76 files changed, 2952 insertions, 807 deletions

diff --git a/recipes-extended/ceph/ceph/0001-cepth-node-proxy-specify-entrypoint-executable.patch b/recipes-extended/ceph/ceph/0001-cepth-node-proxy-specify-entrypoint-executable.patch
new file mode 100644
index 00000000..a4135fd1
--- /dev/null
+++ b/recipes-extended/ceph/ceph/0001-cepth-node-proxy-specify-entrypoint-executable.patch
@@ -0,0 +1,27 @@
+From cd7b184bad23a3a80f2ccf8acc7662d0079282d3 Mon Sep 17 00:00:00 2001
+From: Bruce Ashfield <bruce.ashfield@gmail.com>
+Date: Mon, 22 Jul 2024 20:02:12 +0000
+Subject: [PATCH] cepth-node-proxy: specify entrypoint executable
+
+Upstream-Status: Inappropriate [oe specific]
+
+Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
+---
+ src/ceph-node-proxy/setup.py | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/ceph-node-proxy/setup.py b/src/ceph-node-proxy/setup.py
+index 7dcc7cdf5bf..f137c2e4307 100644
+--- a/src/ceph-node-proxy/setup.py
++++ b/src/ceph-node-proxy/setup.py
+@@ -25,6 +25,7 @@ setup(
+     entry_points=dict(
+         console_scripts=[
+             'ceph-node-proxy = ceph_node_proxy.main:main',
++            'executable': 'python3',
+         ],
+     ),
+     classifiers=[
+-- 
+2.39.2
+
diff --git a/recipes-extended/ceph/ceph/0001-common-dout-fix-FTBFS-on-GCC-14.patch b/recipes-extended/ceph/ceph/0001-common-dout-fix-FTBFS-on-GCC-14.patch
new file mode 100644
index 00000000..263bcf70
--- /dev/null
+++ b/recipes-extended/ceph/ceph/0001-common-dout-fix-FTBFS-on-GCC-14.patch
@@ -0,0 +1,146 @@
+From 0eace4ea9ea42412d4d6a16d24a8660642e41173 Mon Sep 17 00:00:00 2001
+From: Radoslaw Zarzynski <rzarzyns@redhat.com>
+Date: Wed, 24 Jan 2024 17:22:44 +0000
+Subject: [PATCH] common/dout: fix FTBFS on GCC 14
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The following problem has been reported by Kaleb Keithley:
+
+```
+/builddir/build/BUILD/ceph-18.2.1/src/osd/osd_types.h: In lambda function:
+/builddir/build/BUILD/ceph-18.2.1/src/common/dout.h:184:73: error: call to non-‘constexpr’ function ‘virtual unsigned int DoutPrefixProvider::get_subsys() const’
+  184 |     dout_impl(pdpp->get_cct(), ceph::dout::need_dynamic(pdpp->get_subsys()), v) \
+      |                                                         ~~~~~~~~~~~~~~~~^~
+/builddir/build/BUILD/ceph-18.2.1/src/common/dout.h:155:58: note: in definition of macro ‘dout_impl’
+  155 |       return (cctX->_conf->subsys.template should_gather<sub, v>());    \
+      |                                                          ^~~
+/builddir/build/BUILD/ceph-18.2.1/src/osd/osd_types.h:3617:3: note: in expansion of macro ‘ldpp_dout’
+ 3617 |   ldpp_dout(dpp, 10) << "build_prior all_probe " << all_probe << dendl;
+      |   ^~~~~~~~~
+```
+
+For details of the problem and the idea behind the fix,
+please refer to the comment this commit brings to `dout.h`.
+
+The minimized replicator that the facilitated Goldbot-based
+investigation:
+
+```cpp
+namespace ceph::dout {
+
+template<typename T>
+struct dynamic_marker_t {
+  T value;
+  // constexpr ctor isn't needed as it's an aggregate type
+  constexpr operator T() const { return value; }
+};
+
+template<typename T>
+constexpr dynamic_marker_t<T> need_dynamic(T&& t) {
+  return dynamic_marker_t<T>{ std::forward<T>(t) };
+}
+
+template<typename T>
+struct is_dynamic : public std::false_type {};
+
+template<typename T>
+struct is_dynamic<dynamic_marker_t<T>> : public std::true_type {};
+
+} // ceph::dout
+
+struct subsys_t {
+  template <unsigned SubV, int LvlV>
+  bool should_gather() const {
+    return true;
+  }
+  bool should_gather(const unsigned sub, int level) const {
+    return false;
+  }
+};
+
+static subsys_t subsys;
+
+  do {                                                                  \
+  const bool should_gather = [&](const auto cctX) {                     \
+    if constexpr (ceph::dout::is_dynamic<decltype(sub)>::value ||       \
+                  ceph::dout::is_dynamic<decltype(v)>::value) {         \
+      std::cout << "the dynamic path" << std::endl;                     \
+      return subsys.should_gather(sub, v);                              \
+    } else {                                                            \
+      /* The parentheses are **essential** because commas in angle      \
+       * brackets are NOT ignored on macro expansion! A language's      \
+       * limitation, sorry. */                                          \
+      std::cout << "the static path" << std::endl;                      \
+      /*return subsys.should_gather(sub, v);*/                              \
+      return (subsys.template should_gather<sub, v>());             \
+    }                                                                   \
+  }(cct);                                                               \
+  } while (0)
+
+  if (decltype(auto) pdpp = (dpp); pdpp) /* workaround -Wnonnull-compare for 'this' */ \
+    dout_impl(42, sub, v)
+
+  if (decltype(auto) pdpp = (dpp); pdpp) /* workaround -Wnonnull-compare for 'this' */ \
+    dout_impl(42, ceph::dout::need_dynamic(42), v)
+
+int main() {
+    std::random_device dev;
+    std::mt19937 rng(dev());
+    std::uniform_int_distribution<std::mt19937::result_type> dist6(1,6); // distribution in range [1, 6]
+
+    int sub = dist6(rng);
+    ldpp_dout("mocked out", sub);
+    //ldpp_subdout("mocked out", 4, 3);
+}
+```
+
+Upstream-Status: Backport [commit 0eace4ea9ea42412d4d6a16d24a8660642e41173]
+
+Fixes: https://tracker.ceph.com/issues/64050
+Signed-off-by: Radoslaw Zarzynski <rzarzyns@redhat.com>
+---
+ src/common/dout.h | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/src/common/dout.h b/src/common/dout.h
+index 4cd60efff8f..6516060c543 100644
+--- a/src/common/dout.h
++++ b/src/common/dout.h
+@@ -144,17 +144,27 @@ struct is_dynamic<dynamic_marker_t<T>> : public std::true_type {};
+ #else
+ #define dout_impl(cct, sub, v)                                         \
+   do {                                                                 \
+-  const bool should_gather = [&](const auto cctX) {                    \
+-    if constexpr (ceph::dout::is_dynamic<decltype(sub)>::value ||      \
+-                 ceph::dout::is_dynamic<decltype(v)>::value) {         \
++  const bool should_gather = [&](const auto cctX, auto sub_, auto v_) {        \
++    /* The check is performed on `sub_` and `v_` to leverage the C++'s         \
++     * guarantee on _discarding_ one of blocks of `if constexpr`, which        \
++     * includes also the checks for ill-formed code (`should_gather<>` \
++     * must not be feed with non-const expresions), BUT ONLY within    \
++     * a template (thus the generic lambda) and under the restriction  \
++     * it's dependant on a parameter of this template).                        \
++     * GCC prior to v14 was not enforcing these restrictions. */       \
++    if constexpr (ceph::dout::is_dynamic<decltype(sub_)>::value ||     \
++                 ceph::dout::is_dynamic<decltype(v_)>::value) {        \
+       return cctX->_conf->subsys.should_gather(sub, v);                        \
+     } else {                                                           \
++      constexpr auto sub_helper = static_cast<decltype(sub_)>(sub);    \
++      constexpr auto v_helper = static_cast<decltype(v_)>(v);          \
+       /* The parentheses are **essential** because commas in angle     \
+        * brackets are NOT ignored on macro expansion! A language's     \
+        * limitation, sorry. */                                         \
+-      return (cctX->_conf->subsys.template should_gather<sub, v>());   \
++      return (cctX->_conf->subsys.template should_gather<sub_helper,   \
++                                                        v_helper>());  \
+     }                                                                  \
+-  }(cct);                                                              \
++  }(cct, sub, v);                                                      \
+                                                                        \
+   if (should_gather) {                                                 \
+     ceph::logging::MutableEntry _dout_e(v, sub);                        \
+-- 
+2.39.2
+
diff --git a/recipes-extended/ceph/ceph/0001-rados-setup.py-allow-incompatible-pointer-types.patch b/recipes-extended/ceph/ceph/0001-rados-setup.py-allow-incompatible-pointer-types.patch
new file mode 100644
index 00000000..a67e45b5
--- /dev/null
+++ b/recipes-extended/ceph/ceph/0001-rados-setup.py-allow-incompatible-pointer-types.patch
@@ -0,0 +1,28 @@
+From 1b64bc536a3ea47c39e631409c833e99820ae7c2 Mon Sep 17 00:00:00 2001
+From: Bruce Ashfield <bruce.ashfield@gmail.com>
+Date: Mon, 22 Jul 2024 21:01:17 +0000
+Subject: [PATCH] rados: setup.py allow incompatible pointer types
+
+Upstream-Status: Inappropriate [oe specific]
+
+Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
+---
+ src/pybind/rados/setup.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/pybind/rados/setup.py b/src/pybind/rados/setup.py
+index 74bf75b6ddc..87126ca8338 100755
+--- a/src/pybind/rados/setup.py
++++ b/src/pybind/rados/setup.py
+@@ -30,7 +30,7 @@ def filter_unsupported_flags(compiler, flags):
+                                 f.startswith('-fcf-protection'),
+                                 flags))
+     else:
+-        return flags
++        return flags + [ "-Wno-error=incompatible-pointer-types" ]
+ 
+ 
+ def monkey_with_compiler(customize):
+-- 
+2.39.2
+
diff --git a/recipes-extended/ceph/ceph/0001-rgw-setup.py-allow-incompatible-pointer-types.patch b/recipes-extended/ceph/ceph/0001-rgw-setup.py-allow-incompatible-pointer-types.patch
new file mode 100644
index 00000000..b21678a9
--- /dev/null
+++ b/recipes-extended/ceph/ceph/0001-rgw-setup.py-allow-incompatible-pointer-types.patch
@@ -0,0 +1,28 @@
+From 84097fe398ee69172d4d9ae978ff0380fd6362cf Mon Sep 17 00:00:00 2001
+From: Bruce Ashfield <bruce.ashfield@gmail.com>
+Date: Mon, 22 Jul 2024 20:43:50 +0000
+Subject: [PATCH] rgw: setup.py allow incompatible pointer types
+
+Upstream-Status: Inappropriate [oe specific]
+
+Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
+---
+ src/pybind/rgw/setup.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/pybind/rgw/setup.py b/src/pybind/rgw/setup.py
+index 74bf75b6ddc..87126ca8338 100755
+--- a/src/pybind/rgw/setup.py
++++ b/src/pybind/rgw/setup.py
+@@ -30,7 +30,7 @@ def filter_unsupported_flags(compiler, flags):
+                                 f.startswith('-fcf-protection'),
+                                 flags))
+     else:
+-        return flags
++        return flags + [ "-Wno-error=incompatible-pointer-types" ]
+ 
+ 
+ def monkey_with_compiler(customize):
+-- 
+2.39.2
+
diff --git a/recipes-extended/ceph/ceph_18.2.2.bb b/recipes-extended/ceph/ceph_git.bb
index e6c44188..2eaa335a 100644
--- a/recipes-extended/ceph/ceph_18.2.2.bb
+++ b/recipes-extended/ceph/ceph_git.bb
@@ -2,29 +2,35 @@ SUMMARY = "User space components of the Ceph file system"
 LICENSE = "LGPL-2.1-only & GPL-2.0-only & Apache-2.0 & MIT"
 LIC_FILES_CHKSUM = "file://COPYING-LGPL2.1;md5=fbc093901857fcd118f065f900982c24 \
                     file://COPYING-GPL2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
-                    file://COPYING;md5=5351120989d78252e65dc1a2a92e3617 \
+                    file://COPYING;md5=bf502a28c9b8d6430c8952a583a2c896 \
 "
 inherit cmake pkgconfig python3native python3-dir systemd useradd
 # Disable python pybind support for ceph temporary, when corss compiling pybind,
 # pybind mix cmake and python setup environment, would case a lot of errors.
 
-SRC_URI = "http://download.ceph.com/tarballs/ceph-${PV}.tar.gz \
+SRC_URI = "gitsm://github.com/ceph/ceph.git;protocol=https;branch=main \
            file://0001-fix-host-library-paths-were-used.patch \
            file://ceph.conf \
-           file://0001-avoid-to_string-error.patch \
            file://0001-delete-install-layout-deb.patch \
            file://0001-cephadm-build.py-avoid-using-python3-from-sysroot-wh.patch \
-"
+           file://0001-cepth-node-proxy-specify-entrypoint-executable.patch \
+           file://0001-rados-setup.py-allow-incompatible-pointer-types.patch \
+           file://0001-rgw-setup.py-allow-incompatible-pointer-types.patch \
+           "
+
+SRCREV = "a53e858fd7cc6fd8c04f37d503ce9ed7080f2da6"
+PV = "20.0.0+git"
 
-SRC_URI[sha256sum] = "e70bb5246b4a5d7aa78eb548677a05cc21d0d47945ba2937fddc7511134ffb57"
+S = "${WORKDIR}/git"
 
 DEPENDS = "boost bzip2 curl cryptsetup expat gperf-native \
            keyutils libaio libibverbs lua lz4 \
            nspr nss ninja-native \
            oath openldap openssl \
            python3 python3-native python3-cython-native python3-pyyaml-native \
-           rabbitmq-c rocksdb snappy thrift udev \
+           rabbitmq-c snappy thrift udev \
            valgrind xfsprogs zlib libgcc zstd re2 \
+           lmdb autoconf-native automake-native \
 "
 
 
@@ -52,6 +58,7 @@ SYSTEMD_SERVICE:${PN} = " \
         ceph-mgr@.service \
         ceph-mgr.target \
         ceph-crash.service \
+        ceph-exporter.service \
         rbdmap.service \
         ceph-immutable-object-cache@.service \
         ceph-immutable-object-cache.target \
@@ -71,16 +78,20 @@ EXTRA_OECMAKE += "-DWITH_MANPAGE=OFF \
                  -DWITH_MGR=OFF \
                  -DWITH_MGR_DASHBOARD_FRONTEND=OFF \
                  -DWITH_SYSTEM_BOOST=ON \
-                 -DWITH_SYSTEM_ROCKSDB=ON \
                  -DWITH_RDMA=OFF \
+                 -DWITH_RBD=OFF \
+                 -DWITH_KRBD=OFF \
                  -DWITH_RADOSGW_AMQP_ENDPOINT=OFF \
                  -DWITH_RADOSGW_KAFKA_ENDPOINT=OFF \
                  -DWITH_REENTRANT_STRSIGNAL=ON \
-                 -DWITH_PYTHON3=3.12 \
+                 -DWITH_PYTHON3=3.13 \
                  -DPYTHON_DESIRED=3 \
                  -DCMAKE_TOOLCHAIN_FILE:FILEPATH=${WORKDIR}/toolchain.cmake \
+                 -DCEPHADM_BUNDLED_DEPENDENCIES=none \
                  "
 
+# -DWITH_SYSTEM_ROCKSDB=ON
+
 do_configure:prepend () {
         echo "set( CMAKE_SYSROOT \"${RECIPE_SYSROOT}\" )" >> ${WORKDIR}/toolchain.cmake
         echo "set( CMAKE_DESTDIR \"${D}\" )" >> ${WORKDIR}/toolchain.cmake
@@ -88,6 +99,12 @@ do_configure:prepend () {
         # echo "set( CMAKE_C_COMPILER_WORKS TRUE)" >> ${WORKDIR}/toolchain.cmake
         # echo "set( CMAKE_CXX_COMPILER_FORCED TRUE)" >> ${WORKDIR}/toolchain.cmake
         echo "set( CMAKE_C_COMPILER_FORCED TRUE )" >> ${WORKDIR}/toolchain.cmake
+
+        echo "set( WITH_QATDRV OFF )" >> ${WORKDIR}/toolchain.cmake
+        echo "set( WITH_QATZIP OFF )" >> ${WORKDIR}/toolchain.cmake
+        echo "set( WITH_LIBURING OFF )" >> ${WORKDIR}/toolchain.cmake
+        echo "set( WITH_QATLIB OFF )" >> ${WORKDIR}/toolchain.cmake
+        # echo "set( WITH_SYSTEM_ROCKSDB TRUE )" >> ${WORKDIR}/toolchain.cmake
 }
 
 do_compile:prepend() {
@@ -106,7 +123,7 @@ do_install:append () {
                 ${D}${sbindir}/ceph-volume ${D}${sbindir}/ceph-volume-systemd
         find ${D} -name SOURCES.txt | xargs sed -i -e 's:${WORKDIR}::'
         install -d ${D}${sysconfdir}/ceph
-        install -m 644 ${WORKDIR}/ceph.conf ${D}${sysconfdir}/ceph/
+        install -m 644 ${UNPACKDIR}/ceph.conf ${D}${sysconfdir}/ceph/
         install -d ${D}${systemd_unitdir}
         mv ${D}${libexecdir}/ceph/ceph-osd-prestart.sh ${D}${libdir}/ceph
         mv ${D}${libexecdir}/ceph/ceph_common.sh ${D}${libdir}/ceph
@@ -137,6 +154,7 @@ FILES:${PN} += "\
                 ${libdir}/ceph/compressor/*.so \
                 ${libdir}/rados-classes/*.so \
                 ${libdir}/ceph/*.so \
+                ${libdir}/*.so \
                 ${libdir}/libcephsqlite.so \
 "
 
@@ -151,6 +169,7 @@ FILES:${PN}-dev = " \
     ${libdir}/librados*.so \
     ${libdir}/librbd.so \
     ${libdir}/librgw.so \
+    ${libdir}/pkgconfig/cephfs.pc \
 "
 
 FILES:${PN}-python = "\
diff --git a/recipes-extended/cloud-init/cloud-init_git.bb b/recipes-extended/cloud-init/cloud-init_git.bb
index 6cb3d3b5..d40035c4 100644
--- a/recipes-extended/cloud-init/cloud-init_git.bb
+++ b/recipes-extended/cloud-init/cloud-init_git.bb
@@ -7,13 +7,13 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=c6dd79b6ec2130a3364f6fa9d6380408 \
     file://LICENSE-Apache2.0;md5=3b83ef96387f14655fc854ddc3c6bd57 \
 "
 
-SRCREV = "e982c20875db3750c8dfc1915e7a4cee37376924"
-SRC_URI = "git://github.com/canonical/cloud-init;branch=24.1.x;protocol=https \
+SRCREV = "8a1d73498c505049cd281a1661c2750b93fb4a6f"
+SRC_URI = "git://github.com/canonical/cloud-init;branch=25.1.x;protocol=https \
     file://cloud-init-source-local-lsb-functions.patch \
     file://0001-setup.py-check-for-install-anywhere-in-args.patch \
 "
 
-PV = "v23.4.1+git"
+PV = "v25.1.1+git"
 
 S = "${WORKDIR}/git"
 
diff --git a/recipes-extended/dev86/dev86_git.bb b/recipes-extended/dev86/dev86_git.bb
index a3d0fded..d43d1200 100644
--- a/recipes-extended/dev86/dev86_git.bb
+++ b/recipes-extended/dev86/dev86_git.bb
@@ -4,7 +4,7 @@ LICENSE = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://COPYING;md5=8ca43cbc842c2336e835926c2166c28b"
 SECTION = "console/tools"
 
-BASE_PV="0.16.21"
+BASE_PV = "0.16.21"
 PV = "${BASE_PV}+git"
 SRCREV = "e254e0b19651d3b8a20225b40281c9974a95dec4"
 SRC_URI = "git://github.com/jbruchon/${BPN}.git;protocol=https;branch=master \
@@ -41,3 +41,27 @@ do_install() {
 }
 
 FILES:${PN} += "${libdir}/bcc"
+
+# http://gecko.lge.com:8000/Errors/Details/832862
+# http://errors.yoctoproject.org/Errors/Details/766930/
+# cpp.c:548:1: error: type of 'ch' defaults to 'int' [-Wimplicit-int]
+# strsave.c:47:42: error: implicit declaration of function 'strcmp' [-Wimplicit-function-declaration]
+# strsave.c:55:26: error: implicit declaration of function 'hash' [-Wimplicit-function-declaration]
+# strsave.c:66:32: error: implicit declaration of function 'strlen' [-Wimplicit-function-declaration]
+# symbol.c:60:42: error: implicit declaration of function 'strcmp' [-Wimplicit-function-declaration]
+# symbol.c:72:30: error: implicit declaration of function 'strlen' [-Wimplicit-function-declaration]
+# symbol.c:77:13: error: implicit declaration of function 'hash' [-Wimplicit-function-declaration]
+# tok_class.c:305:43: error: implicit declaration of function 'strlen' [-Wimplicit-function-declaration]
+# tok_io.c:219:20: error: implicit declaration of function 'atoi' [-Wimplicit-function-declaration]
+# tok_io.c:488:20: error: implicit declaration of function 'strlen' [-Wimplicit-function-declaration]
+# unproto.c:188:51: error: implicit declaration of function 'strcmp' [-Wimplicit-function-declaration]
+CFLAGS += "-Wno-error=implicit-int -Wno-error=implicit-function-declaration"
+
+# http://errors.yoctoproject.org/Errors/Details/853302/
+CFLAGS += "-std=gnu17"
+
+# http://errors.yoctoproject.org/Errors/Details/853303/
+# ar.c:615:23: error: passing argument 1 of 'ctime' from incompatible pointer type [-Wincompatible-pointer-types]
+CFLAGS += "-Wno-error=incompatible-pointer-types"
+
+EXTRA_OEMAKE += "CFLAGS='${CFLAGS}'"
diff --git a/recipes-extended/diod/diod_1.0.24.bb b/recipes-extended/diod/diod_1.0.24.bb
index 6019fbfb..72a31a68 100644
--- a/recipes-extended/diod/diod_1.0.24.bb
+++ b/recipes-extended/diod/diod_1.0.24.bb
@@ -9,16 +9,16 @@ LICENSE = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://COPYING;md5=59530bdf33659b29e73d4adb9f9f6552"
 
 PV = "1.0.24+git"
-SRCREV = "b4b5e8e00ed11b21d7fcf05a080dc054a8eac2d6"
+SRCREV = "54d1325fc435d14a6f5c161c88dac79b016b0061"
 SRC_URI = "git://github.com/chaos/diod.git;protocol=https;branch=master \
            file://diod \
            file://diod.conf \
            file://0001-build-Find-lua-with-pkg-config.patch \
-           file://0002-Handle-various-time_t-sizes-in-printf-and-scanf.patch \
            "
-DEPENDS = "libcap ncurses tcp-wrappers lua"
+DEPENDS = "libcap ncurses lua"
 
-EXTRA_OEMAKE += "systemddir=${systemd_unitdir}/system"
+EXTRA_OECONF = "--disable-auth \
+                --with-systemdsystemunitdir=${systemd_unitdir}/system"
 
 S = "${WORKDIR}/git"
 
@@ -26,9 +26,9 @@ inherit autotools pkgconfig systemd
 
 do_install:append () {
         # install our init based on start-stop-daemon
-        install -D -m 0755 ${WORKDIR}/diod ${D}${sysconfdir}/init.d/diod
+        install -D -m 0755 ${UNPACKDIR}/diod ${D}${sysconfdir}/init.d/diod
         # install a real(not commented) configuration file for diod
-        install -m 0644 ${WORKDIR}/diod.conf ${D}${sysconfdir}/diod.conf
+        install -m 0644 ${UNPACKDIR}/diod.conf ${D}${sysconfdir}/diod.conf
 }
 
