diff --git a/distributions/LibreELEC/kernel_options b/distributions/LibreELEC/kernel_options
new file mode 100644
index 0000000000..6352f2789b
--- /dev/null
+++ b/distributions/LibreELEC/kernel_options
@@ -0,0 +1,27 @@
+# general
+CONFIG_DRM=y
+CONFIG_SQUASHFS=y
+CONFIG_SQUASHFS_ZSTD=y
+CONFIG_VFAT_FS=y
+CONFIG_EXT4_FS=y
+
+# packages/network/iwd
+CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_CRYPTO_SHA1=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_MD5=y
+CONFIG_CRYPTO_AES=y
+CONFIG_CRYPTO_CMAC=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_USER_API_SKCIPHER=y
+CONFIG_CRYPTO_DES=y
+CONFIG_CRYPTO_ECB=y
+CONFIG_CRYPTO_CBC=y
+CONFIG_KEY_DH_OPERATIONS=y
+CONFIG_KEYS=y
+CONFIG_ASYMMETRIC_KEY_TYPE=y
+CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
+CONFIG_X509_CERTIFICATE_PARSER=y
+CONFIG_PKCS7_MESSAGE_PARSER=y
+CONFIG_PKCS8_PRIVATE_KEY_PARSER=m
diff --git a/packages/linux/package.mk b/packages/linux/package.mk
index 41bbe5fb41..f5cc93e93d 100644
--- a/packages/linux/package.mk
+++ b/packages/linux/package.mk
@@ -78,48 +78,6 @@ post_patch() {
 
     # restore the required Module.symvers from an earlier build
     cp -p ${PKG_INSTALL}/.image/Module.symvers ${PKG_BUILD}
-  else
-    cp ${PKG_KERNEL_CFG_FILE} ${PKG_BUILD}/.config
-
-    sed -i -e "s|@INITRAMFS_SOURCE@|$(kernel_initramfs_confs) ${BUILD}/initramfs|" ${PKG_BUILD}/.config
-
-    # set default hostname based on ${DISTRONAME}
-      sed -i -e "s|@DISTRONAME@|${DISTRONAME}|g" ${PKG_BUILD}/.config
-
-    # disable swap support if not enabled
-    if [ ! "${SWAP_SUPPORT}" = yes ]; then
-      sed -i -e "s|^CONFIG_SWAP=.*$|# CONFIG_SWAP is not set|" ${PKG_BUILD}/.config
-    fi
-
-    # disable nfs support if not enabled
-    if [ ! "${NFS_SUPPORT}" = yes ]; then
-      sed -i -e "s|^CONFIG_NFS_FS=.*$|# CONFIG_NFS_FS is not set|" ${PKG_BUILD}/.config
-    fi
-
-    # disable cifs support if not enabled
-    if [ ! "${SAMBA_SUPPORT}" = yes ]; then
-      sed -i -e "s|^CONFIG_CIFS=.*$|# CONFIG_CIFS is not set|" ${PKG_BUILD}/.config
-    fi
-
-    # disable iscsi support if not enabled
-    if [ ! "${ISCSI_SUPPORT}" = yes ]; then
-      sed -i -e "s|^CONFIG_SCSI_ISCSI_ATTRS=.*$|# CONFIG_SCSI_ISCSI_ATTRS is not set|" ${PKG_BUILD}/.config
-      sed -i -e "s|^CONFIG_ISCSI_TCP=.*$|# CONFIG_ISCSI_TCP is not set|" ${PKG_BUILD}/.config
-      sed -i -e "s|^CONFIG_ISCSI_BOOT_SYSFS=.*$|# CONFIG_ISCSI_BOOT_SYSFS is not set|" ${PKG_BUILD}/.config
-      sed -i -e "s|^CONFIG_ISCSI_IBFT_FIND=.*$|# CONFIG_ISCSI_IBFT_FIND is not set|" ${PKG_BUILD}/.config
