ovpn-mgr/Description
+Kernel module for NSS OpenVPN manager
+endef
+
+define KernelPackage/qca-nss-drv-ovpn-link
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=Kernel driver for interfacing NSS OpenVPN manager with ECM
+  DEPENDS:=@(TARGET_ipq60xx||TARGET_ipq807x) \
+	kmod-qca-nss-drv-ovpn-mgr kmod-qca-nss-ecm-premium
+  FILES:=$(PKG_BUILD_DIR)/openvpn/plugins/qca-nss-ovpn-link.ko
+endef
+
+define KernelPackage/qca-nss-drv-ovpn-link/Description
+This module registers with ECM and communicates with NSS OpenVPN manager for supporting OpenVPN offload.
+endef
+
+define KernelPackage/qca-nss-drv-pvxlanmgr
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  DEPENDS:=+kmod-qca-nss-drv
+  TITLE:=NSS PVXLAN Manager for QCA NSS driver
+  FILES:=$(PKG_BUILD_DIR)/pvxlanmgr/qca-nss-pvxlanmgr.ko
+endef
+
+define KernelPackage/qca-nss-drv-pvxlanmgr/Description
+Kernel module for managing NSS PVxLAN
+endef
+
+define KernelPackage/qca-nss-drv-eogremgr
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  DEPENDS:=+kmod-qca-nss-drv +kmod-qca-nss-drv-gre
+  TITLE:=NSS EOGRE Manager for QCA NSS driver
+  FILES:=$(PKG_BUILD_DIR)/eogremgr/qca-nss-eogremgr.ko
+endef
+
+define KernelPackage/qca-nss-drv-eogremgr/Description
+Kernel module for managing NSS EoGRE
+endef
+
+define KernelPackage/qca-nss-drv-clmapmgr
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  DEPENDS:=+kmod-qca-nss-drv +kmod-qca-nss-drv-eogremgr
+  TITLE:=NSS clmap Manager for QCA NSS driver
+  FILES:=$(PKG_BUILD_DIR)/clmapmgr/qca-nss-clmapmgr.ko
+endef
+
+define KernelPackage/qca-nss-drv-clmapmgr/Description
+Kernel module for managing NSS clmap
+endef
+
+define KernelPackage/qca-nss-drv-vxlanmgr
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  DEPENDS:=+kmod-qca-nss-drv +kmod-vxlan
+  TITLE:=NSS VxLAN Manager for QCA NSS driver
+  FILES:=$(PKG_BUILD_DIR)/vxlanmgr/qca-nss-vxlanmgr.ko
+  AUTOLOAD:=$(call AutoLoad,51,qca-nss-vxlanmgr)
+endef
+
+define KernelPackage/qca-nss-drv-vxlanmgr/Description
+Kernel module for managing NSS VxLAN
+endef
+
+define KernelPackage/qca-nss-drv-match
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  DEPENDS:=+kmod-qca-nss-drv
+  TITLE:=NSS Match for QCA NSS driver
+  FILES:=$(PKG_BUILD_DIR)/match/qca-nss-match.ko
+endef
+
+define KernelPackage/qca-nss-drv-match/Description
+Kernel module for managing NSS Match
+endef
+
+define KernelPackage/qca-nss-drv-mirror
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Support
+  TITLE:=Module for mirroring packets from NSS to host.
+  DEPENDS:=+kmod-qca-nss-drv
+  FILES:=$(PKG_BUILD_DIR)/mirror/qca-nss-mirror.ko
+endef
+
+define KernelPackage/qca-nss-drv-mirror/Description
+Kernel module for managing NSS Mirror
+endef
+
+define KernelPackage/qca-nss-drv-mscs
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Support
+  TITLE:=NSS Module to interface between wlan host driver and ECM MSCS classifier.
