diff --git a/include/cmake.mk b/include/cmake.mk
index 12855982f6..77d85af1fa 100644
--- a/include/cmake.mk
+++ b/include/cmake.mk
@@ -4,6 +4,7 @@ PKG_INSTALL:=1
 
 ifneq ($(findstring c,$(OPENWRT_VERBOSE)),)
   MAKE_FLAGS+=VERBOSE=1
+  HOST_MAKE_FLAGS+=VERBOSE=1
 endif
 
 CMAKE_BINARY_DIR = $(PKG_BUILD_DIR)$(if $(CMAKE_BINARY_SUBDIR),/$(CMAKE_BINARY_SUBDIR))
diff --git a/include/prereq-build.mk b/include/prereq-build.mk
index f67a01299e..8181812599 100644
--- a/include/prereq-build.mk
+++ b/include/prereq-build.mk
@@ -125,7 +125,8 @@ $(eval $(call SetupHostCommand,egrep,Please install GNU 'grep', \
 $(eval $(call SetupHostCommand,getopt, \
 	Please install an extended getopt version that supports --long, \
 	gnugetopt -o t --long test -- --test | grep '^ *--test *--', \
-	getopt -o t --long test -- --test | grep '^ *--test *--'))
+	getopt -o t --long test -- --test | grep '^ *--test *--', \
+	/usr/local/opt/gnu-getopt/bin/getopt -o t --long test -- --test | grep '^ *--test *--'))
 
 $(eval $(call SetupHostCommand,stat,Cannot find a file stat utility, \
 	gnustat -c%s $(TOPDIR)/Makefile, \
diff --git a/include/toplevel.mk b/include/toplevel.mk
index 84b5b6526c..6b51b51bf7 100644
--- a/include/toplevel.mk
+++ b/include/toplevel.mk
@@ -29,6 +29,12 @@ export GNU_HOST_NAME:=$(shell $(TOPDIR)/scripts/config.guess)
 export HOST_OS:=$(shell uname)
 export HOST_ARCH:=$(shell uname -m)
 
+ifeq ($(HOST_OS),Darwin)
+  ifneq ($(filter /Applications/Xcode.app/% /Library/Developer/%,$(MAKE)),)
+    $(error Please use a newer version of GNU make. The version shipped by Apple is not supported)
+  endif
+endif
+
 # prevent perforce from messing with the patch utility
 unexport P4PORT P4USER P4CONFIG P4CLIENT
 
diff --git a/package/base-files/files/etc/rc.common b/package/base-files/files/etc/rc.common
index d3d91ef250..f39b69464e 100755
--- a/package/base-files/files/etc/rc.common
+++ b/package/base-files/files/etc/rc.common
@@ -62,15 +62,15 @@ depends() {
 	return 0
 }
 
-EXTRA_HELP=""
-EXTRA_COMMANDS="boot shutdown depends"
+ALL_HELP=""
+ALL_COMMANDS="boot shutdown depends"
 extra_command() {
 	local cmd="$1"
 	local help="$2"
 
 	local extra="$(printf "%-16s%s" "${cmd}" "${help}")"
-	EXTRA_HELP="${EXTRA_HELP}\t${extra}\n"
-	EXTRA_COMMANDS="${EXTRA_COMMANDS} ${cmd}"
+	ALL_HELP="${ALL_HELP}\t${extra}\n"
+	ALL_COMMANDS="${ALL_COMMANDS} ${cmd}"
 }
 
 help() {
@@ -79,7 +79,7 @@ Syntax: $initscript [command]
 
 Available commands:
 EOF
-	echo -e "$EXTRA_HELP"
+	echo -e "$ALL_HELP"
 }
 
 # for procd
@@ -175,6 +175,7 @@ extra_command "enabled" "Check if service is started on boot"
 	}
 }
 
-ALL_COMMANDS="${EXTRA_COMMANDS}"
+ALL_COMMANDS="${ALL_COMMANDS} ${EXTRA_COMMANDS}"
+ALL_HELP="${ALL_HELP}${EXTRA_HELP}"
 list_contains ALL_COMMANDS "$action" || action=help
 $action "$@"
diff --git a/package/ctcgfw/luci-app-diskman/luasrc/model/diskman.lua b/package/ctcgfw/luci-app-diskman/luasrc/model/diskman.lua
index 27698cf28d..dd10876585 100644
--- a/package/ctcgfw/luci-app-diskman/luasrc/model/diskman.lua
+++ b/package/ctcgfw/luci-app-diskman/luasrc/model/diskman.lua
@@ -412,8 +412,8 @@ d.list_devices = function()
   for i, bname in pairs(target_devnames) do
     local device_info = {}
     local device = "/dev/" .. bname
-    local size = tonumber(fs.readfile(string.format("/sys/class/block/%s/size", bname)))
-    local ss = tonumber(fs.readfile(string.format("/sys/class/block/%s/queue/logical_block_size", bname)))
+    local size = tonumber(fs.readfile(string.format("/sys/class/block/%s/size", bname)) or "0")
+    local ss = tonumber(fs.readfile(string.format("/sys/class/block/%s/queue/logical_block_size", bname)) or "0")
     local model = fs.readfile(string.format("/sys/class/block/%s/device/model", bname))
     local partitions = {}
     for part in nixio.fs.glob("/sys/block/" .. bname .."/" .. bname .. "*") do
diff --git a/package/ctcgfw/luci-app-serverchan/root/usr/bin/serverchan/serverchan b/package/ctcgfw/luci-app-serverchan/root/usr/bin/serverchan/serverchan
index 19b62f7382..99273b7be1 100755
--- a/package/ctcgfw/luci-app-serverchan/root/usr/bin/serverchan/serverchan
+++ b/package/ctcgfw/luci-app-serverchan/root/usr/bin/serverchan/serverchan
@@ -907,6 +907,7 @@ function send(){
 	[ -z "$send_content" ] && local send_content="${markdown_splitline}#### 我遇到了一个难题${markdown_linefeed}${markdown_tab}定时发送选项错误，你没有选择需要发送的项目，该怎么办呢${markdown_splitline}"
 	local nowtime=`date "+%Y-%m-%d %H:%M:%S"`
 	[ "$send_disturb" -eq "0" ] && [ -z "$send_tg" ] && curl -s "http://sc.ftqq.com/${sckey}.send?text=${send_title}" -d "&desp=${nowtime}${markdown_linefeed}${send_content}" >/dev/null 2>&1
+	[ "$send_disturb" -eq "0" ] && [ ! -z "$send_tg" ] && [ "$send_tg" -eq "2" ] && curl -s "http://sctapi.ftqq.com/${sctkey}.send?text=${send_title}" -d "desp=${nowtime}${markdown_linefeed}${send_content}" >/dev/null 2>&1
 	[ "$send_disturb" -eq "0" ] && [ ! -z "$send_tg" ] && [ "$send_tg" -eq "1" ] && curl -d "text=${send_title}${markdown_linefeed}${nowtime}${markdown_linefeed}${send_content}" -X POST "${tgtoken}" >/dev/null 2>&1
 	deltemp
 	echo "`date "+%Y-%m-%d %H:%M:%S"` ${disturb_text}定时推送任务完成" >> ${logfile}
diff --git a/package/ctcgfw/open-app-filter/Makefile b/package/ctcgfw/open-app-filter/Makefile
index 55cc07b96a..7da4cad0f0 100755
--- a/package/ctcgfw/open-app-filter/Makefile
+++ b/package/ctcgfw/open-app-filter/Makefile
@@ -14,6 +14,7 @@ include $(INCLUDE_DIR)/package.mk
 define Package/appfilter
   SECTION:=net
   CATEGORY:=Network
+  DEPENDS:=+libubox-lua
   TITLE:=App filter userspace module
 endef
 
