diff --git a/.github/workflows/data.yml b/.github/workflows/data.yml
index 6ca9c3c1..28200a60 100644
--- a/.github/workflows/data.yml
+++ b/.github/workflows/data.yml
@@ -45,7 +45,7 @@ jobs:
 
           TAG=""
           if [ "${PRERELEASE}" = "true" ]; then
-            TAG="$(curl -skL --connect-timeout 10 "${REPO}/tags" | grep /refs/tags/.*\.zip  | sed -r 's/.*\/refs\/tags\/(.*)\.zip.*$/\1/' | sort -rV | head -1)"
+            TAG="$(curl -skL --connect-timeout 10 "${REPO}/tags" | grep /refs/tags/.*\.zip  | sed -E 's/.*\/refs\/tags\/(.*)\.zip.*$/\1/' | sort -rV | head -1)"
           else
             LATESTURL="$(curl -skL --connect-timeout 10 -w %{url_effective} -o /dev/null "${REPO}/releases/latest")"
             TAG="${LATESTURL##*/}"
diff --git a/.github/workflows/issues.yml b/.github/workflows/issues.yml
index 45eba52a..5e32a36d 100644
--- a/.github/workflows/issues.yml
+++ b/.github/workflows/issues.yml
@@ -182,7 +182,7 @@ jobs:
 
           TAG=""
           if [ "${PRERELEASE}" = "true" ]; then
-            TAG="$(curl -skL --connect-timeout 10 "${REPO}/tags" | grep /refs/tags/.*\.zip  | sed -r 's/.*\/refs\/tags\/(.*)\.zip.*$/\1/' | sort -rV | head -1)"
+            TAG="$(curl -skL --connect-timeout 10 "${REPO}/tags" | grep /refs/tags/.*\.zip  | sed -E 's/.*\/refs\/tags\/(.*)\.zip.*$/\1/' | sort -rV | head -1)"
           else
             LATESTURL="$(curl -skL --connect-timeout 10 -w %{url_effective} -o /dev/null "${REPO}/releases/latest")"
             TAG="${LATESTURL##*/}"
diff --git a/files/initrd/opt/rr/kpatch b/files/initrd/opt/rr/kpatch
index 275c08ad..730f1dac 100755
Binary files a/files/initrd/opt/rr/kpatch and b/files/initrd/opt/rr/kpatch differ
diff --git a/files/initrd/opt/rr/menu.sh b/files/initrd/opt/rr/menu.sh
index a9d72b72..de8fc9a3 100755
--- a/files/initrd/opt/rr/menu.sh
+++ b/files/initrd/opt/rr/menu.sh
@@ -17,8 +17,7 @@ flock -n 304 || {
   dialog --colors --aspect 50 --title "$(TEXT "Error")" --msgbox "${MSG}" 0 0
   exit 1
 }
-trap 'rm -f $LOCKFILE' EXIT
-trap 'rm -f $LOCKFILE; exit' INT TERM HUP
+trap 'flock -u 304; rm -f "${WORK_PATH}/menu.lock"' EXIT INT TERM HUP
 
 # Check partition 3 space, if < 2GiB is necessary clean cache folder
 SPACELEFT=$(df -m ${PART3_PATH} 2>/dev/null | awk 'NR==2 {print $4}')
@@ -1338,16 +1337,15 @@ function make() {
       extractDsmFiles || return 1
     fi
 
