338 files changed, 4819 insertions, 6643 deletions

diff --git a/meta/recipes-core/base-files/base-files/0001-add-nss-resolve-to-nsswitch.patch b/meta/recipes-core/base-files/base-files/0001-add-nss-resolve-to-nsswitch.patch
deleted file mode 100644
index a6e39e0956..0000000000
--- a/meta/recipes-core/base-files/base-files/0001-add-nss-resolve-to-nsswitch.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 830abe652428d9d31780c3ace121635ad7b64274 Mon Sep 17 00:00:00 2001
-From: Eero Aaltonen <eero.aaltonen@vaisala.com>
-Date: Wed Sep 27 15:50:48 2023 +0300
-Subject: [PATCH] Add nss-resolve to the Name Service Switch (NSS)
-
-Add `nss-resolve` so that `systemd-resolved` is used for name
-resolution with glibc `gethostbyname` calls.
-
-Upstream-Status: Inappropriate [no upstream, configuration].
-
-Signed-off-by: Eero Aaltonen <eero.aaltonen@vaisala.com>
----
- nsswitch.conf | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/nsswitch.conf b/nsswitch.conf
-index 06f03d2..34b165c 100644
---- a/nsswitch.conf
-+++ b/nsswitch.conf
-@@ -8,7 +8,7 @@ passwd:         compat
- group:          compat
- shadow:         compat
- 
--hosts:          files dns
-+hosts:          resolve [!UNAVAIL=return] files dns
- networks:       files
- 
- protocols:      db files
--- 
-2.25.1
-
diff --git a/meta/recipes-core/base-files/base-files/nsswitch-resolved.conf b/meta/recipes-core/base-files/base-files/nsswitch-resolved.conf
new file mode 100644
index 0000000000..ec6ce156b5
--- /dev/null
+++ b/meta/recipes-core/base-files/base-files/nsswitch-resolved.conf
@@ -0,0 +1,20 @@
+# /etc/nsswitch.conf
+#
+# Example configuration of GNU Name Service Switch functionality.
+# If you have the `glibc-doc' and `info' packages installed, try:
+# `info libc "Name Service Switch"' for information about this file.
+
+passwd:         compat
+group:          compat
+shadow:         compat
+gshadow:        files
+
+hosts:          resolve [!UNAVAIL=return] files dns
+networks:       files
+
+protocols:      db files
+services:       db files
+ethers:         db files
+rpc:            db files
+
+netgroup:       nis
diff --git a/meta/recipes-core/base-files/base-files/nsswitch.conf b/meta/recipes-core/base-files/base-files/nsswitch.conf
index 06f03d22a6..53279c12b7 100644
--- a/meta/recipes-core/base-files/base-files/nsswitch.conf
+++ b/meta/recipes-core/base-files/base-files/nsswitch.conf
@@ -7,6 +7,7 @@
 passwd:         compat
 group:          compat
 shadow:         compat
+gshadow:        files
 
 hosts:          files dns
 networks:       files
diff --git a/meta/recipes-core/base-files/base-files/profile b/meta/recipes-core/base-files/base-files/profile
index bded3757cc..375be64891 100644
--- a/meta/recipes-core/base-files/base-files/profile
+++ b/meta/recipes-core/base-files/base-files/profile
@@ -1,7 +1,7 @@
 # /etc/profile: system-wide .profile file for the Bourne shell (sh(1))
 # and Bourne compatible shells (bash(1), ksh(1), ash(1), ...).
 
-PATH="/usr/local/bin:/usr/bin:/bin"
+PATH="$PATH:/usr/local/bin:/usr/bin:/bin"
 [ "$TERM" ] || TERM="vt100"     # Basic terminal capab. For screen etc.
 
 # Add /sbin & co to $PATH for the root user
@@ -58,7 +58,7 @@ resize() {
         fi
         # only do this for /dev/tty[A-z] which are typically
         # serial ports
-        if [ $FIRSTTIMESETUP -eq 1 -a $SHLVL -eq 1 ] ; then
+        if [ $FIRSTTIMESETUP -eq 1 -a ${SHLVL:-1} -eq 1 ] ; then
                 case $(tty 2>/dev/null) in
                         /dev/tty[A-z]*) resize >/dev/null;;
                 esac
diff --git a/meta/recipes-core/base-files/base-files_3.0.14.bb b/meta/recipes-core/base-files/base-files_3.0.14.bb
index 9fab53ce63..3f01bb35d9 100644
--- a/meta/recipes-core/base-files/base-files_3.0.14.bb
+++ b/meta/recipes-core/base-files/base-files_3.0.14.bb
@@ -11,6 +11,7 @@ LIC_FILES_CHKSUM = "file://licenses/GPL-2;md5=94d55d512a9ba36caa9b7df079bae19f"
 
 SRC_URI = "file://rotation \
            file://nsswitch.conf \
+           file://nsswitch-resolved.conf \
            file://motd \
            file://hosts \
            file://host.conf \
@@ -23,14 +24,13 @@ SRC_URI = "file://rotation \
            file://share/dot.profile \
            file://licenses/GPL-2 \
            "
-SRC_URI:append:libc-glibc = "${@bb.utils.contains('DISTRO_FEATURES', 'systemd systemd-resolved', ' file://0001-add-nss-resolve-to-nsswitch.patch', '', d)}"
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 INHIBIT_DEFAULT_DEPS = "1"
 
 docdir:append = "/${P}"
-dirs1777 = "/tmp ${localstatedir}/volatile/tmp"
+dirs1777 = "/tmp ${localstatedir}/${@bb.utils.contains('FILESYSTEM_PERMS_TABLES', 'files/fs-perms-volatile-tmp.txt', 'volatile/', '', d)}tmp"
 dirs2775 = ""
 dirs555 = "/sys /proc"
 dirs755 = "/boot /dev ${base_bindir} ${base_sbindir} ${base_libdir} \
@@ -43,7 +43,7 @@ dirs755 = "/boot /dev ${base_bindir} ${base_sbindir} ${base_libdir} \
            ${localstatedir}/backups ${localstatedir}/lib \
            ${localstatedir}/lib/misc ${localstatedir}/spool \
            ${localstatedir}/volatile \
-           ${localstatedir}/${@'volatile/' if oe.types.boolean('${VOLATILE_LOG_DIR}') else ''}log \
+           ${localstatedir}/${@bb.utils.contains('FILESYSTEM_PERMS_TABLES', 'files/fs-perms-volatile-log.txt', 'volatile/', '', d)}log \
            /home ${prefix}/src ${localstatedir}/local \
            /media"
 
@@ -54,7 +54,8 @@ dirs755-lsb = "/srv  \
                ${prefix}/lib/locale"
 dirs2775-lsb = "/var/mail"
 
-volatiles = "${@'log' if oe.types.boolean('${VOLATILE_LOG_DIR}') else ''} tmp"
+volatiles = "${@bb.utils.contains('FILESYSTEM_PERMS_TABLES', 'files/fs-perms-volatile-log.txt', 'log', '', d)} \
+             ${@bb.utils.contains('FILESYSTEM_PERMS_TABLES', 'files/fs-perms-volatile-tmp.txt', 'tmp', '', d)}"
 conffiles = "${sysconfdir}/debian_version ${sysconfdir}/host.conf \
              ${sysconfdir}/issue /${sysconfdir}/issue.net \
              ${sysconfdir}/nsswitch.conf ${sysconfdir}/profile \
@@ -70,29 +71,6 @@ hostname = "${MACHINE}"
 
 BASEFILESISSUEINSTALL ?= "do_install_basefilesissue"
 
-# In previous versions of base-files, /run was a softlink to /var/run and the
-# directory was located in /var/volatlie/run.  Also, /var/lock was a softlink
-# to /var/volatile/lock which is where the real directory was located.  Now,
-# /run and /run/lock are the real directories.  If we are upgrading, we may
-# need to remove the symbolic links first before we create the directories.
-# Otherwise the directory creation will fail and we will have circular symbolic
-# links.
-# 
-pkg_preinst:${PN} () {
-    #!/bin/sh -e
-    if [ x"$D" = "x" ]; then
-        if [ -h "/var/lock" ]; then
-            # Remove the symbolic link
-            rm -f /var/lock
-        fi
-
-        if [ -h "/run" ]; then
-            # Remove the symbolic link
-            rm -f /run
-        fi
-    fi     
-}
-
 do_install () {
         for d in ${dirs555}; do
                 install -m 0555 -d ${D}$d
@@ -113,23 +91,23 @@ do_install () {
         ln -snf ../run ${D}${localstatedir}/run
         ln -snf ../run/lock ${D}${localstatedir}/lock
 
-        install -m 0644 ${WORKDIR}/hosts ${D}${sysconfdir}/hosts
+        install -m 0644 ${S}/hosts ${D}${sysconfdir}/hosts
         ${BASEFILESISSUEINSTALL}
 
-        rotation=`cat ${WORKDIR}/rotation`
+        rotation=`cat ${S}/rotation`
         if [ "$rotation" != "0" ]; then
-                install -m 0644 ${WORKDIR}/rotation ${D}${sysconfdir}/rotation
+                install -m 0644 ${S}/rotation ${D}${sysconfdir}/rotation
         fi
 
-        install -m 0644 ${WORKDIR}/fstab ${D}${sysconfdir}/fstab
-        install -m 0644 ${WORKDIR}/profile ${D}${sysconfdir}/profile
+        install -m 0644 ${S}/fstab ${D}${sysconfdir}/fstab
+        install -m 0644 ${S}/profile ${D}${sysconfdir}/profile
         sed -i 's#ROOTHOME#${ROOT_HOME}#' ${D}${sysconfdir}/profile
         sed -i 's#@BINDIR@#${bindir}#g' ${D}${sysconfdir}/profile
-        install -m 0644 ${WORKDIR}/shells ${D}${sysconfdir}/shells
-        install -m 0755 ${WORKDIR}/share/dot.profile ${D}${sysconfdir}/skel/.profile
-        install -m 0755 ${WORKDIR}/share/dot.bashrc ${D}${sysconfdir}/skel/.bashrc
-        install -m 0644 ${WORKDIR}/host.conf ${D}${sysconfdir}/host.conf
-        install -m 0644 ${WORKDIR}/motd ${D}${sysconfdir}/motd
+        install -m 0644 ${S}/shells ${D}${sysconfdir}/shells
+        install -m 0755 ${S}/share/dot.profile ${D}${sysconfdir}/skel/.profile
+        install -m 0755 ${S}/share/dot.bashrc ${D}${sysconfdir}/skel/.bashrc
+        install -m 0644 ${S}/host.conf ${D}${sysconfdir}/host.conf
+        install -m 0644 ${S}/motd ${D}${sysconfdir}/motd
 
         ln -sf /proc/mounts ${D}${sysconfdir}/mtab
 
@@ -145,12 +123,12 @@ do_install () {
 }
 
 do_install:append:libc-glibc () {
-        install -m 0644 ${WORKDIR}/nsswitch.conf ${D}${sysconfdir}/nsswitch.conf
+        install -m 0644 ${S}/${@bb.utils.contains('DISTRO_FEATURES', 'systemd systemd-resolved', 'nsswitch-resolved.conf', 'nsswitch.conf', d)} ${D}${sysconfdir}/nsswitch.conf
 }
 
 DISTRO_VERSION[vardepsexclude] += "DATE"
 do_install_basefilesissue () {
-        install -m 644 ${WORKDIR}/issue*  ${D}${sysconfdir}
+        install -m 644 ${S}/issue*  ${D}${sysconfdir}
         if [ -n "${DISTRO_NAME}" ]; then
                 printf "${DISTRO_NAME} " >> ${D}${sysconfdir}/issue
                 printf "${DISTRO_NAME} " >> ${D}${sysconfdir}/issue.net
diff --git a/meta/recipes-core/base-passwd/base-passwd/0001-Add-a-shutdown-group.patch b/meta/recipes-core/base-passwd/base-passwd/0001-Add-a-shutdown-group.patch
index e50efc9623..4bb0634a00 100644
--- a/meta/recipes-core/base-passwd/base-passwd/0001-Add-a-shutdown-group.patch
+++ b/meta/recipes-core/base-passwd/base-passwd/0001-Add-a-shutdown-group.patch
@@ -1,4 +1,4 @@
-From 8f3ace87df3aaad85946c22cae240532ea3e73b8 Mon Sep 17 00:00:00 2001
+From caf4344849c67e939689bc7d57a6f5dc24884937 Mon Sep 17 00:00:00 2001
 From: Saul Wold <sgw@linux.intel.com>
 Date: Fri, 29 Apr 2022 13:32:27 +0000
 Subject: [PATCH] Add a shutdown group
@@ -14,10 +14,10 @@ Signed-off-by: Saul Wold <sgw@linux.intel.com>
  1 file changed, 1 insertion(+)
 
 diff --git a/group.master b/group.master
-index ad1dd2d..1b5e2fb 100644
+index 3e7bf1c..72108a8 100644
 --- a/group.master
 +++ b/group.master
-@@ -35,5 +35,6 @@ sasl:*:45:
+@@ -34,5 +34,6 @@ sasl:*:45:
  plugdev:*:46:
  staff:*:50:
  games:*:60:
diff --git a/meta/recipes-core/base-passwd/base-passwd/0001-base-passwd-Add-the-sgx-group.patch b/meta/recipes-core/base-passwd/base-passwd/0001-base-passwd-Add-the-sgx-group.patch
index e1340e1b70..714c5b40fc 100644
--- a/meta/recipes-core/base-passwd/base-passwd/0001-base-passwd-Add-the-sgx-group.patch
+++ b/meta/recipes-core/base-passwd/base-passwd/0001-base-passwd-Add-the-sgx-group.patch
@@ -1,4 +1,4 @@
-From 9e57771d138ac423d5139b984b8c869122ce4976 Mon Sep 17 00:00:00 2001
+From 2ac953ddd31dae19568cc7925d9d56444e3232a7 Mon Sep 17 00:00:00 2001
 From: Alex Kiernan <alexk@zuma.ai>
 Date: Fri, 28 Jul 2023 10:28:57 +0100
 Subject: [PATCH] base-passwd: Add the sgx group
@@ -17,7 +17,7 @@ Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
  1 file changed, 1 insertion(+)
 
 diff --git a/group.master b/group.master
-index d34d2b832d43..e54fd1d2c6dc 100644
+index d34d2b8..e54fd1d 100644
 --- a/group.master
 +++ b/group.master
 @@ -34,6 +34,7 @@ video:*:44:
diff --git a/meta/recipes-core/base-passwd/base-passwd/0002-Use-bin-sh-instead-of-bin-bash-for-the-root-user.patch b/meta/recipes-core/base-passwd/base-passwd/0002-Use-bin-sh-instead-of-bin-bash-for-the-root-user.patch
index 09f8cfea9c..6cac38eada 100644
--- a/meta/recipes-core/base-passwd/base-passwd/0002-Use-bin-sh-instead-of-bin-bash-for-the-root-user.patch
+++ b/meta/recipes-core/base-passwd/base-passwd/0002-Use-bin-sh-instead-of-bin-bash-for-the-root-user.patch
@@ -1,4 +1,4 @@
-From 4411fc0df77566d52bee11ec0bad4be30a96e99e Mon Sep 17 00:00:00 2001
+From dffeea1a44064c11d9035be008db8c628b93c7ab Mon Sep 17 00:00:00 2001
 From: Scott Garman <scott.a.garman@intel.com>
 Date: Fri, 29 Apr 2022 13:32:27 +0000
 Subject: [PATCH] Use /bin/sh instead of /bin/bash for the root user
@@ -12,7 +12,7 @@ Signed-off-by: Scott Garman <scott.a.garman@intel.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/passwd.master b/passwd.master
-index 7cd4e24..041685a 100644
+index 90514a5..bd3efc2 100644
 --- a/passwd.master
 +++ b/passwd.master
 @@ -1,4 +1,4 @@
diff --git a/meta/recipes-core/base-passwd/base-passwd/0003-Remove-for-root-since-we-do-not-have-an-etc-shadow.patch b/meta/recipes-core/base-passwd/base-passwd/0003-Remove-for-root-since-we-do-not-have-an-etc-shadow.patch
index 06222ab04c..7c3642fcc9 100644
--- a/meta/recipes-core/base-passwd/base-passwd/0003-Remove-for-root-since-we-do-not-have-an-etc-shadow.patch
+++ b/meta/recipes-core/base-passwd/base-passwd/0003-Remove-for-root-since-we-do-not-have-an-etc-shadow.patch
@@ -1,4 +1,4 @@
-From 13a1a284a134d18a454625a5b4485c0d99079ae9 Mon Sep 17 00:00:00 2001
+From 8a79e64654eb4ee38a7971cf99ad37df7f5dee63 Mon Sep 17 00:00:00 2001
 From: Scott Garman <scott.a.garman@intel.com>
 Date: Fri, 29 Apr 2022 13:32:28 +0000
 Subject: [PATCH] Remove "*" for root since we do not have an /etc/shadow
@@ -10,7 +10,7 @@ Signed-off-by: Scott Garman <scott.a.garman@intel.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/passwd.master b/passwd.master
-index 041685a..31a84d4 100644
+index bd3efc2..66e9033 100644
 --- a/passwd.master
 +++ b/passwd.master
 @@ -1,4 +1,4 @@
diff --git a/meta/recipes-core/base-passwd/base-passwd/0004-Add-an-input-group-for-the-dev-input-devices.patch b/meta/recipes-core/base-passwd/base-passwd/0004-Add-an-input-group-for-the-dev-input-devices.patch
index 394a0f01d3..4fdbc47b6e 100644
--- a/meta/recipes-core/base-passwd/base-passwd/0004-Add-an-input-group-for-the-dev-input-devices.patch
+++ b/meta/recipes-core/base-passwd/base-passwd/0004-Add-an-input-group-for-the-dev-input-devices.patch
@@ -1,4 +1,4 @@
-From c5f012750f8102ff54af73ccc2d2b7bfa1f26db4 Mon Sep 17 00:00:00 2001
+From 2d02a1e4e3202691e2ddc11f80565d5fa53d532f Mon Sep 17 00:00:00 2001
 From: Darren Hart <dvhart@linux.intel.com>
 Date: Fri, 29 Apr 2022 13:32:28 +0000
 Subject: [PATCH] Add an input group for the /dev/input/* devices
@@ -10,7 +10,7 @@ Signed-off-by: Darren Hart <dvhart@linux.intel.com>
  1 file changed, 1 insertion(+)
 
 diff --git a/group.master b/group.master
-index 1b5e2fb..cea9d60 100644
+index 72108a8..7d794b2 100644
 --- a/group.master
 +++ b/group.master
 @@ -12,6 +12,7 @@ uucp:*:10:
diff --git a/meta/recipes-core/base-passwd/base-passwd/0005-Add-kvm-group.patch b/meta/recipes-core/base-passwd/base-passwd/0005-Add-kvm-group.patch
index 72e6ee333c..742d696a24 100644
--- a/meta/recipes-core/base-passwd/base-passwd/0005-Add-kvm-group.patch
+++ b/meta/recipes-core/base-passwd/base-passwd/0005-Add-kvm-group.patch
@@ -1,4 +1,4 @@
-From 6cf19461fb31d7a7a3010629aae9aab49c26a01b Mon Sep 17 00:00:00 2001
+From 3f25f39802657de55f41fa4d5773f1d1c2bdbd93 Mon Sep 17 00:00:00 2001
 From: Jacob Kroon <jacob.kroon@gmail.com>
 Date: Wed, 30 Jan 2019 04:53:48 +0000
 Subject: [PATCH] Add kvm group
@@ -10,10 +10,10 @@ Signed-off-by: Jacob Kroon <jacob.kroon@gmail.com>
  1 file changed, 1 insertion(+)
 
 diff --git a/group.master b/group.master
-index cea9d60..5b62284 100644
+index 7d794b2..7fdd8bf 100644
 --- a/group.master
 +++ b/group.master
-@@ -34,6 +34,7 @@ utmp:*:43:
+@@ -33,6 +33,7 @@ utmp:*:43:
  video:*:44:
  sasl:*:45:
  plugdev:*:46:
diff --git a/meta/recipes-core/base-passwd/base-passwd/0007-Add-wheel-group.patch b/meta/recipes-core/base-passwd/base-passwd/0007-Add-wheel-group.patch
index d77122789d..00eff1b724 100644
--- a/meta/recipes-core/base-passwd/base-passwd/0007-Add-wheel-group.patch
+++ b/meta/recipes-core/base-passwd/base-passwd/0007-Add-wheel-group.patch
@@ -1,3 +1,7 @@
+From 4980807167a5b7c4d9c91e2af6de61efff548868 Mon Sep 17 00:00:00 2001
+From: Louis Rannou <lrannou@baylibre.com>
+Date: Thu, 15 Jun 2023 13:43:55 +0200
+Subject: [PATCH] base-passwd: add the wheel group
 
 We need to have a wheel group which has some system privileges to consult the
 systemd journal or manage printers with cups.
@@ -7,11 +11,15 @@ Upstream says the group does not exist by default.
 Upstream-Status: Inappropriate [enable feature]
 
 Signed-off-by: Louis Rannou <lrannou@baylibre.com>
-Index: base-passwd-3.5.26/group.master
-===================================================================
---- base-passwd-3.5.29.orig/group.master
-+++ base-passwd-3.5.29/group.master
-@@ -38,5 +38,6 @@
+---
+ group.master | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/group.master b/group.master
+index 7fdd8bf..d34d2b8 100644
+--- a/group.master
++++ b/group.master
+@@ -37,5 +37,6 @@ kvm:*:47:
  staff:*:50:
  games:*:60:
  shutdown:*:70:
diff --git a/meta/recipes-core/base-passwd/base-passwd_3.6.3.bb b/meta/recipes-core/base-passwd/base-passwd_3.6.7.bb
index bf50b01fd5..177927d674 100644
--- a/meta/recipes-core/base-passwd/base-passwd_3.6.3.bb
+++ b/meta/recipes-core/base-passwd/base-passwd_3.6.7.bb
@@ -15,13 +15,13 @@ SRC_URI = "https://launchpad.net/debian/+archive/primary/+files/${BPN}_${PV}.tar
            file://0001-base-passwd-Add-the-sgx-group.patch \
            "
 
-SRC_URI[sha256sum] = "83575327d8318a419caf2d543341215c046044073d1afec2acc0ac4d8095ff39"
+SRC_URI[sha256sum] = "cf869870fed7862b57bfa9e99cd5cd6f365e2349705a1b65af7fc182629bd1ab"
 
 # the package is taken from launchpad; that source is static and goes stale
 # so we check the latest upstream from a directory that does get updated
 UPSTREAM_CHECK_URI = "${DEBIAN_MIRROR}/main/b/base-passwd/"
 
-S = "${WORKDIR}/work"
+S = "${UNPACKDIR}/work"
 
 PACKAGECONFIG = "${@bb.utils.filter('DISTRO_FEATURES', 'selinux', d)}"
 PACKAGECONFIG[selinux] = "--enable-selinux, --disable-selinux, libselinux"
diff --git a/meta/recipes-core/busybox/busybox-inittab_1.36.1.bb b/meta/recipes-core/busybox/busybox-inittab_1.37.0.bb
index 6904a91930..8b46b5763e 100644
--- a/meta/recipes-core/busybox/busybox-inittab_1.36.1.bb
+++ b/meta/recipes-core/busybox/busybox-inittab_1.37.0.bb
@@ -4,7 +4,7 @@ LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/GPL-2.0-only;m
 
 SRC_URI = "file://inittab"
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 INHIBIT_DEFAULT_DEPS = "1"
 
@@ -14,7 +14,7 @@ do_compile() {
 
 do_install() {
         install -d ${D}${sysconfdir}
-        install -D -m 0644 ${WORKDIR}/inittab ${D}${sysconfdir}/inittab
+        install -D -m 0644 ${S}/inittab ${D}${sysconfdir}/inittab
 
     CONSOLES="${SERIAL_CONSOLES}"
     for s in $CONSOLES
@@ -48,7 +48,6 @@ EOF
 
 }
 
-
 # SERIAL_CONSOLES is generally defined by the MACHINE .conf.
 # Set PACKAGE_ARCH appropriately.
 PACKAGE_ARCH = "${MACHINE_ARCH}"
diff --git a/meta/recipes-core/busybox/busybox.inc b/meta/recipes-core/busybox/busybox.inc
index f5d7c3f9c8..4ebaeb92c9 100644
--- a/meta/recipes-core/busybox/busybox.inc
+++ b/meta/recipes-core/busybox/busybox.inc
@@ -7,7 +7,7 @@ DEPENDS += "kern-tools-native virtual/crypt"
 
 # bzip2 applet in busybox is based on lightly-modified bzip2-1.0.4 source
 # the GPL is version 2 only
-LICENSE = "GPL-2.0-only & bzip2-1.0.4"
+LICENSE = "GPL-2.0-only & bzip2-1.0.6"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=de10de48642ab74318e893a61105afbb \
                     file://archival/libarchive/bz/LICENSE;md5=28e3301eae987e8cfe19988e98383dae"
 
@@ -16,6 +16,7 @@ SECTION = "base"
 # Whether to split the suid apps into a seperate binary
 BUSYBOX_SPLIT_SUID ?= "1"
 
+CFLAGS:append:toolchain-clang = " -DBB_GLOBAL_CONST=''"
 export EXTRA_CFLAGS = "${CFLAGS}"
 export EXTRA_LDFLAGS = "${LDFLAGS}"
 
@@ -24,7 +25,14 @@ EXTRA_OEMAKE = "CC='${CC}' LD='${CCLD}' V=1 ARCH=${TARGET_ARCH} CROSS_COMPILE=${
 PACKAGES =+ "${PN}-httpd ${PN}-udhcpd ${PN}-udhcpc ${PN}-syslog ${PN}-mdev ${PN}-hwclock"
 
 FILES:${PN}-httpd = "${sysconfdir}/init.d/busybox-httpd /srv/www"
-FILES:${PN}-syslog = "${sysconfdir}/init.d/syslog* ${sysconfdir}/syslog-startup.conf* ${sysconfdir}/syslog.conf* ${systemd_system_unitdir}/syslog.service ${sysconfdir}/default/busybox-syslog"
+FILES:${PN}-syslog = "\
+    ${sysconfdir}/init.d/syslog* \
+    ${sysconfdir}/syslog-startup.conf* \
+    ${sysconfdir}/syslog.conf* \
+    ${systemd_system_unitdir}/syslog.service \
+    ${systemd_system_unitdir}/busybox-klogd.service \
+    ${sysconfdir}/default/busybox-syslog \
+"
 FILES:${PN}-mdev = "${sysconfdir}/init.d/mdev ${sysconfdir}/mdev.conf ${sysconfdir}/mdev/*"
 FILES:${PN}-udhcpd = "${sysconfdir}/init.d/busybox-udhcpd"
 FILES:${PN}-udhcpc = "${sysconfdir}/udhcpc.d ${datadir}/udhcpc"
@@ -114,7 +122,7 @@ do_prepare_config () {
         export KCONFIG_NOTIMESTAMP=1
 
         sed -e '/CONFIG_STATIC/d' \
-                < ${WORKDIR}/defconfig > ${S}/.config
+                < ${UNPACKDIR}/defconfig > ${S}/.config
         echo "# CONFIG_STATIC is not set" >> .config
         for i in 'CROSS' 'DISTRO FEATURES'; do echo "### $i"; done >> \
                 ${S}/.config
@@ -215,10 +223,14 @@ do_install () {
         sed -i "s:^/usr/bin/:BINDIR/:" busybox.links*
         sed -i "s:^/usr/sbin/:SBINDIR/:" busybox.links*
 
-        # Move arch/link to BINDIR to match coreutils
+        # Move arch/base32/link to BINDIR to match coreutils
         sed -i "s:^BASE_BINDIR/arch:BINDIR/arch:" busybox.links*
+        sed -i "s:^BASE_BINDIR/base32:BINDIR/base32:" busybox.links*
         sed -i "s:^BASE_BINDIR/link:BINDIR/link:" busybox.links*
 
+        # Move start-stop-daemon to SBINDIR to match dpkg
+        sed -i "s:^BASE_SBINDIR/start-stop-daemon:SBINDIR/start-stop-daemon:" busybox.links*
+
         sed -i "s:^BASE_BINDIR/:${base_bindir}/:" busybox.links*
         sed -i "s:^BASE_SBINDIR/:${base_sbindir}/:" busybox.links*
         sed -i "s:^BINDIR/:${bindir}/:" busybox.links*
@@ -280,67 +292,67 @@ do_install () {
         fi
 
         if grep -q "CONFIG_SYSLOGD=y" ${B}/.config; then
-                install -m 0755 ${WORKDIR}/syslog ${D}${sysconfdir}/init.d/syslog
-                install -m 644 ${WORKDIR}/syslog-startup.conf ${D}${sysconfdir}/syslog-startup.conf
-                install -m 644 ${WORKDIR}/syslog.conf ${D}${sysconfdir}/syslog.conf
+                install -m 0755 ${UNPACKDIR}/syslog ${D}${sysconfdir}/init.d/syslog
+                install -m 644 ${UNPACKDIR}/syslog-startup.conf ${D}${sysconfdir}/syslog-startup.conf
+                install -m 644 ${UNPACKDIR}/syslog.conf ${D}${sysconfdir}/syslog.conf
         fi
         if grep -q "CONFIG_CROND=y" ${B}/.config; then
-                install -m 0755 ${WORKDIR}/busybox-cron ${D}${sysconfdir}/init.d/
+                install -m 0755 ${UNPACKDIR}/busybox-cron ${D}${sysconfdir}/init.d/
         fi
         if grep -q "CONFIG_HTTPD=y" ${B}/.config; then
-                install -m 0755 ${WORKDIR}/busybox-httpd ${D}${sysconfdir}/init.d/
+                install -m 0755 ${UNPACKDIR}/busybox-httpd ${D}${sysconfdir}/init.d/
                 install -d ${D}/srv/www
         fi
         if grep -q "CONFIG_UDHCPD=y" ${B}/.config; then
-                install -m 0755 ${WORKDIR}/busybox-udhcpd ${D}${sysconfdir}/init.d/
+                install -m 0755 ${UNPACKDIR}/busybox-udhcpd ${D}${sysconfdir}/init.d/
         fi
         if grep -q "CONFIG_HWCLOCK=y" ${B}/.config; then
-                install -m 0755 ${WORKDIR}/hwclock.sh ${D}${sysconfdir}/init.d/
+                install -m 0755 ${UNPACKDIR}/hwclock.sh ${D}${sysconfdir}/init.d/
         fi
         if grep -q "CONFIG_UDHCPC=y" ${B}/.config; then
                 install -d ${D}${sysconfdir}/udhcpc.d
                 install -d ${D}${datadir}/udhcpc
-                install -m 0755 ${WORKDIR}/simple.script ${D}${sysconfdir}/udhcpc.d/50default
+                install -m 0755 ${UNPACKDIR}/simple.script ${D}${sysconfdir}/udhcpc.d/50default
                 sed -i "s:/SBIN_DIR/:${base_sbindir}/:" ${D}${sysconfdir}/udhcpc.d/50default
-                install -m 0755 ${WORKDIR}/default.script ${D}${datadir}/udhcpc/default.script
+                install -m 0755 ${UNPACKDIR}/default.script ${D}${datadir}/udhcpc/default.script
         fi
         if grep -q "CONFIG_INETD=y" ${B}/.config; then
-                install -m 0755 ${WORKDIR}/inetd ${D}${sysconfdir}/init.d/inetd.${BPN}
+                install -m 0755 ${UNPACKDIR}/inetd ${D}${sysconfdir}/init.d/inetd.${BPN}
                 sed -i "s:/usr/sbin/:${sbindir}/:" ${D}${sysconfdir}/init.d/inetd.${BPN}
-                install -m 0644 ${WORKDIR}/inetd.conf ${D}${sysconfdir}/
+                install -m 0644 ${UNPACKDIR}/inetd.conf ${D}${sysconfdir}/
         fi
         if grep -q "CONFIG_MDEV=y" ${B}/.config; then
-                install -m 0755 ${WORKDIR}/mdev ${D}${sysconfdir}/init.d/mdev
+                install -m 0755 ${UNPACKDIR}/mdev ${D}${sysconfdir}/init.d/mdev
                 if grep "CONFIG_FEATURE_MDEV_CONF=y" ${B}/.config; then
-                        install -m 644 ${WORKDIR}/mdev.conf ${D}${sysconfdir}/mdev.conf
+                        install -m 644 ${UNPACKDIR}/mdev.conf ${D}${sysconfdir}/mdev.conf
                         install -d ${D}${sysconfdir}/mdev
-                        install -m 0755 ${WORKDIR}/find-touchscreen.sh ${D}${sysconfdir}/mdev
-                        install -m 0755 ${WORKDIR}/mdev-mount.sh ${D}${sysconfdir}/mdev
+                        install -m 0755 ${UNPACKDIR}/find-touchscreen.sh ${D}${sysconfdir}/mdev
+                        install -m 0755 ${UNPACKDIR}/mdev-mount.sh ${D}${sysconfdir}/mdev
                 fi
         fi
         if grep -q "CONFIG_INIT=y" ${B}/.config && ${@bb.utils.contains('VIRTUAL-RUNTIME_init_manager','busybox','true','false',d)}; then
-                install -D -m 0755 ${WORKDIR}/rcS ${D}${sysconfdir}/init.d/rcS
-                install -D -m 0755 ${WORKDIR}/rcK ${D}${sysconfdir}/init.d/rcK
-                install -D -m 0755 ${WORKDIR}/rcS.default ${D}${sysconfdir}/default/rcS
+                install -D -m 0755 ${UNPACKDIR}/rcS ${D}${sysconfdir}/init.d/rcS
+                install -D -m 0755 ${UNPACKDIR}/rcK ${D}${sysconfdir}/init.d/rcK
+                install -D -m 0755 ${UNPACKDIR}/rcS.default ${D}${sysconfdir}/default/rcS
         fi
 
         if ${@bb.utils.contains('DISTRO_FEATURES','systemd','true','false',d)}; then
                 if grep -q "CONFIG_KLOGD=y" ${B}/.config; then
                         install -d ${D}${systemd_system_unitdir}
-                        sed 's,@base_sbindir@,${base_sbindir},g' < ${WORKDIR}/busybox-klogd.service.in \
+                        sed 's,@base_sbindir@,${base_sbindir},g' < ${UNPACKDIR}/busybox-klogd.service.in \
                         > ${D}${systemd_system_unitdir}/busybox-klogd.service
                 fi
 