-      sed -i -e "s|^CONFIG_ISCSI_IBFT=.*$|# CONFIG_ISCSI_IBFT is not set|" ${PKG_BUILD}/.config
-    fi
-
-    # disable lima/panfrost if libmali is configured
-    if [ "${OPENGLES}" = "libmali" ]; then
-      sed -e "s|^CONFIG_DRM_LIMA=.*$|# CONFIG_DRM_LIMA is not set|" -i ${PKG_BUILD}/.config
-      sed -e "s|^CONFIG_DRM_PANFROST=.*$|# CONFIG_DRM_PANFROST is not set|" -i ${PKG_BUILD}/.config
-    fi
-
-    # disable wireguard support if not enabled
-    if [ ! "${WIREGUARD_SUPPORT}" = yes ]; then
-      sed -e "s|^CONFIG_WIREGUARD=.*$|# CONFIG_WIREGUARD is not set|" -i ${PKG_BUILD}/.config
-    fi
   fi
 }
 
@@ -156,6 +114,49 @@ pre_make_target() {
   )
   pkg_lock_status "ACTIVE" "linux:target" "build"
 
+  cp ${PKG_KERNEL_CFG_FILE} ${PKG_BUILD}/.config
+
+  # set initramfs source
+  ${PKG_BUILD}/scripts/config --set-str CONFIG_INITRAMFS_SOURCE "$(kernel_initramfs_confs) ${BUILD}/initramfs"
+
+  # set default hostname based on ${DISTRONAME}
+  ${PKG_BUILD}/scripts/config --set-str CONFIG_DEFAULT_HOSTNAME "${DISTRONAME}"
+
+  # disable swap support if not enabled
+  if [ ! "${SWAP_SUPPORT}" = yes ]; then
+    ${PKG_BUILD}/scripts/config --disable CONFIG_SWAP
+  fi
+
+  # disable nfs support if not enabled
+  if [ ! "${NFS_SUPPORT}" = yes ]; then
+    ${PKG_BUILD}/scripts/config --disable CONFIG_NFS_FS
+  fi
+
+  # disable cifs support if not enabled
+  if [ ! "${SAMBA_SUPPORT}" = yes ]; then
+    ${PKG_BUILD}/scripts/config --disable CONFIG_CIFS
+  fi
+
+  # disable iscsi support if not enabled
+  if [ ! "${ISCSI_SUPPORT}" = yes ]; then
+    ${PKG_BUILD}/scripts/config --disable CONFIG_SCSI_ISCSI_ATTRS
+    ${PKG_BUILD}/scripts/config --disable CONFIG_ISCSI_TCP
+    ${PKG_BUILD}/scripts/config --disable CONFIG_ISCSI_BOOT_SYSFS
+    ${PKG_BUILD}/scripts/config --disable CONFIG_ISCSI_IBFT_FIND
+    ${PKG_BUILD}/scripts/config --disable CONFIG_ISCSI_IBFT
+  fi
+
+  # disable lima/panfrost if libmali is configured
+  if [ "${OPENGLES}" = "libmali" ]; then
+    ${PKG_BUILD}/scripts/config --disable CONFIG_DRM_LIMA
+    ${PKG_BUILD}/scripts/config --disable CONFIG_DRM_PANFROST
+  fi
+
+  # disable wireguard support if not enabled
+  if [ ! "${WIREGUARD_SUPPORT}" = yes ]; then
+    ${PKG_BUILD}/scripts/config --disable CONFIG_WIREGUARD
+  fi
+
   if [ "${TARGET_ARCH}" = "x86_64" ]; then
     # copy some extra firmware to linux tree
     mkdir -p ${PKG_BUILD}/external-firmware
@@ -164,7 +165,9 @@ pre_make_target() {
     cp -a $(get_build_dir intel-ucode)/intel-ucode ${PKG_BUILD}/external-firmware
 