-    while true; do
-      SIZE=256 # initrd-dsm + zImage-dsm ≈ 210M
-      SPACELEFT=$(df -m ${PART3_PATH} 2>/dev/null | awk 'NR==2 {print $4}')
-      ZIMAGESIZE=$(du -m ${MOD_ZIMAGE_FILE} 2>/dev/null | awk '{print $1}')
-      RDGZSIZE=$(du -m ${MOD_RDGZ_FILE} 2>/dev/null | awk '{print $1}')
-      SPACEALL=$((${SPACELEFT:-0} + ${ZIMAGESIZE:-0} + ${RDGZSIZE:-0}))
-      [ ${SPACEALL:-0} -ge ${SIZE} ] && break
+    SIZE=256 # initrd-dsm + zImage-dsm ≈ 210M
+    SPACELEFT=$(df -m ${PART3_PATH} 2>/dev/null | awk 'NR==2 {print $4}')
+    ZIMAGESIZE=$(du -m ${MOD_ZIMAGE_FILE} 2>/dev/null | awk '{print $1}')
+    RDGZSIZE=$(du -m ${MOD_RDGZ_FILE} 2>/dev/null | awk '{print $1}')
+    SPACEALL=$((${SPACELEFT:-0} + ${ZIMAGESIZE:-0} + ${RDGZSIZE:-0}))
+    if [ ${SPACEALL:-0} -lt ${SIZE} ]; then
       echo -e "$(TEXT "No disk space left, please clean the cache and try again!")" >"${LOG_FILE}"
       return 1
-    done
+    fi
 
     ${WORK_PATH}/zimage-patch.sh || {
       printf "%s\n%s\n%s:\n%s\n" "$(TEXT "DSM zImage not patched")" "$(TEXT "Please upgrade the bootloader version and try again.")" "$(TEXT "Error")" "$(cat "${LOG_FILE}")" >"${LOG_FILE}"
@@ -2032,7 +2030,7 @@ function languageMenu() {
   while read -r L; do
     A="$(echo "$(strings "${WORK_PATH}/lang/${L}/LC_MESSAGES/rr.mo" 2>/dev/null | grep "Last-Translator" | sed "s/Last-Translator://")")"
     echo "${L} \"${A:-"anonymous"}\"" >>"${TMP_PATH}/menu"
-  done <<<$(ls ${WORK_PATH}/lang/*/LC_MESSAGES/rr.mo 2>/dev/null | sort | sed -r 's/.*\/lang\/(.*)\/LC_MESSAGES\/rr\.mo$/\1/')
+  done <<<$(ls ${WORK_PATH}/lang/*/LC_MESSAGES/rr.mo 2>/dev/null | sort | sed -E 's/.*\/lang\/(.*)\/LC_MESSAGES\/rr\.mo$/\1/')
 
   DIALOG --title "$(TEXT "Settings")" \
     --default-item "${LAYOUT}" --menu "$(TEXT "Choose a language")" 0 0 20 --file "${TMP_PATH}/menu" \
@@ -2268,11 +2266,18 @@ function cloneBootloaderDisk() {
     ENDSECTOR=$(($(fdisk -l ${RESP} | grep "${NEW_BLDISK_P3}" | awk '{print $3}') + 1))
 
     if [ ${SIZEOFDISK}0 -ne ${ENDSECTOR}0 ]; then
-      echo -e "\033[1;36mResizing ${NEW_BLDISK_P3}\033[0m"
-      echo -e "d\n\nn\n\n\n\n\nn\nw" | fdisk "${RESP}" >/dev/null 2>&1
-      resize2fs "${NEW_BLDISK_P3}"
-      fdisk -l "${RESP}"
-      sleep 1
+      if [ -f "/mnt/p1/.noresize" ] || [ ${SIZEOFDISK:-0} -gt $((32 * 1024 * 1024 * 2)) ]; then
+        # Create partition 4 with remaining space
+        echo -e "\033[1;36mCreating partition 4 with remaining space.\033[0m"
+        echo -e "n\n\n\n\n\nw" | fdisk "${RESP}" >/dev/null 2>&1
+        PART4="${RESP}4"
+        mkfs.ext4 -F "${PART4}" # mkfs.ext4 -F -L "RR4" "${PART4}"
+      else
+        echo -e "\033[1;36mResizing ${NEW_BLDISK_P3}\033[0m"
+        echo -e "d\n\nn\n\n\n\n\nn\nw" | fdisk "${RESP}" >/dev/null 2>&1
+        resize2fs "${NEW_BLDISK_P3}"
+        fdisk -l "${RESP}"
+      fi
     fi
 