@@ -39,6 +40,7 @@ define Package/appfilter/install
 	$(INSTALL_BIN) ./files/appfilter.init $(1)/etc/init.d/appfilter
 	$(INSTALL_BIN) ./files/appfilter.sh $(1)/usr/bin
 	$(INSTALL_BIN) ./files/gen_class.sh $(1)/usr/bin
+	$(INSTALL_BIN) ./files/appfilter.lua $(1)/usr/bin/appfilter
 	$(INSTALL_BIN) ./files/appfilter.config $(1)/etc/config/appfilter
 endef
 
diff --git a/package/ctcgfw/open-app-filter/files/appfilter.init b/package/ctcgfw/open-app-filter/files/appfilter.init
index a7fa773b20..089e72ec9a 100755
--- a/package/ctcgfw/open-app-filter/files/appfilter.init
+++ b/package/ctcgfw/open-app-filter/files/appfilter.init
@@ -5,6 +5,7 @@ start() {
 	lsmod | grep -q oaf 2>/dev/null || modprobe oaf
 	gen_class.sh /etc/appfilter/feature.cfg
 	appfilter.sh
+	/usr/bin/appfilter &
 }
 
 stop() {
diff --git a/package/ctcgfw/open-app-filter/files/appfilter.lua b/package/ctcgfw/open-app-filter/files/appfilter.lua
new file mode 100644
index 0000000000..8cea8966f0
--- /dev/null
+++ b/package/ctcgfw/open-app-filter/files/appfilter.lua
@@ -0,0 +1,262 @@
+#!/usr/bin/lua
+
+local libubus = require "ubus"
+local uloop = require "uloop"
+
+local UBUS_STATUS_OK = 0
+local UBUS_STATUS_INVALID_COMMAND = 1
+local UBUS_STATUS_INVALID_ARGUMENT = 2
+local UBUS_STATUS_METHOD_NOT_FOUND = 3
+local UBUS_STATUS_NOT_FOUND = 4
+local UBUS_STATUS_NO_DATA = 5
+local UBUS_STATUS_PERMISSION_DENIED = 6
+local UBUS_STATUS_TIMEOUT = 7
+local UBUS_STATUS_NOT_SUPPORTED = 8
+local UBUS_STATUS_UNKNOWN_ERROR = 9
+local UBUS_STATUS_CONNECTION_FAILED = 10
+local UBUS_STATUS_ALREADY_EXISTS = 11
+
+local cfg_file = "/etc/appfilter/feature.cfg"
+
+local cfg = {}
+local class = {}
+local ubus
+
+cfg.__index = cfg
+class.__index = class
+function cfg:init(file)
+    local f = io.open(file, "r")
+    local t = {}
+    local t2 = {}
+    if f then
+        for line in f:lines() do
+            table.insert(t, line)
+            local tt = line:match("#class (%S+)")
+            if tt then 
+                table.insert(t2, tt)
+            end
+        end
+        setmetatable(t, self)
+        setmetatable(t2, self)
+        return t,t2
+    end
+    return nil
+end
+
+function cfg:lookup(o)
+    if not o then return UBUS_STATUS_INVALID_ARGUMENT end
+	local tab = self
+    for _, v in ipairs(tab) do
+        if v:match(o) then
+            if v:match("#class") then
+                local tt = {}
+                local t2 = {}
+                local found
+                for _, t in ipairs(tab) do
+                    repeat
+                        if t:match(o) then
+                            found = true
+                            table.insert(tt, t)
+                            break
+                        end
+
+                        if t:match("#class") then
+                            found = false
+                            table.insert(t2, t)
+                            break
+                        end
+
+                        if found then
+                            table.insert(tt, t)
+                        else
+                            table.insert(t2, t)
+                        end
+                    until true
+                end
+                setmetatable(tt,  self)
+                setmetatable(t2, self)
+                return tt, t2
+            else
+                return v
+            end
+        end
+    end
+    return nil
+end
+
+function cfg:lookup_class(m)
+    if not m then return UBUS_STATUS_INVALID_ARGUMENT end
+	local t1, t2 = self:lookup(m)
+	if type(t1) ~= "table" then return nil end
+	return t1, t2
+end
+
+function cfg:add_class(m)
+    if not m then return UBUS_STATUS_INVALID_ARGUMENT end
+    local f = io.open(cfg_file, "r+")
+    local tab = self
+    if f then
+        io.output(f)
+        for _, v in ipairs(tab) do
+            io.write(v)
+            io.write("\n")
+        end
+        io.write("#class "..m)
+        f:flush()
+        f:close()
+        return UBUS_STATUS_OK
+    else
+        return UBUS_STATUS_NOT_FOUND
+    end
+end
+
+function cfg:add_app(m, name, proto, sport, dport, url, request, dict)
+    if not name then return UBUS_STATUS_INVALID_ARGUMENT end
+	local id
+	local offset
+    local f = io.open(cfg_file, "r+")
+    io.output(f)
+    local t1,t2 = self:lookup_class(m)
+    if t1[#t1] == nil or "" then
+    	offset = 0
+    	id = math.modf(string.match(t1[#t1-1], "(%d+) %S+:") +1)
+    else
+		offset = 1
+		id = math.modf(string.match(t1[#t1], "(%d+) %S+:") +1)
+    end
+     
+    local str = string.format("%d %s:[%s;%s;%s;%s;%s;%s]", id, name, proto, sport or "", dport or "", url or "", request or "", dict or "")
+    table.insert(t1, #t1+offset, str)
+    if f then
+        for _, v in ipairs(t2) do
+			if v then
+				io.write(v)
+				io.write("\n")
+            end
+        end
+        for _, v in ipairs(t1) do
+			if v then
+				io.write(v)
+				io.write("\n")
+            end
+        end
+        f:flush()
+        f:close()
+    end
+    return id
+end
+
+function cfg:del_app(id, name)
+    local t = self
+    local f = io.open(cfg_file, "r+")
+    local ret
+    if id then
+        for i, v in ipairs(t) do
+            if v:match(id) then
+                table.remove(t, i)
+                ret = i
+            end
+        end
+
+    end
+
+    if name then
+        for i, v in ipairs(t) do
+            if v:match(name) then
+                table.remove(t, i)
+                ret = i
+            end
+        end
+    end
+
+    if f then
+        io.output(f)
+        for _, v in ipairs(t) do
+            io.write(v)
+            io.write("\n")
+        end
+        f:flush()
+        f:close()
+    end
+    return ret
+end
+
+local methods = {
+	["appfilter"] = {
+		add_class = {
+            function(req, msg)
+                if not msg.class then return UBUS_STATUS_INVALID_ARGUMENT end
+                local t = cfg:init(cfg_file)
+                local ret
+                if t:lookup_class(msg.class) then return ubus.reply(req, {ret = UBUS_STATUS_ALREADY_EXISTS}) end
+                ret = t:add_class(msg.class)
+				ubus.reply(req, {msg = ret})
+			end, {class = libubus.STRING}
+        },
+        add_app = {
+            function (req, msg)
+                if not msg.class then return UBUS_STATUS_INVALID_ARGUMENT end
+                if not msg.name then return UBUS_STATUS_INVALID_ARGUMENT end
+				if not msg.proto then return UBUS_STATUS_INVALID_ARGUMENT end
+                local t = cfg:init(cfg_file)
+                local ret
+                if t:lookup(msg.name) then return ubus.reply(req, {ret = UBUS_STATUS_ALREADY_EXISTS}) end
+                ret = t:add_app(msg.class, msg.name, msg.proto, msg.sport, msg.dport, msg.url, msg.request, msg.dict)
+                ubus.reply(req, {ret = ret})
+            end,{class = libubus.STRING, name = libubus.STRING, proto = libubus.STRING, sport = libubus.INT32, dport = libubus.INT32, url = libubus.STRING, request = libubus.STRING, dict = libubus.STRING}
+        },
+        del_app = {
+            function(req, msg)
+                local t = cfg:init(cfg_file)
+                local ret = t:del_app(msg.id, msg.name)
+                ubus.reply(req, {ret = ret})