+  DEPENDS:=kmod-qca-nss-ecm-premium kmod-qca-wifi \
+	+kmod-qca-nss-drv
+  FILES:=$(PKG_BUILD_DIR)/mscs/qca-nss-mscs.ko
+endef
+
+define KernelPackage/qca-nss-drv-mscs/Description
+Kernel module for Mirrored Stream Classification Signalling(MSCS) NSS client
+endef
+
+define KernelPackage/qca-nss-drv-wifi-meshmgr
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  DEPENDS:=+kmod-qca-nss-drv
+  TITLE:=NSS WiFi-Mesh Manager for QCA NSS driver
+  FILES:=$(PKG_BUILD_DIR)/wifi_meshmgr/qca-nss-wifi-meshmgr.ko
+  AUTOLOAD:=$(call AutoLoad,51,qca-nss-wifi-meshmgr)
+endef
+
+define KernelPackage/qca-nss-drv-wifi-meshmgr/Description
+Kernel module for WiFi Mesh manager
+endef
+
+define Build/InstallDev/qca-nss-clients
+	$(INSTALL_DIR) $(1)/usr/include/qca-nss-clients
+	$(CP) $(PKG_BUILD_DIR)/netlink/include/* $(1)/usr/include/qca-nss-clients/
+	$(CP) $(PKG_BUILD_DIR)/exports/* $(1)/usr/include/qca-nss-clients/
+endef
+
+define Build/InstallDev
+	$(call Build/InstallDev/qca-nss-clients,$(1))
+endef
+
+define KernelPackage/qca-nss-drv-ovpn-mgr/install
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) ./files/qca-nss-ovpn.init $(1)/etc/init.d/qca-nss-ovpn
+endef
+
+define KernelPackage/qca-nss-drv-ipsecmgr-klips/install
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) ./files/qca-nss-ipsec $(1)/etc/init.d/qca-nss-ipsec
+endef
+
+define KernelPackage/qca-nss-drv-ipsecmgr-xfrm/install
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) ./files/qca-nss-ipsec $(1)/etc/init.d/qca-nss-ipsec
+endef
+
+define KernelPackage/qca-nss-drv-igs/install
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) ./files/qca-nss-mirred.init $(1)/etc/init.d/qca-nss-mirred
+endef
+
+EXTRA_CFLAGS+= \
+	-I$(STAGING_DIR)/usr/include/qca-nss-drv \
+	-I$(STAGING_DIR)/usr/include/qca-nss-crypto \
+	-I$(STAGING_DIR)/usr/include/qca-nss-cfi \
+	-I$(STAGING_DIR)/usr/include/qca-nss-gmac \
+	-I$(STAGING_DIR)/usr/include/qca-ssdk \
+	-I$(STAGING_DIR)/usr/include/qca-ssdk/fal \
+	-I$(STAGING_DIR)/usr/include/nat46
+
+# Build individual packages if selected
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-profile),)
+MAKE_OPTS+=profile=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-capwapmgr),)
+MAKE_OPTS+=capwapmgr=y
+EXTRA_CFLAGS += -DNSS_CAPWAPMGR_ONE_NETDEV
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-tun6rd),)
+MAKE_OPTS+=tun6rd=m
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-dtlsmgr),)
+MAKE_OPTS+=dtlsmgr=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-tlsmgr),)
+MAKE_OPTS+=tlsmgr=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-l2tpv2),)
+MAKE_OPTS+=l2tpv2=y
+EXTRA_CFLAGS += -DNSS_L2TPV2_ENABLED
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-pptp),)
+MAKE_OPTS+=pptp=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-map-t),)
+MAKE_OPTS+=map-t=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-tunipip6),)
+MAKE_OPTS+=tunipip6=m
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-qdisc),)
+MAKE_OPTS+=qdisc=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-igs),)
+MAKE_OPTS+=igs=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-ipsecmgr),)
+EXTRA_CFLAGS+= -I$(PKG_BUILD_DIR)/exports
+MAKE_OPTS+=ipsecmgr=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-ipsecmgr-klips),)
+EXTRA_CFLAGS+= -I$(STAGING_DIR)/usr/include/qca-nss-ecm
+MAKE_OPTS+=ipsecmgr-klips=m
+# Enable netdev based binding from L2TP to IPsec if KLIPS is enabled
+EXTRA_CFLAGS+= -DNSS_L2TP_IPSEC_BIND_BY_NETDEV
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-ipsecmgr-xfrm),)
+EXTRA_CFLAGS+= -I$(STAGING_DIR)/usr/include/qca-nss-ecm
+MAKE_OPTS+=ipsecmgr-xfrm=m
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-bridge-mgr),)
+MAKE_OPTS+=bridge-mgr=y
+#enable OVS bridge if ovsmgr is enabled
+ifneq ($(CONFIG_PACKAGE_kmod-qca-ovsmgr),)
+MAKE_OPTS+= NSS_BRIDGE_MGR_OVS_ENABLE=y
+EXTRA_CFLAGS+= -I$(STAGING_DIR)/usr/include/qca-ovsmgr
+endif
