14 files changed, 195 insertions, 49 deletions

diff --git a/meta-initramfs/SECURITY.md b/meta-initramfs/SECURITY.md
new file mode 100644
index 0000000000..1530103230
--- /dev/null
+++ b/meta-initramfs/SECURITY.md
@@ -0,0 +1,20 @@
+How to Report a Potential Vulnerability?
+========================================
+
+If you would like to report a public issue (for example, one with a released
+CVE number), please report it to the mailing list:
+
+  https://lists.openembedded.org/g/openembedded-devel
+
+If you are dealing with a not-yet released or urgent issue, please send a
+message to one of the maintainers listed in the README.  Include as many
+details as possible:
+  - the layer or software module affected
+  - the recipe and its version
+  - any example code, if available
+
+Branches maintained with security fixes
+---------------------------------------
+
+See https://wiki.yoctoproject.org/wiki/Releases for the list of current
+releases.  We only accept patches for the LTS releases and the master branch.
diff --git a/meta-initramfs/classes/klibc.bbclass b/meta-initramfs/classes/klibc.bbclass
index 202d132d94..c91ca60391 100644
--- a/meta-initramfs/classes/klibc.bbclass
+++ b/meta-initramfs/classes/klibc.bbclass
@@ -9,8 +9,13 @@ CC:append:armv7ve = " ${@' -mfloat-abi=${TUNE_CCARGS_MFLOAT}' if (d.getVar('TUNE
 CC:append:armv7a = " ${@' -mfloat-abi=${TUNE_CCARGS_MFLOAT}' if (d.getVar('TUNE_CCARGS_MFLOAT') != '') else ''}"
 
 # klcc uses own optimizations by default. See klcc(1) man file.
-export CFLAGS="${TUNE_CCARGS}"
-export CPPFLAGS="${TUNE_CCARGS}"
-export LDFLAGS="${TUNE_CCARGS}"
+CFLAGS = "${TUNE_CCARGS} ${DEBUG_PREFIX_MAP}"
+CFLAGS[export] = "1"
+
+CPPFLAGS = "${TUNE_CCARGS}"
+CPPFLAGS[export] = "1"
+
+LDFLAGS = "${TUNE_CCARGS}"
+LDFLAGS[export] = "1"
 
 OVERRIDES =. "libc-klibc:"
diff --git a/meta-initramfs/conf/include/non-repro-meta-initramfs.inc b/meta-initramfs/conf/include/non-repro-meta-initramfs.inc
deleted file mode 100755
index 8f01f5624b..0000000000
--- a/meta-initramfs/conf/include/non-repro-meta-initramfs.inc
+++ /dev/null
@@ -1,23 +0,0 @@
-# List of known non-reproducible package of the meta-initramfs layer
-# Please keep this list sorted
-KNOWN_NON_REPRO_META_INITRAMFS = " \
-    kexecboot-klibc \
-    kexecboot-klibc-dbg \
-    kexec-klibc \
-    kexec-tools-klibc-dbg \
-    mtdinfo-klibc \
-    ubiattach-klibc \
-    ubiblock-klibc \
-    ubicrc32-klibc \
-    ubidetach-klibc \
-    ubiformat-klibc \
-    ubimkvol-klibc \
-    ubinfo-klibc \
-    ubinize-klibc \
-    ubirename-klibc \
-    ubirmvol-klibc \
-    ubirsvol-klibc \
-    ubiupdatevol-klibc \
-    ubi-utils-klibc-dbg \
-    vmcore-dmesg-klibc \
-"
diff --git a/meta-initramfs/conf/layer.conf b/meta-initramfs/conf/layer.conf
index c844085b09..6d495a6fb3 100644
--- a/meta-initramfs/conf/layer.conf
+++ b/meta-initramfs/conf/layer.conf
@@ -16,7 +16,7 @@ BBFILE_PATTERN_meta-initramfs := "^${LAYERDIR}/"
 BBFILE_PRIORITY_meta-initramfs = "5"
 LAYERDEPENDS_meta-initramfs = "core"
 
-LAYERSERIES_COMPAT_meta-initramfs = "styhead"
+LAYERSERIES_COMPAT_meta-initramfs = "walnascar whinlatter"
 