                 if grep -q "CONFIG_SYSLOGD=y" ${B}/.config; then
                         install -d ${D}${systemd_system_unitdir}
-                        sed 's,@base_sbindir@,${base_sbindir},g' < ${WORKDIR}/busybox-syslog.service.in \
+                        sed 's,@base_sbindir@,${base_sbindir},g' < ${UNPACKDIR}/busybox-syslog.service.in \
                         > ${D}${systemd_system_unitdir}/busybox-syslog.service
                         if  [ ! -e ${D}${systemd_system_unitdir}/busybox-klogd.service ] ; then
                                 sed -i '/klog/d' ${D}${systemd_system_unitdir}/busybox-syslog.service
                         fi
-                        if [ -f ${WORKDIR}/busybox-syslog.default ] ; then
+                        if [ -f ${UNPACKDIR}/busybox-syslog.default ] ; then
                                 install -d ${D}${sysconfdir}/default
-                                install -m 0644 ${WORKDIR}/busybox-syslog.default ${D}${sysconfdir}/default/busybox-syslog
+                                install -m 0644 ${UNPACKDIR}/busybox-syslog.default ${D}${sysconfdir}/default/busybox-syslog
                         fi
                 fi
         fi
diff --git a/meta/recipes-core/busybox/busybox/0001-archival-disallow-path-traversals-CVE-2023-39810.patch b/meta/recipes-core/busybox/busybox/0001-archival-disallow-path-traversals-CVE-2023-39810.patch
new file mode 100644
index 0000000000..e76a4b128e
--- /dev/null
+++ b/meta/recipes-core/busybox/busybox/0001-archival-disallow-path-traversals-CVE-2023-39810.patch
@@ -0,0 +1,141 @@
+From 42ce7953f48e5542297ff4381086b45ae28a02cf Mon Sep 17 00:00:00 2001
+From: Denys Vlasenko <vda.linux@googlemail.com>
+Date: Wed, 2 Oct 2024 10:12:05 +0200
+Subject: [PATCH] archival: disallow path traversals (CVE-2023-39810)
+
+Create new configure option for archival/libarchive based extractions to
+disallow path traversals.
+As this is a paranoid option and might introduce backward
+incompatibility, default it to no.
+
+Fixes: CVE-2023-39810
+
+Based on the patch by Peter Kaestle <peter.kaestle@nokia.com>
+
+function                                             old     new   delta
+data_extract_all                                     921     945     +24
+strip_unsafe_prefix                                  101     102      +1
+------------------------------------------------------------------------------
+(add/remove: 0/0 grow/shrink: 2/0 up/down: 25/0)               Total: 25 bytes
+
+Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
+
+CVE: CVE-2023-39810
+
+Upstream-Status: Backport [https://git.busybox.net/busybox/commit/?id=9a8796436b9b0641e13480811902ea2ac57881d3]
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+---
+ archival/Config.src                        | 11 +++++++++++
+ archival/libarchive/data_extract_all.c     |  8 ++++++++
+ archival/libarchive/unsafe_prefix.c        |  6 +++++-
+ scripts/kconfig/lxdialog/check-lxdialog.sh |  2 +-
+ testsuite/cpio.tests                       | 23 ++++++++++++++++++++++
+ 5 files changed, 48 insertions(+), 2 deletions(-)
+
+diff --git a/archival/Config.src b/archival/Config.src
+index 6f4f30c43..cbcd7217c 100644
+--- a/archival/Config.src
++++ b/archival/Config.src
+@@ -35,4 +35,15 @@ config FEATURE_LZMA_FAST
+        This option reduces decompression time by about 25% at the cost of
+        a 1K bigger binary.
+ 
++config FEATURE_PATH_TRAVERSAL_PROTECTION
++       bool "Prevent extraction of filenames with /../ path component"
++       default n
++       help
++       busybox tar and unzip remove "PREFIX/../" (if it exists)
++       from extracted names.
++       This option enables this behavior for all other unpacking applets,
++       such as cpio, ar, rpm.
++       GNU cpio 2.15 has NO such sanity check.
++# try other archivers and document their behavior?
++
+ endmenu
+diff --git a/archival/libarchive/data_extract_all.c b/archival/libarchive/data_extract_all.c
+index 049c2c156..8a69711c1 100644
+--- a/archival/libarchive/data_extract_all.c
++++ b/archival/libarchive/data_extract_all.c
+@@ -65,6 +65,14 @@ void FAST_FUNC data_extract_all(archive_handle_t *archive_handle)
+                } while (--n != 0);
+        }
+ #endif
++#if ENABLE_FEATURE_PATH_TRAVERSAL_PROTECTION
++       /* Strip leading "/" and up to last "/../" path component */
++       dst_name = (char *)strip_unsafe_prefix(dst_name);
++#endif
++// ^^^ This may be a problem if some applets do need to extract absolute names.
++// (Probably will need to invent ARCHIVE_ALLOW_UNSAFE_NAME flag).
++// You might think that rpm needs it, but in my tests rpm's internal cpio
++// archive has names like "./usr/bin/FOO", not "/usr/bin/FOO".
+ 
+        if (archive_handle->ah_flags & ARCHIVE_CREATE_LEADING_DIRS) {
+                char *slash = strrchr(dst_name, '/');
+diff --git a/archival/libarchive/unsafe_prefix.c b/archival/libarchive/unsafe_prefix.c
+index 33e487bf9..667081195 100644
+--- a/archival/libarchive/unsafe_prefix.c
++++ b/archival/libarchive/unsafe_prefix.c
+@@ -14,7 +14,11 @@ const char* FAST_FUNC strip_unsafe_prefix(const char *str)
+                        cp++;
+                        continue;
+                }
+-               if (is_prefixed_with(cp, "/../"+1)) {
++               /* We are called lots of times.
++                * is_prefixed_with(cp, "../") is slower than open-coding it,
++                * with minimal code growth (~few bytes).
++                */
++               if (cp[0] == '.' && cp[1] == '.' && cp[2] == '/') {
+                        cp += 3;
+                        continue;
+                }
+diff --git a/scripts/kconfig/lxdialog/check-lxdialog.sh b/scripts/kconfig/lxdialog/check-lxdialog.sh
+index 7003e026a..b91a54be6 100755
+--- a/scripts/kconfig/lxdialog/check-lxdialog.sh
++++ b/scripts/kconfig/lxdialog/check-lxdialog.sh
+@@ -55,7 +55,7 @@ trap "rm -f $tmp" 0 1 2 3 15
+ check() {
+         $cc -x c - -o $tmp 2>/dev/null <<'EOF'
+ #include CURSES_LOC
+-main() {}
++int main() { return 0; }
+ EOF
+        if [ $? != 0 ]; then
+            echo " *** Unable to find the ncurses libraries or the"       1>&2
+diff --git a/testsuite/cpio.tests b/testsuite/cpio.tests
+index 85e746589..a4462c53e 100755
+--- a/testsuite/cpio.tests
++++ b/testsuite/cpio.tests
+@@ -154,6 +154,29 @@ testing "cpio -R with extract" \
+ " "" ""
+ SKIP=
+ 
++# Create an archive containing a file with "../dont_write" filename.
++# See that it will not be allowed to unpack.
++# NB: GNU cpio 2.15 DOES NOT do such checks.
++optional FEATURE_PATH_TRAVERSAL_PROTECTION
++rm -rf cpio.testdir
++mkdir -p cpio.testdir/prepare/inner
++echo "file outside of destination was written" > cpio.testdir/prepare/dont_write
++echo "data" > cpio.testdir/prepare/inner/to_extract
++mkdir -p cpio.testdir/extract
++testing "cpio extract file outside of destination" "\
++(cd cpio.testdir/prepare/inner && echo -e '../dont_write\nto_extract' | cpio -o -H newc) | (cd cpio.testdir/extract && cpio -vi 2>&1)
++echo \$?
++ls cpio.testdir/dont_write 2>&1" \
++"\
++cpio: removing leading '../' from member names
++../dont_write
++to_extract
++1 blocks
++0
++ls: cpio.testdir/dont_write: No such file or directory
++" "" ""
++SKIP=
++
+ # Clean up
+ rm -rf cpio.testdir cpio.testdir2 2>/dev/null
+ 
+-- 
+2.48.1
+
diff --git a/meta/recipes-core/busybox/busybox/0001-cut-Fix-s-flag-to-omit-blank-lines.patch b/meta/recipes-core/busybox/busybox/0001-cut-Fix-s-flag-to-omit-blank-lines.patch
new file mode 100644
index 0000000000..a0a8607b23
--- /dev/null
+++ b/meta/recipes-core/busybox/busybox/0001-cut-Fix-s-flag-to-omit-blank-lines.patch
@@ -0,0 +1,66 @@
+From 199606e960942c29fd8085be812edd3d3697825c Mon Sep 17 00:00:00 2001
+From: Colin McAllister <colinmca242@gmail.com>
+Date: Wed, 17 Jul 2024 07:58:52 -0500
+Subject: [PATCH 1/1] cut: Fix "-s" flag to omit blank lines
+
+Using cut with the delimiter flag ("-d") with the "-s" flag to only
+output lines containing the delimiter will print blank lines. This is
+deviant behavior from cut provided by GNU Coreutils. Blank lines should
+be omitted if "-s" is used with "-d".
+
+This change introduces a somewhat naiive, yet efficient solution, where
+line length is checked before looping though bytes. If line length is
+zero and the "-s" flag is used, the code will jump to parsing the next
+line to avoid printing a newline character.
+
+In addition, a test to cut.tests has been added to ensure that this
+regression is fixed and will not happen again in the future.
+
+Upstream-Status: Submitted [http://lists.busybox.net/pipermail/busybox/2024-July/090834.html]
+
+Signed-off-by: Colin McAllister <colinmca242@gmail.com>
+---
+ coreutils/cut.c     | 6 ++++++
+ testsuite/cut.tests | 9 +++++++++
+ 2 files changed, 15 insertions(+)
+
+diff --git a/coreutils/cut.c b/coreutils/cut.c
+index 55bdd9386..b7f986f26 100644
+--- a/coreutils/cut.c
++++ b/coreutils/cut.c
+@@ -152,6 +152,12 @@ static void cut_file(FILE *file, const char *delim, const char *odelim,
+                        unsigned uu = 0, start = 0, end = 0, out = 0;
+                        int dcount = 0;
+ 
++                       /* Blank line? */
++                       if (!linelen) {
++                               if (option_mask32 & CUT_OPT_SUPPRESS_FLGS)
++                                       goto next_line;
++                       }
++
+                        /* Loop through bytes, finding next delimiter */
+                        for (;;) {
+                                /* End of current range? */
+diff --git a/testsuite/cut.tests b/testsuite/cut.tests
+index 2458c019c..0b401bc00 100755
+--- a/testsuite/cut.tests
++++ b/testsuite/cut.tests
+@@ -65,6 +65,15 @@ testing "cut with -d -f( ) -s" "cut -d' ' -f3 -s input && echo yes" "yes\n" "$in
+ testing "cut with -d -f(a) -s" "cut -da -f3 -s input" "n\nsium:Jim\n\ncion:Ed\n" "$input" ""
+ testing "cut with -d -f(a) -s -n" "cut -da -f3 -s -n input" "n\nsium:Jim\n\ncion:Ed\n" "$input" ""
+ 
++input="\
++
++foo bar baz
++
++bing bong boop
++
++"
++testing "cut with -d -s omits blank lines" "cut -d' ' -f2 -s input" "bar\nbong\n" "$input" ""
++
+ # substitute for awk
+ optional FEATURE_CUT_REGEX
+ testing "cut -DF" "cut -DF 2,7,5" \
+-- 
+2.43.0
+
diff --git a/meta/recipes-core/busybox/busybox/0001-hwclock-Check-for-SYS_settimeofday-before-calling-sy.patch b/meta/recipes-core/busybox/busybox/0001-hwclock-Check-for-SYS_settimeofday-before-calling-sy.patch
new file mode 100644
index 0000000000..11ef2b6824
--- /dev/null
+++ b/meta/recipes-core/busybox/busybox/0001-hwclock-Check-for-SYS_settimeofday-before-calling-sy.patch
@@ -0,0 +1,52 @@
+From 4e1eafc6e0de3e58cac9f62e57b552eddb50ca8e Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sun, 7 Mar 2021 17:30:24 -0800
+Subject: [PATCH] hwclock: Check for SYS_settimeofday before calling syscall
+
+Some newer architectures e.g. RISCV32 have 64bit time_t from get go and
+thusly do not have gettimeofday_time64/settimeofday_time64 implemented
+therefore check for SYS_settimeofday definition before making the
+syscall. Fixes build for riscv32 and it will bail out at runtime.
+
+This issue has been discussed on the musl mailing list, and
+the musl developers' opinion is that Busybox is wrong:
+
+https://www.openwall.com/lists/musl/2024/03/03/2
+https://www.openwall.com/lists/musl/2024/04/07/2
+
+The correct fix isn't clear, and in the mean time, the patch
+turns the build issue into a runtime error only on the problematic
+architecture (riscv32), which seems like a reasonable trade-off
+
+Upstream-Status: Submitted [http://lists.busybox.net/pipermail/busybox/2021-March/088583.html]]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ util-linux/hwclock.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/util-linux/hwclock.c b/util-linux/hwclock.c
+index c3fd0eb57..dea9c9a55 100644
+--- a/util-linux/hwclock.c
++++ b/util-linux/hwclock.c
+@@ -132,6 +132,7 @@ static void show_clock(const char **pp_rtcname, int utc)
+ 
+ static void set_kernel_tz(const struct timezone *tz)
+ {
++       int ret = 1;
+ #if LIBC_IS_MUSL
+        /* musl libc does not pass tz argument to syscall
+         * because "it's deprecated by POSIX, therefore it's fine
+@@ -140,9 +141,11 @@ static void set_kernel_tz(const struct timezone *tz)
+ #if !defined(SYS_settimeofday) && defined(SYS_settimeofday_time32)
+ # define SYS_settimeofday SYS_settimeofday_time32
+ #endif
+-       int ret = syscall(SYS_settimeofday, NULL, tz);
++#if defined(SYS_settimeofday)
++       ret = syscall(SYS_settimeofday, NULL, tz);
++#endif
+ #else
+-       int ret = settimeofday(NULL, tz);
++       ret = settimeofday(NULL, tz);
+ #endif
+        if (ret)
+                bb_simple_perror_msg_and_die("settimeofday");
diff --git a/meta/recipes-core/busybox/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch b/meta/recipes-core/busybox/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch
index 4635250170..ceb3ad7250 100644
--- a/meta/recipes-core/busybox/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch
+++ b/meta/recipes-core/busybox/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch
@@ -5,7 +5,7 @@ Subject: [PATCH 1/2] libbb: sockaddr2str: ensure only printable characters are
  returned for the hostname part
 
 CVE: CVE-2022-28391
-Upstream-Status: Pending
+Upstream-Status: Submitted [https://bugs.busybox.net/show_bug.cgi?id=15001]
 Signed-off-by: Ariadne Conill <ariadne@dereferenced.org>
 Signed-off-by: Steve Sakoman <steve@sakoman.com>
 ---
diff --git a/meta/recipes-core/busybox/busybox/0001-syslogd-fix-wrong-OPT_locallog-flag-detection.patch b/meta/recipes-core/busybox/busybox/0001-syslogd-fix-wrong-OPT_locallog-flag-detection.patch
new file mode 100644
index 0000000000..c71172a4f9
--- /dev/null
+++ b/meta/recipes-core/busybox/busybox/0001-syslogd-fix-wrong-OPT_locallog-flag-detection.patch
@@ -0,0 +1,33 @@
+From 43ec36c0e3fbfd4191b18465a0554f4c1acf58d6 Mon Sep 17 00:00:00 2001
+From: Andrej Valek <andrej.v@skyrain.eu>
+Date: Wed, 16 Oct 2024 09:09:55 +0200
+Subject: [PATCH] syslogd: fix wrong OPT_locallog flag detection
+
+The OPT_locallog was set on "option_mask32" but checked on local
+"opts" variable. While this flag it's used on multiple places can't be
+has to be used with "option_mask32". Without this change syslogd
+is more-less unusable while no messages are logged locally.
+
+Upstream-Status: Submitted [https://lists.busybox.net/pipermail/busybox/2024-October/090969.html]
+
+Signed-off-by: Andrej Valek <andrej.v@skyrain.eu>
+---
+ sysklogd/syslogd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sysklogd/syslogd.c b/sysklogd/syslogd.c
+index 7558051f0..fa03aa280 100644
+--- a/sysklogd/syslogd.c
++++ b/sysklogd/syslogd.c
+@@ -1179,7 +1179,7 @@ int syslogd_main(int argc UNUSED_PARAM, char **argv)
+                        }
+                }
+ #endif
+-               if (!ENABLE_FEATURE_REMOTE_LOG || (opts & OPT_locallog)) {
++               if (!ENABLE_FEATURE_REMOTE_LOG || (option_mask32 & OPT_locallog)) {
+                        recvbuf[sz] = '\0'; /* ensure it *is* NUL terminated */
+                        split_escape_and_log(recvbuf, sz);
+                }
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/busybox/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch b/meta/recipes-core/busybox/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch
index 0d7409ddc3..1dbc3388a4 100644
--- a/meta/recipes-core/busybox/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch
+++ b/meta/recipes-core/busybox/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch
@@ -8,7 +8,7 @@ Otherwise, terminal sequences can be injected, which enables various terminal in
 attacks from DNS results.
 
 CVE: CVE-2022-28391
-Upstream-Status: Pending
+Upstream-Status: Submitted [https://bugs.busybox.net/show_bug.cgi?id=15001]
 Signed-off-by: Ariadne Conill <ariadne@dereferenced.org>
 Signed-off-by: Steve Sakoman <steve@sakoman.com>
 ---
diff --git a/meta/recipes-core/busybox/busybox/0002-start-stop-daemon-fix-tests.patch b/meta/recipes-core/busybox/busybox/0002-start-stop-daemon-fix-tests.patch
new file mode 100644
index 0000000000..a5abec4e53
--- /dev/null
+++ b/meta/recipes-core/busybox/busybox/0002-start-stop-daemon-fix-tests.patch
@@ -0,0 +1,65 @@
+From 85fb09e278aff8f4b3e11d7ace0d1347f750487f Mon Sep 17 00:00:00 2001
+From: Andrej Valek <andrej.v@skyrain.eu>
+Date: Wed, 16 Oct 2024 10:11:01 +0200
+Subject: [PATCH] start-stop-daemon: fix tests
+
+- "/tmp" directory could be link to somewhere else, so deference it
+before comparing the expected path
+- run "start-stop-daemon with both -x and -a" test only if "/bin/false"
+is not a symlink.
+
+Upstream-Status: Submitted [https://lists.busybox.net/pipermail/busybox/2024-October/090968.html]
+
+Signed-off-by: Andrej Valek <andrej.v@skyrain.eu>
+---
+ testsuite/start-stop-daemon.tests | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/testsuite/start-stop-daemon.tests b/testsuite/start-stop-daemon.tests
+index e1e49ab5f..fd59859ef 100755
+--- a/testsuite/start-stop-daemon.tests
++++ b/testsuite/start-stop-daemon.tests
+@@ -6,24 +6,27 @@
+ 
+ # testing "test name" "cmd" "expected result" "file input" "stdin"
+ 
++# deference link to /tmp
++TMP_DIR="$(readlink -f /tmp)"
++
+ testing "start-stop-daemon -x without -a" \
+        'start-stop-daemon -S -x true 2>&1; echo $?' \
+        "0\n" \
+        "" ""
+ 
+ testing "start-stop-daemon -x with -d on existing directory" \
+-       'start-stop-daemon -S -d /tmp -x true 2>&1; echo $?' \
++       'start-stop-daemon -S -d $TMP_DIR -x true 2>&1; echo $?' \
+        "0\n" \
+        "" ""
+ 
+ testing "start-stop-daemon -x with -d on existing and check dir" \
+-       'output=$(start-stop-daemon -S -d /tmp -x pwd); echo $output' \
+-       "/tmp\n" \
++       'output=$(start-stop-daemon -S -d $TMP_DIR -x pwd); echo $output' \
++       "$TMP_DIR\n" \
+        "" ""
+ 
+ testing "start-stop-daemon -x with --chdir on existing and check dir" \
+-       'output=$(start-stop-daemon -S --chdir /tmp -x pwd); echo $output' \
+-       "/tmp\n" \
++       'output=$(start-stop-daemon -S --chdir $TMP_DIR -x pwd); echo $output' \
++       "$TMP_DIR\n" \
+        "" ""
+ 
+ testing "start-stop-daemon -a without -x" \
+@@ -48,6 +51,7 @@ testing "start-stop-daemon -x with -d on non-existing directory" \
+ #
+ # NB: this fails if /bin/false is a busybox symlink:
+ # busybox looks at argv[0] and says "qwerty: applet not found"
++test ! -L /bin/false && \
+ testing "start-stop-daemon with both -x and -a" \
+        'start-stop-daemon -S -x /bin/false -a qwerty false 2>&1; echo $?' \
+        "1\n" \
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/busybox/busybox/start-stop-false.patch b/meta/recipes-core/busybox/busybox/0003-start-stop-false.patch
index 3aef68329c..dd5f5b8e03 100644
--- a/meta/recipes-core/busybox/busybox/start-stop-false.patch
+++ b/meta/recipes-core/busybox/busybox/0003-start-stop-false.patch
@@ -9,11 +9,12 @@ diff --git a/testsuite/start-stop-daemon.tests b/testsuite/start-stop-daemon.tes
 index 0757b1288..aa6e9cc41 100755
 --- a/testsuite/start-stop-daemon.tests
 +++ b/testsuite/start-stop-daemon.tests
-@@ -27,10 +27,18 @@ testing "start-stop-daemon without -x and -a" \
+@@ -50,11 +50,18 @@ testing "start-stop-daemon without -x and -a" \
  # but at least it checks that pathname to exec() is correct
  #
  # NB: this fails if /bin/false is a busybox symlink:
 -# busybox looks at argv[0] and says "qwerty: applet not found"
+-test ! -L /bin/false && \
 -testing "start-stop-daemon with both -x and -a" \
 -       'start-stop-daemon -S -x /bin/false -a qwerty false 2>&1; echo $?' \
 -       "1\n" \
@@ -21,15 +22,15 @@ index 0757b1288..aa6e9cc41 100755
 +# busybox looks at argv[0] and says "qwerty: applet not found", so
 +# skip the test if false is busybox.
 +case $(readlink /bin/false) in
-+    *busybox*)
-+        echo "SKIPPED: start-stop-daemon with both -x and -a (need non-busybox false)"
-+        ;;
-+    *)
++       *busybox*)
++               echo "SKIPPED: start-stop-daemon with both -x and -a (need non-busybox false)"
++               ;;
++       *)
 +               testing "start-stop-daemon with both -x and -a" \
 +                       'start-stop-daemon -S -x /bin/false -a qwerty false 2>&1; echo $?' \
 +                       "1\n" \
 +                       "" ""
-+        ;;
++               ;;
 +esac
  
  exit $FAILCOUNT
diff --git a/meta/recipes-core/busybox/busybox/busybox-1.36.1-no-cbq.patch b/meta/recipes-core/busybox/busybox/busybox-1.36.1-no-cbq.patch
new file mode 100644
index 0000000000..80cbc73fc4
--- /dev/null
+++ b/meta/recipes-core/busybox/busybox/busybox-1.36.1-no-cbq.patch
@@ -0,0 +1,61 @@
+Remove CBQ functionality from tc
+
+6.8+ kernel has dropped CBQ support [1], Now that OE uses 6.9 for
+kernel-headers means we are hitting the undefined symbol
+TCA_CBQ_MAX [2]  
+
+[1] https://github.com/torvalds/linux/commit/33241dca486264193ed68167c8eeae1fb197f3df
+[2] https://bugs.busybox.net/show_bug.cgi?id=15934
+
+Upstream-Status: Submitted [https://bugs.busybox.net/show_bug.cgi?id=15931]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+
+diff -up busybox-1.36.1/networking/tc.c.no-cbq busybox-1.36.1/networking/tc.c
+--- busybox-1.36.1/networking/tc.c.no-cbq       2024-01-29 10:24:09.135082923 -0500
++++ busybox-1.36.1/networking/tc.c      2024-01-29 10:28:12.009502552 -0500
+@@ -31,7 +31,7 @@
+ //usage:       "qdisc [handle QHANDLE] [root|"IF_FEATURE_TC_INGRESS("ingress|")"parent CLASSID]\n"
+ /* //usage: "[estimator INTERVAL TIME_CONSTANT]\n" */
+ //usage:       "       [[QDISC_KIND] [help|OPTIONS]]\n"
+-//usage:       "       QDISC_KIND := [p|b]fifo|tbf|prio|cbq|red|etc.\n"
++//usage:       "       QDISC_KIND := [p|b]fifo|tbf|prio|red|etc.\n"
+ //usage:       "qdisc show [dev STRING]"IF_FEATURE_TC_INGRESS(" [ingress]")"\n"
+ //usage:       "class [classid CLASSID] [root|parent CLASSID]\n"
+ //usage:       "       [[QDISC_KIND] [help|OPTIONS] ]\n"
+@@ -230,7 +230,7 @@ static int cbq_parse_opt(int argc, char
+ {
+        return 0;
+ }
+-#endif
++
+ static int cbq_print_opt(struct rtattr *opt)
+ {
+        struct rtattr *tb[TCA_CBQ_MAX+1];
+@@ -322,6 +322,7 @@ static int cbq_print_opt(struct rtattr *
+  done:
+        return 0;
+ }
++#endif
+ 
+ static FAST_FUNC int print_qdisc(
+                const struct sockaddr_nl *who UNUSED_PARAM,
+@@ -373,7 +374,8 @@ static FAST_FUNC int print_qdisc(
+                if (qqq == 0) { /* pfifo_fast aka prio */
+                        prio_print_opt(tb[TCA_OPTIONS]);
+                } else if (qqq == 1) { /* class based queuing */
+-                       cbq_print_opt(tb[TCA_OPTIONS]);
++                       /* cbq_print_opt(tb[TCA_OPTIONS]); */
++                       printf("cbq not supported");
+                } else {
+                        /* don't know how to print options for this qdisc */
+                        printf("(options for %s)", name);
+@@ -444,7 +446,8 @@ static FAST_FUNC int print_class(
+                        /* nothing. */ /*prio_print_opt(tb[TCA_OPTIONS]);*/
+                } else if (qqq == 1) { /* class based queuing */
+                        /* cbq_print_copt() is identical to cbq_print_opt(). */
+-                       cbq_print_opt(tb[TCA_OPTIONS]);
++                       /* cbq_print_opt(tb[TCA_OPTIONS]); */
++                       printf("cbq not supported");
+                } else {
+                        /* don't know how to print options for this class */
+                        printf("(options for %s)", name);
diff --git a/meta/recipes-core/busybox/busybox/busybox-udhcpc-no_deconfig.patch b/meta/recipes-core/busybox/busybox/busybox-udhcpc-no_deconfig.patch
deleted file mode 100644
index 948932a3e8..0000000000
--- a/meta/recipes-core/busybox/busybox/busybox-udhcpc-no_deconfig.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 53626cd06a3ef05ed847daea802ef0aa9661caa7 Mon Sep 17 00:00:00 2001
-From: Anders Darander <anders@chargestorm.se>
-Date: Thu, 3 Nov 2011 08:51:31 +0100
-Subject: [PATCH] busybox-udhcpc-no_deconfig.patch
-
-Upstream-Status: Pending
-
-Add a new option -D to the udhcpc client that allows for
-dhcp renewal to occur without having to down the interface
-in the process.
-
-Signed-off-by: Greg Moffatt <greg.moffatt@windriver.com>
-
-Updated to latest Busybox 1.17.3
-
-Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
-
-Updated to Busybox 1.18.4
-option spec is changed
-
-Signed-off-by: Qing He <qing.he@intel.com>
-
-Updated to Busybox 1.19.3
-
-Signed-off-by: Anders Darander <anders@chargestorm.se>
-
-Fixed options -b, -a and -P.
-
-Signed-off-by: Andreas Oberritter <obi@opendreambox.org>
----
- networking/udhcp/dhcpc.c                       | 29 ++++++++++++++++------
- 1 file changed, 21 insertions(+), 8 deletions(-)
-
-Index: busybox-1.34.0/networking/udhcp/dhcpc.c
-===================================================================
---- busybox-1.34.0.orig/networking/udhcp/dhcpc.c
-+++ busybox-1.34.0/networking/udhcp/dhcpc.c
-@@ -48,6 +48,8 @@
- };
- #endif
- 
-+/* option whether to down the interface when reconfiguring */
-+static int allow_deconfig = 1;
- 
- /* "struct client_data_t client_data" is in bb_common_bufsiz1 */
- 
-@@ -100,8 +102,10 @@
-        OPT_x = 1 << 16,
-        OPT_f = 1 << 17,
-        OPT_B = 1 << 18,
-+       OPT_D = 1 << 19,
- /* The rest has variable bit positions, need to be clever */
-        OPTBIT_B = 18,
-+       OPTBIT_D = 19,
-        USE_FOR_MMU(             OPTBIT_b,)
-        IF_FEATURE_UDHCPC_ARPING(OPTBIT_a,)
-        IF_FEATURE_UDHCP_PORT(   OPTBIT_P,)
-@@ -587,7 +591,8 @@
- 
- static void d4_run_script_deconfig(void)
- {
--       d4_run_script(NULL, "deconfig");
-+       if (allow_deconfig)
-+               d4_run_script(NULL, "deconfig");
- }
- 
- /*** Sending/receiving packets ***/
-@@ -1244,7 +1249,7 @@
-        /* Parse command line */
-        opt = getopt32long(argv, "^"
-                /* O,x: list; -T,-t,-A take numeric param */
--               "CV:F:i:np:qRr:s:T:+t:+SA:+O:*ox:*fB"
-+               "CV:F:i:np:qRr:s:T:+t:+SA:+O:*ox:*fBD"
-                USE_FOR_MMU("b")
-                IF_FEATURE_UDHCPC_ARPING("a::")
-                IF_FEATURE_UDHCP_PORT("P:")
-@@ -1361,6 +1366,10 @@
-                logmode |= LOGMODE_SYSLOG;
-        }
- 
-+       if (opt & OPT_D) {
-+               allow_deconfig = 0;
-+       }
-+
-        /* Create pidfile */
-        write_pidfile(client_data.pidfile);
-        /* Goes to stdout (unless NOMMU) and possibly syslog */
diff --git a/meta/recipes-core/busybox/busybox/defconfig b/meta/recipes-core/busybox/busybox/defconfig
index f3d545dc3f..22c9dafcb3 100644
--- a/meta/recipes-core/busybox/busybox/defconfig
+++ b/meta/recipes-core/busybox/busybox/defconfig
@@ -1,7 +1,6 @@
 #
 # Automatically generated make config: don't edit
-# Busybox version: 1.36.0
-# Tue Jan  3 14:17:01 2023
+# Busybox version: 1.37.0
 #
 CONFIG_HAVE_DOT_CONFIG=y
 
@@ -17,6 +16,7 @@ CONFIG_SHOW_USAGE=y
 # CONFIG_FEATURE_VERBOSE_USAGE is not set
 CONFIG_FEATURE_COMPRESS_USAGE=y
 CONFIG_LFS=y
+CONFIG_TIME64=y
 # CONFIG_PAM is not set
 CONFIG_FEATURE_DEVPTS=y
 CONFIG_FEATURE_UTMP=y
@@ -93,6 +93,9 @@ CONFIG_FEATURE_BUFFERS_USE_MALLOC=y
 # CONFIG_FEATURE_BUFFERS_GO_IN_BSS is not set
 CONFIG_PASSWORD_MINLEN=6
 CONFIG_MD5_SMALL=1
+CONFIG_SHA1_SMALL=3
+CONFIG_SHA1_HWACCEL=y
+CONFIG_SHA256_HWACCEL=y
 CONFIG_SHA3_SMALL=1
 CONFIG_FEATURE_NON_POSIX_CP=y
 # CONFIG_FEATURE_VERBOSE_CP_MESSAGE is not set
@@ -113,13 +116,13 @@ CONFIG_FEATURE_EDITING_FANCY_PROMPT=y
 # CONFIG_FEATURE_EDITING_WINCH is not set
 # CONFIG_FEATURE_EDITING_ASK_TERMINAL is not set
 # CONFIG_LOCALE_SUPPORT is not set
-CONFIG_UNICODE_SUPPORT=y
+# CONFIG_UNICODE_SUPPORT is not set
 # CONFIG_UNICODE_USING_LOCALE is not set
-CONFIG_FEATURE_CHECK_UNICODE_IN_ENV=y
-CONFIG_SUBST_WCHAR=63
-CONFIG_LAST_SUPPORTED_WCHAR=767
-CONFIG_UNICODE_COMBINING_WCHARS=y
-CONFIG_UNICODE_WIDE_WCHARS=y
+# CONFIG_FEATURE_CHECK_UNICODE_IN_ENV is not set
+CONFIG_SUBST_WCHAR=0
+CONFIG_LAST_SUPPORTED_WCHAR=0
+# CONFIG_UNICODE_COMBINING_WCHARS is not set
+# CONFIG_UNICODE_WIDE_WCHARS is not set
 # CONFIG_UNICODE_BIDI_SUPPORT is not set
 # CONFIG_UNICODE_NEUTRAL_TABLE is not set
 # CONFIG_UNICODE_PRESERVE_BROKEN is not set
@@ -145,7 +148,7 @@ CONFIG_FEATURE_SEAMLESS_Z=y
 # CONFIG_UNCOMPRESS is not set
 CONFIG_GUNZIP=y
 CONFIG_ZCAT=y
-CONFIG_FEATURE_GUNZIP_LONG_OPTIONS=y
+# CONFIG_FEATURE_GUNZIP_LONG_OPTIONS is not set
 CONFIG_BUNZIP2=y
 CONFIG_BZCAT=y
 # CONFIG_UNLZMA is not set
@@ -278,8 +281,8 @@ CONFIG_FEATURE_LS_USERNAME=y
 CONFIG_FEATURE_LS_COLOR=y
 # CONFIG_FEATURE_LS_COLOR_IS_DEFAULT is not set
 CONFIG_MD5SUM=y
-CONFIG_SHA1SUM=y
-CONFIG_SHA256SUM=y
+# CONFIG_SHA1SUM is not set
+# CONFIG_SHA256SUM is not set
 # CONFIG_SHA512SUM is not set
 # CONFIG_SHA3SUM is not set
 
@@ -383,8 +386,8 @@ CONFIG_DEFAULT_SETFONT_DIR=""
 CONFIG_LOADKMAP=y
 CONFIG_OPENVT=y
 CONFIG_RESET=y
-CONFIG_RESIZE=y
-CONFIG_FEATURE_RESIZE_PRINT=y
+# CONFIG_RESIZE is not set
+# CONFIG_FEATURE_RESIZE_PRINT is not set
 CONFIG_SETCONSOLE=y
 # CONFIG_FEATURE_SETCONSOLE_LONG_OPTIONS is not set
 # CONFIG_SETKEYCODES is not set
@@ -396,10 +399,10 @@ CONFIG_SETCONSOLE=y
 #
 # CONFIG_PIPE_PROGRESS is not set
 CONFIG_RUN_PARTS=y
-CONFIG_FEATURE_RUN_PARTS_LONG_OPTIONS=y
+# CONFIG_FEATURE_RUN_PARTS_LONG_OPTIONS is not set
 # CONFIG_FEATURE_RUN_PARTS_FANCY is not set
 CONFIG_START_STOP_DAEMON=y
-CONFIG_FEATURE_START_STOP_DAEMON_LONG_OPTIONS=y
+# CONFIG_FEATURE_START_STOP_DAEMON_LONG_OPTIONS is not set
 CONFIG_FEATURE_START_STOP_DAEMON_FANCY=y
 CONFIG_WHICH=y
 
@@ -466,6 +469,7 @@ CONFIG_FEATURE_FIND_NEWER=y
 CONFIG_FEATURE_FIND_SAMEFILE=y
 CONFIG_FEATURE_FIND_EXEC=y
 CONFIG_FEATURE_FIND_EXEC_PLUS=y
+CONFIG_FEATURE_FIND_EXEC_OK=y
 CONFIG_FEATURE_FIND_USER=y
 CONFIG_FEATURE_FIND_GROUP=y
 CONFIG_FEATURE_FIND_NOT=y
@@ -520,41 +524,41 @@ CONFIG_INIT_TERMINAL_TYPE=""
 #
 # Login/Password Management Utilities
 #
-CONFIG_FEATURE_SHADOWPASSWDS=y
+# CONFIG_FEATURE_SHADOWPASSWDS is not set
 # CONFIG_USE_BB_PWD_GRP is not set
 # CONFIG_USE_BB_SHADOW is not set
 CONFIG_USE_BB_CRYPT=y
 # CONFIG_USE_BB_CRYPT_SHA is not set
 # CONFIG_ADD_SHELL is not set
 # CONFIG_REMOVE_SHELL is not set
-CONFIG_ADDGROUP=y
+# CONFIG_ADDGROUP is not set
 # CONFIG_FEATURE_ADDUSER_TO_GROUP is not set
-CONFIG_ADDUSER=y
+# CONFIG_ADDUSER is not set
 # CONFIG_FEATURE_CHECK_NAMES is not set
-CONFIG_LAST_ID=60000
-CONFIG_FIRST_SYSTEM_ID=100
-CONFIG_LAST_SYSTEM_ID=999
+CONFIG_LAST_ID=0
+CONFIG_FIRST_SYSTEM_ID=0
+CONFIG_LAST_SYSTEM_ID=0
 # CONFIG_CHPASSWD is not set
 CONFIG_FEATURE_DEFAULT_PASSWD_ALGO=""
 # CONFIG_CRYPTPW is not set
 # CONFIG_MKPASSWD is not set
-CONFIG_DELUSER=y
-CONFIG_DELGROUP=y
+# CONFIG_DELUSER is not set
+# CONFIG_DELGROUP is not set
 # CONFIG_FEATURE_DEL_USER_FROM_GROUP is not set
-CONFIG_GETTY=y
-CONFIG_LOGIN=y
+# CONFIG_GETTY is not set
+# CONFIG_LOGIN is not set
 # CONFIG_LOGIN_SESSION_AS_CHILD is not set
 # CONFIG_LOGIN_SCRIPTS is not set
 # CONFIG_FEATURE_NOLOGIN is not set
 # CONFIG_FEATURE_SECURETTY is not set
-CONFIG_PASSWD=y
+# CONFIG_PASSWD is not set
 # CONFIG_FEATURE_PASSWD_WEAK_CHECK is not set
-CONFIG_SU=y
+# CONFIG_SU is not set
 # CONFIG_FEATURE_SU_SYSLOG is not set
 # CONFIG_FEATURE_SU_CHECKS_SHELLS is not set
 # CONFIG_FEATURE_SU_BLANK_PW_NEEDS_SECURE_TTY is not set
-CONFIG_SULOGIN=y
-CONFIG_VLOCK=y
+# CONFIG_SULOGIN is not set
+# CONFIG_VLOCK is not set
 
