diff --git a/include/rootfs.mk b/include/rootfs.mk
index b6775c7e15..18ada3cd43 100644
--- a/include/rootfs.mk
+++ b/include/rootfs.mk
@@ -69,7 +69,7 @@ define prepare_rootfs
 	@( \
 		cd $(1); \
 		for script in ./usr/lib/opkg/info/*.postinst; do \
-			IPKG_INSTROOT=$(1) $$(which bash) $$script; \
+			IPKG_INSTROOT=$(1) $$(command -v bash) $$script; \
 			ret=$$?; \
 			if [ $$ret -ne 0 ]; then \
 				echo "postinst script $$script has failed with exit code $$ret" >&2; \
@@ -79,10 +79,10 @@ define prepare_rootfs
 		for script in ./etc/init.d/*; do \
 			grep '#!/bin/sh /etc/rc.common' $$script >/dev/null || continue; \
 			if ! echo " $(3) " | grep -q " $$(basename $$script) "; then \
-				IPKG_INSTROOT=$(1) $$(which bash) ./etc/rc.common $$script enable; \
+				IPKG_INSTROOT=$(1) $$(command -v bash) ./etc/rc.common $$script enable; \
 				echo "Enabling" $$(basename $$script); \
 			else \
-				IPKG_INSTROOT=$(1) $$(which bash) ./etc/rc.common $$script disable; \
+				IPKG_INSTROOT=$(1) $$(command -v bash) ./etc/rc.common $$script disable; \
 				echo "Disabling" $$(basename $$script); \
 			fi; \
 		done || true \
diff --git a/include/toplevel.mk b/include/toplevel.mk
index 8564a4de73..046c3cb135 100644
--- a/include/toplevel.mk
+++ b/include/toplevel.mk
@@ -260,7 +260,7 @@ package/symlinks-clean:
 	./scripts/feeds uninstall -a
 
 help:
-	cat README
+	cat README.md
 
 distclean:
 	rm -rf bin build_dir .config* dl feeds key-build* logs package/feeds package/openwrt-packages staging_dir tmp
diff --git a/package/base-files/Makefile b/package/base-files/Makefile
index 74ca8426a3..b0951747de 100644
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@@ -12,7 +12,7 @@ include $(INCLUDE_DIR)/version.mk
 include $(INCLUDE_DIR)/feeds.mk
 
 PKG_NAME:=base-files
-PKG_RELEASE:=203
+PKG_RELEASE:=204
 PKG_FLAGS:=nonshared
 
 PKG_FILE_DEPENDS:=$(PLATFORM_DIR)/ $(GENERIC_PLATFORM_DIR)/base-files/
diff --git a/package/base-files/files/lib/upgrade/stage2 b/package/base-files/files/lib/upgrade/stage2
index 9d55f3b340..a8128bb458 100755
--- a/package/base-files/files/lib/upgrade/stage2
+++ b/package/base-files/files/lib/upgrade/stage2
@@ -56,7 +56,7 @@ switch_to_ramfs() {
 		snapshot snapshot_tool					\
 		$RAMFS_COPY_BIN
 	do
-		local file="$(which "$binary" 2>/dev/null)"
+		local file="$(command -v "$binary" 2>/dev/null)"
 		[ -n "$file" ] && install_bin "$file"
 	done
 	install_file /etc/resolv.conf /lib/*.sh /lib/functions/*.sh /lib/upgrade/*.sh $RAMFS_COPY_DATA
diff --git a/package/kernel/broadcom-wl/Makefile b/package/kernel/broadcom-wl/Makefile
index 1ed5012b88..1e1447cde5 100644
--- a/package/kernel/broadcom-wl/Makefile
+++ b/package/kernel/broadcom-wl/Makefile
@@ -10,7 +10,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=broadcom-wl
 PKG_VERSION:=5.10.56.27.3
-PKG_RELEASE:=9
+PKG_RELEASE:=10
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)_$(ARCH).tar.bz2
 PKG_SOURCE_URL:=http://downloads.openwrt.org/sources
diff --git a/package/kernel/broadcom-wl/files/lib/wifi/broadcom.sh b/package/kernel/broadcom-wl/files/lib/wifi/broadcom.sh
index 33447341b2..352c365f27 100755
--- a/package/kernel/broadcom-wl/files/lib/wifi/broadcom.sh
+++ b/package/kernel/broadcom-wl/files/lib/wifi/broadcom.sh
@@ -223,7 +223,7 @@ enable_broadcom() {
 	}
 
