Merge remote-tracking branch 'upstream/master'

30 files changed, 1056 insertions, 28 deletions

diff --git a/config/arch/sh.in b/config/arch/sh.in
index 68d3120..60de313 100644
--- a/config/arch/sh.in
+++ b/config/arch/sh.in
@@ -5,6 +5,7 @@
 ## select ARCH_USE_MMU
 ## select ARCH_SUPPORTS_BOTH_ENDIAN
 ## select ARCH_DEFAULT_LE
+## select ARCH_REQUIRES_MULTILIB
 ##
 ## help The Super-H architecture, as defined by:
 ## help     http://www.renesas.com/fmwk.jsp?cnt=superh_family_landing.jsp&fp=/products/mpumcu/superh_family/
diff --git a/config/cc/gcc.in.2 b/config/cc/gcc.in.2
index 17b41cc..c200d22 100644
--- a/config/cc/gcc.in.2
+++ b/config/cc/gcc.in.2
@@ -37,6 +37,16 @@ config CC_GCC_EXTRA_CONFIG_ARRAY
       if they are properly quoted (or escaped, but prefer quotes). Eg.:
           --with-foo="1st arg with 4 spaces" --with-bar=2nd-arg-without-space
 
+config CC_GCC_MULTILIB_LIST
+    string
+    prompt "List of multilib variants"
+    depends on MULTILIB
+    help
+      Architecture-specific option of expanding or restricting the list of
+      the multilib variants to be built. Refer to GCC installation manual
+      for the format of this option for a particular architecture.
+      Leave empty to use the default list for this architecture.
+
 config CC_GCC_TARGET_FINAL
     bool
     prompt "Use the default targets all and install for the final compiler"
diff --git a/config/libc/glibc.in b/config/libc/glibc.in
index fc7c85b..96879cc 100644
--- a/config/libc/glibc.in
+++ b/config/libc/glibc.in
@@ -74,7 +74,7 @@ choice
 config LIBC_GLIBC_V_2_23
     bool
     prompt "2.23"
-    select LIBC_GLIBC_2_20_or_later
+    select LIBC_GLIBC_2_23_or_later
 
 config LIBC_GLIBC_V_2_22
     bool
@@ -109,6 +109,11 @@ endchoice
 
 endif # ! LIBC_GLIBC_CUSTOM
 
+# Checked by SPARC build: SPARCv8 is dropped in 2.23.
+config LIBC_GLIBC_2_23_or_later
+    select LIBC_GLIBC_2_20_or_later
+    bool
+
 # DeMark 2.20 as no longer needs to set NPTL as an addon.
 # It is no longer possible to build glibc without pthread!
 config LIBC_GLIBC_2_20_or_later
diff --git a/config/libc/musl.in b/config/libc/musl.in
index 00d98ea..ff84448 100644
--- a/config/libc/musl.in
+++ b/config/libc/musl.in
@@ -1,6 +1,7 @@
 # musl options
 
