diff --git a/config/Config-build.in b/config/Config-build.in
index dc9552dc17..922d89e92d 100644
--- a/config/Config-build.in
+++ b/config/Config-build.in
@@ -351,6 +351,12 @@ menu "Global build settings"
 			help
 			  SELinux Reference Policy (refpolicy)
 
+		config SELINUXTYPE_targeted-modular
+			bool "targeted-modular"
+			select PACKAGE_refpolicy-modular
+			help
+			  Modular SELinux Reference Policy (refpolicy-modular)
+
 		config SELINUXTYPE_dssp
 			bool "dssp"
 			select PACKAGE_selinux-policy
diff --git a/package/ctcgfw/yq/Makefile b/package/ctcgfw/yq/Makefile
index c9cbb593aa..d416aa35ed 100644
--- a/package/ctcgfw/yq/Makefile
+++ b/package/ctcgfw/yq/Makefile
@@ -6,7 +6,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=yq
 PKG_VERSION:=3.4.1
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/mikefarah/yq/tar.gz/$(PKG_VERSION)?
@@ -18,6 +18,7 @@ PKG_LICENSE_FILES:=LICENSE
 
 PKG_BUILD_DEPENDS:=golang/host
 PKG_BUILD_PARALLEL:=1
+PKG_USE_MIPS16:=0
 
 PKG_CONFIG_DEPENDS:= \
 	CONFIG_YQ_COMPRESS_GOPROXY \
@@ -31,7 +32,7 @@ include $(TOPDIR)/feeds/packages/lang/golang/golang-package.mk
 define Package/yq
   SECTION:=utils
   CATEGORY:=Utilities
-  TITLE:=yq is a portable command-line YAML processor
+  TITLE:=Portable command-line YAML processor
   URL:=https://mikefarah.gitbook.io/yq/
   DEPENDS:=$(GO_ARCH_DEPENDS)
 endef
@@ -62,9 +63,5 @@ ifeq ($(CONFIG_YQ_COMPRESS_UPX),y)
 endif
 endef
 
-define Package/yq/install
-	$(INSTALL_DIR) $(1)/usr/bin/
-	$(INSTALL_BIN) $(GO_PKG_BUILD_BIN_DIR)/yq $(1)/usr/bin/
-endef
-
+$(eval $(call GoBinPackage,yq))
 $(eval $(call BuildPackage,yq))
diff --git a/package/lean/luci-app-ssr-plus/luasrc/controller/shadowsocksr.lua b/package/lean/luci-app-ssr-plus/luasrc/controller/shadowsocksr.lua
index 69f146a711..9c1ec9ec7e 100644
--- a/package/lean/luci-app-ssr-plus/luasrc/controller/shadowsocksr.lua
+++ b/package/lean/luci-app-ssr-plus/luasrc/controller/shadowsocksr.lua
@@ -99,7 +99,7 @@ function refresh_data()
 				if type == "gfw_data" or type == "ad_data" then
 					luci.sys.exec("/usr/share/shadowsocksr/gfw2ipset.sh")
 				else
-					luci.sys.exec("/etc/init.d/shadowsocksr restart &")
+					luci.sys.exec("/usr/share/shadowsocksr/chinaipset.sh /tmp/etc/china_ssr.txt")
 				end
 			end
 		else
@@ -111,7 +111,7 @@ function refresh_data()
 		update(uci:get_first("shadowsocksr", "global", "gfwlist_url", "https://cdn.jsdelivr.net/gh/gfwlist/gfwlist/gfwlist.txt"), "/etc/ssr/gfw_list.conf", set, "/tmp/dnsmasq.ssr/gfw_list.conf")
 	end
 	if set == "ip_data" then
-		update(uci:get_first("shadowsocksr", "global", "chnroute_url","https://ispip.clang.cn/all_cn.txt"), "/etc/ssr/china_ssr.txt", set)
+		update(uci:get_first("shadowsocksr", "global", "chnroute_url","https://ispip.clang.cn/all_cn.txt"), "/etc/ssr/china_ssr.txt", set, "/tmp/etc/china_ssr.txt")
 	end
 	if set == "ad_data" then
 		update(uci:get_first("shadowsocksr", "global", "adblock_url","https://easylist-downloads.adblockplus.org/easylistchina+easylist.txt"), "/etc/ssr/ad.conf", set, "/tmp/dnsmasq.ssr/ad.conf")
diff --git a/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr b/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr
index c25594b861..9623658e40 100755
--- a/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr
+++ b/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr
@@ -63,14 +63,10 @@ uci_get_by_cfgid() {
 