 	local _c=0
-	local nas="$(which nas)"
+	local nas="$(command -v nas)"
 	local if_pre_up if_up nas_cmd
 	local vif vif_pre_up vif_post_up vif_do_up vif_txpower
 	local bssmax=$(wlc ifname "$device" bssmax)
diff --git a/package/libs/libjson-c/Makefile b/package/libs/libjson-c/Makefile
index 5e88bba9a3..84bd722f15 100644
--- a/package/libs/libjson-c/Makefile
+++ b/package/libs/libjson-c/Makefile
@@ -9,29 +9,24 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=json-c
 PKG_VERSION:=0.14
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-nodoc.tar.gz
 PKG_SOURCE_URL:=https://s3.amazonaws.com/json-c_releases/releases/
 PKG_HASH:=99914e644a25201d82ccefa20430f7515c110923360f9ef46755527c02412afa
 
+PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=COPYING
 PKG_CPE_ID:=cpe:/a:json-c_project:json-c
 
-CMAKE_INSTALL:=1
-CMAKE_OPTIONS += -DCMAKE_INSTALL_INCLUDEDIR=$(STAGING_DIR)/usr/include
-
-PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
+PKG_BUILD_PARALLEL:=1
+HOST_BUILD_PREFIX:=$(STAGING_DIR_HOST)
 
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/host-build.mk
 include $(INCLUDE_DIR)/cmake.mk
 
-TARGET_CFLAGS += $(FPIC) -Wno-implicit-fallthrough
-HOST_CFLAGS += -Wno-implicit-fallthrough
-HOST_BUILD_PREFIX:=$(STAGING_DIR_HOST)
-
 define Package/libjson-c
   SECTION:=libs
   CATEGORY:=Libraries
@@ -44,6 +39,12 @@ define Package/libjson-c/description
  This package contains a library for javascript object notation backends.
 endef
 