 FILES:${PN} += "${systemd_unitdir}"
diff --git a/recipes-extended/diod/files/0002-Handle-various-time_t-sizes-in-printf-and-scanf.patch b/recipes-extended/diod/files/0002-Handle-various-time_t-sizes-in-printf-and-scanf.patch
deleted file mode 100644
index 3c13c101..00000000
--- a/recipes-extended/diod/files/0002-Handle-various-time_t-sizes-in-printf-and-scanf.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-From 04b0c5a5cb9e32090b177ff7327ad3260783abe0 Mon Sep 17 00:00:00 2001
-From: Ola x Nilsson <olani@axis.com>
-Date: Mon, 15 Apr 2024 17:31:44 +0200
-Subject: [PATCH] Handle various time_t sizes in printf and scanf
-
-The members of the timeval struct are both signed (defined by POSIX)
-and typically both 64 bits on a system where time_t is 64 bits.  This
-is possible also on 32 bit systems where time_t is larger to handle
-the 2038 problem.
-
-It's practically impossible to find a type and printf format that
-works even on all glibc systems.  Play it safe and always use printf
-with intmax_t and explict int64_t variables for scanf.
-
-Upstream-Status: Submitted [https://github.com/chaos/diod/pull/100]
-Signed-off-by: Ola x Nilsson <olani@axis.com>
----
- libnpfs/conn.c   | 5 +++--
- libnpfs/ctl.c    | 7 ++++---
- utils/dioddate.c | 8 +++++++-
- 3 files changed, 14 insertions(+), 6 deletions(-)
-
-diff --git a/libnpfs/conn.c b/libnpfs/conn.c
-index 6e85fff..c34c840 100644
---- a/libnpfs/conn.c
-+++ b/libnpfs/conn.c
-@@ -16,6 +16,7 @@
- #include <stdio.h>
- #include <string.h>
- #include <stdint.h>
-+#include <inttypes.h>
- #include <stdarg.h>
- #include <errno.h>
- #include <pthread.h>
-@@ -133,8 +134,8 @@ _debug_trace (Npsrv *srv, Npfcall *fc)
-                                (void)gettimeofday(&b, NULL);
-                        (void)gettimeofday(&a, NULL);
-                        timersub(&a, &b, &c);
--                       np_logmsg(srv, "[%lu.%-3lu] %s",
--                                 c.tv_sec, c.tv_usec/1000, s);
-+                       np_logmsg(srv, "[%"PRIdMAX".%-3"PRIdMAX"] %s",
-+                                 (intmax_t)c.tv_sec, (intmax_t)c.tv_usec/1000, s);
-                } else
-                        np_logmsg(srv, "%s", s);
-        }
-diff --git a/libnpfs/ctl.c b/libnpfs/ctl.c
-index f40cde4..317a22e 100644
---- a/libnpfs/ctl.c
-+++ b/libnpfs/ctl.c
-@@ -16,6 +16,7 @@
- #include <stdio.h>
- #include <string.h>
- #include <stdint.h>
-+#include <inttypes.h>
- #include <stdarg.h>
- #include <pthread.h>
- #include <errno.h>
-@@ -291,9 +292,9 @@ _ctl_get_date (char *name, void *a)
-                np_uerror (errno);
-                goto error;
-        }
--       if (aspf (&s, &len, "%lu.%lu %d.%d\n",
--                                       tv.tv_sec,         tv.tv_usec,
--                                       tz.tz_minuteswest, tz.tz_dsttime) < 0) {
-+       if (aspf (&s, &len, "%"PRIdMAX".%"PRIdMAX" %d.%d\n",
-+                                       (uintmax_t)tv.tv_sec, (uintmax_t)tv.tv_usec,
-+                                       tz.tz_minuteswest,    tz.tz_dsttime) < 0) {
-                np_uerror (ENOMEM);
-                goto error;
-        }
-diff --git a/utils/dioddate.c b/utils/dioddate.c
-index bde002f..f392792 100644
---- a/utils/dioddate.c
-+++ b/utils/dioddate.c
-@@ -21,6 +21,7 @@
- #include <unistd.h>
- #include <stdlib.h>
- #include <stdint.h>
-+#include <inttypes.h>
- #include <stdarg.h>
- #include <stdio.h>
- #if HAVE_GETOPT_H
-@@ -142,11 +143,16 @@ main (int argc, char *argv[])
-         errn (np_rerror (), "error reading date");
-         goto done;
-     }
--    if (sscanf (buf, "%lu.%lu %d.%d", &tv.tv_sec, &tv.tv_usec,
-+
-+    int64_t sec = 0, usec = 0;
-+    if (sscanf (buf, "%"SCNd64".%"SCNd64" %d.%d", &sec, &usec,
-                                     &tz.tz_minuteswest, &tz.tz_dsttime) != 4) {
-         msg ("error scanning returned date: %s", buf);
-         goto done;
-     }
-+    tv.tv_sec = sec;
-+    tv.tv_usec = usec;
-+
-     if (Sopt) {
-         if (settimeofday (&tv, &tz) < 0)
-             err_exit ("settimeofday");
diff --git a/recipes-extended/fuse-overlayfs/fuse-overlayfs/0001-utils-Add-missing-include-on-limits.h.patch b/recipes-extended/fuse-overlayfs/fuse-overlayfs/0001-utils-Add-missing-include-on-limits.h.patch
deleted file mode 100644
index cd504ce5..00000000
--- a/recipes-extended/fuse-overlayfs/fuse-overlayfs/0001-utils-Add-missing-include-on-limits.h.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From b48e958aaecfdfc3bb48db082a548a09d6487181 Mon Sep 17 00:00:00 2001
-From: Andrei Gherzan <andrei.gherzan@huawei.com>
-Date: Wed, 13 Jul 2022 12:05:07 +0200
-Subject: [PATCH] utils: Add missing include on limits.h
-
-This happens to not be an issue with glibc because it gets indirectly
-included via dirent.h:
-
-.. /usr/include/dirent.h
-[...]
-..... /usr/include/linux/limits.h
-
-When using the musl libc implementation, that is not the case anymore
-and the build fails.
-
-Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
-Upstream-Status: Submitted [https://github.com/containers/fuse-overlayfs/pull/362]
----
- utils.h | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/utils.h b/utils.h
-index 13a177e..6fbc328 100644
---- a/utils.h
-+++ b/utils.h
-@@ -32,6 +32,7 @@
- # include <sys/types.h>
- # include <fcntl.h>
- # include "fuse-overlayfs.h"
-+# include <limits.h>
- 
- # define XATTR_OVERRIDE_STAT "user.fuseoverlayfs.override_stat"
- # define XATTR_PRIVILEGED_OVERRIDE_STAT "security.fuseoverlayfs.override_stat"
--- 
-2.25.1
-
diff --git a/recipes-extended/fuse-overlayfs/fuse-overlayfs_1.14.bb b/recipes-extended/fuse-overlayfs/fuse-overlayfs_1.14.bb
new file mode 100644
index 00000000..0f6d0fb6
--- /dev/null
+++ b/recipes-extended/fuse-overlayfs/fuse-overlayfs_1.14.bb
@@ -0,0 +1,15 @@
+SUMMARY = "FUSE implementation of overlayfs."
+DESCRIPTION = "An implementation of overlay+shiftfs in FUSE for rootless \
+containers."
+
+LICENSE = "GPL-2.0-or-later"
+LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
+
+SRCREV = "33cb788edc05f5e3cbb8a7a241f5a04bee264730"
+SRC_URI = "git://github.com/containers/fuse-overlayfs.git;nobranch=1;protocol=https"
+
+DEPENDS = "fuse3"
+
+S = "${WORKDIR}/git"
+
+inherit autotools pkgconfig
diff --git a/recipes-extended/fuse-overlayfs/fuse-overlayfs_1.9.bb b/recipes-extended/fuse-overlayfs/fuse-overlayfs_1.9.bb
deleted file mode 100644
index 31199928..00000000
--- a/recipes-extended/fuse-overlayfs/fuse-overlayfs_1.9.bb
+++ /dev/null
@@ -1,18 +0,0 @@
-SUMMARY = "FUSE implementation of overlayfs."
-DESCRIPTION = "An implementation of overlay+shiftfs in FUSE for rootless \
-containers."
-
-LICENSE = "GPL-3.0-or-later"
-LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"
-
-SRCREV = "51592ea406f48faeccab288f65dcba6c4a67cd90"
-SRC_URI = " \
-        git://github.com/containers/fuse-overlayfs.git;nobranch=1;protocol=https \
-        file://0001-utils-Add-missing-include-on-limits.h.patch \
-"
-
-DEPENDS = "fuse3"
-
-S = "${WORKDIR}/git"
-
-inherit autotools pkgconfig
diff --git a/recipes-extended/hyperstart/hyperstart/0001-container.c-Fix-compiler-errors-that-gcc-8.1.0-repor.patch b/recipes-extended/hyperstart/hyperstart/0001-container.c-Fix-compiler-errors-that-gcc-8.1.0-repor.patch
deleted file mode 100644
index d48e2647..00000000
--- a/recipes-extended/hyperstart/hyperstart/0001-container.c-Fix-compiler-errors-that-gcc-8.1.0-repor.patch
+++ /dev/null
@@ -1,230 +0,0 @@
-From 085dd65bba063e391350487f2a5e4a7bf69ee6c8 Mon Sep 17 00:00:00 2001
-From: Jason Wessel <jason.wessel@windriver.com>
-Date: Fri, 15 Jun 2018 08:04:35 -0700
-Subject: [PATCH] container.c: Fix compiler errors that gcc 8.1.0 reports
-
-gcc 8.1.0 reports the following compiler errors/warnings.  They can be
-fixed by using snprintf and checking the result for truncation.  This
-patch also uses a named constant instead of inserting the value 512 in
-many locations.
-
-container.c: In function 'hyper_setup_container_rootfs':
-container.c:630:24: error: '/' directive writing 1 byte into a region of size between 0 and 511 [-Werror=format-overflow=]
-  sprintf(rootfs, "%s/%s/", root, container->rootfs);
-                        ^
-container.c:630:2: note: 'sprintf' output 3 or more bytes (assuming 514) into a destination of size 512
-  sprintf(rootfs, "%s/%s/", root, container->rootfs);
-  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-container.c:262:18: error: '%s' directive writing up to 511 bytes into a region of size 510 [-Werror=format-overflow=]
-  sprintf(dst, "./%s", src);
-                  ^~   ~~~
-container.c:262:2: note: 'sprintf' output between 3 and 514 bytes into a destination of size 512
-  sprintf(dst, "./%s", src);
-  ^~~~~~~~~~~~~~~~~~~~~~~~~
-container.c:218:24: error: '/_data' directive writing 6 bytes into a region of size between 1 and 512 [-Werror=format-overflow=]
-     sprintf(volume, "%s/_data", path);
-                        ^~~~~~
-container.c:218:5: note: 'sprintf' output between 7 and 518 bytes into a destination of size 512
-     sprintf(volume, "%s/_data", path);
-     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-container.c:149:24: error: '/_data' directive writing 6 bytes into a region of size between 0 and 511 [-Werror=format-overflow=]
-    sprintf(volume, "/%s/_data", path);
-                        ^~~~~~
-container.c:149:4: note: 'sprintf' output between 8 and 519 bytes into a destination of size 512
-    sprintf(volume, "/%s/_data", path);
-    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-container.c:131:24: error: '/' directive writing 1 byte into a region of size between 0 and 511 [-Werror=format-overflow=]
-    sprintf(volume, "/%s/", path);
-                        ^
-container.c:131:4: note: 'sprintf' output between 3 and 514 bytes into a destination of size 512
-    sprintf(volume, "/%s/", path);
-    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-container.c:176:24: error: '/_data/' directive writing 7 bytes into a region of size between 0 and 511 [-Werror=format-overflow=]
-    sprintf(volume, "/%s/_data/%s", path, filevolume);
-                        ^~~~~~~
-container.c:176:4: note: 'sprintf' output 9 or more bytes (assuming 520) into a destination of size 512
-    sprintf(volume, "/%s/_data/%s", path, filevolume);
-    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
-
----
- src/container.c | 47 ++++++++++++++++++++++++++++-------------------
- 1 file changed, 28 insertions(+), 19 deletions(-)
-
-diff --git a/src/container.c b/src/container.c
-index fee67ff..94d49d8 100644
---- a/src/container.c
-+++ b/src/container.c
-@@ -22,6 +22,8 @@
- #include "syscall.h"
- #include "netlink.h"
- 
-+#define MAX_PBUF 512
-+
- static int container_populate_volume(char *src, char *dest)
- {
-        struct stat st;
-@@ -116,12 +118,12 @@ static int container_setup_volume(struct hyper_pod *pod,
-                                  struct hyper_container *container)
- {
-        int i;
--       char dev[512], path[512];
-+       char dev[MAX_PBUF], path[MAX_PBUF];
-        struct volume *vol;
- 
-        for (i = 0; i < container->vols_num; i++) {
--               char volume[512];
--               char mountpoint[512];
-+               char volume[MAX_PBUF];
-+               char mountpoint[MAX_PBUF];
-                char *options = NULL;
-                const char *filevolume = NULL;
-                bool newvolume = false;
-@@ -146,7 +148,8 @@ static int container_setup_volume(struct hyper_pod *pod,
-                        if (hyper_mount_nfs(vol->device, path) < 0)
-                                return -1;
-                        /* nfs export has implicitly included _data part of the volume */
--                       sprintf(volume, "/%s/", path);
-+                       if (snprintf(volume, MAX_PBUF, "/%s/", path) >= MAX_PBUF)
-+                                return -1;
-                } else {
-                        fprintf(stdout, "mount %s to %s, tmp path %s\n",
-                                dev, vol->mountpoint, path);
-@@ -155,7 +158,7 @@ static int container_setup_volume(struct hyper_pod *pod,
-                                options = "nouuid";
- 
-                        if (access(dev, R_OK) < 0) {
--                               char device[512];
-+                               char device[MAX_PBUF];
-                                sprintf(device, "/block/%s", vol->device);
-                                hyper_netlink_wait_dev(pod->ueventfd, device);
-                        }
-@@ -164,7 +167,8 @@ static int container_setup_volume(struct hyper_pod *pod,
-                                perror("mount volume device failed");
-                                return -1;
-                        }
--                       sprintf(volume, "/%s/_data", path);
-+                       if (snprintf(volume, MAX_PBUF, "/%s/_data", path) >= MAX_PBUF)
-+                                return -1;
-                }
- 
-                if (container_check_volume(volume, &filevolume, &newvolume) < 0)
-@@ -193,7 +197,8 @@ static int container_setup_volume(struct hyper_pod *pod,
-                                perror("create volume file failed");
-                                return -1;
-                        }
--                       sprintf(volume, "/%s/_data/%s", path, filevolume);
-+                       if (snprintf(volume, MAX_PBUF, "/%s/_data/%s", path, filevolume) >= MAX_PBUF)
-+                                return -1;
-                        /* 0777 so that any user can read/write the new file volume */
-                        if (chmod(volume, 0777) < 0) {
-                                fprintf(stderr, "fail to chmod directory %s\n", volume);
-@@ -217,9 +222,9 @@ static int container_setup_volume(struct hyper_pod *pod,
- 
-        for (i = 0; i < container->maps_num; i++) {
-                struct stat st;
--               char *src, path[512], volume[512];
-+               char *src, path[MAX_PBUF], volume[MAX_PBUF];
-                struct fsmap *map = &container->maps[i];
--               char mountpoint[512];
-+               char mountpoint[MAX_PBUF];
- 
-                sprintf(path, "%s/%s", SHARED_DIR, map->source);
-                sprintf(mountpoint, "./%s", map->path);
-@@ -235,7 +240,8 @@ static int container_setup_volume(struct hyper_pod *pod,
-                        }
-                        if (map->docker) {
-                                /* converted from volume */
--                               sprintf(volume, "%s/_data", path);
-+                               if (snprintf(volume, MAX_PBUF, "%s/_data", path) >= MAX_PBUF)
-+                                        return -1;
-                                src = volume;
-                                if (container->initialize &&
-                                    (container_populate_volume(mountpoint, volume) < 0)) {
-@@ -271,7 +277,7 @@ static int container_setup_modules(struct hyper_container *container)
- {
-        struct stat st;
-        struct utsname uts;
--       char src[512], dst[512];
-+       char src[MAX_PBUF], dst[MAX_PBUF];
- 
-        if (uname(&uts) < 0) {
-                perror("fail to call uname");
-@@ -279,7 +285,8 @@ static int container_setup_modules(struct hyper_container *container)
-        }
- 
-        sprintf(src, "/lib/modules/%s", uts.release);
--       sprintf(dst, "./%s", src);
-+       if (snprintf(dst, MAX_PBUF, "./%s", src) >= MAX_PBUF)
-+        return -1;
- 
-        if (stat(dst, &st) == 0) {
-                struct dirent **list;
-@@ -318,7 +325,7 @@ static int container_setup_modules(struct hyper_container *container)
- 
- static int container_setup_mount(struct hyper_container *container)
- {
--       char src[512];
-+       char src[MAX_PBUF];
- 
-        // current dir is container rootfs, the operations on "./PATH" are the operations on container's "/PATH"
-        if (!container->readonly) {
-@@ -576,7 +583,7 @@ static int hyper_setup_container_rootfs(void *data)
- {
-        struct hyper_container_arg *arg = data;
-        struct hyper_container *container = arg->c;
--       char root[512], rootfs[512];
-+       char root[MAX_PBUF], rootfs[MAX_PBUF];
-        int setup_dns;
- 
-        /* wait for ns-opened ready message */
-@@ -639,7 +646,7 @@ static int hyper_setup_container_rootfs(void *data)
-                        goto fail;
-                }
-        } else {
--               char path[512];
-+               char path[MAX_PBUF];
- 
-                sprintf(path, "%s/%s/", SHARED_DIR, container->image);
-                fprintf(stdout, "src directory %s\n", path);
-@@ -657,7 +664,9 @@ static int hyper_setup_container_rootfs(void *data)
-        fprintf(stdout, "root directory for container is %s/%s, init task %s\n",
-                root, container->rootfs, container->exec.argv[0]);
- 
--       sprintf(rootfs, "%s/%s/", root, container->rootfs);
-+       if (snprintf(rootfs, MAX_PBUF, "%s/%s/", root, container->rootfs) >= MAX_PBUF)
-+        goto fail;
-+    
-        if (mount(rootfs, rootfs, NULL, MS_BIND|MS_REC, NULL) < 0) {
-                perror("failed to bind rootfs");
-                goto fail;
-@@ -740,7 +749,7 @@ fail:
- 
- static int hyper_setup_pty(struct hyper_container *c)
- {
--       char root[512];
-+       char root[MAX_PBUF];
- 
-        sprintf(root, "/tmp/hyper/%s/devpts/", c->id);
- 
-@@ -760,7 +769,7 @@ static int hyper_setup_pty(struct hyper_container *c)
- 
- static void hyper_cleanup_pty(struct hyper_container *c)
- {
--       char path[512];
-+       char path[MAX_PBUF];
- 
-        sprintf(path, "/tmp/hyper/%s/devpts/", c->id);
-        if (umount(path) < 0)
-@@ -769,7 +778,7 @@ static void hyper_cleanup_pty(struct hyper_container *c)
- 
- int container_prepare_rootfs_dev(struct hyper_container *container, struct hyper_pod *pod)
- {
--       char dev[512];
-+       char dev[MAX_PBUF];
- 
-        if (container->fstype == NULL)
-                return 0;
diff --git a/recipes-extended/hyperstart/hyperstart_git.bb b/recipes-extended/hyperstart/hyperstart_git.bb
deleted file mode 100644
index e156cdae..00000000
--- a/recipes-extended/hyperstart/hyperstart_git.bb
+++ /dev/null
@@ -1,26 +0,0 @@
-SUMMARY = "The tiny Init service for HyperContainer"
-DESCRIPTION = "The init Task for HyperContainer"
-
-LICENSE = "Apache-2.0"
-LIC_FILES_CHKSUM = "file://LICENSE;md5=fa818a259cbed7ce8bc2a22d35a464fc"
-
-inherit autotools-brokensep 
-
-SRC_URI = "git://github.com/hyperhq/hyperstart.git;branch=master;protocol=https"
-SRC_URI += "file://0001-container.c-Fix-compiler-errors-that-gcc-8.1.0-repor.patch"
-
-SRCREV = "c0c07d218b482dd07f9068b52a6e7468ae4172ac"
-PV = "v0.2+git"
-
-S = "${WORKDIR}/git"
-
-CACHED_CONFIGUREVARS = "ac_cv_file__usr_include_linux_vm_sockets_h=true"
-
-do_install() {
-        install -d ${D}/var/lib/hyper/
-
-        install -m644 ${S}/build/hyper-initrd.img ${D}/var/lib/hyper/
-        install -m644 ${S}/build/arch/x86_64/kernel ${D}/var/lib/hyper/
-}
-
-FILES:${PN} += "/var/lib/hyper"
diff --git a/recipes-extended/images/README-xen.md b/recipes-extended/images/README-xen.md
new file mode 100644
index 00000000..82d72364
--- /dev/null
+++ b/recipes-extended/images/README-xen.md
@@ -0,0 +1,173 @@
+This README contains information on the xen reference images
+and testing / usability information
+
+Images
+------
+
+xen-image-minimal:
+
+This is the reference xen host image. It currently requires systemd
+and xen as DISTRO_FEATURES.
+
+All required dependencies are included for typical execution (and
+debug) of guests.
+
+xen-guest-image-minimal:
+
+This is the reference guest / domU image. Note that it boots the
+same kernel as the xen host image (unless multiconfig is used
+to differentiate).
+
+It creates tarballs, ext4 and qcow images for testing purposes.
+
+bundling
+--------
+
+Guests can be bundled automatically through the following mechanisms:
+
+  - via the variable XEN_BUNDLED_GUESTS
+  - via a xen configuration file in the deploy directory of the format
+    xen-guest-bundle-*.cfg
+
+The guests can be built via OE, or be 3rd party guests. They just
+must be in the deploy directory so they can be copied into the rootfs
+of the xen host image
+
+Type 1) XEN_BUNDLED_GUESTS
+
+If XEN_BUNDLED_GUESTS is used, it is simply a colon separated list of
+rootfs:kernels. Normal variable rules apply, so it can be set in a
+local.conf, or in a bbappend to the image recipe.
+
+An example would be:
+
+ XEN_BUNDLED_GUESTS = "xen-guest-image-minimal-qemuarm64.rootfs.ext4:Image"
+
+These point at symlinks created in the image deploy directory, or they
+can be specific images/kernels without the symlink.
+
+Type 2) A Xen guest configuration file
+
+If xen guest configuration files are found in the deploy directories
+the kernel and disk information contained within them will be processed
+and modified for the xen host. The kernel and guest image will be
+copied to the appropriate location, and the config made to match.
+
+These files following the naming convention: xen-guest-bundle*.cfg
+
+Guests of type #1 generate a configuration file that is picked up as
+type #2.
+
+An example config file follows:
+
+   name = "xen-guest"
+   memory = 512
+   vcpus = 1
+   disk = ['file:xen-guest-image-minimal-qemuarm64.rootfs.ext4,xvda,rw']
+   vif = ['bridge=xenbr0']
+   kernel = "Image"
+   extra = "root=/dev/xvda ro console=hvc0 ip=dhcp"
+
+It should also be noted that when a xen-guest-image-minimal is built
+with the XEN_GUEST_AUTO_BUNDLE varaible set to True, a configuration
+file for type #2 will be generated and the guest bundled automatically
+when the host image is built.
+
+kernel and rootfs are copied to the target in /var/lib/xen/images/
+
+configuration files are copied to: /etc/xen
+
+Guests can be launched after boot with: xl create -c /etc/xen/<config file>
+
+Build and boot
+--------------
+
+Using a reference qmeuarm64 MACHINE, the following are the commands
+to build and boot a guest.
+
+local.conf contains:
+
+   XEN_BUNDLED_GUESTS = "xen-guest-image-minimal-qemuarm64.rootfs.ext4:Image"
+
+ % bitbake xen-guest-image-minimal
+ % bitbake xen-image-minimal
+
+ % runqemu qemuarm64 nographic slirp qemuparams="-m 4096" tmp/deploy/images/qemuarm64/xen-image-minimal-qemuarm64.rootfs.ext4
+
+Poky (Yocto Project Reference Distro) 5.1 qemuarm64 hvc0
+
+qemuarm64 login: root
+
+WARNING: Poky is a reference Yocto Project distribution that should be used for
+testing and development purposes only. It is recommended that you create your
+own distribution for production use.
+
+ root@qemuarm64:~# uname -a
+Linux qemuarm64 6.10.11-yocto-standard #1 SMP PREEMPT Fri Sep 20 22:32:26 UTC 2024 aarch64 GNU/Linux
+root@qemuarm64:~# ls /etc/xen/
+auto
+cpupool
+scripts
+xen-guest-bundle-xen-guest-image-minimal-qemuarm64--20241112174803.cfg
+xl.conf
+root@qemuarm64:~# ls /var/lib/xen/images/
+Image--6.10.11+git0+4bf82718cf_6c956b2ea6-r0-qemuarm64-20241018190311.bin
+xen-guest-image-minimal-qemuarm64.rootfs-20241111222814.ext4
+
+ root@qemuarm64:~# ip a s
+1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
+    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
+    inet 127.0.0.1/8 scope host lo
+       valid_lft forever preferred_lft forever
+    inet6 ::1/128 scope host noprefixroute 
+       valid_lft forever preferred_lft forever
+2: enp0s1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master xenbr0 qlen 1000
+    link/ether 52:54:00:12:35:02 brd ff:ff:ff:ff:ff:ff
+3: sit0@NONE: <NOARP> mtu 1480 qdisc noop qlen 1000
+    link/sit 0.0.0.0 brd 0.0.0.0
+4: xenbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue qlen 1000
+    link/ether ee:e4:a8:24:24:e7 brd ff:ff:ff:ff:ff:ff
+    inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic xenbr0
+       valid_lft 86354sec preferred_lft 86354sec
+    inet6 fec0::ece4:a8ff:fe24:24e7/64 scope site dynamic noprefixroute flags 100 
+       valid_lft 86356sec preferred_lft 14356sec
+    inet6 fe80::ece4:a8ff:fe24:24e7/64 scope link 
+       valid_lft forever preferred_lft forever
+
+ root@qemuarm64:~# xl create -c /etc/xen/xen-guest-bundle-xen-guest-image-minimal-qemuarm64--20241112174803.cfg
+
+qemuarm64 login: root
+
+WARNING: Poky is a reference Yocto Project distribution that should be used for
+testing and development purposes only. It is recommended that you create your
+own distribution for production use.
+
+root@qemuarm64:~# uname -a
+Linux qemuarm64 6.10.11-yocto-standard #1 SMP PREEMPT Fri Sep 20 22:32:26 UTC 2024 aarch64 GNU/Linux
+
+root@qemuarm64:~# wget example.com
+Connecting to example.com (93.184.215.14:80)
+wget: can't open 'index.html': File exists
+root@qemuarm64:~# rm index.html 
+root@qemuarm64:~# wget example.com
+Connecting to example.com (93.184.215.14:80)
+saving to 'index.html'
+index.html           100% |********************************|  1256  0:00:00 ETA
+'index.html' saved
+
+From the host:
+
+Connection to 127.0.0.1 closed.
+build4 [/home/bruc.../qemuarm64]> ssh -p 2222 root@127.0.0.1
+Last login: Tue Nov 12 20:42:57 2024 from 10.0.2.2
+
+WARNING: Poky is a reference Yocto Project distribution that should be used for
+testing and development purposes only. It is recommended that you create your
+own distribution for production use.
+
+root@qemuarm64:~# xl list
+Name                                        ID   Mem VCPUs      State   Time(s)
+Domain-0                                     0   192     4     r-----     696.2
+xen-guest                                    1   512     1     -b----     153.0
+root@qemuarm64:~# xl destroy xen-guest
+
diff --git a/recipes-extended/images/README.md b/recipes-extended/images/README.md
new file mode 100644
index 00000000..1a25f724
--- /dev/null
+++ b/recipes-extended/images/README.md
@@ -0,0 +1,311 @@
+This README describes the contents of the reference images in
+this directory, as well as some testing and usability tips.
+
+container-image-host
+--------------------
+
+As described in the recipe, this is a flexible image definition that
+is suitable for building a container host image for a target.
+
+The configuration options for the image are best found in the recipe
+itself, so the information will not be duplicated here. The type of
+container host that will be created is controlled by the CONTAINER_PROFILE
+variable:
+
+i.e. in your local.conf: CONTAINER_PROFILE="docker"
+
+The valid settings for this variable can be found in the image recipe.
+
+The recipe checks for mandatory distro features, recommends others
+and provides a list of optional distro features for some workloads.
+
+This image also builds using virt-unique-hostname, which ensures that
+there is some randomization as hostname is often used to identify
+hosts when clustered (i.e. k3s).
+
+To have enough disk space for container images, it is configured
+with extra space. Depending on your use case, you can add (or remove)
+space as appropriate.
+
+Also note that more memory than the default is often required.
+
+An example execution of the image is:
+
+  % runqemu qemuarm64 nographic slirp qemuparams="-m 2048" tmp/deploy/images/qemuarm64/container-image-host-qemuarm64.rootfs.ext4
+
+ssh is enabled in this image by default, so the image can be accessed
+via:
+
+  % ssh -p 2222 root@127.0.0.1
+
+After a container image has been built, it can be copied fro the
+deploy directory to the registry of your choice, for example:
+
+  % cd build/tmp/deploy/images/qemuarm64
+  % skopeo copy --dest-creds <username>:<creds> oci:c3-systemd-container-latest-oci:latest docker://zeddii/c3-systemd-container
+
+Examples of pulling images to the container host for the various
+runtimes follow:
+
+  % podman pull --creds <username>:<password> zeddii/container-devtools
+  % podman run -it docker.io/zeddii/container-devtools bash
+
+  % root@qemuarm64-54:~# docker login
+  # Login Succeeded
+  % root@qemuarm64-54:~# docker pull zeddii/container-devtools
+
+  % root@qemuarm64-54:~# docker run -it --entrypoint /bin/sh zeddii/container-base
+  # [  804.133881] docker0: port 1(veth2801d6a) entered blocking state
+  # [  804.134425] docker0: port 1(veth2801d6a) entered disabled state
+  # [  804.135018] veth2801d6a: entered allmulticast mode
+  # [  804.136101] veth2801d6a: entered promiscuous mode
+  # [  806.227282] eth0: renamed from veth384b37d
+  # [  806.235331] docker0: port 1(veth2801d6a) entered blocking state
+  # [  806.236010] docker0: port 1(veth2801d6a) entered forwarding state
+  # / # ls
+  # bin    boot   dev    etc    home   lib    media  mnt    proc   run    sbin   sys    tmp    usr    var
+
+container-base:
+---------------
+
+Provides a minimal container image (but not absolutely smallest) that is
+inherited / included by the other container images.
+
+By default container base does not execute anything (it doesn't define
+and OCI_IMAGE_ENTRYPOINT), but does provide a shell that can be used
+to inspect the image.
+
+  % root@qemuarm64-54:~# docker run -it zeddii/container-base sh       
+  [51393.764879] docker0: port 1(veth06cb397) entered blocking state
+  [51393.765340] docker0: port 1(veth06cb397) entered disabled state
+  [51393.765854] veth06cb397: entered allmulticast mode
+  [51393.766753] veth06cb397: entered promiscuous mode
+  [51396.060958] eth0: renamed from veth7e5a654
+  [51396.074281] docker0: port 1(veth06cb397) entered blocking state
+  [51396.074786] docker0: port 1(veth06cb397) entered forwarding state
+  / # ls
+  bin    boot   dev    etc    home   lib    media  mnt    proc   run    sbin   sys    tmp    usr    var
+  / # df -kh .
+  Filesystem                Size      Used Available Use% Mounted on
+  overlay                  37.8G      1.9G     33.8G   5% /
+  / # du -sh .
+  2.6M    .
+  / # 
+
+  % root@qemuarm64-54:~# ctr images pull --user <user>:<password> docker.io/zeddii/container-base:latest
+  docker.io/zeddii/container base:latest          saved
+  └──manifest (45395e734a93)                      complete        |++++++++++++++++++++++++++++++++++++++|
+     ├──layer (1fd5069cdbad)                      waiting         |--------------------------------------|
+     └──config (24b67db5b19e)                     waiting         |--------------------------------------|
+  application/vnd.oci.image.manifest.v1+json sha256:45395e734a931468f5329d20d20babf13fbabbcd993e27b0e5c4198d09130966
+  Pulling from OCI Registry (docker.io/zeddii/container-base:latest)      elapsed: 3.7 s  total:  463.0   (123.0 B/s)
+
+  % root@qemuarm64-54:~# ctr run --rm -t docker.io/zeddii/container-base:latest zedd_shell sh
+  / # date
+  Tue Oct 29 00:09:19 UTC 2024
+  / # 
+
+  % root@qemuarm64-54:~# nerdctl pull docker.io/zeddii/container-base:latest
+  docker.io/zeddii/container-base:latest:                                           resolved       |++++++++++++++++++++++++++++++++++++++| 
+  docker.io/zeddii/container-base:latest:                                           resolved       |++++++++++++++++++++++++++++++++++++++| 
+  manifest-sha256:45395e734a931468f5329d20d20babf13fbabbcd993e27b0e5c4198d09130966: exists         |++++++++++++++++++++++++++++++++++++++| 
+  config-sha256:24b67db5b19e0bb90291f1d5619362c7eaade7a8c65da9a32c2016394a5b57bf:   exists         |++++++++++++++++++++++++++++++++++++++| 
+  elapsed: 1.2 s                                                                    total:   0.0 B (0.0 B/s)
+
+  # FIXME: At the time of creating this README, bridge networking and CNI is not working.
+  % root@qemuarm64-54:~# nerdctl run -it --net=host docker.io/zeddii/container-base:latest sh
+  / # 
+
+container-devtools-base:
+-------------------------
+
+includes container-base, and adds image features to make development
+tools/headers available.
+
+Anything added to CORE_DEV_IMAGE_EXTRA_INSTALL will be installed into
+the image in it's development variant.
+
+The container shell is changed to bash from busybox.
+
+package-management is added to this image type, but by default there
+is no package feed configured (since it must be pointed at a build)
+
+  % root@qemuarm64-54:~# docker run -it zeddii/container-devtools bash
+  bash-5.2# du -sh .
+  399M    .
+  bash-5.2# rpm -qa | wc -l
+  308
+  bash-5.2# gcc --version 
+  gcc (GCC) 14.2.0
+  Copyright (C) 2024 Free Software Foundation, Inc.
+  This is free software; see the source for copying conditions.  There is NO
+  warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+
+By default this container has (for rpm) package management configured
+to point to a feed being run against the local build on the host machine
+
+To create a package feed:
+
+  % bitbake package-index
+
+To add a package to the package-index (example: vim-tiny)
+
+  % bitbake vim-tiny
+  % bitbake vim-tiny --runall package_write_rpm
+  % bitbake package-index
+
+To run a local http server for the package feed:
+
+  % cd build/tmp/deploy
+  % sudo python3 -m http.server 80
+
+Run the dev container:
+
+  % docker run -it zeddii/container-devtools bash
+  % dnf makecache
+  % dnf --nogpgcheck install vim-tiny
+
+container-app-base:
+--------------------
+
+Includes container-base.
+
+Provides an application container that installs a package (or packages) to
+the container and make the specified command the OCI_IMAGE_ENTRYPOINT.
+
+   CONTAINER_APP_CMD : the binary to run via the OCI_IMAGE_ENTRYPOINT
+   CONATINER_APP: packages to install to the container
+
+The default entry point is the "date" command.
+
+  % root@qemuarm64-54:~# docker run zeddii/container-app-base
+  Mon Oct 28 18:41:23 UTC 2024
+
+  % root@qemuarm64-54:~# docker run --entrypoint "du" zeddii/container-app-base -sh
+  2.6M    .
+
+  % podman run docker.io/zeddii/container-app-base
+  Mon Oct 28 18:41:23 UTC 2024
+
+container-systemd-base:
+------------------------
+
+Extends container-base to create a systemd enabled container that is
+an appropriate starting point if a systemd applciation is being run
+or a mulit-user style environment is required.
+
+The application specified in SYSTEMD_CONTAINER_APP will be installed
+and be available to be executed.
+
+The rootfs of this container type is post processed to enable and
+disable services as specified by the containeer definition. This allows
+service that are not appropriate in a containerized environemnt to
+be disabled (i.e. getty login)
+
+The list of services can be found in the recipes themselves.
+
+This container enables ssh by default, so that it can be executed
+in the background and then accessed as a full environment.
+
+Note: this is currently a priviledged container if run under docker.
+
+There are multiple ways to add/remove permissions from the container,
+and most are configurable during launch:
+
+  % root@qemuarm64-54:~# docker run -d --rm --name systemd_test  --privileged --cap-add SYS_ADMIN \
+     --security-opt seccomp=unconfined --cgroup-parent=docker.slice --cgroupns private \
+     --tmpfs /tmp --tmpfs /run --tmpfs /run/lock zeddii/systemd-container-base
+
+or
+
+  % docker run -d --rm --name systemd_test --privileged  --cgroup-parent=docker.slice \
+     --cgroupns private  zeddii/c3-systemd-container
+
+  % root@qemuarm64-54:~# docker ps
+  CONTAINER ID   IMAGE                         COMMAND        CREATED         STATUS         PORTS     NAMES
+  4b07cc907e26   zeddii/c3-systemd-container   "/sbin/init"   5 minutes ago   Up 5 minutes             systemd_test
+
+  % podman run -d --name systemd_test --privileged --cgroupns=host --tmpfs /tmp --tmpfs /run --tmpfs /run/lock \
+           -v /sys/fs/cgroup:/sys/fs/cgroup:ro  zeddii/systemd-container-base
+
+  % ctr container create --privileged --runtime="io.containerd.runc.v2" \
+      --mount type=bind,src=/sys/fs/cgroup,dst=/sys/fs/cgroup,options=rbind:rw \
+      docker.io/zeddii/systemd-container-base:latest  my_systemd_container /sbin/init
+
+  % ctr task start --detach my_systemd_container
+
+  % ctr task ls
+    TASK                    PID    STATUS    
+    my_systemd_container    690    RUNNING
+
+Then add a user to the container so you can login:
+
+  % root@qemuarm64-54:~# docker exec systemd_test useradd testuser
+  % root@qemuarm64-54:~# docker exec systemd_test sh -c "echo 'testuser:password' | chpasswd"
+
+  % podman exec systemd_test useradd testuser
+  % podman exec systemd_test sh -c "echo 'testuser:password' | chpasswd"
+
+  % ctr task exec --exec-id test_exec my_systemd_container useradd testuser
+  % ctr task exec --exec-id test_exec my_systemd_container sh -c "echo 'testuser:password' | chpasswd"
+  % ctr task exec -t --exec-id test_exec my_systemd_container bash
+
+Get the IP address:
+
+  % root@qemuarm64-54:~# docker inspect systemd_test | grep \"IPAddress\":    
+            "IPAddress": "172.17.0.2",
+                    "IPAddress": "172.17.0.2",
+
+  % root@qemuarm64-54:~# podman inspect 2f9e00c53c13 | grep IPAdd
+               "IPAddress": "10.88.0.5",
+                         "IPAddress": "10.88.0.5",
+
+ssh into the container:
+
+  % root@qemuarm64-54:~# ssh testuser@172.17.0.2
+  % testuser@172.17.0.2's password:
+
+  WARNING: Poky is a reference Yocto Project distribution that should be used for         
+  testing and development purposes only. It is recommended that you create your                     
+  own distribution for production use.
+
+  4b07cc907e26:~$ systemctl  | grep running
+    init.scope                                    loaded active     running   System and Service Manager
+    session-c1.scope                              loaded active     running   Session c1 of User testuser
+    dbus.service                                  loaded active     running   D-Bus System Message Bus
+    dhcpcd.service                                loaded active     running   A minimalistic network configuration daemon with DHCPv4, rdisc and DHCPv6 support
+    getty@tty1.service                            loaded active     running   Getty on tty1
+    sshd@2-172.17.0.2:22-172.17.0.1:39264.service loaded active     running   OpenSSH Per-Connection Daemon (172.17.0.1:39264)
+    systemd-journald.service                      loaded active     running   Journal Service
+    systemd-logind.service                        loaded active     running   User Login Management
+    systemd-networkd.service                      loaded active     running   Network Configuration
+    systemd-nsresourced.service                   loaded active     running   Namespace Resource Manager
+    systemd-resolved.service                      loaded active     running   Network Name Resolution
+    systemd-userdbd.service                       loaded active     running   User Database Manager
+    user@1000.service                             loaded active     running   User Manager for UID 1000
+    xinetd.service                                loaded active     running   Xinetd A Powerful Replacement For Inetd
+    dbus.socket                                   loaded active     running   D-Bus System Message Bus Socket
+    systemd-journald-dev-log.socket               loaded active     running   Journal Socket (/dev/log)
+    systemd-journald.socket                       loaded active     running   Journal Sockets
+    systemd-networkd.socket                       loaded active     running   Network Service Netlink Socket
+    systemd-nsresourced.socket                    loaded active     running   Namespace Resource Manager Socket
+    systemd-userdbd.socket                        loaded active     running   User Database Manager Socket
+
+
+   % root@qemuarm64-54:~# ssh testuser@10.88.0.5
+   The authenticity of host '10.88.0.5 (10.88.0.5)' can't be established.
+   ECDSA key fingerprint is SHA256:ydCJGSVNLdWiAcC5PUkDsiFZZ6sDTeQ9Nt13a6HQCc4.
+   This key is not known by any other names.
+   Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
+   Warning: Permanently added '10.88.0.5' (ECDSA) to the list of known hosts.
+   testuser@10.88.0.5's password: 
+
+   WARNING: Poky is a reference Yocto Project distribution that should be used for
+   testing and development purposes only. It is recommended that you create your
+   own distribution for production use.
+
+   2f9e00c53c13:~$ 
+
+Enjoy!
+
+
diff --git a/recipes-extended/images/cloud-image-controller.bb b/recipes-extended/images/cloud-image-controller.bb
index c816545f..b192db90 100644
--- a/recipes-extended/images/cloud-image-controller.bb
+++ b/recipes-extended/images/cloud-image-controller.bb
@@ -29,4 +29,4 @@ inherit core-image
 IMAGE_FSTYPES = "wic.vmdk tar.gz"
 