 SIGGEN_EXCLUDE_SAFE_RECIPE_DEPS += " \
   dracut->virtual/kernel \
diff --git a/meta-initramfs/recipes-bsp/kexecboot/files/0001-Fix-argument-errors-in-gcc-15.patch b/meta-initramfs/recipes-bsp/kexecboot/files/0001-Fix-argument-errors-in-gcc-15.patch
new file mode 100644
index 0000000000..3f2aac9469
--- /dev/null
+++ b/meta-initramfs/recipes-bsp/kexecboot/files/0001-Fix-argument-errors-in-gcc-15.patch
@@ -0,0 +1,90 @@
+From d18d3fb700540646f4b79f6c6788614ffff735f6 Mon Sep 17 00:00:00 2001
+From: "mark.yang" <mark.yang@lge.com>
+Date: Thu, 24 Apr 2025 16:17:49 +0900
+Subject: [PATCH] Fix argument errors in gcc 15
+
+* fix following errors:
+../../git/src/fb.c: In function 'fb_new':
+../../git/src/fb.c:646:17: error: too many arguments to function 'fb_destroy'; expected 0, have 1
+  646 |                 fb_destroy(fb);
+      |                 ^~~~~~~~~~ ~~
+../../git/src/fb.c:391:6: note: declared here
+  391 | void fb_destroy()
+      |      ^~~~~~~~~~
+../../git/src/tui.c:102:9: error: conflicting types for 'tui_init'; have 'kx_tui *(FILE *)'
+  102 | kx_tui *tui_init(FILE *ts)
+      |         ^~~~~~~~
+In file included from ../../git/src/tui.c:40:
+../../git/src/tui.h:36:9: note: previous declaration of 'tui_init' with type 'kx_tui *(void)'
+   36 | kx_tui *tui_init();
+...
+Upstream-Status: Submitted [https://github.com/kexecboot/kexecboot/pull/30]
+Signed-off-by: mark.yang <mark.yang@lge.com>
+---
+ src/fb.c  | 4 ++--
+ src/fb.h  | 2 +-
+ src/gui.c | 2 +-
+ src/tui.h | 2 +-
+ 4 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/src/fb.c b/src/fb.c
+index c68009f..6acd9f2 100644
+--- a/src/fb.c
++++ b/src/fb.c
+@@ -388,7 +388,7 @@ void fb_restore(char *dump)
+ }
+ 
+ 
+-void fb_destroy()
++void fb_destroy(FB fb)
+ {
+        if (fb.fd >= 0)
+                close(fb.fd);
+@@ -651,7 +651,7 @@ int fb_new(int angle)
+        return 0;
+ 
+ fail:
+-       fb_destroy();
++       fb_destroy(fb);
+        return -1;
+ }
+ 
+diff --git a/src/fb.h b/src/fb.h
+index 4a1e0d7..9e0af18 100644
+--- a/src/fb.h
++++ b/src/fb.h
+@@ -88,7 +88,7 @@ typedef struct {
+ } kx_picture;
+ 
+ 
+-void fb_destroy();
++void fb_destroy(FB fb);
+ 
+ int fb_new(int angle);
+ 
+diff --git a/src/gui.c b/src/gui.c
+index bf4230a..a140c9b 100644
+--- a/src/gui.c
++++ b/src/gui.c
+@@ -157,7 +157,7 @@ void gui_destroy(struct gui_t *gui)
+        free(gui->icons);
+ #endif
+ 
+-       fb_destroy();
++       fb_destroy(fb);
+        free(gui);
+ }
+ 
+diff --git a/src/tui.h b/src/tui.h
+index feed233..79faac0 100644
+--- a/src/tui.h
++++ b/src/tui.h
+@@ -33,7 +33,7 @@ typedef struct {
+ } kx_tui;
+ 
+ 
+-kx_tui *tui_init();
++kx_tui *tui_init(FILE *ts);
+ 
+ void tui_show_menu(kx_tui *tui, kx_menu *menu);
+ 
diff --git a/meta-initramfs/recipes-bsp/kexecboot/kexecboot-cfg_0.2.bb b/meta-initramfs/recipes-bsp/kexecboot/kexecboot-cfg_0.2.bb
index d8134b228c..18b831fb72 100644
--- a/meta-initramfs/recipes-bsp/kexecboot/kexecboot-cfg_0.2.bb
+++ b/meta-initramfs/recipes-bsp/kexecboot/kexecboot-cfg_0.2.bb
@@ -6,8 +6,7 @@ LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda
 
 SRC_URI = "file://icon.xpm"
 