 ## depends on ! WINDOWS && ! BARE_METAL
+## depends on EXPERIMENTAL
 ##
 ## select LIBC_SUPPORT_THREADS_NATIVE
 ## select CC_CORE_PASSES_NEEDED
diff --git a/patches/dmalloc/5.5.2/170-ppc-bogus-assembly.patch b/patches/dmalloc/5.5.2/170-ppc-bogus-assembly.patch
new file mode 100644
index 0000000..d92bd8a
--- /dev/null
+++ b/patches/dmalloc/5.5.2/170-ppc-bogus-assembly.patch
@@ -0,0 +1,13 @@
+diff -ur dmalloc-5.5.2.orig/return.h dmalloc-5.5.2/return.h
+--- dmalloc-5.5.2.orig/return.h	2016-03-13 13:11:48.090431764 -0700
++++ dmalloc-5.5.2/return.h	2016-03-13 13:12:11.246642618 -0700
+@@ -251,8 +251,7 @@
+ 
+ #define GET_RET_ADDR(file) \
+ do { \
+-  asm("mflr 0"); \
+-  asm("stw 0,%0" : "=g" (file)); \
++  asm("mflr %0" : "=r"(file)); \
+ } while(0)
+ 
+ #endif /* __powerpc__ && __GNUC__ && !__OPTIMIZE__ */
diff --git a/patches/gcc/5.3.0/130-build_gcc-5_with_gcc-6.patch b/patches/gcc/5.3.0/130-build_gcc-5_with_gcc-6.patch
new file mode 100644
index 0000000..fbab9eb
--- /dev/null
+++ b/patches/gcc/5.3.0/130-build_gcc-5_with_gcc-6.patch
@@ -0,0 +1,151 @@
+From 1e5f1089dec3af328fd03125d6778f666d0bd4e4 Mon Sep 17 00:00:00 2001
+From: edlinger <edlinger@138bc75d-0d04-0410-961f-82ee72b054a4>
+Date: Thu, 25 Feb 2016 15:33:50 +0000
+Subject: [PATCH 1/1] 2016-02-25  Bernd Edlinger  <bernd.edlinger@hotmail.de>
+
+        Backported from mainline
+        2016-02-19  Jakub Jelinek  <jakub@redhat.com>
+                    Bernd Edlinger  <bernd.edlinger@hotmail.de>
+
+        * Make-lang.in: Invoke gperf with -L C++.
+        * cfns.gperf: Remove prototypes for hash and libc_name_p
+        inlines.
+        * cfns.h: Regenerated.
+        * except.c (nothrow_libfn_p): Adjust.
+
+
+git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/branches/gcc-5-branch@233720 138bc75d-0d04-0410-961f-82ee72b054a4
+---
+ gcc/cp/Make-lang.in |    2 +-
+ gcc/cp/cfns.gperf   |   10 ++--------
+ gcc/cp/cfns.h       |   41 ++++++++++++++---------------------------
+ gcc/cp/except.c     |    3 ++-
+ 5 files changed, 31 insertions(+), 37 deletions(-)
+
+diff --git a/gcc/cp/Make-lang.in b/gcc/cp/Make-lang.in
+index e98beb1..b09fb02 100644
+--- a/gcc/cp/Make-lang.in
++++ b/gcc/cp/Make-lang.in
+@@ -111,7 +111,7 @@ else
+ # deleting the $(srcdir)/cp/cfns.h file.
+ $(srcdir)/cp/cfns.h:
+ endif
+-	gperf -o -C -E -k '1-6,$$' -j1 -D -N 'libc_name_p' -L ANSI-C \
++	gperf -o -C -E -k '1-6,$$' -j1 -D -N 'libc_name_p' -L C++ \
+ 		$(srcdir)/cp/cfns.gperf --output-file $(srcdir)/cp/cfns.h
+ 
+ #
+diff --git a/gcc/cp/cfns.gperf b/gcc/cp/cfns.gperf
+index 68acd3d..214ecf6 100644
+--- a/gcc/cp/cfns.gperf
++++ b/gcc/cp/cfns.gperf
+@@ -1,3 +1,5 @@
++%language=C++
++%define class-name libc_name
+ %{
+ /* Copyright (C) 2000-2015 Free Software Foundation, Inc.
+ 
+@@ -16,14 +18,6 @@ for more details.
+ You should have received a copy of the GNU General Public License
+ along with GCC; see the file COPYING3.  If not see
+ <http://www.gnu.org/licenses/>.  */
+-#ifdef __GNUC__
+-__inline
+-#endif
+-static unsigned int hash (const char *, unsigned int);
+-#ifdef __GNUC__
+-__inline
+-#endif
+-const char * libc_name_p (const char *, unsigned int);
+ %}
+ %%
+ # The standard C library functions, for feeding to gperf; the result is used
+diff --git a/gcc/cp/cfns.h b/gcc/cp/cfns.h
+index 1c6665d..596f413 100644
+--- a/gcc/cp/cfns.h
++++ b/gcc/cp/cfns.h
+@@ -1,5 +1,5 @@
+-/* ANSI-C code produced by gperf version 3.0.3 */
+-/* Command-line: gperf -o -C -E -k '1-6,$' -j1 -D -N libc_name_p -L ANSI-C cfns.gperf  */
++/* C++ code produced by gperf version 3.0.4 */
++/* Command-line: gperf -o -C -E -k '1-6,$' -j1 -D -N libc_name_p -L C++ --output-file cfns.h cfns.gperf  */
+ 
+ #if !((' ' == 32) && ('!' == 33) && ('"' == 34) && ('#' == 35) \
+       && ('%' == 37) && ('&' == 38) && ('\'' == 39) && ('(' == 40) \
+@@ -28,7 +28,7 @@
+ #error "gperf generated tables don't work with this execution character set. Please report a bug to <bug-gnu-gperf@gnu.org>."
+ #endif
+ 
+-#line 1 "cfns.gperf"
++#line 3 "cfns.gperf"
+ 
+ /* Copyright (C) 2000-2015 Free Software Foundation, Inc.
+ 
+@@ -47,25 +47,18 @@ for more details.
+ You should have received a copy of the GNU General Public License
+ along with GCC; see the file COPYING3.  If not see
+ <http://www.gnu.org/licenses/>.  */
+-#ifdef __GNUC__
+-__inline
+-#endif
+-static unsigned int hash (const char *, unsigned int);
+-#ifdef __GNUC__
+-__inline
+-#endif
+-const char * libc_name_p (const char *, unsigned int);
+ /* maximum key range = 391, duplicates = 0 */
+ 
+-#ifdef __GNUC__
+-__inline
+-#else
+-#ifdef __cplusplus
+-inline
+-#endif
+-#endif
+-static unsigned int
+-hash (register const char *str, register unsigned int len)
++class libc_name
++{
++private:
++  static inline unsigned int hash (const char *str, unsigned int len);
++public:
++  static const char *libc_name_p (const char *str, unsigned int len);
++};
++
++inline unsigned int
++libc_name::hash (register const char *str, register unsigned int len)
+ {
+   static const unsigned short asso_values[] =
+     {
+@@ -122,14 +115,8 @@ hash (register const char *str, register unsigned int len)
+   return hval + asso_values[(unsigned char)str[len - 1]];
+ }
+ 
+-#ifdef __GNUC__
+-__inline
+-#ifdef __GNUC_STDC_INLINE__
+-__attribute__ ((__gnu_inline__))
+-#endif
+-#endif
+ const char *
+-libc_name_p (register const char *str, register unsigned int len)
++libc_name::libc_name_p (register const char *str, register unsigned int len)
+ {
+   enum
+     {
+diff --git a/gcc/cp/except.c b/gcc/cp/except.c
+index 3ff1ce6..2f2e396 100644
+--- a/gcc/cp/except.c
++++ b/gcc/cp/except.c
+@@ -1040,7 +1040,8 @@ nothrow_libfn_p (const_tree fn)
+      unless the system headers are playing rename tricks, and if
+      they are, we don't want to be confused by them.  */
+   id = DECL_NAME (fn);
+-  return !!libc_name_p (IDENTIFIER_POINTER (id), IDENTIFIER_LENGTH (id));
++  return !!libc_name::libc_name_p (IDENTIFIER_POINTER (id),
++				   IDENTIFIER_LENGTH (id));
+ }
+ 
+ /* Returns nonzero if an exception of type FROM will be caught by a
+-- 
+1.7.1
diff --git a/patches/glibc/2.22/120-cve-2105-7547-getaddrinfo-stack.patch b/patches/glibc/2.22/120-cve-2105-7547-getaddrinfo-stack.patch
new file mode 100644
index 0000000..257c5f2
--- /dev/null
+++ b/patches/glibc/2.22/120-cve-2105-7547-getaddrinfo-stack.patch
@@ -0,0 +1,551 @@
+diff -ruN glibc-2.22.orig/resolv/nss_dns/dns-host.c glibc-2.22/resolv/nss_dns/dns-host.c
+--- glibc-2.22.orig/resolv/nss_dns/dns-host.c	2015-08-04 23:42:21.000000000 -0700
++++ glibc-2.22/resolv/nss_dns/dns-host.c	2016-02-16 13:38:38.000000000 -0800
+@@ -1031,7 +1031,10 @@
+   int h_namelen = 0;
+ 
+   if (ancount == 0)
+-    return NSS_STATUS_NOTFOUND;
++    {
++      *h_errnop = HOST_NOT_FOUND;
++      return NSS_STATUS_NOTFOUND;
++    }
+ 
+   while (ancount-- > 0 && cp < end_of_message && had_error == 0)
+     {
+@@ -1208,7 +1211,14 @@
+   /* Special case here: if the resolver sent a result but it only
+      contains a CNAME while we are looking for a T_A or T_AAAA record,
+      we fail with NOTFOUND instead of TRYAGAIN.  */
+-  return canon == NULL ? NSS_STATUS_TRYAGAIN : NSS_STATUS_NOTFOUND;
++  if (canon != NULL)
++    {
++      *h_errnop = HOST_NOT_FOUND;
++      return NSS_STATUS_NOTFOUND;
++    }
++
++  *h_errnop = NETDB_INTERNAL;
++  return NSS_STATUS_TRYAGAIN;
+ }
+ 
+ 
+@@ -1222,11 +1232,101 @@
+ 
+   enum nss_status status = NSS_STATUS_NOTFOUND;
+ 
++  /* Combining the NSS status of two distinct queries requires some
++     compromise and attention to symmetry (A or AAAA queries can be
++     returned in any order).  What follows is a breakdown of how this
++     code is expected to work and why. We discuss only SUCCESS,
++     TRYAGAIN, NOTFOUND and UNAVAIL, since they are the only returns
++     that apply (though RETURN and MERGE exist).  We make a distinction
++     between TRYAGAIN (recoverable) and TRYAGAIN' (not-recoverable).
++     A recoverable TRYAGAIN is almost always due to buffer size issues
++     and returns ERANGE in errno and the caller is expected to retry
++     with a larger buffer.
++
++     Lastly, you may be tempted to make significant changes to the
++     conditions in this code to bring about symmetry between responses.
++     Please don't change anything without due consideration for
++     expected application behaviour.  Some of the synthesized responses
++     aren't very well thought out and sometimes appear to imply that
++     IPv4 responses are always answer 1, and IPv6 responses are always
++     answer 2, but that's not true (see the implemetnation of send_dg
++     and send_vc to see response can arrive in any order, particlarly
++     for UDP). However, we expect it holds roughly enough of the time
++     that this code works, but certainly needs to be fixed to make this
++     a more robust implementation.
++
++     ----------------------------------------------
++     | Answer 1 Status /   | Synthesized | Reason |
++     | Answer 2 Status     | Status      |        |
++     |--------------------------------------------|
++     | SUCCESS/SUCCESS     | SUCCESS     | [1]    |
++     | SUCCESS/TRYAGAIN    | TRYAGAIN    | [5]    |
++     | SUCCESS/TRYAGAIN'   | SUCCESS     | [1]    |
++     | SUCCESS/NOTFOUND    | SUCCESS     | [1]    |
++     | SUCCESS/UNAVAIL     | SUCCESS     | [1]    |
++     | TRYAGAIN/SUCCESS    | TRYAGAIN    | [2]    |
++     | TRYAGAIN/TRYAGAIN   | TRYAGAIN    | [2]    |
++     | TRYAGAIN/TRYAGAIN'  | TRYAGAIN    | [2]    |
++     | TRYAGAIN/NOTFOUND   | TRYAGAIN    | [2]    |
++     | TRYAGAIN/UNAVAIL    | TRYAGAIN    | [2]    |
++     | TRYAGAIN'/SUCCESS   | SUCCESS     | [3]    |
++     | TRYAGAIN'/TRYAGAIN  | TRYAGAIN    | [3]    |
++     | TRYAGAIN'/TRYAGAIN' | TRYAGAIN'   | [3]    |
++     | TRYAGAIN'/NOTFOUND  | TRYAGAIN'   | [3]    |
++     | TRYAGAIN'/UNAVAIL   | UNAVAIL     | [3]    |
++     | NOTFOUND/SUCCESS    | SUCCESS     | [3]    |
++     | NOTFOUND/TRYAGAIN   | TRYAGAIN    | [3]    |
++     | NOTFOUND/TRYAGAIN'  | TRYAGAIN'   | [3]    |
++     | NOTFOUND/NOTFOUND   | NOTFOUND    | [3]    |
++     | NOTFOUND/UNAVAIL    | UNAVAIL     | [3]    |
++     | UNAVAIL/SUCCESS     | UNAVAIL     | [4]    |
++     | UNAVAIL/TRYAGAIN    | UNAVAIL     | [4]    |
++     | UNAVAIL/TRYAGAIN'   | UNAVAIL     | [4]    |
++     | UNAVAIL/NOTFOUND    | UNAVAIL     | [4]    |
++     | UNAVAIL/UNAVAIL     | UNAVAIL     | [4]    |
++     ----------------------------------------------
++
++     [1] If the first response is a success we return success.
++         This ignores the state of the second answer and in fact
++         incorrectly sets errno and h_errno to that of the second
++	 answer.  However because the response is a success we ignore
++	 *errnop and *h_errnop (though that means you touched errno on
++         success).  We are being conservative here and returning the