 get_host_ip() {
 	local host=$1
-	local isip=""
-	local ip=$host
-	isip=$(echo $host | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}")
-	if [ -z "$isip" ]; then
-		if [ "$host" != "${host#*:[0-9a-fA-F]}" ]; then
-			ip=$host
-		else
-			local ip=$(resolveip -4 -t 3 $host | awk 'NR==1{print}')
+	local ip=$1
+	if [ -z "$(echo $1 | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}")" ]; then
+		if [ "$1" == "${1#*:[0-9a-fA-F]}" ]; then
+			ip=$(resolveip -4 -t 3 $1 | awk 'NR==1{print}')
 			[ -z "$ip" ] && ip=$(wget -q -O- http://119.29.29.29/d?dn=$1 | awk -F ';' '{print $1}')
 		fi
 	fi
@@ -133,9 +129,8 @@ gen_config_file() {
 	else
 		uci_set_by_name $1 ip $hostip
 	fi
-	[ "$2" == "0" -a "$kcp_flag" == "1" ] && hostip="127.0.0.1"
 	case "$2" in
-	0) config_file=$CONFIG_FILE ;;
+	0) config_file=$CONFIG_FILE && [ "$kcp_flag" == "1" ] && hostip="127.0.0.1" ;;
 	1) config_file=$CONFIG_UDP_FILE ;;
 	2) config_file=$CONFIG_NETFLIX_FILE ;;
 	*) config_file=$CONFIG_SOCK5_FILE ;;
@@ -302,21 +297,23 @@ start_dns() {
 		EOF
 		/usr/sbin/pdnsd -c /var/etc/pdnsd.conf >/dev/null 2>&1 &
 	}
-	if [ "$ssr_dns" != "0" ]; then
+	ipset_add_dns() {
 		case "$run_mode" in
 		gfw) ipset add gfwlist $dnsserver 2>/dev/null ;;
 		oversea) ipset add oversea $dnsserver 2>/dev/null ;;
 		*) ipset add ss_spec_wan_ac $dnsserver nomatch 2>/dev/null ;;
 		esac
-	fi
+	}
 	case "$ssr_dns" in
 	1)
 		start_pdnsd $dnsserver $dnsport
+		ipset_add_dns
 		pdnsd_enable_flag=1
 		;;
 	2)
 		microsocks -i 127.0.0.1 -p 10802 ssr-dns >/dev/null 2>&1 &
 		dns2socks 127.0.0.1:10802 $dnsserver:$dnsport 127.0.0.1:5335 -q >/dev/null 2>&1 &
+		ipset_add_dns
 		pdnsd_enable_flag=2
 		;;
 	esac
@@ -684,8 +681,8 @@ start_rules() {
 		2) echo "-m multiport --dports 22,53,587,465,995,993,143,80,443,853" ;;
 		esac
 	}
+	run_mode=$(uci_get_by_type global run_mode router)
 	get_mode() {
-		run_mode=$(uci_get_by_type global run_mode router)
 		case "$run_mode" in
 		gfw) echo "-g" ;;
 		router) echo "-r" ;;
@@ -767,8 +764,10 @@ start() {
 }
 
 boot() {
+	echo "$(date "+%Y-%m-%d %H:%M:%S") boot！" >/tmp/ssrplus.log
 	ulimit -n 65535
-	(/usr/share/shadowsocksr/chinaipset.sh && sleep 3 && start >/dev/null 2>&1) &
+	/usr/share/shadowsocksr/chinaipset.sh
+	start >/dev/null 2>&1
 }
 
 stop() {
diff --git a/package/lean/luci-app-ssr-plus/root/etc/uci-defaults/luci-ssr-plus b/package/lean/luci-app-ssr-plus/root/etc/uci-defaults/luci-ssr-plus
old mode 100644
new mode 100755
diff --git a/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-rules b/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-rules
index c960de8492..2219455be3 100755
--- a/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-rules
+++ b/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-rules
@@ -87,12 +87,14 @@ ipset_r() {
 	$IPT -I SS_SPEC_WAN_AC -p tcp ! --dport 53 -d $server -j RETURN
 	case "$RUNMODE" in
 	router)
+		set_china_ip
 		ipset -! -R <<-EOF || return 1
 			create ss_spec_wan_ac hash:net
 			$(gen_iplist | sed -e "s/^/add ss_spec_wan_ac /")
 		EOF
 		ipset -N gfwlist hash:net 2>/dev/null
 		$IPT -A SS_SPEC_WAN_AC -m set --match-set ss_spec_wan_ac dst -j RETURN
+		$IPT -A SS_SPEC_WAN_AC -m set --match-set china dst -j RETURN
 		$IPT -A SS_SPEC_WAN_AC -j SS_SPEC_WAN_FW
 		;;
 	gfw)
@@ -280,10 +282,13 @@ gen_iplist() {
 		240.0.0.0/4
 		255.255.255.255
 		$(get_wan_ip)
-		$(cat ${IGNORE_LIST:=/dev/null} 2>/dev/null)
 	EOF
 }
 