+define Build/InstallDev
+	$(call Build/InstallDev/cmake,$(1))
+	$(SED) 's,/usr/include,$$$${prefix}/include,g' $(1)/usr/lib/pkgconfig/json-c.pc
+	$(SED) 's,/usr/lib,$$$${exec_prefix}/lib,g' $(1)/usr/lib/pkgconfig/json-c.pc
+endef
+
 define Package/libjson-c/install
 	$(INSTALL_DIR) $(1)/usr/lib
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libjson-c.so.* $(1)/usr/lib/
diff --git a/package/libs/libselinux/Makefile b/package/libs/libselinux/Makefile
new file mode 100644
index 0000000000..b0b2491cc9
--- /dev/null
+++ b/package/libs/libselinux/Makefile
@@ -0,0 +1,79 @@
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=libselinux
+PKG_VERSION:=3.1
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/20200710
+PKG_HASH:=ea5dcbb4d859e3f999c26a13c630da2f16dff9462e3cc8cb7b458ac157d112e7
+HOST_BUILD_DEPENDS:=libsepol/host pcre/host
+
+PKG_MAINTAINER:=Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/libselinux
+  SECTION:=libs
+  DEPENDS:=+libsepol +libpcre +musl-fts
+  CATEGORY:=Libraries
+  TITLE:=Runtime SELinux library
+  URL:=http://selinuxproject.org/page/Main_Page
+endef
+
+define Package/libselinux/description
+	libselinux is the runtime SELinux library that provides
+	interfaces (e.g. library functions for the SELinux kernel
+	APIs like getcon(), other support functions like
+	getseuserbyname()) to SELinux-aware applications. libselinux
+	may use the shared libsepol to manipulate the binary policy
+	if necessary (e.g. to downgrade the policy format to an
+	older version supported by the kernel) when loading policy.
+endef
+
+include $(INCLUDE_DIR)/host-build.mk
+
+# Needed to link libselinux utilities, which link against
+# libselinux.so, which indirectly depends on libpcre.so, installed in
+# $(STAGING_DIR_HOSTPKG).
+HOST_LDFLAGS += -Wl,-rpath="$(STAGING_DIR_HOSTPKG)/lib"
+
+HOST_MAKE_FLAGS += \
+	PREFIX=$(STAGING_DIR_HOSTPKG) \
+	SHLIBDIR=$(STAGING_DIR_HOSTPKG)/lib
+
+MAKE_FLAGS += \
+	FTS_LDLIBS=-lfts \
+	SHLIBDIR=/usr/lib \
+
+define Build/Compile
+	$(call Build/Compile/Default,all)
+endef
+
+define Build/Install
+	$(call Build/Install/Default,install)
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/* $(1)/usr/lib/
+	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
+	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libselinux.pc $(1)/usr/lib/pkgconfig/
+	$(SED) 's,/usr/include,$$$${prefix}/include,g' $(1)/usr/lib/pkgconfig/libselinux.pc
+	$(SED) 's,/usr/lib,$$$${exec_prefix}/lib,g' $(1)/usr/lib/pkgconfig/libselinux.pc
+endef
+
+define Package/libselinux/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libselinux.so.* $(1)/usr/lib/
+endef
+
+$(eval $(call HostBuild))
+$(eval $(call BuildPackage,libselinux))
diff --git a/package/libs/libsepol/Makefile b/package/libs/libsepol/Makefile
new file mode 100644
index 0000000000..cd49ed008d
--- /dev/null
+++ b/package/libs/libsepol/Makefile
@@ -0,0 +1,66 @@
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=libsepol
+PKG_VERSION:=3.1
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/20200710
+PKG_HASH:=ae6778d01443fdd38cd30eeee846494e19f4d407b09872580372f4aa4bf8a3cc
+
+PKG_MAINTAINER:=Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/libsepol
+  SECTION:=libs
+  CATEGORY:=Libraries
+  TITLE:=SELinux binary policy manipulation library
+  URL:=http://selinuxproject.org/page/Main_Page
+endef
+
+define Package/libsepol/description
+	Libsepol is the binary policy manipulation library. It doesn't
+	depend upon or use any of the other SELinux components.
+endef #'
+
+include $(INCLUDE_DIR)/host-build.mk
+
+HOST_MAKE_FLAGS += \
+	PREFIX=$(STAGING_DIR_HOSTPKG) \
+	SHLIBDIR=$(STAGING_DIR_HOSTPKG)/lib
+
+MAKE_FLAGS += \
+	SHLIBDIR=/usr/lib
+
+define Build/Compile
+	$(call Build/Compile/Default,all)
+endef
+
+define Build/Install
+	$(call Build/Install/Default,install)
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/* $(1)/usr/lib/
+	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
+	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libsepol.pc $(1)/usr/lib/pkgconfig/
+	$(SED) 's,/usr/include,$$$${prefix}/include,g' $(1)/usr/lib/pkgconfig/libsepol.pc
+	$(SED) 's,/usr/lib,$$$${exec_prefix}/lib,g' $(1)/usr/lib/pkgconfig/libsepol.pc
+endef
+
+define Package/libsepol/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libsepol.so.* $(1)/usr/lib/
+endef
+
+$(eval $(call HostBuild))
+$(eval $(call BuildPackage,libsepol))
diff --git a/package/libs/musl-fts/Makefile b/package/libs/musl-fts/Makefile
new file mode 100644
index 0000000000..494f700f8a
--- /dev/null
+++ b/package/libs/musl-fts/Makefile
@@ -0,0 +1,60 @@
+#
+# Copyright (C) 2017 Lucian Cristian <lucian.cristian@gmail.com>
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+# updated to work with latest source from abrasive
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=musl-fts
+PKG_VERSION:=1.2.7
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://github.com/pullmoll/musl-fts.git
+PKG_SOURCE_VERSION:=0bde52df588e8969879a2cae51c3a4774ec62472
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_MIRROR_HASH:=29c62a600128e9189b1b2e1aea568546178eedf739527f657873b3b773072ecb
+
+PKG_MAINTAINER:=Lucian Cristian <lucian.cristian@gmail.com>
+
+PKG_LICENSE:=LGPL-2.1
+PKG_LICENSE_FILES:=COPYING AUTHORS
+