+            end,{id = libubus.INT32, name = libubus.STRING}
+        },
+        list_class = {
+            function (req, msg)
+                local _, c = cfg:init(cfg_file)
+                ubus.reply(req, {result = c})
+            end,{}
+        },
+        list_app = {
+            function (req, msg)
+                if not msg.class then return UBUS_STATUS_INVALID_ARGUMENT end
+                local t  = cfg:init(cfg_file)
+                local ret = {}
+                for i, v in ipairs(t:lookup_class(msg.class)) do
+					if not v:match("#class") then
+						local id, name = v:match("(%d+) (%S+):%[")
+						ret[i-1] = {id = id,  name = name}
+					end
+                end
+                ubus.reply(req, {result = ret})
+            end,{class = libubus.STRING}
+        }
+	}
+}
+
+function ubus_init()
+    local conn = libubus.connect()
+    if not conn then
+        error("Failed to connect to ubus")
+    end
+
+    conn:add(methods)
+
+    return {
+        call = function(object, method, params)
+            return conn:call(object, method, params or {})
+        end,
+        reply = function(req, msg)
+            conn:reply(req, msg)
+        end
+    }
+end
+
+local function main()
+    uloop.init()
+    ubus = ubus_init()
+    uloop.run()
+end
+
+main()
\ No newline at end of file
diff --git a/package/ctcgfw/r8152/Makefile b/package/ctcgfw/r8152/Makefile
new file mode 100644
index 0000000000..396bfa526e
--- /dev/null
+++ b/package/ctcgfw/r8152/Makefile
@@ -0,0 +1,52 @@
+#Download realtek r8152 linux driver from official site [https://www.realtek.com/en/component/zoo/category/network-interface-controllers-10-100-1000m-gigabit-ethernet-usb-3-0-software]
+#Unpack source file
+#Replace orginal Makefile with this file
+#Put this source to 'package' folder of OpenWRT/LEDE SDK
+#Build(make menuconfig, make defconfig, make)
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=r8152
+PKG_VERSION:=2.14
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/wget/realtek-r8152-linux/tar.gz/v$(PKG_VERSION)?
+PKG_HASH:=617c159eb72355c240be3f78971e5a01c9dffe5545a7ae76bb2bd87bb7a346ed
+
+PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/realtek-$(PKG_NAME)-linux-$(PKG_VERSION)
+
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/usb-net-rtl8152-vendor
+  TITLE:=Kernel module for USB-to-Ethernet Realtek convertors
+  SUBMENU:=USB Support
+  VERSION:=$(LINUX_VERSION)+$(PKG_VERSION)-$(BOARD)-$(PKG_RELEASE)
+  DEPENDS:=+kmod-usb-net
+  CONFLICTS:=kmod-usb-net-rtl8152
+  FILES:= $(PKG_BUILD_DIR)/r8152.ko
+  AUTOLOAD:=$(call AutoProbe,r8152)
+endef
+
+define KernelPackage/usb-net-rtl8152-vendor/description
+ Kernel module for Realtek RTL8152/RTL8153 Based USB Ethernet Adapters
+endef
+
+R8152_MAKEOPTS= -C $(PKG_BUILD_DIR) \
+		PATH="$(TARGET_PATH)" \
+		ARCH="$(LINUX_KARCH)" \
+		CROSS_COMPILE="$(TARGET_CROSS)" \
+		TARGET="$(HAL_TARGET)" \
+		TOOLPREFIX="$(KERNEL_CROSS)" \
+		TOOLPATH="$(KERNEL_CROSS)" \
+		KERNELPATH="$(LINUX_DIR)" \
+		KERNELDIR="$(LINUX_DIR)" \
+		LDOPTS=" " \
+		DOMULTI=1
+
+define Build/Compile
+	+$(MAKE) $(PKG_JOBS) $(R8152_MAKEOPTS) modules
+endef
+
+$(eval $(call KernelPackage,usb-net-rtl8152-vendor))
diff --git a/package/ctcgfw/r8152/patches/100-add-LED-configuration-from-OF.patch b/package/ctcgfw/r8152/patches/100-add-LED-configuration-from-OF.patch
new file mode 100644
index 0000000000..415a42a093
--- /dev/null
+++ b/package/ctcgfw/r8152/patches/100-add-LED-configuration-from-OF.patch
@@ -0,0 +1,74 @@
+From 82985725e071f2a5735052f18e109a32aeac3a0b Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sun, 26 Jul 2020 02:38:31 +0200
+Subject: [PATCH] add LED configuration from OF
+
+This adds the ability to configure the LED configuration register using
+OF. This way, the correct value for board specific LED configuration can
+be determined.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ r8152.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+--- a/r8152.c
++++ b/r8152.c
+@@ -17,6 +17,7 @@
+ #include <linux/mii.h>
+ #include <linux/ethtool.h>
+ #include <linux/usb.h>
++#include <linux/of.h>
+ #include <linux/crc32.h>
+ #include <linux/if_vlan.h>
+ #include <linux/uaccess.h>
+@@ -9736,6 +9737,22 @@ static void rtl_tally_reset(struct r8152
+ 	ocp_write_word(tp, MCU_TYPE_PLA, PLA_RSTTALLY, ocp_data);
+ }
+ 
++static int r8152_led_configuration(struct r8152 *tp)
++{
++	u32 led_data;
++	int ret;
++
++	ret = of_property_read_u32(tp->udev->dev.of_node, "realtek,led-data",
++								&led_data);
++
++	if (ret)
++		return ret;
++	
++	ocp_write_word(tp, MCU_TYPE_PLA, PLA_LEDSEL, led_data);
++
++	return 0;
++}
++
+ static void r8152b_init(struct r8152 *tp)
+ {
+ 	u32 ocp_data;
+@@ -9797,6 +9814,8 @@ static void r8152b_init(struct r8152 *tp
+ 	ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_USB_CTRL);
+ 	ocp_data &= ~(RX_AGG_DISABLE | RX_ZERO_EN);
+ 	ocp_write_word(tp, MCU_TYPE_USB, USB_USB_CTRL, ocp_data);
++
++	r8152_led_configuration(tp);
+ }
+ 
+ static void r8153_init(struct r8152 *tp)
+@@ -9937,6 +9956,8 @@ static void r8153_init(struct r8152 *tp)
+ 		tp->coalesce = COALESCE_SLOW;
+ 		break;
+ 	}
++
++	r8152_led_configuration(tp);
+ }
+ 
+ static void r8153b_init(struct r8152 *tp)
+@@ -10026,6 +10047,8 @@ static void r8153b_init(struct r8152 *tp
+ 	rtl_tally_reset(tp);
+ 
+ 	tp->coalesce = 15000;	/* 15 us */
++
++	r8152_led_configuration(tp);
+ }
+ 
+ static void r8153c_init(struct r8152 *tp)
diff --git a/package/devel/strace/Makefile b/package/devel/strace/Makefile
index 1a0c0f442f..9ea28735a1 100644
--- a/package/devel/strace/Makefile
+++ b/package/devel/strace/Makefile
@@ -9,12 +9,12 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=strace
-PKG_VERSION:=5.8
+PKG_VERSION:=5.9
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://strace.io/files/$(PKG_VERSION)
-PKG_HASH:=df4a669f7fff9cc302784085bd4b72fab216a426a3f72c892b28a537b71e7aa9
+PKG_HASH:=39473eb8465546c3e940fb663cb381eba5613160c7302794699d194a4d5d66d9
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=LGPL-2.1-or-later
diff --git a/package/devel/valgrind/Makefile b/package/devel/valgrind/Makefile
index ecb4af8b35..829f37569e 100644
--- a/package/devel/valgrind/Makefile
+++ b/package/devel/valgrind/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=valgrind
-PKG_VERSION:=3.15.0
-PKG_RELEASE:=2
+PKG_VERSION:=3.16.1
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=http://sourceware.org/pub/valgrind/
-PKG_HASH:=417c7a9da8f60dd05698b3a7bc6002e4ef996f14c13f0ff96679a16873e78ab1
+PKG_HASH:=c91f3a2f7b02db0f3bc99479861656154d241d2fdb265614ba918cc6720a33ca
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=GPL-2.0+
diff --git a/package/devel/valgrind/patches/100-fix_configure_check.patch b/package/devel/valgrind/patches/100-fix_configure_check.patch
index 270181ae37..6e9384ff88 100644
--- a/package/devel/valgrind/patches/100-fix_configure_check.patch
+++ b/package/devel/valgrind/patches/100-fix_configure_check.patch
@@ -1,6 +1,6 @@
 --- a/configure.ac
 +++ b/configure.ac
-@@ -341,7 +341,7 @@ case "${host_os}" in
+@@ -345,7 +345,7 @@ case "${host_os}" in
          # Ok, this is linux. Check the kernel version
          AC_MSG_CHECKING([for the kernel version])
  