+set_china_ip() {
+	[ -f "$IGNORE_LIST" ] && /usr/share/shadowsocksr/chinaipset.sh $IGNORE_LIST
+}
+
 gen_spec_iplist() {
 	cat <<-EOF
 		0.0.0.0/8
diff --git a/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-switch b/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-switch
index c73d975604..2fea13a032 100755
--- a/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-switch
+++ b/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-switch
@@ -38,14 +38,10 @@ CURRENT_SERVER=$DEFAULT_SERVER
 #解析ip
 get_host_ip() {
 	local host=$1
-	local isip=""
-	local ip=$host
-	isip=$(echo $host | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}")
-	if [ -z "$isip" ]; then
-		if [ "$host" != "${host#*:[0-9a-fA-F]}" ]; then
-			ip=$host
-		else
-			local ip=$(resolveip -4 -t 3 $host | awk 'NR==1{print}')
+	local ip=$1
+	if [ -z "$(echo $1 | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}")" ]; then
+		if [ "$1" == "${1#*:[0-9a-fA-F]}" ]; then
+			ip=$(resolveip -4 -t 3 $1 | awk 'NR==1{print}')
 			[ -z "$ip" ] && ip=$(wget -q -O- http://119.29.29.29/d?dn=$1 | awk -F ';' '{print $1}')
 		fi
 	fi
diff --git a/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/chinaipset.sh b/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/chinaipset.sh
index ff3dd2cf16..751678b7f2 100755
--- a/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/chinaipset.sh
+++ b/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/chinaipset.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
 LOCK_FILE="/var/lock/ssr-chinaipset.lock"
 [ -f "$LOCK_FILE" ] && exit 2
+[ -f "$1" ] && china_ip=$1
 touch "$LOCK_FILE"
-echo "create china hash:net family inet hashsize 1024 maxelem 65536" >/tmp/china.ipset
-awk '!/^$/&&!/^#/{printf("add china %s'" "'\n",$0)}' /etc/ssr/china_ssr.txt >>/tmp/china.ipset
-ipset -! flush china
-ipset -! restore </tmp/china.ipset 2>/dev/null
-rm -f /tmp/china.ipset $LOCK_FILE
+ipset -! flush china 2>/dev/null
+ipset -! -R <<-EOF || rm -f $LOCK_FILE && exit 1
+	create china hash:net
+	$(cat ${china_ip:=/etc/ssr/china_ssr.txt} | sed -e "s/^/add china /")
+EOF
+rm -f $LOCK_FILE
diff --git a/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/ssrplusupdate.sh b/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/ssrplusupdate.sh
index 818726a98b..b8ed470db7 100755
--- a/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/ssrplusupdate.sh
+++ b/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/ssrplusupdate.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 /usr/bin/lua /usr/share/shadowsocksr/update.lua
 sleep 2s
-/usr/share/shadowsocksr/chinaipset.sh
+/usr/share/shadowsocksr/chinaipset.sh /tmp/etc/china_ssr.txt
 sleep 2s
 /usr/bin/lua /usr/share/shadowsocksr/subscribe.lua
diff --git a/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/update.lua b/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/update.lua
index 5bde50d61a..84be5ac8ab 100644
--- a/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/update.lua
+++ b/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/update.lua
@@ -42,7 +42,7 @@ end
 log("正在更新【GFW列表】数据库")
 update(uci:get_first("shadowsocksr", "global", "gfwlist_url", "https://cdn.jsdelivr.net/gh/v2fly/domain-list-community@release/gfwlist.txt"), "/etc/ssr/gfw_list.conf", "gfw_data", "/tmp/dnsmasq.ssr/gfw_list.conf")
 log("正在更新【国内IP段】数据库")
-update(uci:get_first("shadowsocksr", "global", "chnroute_url","https://ispip.clang.cn/all_cn.txt"), "/etc/ssr/china_ssr.txt", "cnip")
+update(uci:get_first("shadowsocksr", "global", "chnroute_url","https://ispip.clang.cn/all_cn.txt"), "/etc/ssr/china_ssr.txt", "cnip", "/tmp/etc/china_ssr.txt")
 if uci:get_first("shadowsocksr", "global", "adblock","0") == "1" then
 	log("正在更新【广告屏蔽】数据库")
 	update(uci:get_first("shadowsocksr", "global", "adblock_url","https://easylist-downloads.adblockplus.org/easylistchina+easylist.txt"), "/etc/ssr/ad.conf", "ad_data", "/tmp/dnsmasq.ssr/ad.conf")
diff --git a/package/network/services/dnsmasq/Makefile b/package/network/services/dnsmasq/Makefile
index 46995cabaa..bab6e4aa6a 100644
--- a/package/network/services/dnsmasq/Makefile
+++ b/package/network/services/dnsmasq/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dnsmasq
 PKG_VERSION:=2.82
-PKG_RELEASE:=5
+PKG_RELEASE:=7
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq
diff --git a/package/network/services/dnsmasq/files/dhcp.conf b/package/network/services/dnsmasq/files/dhcp.conf
index cc28a08bd6..57d6c9576d 100644
--- a/package/network/services/dnsmasq/files/dhcp.conf
+++ b/package/network/services/dnsmasq/files/dhcp.conf
@@ -22,6 +22,7 @@ config dnsmasq
 	option localservice	1  # disable to allow DNS requests from non-local subnets
 	option filter_aaaa	0
 	option dns_redirect	1
+	option ednspacket_max	1232
 
 config dhcp lan
 	option interface	lan
diff --git a/package/network/services/dnsmasq/files/dnsmasq.init b/package/network/services/dnsmasq/files/dnsmasq.init
index 2d5c4fa4e9..854e6aee51 100644
--- a/package/network/services/dnsmasq/files/dnsmasq.init
+++ b/package/network/services/dnsmasq/files/dnsmasq.init
@@ -769,6 +769,29 @@ dhcp_relay_add() {
 	fi
 }
 
+dnsmasq_ipset_add() {
+	local cfg="$1"
+	local ipsets domains
+
+	add_ipset() {
+		ipsets="${ipsets:+$ipsets,}$1"
+	}
+
+	add_domain() {
+		# leading '/' is expected
+		domains="$domains/$1"
+	}
+
+	config_list_foreach "$cfg" "name" add_ipset
+	config_list_foreach "$cfg" "domain" add_domain
+
+	if [ -z "$ipsets" ] || [ -z "$domains" ]; then
+		return 0
+	fi
+
+	xappend "--ipset=$domains/$ipsets"
+}
+
 dnsmasq_start()
 {
 	local cfg="$1"
@@ -1060,6 +1083,10 @@ dnsmasq_start()
 	config_foreach filter_dnsmasq cname dhcp_cname_add "$cfg"
 	echo >> $CONFIGFILE_TMP
 
+	echo >> $CONFIGFILE_TMP
+	config_foreach filter_dnsmasq ipset dnsmasq_ipset_add "$cfg"
+	echo >> $CONFIGFILE_TMP
+
 	echo >> $CONFIGFILE_TMP
 	mv -f $CONFIGFILE_TMP $CONFIGFILE
 	mv -f $HOSTFILE_TMP $HOSTFILE
diff --git a/package/system/refpolicy/Makefile b/package/system/refpolicy/Makefile
index a431770955..d9c8c90208 100644
--- a/package/system/refpolicy/Makefile
+++ b/package/system/refpolicy/Makefile
@@ -24,7 +24,7 @@ TAR_OPTIONS:=--transform='s%^refpolicy%$(PKG_NAME)-$(PKG_VERSION)%' -xf -
 
 include $(INCLUDE_DIR)/package.mk
 
-define Package/refpolicy
+define Package/refpolicy/Default
   SECTION:=system
   CATEGORY:=Base system
   TITLE:=SELinux reference policy
@@ -32,6 +32,19 @@ define Package/refpolicy
   PKGARCH:=all
 endef
 