 #
 # Linux Ext2 FS Progs
@@ -601,8 +605,8 @@ CONFIG_DEFAULT_DEPMOD_FILE="modules.dep"
 # CONFIG_ACPID is not set
 # CONFIG_FEATURE_ACPID_COMPAT is not set
 # CONFIG_BLKDISCARD is not set
-CONFIG_BLKID=y
-CONFIG_FEATURE_BLKID_TYPE=y
+# CONFIG_BLKID is not set
+# CONFIG_FEATURE_BLKID_TYPE is not set
 # CONFIG_BLOCKDEV is not set
 # CONFIG_CAL is not set
 # CONFIG_CHRT is not set
@@ -632,8 +636,8 @@ CONFIG_FLOCK=y
 # CONFIG_FSCK_MINIX is not set
 # CONFIG_FSFREEZE is not set
 CONFIG_FSTRIM=y
-CONFIG_GETOPT=y
-CONFIG_FEATURE_GETOPT_LONG=y
+# CONFIG_GETOPT is not set
+# CONFIG_FEATURE_GETOPT_LONG is not set
 CONFIG_HEXDUMP=y
 # CONFIG_HD is not set
 # CONFIG_XXD is not set
@@ -670,7 +674,7 @@ CONFIG_MOUNT=y
 # CONFIG_FEATURE_MOUNT_FAKE is not set
 # CONFIG_FEATURE_MOUNT_VERBOSE is not set
 # CONFIG_FEATURE_MOUNT_HELPERS is not set
-CONFIG_FEATURE_MOUNT_LABEL=y
+# CONFIG_FEATURE_MOUNT_LABEL is not set
 # CONFIG_FEATURE_MOUNT_NFS is not set
 # CONFIG_FEATURE_MOUNT_CIFS is not set
 CONFIG_FEATURE_MOUNT_FLAGS=y
@@ -685,7 +689,7 @@ CONFIG_RDATE=y
 # CONFIG_RDEV is not set
 # CONFIG_READPROFILE is not set
 CONFIG_RENICE=y
-CONFIG_REV=y
+# CONFIG_REV is not set
 # CONFIG_RTCWAKE is not set
 # CONFIG_SCRIPT is not set
 # CONFIG_SCRIPTREPLAY is not set
@@ -718,19 +722,15 @@ CONFIG_FEATURE_UMOUNT_ALL=y
 CONFIG_FEATURE_MOUNT_LOOP=y
 CONFIG_FEATURE_MOUNT_LOOP_CREATE=y
 # CONFIG_FEATURE_MTAB_SUPPORT is not set
-CONFIG_VOLUMEID=y
-
-#
-# Filesystem/Volume identification
-#
+# CONFIG_VOLUMEID is not set
 # CONFIG_FEATURE_VOLUMEID_BCACHE is not set
-CONFIG_FEATURE_VOLUMEID_BTRFS=y
+# CONFIG_FEATURE_VOLUMEID_BTRFS is not set
 # CONFIG_FEATURE_VOLUMEID_CRAMFS is not set
-CONFIG_FEATURE_VOLUMEID_EROFS=y
+# CONFIG_FEATURE_VOLUMEID_EROFS is not set
 # CONFIG_FEATURE_VOLUMEID_EXFAT is not set
-CONFIG_FEATURE_VOLUMEID_EXT=y
-CONFIG_FEATURE_VOLUMEID_F2FS=y
-CONFIG_FEATURE_VOLUMEID_FAT=y
+# CONFIG_FEATURE_VOLUMEID_EXT is not set
+# CONFIG_FEATURE_VOLUMEID_F2FS is not set
+# CONFIG_FEATURE_VOLUMEID_FAT is not set
 # CONFIG_FEATURE_VOLUMEID_HFS is not set
 # CONFIG_FEATURE_VOLUMEID_ISO9660 is not set
 # CONFIG_FEATURE_VOLUMEID_JFS is not set
@@ -744,7 +744,7 @@ CONFIG_FEATURE_VOLUMEID_FAT=y
 # CONFIG_FEATURE_VOLUMEID_OCFS2 is not set
 # CONFIG_FEATURE_VOLUMEID_REISERFS is not set
 # CONFIG_FEATURE_VOLUMEID_ROMFS is not set
-CONFIG_FEATURE_VOLUMEID_SQUASHFS=y
+# CONFIG_FEATURE_VOLUMEID_SQUASHFS is not set
 # CONFIG_FEATURE_VOLUMEID_SYSV is not set
 # CONFIG_FEATURE_VOLUMEID_UBIFS is not set
 # CONFIG_FEATURE_VOLUMEID_UDF is not set
@@ -792,6 +792,7 @@ CONFIG_FEATURE_CROND_DIR=""
 # CONFIG_FLASH_LOCK is not set
 # CONFIG_FLASH_UNLOCK is not set
 # CONFIG_FLASHCP is not set
+CONFIG_GETFATTR=y
 # CONFIG_HDPARM is not set
 # CONFIG_FEATURE_HDPARM_GET_IDENTITY is not set
 # CONFIG_FEATURE_HDPARM_HDIO_SCAN_HWIF is not set
@@ -882,6 +883,7 @@ CONFIG_FEATURE_HWIB=y
 CONFIG_HOSTNAME=y
 CONFIG_DNSDOMAINNAME=y
 # CONFIG_HTTPD is not set
+CONFIG_FEATURE_HTTPD_PORT_DEFAULT=0
 # CONFIG_FEATURE_HTTPD_RANGES is not set
 # CONFIG_FEATURE_HTTPD_SETUID is not set
 # CONFIG_FEATURE_HTTPD_BASIC_AUTH is not set
@@ -897,11 +899,11 @@ CONFIG_DNSDOMAINNAME=y
 # CONFIG_FEATURE_HTTPD_LAST_MODIFIED is not set
 # CONFIG_FEATURE_HTTPD_DATE is not set
 # CONFIG_FEATURE_HTTPD_ACL_IP is not set
-CONFIG_IFCONFIG=y
-CONFIG_FEATURE_IFCONFIG_STATUS=y
+# CONFIG_IFCONFIG is not set
+# CONFIG_FEATURE_IFCONFIG_STATUS is not set
 # CONFIG_FEATURE_IFCONFIG_SLIP is not set
 # CONFIG_FEATURE_IFCONFIG_MEMSTART_IOADDR_IRQ is not set
-CONFIG_FEATURE_IFCONFIG_HW=y
+# CONFIG_FEATURE_IFCONFIG_HW is not set
 # CONFIG_FEATURE_IFCONFIG_BROADCAST_PLUS is not set
 # CONFIG_IFENSLAVE is not set
 # CONFIG_IFPLUGD is not set
@@ -929,6 +931,7 @@ CONFIG_IP=y
 # CONFIG_IPNEIGH is not set
 CONFIG_FEATURE_IP_ADDRESS=y
 CONFIG_FEATURE_IP_LINK=y
+# CONFIG_FEATURE_IP_LINK_CAN is not set
 CONFIG_FEATURE_IP_ROUTE=y
 CONFIG_FEATURE_IP_ROUTE_DIR="/etc/iproute2"
 CONFIG_FEATURE_IP_TUNNEL=y
@@ -947,7 +950,7 @@ CONFIG_NC=y
 # CONFIG_NC_SERVER is not set
 # CONFIG_NC_EXTRA is not set
 # CONFIG_NC_110_COMPAT is not set
-CONFIG_NETSTAT=y
+# CONFIG_NETSTAT is not set
 # CONFIG_FEATURE_NETSTAT_WIDE is not set
 # CONFIG_FEATURE_NETSTAT_PRG is not set
 CONFIG_NSLOOKUP=y
@@ -961,7 +964,7 @@ CONFIG_PING=y
 CONFIG_PING6=y
 CONFIG_FEATURE_FANCY_PING=y
 # CONFIG_PSCAN is not set
-CONFIG_ROUTE=y
+# CONFIG_ROUTE is not set
 # CONFIG_SLATTACH is not set
 # CONFIG_SSL_CLIENT is not set
 # CONFIG_TC is not set
@@ -974,6 +977,7 @@ CONFIG_FEATURE_TELNET_AUTOLOGIN=y
 CONFIG_FEATURE_TELNET_WIDTH=y
 # CONFIG_TELNETD is not set
 # CONFIG_FEATURE_TELNETD_STANDALONE is not set
+CONFIG_FEATURE_TELNETD_PORT_DEFAULT=0
 # CONFIG_FEATURE_TELNETD_INETD_WAIT is not set
 CONFIG_TFTP=y
 # CONFIG_FEATURE_TFTP_PROGRESS_BAR is not set
@@ -983,7 +987,7 @@ CONFIG_FEATURE_TFTP_GET=y
 CONFIG_FEATURE_TFTP_PUT=y
 # CONFIG_FEATURE_TFTP_BLOCKSIZE is not set
 # CONFIG_TFTP_DEBUG is not set
-CONFIG_TLS=y
+# CONFIG_TLS is not set
 CONFIG_TRACEROUTE=y
 # CONFIG_TRACEROUTE6 is not set
 # CONFIG_FEATURE_TRACEROUTE_VERBOSE is not set
@@ -992,16 +996,17 @@ CONFIG_TRACEROUTE=y
 # CONFIG_FEATURE_TUNCTL_UG is not set
 # CONFIG_VCONFIG is not set
 CONFIG_WGET=y
-CONFIG_FEATURE_WGET_LONG_OPTIONS=y
+# CONFIG_FEATURE_WGET_LONG_OPTIONS is not set
 CONFIG_FEATURE_WGET_STATUSBAR=y
 CONFIG_FEATURE_WGET_FTP=y
 CONFIG_FEATURE_WGET_AUTHENTICATION=y
 CONFIG_FEATURE_WGET_TIMEOUT=y
-CONFIG_FEATURE_WGET_HTTPS=y
-# CONFIG_FEATURE_WGET_OPENSSL is not set
+# CONFIG_FEATURE_WGET_HTTPS is not set
+CONFIG_FEATURE_WGET_OPENSSL=y
 # CONFIG_WHOIS is not set
 # CONFIG_ZCIP is not set
 CONFIG_UDHCPD=y
+CONFIG_FEATURE_UDHCPD_BOOTP=y
 # CONFIG_FEATURE_UDHCPD_BASE_IP_ON_MAC is not set
 # CONFIG_FEATURE_UDHCPD_WRITE_LEASES_EARLY is not set
 CONFIG_DHCPD_LEASES_FILE="/var/lib/misc/udhcpd.leases"
@@ -1011,6 +1016,7 @@ CONFIG_UDHCPC=y
 CONFIG_FEATURE_UDHCPC_ARPING=y
 CONFIG_FEATURE_UDHCPC_SANITIZEOPT=y
 CONFIG_UDHCPC_DEFAULT_SCRIPT="/usr/share/udhcpc/default.script"
+CONFIG_UDHCPC6_DEFAULT_SCRIPT=""
 # CONFIG_UDHCPC6 is not set
 # CONFIG_FEATURE_UDHCPC6_RFC3646 is not set
 # CONFIG_FEATURE_UDHCPC6_RFC4704 is not set
@@ -1020,6 +1026,7 @@ CONFIG_UDHCPC_DEFAULT_SCRIPT="/usr/share/udhcpc/default.script"
 #
 # Common options for DHCP applets
 #
+CONFIG_UDHCPC_DEFAULT_INTERFACE="eth0"
 # CONFIG_FEATURE_UDHCP_PORT is not set
 CONFIG_UDHCP_DEBUG=0
 CONFIG_UDHCPC_SLACK_FOR_BUGGY_SERVERS=80
@@ -1059,7 +1066,7 @@ CONFIG_KILLALL=y
 # CONFIG_LSOF is not set
 # CONFIG_MPSTAT is not set
 # CONFIG_NMETER is not set
-CONFIG_PGREP=y
+# CONFIG_PGREP is not set
 # CONFIG_PKILL is not set
 CONFIG_PIDOF=y
 # CONFIG_FEATURE_PIDOF_SINGLE is not set
@@ -1203,21 +1210,17 @@ CONFIG_FEATURE_SH_HISTFILESIZE=y
 # System Logging Utilities
 #
 CONFIG_KLOGD=y
-
-#
-# klogd should not be used together with syslog to kernel printk buffer
-#
 CONFIG_FEATURE_KLOGD_KLOGCTL=y
 CONFIG_LOGGER=y
-CONFIG_LOGREAD=y
-CONFIG_FEATURE_LOGREAD_REDUCED_LOCKING=y
-CONFIG_SYSLOGD=y
-CONFIG_FEATURE_ROTATE_LOGFILE=y
-CONFIG_FEATURE_REMOTE_LOG=y
-CONFIG_FEATURE_SYSLOGD_DUP=y
-CONFIG_FEATURE_SYSLOGD_CFG=y
+# CONFIG_LOGREAD is not set
+# CONFIG_FEATURE_LOGREAD_REDUCED_LOCKING is not set
+# CONFIG_SYSLOGD is not set
+# CONFIG_FEATURE_ROTATE_LOGFILE is not set
+# CONFIG_FEATURE_REMOTE_LOG is not set
+# CONFIG_FEATURE_SYSLOGD_DUP is not set
+# CONFIG_FEATURE_SYSLOGD_CFG is not set
 # CONFIG_FEATURE_SYSLOGD_PRECISE_TIMESTAMPS is not set
-CONFIG_FEATURE_SYSLOGD_READ_BUFFER_SIZE=256
-CONFIG_FEATURE_IPC_SYSLOG=y
-CONFIG_FEATURE_IPC_SYSLOG_BUFFER_SIZE=64
-CONFIG_FEATURE_KMSG_SYSLOG=y
+CONFIG_FEATURE_SYSLOGD_READ_BUFFER_SIZE=0
+# CONFIG_FEATURE_IPC_SYSLOG is not set
+CONFIG_FEATURE_IPC_SYSLOG_BUFFER_SIZE=0
+# CONFIG_FEATURE_KMSG_SYSLOG is not set
diff --git a/meta/recipes-core/busybox/busybox/getopts.cfg b/meta/recipes-core/busybox/busybox/getopts.cfg
index 8db0a4a8f2..26a2e7add9 100644
--- a/meta/recipes-core/busybox/busybox/getopts.cfg
+++ b/meta/recipes-core/busybox/busybox/getopts.cfg
@@ -1,3 +1 @@
 CONFIG_GETOPT=y
-CONFIG_LONG_OPTS=y
-CONFIG_FEATURE_GETOPT_LONG=y
diff --git a/meta/recipes-core/busybox/busybox/login-utilities.cfg b/meta/recipes-core/busybox/busybox/login-utilities.cfg
index cc9b2db502..8a21e80619 100644
--- a/meta/recipes-core/busybox/busybox/login-utilities.cfg
+++ b/meta/recipes-core/busybox/busybox/login-utilities.cfg
@@ -1,5 +1,8 @@
 CONFIG_FEATURE_SHADOWPASSWDS=y
 CONFIG_ADDUSER=y
+CONFIG_LAST_ID=60000
+CONFIG_FIRST_SYSTEM_ID=100
+CONFIG_LAST_SYSTEM_ID=999
 CONFIG_FEATURE_ADDUSER_LONG_OPTIONS=y
 CONFIG_ADDGROUP=y
 CONFIG_FEATURE_ADDGROUP_LONG_OPTIONS=y
diff --git a/meta/recipes-core/busybox/busybox/longopts.cfg b/meta/recipes-core/busybox/busybox/longopts.cfg
index dcfab99919..3255608f64 100644
--- a/meta/recipes-core/busybox/busybox/longopts.cfg
+++ b/meta/recipes-core/busybox/busybox/longopts.cfg
@@ -13,3 +13,4 @@ CONFIG_FEATURE_FTPGETPUT_LONG_OPTIONS=y
 CONFIG_FEATURE_IPCALC_LONG_OPTIONS=y
 CONFIG_FEATURE_NSLOOKUP_LONG_OPTIONS=y
 CONFIG_FEATURE_WGET_LONG_OPTIONS=y
+CONFIG_FEATURE_GETOPT_LONG=y
diff --git a/meta/recipes-core/busybox/busybox/mdev.cfg b/meta/recipes-core/busybox/busybox/mdev.cfg
index 143e6097cb..54d23597cc 100644
--- a/meta/recipes-core/busybox/busybox/mdev.cfg
+++ b/meta/recipes-core/busybox/busybox/mdev.cfg
@@ -5,7 +5,6 @@ CONFIG_FEATURE_MDEV_RENAME_REGEXP=y
 CONFIG_FEATURE_MDEV_EXEC=y
 CONFIG_FEATURE_MDEV_LOAD_FIRMWARE=y
 
-CONFIG_SETSID=y
 CONFIG_CTTYHACK=y
 
 CONFIG_FEATURE_SHADOWPASSWDS=y
diff --git a/meta/recipes-core/busybox/busybox/mount-via-label.cfg b/meta/recipes-core/busybox/busybox/mount-via-label.cfg
index 5a285de7cd..c9ae95c8c2 100644
--- a/meta/recipes-core/busybox/busybox/mount-via-label.cfg
+++ b/meta/recipes-core/busybox/busybox/mount-via-label.cfg
@@ -4,6 +4,7 @@ CONFIG_FEATURE_MOUNT_LABEL=y
 CONFIG_FEATURE_SWAPONOFF_LABEL=y
 CONFIG_VOLUMEID=y
 CONFIG_FEATURE_VOLUMEID_BTRFS=y
+CONFIG_FEATURE_VOLUMEID_EROFS=y
 CONFIG_FEATURE_VOLUMEID_EXT=y
 CONFIG_FEATURE_VOLUMEID_F2FS=y
 CONFIG_FEATURE_VOLUMEID_FAT=y
diff --git a/meta/recipes-core/busybox/busybox/sha1sum.cfg b/meta/recipes-core/busybox/busybox/sha1sum.cfg
index afd4da4ea1..151c447658 100644
--- a/meta/recipes-core/busybox/busybox/sha1sum.cfg
+++ b/meta/recipes-core/busybox/busybox/sha1sum.cfg
@@ -1,2 +1,3 @@
 CONFIG_SHA1SUM=y
 CONFIG_SHA1_SMALL=3
+# CONFIG_SHA1_HWACCEL is not set
diff --git a/meta/recipes-core/busybox/busybox/sha256sum.cfg b/meta/recipes-core/busybox/busybox/sha256sum.cfg
index ce652ae4c6..aa0b0b0b98 100644
--- a/meta/recipes-core/busybox/busybox/sha256sum.cfg
+++ b/meta/recipes-core/busybox/busybox/sha256sum.cfg
@@ -1 +1,2 @@
 CONFIG_SHA256SUM=y
+# CONFIG_SHA256_HWACCEL is not set
diff --git a/meta/recipes-core/busybox/busybox/sha_accel.cfg b/meta/recipes-core/busybox/busybox/sha_accel.cfg
index 8900305a11..70038a8509 100644
--- a/meta/recipes-core/busybox/busybox/sha_accel.cfg
+++ b/meta/recipes-core/busybox/busybox/sha_accel.cfg
@@ -1,2 +1,2 @@
-# CONFIG_SHA256_HWACCEL is not set
-# CONFIG_SHA1_HWACCEL is not set
+CONFIG_SHA1_HWACCEL=y
+CONFIG_SHA256_HWACCEL=y
diff --git a/meta/recipes-core/busybox/busybox_1.36.1.bb b/meta/recipes-core/busybox/busybox_1.37.0.bb
index 06eb9eb999..9f7ded3354 100644
--- a/meta/recipes-core/busybox/busybox_1.36.1.bb
+++ b/meta/recipes-core/busybox/busybox_1.37.0.bb
@@ -2,7 +2,6 @@ require busybox.inc
 
 SRC_URI = "https://busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
            file://0001-depmod-Ignore-.debug-directories.patch \
-           file://busybox-udhcpc-no_deconfig.patch \
            file://find-touchscreen.sh \
            file://busybox-cron \
            file://busybox-httpd \
@@ -49,9 +48,14 @@ SRC_URI = "https://busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
            file://0001-sysctl-ignore-EIO-of-stable_secret-below-proc-sys-ne.patch \
            file://0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch \
            file://0002-nslookup-sanitize-all-printed-strings-with-printable.patch \
-           file://start-stop-false.patch \
+           file://busybox-1.36.1-no-cbq.patch \
+           file://0001-cut-Fix-s-flag-to-omit-blank-lines.patch \
+           file://0001-syslogd-fix-wrong-OPT_locallog-flag-detection.patch \
+           file://0002-start-stop-daemon-fix-tests.patch \
+           file://0003-start-stop-false.patch \
+           file://0001-archival-disallow-path-traversals-CVE-2023-39810.patch \
+           file://0001-hwclock-Check-for-SYS_settimeofday-before-calling-sy.patch \
            "
-SRC_URI:append:libc-musl = " file://musl.cfg "
-# TODO http://lists.busybox.net/pipermail/busybox/2023-January/090078.html
-SRC_URI:append:x86 = " file://sha_accel.cfg"
-SRC_URI[tarball.sha256sum] = "b8cc24c9574d809e7279c3be349795c5d5ceb6fdf19ca709f80cde50e47de314"
+SRC_URI:append:libc-musl = " file://musl.cfg"
+SRC_URI:append:x86-64 = " file://sha_accel.cfg"
+SRC_URI[tarball.sha256sum] = "3311dff32e746499f4df0d5df04d7eb396382d7e108bb9250e7b519b837043a4"
diff --git a/meta/recipes-core/coreutils/coreutils/0001-local.mk-fix-cross-compiling-problem.patch b/meta/recipes-core/coreutils/coreutils/0001-local.mk-fix-cross-compiling-problem.patch
deleted file mode 100644
index 97a6357ab9..0000000000
--- a/meta/recipes-core/coreutils/coreutils/0001-local.mk-fix-cross-compiling-problem.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 7cb2d20cfa2a27191255031d231cd41917dcffe8 Mon Sep 17 00:00:00 2001
-From: Chen Qi <Qi.Chen@windriver.com>
-Date: Mon, 26 Dec 2016 16:10:35 +0800
-Subject: [PATCH] local.mk: fix cross compiling problem
-
-We meet the following error when cross compiling.
-| Makefile:3418: *** Recursive variable 'INSTALL' references itself (eventually).  Stop.
-This patch fixes this problem.
-
-Upstream-Status: Pending
-
-Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
----
- src/local.mk | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/local.mk b/src/local.mk
-index 96ee941..cdd47d6 100644
---- a/src/local.mk
-+++ b/src/local.mk
-@@ -704,4 +704,4 @@ cu_install_program = @INSTALL@
- else
- cu_install_program = src/ginstall
- endif
--INSTALL = $(cu_install_program) -c
-+INSTALL_PROGRAM = $(cu_install_program)
diff --git a/meta/recipes-core/coreutils/coreutils/0001-sort-fix-buffer-under-read-CWE-127.patch b/meta/recipes-core/coreutils/coreutils/0001-sort-fix-buffer-under-read-CWE-127.patch
new file mode 100644
index 0000000000..41be1635b5
--- /dev/null
+++ b/meta/recipes-core/coreutils/coreutils/0001-sort-fix-buffer-under-read-CWE-127.patch
@@ -0,0 +1,112 @@
+From 8763c305c29d0abb7e2be4695212b42917d054b2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?P=C3=A1draig=20Brady?= <P@draigBrady.com>
+Date: Tue, 20 May 2025 16:03:44 +0100
+Subject: [PATCH] sort: fix buffer under-read (CWE-127)
+
+* src/sort.c (begfield): Check pointer adjustment
+to avoid Out-of-range pointer offset (CWE-823).
+(limfield): Likewise.
+* tests/sort/sort-field-limit.sh: Add a new test,
+which triggers with ASAN or Valgrind.
+* tests/local.mk: Reference the new test.
+* NEWS: Mention bug fix introduced in v7.2 (2009).
+Fixes https://bugs.gnu.org/78507
+
+CVE: CVE-2025-5278
+
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633]
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+---
+ src/sort.c                     | 12 ++++++++++--
+ tests/local.mk                 |  1 +
+ tests/sort/sort-field-limit.sh | 35 ++++++++++++++++++++++++++++++++++
+ 3 files changed, 46 insertions(+), 2 deletions(-)
+ create mode 100755 tests/sort/sort-field-limit.sh
+
+diff --git a/src/sort.c b/src/sort.c
+index b10183b6f..7af1a2512 100644
+--- a/src/sort.c
++++ b/src/sort.c
+@@ -1644,7 +1644,11 @@ begfield (struct line const *line, struct keyfield const *key)
+       ++ptr;
+ 
+   /* Advance PTR by SCHAR (if possible), but no further than LIM.  */
+-  ptr = MIN (lim, ptr + schar);
++  size_t remaining_bytes = lim - ptr;
++  if (schar < remaining_bytes)
++    ptr += schar;
++  else
++    ptr = lim;
+ 
+   return ptr;
+ }
+@@ -1746,7 +1750,11 @@ limfield (struct line const *line, struct keyfield const *key)
+           ++ptr;
+ 
+       /* Advance PTR by ECHAR (if possible), but no further than LIM.  */
+-      ptr = MIN (lim, ptr + echar);
++      size_t remaining_bytes = lim - ptr;
++      if (echar < remaining_bytes)
++        ptr += echar;
++      else
++        ptr = lim;
+     }
+ 
+   return ptr;
+diff --git a/tests/local.mk b/tests/local.mk
+index 4da6756ac..642d225fa 100644
+--- a/tests/local.mk
++++ b/tests/local.mk
+@@ -388,6 +388,7 @@ all_tests =                                 \
+   tests/sort/sort-debug-keys.sh                        \
+   tests/sort/sort-debug-warn.sh                        \
+   tests/sort/sort-discrim.sh                   \
++  tests/sort/sort-field-limit.sh               \
+   tests/sort/sort-files0-from.pl               \
+   tests/sort/sort-float.sh                     \
+   tests/sort/sort-h-thousands-sep.sh           \
+diff --git a/tests/sort/sort-field-limit.sh b/tests/sort/sort-field-limit.sh
+new file mode 100755
+index 000000000..52d8e1d17
+--- /dev/null
++++ b/tests/sort/sort-field-limit.sh
+@@ -0,0 +1,35 @@
++#!/bin/sh
++# From 7.2-9.7, this would trigger an out of bounds mem read
++
++# Copyright (C) 2025 Free Software Foundation, Inc.
++
++# This program is free software: you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation, either version 3 of the License, or
++# (at your option) any later version.
++
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++# GNU General Public License for more details.
++
++# You should have received a copy of the GNU General Public License
++# along with this program.  If not, see <https://www.gnu.org/licenses/>.
++
++. "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
++print_ver_ sort
++getlimits_
++
++# This issue triggers with valgrind or ASAN
++valgrind --error-exitcode=1 sort --version 2>/dev/null &&
++  VALGRIND='valgrind --error-exitcode=1'
++
++{ printf '%s\n' aa bb; } > in || framework_failure_
++
++_POSIX2_VERSION=200809 $VALGRIND sort +0.${SIZE_MAX}R in > out || fail=1
++compare in out || fail=1
++
++_POSIX2_VERSION=200809 $VALGRIND sort +1 -1.${SIZE_MAX}R in > out || fail=1
++compare in out || fail=1
++
++Exit $fail
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/coreutils/coreutils_9.5.bb b/meta/recipes-core/coreutils/coreutils_9.7.bb
index 9a5f836ebe..5a6456d65e 100644
--- a/meta/recipes-core/coreutils/coreutils_9.5.bb
+++ b/meta/recipes-core/coreutils/coreutils_9.7.bb
@@ -6,7 +6,7 @@ HOMEPAGE = "http://www.gnu.org/software/coreutils/"
 BUGTRACKER = "http://debbugs.gnu.org/coreutils"
 LICENSE = "GPL-3.0-or-later"
 LIC_FILES_CHKSUM = "file://COPYING;md5=1ebbd3e34237af26da5dc08a4e440464 \
-                    file://src/ls.c;beginline=1;endline=15;md5=9ac94aaed7fd46fd8df7147a9e3410cb \
+                    file://src/ls.c;beginline=1;endline=15;md5=824c1997414aea9f344747bd81cf5a31 \
                     "
 DEPENDS = "gmp libcap"
 DEPENDS:class-native = ""
@@ -15,10 +15,10 @@ inherit autotools gettext texinfo
 
 SRC_URI = "${GNU_MIRROR}/coreutils/${BP}.tar.xz \
            file://remove-usr-local-lib-from-m4.patch \
-           file://0001-local.mk-fix-cross-compiling-problem.patch \
+           file://0001-sort-fix-buffer-under-read-CWE-127.patch \
            file://run-ptest \
            "
-SRC_URI[sha256sum] = "cd328edeac92f6a665de9f323c93b712af1858bc2e0d88f3f7100469470a1b8a"
+SRC_URI[sha256sum] = "e8bb26ad0293f9b5a1fc43fb42ba970e312c66ce92c1b0b16713d7500db251bf"
 
 # http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=v8.27-101-gf5d7c0842
 #
@@ -47,7 +47,7 @@ PACKAGECONFIG[single-binary] = "--enable-single-binary,--disable-single-binary,,
 PACKAGECONFIG[selinux] = "--with-selinux,--without-selinux,libselinux"
 PACKAGECONFIG[openssl] = "--with-openssl=yes,--with-openssl=no,openssl"
 
-# [ df mktemp nice printenv base64 gets a special treatment and is not included in this
+# [ base32 base64 df mktemp nice printenv get a special treatment and are not included in this
 bindir_progs = "arch basename chcon cksum comm csplit cut dir dircolors dirname du \
                 env expand expr factor fmt fold groups head hostid id install \
                 join link logname md5sum mkfifo nl nohup nproc od paste pathchk \
@@ -55,11 +55,10 @@ bindir_progs = "arch basename chcon cksum comm csplit cut dir dircolors dirname
                 sha384sum sha512sum shred shuf sort split sum tac tail tee test timeout \
                 tr truncate tsort tty unexpand uniq unlink uptime users vdir wc who whoami yes"
 
-# hostname gets a special treatment and is not included in this
 base_bindir_progs = "cat chgrp chmod chown cp date dd echo false hostname kill ln ls mkdir \
                      mknod mv pwd rm rmdir sleep stty sync touch true uname stat"
 
-sbindir_progs= "chroot"
+sbindir_progs = "chroot"
 
 # Split stdbuf into its own package, so one can include
 # coreutils-stdbuf without getting the rest of coreutils, but make
@@ -76,12 +75,6 @@ RDEPENDS:coreutils:class-target += "${@bb.utils.contains('PACKAGECONFIG', 'singl
 # regardless of whether single-binary is in effect.
 RPROVIDES:coreutils += "${@bb.utils.contains('PACKAGECONFIG', 'single-binary', 'coreutils-stdbuf', '', d)}"
 
-# Let aclocal use the relative path for the m4 file rather than the
-# absolute since coreutils has a lot of m4 files, otherwise there might
-# be an "Argument list too long" error when it is built in a long/deep
-# directory.
-acpaths = "-I ./m4"
-
 # Deal with a separate builddir failure if src doesn't exist when creating version.c/version.h
 do_compile:prepend () {
         mkdir -p ${B}/src
@@ -173,12 +166,13 @@ RDEPENDS:${PN}-ptest += "bash findutils gawk make perl perl-modules python3-core
 # may need tweaking if DEPENDS changes
 # Can't use ${PN}-dev here since flags with overrides and key expansion not supported
 RRECOMMENDS:coreutils-dev[nodeprrecs] = "1"
-RRECOMMENDS:${PN}-dev += "acl-dev attr-dev gmp-dev libcap-dev bash-dev findutils-dev gawk-dev shadow-dev"
+DEVDEPS = "acl-dev attr-dev gmp-dev libcap-dev bash-dev findutils-dev gawk-dev shadow-dev"
+DEVDEPS:class-native = ""
+RRECOMMENDS:${PN}-dev += "${DEVDEPS}"
 
 do_install_ptest () {
     install -d ${D}${PTEST_PATH}/tests
     cp -r ${S}/tests/* ${D}${PTEST_PATH}/tests
-    sed -i 's/ginstall/install/g'  `grep -R ginstall ${D}${PTEST_PATH}/tests | awk -F: '{print $1}' | uniq`
     install -d ${D}${PTEST_PATH}/build-aux
     install ${S}/build-aux/test-driver ${D}${PTEST_PATH}/build-aux/
     install -Dm 0644 ${B}/lib/config.h ${D}${PTEST_PATH}/lib/config.h
@@ -192,8 +186,8 @@ do_install_ptest () {
     sed -i '/^abs_srcdir/s/= .*$/= \$\{PWD\}/g' ${D}${PTEST_PATH}/Makefile
     sed -i '/^abs_top_builddir/s/= .*$/= \$\{PWD\}/g' ${D}${PTEST_PATH}/Makefile
     sed -i '/^abs_top_srcdir/s/= .*$/= \$\{PWD\}/g' ${D}${PTEST_PATH}/Makefile
-    sed -i '/^built_programs/s/ginstall/install/g' ${D}${PTEST_PATH}/Makefile
     sed -i '/^CC =/s/ --sysroot=.*recipe-sysroot/ /g' ${D}${PTEST_PATH}/Makefile
+    sed -i '/^BUILD_LDFLAGS =/d' ${D}${PTEST_PATH}/Makefile
     chmod -R 777 ${D}${PTEST_PATH}
 
     # Disable subcase stty-pairs.sh, it will cause test framework hang
@@ -204,8 +198,15 @@ do_install_ptest () {
 
     # Tweak test d_type-check to use python3 instead of python
     sed -i "1s@.*@#!/usr/bin/python3@" ${D}${PTEST_PATH}/tests/d_type-check
+
+    # Fix for single-binary
+    for prog in ${D}${PTEST_PATH}/src/*; do
+        if [ -f $prog ]; then
+            sed -i "1s@#!.*/src/coreutils @#!${bindir}/coreutils @" $prog
+        fi
+    done
+
     install ${B}/src/getlimits ${D}/${bindir}
-    
     # handle multilib
     sed -i s:@libdir@:${libdir}:g ${D}${PTEST_PATH}/run-ptest
 }
@@ -216,4 +217,8 @@ do_install_ptest:append:libc-musl () {
     sed -i -e '/tests\/dd\/no-allocate.sh/d' ${D}${PTEST_PATH}/Makefile
     sed -i -e '/tests\/split\/line-bytes.sh/d' ${D}${PTEST_PATH}/Makefile
 }
+
+RDEPENDS:${PN}-ptest += "xz  \
+                         ${@bb.utils.contains('PACKAGECONFIG', 'acl', 'acl', '', d)} \
+                         ${@bb.utils.contains('PACKAGECONFIG', 'xattr', 'attr', '', d)}"
 FILES:${PN}-ptest += "${bindir}/getlimits"
diff --git a/meta/recipes-core/dbus-wait/dbus-wait_git.bb b/meta/recipes-core/dbus-wait/dbus-wait_git.bb
index 39363b9b3a..c6a9abde63 100644
--- a/meta/recipes-core/dbus-wait/dbus-wait_git.bb
+++ b/meta/recipes-core/dbus-wait/dbus-wait_git.bb
@@ -13,6 +13,4 @@ PV = "0.1+git"
 SRC_URI = "git://git.yoctoproject.org/${BPN};branch=master;protocol=https"
 UPSTREAM_CHECK_COMMITS = "1"
 
-S = "${WORKDIR}/git"
-
 inherit autotools pkgconfig
diff --git a/meta/recipes-core/dbus/dbus-glib/no-examples.patch b/meta/recipes-core/dbus/dbus-glib/no-examples.patch
index 32e7611718..3e2fa41c59 100644
--- a/meta/recipes-core/dbus/dbus-glib/no-examples.patch
+++ b/meta/recipes-core/dbus/dbus-glib/no-examples.patch
@@ -1,14 +1,20 @@
-Disable compiling examples
+From 8bb06c2f0929a4b878fd9abdb63c177a7c308b9d Mon Sep 17 00:00:00 2001
+From: Kevin Tian <kevin.tian@intel.com>
+Date: Tue, 21 Nov 2006 14:20:37 +0000
+Subject: [PATCH] Disable compiling examples
 
 Upstream-Status: Inappropriate [disable feature]
 
 Signed-off-by: Kevin Tian <kevin.tian@intel.com>
 Signed-off-by: Scott Garman <scott.a.garman@intel.com>
+---
+ dbus/Makefile.am | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
 
-Index: dbus-glib-0.108/dbus/Makefile.am
-===================================================================
---- dbus-glib-0.108.orig/dbus/Makefile.am
-+++ dbus-glib-0.108/dbus/Makefile.am
+diff --git a/dbus/Makefile.am b/dbus/Makefile.am
+index 2e8cb27..a86df30 100644
+--- a/dbus/Makefile.am
++++ b/dbus/Makefile.am
 @@ -1,4 +1,4 @@
 -SUBDIRS = . examples
 +SUBDIRS = .
diff --git a/meta/recipes-core/dbus/dbus-glib/test-install-makefile.patch b/meta/recipes-core/dbus/dbus-glib/test-install-makefile.patch
index 027c82b27e..0b1b712dd9 100644
--- a/meta/recipes-core/dbus/dbus-glib/test-install-makefile.patch
+++ b/meta/recipes-core/dbus/dbus-glib/test-install-makefile.patch
@@ -1,4 +1,8 @@
-Change Makefile.am to install regression tests for test package purpose.
+From 4dbb1a459c281eeb716b4f0ce2fc01e8034c3e20 Mon Sep 17 00:00:00 2001
+From: Yao Zhao <yao.zhao@windriver.com>
+Date: Tue, 17 Jul 2012 16:46:30 -0400
+Subject: [PATCH] Change Makefile.am to install regression tests for test
+ package purpose.
 