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-vlan-mgr),)
+MAKE_OPTS+=vlan-mgr=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-lag-mgr),)
+MAKE_OPTS+=lag-mgr=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-gre),)
+EXTRA_CFLAGS+= -I$(PKG_BUILD_DIR)/exports
+MAKE_OPTS+=gre=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-pppoe),)
+MAKE_OPTS+=pppoe=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-netlink),)
+MAKE_OPTS+=netlink=y
+
+# ifeq ($(CONFIG_KERNEL_IPQ_MEM_PROFILE),256)
+# EXTRA_CFLAGS+= -DNSS_NETLINK_UDP_ST_NO_RMNET_SUPPORT
+# else ifeq ($(CONFIG_LOWMEM_FLASH),y)
+# EXTRA_CFLAGS+= -DNSS_NETLINK_UDP_ST_NO_RMNET_SUPPORT
+# endif
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-ovpn-mgr),)
+MAKE_OPTS+=ovpn-mgr=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-ovpn-link),)
+MAKE_OPTS+=ovpn-link=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-pvxlanmgr),)
+MAKE_OPTS+=pvxlanmgr=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-eogremgr),)
+MAKE_OPTS+=eogremgr=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-clmapmgr),)
+MAKE_OPTS+=clmapmgr=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-vxlanmgr),)
+MAKE_OPTS+=vxlanmgr=y
+EXTRA_CFLAGS += -DNSS_VXLAN_ENABLED
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-match),)
+MAKE_OPTS+=match=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-mirror),)
+MAKE_OPTS+=mirror=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-mscs),)
+EXTRA_CFLAGS+= \
+	-I$(STAGING_DIR)/usr/include/qca-wifi \
+	-I$(STAGING_DIR)/usr/include/qca-nss-ecm
+MAKE_OPTS+=mscs=y
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-drv-wifi-meshmgr),)
+MAKE_OPTS+=wifi-meshmgr=y
+endif
+
+define Build/Compile
+	$(MAKE) -C "$(LINUX_DIR)" $(strip $(MAKE_OPTS)) \
+		CROSS_COMPILE="$(TARGET_CROSS)" \
+		ARCH="$(LINUX_KARCH)" \
+		M="$(PKG_BUILD_DIR)" \
+		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
+		SoC="$(subtarget)" \
+		DTLSMGR_DIR="$(DTLSMGR_DIR)" \
+		IPSECMGR_DIR="$(IPSECMGR_DIR)" \
+		modules
+endef
+
+$(eval $(call KernelPackage,qca-nss-drv-profile))
+$(eval $(call KernelPackage,qca-nss-drv-capwapmgr))
+$(eval $(call KernelPackage,qca-nss-drv-tun6rd))
+$(eval $(call KernelPackage,qca-nss-drv-dtlsmgr))
+$(eval $(call KernelPackage,qca-nss-drv-l2tpv2))
+$(eval $(call KernelPackage,qca-nss-drv-pptp))
+$(eval $(call KernelPackage,qca-nss-drv-pppoe))
+$(eval $(call KernelPackage,qca-nss-drv-map-t))
+$(eval $(call KernelPackage,qca-nss-drv-tunipip6))
+$(eval $(call KernelPackage,qca-nss-drv-qdisc))
+$(eval $(call KernelPackage,qca-nss-drv-igs))
+$(eval $(call KernelPackage,qca-nss-drv-netlink))
+$(eval $(call KernelPackage,qca-nss-drv-ipsecmgr))
+$(eval $(call KernelPackage,qca-nss-drv-ipsecmgr-klips))
+$(eval $(call KernelPackage,qca-nss-drv-ipsecmgr-xfrm))
+$(eval $(call KernelPackage,qca-nss-drv-bridge-mgr))
+$(eval $(call KernelPackage,qca-nss-drv-vlan-mgr))
+$(eval $(call KernelPackage,qca-nss-drv-lag-mgr))
+$(eval $(call KernelPackage,qca-nss-drv-gre))
+$(eval $(call KernelPackage,qca-nss-drv-ovpn-mgr))
+$(eval $(call KernelPackage,qca-nss-drv-ovpn-link))
+$(eval $(call KernelPackage,qca-nss-drv-pvxlanmgr))
+$(eval $(call KernelPackage,qca-nss-drv-eogremgr))
+$(eval $(call KernelPackage,qca-nss-drv-clmapmgr))
+$(eval $(call KernelPackage,qca-nss-drv-vxlanmgr))
+$(eval $(call KernelPackage,qca-nss-drv-match))
+$(eval $(call KernelPackage,qca-nss-drv-tlsmgr))
+$(eval $(call KernelPackage,qca-nss-drv-mirror))
+$(eval $(call KernelPackage,qca-nss-drv-mscs))
+$(eval $(call KernelPackage,qca-nss-drv-wifi-meshmgr))
diff --git a/package/kernel/qca/qca-nss-clients/files/qca-nss-ipsec b/package/kernel/qca/qca-nss-clients/files/qca-nss-ipsec
new file mode 100644
index 0000000000..5f682c8e91
--- /dev/null
+++ b/package/kernel/qca/qca-nss-clients/files/qca-nss-ipsec
@@ -0,0 +1,214 @@
+#!/bin/sh  /etc/rc.common
+#
+# Copyright (c) 2018-2019, 2021 The Linux Foundation. All rights reserved.