+PKG_FIXUP:=autoreconf
+PKG_REMOVE_FILES:=autogen.sh
+
+PKG_BUILD_PARALLEL:=1
+PKG_INSTALL:=1
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/musl-fts
+  SECTION:=libs
+  CATEGORY:=Libraries
+  TITLE:=fts implementation for musl libc
+  URL:=https://github.com/pullmoll/musl-fts
+  DEPENDS:= +libpthread
+endef
+
+define Package/musl-fts/description
+  The musl-fts package implements the fts(3) functions fts_open, fts_read, fts_children, fts_set and fts_close, which are missing in musl libc.
+endef
+
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/fts.h $(1)/usr/include/
+	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libfts.so* $(1)/usr/lib/
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/musl-fts.pc $(1)/usr/lib/pkgconfig/
+endef
+
+define Package/musl-fts/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libfts.so* $(1)/usr/lib/
+endef
+
+$(eval $(call BuildPackage,musl-fts))
diff --git a/package/libs/pcre/Config.in b/package/libs/pcre/Config.in
new file mode 100644
index 0000000000..15e75fc753
--- /dev/null
+++ b/package/libs/pcre/Config.in
@@ -0,0 +1,11 @@
+config PCRE_JIT_ENABLED
+	bool
+	depends on PACKAGE_libpcre && (arm || i386 || i686 || x86_64 || mips || mipsel || powerpc || sparc)
+	default y if (arm || i686 || x86_64)
+	prompt "Enable JIT compiler support"
+	help
+		Enable JIT (Just-In-Time) compiler support.
+
+		Enabling this option can give an about 10x performance increase on JIT operations. It can be desireable for e.g. high performance Apache mod_rewrite or HA-Proxy reqrep operations.
+
+		However, JIT should _only_ be enabled on architectures that are supported. Enabling JIT on unsupported platforms will result in a compilation failure. A list of supported architectures can be found here: https://pcre.org/original/doc/html/pcrejit.html#SEC3 .
diff --git a/package/libs/pcre/Makefile b/package/libs/pcre/Makefile
new file mode 100644
index 0000000000..b638c876da
--- /dev/null
+++ b/package/libs/pcre/Makefile
@@ -0,0 +1,119 @@
+#
+# Copyright (C) 2006-2015 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=pcre
+PKG_VERSION:=8.44
+PKG_RELEASE:=2
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
+PKG_SOURCE_URL:=@SF/$(PKG_NAME)
+PKG_HASH:=19108658b23b3ec5058edc9f66ac545ea19f9537234be1ec62b714c84399366d
+
+PKG_MAINTAINER:=Thomas Heil <heil@terminal-consulting.de>
+PKG_LICENSE:=BSD-3-Clause
+PKG_LICENSE_FILES:=LICENCE
+PKG_CPE_ID:=cpe:/a:pcre:pcre
+
+PKG_INSTALL:=1
+PKG_BUILD_PARALLEL:=1
+
+PKG_CONFIG_DEPENDS:=\
+	CONFIG_PACKAGE_libpcrecpp \
+	CONFIG_PCRE_JIT_ENABLED
+
+include $(INCLUDE_DIR)/uclibc++.mk
+include $(INCLUDE_DIR)/package.mk
+
+define Package/libpcre/default
+  SECTION:=libs
+  CATEGORY:=Libraries
+  URL:=https://www.pcre.org/
+endef
+
+define Package/libpcre/config
+  source "$(SOURCE)/Config.in"
+endef
+
+define Package/libpcre
+  $(call Package/libpcre/default)
+  TITLE:=A Perl Compatible Regular Expression library
+endef
+
+define Package/libpcre16
+  $(call Package/libpcre/default)
+  TITLE:=A Perl Compatible Regular Expression library (16bit support)
+endef
+
+define Package/libpcre32
+  $(call Package/libpcre/default)
+  TITLE:=A Perl Compatible Regular Expression library (32bit support)
+endef
+
+define Package/libpcrecpp
+  $(call Package/libpcre/default)
+  TITLE:=C++ wrapper for Perl Compatible Regular Expression library
+  DEPENDS:=+libpcre $(CXX_DEPENDS)
+endef
+
+TARGET_CFLAGS += $(FPIC)
+
+CONFIGURE_ARGS += \
+	--enable-utf8 \
+	--enable-unicode-properties \
+	--enable-pcre16 \
+	--enable-pcre32 \
+	$(if $(CONFIG_PCRE_JIT_ENABLED),--enable-jit,--disable-jit) \
+	--with-match-limit-recursion=16000 \
+	$(if $(CONFIG_PACKAGE_libpcrecpp),--enable,--disable)-cpp
+
+MAKE_FLAGS += \
+	CFLAGS="$(TARGET_CFLAGS)"
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/pcre-config $(1)/usr/bin/
+
+	$(INSTALL_DIR) $(2)/bin
+	$(LN) $(STAGING_DIR)/usr/bin/pcre-config $(2)/bin
+
+	$(INSTALL_DIR) $(1)/usr/include
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/pcre*.h $(1)/usr/include/
+
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre*.{a,so*} $(1)/usr/lib/
+
+	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libpcre*.pc $(1)/usr/lib/pkgconfig/
+endef
+
+define Package/libpcre/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre{,posix}.so.* $(1)/usr/lib/
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre.so $(1)/usr/lib/
+endef
+
+define Package/libpcre16/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre16.so* $(1)/usr/lib/
+endef
+
+define Package/libpcre32/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre32.so* $(1)/usr/lib/
+endef
+
+define Package/libpcrecpp/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcrecpp.so.* $(1)/usr/lib/
+endef
+
+$(eval $(call BuildPackage,libpcre))
+$(eval $(call BuildPackage,libpcre16))
+$(eval $(call BuildPackage,libpcre32))
+$(eval $(call BuildPackage,libpcrecpp))
diff --git a/package/lienol/luci-app-passwall/Makefile b/package/lienol/luci-app-passwall/Makefile
index 5b4c6632ad..f4f24ddaa9 100644
--- a/package/lienol/luci-app-passwall/Makefile
+++ b/package/lienol/luci-app-passwall/Makefile
@@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall
 PKG_VERSION:=3.9
-PKG_RELEASE:=35
+PKG_RELEASE:=36
 PKG_DATE:=20200812
 