+define Package/refpolicy
+  $(call Package/refpolicy/Default)
+  CONFLICTS:=refpolicy-modular
+  VARIANT:=default
+endef
+
+define Package/refpolicy-modular
+  $(call Package/refpolicy/Default)
+  TITLE += (modular)
+  VARIANT:=modular
+  PROVIDES:=refpolicy
+endef
+
 define Package/refpolicy/description
 	The SELinux Reference Policy project (refpolicy) is a
 	complete SELinux policy that can be used as the system
@@ -56,25 +69,43 @@ endef
 # builds is a small host tool that gets run as part of the build
 # process.
 MAKE_FLAGS += \
+	DESTDIR="$(PKG_INSTALL_DIR)"
 	SETFILES="$(STAGING_DIR_HOST)/bin/setfiles" \
 	CHECKPOLICY="$(STAGING_DIR_HOSTPKG)/bin/checkpolicy" \
 	CC="$(HOSTCC)" \
 	CFLAGS="$(HOST_CFLAGS)"
 
 define Build/Configure
-	$(SED) "/MONOLITHIC/c\MONOLITHIC = y" $(PKG_BUILD_DIR)/build.conf
 	$(SED) "/NAME/c\NAME = targeted" $(PKG_BUILD_DIR)/build.conf
+ifneq ($(BUILD_VARIANT),modular)
+	$(SED) "/MONOLITHIC/c\MONOLITHIC = y" $(PKG_BUILD_DIR)/build.conf
+endif
 	$(call Build/Compile/Default,conf)
 endef
 
+ifeq ($(BUILD_VARIANT),modular)
+define Build/Install
+	$(call Build/Compile/Default,install install-headers)
+endef
+endif
+
 define Package/refpolicy/conffiles
 /etc/selinux/config
 endef
 
+Package/refpolicy-modular/conffiles = $(Package/refpolicy/conffiles)
+
 define Package/refpolicy/install
 	$(INSTALL_DIR) $(1)/etc/selinux
 	$(CP) $(PKG_INSTALL_DIR)/etc/selinux/* $(1)/etc/selinux/
 	$(CP) ./files/selinux-config $(1)/etc/selinux/config
+ifeq ($(BUILD_VARIANT),modular)
+	$(INSTALL_DIR) $(1)/usr/share/selinux
+	$(CP) $(PKG_INSTALL_DIR)/usr/share/selinux/* $(1)/usr/share/selinux/
+endif
 endef
 
+Package/refpolicy-modular/install = $(Package/refpolicy/install)
+
 $(eval $(call BuildPackage,refpolicy))
+$(eval $(call BuildPackage,refpolicy-modular))
diff --git a/scripts/mkhash.c b/scripts/mkhash.c
index 0f5815f242..ced4f3c34a 100644
--- a/scripts/mkhash.c
+++ b/scripts/mkhash.c
@@ -85,6 +85,7 @@
 #include <stdint.h>
 #include <stdbool.h>
 #include <unistd.h>
+#include <sys/stat.h>
 
 #define ARRAY_SIZE(_n) (sizeof(_n) / sizeof((_n)[0]))
 
@@ -736,7 +737,10 @@ static int usage(const char *progname)
 {
 	int i;
 
-	fprintf(stderr, "Usage: %s <hash type> [<file>...]\n"
+	fprintf(stderr, "Usage: %s <hash type> [options] [<file>...]\n"
+		"Options:\n"
+		"	-n		Print filename(s)\n"
+		"\n"
 		"Supported hash types:", progname);
 
 	for (i = 0; i < ARRAY_SIZE(types); i++)
@@ -767,6 +771,13 @@ static int hash_file(struct hash_type *t, const char *filename, bool add_filenam
 	if (!filename || !strcmp(filename, "-")) {
 		str = t->func(stdin);
 	} else {
+		struct stat path_stat;
+		stat(filename, &path_stat);
+		if (S_ISDIR(path_stat.st_mode)) {
+			fprintf(stderr, "Failed to open '%s': Is a directory\n", filename);
+			return 1;
+		}
+
 		FILE *f = fopen(filename, "r");
 
 		if (!f) {
@@ -820,8 +831,11 @@ int main(int argc, char **argv)
 	if (argc < 2)
 		return hash_file(t, NULL, add_filename);
 
-	for (i = 0; i < argc - 1; i++)
-		hash_file(t, argv[1 + i], add_filename);
+	for (i = 0; i < argc - 1; i++) {
+		int ret = hash_file(t, argv[1 + i], add_filename);
+		if (ret)
+			return ret;
+	}
 
 	return 0;
 }
diff --git a/target/imagebuilder/Makefile b/target/imagebuilder/Makefile
index b66f665d6f..5a4790ba5a 100644
--- a/target/imagebuilder/Makefile
+++ b/target/imagebuilder/Makefile
@@ -90,7 +90,7 @@ endif
 	(cd $(PKG_BUILD_DIR); find staging_dir/host/bin/ $(IB_LDIR)/scripts/dtc/ -type f | \
 		$(XARGS) $(SCRIPT_DIR)/bundle-libraries.sh $(PKG_BUILD_DIR)/staging_dir/host)
 	$(CP) $(TOPDIR)/staging_dir/host/lib/libfakeroot* $(PKG_BUILD_DIR)/staging_dir/host/lib
-	STRIP=sstrip $(SCRIPT_DIR)/rstrip.sh $(PKG_BUILD_DIR)/staging_dir/host/bin/
+	STRIP=$(STAGING_DIR_HOST)/bin/sstrip $(SCRIPT_DIR)/rstrip.sh $(PKG_BUILD_DIR)/staging_dir/host/bin/
 	$(TAR) -cf - -C $(BUILD_DIR) $(IB_NAME) | xz -T$(if $(filter 1,$(NPROC)),2,0) -zc -7e > $@
 