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+NSS_IPSEC_LOG_FILE=/tmp/.nss_ipsec_log
+NSS_IPSEC_LOG_STR_ECM="ECM_Loaded"
+NSS_IPSEC_OL_FILE=/tmp/qca_nss_ipsec_ol
+
+ecm_load () {
+	if [ ! -d /sys/module/ecm ]; then
+		/etc/init.d/qca-nss-ecm start
+		if [ -d /sys/module/ecm ]; then
+			echo ${NSS_IPSEC_LOG_STR_ECM} >> ${NSS_IPSEC_LOG_FILE}
+		fi
+	fi
+}
+
+ecm_unload () {
+	if [ -f /tmp/.nss_ipsec_log ]; then
+		str=`grep ${NSS_IPSEC_LOG_STR_ECM} ${NSS_IPSEC_LOG_FILE}`
+		if [[ $str == ${NSS_IPSEC_LOG_STR_ECM} ]]; then
+			/etc/init.d/qca-nss-ecm stop
+			`sed 's/${NSS_IPSEC_LOG_STR_ECM}/ /g' $NSS_IPSEC_LOG_FILE >  $NSS_IPSEC_LOG_FILE`
+		fi
+	fi
+}
+
+ecm_disable() {
+
+	if [ ! -d /sys/module/ecm ]; then
+		return;
+	fi
+
+	echo 1 > /sys/kernel/debug/ecm/front_end_ipv4_stop
+	echo 1 > /sys/kernel/debug/ecm/front_end_ipv6_stop
+	echo 1 > /sys/kernel/debug/ecm/ecm_db/defunct_all
+	sleep 2
+}
+
+ecm_enable() {
+	if [ ! -d /sys/module/ecm ]; then
+		return;
+	fi
+
+	echo 0 > /sys/kernel/debug/ecm/ecm_db/defunct_all
+	echo 0 > /sys/kernel/debug/ecm/front_end_ipv4_stop
+	echo 0 > /sys/kernel/debug/ecm/front_end_ipv6_stop
+}
+
+kernel_version_check_5_4() {
+	major_ver=$(uname -r | awk -F '.' '{print $1}')
+	minor_ver=$(uname -r | awk -F '.' '{print $2}')
+	if [ $major_ver -lt 5 ] || ([ $major_ver -eq 5 ] && [ $minor_ver -lt 4 ] ) ; then
+		return 1
+	else
+		return 0
+	fi
+}
+
+start_klips() {
+	if kernel_version_check_5_4
+	then
+		echo "Kernel 5.4 doesn't support klips stack."
+		return $?
+	fi
+
+	touch $NSS_IPSEC_OL_FILE
+	ecm_load
+
+	local kernel_version=$(uname -r)
+
+	insmod /lib/modules/${kernel_version}/qca-nss-ipsec-klips.ko
+	if [ "$?" -gt 0 ]; then
+		echo "Failed to load plugin. Please start ecm if not done already"
+		ecm_enable
+		rm $NSS_IPSEC_OL_FILE
+		return
+	fi
+
+	/etc/init.d/ipsec start
+	sleep 2
+	ipsec eroute
+
+	ecm_enable
+}
+
+stop_klips() {
+	if kernel_version_check_5_4
+	then
+		echo "Kernel 5.4 doesn't support klips stack."
+		return $?
+	fi
+
+	ecm_disable
+
+	/etc/init.d/ipsec stop
+	rmmod qca-nss-ipsec-klips
+	rm $NSS_IPSEC_OL_FILE
+
+	ecm_unload
+}
+
+start_xfrm() {
+	touch $NSS_IPSEC_OL_FILE
+	ecm_load
+
+	local kernel_version=$(uname -r)
+
+	# load all NETKEY modules first.
+	for mod in xfrm_ipcomp ipcomp xfrm6_tunnel ipcomp6 xfrm6_mode_tunnel xfrm6_mode_beet xfrm6_mode_ro \
+		xfrm6_mode_transport xfrm4_mode_transport xfrm4_mode_tunnel \
+		xfrm4_tunnel xfrm4_mode_beet esp4 esp6 ah4 ah6 af_key
+		do
+			insmod $mod 2> /dev/null
+		done
+
+	# Now load the xfrm plugin
+	insmod /lib/modules/${kernel_version}/qca-nss-ipsec-xfrm.ko
+	if [ "$?" -gt 0 ]; then
+		echo "Failed to load plugin. Please start ecm if not done already"
+		ecm_enable
+		rm $NSS_IPSEC_OL_FILE
+		return
+	fi
+
+	/etc/init.d/ipsec start
+	sleep 2
+
+	ecm_enable
+}
+
+stop_xfrm() {
+	ecm_disable
+
+	#Shutdown Pluto first. Then only plugin can be removed.
+	plutopid=/var/run/pluto/pluto.pid
+	if [ -f $plutopid ]; then
+		pid=`cat $plutopid`
+		if [ ! -z "$pid" ]; then
+			ipsec whack --shutdown | grep -v "002";
+			if [ -s $plutopid ]; then
+				echo "Attempt to shut Pluto down failed!  Trying kill:"
+				kill $pid;
+				sleep 5;
+			fi
+		fi
+		rm -rf $plutopid
+	fi
+	ip xfrm state flush;
+	ip xfrm policy flush;
+	sleep 2
+
+	#Now we can remove the plugin
+	retries=5
+	while [ -d /sys/module/qca_nss_ipsec_xfrm ]
+	do
+		rmmod qca-nss-ipsec-xfrm
+		if [ "$?" -eq 0 ]; then
+			rm $NSS_IPSEC_OL_FILE
+			break
+		fi
+
+		if [ ${retries} -eq 0 ]; then
+			echo "Failed to unload qca-nss-ipsec-xfrm plugin!"