++         likely IPv4 response in the first answer as a success.
++
++     [2] If the first response is a recoverable TRYAGAIN we return
++	 that instead of looking at the second response.  The
++	 expectation here is that we have failed to get an IPv4 response
++	 and should retry both queries.
++
++     [3] If the first response was not a SUCCESS and the second
++	 response is not NOTFOUND (had a SUCCESS, need to TRYAGAIN,
++	 or failed entirely e.g. TRYAGAIN' and UNAVAIL) then use the
++	 result from the second response, otherwise the first responses
++	 status is used.  Again we have some odd side-effects when the
++	 second response is NOTFOUND because we overwrite *errnop and
++	 *h_errnop that means that a first answer of NOTFOUND might see
++	 its *errnop and *h_errnop values altered.  Whether it matters
++	 in practice that a first response NOTFOUND has the wrong
++	 *errnop and *h_errnop is undecided.
++
++     [4] If the first response is UNAVAIL we return that instead of
++	 looking at the second response.  The expectation here is that
++	 it will have failed similarly e.g. configuration failure.
++
++     [5] Testing this code is complicated by the fact that truncated
++	 second response buffers might be returned as SUCCESS if the
++	 first answer is a SUCCESS.  To fix this we add symmetry to
++	 TRYAGAIN with the second response.  If the second response
++	 is a recoverable error we now return TRYAGIN even if the first
++	 response was SUCCESS.  */
++
+   if (anslen1 > 0)
+     status = gaih_getanswer_slice(answer1, anslen1, qname,
+ 				  &pat, &buffer, &buflen,
+ 				  errnop, h_errnop, ttlp,
+ 				  &first);
++
+   if ((status == NSS_STATUS_SUCCESS || status == NSS_STATUS_NOTFOUND
+        || (status == NSS_STATUS_TRYAGAIN
+ 	   /* We want to look at the second answer in case of an
+@@ -1242,8 +1342,15 @@
+ 						     &pat, &buffer, &buflen,
+ 						     errnop, h_errnop, ttlp,
+ 						     &first);
++      /* Use the second response status in some cases.  */
+       if (status != NSS_STATUS_SUCCESS && status2 != NSS_STATUS_NOTFOUND)
+ 	status = status2;
++      /* Do not return a truncated second response (unless it was
++         unavoidable e.g. unrecoverable TRYAGAIN).  */
++      if (status == NSS_STATUS_SUCCESS
++	  && (status2 == NSS_STATUS_TRYAGAIN
++	      && *errnop == ERANGE && *h_errnop != NO_RECOVERY))
++	status = NSS_STATUS_TRYAGAIN;
+     }
+ 
+   return status;
+diff -ruN glibc-2.22.orig/resolv/res_query.c glibc-2.22/resolv/res_query.c
+--- glibc-2.22.orig/resolv/res_query.c	2015-08-04 23:42:21.000000000 -0700
++++ glibc-2.22/resolv/res_query.c	2016-02-16 13:38:38.000000000 -0800
+@@ -396,6 +396,7 @@
+ 		  {
+ 		    free (*answerp2);
+ 		    *answerp2 = NULL;
++		    *nanswerp2 = 0;
+ 		    *answerp2_malloced = 0;
+ 		  }
+ 	}
+@@ -447,6 +448,7 @@
+ 			  {
+ 			    free (*answerp2);
+ 			    *answerp2 = NULL;
++			    *nanswerp2 = 0;
+ 			    *answerp2_malloced = 0;
+ 			  }
+ 
+@@ -521,6 +523,7 @@
+ 	  {
+ 	    free (*answerp2);
+ 	    *answerp2 = NULL;
++	    *nanswerp2 = 0;
+ 	    *answerp2_malloced = 0;
+ 	  }
+ 	if (saved_herrno != -1)
+diff -ruN glibc-2.22.orig/resolv/res_send.c glibc-2.22/resolv/res_send.c
+--- glibc-2.22.orig/resolv/res_send.c	2015-08-04 23:42:21.000000000 -0700
++++ glibc-2.22/resolv/res_send.c	2016-02-16 13:43:59.000000000 -0800
+@@ -1,3 +1,20 @@
++/* Copyright (C) 2016 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <http://www.gnu.org/licenses/>.  */
++
+ /*
+  * Copyright (c) 1985, 1989, 1993
+  *    The Regents of the University of California.  All rights reserved.
+@@ -363,6 +380,8 @@
+ #ifdef USE_HOOKS
+ 	if (__glibc_unlikely (statp->qhook || statp->rhook))       {
+ 		if (anssiz < MAXPACKET && ansp) {
++			/* Always allocate MAXPACKET, callers expect
++			   this specific size.  */
+ 			u_char *buf = malloc (MAXPACKET);
+ 			if (buf == NULL)
+ 				return (-1);
+@@ -638,6 +657,77 @@
+     return (struct sockaddr *) (void *) &statp->nsaddr_list[n];
+ }
+ 
++/* The send_vc function is responsible for sending a DNS query over TCP
++   to the nameserver numbered NS from the res_state STATP i.e.
++   EXT(statp).nssocks[ns].  The function supports sending both IPv4 and
++   IPv6 queries at the same serially on the same socket.
++
++   Please note that for TCP there is no way to disable sending both
++   queries, unlike UDP, which honours RES_SNGLKUP and RES_SNGLKUPREOP
++   and sends the queries serially and waits for the result after each
++   sent query.  This implemetnation should be corrected to honour these
++   options.
++
++   Please also note that for TCP we send both queries over the same
++   socket one after another.  This technically violates best practice
++   since the server is allowed to read the first query, respond, and
++   then close the socket (to service another client).  If the server
++   does this, then the remaining second query in the socket data buffer
++   will cause the server to send the client an RST which will arrive
++   asynchronously and the client's OS will likely tear down the socket
++   receive buffer resulting in a potentially short read and lost
++   response data.  This will force the client to retry the query again,
++   and this process may repeat until all servers and connection resets
++   are exhausted and then the query will fail.  It's not known if this
++   happens with any frequency in real DNS server implementations.  This
++   implementation should be corrected to use two sockets by default for
++   parallel queries.
++
++   The query stored in BUF of BUFLEN length is sent first followed by
++   the query stored in BUF2 of BUFLEN2 length.  Queries are sent
++   serially on the same socket.
++
++   Answers to the query are stored firstly in *ANSP up to a max of
++   *ANSSIZP bytes.  If more than *ANSSIZP bytes are needed and ANSCP
++   is non-NULL (to indicate that modifying the answer buffer is allowed)
++   then malloc is used to allocate a new response buffer and ANSCP and
++   ANSP will both point to the new buffer.  If more than *ANSSIZP bytes
++   are needed but ANSCP is NULL, then as much of the response as
++   possible is read into the buffer, but the results will be truncated.
++   When truncation happens because of a small answer buffer the DNS
++   packets header feild TC will bet set to 1, indicating a truncated
++   message and the rest of the socket data will be read and discarded.
++
++   Answers to the query are stored secondly in *ANSP2 up to a max of
++   *ANSSIZP2 bytes, with the actual response length stored in
++   *RESPLEN2.  If more than *ANSSIZP bytes are needed and ANSP2
++   is non-NULL (required for a second query) then malloc is used to
++   allocate a new response buffer, *ANSSIZP2 is set to the new buffer
++   size and *ANSP2_MALLOCED is set to 1.
++
++   The ANSP2_MALLOCED argument will eventually be removed as the
++   change in buffer pointer can be used to detect the buffer has
++   changed and that the caller should use free on the new buffer.
++
++   Note that the answers may arrive in any order from the server and
++   therefore the first and second answer buffers may not correspond to
++   the first and second queries.
++
++   It is not supported to call this function with a non-NULL ANSP2
++   but a NULL ANSCP.  Put another way, you can call send_vc with a
++   single unmodifiable buffer or two modifiable buffers, but no other
++   combination is supported.
++
++   It is the caller's responsibility to free the malloc allocated
++   buffers by detecting that the pointers have changed from their
++   original values i.e. *ANSCP or *ANSP2 has changed.
++
++   If errors are encountered then *TERRNO is set to an appropriate
++   errno value and a zero result is returned for a recoverable error,
++   and a less-than zero result is returned for a non-recoverable error.
++
++   If no errors are encountered then *TERRNO is left unmodified and
++   a the length of the first response in bytes is returned.  */
+ static int
+ send_vc(res_state statp,
+ 	const u_char *buf, int buflen, const u_char *buf2, int buflen2,
+@@ -647,11 +737,7 @@
+ {
+ 	const HEADER *hp = (HEADER *) buf;
+ 	const HEADER *hp2 = (HEADER *) buf2;
+-	u_char *ans = *ansp;
+-	int orig_anssizp = *anssizp;
+-	// XXX REMOVE
+-	// int anssiz = *anssizp;
+-	HEADER *anhp = (HEADER *) ans;
++	HEADER *anhp = (HEADER *) *ansp;
+ 	struct sockaddr *nsap = get_nsaddr (statp, ns);
+ 	int truncating, connreset, n;
+ 	/* On some architectures compiler might emit a warning indicating
+@@ -743,6 +829,8 @@
+ 	 * Receive length & response
+ 	 */
+ 	int recvresp1 = 0;
++	/* Skip the second response if there is no second query.
++           To do that we mark the second response as received.  */
+ 	int recvresp2 = buf2 == NULL;
+ 	uint16_t rlen16;
+  read_len:
+@@ -779,40 +867,14 @@
+ 	u_char **thisansp;
+ 	int *thisresplenp;
+ 	if ((recvresp1 | recvresp2) == 0 || buf2 == NULL) {
++		/* We have not received any responses
++		   yet or we only have one response to
++		   receive.  */
+ 		thisanssizp = anssizp;
+ 		thisansp = anscp ?: ansp;
+ 		assert (anscp != NULL || ansp2 == NULL);
+ 		thisresplenp = &resplen;
+ 	} else {
+-		if (*anssizp != MAXPACKET) {
+-			/* No buffer allocated for the first
+-			   reply.  We can try to use the rest
+-			   of the user-provided buffer.  */
+-#if __GNUC_PREREQ (4, 7)
+-			DIAG_PUSH_NEEDS_COMMENT;
+-			DIAG_IGNORE_NEEDS_COMMENT (5, "-Wmaybe-uninitialized");
+-#endif
+-#if _STRING_ARCH_unaligned
+-			*anssizp2 = orig_anssizp - resplen;
+-			*ansp2 = *ansp + resplen;
+-#else
+-			int aligned_resplen
+-			  = ((resplen + __alignof__ (HEADER) - 1)
+-			     & ~(__alignof__ (HEADER) - 1));
+-			*anssizp2 = orig_anssizp - aligned_resplen;
+-			*ansp2 = *ansp + aligned_resplen;
+-#endif
+-#if __GNUC_PREREQ (4, 7)
+-			DIAG_POP_NEEDS_COMMENT;
+-#endif
+-		} else {
+-			/* The first reply did not fit into the
+-			   user-provided buffer.  Maybe the second
+-			   answer will.  */
+-			*anssizp2 = orig_anssizp;
+-			*ansp2 = *ansp;
+-		}
+-
+ 		thisanssizp = anssizp2;
+ 		thisansp = ansp2;
+ 		thisresplenp = resplen2;
+@@ -820,10 +882,14 @@
+ 	anhp = (HEADER *) *thisansp;
+ 
+ 	*thisresplenp = rlen;
+-	if (rlen > *thisanssizp) {
+-		/* Yes, we test ANSCP here.  If we have two buffers
+-		   both will be allocatable.  */
+-		if (__glibc_likely (anscp != NULL))       {
++	/* Is the answer buffer too small?  */
++	if (*thisanssizp < rlen) {
++		/* If the current buffer is not the the static
++		   user-supplied buffer then we can reallocate
++		   it.  */
++		if (thisansp != NULL && thisansp != ansp) {
++			/* Always allocate MAXPACKET, callers expect
++			   this specific size.  */
+ 			u_char *newp = malloc (MAXPACKET);
+ 			if (newp == NULL) {
+ 				*terrno = ENOMEM;
+@@ -835,6 +901,9 @@