     function __umountNewBlDisk() {
@@ -2745,9 +2750,12 @@ function changePassword() {
 # Change ports of TTYD/DUFS/HTTP
 function changePorts() {
   local MSG="$(TEXT "Please fill in a number between 0-65535: (Empty for default value.)")"
-  local HTTP=$(grep -i '^HTTP_PORT=' /etc/rrorg.conf 2>/dev/null | cut -d'=' -f2)
-  local DUFS=$(grep -i '^DUFS_PORT=' /etc/rrorg.conf 2>/dev/null | cut -d'=' -f2)
-  local TTYD=$(grep -i '^TTYD_PORT=' /etc/rrorg.conf 2>/dev/null | cut -d'=' -f2)
+  unset HTTP_PORT DUFS_PORT TTYD_PORT
+  [ -f "/etc/rrorg.conf" ] && source "/etc/rrorg.conf" 2>/dev/null
+  local HTTP=${HTTP_PORT:-7080}
+  local DUFS=${DUFS_PORT:-7304}
+  local TTYD=${TTYD_PORT:-7681}
+
   while true; do
     DIALOG --title "$(TEXT "Settings")" \
       --form "${MSG}" 11 70 3 "HTTP" 1 1 "${HTTP:-7080}" 1 10 55 0 "DUFS" 2 1 "${DUFS:-7304}" 2 10 55 0 "TTYD" 3 1 "${TTYD:-7681}" 3 10 55 0 \
@@ -2826,14 +2834,17 @@ function changePorts() {
         rm -f "${RR_RAMUSER_FILE}"
       fi
       rm -rf "${RDXZ_PATH}"
-      {
-        [ ! "${HTTP:-7080}" = "7080" ] && /etc/init.d/S90thttpd restart
-        [ ! "${DUFS:-7304}" = "7304" ] && /etc/init.d/S99dufs restart
-        [ ! "${TTYD:-7681}" = "7681" ] && /etc/init.d/S99ttyd restart
-      } >/dev/null 2>&1 &
       [ ! -f "/etc/rrorg.conf" ] && MSG="$(TEXT "Ports for TTYD/DUFS/HTTP restored.")" || MSG="$(TEXT "Ports for TTYD/DUFS/HTTP changed.")"
       DIALOG --title "$(TEXT "Settings")" \
         --msgbox "${MSG}" 0 0
+      rm -f "${TMP_PATH}/restartS.sh"
+      {
+        [ ! "${HTTP:-7080}" = "${HTTP_PORT:-7080}" ] && echo "/etc/init.d/S90thttpd restart"
+        [ ! "${DUFS:-7304}" = "${DUFS_PORT:-7304}" ] && echo "/etc/init.d/S99dufs restart"
+        [ ! "${TTYD:-7681}" = "${TTYD_PORT:-7681}" ] && echo "/etc/init.d/S99ttyd restart"
+      } >"${TMP_PATH}/restartS.sh"
+      chmod +x "${TMP_PATH}/restartS.sh"
+      nohup "${TMP_PATH}/restartS.sh" >/dev/null 2>&1
       break
       ;;
     1)
@@ -2872,7 +2883,7 @@ function advancedMenu() {
         echo "k \"$(TEXT "Kernel switching method:") \Z4${KERNELWAY}\Zn\""
         # Some GPU have compatibility issues, so this function is temporarily disabled. RR_CMDLINE= ... nomodeset
         # checkCmdline "rr_cmdline" "nomodeset" && POWEROFFDISPLAY="false" || POWEROFFDISPLAY="true"
-        # echo "v \"$(TEXT "Power off display after boot:") \Z4${POWEROFFDISPLAY}\Zn\"" >>"${TMP_PATH}/menu"
+        # echo "v \"$(TEXT "Power off display after boot:") \Z4${POWEROFFDISPLAY}\Zn\""
       fi
       echo "n \"$(TEXT "Reboot on kernel panic:") \Z4${KERNELPANIC}\Zn\""
       if [ -n "$(ls /dev/mmcblk* 2>/dev/null)" ]; then
@@ -3250,7 +3261,7 @@ function downloadExts() {
   TAG=""
   if [ "${PRERELEASE}" = "true" ]; then
     # TAG="$(curl -skL --connect-timeout 10 "${PROXY}${3}/tags" | pup 'a[class="Link--muted"] attr{href}' | grep ".zip" | head -1)"
-    TAG="$(curl -skL --connect-timeout 10 "${PROXY}${3}/tags" | grep /refs/tags/.*\.zip | sed -r 's/.*\/refs\/tags\/(.*)\.zip.*$/\1/' | sort -rV | head -1)"
+    TAG="$(curl -skL --connect-timeout 10 "${PROXY}${3}/tags" | grep /refs/tags/.*\.zip | sed -E 's/.*\/refs\/tags\/(.*)\.zip.*$/\1/' | sort -rV | head -1)"
   else
     LATESTURL="$(curl -skL --connect-timeout 10 -w %{url_effective} -o /dev/null "${PROXY}${3}/releases/latest")"
     TAG="${LATESTURL##*/}"
@@ -4045,7 +4056,6 @@ else
       settingsMenu
       NEXT="m"
       ;;
-
     c)
       cleanCache
       NEXT="d"
diff --git a/files/initrd/opt/rr/ramdisk-patch.sh b/files/initrd/opt/rr/ramdisk-patch.sh
index 4600dd6c..ad0ef619 100755
--- a/files/initrd/opt/rr/ramdisk-patch.sh
+++ b/files/initrd/opt/rr/ramdisk-patch.sh
@@ -125,16 +125,21 @@ for KEY in "${!SYNOINFO[@]}"; do
 done
 