+			exit
+		fi
+
+		echo "XFRM plugin unload failed; retrying ${retries} times"
+		sleep 1
+		retries=`expr ${retries} - 1`
+	done
+
+	/etc/init.d/ipsec stop
+	ecm_unload
+}
+
+start() {
+	local protostack=`uci -q get ipsec.setup.protostack`
+	if [ "$protostack" = "klips" ]; then
+		start_klips
+		return $?
+	fi
+
+	start_xfrm
+	return $?
+}
+
+stop() {
+	local protostack=`uci -q get ipsec.setup.protostack`
+	if [ "$protostack" = "klips" ]; then
+		stop_klips
+		return $?
+	fi
+
+	stop_xfrm
+	return $?
+}
+
+restart() {
+	stop
+	start
+}
diff --git a/package/kernel/qca/qca-nss-clients/files/qca-nss-mirred.init b/package/kernel/qca/qca-nss-clients/files/qca-nss-mirred.init
new file mode 100644
index 0000000000..1f931f0903
--- /dev/null
+++ b/package/kernel/qca/qca-nss-clients/files/qca-nss-mirred.init
@@ -0,0 +1,28 @@
+#!/bin/sh /etc/rc.common
+
+###########################################################################
+# Copyright (c) 2019, The Linux Foundation. All rights reserved.
+# Permission to use, copy, modify, and/or distribute this software for
+# any purpose with or without fee is hereby granted, provided that the
+# above copyright notice and this permission notice appear in all copies.
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+# OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+###########################################################################
+
+restart() {
+	rmmod act_nssmirred.ko
+	insmod act_nssmirred.ko
+}
+
+start() {
+	insmod act_nssmirred.ko
+}
+
+stop() {
+	rmmod act_nssmirred.ko
+}
diff --git a/package/kernel/qca/qca-nss-clients/files/qca-nss-ovpn.init b/package/kernel/qca/qca-nss-clients/files/qca-nss-ovpn.init
new file mode 100644
index 0000000000..622e295eee
--- /dev/null
+++ b/package/kernel/qca/qca-nss-clients/files/qca-nss-ovpn.init
@@ -0,0 +1,69 @@
+#!/bin/sh /etc/rc.common
+
+###########################################################################
+# Copyright (c) 2019, The Linux Foundation. All rights reserved.
+# Permission to use, copy, modify, and/or distribute this software for
+# any purpose with or without fee is hereby granted, provided that the
+# above copyright notice and this permission notice appear in all copies.
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+# OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+###########################################################################
+
+ecm_disable() {
+	if [ ! -d /sys/module/ecm ]; then
+	   return
+	fi
+
+	echo 1 > /sys/kernel/debug/ecm/front_end_ipv4_stop
+	echo 1 > /sys/kernel/debug/ecm/front_end_ipv6_stop
+	echo 1 > /sys/kernel/debug/ecm/ecm_db/defunct_all
+	sleep 2
+}
+
+ecm_enable() {
+	if [ ! -d /sys/module/ecm ]; then
+	   return
+	fi
+
+	echo 0 > /sys/kernel/debug/ecm/ecm_db/defunct_all
+	echo 0 > /sys/kernel/debug/ecm/front_end_ipv4_stop
+	echo 0 > /sys/kernel/debug/ecm/front_end_ipv6_stop
+}
+
+restart() {
+	ecm_disable
+
+	/etc/init.d/openvpn stop
+	rmmod qca-nss-ovpn-link
+	rmmod qca-nss-ovpn-mgr
+
+	insmod qca-nss-ovpn-mgr
+	insmod qca-nss-ovpn-link
+
+	if [ "$?" -gt 0 ]; then
+		echo "Failed to load plugin. Please start ecm if not done already"
+		ecm_enable
+		return
+	fi
+
+	ecm_enable
+}
+
+start() {
+	restart
+}
+
+stop() {
+	ecm_disable
+
+	/etc/init.d/openvpn stop