diff --git a/package/lean/frp/Makefile b/package/lean/frp/Makefile
index 8bc5e54ba3..d571ae34ff 100644
--- a/package/lean/frp/Makefile
+++ b/package/lean/frp/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=frp
-PKG_VERSION:=0.34.1
+PKG_VERSION:=0.34.2
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/fatedier/frp/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=a47f952cc491a1d5d6f838306f221d6a8635db7cf626453df72fe6531613d560
+PKG_HASH:=53d8c29ef627e544cf8970b0a05570589d5270398068eb162957bdddb36de9ac
 
 PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=LICENSE
diff --git a/package/lean/vsftpd-alt/files/vsftpd_prepare b/package/lean/vsftpd-alt/files/vsftpd_prepare
index 29169ab33c..612e90b5aa 100755
--- a/package/lean/vsftpd-alt/files/vsftpd_prepare
+++ b/package/lean/vsftpd-alt/files/vsftpd_prepare
@@ -253,5 +253,6 @@ else
 fi
 
 output_const "seccomp_sandbox" NO
+output_const "use_localtime" YES
 
 exit 0
diff --git a/package/libs/libjson-c/Makefile b/package/libs/libjson-c/Makefile
index c8a514a147..13cf955960 100644
--- a/package/libs/libjson-c/Makefile
+++ b/package/libs/libjson-c/Makefile
@@ -27,6 +27,11 @@ include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/host-build.mk
 include $(INCLUDE_DIR)/cmake.mk
 