 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
index 5d040b0b7f..32d0570744 100755
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
@@ -452,7 +452,8 @@ run_redir() {
 					local run_kcptun_ip=$server_host
 					[ -n "$kcptun_server_host" ] && run_kcptun_ip=$(get_host_ip $network_type $kcptun_server_host)
 					KCPTUN_REDIR_PORT=$(get_new_port $KCPTUN_REDIR_PORT tcp)
-					ln_start_bin "$(first_type $(config_t_get global_app kcptun_client_file notset) kcptun-client)" "kcptun_tcp_$6" -l "0.0.0.0:$KCPTUN_REDIR_PORT" -r "$run_kcptun_ip:$kcptun_port" "$kcptun_config"
+					kcptun_params="-l 0.0.0.0:$KCPTUN_REDIR_PORT -r $run_kcptun_ip:$kcptun_port $kcptun_config"
+					ln_start_bin "$(first_type $(config_t_get global_app kcptun_client_file notset) kcptun-client)" "kcptun_tcp_$6" $kcptun_params
 				fi
 			fi
 			if [ "$type" == "ssr" ] || [ "$type" == "ss" ]; then
diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile
index 0a9b5c0a99..bedb000fda 100644
--- a/package/network/services/dropbear/Makefile
+++ b/package/network/services/dropbear/Makefile
@@ -53,9 +53,9 @@ define Package/dropbear
   CATEGORY:=Base system
   TITLE:=Small SSH2 client/server
   DEPENDS:= +DROPBEAR_ZLIB:zlib
-  ALTERNATIVES:=\
-	  100:/usr/bin/ssh:/usr/sbin/dropbear \
-	  100:/usr/bin/scp:/usr/sbin/dropbear \
+  ALTERNATIVES:=100:/usr/bin/scp:/usr/sbin/dropbear
+  $(if $(CONFIG_DROPBEAR_DBCLIENT),ALTERNATIVES+= \
+	  100:/usr/bin/ssh:/usr/sbin/dropbear,)
 