 # Patch /sbin/init.post
+# Apply config manipulators
 grep -v -e '^[\t ]*#' -e '^$' "${WORK_PATH}/patch/config-manipulators.sh" >"${TMP_PATH}/rp.txt"
 sed -e "/@@@CONFIG-MANIPULATORS-TOOLS@@@/ {" -e "r ${TMP_PATH}/rp.txt" -e 'd' -e '}' -i "${RAMDISK_PATH}/sbin/init.post"
 rm -f "${TMP_PATH}/rp.txt"
-touch "${TMP_PATH}/rp.txt"
-echo "_set_conf_kv 'SN' '${SN}' '/tmpRoot/etc/synoinfo.conf'" >>"${TMP_PATH}/rp.txt"
-echo "_set_conf_kv 'SN' '${SN}' '/tmpRoot/etc.defaults/synoinfo.conf'" >>"${TMP_PATH}/rp.txt"
-for KEY in "${!SYNOINFO[@]}"; do
-  echo "_set_conf_kv '${KEY}' '${SYNOINFO[${KEY}]}' '/tmpRoot/etc/synoinfo.conf'" >>"${TMP_PATH}/rp.txt"
-  echo "_set_conf_kv '${KEY}' '${SYNOINFO[${KEY}]}' '/tmpRoot/etc.defaults/synoinfo.conf'" >>"${TMP_PATH}/rp.txt"
-done
+
+# Generate synoinfo configurations
+{
+  echo "_set_conf_kv 'SN' '${SN}' '/tmpRoot/etc/synoinfo.conf'"
+  echo "_set_conf_kv 'SN' '${SN}' '/tmpRoot/etc.defaults/synoinfo.conf'"
+  for KEY in "${!SYNOINFO[@]}"; do
+    echo "_set_conf_kv '${KEY}' '${SYNOINFO[${KEY}]}' '/tmpRoot/etc/synoinfo.conf'"
+    echo "_set_conf_kv '${KEY}' '${SYNOINFO[${KEY}]}' '/tmpRoot/etc.defaults/synoinfo.conf'"
+  done
+} >"${TMP_PATH}/rp.txt"
+
 sed -e "/@@@CONFIG-GENERATED@@@/ {" -e "r ${TMP_PATH}/rp.txt" -e 'd' -e '}' -i "${RAMDISK_PATH}/sbin/init.post"
 rm -f "${TMP_PATH}/rp.txt"
 