 # Ensure extra space for guest images
-#IMAGE_ROOTFS_EXTRA_SPACE = "41943040"
+#IMAGE_ROOTFS_EXTRA_SPACE = "2000000"
diff --git a/recipes-extended/images/container-app-base.bb b/recipes-extended/images/container-app-base.bb
new file mode 100644
index 00000000..34381ed2
--- /dev/null
+++ b/recipes-extended/images/container-app-base.bb
@@ -0,0 +1,17 @@
+SUMMARY = "Basic Application container image"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
+
+include container-base.bb
+
+# CONTAINER_APP_CMD is the executable to run as the entrypoint of the
+# container. What we have below is a placholder. if you run this
+# container, you'll get the date echo'd
+CONTAINER_APP_CMD ?= "date"
+
+# The container app is the package(s) to install into the container.
+# They must provide the command specified in CONTAINER_APP_CMD
+CONTAINER_APP ?= ""
+
+OCI_IMAGE_ENTRYPOINT = "${CONTAINER_APP_CMD}"
+IMAGE_INSTALL:append = " ${CONTAINER_APP}"
diff --git a/recipes-extended/images/container-base.bb b/recipes-extended/images/container-base.bb
index c9dd32d1..64655e0b 100644
--- a/recipes-extended/images/container-base.bb
+++ b/recipes-extended/images/container-base.bb
@@ -7,6 +7,7 @@ LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
 
 IMAGE_FSTYPES = "container oci"
+
 inherit image
 inherit image-oci
 
@@ -21,6 +22,10 @@ IMAGE_INSTALL = " \
        ${CONTAINER_SHELL} \
 "
 
+# Keep the entrypoint empty so that this image can be easily be
+# inherted and re-used for interactive or non interactive images
+OCI_IMAGE_ENTRYPOINT ?= ""
+
 # If the following is configured in local.conf (or the distro):
 #      PACKAGE_EXTRA_ARCHS:append = " container-dummy-provides"
 # 
@@ -36,7 +41,16 @@ CONTAINER_SHELL ?= "${@bb.utils.contains('PACKAGE_EXTRA_ARCHS', 'container-dummy
 IMAGE_CONTAINER_NO_DUMMY = "1"
 
 # Workaround /var/volatile for now
+# This is required because the lack of post-install scripts means volatile
+# directories (/var/volatile/*, etc.) are not created, so we do that ourselves
+# in a minimal way below. We could bootstrap and run some of the more standard
+# scripts that do it at boot, but we avoid that until needed.
 ROOTFS_POSTPROCESS_COMMAND += "rootfs_fixup_var_volatile ; "
+
+# This :remove is required, because it comes along and deletes our /var/volatile/
+# fixups!
+ROOTFS_POSTPROCESS_COMMAND:remove = "empty_var_volatile"
+
 rootfs_fixup_var_volatile () {
     install -m 1777 -d ${IMAGE_ROOTFS}/${localstatedir}/volatile/tmp
     install -m 755 -d ${IMAGE_ROOTFS}/${localstatedir}/volatile/log
diff --git a/recipes-extended/images/container-devtools-base.bb b/recipes-extended/images/container-devtools-base.bb
new file mode 100644
index 00000000..63d40ab7
--- /dev/null
+++ b/recipes-extended/images/container-devtools-base.bb
@@ -0,0 +1,51 @@
+SUMMARY = "Basic container image with development tools"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
+
+CONTAINER_SHELL = "bash"
+
+CORE_DEV_IMAGE_EXTRA_INSTALL ?= ""
+
+include container-base.bb
+inherit core-image
+
+CORE_DEV_IMAGE_EDITOR ?= "vim-tiny"
+# base-utils is required for post-install scriptlets in most packages,
+# coreutils or busybox can do the job
+CORE_DEV_IMAGE_CORE_UTILS ?= "${VIRTUAL-RUNTIME_base-utils}"
+
+IMAGE_INSTALL += " \
+   ${CORE_DEV_IMAGE_EXTRA_INSTALL} \
+   ${CORE_DEV_IMAGE_CORE_UTILS} \
+   ${CORE_DEV_IMAGE_EDITOR} \
+   "
+
+OCI_IMAGE_ENTRYPOINT = ""
+
+# development headers, tools and package management to update
+# the container.
+IMAGE_FEATURES += "dev-pkgs"
+IMAGE_FEATURES += "tools-sdk"
+IMAGE_FEATURES += "package-management"
+
+# This default configuration of 10.0.2.2 is configured
+# to contact a web server running against a bitbaked
+# package-index
+#
+#  % cd build/tmp/deploy
+#  % sudo python3 -m http.server 80
+#
+DEVTOOLS_BASE_PKG_FEED_URL ?= "http://10.0.2.2/rpm"
+
+
+# TODO: support more than rpm
+ROOTFS_POSTPROCESS_COMMAND += "rootfs_pkg_feed_config ; "
+rootfs_pkg_feed_config () {
+    if [ "${IMAGE_PKGTYPE}" = "rpm" ]; then
+       install -m 755 -d ${IMAGE_ROOTFS}/${sysconfdir}/yum.repos.d
+cat <<EOF >>${IMAGE_ROOTFS}/${sysconfdir}/yum.repos.d/oe-packages.repo
+[oe-packages]
+baseurl="${DEVTOOLS_BASE_PKG_FEED_URL}"
+EOF
+    fi
+}
diff --git a/recipes-extended/images/container-image-host.bb b/recipes-extended/images/container-image-host.bb
new file mode 100644
index 00000000..d63ef51e
--- /dev/null
+++ b/recipes-extended/images/container-image-host.bb
@@ -0,0 +1,129 @@
+DESCRIPTION = "A configurable container host image"
+LICENSE = "MIT"
+
+# This image is a reference implementation to create a target platform
+# capable of running containers. This includes kernel configuration,
+# container runtimes, tools and other support applications.
+#
+# The wpackages to install are largely described in the packagegroups
+# that are part of this layer. packagegroups are preferred as they can
+# easily be used to create similar images of different composition.
+# The recipes for the packages have their list of build and runtime
+# dependencies, as such, those dependencies are not part of the image
+# install or listed explicitly in the packgroups.
+#
+# CNCF areas that have choices are described by VIRTUAL-RUNTIME
+# variables. These variables can be set individually (in a distro,
+# layer or local configuration file), or can be set by the setting of
+# a "CONTAINER_PROFILE". It is possible to select incompatible
+# packages if setting the VIRTUAL-RUNTIME variables individually.
+# container profiles have been created as valid / tested stacks of the
+# components in meta-virtualization.
+#
+# The contents of the image are selected by testing the VIRTUAL-RUNTIME
+# values and mapping them to packagegroups.
+#
+# The possible VIRTUAL-RUNTIME variables (and their values) are
+# currently:
+#
+## engines: docker/docker-moby, virtual-containerd, cri-o, podman, lxc
+##    VIRTUAL-RUNTIME_container_engine ??= "podman"
+## runtime: runc, crun, runv, runx
+##    VIRTUAL-RUNTIME_container_runtime ??= "virtual-runc"
+## networking: cni, netavark
+##    VIRTUAL-RUNTIME_container_networking ??= "cni"
+## dns: cni, aardvark-dns
+##    VIRTUAL-RUNTIME_container_dns ??= "cni"
+## orchestration: k8s, k3s
+##    VIRTUAL-RUNTIME_container_orchestration ??= "k3s"
+## Kubernetes terminology "components"
+##   VIRTUAL-RUNTIME_cri ??= "virtual-containerd"
+##   VIRTUAL-RUNTIME_cni ??= "cni"
+#
+# To select a CONTAINER_PROFILE, set the variable in your local,
+# distro or layer configuration:
+#
+#   CONTAINER_PROFILE="<your value>"
+#
+# The possible values for CONTAINER_PROFILE can be found in
+# conf/distro/include in the format of: meta-virt-container-<profile>.inc
+#
+##    default (docker)
+##    containerd
+##    podman
+##    docker
+##    k3s-host
+##    k3s-node
+
+inherit features_check
+
+# minimum features tested to have a working container host
+# image. These will be enforced by the features_check inherit
+REQUIRED_DISTRO_FEATURES ?= " virtualization \
+                              systemd \
+                              seccomp \
+                            "
+
+# features that are typically enabled. Note, these are not
+# enforced, but maybe added to the required distro feature
+# definition in the future.
+RECOMMENDED_DISTRO_FEATURES ?= " pam \
+                                 usrmerge \
+                               "
+# features that are enabled for specific wworkloads. These
+# are not enforced, except for specific configurations.
+OPTIONAL_DISTRO_FEATURES ?= " vmsep \
+                              k3s \
+                              k8s \
+                             "
+
+REQUIRED_DISTRO_FEATURES:append = " ${@bb.utils.contains('VIRTUAL-RUNTIME_container_orchestration','k3s-node','k3s','',d)}"
+REQUIRED_DISTRO_FEATURES:append = " ${@bb.utils.contains('VIRTUAL-RUNTIME_container_orchestration','k3s-host','k3s','',d)}"
+
+# If the image is going to be placed into a cluster, we need some randomization
+# of the host name to make it unique
+IMAGE_FEATURES[validitems] += "virt-unique-hostname"
+IMAGE_FEATURES[validitems] += "container-tools"
+
+IMAGE_FEATURES += "ssh-server-openssh"
+IMAGE_FEATURES += "package-management"
+IMAGE_FEATURES += "virt-unique-hostname"
+# This may be automatically enabled in the future via a toold or debug flag
+# IMAGE_FEATURES += "container-tools"
+
+IMAGE_LINGUAS = " "
+
+# additional packages to install
+CONTAINER_IMAGE_HOST_EXTRA_INSTALL ?= ""
+
+# values can be: "all", "split" or ""
+CONTAINER_IMAGE_KERNEL_MODULES ?= "all"
+
+# These could be done via a mapping to allow a single selection line
+# per type of virtul runtime, but right now the format of the
+# virtual-runtime to packagegroup name is not mandated, so we keep
+# them separate to allow the mapping in the individual items.
+IMAGE_INSTALL = " \
+    packagegroup-core-boot \
+    packagegroup-oci \
+    container-host-config \
+    ${@bb.utils.contains('CONTAINER_IMAGE_KERNEL_MODULES','split','','kernel-modules',d)}  \
+    ${@bb.utils.contains_any('VIRTUAL-RUNTIME_container_engine','docker docker-moby','packagegroup-docker','',d)}  \
+    ${@bb.utils.contains_any('VIRTUAL-RUNTIME_container_engine','podman','packagegroup-podman','',d)}  \
+    ${@bb.utils.contains_any('VIRTUAL-RUNTIME_container_engine','containerd','packagegroup-containerd','',d)}  \
+    ${@bb.utils.contains('VIRTUAL-RUNTIME_container_networking','cni','packagegroup-cni','',d)}  \
+    ${@bb.utils.contains('VIRTUAL-RUNTIME_container_networking','netavark','packagegroup-netavark','',d)}  \
+    ${@bb.utils.contains('IMAGE_FEATURES','container-tools','packagegroup-container-tools','',d)}  \
+    ${@bb.utils.contains('VIRTUAL-RUNTIME_container_orchestration','k3s-host','packagegroup-k3s-host','',d)}  \
+    ${@bb.utils.contains('VIRTUAL-RUNTIME_container_orchestration','k3s-node','packagegroup-k3s-node','',d)}  \
+    ${CONTAINER_IMAGE_HOST_EXTRA_INSTALL} \
+    "
+
+# inherit the basics of a booting image
+inherit core-image
+
+IMAGE_ROOTFS_SIZE = "8192"
+
+# we always need extra space to install container images
+# 2GB
+IMAGE_ROOTFS_EXTRA_SPACE = "2000000"
diff --git a/recipes-extended/images/container-systemd-base.bb b/recipes-extended/images/container-systemd-base.bb
new file mode 100644
index 00000000..96ef4667
--- /dev/null
+++ b/recipes-extended/images/container-systemd-base.bb
@@ -0,0 +1,17 @@
+SUMMARY = "Systemd system container for ${SYSTEMD_CONTAINER_APP}"
+DESCRIPTION = "A small systemd system container which will run \
+                ${SYSTEMD_CONTAINER_APP}."
+
+SYSTEMD_CONTAINER_APP ?= ""
+
+# Use local.conf to specify the application(s) to install
+IMAGE_INSTALL += "${SYSTEMD_CONTAINER_APP}"
+
+# Use local.conf to specify additional systemd services to disable. To overwrite
+# the default list use SERVICES_TO_DISABLE:pn-systemd-container in local.conf
+SERVICES_TO_DISABLE:append = " ${SYSTEMD_CONTAINER_DISABLE_SERVICES}"
+
+# Use local.conf to enable systemd services
+SERVICES_TO_ENABLE += "${SYSTEMD_CONTAINER_ENABLE_SERVICES}"
+
+require container-systemd-base.inc
diff --git a/recipes-extended/images/container-systemd-base.inc b/recipes-extended/images/container-systemd-base.inc
new file mode 100644
index 00000000..0b856e83
--- /dev/null
+++ b/recipes-extended/images/container-systemd-base.inc
@@ -0,0 +1,72 @@
+SUMMARY ?= "Sample systemd system container"
+DESCRIPTION ?= "A small systemd system container which will run \
+                the application defined in IMAGE_INSTALL."
+
+LICENSE ?= "MIT"
+LIC_FILES_CHKSUM ?= "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"
+
+# Some commands of interest:
+# % docker run -d --rm --name systemd_test  --privileged \
+#    --cap-add SYS_ADMIN --security-opt seccomp=unconfined --cgroup-parent=docker.slice \
+#    --cgroupns private --tmpfs /tmp --tmpfs /run --tmpfs /run/lock zeddii/systemd-container-base
+#
+# % docker run -d --rm --name systemd_test --privileged \
+#    --cgroup-parent=docker.slice --cgroupns private  zeddii/c3-systemd-container
+#
+# % docker inspect systemd_test
+# % docker inspect systemd_test | grep \"IPAddress\":
+# % docker exec systemd_test bash -c "echo 'testuser:password' | chpasswd"
+# % ssh testuser@172.17.0.2
+
+require container-base.bb
+
+OCI_IMAGE_ENTRYPOINT = "/sbin/init"
+
+IMAGE_INSTALL:append = " systemd"
+IMAGE_INSTALL:append = " packagegroup-core-base-utils"
+IMAGE_INSTALL:append = " packagegroup-core-ssh-openssh"
+IMAGE_INSTALL:append = " busybox"
+
+IMAGE_FEATURES ?= ""
+
+NO_RECOMMENDATIONS = "1"
+
+SERVICES_TO_DISABLE ?= " \
+    systemd-udevd.service \
+    systemd-udevd-control.socket \
+    systemd-udevd-kernel.socket \
+    proc-sys-fs-binfmt_misc.automount \
+    sys-fs-fuse-connections.mount \
+    sys-kernel-debug.mount \
+    systemd-hwdb-update.service \
+    serial-getty@ttyS0.service \
+    dev-ttyS0.device \
+    console-getty.service \
+    serial-getty@.service \
+"
+
+SERVICES_TO_ENABLE ?= ""
+
+disable_systemd_services () {
+        SERVICES_TO_DISABLE="${SERVICES_TO_DISABLE}"
+        if [ -n "$SERVICES_TO_DISABLE" ]; then
+                echo "Disabling systemd services:"
+                for service in $SERVICES_TO_DISABLE; do
+                        echo "    $service"
+                        systemctl --root="${IMAGE_ROOTFS}" mask $service > /dev/null >1
+                done
+        fi
+}
+
+enable_systemd_services () {
+        SERVICES_TO_ENABLE="${SERVICES_TO_ENABLE}"
+        if [ -n "$SERVICES_TO_ENABLE" ]; then
+                echo "Enabling additional systemd services:"
+                for service in $SERVICES_TO_ENABLE; do
+                        echo "    $service"
+                        systemctl --root="${IMAGE_ROOTFS}" enable $service > /dev/null >1
+                done
+        fi
+}
+
+ROOTFS_POSTPROCESS_COMMAND += "disable_systemd_services; enable_systemd_services;"
diff --git a/recipes-extended/images/xen-guest-image-minimal.bb b/recipes-extended/images/xen-guest-image-minimal.bb
index fced7639..76f320e4 100644
--- a/recipes-extended/images/xen-guest-image-minimal.bb
+++ b/recipes-extended/images/xen-guest-image-minimal.bb
@@ -1,6 +1,7 @@
 DESCRIPTION = "A Xen guest image."
 
-inherit core-image features_check
+inherit core-image features_check deploy
+inherit kernel-artifact-names
 
 IMAGE_INSTALL += " \
     packagegroup-core-boot \
@@ -23,3 +24,28 @@ LICENSE = "MIT"
 
 # Send console messages to xen console
 APPEND += "console=hvc0"
+
+IMAGE_FSTYPES = "tar.bz2 ext4 ext4.qcow2"
+
+XEN_GUEST_AUTO_BUNDLE ?= ""
+
+# When a xen-guest-image-minimal is built with the
+# XEN_GUEST_AUTO_BUNDLE varaible set to True, a configuration file for
+# automatic guest bundling will be generated and the guest bundled
+# automatically when a xen  host image is built.
+do_deploy() {
+    if [ -n "${XEN_GUEST_AUTO_BUNDLE}" ]; then
+        outname="xen-guest-bundle-${IMAGE_BASENAME}${IMAGE_MACHINE_SUFFIX}-${IMAGE_VERSION_SUFFIX}.cfg"
+cat <<EOF >>${DEPLOYDIR}/$outname
+name = "xen-guest"
+memory = 512
+vcpus = 1
+disk = ['file:${IMAGE_LINK_NAME}.ext4,xvda,rw']
+vif = ['bridge=xenbr0']
+kernel = "${KERNEL_IMAGETYPE}"
+extra = "root=/dev/xvda ro ip=dhcp"
+EOF
+    fi
+}
+
+addtask deploy after do_compile
diff --git a/recipes-extended/images/xen-image-minimal.bb b/recipes-extended/images/xen-image-minimal.bb
index fe79a485..6da797d7 100644
--- a/recipes-extended/images/xen-image-minimal.bb
+++ b/recipes-extended/images/xen-image-minimal.bb
@@ -1,9 +1,14 @@
 DESCRIPTION = "A minimal xen image"
 
+inherit features_check
+
+REQUIRED_DISTRO_FEATURES ?= "xen systemd"
+
 INITRD_IMAGE = "core-image-minimal-initramfs"
 
 XEN_KERNEL_MODULES ?= "kernel-module-xen-blkback kernel-module-xen-gntalloc \
                        kernel-module-xen-gntdev kernel-module-xen-netback kernel-module-xen-wdt \
+                       kernel-module-xt-comment kernel-module-xt-masquerade \
                        ${@bb.utils.contains('MACHINE_FEATURES', 'pci', "${XEN_PCIBACK_MODULE}", '', d)} \
                        ${@bb.utils.contains('MACHINE_FEATURES', 'acpi', '${XEN_ACPI_PROCESSOR_MODULE}', '', d)} \
                       "
@@ -16,6 +21,7 @@ IMAGE_INSTALL += " \
     qemu \
     kernel-image \
     kernel-vmlinux \
+    rsync \
     "
 
 # The hypervisor may not be within the dom0 filesystem image but at least
@@ -44,14 +50,6 @@ QB_QEMU_CLASSES = ""
 QB_QEMU_CLASSES:qemuall = "qemuboot-xen-defaults qemuboot-xen-dtb qemuboot-testimage-network"
 inherit ${QB_QEMU_CLASSES}
 
-do_check_xen_state() {
-    if [ "${@bb.utils.contains('DISTRO_FEATURES', 'xen', ' yes', 'no', d)}" = "no" ]; then
-        die "DISTRO_FEATURES does not contain 'xen'"
-    fi
-}
-
-addtask check_xen_state before do_rootfs
-
 # note: this may be unused, see the wic plugin
 syslinux_iso_populate:append() {
         install -m 0444 ${STAGING_DATADIR}/syslinux/libcom32.c32 ${ISODIR}${ISOLINUXDIR}
@@ -88,6 +86,168 @@ build_syslinux_cfg () {
         echo "  APPEND /xen.gz ${SYSLINUX_XEN_ARGS} --- /vmlinuz ${SYSLINUX_KERNEL_ARGS} --- /initrd" >> ${SYSLINUX_CFG}
 }
 