 download:
diff --git a/toolchain/glibc/common.mk b/toolchain/glibc/common.mk
index ad4b324374..90a22c31e8 100644
--- a/toolchain/glibc/common.mk
+++ b/toolchain/glibc/common.mk
@@ -7,13 +7,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=glibc
-PKG_VERSION:=2.31
+PKG_VERSION:=2.32
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=4bc9918c998085800ecf5bbb3c863e66ea6252a0
-PKG_MIRROR_HASH:=51877ffff6819b5ccc004a842de755c6c203996d673d94d7013927712e252c17
+PKG_SOURCE_VERSION:=70ee5e8b573f76745760dd6b75f705590fc1923a
+PKG_MIRROR_HASH:=d816dc7658446c2969d307730b58df5f8a65853b4e57a655895feb685590d63b
 PKG_SOURCE_URL:=https://sourceware.org/git/glibc.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz
 
diff --git a/toolchain/glibc/patches/050-Revert-Disallow-use-of-DES-encryption-functions-in-n.patch b/toolchain/glibc/patches/050-Revert-Disallow-use-of-DES-encryption-functions-in-n.patch
index 4e3e2eebb2..002e7a1770 100644
--- a/toolchain/glibc/patches/050-Revert-Disallow-use-of-DES-encryption-functions-in-n.patch
+++ b/toolchain/glibc/patches/050-Revert-Disallow-use-of-DES-encryption-functions-in-n.patch
@@ -1,11 +1,11 @@
-From cfc93329e00cd23c226f34b3ffd5552a93c35bd7 Mon Sep 17 00:00:00 2001
-From: Hauke Mehrtens <hauke@hauke-m.de>
-Date: Mon, 23 Mar 2020 22:33:46 +0100
+From 08f5e0df46ce1ad617bcde1fd5542545397630b9 Mon Sep 17 00:00:00 2001
+From: Hans Dedecker <dedeckeh@gmail.com>
+Date: Sat, 24 Oct 2020 21:13:30 +0200
 Subject: Revert "Disallow use of DES encryption functions in new programs."
 
 This reverts commit b10a0accee709a5efff2fadf0b0bbb79ff0ad759.
 
-ppp still uses the encrypt functions from the libc. musl libc also
+ppp still uses the encrypt functions from the libc while musl libc also
 provides them.
 ---
  conform/data/stdlib.h-data |   3 +
@@ -15,18 +15,19 @@ provides them.
  crypt/crypt.h              |  16 +++
  crypt/crypt_util.c         |   9 --
  manual/conf.texi           |   2 -
- manual/crypt.texi          | 201 +++++++++++++++++++++++++++++++++++++
+ manual/crypt.texi          | 204 +++++++++++++++++++++++++++++++++++++
  manual/string.texi         |  82 +++++++--------
- posix/unistd.h             |  22 ++--
+ posix/unistd.h             |  17 +++-
  stdlib/stdlib.h            |   6 ++
- sunrpc/Makefile            |   2 +-
  sunrpc/des_crypt.c         |   7 +-
  sunrpc/des_soft.c          |   2 +-
- 14 files changed, 303 insertions(+), 96 deletions(-)
+ 13 files changed, 305 insertions(+), 90 deletions(-)
 
+diff --git a/conform/data/stdlib.h-data b/conform/data/stdlib.h-data
+index 6913828196..d8fcccc2fb 100644
 --- a/conform/data/stdlib.h-data
 +++ b/conform/data/stdlib.h-data
-@@ -149,6 +149,9 @@ function {unsigned short int*} seed48 (u
+@@ -149,6 +149,9 @@ function {unsigned short int*} seed48 (unsigned short int[3])
  #if !defined ISO && !defined ISO99 && !defined ISO11 && !defined POSIX && !defined XPG4 && !defined XPG42 && !defined UNIX98
  function int setenv (const char*, const char*, int)
  #endif
@@ -36,6 +37,8 @@ provides them.
  #if !defined ISO && !defined ISO99 && !defined ISO11 && !defined XPG4 && !defined POSIX && !defined POSIX2008
  function {char*} setstate (char*)
  #endif
+diff --git a/conform/data/unistd.h-data b/conform/data/unistd.h-data
+index aa070528e8..ddf4f25132 100644
 --- a/conform/data/unistd.h-data
 +++ b/conform/data/unistd.h-data
 @@ -437,6 +437,9 @@ function int chroot (const char*)
@@ -58,6 +61,8 @@ provides them.
  function int execl (const char*, const char*, ...)
  function int execle (const char*, const char*, ...)
  function int execlp (const char*, const char*, ...)
+diff --git a/crypt/cert.c b/crypt/cert.c
+index e070ca398d..80029e9078 100644
 --- a/crypt/cert.c
 +++ b/crypt/cert.c
 @@ -10,22 +10,6 @@
@@ -97,6 +102,8 @@ provides them.
 -}
 -
 -#endif
+diff --git a/crypt/crypt-entry.c b/crypt/crypt-entry.c
+index 502b5846f0..09332c690a 100644
 --- a/crypt/crypt-entry.c
 +++ b/crypt/crypt-entry.c
 @@ -35,7 +35,6 @@
@@ -107,7 +114,7 @@ provides them.
  