     FW_LIST="$(find ${PKG_BUILD}/external-firmware \( -type f -o -type l \) \( -iname '*.bin' -o -iname '*.fw' -o -path '*/intel-ucode/*' \) | sed 's|.*external-firmware/||' | sort | xargs)"
-    sed -i "s|CONFIG_EXTRA_FIRMWARE=.*|CONFIG_EXTRA_FIRMWARE=\"${FW_LIST}\"|" ${PKG_BUILD}/.config
+
+    ${PKG_BUILD}/scripts/config --set-str CONFIG_EXTRA_FIRMWARE "${FW_LIST}"
+    ${PKG_BUILD}/scripts/config --set-str CONFIG_EXTRA_FIRMWARE_DIR "external-firmware"
 
   elif [ "${TARGET_ARCH}" = "arm" -a "${DEVICE}" = "iMX6" ]; then
     mkdir -p ${PKG_BUILD}/external-firmware/imx/sdma
@@ -172,11 +175,30 @@ pre_make_target() {
       cp -a $(get_build_dir firmware-imx)/firmware/vpu/*imx6*.bin ${PKG_BUILD}/external-firmware
 
     FW_LIST="$(find ${PKG_BUILD}/external-firmware -type f | sed 's|.*external-firmware/||' | sort | xargs)"
-    sed -i -e "s|^CONFIG_EXTRA_FIRMWARE=.*$|CONFIG_EXTRA_FIRMWARE=\"${FW_LIST}\"|" ${PKG_BUILD}/.config
-    sed -i -e "/CONFIG_EXTRA_FIRMWARE_DIR/d" -e "/CONFIG_EXTRA_FIRMWARE=.../a CONFIG_EXTRA_FIRMWARE_DIR=\"external-firmware\"" ${PKG_BUILD}/.config
+
+    ${PKG_BUILD}/scripts/config --set-str CONFIG_EXTRA_FIRMWARE "${FW_LIST}"
+    ${PKG_BUILD}/scripts/config --set-str CONFIG_EXTRA_FIRMWARE_DIR "external-firmware"
   fi
 
   kernel_make oldconfig
+
+  if [ -f "${DISTRO_DIR}/${DISTRO}/kernel_options" ]; then
+    while read OPTION; do
+      [ -z "${OPTION}" -o -n "$(echo "${OPTION}" | grep '^#')" ] && continue
+
+      if [ "${OPTION##*=}" == "n" -a "$(${PKG_BUILD}/scripts/config --state ${OPTION%%=*})" == "undef" ]; then
+        continue
+      fi
+
+      if [ "$($PKG_BUILD/scripts/config --state ${OPTION%%=*})" != "${OPTION##*=}" ]; then
+        MISSING_KERNEL_OPTIONS+="\t${OPTION}\n"
+      fi
+    done < ${DISTRO_DIR}/${DISTRO}/kernel_options
+
+    if [ -n "${MISSING_KERNEL_OPTIONS}" ]; then
+      print_color CLR_WARNING "LINUX: kernel options not correct: \n${MISSING_KERNEL_OPTIONS%%}\nPlease run ./tools/check_kernel_config\n"
+    fi
+  fi
 }
 
 make_target() {
diff --git a/projects/Allwinner/linux/linux.aarch64.conf b/projects/Allwinner/linux/linux.aarch64.conf
index 16449428d0..330dd6e642 100644
--- a/projects/Allwinner/linux/linux.aarch64.conf
+++ b/projects/Allwinner/linux/linux.aarch64.conf
@@ -6114,7 +6114,7 @@ CONFIG_CRYPTO_DEV_SUN8I_SS_HASH=y
 CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
 CONFIG_X509_CERTIFICATE_PARSER=y
-CONFIG_PKCS8_PRIVATE_KEY_PARSER=y
+CONFIG_PKCS8_PRIVATE_KEY_PARSER=m
 CONFIG_PKCS7_MESSAGE_PARSER=y
 # CONFIG_PKCS7_TEST_KEY is not set
 # CONFIG_SIGNED_PE_FILE_VERIFICATION is not set
diff --git a/projects/Allwinner/linux/linux.arm.conf b/projects/Allwinner/linux/linux.arm.conf