 Upstream-Status: Inappropriate [test not install is for purpose from upstream]
 
@@ -11,7 +15,7 @@ Signed-off-by: Chong Lu <Chong.Lu@windriver.com>
  3 files changed, 6 insertions(+), 3 deletions(-)
 
 diff --git a/test/Makefile.am b/test/Makefile.am
-index 379c8c3..6580927 100644
+index 7393bed..1c25d5d 100644
 --- a/test/Makefile.am
 +++ b/test/Makefile.am
 @@ -48,7 +48,8 @@ TESTS = \
@@ -25,10 +29,10 @@ index 379c8c3..6580927 100644
         $(test_related_programs) \
         $(NULL)
 diff --git a/test/core/Makefile.am b/test/core/Makefile.am
-index e4bceb4..54b077d 100644
+index 35defa9..295202f 100644
 --- a/test/core/Makefile.am
 +++ b/test/core/Makefile.am
-@@ -64,7 +64,8 @@ endif
+@@ -57,7 +57,8 @@ if DBUS_BUILD_TESTS
  
  ## we use noinst_PROGRAMS not check_PROGRAMS for TESTS so that we
  ## build even when not doing "make check"
@@ -39,7 +43,7 @@ index e4bceb4..54b077d 100644
         test-error-mapping \
         test-service-glib \
 diff --git a/test/interfaces/Makefile.am b/test/interfaces/Makefile.am
-index a94d08d..707dcac 100644
+index f3f62e4..f034b95 100644
 --- a/test/interfaces/Makefile.am
 +++ b/test/interfaces/Makefile.am
 @@ -57,7 +57,8 @@ if DBUS_BUILD_TESTS
@@ -52,6 +56,3 @@ index a94d08d..707dcac 100644
  
  test_service_SOURCES = \
         test-interfaces.c \
--- 
-1.9.1
-
diff --git a/meta/recipes-core/dbus/dbus-glib_0.112.bb b/meta/recipes-core/dbus/dbus-glib_0.114.bb
index 4acf435694..28a9d4a4fc 100644
--- a/meta/recipes-core/dbus/dbus-glib_0.112.bb
+++ b/meta/recipes-core/dbus/dbus-glib_0.114.bb
@@ -2,9 +2,14 @@ SUMMARY = "High level language (GLib) binding for D-Bus"
 DESCRIPTION = "GLib bindings for the D-Bus message bus that integrate \
 the D-Bus library with the GLib thread abstraction and main loop."
 HOMEPAGE = "https://www.freedesktop.org/Software/dbus"
-LICENSE = "AFL-2.1 | GPL-2.0-or-later"
-LIC_FILES_CHKSUM = "file://COPYING;md5=c31c73c1d8f5d06784b2ccd22e42d641 \
-                    file://dbus/dbus-glib.h;beginline=7;endline=21;md5=c374833bd817988323f3a8fda0dc7f48"
+LICENSE = "(AFL-2.1 & LGPL-2.0-or-later & MIT) | (GPL-2.0-or-later & LGPL-2.0-or-later & MIT)"
+LIC_FILES_CHKSUM = "file://COPYING;md5=267b04646da5ce3ea2df7a38a07c3f0b \
+                    file://LICENSES/AFL-2.1.txt;md5=f3ad2f482ec639b440413665cfb9e714 \
+                    file://LICENSES/GPL-2.0-or-later.txt;md5=3d26203303a722dedc6bf909d95ba815 \
+                    file://LICENSES/LGPL-2.1-or-later.txt;md5=41890f71f740302b785c27661123bff5 \
+                    file://LICENSES/MIT.txt;md5=7dda4e90ded66ab88b86f76169f28663 \
+                    file://dbus/dbus-glib.h;beginline=7;endline=21;md5=c374833bd817988323f3a8fda0dc7f48 \
+                    "
 SECTION = "base"
 
 DEPENDS = "expat glib-2.0 virtual/libintl dbus-glib-native dbus"
@@ -14,8 +19,7 @@ SRC_URI = "https://dbus.freedesktop.org/releases/dbus-glib/dbus-glib-${PV}.tar.g
            file://no-examples.patch \
            file://test-install-makefile.patch \
 "
-SRC_URI[md5sum] = "021e6c8a288df02c227e4aafbf7e7527"
-SRC_URI[sha256sum] = "7d550dccdfcd286e33895501829ed971eeb65c614e73aadb4a08aeef719b143a"
+SRC_URI[sha256sum] = "c09c5c085b2a0e391b8ee7d783a1d63fe444e96717cc1814d61b5e8fc2827a7c"
 
 inherit autotools pkgconfig gettext bash-completion gtk-doc
 
@@ -30,10 +34,11 @@ PACKAGES += "${PN}-tests"
 
 FILES:${PN} = "${libdir}/lib*${SOLIBS}"
 FILES:${PN}-bash-completion += "${libexecdir}/dbus-bash-completion-helper"
+LICENSE:${PN}-bash-completion = "GPL-2.0-or-later"
 FILES:${PN}-dev += "${libdir}/dbus-1.0/include ${bindir}/dbus-glib-tool"
 FILES:${PN}-dev += "${bindir}/dbus-binding-tool"
 
-RDEPENDS:${PN}-tests += "dbus-x11"
+RDEPENDS:${PN}-tests = "${PN}"
 FILES:${PN}-tests = "${datadir}/${BPN}/tests"
 
 BBCLASSEXTEND = "native"
diff --git a/meta/recipes-core/dbus/dbus/tmpdir.patch b/meta/recipes-core/dbus/dbus/tmpdir.patch
deleted file mode 100644
index bf086e1788..0000000000
--- a/meta/recipes-core/dbus/dbus/tmpdir.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 5105fedd7fa13dadd2d0d864fb77873b83b79a4b Mon Sep 17 00:00:00 2001
-From: Koen Kooi <koen@dominion.thruhere.net>
-Date: Thu, 23 Jun 2011 13:52:09 +0200
-Subject: [PATCH] buildsys: hardcode socketdir to /tmp
-
-the TMPDIR env var isn't always pointing to the right target path
-
-Upstream-Status: Inappropriate [embedded]
-
-Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
-
-Original comment:
-
-        avoid to check tmp dir at build time. instead uses hard coded /tmp here
-        comment added by Kevin Tian <kevin.tian@intel.com>
----
- configure.ac |   11 +----------
- 1 files changed, 1 insertions(+), 10 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 408054b..6d26180 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1483,16 +1483,7 @@ AC_SUBST(TEST_LAUNCH_HELPER_BINARY)
- AC_DEFINE_UNQUOTED(DBUS_TEST_LAUNCH_HELPER_BINARY, "$TEST_LAUNCH_HELPER_BINARY",
-                    [Full path to the launch helper test program in the builddir])
- 
--#### Find socket directories
--if ! test -z "$TMPDIR" ; then
--   DEFAULT_SOCKET_DIR=$TMPDIR
--elif ! test -z "$TEMP" ; then
--   DEFAULT_SOCKET_DIR=$TEMP
--elif ! test -z "$TMP" ; then
--   DEFAULT_SOCKET_DIR=$TMP
--else
--   DEFAULT_SOCKET_DIR=/tmp
--fi
-+DEFAULT_SOCKET_DIR=/tmp
- 
- DEFAULT_SOCKET_DIR=`echo $DEFAULT_SOCKET_DIR | sed 's/+/%2B/g'`
- 
--- 
-1.6.6.1
-
diff --git a/meta/recipes-core/dbus/dbus_1.14.10.bb b/meta/recipes-core/dbus/dbus_1.16.2.bb
index 4fe7af7512..65f7028b4f 100644
--- a/meta/recipes-core/dbus/dbus_1.14.10.bb
+++ b/meta/recipes-core/dbus/dbus_1.16.2.bb
@@ -3,43 +3,44 @@ DESCRIPTION = "D-Bus is a message bus system, a simple way for applications to t
 HOMEPAGE = "https://dbus.freedesktop.org"
 SECTION = "base"
 
-inherit autotools pkgconfig gettext upstream-version-is-even ptest-gnome
+inherit meson pkgconfig gettext upstream-version-is-even ptest-gnome
 
 LICENSE = "AFL-2.1 | GPL-2.0-or-later"
-LIC_FILES_CHKSUM = "file://COPYING;md5=6423dcd74d7be9715b0db247fd889da3 \
-                    file://dbus/dbus.h;beginline=6;endline=20;md5=866739837ccd835350af94dccd6457d8 \
+LIC_FILES_CHKSUM = "file://COPYING;md5=eb0ffc69a965797a3d6686baa153ef05 \
+                    file://dbus/dbus.h;beginline=6;endline=22;md5=df4251a6c6e15e6a9e3c77b2ac30065d \
                     "
 
 SRC_URI = "https://dbus.freedesktop.org/releases/dbus/dbus-${PV}.tar.xz \
            file://run-ptest \
-           file://tmpdir.patch \
            file://dbus-1.init \
            "
 
-SRC_URI[sha256sum] = "ba1f21d2bd9d339da2d4aa8780c09df32fea87998b73da24f49ab9df1e36a50f"
+SRC_URI[sha256sum] = "0ba2a1a4b16afe7bceb2c07e9ce99a8c2c3508e5dec290dbb643384bd6beb7e2"
 
-EXTRA_OECONF = "--disable-xml-docs \
-                --disable-doxygen-docs \
-                --enable-largefile \
-                --with-system-socket=/run/dbus/system_bus_socket \
-                --enable-modular-tests \
-                --enable-checks \
-                --runstatedir=/run \
+EXTRA_OEMESON = "-Dxml_docs=disabled \
+                 -Ddoxygen_docs=disabled \
+                 -Dsystem_socket=/run/dbus/system_bus_socket \
+                 -Dmodular_tests=enabled \
+                 -Dchecks=true \
+                 -Druntime_dir=${runtimedir} \
+                 -Dtest_socket_dir=/tmp \
+                 -Dsession_socket_dir=/tmp \
                 "
-EXTRA_OECONF:append:class-target = " SYSTEMCTL=${base_bindir}/systemctl"
 
 PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'systemd x11', d)} \
                    user-session \
+                  ${@bb.utils.contains('PTEST_ENABLED', '1', 'tests', '', d)} \
                   "
 PACKAGECONFIG:class-native = ""
 PACKAGECONFIG:class-nativesdk = ""
 
-PACKAGECONFIG[systemd] = "--enable-systemd --with-systemdsystemunitdir=${systemd_system_unitdir},--disable-systemd --without-systemdsystemunitdir,systemd"
-PACKAGECONFIG[x11] = "--enable-x11-autolaunch,--without-x --disable-x11-autolaunch, virtual/libx11 libsm"
-PACKAGECONFIG[user-session] = "--enable-user-session --with-systemduserunitdir=${systemd_user_unitdir},--disable-user-session"
-PACKAGECONFIG[verbose-mode] = "--enable-verbose-mode,,,"
-PACKAGECONFIG[audit] = "--enable-libaudit,--disable-libaudit,audit"
-PACKAGECONFIG[selinux] = "--enable-selinux,--disable-selinux,libselinux"
+PACKAGECONFIG[systemd] = "-Dsystemd=enabled -Dsystemd_system_unitdir=${systemd_system_unitdir},-Dsystemd=disabled,systemd"
+PACKAGECONFIG[x11] = "-Dx11_autolaunch=enabled,-Dx11_autolaunch=disabled, virtual/libx11 libsm"
+PACKAGECONFIG[user-session] = "-Duser_session=true -Dsystemd_user_unitdir=${systemd_user_unitdir},-Duser_session=false"
+PACKAGECONFIG[verbose-mode] = "-Dverbose_mode=true,-Dverbose_mode=false,,"
+PACKAGECONFIG[audit] = "-Dlibaudit=enabled,-Dlibaudit=disabled,audit"
+PACKAGECONFIG[selinux] = "-Dselinux=enabled,-Dselinux=disabled,libselinux"
+PACKAGECONFIG[tests] = "-Dinstalled_tests=true,-Dinstalled_tests=false"
 
 DEPENDS = "expat virtual/libintl autoconf-archive-native glib-2.0"
 RDEPENDS:${PN} += "${PN}-common ${PN}-tools"
@@ -66,13 +67,6 @@ CONFFILES:${PN} = "${sysconfdir}/dbus-1/system.conf ${sysconfdir}/dbus-1/session
 
 DEBIANNAME:${PN} = "dbus-1"
 
-OLDPKGNAME = "dbus-x11"
-OLDPKGNAME:class-nativesdk = ""
-
-# for compatibility
-RPROVIDES:${PN} = "${OLDPKGNAME}"
-RREPLACES:${PN} += "${OLDPKGNAME}"
-
 FILES:${PN} = "${bindir}/dbus-daemon* \
                ${bindir}/dbus-cleanup-sockets \
                ${bindir}/dbus-launch \
@@ -104,6 +98,7 @@ FILES:${PN}-tools = "${bindir}/dbus-uuidgen \
 "
 FILES:${PN}-lib = "${libdir}/lib*.so.*"
 RRECOMMENDS:${PN}-lib = "${PN}"
+RRECOMMENDS:${PN}-lib:class-target = "${VIRTUAL-RUNTIME_dbus}"
 FILES:${PN}-dev += "${libdir}/dbus-1.0/include ${bindir}/dbus-test-tool ${datadir}/xml/dbus-1"
 
 RDEPENDS:${PN}-ptest += "bash make dbus"
@@ -123,14 +118,22 @@ pkg_postinst:dbus() {
         fi
 }
 
+# dbus uses find_program() to find systemctl, which results in a build path in the
+# user dbus.socket
+EXTRA_OEMESON:append:class-target = " --cross-file=${WORKDIR}/dbus.cross"
 
-do_install() {
-        autotools_do_install
+do_configure:prepend:class-target() {
+    cat >${WORKDIR}/dbus.cross <<EOF
+[binaries]
+systemctl = '${bindir}/systemctl'
+EOF
+}
 
+do_install:append:class-target() {
         if ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'true', 'false', d)}; then
                 install -d ${D}${sysconfdir}/init.d
-                sed 's:@bindir@:${bindir}:' < ${WORKDIR}/dbus-1.init >${WORKDIR}/dbus-1.init.sh
-                install -m 0755 ${WORKDIR}/dbus-1.init.sh ${D}${sysconfdir}/init.d/dbus-1
+                sed 's:@bindir@:${bindir}:' < ${UNPACKDIR}/dbus-1.init > ${S}/dbus-1.init.sh
+                install -m 0755 ${S}/dbus-1.init.sh ${D}${sysconfdir}/init.d/dbus-1
                 install -d ${D}${sysconfdir}/default/volatiles
                 echo "d messagebus messagebus 0755 /run/dbus none" \
                      > ${D}${sysconfdir}/default/volatiles/99_dbus
@@ -145,7 +148,6 @@ do_install() {
                 ln -fs ../dbus.service ${D}${systemd_system_unitdir}/multi-user.target.wants/dbus.service
         fi
 
-
         mkdir -p ${D}${localstatedir}/lib/dbus
 
         chown messagebus:messagebus ${D}${localstatedir}/lib/dbus
@@ -159,27 +161,23 @@ do_install() {
         # Remove empty testexec directory as we don't build tests
         rm -rf ${D}${libdir}/dbus-1.0/test
 
-        # Remove /var/run as it is created on startup
-        rm -rf ${D}${localstatedir}/run
+        # Remove /run as it is created on startup
+        rm -rf ${D}${runtimedir}
 }
 
-do_install:class-native() {
-        autotools_do_install
-
+do_install:append:class-native() {
         # dbus-launch has no X support so lets not install it in case the host
         # has a more featured and useful version
         rm -f ${D}${bindir}/dbus-launch
 }
 
-do_install:class-nativesdk() {
-        autotools_do_install
-
+do_install:append:class-nativesdk() {
         # dbus-launch has no X support so lets not install it in case the host
         # has a more featured and useful version
         rm -f ${D}${bindir}/dbus-launch
 
-        # Remove /var/run to avoid QA error
-        rm -rf ${D}${localstatedir}/run
+        # Remove /run to avoid QA error
+        rm -rf ${D}${runtimedir}
 }
 BBCLASSEXTEND = "native nativesdk"
 
diff --git a/meta/recipes-core/dropbear/dropbear/0001-Fix-proxycmd-without-netcat.patch b/meta/recipes-core/dropbear/dropbear/0001-Fix-proxycmd-without-netcat.patch
new file mode 100644
index 0000000000..967b66322f
--- /dev/null
+++ b/meta/recipes-core/dropbear/dropbear/0001-Fix-proxycmd-without-netcat.patch
@@ -0,0 +1,74 @@
+From 5cc0127000db5f7567b54d0495fb91a8e452fe09 Mon Sep 17 00:00:00 2001
+From: Konstantin Demin <rockdrilla@gmail.com>
+Date: Fri, 9 May 2025 22:39:35 +0300
+Subject: [PATCH] Fix proxycmd without netcat
+
+fixes e5a0ef27c2 "Execute multihop commands directly, no shell"
+
+Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
+
+Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/5cc0127000db5f7567b54d0495fb91a8e452fe09]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/cli-main.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/src/cli-main.c b/src/cli-main.c
+index 2fafa88..0a052a3 100644
+--- a/src/cli-main.c
++++ b/src/cli-main.c
+@@ -77,7 +77,11 @@ int main(int argc, char ** argv) {
+        }
+ 
+ #if DROPBEAR_CLI_PROXYCMD
+-       if (cli_opts.proxycmd || cli_opts.proxyexec) {
++       if (cli_opts.proxycmd
++#if DROPBEAR_CLI_MULTIHOP
++               || cli_opts.proxyexec
++#endif
++       ) {
+                cli_proxy_cmd(&sock_in, &sock_out, &proxy_cmd_pid);
+                if (signal(SIGINT, kill_proxy_sighandler) == SIG_ERR ||
+                        signal(SIGTERM, kill_proxy_sighandler) == SIG_ERR ||
+@@ -110,11 +114,13 @@ static void shell_proxy_cmd(const void *user_data_cmd) {
+        dropbear_exit("Failed to run '%s'\n", cmd);
+ }
+ 
++#if DROPBEAR_CLI_MULTIHOP
+ static void exec_proxy_cmd(const void *unused) {
+        (void)unused;
+        run_command(cli_opts.proxyexec[0], cli_opts.proxyexec, ses.maxfd);
+        dropbear_exit("Failed to run '%s'\n", cli_opts.proxyexec[0]);
+ }
++#endif
+ 
+ static void cli_proxy_cmd(int *sock_in, int *sock_out, pid_t *pid_out) {
+        char * cmd_arg = NULL;
+@@ -145,9 +151,11 @@ static void cli_proxy_cmd(int *sock_in, int *sock_out, pid_t *pid_out) {
+                cmd_arg = m_malloc(shell_cmdlen);
+                snprintf(cmd_arg, shell_cmdlen, "exec %s", cli_opts.proxycmd);
+                exec_fn = shell_proxy_cmd;
++#if DROPBEAR_CLI_MULTIHOP
+        } else {
+                /* No shell */
+                exec_fn = exec_proxy_cmd;
++#endif
+        }
+ 
+        ret = spawn_command(exec_fn, cmd_arg, sock_out, sock_in, NULL, pid_out);
+@@ -159,6 +167,7 @@ static void cli_proxy_cmd(int *sock_in, int *sock_out, pid_t *pid_out) {
+ cleanup:
+        m_free(cli_opts.proxycmd);
+        m_free(cmd_arg);
++#if DROPBEAR_CLI_MULTIHOP
+        if (cli_opts.proxyexec) {
+                char **a = NULL;
+                for (a = cli_opts.proxyexec; *a; a++) {
+@@ -166,6 +175,7 @@ cleanup:
+                }
+                m_free(cli_opts.proxyexec);
+        }
++#endif
+ }
+ 
+ static void kill_proxy_sighandler(int UNUSED(signo)) {
diff --git a/meta/recipes-core/dropbear/dropbear/0001-urandom-xauth-changes-to-options.h.patch b/meta/recipes-core/dropbear/dropbear/0001-urandom-xauth-changes-to-options.h.patch
index 99adcfd770..0687e5dab1 100644
--- a/meta/recipes-core/dropbear/dropbear/0001-urandom-xauth-changes-to-options.h.patch
+++ b/meta/recipes-core/dropbear/dropbear/0001-urandom-xauth-changes-to-options.h.patch
@@ -1,15 +1,18 @@
-Subject: [PATCH 1/6] urandom-xauth-changes-to-options.h
+From cdc6a4a57a86d8116a92a5d905993e65cf723556 Mon Sep 17 00:00:00 2001
+From: Richard Purdie <richard@openedhand.com>
+Date: Wed, 31 Aug 2005 10:45:47 +0000
+Subject: [PATCH] urandom-xauth-changes-to-options.h
 
 Upstream-Status: Inappropriate [configuration]
 ---
- default_options.h | 2 +-
+ src/default_options.h | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
-diff --git a/default_options.h b/default_options.h
-index 349338c..5ffac25 100644
---- a/default_options.h
-+++ b/default_options.h
-@@ -289,7 +289,7 @@ group1 in Dropbear server too */
+diff --git a/src/default_options.h b/src/default_options.h
+index 6e970bb..ccc8b47 100644
+--- a/src/default_options.h
++++ b/src/default_options.h
+@@ -317,7 +317,7 @@ group1 in Dropbear server too */
  
  /* The command to invoke for xauth when using X11 forwarding.
   * "-q" for quiet */
@@ -18,6 +21,3 @@ index 349338c..5ffac25 100644
  
  
  /* If you want to enable running an sftp server (such as the one included with
--- 
-2.25.1
-
diff --git a/meta/recipes-core/dropbear/dropbear/0005-dropbear-enable-pam.patch b/meta/recipes-core/dropbear/dropbear/0005-dropbear-enable-pam.patch
index 32c3ea5f08..6743f506e9 100644
--- a/meta/recipes-core/dropbear/dropbear/0005-dropbear-enable-pam.patch
+++ b/meta/recipes-core/dropbear/dropbear/0005-dropbear-enable-pam.patch
@@ -1,7 +1,7 @@
-From b8cece92ba19aa77ac013ea161bfe4c7147747c9 Mon Sep 17 00:00:00 2001
+From 253ca01f0fc50dbaeb2ff8bcece0c34256eba94f Mon Sep 17 00:00:00 2001
 From: Jussi Kukkonen <jussi.kukkonen@intel.com>
 Date: Wed, 2 Dec 2015 11:36:02 +0200
-Subject: Enable pam
+Subject: [PATCH] Enable pam
 
 We need modify file default_options.h besides enabling pam in
 configure if we want dropbear to support pam.
@@ -11,14 +11,14 @@ Upstream-Status: Pending
 Signed-off-by: Xiaofeng Yan <xiaofeng.yan@windriver.com>
 Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
 ---
- default_options.h | 4 ++--
+ src/default_options.h | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)
 
-diff --git a/default_options.h b/default_options.h
-index 0e3d027..349338c 100644
---- a/default_options.h
-+++ b/default_options.h
-@@ -210,7 +210,7 @@ group1 in Dropbear server too */
+diff --git a/src/default_options.h b/src/default_options.h
+index ccc8b47..12768d1 100644
+--- a/src/default_options.h
++++ b/src/default_options.h
+@@ -228,7 +228,7 @@ group1 in Dropbear server too */
  
  /* Authentication Types - at least one required.
     RFC Draft requires pubkey auth, and recommends password */
@@ -27,7 +27,7 @@ index 0e3d027..349338c 100644
  
  /* Note: PAM auth is quite simple and only works for PAM modules which just do
   * a simple "Login: " "Password: " (you can edit the strings in svr-authpam.c).
-@@ -218,7 +218,7 @@ group1 in Dropbear server too */
+@@ -236,7 +236,7 @@ group1 in Dropbear server too */
   * but there's an interface via a PAM module. It won't work for more complex
   * PAM challenge/response.
   * You can't enable both PASSWORD and PAM. */
@@ -36,6 +36,3 @@ index 0e3d027..349338c 100644
  
  /* ~/.ssh/authorized_keys authentication.
   * You must define DROPBEAR_SVR_PUBKEY_AUTH in order to use plugins. */
--- 
-2.25.1
-
diff --git a/meta/recipes-core/dropbear/dropbear/0006-dropbear-configuration-file.patch b/meta/recipes-core/dropbear/dropbear/0006-dropbear-configuration-file.patch
index deed78ffb9..44861088cc 100644
--- a/meta/recipes-core/dropbear/dropbear/0006-dropbear-configuration-file.patch
+++ b/meta/recipes-core/dropbear/dropbear/0006-dropbear-configuration-file.patch
@@ -1,4 +1,4 @@
-From e3a5db1b6d3f6382a15b2266458c26c645a10f18 Mon Sep 17 00:00:00 2001
+From 16b147f97f0938cddb55ec1c90bc919c13f26fc0 Mon Sep 17 00:00:00 2001
 From: Mingli Yu <Mingli.Yu@windriver.com>
 Date: Thu, 6 Sep 2018 15:54:00 +0800
 Subject: [PATCH] dropbear configuration file
@@ -12,14 +12,14 @@ Signed-off-by: Maxin B. John <maxin.john@enea.com>
 Signed-off-by: Xiaofeng Yan <xiaofeng.yan@windriver.com>
 Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
 ---
- svr-authpam.c | 2 +-
+ src/svr-authpam.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
-diff --git a/svr-authpam.c b/svr-authpam.c
-index d201bc9..165ec5c 100644
---- a/svr-authpam.c
-+++ b/svr-authpam.c
-@@ -223,7 +223,7 @@ void svr_auth_pam(int valid_user) {
+diff --git a/src/svr-authpam.c b/src/svr-authpam.c
+index ec14632..026102f 100644
+--- a/src/svr-authpam.c
++++ b/src/svr-authpam.c
+@@ -224,7 +224,7 @@ void svr_auth_pam(int valid_user) {
         }
  
         /* Init pam */
@@ -28,6 +28,3 @@ index d201bc9..165ec5c 100644
                 dropbear_log(LOG_WARNING, "pam_start() failed, rc=%d, %s", 
                                 rc, pam_strerror(pamHandlep, rc));
                 goto cleanup;
--- 
-2.7.4
-
diff --git a/meta/recipes-core/dropbear/dropbear/CVE-2023-36328.patch b/meta/recipes-core/dropbear/dropbear/CVE-2023-36328.patch
deleted file mode 100644
index ec50d69816..0000000000
--- a/meta/recipes-core/dropbear/dropbear/CVE-2023-36328.patch
+++ /dev/null
@@ -1,144 +0,0 @@
-From beba892bc0d4e4ded4d667ab1d2a94f4d75109a9 Mon Sep 17 00:00:00 2001
-From: czurnieden <czurnieden@gmx.de>
-Date: Fri, 8 Sep 2023 10:07:32 +0000
-Subject: [PATCH] Fix possible integer overflow
-
-CVE: CVE-2023-36328
-
-Upstream-Status: Backport [https://github.com/libtom/libtommath/commit/beba892bc0d4e4ded4d667ab1d2a94f4d75109a9]
-
-Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
----
- libtommath/bn_mp_2expt.c                | 4 ++++
- libtommath/bn_mp_grow.c                 | 4 ++++
- libtommath/bn_mp_init_size.c            | 5 +++++
- libtommath/bn_mp_mul_2d.c               | 4 ++++
- libtommath/bn_s_mp_mul_digs.c           | 4 ++++
- libtommath/bn_s_mp_mul_digs_fast.c      | 4 ++++
- libtommath/bn_s_mp_mul_high_digs.c      | 4 ++++
- libtommath/bn_s_mp_mul_high_digs_fast.c | 4 ++++
- 8 files changed, 33 insertions(+)
-
-diff --git a/libtommath/bn_mp_2expt.c b/libtommath/bn_mp_2expt.c
-index 0ae3df1..ca6fbc3 100644
---- a/libtommath/bn_mp_2expt.c
-+++ b/libtommath/bn_mp_2expt.c
-@@ -12,6 +12,10 @@ mp_err mp_2expt(mp_int *a, int b)
- {
-    mp_err    err;
-
-+   if (b < 0) {
-+      return MP_VAL;
-+   }
-+
-    /* zero a as per default */
-    mp_zero(a);
-
-diff --git a/libtommath/bn_mp_grow.c b/libtommath/bn_mp_grow.c
-index 9e904c5..2b16826 100644
---- a/libtommath/bn_mp_grow.c
-+++ b/libtommath/bn_mp_grow.c
-@@ -9,6 +9,10 @@ mp_err mp_grow(mp_int *a, int size)
-    int     i;
-    mp_digit *tmp;
-
-+   if (size < 0) {
-+      return MP_VAL;
-+   }
-+
-    /* if the alloc size is smaller alloc more ram */
-    if (a->alloc < size) {
-       /* reallocate the array a->dp
-diff --git a/libtommath/bn_mp_init_size.c b/libtommath/bn_mp_init_size.c
-index d622687..5fefa96 100644
---- a/libtommath/bn_mp_init_size.c
-+++ b/libtommath/bn_mp_init_size.c
-@@ -6,6 +6,11 @@
- /* init an mp_init for a given size */
- mp_err mp_init_size(mp_int *a, int size)
- {
-+
-+   if (size < 0) {
-+      return MP_VAL;
-+   }
-+
-    size = MP_MAX(MP_MIN_PREC, size);
-
-    /* alloc mem */
-diff --git a/libtommath/bn_mp_mul_2d.c b/libtommath/bn_mp_mul_2d.c
-index 87354de..2744163 100644
---- a/libtommath/bn_mp_mul_2d.c
-+++ b/libtommath/bn_mp_mul_2d.c
-@@ -9,6 +9,10 @@ mp_err mp_mul_2d(const mp_int *a, int b, mp_int *c)
-    mp_digit d;
-    mp_err   err;
-
-+   if (b < 0) {
-+      return MP_VAL;
-+   }
-+
-    /* copy */
-    if (a != c) {
-       if ((err = mp_copy(a, c)) != MP_OKAY) {
-diff --git a/libtommath/bn_s_mp_mul_digs.c b/libtommath/bn_s_mp_mul_digs.c
-index 64509d4..2d2f5b0 100644
---- a/libtommath/bn_s_mp_mul_digs.c
-+++ b/libtommath/bn_s_mp_mul_digs.c
-@@ -16,6 +16,10 @@ mp_err s_mp_mul_digs(const mp_int *a, const mp_int *b, mp_int *c, int digs)
-    mp_word r;
-    mp_digit tmpx, *tmpt, *tmpy;
-
-+   if (digs < 0) {
-+      return MP_VAL;
-+   }
-+
-    /* can we use the fast multiplier? */
-    if ((digs < MP_WARRAY) &&
-        (MP_MIN(a->used, b->used) < MP_MAXFAST)) {
-diff --git a/libtommath/bn_s_mp_mul_digs_fast.c b/libtommath/bn_s_mp_mul_digs_fast.c
-index b2a287b..d6dd3cc 100644
---- a/libtommath/bn_s_mp_mul_digs_fast.c
-+++ b/libtommath/bn_s_mp_mul_digs_fast.c
-@@ -26,6 +26,10 @@ mp_err s_mp_mul_digs_fast(const mp_int *a, const mp_int *b, mp_int *c, int digs)
-    mp_digit W[MP_WARRAY];
-    mp_word  _W;
-
-+   if (digs < 0) {
-+      return MP_VAL;
-+   }
-+
-    /* grow the destination as required */
-    if (c->alloc < digs) {
-       if ((err = mp_grow(c, digs)) != MP_OKAY) {
-diff --git a/libtommath/bn_s_mp_mul_high_digs.c b/libtommath/bn_s_mp_mul_high_digs.c
-index 2bb2a50..c9dd355 100644
---- a/libtommath/bn_s_mp_mul_high_digs.c
-+++ b/libtommath/bn_s_mp_mul_high_digs.c
-@@ -15,6 +15,10 @@ mp_err s_mp_mul_high_digs(const mp_int *a, const mp_int *b, mp_int *c, int digs)
-    mp_word  r;
-    mp_digit tmpx, *tmpt, *tmpy;
-
-+   if (digs < 0) {
-+      return MP_VAL;
-+   }
-+
-    /* can we use the fast multiplier? */
-    if (MP_HAS(S_MP_MUL_HIGH_DIGS_FAST)
-        && ((a->used + b->used + 1) < MP_WARRAY)
-diff --git a/libtommath/bn_s_mp_mul_high_digs_fast.c b/libtommath/bn_s_mp_mul_high_digs_fast.c
-index a2c4fb6..afe3e4b 100644
---- a/libtommath/bn_s_mp_mul_high_digs_fast.c
-+++ b/libtommath/bn_s_mp_mul_high_digs_fast.c
-@@ -19,6 +19,10 @@ mp_err s_mp_mul_high_digs_fast(const mp_int *a, const mp_int *b, mp_int *c, int
-    mp_digit W[MP_WARRAY];
-    mp_word  _W;
-
-+   if (digs < 0) {
-+      return MP_VAL;
-+   }
-+
-    /* grow the destination as required */
-    pa = a->used + b->used;
-    if (c->alloc < pa) {
---
-2.35.5
diff --git a/meta/recipes-core/dropbear/dropbear/dropbear-disable-weak-ciphers.patch b/meta/recipes-core/dropbear/dropbear/dropbear-disable-weak-ciphers.patch
deleted file mode 100644
index 5c60868ed8..0000000000
--- a/meta/recipes-core/dropbear/dropbear/dropbear-disable-weak-ciphers.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From c347ece05a7fdbf50d76cb136b9ed45caed333f6 Mon Sep 17 00:00:00 2001
-From: Joseph Reynolds <joseph.reynolds1@ibm.com>
-Date: Thu, 20 Jun 2019 16:29:15 -0500
-Subject: [PATCH] dropbear: new feature: disable-weak-ciphers
-
-This feature disables all CBC, SHA1, and diffie-hellman group1 ciphers
-in the dropbear ssh server and client since they're considered weak ciphers
-and we want to support the stong algorithms.
-
-Upstream-Status: Inappropriate [configuration]
-Signed-off-by: Joseph Reynolds <joseph.reynolds1@ibm.com>
----
- default_options.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/default_options.h b/default_options.h
-index d417588..bc5200f 100644
---- a/default_options.h
-+++ b/default_options.h
-@@ -180,7 +180,7 @@ IMPORTANT: Some options will require "make clean" after changes */
-  * Small systems should generally include either curve25519 or ecdh for performance.
-  * curve25519 is less widely supported but is faster
-  */
--#define DROPBEAR_DH_GROUP14_SHA1 1
-+#define DROPBEAR_DH_GROUP14_SHA1 0
- #define DROPBEAR_DH_GROUP14_SHA256 1
- #define DROPBEAR_DH_GROUP16 0
- #define DROPBEAR_CURVE25519 1
--- 
-2.25.1
-
diff --git a/meta/recipes-core/dropbear/dropbear/dropbearkey.service b/meta/recipes-core/dropbear/dropbear/dropbearkey.service
index 71a12a6110..501e47124f 100644
--- a/meta/recipes-core/dropbear/dropbear/dropbearkey.service
+++ b/meta/recipes-core/dropbear/dropbear/dropbearkey.service
@@ -9,6 +9,6 @@ Environment="DROPBEAR_RSAKEY_DIR=/etc/dropbear"
 EnvironmentFile=-/etc/default/dropbear
 Type=oneshot
 ExecStart=@BASE_BINDIR@/mkdir -p ${DROPBEAR_RSAKEY_DIR}
-ExecStart=@SBINDIR@/dropbearkey -t rsa -f ${DROPBEAR_RSAKEY_DIR}/dropbear_rsa_host_key
+ExecStart=@SBINDIR@/dropbearkey -t rsa -f ${DROPBEAR_RSAKEY_DIR}/dropbear_rsa_host_key $DROPBEAR_RSAKEY_ARGS
 RemainAfterExit=yes
 Nice=10
diff --git a/meta/recipes-core/dropbear/dropbear_2022.83.bb b/meta/recipes-core/dropbear/dropbear_2025.88.bb
index 528eff1a10..72a886d907 100644
--- a/meta/recipes-core/dropbear/dropbear_2022.83.bb
+++ b/meta/recipes-core/dropbear/dropbear_2025.88.bb
@@ -19,12 +19,12 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \
            file://dropbear@.service \
            file://dropbear.socket \
            file://dropbear.default \
+           file://0001-Fix-proxycmd-without-netcat.patch \
            ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \
-           ${@bb.utils.contains('PACKAGECONFIG', 'disable-weak-ciphers', 'file://dropbear-disable-weak-ciphers.patch', '', d)} \
-           file://CVE-2023-36328.patch \
            "
 
-SRC_URI[sha256sum] = "bc5a121ffbc94b5171ad5ebe01be42746d50aa797c9549a4639894a16749443b"
+SRC_URI[sha256sum] = "783f50ea27b17c16da89578fafdb6decfa44bb8f6590e5698a4e4d3672dc53d4"
+MIRRORS += "http://matt.ucc.asn.au/dropbear/releases/ https://dropbear.nl/mirror/releases/"
 
 PAM_SRC_URI = "file://0005-dropbear-enable-pam.patch \
                file://0006-dropbear-configuration-file.patch \
@@ -48,11 +48,10 @@ SBINCOMMANDS = "dropbear dropbearkey dropbearconvert"
 BINCOMMANDS = "dbclient ssh scp"
 EXTRA_OEMAKE = 'MULTI=1 SCPPROGRESS=1 PROGRAMS="${SBINCOMMANDS} ${BINCOMMANDS}"'
 
-PACKAGECONFIG ?= "disable-weak-ciphers ${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)}"
+PACKAGECONFIG ?= "${@bb.utils.filter('DISTRO_FEATURES', 'pam x11', d)}"
 PACKAGECONFIG[pam] = "--enable-pam,--disable-pam,libpam,${PAM_PLUGINS}"
 PACKAGECONFIG[system-libtom] = "--disable-bundled-libtom,--enable-bundled-libtom,libtommath libtomcrypt"
-PACKAGECONFIG[disable-weak-ciphers] = ""
-PACKAGECONFIG[enable-x11-forwarding] = ""
+PACKAGECONFIG[x11] = ",,,,xauth"
 
 # This option appends to CFLAGS and LDFLAGS from OE
 # This is causing [textrel] QA warning
@@ -63,7 +62,7 @@ EXTRA_OECONF:append:libc-musl = " --disable-wtmp --disable-lastlog"
 
 do_configure:append() {
         echo "/* Dropbear features */" > ${B}/localoptions.h
-        if ${@bb.utils.contains('PACKAGECONFIG', 'enable-x11-forwarding', 'true', 'false', d)}; then
+        if ${@bb.utils.contains('PACKAGECONFIG', 'x11', 'true', 'false', d)}; then
                 echo "#define DROPBEAR_X11FWD 1" >> ${B}/localoptions.h
         fi
 }
@@ -77,7 +76,7 @@ do_install() {
                 ${D}${sbindir} \
                 ${D}${localstatedir}
 