+CMAKE_HOST_OPTIONS += \
+	-DCMAKE_SKIP_RPATH=FALSE \
+	-DCMAKE_MACOSX_RPATH=1 \
+	-DCMAKE_INSTALL_RPATH="${STAGING_DIR_HOST}/lib"
+
 define Package/libjson-c
   SECTION:=libs
   CATEGORY:=Libraries
diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile
index 1ecca2feb1..8520426382 100644
--- a/package/network/services/dropbear/Makefile
+++ b/package/network/services/dropbear/Makefile
@@ -8,14 +8,14 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dropbear
-PKG_VERSION:=2020.80
-PKG_RELEASE:=4
+PKG_VERSION:=2020.81
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:= \
 	http://matt.ucc.asn.au/dropbear/releases/ \
 	https://dropbear.nl/mirror/releases/
-PKG_HASH:=d927941b91f2da150b2033f1a88b6a47999bf0afb1493a73e9216cffdb5d7949
+PKG_HASH:=48235d10b37775dbda59341ac0c4b239b82ad6318c31568b985730c788aac53b
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE libtomcrypt/LICENSE libtommath/LICENSE
diff --git a/package/network/services/dropbear/patches/110-change_user.patch b/package/network/services/dropbear/patches/110-change_user.patch
index f66b319100..1dd67948af 100644
--- a/package/network/services/dropbear/patches/110-change_user.patch
+++ b/package/network/services/dropbear/patches/110-change_user.patch
@@ -1,6 +1,6 @@
 --- a/svr-chansession.c
 +++ b/svr-chansession.c
-@@ -950,12 +950,12 @@ static void execchild(const void *user_d
+@@ -954,12 +954,12 @@ static void execchild(const void *user_d
  	/* We can only change uid/gid as root ... */
  	if (getuid() == 0) {
  
diff --git a/package/network/services/dropbear/patches/160-lto-jobserver.patch b/package/network/services/dropbear/patches/160-lto-jobserver.patch
index dbba613ac3..1ba7dd6f44 100644
--- a/package/network/services/dropbear/patches/160-lto-jobserver.patch
+++ b/package/network/services/dropbear/patches/160-lto-jobserver.patch
@@ -1,6 +1,6 @@
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -199,17 +199,17 @@ dropbearkey: $(dropbearkeyobjs)
+@@ -198,17 +198,17 @@ dropbearkey: $(dropbearkeyobjs)
  dropbearconvert: $(dropbearconvertobjs)
  
  dropbear: $(HEADERS) $(LIBTOM_DEPS) Makefile
@@ -22,7 +22,7 @@
  
  
  # multi-binary compilation.
-@@ -220,7 +220,7 @@ ifeq ($(MULTI),1)
+@@ -219,7 +219,7 @@ ifeq ($(MULTI),1)
  endif
  
  dropbearmulti$(EXEEXT): $(HEADERS) $(MULTIOBJS) $(LIBTOM_DEPS) Makefile
diff --git a/package/network/services/dropbear/patches/910-signkey-fix-use-of-rsa-sha2-256-pubkeys.patch b/package/network/services/dropbear/patches/910-signkey-fix-use-of-rsa-sha2-256-pubkeys.patch
index afa0ebb310..b774a38b1a 100644
--- a/package/network/services/dropbear/patches/910-signkey-fix-use-of-rsa-sha2-256-pubkeys.patch
+++ b/package/network/services/dropbear/patches/910-signkey-fix-use-of-rsa-sha2-256-pubkeys.patch
@@ -19,11 +19,9 @@ Signed-off-by: Petr Štetiar <ynezz@true.cz>
  signkey.c | 8 ++++++--
  1 file changed, 6 insertions(+), 2 deletions(-)
 
-diff --git a/signkey.c b/signkey.c
-index 92fe6a242cd0..d16ab174d83a 100644
 --- a/signkey.c
 +++ b/signkey.c
-@@ -657,8 +657,12 @@ int buf_verify(buffer * buf, sign_key *key, enum signature_type expect_sigtype,
+@@ -657,8 +657,12 @@ int buf_verify(buffer * buf, sign_key *k
  	sigtype = signature_type_from_name(type_name, type_name_len);
  	m_free(type_name);
  
diff --git a/package/network/services/odhcpd/Makefile b/package/network/services/odhcpd/Makefile
index 3f73141c44..9a4cd19bef 100644
--- a/package/network/services/odhcpd/Makefile
+++ b/package/network/services/odhcpd/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=odhcpd
-PKG_RELEASE:=4
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/odhcpd.git
-PKG_SOURCE_DATE:=2020-11-01
-PKG_SOURCE_VERSION:=735c7836bfcc08f3ecd8cdaf1368665b8a241b94
-PKG_MIRROR_HASH:=887a2c07375dc5127b31edd71c281f48962d8a40e64995401baf648ed4c94b95
+PKG_SOURCE_DATE:=2020-11-15
+PKG_SOURCE_VERSION:=fb55e80394c51d7502bb278f57520dec15a11355
+PKG_MIRROR_HASH:=631d15fd7c93529fa33433380c4811dbacca9665864e5836c6daca0c7165f25a
 
 PKG_MAINTAINER:=Hans Dedecker <dedeckeh@gmail.com>
 PKG_LICENSE:=GPL-2.0
diff --git a/package/network/utils/ethtool/Makefile b/package/network/utils/ethtool/Makefile
index 6547eee9a5..df8d7ce119 100644
--- a/package/network/utils/ethtool/Makefile
+++ b/package/network/utils/ethtool/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ethtool
-PKG_VERSION:=5.8
+PKG_VERSION:=5.9
 PKG_RELEASE:=1
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/software/network/ethtool
-PKG_HASH:=2f3b54d08d048f5977b80cb6cb4744994370def7553ee634d39dbbb6ccf87546
+PKG_HASH:=512932010af87bc3e09773c89baea44bca96c1da1151bbcf109fa0e055a88a6f
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=COPYING
diff --git a/package/network/utils/iperf3/Makefile b/package/network/utils/iperf3/Makefile
index ab946c2590..6f90bc9221 100644
--- a/package/network/utils/iperf3/Makefile
+++ b/package/network/utils/iperf3/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=iperf
-PKG_VERSION:=3.7
+PKG_VERSION:=3.9
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://downloads.es.net/pub/iperf
-PKG_HASH:=d846040224317caf2f75c843d309a950a7db23f9b44b94688ccbe557d6d1710c
+PKG_HASH:=24b63a26382325f759f11d421779a937b63ca1bc17c44587d2fcfedab60ac038
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=BSD-3-Clause
diff --git a/package/network/utils/wireguard-tools/Makefile b/package/network/utils/wireguard-tools/Makefile
index a5264a50b4..3cdbaa785c 100644
--- a/package/network/utils/wireguard-tools/Makefile
+++ b/package/network/utils/wireguard-tools/Makefile
@@ -30,13 +30,22 @@ MAKE_PATH:=src
 MAKE_VARS += PLATFORM=linux
 
 define Package/wireguard-tools
-  $(call Package/wireguard/Default)
+  SECTION:=net
+  CATEGORY:=Network
+  SUBMENU:=VPN
+  URL:=https://www.wireguard.com
+  MAINTAINER:=Jason A. Donenfeld <Jason@zx2c4.com>
   TITLE:=WireGuard userspace control program (wg)
-  DEPENDS:=+ip
+  DEPENDS:=+@BUSYBOX_CONFIG_IP +@BUSYBOX_CONFIG_FEATURE_IP_LINK
 endef
 
 define Package/wireguard-tools/description
-  $(call Package/wireguard/Default/description)
+  WireGuard is a novel VPN that runs inside the Linux Kernel and utilizes
+  state-of-the-art cryptography. It aims to be faster, simpler, leaner, and
+  more useful than IPSec, while avoiding the massive headache. It intends to
+  be considerably more performant than OpenVPN.  WireGuard is designed as a
+  general purpose VPN for running on embedded interfaces and super computers
+  alike, fit for many different circumstances. It uses UDP.
 