  /* Prototypes for local functions.  */
  #ifndef __GNU_LIBRARY__
-@@ -177,7 +176,17 @@ crypt (const char *key, const char *salt
+@@ -177,7 +176,17 @@ crypt (const char *key, const char *salt)
    return __crypt_r (key, salt, &_ufc_foobar);
  }
  
@@ -127,6 +134,8 @@ provides them.
 +  return crypt (key, salt);
 +}
  #endif
+diff --git a/crypt/crypt.h b/crypt/crypt.h
+index ca8ad456cc..7d0de95018 100644
 --- a/crypt/crypt.h
 +++ b/crypt/crypt.h
 @@ -36,6 +36,14 @@ __BEGIN_DECLS
@@ -159,6 +168,8 @@ provides them.
  #endif
  
  __END_DECLS
+diff --git a/crypt/crypt_util.c b/crypt/crypt_util.c
+index 4b2f0a89cb..b012cde6bd 100644
 --- a/crypt/crypt_util.c
 +++ b/crypt/crypt_util.c
 @@ -34,7 +34,6 @@
@@ -185,7 +196,7 @@ provides them.
  
  /*
   * This is the final
-@@ -788,7 +785,6 @@ _ufc_output_conversion_r (ufc_long v1, u
+@@ -788,7 +785,6 @@ _ufc_output_conversion_r (ufc_long v1, ufc_long v2, const char *salt,
    __data->crypt_3_buf[13] = 0;
  }
  
@@ -193,7 +204,7 @@ provides them.
  
  /*
   * UNIX encrypt function. Takes a bitvector
-@@ -889,14 +885,12 @@ __encrypt_r (char *__block, int __edflag
+@@ -889,14 +885,12 @@ __encrypt_r (char *__block, int __edflag,
    }
  }
  weak_alias (__encrypt_r, encrypt_r)
@@ -208,7 +219,7 @@ provides them.
  
  
  /*
-@@ -921,15 +915,12 @@ __setkey_r (const char *__key, struct cr
+@@ -921,15 +915,12 @@ __setkey_r (const char *__key, struct crypt_data * __restrict __data)
    _ufc_mk_keytab_r((char *) ktab, __data);
  }
  weak_alias (__setkey_r, setkey_r)
@@ -224,9 +235,11 @@ provides them.
  
  void
  __b64_from_24bit (char **cp, int *buflen,
+diff --git a/manual/conf.texi b/manual/conf.texi
+index f959b00bb6..51fb2f5aa1 100644
 --- a/manual/conf.texi
 +++ b/manual/conf.texi
-@@ -780,8 +780,6 @@ Inquire about the parameter correspondin
+@@ -780,8 +780,6 @@ Inquire about the parameter corresponding to @code{_XOPEN_LEGACY}.
  @item _SC_XOPEN_CRYPT
  @standards{X/Open, unistd.h}
  Inquire about the parameter corresponding to @code{_XOPEN_CRYPT}.
@@ -235,9 +248,11 @@ provides them.
  
  @item _SC_XOPEN_ENH_I18N
  @standards{X/Open, unistd.h}
+diff --git a/manual/crypt.texi b/manual/crypt.texi
+index af23dd7847..1b151f2d74 100644
 --- a/manual/crypt.texi
 +++ b/manual/crypt.texi
-@@ -16,8 +16,19 @@ subject to them, even if you do not use
+@@ -16,8 +16,19 @@ subject to them, even if you do not use the functions in this chapter
  yourself.  The restrictions vary from place to place and are changed
  often, so we cannot give any more specific advice than this warning.
  
@@ -253,12 +268,12 @@ provides them.
 +
  @menu
  * Passphrase Storage::          One-way hashing for passphrases.
-+* DES Encryption::              Routines for DES encryption.
++* crypt::                       A one-way function for passwords.
  * Unpredictable Bytes::         Randomness for cryptographic purposes.
  @end menu
  
-@@ -200,6 +211,196 @@ hashes for the same passphrase.
- @include testpass.c.texi
+@@ -190,6 +201,199 @@ unpredictable as possible; @pxref{Unpredictable Bytes}.
+ @include genpass.c.texi
  @end smallexample
  
 +@node DES Encryption
@@ -451,9 +466,14 @@ provides them.
 +functions and their accompanying macros are all defined in the header
 +@file{rpc/des_crypt.h}.
 +
- @node Unpredictable Bytes
- @section Generating Unpredictable Bytes
- @cindex randomness source
++@node Unpredictable Bytes
++@section Generating Unpredictable Bytes
++
+ The next program demonstrates how to verify a passphrase.  It checks a
+ hash hardcoded into the program, because looking up real users' hashed
+ passphrases may require special privileges (@pxref{User Database}).
+diff --git a/manual/string.texi b/manual/string.texi
+index 23f516439a..5586b52dee 100644
 --- a/manual/string.texi
 +++ b/manual/string.texi
 @@ -36,8 +36,8 @@ too.
@@ -467,7 +487,7 @@ provides them.
  * Encode Binary Data::          Encoding and Decoding of Binary Data.
  * Argz and Envz Vectors::       Null-separated string vectors.
  @end menu
-@@ -2426,73 +2426,73 @@ functionality under a different name, su
+@@ -2426,73 +2426,73 @@ functionality under a different name, such as @code{explicit_memset},
  systems it may be in @file{strings.h} instead.
  @end deftypefun
  
@@ -518,19 +538,10 @@ provides them.
  