 endef
 
diff --git a/package/network/utils/iproute2/patches/300-selinux-configurable.patch b/package/network/utils/iproute2/patches/300-selinux-configurable.patch
new file mode 100644
index 0000000000..4cda30f978
--- /dev/null
+++ b/package/network/utils/iproute2/patches/300-selinux-configurable.patch
@@ -0,0 +1,11 @@
+--- a/configure
++++ b/configure
+@@ -244,7 +244,7 @@ check_elf()
+ check_selinux()
+ # SELinux is a compile time option in the ss utility
+ {
+-	if ${PKG_CONFIG} libselinux --exists; then
++	if [ "${HAVE_SELINUX}" = "y" ] && ${PKG_CONFIG} libselinux --exists; then
+ 		echo "HAVE_SELINUX:=y" >>$CONFIG
+ 		echo "yes"
+ 
diff --git a/package/ntlf9t/smartdns/Makefile b/package/ntlf9t/smartdns/Makefile
index 40c6507055..2d8d9ed291 100644
--- a/package/ntlf9t/smartdns/Makefile
+++ b/package/ntlf9t/smartdns/Makefile
@@ -16,12 +16,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=smartdns
-PKG_VERSION:=8.2020.03
+PKG_VERSION:=8.2020.09
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/pymumu/smartdns.git
-PKG_SOURCE_VERSION:=c23ec7ea8f6c075fef7d4f8c82c5771ca1bd3567
+PKG_SOURCE_VERSION:=a9829f6155cfe75dc981066a2239954ef7b40d78
 
 PKG_MAINTAINER:=Nick Peng <pymumu@gmail.com>
 PKG_LICENSE:=GPL-3.0-or-later
diff --git a/package/system/procd/Makefile b/package/system/procd/Makefile
index 17a871b15c..b0c035545e 100644
--- a/package/system/procd/Makefile
+++ b/package/system/procd/Makefile
@@ -41,18 +41,34 @@ TARGET_LDFLAGS += $(if $(CONFIG_USE_GLIBC),-lrt)
 TARGET_CFLAGS += -flto
 TARGET_LDFLAGS += -flto
 
-define Package/procd
+define Package/procd/Default
   SECTION:=base
   CATEGORY:=Base system
-  DEPENDS:=+ubusd +ubus +libjson-script +ubox +USE_GLIBC:librt +libubox +libubus +libblobmsg-json +libjson-c +PACKAGE_libselinux:libselinux
+  DEPENDS:=+ubusd +ubus +libjson-script +ubox +USE_GLIBC:librt +libubox \
+	  +libubus +libblobmsg-json +libjson-c
   TITLE:=OpenWrt system process manager
   USERID:=:dialout=20 :audio=29
 endef
 
+define Package/procd
+  $(call Package/procd/Default)
+  VARIANT:=default
+  CONFLICTS:=procd-selinux
+endef
+
+define Package/procd-selinux
+  $(call Package/procd/Default)
+  DEPENDS += +libselinux
+  TITLE += with SELinux support
+  PROVIDES:=procd
+  VARIANT:=selinux
+endef
+
 define Package/procd-ujail
   SECTION:=base
   CATEGORY:=Base system
-  DEPENDS:=@KERNEL_NAMESPACES +@KERNEL_UTS_NS +@KERNEL_IPC_NS +@KERNEL_PID_NS +libubox +libubus +libblobmsg-json
+  DEPENDS:=@KERNEL_NAMESPACES +@KERNEL_UTS_NS +@KERNEL_IPC_NS +@KERNEL_PID_NS \
+	  +libubox +libubus +libblobmsg-json
   TITLE:=OpenWrt process jail helper
 endef
 