index bb26fea8c7..cf9576534b 100644
--- a/projects/Allwinner/linux/linux.arm.conf
+++ b/projects/Allwinner/linux/linux.arm.conf
@@ -5717,7 +5717,7 @@ CONFIG_CRYPTO_ECHAINIV=m
 #
 # Block modes
 #
-CONFIG_CRYPTO_CBC=m
+CONFIG_CRYPTO_CBC=y
 # CONFIG_CRYPTO_CFB is not set
 CONFIG_CRYPTO_CTR=y
 # CONFIG_CRYPTO_CTS is not set
@@ -5853,7 +5853,7 @@ CONFIG_CRYPTO_DEV_SUN8I_SS_HASH=y
 CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
 CONFIG_X509_CERTIFICATE_PARSER=y
-CONFIG_PKCS8_PRIVATE_KEY_PARSER=y
+CONFIG_PKCS8_PRIVATE_KEY_PARSER=m
 CONFIG_PKCS7_MESSAGE_PARSER=y
 # CONFIG_PKCS7_TEST_KEY is not set
 # CONFIG_SIGNED_PE_FILE_VERIFICATION is not set
diff --git a/projects/Amlogic/linux/linux.aarch64.conf b/projects/Amlogic/linux/linux.aarch64.conf
index 6026617b44..56c69e03dc 100644
--- a/projects/Amlogic/linux/linux.aarch64.conf
+++ b/projects/Amlogic/linux/linux.aarch64.conf
@@ -6489,7 +6489,7 @@ CONFIG_CRYPTO_DEV_AMLOGIC_GXL=y
 CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
 CONFIG_X509_CERTIFICATE_PARSER=y
-CONFIG_PKCS8_PRIVATE_KEY_PARSER=y
+CONFIG_PKCS8_PRIVATE_KEY_PARSER=m
 CONFIG_PKCS7_MESSAGE_PARSER=y
 # CONFIG_PKCS7_TEST_KEY is not set
 # CONFIG_SIGNED_PE_FILE_VERIFICATION is not set
diff --git a/projects/Generic/linux/linux.x86_64.conf b/projects/Generic/linux/linux.x86_64.conf
index a131c09137..924c828e81 100644
--- a/projects/Generic/linux/linux.x86_64.conf
+++ b/projects/Generic/linux/linux.x86_64.conf
@@ -1516,7 +1516,6 @@ CONFIG_STANDALONE=y
 #
 CONFIG_FW_LOADER=y
 CONFIG_EXTRA_FIRMWARE=""
-CONFIG_EXTRA_FIRMWARE_DIR="external-firmware"
 # CONFIG_FW_LOADER_USER_HELPER is not set
 # CONFIG_FW_LOADER_COMPRESS is not set
 CONFIG_FW_CACHE=y
@@ -5973,7 +5972,7 @@ CONFIG_CRYPTO_ECHAINIV=m
 #
 # Block modes
 #
-CONFIG_CRYPTO_CBC=m
+CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_CTR=y
 CONFIG_CRYPTO_CTS=m
@@ -6121,7 +6120,7 @@ CONFIG_CRYPTO_LIB_SHA256=y
 CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
 CONFIG_X509_CERTIFICATE_PARSER=y
-CONFIG_PKCS8_PRIVATE_KEY_PARSER=y
+CONFIG_PKCS8_PRIVATE_KEY_PARSER=m
 CONFIG_PKCS7_MESSAGE_PARSER=y
 # CONFIG_PKCS7_TEST_KEY is not set
 # CONFIG_SIGNED_PE_FILE_VERIFICATION is not set
diff --git a/projects/RPi/devices/RPi/linux/linux.arm.conf b/projects/RPi/devices/RPi/linux/linux.arm.conf
index 556ef05ae6..da5f794c31 100644
--- a/projects/RPi/devices/RPi/linux/linux.arm.conf
+++ b/projects/RPi/devices/RPi/linux/linux.arm.conf
@@ -5065,7 +5065,7 @@ CONFIG_CRYPTO_ECHAINIV=m
 #
 # Block modes
 #
-CONFIG_CRYPTO_CBC=m
+CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_CTR=y
 CONFIG_CRYPTO_CTS=m
@@ -5104,7 +5104,7 @@ CONFIG_CRYPTO_MD5=y
 # CONFIG_CRYPTO_RMD160 is not set
 # CONFIG_CRYPTO_RMD256 is not set
 # CONFIG_CRYPTO_RMD320 is not set
-CONFIG_CRYPTO_SHA1=m
+CONFIG_CRYPTO_SHA1=y
 CONFIG_CRYPTO_SHA256=y
 CONFIG_CRYPTO_SHA512=y
 # CONFIG_CRYPTO_SHA3 is not set
@@ -5184,7 +5184,7 @@ CONFIG_CRYPTO_LIB_SHA256=y
 CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
 CONFIG_X509_CERTIFICATE_PARSER=y
-CONFIG_PKCS8_PRIVATE_KEY_PARSER=y
+CONFIG_PKCS8_PRIVATE_KEY_PARSER=m
 CONFIG_PKCS7_MESSAGE_PARSER=y
 # CONFIG_PKCS7_TEST_KEY is not set
 # CONFIG_SIGNED_PE_FILE_VERIFICATION is not set
diff --git a/projects/RPi/devices/RPi2/linux/linux.arm.conf b/projects/RPi/devices/RPi2/linux/linux.arm.conf
index 17548d226e..7fdefdda69 100644
--- a/projects/RPi/devices/RPi2/linux/linux.arm.conf
+++ b/projects/RPi/devices/RPi2/linux/linux.arm.conf
@@ -5212,7 +5212,7 @@ CONFIG_CRYPTO_ECHAINIV=m
 #
 # Block modes
 #
-CONFIG_CRYPTO_CBC=m
+CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_CTR=y
 CONFIG_CRYPTO_CTS=m
@@ -5332,7 +5332,7 @@ CONFIG_CRYPTO_LIB_SHA256=y
 CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
 CONFIG_X509_CERTIFICATE_PARSER=y
-CONFIG_PKCS8_PRIVATE_KEY_PARSER=y
+CONFIG_PKCS8_PRIVATE_KEY_PARSER=m
 CONFIG_PKCS7_MESSAGE_PARSER=y
 # CONFIG_PKCS7_TEST_KEY is not set
 # CONFIG_SIGNED_PE_FILE_VERIFICATION is not set
diff --git a/projects/RPi/devices/RPi4/linux/linux.arm.conf b/projects/RPi/devices/RPi4/linux/linux.arm.conf
index e3357db0a7..abd292ed95 100644
--- a/projects/RPi/devices/RPi4/linux/linux.arm.conf
+++ b/projects/RPi/devices/RPi4/linux/linux.arm.conf
@@ -5727,7 +5727,7 @@ CONFIG_KEYS=y
 # CONFIG_KEYS_REQUEST_CACHE is not set
 # CONFIG_PERSISTENT_KEYRINGS is not set
 # CONFIG_ENCRYPTED_KEYS is not set
-# CONFIG_KEY_DH_OPERATIONS is not set
+CONFIG_KEY_DH_OPERATIONS=y
 # CONFIG_SECURITY_DMESG_RESTRICT is not set
 # CONFIG_SECURITY is not set
 # CONFIG_SECURITYFS is not set
@@ -5811,7 +5811,7 @@ CONFIG_CRYPTO_ECHAINIV=m
 #
 # Block modes
 #
-CONFIG_CRYPTO_CBC=m
+CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_CTR=y
 CONFIG_CRYPTO_CTS=m
@@ -5896,8 +5896,8 @@ CONFIG_CRYPTO_DRBG_HMAC=y
 # CONFIG_CRYPTO_DRBG_CTR is not set
 CONFIG_CRYPTO_DRBG=y
 CONFIG_CRYPTO_JITTERENTROPY=y
-# CONFIG_CRYPTO_USER_API_HASH is not set
-# CONFIG_CRYPTO_USER_API_SKCIPHER is not set
+CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_CRYPTO_USER_API_SKCIPHER=y
 # CONFIG_CRYPTO_USER_API_RNG is not set
 # CONFIG_CRYPTO_USER_API_AEAD is not set
 CONFIG_CRYPTO_HASH_INFO=y