+# Function to parse the config file and get values for specific keys
+get_config_value() {
+    config_file="$1"
+    key="$2"
+    line=$(grep -w "$key" $config_file)
+    value=$(echo "$line" | cut -d '=' -f 2-)
+    # Remove quotes, leading/trailing whitespace, and content after the first comma
+    echo "${value#*=}" | sed "s/'//g; s/^\s*|\s*$//g; s/\[//g;s/\"//g;s/^ *//g;" | cut -d ',' -f 1
+}
+
+generate_guest_config() {
+    name=$1
+    kernel=$2
+    disk=$3
+    outname=$name.cfg
+
+    cat <<EOF >${DEPLOY_DIR_IMAGE}/$outname
+name = "$name"
+memory = 512
+vcpus = 1
+disk = ['file:$disk,xvda,rw']
+vif = ['bridge=xenbr0']
+kernel = "$kernel"
+extra = "root=/dev/xvda ro ip=dhcp"
+EOF
+}
+
+# Guests can be bundled automatically through the following mechanisms:
+#
+#   - via the variable XEN_BUNDLED_GUESTS
+#   - via a xen configuration file in the deploy directory of the format
+#     xen-guest-bundle-*.cfg
+#
+# The guests can be built via OE, or be 3rd party guests. They just
+# must be in the deploy directory so they can be copied into the rootfs
+# of the xen host image
+#
+# Type 1) XEN_BUNDLED_GUESTS
+#
+# If XEN_BUNDLED_GUESTS is used, it is simply a colon separated list of
+# rootfs:kernels. Normal variable rules apply, so it can be set in a
+# local.conf, or in a bbappend to the image recipe.
+#
+# An example would be:
+#
+#  XEN_BUNDLED_GUESTS = "xen-guest-image-minimal-qemuarm64.rootfs.ext4:Image"
+#
+# These point at symlinks created in the image deploy directory, or they
+# can be specific images/kernels without the symlink.
+#
+# Type 2) A Xen guest configuration file
+#
+# If xen guest configuration files are found in the deploy directories
+# the kernel and disk information contained within them will be processed
+# and modified for the xen host. The kernel and guest image will be
+# copied to the appropriate location, and the config made to match.
+#
+# These files following the naming convention: xen-guest-bundle*.cfg
+#
+# Guests of type #1 generate a configuration file that is picked up as
+# type #2.
+#
+# An example config file follows:
+#
+## name = "xen-guest"
+## memory = 512
+## vcpus = 1
+## disk = ['file:xen-guest-image-minimal-qemuarm64.rootfs.ext4,xvda,rw']
+## vif = ['bridge=xenbr0']
+## kernel = "Image"
+## extra = "root=/dev/xvda ro console=hvc0 ip=dhcp"
+#
+# It should also be noted that when a xen-guest-image-minimal is built
+# with the XEN_GUEST_AUTO_BUNDLE varaible set to True, a configuration
+# file for type #2 will be generated and the guest bundled automatically
+# when the host image is built.
+#
+# kernel and rootfs are copied to the target in /var/lib/xen/images/
+#
+# configuration files are copied to: /etc/xen
+#
+# Guests can be launched after boot with: xl create -c /etc/xen/<config file>
+#
+bundle_xen_guests() {
+    set +e
+
+    if [ -n "${XEN_BUNDLED_GUESTS}" ]; then
+        echo "Processing Xen bundled guests variable: ${XEN_BUNDLED_GUESTS}"
+        # these are a colon separated list of rootfs:kernel
+        count=1
+        for g in ${XEN_BUNDLED_GUESTS}; do
+            echo "Guest line: $g"
+            rootfs=$(echo "$g" | cut -d":" -f1)
+            kernel=$(echo "$g" | cut -d":" -f2)
+            name="xen-guest-bundle-$count"
+
+            if ! [ -e ${DEPLOY_DIR_IMAGE}/$rootfs ]; then
+                echo "rootfs '${DEPLOY_DIR_IMAGE}/$rootfs' not found, skipping ...."
+                continue
+            fi
+            if ! [ -e ${DEPLOY_DIR_IMAGE}/$kernel ]; then
+                echo "kernel '${DEPLOY_DIR_IMAGE}/$kernel' not found, skipping ...."
+                continue
+            fi
+
+            generate_guest_config $name $kernel $rootfs
+
+            count=$(expr $count + 1)
+        done
+    fi
+
+    echo ls ${DEPLOY_DIR_IMAGE}/xen-guest-bundle*.cfg
+    ls ${DEPLOY_DIR_IMAGE}/xen-guest-bundle*.cfg >/dev/null 2>/dev/null
+    if [ $? -eq 0 ]; then
+        for guest_cfg in $(ls ${DEPLOY_DIR_IMAGE}/xen-guest-bundle*.cfg); do
+            echo "Bundling guest: $guest_cfg"
+
+            CONFIG_FILE_BASE=$(basename $guest_cfg .cfg)
+            CONFIG_FILE="${DEPLOY_DIR_IMAGE}/$CONFIG_FILE_BASE.cfg"
+            DEST_DIR="${IMAGE_ROOTFS}/var/lib/xen/images"
+            MODIFIED_CONFIG_FILE="${DEPLOY_DIR_IMAGE}/$CONFIG_FILE_BASE-modified.cfg"
+
+            # Extract values from the configuration file
+            DISK_ORIG=$(get_config_value $CONFIG_FILE "disk" | sed 's/file://g')
+            DISK=$(readlink -f ${DEPLOY_DIR_IMAGE}/$DISK_ORIG)
+            DISK_NAME=$(basename $DISK)
+            KERNEL_ORIG=$(get_config_value $CONFIG_FILE "kernel")
+            KERNEL=$(readlink -f ${DEPLOY_DIR_IMAGE}/$KERNEL_ORIG)
+            KERNEL_NAME=$(basename $KERNEL)
+
+            if [ -z "$DISK" ]; then
+                echo "rootfs '$DISK' not found, skipping ...."
+                continue
+            fi
+            if [ -z "$KERNEL" ]; then
+                echo "kernel '$KERNEL' not found, skipping ...."
+                continue
+            fi
+
+            mkdir -p "$DEST_DIR"
+            # Copy the disk and kernel to the destination directory
+            echo "Copying disk and kernel files..."
+            echo cp "$DISK" "$DEST_DIR"
+            echo cp "$KERNEL" "$DEST_DIR"
+            cp "$DISK" "$DEST_DIR"
+            cp "$KERNEL" "$DEST_DIR"
+
+            # Create a modified config file with updated paths
+            sed -E \
+                -e "s#^(disk = \[)[^,]+#\1'file:/var/lib/xen/images/$DISK_NAME#" \
+                -e "s#^(kernel = )\"[^\"]+\"#\1\"/var/lib/xen/images/$KERNEL_NAME\"#" \
+                "$CONFIG_FILE" > "$MODIFIED_CONFIG_FILE"
+
+            mkdir -p ${IMAGE_ROOTFS}/etc/xen
+            cp $MODIFIED_CONFIG_FILE ${IMAGE_ROOTFS}/etc/xen/$CONFIG_FILE_BASE.cfg
+            rm -f $MODIFIED_CONFIG_FILE
+        done
+    fi
+    # exit 1
+}
+ROOTFS_POSTPROCESS_COMMAND += "bundle_xen_guests;"
+
 # Enable runqemu. eg: runqemu xen-image-minimal nographic slirp
 WKS_FILE:x86-64 = "directdisk-xen.wks"
 WKS_FILE_DEPENDS_DEFAULT:x86-64 = "syslinux-native"
@@ -102,7 +262,13 @@ QB_SERIAL_OPT = "-serial mon:stdio"
 # qemux86-64 machine does not include 'wic' in IMAGE_FSTYPES, which is needed
 # to boot this image, so add it here:
 IMAGE_FSTYPES:qemux86-64 += "wic"
+do_image_wic[depends] += "xen:do_deploy"
 # Networking: the qemuboot.bbclass default virtio network device works ok
 # and so does the emulated e1000 -- choose according to the network device
 # drivers that are present in your dom0 Linux kernel. To switch to e1000:
 # QB_NETWORK_DEVICE = "-device e1000,netdev=net0,mac=@MAC@"
+
+
+IMAGE_ROOTFS_SIZE = "8192"
+# we always need extra space to install VMs, so add 2GB
+IMAGE_ROOTFS_EXTRA_SPACE = "2000000"
diff --git a/recipes-extended/images/xtf-image.bb b/recipes-extended/images/xtf-image.bb
index f9ecea91..7b6eadfd 100644
--- a/recipes-extended/images/xtf-image.bb
+++ b/recipes-extended/images/xtf-image.bb
@@ -25,7 +25,7 @@ DESCRIPTION = "A minimal Xen Test Framework (XTF) image for testing the Xen hype
 # For testimage, see the qemu boot log: ${WORKDIR}/testimage/qemu_boot_log.*
 # and the test log: ${WORKDIR}/temp/log.do_testimage
 
-IMAGE_NAME="xtf"
+IMAGE_NAME = "xtf"
 
 IMAGE_INSTALL:append = " xtf"
 
diff --git a/recipes-extended/ipxe/files/0001-build-Fix-typo-in-xenver.h-header-guard.patch b/recipes-extended/ipxe/files/0001-build-Fix-typo-in-xenver.h-header-guard.patch
new file mode 100644
index 00000000..089a8143
--- /dev/null
+++ b/recipes-extended/ipxe/files/0001-build-Fix-typo-in-xenver.h-header-guard.patch
@@ -0,0 +1,25 @@
+From e4795a590e3b708008a7bbd944370aef5337c561 Mon Sep 17 00:00:00 2001
+From: Michael Brown <mcb30@ipxe.org>
+Date: Sun, 27 Apr 2025 17:33:28 +0100
+Subject: [PATCH] [build] Fix typo in xenver.h header guard
+
+GCC 15 helpfully reports mismatched #ifdef and #define lines in header
+guards.
+
+Signed-off-by: Michael Brown <mcb30@ipxe.org>
+Upstream-Status: Backport [https://github.com/ipxe/ipxe/pull/1457]
+---
+ src/include/ipxe/xenver.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/include/ipxe/xenver.h b/src/include/ipxe/xenver.h
+index b29dfb321..5d820a6e7 100644
+--- a/src/include/ipxe/xenver.h
++++ b/src/include/ipxe/xenver.h
+@@ -1,5 +1,5 @@
+ #ifndef _IPXE_XENVER_H
+-#define _IPXE_VENVER_H
++#define _IPXE_XENVER_H
+ 
+ /** @file
+  *
diff --git a/recipes-extended/ipxe/files/0002-build-Fix-old-style-function-definition.patch b/recipes-extended/ipxe/files/0002-build-Fix-old-style-function-definition.patch
new file mode 100644
index 00000000..7edafd0d
--- /dev/null
+++ b/recipes-extended/ipxe/files/0002-build-Fix-old-style-function-definition.patch
@@ -0,0 +1,25 @@
+From 0b5e26f82d3bb5dc49557b8c29d802911c050aaf Mon Sep 17 00:00:00 2001
+From: Michael Brown <mcb30@ipxe.org>
+Date: Sun, 27 Apr 2025 17:36:52 +0100
+Subject: [PATCH] [build] Fix old-style function definition
+
+Signed-off-by: Michael Brown <mcb30@ipxe.org>
+Upstream-Status: Backport [https://github.com/ipxe/ipxe/pull/1457]
+---
+ src/drivers/net/3c595.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/src/drivers/net/3c595.c b/src/drivers/net/3c595.c
+index 92d38cfc5..c3442946e 100644
+--- a/src/drivers/net/3c595.c
++++ b/src/drivers/net/3c595.c
+@@ -342,8 +342,7 @@ eeprom_rdy()
+  * before
+  */
+ static int
+-get_e(offset)
+-int offset;
++get_e(int offset)
+ {
+        if (!eeprom_rdy())
+                return (0xffff);
diff --git a/recipes-extended/ipxe/files/0003-build-Prevent-the-use-of-reserved-words-in-C23.patch b/recipes-extended/ipxe/files/0003-build-Prevent-the-use-of-reserved-words-in-C23.patch
new file mode 100644
index 00000000..fb93d96f
--- /dev/null
+++ b/recipes-extended/ipxe/files/0003-build-Prevent-the-use-of-reserved-words-in-C23.patch
@@ -0,0 +1,103 @@
+From 2f39451dbab215763c09465848b89dcf41eb71be Mon Sep 17 00:00:00 2001
+From: Miao Wang <shankerwangmiao@gmail.com>
+Date: Sun, 27 Apr 2025 17:30:49 +0100
+Subject: [PATCH] [build] Prevent the use of reserved words in C23
+
+GCC 15 defaults to C23, which reserves bool, true, and false as
+keywords.  Avoid using these as parameter or variable names.
+
+Modified-by: Michael Brown <mcb30@ipxe.org>
+Signed-off-by: Michael Brown <mcb30@ipxe.org>
+Upstream-Status: Backport [https://github.com/ipxe/ipxe/pull/1457]
+---
+ .../infiniband/mlx_utils/src/public/mlx_pci_gw.c     |  4 ++--
+ src/drivers/net/igbvf/igbvf_osdep.h                  |  7 ++-----
+ src/interface/efi/efi_hii.c                          | 12 ++++++------
+ 3 files changed, 10 insertions(+), 13 deletions(-)
+
+diff --git a/src/drivers/infiniband/mlx_utils/src/public/mlx_pci_gw.c b/src/drivers/infiniband/mlx_utils/src/public/mlx_pci_gw.c
+index 30c1e644e..0b257ed22 100644
+--- a/src/drivers/infiniband/mlx_utils/src/public/mlx_pci_gw.c
++++ b/src/drivers/infiniband/mlx_utils/src/public/mlx_pci_gw.c
+@@ -32,7 +32,7 @@ mlx_status
+ mlx_pci_gw_check_capability_id(
+                                                        IN mlx_utils *utils,
+                                                        IN mlx_uint8 cap_pointer,
+-                                                       OUT mlx_boolean *bool
++                                                       OUT mlx_boolean *result
+                                                        )
+ {
+        mlx_status              status = MLX_SUCCESS;
+@@ -41,7 +41,7 @@ mlx_pci_gw_check_capability_id(
+        status = mlx_pci_read(utils, MlxPciWidthUint8, offset,
+                                1, &id);
+        MLX_CHECK_STATUS(utils, status, read_err,"failed to read capability id");
+-       *bool = ( id == PCI_GW_CAPABILITY_ID );
++       *result = ( id == PCI_GW_CAPABILITY_ID );
+ read_err:
+        return status;
+ }
+diff --git a/src/drivers/net/igbvf/igbvf_osdep.h b/src/drivers/net/igbvf/igbvf_osdep.h
+index 8ac179de0..dc65da6c1 100644
+--- a/src/drivers/net/igbvf/igbvf_osdep.h
++++ b/src/drivers/net/igbvf/igbvf_osdep.h
+@@ -35,8 +35,9 @@ FILE_LICENCE ( GPL2_ONLY );
+ #ifndef _IGBVF_OSDEP_H_
+ #define _IGBVF_OSDEP_H_
+ 
++#include <stdbool.h>
++
+ #define u8         unsigned char
+-#define bool       boolean_t
+ #define dma_addr_t unsigned long
+ #define __le16     uint16_t
+ #define __le32     uint32_t
+@@ -51,10 +52,6 @@ FILE_LICENCE ( GPL2_ONLY );
+ #define ETH_FCS_LEN 4
+ 
+ typedef int spinlock_t;
+-typedef enum {
+-    false = 0,
+-    true = 1
+-} boolean_t;
+ 
+ #define usec_delay(x) udelay(x)
+ #define msec_delay(x) mdelay(x)
+diff --git a/src/interface/efi/efi_hii.c b/src/interface/efi/efi_hii.c
+index 506fc8869..66f58affe 100644
+--- a/src/interface/efi/efi_hii.c
++++ b/src/interface/efi/efi_hii.c
+@@ -147,13 +147,13 @@ void efi_ifr_end_op ( struct efi_ifr_builder *ifr ) {
+  */
+ void efi_ifr_false_op ( struct efi_ifr_builder *ifr ) {
+        size_t dispaddr = ifr->ops_len;
+-       EFI_IFR_FALSE *false;
++       EFI_IFR_FALSE *op;
+ 
+        /* Add opcode */
+-       false = efi_ifr_op ( ifr, EFI_IFR_FALSE_OP, sizeof ( *false ) );
++       op = efi_ifr_op ( ifr, EFI_IFR_FALSE_OP, sizeof ( *op ) );
+ 
+        DBGC ( ifr, "IFR %p false\n", ifr );
+-       DBGC2_HDA ( ifr, dispaddr, false, sizeof ( *false ) );
++       DBGC2_HDA ( ifr, dispaddr, op, sizeof ( *op ) );
+ }
+ 
+ /**
+@@ -462,13 +462,13 @@ void efi_ifr_text_op ( struct efi_ifr_builder *ifr, unsigned int prompt_id,
+  */
+ void efi_ifr_true_op ( struct efi_ifr_builder *ifr ) {
+        size_t dispaddr = ifr->ops_len;
+-       EFI_IFR_TRUE *true;
++       EFI_IFR_TRUE *op;
+ 
+        /* Add opcode */
+-       true = efi_ifr_op ( ifr, EFI_IFR_TRUE_OP, sizeof ( *true ) );
++       op = efi_ifr_op ( ifr, EFI_IFR_TRUE_OP, sizeof ( *op ) );
+ 
+        DBGC ( ifr, "IFR %p true\n", ifr );
+-       DBGC2_HDA ( ifr, dispaddr, true, sizeof ( *true ) );
++       DBGC2_HDA ( ifr, dispaddr, op, sizeof ( *op ) );
+ }
+ 
+ /**
diff --git a/recipes-extended/ipxe/files/0004-build-Remove-unsafe-disable-function-wrapper-from-le.patch b/recipes-extended/ipxe/files/0004-build-Remove-unsafe-disable-function-wrapper-from-le.patch
new file mode 100644
index 00000000..6598882d
--- /dev/null
+++ b/recipes-extended/ipxe/files/0004-build-Remove-unsafe-disable-function-wrapper-from-le.patch
@@ -0,0 +1,294 @@
+From 1de32c9e11e727fe8c4eab68b331d862cb2f03e7 Mon Sep 17 00:00:00 2001
+From: Michael Brown <mcb30@ipxe.org>
+Date: Sun, 27 Apr 2025 17:37:44 +0100
+Subject: [PATCH] [build] Remove unsafe disable function wrapper from legacy
+ NIC drivers
+
+The legacy NIC drivers do not consistently take a second parameter in
+their disable function.  We currently use an unsafe function wrapper
+that declares no parameters, and rely on the ABI allowing a second
+parameter to be silently ignored if not expected by the caller.  As of
+GCC 15, this hack results in an incompatible pointer type warning.
+
+Fix by removing the hack, and instead updating all relevant legacy NIC
+drivers to take an unused second parameter in their disable function.
+
+Signed-off-by: Michael Brown <mcb30@ipxe.org>
+Upstream-Status: Backport [https://github.com/ipxe/ipxe/pull/1457]
+---
+ src/drivers/net/3c595.c      | 2 +-
+ src/drivers/net/amd8111e.c   | 2 +-
+ src/drivers/net/bnx2.c       | 8 +++++++-
+ src/drivers/net/davicom.c    | 4 ++--
+ src/drivers/net/depca.c      | 2 +-
+ src/drivers/net/dmfe.c       | 2 +-
+ src/drivers/net/epic100.c    | 4 ++--
+ src/drivers/net/ns8390.c     | 2 +-
+ src/drivers/net/prism2_pci.c | 2 +-
+ src/drivers/net/prism2_plx.c | 2 +-
+ src/drivers/net/sis900.c     | 4 ++--
+ src/drivers/net/sundance.c   | 2 +-
+ src/drivers/net/tlan.c       | 2 +-
+ src/drivers/net/tulip.c      | 4 ++--
+ src/drivers/net/w89c840.c    | 2 +-
+ src/include/nic.h            | 3 +--
+ 16 files changed, 26 insertions(+), 21 deletions(-)
+
+diff --git a/src/drivers/net/3c595.c b/src/drivers/net/3c595.c
+index c3442946e..fbee739a2 100644
+--- a/src/drivers/net/3c595.c
++++ b/src/drivers/net/3c595.c
+@@ -443,7 +443,7 @@ vxsetlink(void)
+     GO_WINDOW(1); 
+ }
+ 
+-static void t595_disable ( struct nic *nic ) {
++static void t595_disable ( struct nic *nic, void *hwdev __unused ) {
+ 
+        t595_reset(nic);
+ 
+diff --git a/src/drivers/net/amd8111e.c b/src/drivers/net/amd8111e.c
+index 693d77d1d..5ad55eea1 100644
+--- a/src/drivers/net/amd8111e.c
++++ b/src/drivers/net/amd8111e.c
+@@ -609,7 +609,7 @@ static int amd8111e_poll(struct nic *nic, int retrieve)
+        return pkt_ok;
+ }
+ 
+-static void amd8111e_disable(struct nic *nic)
++static void amd8111e_disable(struct nic *nic, void *hwdev __unused)
+ {
+        struct amd8111e_priv *lp = nic->priv_data;
+ 
+diff --git a/src/drivers/net/bnx2.c b/src/drivers/net/bnx2.c
+index 4ebcc52a9..60bef7711 100644
+--- a/src/drivers/net/bnx2.c
++++ b/src/drivers/net/bnx2.c
+@@ -2671,6 +2671,12 @@ err_out_disable:
+        return 0;
+ }
+ 
++static void
++bnx2_remove(struct nic *nic, void *hwdev __unused)
++{
++       bnx2_disable(nic);
++}
++
+ static struct pci_device_id bnx2_nics[] = {
+        PCI_ROM(0x14e4, 0x164a, "bnx2-5706",        "Broadcom NetXtreme II BCM5706", 0),
+        PCI_ROM(0x14e4, 0x164c, "bnx2-5708",        "Broadcom NetXtreme II BCM5708", 0),
+@@ -2680,7 +2686,7 @@ static struct pci_device_id bnx2_nics[] = {
+ 
+ PCI_DRIVER ( bnx2_driver, bnx2_nics, PCI_NO_CLASS );
+ 
+-DRIVER ( "BNX2", nic_driver, pci_driver, bnx2_driver, bnx2_probe, bnx2_disable );
++DRIVER ( "BNX2", nic_driver, pci_driver, bnx2_driver, bnx2_probe, bnx2_remove );
+ 
+ /*
+ static struct pci_driver bnx2_driver __pci_driver = {
+diff --git a/src/drivers/net/davicom.c b/src/drivers/net/davicom.c
+index 9d3d8b915..07c994573 100644
+--- a/src/drivers/net/davicom.c
++++ b/src/drivers/net/davicom.c
+@@ -159,7 +159,7 @@ static void davicom_reset(struct nic *nic);
+ static void davicom_transmit(struct nic *nic, const char *d, unsigned int t,
+                           unsigned int s, const char *p);
+ static int davicom_poll(struct nic *nic, int retrieve);
+-static void davicom_disable(struct nic *nic);
++static void davicom_disable(struct nic *nic, void *hwdev);
+ static void davicom_wait(unsigned int nticks);
+ static int phy_read(int);
+ static void phy_write(int, u16);
+@@ -601,7 +601,7 @@ static int davicom_poll(struct nic *nic, int retrieve)
+ /*********************************************************************/
+ /* eth_disable - Disable the interface                               */
+ /*********************************************************************/
+-static void davicom_disable ( struct nic *nic ) {
++static void davicom_disable ( struct nic *nic, void *hwdev __unused ) {
+ 
+   whereami("davicom_disable\n");
+ 
+diff --git a/src/drivers/net/depca.c b/src/drivers/net/depca.c
+index 016f28bb2..30e2fcb0a 100644
+--- a/src/drivers/net/depca.c
++++ b/src/drivers/net/depca.c
+@@ -644,7 +644,7 @@ static void depca_transmit(
+ /**************************************************************************
+ DISABLE - Turn off ethernet interface
+ ***************************************************************************/
+-static void depca_disable ( struct nic *nic ) {
++static void depca_disable ( struct nic *nic, void *hwdev __unused ) {
+        depca_reset(nic);
+ 
+        STOP_DEPCA(nic->ioaddr);
+diff --git a/src/drivers/net/dmfe.c b/src/drivers/net/dmfe.c
+index 2ea0d2b2b..ea14c462f 100644
+--- a/src/drivers/net/dmfe.c
++++ b/src/drivers/net/dmfe.c
+@@ -435,7 +435,7 @@ static void dmfe_transmit(struct nic *nic,
+ /**************************************************************************
+ DISABLE - Turn off ethernet interface
+ ***************************************************************************/
+-static void dmfe_disable ( struct nic *nic __unused ) {
++static void dmfe_disable ( struct nic *nic __unused, void *hwdev __unused ) {
+        /* Reset & stop DM910X board */
+        outl(DM910X_RESET, BASE + DCR0);
+        udelay(5);
+diff --git a/src/drivers/net/epic100.c b/src/drivers/net/epic100.c
+index 8e31a3bfa..01c0c43c9 100644
+--- a/src/drivers/net/epic100.c
++++ b/src/drivers/net/epic100.c
+@@ -51,7 +51,7 @@ struct epic_tx_desc {
+ 
+ static void    epic100_open(void);
+ static void    epic100_init_ring(void);
+-static void    epic100_disable(struct nic *nic);
++static void    epic100_disable(struct nic *nic, void *hwdev);
+ static int     epic100_poll(struct nic *nic, int retrieve);
+ static void    epic100_transmit(struct nic *nic, const char *destaddr,
+                                 unsigned int type, unsigned int len, const char *data);
+@@ -419,7 +419,7 @@ epic100_poll(struct nic *nic, int retrieve)
+ }
+ 
+ 
+-static void epic100_disable ( struct nic *nic __unused ) {
++static void epic100_disable ( struct nic *nic __unused, void *hwdev __unused ) {
+        /* Soft reset the chip. */
+        outl(GC_SOFT_RESET, genctl);
+ }
+diff --git a/src/drivers/net/ns8390.c b/src/drivers/net/ns8390.c
+index 0ffc6216b..ffd05afdb 100644
+--- a/src/drivers/net/ns8390.c
++++ b/src/drivers/net/ns8390.c
+@@ -597,7 +597,7 @@ static int ns8390_poll(struct nic *nic, int retrieve)
+ /**************************************************************************
+ NS8390_DISABLE - Turn off adapter
+ **************************************************************************/
+-static void ns8390_disable ( struct nic *nic ) {
++static void ns8390_disable ( struct nic *nic, void *hwdev __unused ) {
+        ns8390_reset(nic);
+ }
+ 
+diff --git a/src/drivers/net/prism2_pci.c b/src/drivers/net/prism2_pci.c
+index 69ddf0fb0..b4ed0a728 100644
+--- a/src/drivers/net/prism2_pci.c
++++ b/src/drivers/net/prism2_pci.c
+@@ -44,7 +44,7 @@ static int prism2_pci_probe ( struct nic *nic, struct pci_device *pci ) {
+   return prism2_probe ( nic, hw );
+ }
+ 
+-static void prism2_pci_disable ( struct nic *nic ) {
++static void prism2_pci_disable ( struct nic *nic, void *hwdev __unused ) {
+   prism2_disable ( nic );
+ }
+ 
+diff --git a/src/drivers/net/prism2_plx.c b/src/drivers/net/prism2_plx.c
+index a73b0e087..b1c466de9 100644
+--- a/src/drivers/net/prism2_plx.c
++++ b/src/drivers/net/prism2_plx.c
+@@ -99,7 +99,7 @@ static int prism2_plx_probe ( struct nic *nic, struct pci_device *pci ) {
+   return prism2_probe ( nic, hw );
+ }
+ 
+-static void prism2_plx_disable ( struct nic *nic ) {
++static void prism2_plx_disable ( struct nic *nic, void *hwdev __unused ) {
+   prism2_disable ( nic );
+ }
+ 
+diff --git a/src/drivers/net/sis900.c b/src/drivers/net/sis900.c
+index 8a3ac01bc..c8fd3e9b5 100644
+--- a/src/drivers/net/sis900.c
++++ b/src/drivers/net/sis900.c
+@@ -164,7 +164,7 @@ static void sis900_transmit(struct nic *nic, const char *d,
+                             unsigned int t, unsigned int s, const char *p);
+ static int  sis900_poll(struct nic *nic, int retrieve);
+ 
+-static void sis900_disable(struct nic *nic);
++static void sis900_disable(struct nic *nic, void *hwdev);
+ 
+ static void sis900_irq(struct nic *nic, irq_action_t action);
+ 
+@@ -1238,7 +1238,7 @@ sis900_poll(struct nic *nic, int retrieve)
+  */
+ 
+ static void
+-sis900_disable ( struct nic *nic ) {
++sis900_disable ( struct nic *nic, void *hwdev __unused ) {
+ 
+     sis900_init(nic);
+ 
+diff --git a/src/drivers/net/sundance.c b/src/drivers/net/sundance.c
+index 9127fa2cd..77567a5e8 100644
+--- a/src/drivers/net/sundance.c
++++ b/src/drivers/net/sundance.c
+@@ -536,7 +536,7 @@ static void sundance_transmit(struct nic *nic, const char *d,       /* Destination */
+ /**************************************************************************
+ DISABLE - Turn off ethernet interface
+ ***************************************************************************/
+-static void sundance_disable ( struct nic *nic __unused ) {
++static void sundance_disable ( struct nic *nic __unused, void *hwdev __unused) {
+        /* put the card in its initial state */
+        /* This function serves 3 purposes.
+         * This disables DMA and interrupts so we don't receive
+diff --git a/src/drivers/net/tlan.c b/src/drivers/net/tlan.c
+index 0e85b35b6..7127c7373 100644
+--- a/src/drivers/net/tlan.c
++++ b/src/drivers/net/tlan.c
+@@ -717,7 +717,7 @@ static void tlan_transmit(struct nic *nic, const char *d,   /* Destination */
+ /**************************************************************************
+ DISABLE - Turn off ethernet interface
+ ***************************************************************************/
+-static void tlan_disable ( struct nic *nic __unused ) {
++static void tlan_disable ( struct nic *nic __unused, void *hwdev __unused ) {
+        /* put the card in its initial state */
+        /* This function serves 3 purposes.
+         * This disables DMA and interrupts so we don't receive
+diff --git a/src/drivers/net/tulip.c b/src/drivers/net/tulip.c
+index e4e6ffa87..55e9747b4 100644
+--- a/src/drivers/net/tulip.c
++++ b/src/drivers/net/tulip.c
+@@ -494,7 +494,7 @@ static void tulip_reset(struct nic *nic);
+ static void tulip_transmit(struct nic *nic, const char *d, unsigned int t,
+                            unsigned int s, const char *p);
+ static int tulip_poll(struct nic *nic, int retrieve);
+-static void tulip_disable(struct nic *nic);
++static void tulip_disable(struct nic *nic, void *hwdev);
+ static void nway_start(struct nic *nic);
+ static void pnic_do_nway(struct nic *nic);
+ static void select_media(struct nic *nic, int startup);
+@@ -1128,7 +1128,7 @@ static int tulip_poll(struct nic *nic, int retrieve)
+ /*********************************************************************/
+ /* eth_disable - Disable the interface                               */
+ /*********************************************************************/
+-static void tulip_disable ( struct nic *nic ) {
++static void tulip_disable ( struct nic *nic, void *hwdev __unused ) {
+ 
+     whereami("tulip_disable\n");
+ 
+diff --git a/src/drivers/net/w89c840.c b/src/drivers/net/w89c840.c
+index 72ccf3a28..0c222214e 100644
+--- a/src/drivers/net/w89c840.c
++++ b/src/drivers/net/w89c840.c
+@@ -579,7 +579,7 @@ static void w89c840_transmit(
+ /**************************************************************************
+ w89c840_disable - Turn off ethernet interface
+ ***************************************************************************/
+-static void w89c840_disable ( struct nic *nic ) {
++static void w89c840_disable ( struct nic *nic, void *hwdev __unused ) {
+ 
+     w89c840_reset(nic);
+ 
+diff --git a/src/include/nic.h b/src/include/nic.h
+index 8b06e88f4..8e928beb4 100644
+--- a/src/include/nic.h
++++ b/src/include/nic.h
+@@ -217,8 +217,7 @@ static inline void * legacy_isa_get_drvdata ( void *hwdev ) {
+        }                                                                 \
+        static inline void                                                \
+        _name ## _disable ( struct nic *nic, void *hwdev ) {              \
+-               void ( * _unsafe_disable ) () = _disable;                 \
+-               _unsafe_disable ( nic, hwdev );                           \
++               _disable ( nic, hwdev );                                  \
+        }                                                                 \
+        static inline int                                                 \
+        _name ## _pci_legacy_probe ( struct pci_device *pci ) {           \
diff --git a/recipes-extended/ipxe/ipxe_git.bb b/recipes-extended/ipxe/ipxe_git.bb
index 08ed519a..8625919d 100644
--- a/recipes-extended/ipxe/ipxe_git.bb
+++ b/recipes-extended/ipxe/ipxe_git.bb
@@ -19,6 +19,10 @@ SRC_URI = " \
     file://ipxe-intel-Avoid-spurious-compiler-warning-on-GCC-10.patch \
     file://ipxe-golan-Add-explicit-type-casts-for-nodnic_queue_pair_.patch \
     file://build-be-explicit-about-fcommon-compiler-directive.patch \
+    file://0001-build-Fix-typo-in-xenver.h-header-guard.patch;patchdir=.. \
+    file://0002-build-Fix-old-style-function-definition.patch;patchdir=.. \
+    file://0003-build-Prevent-the-use-of-reserved-words-in-C23.patch;patchdir=.. \
+    file://0004-build-Remove-unsafe-disable-function-wrapper-from-le.patch;patchdir=.. \
     "
 