+ 			if (thisansp == ansp2)
+ 			  *ansp2_malloced = 1;
+ 			anhp = (HEADER *) newp;
++			/* A uint16_t can't be larger than MAXPACKET
++			   thus it's safe to allocate MAXPACKET but
++			   read RLEN bytes instead.  */
+ 			len = rlen;
+ 		} else {
+ 			Dprint(statp->options & RES_DEBUG,
+@@ -997,6 +1066,66 @@
+ 	return 1;
+ }
+ 
++/* The send_dg function is responsible for sending a DNS query over UDP
++   to the nameserver numbered NS from the res_state STATP i.e.
++   EXT(statp).nssocks[ns].  The function supports IPv4 and IPv6 queries
++   along with the ability to send the query in parallel for both stacks
++   (default) or serially (RES_SINGLKUP).  It also supports serial lookup
++   with a close and reopen of the socket used to talk to the server
++   (RES_SNGLKUPREOP) to work around broken name servers.
++
++   The query stored in BUF of BUFLEN length is sent first followed by
++   the query stored in BUF2 of BUFLEN2 length.  Queries are sent
++   in parallel (default) or serially (RES_SINGLKUP or RES_SNGLKUPREOP).
++
++   Answers to the query are stored firstly in *ANSP up to a max of
++   *ANSSIZP bytes.  If more than *ANSSIZP bytes are needed and ANSCP
++   is non-NULL (to indicate that modifying the answer buffer is allowed)
++   then malloc is used to allocate a new response buffer and ANSCP and
++   ANSP will both point to the new buffer.  If more than *ANSSIZP bytes
++   are needed but ANSCP is NULL, then as much of the response as
++   possible is read into the buffer, but the results will be truncated.
++   When truncation happens because of a small answer buffer the DNS
++   packets header feild TC will bet set to 1, indicating a truncated
++   message, while the rest of the UDP packet is discarded.
++
++   Answers to the query are stored secondly in *ANSP2 up to a max of
++   *ANSSIZP2 bytes, with the actual response length stored in
++   *RESPLEN2.  If more than *ANSSIZP bytes are needed and ANSP2
++   is non-NULL (required for a second query) then malloc is used to
++   allocate a new response buffer, *ANSSIZP2 is set to the new buffer
++   size and *ANSP2_MALLOCED is set to 1.
++
++   The ANSP2_MALLOCED argument will eventually be removed as the
++   change in buffer pointer can be used to detect the buffer has
++   changed and that the caller should use free on the new buffer.
++
++   Note that the answers may arrive in any order from the server and
++   therefore the first and second answer buffers may not correspond to
++   the first and second queries.
++
++   It is not supported to call this function with a non-NULL ANSP2
++   but a NULL ANSCP.  Put another way, you can call send_vc with a
++   single unmodifiable buffer or two modifiable buffers, but no other
++   combination is supported.
++
++   It is the caller's responsibility to free the malloc allocated
++   buffers by detecting that the pointers have changed from their
++   original values i.e. *ANSCP or *ANSP2 has changed.
++
++   If an answer is truncated because of UDP datagram DNS limits then
++   *V_CIRCUIT is set to 1 and the return value non-zero to indicate to
++   the caller to retry with TCP.  The value *GOTSOMEWHERE is set to 1
++   if any progress was made reading a response from the nameserver and
++   is used by the caller to distinguish between ECONNREFUSED and
++   ETIMEDOUT (the latter if *GOTSOMEWHERE is 1).
++
++   If errors are encountered then *TERRNO is set to an appropriate
++   errno value and a zero result is returned for a recoverable error,
++   and a less-than zero result is returned for a non-recoverable error.
++
++   If no errors are encountered then *TERRNO is left unmodified and
++   a the length of the first response in bytes is returned.  */
+ static int
+ send_dg(res_state statp,
+ 	const u_char *buf, int buflen, const u_char *buf2, int buflen2,
+@@ -1006,8 +1135,6 @@
+ {
+ 	const HEADER *hp = (HEADER *) buf;
+ 	const HEADER *hp2 = (HEADER *) buf2;
+-	u_char *ans = *ansp;
+-	int orig_anssizp = *anssizp;
+ 	struct timespec now, timeout, finish;
+ 	struct pollfd pfd[1];
+ 	int ptimeout;
+@@ -1040,6 +1167,8 @@
+ 	int need_recompute = 0;
+ 	int nwritten = 0;
+ 	int recvresp1 = 0;
++	/* Skip the second response if there is no second query.
++           To do that we mark the second response as received.  */
+ 	int recvresp2 = buf2 == NULL;
+ 	pfd[0].fd = EXT(statp).nssocks[ns];
+ 	pfd[0].events = POLLOUT;
+@@ -1203,55 +1332,56 @@
+ 		int *thisresplenp;
+ 
+ 		if ((recvresp1 | recvresp2) == 0 || buf2 == NULL) {
++			/* We have not received any responses
++			   yet or we only have one response to
++			   receive.  */
+ 			thisanssizp = anssizp;
+ 			thisansp = anscp ?: ansp;
+ 			assert (anscp != NULL || ansp2 == NULL);
+ 			thisresplenp = &resplen;
+ 		} else {
+-			if (*anssizp != MAXPACKET) {
+-				/* No buffer allocated for the first
+-				   reply.  We can try to use the rest
+-				   of the user-provided buffer.  */
+-#if _STRING_ARCH_unaligned
+-				*anssizp2 = orig_anssizp - resplen;
+-				*ansp2 = *ansp + resplen;
+-#else
+-				int aligned_resplen
+-				  = ((resplen + __alignof__ (HEADER) - 1)
+-				     & ~(__alignof__ (HEADER) - 1));
+-				*anssizp2 = orig_anssizp - aligned_resplen;
+-				*ansp2 = *ansp + aligned_resplen;
+-#endif
+-			} else {
+-				/* The first reply did not fit into the
+-				   user-provided buffer.  Maybe the second
+-				   answer will.  */
+-				*anssizp2 = orig_anssizp;
+-				*ansp2 = *ansp;
+-			}
+-
+ 			thisanssizp = anssizp2;
+ 			thisansp = ansp2;
+ 			thisresplenp = resplen2;
+ 		}
+ 
+ 		if (*thisanssizp < MAXPACKET
+-		    /* Yes, we test ANSCP here.  If we have two buffers
+-		       both will be allocatable.  */
+-		    && anscp
++		    /* If the current buffer is not the the static
++		       user-supplied buffer then we can reallocate
++		       it.  */
++		    && (thisansp != NULL && thisansp != ansp)
+ #ifdef FIONREAD
++		    /* Is the size too small?  */
+ 		    && (ioctl (pfd[0].fd, FIONREAD, thisresplenp) < 0
+ 			|| *thisanssizp < *thisresplenp)
+ #endif
+                     ) {
++			/* Always allocate MAXPACKET, callers expect
++			   this specific size.  */
+ 			u_char *newp = malloc (MAXPACKET);
+ 			if (newp != NULL) {
+-				*anssizp = MAXPACKET;
+-				*thisansp = ans = newp;
++				*thisanssizp = MAXPACKET;
++				*thisansp = newp;
+ 				if (thisansp == ansp2)
+ 				  *ansp2_malloced = 1;
+ 			}
+ 		}
++		/* We could end up with truncation if anscp was NULL
++		   (not allowed to change caller's buffer) and the
++		   response buffer size is too small.  This isn't a
++		   reliable way to detect truncation because the ioctl
++		   may be an inaccurate report of the UDP message size.
++		   Therefore we use this only to issue debug output.
++		   To do truncation accurately with UDP we need
++		   MSG_TRUNC which is only available on Linux.  We
++		   can abstract out the Linux-specific feature in the
++		   future to detect truncation.  */
++		if (__glibc_unlikely (*thisanssizp < *thisresplenp)) {
++			Dprint(statp->options & RES_DEBUG,
++			       (stdout, ";; response may be truncated (UDP)\n")
++			);
++		}
++
+ 		HEADER *anhp = (HEADER *) *thisansp;
+ 		socklen_t fromlen = sizeof(struct sockaddr_in6);
+ 		assert (sizeof(from) <= fromlen);
diff --git a/patches/uClibc-ng/1.0.12/100-provide-_obstack_free.patch b/patches/uClibc-ng/1.0.12/100-provide-_obstack_free.patch
new file mode 100644
index 0000000..9fd4bc3
--- /dev/null
+++ b/patches/uClibc-ng/1.0.12/100-provide-_obstack_free.patch
@@ -0,0 +1,12 @@
+diff -ur uClibc-ng-1.0.12.orig/libc/misc/gnu/obstack.c uClibc-ng-1.0.12/libc/misc/gnu/obstack.c
+--- uClibc-ng-1.0.12.orig/libc/misc/gnu/obstack.c	2016-03-13 15:08:44.408962824 -0700
++++ uClibc-ng-1.0.12/libc/misc/gnu/obstack.c	2016-03-13 15:13:30.129322998 -0700
+@@ -385,7 +385,7 @@
+     abort ();
+ }
+ 
+-# if 0
++# if 1
+ /* Older versions of libc used a function _obstack_free intended to be
+    called by non-GCC compilers.  */
+ strong_alias (obstack_free, _obstack_free)
diff --git a/samples/aarch64-rpi3-linux-gnueabi/crosstool.config b/samples/aarch64-rpi3-linux-gnueabi/crosstool.config
index 7c880c4..2bbece8 100644
--- a/samples/aarch64-rpi3-linux-gnueabi/crosstool.config
+++ b/samples/aarch64-rpi3-linux-gnueabi/crosstool.config
@@ -11,4 +11,3 @@ CT_BINUTILS_LD_WRAPPER=y
 CT_BINUTILS_PLUGINS=y
 CT_CC_LANG_CXX=y
 CT_DEBUG_gdb=y
-CT_GDB_CROSS_EXTRA_CONFIG_ARRAY="--with-expat"
diff --git a/samples/aarch64-unknown-linux-gnueabi/crosstool.config b/samples/aarch64-unknown-linux-gnueabi/crosstool.config
index 90a2ccc..20b8509 100644
--- a/samples/aarch64-unknown-linux-gnueabi/crosstool.config
+++ b/samples/aarch64-unknown-linux-gnueabi/crosstool.config
@@ -11,4 +11,3 @@ CT_BINUTILS_LD_WRAPPER=y
 CT_BINUTILS_PLUGINS=y
 CT_CC_LANG_CXX=y
 CT_DEBUG_gdb=y
-CT_GDB_CROSS_EXTRA_CONFIG_ARRAY="--with-expat"
diff --git a/samples/armv7-rpi2-linux-gnueabihf/crosstool.config b/samples/armv7-rpi2-linux-gnueabihf/crosstool.config
index 3c2e478..d56a4f4 100644
--- a/samples/armv7-rpi2-linux-gnueabihf/crosstool.config
+++ b/samples/armv7-rpi2-linux-gnueabihf/crosstool.config
@@ -12,4 +12,3 @@ CT_BINUTILS_LD_WRAPPER=y
 CT_BINUTILS_PLUGINS=y
 CT_CC_LANG_CXX=y
 CT_DEBUG_gdb=y
-CT_GDB_CROSS_EXTRA_CONFIG_ARRAY="--with-expat"
diff --git a/samples/armv8-rpi3-linux-gnueabihf/crosstool.config b/samples/armv8-rpi3-linux-gnueabihf/crosstool.config
index 2a0ad43..043cc6f 100644
--- a/samples/armv8-rpi3-linux-gnueabihf/crosstool.config
+++ b/samples/armv8-rpi3-linux-gnueabihf/crosstool.config
@@ -12,4 +12,3 @@ CT_BINUTILS_LD_WRAPPER=y
 CT_BINUTILS_PLUGINS=y
 CT_CC_LANG_CXX=y
 CT_DEBUG_gdb=y
-CT_GDB_CROSS_EXTRA_CONFIG_ARRAY="--with-expat"
diff --git a/samples/powerpc-unknown-linux-uclibc/broken b/samples/x86_64-w64-mingw32,x86_64-pc-linux-gnu/broken
index e69de29..e69de29 100644
--- a/samples/powerpc-unknown-linux-uclibc/broken
+++ b/samples/x86_64-w64-mingw32,x86_64-pc-linux-gnu/broken
diff --git a/samples/x86_64-w64-mingw32,x86_64-pc-linux-gnu/crosstool.config b/samples/x86_64-w64-mingw32,x86_64-pc-linux-gnu/crosstool.config
index 10ed299..304ad60 100644
--- a/samples/x86_64-w64-mingw32,x86_64-pc-linux-gnu/crosstool.config
+++ b/samples/x86_64-w64-mingw32,x86_64-pc-linux-gnu/crosstool.config
@@ -1,6 +1,4 @@
 CT_EXPERIMENTAL=y
-CT_DEBUG_CT=y
-CT_DEBUG_CT_SAVE_STEPS=y
 CT_LOCAL_TARBALLS_DIR="${HOME}/src"
 CT_SAVE_TARBALLS=y
 # CT_STRIP_HOST_TOOLCHAIN_EXECUTABLES is not set
diff --git a/scripts/addToolVersion.sh b/scripts/addToolVersion.sh
index 3cbf712..806ecca 100755
--- a/scripts/addToolVersion.sh
+++ b/scripts/addToolVersion.sh
@@ -44,7 +44,7 @@ doHelp() {
             add experimental obsolete version 2.3.5 and stable current versions 2.6.1
             and 2.6.2 to glibc, add stable obsolete version 3.3.3 to gcc:
               ${myname} --glibc -x -o 2.3.5 -s -c 2.6.1 2.6.2 --gcc -o 3.3.3
-        EOF
+EOF
 }
 