-S = "${WORKDIR}/sources"
-UNPACKDIR = "${S}"
+S = "${UNPACKDIR}"
 
 do_install:prepend () {
 echo '# /boot/boot.cfg - KEXECBOOT configuration file.
diff --git a/meta-initramfs/recipes-bsp/kexecboot/kexecboot_git.bb b/meta-initramfs/recipes-bsp/kexecboot/kexecboot_git.bb
index a92c0e8966..00985c09c5 100644
--- a/meta-initramfs/recipes-bsp/kexecboot/kexecboot_git.bb
+++ b/meta-initramfs/recipes-bsp/kexecboot/kexecboot_git.bb
@@ -4,8 +4,10 @@ HOMEPAGE = "https://github.com/kexecboot/kexecboot/wiki"
 LICENSE = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://COPYING;md5=94d55d512a9ba36caa9b7df079bae19f"
 PV = "0.6+git"
-S = "${WORKDIR}/git"
-SRC_URI = "git://github.com/kexecboot/kexecboot.git;branch=master;protocol=https"
+SRC_URI = " \
+    git://github.com/kexecboot/kexecboot.git;branch=master;protocol=https \
+    file://0001-Fix-argument-errors-in-gcc-15.patch \
+"
 SRC_URI:append:libc-klibc = "\
     file://0001-kexecboot-Use-new-reboot-API-with-klibc.patch \
     file://0001-make-Add-compiler-includes-in-cflags.patch \
diff --git a/meta-initramfs/recipes-core/initrdscripts/initramfs-debug_1.0.bb b/meta-initramfs/recipes-core/initrdscripts/initramfs-debug_1.0.bb
index c2b3faddda..21dce17bb7 100644
--- a/meta-initramfs/recipes-core/initrdscripts/initramfs-debug_1.0.bb
+++ b/meta-initramfs/recipes-core/initrdscripts/initramfs-debug_1.0.bb
@@ -3,8 +3,7 @@ LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"
 SRC_URI = "file://init-debug.sh"
 
-S = "${WORKDIR}/sources"
-UNPACKDIR = "${S}"
+S = "${UNPACKDIR}"
 
 do_install() {
         install -m 0755 ${UNPACKDIR}/init-debug.sh ${D}/init
diff --git a/meta-initramfs/recipes-devtools/dracut/dracut/0001-fix-broken-symlink-in-dracut-config-examples.patch b/meta-initramfs/recipes-devtools/dracut/dracut/0001-fix-broken-symlink-in-dracut-config-examples.patch
new file mode 100644
index 0000000000..7d0b65a161
--- /dev/null
+++ b/meta-initramfs/recipes-devtools/dracut/dracut/0001-fix-broken-symlink-in-dracut-config-examples.patch
@@ -0,0 +1,44 @@
+From 8871c593973d9abfef45408575e5da887830f42e Mon Sep 17 00:00:00 2001
+From: Hongxu Jia <hongxu.jia@windriver.com>
+Date: Thu, 22 May 2025 18:07:27 +0800
+Subject: [PATCH] fix broken symlink in dracut config examples
+
+Due to commit [1], it installs dracut config examples under /usr.
+But while enable_test=no, the symlink of test in dracut config is broken
+...
+root@qemux86-64:~# ls /usr/lib/dracut/dracut.conf.d/test*  -ahl
+lrwxrwxrwx 1 root root 27 Apr  5  2011 /usr/lib/dracut/dracut.conf.d/test -> ../test/dracut.conf.d/test/
+lrwxrwxrwx 1 root root 36 Apr  5  2011 /usr/lib/dracut/dracut.conf.d/test-makeroot -> ../test/dracut.conf.d/test-makeroot/
+lrwxrwxrwx 1 root root 31 Apr  5  2011 /usr/lib/dracut/dracut.conf.d/test-root -> ../test/dracut.conf.d/test-root
+root@qemux86-64:~# realpath /usr/lib/dracut/dracut.conf.d/test*
+realpath: /usr/lib/dracut/dracut.conf.d/test: No such file or directory
+realpath: /usr/lib/dracut/dracut.conf.d/test-makeroot: No such file or directory
+realpath: /usr/lib/dracut/dracut.conf.d/test-root: No such file or directory
+...
+
+This commit cleans up test symlink if enable_test=no
+
+[1] https://github.com/dracut-ng/dracut-ng/commit/0d369e3e30935dffe48dfff1e90463868e7f804a
+
+Upstream-Status: Submitted [https://github.com/dracut-ng/dracut-ng/pull/1344]
+
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/Makefile b/Makefile
+index d33aebbc..151d9f79 100644
+--- a/Makefile
++++ b/Makefile
+@@ -180,6 +180,7 @@ ifneq ($(enable_test),no)
+        cp -arx test $(DESTDIR)$(pkglibdir)
+ else
+        rm -rf $(DESTDIR)$(pkglibdir)/modules.d/80test*
++       rm -rf $(DESTDIR)$(pkglibdir)/dracut.conf.d/test*
+ endif
+ ifneq ($(enable_documentation),no)
+        for i in $(man1pages); do install -m 0644 $$i $(DESTDIR)$(mandir)/man1/$${i##*/}; done
+-- 
+2.34.1
+
diff --git a/meta-initramfs/recipes-devtools/dracut/dracut_102.bb b/meta-initramfs/recipes-devtools/dracut/dracut_106.bb
index 39ff265a31..d59b357dc1 100644
--- a/meta-initramfs/recipes-devtools/dracut/dracut_102.bb
+++ b/meta-initramfs/recipes-devtools/dracut/dracut_106.bb
@@ -7,9 +7,10 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
 