 FILES:${PN} = "/usr/share/firmware/*.rom"
diff --git a/recipes-extended/irqbalance/irqbalance/0001-add-void-to-fix-strict-prototypes.patch b/recipes-extended/irqbalance/irqbalance/0001-add-void-to-fix-strict-prototypes.patch
new file mode 100644
index 00000000..f40d6897
--- /dev/null
+++ b/recipes-extended/irqbalance/irqbalance/0001-add-void-to-fix-strict-prototypes.patch
@@ -0,0 +1,298 @@
+From c25dfc295df789ceb1ed890ab7e5a9694503d829 Mon Sep 17 00:00:00 2001
+From: Rosen Penev <rosenp@gmail.com>
+Date: Sun, 31 Mar 2024 14:31:22 -0700
+Subject: [PATCH] add void to fix strict-prototypes
+
+This becomes a hard error with C23
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Upstream-Status: Backport [https://github.com/Irqbalance/irqbalance/commit/b6a831d692ed7e12db7748db49b3b39516d151d2]
+---
+ irqbalance.c       |  2 +-
+ irqbalance.h       |  2 +-
+ procinterrupts.c   |  2 +-
+ ui/helpers.c       |  2 +-
+ ui/helpers.h       |  2 +-
+ ui/irqbalance-ui.c |  4 ++--
+ ui/irqbalance-ui.h |  5 ++---
+ ui/ui.c            | 24 ++++++++++++------------
+ ui/ui.h            | 26 +++++++++++++-------------
+ 9 files changed, 34 insertions(+), 35 deletions(-)
+
+diff --git a/irqbalance.c b/irqbalance.c
+index e8d9ba9..d7b4184 100644
+--- a/irqbalance.c
++++ b/irqbalance.c
+@@ -554,7 +554,7 @@ out:
+        return TRUE;
+ }
+ 
+-int init_socket()
++int init_socket(void)
+ {
+        struct sockaddr_un addr;
+        memset(&addr, 0, sizeof(struct sockaddr_un));
+diff --git a/irqbalance.h b/irqbalance.h
+index e7f6b94..96ee07a 100644
+--- a/irqbalance.h
++++ b/irqbalance.h
+@@ -36,7 +36,7 @@ extern char *classes[];
+ extern void parse_cpu_tree(void);
+ extern void clear_work_stats(void);
+ extern void parse_proc_interrupts(void);
+-extern GList* collect_full_irq_list();
++extern GList* collect_full_irq_list(void);
+ extern void parse_proc_stat(void);
+ extern void set_interrupt_count(int number, uint64_t count);
+ extern void set_msi_interrupt_numa(int number);
+diff --git a/procinterrupts.c b/procinterrupts.c
+index 9015177..938cfad 100644
+--- a/procinterrupts.c
++++ b/procinterrupts.c
+@@ -204,7 +204,7 @@ void init_irq_class_and_type(char *savedline, struct irq_info *info, int irq)
+        info->name = strdup(irq_fullname);
+ }
+ 
+-GList* collect_full_irq_list()
++GList* collect_full_irq_list(void)
+ {
+        GList *tmp_list = NULL;
+        FILE *file;
+diff --git a/ui/helpers.c b/ui/helpers.c
+index 5d71275..14861cb 100644
+--- a/ui/helpers.c
++++ b/ui/helpers.c
+@@ -163,7 +163,7 @@ void dump_node(cpu_node_t *node, void *data __attribute__((unused)))
+        }
+ }
+ 
+-void dump_tree()
++void dump_tree(void)
+ {
+        for_each_node(tree, dump_node, NULL);
+ }
+diff --git a/ui/helpers.h b/ui/helpers.h
+index b8d9fcc..922914b 100644
+--- a/ui/helpers.h
++++ b/ui/helpers.h
+@@ -25,7 +25,7 @@ void for_each_node(GList *list, void (*fp)(cpu_node_t *node, void *data), void *
+ 
+ void dump_irq(irq_t *irq, void *data __attribute__((unused)));
+ void dump_node(cpu_node_t *node, void *data __attribute__((unused)));
+-void dump_tree();
++void dump_tree(void);
+ 
+ 
+ #endif /* HELPERS_H */
+diff --git a/ui/irqbalance-ui.c b/ui/irqbalance-ui.c
+index 3ad3553..132bb45 100644
+--- a/ui/irqbalance-ui.c
++++ b/ui/irqbalance-ui.c
+@@ -23,7 +23,7 @@ GMainLoop *main_loop;
+ int is_tree = 1;
+ static int default_bufsz = 8192;
+ 
+-struct msghdr * create_credentials_msg()
++struct msghdr * create_credentials_msg(void)
+ {
+        struct ucred *credentials = malloc(sizeof(struct ucred));
+        credentials->pid = getpid();
+@@ -46,7 +46,7 @@ struct msghdr * create_credentials_msg()
+        return msg;
+ }
+ 
+-int init_connection()
++int init_connection(void)
+ {
+        struct sockaddr_un addr;
+        memset(&addr, 0, sizeof(struct sockaddr_un));
+diff --git a/ui/irqbalance-ui.h b/ui/irqbalance-ui.h
+index fba7e7c..e9f6114 100644
+--- a/ui/irqbalance-ui.h
++++ b/ui/irqbalance-ui.h
+@@ -70,8 +70,8 @@ typedef struct setup {
+ 
+ /* Function prototypes */
+ 
+-struct msghdr * create_credentials_msg();
+-int init_connection();
++struct msghdr * create_credentials_msg(void);
++int init_connection(void);
+ void send_settings(char *data);
+ char * get_data(char *string);
+ void parse_setup(char *setup_data);
+@@ -81,7 +81,6 @@ void assign_cpu_lists(cpu_node_t *node, void *data);
+ void assign_cpu_mask(cpu_node_t *node, void *data);
+ void parse_into_tree(char *data);
+ gboolean rescan_tree(gpointer data);
+-int main();
+ 
+ 
+ #endif /* IRQBALANCE_UI_H */
+diff --git a/ui/ui.c b/ui/ui.c
+index 6ff3305..bc1d743 100644
+--- a/ui/ui.c
++++ b/ui/ui.c
+@@ -17,7 +17,7 @@ char *IRQ_CLASS_TO_STR[] = {
+                        "10-Gigabit Ethernet",
+                        "Virt Event"};
+ 
+-void show_frame()
++void show_frame(void)
+ {
+        int i;
+        attrset(COLOR_PAIR(4));
+@@ -33,7 +33,7 @@ void show_frame()
+        }
+ }
+ 
+-void show_footer()
++void show_footer(void)
+ {
+        char footer[COLS];
+        snprintf(footer, COLS - 1,
+@@ -149,7 +149,7 @@ void print_cpu_line(cpu_ban_t *cpu, void *data)
+        (*line_offset)++;
+ }
+ 
+-void print_all_cpus()
++void print_all_cpus(void)
+ {
+        if(all_cpus == NULL) {
+                for_each_node(tree, get_cpu, NULL);
+@@ -168,7 +168,7 @@ void add_banned_cpu(int *banned_cpu, void *data)
+        snprintf(data + strlen(data), 1024 - strlen(data), "%d, ", *banned_cpu);
+ }
+ 
+-void display_banned_cpus()
++void display_banned_cpus(void)
+ {
+        char banned_cpus[1024] = "Banned CPU numbers: \0";
+        if(g_list_length(setup.banned_cpus) > 0) {
+@@ -221,7 +221,7 @@ void get_cpu(cpu_node_t *node, void *data __attribute__((unused)))
+        }
+ }
+ 
+-void handle_cpu_banning()
++void handle_cpu_banning(void)
+ {
+        GList *tmp = g_list_copy_deep(all_cpus, copy_cpu_ban, NULL);
+        attrset(COLOR_PAIR(5));
+@@ -371,7 +371,7 @@ void print_irq_line(irq_t *irq, void *data)
+ 
+ }
+ 
+-void print_all_irqs()
++void print_all_irqs(void)
+ {
+        int *line = malloc(sizeof(int));
+        *line = 4;
+@@ -418,13 +418,13 @@ void copy_irqs_from_nodes(cpu_node_t *node, void *data __attribute__((unused)))
+        }
+ }
+ 
+-void get_all_irqs()
++void get_all_irqs(void)
+ {
+        all_irqs = g_list_copy_deep(setup.banned_irqs, copy_irq, NULL);
+        for_each_node(tree, copy_irqs_from_nodes, NULL);
+ }
+ 
+-void handle_irq_banning()
++void handle_irq_banning(void)
+ {
+        GList *tmp = g_list_copy_deep(all_irqs, copy_irq, NULL);
+        attrset(COLOR_PAIR(5));
+@@ -520,7 +520,7 @@ void handle_irq_banning()
+        }
+ }
+ 
+-void init()
++void init(void)
+ {
+        signal(SIGINT, close_window);
+        initscr();
+@@ -556,7 +556,7 @@ void close_window(int sig __attribute__((unused)))
+        exit(EXIT_SUCCESS);
+ }
+ 
+-void settings()
++void settings(void)
+ {
+        clear();
+        char *setup_data = get_data(SETUP);
+@@ -620,7 +620,7 @@ void settings()
+        free(setup_data);
+ }
+ 
+-void setup_irqs()
++void setup_irqs(void)
+ {
+        clear();
+        get_all_irqs();
+@@ -720,7 +720,7 @@ void display_tree_node(cpu_node_t *node, void *data)
+        }
+ }
+ 
+-void display_tree()
++void display_tree(void)
+ {
+        clear();
+        char *setup_data = get_data(SETUP);
+diff --git a/ui/ui.h b/ui/ui.h
+index 0aa8280..bb017e9 100644
+--- a/ui/ui.h
++++ b/ui/ui.h
+@@ -15,39 +15,39 @@ extern GList *tree;
+ extern setup_t setup;
+ extern int is_tree;
+ 
+-void show_frame();
+-void show_footer();
++void show_frame(void);
++void show_footer(void);
+ 
+ char * check_control_in_sleep_input(int max_len, int column_offest, int line_offset);
+ int get_valid_sleep_input(int column_offest);
+ 
+ void get_banned_cpu(int *cpu, void *data);
+ void print_cpu_line(cpu_ban_t *cpu, void *data);
+-void print_all_cpus();
++void print_all_cpus(void);
+ void add_banned_cpu(int *banned_cpu, void *data);
+-void display_banned_cpus();
++void display_banned_cpus(void);
+ int toggle_cpu(GList *cpu_list, int cpu_number);
+ void get_new_cpu_ban_values(cpu_ban_t *cpu, void *data);
+-void get_cpu();
+-void handle_cpu_banning();
++void get_cpu(cpu_node_t *node, void *data);
++void handle_cpu_banning(void);
+ 
+ void copy_assigned_obj(int *number, void *data);
+ void print_assigned_objects_string(irq_t *irq, int *line_offset);
+ void print_irq_line(irq_t *irq, void *data);
+-void print_all_irqs();
++void print_all_irqs(void);
+ int toggle_irq(GList *irq_list, int position);
+ void get_new_irq_ban_values(irq_t *irq, void *data);
+ void copy_irqs_from_nodes(cpu_node_t *node, void *data);
+-void get_all_irqs();
+-void handle_irq_banning();
++void get_all_irqs(void);
++void handle_irq_banning(void);
+ 
+-void init();
++void init(void);
+ void close_window(int sig);
+-void settings();
+-void setup_irqs();
++void settings(void);
++void setup_irqs(void);
+ void display_tree_node_irqs(irq_t *irq, void *data);
+ void display_tree_node(cpu_node_t *node, void *data);
+-void display_tree();
++void display_tree(void);
+ 
+ 
+ #endif /* UI_H */
diff --git a/recipes-extended/irqbalance/irqbalance_git.bb b/recipes-extended/irqbalance/irqbalance_git.bb
index aa7f0de9..068cf12e 100644
--- a/recipes-extended/irqbalance/irqbalance_git.bb
+++ b/recipes-extended/irqbalance/irqbalance_git.bb
@@ -10,6 +10,7 @@ PV = "1.8.0+git"
 SRC_URI = "git://github.com/Irqbalance/irqbalance;branch=master;protocol=https \
            file://add-initscript.patch \
            file://irqbalance-Add-status-and-reload-commands.patch \
+           file://0001-add-void-to-fix-strict-prototypes.patch \
           "
 
 S = "${WORKDIR}/git"
diff --git a/recipes-extended/kvmtool/kvmtool_git.bb b/recipes-extended/kvmtool/kvmtool_git.bb
index 141fb02d..6597873d 100644
--- a/recipes-extended/kvmtool/kvmtool_git.bb
+++ b/recipes-extended/kvmtool/kvmtool_git.bb
@@ -16,12 +16,12 @@ SRC_URI = "git://git.kernel.org/pub/scm/linux/kernel/git/will/kvmtool.git;branch
            file://0003-kvmtool-Werror-disabled.patch \
            "
 
-SRCREV = "4d2c017f41533b0e51e00f689050c26190a15318"
+SRCREV = "e48563f5c4a48fe6a6bc2a98a9a7c84a10f043be"
 PV = "5.10.0+git"
 
 S = "${WORKDIR}/git"
 
-EXTRA_OEMAKE='V=1 EXTRA_CFLAGS="-I${STAGING_KERNEL_BUILDDIR}/include/generated -I${STAGING_KERNEL_BUILDDIR}/arch/${ARCH}/include/generated"'
+EXTRA_OEMAKE = 'V=1 EXTRA_CFLAGS="-I${STAGING_KERNEL_BUILDDIR}/include/generated -I${STAGING_KERNEL_BUILDDIR}/arch/${ARCH}/include/generated"'
 
 do_install() {
     install -d ${D}${bindir}
diff --git a/recipes-extended/libvirt/libvirt-python.inc b/recipes-extended/libvirt/libvirt-python.inc
index 6fb2b68c..20c9f69b 100644
--- a/recipes-extended/libvirt/libvirt-python.inc
+++ b/recipes-extended/libvirt/libvirt-python.inc
@@ -18,14 +18,14 @@ FILES:${PN}-python = "${bindir}/* ${libdir}/* ${libdir}/${PYTHON_DIR}/*"
 # Currently the libvirt-python debug libraries contain buildpaths
 INSANE_SKIP:${PN}-dbg += "buildpaths"
 
-SRC_URI += "http://libvirt.org/sources/python/libvirt-python-${PV}.tar.gz;name=libvirt_python"
+SRC_URI += "http://libvirt.org/sources/python/${BPN}-python-${LIBVIRT_VERSION}.tar.gz;name=libvirt_python;subdir=${BP}"
 
-SRC_URI[libvirt_python.sha256sum] = "a82588f0e7db53eda7b7dbcbc448b0ec43e00a8c77cac69644495299b410c20d"
+SRC_URI[libvirt_python.sha256sum] = "00efb9a781087668512d6a002eb9cd136e44ff8701ac6793cc13b6fdc6d9ef8f"
 
 export LIBVIRT_API_PATH = "${S}/docs/libvirt-api.xml"
 export LIBVIRT_CFLAGS = "-I${S}/include"
 export LIBVIRT_LIBS = "-L${B}/src/.libs -lvirt -ldl"
-export LDFLAGS="-L${B}/src/.libs"
+export LDFLAGS = "-L${B}/src/.libs"
 
 LIBVIRT_INSTALL_ARGS = "--root=${D} \
     --prefix=${prefix} \
@@ -46,8 +46,9 @@ do_compile:append() {
                 # the syroot staged pkgconfig entries. So we clear the sysroot
                 # for just this portion.
                 export PKG_CONFIG_SYSROOT_DIR=
-                cd ${WORKDIR}/${BPN}-python-${PV} && \
+                cd ${UNPACKDIR}/${BP}/${BPN}-python-${LIBVIRT_VERSION} && \
                   ${STAGING_BINDIR_NATIVE}/python3-native/python3 setup.py build
+                cd -
         fi
 }
 
@@ -57,8 +58,9 @@ do_install:append() {
                 # the syroot staged pkgconfig entries. So we clear the sysroot
                 # for just this portion.
                 export PKG_CONFIG_SYSROOT_DIR=
-                cd ${WORKDIR}/${BPN}-python-${PV} && \
+                cd ${UNPACKDIR}/${BP}/${BPN}-python-${LIBVIRT_VERSION} && \
                   ${STAGING_BINDIR_NATIVE}/python3-native/python3 setup.py install \
                        --install-lib=${D}/${PYTHON_SITEPACKAGES_DIR} ${LIBVIRT_INSTALL_ARGS}
+                cd -
         fi
 }
diff --git a/recipes-extended/libvirt/libvirt/0001-meson.build-clear-abs_top_builddir-to-avoid-QA-warni.patch b/recipes-extended/libvirt/libvirt/0001-meson.build-clear-abs_top_builddir-to-avoid-QA-warni.patch
new file mode 100644
index 00000000..04db24d0
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/0001-meson.build-clear-abs_top_builddir-to-avoid-QA-warni.patch
@@ -0,0 +1,31 @@
+From d06f0795cfd097c373c7b9824ce59f17c9194520 Mon Sep 17 00:00:00 2001
+From: Bruce Ashfield <bruce.ashfield@gmail.com>
+Date: Tue, 9 Jul 2024 21:23:47 +0000
+Subject: [PATCH] meson.build: clear abs_top_builddir to avoid QA warnings
+
+If we don't clear the absolute directories from the build,
+we'll get QA warnings on packaging.
+
+Upstream-Status: Inappropriate [oe specific]
+
+Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
+---
+ src/meson.build | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/src/meson.build b/src/meson.build
+index 8cce42c7ad..dc7a81c980 100644
+--- a/src/meson.build
++++ b/src/meson.build
+@@ -3,8 +3,6 @@ src_inc_dir = include_directories('.')
+ src_dep = declare_dependency(
+   compile_args: [
+     '-DIN_LIBVIRT',
+-    '-Dabs_top_builddir="@0@"'.format(meson.project_build_root()),
+-    '-Dabs_top_srcdir="@0@"'.format(meson.project_source_root()),
+   ] + coverage_flags + win32_flags,
+   dependencies: [
+     glib_dep,
+-- 
+2.39.2
+
diff --git a/recipes-extended/libvirt/libvirt/0001-messon.build-remove-build-path-information-to-avoid-.patch b/recipes-extended/libvirt/libvirt/0001-messon.build-remove-build-path-information-to-avoid-.patch
index d9bcef0b..c68e05b9 100644
--- a/recipes-extended/libvirt/libvirt/0001-messon.build-remove-build-path-information-to-avoid-.patch
+++ b/recipes-extended/libvirt/libvirt/0001-messon.build-remove-build-path-information-to-avoid-.patch
@@ -25,11 +25,11 @@ Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
  meson.build | 10 +++++-----
  1 file changed, 5 insertions(+), 5 deletions(-)
 
-Index: libvirt-9.2.0/meson.build
+Index: git/meson.build
 ===================================================================
---- libvirt-9.2.0.orig/meson.build
-+++ libvirt-9.2.0/meson.build
-@@ -26,8 +26,8 @@
+--- git.orig/meson.build
++++ git/meson.build
+@@ -38,8 +38,8 @@
  conf = configuration_data()
  
  conf.set('_GNU_SOURCE', 1)
@@ -40,7 +40,7 @@ Index: libvirt-9.2.0/meson.build
  conf.set_quoted('PACKAGE', meson.project_name())
  conf.set_quoted('PACKAGE_NAME', meson.project_name())
  conf.set_quoted('PACKAGE_VERSION', meson.project_version())
-@@ -1770,9 +1770,9 @@
+@@ -1830,9 +1830,9 @@
        use_storage = true
  
        conf.set('WITH_STORAGE_FS', 1)
@@ -50,6 +50,6 @@ Index: libvirt-9.2.0/meson.build
 +      conf.set_quoted('MOUNT', '/usr/bin/mount')
 +      conf.set_quoted('UMOUNT', '/usr/bin/umount')
 +      conf.set_quoted('MKFS', '/usr/sbin/mkfs')
+     endif
+   endif
  
-       showmount_prog = find_program('showmount', required: false, dirs: libvirt_sbin_path)
-       showmount_path = ''
diff --git a/recipes-extended/libvirt/libvirt/0001-qemu_nbdkit.c-use-llu-to-print-time_t.patch b/recipes-extended/libvirt/libvirt/0001-qemu_nbdkit.c-use-llu-to-print-time_t.patch
new file mode 100644
index 00000000..7263666a
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/0001-qemu_nbdkit.c-use-llu-to-print-time_t.patch
@@ -0,0 +1,76 @@
+From c4636402c06ab5ae436176daf0ef17005346e27d Mon Sep 17 00:00:00 2001
+From: Chen Qi <Qi.Chen@windriver.com>
+Date: Mon, 2 Sep 2024 22:15:51 -0700
+Subject: [PATCH] qemu_nbdkit.c: use %llu to print time_t
+
+Use %lu to print time_t will give use the following error:
+
+  error: format '%lu' expects argument of type 'long unsigned int',
+  but argument 10 has type 'time_t' {aka 'long long int'} [-Werror=format=]
+
+So use %llu to print time_t.
+
+Upstream-Status: Submitted [https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/FQSQMML6VWMHNWBYP67OLCUTJY5LJQST/]
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+---
+ src/qemu/qemu_nbdkit.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/src/qemu/qemu_nbdkit.c b/src/qemu/qemu_nbdkit.c
+index f099f35e1e..fe660c78e5 100644
+--- a/src/qemu/qemu_nbdkit.c
++++ b/src/qemu/qemu_nbdkit.c
+@@ -544,18 +544,18 @@ qemuNbdkitCapsFormatCache(qemuNbdkitCaps *nbdkitCaps)
+ 
+     virBufferEscapeString(&buf, "<path>%s</path>\n",
+                           nbdkitCaps->path);
+-    virBufferAsprintf(&buf, "<nbdkitctime>%lu</nbdkitctime>\n",
+-                      nbdkitCaps->ctime);
++    virBufferAsprintf(&buf, "<nbdkitctime>%llu</nbdkitctime>\n",
++                      (long long)nbdkitCaps->ctime);
+     virBufferEscapeString(&buf, "<plugindir>%s</plugindir>\n",
+                           nbdkitCaps->pluginDir);
+-    virBufferAsprintf(&buf, "<plugindirmtime>%lu</plugindirmtime>\n",
+-                      nbdkitCaps->pluginDirMtime);
++    virBufferAsprintf(&buf, "<plugindirmtime>%llu</plugindirmtime>\n",
++                      (long long)nbdkitCaps->pluginDirMtime);
+     virBufferEscapeString(&buf, "<filterdir>%s</filterdir>\n",
+                           nbdkitCaps->filterDir);
+-    virBufferAsprintf(&buf, "<filterdirmtime>%lu</filterdirmtime>\n",
+-                      nbdkitCaps->filterDirMtime);
+-    virBufferAsprintf(&buf, "<selfctime>%lu</selfctime>\n",
+-                      nbdkitCaps->libvirtCtime);
++    virBufferAsprintf(&buf, "<filterdirmtime>%llu</filterdirmtime>\n",
++                      (long long)nbdkitCaps->filterDirMtime);
++    virBufferAsprintf(&buf, "<selfctime>%llu</selfctime>\n",
++                      (long long)nbdkitCaps->libvirtCtime);
+     virBufferAsprintf(&buf, "<selfvers>%u</selfvers>\n",
+                       nbdkitCaps->libvirtVersion);
+ 
+@@ -593,10 +593,10 @@ virNbdkitCapsSaveFile(void *data,
+         return -1;
+     }
+ 
+-    VIR_DEBUG("Saved caps '%s' for '%s' with (%lu, %lu)",
++    VIR_DEBUG("Saved caps '%s' for '%s' with (%llu, %llu)",
+               filename, nbdkitCaps->path,
+-              nbdkitCaps->ctime,
+-              nbdkitCaps->libvirtCtime);
++              (long long)nbdkitCaps->ctime,
++              (long long)nbdkitCaps->libvirtCtime);
+ 
+     return 0;
+ }
+@@ -1054,7 +1054,7 @@ qemuNbdkitProcessBuildCommandCurl(qemuNbdkitProcess *proc,
+     }
+ 
+     if (proc->source->timeout > 0) {
+-        g_autofree char *timeout = g_strdup_printf("%llu", proc->source->timeout);
++        g_autofree char *timeout = g_strdup_printf("%llu", (long long)proc->source->timeout);
+         virCommandAddArgPair(cmd, "timeout", timeout);
+     }
+ 
+-- 
+2.25.1
+
diff --git a/recipes-extended/libvirt/libvirt/0001-tests-meson-clear-absolute-directory-paths.patch b/recipes-extended/libvirt/libvirt/0001-tests-meson-clear-absolute-directory-paths.patch
new file mode 100644
index 00000000..4cbe4913
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/0001-tests-meson-clear-absolute-directory-paths.patch
@@ -0,0 +1,38 @@
+From 05ef0d41895a355601333b5caa413754272fce03 Mon Sep 17 00:00:00 2001
+From: Bruce Ashfield <bruce.ashfield@gmail.com>
+Date: Tue, 9 Jul 2024 23:06:39 +0000
+Subject: [PATCH] tests/meson: clear absolute directory paths
+
+Ensure that the abs_* directory definitions are cleared, so
+they'll be consistent with the top level definitions and so
+we won't hav QA warnings due to tmpdir references in the
+resulting binaries.
+
+Upstream-Status: Inappropriate [oe specific]
+
+Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
+---
+ tests/meson.build | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tests/meson.build b/tests/meson.build
+index 2f1eda1f95..6fa8308385 100644
+--- a/tests/meson.build
++++ b/tests/meson.build
+@@ -1,9 +1,9 @@
+ tests_dep = declare_dependency(
+   compile_args: [
+-    '-Dabs_builddir="@0@"'.format(meson.current_build_dir()),
+-    '-Dabs_top_builddir="@0@"'.format(meson.project_build_root()),
+-    '-Dabs_srcdir="@0@"'.format(meson.current_source_dir()),
+-    '-Dabs_top_srcdir="@0@"'.format(meson.project_source_root()),
++    '-Dabs_builddir="@0@"'.format(' '),
++    '-Dabs_top_builddir="@0@"'.format(' '),
++    '-Dabs_srcdir="@0@"'.format(' '),
++    '-Dabs_top_srcdir="@0@"'.format(' '),
+   ] + coverage_flags + cc_flags_relaxed_frame_limit,
+   dependencies: [
+     apparmor_dep,
+-- 
+2.39.2
+
diff --git a/recipes-extended/libvirt/libvirt/libvirt-qemu.conf b/recipes-extended/libvirt/libvirt/libvirt-qemu.conf
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/libvirt-qemu.conf
diff --git a/recipes-extended/libvirt/libvirt_10.0.0.bb b/recipes-extended/libvirt/libvirt_git.bb
index 6b19b700..7ed708f5 100644
--- a/recipes-extended/libvirt/libvirt_10.0.0.bb
+++ b/recipes-extended/libvirt/libvirt_git.bb
@@ -24,23 +24,33 @@ RDEPENDS:libvirt-libvirtd:append:aarch64 = " dmidecode"
 #connman blocks the 53 port and libvirtd can't start its DNS service
 RCONFLICTS:${PN}_libvirtd = "connman"
 
-SRC_URI = "http://libvirt.org/sources/libvirt-${PV}.tar.xz;name=libvirt \
+SRCREV_libvirt = "9cd06737487c8ee311f71b7288c46a5cc70a700a"
+
+LIBVIRT_VERSION = "11.1.0"
+PV = "v${LIBVIRT_VERSION}+git"
+
+SRC_URI = "gitsm://github.com/libvirt/libvirt.git;name=libvirt;protocol=https;branch=master \
            file://libvirtd.sh \
            file://libvirtd.conf \
            file://dnsmasq.conf \
            file://hook_support.py \
-           file://gnutls-helper.py \
+           file://gnutls-helper.py;subdir=${BP} \
+           file://libvirt-qemu.conf \
            file://0001-prevent-gendispatch.pl-generating-build-path-in-code.patch \
            file://0001-messon.build-remove-build-path-information-to-avoid-.patch \
+           file://0001-meson.build-clear-abs_top_builddir-to-avoid-QA-warni.patch \
+           file://0001-tests-meson-clear-absolute-directory-paths.patch \
+           file://0001-qemu_nbdkit.c-use-llu-to-print-time_t.patch \
           "
 
-SRC_URI[libvirt.sha256sum] = "8ba2e72ec8bdd2418554a1474c42c35704c30174b7611eaf9a16544b71bcf00a"
+S = "${WORKDIR}/git"
 
 inherit meson gettext update-rc.d pkgconfig systemd useradd perlnative
 USERADD_PACKAGES = "${PN}"
-GROUPADD_PARAM:${PN} = "-r qemu; -r kvm"
+GROUPADD_PARAM:${PN} = "-r qemu; -r kvm; -r libvirt; -r virtlogin"
 USERADD_PARAM:${PN} = "-r -g qemu -G kvm qemu"
 
+CFLAGS += "${@oe.utils.vartrue('DEBUG_BUILD', '-Wno-error=inline', '', d)}"
 
 EXTRA_OEMESON += "--cross-file ${WORKDIR}/meson-${PN}.cross"
 do_write_config:append() {
@@ -78,6 +88,7 @@ FILES:${PN}-virsh = " \
     ${bindir}/virsh \
     ${datadir}/bash-completion/completions/virsh \
 "
+RDEPENDS:${PN}-virsh = "${PN}-libvirtd"
 
 FILES:${PN} += "${libdir}/libvirt/connection-driver \
             ${datadir}/augeas \
@@ -85,6 +96,7 @@ FILES:${PN} += "${libdir}/libvirt/connection-driver \
             ${datadir}/bash-completion/completions/vsh \
             ${datadir}/bash-completion/completions/virt-admin \
             /usr/lib/firewalld/ \
+            ${nonarch_libdir}/sysusers.d/ \
             "
 
 FILES:${PN}-dbg += "${libdir}/libvirt/connection-driver/.debug ${libdir}/libvirt/lock-driver/.debug"
@@ -118,7 +130,7 @@ SYSTEMD_SERVICE:${PN}-libvirtd = " \
 #PACKAGECONFIG ??= "xen libxl xen-inotify test remote libvirtd"
 