-        install -m 0644 ${WORKDIR}/dropbear.default ${D}${sysconfdir}/default/dropbear
+        install -m 0644 ${UNPACKDIR}/dropbear.default ${D}${sysconfdir}/default/dropbear
 
         install -m 0755 dropbearmulti ${D}${sbindir}/
 
@@ -95,18 +94,18 @@ do_install() {
                 -e 's,/usr/sbin,${sbindir},g' \
                 -e 's,/var,${localstatedir},g' \
                 -e 's,/usr/bin,${bindir},g' \
-                -e 's,/usr,${prefix},g' ${WORKDIR}/init > ${D}${sysconfdir}/init.d/dropbear
+                -e 's,/usr,${prefix},g' ${UNPACKDIR}/init > ${D}${sysconfdir}/init.d/dropbear
         chmod 755 ${D}${sysconfdir}/init.d/dropbear
         if [ "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)}" ]; then
                 install -d ${D}${sysconfdir}/pam.d
-                install -m 0644 ${WORKDIR}/dropbear  ${D}${sysconfdir}/pam.d/
+                install -m 0644 ${UNPACKDIR}/dropbear  ${D}${sysconfdir}/pam.d/
         fi
 
         # deal with systemd unit files
         install -d ${D}${systemd_system_unitdir}
-        install -m 0644 ${WORKDIR}/dropbearkey.service ${D}${systemd_system_unitdir}
-        install -m 0644 ${WORKDIR}/dropbear@.service ${D}${systemd_system_unitdir}
-        install -m 0644 ${WORKDIR}/dropbear.socket ${D}${systemd_system_unitdir}
+        install -m 0644 ${UNPACKDIR}/dropbearkey.service ${D}${systemd_system_unitdir}
+        install -m 0644 ${UNPACKDIR}/dropbear@.service ${D}${systemd_system_unitdir}
+        install -m 0644 ${UNPACKDIR}/dropbear.socket ${D}${systemd_system_unitdir}
         sed -i -e 's,@BASE_BINDIR@,${base_bindir},g' \
                 -e 's,@BINDIR@,${bindir},g' \
                 -e 's,@SBINDIR@,${sbindir},g' \
@@ -130,3 +129,5 @@ pkg_postrm:${PN} () {
 }
 
 CONFFILES:${PN} = "${sysconfdir}/default/dropbear"
+
+FILES:${PN} += "${systemd_system_unitdir}/dropbearkey.service"
diff --git a/meta/recipes-core/ell/ell_0.64.bb b/meta/recipes-core/ell/ell_0.76.bb
index c4f16905fd..fcc56e02f7 100644
--- a/meta/recipes-core/ell/ell_0.64.bb
+++ b/meta/recipes-core/ell/ell_0.76.bb
@@ -15,8 +15,4 @@ DEPENDS = "dbus"
 inherit autotools pkgconfig
 
 SRC_URI = "https://mirrors.edge.kernel.org/pub/linux/libs/${BPN}/${BPN}-${PV}.tar.xz"
-SRC_URI[sha256sum] = "760f3901078409f66cadf1bb24c8bdc60f13d53f6dd66b88631221d2494f8405"
-
-do_configure:prepend () {
-    mkdir -p ${S}/build-aux
-}
+SRC_URI[sha256sum] = "a0bf2b5a78450c0c167e3f65c18452ffe4c0f179d48c2a3661e6afaca8017ef9"
diff --git a/meta/recipes-core/expat/expat_2.6.2.bb b/meta/recipes-core/expat/expat_2.7.1.bb
index 6c9db91bef..2da1532922 100644
--- a/meta/recipes-core/expat/expat_2.6.2.bb
+++ b/meta/recipes-core/expat/expat_2.7.1.bb
@@ -4,7 +4,7 @@ HOMEPAGE = "https://github.com/libexpat/libexpat"
 SECTION = "libs"
 LICENSE = "MIT"
 
-LIC_FILES_CHKSUM = "file://COPYING;md5=7b3b078238d0901d3b339289117cb7fb"
+LIC_FILES_CHKSUM = "file://COPYING;md5=f4fedd6116da0e171f7cb4d2923d7ac2"
 
 VERSION_TAG = "${@d.getVar('PV').replace('.', '_')}"
 
@@ -15,7 +15,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2  \
 GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
 UPSTREAM_CHECK_REGEX = "releases/tag/R_(?P<pver>.+)"
 
-SRC_URI[sha256sum] = "9c7c1b5dcbc3c237c500a8fb1493e14d9582146dd9b42aa8d3ffb856a3b927e0"
+SRC_URI[sha256sum] = "45c98ae1e9b5127325d25186cf8c511fa814078e9efeae7987a574b482b79b3d"
 
 EXTRA_OECMAKE:class-native += "-DEXPAT_BUILD_DOCS=OFF"
 
diff --git a/meta/recipes-core/fts/fts_1.2.7.bb b/meta/recipes-core/fts/fts_1.2.7.bb
index 10103830af..699dc5ddd3 100644
--- a/meta/recipes-core/fts/fts_1.2.7.bb
+++ b/meta/recipes-core/fts/fts_1.2.7.bb
@@ -12,8 +12,6 @@ SRCREV = "0bde52df588e8969879a2cae51c3a4774ec62472"
 
 SRC_URI = "git://github.com/pullmoll/musl-fts.git;branch=master;protocol=https"
 
-S = "${WORKDIR}/git"
-
 inherit autotools pkgconfig
 #
 # We will skip parsing for non-musl systems
diff --git a/meta/recipes-core/gettext/gettext-minimal-native_0.22.5.bb b/meta/recipes-core/gettext/gettext-minimal-native_0.23.1.bb
index db1bbb7e68..941896ec48 100644
--- a/meta/recipes-core/gettext/gettext-minimal-native_0.22.5.bb
+++ b/meta/recipes-core/gettext/gettext-minimal-native_0.23.1.bb
@@ -13,11 +13,11 @@ INHIBIT_DEFAULT_DEPS = "1"
 INHIBIT_AUTOTOOLS_DEPS = "1"
 
 LICENSE = "FSF-Unlimited"
-LIC_FILES_CHKSUM = "file://../COPYING;md5=4bd090a20bfcd1a18f1f79837b5e3e91"
+LIC_FILES_CHKSUM = "file://${UNPACKDIR}/COPYING;md5=4bd090a20bfcd1a18f1f79837b5e3e91"
 
 inherit native
 
-S = "${WORKDIR}/gettext-${PV}"
+S = "${UNPACKDIR}/gettext-${PV}"
 
 python get_aclocal_files() {
     fpath = oe.path.join(d.getVar("S"), "/gettext-tools/m4/Makefile.am")
@@ -42,5 +42,5 @@ do_install () {
         install -d ${D}${datadir}/gettext/po/
         cp ${S}/build-aux/config.rpath ${D}${datadir}/gettext/
         cp ${S}/gettext-runtime/po/Makefile.in.in ${D}${datadir}/gettext/po/
-        cp ${S}/gettext-runtime/po/remove-potcdate.sin ${D}${datadir}/gettext/po/
+        cp ${S}/gettext-runtime/po/remove-potcdate.sed ${D}${datadir}/gettext/po/
 }
diff --git a/meta/recipes-core/gettext/gettext-sources.inc b/meta/recipes-core/gettext/gettext-sources.inc
index fd05837528..5d90d81b58 100644
--- a/meta/recipes-core/gettext/gettext-sources.inc
+++ b/meta/recipes-core/gettext/gettext-sources.inc
@@ -1,4 +1,4 @@
 HOMEPAGE = "http://www.gnu.org/software/gettext/gettext.html"
 SRC_URI = "${GNU_MIRROR}/gettext/gettext-${PV}.tar.gz \
            "
-SRC_URI[sha256sum] = "ec1705b1e969b83a9f073144ec806151db88127f5e40fe5a94cb6c8fa48996a0"
+SRC_URI[sha256sum] = "52a578960fe308742367d75cd1dff8552c5797bd0beba7639e12bdcda28c0e49"
diff --git a/meta/recipes-core/gettext/gettext/0001-init-env.in-do-not-add-C-CXX-parameters.patch b/meta/recipes-core/gettext/gettext/0001-init-env.in-do-not-add-C-CXX-parameters.patch
index 33d45a038c..e59c73fb7d 100644
--- a/meta/recipes-core/gettext/gettext/0001-init-env.in-do-not-add-C-CXX-parameters.patch
+++ b/meta/recipes-core/gettext/gettext/0001-init-env.in-do-not-add-C-CXX-parameters.patch
@@ -1,4 +1,4 @@
-From c58c503c532d20883a93ef778327c86dd6de24f6 Mon Sep 17 00:00:00 2001
+From 9d36ff90d3a488caa8cd7b3351e5a3bdc4229b1b Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Fri, 6 Mar 2020 21:04:05 +0000
 Subject: [PATCH] init-env.in: do not add C/CXX parameters
@@ -13,7 +13,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
  1 file changed, 4 deletions(-)
 
 diff --git a/gettext-tools/tests/init-env.in b/gettext-tools/tests/init-env.in
-index cc84ffd..b69c990 100644
+index 0968388..3d9a8a5 100644
 --- a/gettext-tools/tests/init-env.in
 +++ b/gettext-tools/tests/init-env.in
 @@ -3,10 +3,6 @@ top_builddir=../..
@@ -24,6 +24,6 @@ index cc84ffd..b69c990 100644
 -CFLAGS="@CFLAGS@"
 -CXX="@CXX@"
 -CXXFLAGS="@CXXFLAGS@"
+ OBJC="@OBJC@"
+ OBJCFLAGS="@OBJCFLAGS@"
  CPPFLAGS="@CPPFLAGS@"
- LDFLAGS="@LDFLAGS@"
- LTLIBINTL="@LTLIBINTL@"
diff --git a/meta/recipes-core/gettext/gettext/0001-tests-autopoint-3-unset-MAKEFLAGS.patch b/meta/recipes-core/gettext/gettext/0001-tests-autopoint-3-unset-MAKEFLAGS.patch
index 94afb255c3..a8f6684bd7 100644
--- a/meta/recipes-core/gettext/gettext/0001-tests-autopoint-3-unset-MAKEFLAGS.patch
+++ b/meta/recipes-core/gettext/gettext/0001-tests-autopoint-3-unset-MAKEFLAGS.patch
@@ -1,4 +1,4 @@
-From 7006142d199af13628edc687847a9a5bac48b45d Mon Sep 17 00:00:00 2001
+From 4e9ea45803fe8dfc41ec5c51a65048addd985765 Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Tue, 7 Jan 2020 16:44:38 +0100
 Subject: [PATCH] tests/autopoint-3: unset MAKEFLAGS
@@ -13,13 +13,13 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
  1 file changed, 1 insertion(+)
 
 diff --git a/gettext-tools/tests/autopoint-3 b/gettext-tools/tests/autopoint-3
-index bd3fbf3..380eaac 100755
+index af2e17f..46cf3f7 100755
 --- a/gettext-tools/tests/autopoint-3
 +++ b/gettext-tools/tests/autopoint-3
-@@ -131,6 +131,7 @@ test $? = 0 || { cat autopoint.err; Exit 1; }
- ${CONFIG_SHELL} ./configure >/dev/null 2>autpoint.err
+@@ -137,6 +137,7 @@ ${CONFIG_SHELL} ./configure >/dev/null 2>autopoint.err
  test $? = 0 || { cat autopoint.err; Exit 1; }
  
+ : ${MAKE=make}
 +unset MAKEFLAGS
  ${MAKE} >/dev/null 2>autopoint.err
  test $? = 0 || { cat autopoint.err; Exit 1; }
diff --git a/meta/recipes-core/gettext/gettext/parallel.patch b/meta/recipes-core/gettext/gettext/parallel.patch
deleted file mode 100644
index 8ecba46fd0..0000000000
--- a/meta/recipes-core/gettext/gettext/parallel.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 83333bc873c2655ff1de161f6b7db930f22f1cea Mon Sep 17 00:00:00 2001
-From: Joe Slater <jslater@windriver.com>
-Date: Thu, 7 Jun 2012 16:37:01 -0700
-Subject: [PATCH] instal libgettextlib.a before removing it
-
-In a multiple job build, Makefile can simultaneously
-be installing and removing libgettextlib.a.  We serialize
-the operations.
-
-Upstream-Status: Pending
-
-Signed-off-by: Joe Slater <jslater@windriver.com>
----
- gettext-tools/gnulib-lib/Makefile.am | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/gettext-tools/gnulib-lib/Makefile.am b/gettext-tools/gnulib-lib/Makefile.am
-index ab729cd..a0d713e 100644
---- a/gettext-tools/gnulib-lib/Makefile.am
-+++ b/gettext-tools/gnulib-lib/Makefile.am
-@@ -58,6 +58,10 @@ AM_CFLAGS = @WARN_CFLAGS@
- # Rules generated and collected by gnulib-tool.
- include Makefile.gnulib
- 
-+# defined in Makefile.gnulib but missing this dependency
-+#
-+install-exec-clean: install-libLTLIBRARIES
-+
- # OS/2 does not support a DLL name longer than 8 characters.
- if OS2
- libgettextlib_la_LDFLAGS += -os2dllname gtlib
diff --git a/meta/recipes-core/gettext/gettext/serial-tests-config.patch b/meta/recipes-core/gettext/gettext/serial-tests-config.patch
index 7d39d6086a..3baf549795 100644
--- a/meta/recipes-core/gettext/gettext/serial-tests-config.patch
+++ b/meta/recipes-core/gettext/gettext/serial-tests-config.patch
@@ -1,4 +1,4 @@
-From aa8dfe0aafd0b53a6c5bac61b356ca92e1430a36 Mon Sep 17 00:00:00 2001
+From 33fd16b0b2c69ec1118bb605384e7e3b1a94eee0 Mon Sep 17 00:00:00 2001
 From: "Hongjun.Yang" <hongjun.yang@windriver.com>
 Date: Thu, 28 Jul 2016 12:36:15 +0800
 Subject: [PATCH] fix for ptest
@@ -15,7 +15,7 @@ Signed-off-by: Changqing Li <changqing.li@windriver.com>
  3 files changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index f4e54ea..a47ff14 100644
+index 5106676..3114998 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -22,7 +22,7 @@ AC_INIT([gettext],
@@ -28,7 +28,7 @@ index f4e54ea..a47ff14 100644
  dnl Override automake's tar command used for creating distributions.
  am__tar='${AMTAR} chf - --format=ustar --owner=root --group=root "$$tardir"'
 diff --git a/gettext-runtime/configure.ac b/gettext-runtime/configure.ac
-index 126d069..aa23232 100644
+index e128f5b..9f7447c 100644
 --- a/gettext-runtime/configure.ac
 +++ b/gettext-runtime/configure.ac
 @@ -22,7 +22,7 @@ AC_INIT([gettext-runtime],
@@ -41,7 +41,7 @@ index 126d069..aa23232 100644
  
  dnl Installation directories.
 diff --git a/gettext-tools/configure.ac b/gettext-tools/configure.ac
-index 3610ee3..6f56a23 100644
+index 3b1f461..14510a9 100644
 --- a/gettext-tools/configure.ac
 +++ b/gettext-tools/configure.ac
 @@ -22,7 +22,7 @@ AC_INIT([gettext-tools],
diff --git a/meta/recipes-core/gettext/gettext/use-pkgconfig.patch b/meta/recipes-core/gettext/gettext/use-pkgconfig.patch
index ceb1856118..9774c4cce0 100644
--- a/meta/recipes-core/gettext/gettext/use-pkgconfig.patch
+++ b/meta/recipes-core/gettext/gettext/use-pkgconfig.patch
@@ -1,4 +1,4 @@
-From 6aa1338b916fe72c200b6f160b934be15b6ff590 Mon Sep 17 00:00:00 2001
+From 7302a77e08e62fc3b00f75d8aa143c5565c3f680 Mon Sep 17 00:00:00 2001
 From: Ross Burton <ross.burton@intel.com>
 Date: Tue, 23 Jan 2018 00:54:13 +0000
 Subject: [PATCH] gettext: beat library detection into shape
@@ -19,10 +19,10 @@ Signed-off-by: Ross Burton <ross.burton@intel.com>
  3 files changed, 31 insertions(+), 286 deletions(-)
 
 diff --git a/gettext-tools/gnulib-m4/libxml.m4 b/gettext-tools/gnulib-m4/libxml.m4
-index 0340490..0355388 100644
+index c7160d7..8e46cc7 100644
 --- a/gettext-tools/gnulib-m4/libxml.m4
 +++ b/gettext-tools/gnulib-m4/libxml.m4
-@@ -13,6 +13,7 @@ dnl gl_LIBXML(FORCE-INCLUDED)
+@@ -14,6 +14,7 @@ dnl gl_LIBXML(FORCE-INCLUDED)
  dnl   forces the use of the included or an external libxml.
  AC_DEFUN([gl_LIBXML],
  [
@@ -30,7 +30,7 @@ index 0340490..0355388 100644
    AC_REQUIRE([AM_ICONV_LINK])
  
    ifelse([$1], , [
-@@ -30,106 +31,10 @@ AC_DEFUN([gl_LIBXML],
+@@ -31,106 +32,10 @@ AC_DEFUN([gl_LIBXML],
    INCXML=
    ifelse([$1], [yes], , [
      if test "$gl_cv_libxml_use_included" != yes; then
@@ -142,10 +142,10 @@ index 0340490..0355388 100644
    ])
    AC_SUBST([LIBXML])
 diff --git a/libtextstyle/gnulib-local/m4/libglib.m4 b/libtextstyle/gnulib-local/m4/libglib.m4
-index dbc9eb8..136e512 100644
+index baa2cf4..b287c5b 100644
 --- a/libtextstyle/gnulib-local/m4/libglib.m4
 +++ b/libtextstyle/gnulib-local/m4/libglib.m4
-@@ -6,106 +6,26 @@ dnl with or without modifications, as long as this notice is preserved.
+@@ -7,106 +7,26 @@ dnl with or without modifications, as long as this notice is preserved.
  
  dnl From Bruno Haible.
  
@@ -266,10 +266,10 @@ index dbc9eb8..136e512 100644
    AC_SUBST([LTLIBGLIB])
    AC_SUBST([INCGLIB])
 diff --git a/libtextstyle/gnulib-m4/libglib.m4 b/libtextstyle/gnulib-m4/libglib.m4
-index dbc9eb8..136e512 100644
+index baa2cf4..b287c5b 100644
 --- a/libtextstyle/gnulib-m4/libglib.m4
 +++ b/libtextstyle/gnulib-m4/libglib.m4
-@@ -6,106 +6,26 @@ dnl with or without modifications, as long as this notice is preserved.
+@@ -7,106 +7,26 @@ dnl with or without modifications, as long as this notice is preserved.
  
  dnl From Bruno Haible.
  
diff --git a/meta/recipes-core/gettext/gettext_0.22.5.bb b/meta/recipes-core/gettext/gettext_0.23.1.bb
index 1a66d37916..c704a3b6d7 100644
--- a/meta/recipes-core/gettext/gettext_0.22.5.bb
+++ b/meta/recipes-core/gettext/gettext_0.23.1.bb
@@ -13,7 +13,6 @@ LIC_FILES_CHKSUM:append = " ${@bb.utils.contains('PACKAGECONFIG', 'libxml', '',
 # without glib in PACKAGECONFIG vendor copy of the lib will be used
 LIC_FILES_CHKSUM:append = " ${@bb.utils.contains('PACKAGECONFIG', 'glib', '', 'file://libtextstyle/lib/glib/ghash.c;md5=e3159f5ac38dfe77af5cc0ee104dab2d;beginline=10;endline=27', d)}"
 
-
 DEPENDS = "gettext-native virtual/libiconv"
 DEPENDS:class-native = "gettext-minimal-native"
 PROVIDES = "virtual/libintl virtual/gettext"
@@ -22,7 +21,6 @@ RCONFLICTS:${PN} = "proxy-libintl"
 
 require gettext-sources.inc
 SRC_URI += " \
-           file://parallel.patch \
            file://use-pkgconfig.patch \
            file://run-ptest \
            file://serial-tests-config.patch \
@@ -64,9 +62,6 @@ PACKAGECONFIG[libxml] = "--without-included-libxml,--with-included-libxml,libxml
 PACKAGECONFIG[libunistring] = "--with-libunistring-prefix=${STAGING_LIBDIR}/..,--with-included-libunistring,libunistring"
 PACKAGECONFIG[msgcat-curses] = "--with-libncurses-prefix=${STAGING_LIBDIR}/..,--disable-curses,ncurses,"
 
-acpaths = '-I ${S}/gettext-runtime/m4 \
-           -I ${S}/gettext-tools/m4'
-
 do_install:append:libc-musl () {
         rm -f ${D}${libdir}/charset.alias
         rm -f ${D}${includedir}/libintl.h
@@ -89,7 +84,7 @@ FILES:libgettextsrc = "${libdir}/libgettextsrc-*.so*"
 
 PACKAGES =+ "gettext-runtime gettext-runtime-dev gettext-runtime-doc"
 
-FILES:${PN} += "${libdir}/${BPN}/*"
+FILES:${PN} += "${libdir}/${BPN}/"
 
 # The its/Makefile.am has defined:
 # itsdir = $(pkgdatadir)$(PACKAGE_SUFFIX)/its
@@ -129,7 +124,7 @@ do_install:append:class-native () {
         rm ${D}${datadir}/aclocal/*
         rm ${D}${datadir}/gettext/config.rpath
         rm ${D}${datadir}/gettext/po/Makefile.in.in
-        rm ${D}${datadir}/gettext/po/remove-potcdate.sin
+        rm ${D}${datadir}/gettext/po/remove-potcdate.sed
 
         create_wrapper ${D}${bindir}/msgfmt \
                 GETTEXTDATADIR="${STAGING_DATADIR_NATIVE}/gettext-${PV}/"
@@ -144,7 +139,6 @@ do_compile_ptest() {
 }
 
 do_install_ptest() {
-    if [ ${PTEST_ENABLED} = "1" ]; then
         mkdir -p                                        ${D}${PTEST_PATH}/tests
         mkdir -p                                        ${D}${PTEST_PATH}/src
         mkdir -p                                        ${D}${PTEST_PATH}/po
@@ -175,9 +169,9 @@ do_install_ptest() {
         install ${B}/gettext-tools/misc/*       ${D}${PTEST_PATH}/misc
         find ${D}${PTEST_PATH}/ -name "*.o" -exec rm {} \;
         chmod 0755 ${D}${PTEST_PATH}/tests/lang-vala ${D}${PTEST_PATH}/tests/plural-1 ${D}${PTEST_PATH}/tests/xgettext-tcl-4 \
-                   ${D}${PTEST_PATH}/tests/xgettext-vala-1  ${D}${PTEST_PATH}/tests/xgettext-po-2 ${D}${PTEST_PATH}/tests/xgettext-vala-6
+                   ${D}${PTEST_PATH}/tests/xgettext-vala-1  ${D}${PTEST_PATH}/tests/xgettext-po-2 ${D}${PTEST_PATH}/tests/xgettext-vala-6 \
+                   ${D}${PTEST_PATH}/tests/plural-3 ${D}${PTEST_PATH}/tests/plural-4 ${D}${PTEST_PATH}/tests/xgettext-java-8 ${D}${PTEST_PATH}/tests/xgettext-java-9
         sed -i -e 's|${DEBUG_PREFIX_MAP}||g' ${D}${PTEST_PATH}/tests/init-env
-    fi
 }
 
 RDEPENDS:${PN}-ptest += "make xz bash gawk autoconf locale-base-de-de locale-base-fr-fr"
@@ -207,7 +201,4 @@ RRECOMMENDS:${PN}-ptest:append:libc-glibc = "\
     locale-base-fr-fr.iso-8859-1 \
 "
 
-INSANE_SKIP:${PN}-ptest += "ldflags"
-INSANE_SKIP:${PN}-ptest += "rpaths"
-
 BBCLASSEXTEND = "native nativesdk"
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/0001-Do-not-write-bindir-into-pkg-config-files.patch b/meta/recipes-core/glib-2.0/files/0001-Do-not-write-bindir-into-pkg-config-files.patch
index 8e6598fbef..c394ab3277 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0/0001-Do-not-write-bindir-into-pkg-config-files.patch
+++ b/meta/recipes-core/glib-2.0/files/0001-Do-not-write-bindir-into-pkg-config-files.patch
@@ -1,26 +1,30 @@
-From e7077aa23bfcd31a8e72e39dc93ce4f854678376 Mon Sep 17 00:00:00 2001
+From 8981db5d775e04b72fb68b6a4553c87fdaedee65 Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Fri, 15 Feb 2019 11:17:27 +0100
-Subject: [PATCH] Do not write $bindir into pkg-config files
+Subject: [PATCH] Do not prefix executables with $bindir in pkg-config files
 
-This would otherwise break when using the files to build other target
+This would otherwise break when using the executables to build other target
 components (we need to rely on PATH containing the paths to utilities,
 rather than use target paths).
 
 Upstream-Status: Inappropriate [upstream wants the paths in .pc files]
 Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
 ---
- gio/meson.build  | 16 ++++++++--------
- glib/meson.build |  6 +++---
- 2 files changed, 11 insertions(+), 11 deletions(-)
+ gio/meson.build  | 17 +++++++++--------
+ glib/meson.build |  7 ++++---
+ 2 files changed, 13 insertions(+), 11 deletions(-)
 
 diff --git a/gio/meson.build b/gio/meson.build
-index 5f91586..1a95f4f 100644
+index 5d91b89..1a8da12 100644
 --- a/gio/meson.build
 +++ b/gio/meson.build
-@@ -884,14 +884,14 @@ pkg.generate(libgio,
+@@ -901,17 +901,18 @@ libgio_dep = declare_dependency(link_with : libgio,
+ pkg.generate(libgio,
+   requires : ['glib-2.0', 'gobject-2.0'],
+   variables : [
++    'bindir=' + '${prefix}' / get_option('bindir'),
+     'schemasdir=' + '${datadir}' / schemas_subdir,
      'dtdsdir=' + '${datadir}' / dtds_subdir,
-     'bindir=' + '${prefix}' / get_option('bindir'),
      'giomoduledir=' + pkgconfig_giomodulesdir,
 -    'gio=' + '${bindir}' / 'gio',
 -    'gio_querymodules=' + pkgconfig_multiarch_bindir / 'gio-querymodules',
@@ -39,19 +43,20 @@ index 5f91586..1a95f4f 100644
 +    'gresource=gresource',
 +    'gsettings=gsettings',
    ],
-   version : glib_version,
-   install_dir : glib_pkgconfigreldir,
+   uninstalled_variables : [
+     'gio=${prefix}/gio/gio',
 diff --git a/glib/meson.build b/glib/meson.build
-index c26a35e..1d8ca6b 100644
+index 837960d..97d4af0 100644
 --- a/glib/meson.build
 +++ b/glib/meson.build
-@@ -447,9 +447,9 @@ pkg.generate(libglib,
+@@ -443,9 +443,10 @@ pkg.generate(libglib,
+   subdirs : ['glib-2.0'],
+   extra_cflags : ['-I${libdir}/glib-2.0/include'] + win32_cflags,
    variables : [
-     'bindir=' + '${prefix}' / get_option('bindir'),
-     'datadir=' + '${prefix}' / get_option('datadir'),
 -    'glib_genmarshal=' + '${bindir}' / 'glib-genmarshal',
 -    'gobject_query=' + '${bindir}' / 'gobject-query',
 -    'glib_mkenums=' + '${bindir}' / 'glib-mkenums',
++    'bindir=' + '${prefix}' / get_option('bindir'),
 +    'glib_genmarshal=glib-genmarshal',
 +    'gobject_query=gobject-query',
 +    'glib_mkenums=glib-mkenums',
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/0001-Fix-DATADIRNAME-on-uclibc-Linux.patch b/meta/recipes-core/glib-2.0/files/0001-Fix-DATADIRNAME-on-uclibc-Linux.patch
index eb9dfdbcf9..19fffbdc5f 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0/0001-Fix-DATADIRNAME-on-uclibc-Linux.patch
+++ b/meta/recipes-core/glib-2.0/files/0001-Fix-DATADIRNAME-on-uclibc-Linux.patch
@@ -1,4 +1,4 @@
-From 9a5d4bf65b658d744d610ee27ecd2ae65b14b158 Mon Sep 17 00:00:00 2001
+From 48bfc87e9f757cf65ad967520860bfd7526c36f2 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Sat, 15 Mar 2014 22:42:29 -0700
 Subject: [PATCH] Fix DATADIRNAME on uclibc/Linux
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/0001-Install-gio-querymodules-as-libexec_PROGRAM.patch b/meta/recipes-core/glib-2.0/files/0001-Install-gio-querymodules-as-libexec_PROGRAM.patch
index ad69f7ec65..89ba10ff6d 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0/0001-Install-gio-querymodules-as-libexec_PROGRAM.patch
+++ b/meta/recipes-core/glib-2.0/files/0001-Install-gio-querymodules-as-libexec_PROGRAM.patch
@@ -1,4 +1,4 @@
-From 4933aef791857a5aac650b60af800778658b875b Mon Sep 17 00:00:00 2001
+From b8dcbf03b315d31759176e9d4fd389e8fda6ffcd Mon Sep 17 00:00:00 2001
 From: Jussi Kukkonen <jussi.kukkonen@intel.com>
 Date: Tue, 22 Mar 2016 15:14:58 +0200
 Subject: [PATCH] Install gio-querymodules as libexec_PROGRAM
@@ -13,10 +13,10 @@ Upstream-Status: Inappropriate [OE specific]
  1 file changed, 1 insertion(+)
 
 diff --git a/gio/meson.build b/gio/meson.build
-index f9fdf6e..5f91586 100644
+index 854b95a..5d91b89 100644
 --- a/gio/meson.build
 +++ b/gio/meson.build
-@@ -1005,6 +1005,7 @@ gio_querymodules = executable('gio-querymodules', 'gio-querymodules.c', 'giomodu
+@@ -1038,6 +1038,7 @@ gio_querymodules = executable('gio-querymodules', 'gio-querymodules.c', 'giomodu
    c_args : gio_c_args,
    # intl.lib is not compatible with SAFESEH
    link_args : noseh_link_args,
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/0001-Remove-the-warning-about-deprecated-paths-in-schemas.patch b/meta/recipes-core/glib-2.0/files/0001-Remove-the-warning-about-deprecated-paths-in-schemas.patch
index 0e3a62af6a..ebdf957272 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0/0001-Remove-the-warning-about-deprecated-paths-in-schemas.patch
+++ b/meta/recipes-core/glib-2.0/files/0001-Remove-the-warning-about-deprecated-paths-in-schemas.patch
@@ -1,4 +1,4 @@
-From 8ae2e9c2a04e089306693a021149dc6b7d1bd679 Mon Sep 17 00:00:00 2001
+From bdb2772d672e95584585e902689936559c5db05d Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Fri, 12 Jun 2015 17:08:46 +0300
 Subject: [PATCH] Remove the warning about deprecated paths in schemas
@@ -14,7 +14,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
  1 file changed, 13 deletions(-)
 
 diff --git a/gio/glib-compile-schemas.c b/gio/glib-compile-schemas.c
-index 04ef404..e791ce2 100644
+index 81e675f..1a10a8d 100644
 --- a/gio/glib-compile-schemas.c
 +++ b/gio/glib-compile-schemas.c
 @@ -1232,19 +1232,6 @@ parse_state_start_schema (ParseState  *state,
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/0001-gio-tests-resources.c-comment-out-a-build-host-only-.patch b/meta/recipes-core/glib-2.0/files/0001-gio-tests-resources.c-comment-out-a-build-host-only-.patch
index aee2986033..771b03e66d 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0/0001-gio-tests-resources.c-comment-out-a-build-host-only-.patch
+++ b/meta/recipes-core/glib-2.0/files/0001-gio-tests-resources.c-comment-out-a-build-host-only-.patch
@@ -1,4 +1,4 @@
-From 878e51f82100c698236fda0e069e14ea9249350c Mon Sep 17 00:00:00 2001
+From 8cb75d3bc368ee108a4b14bc57a92bd0c0b2e10e Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Wed, 8 Jan 2020 18:22:46 +0100
 Subject: [PATCH] gio/tests/resources.c: comment out a build host-only test
@@ -13,10 +13,10 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/gio/tests/resources.c b/gio/tests/resources.c
-index f567914..b21b616 100644
+index ee9cee4..ff844c1 100644
 --- a/gio/tests/resources.c
 +++ b/gio/tests/resources.c
-@@ -1068,7 +1068,7 @@ main (int   argc,
+@@ -1196,7 +1196,7 @@ main (int   argc,
    g_test_add_func ("/resource/automatic", test_resource_automatic);
    /* This only uses automatic resources too, so it tests the constructors and destructors */
    g_test_add_func ("/resource/module", test_resource_module);
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/0001-meson-Run-atomics-test-on-clang-as-well.patch b/meta/recipes-core/glib-2.0/files/0001-meson-Run-atomics-test-on-clang-as-well.patch
index 0b10269114..e5878a1428 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0/0001-meson-Run-atomics-test-on-clang-as-well.patch
+++ b/meta/recipes-core/glib-2.0/files/0001-meson-Run-atomics-test-on-clang-as-well.patch
@@ -1,4 +1,4 @@
-From b4b523160ef550a53705fcc45ac6e10d086ce491 Mon Sep 17 00:00:00 2001
+From 502984fe340a76c92e2c04235f43fdcb47728806 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Sat, 12 Oct 2019 17:46:26 -0700
 Subject: [PATCH] meson: Run atomics test on clang as well
@@ -14,10 +14,10 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/meson.build b/meson.build
-index 6ee775e..8bc5fa7 100644
+index a8bcadc..041b68e 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -1938,7 +1938,7 @@ atomicdefine = '''
+@@ -2075,7 +2075,7 @@ atomicdefine = '''
  # We know that we can always use real ("lock free") atomic operations with MSVC
  if cc.get_id() == 'msvc' or cc.get_id() == 'clang-cl' or cc.links(atomictest, name : 'atomic ops')
    have_atomic_lock_free = true
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch b/meta/recipes-core/glib-2.0/files/0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch
index 14dcb278e0..e512940e34 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0/0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch
+++ b/meta/recipes-core/glib-2.0/files/0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch
@@ -1,4 +1,4 @@
-From 294f3e6e9a0a9f4733e85ed6810d1b743055370b Mon Sep 17 00:00:00 2001
+From d5e566c45a9ab4d7e51104ab176e6eb5f705f91d Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex@linutronix.de>
 Date: Sat, 16 Sep 2023 22:28:27 +0200
 Subject: [PATCH] meson.build: do not enable pidfd features on native glib
@@ -14,10 +14,10 @@ Signed-off-by: Alexander Kanavin <alex@linutronix.de>
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/meson.build b/meson.build
-index 8bc5fa7..df1fa60 100644
+index 041b68e..155bfd4 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -981,7 +981,8 @@ if cc.links('''#include <sys/syscall.h>
+@@ -1073,7 +1073,8 @@ if cc.links('''#include <sys/syscall.h>
                   waitid (P_PIDFD, 0, &child_info, WEXITED | WNOHANG);
                   return 0;
                 }''', name : 'pidfd_open(2) system call')
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/0010-Do-not-hardcode-python-path-into-various-tools.patch b/meta/recipes-core/glib-2.0/files/0010-Do-not-hardcode-python-path-into-various-tools.patch
index 6dff5179c7..d26f944d51 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0/0010-Do-not-hardcode-python-path-into-various-tools.patch
+++ b/meta/recipes-core/glib-2.0/files/0010-Do-not-hardcode-python-path-into-various-tools.patch
@@ -1,4 +1,4 @@
-From 50636758c73e5e61212a8f801c6c602b8aab5ba7 Mon Sep 17 00:00:00 2001
+From 211927d2caa4a81e1131c2210e1db838104a1fb9 Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Tue, 3 Oct 2017 10:45:55 +0300
 Subject: [PATCH] Do not hardcode python path into various tools
@@ -12,31 +12,31 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
  3 files changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/gio/gdbus-2.0/codegen/gdbus-codegen.in b/gio/gdbus-2.0/codegen/gdbus-codegen.in
-index 67d3675..4e92a7a 100755
+index 877505e..49a1e8c 100755
 --- a/gio/gdbus-2.0/codegen/gdbus-codegen.in
 +++ b/gio/gdbus-2.0/codegen/gdbus-codegen.in
 @@ -1,4 +1,4 @@
--#!/usr/bin/env @PYTHON@
+-#!@PYTHON@
 +#!/usr/bin/env python3
  
  # GDBus - GLib D-Bus Library
  #
 diff --git a/gobject/glib-genmarshal.in b/gobject/glib-genmarshal.in
-index aa5af43..56e8e2e 100755
+index 0578b74..56e8e2e 100755
 --- a/gobject/glib-genmarshal.in
 +++ b/gobject/glib-genmarshal.in
 @@ -1,4 +1,4 @@
--#!/usr/bin/env @PYTHON@
+-#!@PYTHON@
 +#!/usr/bin/env python3
  
  # pylint: disable=too-many-lines, missing-docstring, invalid-name
  
 diff --git a/gobject/glib-mkenums.in b/gobject/glib-mkenums.in
-index 353e53a..8ed6c39 100755
+index 7e794e9..4b619f8 100755
 --- a/gobject/glib-mkenums.in
 +++ b/gobject/glib-mkenums.in
 @@ -1,4 +1,4 @@
--#!/usr/bin/env @PYTHON@
+-#!@PYTHON@
 +#!/usr/bin/env python3
  