 # Extract field $3 from version $1 with separator $2
@@ -61,7 +61,7 @@ getVersionField() {
 # $tool         : tool name
 # $tool_prefix  : tool directory prefix
 # $EXP          : set to non empty if experimental, to empty otherwise
-# #OBS          : set to non empty if obsolete, to empty otherwise
+# OBS           : set to non empty if obsolete, to empty otherwise
 # $1            : version string to add
 addToolVersion() {
     local version="$1"
@@ -124,7 +124,7 @@ addToolVersion() {
             ver_p=$(getVersionField "${version}" . 3)
             if [ ${ver_M} -eq 2 -a ${ver_m} -eq 26 ]; then
                 SedExpr1="${SedExpr1}\n    select BINUTILS_2_26_or_later"
-            if [ ${ver_M} -eq 2 -a ${ver_m} -eq 25 -a ${ver_p} -eq 1 ]; then
+            elif [ ${ver_M} -eq 2 -a ${ver_m} -eq 25 -a ${ver_p} -eq 1 ]; then
                 SedExpr1="${SedExpr1}\n    select BINUTILS_2_25_1_or_later"
             elif [ ${ver_M} -eq 2 -a ${ver_m} -eq 25 -a -z ${ver_p} ]; then
                 SedExpr1="${SedExpr1}\n    select BINUTILS_2_25_or_later"
@@ -139,7 +139,7 @@ addToolVersion() {
             ver_M=$(getVersionField "${version}" . 1)
             ver_m=$(getVersionField "${version}" . 2)
             ver_p=$(getVersionField "${version}" . 3)
-            elif [  ${ver_M} -eq 0 -a ${ver_m} -eq 9 -a ${ver_p} -eq 33 ]; then
+            if [  ${ver_M} -eq 0 -a ${ver_m} -eq 9 -a ${ver_p} -eq 33 ]; then
                 SedExpr1="${SedExpr1}\n    select LIBC_UCLIBC_0_9_33_2_or_later"
             fi
             ;;
diff --git a/scripts/build/arch/alpha.sh b/scripts/build/arch/alpha.sh
index cf6d40d..ffceae3 100644
--- a/scripts/build/arch/alpha.sh
+++ b/scripts/build/arch/alpha.sh
@@ -4,3 +4,14 @@ CT_DoArchTupleValues () {
     # The architecture part of the tuple:
     CT_TARGET_ARCH="${CT_ARCH}${CT_ARCH_SUFFIX:-${CT_ARCH_ALPHA_VARIANT}}"
 }
+
+#------------------------------------------------------------------------------
+# Get multilib architecture-specific target
+# Usage: CT_DoArchMultilibTarget "multilib flags" "target tuple"
+CT_DoArchMultilibTarget ()
+{
+    local target="${1}"; shift
+    local -a multi_flags=( "$@" )
+
+    echo "${target}"
+}
diff --git a/scripts/build/arch/arm.sh b/scripts/build/arch/arm.sh
index 5f6ce2f..338392c 100644
--- a/scripts/build/arch/arm.sh
+++ b/scripts/build/arch/arm.sh
@@ -39,3 +39,14 @@ CT_DoArchTupleValues() {
         CT_TARGET_SYS="${CT_TARGET_SYS}hf"
     fi
 }
+
+#------------------------------------------------------------------------------
+# Get multilib architecture-specific target
+# Usage: CT_DoArchMultilibTarget "multilib flags" "target tuple"
+CT_DoArchMultilibTarget ()
+{
+    local target="${1}"; shift
+    local -a multi_flags=( "$@" )
+
+    echo "${target}"
+}
diff --git a/scripts/build/arch/m68k.sh b/scripts/build/arch/m68k.sh
index bf26d1b..a6eb010 100644
--- a/scripts/build/arch/m68k.sh
+++ b/scripts/build/arch/m68k.sh
@@ -3,3 +3,14 @@
 CT_DoArchTupleValues() {
     :
 }
+
+#------------------------------------------------------------------------------
+# Get multilib architecture-specific target
+# Usage: CT_DoArchMultilibTarget "multilib flags" "target tuple"
+CT_DoArchMultilibTarget ()
+{
+    local target="${1}"; shift
+    local -a multi_flags=( "$@" )
+
+    echo "${target}"
+}
diff --git a/scripts/build/arch/microblaze.sh b/scripts/build/arch/microblaze.sh
index 456a6e3..93ecc9a 100644
--- a/scripts/build/arch/microblaze.sh
+++ b/scripts/build/arch/microblaze.sh
@@ -19,3 +19,14 @@ CT_DoArchTupleValues () {
     esac
 