 # full config
-PACKAGECONFIG ??= "gnutls qemu yajl openvz vmware vbox esx lxc test remote \
+PACKAGECONFIG ??= "gnutls qemu openvz vmware vbox esx lxc test remote \
                    libvirtd netcf udev python fuse firewalld libpcap \
                    ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'selinux audit libcap-ng', '', d)} \
                    ${@bb.utils.contains('DISTRO_FEATURES', 'xen', 'libxl', '', d)} \
@@ -138,8 +150,7 @@ PACKAGECONFIG:remove:armeb = "numactl"
 # enable,disable,depends,rdepends
 #
 PACKAGECONFIG[gnutls] = ",,,gnutls-bin"
-PACKAGECONFIG[qemu] = "-Ddriver_qemu=enabled -Dqemu_user=qemu -Dqemu_group=qemu,-Ddriver_qemu=disabled,qemu,"
-PACKAGECONFIG[yajl] = "-Dyajl=enabled,-Dyajl=disabled,yajl,yajl"
+PACKAGECONFIG[qemu] = "-Ddriver_qemu=enabled -Dqemu_user=qemu -Dqemu_group=qemu,-Ddriver_qemu=disabled,qemu json-c,"
 PACKAGECONFIG[libxl] = "-Ddriver_libxl=enabled,-Ddriver_libxl=disabled,xen,"
 PACKAGECONFIG[openvz] = "-Ddriver_openvz=enabled,-Ddriver_openvz=disabled,,"
 PACKAGECONFIG[vmware] = "-Ddriver_vmware=enabled,-Ddriver_vmware=disabled,,"
@@ -194,9 +205,11 @@ do_install:append() {
         install -d ${D}/etc/init.d
         install -d ${D}/etc/libvirt
         install -d ${D}/etc/dnsmasq.d
+        install -d ${D}${nonarch_libdir}/sysusers.d/
 
-        install -m 0755 ${WORKDIR}/libvirtd.sh ${D}/etc/init.d/libvirtd
-        install -m 0644 ${WORKDIR}/libvirtd.conf ${D}/etc/libvirt/libvirtd.conf
+        install -m 0755 ${UNPACKDIR}/libvirtd.sh ${D}/etc/init.d/libvirtd
+        install -m 0644 ${UNPACKDIR}/libvirtd.conf ${D}/etc/libvirt/libvirtd.conf
+        install -m 0644 ${UNPACKDIR}/libvirt-qemu.conf ${D}${nonarch_libdir}/sysusers.d/libvirt-qemu.conf
 
         if ${@bb.utils.contains('DISTRO_FEATURES','sysvinit','true','false',d)}; then
             # This will wind up in the libvirtd package, but will NOT be invoked by default.
@@ -236,15 +249,6 @@ do_install:append() {
         echo "d root root 0755 /run/libvirt/qemu none" \
              >> ${D}${sysconfdir}/default/volatiles/99_libvirt
 
-        # Manually set permissions and ownership to match polkit recipe
-        if ${@bb.utils.contains('PACKAGECONFIG', 'polkit', 'true', 'false', d)}; then
-                install -d -m 0700 ${D}/${datadir}/polkit-1/rules.d
-                chown polkitd ${D}/${datadir}/polkit-1/rules.d
-                chgrp root ${D}/${datadir}/polkit-1/rules.d
-        else
-                rm -rf ${D}/${datadir}/polkit-1
-        fi
-
         # disable seccomp_sandbox
         if [ -e ${D}${sysconfdir}/libvirt/qemu.conf ] ; then
            sed -i '/^#seccomp_sandbox = 1/aseccomp_sandbox = 0' \
@@ -255,12 +259,12 @@ do_install:append() {
         mkdir -p ${D}/etc/libvirt/hooks
         for hook in "daemon" "lxc" "network" "qemu"
         do
-                install -m 0755 ${WORKDIR}/hook_support.py ${D}/etc/libvirt/hooks/${hook}
+                install -m 0755 ${UNPACKDIR}/hook_support.py ${D}/etc/libvirt/hooks/${hook}
         done
 
         # Force the main dnsmasq instance to bind only to specified interfaces and
         # to not bind to virbr0. Libvirt will run its own instance on this interface.
-        install -m 644 ${WORKDIR}/dnsmasq.conf ${D}/${sysconfdir}/dnsmasq.d/libvirt-daemon
+        install -m 644 ${UNPACKDIR}/dnsmasq.conf ${D}/${sysconfdir}/dnsmasq.d/libvirt-daemon
 
         # remove .la references to our working diretory
         for i in `find ${D}${libdir} -type f -name *.la`; do
@@ -286,21 +290,20 @@ do_install:append() {
 
         if ${@bb.utils.contains('PACKAGECONFIG','gnutls','true','false',d)}; then
             # Generate sample keys and certificates.
-            cd ${WORKDIR}
-            ${WORKDIR}/gnutls-helper.py -y
+            ${UNPACKDIR}/${BP}/gnutls-helper.py -y
 
             # Deploy all sample keys and certificates of CA, server and client
             # to target so that libvirtd is able to boot successfully and local
             # connection via 127.0.0.1 is available out of box.
             install -d ${D}/etc/pki/CA
             install -d ${D}/etc/pki/libvirt/private
-            install -m 0755 ${WORKDIR}/gnutls-helper.py ${D}/${bindir}
-            install -m 0644 ${WORKDIR}/cakey.pem ${D}/${sysconfdir}/pki/libvirt/private/cakey.pem
-            install -m 0644 ${WORKDIR}/cacert.pem ${D}/${sysconfdir}/pki/CA/cacert.pem
-            install -m 0644 ${WORKDIR}/serverkey.pem ${D}/${sysconfdir}/pki/libvirt/private/serverkey.pem
-            install -m 0644 ${WORKDIR}/servercert.pem ${D}/${sysconfdir}/pki/libvirt/servercert.pem
-            install -m 0644 ${WORKDIR}/clientkey.pem ${D}/${sysconfdir}/pki/libvirt/private/clientkey.pem
-            install -m 0644 ${WORKDIR}/clientcert.pem ${D}/${sysconfdir}/pki/libvirt/clientcert.pem
+            install -m 0755 ${UNPACKDIR}/${BP}/gnutls-helper.py ${D}/${bindir}
+            install -m 0644 cakey.pem ${D}/${sysconfdir}/pki/libvirt/private/cakey.pem
+            install -m 0644 cacert.pem ${D}/${sysconfdir}/pki/CA/cacert.pem
+            install -m 0644 serverkey.pem ${D}/${sysconfdir}/pki/libvirt/private/serverkey.pem
+            install -m 0644 servercert.pem ${D}/${sysconfdir}/pki/libvirt/servercert.pem
+            install -m 0644 clientkey.pem ${D}/${sysconfdir}/pki/libvirt/private/clientkey.pem
+            install -m 0644 clientcert.pem ${D}/${sysconfdir}/pki/libvirt/clientcert.pem
 
             # Force the connection to be tls.
             sed -i -e 's/^\(listen_tls\ =\ .*\)/#\1/' -e 's/^\(listen_tcp\ =\ .*\)/#\1/' ${D}/etc/libvirt/libvirtd.conf
diff --git a/recipes-extended/libvmi/libvmi_git.bb b/recipes-extended/libvmi/libvmi_git.bb
index c812cf17..cd2eba7f 100644
--- a/recipes-extended/libvmi/libvmi_git.bb
+++ b/recipes-extended/libvmi/libvmi_git.bb
@@ -12,7 +12,7 @@ SRC_URI = "git://github.com/libvmi/libvmi.git;branch=master;protocol=https \
            file://0001-Build-vbd-only-when-xen-is-enabled.patch \
 "
 
-SRCREV = "df8547ff075d4352db2eb802775b7fa7a92756db"
+SRCREV = "f02aeb751fd27bd4ae753dcd5904a4ef3232821e"
 
 S = "${WORKDIR}/git"
 
@@ -41,3 +41,20 @@ do_install:append () {
 
 # Construction of grammar.h is not parallel safe.
 PARALLEL_MAKE = "-j1"
+
+# http://errors.yoctoproject.org/Errors/Details/853259/
+# tools/vmifs/vmifs.c:129:18: error: initialization of 'void (*)(void *)' from incompatible pointer type 'void (*)(void)' [-Wincompatible-pointer-types]
+# examples/process-list.c:120:64: error: passing argument 3 of 'vmi_get_offset' from incompatible pointer type [-Wincompatible-pointer-types]
+# examples/process-list.c:122:63: error: passing argument 3 of 'vmi_get_offset' from incompatible pointer type [-Wincompatible-pointer-types]
+# examples/process-list.c:124:62: error: passing argument 3 of 'vmi_get_offset' from incompatible pointer type [-Wincompatible-pointer-types]
+# examples/process-list.c:127:62: error: passing argument 3 of 'vmi_get_offset' from incompatible pointer type [-Wincompatible-pointer-types]
+# examples/process-list.c:129:62: error: passing argument 3 of 'vmi_get_offset' from incompatible pointer type [-Wincompatible-pointer-types]
+# examples/process-list.c:131:60: error: passing argument 3 of 'vmi_get_offset' from incompatible pointer type [-Wincompatible-pointer-types]
+# examples/process-list.c:135:65: error: passing argument 3 of 'vmi_get_offset' from incompatible pointer type [-Wincompatible-pointer-types]
+# examples/process-list.c:137:64: error: passing argument 3 of 'vmi_get_offset' from incompatible pointer type [-Wincompatible-pointer-types]
+# examples/process-list.c:141:60: error: passing argument 3 of 'vmi_get_offset' from incompatible pointer type [-Wincompatible-pointer-types]
+# examples/process-list.c:143:59: error: passing argument 3 of 'vmi_get_offset' from incompatible pointer type [-Wincompatible-pointer-types]
+# examples/dump-memory.c:185:20: error: passing argument 2 of 'signal' from incompatible pointer type [-Wincompatible-pointer-types]
+# examples/win-offsets.c:287:20: error: passing argument 2 of 'signal' from incompatible pointer type [-Wincompatible-pointer-types]
+# examples/dmesg.c:146:80: error: passing argument 4 of 'vmi_get_struct_size_from_json' from incompatible pointer type [-Wincompatible-pointer-types]
+CFLAGS += "-Wno-error=incompatible-pointer-types"
diff --git a/recipes-extended/nagios/nagios-core/0001-fix-autoheader-error.patch b/recipes-extended/nagios/nagios-core/0001-fix-autoheader-error.patch
deleted file mode 100644
index 014ed1d8..00000000
--- a/recipes-extended/nagios/nagios-core/0001-fix-autoheader-error.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 3c51d942f6da08045351ce61cc7f426fa0855489 Mon Sep 17 00:00:00 2001
-From: Chen Qi <Qi.Chen@windriver.com>
-Date: Fri, 31 Aug 2018 10:51:36 +0800
-Subject: [PATCH] fix autoheader error
-
-Upstream-Status: Pending
-
-Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
----
- configure.ac | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 17e436d..16b3e71 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -388,7 +388,7 @@ AC_ARG_WITH(iobroker,
- case $IOBROKER_METHOD in
- epoll*)
-        if test "$GLIBC_NEWER_2_4" -eq 1 -a "x$ac_cv_header_sys_epoll_h" = "xyes"; then
--               AC_DEFINE([IOBROKER_USES_EPOLL])
-+               AC_DEFINE([IOBROKER_USES_EPOLL], [1], [iobroker uses epoll])
-        else
-                echo "\"epoll\" is not available as an iobroker method."
-                echo "Please use one of the other options."
-@@ -397,7 +397,7 @@ epoll*)
-        ;;
- poll*)
-        if test "x$ac_cv_header_sys_poll_h" = "xyes" -o "x$ac_cv_header_poll_h" = "xyes"; then
--               AC_DEFINE([IOBROKER_USES_POLL])
-+               AC_DEFINE([IOBROKER_USES_POLL], [1], [iobroker uses poll])
-        else
-                echo "\"poll\" is not available as an iobroker method."
-                echo "Please use one of the other options."
-@@ -406,7 +406,7 @@ poll*)
-        ;;
- select*)
-        if test "x$ac_cv_header_sys_select_h" = "xyes"; then
--               AC_DEFINE([IOBROKER_USES_SELECT])
-+               AC_DEFINE([IOBROKER_USES_SELECT], [1], [iobroker uses select])
-        else
-                echo "\"select\" is not available as an iobroker method."
-                echo "Please use one of the other options."
-@@ -415,13 +415,13 @@ select*)
-        ;;
- none*)
-        if test "$GLIBC_NEWER_2_4" -eq 1 -a "x$ac_cv_header_sys_epoll_h" = "xyes"; then
--               AC_DEFINE([IOBROKER_USES_EPOLL])
-+               AC_DEFINE([IOBROKER_USES_EPOLL], [1], [iobroker uses epoll])
-                IOBROKER_METHOD="epoll"
-        elif test "x$ac_cv_header_sys_poll_h" = "xyes" -o "x$ac_cv_header_poll_h" = "xyes"; then
--               AC_DEFINE([IOBROKER_USES_POLL])
-+               AC_DEFINE([IOBROKER_USES_POLL], [1], [iobroker uses poll])
-                IOBROKER_METHOD="poll"
-        elif test "x$ac_cv_header_sys_select_h" = "xyes"; then
--               AC_DEFINE([IOBROKER_USES_SELECT])
-+               AC_DEFINE([IOBROKER_USES_SELECT], [1], [iobroker uses select])
-                IOBROKER_METHOD="select"
-        else
-                echo "There are no available options for iobroker polling"
--- 
-2.7.4
-
diff --git a/recipes-extended/nagios/nagios-core_4.4.6.bb b/recipes-extended/nagios/nagios-core_git.bb
index 59b70895..5ffb4e17 100644
--- a/recipes-extended/nagios/nagios-core_4.4.6.bb
+++ b/recipes-extended/nagios/nagios-core_git.bb
@@ -10,9 +10,10 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=4c4203caac58013115c9ca4b85f296ae"
 
 SRCNAME = "nagios"
 
-SRC_URI = "http://prdownloads.sourceforge.net/sourceforge/${SRCNAME}/${SRCNAME}-${PV}.tar.gz \
+SRCREV = "2706fa7a451afe48bd4dc240d72d23fdcec0d9ef"
+
+SRC_URI = "git://github.com/NagiosEnterprises/nagioscore.git;protocol=https;branch=master \
            file://eventhandlers_nagioscmd_path.patch \
-           file://0001-fix-autoheader-error.patch \
            file://0001-fix-compile-error-of-missing-headers.patch \
            file://0001-fix-segment-fault.patch \
            file://volatiles \
@@ -20,14 +21,13 @@ SRC_URI = "http://prdownloads.sourceforge.net/sourceforge/${SRCNAME}/${SRCNAME}-
            file://nagios-core-systemd-volatile.conf \
            "
 
-SRC_URI[md5sum] = "ba849e9487e13859381eb117127bfee2"
-SRC_URI[sha256sum] = "ab0d5a52caf01e6f4dcd84252c4eb5df5a24f90bb7f951f03875eef54f5ab0f4"
+PV = "4.5.9+git"
 
-S = "${WORKDIR}/${SRCNAME}-${PV}"
+S = "${WORKDIR}/git"
 
-inherit autotools-brokensep update-rc.d systemd update-alternatives
+inherit autotools-brokensep update-rc.d systemd update-alternatives pkgconfig
 
-DEPENDS = "gd unzip-native"
+DEPENDS = "gd unzip-native openssl"
 
 RDEPENDS:${PN} += "\
     gd \
@@ -41,6 +41,7 @@ RDEPENDS:${PN} += "\
 SKIP_RECIPE[nagios-core] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'webserver', '', 'Depends on apache2 from meta-webserver which is not included', d)}"
 
 acpaths = "-I ${S}/autoconf-macros"
+EXTRA_AUTORECONF += "-I ${S}/m4 -I ${S}/autoconf-macros"
 
 # Set default password for the hardcoded Nagios admin user "nagiosadmin".
 # If this variable is empty then will prompt user for password.
@@ -52,7 +53,9 @@ EXTRA_OECONF += "--sbindir=${NAGIOS_CGIBIN_DIR} \
                  --with-command-group=nagcmd \
                  --with-httpd-conf=${sysconfdir}/apache2/conf.d \
                  --with-lockfile=${localstatedir}/run/nagios/nagios.pid \
-                 --with-init-dir=${sysconfdir}/init.d \
+                 --with-initdir=${sysconfdir}/init.d \
+                 --with-init-type=${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd', 'sysv', d)} \
+                 --with-inetd-type=${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd', 'inetd', d)} \
 "
 
 # Prevent nagios from stripping binaries, bitbake will take care of that
@@ -106,14 +109,17 @@ do_install() {
 
     if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
         install -d ${D}${systemd_unitdir}/system
-        install -m 644 ${WORKDIR}/nagios-core.service ${D}${systemd_unitdir}/system/
+        install -m 644 ${UNPACKDIR}/nagios-core.service ${D}${systemd_unitdir}/system/
         # use our own service file
-        rm -f ${D}${systemd_unitdir}/system/nagios.service
+        nagios_default_service=$(find ${D} -name 'nagios.service')
+        if [ -n "$nagios_default_service" ]; then
+            rm -f $nagios_default_service
+        fi
         install -d ${D}${sysconfdir}/tmpfiles.d
-        install -m 755 ${WORKDIR}/nagios-core-systemd-volatile.conf ${D}${sysconfdir}/tmpfiles.d/nagios-core-volatile.conf
+        install -m 755 ${UNPACKDIR}/nagios-core-systemd-volatile.conf ${D}${sysconfdir}/tmpfiles.d/nagios-core-volatile.conf
     else
         install -d ${D}${sysconfdir}/default/volatiles
-        install -m 0644 ${WORKDIR}/volatiles ${D}${sysconfdir}/default/volatiles/99_nagios
+        install -m 0644 ${UNPACKDIR}/volatiles ${D}${sysconfdir}/default/volatiles/99_nagios
     fi
 }
 
diff --git a/recipes-extended/nagios/nagios-nrpe_4.0.2.bb b/recipes-extended/nagios/nagios-nrpe_4.0.2.bb
index ac54469b..503ef547 100644
--- a/recipes-extended/nagios/nagios-nrpe_4.0.2.bb
+++ b/recipes-extended/nagios/nagios-nrpe_4.0.2.bb
@@ -73,11 +73,11 @@ do_install:append() {
         -i ${D}${NAGIOS_CONF_DIR}/nrpe.cfg
 
     install -d ${D}${NAGIOS_PLUGIN_CONF_DIR}
-    install -m 664 ${WORKDIR}/check_nrpe.cfg ${D}${NAGIOS_PLUGIN_CONF_DIR}
+    install -m 664 ${UNPACKDIR}/check_nrpe.cfg ${D}${NAGIOS_PLUGIN_CONF_DIR}
 
     if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
         install -d ${D}${systemd_unitdir}/system
-        install -m 644 ${WORKDIR}/nagios-nrpe.service ${D}${systemd_unitdir}/system/
+        install -m 644 ${UNPACKDIR}/nagios-nrpe.service ${D}${systemd_unitdir}/system/
     fi
 }
 
diff --git a/recipes-extended/nagios/nagios-nsca_2.9.2.bb b/recipes-extended/nagios/nagios-nsca_2.9.2.bb
index 2db51238..a400b68f 100644
--- a/recipes-extended/nagios/nagios-nsca_2.9.2.bb
+++ b/recipes-extended/nagios/nagios-nsca_2.9.2.bb
@@ -35,7 +35,7 @@ EXTRA_OECONF += "--with-nsca-user=${NAGIOS_USER} \
 "
 
 do_configure() {
-    cp ${WORKDIR}/init-script.in ${S}/init-script.in
+    cp ${UNPACKDIR}/init-script.in ${S}/init-script.in
     oe_runconf || die "make failed"
 }
 
@@ -55,7 +55,7 @@ do_install() {
 
     if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
         install -d ${D}${systemd_unitdir}/system
-        install -m 644 ${WORKDIR}/nagios-nsca.service ${D}${systemd_unitdir}/system/
+        install -m 644 ${UNPACKDIR}/nagios-nsca.service ${D}${systemd_unitdir}/system/
     fi
 }
 
diff --git a/recipes-extended/nagios/nagios-plugins_2.2.1.bb b/recipes-extended/nagios/nagios-plugins_git.bb
index 471d4b42..82263def 100644
--- a/recipes-extended/nagios/nagios-plugins_2.2.1.bb
+++ b/recipes-extended/nagios/nagios-plugins_git.bb
@@ -8,15 +8,13 @@ LICENSE = "GPL-3.0-only"
 
 LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"
 
-SRC_URI = "https://www.nagios-plugins.org/download/${BPN}-${PV}.tar.gz \
-"
-
-SRC_URI[md5sum] = "fb521d5c05897f165b0b1862c1e5cb27"
-SRC_URI[sha256sum] = "647c0ba4583d891c965fc29b77c4ccfeccc21f409fdf259cb8af52cb39c21e18"
+SRCREV = "7c74420158c3e228b3d66d4c781a6abc7a93075a"
+SRC_URI = "git://github.com/nagios-plugins/nagios-plugins.git;protocol=https;branch=master"
 
-S = "${WORKDIR}/${BPN}-${PV}"
+PV = "2.4.12+git"
+S = "${WORKDIR}/git"
 
-inherit autotools gettext
+inherit autotools gettext pkgconfig autotools-brokensep
 
 SKIP_RECIPE[nagios-plugins] ?= "${@bb.utils.contains('BBFILE_COLLECTIONS', 'webserver', '', 'Depends on nagios-core which depends on apache2 from meta-webserver which is not included', d)}"
 
@@ -25,6 +23,12 @@ EXTRA_OECONF += "--with-sysroot=${STAGING_DIR_HOST} \
                  --with-nagios-group=${NAGIOS_GROUP} \
                  --without-apt-get-command \
                  --with-trusted-path=/bin:/sbin:/usr/bin:/usr/sbin \
+                 --with-sudo-command=${bindir}/sudo \
+                 --with-ssh-command=${bindir}/ssh \
+                 --with-ps-command=${bindir}/ps \
+                 --with-ps-format='%*s %s %d %d %d %*s %*s %*s %*s %*s %*s %*s %*s %n%s' \
+                 --with-ps-varlist='procstat,&procuid,&procpid,&procppid,&pos,procprog' \
+                 --with-ps-cols=6 \
                  ac_cv_path_PERL=${bindir}/perl \
 "
 
@@ -55,8 +59,11 @@ PACKAGECONFIG[snmp] = "\
 
 PACKAGECONFIG ??= "ssl gnutls"
 
-do_configure() {
-    oe_runconf || die "make failed"
+do_configure:prepend() {
+    # rename these macros to have .m4 suffix so that autoreconf could recognize them
+    for macro in `ls ${S}/autoconf-macros/ax_nagios_get_*`; do
+        mv $macro $macro.m4
+    done
 }
 
 do_install:append() {
diff --git a/recipes-extended/oath/oath_2.6.2.bb b/recipes-extended/oath/oath_2.6.2.bb
index 84d42dff..3d962869 100644
--- a/recipes-extended/oath/oath_2.6.2.bb
+++ b/recipes-extended/oath/oath_2.6.2.bb
@@ -14,6 +14,10 @@ SRC_URI[sha256sum] = "b03446fa4b549af5ebe4d35d7aba51163442d255660558cd861ebce536
 