+	rmmod qca-nss-ovpn-link
+	rmmod qca-nss-ovpn-mgr
+
+	ecm_enable
+}
diff --git a/package/kernel/qca/qca-nss-drv/Makefile b/package/kernel/qca/qca-nss-drv/Makefile
new file mode 100644
index 0000000000..2345240970
--- /dev/null
+++ b/package/kernel/qca/qca-nss-drv/Makefile
@@ -0,0 +1,141 @@
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=qca-nss-drv
+PKG_VERSION:=NHSS.QSDK.11.5.0.5
+PKG_RELEASE:=2
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://git.codelinaro.org/clo/qsdk/oss/lklm/nss-drv
+PKG_SOURCE_VERSION:=7563fe37340ec4a28b7821a0ac17608ff30e2a85
+PKG_MIRROR_HASH:=skip
+
+NSS_CLIENTS_DIR:=$(TOPDIR)/qca/src/qca-nss-clients
+
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/qca-nss-drv
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  DEPENDS:=@(TARGET_ipq50xx||TARGET_ipq60xx||TARGET_ipq806x||TARGET_ipq807x) \
+	+PACKAGE_kmod-qca-nss-gmac:kmod-qca-nss-gmac \
+	+PACKAGE_kmod-qca-nss-dp:kmod-qca-nss-dp
+  TITLE:=Kernel driver for NSS (core driver)
+  FILES:=$(PKG_BUILD_DIR)/qca-nss-drv.ko
+  AUTOLOAD:=$(call AutoLoad,32,qca-nss-drv)
+endef
+
+define KernelPackage/qca-nss-drv/install
+	$(INSTALL_DIR) $(1)/lib/debug
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_DIR) $(1)/etc/sysctl.d
+	$(INSTALL_DIR) $(1)/etc/hotplug.d/firmware
+	$(INSTALL_DIR) $(1)/etc/config
+
+	$(INSTALL_BIN) ./files/qca-nss-drv.debug $(1)/lib/debug/qca-nss-drv
+	$(INSTALL_BIN) ./files/qca-nss-drv.init $(1)/etc/init.d/qca-nss-drv
+	$(INSTALL_BIN) ./files/qca-nss-drv.sysctl $(1)/etc/sysctl.d/qca-nss-drv.conf
+	$(INSTALL_BIN) ./files/qca-nss-drv.hotplug $(1)/etc/hotplug.d/firmware/10-qca-nss-fw
+	$(INSTALL_BIN) ./files/qca-nss-drv.conf $(1)/etc/config/nss
+
+endef
+
+define KernelPackage/qca-nss-drv/Description
+This package contains a NSS driver for QCA chipset
+endef
+
+define Build/InstallDev
+	mkdir -p $(1)/usr/include/qca-nss-drv
+	$(CP) $(PKG_BUILD_DIR)/exports/* $(1)/usr/include/qca-nss-drv/
+ifneq (, $(findstring $(subtarget), "ipq807x" "ipq807x_64" "ipq60xx" "ipq60xx_64" "ipq50xx" "ipq50xx_64"))
+	$(RM) $(1)/usr/include/qca-nss-drv/nss_ipsecmgr.h
+	$(INSTALL_DIR) $(1)/usr/include/qca-nss-clients
+	# $(CP) $(NSS_CLIENTS_DIR)/exports/nss_ipsecmgr.h $(1)/usr/include/qca-nss-clients/.
+endif
+endef
+
+EXTRA_CFLAGS+= -I$(STAGING_DIR)/usr/include/qca-nss-gmac -I$(STAGING_DIR)/usr/include/qca-nss-dp -I$(STAGING_DIR)/usr/include/qca-ssdk
+
+# Keeping default as ipq806x for branches that does not have subtarget framework
+ifeq ($(CONFIG_TARGET_ipq),y)
+subtarget:=$(SUBTARGET)
+else
+subtarget:=$(CONFIG_TARGET_BOARD)
+endif
+
+# ifeq ($(CONFIG_KERNEL_IPQ_MEM_PROFILE),256)
+EXTRA_CFLAGS+= -DNSS_MEM_PROFILE_LOW
+LOW_MEM_PROFILE_MAKE_OPTS=y
+# else ifeq ($(CONFIG_LOWMEM_FLASH),y)
+# EXTRA_CFLAGS+= -DNSS_MEM_PROFILE_LOW
+# LOW_MEM_PROFILE_MAKE_OPTS=y
+# else ifeq ($(CONFIG_KERNEL_IPQ_MEM_PROFILE),512)
+# EXTRA_CFLAGS+= -DNSS_MEM_PROFILE_MEDIUM
+# endif
+
+ifeq ($(CONFIG_KERNEL_SKB_FIXED_SIZE_2K),y)
+EXTRA_CFLAGS+= -DNSS_SKB_FIXED_SIZE_2K
+endif
+
+DRV_MAKE_OPTS:=
+ifeq ($(LOW_MEM_PROFILE_MAKE_OPTS),y)
+DRV_MAKE_OPTS+=NSS_DRV_C2C_ENABLE=n \
+        NSS_DRV_CAPWAP_ENABLE=n \
+        NSS_DRV_CLMAP_ENABLE=n \
+        NSS_DRV_CRYPTO_ENABLE=n \
+        NSS_DRV_DTLS_ENABLE=n \
+        NSS_DRV_GRE_ENABLE=n \
+        NSS_DRV_GRE_REDIR_ENABLE=n \