@@ -66,7 +82,8 @@ endef
 define Package/procd-seccomp
   SECTION:=base
   CATEGORY:=Base system
-  DEPENDS:=@(arm||armeb||mips||mipsel||i386||powerpc||x86_64) @!TARGET_uml @KERNEL_SECCOMP +libubox +libblobmsg-json
+  DEPENDS:=@(arm||armeb||mips||mipsel||i386||powerpc||x86_64) @!TARGET_uml \
+	  @KERNEL_SECCOMP +libubox +libblobmsg-json
   TITLE:=OpenWrt process seccomp helper + utrace
 endef
 
@@ -80,7 +97,7 @@ endef
 
 define Package/procd/config
 menu "Configuration"
-	depends on PACKAGE_procd
+	depends on PACKAGE_procd || PACKAGE_procd-selinux
 
 config PROCD_SHOW_BOOT
 	bool
@@ -94,6 +111,9 @@ config PROCD_ZRAM_TMPFS
 endmenu
 endef
 
+ifeq ($(BUILD_VARIANT),selinux)
+  CMAKE_OPTIONS += -DSELINUX=1
+endif
 
 ifeq ($(CONFIG_PROCD_SHOW_BOOT),y)
   CMAKE_OPTIONS += -DSHOW_BOOT_ON_CONSOLE=1
@@ -108,8 +128,7 @@ ifdef CONFIG_PACKAGE_procd-ujail
 endif
 
 SECCOMP=$(if $(CONFIG_PACKAGE_procd-seccomp),1,0)
-SELINUX=$(if $(CONFIG_PACKAGE_libselinux),1,0)
-CMAKE_OPTIONS += -DSECCOMP_SUPPORT=$(SECCOMP) -DUTRACE_SUPPORT=$(SECCOMP) -DSELINUX=$(SELINUX)
+CMAKE_OPTIONS += -DSECCOMP_SUPPORT=$(SECCOMP) -DUTRACE_SUPPORT=$(SECCOMP)
 
 define Package/procd/install
 	$(INSTALL_DIR) $(1)/sbin $(1)/etc $(1)/lib/functions
@@ -121,6 +140,8 @@ define Package/procd/install
 	$(INSTALL_DATA) ./files/procd.sh $(1)/lib/functions/
 endef
 
+Package/procd-selinux/install = $(Package/procd/install)
+
 define Package/procd-ujail/install
 	$(INSTALL_DIR) $(1)/sbin
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/ujail $(1)/sbin/
@@ -151,6 +172,7 @@ define Package/uxc/install
 endef
 
 $(eval $(call BuildPackage,procd))
+$(eval $(call BuildPackage,procd-selinux))
 $(eval $(call BuildPackage,procd-ujail))
 $(eval $(call BuildPackage,procd-ujail-console))
 $(eval $(call BuildPackage,procd-seccomp))
diff --git a/package/system/zram-swap/Makefile b/package/system/zram-swap/Makefile
index 4422c351ea..5c132c9062 100644
--- a/package/system/zram-swap/Makefile
+++ b/package/system/zram-swap/Makefile
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zram-swap
-PKG_RELEASE:=5
+PKG_RELEASE:=6
 
 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
 
diff --git a/package/system/zram-swap/files/zram.init b/package/system/zram-swap/files/zram.init
index a6126e578f..42c084855a 100755
--- a/package/system/zram-swap/files/zram.init
+++ b/package/system/zram-swap/files/zram.init
@@ -35,17 +35,17 @@ zram_applicable()
 		return 1
 	}
 
-	which mkswap >/dev/null || {
+	command -v mkswap >/dev/null || {
 		logger -s -t zram_applicable -p daemon.err "[ERROR] 'mkswap' not installed"
 		return 1
 	}
 
-	which swapon >/dev/null || {
+	command -v swapon >/dev/null || {
 		logger -s -t zram_applicable -p daemon.err "[ERROR] 'swapon' not installed"
 		return 1
 	}
 