   This package provides the userspace control program for WireGuard,
   `wg(8)`, a netifd protocol helper, and a re-resolve watchdog script.
diff --git a/package/ntlf9t/AdGuardHome/Makefile b/package/ntlf9t/AdGuardHome/Makefile
index fdb68b7787..fcf996292d 100644
--- a/package/ntlf9t/AdGuardHome/Makefile
+++ b/package/ntlf9t/AdGuardHome/Makefile
@@ -7,13 +7,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=AdGuardHome
-PKG_VERSION:=0.104.0
+PKG_VERSION:=0.104.3
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_VERSION:=v$(PKG_VERSION)
 PKG_SOURCE_URL:=https://github.com/AdguardTeam/AdGuardHome
-PKG_MIRROR_HASH:=852861f83c3788a3913cb953b2eb0e2a94c27e2e158feae8c7485480c1481257
+PKG_MIRROR_HASH:=ec0d48413778267f4ac81091e58a88e5b5ee2f3c1ab48256ded3438bf171d311
 
 PKG_LICENSE:=GPL-3.0-only
 PKG_LICENSE_FILES:=LICENSE.txt
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 9da28baf35..8ffc093548 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -2355,7 +2355,7 @@ sub process {
 	my $commit_log_possible_stack_dump = 0;
 	my $commit_log_long_line = 0;
 	my $commit_log_has_diff = 0;
-	my $reported_maintainer_file = 0;
+	my $reported_maintainer_file = 1;
 	my $non_utf8_charset = 0;
 
 	my $last_blank_line = 0;
diff --git a/scripts/const_structs.checkpatch b/scripts/const_structs.checkpatch
new file mode 100644
index 0000000000..1aae4f4fda
--- /dev/null
+++ b/scripts/const_structs.checkpatch
@@ -0,0 +1,68 @@
+acpi_dock_ops
+address_space_operations
+backlight_ops
+block_device_operations
+clk_ops
+comedi_lrange
+component_ops
+dentry_operations
+dev_pm_ops
+dma_map_ops
+driver_info
+drm_connector_funcs
+drm_encoder_funcs
+drm_encoder_helper_funcs
+ethtool_ops
+extent_io_ops
+file_lock_operations
+file_operations
+hv_ops
+ide_dma_ops
+ide_port_ops
+inode_operations
+intel_dvo_dev_ops
+irq_domain_ops
+item_operations
+iwl_cfg
+iwl_ops
+kgdb_arch
+kgdb_io
+kset_uevent_ops
+lock_manager_operations
+machine_desc
+microcode_ops
+mlxsw_reg_info
+mtrr_ops
+neigh_ops
+net_device_ops
+nlmsvc_binding
+nvkm_device_chip
+of_device_id
+pci_raw_ops
+phy_ops
+pinctrl_ops
+pinmux_ops
+pipe_buf_operations
+platform_hibernation_ops
+platform_suspend_ops
+proto_ops
+regmap_access_table
+regulator_ops
+rpc_pipe_ops
+rtc_class_ops
+sd_desc
+seq_operations
+sirfsoc_padmux
+snd_ac97_build_ops
+snd_soc_component_driver
+soc_pcmcia_socket_ops
+stacktrace_ops
+sysfs_ops
+tty_operations
+uart_ops
+usb_mon_operations
+v4l2_ctrl_ops
+v4l2_ioctl_ops
+vm_operations_struct
+wacom_features
+wd_ops
diff --git a/scripts/download.pl b/scripts/download.pl
index 02ef7de4da..910e1e3a94 100755
--- a/scripts/download.pl
+++ b/scripts/download.pl
@@ -93,6 +93,7 @@ $hash_cmd or ($file_hash eq "skip") or die "Cannot find appropriate hash command
 sub download
 {
 	my $mirror = shift;
+	my $download_filename = shift;
 
 	$mirror =~ s!/$!!;
 
@@ -139,7 +140,7 @@ sub download
 			}
 		};
 	} else {
-		my @cmd = download_cmd("$mirror/$url_filename");
+		my @cmd = download_cmd("$mirror/$download_filename");
 		print STDERR "+ ".join(" ",@cmd)."\n";
 		open(FETCH_FD, '-|', @cmd) or die "Cannot launch curl or wget.\n";
 		$hash_cmd and do {
@@ -280,7 +281,10 @@ while (!-f "$target/$filename") {
 	my $mirror = shift @mirrors;
 	$mirror or die "No more mirrors to try - giving up.\n";
 
-	download($mirror);
+	download($mirror, $url_filename);
+	if (!-f "$target/$filename" && $url_filename ne $filename) {
+		download($mirror, $filename);
+	}
 }
 
 $SIG{INT} = \&cleanup;
diff --git a/target/imagebuilder/Makefile b/target/imagebuilder/Makefile
index 5a4790ba5a..de8a67ef99 100644
--- a/target/imagebuilder/Makefile
+++ b/target/imagebuilder/Makefile
@@ -61,6 +61,14 @@ else
 		-exec $(CP) -t $(IB_LDIR)/ {} +
 endif
 
+ifneq ($(CONFIG_SIGNATURE_CHECK),)
+	echo ''                                                        >> $(PKG_BUILD_DIR)/repositories.conf
+	echo 'option check_signature'                                  >> $(PKG_BUILD_DIR)/repositories.conf
+	$(INSTALL_DIR) $(PKG_BUILD_DIR)/keys
+	$(CP) -L $(STAGING_DIR_ROOT)/etc/opkg/keys/ $(PKG_BUILD_DIR)/
+	$(CP) -L $(STAGING_DIR_ROOT)/usr/sbin/opkg-key $(PKG_BUILD_DIR)/scripts/
+endif
+
 	$(CP) $(TOPDIR)/target/linux $(PKG_BUILD_DIR)/target/
 	if [ -d $(TOPDIR)/staging_dir/host/lib/grub ]; then \
 		$(CP) $(TOPDIR)/staging_dir/host/lib/grub/ $(PKG_BUILD_DIR)/staging_dir/host/lib; \
diff --git a/target/imagebuilder/files/Makefile b/target/imagebuilder/files/Makefile
index fd7aa9190f..b3edf5bc9d 100644
--- a/target/imagebuilder/files/Makefile
+++ b/target/imagebuilder/files/Makefile
@@ -45,6 +45,7 @@ Building images:
 	make image FILES="<path>" # include extra files from <path>
 	make image BIN_DIR="<path>" # alternative output directory for the images
 	make image EXTRA_IMAGE_NAME="<string>" # Add this to the output image filename (sanitized)
+	make image ADD_LOCAL_KEY=1 # store locally generated signing key in built images
 