 inherit autotools pkgconfig
 
+# http://errors.yoctoproject.org/Errors/Details/848019/
+# uses AM_PATH_XML2 from oath-toolkit-2.6.2/m4/libxml2.m4:AC_DEFUN([AM_PATH_XML2],[...
+EXTRA_AUTORECONF += "-I ${S}/m4"
+
 # Specify any options you want to pass to the configure script using EXTRA_OECONF:
 EXTRA_OECONF = ""
 DEPENDS = "gtk-doc-native"
diff --git a/recipes-extended/rootlesskit/relocation.inc b/recipes-extended/rootlesskit/relocation.inc
new file mode 100644
index 00000000..6c64233d
--- /dev/null
+++ b/recipes-extended/rootlesskit/relocation.inc
@@ -0,0 +1,37 @@
+export sites = "gotest.tools/v3:gotest.tools/v3:force \
+           golang.org/x/sys:golang.org/x/sys:force \
+           golang.org/x/net:golang.org/x/net:force \
+           github.com/gofrs/flock:github.com/gofrs/flock:force \
+           github.com/google/uuid:github.com/google/uuid:force \
+           github.com/gorilla/mux:github.com/gorilla/mux:force \
+           github.com/moby/vpnkit:github.com/moby/vpnkit:force \
+           github.com/u-root/uio:github.com/u-root/uio:force \
+           github.com/songgao/water:github.com/songgao/water:force \
+           github.com/urfave/cli/v2:github.com/urfave/cli/v2:force \
+           github.com/google/go-cmp:github.com/google/go-cmp:force \
+           github.com/pierrec/lz4/v4:github.com/pierrec/lz4/v4:force \
+           github.com/xrash/smetrics:github.com/xrash/smetrics:force \
+           github.com/sirupsen/logrus:github.com/sirupsen/logrus:force \
+           github.com/insomniacslk/dhcp:github.com/insomniacslk/dhcp:force \
+           github.com/Masterminds/semver/v3:github.com/Masterminds/semver/v3:force \
+           github.com/cpuguy83/go-md2man/v2:github.com/cpuguy83/go-md2man/v2:force \
+           github.com/moby/sys/mountinfo:github.com/moby/sys/mountinfo/mountinfo:force \
+           github.com/russross/blackfriday/v2:github.com/russross/blackfriday/v2:force \
+           github.com/containernetworking/plugins:github.com/containernetworking/plugins:force"
+
+do_compile:prepend() {
+    cd ${S}/src/import
+    for s in $sites; do
+        site_dest=$(echo $s | cut -d: -f1)
+        site_source=$(echo $s | cut -d: -f2)
+        force_flag=$(echo $s | cut -d: -f3)
+        mkdir -p vendor.copy/$site_dest
+        if [ -n "$force_flag" ]; then
+            echo "[INFO] $site_dest: force copying .go files"
+            rm -rf vendor.copy/$site_dest
+            rsync -a --exclude='vendor/' --exclude='.git/' vendor.fetch/$site_source/ vendor.copy/$site_dest
+        else
+            [ -n "$(ls -A vendor.copy/$site_dest/*.go 2> /dev/null)" ] && { echo "[INFO] vendor.fetch/$site_source -> $site_dest: go copy skipped (files present)" ; true ; } || { echo "[INFO] $site_dest: copying .go files" ; rsync -a --exclude='vendor/' --exclude='.git/' vendor.fetch/$site_source/ vendor.copy/$site_dest ; }
+        fi
+    done
+}
diff --git a/recipes-extended/rootlesskit/rootlesskit/modules.txt b/recipes-extended/rootlesskit/rootlesskit/modules.txt
new file mode 100644
index 00000000..29954c7c
--- /dev/null
+++ b/recipes-extended/rootlesskit/rootlesskit/modules.txt
@@ -0,0 +1,83 @@
+# github.com/Masterminds/semver/v3 v3.3.1
+## explicit; go 1.21
+github.com/Masterminds/semver/v3
+# github.com/containernetworking/plugins v1.6.2
+## explicit; go 1.23
+github.com/containernetworking/plugins/pkg/ns
+# github.com/cpuguy83/go-md2man/v2 v2.0.5
+## explicit; go 1.11
+github.com/cpuguy83/go-md2man/v2/md2man
+# github.com/gofrs/flock v0.12.1
+## explicit; go 1.21.0
+github.com/gofrs/flock
+# github.com/google/go-cmp v0.6.0
+## explicit; go 1.13
+github.com/google/go-cmp/cmp
+github.com/google/go-cmp/cmp/internal/diff
+github.com/google/go-cmp/cmp/internal/flags
+github.com/google/go-cmp/cmp/internal/function
+github.com/google/go-cmp/cmp/internal/value
+# github.com/google/uuid v1.6.0
+## explicit
+github.com/google/uuid
+# github.com/gorilla/mux v1.8.1
+## explicit; go 1.20
+github.com/gorilla/mux
+# github.com/insomniacslk/dhcp v0.0.0-20250109001534-8abf58130905
+## explicit; go 1.20
+github.com/insomniacslk/dhcp/dhcpv4
+github.com/insomniacslk/dhcp/dhcpv4/client4
+github.com/insomniacslk/dhcp/iana
+github.com/insomniacslk/dhcp/interfaces
+github.com/insomniacslk/dhcp/rfc1035label
+# github.com/moby/sys/mountinfo v0.7.2
+## explicit; go 1.17
+github.com/moby/sys/mountinfo
+# github.com/moby/vpnkit v0.5.0
+## explicit
+github.com/moby/vpnkit/go/pkg/vmnet
+# github.com/pierrec/lz4/v4 v4.1.21
+## explicit; go 1.14
+github.com/pierrec/lz4/v4
+github.com/pierrec/lz4/v4/internal/lz4block
+github.com/pierrec/lz4/v4/internal/lz4errors
+github.com/pierrec/lz4/v4/internal/lz4stream
+github.com/pierrec/lz4/v4/internal/xxh32
+# github.com/russross/blackfriday/v2 v2.1.0
+## explicit
+github.com/russross/blackfriday/v2
+# github.com/sirupsen/logrus v1.9.3
+## explicit; go 1.13
+github.com/sirupsen/logrus
+# github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8
+## explicit
+github.com/songgao/water
+# github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701
+## explicit; go 1.21
+github.com/u-root/uio/rand
+github.com/u-root/uio/uio
+# github.com/urfave/cli/v2 v2.27.6
+## explicit; go 1.18
+github.com/urfave/cli/v2
+# github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1
+## explicit; go 1.15
+github.com/xrash/smetrics
+# golang.org/x/net v0.36.0
+## explicit; go 1.23.0
+golang.org/x/net/bpf
+golang.org/x/net/internal/iana
+golang.org/x/net/internal/socket
+golang.org/x/net/ipv4
+# golang.org/x/sys v0.31.0
+## explicit; go 1.23.0
+golang.org/x/sys/unix
+golang.org/x/sys/windows
+golang.org/x/sys/windows/registry
+# gotest.tools/v3 v3.5.2
+## explicit; go 1.17
+gotest.tools/v3/assert
+gotest.tools/v3/assert/cmp
+gotest.tools/v3/internal/assert
+gotest.tools/v3/internal/difflib
+gotest.tools/v3/internal/format
+gotest.tools/v3/internal/source
diff --git a/recipes-extended/rootlesskit/rootlesskit_git.bb b/recipes-extended/rootlesskit/rootlesskit_git.bb
new file mode 100644
index 00000000..f8dd55af
--- /dev/null
+++ b/recipes-extended/rootlesskit/rootlesskit_git.bb
@@ -0,0 +1,81 @@
+HOMEPAGE = "https://github.com/rootless-containers/rootlesskit"
+SUMMARY =  "RootlessKit: Linux-native fakeroot using user namespaces"
+DESCRIPTION = "RootlessKit is a Linux-native implementation of 'fake root' using user_namespaces(7). \
+The purpose of RootlessKit is to run Docker and Kubernetes as an unprivileged user (known as 'Rootless mode'),\
+so as to protect the real root on the host from potential container-breakout attacks. \
+"
+
+# generated with:
+# scripts/oe-go-mod-autogen.py --repo  https://github.com/rootless-containers/rootlesskit  --rev c784875ba4ba4c5aaa256f98675fd543b087c900
+
+DEPENDS = " \
+    go-md2man \
+    rsync-native \
+"
+# Specify the first two important SRCREVs as the format
+SRCREV_FORMAT = "rootless"
+SRCREV_rootless = "530859a92629689c0c17c96d9ab145f4d04b5b5a"
+
+SRC_URI = "git://github.com/rootless-containers/rootlesskit;name=rootless;branch=master;protocol=https;destsuffix=${GO_SRCURI_DESTSUFFIX}"
+
+include src_uri.inc
+
+# patches and config
+SRC_URI += "file://modules.txt \
+           "
+
+LICENSE = "Apache-2.0"
+LIC_FILES_CHKSUM = "file://src/import/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
+
+GO_IMPORT = "import"
+
+S = "${WORKDIR}/git"
+
+PV = "v2.3.4+git"
+
+ROOTLESS_PKG = "github.com/rootless-containers/rootlesskit"
+
+inherit go goarch
+inherit systemd pkgconfig
+
+do_configure[noexec] = "1"
+
+EXTRA_OEMAKE = " \
+     PREFIX=${prefix} BINDIR=${bindir} LIBEXECDIR=${libexecdir} \
+     ETCDIR=${sysconfdir} TMPFILESDIR=${nonarch_libdir}/tmpfiles.d \
+     SYSTEMDDIR=${systemd_unitdir}/system USERSYSTEMDDIR=${systemd_unitdir}/user \
+"
+
+PACKAGECONFIG ?= ""
+
+include relocation.inc
+
+do_compile() {
+
+        cd ${S}/src/import
+
+        export GOPATH="$GOPATH:${S}/src/import/.gopath"
+
+        # Pass the needed cflags/ldflags so that cgo
+        # can find the needed headers files and libraries
+        export GOARCH=${TARGET_GOARCH}
+        export CGO_ENABLED="1"
+        export CGO_CFLAGS="${CFLAGS} --sysroot=${STAGING_DIR_TARGET}"
+        export CGO_LDFLAGS="${LDFLAGS} --sysroot=${STAGING_DIR_TARGET}"
+
+        export GOFLAGS="-mod=vendor -trimpath ${PIEFLAG}"
+
+        # our copied .go files are to be used for the build
+        ln -sf vendor.copy vendor
+        # inform go that we know what we are doing
+        cp ${UNPACKDIR}/modules.txt vendor/
+
+        oe_runmake GO=${GO} BUILDTAGS="${BUILDTAGS}" all
+}
+
+do_install() {
+        install -d "${D}${BIN_PREFIX}${base_bindir}"
+        for b in rootlessctl  rootlesskit  rootlesskit-docker-proxy; do
+                install -m 755 "${S}/src/import/bin/$b" "${D}${BIN_PREFIX}${base_bindir}"
+        done
+}
diff --git a/recipes-extended/rootlesskit/src_uri.inc b/recipes-extended/rootlesskit/src_uri.inc
new file mode 100644
index 00000000..c7a8b693
--- /dev/null
+++ b/recipes-extended/rootlesskit/src_uri.inc
@@ -0,0 +1,100 @@
+#       gotest.tools/v3 v3.5.2
+# [1] git ls-remote https://github.com/gotestyourself/gotest.tools 0b81523ff268a1f1b0baf4a5da67e42fbb86880b
+SRCREV_gotest.tools-v3 = "0b81523ff268a1f1b0baf4a5da67e42fbb86880b"
+SRC_URI += "git://github.com/gotestyourself/gotest.tools;name=gotest.tools-v3;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/gotest.tools/v3"
+
+#       golang.org/x/sys v0.31.0
+# [1] git ls-remote https://github.com/golang/sys 74cfc93a99be6ca6f193856132e6799065b071af
+SRCREV_sys = "74cfc93a99be6ca6f193856132e6799065b071af"
+SRC_URI += "git://github.com/golang/sys;name=sys;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/golang.org/x/sys"
+
+#       golang.org/x/net v0.36.0
+# [1] git ls-remote https://go.googlesource.com/net 85d1d54551b68719346cb9fec24b911da4e452a1
+SRCREV_net = "85d1d54551b68719346cb9fec24b911da4e452a1"
+SRC_URI += "git://go.googlesource.com/net;name=net;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/golang.org/x/net"
+
+#       github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701
+# [1] git ls-remote https://github.com/u-root/uio d2acac8f37018c514adec45c51f58eace3795df4
+SRCREV_uio = "d2acac8f37018c514adec45c51f58eace3795df4"
+SRC_URI += "git://github.com/u-root/uio;name=uio;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/github.com/u-root/uio"
+
+#       github.com/gofrs/flock v0.12.1
+# [1] git ls-remote https://github.com/gofrs/flock 9de625d921bf362f81e0760056fdff11c8542435
+SRCREV_flock = "9de625d921bf362f81e0760056fdff11c8542435"
+SRC_URI += "git://github.com/gofrs/flock;name=flock;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/github.com/gofrs/flock"
+
+#       github.com/google/uuid v1.6.0
+# [1] git ls-remote https://github.com/google/uuid 0f11ee6918f41a04c201eceeadf612a377bc7fbc
+SRCREV_uuid = "0f11ee6918f41a04c201eceeadf612a377bc7fbc"
+SRC_URI += "git://github.com/google/uuid;name=uuid;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/github.com/google/uuid"
+
+#       github.com/gorilla/mux v1.8.1
+# [1] git ls-remote https://github.com/gorilla/mux b4617d0b9670ad14039b2739167fd35a60f557c5
+SRCREV_mux = "b4617d0b9670ad14039b2739167fd35a60f557c5"
+SRC_URI += "git://github.com/gorilla/mux;name=mux;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/github.com/gorilla/mux"
+
+#       github.com/moby/vpnkit v0.5.0
+# [1] git ls-remote https://github.com/moby/vpnkit 7f0eff0dd99b576c5474de53b4454a157c642834
+SRCREV_vpnkit = "7f0eff0dd99b576c5474de53b4454a157c642834"
+SRC_URI += "git://github.com/moby/vpnkit;name=vpnkit;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/github.com/moby/vpnkit"
+
+#       github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8
+# [1] git ls-remote https://github.com/songgao/water 2b4b6d7c09d80835e5f13f6b040d69f00a158b24
+SRCREV_water = "2b4b6d7c09d80835e5f13f6b040d69f00a158b24"
+SRC_URI += "git://github.com/songgao/water;name=water;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/github.com/songgao/water"
+
+#       github.com/urfave/cli/v2 v2.27.6
+# [1] git ls-remote https://github.com/urfave/cli 9d76d15e478af5e952fffc872597c47b69ec7ee7
+SRCREV_v2 = "9d76d15e478af5e952fffc872597c47b69ec7ee7"
+SRC_URI += "git://github.com/urfave/cli;name=v2;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/github.com/urfave/cli/v2"
+
+#       github.com/google/go-cmp v0.6.0
+# [1] git ls-remote https://github.com/google/go-cmp c3ad8435e7bef96af35732bc0789e5a2278c6d5f
+SRCREV_go-cmp = "c3ad8435e7bef96af35732bc0789e5a2278c6d5f"
+SRC_URI += "git://github.com/google/go-cmp;name=go-cmp;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/github.com/google/go-cmp"
+
+#       github.com/pierrec/lz4/v4 v4.1.21
+# [1] git ls-remote https://github.com/pierrec/lz4 294e7659e17723306ebf3a44cd7ad2c11f456c37
+SRCREV_v4 = "294e7659e17723306ebf3a44cd7ad2c11f456c37"
+SRC_URI += "git://github.com/pierrec/lz4;name=v4;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/github.com/pierrec/lz4/v4"
+
+#       github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1
+# [1] git ls-remote https://github.com/xrash/smetrics 686a1a2994c11fac124829fadcb683a24ab8d25f
+SRCREV_smetrics = "686a1a2994c11fac124829fadcb683a24ab8d25f"
+SRC_URI += "git://github.com/xrash/smetrics;name=smetrics;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/github.com/xrash/smetrics"
+
+#       github.com/sirupsen/logrus v1.9.3
+# [1] git ls-remote https://github.com/sirupsen/logrus d40e25cd45ed9c6b2b66e6b97573a0413e4c23bd
+SRCREV_logrus = "d40e25cd45ed9c6b2b66e6b97573a0413e4c23bd"
+SRC_URI += "git://github.com/sirupsen/logrus;name=logrus;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/github.com/sirupsen/logrus"
+
+#       github.com/insomniacslk/dhcp v0.0.0-20250109001534-8abf58130905
+# [1] git ls-remote https://github.com/insomniacslk/dhcp 8abf58130905b866076c8002e77aac6cb2e26d0e
+SRCREV_dhcp = "8abf58130905b866076c8002e77aac6cb2e26d0e"
+SRC_URI += "git://github.com/insomniacslk/dhcp;name=dhcp;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/github.com/insomniacslk/dhcp"
+
+#       github.com/moby/sys/mountinfo v0.7.2
+# [1] git ls-remote https://github.com/moby/sys cafbe42351600ca9b363e220722f66d96f6e71f4
+SRCREV_mountinfo = "cafbe42351600ca9b363e220722f66d96f6e71f4"
+SRC_URI += "git://github.com/moby/sys;name=mountinfo;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/github.com/moby/sys/mountinfo"
+
+#       github.com/Masterminds/semver/v3 v3.3.1
+# [1] git ls-remote https://github.com/Masterminds/semver 1558ca3488226e3490894a145e831ad58a5ff958
+SRCREV_v3 = "1558ca3488226e3490894a145e831ad58a5ff958"
+SRC_URI += "git://github.com/Masterminds/semver;name=v3;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/github.com/Masterminds/semver/v3"
+
+#       github.com/cpuguy83/go-md2man/v2 v2.0.5
+# [1] git ls-remote https://github.com/cpuguy83/go-md2man b14773d4db11046c50d0d1c05955839604aae991
+SRCREV_go-md2man-v2 = "b14773d4db11046c50d0d1c05955839604aae991"
+SRC_URI += "git://github.com/cpuguy83/go-md2man;name=go-md2man-v2;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/github.com/cpuguy83/go-md2man/v2"
+
+#       github.com/russross/blackfriday/v2 v2.1.0
+# [1] git ls-remote https://github.com/russross/blackfriday 4c9bf9512682b995722660a4196c0013228e2049
+SRCREV_blackfriday-v2 = "4c9bf9512682b995722660a4196c0013228e2049"
+SRC_URI += "git://github.com/russross/blackfriday;name=blackfriday-v2;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/github.com/russross/blackfriday/v2"
+
+#       github.com/containernetworking/plugins v1.6.2
+# [1] git ls-remote https://github.com/containernetworking/plugins 7f756b411efc3d3730c707e2cc1f2baf1a66e28c
+SRCREV_plugins = "7f756b411efc3d3730c707e2cc1f2baf1a66e28c"
+SRC_URI += "git://github.com/containernetworking/plugins;name=plugins;protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}/vendor.fetch/github.com/containernetworking/plugins"
+
diff --git a/recipes-extended/upx/upx_git.bb b/recipes-extended/upx/upx_git.bb
index 02e70ffe..dde1bf9f 100644
--- a/recipes-extended/upx/upx_git.bb
+++ b/recipes-extended/upx/upx_git.bb
@@ -2,12 +2,36 @@ SUMMARY = "Ultimate executable compressor."
 HOMEPAGE = "https://upx.github.io/"
 LICENSE = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=353753597aa110e0ded3508408c6374a"
-SRCREV_upx = "099c3d829e80488af7395a4242b318877e980da4"
-PV = "4.2.2+git${SRCPV}"
 
 # Note: DO NOT use released tarball in favor of the git repository with submodules.
 # it makes maintenance easier for CVEs or other issues.
-SRC_URI = "gitsm://github.com/upx/upx;protocol=https;;name=upx;branch=devel"
+
+SRCREV_upx = "44e4bd0b5454ff8aee1ff3376974dfe6014300d9"
+PV = "4.2.4+git${SRCPV}"
+
+# SRCREVs are from:
+#   git submodule status | awk '{ commit_hash = $1; sub(/vendor\//, "", $2); gsub("-", "_", $2); printf "SRCREV_vendor_%s = \"%s\"\n", $2, commit_hash }'
+#
+# with two substitions for invalid SRCREVs (hence why the gitsm fetcher
+# has issues)
+SRCREV_vendor_doctest = "835aaee34666173532e98437b057f37b385076c9"
+SRCREV_vendor_lzma_sdk = "f9637f9f563d17b6ecf33ae2212dcd44866bfb25"
+SRCREV_vendor_ucl = "a60611d342b0b7d2924c495ebaa1910e4c3c3fe6"
+SRCREV_vendor_valgrind = "b054e44ea1b6d630853ed74d33e0934ef4642efc"
+SRCREV_vendor_zlib = "0a41a7d0a974d0b43afe4afe4b8025c8f144474e"
+
+# This is broken for commits newer than 4.2.4 with invalid SRCREVs being reported
+# by the git submodules. We switch back to individual fetches while this is
+# investigated.
+# SRC_URI = "gitsm://github.com/upx/upx;protocol=https;;name=upx;branch=devel"
+SRCREV_FORMAT = "upx"
+SRC_URI = "git://github.com/upx/upx;name=upx;branch=devel;protocol=https \
+           git://github.com/upx/upx-vendor-doctest;name=vendor_doctest;subdir=git/vendor/doctest;branch=upx-vendor;protocol=https \
+           git://github.com/upx/upx-vendor-lzma-sdk;name=vendor_lzma_sdk;subdir=git/vendor/lzma-sdk;branch=upx-vendor;protocol=https \
+           git://github.com/upx/upx-vendor-ucl;name=vendor_ucl;subdir=git/vendor/ucl;branch=upx-vendor;protocol=https \
+           git://github.com/upx/upx-vendor-zlib;name=vendor_zlib;subdir=git/vendor/zlib;branch=upx-vendor;protocol=https \
+           git://github.com/upx/upx-vendor-valgrind;name=vendor_valgrind;subdir=git/vendor/valgrind;branch=upx-vendor;protocol=https \
+           "
 
 S = "${WORKDIR}/git"
 
diff --git a/recipes-extended/uxen/uxen-guest-tools_4.1.8.bb b/recipes-extended/uxen/uxen-guest-tools_4.1.8.bb
index c2f3464c..c2e8be93 100644
--- a/recipes-extended/uxen/uxen-guest-tools_4.1.8.bb
+++ b/recipes-extended/uxen/uxen-guest-tools_4.1.8.bb
@@ -19,7 +19,7 @@ SRC_URI[uxen.sha384sum] = "be2233bc6506a23350d76c03ac28ea7ea381e1dc6ed5ce996e8ac
 SRC_URI[license.sha384sum] = "92e48c614df3094cb52321d4c4e01f6df5526d46aee5c6fa36c43ee23d4c33f03baa1fc5f6f29efafff636b6d13bc92c"
 
 # The software license is GPLv2: please see page 199 of the pdf document
-LIC_FILES_CHKSUM = "file://${WORKDIR}/Bromium-4.1.8-Open-Source-Software.pdf;md5=cf120df6ffa417b36f870a9997650049"
+LIC_FILES_CHKSUM = "file://${UNPACKDIR}/Bromium-4.1.8-Open-Source-Software.pdf;md5=cf120df6ffa417b36f870a9997650049"
 
 S = "${WORKDIR}/uxen-${PV}-72a4af9/vm-support/linux"
 
diff --git a/recipes-extended/virt-manager/virt-manager/0001-build-drop-man-directory.patch b/recipes-extended/virt-manager/virt-manager/0001-build-drop-man-directory.patch
new file mode 100644
index 00000000..043428b9
--- /dev/null
+++ b/recipes-extended/virt-manager/virt-manager/0001-build-drop-man-directory.patch
@@ -0,0 +1,31 @@
+From f86dfffa8d443ec640b1c76d2eeccd6a4913305d Mon Sep 17 00:00:00 2001
+From: Bruce Ashfield <bruce.ashfield@gmail.com>
+Date: Fri, 17 Jan 2025 15:32:51 +0000
+Subject: [PATCH] build: drop man directory
+
+The man pages require rst2man, which isn't available (or at least
+not trivial to provide), so we drop the man directory to avoid
+building the pages.
+
+Upstream-Status: Inappropriate [oe specific]
+
+Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
+---
+ meson.build | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index 8862ada8f..22a14d53f 100644
+--- a/meson.build
++++ b/meson.build
+@@ -15,7 +15,6 @@ pkgdir = datadir / 'virt-manager'
+ git = run_command('test', '-e', '.git', check: false).returncode() == 0
+ 
+ subdir('scripts')
+-subdir('man')
+ subdir('data')
+ subdir('ui')
+ subdir('virtinst')
+-- 
+2.39.2
+
diff --git a/recipes-extended/virt-manager/virt-manager/0001-setup.py-move-global-args-to-install-args.patch b/recipes-extended/virt-manager/virt-manager/0001-setup.py-move-global-args-to-install-args.patch
deleted file mode 100644
index f0bbf73b..00000000
--- a/recipes-extended/virt-manager/virt-manager/0001-setup.py-move-global-args-to-install-args.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From bcdb3555b924573e85039b54d63d6173ad99b846 Mon Sep 17 00:00:00 2001
-From: Paul Le Guen de Kerneizon <paul.leguendekerneizon@savoirfairelinux.com>
-Date: Wed, 28 Feb 2024 10:24:00 +0100
-Subject: [PATCH] setup.py: move global args to install args
-
-Presently, during the installation process, global arguments such as
-`no-update-icon-cache` and `no-compile-schemas` are utilized to
-prevent the installation of specific graphical components. These
-arguments are essential, for instance, when installing virt-manager
-without any GUI dependencies on the target system. However, these
-global arguments must be set before the install command, yet they only
-take effect during the execution of the command.
-
-Since the Yocto `setuptools3_legacy` class parses arguments after the
-command, this commit aims to make these arguments applicable locally to
-the install command.
-
-Upstream-Status: Inappropriate [oe specific]
-
-Signed-off-by: Paul Le Guen de Kerneizon <paul.leguendekerneizon@savoirfairelinux.com>
----
- setup.py | 20 ++++++++++++--------
- 1 file changed, 12 insertions(+), 8 deletions(-)
-
-diff --git a/setup.py b/setup.py
-index cd6cd83e..faca546a 100755
---- a/setup.py
-+++ b/setup.py
-@@ -242,6 +242,16 @@ class my_egg_info(setuptools.command.install_egg_info.install_egg_info):
-
-
- class my_install(setuptools.command.install.install):
-+    setuptools.command.install.install.user_options += [
-+        ("no-update-icon-cache", None, "Don't run gtk-update-icon-cache"),
-+        ("no-compile-schemas", None, "Don't compile gsettings schemas"),
-+    ]
-+
-+    def initialize_options(self):
-+        setuptools.command.install.install.initialize_options(self)
-+        self.no_update_icon_cache = None
-+        self.no_compile_schemas = None
-+
-     """
-     Error if we weren't 'configure'd with the correct install prefix
-     """
-@@ -266,12 +276,12 @@ class my_install(setuptools.command.install.install):
-     def run(self):
-         setuptools.command.install.install.run(self)
-
--        if not self.distribution.no_update_icon_cache:
-+        if not self.no_update_icon_cache:
-             print("running gtk-update-icon-cache")
-             icon_path = os.path.join(self.install_data, "share/icons/hicolor")
-             self.spawn(["gtk-update-icon-cache", "-q", "-t", icon_path])
-
--        if not self.distribution.no_compile_schemas:
-+        if not self.no_compile_schemas:
-             print("compiling gsettings schemas")
-             gschema_install = os.path.join(self.install_data,
-                 "share/glib-2.0/schemas")
-@@ -421,14 +431,8 @@ class CheckPylint(setuptools.Command):
-
-
- class VMMDistribution(setuptools.dist.Distribution):
--    global_options = setuptools.dist.Distribution.global_options + [
--        ("no-update-icon-cache", None, "Don't run gtk-update-icon-cache"),
--        ("no-compile-schemas", None, "Don't compile gsettings schemas"),
--    ]
-
-     def __init__(self, *args, **kwargs):
--        self.no_update_icon_cache = False
--        self.no_compile_schemas = False
-         setuptools.dist.Distribution.__init__(self, *args, **kwargs)
-
-
---
-2.34.1
-
diff --git a/recipes-extended/virt-manager/virt-manager_4.1.0.bb b/recipes-extended/virt-manager/virt-manager_git.bb
index a2395012..4af8977c 100644
--- a/recipes-extended/virt-manager/virt-manager_4.1.0.bb
+++ b/recipes-extended/virt-manager/virt-manager_git.bb
@@ -2,21 +2,25 @@ DESCRIPTION = "virt-manager is a graphical tool for managing virtual machines vi
 HOMEPAGE = "https://virt-manager.org/"
 LICENSE = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
-DEPENDS += "python3-docutils-native"
-SRCREV = "6710ca6969b7d9c4e8344acd0fe3d50b24adc8ec"
+DEPENDS += "python3-docutils-native python3-pylint"
+SRCREV = "4f9618289f279f86994a5d2f1aada8a6524f5a6f"
 
 SRC_URI = " \
   git://github.com/virt-manager/virt-manager;branch=main;protocol=https \
-  file://0001-setup.py-move-global-args-to-install-args.patch \
+  file://0001-build-drop-man-directory.patch \
 "
 
+PV = "v5.0.0+git"
+
 S = "${WORKDIR}/git"
 
 PACKAGECONFIG ??= "gui"
-PACKAGECONFIG[gui] = ",--no-update-icon-cache --no-compile-schemas,python3-pygobject"
+PACKAGECONFIG[gui] = ",-Dupdate-icon-cache=false -Dcompile-schemas=false,python3-pygobject"
 
 inherit ${@bb.utils.contains('PACKAGECONFIG', 'gui', 'gtk-icon-cache', '', d)}
-inherit bash-completion gettext pkgconfig setuptools3_legacy
+inherit bash-completion gettext pkgconfig meson
+
+EXTRA_OEMESON += "-Dtests=disabled"
 
 PACKAGES += " \
   ${PN}-common \
@@ -28,8 +32,23 @@ RDEPENDS:${PN}-common += " \
   libosinfo \
 "
 
-RDEPENDS:${PN} = "${PN}-common"
-RDEPENDS:${PN}-install = "${PN}-common"
+RDEPENDS:${PN} = " \
+  ${PN}-common \
+  libvirt-glib \
+  libxml2-python \
+  gdk-pixbuf \
+  gtk+3 \
+  hicolor-icon-theme \
+  python3-pygobject \
+  python3-requests \
+"
+RDEPENDS:${PN}-install = " \
+  ${PN}-common \
+  libvirt-virsh \
+  libxml2-python \
+  python3-pygobject \
+  python3-requests \
+"
 
 SETUPTOOLS_INSTALL_ARGS += "${PACKAGECONFIG_CONFARGS}"
 
diff --git a/recipes-extended/virt-viewer/virt-viewer_11.0.bb b/recipes-extended/virt-viewer/virt-viewer_git.bb
index 273e1fc5..322d92ff 100644
--- a/recipes-extended/virt-viewer/virt-viewer_11.0.bb
+++ b/recipes-extended/virt-viewer/virt-viewer_git.bb
@@ -12,7 +12,7 @@ DEPENDS = " \
 
 SRC_URI = "git://gitlab.com/virt-viewer/virt-viewer.git;protocol=https;branch=master"
 
-SRCREV = "de864c14146c120b46d435949b1d8d0b11e57b85"
+SRCREV = "107f60c168c405cf1782b686a65bf4af16ec8c9d"
 PV = "11.0+git"
 S = "${WORKDIR}/git"
 
diff --git a/recipes-extended/xen/files/0001-arm-silence-gcc14-warning-error-on-irq-bounds-check.patch b/recipes-extended/xen/files/0001-arm-silence-gcc14-warning-error-on-irq-bounds-check.patch
new file mode 100644
index 00000000..637d6fe5
--- /dev/null
+++ b/recipes-extended/xen/files/0001-arm-silence-gcc14-warning-error-on-irq-bounds-check.patch
@@ -0,0 +1,65 @@
+From 2258853a19b2d0b1fafd901cddf69f730c38d450 Mon Sep 17 00:00:00 2001
+From: Bruce Ashfield <bruce.ashfield@gmail.com>
+Date: Fri, 31 May 2024 14:50:33 +0000
+Subject: [PATCH] arm: silence gcc14 warning (error) on irq bounds check
+
+While we wait for upstream to update to gcc14, we add a quick
+check to avoid gcc14 not being able to confirm that IRQ is
+greater than 0 and hence throws a warning, which leads to an
+error.
+
+| In function '__irq_to_desc',
+|     inlined from 'route_irq_to_guest' at arch/arm/irq.c:467:12:
+| arch/arm/irq.c:65:16: error: array subscript -2 is below array bounds of 'irq_desc_t[32]' {aka 'struct irq_desc[32]'} [-Werror=array-bounds=]
+|    65 |         return &this_cpu(local_irq_desc)[irq];
+|       |                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Upstream-Status: Pending [the xen folks understand the code and the right fix .. I don't]
+
+Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
+---
+ xen/arch/arm/irq.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+Index: git/xen/arch/arm/irq.c
+===================================================================
+--- git.orig/xen/arch/arm/irq.c
++++ git/xen/arch/arm/irq.c
+@@ -48,8 +48,13 @@ void irq_end_none(struct irq_desc *irq)
+ static irq_desc_t irq_desc[NR_IRQS];
+ static DEFINE_PER_CPU(irq_desc_t[NR_LOCAL_IRQS], local_irq_desc);
+ 
++
+ struct irq_desc *__irq_to_desc(int irq)
+ {
++    /* silence gcc14 warning */
++    if ( irq < 0 )
++        return &this_cpu(local_irq_desc)[0];
++
+     if ( irq < NR_LOCAL_IRQS )
+         return &this_cpu(local_irq_desc)[irq];
+ 
+@@ -722,16 +727,16 @@ int platform_get_irq(const struct dt_dev
+ 
+ int platform_get_irq_byname(const struct dt_device_node *np, const char *name)
+ {
+-       int index;
++        int index;
+ 
+-       if ( unlikely(!name) )
+-               return -EINVAL;
++        if ( unlikely(!name) )
++                return -EINVAL;
+ 
+-       index = dt_property_match_string(np, "interrupt-names", name);
+-       if ( index < 0 )
+-               return index;
++        index = dt_property_match_string(np, "interrupt-names", name);
++        if ( index < 0 )
++                return index;
+ 
+-       return platform_get_irq(np, index);
++        return platform_get_irq(np, index);
+ }
+ 
+ /*
diff --git a/recipes-extended/xen/files/0001-python-pygrub-pass-DISTUTILS-xen-4.15.patch b/recipes-extended/xen/files/0001-python-pygrub-pass-DISTUTILS-xen-4.15.patch
deleted file mode 100644
index 476f5ddc..00000000
--- a/recipes-extended/xen/files/0001-python-pygrub-pass-DISTUTILS-xen-4.15.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 6db88791d923167f160afbcadeffad84a4cbdbc5 Mon Sep 17 00:00:00 2001
-Message-Id: <6db88791d923167f160afbcadeffad84a4cbdbc5.1612262706.git.bertrand.marquis@arm.com>
-From: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
-Date: Fri, 19 Oct 2018 11:01:37 +0200
-Subject: [PATCH] python,pygrub: pass DISTUTILS env vars as setup.py args
-
-Upstream-Status: Inappropriate [oe specific, python install issues]
-
-Allow to respect the target install dir (PYTHON_SITEPACKAGES_DIR)
-as well as other parameters set by the OpenEmbedded build system.
-This is especially useful when the target libdir is not the default one
-(/usr/lib), but for example /usr/lib64.
-
-Signed-off-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
-
-Forward-ported to Xen 4.12.0
-Signed-off-by: Christopher Clark <christopher.clark6@baesystems.com>
-
-Modified to support pygrub installation with python 3
-Signed-off-by: Christopher Clark <christopher.clark6@baesystems.com>
-
-Forward-ported to Xen 4.14.0
-Signed-off-by: Christopher Clark <christopher.clark6@baesystems.com>
-
-Forward-ported to Xen 4.15.0
-Signed-off-by: Bertrand Marquis <bertrand.marquis@arm.com>
-
----
- tools/pygrub/Makefile | 7 +++++--
- tools/python/Makefile | 2 +-
- 2 files changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/tools/pygrub/Makefile b/tools/pygrub/Makefile
-index 37b2146214..ffb9270065 100644
---- a/tools/pygrub/Makefile
-+++ b/tools/pygrub/Makefile
-@@ -10,7 +10,7 @@ INSTALL_LOG = build/installed_files.txt
- all: build
- .PHONY: build
- build:
--       CC="$(CC)" CFLAGS="$(PY_CFLAGS)" LDSHARED="$(CC)" LDFLAGS="$(PY_LDFLAGS)" $(PYTHON) setup.py build
-+       CC="$(CC)" CFLAGS="$(PY_CFLAGS)" LDSHARED="$(CC)" LDFLAGS="$(PY_LDFLAGS)" $(PYTHON) setup.py build $(DISTUTILS_BUILD_ARGS)
- 
- .PHONY: install
- install: all
-@@ -18,7 +18,10 @@ install: all
-        CC="$(CC)" CFLAGS="$(PY_CFLAGS)" LDSHARED="$(CC)" \
-                LDFLAGS="$(PY_LDFLAGS)" $(PYTHON) setup.py install \
-                --record $(INSTALL_LOG) $(PYTHON_PREFIX_ARG) \
--                --root="$(DESTDIR)" --install-scripts=$(LIBEXEC_BIN) --force
-+                --root="$(DESTDIR)" --install-scripts=$(LIBEXEC_BIN) --force \
-+                $(DISTUTILS_INSTALL_ARGS)
-+       rm -f $(DESTDIR)/$(LIBEXEC_BIN)/pygrub
-+       $(INSTALL_PYTHON_PROG) src/pygrub $(DESTDIR)/$(LIBEXEC_BIN)/pygrub
-        set -e; if [ $(bindir) != $(LIBEXEC_BIN) -a \
-                     "`readlink -f $(DESTDIR)/$(bindir)`" != \
-                     "`readlink -f $(LIBEXEC_BIN)`" ]; then \
-diff --git a/tools/python/Makefile b/tools/python/Makefile
-index cc76423647..5cb11ae453 100644
---- a/tools/python/Makefile
-+++ b/tools/python/Makefile
-@@ -12,7 +12,7 @@ setup.py = CC="$(CC)" CFLAGS="$(PY_CFLAGS)" LDSHARED="$(CC)" LDFLAGS="$(PY_LDFLA
-            SHLIB_libxenctrl="$(SHLIB_libxenctrl)" \
-            SHLIB_libxenguest="$(SHLIB_libxenguest)" \
-            SHLIB_libxenstore="$(SHLIB_libxenstore)" \
--           $(PYTHON) setup.py
-+           $(PYTHON) setup.py $(DISTUTILS_BUILD_ARGS)
- 
- .PHONY: build
- build:
--- 
-2.17.1
-
diff --git a/recipes-extended/xen/files/0001-python-pygrub-pass-DISTUTILS-xen-4.18.patch b/recipes-extended/xen/files/0001-python-pygrub-pass-DISTUTILS-xen-4.19.patch
index 7ac1a399..bfd1acb4 100644
--- a/recipes-extended/xen/files/0001-python-pygrub-pass-DISTUTILS-xen-4.18.patch
+++ b/recipes-extended/xen/files/0001-python-pygrub-pass-DISTUTILS-xen-4.19.patch
@@ -1,10 +1,10 @@
 Upstream-Status: Pending
 