 PE = "1"
 
-SRCREV = "1a8ee6e00bbe017717a5ef9e9bcfefb3b88f629e"
+SRCREV = "956c08774074ddc45b2f975e13d5c13d1fc36eff"
 SRC_URI = "git://github.com/dracut-ng/dracut-ng.git;protocol=http;branch=main \
            file://0001-feat-dracut-install-split-ldd-command-arguments-for-.patch \
+           file://0001-fix-broken-symlink-in-dracut-config-examples.patch \
            "
 
 DEPENDS += "kmod"
@@ -17,24 +18,23 @@ DEPENDS:append:libc-musl = " fts"
 
 inherit bash-completion pkgconfig
 
-S = "${WORKDIR}/git"
 
 EXTRA_OECONF = "--prefix=${prefix} \
-                --libdir=${prefix}/lib \
+                --libdir=${nonarch_libdir} \
                 --datadir=${datadir} \
                 --sysconfdir=${sysconfdir} \
                 --sbindir=${sbindir} \
-                --disable-documentation \
                 --bindir=${bindir} \
                 --includedir=${includedir} \
                 --localstatedir=${localstatedir} \
+                --disable-documentation \
                "
 
 # RDEPEND on systemd optionally
 PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)}"
 PACKAGECONFIG[systemd] = "--with-systemdsystemunitdir=${systemd_unitdir}/system/,,,systemd"
 
-EXTRA_OEMAKE += 'libdir=${prefix}/lib LDLIBS="${LDLIBS}"'
+EXTRA_OEMAKE += 'libdir=${nonarch_libdir} LDLIBS="${LDLIBS}" enable_test=no DRACUT_FULL_VERSION=${PV}'
 
 CFLAGS:append = " -fPIC"
 LDLIBS:append:libc-musl = " -lfts"
@@ -47,22 +47,26 @@ do_install() {
     oe_runmake install DESTDIR=${D}
     # Its Makefile uses cp -arx to install modules.d, so fix the owner
     # to root:root
-    chown -R root:root ${D}/${prefix}/lib/dracut/modules.d
+    chown -R root:root ${D}/${nonarch_libdir}/dracut/modules.d \
+        ${D}/${nonarch_libdir}/dracut/dracut.conf.d
+
+    if ! ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
+        rm -rf ${D}${nonarch_libdir}/systemd
+    fi
 }
 
-FILES:${PN} += "${prefix}/lib/kernel \
-                ${prefix}/lib/dracut \
+FILES:${PN} += "${nonarch_libdir}/kernel \
+                ${nonarch_libdir}/dracut \
                 ${systemd_unitdir} \
                "
-FILES:${PN}-dbg += "${prefix}/lib/dracut/.debug"
+FILES:${PN}-dbg += "${nonarch_libdir}/dracut/.debug"
 
 CONFFILES:${PN} += "${sysconfdir}/dracut.conf"
 
 RDEPENDS:${PN} = "findutils cpio util-linux-blkid util-linux-getopt util-linux bash ldd"
 