diff --git a/files/initrd/opt/rr/vmlinux-to-bzImage.sh b/files/initrd/opt/rr/vmlinux-to-bzImage.sh
index 9957d49b..8111f4d9 100755
--- a/files/initrd/opt/rr/vmlinux-to-bzImage.sh
+++ b/files/initrd/opt/rr/vmlinux-to-bzImage.sh
@@ -3,12 +3,36 @@
 
 [ -z "${WORK_PATH}" ] || [ ! -d "${WORK_PATH}/include" ] && WORK_PATH="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
 
-. "${WORK_PATH}/include/functions.sh"
+calculate_run_size() {
+  NUM='\([0-9a-fA-F]*[ \t]*\)'
+  OUT=$(sed -n 's/^[ \t0-9]*.b[sr][sk][ \t]*'"${NUM}${NUM}${NUM}${NUM}"'.*/0x\1 0x\4/p')
 
-PLATFORM="$(readConfigKey "platform" "${USER_CONFIG_FILE}")"
-PRODUCTVER="$(readConfigKey "productver" "${USER_CONFIG_FILE}")"
-KVER="$(readConfigKey "platforms.${PLATFORM}.productvers.\"${PRODUCTVER}\".kver" "${WORK_PATH}/platforms.yml")"
-KPRE="$(readConfigKey "platforms.${PLATFORM}.productvers.\"${PRODUCTVER}\".kpre" "${WORK_PATH}/platforms.yml")"
+  if [ -z "${OUT}" ]; then
+    echo "Never found .bss or .brk file offset" >&2
+    return 1
+  fi
+
+  read -r sizeA offsetA sizeB offsetB <<<$(echo ${OUT} | awk '{printf "%d %d %d %d", strtonum($1), strtonum($2), strtonum($3), strtonum($4)}')
+
+  runSize=$((offsetA + sizeA + sizeB))
+
+  # BFD linker shows the same file offset in ELF.
+  if [ "${offsetA}" -ne "${offsetB}" ]; then
+    # Gold linker shows them as consecutive.
+    endSize=$((offsetB + sizeB))
+    if [ "${endSize}" -ne "${runSize}" ]; then
+      printf "sizeA: 0x%x\n" ${sizeA} >&2
+      printf "offsetA: 0x%x\n" ${offsetA} >&2
+      printf "sizeB: 0x%x\n" ${sizeB} >&2
+      printf "offsetB: 0x%x\n" ${offsetB} >&2
+      echo ".bss and .brk are non-contiguous" >&2
+      return 1
+    fi
+  fi
+
+  printf "%d\n" ${runSize}
+  return 0
+}
 
 # Adapted from: scripts/Makefile.lib
 # Usage: size_append FILE [FILE2] [FILEn]...
@@ -35,6 +59,8 @@ size_le() {
 
 VMLINUX_MOD=${1}
 ZIMAGE_MOD=${2}
+
+KVER=$(strings "${VMLINUX_MOD}" | grep -Eo "Linux version [0-9]+\.[0-9]+\.[0-9]+" | head -1 | awk '{print $3}')
 if [ "$(echo "${KVER:-4}" | cut -d'.' -f1)" -lt 5 ]; then
   # Kernel version 4.x or 3.x (bromolow)
   # zImage_head           16494
@@ -57,7 +83,7 @@ if [ "$(echo "${KVER:-4}" | cut -d'.' -f1)" -lt 5 ]; then
   file_size_le "${VMLINUX_MOD}" | dd of="${ZIMAGE_MOD}" bs=15745134 seek=1 conv=notrunc || exit 1
   file_size_le "${VMLINUX_MOD}" | dd of="${ZIMAGE_MOD}" bs=15745244 seek=1 conv=notrunc || exit 1
 