-diff --git a/tools/pygrub/Makefile b/tools/pygrub/Makefile
-index 4963bc89c6..c1c05eb421 100644
---- a/tools/pygrub/Makefile
-+++ b/tools/pygrub/Makefile
-@@ -13,14 +13,14 @@ setup.py = CC="$(CC)" CFLAGS="$(PY_CFLAGS)" LDSHARED="$(CC)" LDFLAGS="$(PY_LDFLA
+Index: git/tools/pygrub/Makefile
+===================================================================
+--- git.orig/tools/pygrub/Makefile
++++ git/tools/pygrub/Makefile
+@@ -13,14 +13,14 @@ setup.py = CC="$(CC)" CFLAGS="$(PY_CFLAG
  all: build
  .PHONY: build
  build:
@@ -19,13 +19,13 @@ index 4963bc89c6..c1c05eb421 100644
 -               --root="$(DESTDIR)" --force
 +               --root="$(DESTDIR)" --force  $(DISTUTILS_INSTALL_ARGS)
         $(INSTALL_PYTHON_PROG) src/pygrub $(DESTDIR)/$(LIBEXEC_BIN)/pygrub
-        set -e; if [ $(bindir) != $(LIBEXEC_BIN) -a \
-                     "`readlink -f $(DESTDIR)/$(bindir)`" != \
-diff --git a/tools/python/Makefile b/tools/python/Makefile
-index 437431c48e..0a99c2067e 100644
---- a/tools/python/Makefile
-+++ b/tools/python/Makefile
-@@ -16,13 +16,13 @@ setup.py = CC="$(CC)" CFLAGS="$(PY_CFLAGS)" LDSHARED="$(CC)" LDFLAGS="$(PY_LDFLA
+ 
+ .PHONY: uninstall
+Index: git/tools/python/Makefile
+===================================================================
+--- git.orig/tools/python/Makefile
++++ git/tools/python/Makefile
+@@ -16,13 +16,13 @@ setup.py = CC="$(CC)" CFLAGS="$(PY_CFLAG
  
  .PHONY: build
  build:
diff --git a/recipes-extended/xen/files/0001-python-pygrub-pass-DISTUTILS-xen-4.20.patch b/recipes-extended/xen/files/0001-python-pygrub-pass-DISTUTILS-xen-4.20.patch
new file mode 100644
index 00000000..bfd1acb4
--- /dev/null
+++ b/recipes-extended/xen/files/0001-python-pygrub-pass-DISTUTILS-xen-4.20.patch
@@ -0,0 +1,43 @@
+Upstream-Status: Pending
+
+Index: git/tools/pygrub/Makefile
+===================================================================
+--- git.orig/tools/pygrub/Makefile
++++ git/tools/pygrub/Makefile
+@@ -13,14 +13,14 @@ setup.py = CC="$(CC)" CFLAGS="$(PY_CFLAG
+ all: build
+ .PHONY: build
+ build:
+-       $(setup.py) build
++       $(setup.py) build $(DISTUTILS_BUILD_ARGS)
+ 
+ .PHONY: install
+ install: all
+        $(INSTALL_DIR) $(DESTDIR)/$(bindir)
+        $(INSTALL_DIR) $(DESTDIR)/$(LIBEXEC_BIN)
+        $(setup.py) install --record $(INSTALL_LOG) $(PYTHON_PREFIX_ARG) \
+-               --root="$(DESTDIR)" --force
++               --root="$(DESTDIR)" --force  $(DISTUTILS_INSTALL_ARGS)
+        $(INSTALL_PYTHON_PROG) src/pygrub $(DESTDIR)/$(LIBEXEC_BIN)/pygrub
+ 
+ .PHONY: uninstall
+Index: git/tools/python/Makefile
+===================================================================
+--- git.orig/tools/python/Makefile
++++ git/tools/python/Makefile
+@@ -16,13 +16,13 @@ setup.py = CC="$(CC)" CFLAGS="$(PY_CFLAG
+ 
+ .PHONY: build
+ build:
+-       $(setup.py) build
++       $(setup.py) build $(DISTUTILS_BUILD_ARGS)
+ 
+ .PHONY: install
+ install:
+        $(INSTALL_DIR) $(DESTDIR)$(LIBEXEC_BIN)
+        $(setup.py) install --record $(INSTALL_LOG) $(PYTHON_PREFIX_ARG) \
+-               --root="$(DESTDIR)" --force
++               --root="$(DESTDIR)" --force $(DISTUTILS_INSTALL_ARGS)
+        $(INSTALL_PYTHON_PROG) scripts/convert-legacy-stream $(DESTDIR)$(LIBEXEC_BIN)
+        $(INSTALL_PYTHON_PROG) scripts/verify-stream-v2 $(DESTDIR)$(LIBEXEC_BIN)
+ 
diff --git a/recipes-extended/xen/files/0001-xen-fix-header-guard-inconsistencies-gcc15.patch b/recipes-extended/xen/files/0001-xen-fix-header-guard-inconsistencies-gcc15.patch
new file mode 100644
index 00000000..4b2c0bdf
--- /dev/null
+++ b/recipes-extended/xen/files/0001-xen-fix-header-guard-inconsistencies-gcc15.patch
@@ -0,0 +1,54 @@
+From 70f96461462a5a0437398022aa71a2033c8c5c3a Mon Sep 17 00:00:00 2001
+From: Bruce Ashfield <bruce.ashfield@gmail.com>
+Date: Thu, 15 May 2025 14:26:47 -0400
+Subject: [PATCH] xen: fix header guard inconsistencies (gcc15)
+
+Fixing the following header inconsistencies
+
+   | In file included from arch/arm/platforms/midway.c:22:
+   | ./arch/arm/include/asm/platforms/midway.h:1: error: header guard '__ASM_ARM_PLATFORMS_MIDWAY_H' followed by '#define' of a different macro [-Werror=header-guard]
+   |     1 | #ifndef __ASM_ARM_PLATFORMS_MIDWAY_H
+   | ./arch/arm/include/asm/platforms/midway.h:2: note: '__ASM_ASM_PLATFORMS_MIDWAY_H' is defined here; did you mean '__ASM_ARM_PLATFORMS_MIDWAY_H'?
+   |     2 | #define __ASM_ASM_PLATFORMS_MIDWAY_H
+   | In file included from arch/arm/platforms/omap5.c:21:
+   | ./arch/arm/include/asm/platforms/omap5.h:1: error: header guard '__ASM_ARM_PLATFORMS_OMAP5_H' followed by '#define' of a different macro [-Werror=header-guard]
+   |     1 | #ifndef __ASM_ARM_PLATFORMS_OMAP5_H
+   | ./arch/arm/include/asm/platforms/omap5.h:2: note: '__ASM_ASM_PLATFORMS_OMAP5_H' is defined here; did you mean '__ASM_ARM_PLATFORMS_OMAP5_H'?
+
+It is unclear whether this is on purpose or not, but for our limited
+set of permuations, we change them to match and no issues have been
+found.
+
+Upstream-Status: Pending [the xen folks understand the code and the right fix .. I don't]
+
+Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
+---
+ xen/arch/arm/include/asm/platforms/midway.h | 2 +-
+ xen/arch/arm/include/asm/platforms/omap5.h  | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/xen/arch/arm/include/asm/platforms/midway.h b/xen/arch/arm/include/asm/platforms/midway.h
+index 099e4350f9..69143931c2 100644
+--- a/xen/arch/arm/include/asm/platforms/midway.h
++++ b/xen/arch/arm/include/asm/platforms/midway.h
+@@ -1,5 +1,5 @@
+ #ifndef __ASM_ARM_PLATFORMS_MIDWAY_H
+-#define __ASM_ASM_PLATFORMS_MIDWAY_H
++#define __ASM_ARM_PLATFORMS_MIDWAY_H
+ 
+ /* addresses of SREG registers for resetting the SoC */
+ #define MW_SREG_PWR_REQ             0xfff3cf00
+diff --git a/xen/arch/arm/include/asm/platforms/omap5.h b/xen/arch/arm/include/asm/platforms/omap5.h
+index c559c84b61..8867b4589a 100644
+--- a/xen/arch/arm/include/asm/platforms/omap5.h
++++ b/xen/arch/arm/include/asm/platforms/omap5.h
+@@ -1,5 +1,5 @@
+ #ifndef __ASM_ARM_PLATFORMS_OMAP5_H
+-#define __ASM_ASM_PLATFORMS_OMAP5_H
++#define __ASM_ARM_PLATFORMS_OMAP5_H
+ 
+ #define REALTIME_COUNTER_BASE                   0x48243200
+ #define INCREMENTER_NUMERATOR_OFFSET            0x10
+-- 
+2.39.2
+
diff --git a/recipes-extended/xen/files/10-ether.network b/recipes-extended/xen/files/10-ether.network
new file mode 100644
index 00000000..8d27ca92
--- /dev/null
+++ b/recipes-extended/xen/files/10-ether.network
@@ -0,0 +1,5 @@
+[Match]
+Type=ether
+
+[Network]
+Bridge=xenbr0
diff --git a/recipes-extended/xen/files/10-xenbr0.netdev b/recipes-extended/xen/files/10-xenbr0.netdev
new file mode 100644
index 00000000..ec45879f
--- /dev/null
+++ b/recipes-extended/xen/files/10-xenbr0.netdev
@@ -0,0 +1,3 @@
+[NetDev]
+Name=xenbr0
+Kind=bridge
diff --git a/recipes-extended/xen/files/10-xenbr0.network b/recipes-extended/xen/files/10-xenbr0.network
new file mode 100644
index 00000000..1e10c3eb
--- /dev/null
+++ b/recipes-extended/xen/files/10-xenbr0.network
@@ -0,0 +1,5 @@
+[Match]
+Name=xenbr0
+
+[Network]
+DHCP=yes
diff --git a/recipes-extended/xen/xen-hypervisor.inc b/recipes-extended/xen/xen-hypervisor.inc
index 6f3d24d0..347f98f7 100644
--- a/recipes-extended/xen/xen-hypervisor.inc
+++ b/recipes-extended/xen/xen-hypervisor.inc
@@ -114,4 +114,4 @@ KCONFIG_CONFIG_ROOTDIR = "${S}/xen"
 
 # Xen is setting all CC flags on its own. Make sure that they are not modified
 # for aarch64, e.g. with architecture-specific optimizations.
-TUNE_CCARGS:aarch64=""
+TUNE_CCARGS:aarch64 = ""
diff --git a/recipes-extended/xen/xen-tools.inc b/recipes-extended/xen/xen-tools.inc
index 5f010a5d..a034bc4c 100644
--- a/recipes-extended/xen/xen-tools.inc
+++ b/recipes-extended/xen/xen-tools.inc
@@ -6,6 +6,20 @@ COMPATIBLE_HOST = 'i686-.*-linux|(x86_64.*).*-linux|aarch64.*-linux|arm-.*-linux
 inherit setuptools3 update-rc.d systemd deploy
 require xen-blktap.inc
 
+SRC_URI += "file://10-ether.network \
+            file://10-xenbr0.netdev \
+            file://10-xenbr0.network"
+
+VIRT_NETWORKING_FILES = "${UNPACKDIR}/10-ether.network \
+                         ${UNPACKDIR}/10-xenbr0.netdev \
+                         ${UNPACKDIR}/10-xenbr0.network"
+inherit virt_networking
+
+QEMU_SYSTEM ?= "qemu-system-i386"
+# The qemu-firware package is only available if "vmsep" is in distro features
+QEMU_FIRMWARE ?= "${@bb.utils.contains('DISTRO_FEATURES', 'vmsep', 'qemu-firmware', '', d)}"
+QEMU_SYSTEM_RDEPENDS ?= "${QEMU_SYSTEM} ${QEMU_FIRMWARE}"
+
 RDEPENDS:${PN} = "\
     bash perl xz \
     ${PN}-console \
@@ -26,6 +40,8 @@ RDEPENDS:${PN} = "\
     ${PN}-xenstore \
     virtual-xenstored \
     ${PN}-xl \
+    ${QEMU_SYSTEM_RDEPENDS} \
+    ${PN}-net-conf \
     "
 
 RDEPENDS:${PN}-dev = ""
@@ -213,6 +229,7 @@ PACKAGES = " \
     ${PN}-test \
     ${PN}-xen-vmtrace \
     ${PN}-xen-mceinj \
+    ${PN}-xen-9pfsd \
     "
 
 PROVIDES =+ " \
@@ -594,6 +611,12 @@ FILES:${PN}-xenstored = "\
     ${localstatedir}/lib/xenstored \
     "
 
+FILES:${PN}-xen-9pfsd = "\
+    ${libdir}/xen/bin/xen-9pfsd \
+    "
+# 9pfsd is only on xen-4.19+
+ALLOW_EMPTY:${PN}-xen-9pfsd = "1"
+
 FILES:${PN}-xentrace = "\
     ${bindir}/xentrace \
     ${bindir}/xentrace_setsize \
@@ -698,14 +721,14 @@ FILES:${PN}-test += "\
 # test-cpu-policy and test-tsx only exist in 4.16 for x86
 ALLOW_EMPTY:${PN}-test = "1"
 
-FILES:${PN}-xen-mceinj +="\
+FILES:${PN}-xen-mceinj += "\
     ${sbindir}/xen-mceinj \
     "
 
 # xen-mceinj is only built for x86 4.16, so allow empty package
 ALLOW_EMPTY:${PN}-xen-mceinj = "1"
 
-FILES:${PN}-xen-vmtrace +="\
+FILES:${PN}-xen-vmtrace += "\
     ${sbindir}/xen-vmtrace \
     "
 
@@ -745,7 +768,7 @@ EXTRA_OECONF += " \
     --with-systemd=${systemd_unitdir}/system \
     --with-initddir=${INIT_D_DIR} \
     --with-sysconfig-leaf-dir=default \
-    --with-system-qemu=${bindir}/qemu-system-i386 \
+    --with-system-qemu=${bindir}/${QEMU_SYSTEM} \
     "
 
 do_configure() {
@@ -807,15 +830,15 @@ do_install() {
     fi
 
     if [ -e ${D}${systemd_unitdir}/system/xen-qemu-dom0-disk-backend.service ]; then
-        sed -i 's#ExecStart=.*qemu-system-i386\(.*\)$#ExecStart=/usr/bin/qemu-system-i386\1#' \
+        sed -i 's#ExecStart=.*${QEMU_SYSTEM}\(.*\)$#ExecStart=/usr/bin/${QEMU_SYSTEM}\1#' \
             ${D}${systemd_unitdir}/system/xen-qemu-dom0-disk-backend.service
     fi
 
     if ${@bb.utils.contains('DISTRO_FEATURES','systemd','true','false',d)}; then
         rm -f ${D}/${sysconfdir}/init.d/xencommons
     else
-        # fixup default path to qemu-system-i386
-        sed -i 's#\(test -z "$QEMU_XEN" && QEMU_XEN=\).*$#\1"/usr/bin/qemu-system-i386"#' ${D}/etc/init.d/xencommons
+        # fixup default path to ${QEMU_SYSTEM}
+        sed -i 's#\(test -z "$QEMU_XEN" && QEMU_XEN=\).*$#\1"/usr/bin/${QEMU_SYSTEM}"#' ${D}/etc/init.d/xencommons
 
         # remove the uncondiontally installed systemd service files
         rm -f ${D}/${systemd_unitdir}/system/xen-qemu-dom0-disk-backend.service
diff --git a/recipes-extended/xen/xen-tools_4.17.bb b/recipes-extended/xen/xen-tools_4.17.bb
deleted file mode 100644
index 72deed01..00000000
--- a/recipes-extended/xen/xen-tools_4.17.bb
+++ /dev/null
@@ -1,19 +0,0 @@
-# xen 4.17.2 release sha
-SRCREV ?= "0ebd2e49bcd0f566ba6b9158555942aab8e41332"
-
-XEN_REL ?= "4.17"
-XEN_BRANCH ?= "stable-${XEN_REL}"
-
-SRC_URI = "git://xenbits.xen.org/xen.git;branch=${XEN_BRANCH} \
-           file://0001-python-pygrub-pass-DISTUTILS-xen-4.15.patch \
-           file://0001-tools-xenstore-xenstored_control.c-correctly-print-t.patch \
-           "
-
-LIC_FILES_CHKSUM ?= "file://COPYING;md5=d1a1e216f80b6d8da95fec897d0dbec9"
-
-PV = "${XEN_REL}+stable"
-
-S = "${WORKDIR}/git"
-
-require xen.inc
-require xen-tools.inc
diff --git a/recipes-extended/xen/xen-tools_4.18.bb b/recipes-extended/xen/xen-tools_4.19.bb
index 5dbe180a..3667e044 100644
--- a/recipes-extended/xen/xen-tools_4.18.bb
+++ b/recipes-extended/xen/xen-tools_4.19.bb
@@ -1,12 +1,12 @@
-# tag: RELEASE-4.18.0
-SRCREV ?= "4da8ca9cb9cfdb92c9dd09d5270ae16a3b2dbc89"
+# tag: RELEASE-4.19.0
+SRCREV ?= "8dd897e69119492989aaa034967f3a887f590197"
 
-XEN_REL ?= "4.18"
-XEN_BRANCH ?= "stable-4.18"
+XEN_REL ?= "4.19"
+XEN_BRANCH ?= "stable-4.19"
 
 SRC_URI = " \
     git://xenbits.xen.org/xen.git;branch=${XEN_BRANCH} \
-    file://0001-python-pygrub-pass-DISTUTILS-xen-4.18.patch \
+    file://0001-python-pygrub-pass-DISTUTILS-xen-4.19.patch \
     "
 
 LIC_FILES_CHKSUM ?= "file://COPYING;md5=d1a1e216f80b6d8da95fec897d0dbec9"
diff --git a/recipes-extended/xen/xen-tools_4.20.bb b/recipes-extended/xen/xen-tools_4.20.bb
new file mode 100644
index 00000000..0f864e63
--- /dev/null
+++ b/recipes-extended/xen/xen-tools_4.20.bb
@@ -0,0 +1,20 @@
+SRCREV ?= "3ad5d648cda5add395f49fc3704b2552aae734f7"
+
+XEN_REL ?= "4.20"
+XEN_BRANCH ?= "stable-4.20"
+
+SRC_URI = " \
+    git://xenbits.xen.org/xen.git;branch=${XEN_BRANCH} \
+    file://0001-python-pygrub-pass-DISTUTILS-xen-4.19.patch \
+    "
+
+LIC_FILES_CHKSUM ?= "file://COPYING;md5=d1a1e216f80b6d8da95fec897d0dbec9"
+
+PV = "${XEN_REL}+stable"
+
+S = "${WORKDIR}/git"
+
+DEFAULT_PREFERENCE ??= "-1"
+
+require xen.inc
+require xen-tools.inc
diff --git a/recipes-extended/xen/xen-tools_git.bb b/recipes-extended/xen/xen-tools_git.bb
index 8397178e..47d1e236 100644
--- a/recipes-extended/xen/xen-tools_git.bb
+++ b/recipes-extended/xen/xen-tools_git.bb
@@ -1,12 +1,12 @@
-# master status on 2023-05-26
-SRCREV ?= "03cf7ca23e0e876075954c558485b267b7d02406"
+# master status March 2025
+SRCREV ?= "de0254b90922a8644bb2c4c1593786d45c80ea22"
 
-XEN_REL ?= "4.18"
+XEN_REL ?= "4.21-dev"
 XEN_BRANCH ?= "master"
 
 SRC_URI = " \
     git://xenbits.xen.org/xen.git;branch=${XEN_BRANCH} \
-    file://0001-python-pygrub-pass-DISTUTILS-xen-4.18.patch \
+    file://0001-python-pygrub-pass-DISTUTILS-xen-4.20.patch \
     "
 
 LIC_FILES_CHKSUM ?= "file://COPYING;md5=d1a1e216f80b6d8da95fec897d0dbec9"
diff --git a/recipes-extended/xen/xen.inc b/recipes-extended/xen/xen.inc
index dcd281b5..f8c1e266 100644
--- a/recipes-extended/xen/xen.inc
+++ b/recipes-extended/xen/xen.inc
@@ -73,20 +73,20 @@ libexecdir = "${libdir}"
 export XEN_OS = "Linux"
 
 # this is used for the header (#!${bindir}/python) of the install python scripts
-export PYTHONPATH="${bindir}/env python3"
-export ac_cv_path_PYTHONPATH="${bindir}/env python3"
+export PYTHONPATH = "${bindir}/env python3"
+export ac_cv_path_PYTHONPATH = "${bindir}/env python3"
 export DISTUTILS_BUILD_ARGS
 export DISTUTILS_INSTALL_ARGS
 
 # xen and seabios require HOSTCC and HOSTCXX set to cross-compile
-export HOSTCC="${BUILD_CC}"
-export HOSTCXX="${BUILD_CXX}"
+export HOSTCC = "${BUILD_CC}"
+export HOSTCXX = "${BUILD_CXX}"
 
 # make xen requires CROSS_COMPILE set by hand as it does not abide by ./configure
-export CROSS_COMPILE="${TARGET_PREFIX}"
+export CROSS_COMPILE = "${TARGET_PREFIX}"
 
 # overide LDFLAGS to allow xen to build without: "x86_64-oe-linux-ld: unrecognized option '-Wl,-O1'"
-export LDFLAGS=""
+export LDFLAGS = ""
 
 # No additional C flags for the main hypervisor build
 EXTRA_CFLAGS_XEN_CORE ?= ""
@@ -99,7 +99,7 @@ DEBUG_PREFIX_MAP:append = " \
 # - The Xen tools build for x86 systems with HVM-mode enabled includes hvmloader
 #   which fails to build when "-m64" is included in flags set via the
 #   EXTRA_CFLAGS_XEN_TOOLS: so clear TUNE_CCARGS on x86 to prevent that.
-TUNE_CCARGS:x86-64=""
+TUNE_CCARGS:x86-64 = ""
 
 # - Yocto supplies the _FORTIFY_SOURCE flag via CC/CPP/CXX but then passes the
 #   optimization -O via C*FLAGS which is problematic when the CFLAGS are cleared
@@ -110,11 +110,11 @@ TUNE_CCARGS:x86-64=""
 #   It must not be compiled with SSE compiler options enabled and the Xen build
 #   explicitly clears CFLAGS to ensure that, so such options must not be passed
 #   in via the tool variable. hvmloader is required to run HVM-mode guest VMs.
-CC="${CCACHE}${HOST_PREFIX}gcc ${TOOLCHAIN_OPTIONS} ${DEBUG_PREFIX_MAP} ${CC_REPRODUCIBLE_OPTIONS}"
-EXTRA_CFLAGS_XEN_TOOLS="${HOST_CC_ARCH} ${CFLAGS}"
+CC = "${CCACHE}${HOST_PREFIX}gcc ${TOOLCHAIN_OPTIONS} ${DEBUG_PREFIX_MAP} ${CC_REPRODUCIBLE_OPTIONS}"
+EXTRA_CFLAGS_XEN_TOOLS = "${HOST_CC_ARCH} ${CFLAGS}"
 # 32-bit ARM needs the TUNE_CCARGS component of HOST_CC_ARCH to be passed
 # in CC to ensure that configure can compile binaries for the right arch.
-CC:arm="${CCACHE}${HOST_PREFIX}gcc ${TUNE_CCARGS} ${TOOLCHAIN_OPTIONS} ${DEBUG_PREFIX_MAP} ${CC_REPRODUCIBLE_OPTIONS}"
+CC:arm = "${CCACHE}${HOST_PREFIX}gcc ${TUNE_CCARGS} ${TOOLCHAIN_OPTIONS} ${DEBUG_PREFIX_MAP} ${CC_REPRODUCIBLE_OPTIONS}"
 
 # There are no Xen-provided variables for C++, so append to the tool variables:
 CPP:append = " ${CPPFLAGS}"
@@ -151,7 +151,7 @@ def get_build_time_vars(d):
     source_date_epoch = d.getVar('SOURCE_DATE_EPOCH')
     if source_date_epoch is not None:
         import datetime
-        utc_datetime = datetime.datetime.utcfromtimestamp(float(source_date_epoch))
+        utc_datetime =  datetime.datetime.fromtimestamp(float(source_date_epoch), datetime.timezone.utc)
         return " XEN_BUILD_DATE=" + utc_datetime.strftime("%Y-%m-%d") + \
                " XEN_BUILD_TIME=" + utc_datetime.strftime("%H:%M:%S")
     return ""
diff --git a/recipes-extended/xen/xen_4.18.bb b/recipes-extended/xen/xen_4.19.bb
index 2ad7704e..3ee29ae1 100644
--- a/recipes-extended/xen/xen_4.18.bb
+++ b/recipes-extended/xen/xen_4.19.bb
@@ -1,8 +1,8 @@
-# tag: RELEASE-4.18.0
-SRCREV ?= "4da8ca9cb9cfdb92c9dd09d5270ae16a3b2dbc89"
+# tag: RELEASE-4.19.0
+SRCREV ?= "8dd897e69119492989aaa034967f3a887f590197"
 
-XEN_REL ?= "4.18"
-XEN_BRANCH ?= "stable-4.18"
+XEN_REL ?= "4.19.0"
+XEN_BRANCH ?= "stable-4.19"
 
 SRC_URI = " \
     git://xenbits.xen.org/xen.git;branch=${XEN_BRANCH} \
diff --git a/recipes-extended/xen/xen_4.17.bb b/recipes-extended/xen/xen_4.20.bb
index d83fa97f..85c56296 100644
--- a/recipes-extended/xen/xen_4.17.bb
+++ b/recipes-extended/xen/xen_4.20.bb
@@ -1,12 +1,12 @@
-# xen 4.17.2 release sha
-SRCREV ?= "0ebd2e49bcd0f566ba6b9158555942aab8e41332"
+SRCREV ?= "47d911f69eb976785fd17cae4e39de4d55b94b9e"
 
-XEN_REL ?= "4.17"
-XEN_BRANCH ?= "stable-${XEN_REL}"
+XEN_REL ?= "4.20.0"
+XEN_BRANCH ?= "stable-4.20"
 
 SRC_URI = " \
     git://xenbits.xen.org/xen.git;branch=${XEN_BRANCH} \
     file://0001-menuconfig-mconf-cfg-Allow-specification-of-ncurses-location.patch \
+    file://0001-xen-fix-header-guard-inconsistencies-gcc15.patch \
     "
 
 LIC_FILES_CHKSUM ?= "file://COPYING;md5=d1a1e216f80b6d8da95fec897d0dbec9"
@@ -15,8 +15,7 @@ PV = "${XEN_REL}+stable"
 
 S = "${WORKDIR}/git"
 
+DEFAULT_PREFERENCE ??= "-1"
+
 require xen.inc
 require xen-hypervisor.inc
-
-TOOLCHAIN = "gcc"
-LDFLAGS:remove = "-fuse-ld=lld"
diff --git a/recipes-extended/xen/xen_git.bb b/recipes-extended/xen/xen_git.bb
index 79078878..18b19be7 100644
--- a/recipes-extended/xen/xen_git.bb
+++ b/recipes-extended/xen/xen_git.bb
@@ -1,7 +1,6 @@
-# master status on 2023-11-24
-SRCREV ?= "03cf7ca23e0e876075954c558485b267b7d02406"
+SRCREV ?= "de0254b90922a8644bb2c4c1593786d45c80ea22"
 
-XEN_REL ?= "4.19"
+XEN_REL ?= "4.21-dev"
 XEN_BRANCH ?= "master"
 
 SRC_URI = " \