 }
+
+#------------------------------------------------------------------------------
+# Get multilib architecture-specific target
+# Usage: CT_DoArchMultilibTarget "multilib flags" "target tuple"
+CT_DoArchMultilibTarget ()
+{
+    local target="${1}"; shift
+    local -a multi_flags=( "$@" )
+
+    echo "${target}"
+}
diff --git a/scripts/build/arch/mips.sh b/scripts/build/arch/mips.sh
index 4d732be..68ad4fa 100644
--- a/scripts/build/arch/mips.sh
+++ b/scripts/build/arch/mips.sh
@@ -14,3 +14,14 @@ CT_DoArchTupleValues() {
     CT_ARCH_ABI_CFLAG="-mabi=${CT_ARCH_mips_ABI}"
     CT_ARCH_WITH_ABI="--with-abi=${CT_ARCH_mips_ABI}"
 }
+
+#------------------------------------------------------------------------------
+# Get multilib architecture-specific target
+# Usage: CT_DoArchMultilibTarget "multilib flags" "target tuple"
+CT_DoArchMultilibTarget ()
+{
+    local target="${1}"; shift
+    local -a multi_flags=( "$@" )
+
+    echo "${target}"
+}
diff --git a/scripts/build/arch/powerpc.sh b/scripts/build/arch/powerpc.sh
index fbc3120..77bbc8a 100644
--- a/scripts/build/arch/powerpc.sh
+++ b/scripts/build/arch/powerpc.sh
@@ -26,3 +26,44 @@ CT_DoArchTupleValues () {
         CT_ARCH_CC_EXTRA_CONFIG="--enable-e500_double"
     fi
 }
+#------------------------------------------------------------------------------
+# Get multilib architecture-specific target
+# Usage: CT_DoArchMultilibTarget "multilib flags" "target tuple"
+CT_DoArchMultilibTarget ()
+{
+    local target="${1}"; shift
+    local -a multi_flags=( "$@" )
+
+    local m32=false
+    local m64=false
+    local mlittle=false
+    local mbig=false
+
+    for m in "${multi_flags[@]}"; do
+        case "$m" in
+            -m32)     m32=true ;;
+            -m64)     m64=true ;;
+            -mbig)    mbig=true ;;
+            -mlittle) mlittle=true ;;
+        esac
+    done
+
+    # Fix up bitness
+    case "${target}" in
+        powerpc-*)      $m64 && target=${target/#powerpc-/powerpc64-} ;;
+        powerpcle-*)    $m64 && target=${target/#powerpcle-/powerpc64le-} ;;
+        powerpc64-*)    $m32 && target=${target/#powerpc64-/powerpc-} ;;
+        powerpc64le-*)  $m32 && target=${target/#powerpc64le-/powerpcle-} ;;
+    esac
+
+    # Fix up endianness
+    case "${target}" in
+        powerpc-*)      $mlittle && target=${target/#powerpc-/powerpcle-} ;;
+        powerpcle-*)    $mbig && target=${target/#powerpcle-/powerpc-} ;;
+        powerpc64-*)    $mlittle && target=${target/#powerpc64-/powerpc64le-} ;;
+        powerpc64le-*)  $mbig && target=${target/#powerpc64le-/powerpc64-} ;;
+    esac
+
+    # return the target
+    echo "${target}"
+}
diff --git a/scripts/build/arch/s390.sh b/scripts/build/arch/s390.sh
index b4b8078..e303420 100644
--- a/scripts/build/arch/s390.sh
+++ b/scripts/build/arch/s390.sh
@@ -6,3 +6,30 @@ CT_DoArchTupleValues() {
         CT_TARGET_ARCH="s390x${CT_ARCH_SUFFIX}"
     fi
 }
+
+#------------------------------------------------------------------------------
+# Get multilib architecture-specific target
+# Usage: CT_DoArchMultilibTarget "multilib flags" "target tuple"
+CT_DoArchMultilibTarget ()
+{
+    local target="${1}"; shift
+    local -a multi_flags=( "$@" )
+
+    local m31=false
+    local m64=false
+
+    for m in "${multi_flags[@]}"; do
+        case "${multi_flags}" in
+            -m64) m64=true ;;
+            -m31) m31=true ;;
+        esac
+    done
+
+    # Fix bitness
+    case "${target}" in
+        s390-*)   $m64 && target=${target/#s390-/s390x-} ;;
+        s390x-*)  $m31 && target=${target/#s390x-/s390-} ;;
+    esac
+
+    echo "${target}"
+}
diff --git a/scripts/build/arch/sh.sh b/scripts/build/arch/sh.sh
index 7780e40..e7f4f1a 100644
--- a/scripts/build/arch/sh.sh
+++ b/scripts/build/arch/sh.sh
@@ -35,3 +35,14 @@ CT_DoArchTupleValues () {
     esac
     CT_ARCH_FLOAT_CFLAG=
 }
+
+#------------------------------------------------------------------------------
+# Get multilib architecture-specific target
+# Usage: CT_DoArchMultilibTarget "multilib flags" "target tuple"
+CT_DoArchMultilibTarget ()
+{
+    local target="${1}"; shift
+    local -a multi_flags=( "$@" )
+
+    echo "${target}"
+}
diff --git a/scripts/build/arch/sparc.sh b/scripts/build/arch/sparc.sh
index e3e7491..2d3baa3 100644
--- a/scripts/build/arch/sparc.sh
+++ b/scripts/build/arch/sparc.sh
@@ -2,4 +2,28 @@
 CT_DoArchTupleValues() {
     # That's the only thing to override
     CT_TARGET_ARCH="sparc${target_bits_64}${CT_ARCH_SUFFIX}"
+
+    # By default, sparc64-*-linux is configured with -mcpu=v9. However,
+    # according to https://sourceware.org/ml/libc-alpha/2005-12/msg00027.html,
+    # "There is no Linux sparc64 port that runs on non-UltraSPARC-I+ ISA CPUs."
+    # There is a patch that would change the default to -mcpu=ultrasparc for
+    # sparc64-*-linux configuration: https://patchwork.ozlabs.org/patch/409424/
+    # but that patch has not been integrated (yet). One concern raised about
+    # this patch was that -mcpu=ultrasparc can suboptimally schedule instructions
+    # for newer SPARC CPUs. So, override to -mcpu=ultrasparc and warn the user.
+    if [ "${CT_KERNEL}" = "linux" -a "${CT_ARCH_64}" = "y" -a -z "${CT_ARCH_CPU}" ]; then
+        CT_DoLog WARN "Setting CPU to UltraSPARC-I for sparc64-linux. Set CT_ARCH_CPU if a different CPU is desired."
+        CT_ARCH_WITH_CPU="--with-cpu=ultrasparc"
+    fi
+}
+
+#------------------------------------------------------------------------------
+# Get multilib architecture-specific target
+# Usage: CT_DoArchMultilibTarget "multilib flags" "target tuple"
+CT_DoArchMultilibTarget ()
+{
+    local target="${1}"; shift
+    local -a multi_flags=( "$@" )
+
+    echo "${target}"
 }
diff --git a/scripts/build/arch/x86.sh b/scripts/build/arch/x86.sh
index 69407db..ca0f08b 100644
--- a/scripts/build/arch/x86.sh
+++ b/scripts/build/arch/x86.sh
@@ -20,4 +20,51 @@ CT_DoArchTupleValues() {
         esac
     fi
     CT_TARGET_ARCH="${CT_TARGET_ARCH}${CT_ARCH_SUFFIX}"
+
+    # Shouldn't be possible to specify this (CT_TARGET_SYS is not specified by the user,
+    # it is computed by scripts/functions from libc choices). But trap if such invalid
+    # values ever come from the caller:
+    case "${CT_TARGET_ARCH}-${CT_TARGET_SYS}" in
+        i[34567]86-gnux32)
+            CT_DoLog ERROR "Invalid CT_TARGET: i[34567]86-<vendor>-<os>-gnux32 is invalid."
+            CT_DoLog ERROR "CT_TARGET: ${CT_TARGET}"
+            CT_Abort "Go read: https://wiki.debian.org/Multiarch/Tuples"
+            ;;
+    esac
+}
+
+#------------------------------------------------------------------------------
+# Get multilib architecture-specific target
+# Usage: CT_DoArchMultilibTarget "multilib flags" "target tuple"
+CT_DoArchMultilibTarget ()
+{
+    local target="${1}"; shift
+    local -a multi_flags=( "$@" )
+
+    local bit32=false
+    local bit64=false
+    local abi_dflt=false
+    local abi_x32=false
+
+    for m in "${multi_flags[@]}"; do
+        case "$m" in
+            -m32)  bit32=true; abi_dflt=true;;
+            -m64)  bit64=true; abi_dflt=true;;
+            -mx32) bit64=true; abi_x32=true;;
+        esac
+    done
+
+    # Fix up architecture.
+    case "${target}" in
+        x86_64-*)      $bit32 && target=${target/#x86_64-/i386-} ;;
+        i[34567]86-*)  $bit64 && target=${target/#i[34567]86-/x86_64-} ;;
+    esac
+
+    # Fix up the ABI part.
+    case "${target}" in
+        *x32) $abi_dflt && target=${target/%x32} ;;
+        *)    $abi_x32  && target=${target}x32 ;;
+    esac
+
+    echo "${target}"
 }
diff --git a/scripts/build/cc/100-gcc.sh b/scripts/build/cc/100-gcc.sh
index 7085a90..7bb3610 100644
--- a/scripts/build/cc/100-gcc.sh
+++ b/scripts/build/cc/100-gcc.sh
@@ -403,10 +403,20 @@ do_gcc_core_backend() {
         extra_config+=("--with-system-zlib")
     fi
 