 -@node Obfuscating Data
 -@section Obfuscating Data
+-@cindex Rot13
 +@node Trivial Encryption
 +@section Trivial Encryption
 +@cindex encryption
-+
-+
-+The @code{memfrob} function converts an array of data to something
-+unrecognizable and back again.  It is not encryption in its usual sense
-+since it is easy for someone to convert the encrypted data back to clear
-+text.  The transformation is analogous to Usenet's ``Rot13'' encryption
-+method for obscuring offensive jokes from sensitive eyes and such.
-+Unlike Rot13, @code{memfrob} works on arbitrary binary data, not just
-+text.
- @cindex Rot13
  
 -The @code{memfrob} function reversibly obfuscates an array of binary
 -data.  This is not true encryption; the obfuscated data still bears a
@@ -538,12 +549,20 @@ provides them.
 -undo the obfuscation.  It is analogous to the ``Rot13'' cipher used on
 -Usenet for obscuring offensive jokes, spoilers for works of fiction,
 -and so on, but it can be applied to arbitrary binary data.
--
+ 
 -Programs that need true encryption---a transformation that completely
 -obscures the original and cannot be reversed without knowledge of a
 -secret key---should use a dedicated cryptography library, such as
 -@uref{https://www.gnu.org/software/libgcrypt/,,libgcrypt}.
--
++The @code{memfrob} function converts an array of data to something
++unrecognizable and back again.  It is not encryption in its usual sense
++since it is easy for someone to convert the encrypted data back to clear
++text.  The transformation is analogous to Usenet's ``Rot13'' encryption
++method for obscuring offensive jokes from sensitive eyes and such.
++Unlike Rot13, @code{memfrob} works on arbitrary binary data, not just
++text.
++@cindex Rot13
+ 
 -Programs that need to @emph{destroy} data should use
 -@code{explicit_bzero} (@pxref{Erasing Sensitive Data}), or possibly
 -@code{strfry} (@pxref{Shuffling Bytes}).
@@ -560,14 +579,13 @@ provides them.
 -beginning at @var{mem}, in place.  Each byte is bitwise xor-ed with
 -the binary pattern 00101010 (hexadecimal 0x2A).  The return value is
 -always @var{mem}.
--
--@code{memfrob} a second time on the same data returns it to
--its original state.
 +@code{memfrob} transforms (frobnicates) each byte of the data structure
 +at @var{mem}, which is @var{length} bytes long, by bitwise exclusive
 +oring it with binary 00101010.  It does the transformation in place and
 +its return value is always @var{mem}.
-+
+ 
+-@code{memfrob} a second time on the same data returns it to
+-its original state.
 +Note that @code{memfrob} a second time on the same data structure
 +returns it to its original state.
 +
@@ -582,6 +600,8 @@ provides them.
  @end deftypefun
  
  @node Encode Binary Data
+diff --git a/posix/unistd.h b/posix/unistd.h
+index 32b8161619..6fac59999f 100644
 --- a/posix/unistd.h
 +++ b/posix/unistd.h
 @@ -107,6 +107,9 @@ __BEGIN_DECLS
@@ -594,20 +614,20 @@ provides them.
  /* The enhanced internationalization capabilities according to XPG4.2
     are present.  */
  #define	_XOPEN_ENH_I18N	1
-@@ -1115,17 +1118,20 @@ ssize_t copy_file_range (int __infd, __o
+@@ -1129,17 +1132,25 @@ ssize_t copy_file_range (int __infd, __off64_t *__pinoff,
  extern int fdatasync (int __fildes);
  #endif /* Use POSIX199309 */
  
 -#ifdef __USE_MISC
--/* One-way hash PHRASE, returning a string suitable for storage in the
--   user database.  SALT selects the one-way function to use, and
--   ensures that no two users' hashes are the same, even if they use
--   the same passphrase.  The return value points to static storage
--   which will be overwritten by the next call to crypt.  */
-+
 +/* XPG4.2 specifies that prototypes for the encryption functions must
 +   be defined here.  */
 +#ifdef	__USE_XOPEN
+ /* One-way hash PHRASE, returning a string suitable for storage in the
+    user database.  SALT selects the one-way function to use, and
+    ensures that no two users' hashes are the same, even if they use
+    the same passphrase.  The return value points to static storage
+    which will be overwritten by the next call to crypt.  */
++
 +/* Encrypt at most 8 characters from KEY using salt to perturb DES.  */
  extern char *crypt (const char *__key, const char *__salt)
       __THROW __nonnull ((1, 2));
@@ -623,9 +643,11 @@ provides them.
  /* Swab pairs bytes in the first N bytes of the area pointed to by
     FROM and copy the result to TO.  The value of TO must not be in the
     range [FROM - N + 1, FROM - 1].  If N is odd the first byte in FROM
+diff --git a/stdlib/stdlib.h b/stdlib/stdlib.h
+index 3aa27a9d25..67e5e66f94 100644
 --- a/stdlib/stdlib.h
 +++ b/stdlib/stdlib.h
-@@ -961,6 +961,12 @@ extern int getsubopt (char **__restrict
+@@ -962,6 +962,12 @@ extern int getsubopt (char **__restrict __optionp,
  #endif
  
  
@@ -638,20 +660,11 @@ provides them.
  /* X/Open pseudo terminal handling.  */
  
  #ifdef __USE_XOPEN2KXSI
---- a/sunrpc/Makefile
-+++ b/sunrpc/Makefile
-@@ -51,7 +51,7 @@ rpcsvc = bootparam_prot.x nlm_prot.x rst
- headers-sunrpc = $(addprefix rpc/,auth.h auth_unix.h clnt.h pmap_clnt.h \
- 				  pmap_prot.h pmap_rmt.h rpc.h rpc_msg.h \
- 				  svc.h svc_auth.h types.h xdr.h auth_des.h \
--				  key_prot.h) \
-+				  des_crypt.h key_prot.h rpc_des.h) \
- 		       $(rpcsvc:%=rpcsvc/%) rpcsvc/bootparam.h
- headers = rpc/netdb.h
- install-others = $(inst_sysconfdir)/rpc
+diff --git a/sunrpc/des_crypt.c b/sunrpc/des_crypt.c
+index 9b4bd2d5dd..a4d8b2936b 100644
 --- a/sunrpc/des_crypt.c
 +++ b/sunrpc/des_crypt.c
-@@ -86,9 +86,6 @@ common_crypt (char *key, char *buf, regi
+@@ -86,9 +86,6 @@ common_crypt (char *key, char *buf, register unsigned len,
    return desdev == DES_SW ? DESERR_NONE : DESERR_NOHWDEVICE;
  }
  
@@ -661,7 +674,7 @@ provides them.
  /*
   * CBC mode encryption
   */
-@@ -105,7 +102,7 @@ cbc_crypt (char *key, char *buf, unsigne
+@@ -105,7 +102,7 @@ cbc_crypt (char *key, char *buf, unsigned int len, unsigned int mode,
    COPY8 (dp.des_ivec, ivec);
    return err;
  }
@@ -670,12 +683,14 @@ provides them.
  