  # If the code below looks horrible and unpythonic, do not panic.
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/meson.cross.d/common b/meta/recipes-core/glib-2.0/files/meson.cross.d/common
index 0d7c5fa3f8..0d7c5fa3f8 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0/meson.cross.d/common
+++ b/meta/recipes-core/glib-2.0/files/meson.cross.d/common
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/meson.cross.d/common-glibc b/meta/recipes-core/glib-2.0/files/meson.cross.d/common-glibc
index 3049e5116e..3049e5116e 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0/meson.cross.d/common-glibc
+++ b/meta/recipes-core/glib-2.0/files/meson.cross.d/common-glibc
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/meson.cross.d/common-linux b/meta/recipes-core/glib-2.0/files/meson.cross.d/common-linux
index adad7e62ee..adad7e62ee 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0/meson.cross.d/common-linux
+++ b/meta/recipes-core/glib-2.0/files/meson.cross.d/common-linux
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/meson.cross.d/common-mingw b/meta/recipes-core/glib-2.0/files/meson.cross.d/common-mingw
index 75f911ba1e..75f911ba1e 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0/meson.cross.d/common-mingw
+++ b/meta/recipes-core/glib-2.0/files/meson.cross.d/common-mingw
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/meson.cross.d/common-musl b/meta/recipes-core/glib-2.0/files/meson.cross.d/common-musl
index 3049e5116e..3049e5116e 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0/meson.cross.d/common-musl
+++ b/meta/recipes-core/glib-2.0/files/meson.cross.d/common-musl
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/relocate-modules.patch b/meta/recipes-core/glib-2.0/files/relocate-modules.patch
index 3e79bbf679..ddf464526c 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0/relocate-modules.patch
+++ b/meta/recipes-core/glib-2.0/files/relocate-modules.patch
@@ -1,4 +1,4 @@
-From f40e89b3852df37959606ee13b1a14ade81fa886 Mon Sep 17 00:00:00 2001
+From 456bac53f19d3094aa2007054c87d86c9d65b423 Mon Sep 17 00:00:00 2001
 From: Ross Burton <ross.burton@intel.com>
 Date: Fri, 11 Mar 2016 15:35:55 +0000
 Subject: [PATCH] glib-2.0: relocate the GIO module directory for native builds
@@ -18,10 +18,10 @@ Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
  1 file changed, 7 deletions(-)
 
 diff --git a/gio/giomodule.c b/gio/giomodule.c
-index 17fabe6..8021208 100644
+index 76c2028..6deba7c 100644
 --- a/gio/giomodule.c
 +++ b/gio/giomodule.c
-@@ -1271,11 +1271,6 @@ get_gio_module_dir (void)
+@@ -1260,11 +1260,6 @@ get_gio_module_dir (void)
        g_free (install_dir);
  #else
        module_dir = g_strdup (GIO_MODULE_DIR);
@@ -33,7 +33,7 @@ index 17fabe6..8021208 100644
  #include <dlfcn.h>
        {
          g_autofree gchar *path = NULL;
-@@ -1294,8 +1289,6 @@ get_gio_module_dir (void)
+@@ -1283,8 +1278,6 @@ get_gio_module_dir (void)
                }
            }
        }
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/run-ptest b/meta/recipes-core/glib-2.0/files/run-ptest
index 831bc3b91f..831bc3b91f 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0/run-ptest
+++ b/meta/recipes-core/glib-2.0/files/run-ptest
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/skip-timeout.patch b/meta/recipes-core/glib-2.0/files/skip-timeout.patch
index cd5ac287c3..138e970553 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0/skip-timeout.patch
+++ b/meta/recipes-core/glib-2.0/files/skip-timeout.patch
@@ -1,4 +1,4 @@
-From bb11d1a4ae77d93ec0743e54077cf0f990243fa6 Mon Sep 17 00:00:00 2001
+From 51bfcab0b60bd57f4d3463c479fdf47e645cd6fe Mon Sep 17 00:00:00 2001
 From: Ross Burton <ross.burton@arm.com>
 Date: Thu, 28 Mar 2024 16:27:09 +0000
 Subject: [PATCH] Skip /timeout/rounding test
@@ -16,7 +16,7 @@ Signed-off-by: Ross Burton <ross.burton@arm.com>
  1 file changed, 1 deletion(-)
 
 diff --git a/glib/tests/timeout.c b/glib/tests/timeout.c
-index 1ae3f3a34..85a715b0f 100644
+index 1ae3f3a..85a715b 100644
 --- a/glib/tests/timeout.c
 +++ b/glib/tests/timeout.c
 @@ -214,7 +214,6 @@ main (int argc, char *argv[])
@@ -27,6 +27,3 @@ index 1ae3f3a34..85a715b0f 100644
  
    return g_test_run ();
  }
--- 
-2.34.1
-
diff --git a/meta/recipes-core/glib-2.0/glib-2.0-initial_2.84.2.bb b/meta/recipes-core/glib-2.0/glib-2.0-initial_2.84.2.bb
new file mode 100644
index 0000000000..acec7e9676
--- /dev/null
+++ b/meta/recipes-core/glib-2.0/glib-2.0-initial_2.84.2.bb
@@ -0,0 +1,6 @@
+require glib.inc
+PACKAGES = ""
+PACKAGECONFIG = ""
+
+inherit nopackages
+
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/0001-Set-host_machine-correctly-when-building-with-mingw3.patch b/meta/recipes-core/glib-2.0/glib-2.0/0001-Set-host_machine-correctly-when-building-with-mingw3.patch
deleted file mode 100644
index 32b4cea409..0000000000
--- a/meta/recipes-core/glib-2.0/glib-2.0/0001-Set-host_machine-correctly-when-building-with-mingw3.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From c0733f7a91dfe13152abc60c5a3064456b3e9d63 Mon Sep 17 00:00:00 2001
-From: Alexander Kanavin <alex.kanavin@gmail.com>
-Date: Wed, 13 Feb 2019 15:32:05 +0100
-Subject: [PATCH] Set host_machine correctly when building with mingw32
-
-Upstream-Status: Inappropriate [oe-core specific]
-Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
----
- gio/tests/meson.build  | 8 ++++----
- glib/tests/meson.build | 2 +-
- meson.build            | 3 +++
- 3 files changed, 8 insertions(+), 5 deletions(-)
-
-diff --git a/gio/tests/meson.build b/gio/tests/meson.build
-index 4ef3343..e498e7e 100644
---- a/gio/tests/meson.build
-+++ b/gio/tests/meson.build
-@@ -29,7 +29,7 @@ endif
- 
- test_cpp_args = test_c_args
- 
--if host_machine.system() == 'windows'
-+if host_system == 'windows'
-   common_gio_tests_deps += [iphlpapi_dep, winsock2, cc.find_library ('secur32')]
- endif
- 
-@@ -230,7 +230,7 @@ if have_dbus_daemon
- endif
- 
- #  Test programs buildable on UNIX only
--if host_machine.system() != 'windows'
-+if host_system != 'windows'
-   gio_tests += {
-     'file' : {},
-     'gdbus-peer-object-manager' : {},
-@@ -562,7 +562,7 @@ if host_machine.system() != 'windows'
- endif # unix
- 
- #  Test programs buildable on Windows only
--if host_machine.system() == 'windows'
-+if host_system == 'windows'
-   gio_tests += {'win32-streams' : {}}
- endif
- 
-@@ -632,7 +632,7 @@ if cc.get_id() != 'msvc' and cc.get_id() != 'clang-cl'
-   }
- endif
- 
--if host_machine.system() != 'windows'
-+if host_system != 'windows'
-   test_extra_programs += {
-     'gdbus-example-unix-fd-client' : {
-       'install' : false,
-diff --git a/glib/tests/meson.build b/glib/tests/meson.build
-index d80c86e..5329cda 100644
---- a/glib/tests/meson.build
-+++ b/glib/tests/meson.build
-@@ -216,7 +216,7 @@ if glib_conf.has('HAVE_EVENTFD')
-   }
- endif
- 
--if host_machine.system() == 'windows'
-+if host_system == 'windows'
-   if winsock2.found()
-     glib_tests += {
-       'gpoll' : {
-diff --git a/meson.build b/meson.build
-index 813c9b7..6ee775e 100644
---- a/meson.build
-+++ b/meson.build
-@@ -54,6 +54,9 @@ else
- endif
- 
- host_system = host_machine.system()
-+if host_system == 'mingw32'
-+  host_system = 'windows'
-+endif
- 
- if host_system == 'darwin'
-   ios_test_code = '''#include <TargetConditionals.h>
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/0001-Switch-from-the-deprecated-distutils-module-to-the-p.patch b/meta/recipes-core/glib-2.0/glib-2.0/0001-Switch-from-the-deprecated-distutils-module-to-the-p.patch
deleted file mode 100644
index b11c283e6d..0000000000
--- a/meta/recipes-core/glib-2.0/glib-2.0/0001-Switch-from-the-deprecated-distutils-module-to-the-p.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From a8eb944a10353403241608a084787f6efcbb2eb7 Mon Sep 17 00:00:00 2001
-From: Jordan Williams <jordan@jwillikers.com>
-Date: Fri, 1 Dec 2023 09:53:50 -0600
-Subject: [PATCH] Switch from the deprecated distutils module to the packaging
- module
-
-The distutils module was removed in Python 3.12.
-
-Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/6ef967a0f930ce37a8c9b5aff969693b34714291]
-
-Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
----
- gio/gdbus-2.0/codegen/utils.py | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/gio/gdbus-2.0/codegen/utils.py b/gio/gdbus-2.0/codegen/utils.py
-index 0204610..08f1ba9 100644
---- a/gio/gdbus-2.0/codegen/utils.py
-+++ b/gio/gdbus-2.0/codegen/utils.py
-@@ -19,7 +19,7 @@
- #
- # Author: David Zeuthen <davidz@redhat.com>
- 
--import distutils.version
-+import packaging.version
- import os
- import sys
- 
-@@ -166,4 +166,4 @@ def version_cmp_key(key):
-         v = str(key[0])
-     else:
-         v = "0"
--    return (distutils.version.LooseVersion(v), key[1])
-+    return (packaging.version.Version(v), key[1])
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/fix-regex.patch b/meta/recipes-core/glib-2.0/glib-2.0/fix-regex.patch
deleted file mode 100644
index bdfbd55899..0000000000
--- a/meta/recipes-core/glib-2.0/glib-2.0/fix-regex.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From cce3ae98a2c1966719daabff5a4ec6cf94a846f6 Mon Sep 17 00:00:00 2001
-From: Philip Withnall <pwithnall@gnome.org>
-Date: Mon, 26 Feb 2024 16:55:44 +0000
-Subject: [PATCH] tests: Remove variable-length lookbehind tests for GRegex
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-PCRE2 10.43 has now introduced support for variable-length lookbehind,
-so these tests now fail if GLib is built against PCRE2 10.43 or higher.
-
-See
-https://github.com/PCRE2Project/pcre2/blob/e8db6fa7137f4c6f66cb87e0a3c9467252ec1ef7/ChangeLog#L94.
-
-Rather than making the tests conditional on the version of PCRE2 in use,
-just remove them. They are mostly testing the PCRE2 code rather than
-any code in GLib, so don’t have much value.
-
-This should fix CI runs on msys2-mingw32, which updated to PCRE2 10.43 2
-days ago.
-
-Signed-off-by: Philip Withnall <pwithnall@gnome.org>
-
-Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/cce3ae98a2c1966719daabff5a4ec6cf94a846f6]
-Signed-off-by: Alexander Kanavin <alex@linutronix.de>
----
- glib/tests/regex.c | 10 ----------
- 1 file changed, 10 deletions(-)
-
-diff --git a/glib/tests/regex.c b/glib/tests/regex.c
-index 1082526292..d7a698ec67 100644
---- a/glib/tests/regex.c
-+++ b/glib/tests/regex.c
-@@ -1885,16 +1885,6 @@ test_lookbehind (void)
-   g_match_info_free (match);
-   g_regex_unref (regex);
- 
--  regex = g_regex_new ("(?<!dogs?|cats?) x", G_REGEX_OPTIMIZE, G_REGEX_MATCH_DEFAULT, &error);
--  g_assert (regex == NULL);
--  g_assert_error (error, G_REGEX_ERROR, G_REGEX_ERROR_VARIABLE_LENGTH_LOOKBEHIND);
--  g_clear_error (&error);
--
--  regex = g_regex_new ("(?<=ab(c|de)) foo", G_REGEX_OPTIMIZE, G_REGEX_MATCH_DEFAULT, &error);
--  g_assert (regex == NULL);
--  g_assert_error (error, G_REGEX_ERROR, G_REGEX_ERROR_VARIABLE_LENGTH_LOOKBEHIND);
--  g_clear_error (&error);
--
-   regex = g_regex_new ("(?<=abc|abde)foo", G_REGEX_OPTIMIZE, G_REGEX_MATCH_DEFAULT, &error);
-   g_assert (regex);
-   g_assert_no_error (error);
--- 
-GitLab
-
-
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/memory-monitor.patch b/meta/recipes-core/glib-2.0/glib-2.0/memory-monitor.patch
deleted file mode 100644
index 4f38509da6..0000000000
--- a/meta/recipes-core/glib-2.0/glib-2.0/memory-monitor.patch
+++ /dev/null
@@ -1,361 +0,0 @@
-From ce840b6b111e1e109e511f6833d6aa419e2b723a Mon Sep 17 00:00:00 2001
-From: Philip Withnall <philip@tecnocode.co.uk>
-Date: Tue, 23 Jan 2024 11:16:52 +0000
-Subject: [PATCH] Merge branch '2887-memory-monitor-tests' into 'main'
-
-tests: Fix race condition in memory-monitor-dbus.test
-
-Closes #2887
-
-See merge request GNOME/glib!3844
-
-Hopefully these commits fix the occasional failures we've been seeing:
-https://bugzilla.yoctoproject.org/show_bug.cgi?id=15362
-
-Upstream-Status: Backport
-Signed-off-by: Ross Burton <ross.burton@arm.com>
----
- gio/tests/memory-monitor-dbus.py.in          | 64 +++++++++++++-------
- gio/tests/memory-monitor-portal.py.in        | 54 ++++++++++-------
- gio/tests/power-profile-monitor-dbus.py.in   | 35 ++++++-----
- gio/tests/power-profile-monitor-portal.py.in | 34 ++++++-----
- 4 files changed, 113 insertions(+), 74 deletions(-)
-
-diff --git a/gio/tests/memory-monitor-dbus.py.in b/gio/tests/memory-monitor-dbus.py.in
-index bf32918..7aae01e 100755
---- a/gio/tests/memory-monitor-dbus.py.in
-+++ b/gio/tests/memory-monitor-dbus.py.in
-@@ -16,7 +16,6 @@ import sys
- import subprocess
- import fcntl
- import os
--import time
- 
- import taptestrunner
- 
-@@ -57,53 +56,74 @@ try:
-             fcntl.fcntl(self.p_mock.stdout, fcntl.F_SETFL, flags | os.O_NONBLOCK)
-             self.last_warning = -1
-             self.dbusmock = dbus.Interface(self.obj_lmm, dbusmock.MOCK_IFACE)
-+
-+            try:
-+                self.wait_for_bus_object('org.freedesktop.LowMemoryMonitor',
-+                                        '/org/freedesktop/LowMemoryMonitor',
-+                                        system_bus=True)
-+            except:
-+                raise
-+
-             self.memory_monitor = Gio.MemoryMonitor.dup_default()
-+            assert("GMemoryMonitorDBus" in str(self.memory_monitor))
-             self.memory_monitor.connect("low-memory-warning", self.memory_warning_cb)
-             self.mainloop = GLib.MainLoop()
-             self.main_context = self.mainloop.get_context()
- 
-+            # The LowMemoryMonitor API is stateless: it doesn’t expose any
-+            # properties, just a warning signal. Emit the signal in a loop until
-+            # the GMemoryMonitor instance has initialised and synchronised to
-+            # the right state.
-+            def emit_warning(level):
-+                self.dbusmock.EmitWarning(level)
-+                return GLib.SOURCE_CONTINUE
-+
-+            idle_id = GLib.idle_add(emit_warning, 0)
-+            while self.last_warning != 0:
-+                self.main_context.iteration(True)
-+            GLib.source_remove(idle_id)
-+
-         def tearDown(self):
-             self.p_mock.terminate()
-             self.p_mock.wait()
- 
--        def assertEventually(self, condition, message=None, timeout=50):
-+        def assertEventually(self, condition, message=None, timeout=5):
-             '''Assert that condition function eventually returns True.
- 
--            Timeout is in deciseconds, defaulting to 50 (5 seconds). message is
-+            Timeout is in seconds, defaulting to 5 seconds. message is
-             printed on failure.
-             '''
--            while timeout >= 0:
--                context = GLib.MainContext.default()
--                while context.iteration(False):
--                    pass
--                if condition():
--                    break
--                timeout -= 1
--                time.sleep(0.1)
--            else:
--                self.fail(message or 'timed out waiting for ' + str(condition))
-+            if not message:
-+                message = 'timed out waiting for ' + str(condition)
-+
-+            def timed_out_cb(message):
-+                self.fail(message)
-+                return GLib.SOURCE_REMOVE
-+
-+            timeout_source = GLib.timeout_source_new_seconds(timeout)
-+            timeout_source.set_callback(timed_out_cb, message)
-+            timeout_source.attach(self.main_context)
-+
-+            while not condition():
-+                self.main_context.iteration(True)
-+
-+            timeout_source.destroy()
- 
-         def memory_warning_cb(self, monitor, level):
-+            print("Received memory warning signal, level", level)
-             self.last_warning = level
-             self.main_context.wakeup()
- 
-         def test_low_memory_warning_signal(self):
-             '''LowMemoryWarning signal'''
- 
--            # Wait 2 seconds
--            timeout = 2
--            while timeout > 0:
--                time.sleep(0.5)
--                timeout -= 0.5
--                self.main_context.iteration(False)
--
-             self.dbusmock.EmitWarning(100)
-             # Wait 2 seconds or until warning
--            self.assertEventually(lambda: self.last_warning == 100, "'100' low-memory warning not received", 20)
-+            self.assertEventually(lambda: self.last_warning == 100, "'100' low-memory warning not received", 2)
- 
-             self.dbusmock.EmitWarning(255)
-             # Wait 2 seconds or until warning
--            self.assertEventually(lambda: self.last_warning == 255, "'255' low-memory warning not received", 20)
-+            self.assertEventually(lambda: self.last_warning == 255, "'255' low-memory warning not received", 2)
- 
- except ImportError as e:
-     @unittest.skip("Cannot import %s" % e.name)
-diff --git a/gio/tests/memory-monitor-portal.py.in b/gio/tests/memory-monitor-portal.py.in
-index 748cee8..f570508 100755
---- a/gio/tests/memory-monitor-portal.py.in
-+++ b/gio/tests/memory-monitor-portal.py.in
-@@ -16,7 +16,6 @@ import sys
- import subprocess
- import fcntl
- import os
--import time
- 
- import taptestrunner
- 
-@@ -80,26 +79,44 @@ try:
-             self.mainloop = GLib.MainLoop()
-             self.main_context = self.mainloop.get_context()
- 
-+            # The LowMemoryMonitor API is stateless: it doesn’t expose any
-+            # properties, just a warning signal. Emit the signal in a loop until
-+            # the GMemoryMonitor instance has initialised and synchronised to
-+            # the right state.
-+            def emit_warning(level):
-+                self.dbusmock.EmitWarning(level)
-+                return GLib.SOURCE_CONTINUE
-+
-+            idle_id = GLib.idle_add(self.emit_warning, 0)
-+            while self.last_warning != 0:
-+                self.main_context.iteration(True)
-+            GLib.source_remove(idle_id)
-+
-         def tearDown(self):
-             self.p_mock.terminate()
-             self.p_mock.wait()
- 
--        def assertEventually(self, condition, message=None, timeout=50):
-+        def assertEventually(self, condition, message=None, timeout=5):
-             '''Assert that condition function eventually returns True.
- 
--            Timeout is in deciseconds, defaulting to 50 (5 seconds). message is
-+            Timeout is in seconds, defaulting to 5 seconds. message is
-             printed on failure.
-             '''
--            while timeout >= 0:
--                context = GLib.MainContext.default()
--                while context.iteration(False):
--                    pass
--                if condition():
--                    break
--                timeout -= 1
--                time.sleep(0.1)
--            else:
--                self.fail(message or 'timed out waiting for ' + str(condition))
-+            if not message:
-+                message = 'timed out waiting for ' + str(condition)
-+
-+            def timed_out_cb(message):
-+                self.fail(message)
-+                return GLib.SOURCE_REMOVE
-+
-+            timeout_source = GLib.timeout_source_new_seconds(timeout)
-+            timeout_source.set_callback(timed_out_cb, message)
-+            timeout_source.attach(self.main_context)
-+
-+            while not condition():
-+                self.main_context.iteration(True)
-+
-+            timeout_source.destroy()
- 
-         def portal_memory_warning_cb(self, monitor, level):
-             self.last_warning = level
-@@ -108,20 +125,13 @@ try:
-         def test_low_memory_warning_portal_signal(self):
-             '''LowMemoryWarning signal'''
- 
--            # Wait 2 seconds
--            timeout = 2
--            while timeout > 0:
--                time.sleep(0.5)
--                timeout -= 0.5
--                self.main_context.iteration(False)
--
-             self.dbusmock.EmitWarning(100)
-             # Wait 2 seconds or until warning
--            self.assertEventually(lambda: self.last_warning == 100, "'100' low-memory warning not received", 20)
-+            self.assertEventually(lambda: self.last_warning == 100, "'100' low-memory warning not received", 2)
- 
-             self.dbusmock.EmitWarning(255)
-             # Wait 2 seconds or until warning
--            self.assertEventually(lambda: self.last_warning == 255, "'255' low-memory warning not received", 20)
-+            self.assertEventually(lambda: self.last_warning == 255, "'255' low-memory warning not received", 2)
- 
- except ImportError as e:
-     @unittest.skip("Cannot import %s" % e.name)
-diff --git a/gio/tests/power-profile-monitor-dbus.py.in b/gio/tests/power-profile-monitor-dbus.py.in
-index 06e594f..f955afc 100755
---- a/gio/tests/power-profile-monitor-dbus.py.in
-+++ b/gio/tests/power-profile-monitor-dbus.py.in
-@@ -16,7 +16,6 @@ import sys
- import subprocess
- import fcntl
- import os
--import time
- 
- import taptestrunner
- 
-@@ -58,6 +57,7 @@ try:
-             self.power_saver_enabled = False
-             self.dbus_props = dbus.Interface(self.obj_ppd, dbus.PROPERTIES_IFACE)
-             self.power_profile_monitor = Gio.PowerProfileMonitor.dup_default()
-+            assert("GPowerProfileMonitorDBus" in str(self.power_profile_monitor))
-             self.power_profile_monitor.connect("notify::power-saver-enabled", self.power_saver_enabled_cb)
-             self.mainloop = GLib.MainLoop()
-             self.main_context = self.mainloop.get_context()
-@@ -66,22 +66,27 @@ try:
-             self.p_mock.terminate()
-             self.p_mock.wait()
- 
--        def assertEventually(self, condition, message=None, timeout=50):
-+        def assertEventually(self, condition, message=None, timeout=5):
-             '''Assert that condition function eventually returns True.
- 
--            Timeout is in deciseconds, defaulting to 50 (5 seconds). message is
-+            Timeout is in seconds, defaulting to 5 seconds. message is
-             printed on failure.
-             '''
--            while timeout >= 0:
--                context = GLib.MainContext.default()
--                while context.iteration(False):
--                    pass
--                if condition():
--                    break
--                timeout -= 1
--                time.sleep(0.1)
--            else:
--                self.fail(message or 'timed out waiting for ' + str(condition))
-+            if not message:
-+                message = 'timed out waiting for ' + str(condition)
-+
-+            def timed_out_cb(message):
-+                self.fail(message)
-+                return GLib.SOURCE_REMOVE
-+
-+            timeout_source = GLib.timeout_source_new_seconds(timeout)
-+            timeout_source.set_callback(timed_out_cb, message)
-+            timeout_source.attach(self.main_context)
-+
-+            while not condition():
-+                self.main_context.iteration(True)
-+
-+            timeout_source.destroy()
- 
-         def power_saver_enabled_cb(self, spec, data):
-             self.power_saver_enabled = self.power_profile_monitor.get_power_saver_enabled()
-@@ -92,10 +97,10 @@ try:
- 
-             self.assertEqual(self.power_profile_monitor.get_power_saver_enabled(), False)
-             self.dbus_props.Set('net.hadess.PowerProfiles', 'ActiveProfile', dbus.String('power-saver', variant_level=1))
--            self.assertEventually(lambda: self.power_saver_enabled == True, "power-saver didn't become enabled", 10)
-+            self.assertEventually(lambda: self.power_saver_enabled == True, "power-saver didn't become enabled", 1)
- 
-             self.dbus_props.Set('net.hadess.PowerProfiles', 'ActiveProfile', dbus.String('balanced', variant_level=1))
--            self.assertEventually(lambda: self.power_saver_enabled == False, "power-saver didn't become disabled", 10)
-+            self.assertEventually(lambda: self.power_saver_enabled == False, "power-saver didn't become disabled", 1)
- 
- except ImportError as e:
-     @unittest.skip("Cannot import %s" % e.name)
-diff --git a/gio/tests/power-profile-monitor-portal.py.in b/gio/tests/power-profile-monitor-portal.py.in
-index 09e9a45..ad2abf6 100755
---- a/gio/tests/power-profile-monitor-portal.py.in
-+++ b/gio/tests/power-profile-monitor-portal.py.in
-@@ -16,7 +16,6 @@ import sys
- import subprocess
- import fcntl
- import os
--import time
- 
- import taptestrunner
- 
-@@ -90,22 +89,27 @@ try:
-             self.p_mock.terminate()
-             self.p_mock.wait()
- 
--        def assertEventually(self, condition, message=None, timeout=50):
-+        def assertEventually(self, condition, message=None, timeout=5):
-             '''Assert that condition function eventually returns True.
- 
--            Timeout is in deciseconds, defaulting to 50 (5 seconds). message is
-+            Timeout is in seconds, defaulting to 5 seconds. message is
-             printed on failure.
-             '''
--            while timeout >= 0:
--                context = GLib.MainContext.default()
--                while context.iteration(False):
--                    pass
--                if condition():
--                    break
--                timeout -= 1
--                time.sleep(0.1)
--            else:
--                self.fail(message or 'timed out waiting for ' + str(condition))
-+            if not message:
-+                message = 'timed out waiting for ' + str(condition)
-+
-+            def timed_out_cb(message):
-+                self.fail(message)
-+                return GLib.SOURCE_REMOVE
-+
-+            timeout_source = GLib.timeout_source_new_seconds(timeout)
-+            timeout_source.set_callback(timed_out_cb, message)
-+            timeout_source.attach(self.main_context)
-+
-+            while not condition():
-+                self.main_context.iteration(True)
-+
-+            timeout_source.destroy()
- 
-         def power_saver_enabled_cb(self, spec, data):
-             self.power_saver_enabled = self.power_profile_monitor.get_power_saver_enabled()
-@@ -116,10 +120,10 @@ try:
- 
-             self.assertEqual(self.power_profile_monitor.get_power_saver_enabled(), False)
-             self.dbus_props.Set('net.hadess.PowerProfiles', 'ActiveProfile', dbus.String('power-saver', variant_level=1))
--            self.assertEventually(lambda: self.power_saver_enabled == True, "power-saver didn't become enabled", 10)
-+            self.assertEventually(lambda: self.power_saver_enabled == True, "power-saver didn't become enabled", 1)
- 
-             self.dbus_props.Set('net.hadess.PowerProfiles', 'ActiveProfile', dbus.String('balanced', variant_level=1))
--            self.assertEventually(lambda: self.power_saver_enabled == False, "power-saver didn't become disabled", 10)
-+            self.assertEventually(lambda: self.power_saver_enabled == False, "power-saver didn't become disabled", 1)
- 
-         def test_power_profile_power_saver_enabled_portal_default(self):
-             '''power-saver-enabled property default value'''
diff --git a/meta/recipes-core/glib-2.0/glib-2.0_2.78.4.bb b/meta/recipes-core/glib-2.0/glib-2.0_2.78.4.bb
deleted file mode 100644
index b1669ead75..0000000000
--- a/meta/recipes-core/glib-2.0/glib-2.0_2.78.4.bb
+++ /dev/null
@@ -1,57 +0,0 @@
-require glib.inc
-
-PE = "1"
-
-SHRT_VER = "${@oe.utils.trim_version("${PV}", 2)}"
-
-SRC_URI = "${GNOME_MIRROR}/glib/${SHRT_VER}/glib-${PV}.tar.xz \
-           file://run-ptest \
-           file://0001-Fix-DATADIRNAME-on-uclibc-Linux.patch \
-           file://0001-Remove-the-warning-about-deprecated-paths-in-schemas.patch \
-           file://0001-Install-gio-querymodules-as-libexec_PROGRAM.patch \
-           file://0010-Do-not-hardcode-python-path-into-various-tools.patch \
-           file://0001-Set-host_machine-correctly-when-building-with-mingw3.patch \
-           file://0001-Do-not-write-bindir-into-pkg-config-files.patch \
-           file://0001-meson-Run-atomics-test-on-clang-as-well.patch \
-           file://0001-gio-tests-resources.c-comment-out-a-build-host-only-.patch \
-           file://0001-Switch-from-the-deprecated-distutils-module-to-the-p.patch \
-           file://memory-monitor.patch \
-           file://fix-regex.patch \
-           file://skip-timeout.patch \
-           "
-SRC_URI:append:class-native = " file://relocate-modules.patch \ 
-                                file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \
-                              "
-
-SRC_URI[sha256sum] = "24b8e0672dca120cc32d394bccb85844e732e04fe75d18bb0573b2dbc7548f63"
-
-# Find any meson cross files in FILESPATH that are relevant for the current
-# build (using siteinfo) and add them to EXTRA_OEMESON.
-inherit siteinfo
-def find_meson_cross_files(d):
-    if bb.data.inherits_class('native', d):
-        return ""
-
-    thisdir = os.path.normpath(d.getVar("THISDIR"))
-    import collections
-    sitedata = siteinfo_data(d)
-    # filename -> found
-    files = collections.OrderedDict()
-    for path in d.getVar("FILESPATH").split(":"):
-        for element in sitedata:
-            filename = os.path.normpath(os.path.join(path, "meson.cross.d", element))
-            sanitized_path = filename.replace(thisdir, "${THISDIR}")
-            if sanitized_path == filename:
-                if os.path.exists(filename):
-                    bb.error("Cannot add '%s' to --cross-file, because it's not relative to THISDIR '%s' and sstate signature would contain this full path" % (filename, thisdir))
-                continue
-            files[filename.replace(thisdir, "${THISDIR}")] = os.path.exists(filename)
-
-    items = ["--cross-file=" + k for k,v in files.items() if v]
-    d.appendVar("EXTRA_OEMESON", " " + " ".join(items))
-    items = ["%s:%s" % (k, "True" if v else "False") for k,v in files.items()]
-    d.appendVarFlag("do_configure", "file-checksums", " " + " ".join(items))
-
-python () {
-    find_meson_cross_files(d)
-}
diff --git a/meta/recipes-core/glib-2.0/glib-2.0_2.84.2.bb b/meta/recipes-core/glib-2.0/glib-2.0_2.84.2.bb
new file mode 100644
index 0000000000..ef80cc47cf
--- /dev/null
+++ b/meta/recipes-core/glib-2.0/glib-2.0_2.84.2.bb
@@ -0,0 +1,2 @@
+require glib.inc
+
diff --git a/meta/recipes-core/glib-2.0/glib.inc b/meta/recipes-core/glib-2.0/glib.inc
index fac8875d84..ba7763c841 100644
--- a/meta/recipes-core/glib-2.0/glib.inc
+++ b/meta/recipes-core/glib-2.0/glib.inc
@@ -28,21 +28,27 @@ PACKAGES += "${PN}-codegen ${PN}-utils"
 
 LEAD_SONAME = "libglib-2.0.*"
 
-inherit meson gettext gtk-doc pkgconfig ptest-gnome upstream-version-is-even bash-completion gio-module-cache manpages gobject-introspection-data
+inherit meson gettext gi-docgen pkgconfig ptest-gnome upstream-version-is-even bash-completion gio-module-cache manpages gobject-introspection-data
 
-GTKDOC_MESON_OPTION = "gtk_doc"
+S = "${UNPACKDIR}/glib-${PV}"
 
-S = "${WORKDIR}/glib-${PV}"
+GIDOCGEN_MESON_OPTION = "documentation"
 
 PACKAGECONFIG ??= "libmount \
+                   ${@bb.utils.contains('GI_DATA_ENABLED', 'True', 'introspection', '', d)} \
                    ${@bb.utils.contains('PTEST_ENABLED', '1', 'tests', '', d)}"
+PACKAGECONFIG:class-native = ""
+
 PACKAGECONFIG[libmount] = "-Dlibmount=enabled,-Dlibmount=disabled,util-linux"
-PACKAGECONFIG[manpages] = "-Dman=true, -Dman=false, libxslt-native xmlto-native"
+PACKAGECONFIG[manpages] = "-Dman-pages=enabled, -Dman-pages=disabled, python3-docutils-native"
 PACKAGECONFIG[libelf] = "-Dlibelf=enabled,-Dlibelf=disabled,elfutils"
-PACKAGECONFIG[tests] = "-Dinstalled_tests=true,-Dinstalled_tests=false,"
+PACKAGECONFIG[tests] = "-Dtests=true -Dinstalled_tests=true,-Dtests=false -Dinstalled_tests=false,"
 PACKAGECONFIG[selinux] = "-Dselinux=enabled,-Dselinux=disabled,libselinux"
+PACKAGECONFIG[introspection] = "-Dintrospection=enabled,-Dintrospection=disabled,gobject-introspection-native gobject-introspection glib-2.0-initial"
+
+EXTRA_OEMESON = "-Ddtrace=disabled -Dsystemtap=disabled -Dsysprof=disabled"
 
-EXTRA_OEMESON = "-Ddtrace=false -Dsystemtap=false"
+EXTRA_OEMESON:append:class-target = " ${@'-Dgir_dir_prefix=${libdir}' if d.getVar('MULTILIBS') else ''}"
 
 do_configure:prepend() {
         sed -i -e '1s,#!.*,#!${USRBINPATH}/env python3,' ${S}/gio/gdbus-2.0/codegen/gdbus-codegen.in
@@ -53,14 +59,16 @@ FILES:${PN} = "${libdir}/lib*${SOLIBS} \
                ${libexecdir}/*gio-querymodules \
                ${libexecdir}/*gio-launch-desktop \
                ${datadir}/glib-2.0/dtds \
-               ${datadir}/glib-2.0/schemas"
-
+               ${datadir}/glib-2.0/schemas \
+               ${libdir}/girepository-*/*.typelib \
+"
 FILES:${PN}-dev += "${libdir}/glib-2.0/include \
                     ${libdir}/gio/modules/lib*${SOLIBSDEV} \
                     ${libdir}/gio/modules/*.la \
                     ${datadir}/glib-2.0/gettext/po/Makefile.in.in \
                     ${datadir}/glib-2.0/schemas/gschema.dtd \
                     ${datadir}/glib-2.0/valgrind/glib.supp \
+                    ${datadir}/gir-*/*.gir ${libdir}/gir-*/*.gir \
                     ${datadir}/gettext/its"
 FILES:${PN}-dbg += "${datadir}/glib-2.0/gdb ${datadir}/gdb"
 FILES:${PN}-codegen = "${datadir}/glib-2.0/codegen/*.py \
@@ -149,12 +157,10 @@ CODEGEN_PYTHON_RDEPENDS:mingw32 = ""
 
 RDEPENDS:${PN}-codegen += "${CODEGEN_PYTHON_RDEPENDS}"
 
-RDEPENDS:${PN}-ptest += "${PN}-utils"
-
 RDEPENDS:${PN}-ptest += "\
             coreutils \
             libgcc \
-            dbus \
+            ${VIRTUAL-RUNTIME_dbus} \
             desktop-file-utils \
             gnome-desktop-testing \
             tzdata \
@@ -163,6 +169,7 @@ RDEPENDS:${PN}-ptest += "\
             tzdata-europe \
             tzdata-posix \
             shared-mime-info \
+            ${PN}-dev \
             ${PN}-locale-ja \
             ${PN}-locale-fr \
             ${PN}-locale-el \
@@ -171,6 +178,7 @@ RDEPENDS:${PN}-ptest += "\
             ${PN}-locale-pl \
             ${PN}-locale-ru \
             ${PN}-locale-th \
+            ${PN}-utils \
             python3-core \
             python3-modules \
             ${@bb.utils.contains('GI_DATA_ENABLED', 'True', 'python3-dbusmock', '', d)} \
@@ -182,6 +190,7 @@ RDEPENDS:${PN}-ptest += "\
             locale-base-fr-fr \
             locale-base-ru-ru \
            "
+INSANE_SKIP:${PN}-ptest = "dev-deps"
 
 RDEPENDS:${PN}-ptest:append:libc-glibc = "\
             glibc-gconv-utf-16 \
@@ -195,6 +204,7 @@ RDEPENDS:${PN}-ptest:append:libc-glibc = "\
             glibc-gconv-iso8859-15 \
             glibc-charmap-invariant \
             glibc-localedata-translit-cjk-variants \
+            locale-base-c \
             locale-base-lt-lt \
             locale-base-ja-jp.euc-jp \
             locale-base-fa-ir \
@@ -204,3 +214,55 @@ RDEPENDS:${PN}-ptest:append:libc-glibc = "\
             locale-base-pl-pl.iso-8859-2 \
             locale-base-tr-tr \
            "
+
+PE = "1"
+
+SHRT_VER = "${@oe.utils.trim_version("${PV}", 2)}"
+
+SRC_URI = "${GNOME_MIRROR}/glib/${SHRT_VER}/glib-${PV}.tar.xz \
+           file://run-ptest \
+           file://0001-Fix-DATADIRNAME-on-uclibc-Linux.patch \
+           file://0001-Remove-the-warning-about-deprecated-paths-in-schemas.patch \
+           file://0001-Install-gio-querymodules-as-libexec_PROGRAM.patch \
+           file://0001-Do-not-write-bindir-into-pkg-config-files.patch \
+           file://0001-meson-Run-atomics-test-on-clang-as-well.patch \
+           file://0001-gio-tests-resources.c-comment-out-a-build-host-only-.patch \
+           file://0010-Do-not-hardcode-python-path-into-various-tools.patch \
+           file://skip-timeout.patch \
+           "
+SRC_URI:append:class-native = " file://relocate-modules.patch \ 
+                                file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \
+                              "
+
+SRC_URI[sha256sum] = "88e960dd937057407d61fcb3b45a860704b25923c37ae2478b85f2ecb5a4021f"
+
+# Find any meson cross files in FILESPATH that are relevant for the current
+# build (using siteinfo) and add them to EXTRA_OEMESON.
+inherit siteinfo
+def find_meson_cross_files(d):
+    if bb.data.inherits_class('native', d):
+        return ""
+
+    thisdir = os.path.normpath(d.getVar("THISDIR"))
+    import collections
+    sitedata = siteinfo_data(d)
+    # filename -> found
+    files = collections.OrderedDict()
+    for path in d.getVar("FILESPATH").split(":"):
+        for element in sitedata:
+            filename = os.path.normpath(os.path.join(path, "meson.cross.d", element))
+            sanitized_path = filename.replace(thisdir, "${THISDIR}")
+            if sanitized_path == filename:
+                if os.path.exists(filename):
+                    bb.error("Cannot add '%s' to --cross-file, because it's not relative to THISDIR '%s' and sstate signature would contain this full path" % (filename, thisdir))
+                continue
+            files[filename.replace(thisdir, "${THISDIR}")] = os.path.exists(filename)
+
+    items = ["--cross-file=" + k for k,v in files.items() if v]
+    d.appendVar("EXTRA_OEMESON", " " + " ".join(items))
+    items = ["%s:%s" % (k, "True" if v else "False") for k,v in files.items()]
+    d.appendVarFlag("do_configure", "file-checksums", " " + " ".join(items))
+
+python () {
+    find_meson_cross_files(d)
+}
diff --git a/meta/recipes-core/glib-networking/glib-networking/eagain.patch b/meta/recipes-core/glib-networking/glib-networking/eagain.patch
index 6c2e3c634b..98974aa4e7 100644
--- a/meta/recipes-core/glib-networking/glib-networking/eagain.patch
+++ b/meta/recipes-core/glib-networking/glib-networking/eagain.patch
@@ -1,4 +1,4 @@
-From 5604707bed4b4a4bc4658c7158a18c1774775775 Mon Sep 17 00:00:00 2001
+From f917ef5579257007bc02850e79769fe5ec48b2b7 Mon Sep 17 00:00:00 2001
 From: Richard Purdie <richard.purdie@linuxfoundation.org>
 Date: Sat, 6 May 2023 12:18:50 +0100
 Subject: [PATCH] In autobuilder testing we regularly see glib-networking ptest
@@ -12,7 +12,7 @@ FAIL: glib-networking/connection-openssl.test (Child process killed by signal 6)
 
 The test should probably retry in this situation so test a patch which does this.
 