 Print manifest:
 	List "all" packages which get installed into the image.
@@ -63,8 +64,10 @@ help: FORCE
 # override variables from rules.mk
 PACKAGE_DIR:=$(TOPDIR)/packages
 LISTS_DIR:=$(subst $(space),/,$(patsubst %,..,$(subst /,$(space),$(TARGET_DIR))))$(DL_DIR)
+export OPKG_KEYS:=$(TOPDIR)/keys
 OPKG:=$(call opkg,$(TARGET_DIR)) \
 	-f $(TOPDIR)/repositories.conf \
+	--verify-program $(SCRIPT_DIR)/opkg-key \
 	--cache $(DL_DIR) \
 	--lists-dir $(LISTS_DIR)
 
@@ -129,7 +132,9 @@ package_index: FORCE
 	@echo Building package index... >&2
 	@mkdir -p $(TMP_DIR) $(TARGET_DIR)/tmp
 	(cd $(PACKAGE_DIR); $(SCRIPT_DIR)/ipkg-make-index.sh . > Packages && \
-		gzip -9nc Packages > Packages.gz \
+		gzip -9nc Packages > Packages.gz; \
+		$(if $(CONFIG_SIGNATURE_CHECK), \
+			$(STAGING_DIR_HOST)/bin/usign -S -m Packages -s $(BUILD_KEY)); \
 	) >/dev/null 2>/dev/null
 	$(OPKG) update >&2 || true
 
@@ -161,9 +166,14 @@ prepare_rootfs: FORCE
 	@echo Finalizing root filesystem...
 
 	$(CP) $(TARGET_DIR) $(TARGET_DIR_ORIG)
+	$(if $(CONFIG_SIGNATURE_CHECK), \
+		$(if $(ADD_LOCAL_KEY), \
+			OPKG_KEYS=$(TARGET_DIR)/etc/opkg/keys/ \
+			$(SCRIPT_DIR)/opkg-key add $(BUILD_KEY).pub \
+		) \
+	)
 	$(call prepare_rootfs,$(TARGET_DIR),$(USER_FILES))
 
-
 build_image: FORCE
 	@echo
 	@echo Building images...
@@ -202,8 +212,26 @@ ifneq ($(PROFILE),)
   endif
 endif
 
+_check_keys: FORCE
+ifneq ($(CONFIG_SIGNATURE_CHECK),)
+	@if [ ! -s $(BUILD_KEY) -o ! -s $(BUILD_KEY).pub ]; then \
+		echo Generate local signing keys... >&2; \
+		$(STAGING_DIR_HOST)/bin/usign -G \
+			-s $(BUILD_KEY) -p $(BUILD_KEY).pub -c "Local build key"; \
+		$(SCRIPT_DIR)/opkg-key add $(BUILD_KEY).pub; \
+	fi
+	if [ ! -s $(BUILD_KEY).ucert ]; then \
+		echo Generate local certificate... >&2; \
+		$(STAGING_DIR_HOST)/bin/ucert -I \
+			-c $(BUILD_KEY).ucert \
+			-p $(BUILD_KEY).pub \
+			-s $(BUILD_KEY); \
+	fi
+endif
+
 image:
 	$(MAKE) -s _check_profile
+	$(MAKE) -s _check_keys
 	(unset PROFILE FILES PACKAGES MAKEFLAGS; \
 	$(MAKE) -s _call_image \
 		$(if $(PROFILE),USER_PROFILE="$(PROFILE_FILTER)") \
@@ -213,6 +241,7 @@ image:
 
 manifest: FORCE
 	$(MAKE) -s _check_profile
+	$(MAKE) -s _check_keys
 	(unset PROFILE FILES PACKAGES MAKEFLAGS; \
 	$(MAKE) -s _call_manifest \
 		$(if $(PROFILE),USER_PROFILE="$(PROFILE_FILTER)") \
diff --git a/target/linux/bcm27xx/image/Makefile b/target/linux/bcm27xx/image/Makefile
index 2b97593c9a..dffd4e771d 100644
--- a/target/linux/bcm27xx/image/Makefile
+++ b/target/linux/bcm27xx/image/Makefile
@@ -86,7 +86,14 @@ ifeq ($(SUBTARGET),bcm2708)
 endif
 
 define Device/rpi-2
-  DEVICE_MODEL := 2B/3B/3B+/3CM/4B
+  DEVICE_MODEL := 2B/2B 1.2
+  DEVICE_VARIANT := (32bit)
+  DEVICE_ALT0_VENDOR := Raspberry Pi
+  DEVICE_ALT0_MODEL := 3B/3B+/3CM
+  DEVICE_ALT0_VARIANT := (32bit)
+  DEVICE_ALT1_VENDOR := Raspberry Pi
+  DEVICE_ALT1_MODEL := 4B
+  DEVICE_ALT1_VARIANT := (32bit)
   DEVICE_DTS := \
 	bcm2709-rpi-2-b bcm2710-rpi-2-b \
 	bcm2710-rpi-3-b bcm2710-rpi-3-b-plus \
@@ -112,7 +119,11 @@ ifeq ($(SUBTARGET),bcm2709)
 endif
 
 define Device/rpi-3
-  DEVICE_MODEL := 2B-1.2/3B/3B+/3CM
+  DEVICE_MODEL := 3B/3B+/3CM
+  DEVICE_VARIANT := (64bit)
+  DEVICE_ALT0_VENDOR := Raspberry Pi
+  DEVICE_ALT0_MODEL := 2B-1.2
+  DEVICE_ALT0_VARIANT := (64bit)
   KERNEL_IMG := kernel8.img
   DEVICE_DTS := \
 	broadcom/bcm2710-rpi-2-b \
@@ -136,6 +147,7 @@ endif
 
 define Device/rpi-4
   DEVICE_MODEL := 4B
+  DEVICE_VARIANT := (64bit)
   KERNEL_IMG := kernel8.img
   DEVICE_DTS := broadcom/bcm2711-rpi-4-b
   SUPPORTED_DEVICES := \
diff --git a/toolchain/musl/common.mk b/toolchain/musl/common.mk
index 8c8eddc855..68098f5c6a 100644
--- a/toolchain/musl/common.mk
+++ b/toolchain/musl/common.mk
@@ -9,7 +9,7 @@ include $(INCLUDE_DIR)/target.mk
 