-  RUN_SIZE=$(objdump -h "${VMLINUX_MOD}" | sh "${WORK_PATH}/calc_run_size.sh")
+  RUN_SIZE=$(objdump -h "${VMLINUX_MOD}" | calc_run_size)
   size_le "${RUN_SIZE}" | dd of="${ZIMAGE_MOD}" bs=15745210 seek=1 conv=notrunc || exit 1
   size_le "$((16#$(crc32 "${ZIMAGE_MOD}" | awk '{print $1}') ^ 0xFFFFFFFF))" | dd of="${ZIMAGE_MOD}" conv=notrunc oflag=append || exit 1
 else
@@ -67,7 +93,7 @@ else
   dd if="${VMLINUX_MOD}" of="${ZIMAGE_MOD}" bs=14561 seek=1 conv=notrunc || exit 1
   file_size_le "${VMLINUX_MOD}" | dd of="${ZIMAGE_MOD}" bs=34463421 seek=1 conv=notrunc || exit 1
   file_size_le "${VMLINUX_MOD}" | dd of="${ZIMAGE_MOD}" bs=34479132 seek=1 conv=notrunc || exit 1
-  #  RUN_SIZE=$(objdump -h "${VMLINUX_MOD}" | sh "${WORK_PATH}/calc_run_size.sh")
+  #  RUN_SIZE=$(objdump -h "${VMLINUX_MOD}" | calc_run_size)
   #  size_le "${RUN_SIZE}" | dd of="${ZIMAGE_MOD}" bs=34626904 seek=1 conv=notrunc || exit 1
   size_le "$((16#$(crc32 "${ZIMAGE_MOD}" | awk '{print $1}') ^ 0xFFFFFFFF))" | dd of="${ZIMAGE_MOD}" conv=notrunc oflag=append || exit 1
 fi
diff --git a/guide.md b/guide.md
index 4a761cc1..c36642ba 100644
--- a/guide.md
+++ b/guide.md
@@ -65,7 +65,7 @@
 * RR 备份 (Any version):
     ```shell
     # 备份为 disk.img.gz, 自行导出.
-    dd if=`blkid | grep 'LABEL="RR3"' | cut -d3 -f1` | gzip > disk.img.gz
+    dd if="$(blkid | grep 'LABEL="RR3"' | cut -d3 -f1)" | gzip > disk.img.gz
     # 结合 transfer.sh 直接导出链接
     curl -skL --insecure -w '\n' --upload-file disk.img.gz https://transfer.sh
     ```
@@ -73,7 +73,7 @@
 * RR 开机强行进入到 RR shell:
     ```shell
     # 在 wait IP 的时候, 快速的连上, 杀死 boot.sh 进程.
-    kill `ps | grep -v grep | grep boot.sh | awk '{print $1}'`
+    kill $(ps | grep -v grep | grep boot.sh | awk '{print $1}')
     ```
 
 # SYNO:
@@ -109,7 +109,7 @@
     SN=xxxxxxxxxx   # 输入你要设置的SN
     echo 1 > /proc/sys/kernel/syno_install_flag
     [ -b "/dev/synoboot1" ] && (mkdir -p /tmp/synoboot1; mount /dev/synoboot1 /tmp/synoboot1)
-    [ -f "/tmp/synoboot1/user-config.yml" ] && OLD_SN=`grep '^sn:' /tmp/synoboot1/user-config.yml | sed -r 's/sn:(.*)/\1/; s/[\" ]//g'`
+    [ -f "/tmp/synoboot1/user-config.yml" ] && OLD_SN=$(sed -E 's/^sn:(.*)/\1/; s/[\" ]//g' /tmp/synoboot1/user-config.yml)
     [ -n "${OLD_SN}" ] && sed -i "s/${OLD_SN}/${SN}/g" /tmp/synoboot1/user-config.yml
     reboot
     ```
diff --git a/kpatch/kpatch b/kpatch/kpatch
deleted file mode 100755
index 275c08ad..00000000
Binary files a/kpatch/kpatch and /dev/null differ