+        NSS_DRV_GRE_TUNNEL_ENABLE=n \
+        NSS_DRV_IGS_ENABLE=n \
+        NSS_DRV_IPSEC_ENABLE=n \
+        NSS_DRV_LAG_ENABLE=n \
+        NSS_DRV_L2TP_ENABLE=n \
+        NSS_DRV_MAPT_ENABLE=n \
+        NSS_DRV_OAM_ENABLE=n \
+        NSS_DRV_PPTP_ENABLE=n \
+        NSS_DRV_PORTID_ENABLE=n \
+        NSS_DRV_PVXLAN_ENABLE=n \
+        NSS_DRV_QRFS_ENABLE=n \
+        NSS_DRV_QVPN_ENABLE=n \
+        NSS_DRV_RMNET_ENABLE=n \
+        NSS_DRV_SHAPER_ENABLE=n \
+        NSS_DRV_SJACK_ENABLE=n \
+        NSS_DRV_TLS_ENABLE=n \
+        NSS_DRV_TRUSTSEC_ENABLE=n \
+        NSS_DRV_TSTAMP_ENABLE=n \
+        NSS_DRV_TUN6RD_ENABLE=n \
+        NSS_DRV_TUNIPIP6_ENABLE=n \
+        NSS_DRV_VXLAN_ENABLE=n \
+        NSS_DRV_MATCH_ENABLE=n \
+        NSS_DRV_MIRROR_ENABLE=n \
+        NSS_DRV_WIFI_EXT_VDEV_ENABLE=n \
+        NSS_DRV_WIFI_MESH_ENABLE=n \
+        NSS_DRV_IPV4_REASM_ENABLE=n \
+        NSS_DRV_IPV6_REASM_ENABLE=n
+# Disable PPE bridge support for IPQ50xx.
+ifneq (, $(findstring $(subtarget), "ipq50xx"))
+        DRV_MAKE_OPTS+=NSS_DRV_BRIDGE_ENABLE=n
+endif
+endif
+
+# Disable DRV IPv6 support when global IPv6 support is disabled.
+ifneq ($(CONFIG_IPV6),y)
+DRV_MAKE_OPTS+=NSS_DRV_IPV6_ENABLE=n
+endif
+
+define Build/Configure
+	$(LN) arch/nss_$(subtarget).h $(PKG_BUILD_DIR)/exports/nss_arch.h
+endef
+
+define Build/Compile
+	$(MAKE) -C "$(LINUX_DIR)" $(strip $(DRV_MAKE_OPTS)) \
+		CROSS_COMPILE="$(TARGET_CROSS)" \
+		ARCH="$(LINUX_KARCH)" \
+		M="$(PKG_BUILD_DIR)" \
+		EXTRA_CFLAGS="$(EXTRA_CFLAGS)" SoC="$(subtarget)" \
+		modules
+endef
+
+$(eval $(call KernelPackage,qca-nss-drv))
diff --git a/package/kernel/qca/qca-nss-drv/files/qca-nss-drv.conf b/package/kernel/qca/qca-nss-drv/files/qca-nss-drv.conf
new file mode 100644
index 0000000000..a8a1fbf406
--- /dev/null
+++ b/package/kernel/qca/qca-nss-drv/files/qca-nss-drv.conf
@@ -0,0 +1,6 @@
+config nss_firmware 'qca_nss_0'
+
+config nss_firmware 'qca_nss_1'
+
+config general
+	option enable_rps	'1'
diff --git a/package/kernel/qca/qca-nss-drv/files/qca-nss-drv.debug b/package/kernel/qca/qca-nss-drv/files/qca-nss-drv.debug
new file mode 100644
index 0000000000..5d435c3a76
--- /dev/null
+++ b/package/kernel/qca/qca-nss-drv/files/qca-nss-drv.debug
@@ -0,0 +1,26 @@
+#!/bin/sh /sbin/sysdebug
+#
+# Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+log cat /sys/kernel/debug/qca-nss-drv/stats/pppoe
+log cat /sys/kernel/debug/qca-nss-drv/stats/n2h
+log cat /sys/kernel/debug/qca-nss-drv/stats/ipv6
+log cat /sys/kernel/debug/qca-nss-drv/stats/ipv4
+log cat /sys/kernel/debug/qca-nss-drv/stats/gmac
+log cat /sys/kernel/debug/qca-nss-drv/stats/drv
+log cat /sys/kernel/debug/qca-nss-drv/stats/wifi
+log cat /sys/kernel/debug/qca-nss-drv/stats/wifi_if
+log cat /sys/kernel/debug/qca-nss-drv/stats/eth_rx
diff --git a/package/kernel/qca/qca-nss-drv/files/qca-nss-drv.hotplug b/package/kernel/qca/qca-nss-drv/files/qca-nss-drv.hotplug
new file mode 100644
index 0000000000..1e4813838c
--- /dev/null
+++ b/package/kernel/qca/qca-nss-drv/files/qca-nss-drv.hotplug
@@ -0,0 +1,70 @@
+#!/bin/sh
+#
+# Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+KERNEL=`uname -r`
+case "${KERNEL}" in
+	3.4*)
+		select_or_load=load_nss_fw
+		;;
+	*)
+		select_or_load=select_nss_fw
+		;;