 PKG_NAME:=musl
 PKG_VERSION:=1.1.24
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://musl.libc.org/releases/
diff --git a/toolchain/musl/patches/700-wcsnrtombs-cve-2020-28928.diff b/toolchain/musl/patches/700-wcsnrtombs-cve-2020-28928.diff
new file mode 100644
index 0000000000..8465f9422a
--- /dev/null
+++ b/toolchain/musl/patches/700-wcsnrtombs-cve-2020-28928.diff
@@ -0,0 +1,65 @@
+diff --git a/src/multibyte/wcsnrtombs.c b/src/multibyte/wcsnrtombs.c
+index 676932b5..95e25e70 100644
+--- a/src/multibyte/wcsnrtombs.c
++++ b/src/multibyte/wcsnrtombs.c
+@@ -1,41 +1,33 @@
+ #include <wchar.h>
++#include <limits.h>
++#include <string.h>
+ 
+ size_t wcsnrtombs(char *restrict dst, const wchar_t **restrict wcs, size_t wn, size_t n, mbstate_t *restrict st)
+ {
+-	size_t l, cnt=0, n2;
+-	char *s, buf[256];
+ 	const wchar_t *ws = *wcs;
+-	const wchar_t *tmp_ws;
+-
+-	if (!dst) s = buf, n = sizeof buf;
+-	else s = dst;
+-
+-	while ( ws && n && ( (n2=wn)>=n || n2>32 ) ) {
+-		if (n2>=n) n2=n;
+-		tmp_ws = ws;
+-		l = wcsrtombs(s, &ws, n2, 0);
+-		if (!(l+1)) {
+-			cnt = l;
+-			n = 0;
++	size_t cnt = 0;
++	if (!dst) n=0;
++	while (ws && wn) {
++		char tmp[MB_LEN_MAX];
++		size_t l = wcrtomb(n<MB_LEN_MAX ? tmp : dst, *ws, 0);
++		if (l==-1) {
++			cnt = -1;
+ 			break;
+ 		}
+-		if (s != buf) {
+-			s += l;
++		if (dst) {
++			if (n<MB_LEN_MAX) {
++				if (l>n) break;
++				memcpy(dst, tmp, l);
++			}
++			dst += l;
+ 			n -= l;
+ 		}
+-		wn = ws ? wn - (ws - tmp_ws) : 0;
+-		cnt += l;
+-	}
+-	if (ws) while (n && wn) {
+-		l = wcrtomb(s, *ws, 0);
+-		if ((l+1)<=1) {
+-			if (!l) ws = 0;
+-			else cnt = l;
++		if (!*ws) {
++			ws = 0;
+ 			break;
+ 		}
+-		ws++; wn--;
+-		/* safe - this loop runs fewer than sizeof(buf) times */
+-		s+=l; n-=l;
++		ws++;
++		wn--;
+ 		cnt += l;
+ 	}
+ 	if (dst) *wcs = ws;
diff --git a/tools/Makefile b/tools/Makefile
index 28a8ac6511..bcf5357a28 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -42,7 +42,7 @@ tools-$(CONFIG_USE_SPARSE) += sparse
 $(curdir)/autoconf/compile := $(curdir)/m4/compile
 $(curdir)/automake/compile := $(curdir)/m4/compile $(curdir)/autoconf/compile $(curdir)/pkg-config/compile $(curdir)/xz/compile
 $(curdir)/b43-tools/compile := $(curdir)/bison/compile
-$(curdir)/bc/compile := $(curdir)/bison/compile
+$(curdir)/bc/compile := $(curdir)/bison/compile $(curdir)/libtool/compile
 $(curdir)/bison/compile := $(curdir)/flex/compile
 $(curdir)/cbootimage/compile += $(curdir)/automake/compile
 $(curdir)/cmake/compile += $(curdir)/libressl/compile
diff --git a/tools/bc/Makefile b/tools/bc/Makefile
index 3d505d6032..e5af713cf0 100644
--- a/tools/bc/Makefile
+++ b/tools/bc/Makefile
@@ -16,6 +16,8 @@ PKG_SOURCE_URL:=http://alpha.gnu.org/gnu/bc \
 	http://www.nic.funet.fi/pub/gnu/alpha/gnu/bc/
 PKG_HASH:=7ee4abbcfac03d8a6e1a8a3440558a3d239d6b858585063e745c760957725ecc
 
+PKG_FIXUP := autoreconf
+
 include $(INCLUDE_DIR)/host-build.mk
 
 $(eval $(call HostBuild))
diff --git a/tools/fakeroot/patches/100-portability.patch b/tools/fakeroot/patches/100-portability.patch
index 3835a7792b..5713c9e3fe 100644
--- a/tools/fakeroot/patches/100-portability.patch
+++ b/tools/fakeroot/patches/100-portability.patch
@@ -25,7 +25,7 @@
  #ifdef HAVE_SYS_ACL_H
  #include <sys/acl.h>
  #endif /* HAVE_SYS_ACL_H */
-@@ -1894,7 +1901,7 @@ ssize_t fremovexattr(int fd, const char
+@@ -1894,7 +1901,7 @@ ssize_t fremovexattr(int fd, const char 
  }
  #endif /* HAVE_FREMOVEXATTR */
  
@@ -110,3 +110,23 @@
      if(argname){
          print "static __inline__ " ret " next_" name, argtype " __attribute__((always_inline));" > tmpffile;
          print "static __inline__ " ret " next_" name, argtype " {" > tmpffile;
+--- a/configure.ac
++++ b/configure.ac
+@@ -110,6 +110,7 @@ for first in size_t int; do
+ #include <sys/types.h>
+ #endif
+ #include <unistd.h>
++#include <stdio.h>
+ #ifdef HAVE_GRP_H
+ #include <grp.h>
+ #endif
+--- a/configure
++++ b/configure
+@@ -12847,6 +12847,7 @@ for first in size_t int; do
+ #include <sys/types.h>
+ #endif
+ #include <unistd.h>
++#include <stdio.h>
+ #ifdef HAVE_GRP_H
+ #include <grp.h>
+ #endif
diff --git a/tools/libelf/Makefile b/tools/libelf/Makefile
index 9fec8308b5..726c4776bf 100644
--- a/tools/libelf/Makefile
+++ b/tools/libelf/Makefile
@@ -18,8 +18,12 @@ PKG_SOURCE_URL:= \
 	http://distcache.freebsd.org/ports-distfiles/
 HOST_BUILD_PARALLEL:=1
 
+HOST_FIXUP:=autoreconf
+
 include $(INCLUDE_DIR)/host-build.mk
 
+PKG_REMOVE_FILES :=
+
 HOST_CONFIGURE_ARGS += \
 	--disable-shared \
 	--enable-elf64