@@ -5924,7 +5924,7 @@ CONFIG_CRYPTO_LIB_SHA256=y
 CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
 CONFIG_X509_CERTIFICATE_PARSER=y
-# CONFIG_PKCS8_PRIVATE_KEY_PARSER is not set
+CONFIG_PKCS8_PRIVATE_KEY_PARSER=m
 CONFIG_PKCS7_MESSAGE_PARSER=y
 # CONFIG_PKCS7_TEST_KEY is not set
 # CONFIG_SIGNED_PE_FILE_VERIFICATION is not set
diff --git a/projects/Rockchip/devices/RK3288/linux/default/linux.arm.conf b/projects/Rockchip/devices/RK3288/linux/default/linux.arm.conf
index a2a4eb1524..853611a899 100644
--- a/projects/Rockchip/devices/RK3288/linux/default/linux.arm.conf
+++ b/projects/Rockchip/devices/RK3288/linux/default/linux.arm.conf
@@ -5573,7 +5573,7 @@ CONFIG_KEYS=y
 # CONFIG_KEYS_REQUEST_CACHE is not set
 # CONFIG_PERSISTENT_KEYRINGS is not set
 # CONFIG_ENCRYPTED_KEYS is not set
-# CONFIG_KEY_DH_OPERATIONS is not set
+CONFIG_KEY_DH_OPERATIONS=y
 # CONFIG_SECURITY_DMESG_RESTRICT is not set
 # CONFIG_SECURITY is not set
 # CONFIG_SECURITYFS is not set
@@ -5660,7 +5660,7 @@ CONFIG_CRYPTO_ECHAINIV=m
 #
 # Block modes
 #
-CONFIG_CRYPTO_CBC=m
+CONFIG_CRYPTO_CBC=y
 # CONFIG_CRYPTO_CFB is not set
 CONFIG_CRYPTO_CTR=y
 # CONFIG_CRYPTO_CTS is not set
@@ -5719,7 +5719,7 @@ CONFIG_CRYPTO_ARC4=m
 # CONFIG_CRYPTO_CAMELLIA is not set
 # CONFIG_CRYPTO_CAST5 is not set
 # CONFIG_CRYPTO_CAST6 is not set
-CONFIG_CRYPTO_DES=m
+CONFIG_CRYPTO_DES=y
 # CONFIG_CRYPTO_FCRYPT is not set
 # CONFIG_CRYPTO_KHAZAD is not set
 # CONFIG_CRYPTO_SALSA20 is not set
@@ -5751,8 +5751,8 @@ CONFIG_CRYPTO_DRBG_HMAC=y
 CONFIG_CRYPTO_DRBG=m
 CONFIG_CRYPTO_JITTERENTROPY=m
 CONFIG_CRYPTO_USER_API=m
-CONFIG_CRYPTO_USER_API_HASH=m
-CONFIG_CRYPTO_USER_API_SKCIPHER=m
+CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_CRYPTO_USER_API_SKCIPHER=y
 CONFIG_CRYPTO_USER_API_RNG=m
 # CONFIG_CRYPTO_USER_API_RNG_CAVP is not set
 CONFIG_CRYPTO_USER_API_AEAD=m
@@ -5788,7 +5788,7 @@ CONFIG_CRYPTO_DEV_VIRTIO=m
 CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
 CONFIG_X509_CERTIFICATE_PARSER=y
-# CONFIG_PKCS8_PRIVATE_KEY_PARSER is not set
+CONFIG_PKCS8_PRIVATE_KEY_PARSER=m
 CONFIG_PKCS7_MESSAGE_PARSER=y
 # CONFIG_PKCS7_TEST_KEY is not set
 # CONFIG_SIGNED_PE_FILE_VERIFICATION is not set
diff --git a/projects/Rockchip/devices/RK3328/linux/default/linux.aarch64.conf b/projects/Rockchip/devices/RK3328/linux/default/linux.aarch64.conf
index c6c2e73658..117b63699d 100644
--- a/projects/Rockchip/devices/RK3328/linux/default/linux.aarch64.conf
+++ b/projects/Rockchip/devices/RK3328/linux/default/linux.aarch64.conf
@@ -5552,7 +5552,7 @@ CONFIG_KEYS=y