+esac
+
+load_nss_fw () {
+	ls -l $1 | awk ' { print $9,$5 } '> /dev/console
+	echo 1 > /sys/class/firmware/$DEVICENAME/loading
+	cat $1 > /sys/class/firmware/$DEVICENAME/data
+	echo 0 > /sys/class/firmware/$DEVICENAME/loading
+}
+
+select_nss_fw () {
+	rm -f /lib/firmware/$DEVICENAME
+	ln -s $1 /lib/firmware/$DEVICENAME
+	ls -l /lib/firmware/$DEVICENAME | awk ' { print $9,$5 } '> /dev/console
+}
+
+[ "$ACTION" != "add" ] && exit
+
+# dev name for UCI, since it doesn't let you use . or -
+SDEVNAME=$(echo ${DEVICENAME} | sed s/[.-]/_/g)
+
+SELECTED_FW=$(uci get nss.${SDEVNAME}.firmware 2>/dev/null)
+[ -e "${SELECTED_FW}" ] && {
+	$select_or_load ${SELECTED_FW}
+	exit
+}
+
+case $DEVICENAME in
+        qca-nss0* | qca-nss.0*)
+                if [ -e /lib/firmware/qca-nss0-enterprise.bin ] ; then
+                        $select_or_load /lib/firmware/qca-nss0-enterprise.bin
+                else
+                        $select_or_load /lib/firmware/qca-nss0-retail.bin
+                fi
+                exit
+                ;;
+        qca-nss1* | qca-nss.1*)
+                if [ -e /lib/firmware/qca-nss1-enterprise.bin ] ; then
+                        $select_or_load /lib/firmware/qca-nss1-enterprise.bin
+                else
+                        $select_or_load /lib/firmware/qca-nss1-retail.bin
+                fi
+                exit
+                ;;
+esac
+
diff --git a/package/kernel/qca/qca-nss-drv/files/qca-nss-drv.init b/package/kernel/qca/qca-nss-drv/files/qca-nss-drv.init
new file mode 100644
index 0000000000..de12cb6d12
--- /dev/null
+++ b/package/kernel/qca/qca-nss-drv/files/qca-nss-drv.init
@@ -0,0 +1,50 @@
+#!/bin/sh /etc/rc.common
+#
+# Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+START=70
+
+enable_rps() {
+	irq_nss_rps=`grep nss_queue1 /proc/interrupts | cut -d ':' -f 1 | tr -d ' '`
+	for entry in $irq_nss_rps
+	do
+		echo 2 > /proc/irq/$entry/smp_affinity
+	done
+
+	irq_nss_rps=`grep nss_queue2 /proc/interrupts | cut -d ':' -f 1 | tr -d ' '`
+	for entry in $irq_nss_rps
+	do
+		echo 4 > /proc/irq/$entry/smp_affinity
+	done
+
+	irq_nss_rps=`grep nss_queue3 /proc/interrupts | cut -d ':' -f 1 | tr -d ' '`
+	for entry in $irq_nss_rps
+	do
+		echo 8 > /proc/irq/$entry/smp_affinity
+	done
+
+	# Enable NSS RPS
+	sysctl -w dev.nss.rps.enable=1 >/dev/null 2>/dev/null
+
+}
+
+
+start() {
+	local rps_enabled="$(uci_get nss @general[0] enable_rps)"
+	if [ "$rps_enabled" -eq 1 ]; then
+		enable_rps
+	fi
+}
diff --git a/package/kernel/qca/qca-nss-drv/files/qca-nss-drv.sysctl b/package/kernel/qca/qca-nss-drv/files/qca-nss-drv.sysctl
new file mode 100644
index 0000000000..fc36c33eb5
--- /dev/null
+++ b/package/kernel/qca/qca-nss-drv/files/qca-nss-drv.sysctl
@@ -0,0 +1,4 @@
+# Default Number of connection configuration
+dev.nss.ipv4cfg.ipv4_conn=4096
+dev.nss.ipv6cfg.ipv6_conn=4096
+
diff --git a/target/linux/ipq50xx/Makefile b/target/linux/ipq50xx/Makefile
index 3c84a5099f..5c50de1625 100644
--- a/target/linux/ipq50xx/Makefile
+++ b/target/linux/ipq50xx/Makefile
@@ -26,6 +26,7 @@ KERNELNAME:=Image dtbs
 DEFAULT_PACKAGES += \
 	kmod-gpio-button-hotplug \
 	uboot-envtools \
-	kmod-qca-nss-dp swconfig
+	kmod-qca-nss-dp swconfig \
+	kmod-qca-nss-drv qca-nss-fw-ipq50xx-retail
 
 $(eval $(call BuildTarget))