 # This could be optimized a bit, but let's avoid non-booting systems :)
-RRECOMMENDS:${PN} = " \
-                     kernel-modules \
+RRECOMMENDS:${PN} = "kernel-modules \
                      coreutils \
                     "
 
diff --git a/meta-initramfs/recipes-devtools/grubby/grubby_git.bb b/meta-initramfs/recipes-devtools/grubby/grubby_git.bb
index ff673e21bb..60f68728e9 100644
--- a/meta-initramfs/recipes-devtools/grubby/grubby_git.bb
+++ b/meta-initramfs/recipes-devtools/grubby/grubby_git.bb
@@ -12,7 +12,6 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=892f569a555ba9c07a568a7c0c4fa63a"
 DEPENDS = "popt util-linux rpm"
 DEPENDS:append:libc-musl = " libexecinfo argp-standalone"
 
-S = "${WORKDIR}/git"
 SRCREV = "c01b0d5bb182bde35b464d14996acf354a3ada2e"
 SRC_URI = "git://github.com/rhboot/grubby.git;protocol=https;;branch=main \
            file://0001-rename-grub2-editenv-to-grub-editenv.patch \
@@ -24,12 +23,21 @@ SRC_URI = "git://github.com/rhboot/grubby.git;protocol=https;;branch=main \
 
 RDEPENDS:${PN} += "dracut"
 
-inherit autotools-brokensep ptest
+inherit ptest
 
 EXTRA_OEMAKE = "-e 'CC=${CC}' 'LDFLAGS=${LDFLAGS}' 'LIBS=${LIBS}'"
 
 LIBS:libc-musl = "-lexecinfo -largp"
 LIBS ?= ""
+
+do_compile() {
+        oe_runmake
+}
+
+do_install() {
+        oe_runmake DESTDIR=${D} install
+}
+
 do_install_ptest() {
     install -d ${D}${PTEST_PATH}
     cp -r ${S}/test ${S}/test.sh ${D}${PTEST_PATH}
diff --git a/meta-initramfs/recipes-devtools/klibc/klibc.inc b/meta-initramfs/recipes-devtools/klibc/klibc.inc
index 6093e19b7c..2af53b18e3 100644
--- a/meta-initramfs/recipes-devtools/klibc/klibc.inc
+++ b/meta-initramfs/recipes-devtools/klibc/klibc.inc
@@ -29,7 +29,7 @@ ARMPATCHES:arm = " \
                  "
 SRC_URI[sha256sum] = "d673a294f742d59368222ff5c38462d81098c55063799de6fb8a7ba3d4af0436"
 
-S = "${WORKDIR}/klibc-${PV}"
+S = "${UNPACKDIR}/klibc-${PV}"
 
 OPTFLAGS = "${TUNE_CCARGS} -Os -fcommon"
 OPTFLAGS:append = " ${DEBUG_PREFIX_MAP}"
diff --git a/meta-initramfs/recipes-devtools/mtd/ubi-utils-klibc_2.0.2.bb b/meta-initramfs/recipes-devtools/mtd/ubi-utils-klibc_2.0.2.bb
index 43ddb82a00..461d75e625 100644
--- a/meta-initramfs/recipes-devtools/mtd/ubi-utils-klibc_2.0.2.bb
+++ b/meta-initramfs/recipes-devtools/mtd/ubi-utils-klibc_2.0.2.bb
@@ -19,7 +19,6 @@ SRC_URI = "git://git.infradead.org/mtd-utils.git;branch=master \
              file://0001-make-Add-compiler-includes-in-cflags.patch \
              "
 
-S = "${WORKDIR}/git"
 
 EXTRA_OECONF += "--disable-tests --without-jffs --without-ubifs"
 
diff --git a/meta-initramfs/recipes-kernel/kexec/kexec-tools-klibc_git.bb b/meta-initramfs/recipes-kernel/kexec/kexec-tools-klibc_git.bb
index 363cdb9adf..2df53ff38e 100644
--- a/meta-initramfs/recipes-kernel/kexec/kexec-tools-klibc_git.bb
+++ b/meta-initramfs/recipes-kernel/kexec/kexec-tools-klibc_git.bb
@@ -61,7 +61,6 @@ SRC_URI:append:aarch64 = " file://arm64_kexec-image-header.h-add-missing-le64toh
 
 SRC_URI:append:powerpc = " file://powerpc-purgatory-Makefile-remove-unknown-flags.patch"
 
-S = "${WORKDIR}/git"
 
 EXTRA_OECONF += "--without-zlib --without-lzma --without-xen"