-    # Some versions of gcc have a deffective --enable-multilib.
-    # Since that's the default, only pass --disable-multilib.
+    # Some versions of gcc have a defective --enable-multilib.
+    # Since that's the default, only pass --disable-multilib. For multilib,
+    # also enable multiarch. Without explicit --enable-multiarch, pass-1
+    # compiler is configured as multilib/no-multiarch and pass-2/final
+    # are multilib/multiarch (because gcc autodetects multiarch based on
+    # multiple instances of crt*.o in the install directory - which do
+    # not exist in pass-1).
     if [ "${CT_MULTILIB}" != "y" ]; then
         extra_config+=("--disable-multilib")
+    else
+        extra_config+=("--enable-multiarch")
+        if [ -n "${CT_CC_GCC_MULTILIB_LIST}" ]; then
+            extra_config+=("--with-multilib-list=${CT_CC_GCC_MULTILIB_LIST}")
+        fi
     fi
 
     CT_DoLog DEBUG "Extra config passed: '${extra_config[*]}'"
@@ -880,10 +890,15 @@ do_gcc_backend() {
         extra_config+=("--with-system-zlib")
     fi
 
-    # Some versions of gcc have a deffective --enable-multilib.
+    # Some versions of gcc have a defective --enable-multilib.
     # Since that's the default, only pass --disable-multilib.
     if [ "${CT_MULTILIB}" != "y" ]; then
         extra_config+=("--disable-multilib")
+    else
+        extra_config+=("--enable-multiarch")
+        if [ -n "${CT_CC_GCC_MULTILIB_LIST}" ]; then
+            extra_config+=("--with-multilib-list=${CT_CC_GCC_MULTILIB_LIST}")
+        fi
     fi
 
     CT_DoLog DEBUG "Extra config passed: '${extra_config[*]}'"
diff --git a/scripts/build/debug/300-gdb.sh b/scripts/build/debug/300-gdb.sh
index 418e85c..ee4753e 100644
--- a/scripts/build/debug/300-gdb.sh
+++ b/scripts/build/debug/300-gdb.sh
@@ -69,7 +69,11 @@ do_debug_gdb_build() {
 
         cross_extra_config=("${extra_config[@]}")
         cross_extra_config+=("--with-expat")
-        cross_extra_config+=("--with-libexpat-prefix=${CT_HOST_COMPLIBS_DIR}")
+        # NOTE: DO NOT USE --with-libexpat-prefix (until GDB configure is smarter)!!!
+        # It conflicts with a static build: GDB's configure script will find the shared
+        # version of expat and will attempt to link that, despite the -static flag.
+        # The link will fail, and configure will abort with "expat missing or unusable"
+        # message.
         case "${CT_THREADS}" in
             none)   cross_extra_config+=("--disable-threads");;
             *)      cross_extra_config+=("--enable-threads");;
@@ -88,17 +92,24 @@ do_debug_gdb_build() {
             cross_extra_config+=("--disable-nls")
         fi
 
-        CC_for_gdb=
-        LD_for_gdb=
+        CC_for_gdb="${CT_HOST}-gcc ${CT_CFLAGS_FOR_HOST} ${CT_LDFLAGS_FOR_HOST}"
+        LD_for_gdb="${CT_HOST}-ld ${CT_LDFLAGS_FOR_HOST}"
         if [ "${CT_GDB_CROSS_STATIC}" = "y" ]; then
-            CC_for_gdb="${CT_HOST}-gcc -static"
-            LD_for_gdb="${CT_HOST}-ld -static"
+            CC_for_gdb+=" -static"
+            LD_for_gdb+=" -static"
         fi
 