  /*
   * ECB mode encryption
-@@ -118,4 +115,4 @@ ecb_crypt (char *key, char *buf, unsigne
+@@ -118,4 +115,4 @@ ecb_crypt (char *key, char *buf, unsigned int len, unsigned int mode)
    dp.des_mode = ECB;
    return common_crypt (key, buf, len, mode, &dp);
  }
 -hidden_nolink (ecb_crypt, libc, GLIBC_2_1)
 +libc_hidden_nolink_sunrpc (ecb_crypt, GLIBC_2_1)
+diff --git a/sunrpc/des_soft.c b/sunrpc/des_soft.c
+index a87de96cc7..f884f8f21b 100644
 --- a/sunrpc/des_soft.c
 +++ b/sunrpc/des_soft.c
 @@ -71,4 +71,4 @@ des_setparity (char *p)
@@ -684,3 +699,6 @@ provides them.
  }
 -hidden_nolink (des_setparity, libc, GLIBC_2_1)
 +libc_hidden_nolink_sunrpc (des_setparity, GLIBC_2_1)
+-- 
+2.25.1
+
diff --git a/toolchain/glibc/patches/100-fix_cross_rpcgen.patch b/toolchain/glibc/patches/100-fix_cross_rpcgen.patch
index f10efcc5d6..6ee1e80424 100644
--- a/toolchain/glibc/patches/100-fix_cross_rpcgen.patch
+++ b/toolchain/glibc/patches/100-fix_cross_rpcgen.patch
@@ -33,20 +33,3 @@
 +typedef char *caddr_t;
  # define __daddr_t_defined
  #endif
- 
---- a/sunrpc/rpc_main.c
-+++ b/sunrpc/rpc_main.c
-@@ -958,9 +958,10 @@ mkfile_output (struct commandline *cmd)
- 	abort ();
-       temp = strrchr (cmd->infile, '.');
-       cp = stpcpy (mkfilename, "Makefile.");
--      if (temp != NULL)
--	*((char *) stpncpy (cp, cmd->infile, temp - cmd->infile)) = '\0';
--      else
-+      if (temp != NULL) {
-+        strncpy(cp, cmd->infile, temp - cmd->infile);
-+        cp[temp - cmd->infile - 1] = 0;
-+      } else
- 	stpcpy (cp, cmd->infile);
- 
-     }
diff --git a/tools/fakeroot/patches/000-relocatable.patch b/tools/fakeroot/patches/000-relocatable.patch
index 9f6915bfe8..0408acfa25 100644
--- a/tools/fakeroot/patches/000-relocatable.patch
+++ b/tools/fakeroot/patches/000-relocatable.patch
@@ -1,25 +1,29 @@
 --- a/scripts/fakeroot.in
 +++ b/scripts/fakeroot.in
-@@ -30,12 +30,19 @@ fatal ()
+@@ -30,13 +30,20 @@ fatal ()
  }
  
  # strip /bin/fakeroot to find install prefix
 -FAKEROOT_PREFIX=@prefix@
 -FAKEROOT_BINDIR=@bindir@
 +if [ -n "$STAGING_DIR_HOST" ]; then
-+    FAKEROOT_PREFIX="${STAGING_DIR_HOST}"
-+    FAKEROOT_BINDIR="${STAGING_DIR_HOST}/bin"
-+    FAKEROOT_LIBDIR="${STAGING_DIR_HOST}/lib"
++    USEABSLIBPATH=1
++    LIB=${STAGING_DIR_HOST}/lib/lib@fakeroot_transformed@@DLSUFFIX@
++    FAKED=${STAGING_DIR_HOST}/bin/faked
++    PATHS=
 +else
 +    FAKEROOT_PREFIX=@prefix@
 +    FAKEROOT_BINDIR=@bindir@
-+    FAKEROOT_LIBDIR=@libdir@
+ 
+-USEABSLIBPATH=@LDPRELOADABS@
+-LIB=lib@fakeroot_transformed@@DLSUFFIX@
+-PATHS=@libdir@:${FAKEROOT_PREFIX}/lib64/libfakeroot:${FAKEROOT_PREFIX}/lib32/libfakeroot
+-FAKED=${FAKEROOT_BINDIR}/@faked_transformed@
++    USEABSLIBPATH=@LDPRELOADABS@
++    LIB=lib@fakeroot_transformed@@DLSUFFIX@
++    PATHS=@libdir@:${FAKEROOT_PREFIX}/lib64/libfakeroot:${FAKEROOT_PREFIX}/lib32/libfakeroot
++    FAKED=${FAKEROOT_BINDIR}/@faked_transformed@
 +fi
  
- USEABSLIBPATH=@LDPRELOADABS@
- LIB=lib@fakeroot_transformed@@DLSUFFIX@
--PATHS=@libdir@:${FAKEROOT_PREFIX}/lib64/libfakeroot:${FAKEROOT_PREFIX}/lib32/libfakeroot
-+PATHS=${FAKEROOT_LIBDIR}:${FAKEROOT_PREFIX}/lib64/libfakeroot:${FAKEROOT_PREFIX}/lib32/libfakeroot
- FAKED=${FAKEROOT_BINDIR}/@faked_transformed@
- 
  FAKED_MODE="unknown-is-root"
+ export FAKED_MODE