-Upstream-Status: Pending [testing to see if patch resolves the issue]
+Upstream-Status: Submitted [https://gitlab.gnome.org/GNOME/glib-networking/-/merge_requests/253]
 
 Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 ---
diff --git a/meta/recipes-core/glib-networking/glib-networking_2.78.1.bb b/meta/recipes-core/glib-networking/glib-networking_2.80.0.bb
index 5060d9fd7a..b080285b6e 100644
--- a/meta/recipes-core/glib-networking/glib-networking_2.78.1.bb
+++ b/meta/recipes-core/glib-networking/glib-networking_2.80.0.bb
@@ -14,14 +14,14 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c \
 SECTION = "libs"
 DEPENDS = "glib-2.0-native glib-2.0"
 
-SRC_URI[archive.sha256sum] = "e48f2ddbb049832cbb09230529c5e45daca9f0df0eda325f832f7379859bf09f"
+SRC_URI[archive.sha256sum] = "d8f4f1aab213179ae3351617b59dab5de6bcc9e785021eee178998ebd4bb3acf"
 
 # Upstream note that for the openssl backend, half the tests where this backend don't return
 # the expected error code or don't work as expected so default to gnutls
 PACKAGECONFIG ??= "gnutls environment ${@bb.utils.contains('PTEST_ENABLED', '1', 'tests', '', d)}"
 
-PACKAGECONFIG[gnutls] = "-Dgnutls=enabled,-Dgnutls=disabled,gnutls"
-PACKAGECONFIG[openssl] = "-Dopenssl=enabled,-Dopenssl=disabled,openssl"
+PACKAGECONFIG[gnutls] = "-Dgnutls=enabled,-Dgnutls=disabled,gnutls,ca-certificates"
+PACKAGECONFIG[openssl] = "-Dopenssl=enabled,-Dopenssl=disabled,openssl,ca-certificates"
 PACKAGECONFIG[environment] = "-Denvironment_proxy=enabled,-Denvironment_proxy=disabled"
 PACKAGECONFIG[libproxy] = "-Dlibproxy=enabled,-Dlibproxy=disabled,libproxy"
 PACKAGECONFIG[tests] = "-Dinstalled_tests=true,-Dinstalled_tests=false"
diff --git a/meta/recipes-core/glibc/cross-localedef-native_2.39.bb b/meta/recipes-core/glibc/cross-localedef-native_2.41.bb
index fed6e4ea97..95acb3fc56 100644
--- a/meta/recipes-core/glibc/cross-localedef-native_2.39.bb
+++ b/meta/recipes-core/glibc/cross-localedef-native_2.41.bb
@@ -3,7 +3,7 @@ HOMEPAGE = "http://www.gnu.org/software/libc/libc.html"
 SECTION = "libs"
 LICENSE = "LGPL-2.1-only"
 
-LIC_FILES_CHKSUM = "file://LICENSES;md5=f77e878d320e99e94ae9a4aea7f491d1 \
+LIC_FILES_CHKSUM = "file://LICENSES;md5=df6e0948b55669789c30764c5fd9bc41 \
       file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
       file://posix/rxspencer/COPYRIGHT;md5=dc5485bb394a13b2332ec1c785f5d83a \
       file://COPYING.LIB;md5=4fbd65380cdd255951079008b364516c"
@@ -20,7 +20,7 @@ inherit native
 FILESEXTRAPATHS =. "${FILE_DIRNAME}/${PN}:${FILE_DIRNAME}/glibc:"
 
 SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
-           git://github.com/kraj/localedef;branch=master;name=localedef;destsuffix=git/localedef;protocol=https \
+           git://github.com/kraj/localedef;branch=master;name=localedef;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/localedef;protocol=https \
            \
            file://0001-localedef-Add-hardlink-resolver-from-util-linux.patch \
            file://0002-localedef-fix-ups-hardlink-to-make-it-compile.patch \
@@ -37,8 +37,6 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
 #
 SRCREV_FORMAT = "glibc_localedef"
 
-S = "${WORKDIR}/git"
-
 EXTRA_OECONF = "--with-glibc=${S}"
 
 # We do not need bash to run tzselect script, the default is to use
diff --git a/meta/recipes-core/glibc/glibc-common.inc b/meta/recipes-core/glibc/glibc-common.inc
index b9516e77f0..fb62a4af94 100644
--- a/meta/recipes-core/glibc/glibc-common.inc
+++ b/meta/recipes-core/glibc/glibc-common.inc
@@ -2,9 +2,9 @@ SUMMARY = "GLIBC (GNU C Library)"
 DESCRIPTION = "The GNU C Library is used as the system C library in most systems with the Linux kernel."
 HOMEPAGE = "http://www.gnu.org/software/libc/libc.html"
 SECTION = "libs"
-LICENSE = "GPL-2.0-only & LGPL-2.1-only"
+LICENSE = "GPL-2.0-only & LGPL-2.1-or-later"
 
-LIC_FILES_CHKSUM ?= "file://LICENSES;md5=f77e878d320e99e94ae9a4aea7f491d1 \
+LIC_FILES_CHKSUM ?= "file://LICENSES;md5=df6e0948b55669789c30764c5fd9bc41 \
       file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
       file://posix/rxspencer/COPYRIGHT;md5=dc5485bb394a13b2332ec1c785f5d83a \
       file://COPYING.LIB;md5=4fbd65380cdd255951079008b364516c"
@@ -22,4 +22,6 @@ ARM_INSTRUCTION_SET:armv6 = "arm"
 #
 COMPATIBLE_HOST:libc-musl:class-target = "null"
 
-PV = "2.39+git"
+PV = "2.41+git"
+
+TOOLCHAIN = "gcc"
diff --git a/meta/recipes-core/glibc/glibc-locale.inc b/meta/recipes-core/glibc/glibc-locale.inc
index c63c9edd76..90248bbc0f 100644
--- a/meta/recipes-core/glibc/glibc-locale.inc
+++ b/meta/recipes-core/glibc/glibc-locale.inc
@@ -65,6 +65,8 @@ FILES:${LOCALEBASEPN}-locale-alias = "${datadir}/locale/locale.alias"
 
 LOCALETREESRC = "${COMPONENTS_DIR}/${PACKAGE_ARCH}/glibc-stash-locale"
 
+PSEUDO_INCLUDE_PATHS .= ",${WORKDIR}/locale-tree"
+
 copy_locale_files() {
         local dir=$1 mode=$2
 
diff --git a/meta/recipes-core/glibc/glibc-locale_2.39.bb b/meta/recipes-core/glibc/glibc-locale_2.41.bb
index f7702e0358..f7702e0358 100644
--- a/meta/recipes-core/glibc/glibc-locale_2.39.bb
+++ b/meta/recipes-core/glibc/glibc-locale_2.41.bb
diff --git a/meta/recipes-core/glibc/glibc-mtrace_2.39.bb b/meta/recipes-core/glibc/glibc-mtrace_2.41.bb
index 0b69bad46a..0b69bad46a 100644
--- a/meta/recipes-core/glibc/glibc-mtrace_2.39.bb
+++ b/meta/recipes-core/glibc/glibc-mtrace_2.41.bb
diff --git a/meta/recipes-core/glibc/glibc-package.inc b/meta/recipes-core/glibc/glibc-package.inc
index 1ef987be0a..21f2200d19 100644
--- a/meta/recipes-core/glibc/glibc-package.inc
+++ b/meta/recipes-core/glibc/glibc-package.inc
@@ -26,6 +26,7 @@ INSANE_SKIP:${PN}-dev += "staticdev"
 INSANE_SKIP:${MLPREFIX}ldso:append = " dev-so libdir"
 
 FILES:${PN} = "${libc_baselibs} ${libexecdir}/* ${sysconfdir}/ld.so.conf"
+CONFFILES:${PN} = "${sysconfdir}/ld.so.conf"
 RRECOMMENDS:${PN} = "${@bb.utils.contains('DISTRO_FEATURES', 'ldconfig', '${MLPREFIX}ldconfig', '', d)}"
 FILES:ldconfig = "${base_sbindir}/ldconfig"
 FILES:ldd = "${bindir}/ldd"
@@ -39,7 +40,7 @@ FILES:sln = "${base_sbindir}/sln"
 FILES:${PN}-pic = "${libdir}/*_pic.a ${libdir}/*_pic.map ${libdir}/libc_pic/*.o"
 FILES:libsotruss = "${libdir}/audit/sotruss-lib.so"
 FILES_SOLIBSDEV = "${libdir}/lib*${SOLIBSDEV}"
-FILES:${PN}-dev += "${libdir}/libpthread.a ${libdir}/libdl.a ${libdir}/libutil.a ${libdir}/libanl.a ${libdir}/*_nonshared.a ${base_libdir}/*_nonshared.a ${base_libdir}/*.o ${datadir}/aclocal"
+FILES:${PN}-dev += "${libdir}/libpthread.a ${libdir}/libdl.a ${libdir}/libutil.a ${libdir}/libanl.a ${libdir}/*_nonshared.a ${base_libdir}/*_nonshared.a ${base_libdir}/*.o ${datadir}/aclocal ${libdir}/gcc/${TARGET_SYS}/*/finclude"
 RDEPENDS:${PN}-dev = "linux-libc-headers-dev"
 FILES:${PN}-staticdev += "${libdir}/*.a ${base_libdir}/*.a"
 FILES:nscd = "${sbindir}/nscd* ${sysconfdir}/init.d/nscd ${systemd_system_unitdir}/nscd* ${nonarch_libdir}/tmpfiles.d/nscd.conf \
@@ -69,9 +70,9 @@ inherit multilib_header
 
 do_install() {
         oe_runmake install_root=${D} install
-        install -Dm 0644 ${WORKDIR}/etc/ld.so.conf ${D}/${sysconfdir}/ld.so.conf
+        install -Dm 0644 ${UNPACKDIR}/etc/ld.so.conf ${D}/${sysconfdir}/ld.so.conf
         install -d ${D}${localedir}
-        make -f ${WORKDIR}/generate-supported.mk IN="${S}/localedata/SUPPORTED" OUT="${WORKDIR}/SUPPORTED"
+        make -f ${UNPACKDIR}/generate-supported.mk IN="${S}/localedata/SUPPORTED" OUT="${WORKDIR}/SUPPORTED"
         # get rid of some broken files...
         for i in ${GLIBC_BROKEN_LOCALES}; do
                 sed -i "/$i/d" ${WORKDIR}/SUPPORTED
@@ -87,7 +88,7 @@ do_install() {
                 rmdir --ignore-fail-on-non-empty ${D}${libexecdir}
         fi
 
-        oe_multilib_header bits/syscall.h bits/long-double.h bits/floatn.h bits/endianness.h bits/struct_rwlock.h bits/math-vector.h
+        oe_multilib_header bits/syscall.h bits/long-double.h bits/floatn.h bits/endianness.h bits/struct_rwlock.h bits/math-vector.h bits/indirect-return.h
 
         if [ -f ${D}${bindir}/mtrace ]; then
                 sed -i -e '1s,#!.*perl,#! ${USRBINPATH}/env perl,' -e '2s,exec.*perl,exec ${USRBINPATH}/env perl,' ${D}${bindir}/mtrace
@@ -101,7 +102,7 @@ do_install() {
         install -d ${D}${localstatedir}/db/nscd
         install -m 0755 ${S}/nscd/nscd.init ${D}${sysconfdir}/init.d/nscd
         install -m 0755 ${S}/nscd/nscd.conf ${D}${sysconfdir}/nscd.conf
-        install -m 0755 ${WORKDIR}/makedbs.sh ${D}${localstatedir}/db
+        install -m 0755 ${UNPACKDIR}/makedbs.sh ${D}${localstatedir}/db
         sed -i "s%daemon%start-stop-daemon --start --exec%g" ${D}${sysconfdir}/init.d/nscd
         sed -i "s|\(enable-cache\t\+netgroup\t\+\)yes|\1no|" ${D}${sysconfdir}/nscd.conf
 
@@ -169,6 +170,12 @@ do_install_armmultilib () {
         oe_multilib_header sys/elf.h sys/procfs.h sys/ptrace.h sys/ucontext.h sys/user.h
 }
 
+do_install_armmultilib:append:class-target() {
+    gcc_version=$($CC -dumpversion)
+    mkdir -p ${D}${libdir}/gcc/${TARGET_SYS}/${gcc_version}/finclude
+    mv ${D}${includedir}/finclude/math-vector-fortran.h ${D}${libdir}/gcc/${TARGET_SYS}/${gcc_version}/finclude/
+    rmdir --ignore-fail-on-non-empty ${D}${includedir}/finclude
+}
 
 LOCALESTASH = "${WORKDIR}/stashed-locale"
 bashscripts = "mtrace sotruss xtrace"
@@ -286,7 +293,7 @@ pkg_postinst:nscd () {
                 fi
         fi
 }
-CONFFILES:nscd="${sysconfdir}/nscd.conf"
+CONFFILES:nscd = "${sysconfdir}/nscd.conf"
 
 SYSTEMD_PACKAGES = "nscd"
 SYSTEMD_SERVICE:nscd = "nscd.service"
diff --git a/meta/recipes-core/glibc/glibc-scripts_2.39.bb b/meta/recipes-core/glibc/glibc-scripts_2.41.bb
index 5a89bd8022..5a89bd8022 100644
--- a/meta/recipes-core/glibc/glibc-scripts_2.39.bb
+++ b/meta/recipes-core/glibc/glibc-scripts_2.41.bb
diff --git a/meta/recipes-core/glibc/glibc-testsuite_2.39.bb b/meta/recipes-core/glibc/glibc-testsuite_2.41.bb
index 2e076f4b0f..3a2764e40b 100644
--- a/meta/recipes-core/glibc/glibc-testsuite_2.39.bb
+++ b/meta/recipes-core/glibc/glibc-testsuite_2.41.bb
@@ -18,7 +18,7 @@ TOOLCHAIN_TEST_HOST_PORT ??= "2222"
 do_check[nostamp] = "1"
 do_check[network] = "1"
 do_check:append () {
-    chmod 0755 ${WORKDIR}/check-test-wrapper
+    chmod 0755 ${UNPACKDIR}/check-test-wrapper
 
     oe_runmake -i \
         QEMU_SYSROOT="${RECIPE_SYSROOT}" \
@@ -26,7 +26,7 @@ do_check:append () {
         SSH_HOST="${TOOLCHAIN_TEST_HOST}" \
         SSH_HOST_USER="${TOOLCHAIN_TEST_HOST_USER}" \
         SSH_HOST_PORT="${TOOLCHAIN_TEST_HOST_PORT}" \
-        test-wrapper="${WORKDIR}/check-test-wrapper ${TOOLCHAIN_TEST_TARGET}" \
+        test-wrapper="${UNPACKDIR}/check-test-wrapper ${TOOLCHAIN_TEST_TARGET}" \
         check
 }
 
diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
index 618a574566..2d31131e03 100644
--- a/meta/recipes-core/glibc/glibc-version.inc
+++ b/meta/recipes-core/glibc/glibc-version.inc
@@ -1,10 +1,8 @@
-SRCBRANCH ?= "release/2.39/master"
-PV = "2.39+git"
-SRCREV_glibc ?= "1b9c1a0047fb26a65a9b2a7b8cd977243f7d353c"
+SRCBRANCH ?= "release/2.41/master"
+PV = "2.41+git"
+SRCREV_glibc ?= "0c76c951620f9e12df2a89b2c684878b55bb6795"
 SRCREV_localedef ?= "fab74f31b3811df543e24b6de47efdf45b538abc"
 
 GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
 
 UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+\.\d+(\.(?!90)\d+)*)"
-
-CVE_STATUS[CVE-2023-4911] = "fixed-version: Fixed in stable branch updates"
diff --git a/meta/recipes-core/glibc/glibc-y2038-tests_2.39.bb b/meta/recipes-core/glibc/glibc-y2038-tests_2.39.bb
deleted file mode 100644
index be49ca4cb7..0000000000
--- a/meta/recipes-core/glibc/glibc-y2038-tests_2.39.bb
+++ /dev/null
@@ -1,119 +0,0 @@
-require glibc_${PV}.bb
-require glibc-tests.inc
-
-inherit ptest features_check
-REQUIRED_DISTRO_FEATURES = "ptest"
-
-SRC_URI += "\
-        file://run-ptest \
-"
-
-SUMMARY = "glibc tests using time32/time64 interfaces to be run with ptest for the purpose of checking y2038 compatiblity"
-
-# Erase some variables already set by glibc_${PV}
-python __anonymous() {
-       # Remove packages provided by glibc build, we only need a subset of them
-       d.setVar("PACKAGES", "${PN} ${PN}-ptest")
-
-       d.setVar("PROVIDES", "${PN} ${PN}-ptest")
-
-       bbclassextend = d.getVar("BBCLASSEXTEND").replace("nativesdk", "").strip()
-       d.setVar("BBCLASSEXTEND", bbclassextend)
-       d.setVar("RRECOMMENDS", "")
-       d.setVar("SYSTEMD_SERVICE:nscd", "")
-       d.setVar("SYSTEMD_PACKAGES", "")
-}
-
-# Remove any leftovers from original glibc recipe
-RPROVIDES:${PN} = "${PN}"
-RRECOMMENDS:${PN} = ""
-RDEPENDS:${PN} = "glibc libgcc sed bash"
-RDEPENDS:${PN}-ptest = "${PN}"
-DEPENDS += "sed"
-
-export oe_srcdir="${exec_prefix}/src/debug/glibc/${PV}/"
-
-# Just build tests for target - do not run them
-do_check:append () {
-        oe_runmake -i check run-built-tests=no
-}
-addtask do_check after do_compile before do_install_ptest_base
-
-glibc_strip_build_directory () {
-        # Delete all non executable files from build directory
-        find ${B} ! -executable -type f -delete
-
-        # Remove build dynamic libraries and links to them as
-        # those are already installed in the target device
-        find ${B} -type f -name "*.so" -delete
-        find ${B} -type l -name "*.so*" -delete
-
-        # Remove headers (installed with glibc)
-        find ${B} -type f -name "*.h" -delete
-
-        find ${B} -type f -name "isomac" -delete
-        find ${B} -type f -name "annexc" -delete
-}
-
-do_install_ptest_base () {
-        glibc_strip_build_directory
-
-        ls -r ${B}/*/*-time64 > ${B}/tst_time64
-
-        # Remove '-time64' suffix - those tests are also time related
-        sed -e "s/-time64$//" ${B}/tst_time64 > ${B}/tst_time_tmp
-        tst_time=$(cat ${B}/tst_time_tmp ${B}/tst_time64)
-
-        rm ${B}/tst_time_tmp ${B}/tst_time64
-        echo "${tst_time}"
-
-        # Install build test programs to the image
-        install -d ${D}${PTEST_PATH}/tests/glibc-ptest/
-
-        for f in "${tst_time}"
-        do
-            cp -r ${f} ${D}${PTEST_PATH}/tests/glibc-ptest/
-        done
-
-        install -d ${D}${PTEST_PATH}
-        cp ${WORKDIR}/run-ptest ${D}${PTEST_PATH}/
-
-}
-
-# The datadir directory is required to allow core (and reused)
-# glibc cleanup function to finish correctly, as this directory
-# is not created for ptests
-stash_locale_package_cleanup:prepend () {
-        mkdir -p ${PKGD}${datadir}
-}
-
-stash_locale_sysroot_cleanup:prepend () {
-        mkdir -p ${SYSROOT_DESTDIR}${datadir}
-}
-
-# Prevent the do_package() task to set 'libc6' prefix
-# for glibc tests related packages
-python populate_packages:prepend () {
-    if d.getVar('DEBIAN_NAMES'):
-        d.setVar('DEBIAN_NAMES', '')
-}
-
-FILES:${PN} = "${PTEST_PATH}/* /usr/src/debug/${PN}/*"
-
-EXCLUDE_FROM_SHLIBS = "1"
-
-# Install debug data in .debug and sources in /usr/src/debug
-# It is more handy to have _all_ the sources and symbols in one
-# place (package) as this recipe will be used for validation and
-# debugging.
-PACKAGE_DEBUG_SPLIT_STYLE = ".debug"
-
-# glibc test cases violate by default some Yocto/OE checks (staticdev,
-# textrel)
-# 'debug-files' - add everything (including debug) into one package
-#                 (no need to install/build *-src package)
-INSANE_SKIP:${PN} += "staticdev textrel debug-files rpaths"
-
-deltask do_stash_locale
-do_install[noexec] = "1"
-do_populate_sysroot[noexec] = "1"
diff --git a/meta/recipes-core/glibc/glibc.inc b/meta/recipes-core/glibc/glibc.inc
index b08a70aa46..d8f20c87dd 100644
--- a/meta/recipes-core/glibc/glibc.inc
+++ b/meta/recipes-core/glibc/glibc.inc
@@ -1,7 +1,7 @@
 require glibc-common.inc
 require glibc-ld.inc
 
-DEPENDS = "virtual/${HOST_PREFIX}gcc virtual/${HOST_PREFIX}binutils libgcc-initial linux-libc-headers"
+DEPENDS = "virtual/cross-cc virtual/cross-binutils libgcc-initial linux-libc-headers"
 
 PROVIDES = "virtual/libc"
 PROVIDES += "virtual/libintl virtual/libiconv"
diff --git a/meta/recipes-core/glibc/glibc/0001-Propagate-ffile-prefix-map-from-CFLAGS-to-ASFLAGS.patch b/meta/recipes-core/glibc/glibc/0001-Propagate-ffile-prefix-map-from-CFLAGS-to-ASFLAGS.patch
new file mode 100644
index 0000000000..b42b186418
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0001-Propagate-ffile-prefix-map-from-CFLAGS-to-ASFLAGS.patch
@@ -0,0 +1,24 @@
+From 603e50d6b8ccadb32d59b0497f76629665c1794b Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Wed, 16 Apr 2025 19:51:01 -0700
+Subject: [PATCH] Propagate -ffile-prefix-map from CFLAGS to ASFLAGS.
+
+Upstream-Status: Submitted [https://sourceware.org/pipermail/libc-alpha/2025-April/165969.html]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ Makeconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makeconfig b/Makeconfig
+index e35c5cfe4e..7a19c731c6 100644
+--- a/Makeconfig
++++ b/Makeconfig
+@@ -1172,7 +1172,7 @@ endif
+ 
+ # The assembler can generate debug information too.
+ ifndef ASFLAGS
+-ASFLAGS := $(filter -g% -fdebug-prefix-map=%,$(CFLAGS))
++ASFLAGS := $(filter -g% -fdebug-prefix-map=% -ffile-prefix-map=%,$(CFLAGS))
+ endif
+ override ASFLAGS += -Werror=undef $(ASFLAGS-config) $(asflags-cpu)
+ 
diff --git a/meta/recipes-core/glibc/glibc/0001-localedef-Add-hardlink-resolver-from-util-linux.patch b/meta/recipes-core/glibc/glibc/0001-localedef-Add-hardlink-resolver-from-util-linux.patch
index 4f919078dd..dbe3ce8c32 100644
--- a/meta/recipes-core/glibc/glibc/0001-localedef-Add-hardlink-resolver-from-util-linux.patch
+++ b/meta/recipes-core/glibc/glibc/0001-localedef-Add-hardlink-resolver-from-util-linux.patch
@@ -1,4 +1,4 @@
-From 544d23dea91b2be793c805b9e4bce8cd1d28121f Mon Sep 17 00:00:00 2001
+From cecd20fa2ff3ee2bd887b1d427088f32678cc04f Mon Sep 17 00:00:00 2001
 From: Jason Wessel <jason.wessel@windriver.com>
 Date: Sat, 7 Dec 2019 09:59:22 -0800
 Subject: [PATCH] localedef: Add hardlink resolver from util-linux
diff --git a/meta/recipes-core/glibc/glibc/0001-stdlib-Add-single-threaded-fast-path-to-rand.patch b/meta/recipes-core/glibc/glibc/0001-stdlib-Add-single-threaded-fast-path-to-rand.patch
new file mode 100644
index 0000000000..736fc51f38
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0001-stdlib-Add-single-threaded-fast-path-to-rand.patch
@@ -0,0 +1,47 @@
+From 4f54b0dfc16dbe0df86afccb90e447df5f7f571e Mon Sep 17 00:00:00 2001
+From: Wilco Dijkstra <wilco.dijkstra@arm.com>
+Date: Mon, 18 Mar 2024 15:18:20 +0000
+Subject: [PATCH] stdlib: Add single-threaded fast path to rand()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Improve performance of rand() and __random() by adding a single-threaded
+fast path.  Bench-random-lock shows about 5x speedup on Neoverse V1.
+
+Upstream-Status: Backport [be0cfd848d9ad7378800d6302bc11467cf2b514f]
+
+Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
+---
+ stdlib/random.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/stdlib/random.c b/stdlib/random.c
+index 17cc61ba8f55..5d482a857065 100644
+--- a/stdlib/random.c
++++ b/stdlib/random.c
+@@ -51,6 +51,7 @@
+    SUCH DAMAGE.*/
+ 
+ #include <libc-lock.h>
++#include <sys/single_threaded.h>
+ #include <limits.h>
+ #include <stddef.h>
+ #include <stdlib.h>
+@@ -288,6 +289,12 @@ __random (void)
+ {
+   int32_t retval;
+ 
++  if (SINGLE_THREAD_P)
++    {
++      (void) __random_r (&unsafe_state, &retval);
++      return retval;
++    }
++
+   __libc_lock_lock (lock);
+ 
+   (void) __random_r (&unsafe_state, &retval);
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/glibc/glibc/0002-localedef-fix-ups-hardlink-to-make-it-compile.patch b/meta/recipes-core/glibc/glibc/0002-localedef-fix-ups-hardlink-to-make-it-compile.patch
index 7c8fa973ec..59d71a0d8b 100644
--- a/meta/recipes-core/glibc/glibc/0002-localedef-fix-ups-hardlink-to-make-it-compile.patch
+++ b/meta/recipes-core/glibc/glibc/0002-localedef-fix-ups-hardlink-to-make-it-compile.patch
@@ -1,4 +1,4 @@
-From ebb1e37285ab541135005cfe945b7a58e4b95040 Mon Sep 17 00:00:00 2001
+From e31f032ae87ba38645c66dd7d2dfaa8606602e70 Mon Sep 17 00:00:00 2001
 From: Jason Wessel <jason.wessel@windriver.com>
 Date: Sat, 7 Dec 2019 10:01:37 -0800
 Subject: [PATCH] localedef: fix-ups hardlink to make it compile
diff --git a/meta/recipes-core/glibc/glibc/0003-nativesdk-glibc-Look-for-host-system-ld.so.cache-as-.patch b/meta/recipes-core/glibc/glibc/0003-nativesdk-glibc-Look-for-host-system-ld.so.cache-as-.patch
index bd4b5aa98b..0f7db0d500 100644
--- a/meta/recipes-core/glibc/glibc/0003-nativesdk-glibc-Look-for-host-system-ld.so.cache-as-.patch
+++ b/meta/recipes-core/glibc/glibc/0003-nativesdk-glibc-Look-for-host-system-ld.so.cache-as-.patch
@@ -1,6 +1,6 @@
-From 9770abfda8e85fe027f95871bc03450d05b1e2c8 Mon Sep 17 00:00:00 2001
+From f794ec18764a59ad45e242092e2ae6f5e3b19761 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
-Date: Wed, 18 Mar 2015 01:48:24 +0000
+Date: Sat, 3 Feb 2024 13:54:16 -0800
 Subject: [PATCH] nativesdk-glibc: Look for host system ld.so.cache as well
 
 Upstream-Status: Inappropriate [embedded specific]
@@ -30,25 +30,25 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  1 file changed, 8 insertions(+), 8 deletions(-)
 
 diff --git a/elf/dl-load.c b/elf/dl-load.c
-index ce8fdea302..1f502eb026 100644
+index f905578a65..d4dd0fbc2a 100644
 --- a/elf/dl-load.c
 +++ b/elf/dl-load.c
-@@ -2105,6 +2105,14 @@ _dl_map_object (struct link_map *loader, const char *name,
-             }
-         }
+@@ -2038,6 +2038,14 @@ _dl_map_object (struct link_map *loader, const char *name,
+                        &loader->l_runpath_dirs, &realname, &fb, loader,
+                        LA_SER_RUNPATH, &found_other_class);
  
-+      /* try the default path.  */
-+      if (fd == -1
-+         && ((l = loader ?: GL(dl_ns)[nsid]._ns_loaded) == NULL
-+          || __builtin_expect (!(l->l_flags_1 & DF_1_NODEFLIB), 1))
-+        && __rtld_search_dirs.dirs != (void *) -1)
-+       fd = open_path (name, namelen, mode & __RTLD_SECURE, &__rtld_search_dirs,
-+                       &realname, &fb, l, LA_SER_DEFAULT, &found_other_class);
-+      /* Finally try ld.so.cache */
++    /* Try the default path.  */
++    if (fd == -1
++      && ((l = loader ?: GL(dl_ns)[nsid]._ns_loaded) == NULL
++      || __glibc_likely (!(l->l_flags_1 & DF_1_NODEFLIB)))
++      && __rtld_search_dirs.dirs != (void *) -1)
++      fd = open_path (name, namelen, mode, &__rtld_search_dirs,
++                      &realname, &fb, l, LA_SER_DEFAULT, &found_other_class);
++  /* Finally try ld.so.cache */
  #ifdef USE_LDCONFIG
        if (fd == -1
           && (__glibc_likely ((mode & __RTLD_SECURE) == 0)
-@@ -2163,14 +2171,6 @@ _dl_map_object (struct link_map *loader, const char *name,
+@@ -2096,14 +2104,6 @@ _dl_map_object (struct link_map *loader, const char *name,
         }
  #endif
  
diff --git a/meta/recipes-core/glibc/glibc/0004-nativesdk-glibc-Fix-buffer-overrun-with-a-relocated-.patch b/meta/recipes-core/glibc/glibc/0004-nativesdk-glibc-Fix-buffer-overrun-with-a-relocated-.patch
index 19fc561a06..d9731a6fb7 100644
--- a/meta/recipes-core/glibc/glibc/0004-nativesdk-glibc-Fix-buffer-overrun-with-a-relocated-.patch
+++ b/meta/recipes-core/glibc/glibc/0004-nativesdk-glibc-Fix-buffer-overrun-with-a-relocated-.patch
@@ -1,4 +1,4 @@
-From 587b92ff99e6d8f59c461ee8beecae39d8818f7e Mon Sep 17 00:00:00 2001
+From e8af7c91033875cfaf419c840d3283d71eb72d50 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Wed, 18 Mar 2015 01:50:00 +0000
 Subject: [PATCH] nativesdk-glibc: Fix buffer overrun with a relocated SDK
@@ -21,10 +21,10 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  1 file changed, 12 insertions(+)
 
 diff --git a/elf/dl-load.c b/elf/dl-load.c
-index 1f502eb026..c4a543fb00 100644
+index d4dd0fbc2a..0cd5221d6a 100644
 --- a/elf/dl-load.c
 +++ b/elf/dl-load.c
-@@ -1802,7 +1802,19 @@ open_path (const char *name, size_t namelen, int mode,
+@@ -1749,7 +1749,19 @@ open_path (const char *name, size_t namelen, int mode,
         given on the command line when rtld is run directly.  */
      return -1;
  
diff --git a/meta/recipes-core/glibc/glibc/0005-nativesdk-glibc-Raise-the-size-of-arrays-containing-.patch b/meta/recipes-core/glibc/glibc/0005-nativesdk-glibc-Raise-the-size-of-arrays-containing-.patch
index 55892417f4..0ee03c95d8 100644
--- a/meta/recipes-core/glibc/glibc/0005-nativesdk-glibc-Raise-the-size-of-arrays-containing-.patch
+++ b/meta/recipes-core/glibc/glibc/0005-nativesdk-glibc-Raise-the-size-of-arrays-containing-.patch
@@ -1,4 +1,4 @@
-From 49caf586b80ba030a0ee4af9f6128ff2979ea636 Mon Sep 17 00:00:00 2001
+From d7c4488ff48992631e14a53c27252790eaefe928 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Wed, 18 Mar 2015 01:51:38 +0000
 Subject: [PATCH] nativesdk-glibc: Raise the size of arrays containing dl paths
@@ -26,10 +26,10 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  8 files changed, 15 insertions(+), 10 deletions(-)
 
 diff --git a/elf/dl-cache.c b/elf/dl-cache.c
-index 85f3f179ed..cc55887c56 100644
+index 300aa1b6dd..6df873e08b 100644
 --- a/elf/dl-cache.c
 +++ b/elf/dl-cache.c
-@@ -352,6 +352,10 @@ search_cache (const char *string_table, uint32_t string_table_size,
+@@ -336,6 +336,10 @@ search_cache (const char *string_table, uint32_t string_table_size,
    return best;
  }
  
@@ -41,10 +41,10 @@ index 85f3f179ed..cc55887c56 100644
  _dl_cache_libcmp (const char *p1, const char *p2)
  {
 diff --git a/elf/dl-load.c b/elf/dl-load.c
-index c4a543fb00..27fb70f09b 100644
+index 0cd5221d6a..9b9593f8d8 100644
 --- a/elf/dl-load.c
 +++ b/elf/dl-load.c
-@@ -117,8 +117,8 @@ enum { ncapstr = 1, max_capstrlen = 0 };
+@@ -107,8 +107,8 @@ enum { ncapstr = 1, max_capstrlen = 0 };
     gen-trusted-dirs.awk.  */
  #include "trusted-dirs.h"
  