-    # Disable binutils options when building from the binutils-gdb repo.
-    cross_extra_config+=("--disable-binutils")
-    cross_extra_config+=("--disable-ld")
-    cross_extra_config+=("--disable-gas")
+        # Fix up whitespace. Some older GDB releases (e.g. 6.8a) get confused if there
+        # are multiple consecutive spaces: sub-configure scripts replace them with a
+        # single space and then complain that $CC value changed from that in
+        # the master directory.
+        CC_for_gdb=`echo $CC_for_gdb`
+        LD_for_gdb=`echo $LD_for_gdb`
+
+        # Disable binutils options when building from the binutils-gdb repo.
+        cross_extra_config+=("--disable-binutils")
+        cross_extra_config+=("--disable-ld")
+        cross_extra_config+=("--disable-gas")
 
         CT_DoLog DEBUG "Extra config passed: '${cross_extra_config[*]}'"
 
@@ -162,6 +173,11 @@ do_debug_gdb_build() {
         fi
 
         native_extra_config+=("--with-expat")
+        # NOTE: DO NOT USE --with-libexpat-prefix (until GDB configure is smarter)!!!
+        # It conflicts with a static build: GDB's configure script will find the shared
+        # version of expat and will attempt to link that, despite the -static flag.
+        # The link will fail, and configure will abort with "expat missing or unusable"
+        # message.
 
         CT_DoLog EXTRA "Configuring native gdb"
 
diff --git a/scripts/build/libc/glibc.sh b/scripts/build/libc/glibc.sh
index 0a09cbd..472acad 100644
--- a/scripts/build/libc/glibc.sh
+++ b/scripts/build/libc/glibc.sh
@@ -73,6 +73,7 @@ do_libc_backend() {
     local multi_dir
     local multi_flags
     local extra_dir
+    local target
     local libc_headers libc_startfiles libc_full
     local hdr
     local arg
@@ -136,11 +137,36 @@ do_libc_backend() {
 
         CT_mkdir_pushd "${CT_BUILD_DIR}/build-libc-${libc_mode}${extra_dir//\//_}"
 
+        target=$( CT_DoMultilibTarget "${CT_TARGET}" ${extra_flags} )
+        case "${target}" in
+            # SPARC quirk: glibc 2.23 and newer dropped support for SPARCv8 and
+            # earlier (corresponding pthread barrier code is missing). Until this
+            # support is reintroduced, configure as sparcv9.
+            sparc-*)
+                if [ "${CT_LIBC_GLIBC_2_23_or_later}" = y ]; then
+                    target=${target/#sparc-/sparcv9-}
+                fi
+                ;;
+            # x86 quirk: architecture name is i386, but glibc expects i[4567]86 - to
+            # indicate the desired optimization. If it was a multilib variant of x86_64,
+            # then it targets at least NetBurst a.k.a. i786, but we'll follow arch/x86.sh
+            # and set the optimization to i686. Otherwise, replace with the most
+            # conservative choice, i486.
+            i386-*)
+                if [ "${CT_TARGET_ARCH}" = "x86_64" ]; then
+                    target=${target/#i386-/i686-}
+                else
+                    target=${target/#i386-/i486-}
+                fi
+                ;;
+        esac
+
         do_libc_backend_once extra_dir="${extra_dir}"               \
                              extra_flags="${extra_flags}"           \
                              libc_headers="${libc_headers}"         \
                              libc_startfiles="${libc_startfiles}"   \
-                             libc_full="${libc_full}"
+                             libc_full="${libc_full}"               \
+                             target="${target}"
 
         CT_Popd
 
@@ -179,6 +205,7 @@ do_libc_backend() {
 #   libc_full           : Build full libc                       : bool      : n
 #   extra_flags         : Extra CFLAGS to use (for multilib)    : string    : (empty)
 #   extra_dir           : Extra subdir for multilib             : string    : (empty)
+#   target              : Build libc using this target (for multilib) : string : ${CT_TARGET}
 do_libc_backend_once() {
     local libc_headers
     local libc_startfiles
@@ -192,12 +219,17 @@ do_libc_backend_once() {
     local glibc_cflags
     local float_extra
     local endian_extra
+    local target
     local arg
 
     for arg in "$@"; do
         eval "${arg// /\\ }"
     done
 
+    if [ "${target}" = "" ]; then
+        target="${CT_TARGET}"
+    fi
+
     CT_DoLog EXTRA "Configuring C library"
 
     case "${CT_LIBC}" in
@@ -273,12 +305,12 @@ do_libc_backend_once() {
                      |${sed} -r -e '/^(.*[[:space:]])?-(E[BL]|m((big|little)(-endian)?|e?[bl]))([[:space:]].*)?$/!d;' \
                                 -e 's//\2/;'    \
                    )"
+    # If extra_flags contained an endianness option, no need to add it again. Otherwise,
+    # add the option from the configuration.
     case "${endian_extra}" in
         EB|mbig-endian|mbig|meb|mb)
-            extra_cc_args="${extra_cc_args} ${endian_extra}"
             ;;
         EL|mlittle-endian|mlittle|mel|ml)
-            extra_cc_args="${extra_cc_args} ${endian_extra}"
             ;;
         "") extra_cc_args="${extra_cc_args} ${CT_ARCH_ENDIAN_OPT}"
             ;;
@@ -341,7 +373,7 @@ do_libc_backend_once() {
     "${src_dir}/configure"                                          \
         --prefix=/usr                                               \
         --build=${CT_BUILD}                                         \
-        --host=${CT_TARGET}                                         \
+        --host=${target}                                            \
         --cache-file="$(pwd)/config.cache"                          \
         --without-cvs                                               \
         --disable-profile                                           \
@@ -443,7 +475,8 @@ do_libc_backend_once() {
             # However, since we will never actually execute its code,
             # it doesn't matter what it contains.  So, treating '/dev/null'
             # as a C source file, we produce a dummy 'libc.so' in one step
-            CT_DoExecLog ALL "${cross_cc}" -nostdlib        \
+            CT_DoExecLog ALL "${cross_cc}" ${extra_flags}   \
+                                           -nostdlib        \
                                            -nostartfiles    \
                                            -shared          \
                                            -x c /dev/null   \
diff --git a/scripts/crosstool-NG.sh.in b/scripts/crosstool-NG.sh.in
index 9297e3b..3c193c3 100644
--- a/scripts/crosstool-NG.sh.in
+++ b/scripts/crosstool-NG.sh.in
@@ -509,6 +509,8 @@ if [ -z "${CT_RESTART}" ]; then
     CT_CFLAGS_FOR_HOST+=" ${CT_EXTRA_CFLAGS_FOR_HOST}"
     CT_LDFLAGS_FOR_HOST=
     CT_LDFLAGS_FOR_HOST+=" ${CT_EXTRA_LDFLAGS_FOR_HOST}"
+    CT_CFLAGS_FOR_HOST+=" -I${CT_HOST_COMPLIBS_DIR}/include"
+    CT_LDFLAGS_FOR_HOST+=" -L${CT_HOST_COMPLIBS_DIR}/lib"
     CT_DoLog DEBUG "CFLAGS for host compiler: '${CT_CFLAGS_FOR_HOST}'"
     CT_DoLog DEBUG "LDFLAGS for host compiler: '${CT_LDFLAGS_FOR_HOST}'"
 
diff --git a/scripts/functions b/scripts/functions
index 70c1ba6..62d264e 100644
--- a/scripts/functions
+++ b/scripts/functions
@@ -1305,6 +1305,25 @@ CT_DoBuildTargetTuple() {
     CT_ARCH_TARGET_LDFLAGS="${CT_ARCH_TARGET_LDFLAGS} ${CT_ARCH_ENDIAN_LDFLAG}"
 }
 
+# This function determines the target tuple for a given set of compiler
+# flags, using either GCC's multiarch feature (if supported; if not,
+# GCC prints nothing and exits with status 0), falling back to calling
+# the architecture-specific functions.
+CT_DoMultilibTarget() {
+    local target="$1"; shift
+    local -a multi_flags=( "$@" )
+    local gcc_multiarch
+
+    gcc_multiarch=$( "${CT_TARGET}-gcc" -print-multiarch "${multi_flags[@]}" )
+    if [ -n "${gcc_multiarch}" ]; then
+        echo "${gcc_multiarch}"
+        return
+    fi
+
+    # Fall back to arch-specific guesswork
+    CT_DoArchMultilibTarget "${target}" "${multi_flags[@]}"
+}
+
 # This function does pause the build until the user strikes "Return"
 # Usage: CT_DoPause [optional_message]
 CT_DoPause() {