 # CONFIG_KEYS_REQUEST_CACHE is not set
 # CONFIG_PERSISTENT_KEYRINGS is not set
 # CONFIG_ENCRYPTED_KEYS is not set
-# CONFIG_KEY_DH_OPERATIONS is not set
+CONFIG_KEY_DH_OPERATIONS=y
 # CONFIG_SECURITY_DMESG_RESTRICT is not set
 CONFIG_SECURITY=y
 # CONFIG_SECURITYFS is not set
@@ -5654,7 +5654,7 @@ CONFIG_CRYPTO_ECHAINIV=y
 #
 # Block modes
 #
-# CONFIG_CRYPTO_CBC is not set
+CONFIG_CRYPTO_CBC=y
 # CONFIG_CRYPTO_CFB is not set
 CONFIG_CRYPTO_CTR=y
 # CONFIG_CRYPTO_CTS is not set
@@ -5714,7 +5714,7 @@ CONFIG_CRYPTO_ARC4=m
 # CONFIG_CRYPTO_CAMELLIA is not set
 # CONFIG_CRYPTO_CAST5 is not set
 # CONFIG_CRYPTO_CAST6 is not set
-# CONFIG_CRYPTO_DES is not set
+CONFIG_CRYPTO_DES=y
 # CONFIG_CRYPTO_FCRYPT is not set
 # CONFIG_CRYPTO_KHAZAD is not set
 # CONFIG_CRYPTO_SALSA20 is not set
@@ -5785,7 +5785,7 @@ CONFIG_CRYPTO_DEV_VIRTIO=m
 CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
 CONFIG_X509_CERTIFICATE_PARSER=y
-# CONFIG_PKCS8_PRIVATE_KEY_PARSER is not set
+CONFIG_PKCS8_PRIVATE_KEY_PARSER=m
 CONFIG_PKCS7_MESSAGE_PARSER=y
 # CONFIG_PKCS7_TEST_KEY is not set
 # CONFIG_SIGNED_PE_FILE_VERIFICATION is not set
diff --git a/projects/Rockchip/devices/RK3399/linux/default/linux.aarch64.conf b/projects/Rockchip/devices/RK3399/linux/default/linux.aarch64.conf
index b639c30d86..817711b44a 100644
--- a/projects/Rockchip/devices/RK3399/linux/default/linux.aarch64.conf
+++ b/projects/Rockchip/devices/RK3399/linux/default/linux.aarch64.conf
@@ -6234,7 +6234,7 @@ CONFIG_KEYS=y
 # CONFIG_KEYS_REQUEST_CACHE is not set
 # CONFIG_PERSISTENT_KEYRINGS is not set
 # CONFIG_ENCRYPTED_KEYS is not set
-# CONFIG_KEY_DH_OPERATIONS is not set
+CONFIG_KEY_DH_OPERATIONS=y
 # CONFIG_SECURITY_DMESG_RESTRICT is not set
 CONFIG_SECURITY=y
 # CONFIG_SECURITYFS is not set
@@ -6336,7 +6336,7 @@ CONFIG_CRYPTO_ECHAINIV=y
 #
 # Block modes
 #
-# CONFIG_CRYPTO_CBC is not set
+CONFIG_CRYPTO_CBC=y
 # CONFIG_CRYPTO_CFB is not set
 CONFIG_CRYPTO_CTR=y
 # CONFIG_CRYPTO_CTS is not set
@@ -6396,7 +6396,7 @@ CONFIG_CRYPTO_ARC4=m
 # CONFIG_CRYPTO_CAMELLIA is not set
 # CONFIG_CRYPTO_CAST5 is not set
 # CONFIG_CRYPTO_CAST6 is not set
-# CONFIG_CRYPTO_DES is not set
+CONFIG_CRYPTO_DES=y
 # CONFIG_CRYPTO_FCRYPT is not set
 # CONFIG_CRYPTO_KHAZAD is not set
 # CONFIG_CRYPTO_SALSA20 is not set
@@ -6469,7 +6469,7 @@ CONFIG_CRYPTO_DEV_VIRTIO=m
 CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
 CONFIG_X509_CERTIFICATE_PARSER=y
-# CONFIG_PKCS8_PRIVATE_KEY_PARSER is not set
+CONFIG_PKCS8_PRIVATE_KEY_PARSER=m
 CONFIG_PKCS7_MESSAGE_PARSER=y