-	which swapoff >/dev/null || {
+	command -v swapoff >/dev/null || {
 		logger -s -t zram_applicable -p daemon.err "[ERROR] 'swapoff' not installed"
 		return 1
 	}
diff --git a/package/utils/busybox/patches/130-mconf_missing_sigwinch.patch b/package/utils/busybox/patches/130-mconf_missing_sigwinch.patch
deleted file mode 100644
index b8ca2122b8..0000000000
--- a/package/utils/busybox/patches/130-mconf_missing_sigwinch.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- a/scripts/kconfig/mconf.c
-+++ b/scripts/kconfig/mconf.c
-@@ -31,6 +31,10 @@
- #define SIGWINCH 28
- #endif
- 
-+#ifndef SIGWINCH
-+#define SIGWINCH 28
-+#endif
-+
- #define LKC_DIRECT_LINK
- #include "lkc.h"
- 
diff --git a/package/zxlhhyccc/tvheadend/patches/010-gcc10.patch b/package/zxlhhyccc/tvheadend/patches/010-gcc10.patch
new file mode 100644
index 0000000000..b2ef7402ae
--- /dev/null
+++ b/package/zxlhhyccc/tvheadend/patches/010-gcc10.patch
@@ -0,0 +1,28 @@
+diff --git a/src/input.h b/src/input.h
+index 516f850ef..378996a80 100644
+--- a/src/input.h
++++ b/src/input.h
+@@ -129,8 +129,8 @@ void tvh_hardware_delete ( tvh_hardware_t *th );
+ extern const idclass_t tvh_input_class;
+ extern const idclass_t tvh_input_instance_class;
+ 
+-tvh_input_list_t    tvh_inputs;
+-tvh_hardware_list_t tvh_hardware;
++extern tvh_input_list_t    tvh_inputs;
++extern tvh_hardware_list_t tvh_hardware;
+ 
+ #define TVH_INPUT_FOREACH(x) LIST_FOREACH(x, &tvh_inputs, ti_link)
+ #define TVH_HARDWARE_FOREACH(x) LIST_FOREACH(x, &tvh_hardware, th_link)
+diff --git a/src/input/mpegts.h b/src/input/mpegts.h
+index 9d29d56ca..fd46e4f9e 100644
+--- a/src/input/mpegts.h
++++ b/src/input/mpegts.h
+@@ -1144,7 +1144,7 @@ typedef struct mpegts_listener
+   void (*ml_mux_delete) (mpegts_mux_t *mm, void *p);
+ } mpegts_listener_t;
+ 
+-LIST_HEAD(,mpegts_listener) mpegts_listeners;
++static LIST_HEAD(,mpegts_listener) mpegts_listeners;
+ 
+ #define mpegts_add_listener(ml)\
+   LIST_INSERT_HEAD(&mpegts_listeners, ml, ml_link)
diff --git a/scripts/ipkg-build b/scripts/ipkg-build
index 21127f3391..6e027bc546 100755
--- a/scripts/ipkg-build
+++ b/scripts/ipkg-build
@@ -10,10 +10,10 @@
 set -e
 
 version=1.0
-FIND="$(which find)"
-FIND="${FIND:-$(which gfind)}"
-TAR="${TAR:-$(which tar)}"
-GZIP="$(which gzip)"
+FIND="$(command -v find)"
+FIND="${FIND:-$(command -v gfind)}"
+TAR="${TAR:-$(command -v tar)}"
+GZIP="$(command -v gzip)"
 
 # try to use fixed source epoch
 if [ -n "$SOURCE_DATE_EPOCH" ]; then
@@ -21,10 +21,10 @@ if [ -n "$SOURCE_DATE_EPOCH" ]; then
 
 # look up date of last commit
 elif [ -d "$TOPDIR/.git" ]; then
-	GIT="$(which git)"
+	GIT="$(command -v git)"
 	TIMESTAMP=$(cd $TOPDIR; $GIT log -1 -s --format=%ci)
 elif [ -d "$TOPDIR/.svn" ]; then
-	SVN="$(which svn)"
+	SVN="$(command -v svn)"
 	TIMESTAMP=$($SVN info "$TOPDIR" | sed -n "s/^Last Changed Date: \(.*\)/\1/p")
 else
 	TIMESTAMP=$(date)