 # CONFIG_PKCS7_TEST_KEY is not set
 # CONFIG_SIGNED_PE_FILE_VERIFICATION is not set
diff --git a/tools/adjust_kernel_config b/tools/adjust_kernel_config
new file mode 100755
index 0000000000..7a8001fdc6
--- /dev/null
+++ b/tools/adjust_kernel_config
@@ -0,0 +1,40 @@
+#!/bin/bash
+
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (C) 2021-present Team LibreELEC (https://libreelec.tv)
+
+if [ -z "${1}" -o "${1}" == "help" -o "${1}" == "--help" -o "${1}" == "h" -o "${1}" == "-h" ]; then
+  echo -e "A kernel config command must be specified:\n"
+  echo -e "${0} menuconfig"
+  echo -e ""
+  echo -e "To see all available config commands use:\n"
+  echo -e "${0} commands"
+  exit
+fi
+
+KERNEL_CONFIG_COMMAND="$1"
+
+. config/options linux
+
+${SCRIPTS}/unpack linux
+
+AVAILABLE_KERNEL_CONFIG_COMMANDS="$(kernel_make -C ${PKG_BUILD} help | sed -n '/Configuration targets:/,/Other generic targets:/p' | sed -n -E 's/^  ([a-z0-9]+)[ -]*.*/\1/p')"
+
+print_config_commands() {
+  echo -e "Available kernel config commands are:\n\n${AVAILABLE_KERNEL_CONFIG_COMMANDS}"
+}
+
+if [ "${1}" == "commands" ]; then
+  print_config_commands
+  exit
+fi
+
+if [ -z "$(echo ${AVAILABLE_KERNEL_CONFIG_COMMANDS} | grep ${KERNEL_CONFIG_COMMAND})" ]; then
+  echo -e "\"${KERNEL_CONFIG_COMMAND}\" is not an available kernel config command\n"
+  print_config_commands
+  exit
+fi
+
+tools/check_kernel_config
+
+kernel_make KCONFIG_CONFIG=${PKG_KERNEL_CFG_FILE} -C ${PKG_BUILD} ${KERNEL_CONFIG_COMMAND}
diff --git a/tools/check_kernel_config b/tools/check_kernel_config
new file mode 100755
index 0000000000..41a52d7117
--- /dev/null
+++ b/tools/check_kernel_config
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (C) 2021-present Team LibreELEC (https://libreelec.tv)
+
+. config/options linux
+
+${SCRIPTS}/unpack linux
+
+if [ -f "${DISTRO_DIR}/${DISTRO}/kernel_options" ]; then
+  while read OPTION; do
+    [ -z "$OPTION" -o -n "$(echo "$OPTION" | grep '^#')" ] && continue
+
+    if [ "${OPTION##*=}" == "m" ]; then
+      echo "[m] ${OPTION%%=*}"
+      $PKG_BUILD/scripts/config --file $PKG_KERNEL_CFG_FILE --module ${OPTION%%=*}
+    fi
+
+    if [ "${OPTION##*=}" == "y" ]; then
+      echo "[y] ${OPTION%%=*}"
+      $PKG_BUILD/scripts/config --file $PKG_KERNEL_CFG_FILE --enable ${OPTION%%=*}
+    fi
+
+    if [ "${OPTION##*=}" == "n" ]; then
+      echo "[n] ${OPTION%%=*}"
+      $PKG_BUILD/scripts/config --file $PKG_KERNEL_CFG_FILE --disable ${OPTION%%=*}
+    fi
+
+  done < ${DISTRO_DIR}/${DISTRO}/kernel_options
+else
+  echo "kernel options file doesn't exist: ${DISTRO_DIR}/${DISTRO}/kernel_options"
+fi