@@ -56,7 +56,7 @@ index c4a543fb00..27fb70f09b 100644
    SYSTEM_DIRS_LEN
  };
 diff --git a/elf/dl-usage.c b/elf/dl-usage.c
-index 5baac4ba8e..60097ad0e2 100644
+index c6d13ac2ee..1dac82102d 100644
 --- a/elf/dl-usage.c
 +++ b/elf/dl-usage.c
 @@ -25,6 +25,8 @@
@@ -87,7 +87,7 @@ index 5baac4ba8e..60097ad0e2 100644
    print_hwcaps_subdirectories (state);
    _exit (EXIT_SUCCESS);
 diff --git a/elf/interp.c b/elf/interp.c
-index 8b705824bf..7d094829f3 100644
+index cc49e13c86..394c1ce0c5 100644
 --- a/elf/interp.c
 +++ b/elf/interp.c
 @@ -18,5 +18,5 @@
@@ -98,10 +98,10 @@ index 8b705824bf..7d094829f3 100644
 +const char __invoke_dynamic_linker__[4096] __attribute__ ((section (".interp")))
    = RUNTIME_LINKER;
 diff --git a/elf/ldconfig.c b/elf/ldconfig.c
-index b64c54b53e..caf7001745 100644
+index 1432187e9b..0654e02389 100644
 --- a/elf/ldconfig.c
 +++ b/elf/ldconfig.c
-@@ -150,6 +150,8 @@ static struct argp argp =
+@@ -151,6 +151,8 @@ static struct argp argp =
    options, parse_opt, NULL, doc, NULL, more_help, NULL
  };
  
@@ -111,7 +111,7 @@ index b64c54b53e..caf7001745 100644
  static error_t
  parse_opt (int key, char *arg, struct argp_state *state)
 diff --git a/elf/rtld.c b/elf/rtld.c
-index 4f494b792e..d1c1252188 100644
+index f32058bba6..434ea6d0c5 100644
 --- a/elf/rtld.c
 +++ b/elf/rtld.c
 @@ -190,6 +190,7 @@ dso_name_valid_for_suid (const char *p)
@@ -123,7 +123,7 @@ index 4f494b792e..d1c1252188 100644
  static void
  audit_list_init (struct audit_list *list)
 diff --git a/iconv/gconv_conf.c b/iconv/gconv_conf.c
-index 1063c31a2b..57fa832e52 100644
+index 41ab0768c9..7c48c2b328 100644
 --- a/iconv/gconv_conf.c
 +++ b/iconv/gconv_conf.c
 @@ -35,7 +35,7 @@
@@ -136,7 +136,7 @@ index 1063c31a2b..57fa832e52 100644
  /* Type to represent search path.  */
  struct path_elem
 diff --git a/sysdeps/generic/dl-cache.h b/sysdeps/generic/dl-cache.h
-index 919e49ffc8..cd3f8ba94b 100644
+index 0ee6571315..792308c0ab 100644
 --- a/sysdeps/generic/dl-cache.h
 +++ b/sysdeps/generic/dl-cache.h
 @@ -34,10 +34,6 @@
diff --git a/meta/recipes-core/glibc/glibc/0006-nativesdk-glibc-Allow-64-bit-atomics-for-x86.patch b/meta/recipes-core/glibc/glibc/0006-nativesdk-glibc-Allow-64-bit-atomics-for-x86.patch
index 56eaaed4b7..597923e792 100644
--- a/meta/recipes-core/glibc/glibc/0006-nativesdk-glibc-Allow-64-bit-atomics-for-x86.patch
+++ b/meta/recipes-core/glibc/glibc/0006-nativesdk-glibc-Allow-64-bit-atomics-for-x86.patch
@@ -1,4 +1,4 @@
-From 3a94365c730d174a3c30c6d9282e6ca12d9ad091 Mon Sep 17 00:00:00 2001
+From 9b408439eb042c4fc5cb33c8929dea419bf25b41 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Thu, 31 Dec 2015 14:35:35 -0800
 Subject: [PATCH] nativesdk-glibc: Allow 64 bit atomics for x86
@@ -17,7 +17,7 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  1 file changed, 1 insertion(+), 6 deletions(-)
 
 diff --git a/sysdeps/x86/atomic-machine.h b/sysdeps/x86/atomic-machine.h
-index cfd395087b..28a937c468 100644
+index 5452716d22..8c7408feb4 100644
 --- a/sysdeps/x86/atomic-machine.h
 +++ b/sysdeps/x86/atomic-machine.h
 @@ -26,19 +26,14 @@
diff --git a/meta/recipes-core/glibc/glibc/0007-nativesdk-glibc-Make-relocatable-install-for-locales.patch b/meta/recipes-core/glibc/glibc/0007-nativesdk-glibc-Make-relocatable-install-for-locales.patch
index 54c085a714..2886d461c8 100644
--- a/meta/recipes-core/glibc/glibc/0007-nativesdk-glibc-Make-relocatable-install-for-locales.patch
+++ b/meta/recipes-core/glibc/glibc/0007-nativesdk-glibc-Make-relocatable-install-for-locales.patch
@@ -1,4 +1,4 @@
-From 296bdde0683aa55cdea0fd0cab05ff8fbc462b17 Mon Sep 17 00:00:00 2001
+From 1a57ab6f7d602401396a18b0270498ff9228cf64 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Fri, 3 Aug 2018 09:55:12 -0700
 Subject: [PATCH] nativesdk-glibc: Make relocatable install for locales
@@ -19,7 +19,7 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  4 files changed, 8 insertions(+), 7 deletions(-)
 
 diff --git a/locale/findlocale.c b/locale/findlocale.c
-index 8d6e4e33e3..bfe74f241d 100644
+index e5e2bd3974..bdd9b79f83 100644
 --- a/locale/findlocale.c
 +++ b/locale/findlocale.c
 @@ -55,7 +55,7 @@ struct __locale_data *const _nl_C[] attribute_hidden =
@@ -41,7 +41,7 @@ index 8d6e4e33e3..bfe74f241d 100644
    else
      /* We really have to load some data.  First see whether the name is
 diff --git a/locale/loadarchive.c b/locale/loadarchive.c
-index 452e3eb6e3..c7467aec42 100644
+index 058a467cde..af62f3c304 100644
 --- a/locale/loadarchive.c
 +++ b/locale/loadarchive.c
 @@ -42,7 +42,7 @@
@@ -54,7 +54,7 @@ index 452e3eb6e3..c7467aec42 100644
  /* Size of initial mapping window, optimal if large enough to
     cover the header plus the initial locale.  */
 diff --git a/locale/localeinfo.h b/locale/localeinfo.h
-index ed698faef1..f7efc288a5 100644
+index ab1b5e5659..92aef8d58e 100644
 --- a/locale/localeinfo.h
 +++ b/locale/localeinfo.h
 @@ -347,7 +347,7 @@ _nl_lookup_word (locale_t l, int category, int item)
@@ -67,7 +67,7 @@ index ed698faef1..f7efc288a5 100644
  /* Load the locale data for CATEGORY from the file specified by *NAME.
     If *NAME is "", use environment variables as specified by POSIX, and
 diff --git a/locale/programs/locale.c b/locale/programs/locale.c
-index c7ee1874e8..8281e32236 100644
+index 7e8832dc3b..7fa484f092 100644
 --- a/locale/programs/locale.c
 +++ b/locale/programs/locale.c
 @@ -631,6 +631,7 @@ nameentcmp (const void *a, const void *b)
diff --git a/meta/recipes-core/glibc/glibc/0008-nativesdk-glibc-Fall-back-to-faccessat-on-faccess2-r.patch b/meta/recipes-core/glibc/glibc/0008-nativesdk-glibc-Fall-back-to-faccessat-on-faccess2-r.patch
index 096764009a..025ad153d6 100644
--- a/meta/recipes-core/glibc/glibc/0008-nativesdk-glibc-Fall-back-to-faccessat-on-faccess2-r.patch
+++ b/meta/recipes-core/glibc/glibc/0008-nativesdk-glibc-Fall-back-to-faccessat-on-faccess2-r.patch
@@ -1,4 +1,4 @@
-From 70da806febac8b2eead6ddc32451bbc1787a1d7d Mon Sep 17 00:00:00 2001
+From 789083eea1feb1249ec5817710552dc31653b36e Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Sat, 6 Mar 2021 14:48:56 -0800
 Subject: [PATCH] nativesdk-glibc: Fall back to faccessat on faccess2 returns
@@ -14,7 +14,7 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/sysdeps/unix/sysv/linux/faccessat.c b/sysdeps/unix/sysv/linux/faccessat.c
-index 2fa57fd63d..4d0d5ff0c4 100644
+index edb22ebce6..b67684a3ba 100644
 --- a/sysdeps/unix/sysv/linux/faccessat.c
 +++ b/sysdeps/unix/sysv/linux/faccessat.c
 @@ -30,7 +30,11 @@ __faccessat (int fd, const char *file, int mode, int flag)
diff --git a/meta/recipes-core/glibc/glibc/0009-yes-within-the-path-sets-wrong-config-variables.patch b/meta/recipes-core/glibc/glibc/0009-yes-within-the-path-sets-wrong-config-variables.patch
index 364e5cfde8..dbb6d674d5 100644
--- a/meta/recipes-core/glibc/glibc/0009-yes-within-the-path-sets-wrong-config-variables.patch
+++ b/meta/recipes-core/glibc/glibc/0009-yes-within-the-path-sets-wrong-config-variables.patch
@@ -1,4 +1,4 @@
-From 2192588942c5bc3b5fa10fc6d7433923f42e9ba0 Mon Sep 17 00:00:00 2001
+From 4a1ff3c313645aa425a0a87459c907dad1b9ca4b Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Wed, 18 Mar 2015 00:31:06 +0000
 Subject: [PATCH] 'yes' within the path sets wrong config variables
@@ -20,20 +20,22 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  sysdeps/arm/configure.ac                               | 4 ++--
  sysdeps/mips/configure                                 | 4 ++--
  sysdeps/mips/configure.ac                              | 4 ++--
- sysdeps/nios2/configure                                | 4 ++--
- sysdeps/nios2/configure.ac                             | 4 ++--
  sysdeps/unix/sysv/linux/mips/configure                 | 4 ++--
  sysdeps/unix/sysv/linux/mips/configure.ac              | 4 ++--
  sysdeps/unix/sysv/linux/powerpc/powerpc64/configure    | 8 ++++----
  sysdeps/unix/sysv/linux/powerpc/powerpc64/configure.ac | 8 ++++----
- 12 files changed, 28 insertions(+), 28 deletions(-)
+ 10 files changed, 24 insertions(+), 24 deletions(-)
+ mode change 100644 => 100755 sysdeps/arm/configure
+ mode change 100644 => 100755 sysdeps/mips/configure
+ mode change 100644 => 100755 sysdeps/unix/sysv/linux/mips/configure
+ mode change 100644 => 100755 sysdeps/unix/sysv/linux/powerpc/powerpc64/configure
 
 diff --git a/sysdeps/aarch64/configure b/sysdeps/aarch64/configure
-index ca57edce47..5e91fab023 100644
+index 4bd5496a4a..6c051369fb 100755
 --- a/sysdeps/aarch64/configure
 +++ b/sysdeps/aarch64/configure
-@@ -165,12 +165,12 @@ else $as_nop
-   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+@@ -157,12 +157,12 @@ else case e in #(
+   e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext
  /* end confdefs.h.  */
  #ifdef __AARCH64EB__
 -                      yes
@@ -42,13 +44,13 @@ index ca57edce47..5e91fab023 100644
  
  _ACEOF
  if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
--  $EGREP "yes" >/dev/null 2>&1
-+  $EGREP "is_aarch64_be" >/dev/null 2>&1
+-  $EGREP_TRADITIONAL "yes" >/dev/null 2>&1
++  $EGREP_TRADITIONAL "is_aarch64_be" >/dev/null 2>&1
  then :
    libc_cv_aarch64_be=yes
- else $as_nop
+ else case e in #(
 diff --git a/sysdeps/aarch64/configure.ac b/sysdeps/aarch64/configure.ac
-index 27874eceb4..8a708f2ef4 100644
+index 56d12d661d..80fca20873 100644
 --- a/sysdeps/aarch64/configure.ac
 +++ b/sysdeps/aarch64/configure.ac
 @@ -13,8 +13,8 @@ AC_DEFINE(SUPPORT_STATIC_PIE)
@@ -63,11 +65,13 @@ index 27874eceb4..8a708f2ef4 100644
    ], libc_cv_aarch64_be=yes, libc_cv_aarch64_be=no)])
  if test $libc_cv_aarch64_be = yes; then
 diff --git a/sysdeps/arm/configure b/sysdeps/arm/configure
-index 35e2918922..94d7fbe8bb 100644
+old mode 100644
+new mode 100755
+index 935e022c74..9f7c98bcd3
 --- a/sysdeps/arm/configure
 +++ b/sysdeps/arm/configure
-@@ -161,12 +161,12 @@ else $as_nop
-   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+@@ -153,12 +153,12 @@ else case e in #(
+   e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext
  /* end confdefs.h.  */
  #ifdef __ARM_PCS_VFP
 -                     yes
@@ -76,13 +80,13 @@ index 35e2918922..94d7fbe8bb 100644
  
  _ACEOF
  if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
--  $EGREP "yes" >/dev/null 2>&1
-+  $EGREP "use_arm_pcs_vfp" >/dev/null 2>&1
+-  $EGREP_TRADITIONAL "yes" >/dev/null 2>&1
++  $EGREP_TRADITIONAL "use_arm_pcs_vfp" >/dev/null 2>&1
  then :
    libc_cv_arm_pcs_vfp=yes
- else $as_nop
+ else case e in #(
 diff --git a/sysdeps/arm/configure.ac b/sysdeps/arm/configure.ac
-index 5172e30bbe..f06dedd7c5 100644
+index cd00ddc9d9..d3831867ac 100644
 --- a/sysdeps/arm/configure.ac
 +++ b/sysdeps/arm/configure.ac
 @@ -10,8 +10,8 @@ GLIBC_PROVIDES dnl See aclocal.m4 in the top level source directory.
@@ -97,10 +101,12 @@ index 5172e30bbe..f06dedd7c5 100644
    ], libc_cv_arm_pcs_vfp=yes, libc_cv_arm_pcs_vfp=no)])
  if test $libc_cv_arm_pcs_vfp = yes; then
 diff --git a/sysdeps/mips/configure b/sysdeps/mips/configure
-index 1e8c6711e6..ae52ccd929 100644
+old mode 100644
+new mode 100755
+index 60dbd947e2..e3d10d7b96
 --- a/sysdeps/mips/configure
 +++ b/sysdeps/mips/configure
-@@ -158,11 +158,11 @@ else $as_nop
+@@ -150,11 +150,11 @@ else case e in #(
  /* end confdefs.h.  */
  dnl
  #ifdef __mips_nan2008
@@ -109,11 +115,11 @@ index 1e8c6711e6..ae52ccd929 100644
  #endif
  _ACEOF
  if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
--  $EGREP "yes" >/dev/null 2>&1
-+  $EGREP "use_mips_nan2008" >/dev/null 2>&1
+-  $EGREP_TRADITIONAL "yes" >/dev/null 2>&1
++  $EGREP_TRADITIONAL "use_mips_nan2008" >/dev/null 2>&1
  then :
    libc_cv_mips_nan2008=yes
- else $as_nop
+ else case e in #(
 diff --git a/sysdeps/mips/configure.ac b/sysdeps/mips/configure.ac
 index d3cd780d78..250223d206 100644
 --- a/sysdeps/mips/configure.ac
@@ -130,45 +136,13 @@ index d3cd780d78..250223d206 100644
  #endif], libc_cv_mips_nan2008=yes, libc_cv_mips_nan2008=no)])
  if test x$libc_cv_mips_nan2008 = xyes; then
    AC_DEFINE(HAVE_MIPS_NAN2008)
-diff --git a/sysdeps/nios2/configure b/sysdeps/nios2/configure
-index 2fb230cbaa..1959d0a444 100644
---- a/sysdeps/nios2/configure
-+++ b/sysdeps/nios2/configure
-@@ -155,12 +155,12 @@ else $as_nop
-   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
- /* end confdefs.h.  */
- #ifdef __nios2_big_endian__
--                      yes
-+                      is_nios2_be
-                      #endif
- 
- _ACEOF
- if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
--  $EGREP "yes" >/dev/null 2>&1
-+  $EGREP "is_nios2_be" >/dev/null 2>&1
- then :
-   libc_cv_nios2_be=yes
- else $as_nop
-diff --git a/sysdeps/nios2/configure.ac b/sysdeps/nios2/configure.ac
-index f738e9a7ed..4085851cbc 100644
---- a/sysdeps/nios2/configure.ac
-+++ b/sysdeps/nios2/configure.ac
-@@ -4,8 +4,8 @@ GLIBC_PROVIDES dnl See aclocal.m4 in the top level source directory.
- # Nios II big endian is not yet supported.
- AC_CACHE_CHECK([for big endian],
-   [libc_cv_nios2_be],
--  [AC_EGREP_CPP(yes,[#ifdef __nios2_big_endian__
--                      yes
-+  [AC_EGREP_CPP(is_nios2_be,[#ifdef __nios2_big_endian__
-+                      is_nios2_be
-                      #endif
-   ], libc_cv_nios2_be=yes, libc_cv_nios2_be=no)])
- if test $libc_cv_nios2_be = yes; then
 diff --git a/sysdeps/unix/sysv/linux/mips/configure b/sysdeps/unix/sysv/linux/mips/configure
-index a060901de4..0ac7019438 100644
+old mode 100644
+new mode 100755
+index 6e3402c111..a23f24ef8e
 --- a/sysdeps/unix/sysv/linux/mips/configure
 +++ b/sysdeps/unix/sysv/linux/mips/configure
-@@ -441,11 +441,11 @@ else $as_nop
+@@ -443,11 +443,11 @@ else case e in #(
  /* end confdefs.h.  */
  dnl
  #ifdef __mips_nan2008
@@ -177,11 +151,11 @@ index a060901de4..0ac7019438 100644
  #endif
  _ACEOF
  if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
--  $EGREP "yes" >/dev/null 2>&1
-+  $EGREP "use_mips_nan2008" >/dev/null 2>&1
+-  $EGREP_TRADITIONAL "yes" >/dev/null 2>&1
++  $EGREP_TRADITIONAL "use_mips_nan2008" >/dev/null 2>&1
  then :
    libc_cv_mips_nan2008=yes
- else $as_nop
+ else case e in #(
 diff --git a/sysdeps/unix/sysv/linux/mips/configure.ac b/sysdeps/unix/sysv/linux/mips/configure.ac
 index 049a0f4bdf..005526d4e8 100644
 --- a/sysdeps/unix/sysv/linux/mips/configure.ac
@@ -199,11 +173,13 @@ index 049a0f4bdf..005526d4e8 100644
  
  libc_mips_nan=
 diff --git a/sysdeps/unix/sysv/linux/powerpc/powerpc64/configure b/sysdeps/unix/sysv/linux/powerpc/powerpc64/configure
-index cf1b70c745..0dccf6cd76 100644
+old mode 100644
+new mode 100755
+index 5dd70689fc..7d6c2322d3
 --- a/sysdeps/unix/sysv/linux/powerpc/powerpc64/configure
 +++ b/sysdeps/unix/sysv/linux/powerpc/powerpc64/configure
-@@ -168,12 +168,12 @@ else $as_nop
-   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+@@ -160,12 +160,12 @@ else case e in #(
+   e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext
  /* end confdefs.h.  */
  #if _CALL_ELF == 2
 -                      yes
@@ -212,13 +188,13 @@ index cf1b70c745..0dccf6cd76 100644
  
  _ACEOF
  if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
--  $EGREP "yes" >/dev/null 2>&1
-+  $EGREP "use_ppc_elfv2_abi" >/dev/null 2>&1
+-  $EGREP_TRADITIONAL "yes" >/dev/null 2>&1
++  $EGREP_TRADITIONAL "use_ppc_elfv2_abi" >/dev/null 2>&1
  then :
    libc_cv_ppc64_elfv2_abi=yes
- else $as_nop
-@@ -203,12 +203,12 @@ else $as_nop
-   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ else case e in #(
+@@ -197,12 +197,12 @@ else case e in #(
+   e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext
  /* end confdefs.h.  */
  #ifdef _CALL_ELF
 -                         yes
@@ -227,11 +203,11 @@ index cf1b70c745..0dccf6cd76 100644
  
  _ACEOF
  if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
--  $EGREP "yes" >/dev/null 2>&1
-+  $EGREP "is_def_call_elf" >/dev/null 2>&1
+-  $EGREP_TRADITIONAL "yes" >/dev/null 2>&1
++  $EGREP_TRADITIONAL "is_def_call_elf" >/dev/null 2>&1
  then :
    libc_cv_ppc64_def_call_elf=yes
- else $as_nop
+ else case e in #(
 diff --git a/sysdeps/unix/sysv/linux/powerpc/powerpc64/configure.ac b/sysdeps/unix/sysv/linux/powerpc/powerpc64/configure.ac
 index f9cba6e15d..b21f72f1e4 100644
 --- a/sysdeps/unix/sysv/linux/powerpc/powerpc64/configure.ac
diff --git a/meta/recipes-core/glibc/glibc/0010-eglibc-Cross-building-and-testing-instructions.patch b/meta/recipes-core/glibc/glibc/0010-eglibc-Cross-building-and-testing-instructions.patch
index d7f15c1cfa..b1bed71f2b 100644
--- a/meta/recipes-core/glibc/glibc/0010-eglibc-Cross-building-and-testing-instructions.patch
+++ b/meta/recipes-core/glibc/glibc/0010-eglibc-Cross-building-and-testing-instructions.patch
@@ -1,4 +1,4 @@
-From ce8b13bdf488058754fce573754cea0b022c37e2 Mon Sep 17 00:00:00 2001
+From 7d158af5750b351b3b08e78bb6c5fe80e7cb36ba Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Wed, 18 Mar 2015 00:42:58 +0000
 Subject: [PATCH] eglibc: Cross building and testing instructions
diff --git a/meta/recipes-core/glibc/glibc/0011-eglibc-Help-bootstrap-cross-toolchain.patch b/meta/recipes-core/glibc/glibc/0011-eglibc-Help-bootstrap-cross-toolchain.patch
index 82a3292655..13190125eb 100644
--- a/meta/recipes-core/glibc/glibc/0011-eglibc-Help-bootstrap-cross-toolchain.patch
+++ b/meta/recipes-core/glibc/glibc/0011-eglibc-Help-bootstrap-cross-toolchain.patch
@@ -1,4 +1,4 @@
-From 65b79161b9e2848a174d3519a03348884f182975 Mon Sep 17 00:00:00 2001
+From 435b57e8327555b273a52df672b2611050a8c579 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Wed, 18 Mar 2015 00:49:28 +0000
 Subject: [PATCH] eglibc: Help bootstrap cross toolchain
@@ -29,7 +29,7 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  create mode 100644 include/stubs-bootstrap.h
 
 diff --git a/Makefile b/Makefile
-index 7052b46df8..46073abaa8 100644
+index 97b4328af8..5c20ed3cff 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -79,9 +79,18 @@ subdir-dirs = include
diff --git a/meta/recipes-core/glibc/glibc/0012-eglibc-Resolve-__fpscr_values-on-SH4.patch b/meta/recipes-core/glibc/glibc/0012-eglibc-Resolve-__fpscr_values-on-SH4.patch
index e726a9e76f..780aff1e7d 100644
--- a/meta/recipes-core/glibc/glibc/0012-eglibc-Resolve-__fpscr_values-on-SH4.patch
+++ b/meta/recipes-core/glibc/glibc/0012-eglibc-Resolve-__fpscr_values-on-SH4.patch
@@ -1,4 +1,4 @@
-From 07a5fa22a9a8bbd43982c1b35132f8c2d5276bfe Mon Sep 17 00:00:00 2001
+From 46937c30c52cf186609bee1ec927464d395afb30 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Wed, 18 Mar 2015 00:55:53 +0000
 Subject: [PATCH] eglibc: Resolve __fpscr_values on SH4
@@ -33,7 +33,7 @@ index 3ad702e165..931985b5d6 100644
      # a*
      alphasort64;
 diff --git a/sysdeps/unix/sysv/linux/sh/sysdep.S b/sysdeps/unix/sysv/linux/sh/sysdep.S
-index d5d8c5e033..f356d02077 100644
+index db898e9e39..6e2972e814 100644
 --- a/sysdeps/unix/sysv/linux/sh/sysdep.S
 +++ b/sysdeps/unix/sysv/linux/sh/sysdep.S
 @@ -30,3 +30,14 @@ ENTRY (__syscall_error)
diff --git a/meta/recipes-core/glibc/glibc/0013-eglibc-Forward-port-cross-locale-generation-support.patch b/meta/recipes-core/glibc/glibc/0013-eglibc-Forward-port-cross-locale-generation-support.patch
index f36b7f6f4c..8f9bbb6cf3 100644
--- a/meta/recipes-core/glibc/glibc/0013-eglibc-Forward-port-cross-locale-generation-support.patch
+++ b/meta/recipes-core/glibc/glibc/0013-eglibc-Forward-port-cross-locale-generation-support.patch
@@ -1,4 +1,4 @@
-From 33e9867758e830e19d181d5a0aa7f2f3cc4a08b3 Mon Sep 17 00:00:00 2001
+From 68dcae2527a64a4448334fdfe27c7b6014589aae Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Wed, 18 Mar 2015 01:33:49 +0000
 Subject: [PATCH] eglibc: Forward port cross locale generation support
@@ -23,7 +23,7 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  create mode 100644 locale/catnames.c
 
 diff --git a/locale/Makefile b/locale/Makefile
-index 2810f28605..05f847f9a6 100644
+index 9d9c1a7691..bf271fd0a8 100644
 --- a/locale/Makefile
 +++ b/locale/Makefile
 @@ -30,6 +30,7 @@ headers = \
@@ -87,7 +87,7 @@ index 0000000000..538f3f5edb
 +    [LC_ALL] = sizeof ("LC_ALL") - 1
 +  };
 diff --git a/locale/localeinfo.h b/locale/localeinfo.h
-index f7efc288a5..6ef082eb25 100644
+index 92aef8d58e..ae23b2f7fe 100644
 --- a/locale/localeinfo.h
 +++ b/locale/localeinfo.h
 @@ -246,7 +246,7 @@ __libc_tsd_define (extern, locale_t, LOCALE)
@@ -100,7 +100,7 @@ index f7efc288a5..6ef082eb25 100644
  # define NL_CURRENT_INDIRECT   1
  #endif
 diff --git a/locale/programs/charmap-dir.c b/locale/programs/charmap-dir.c
-index 36504f238d..56ee97e61b 100644
+index e635a01ede..10e34a6da9 100644
 --- a/locale/programs/charmap-dir.c
 +++ b/locale/programs/charmap-dir.c
 @@ -18,7 +18,9 @@
@@ -146,7 +146,7 @@ index 36504f238d..56ee97e61b 100644
    return NULL;
  }
 diff --git a/locale/programs/ld-collate.c b/locale/programs/ld-collate.c
-index 5048adbd9f..4232834ead 100644
+index 7de3ba064d..3256427d21 100644
 --- a/locale/programs/ld-collate.c
 +++ b/locale/programs/ld-collate.c
 @@ -352,7 +352,7 @@ new_element (struct locale_collate_t *collate, const char *mbs, size_t mbslen,
@@ -195,7 +195,7 @@ index 5048adbd9f..4232834ead 100644
                          == runp->wcnext->wcs[runp->nwcs - 1] + 1));
  
 diff --git a/locale/programs/ld-ctype.c b/locale/programs/ld-ctype.c
-index eb6e7e145c..14736d1cac 100644
+index 15fd39c637..d4c5e0c9e7 100644
 --- a/locale/programs/ld-ctype.c
 +++ b/locale/programs/ld-ctype.c
 @@ -914,7 +914,7 @@ ctype_output (struct localedef_t *locale, const struct charmap_t *charmap,
@@ -277,7 +277,7 @@ index eb6e7e145c..14736d1cac 100644
               srunp = srunp->next;
             }
 diff --git a/locale/programs/ld-time.c b/locale/programs/ld-time.c
-index 1abff3cf53..8a2f2b820a 100644
+index 9529d7945a..554454b9c1 100644
 --- a/locale/programs/ld-time.c
 +++ b/locale/programs/ld-time.c
 @@ -219,8 +219,10 @@ No definition for %s category found"), "LC_TIME");
@@ -346,7 +346,7 @@ index 1abff3cf53..8a2f2b820a 100644
  
  
 diff --git a/locale/programs/linereader.c b/locale/programs/linereader.c
-index 61373d2657..7ec5726377 100644
+index 6f40ecf77a..573d051d0a 100644
 --- a/locale/programs/linereader.c
 +++ b/locale/programs/linereader.c
 @@ -776,7 +776,7 @@ get_string (struct linereader *lr, const struct charmap_t *charmap,
@@ -359,7 +359,7 @@ index 61373d2657..7ec5726377 100644
    lr_buffer_init (&lrb);
  
 diff --git a/locale/programs/localedef.c b/locale/programs/localedef.c
-index 907bb5fb25..3106529043 100644
+index 7b66cd279c..dd0c3f1562 100644
 --- a/locale/programs/localedef.c
 +++ b/locale/programs/localedef.c
 @@ -108,6 +108,7 @@ void (*argp_program_version_hook) (FILE *, struct argp_state *) = print_version;
@@ -405,7 +405,7 @@ index 907bb5fb25..3106529043 100644
        force_output = 1;
        break;
 diff --git a/locale/programs/locfile.c b/locale/programs/locfile.c
-index 6c6ebf2dd6..cc02ab82bf 100644
+index b54fcbbceb..6110c7b369 100644
 --- a/locale/programs/locfile.c
 +++ b/locale/programs/locfile.c
 @@ -543,6 +543,9 @@ compare_files (const char *filename1, const char *filename2, size_t size,
@@ -428,7 +428,7 @@ index 6c6ebf2dd6..cc02ab82bf 100644
  
  /* Record that FILE's next element is the 32-bit integer VALUE.  */
 diff --git a/locale/programs/locfile.h b/locale/programs/locfile.h
-index 3afb0a8d29..46785374e8 100644
+index 9103fade14..ecd878563d 100644
 --- a/locale/programs/locfile.h
 +++ b/locale/programs/locfile.h
 @@ -70,6 +70,8 @@ extern void write_all_categories (struct localedef_t *definitions,
@@ -517,7 +517,7 @@ index 3afb0a8d29..46785374e8 100644
 +
  #endif /* locfile.h */
 diff --git a/locale/setlocale.c b/locale/setlocale.c
-index 7bd27e5398..2f194bad7c 100644
+index c04740ca19..12deadeb24 100644
 --- a/locale/setlocale.c
 +++ b/locale/setlocale.c
 @@ -63,35 +63,6 @@ static char *const _nl_current_used[] =
diff --git a/meta/recipes-core/glibc/glibc/0014-localedef-add-to-archive-uses-a-hard-coded-locale-pa.patch b/meta/recipes-core/glibc/glibc/0014-localedef-add-to-archive-uses-a-hard-coded-locale-pa.patch
index daeff7b065..9448f360ef 100644
--- a/meta/recipes-core/glibc/glibc/0014-localedef-add-to-archive-uses-a-hard-coded-locale-pa.patch
+++ b/meta/recipes-core/glibc/glibc/0014-localedef-add-to-archive-uses-a-hard-coded-locale-pa.patch
@@ -1,4 +1,4 @@
-From f4b1d6429298c0f8a2aa29ff559eb2093ea0188f Mon Sep 17 00:00:00 2001
+From 194e83794369783287956fb12c7f8469e6b7d110 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Fri, 3 Aug 2018 09:42:06 -0700
 Subject: [PATCH] localedef --add-to-archive uses a hard-coded locale path
@@ -18,7 +18,7 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  1 file changed, 25 insertions(+), 10 deletions(-)
 
 diff --git a/locale/programs/locarchive.c b/locale/programs/locarchive.c
-index 8d79a1b6d1..6dc7ecd4e7 100644
+index 2c19f4fd29..b8495848c3 100644
 --- a/locale/programs/locarchive.c
 +++ b/locale/programs/locarchive.c
 @@ -339,12 +339,24 @@ enlarge_archive (struct locarhandle *ah, const struct locarhead *head)
diff --git a/meta/recipes-core/glibc/glibc/0015-powerpc-Do-not-ask-compiler-for-finding-arch.patch b/meta/recipes-core/glibc/glibc/0015-powerpc-Do-not-ask-compiler-for-finding-arch.patch
index 8dd1f0a656..0e00c04659 100644
--- a/meta/recipes-core/glibc/glibc/0015-powerpc-Do-not-ask-compiler-for-finding-arch.patch
+++ b/meta/recipes-core/glibc/glibc/0015-powerpc-Do-not-ask-compiler-for-finding-arch.patch
@@ -1,4 +1,4 @@
-From 2d064c0c1243ea0bf405909285d7cddca92cf097 Mon Sep 17 00:00:00 2001
+From 7d7f6fcd4f4b6664bff75addc92bc7b8a86dc22d Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Fri, 7 Aug 2020 14:31:16 -0700
 Subject: [PATCH] powerpc: Do not ask compiler for finding arch
@@ -15,7 +15,7 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  2 files changed, 2 insertions(+), 8 deletions(-)
 
 diff --git a/sysdeps/powerpc/preconfigure b/sysdeps/powerpc/preconfigure
-index 4de94089a3..428ad7b162 100644
+index 48b9c9b65a..7eb260fc78 100644
 --- a/sysdeps/powerpc/preconfigure
 +++ b/sysdeps/powerpc/preconfigure
 @@ -29,10 +29,7 @@ esac
@@ -31,7 +31,7 @@ index 4de94089a3..428ad7b162 100644
    # directory exists in sysdeps/powerpc.  Likewise, if we find a
    # cpu, don't let the generic configure append extra compiler options.
 diff --git a/sysdeps/powerpc/preconfigure.ac b/sysdeps/powerpc/preconfigure.ac
-index 6c63bd8257..3e925f1d48 100644
+index 14b6dafd4a..1acc6a457c 100644
 --- a/sysdeps/powerpc/preconfigure.ac
 +++ b/sysdeps/powerpc/preconfigure.ac
 @@ -29,10 +29,7 @@ esac
diff --git a/meta/recipes-core/glibc/glibc/0016-wordsize.h-Unify-the-header-between-arm-and-aarch64.patch b/meta/recipes-core/glibc/glibc/0016-wordsize.h-Unify-the-header-between-arm-and-aarch64.patch
index 066c3b1ea2..f40a8eff07 100644
--- a/meta/recipes-core/glibc/glibc/0016-wordsize.h-Unify-the-header-between-arm-and-aarch64.patch
+++ b/meta/recipes-core/glibc/glibc/0016-wordsize.h-Unify-the-header-between-arm-and-aarch64.patch
@@ -1,4 +1,4 @@
-From b1c374f7ede81a98f2d02def2c7ca17f1001f7cb Mon Sep 17 00:00:00 2001
+From 2bd0ea2c8f9595414741ed523c6ca07630a4fc96 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Fri, 15 May 2020 17:05:45 -0700
 Subject: [PATCH] wordsize.h: Unify the header between arm and aarch64
@@ -11,16 +11,16 @@ Upstream-Status: Inappropriate [ OE-Specific ]
 
 Signed-off-by: Khem Raj <raj.khem@gmail.com>
 ---
- sysdeps/aarch64/bits/wordsize.h | 8 ++++++--
- sysdeps/arm/bits/wordsize.h     | 1 +
- 2 files changed, 7 insertions(+), 2 deletions(-)
- create mode 120000 sysdeps/arm/bits/wordsize.h
+ sysdeps/aarch64/bits/wordsize.h | 11 +++++++++--
+ sysdeps/arm/bits/wordsize.h     | 22 +---------------------
+ 2 files changed, 10 insertions(+), 23 deletions(-)
+ mode change 100644 => 120000 sysdeps/arm/bits/wordsize.h
 
 diff --git a/sysdeps/aarch64/bits/wordsize.h b/sysdeps/aarch64/bits/wordsize.h
-index 118e59172d..b4b0692eb5 100644
+index f56260c2de..391d79d5a8 100644
 --- a/sysdeps/aarch64/bits/wordsize.h
 +++ b/sysdeps/aarch64/bits/wordsize.h
-@@ -17,12 +17,16 @@
+@@ -17,12 +17,19 @@
     License along with the GNU C Library; if not, see
     <https://www.gnu.org/licenses/>.  */
  
@@ -34,11 +34,41 @@ index 118e59172d..b4b0692eb5 100644
  # define __WORDSIZE32_PTRDIFF_LONG     1
 +#else
 +# define __WORDSIZE                    32
++# define __WORDSIZE_TIME64_COMPAT32    1
 +# define __WORDSIZE32_SIZE_ULONG       0
 +# define __WORDSIZE32_PTRDIFF_LONG     0
  #endif
  
++#ifdef __aarch64__
  #define __WORDSIZE_TIME64_COMPAT32     0
++#endif
+diff --git a/sysdeps/arm/bits/wordsize.h b/sysdeps/arm/bits/wordsize.h
+deleted file mode 100644
+index be457d84d3..0000000000
+--- a/sysdeps/arm/bits/wordsize.h
++++ /dev/null
+@@ -1,21 +0,0 @@
+-/* Copyright (C) 1999-2025 Free Software Foundation, Inc.
+-   This file is part of the GNU C Library.
+-
+-   The GNU C Library is free software; you can redistribute it and/or
+-   modify it under the terms of the GNU Lesser General Public
+-   License as published by the Free Software Foundation; either
+-   version 2.1 of the License, or (at your option) any later version.
+-
+-   The GNU C Library is distributed in the hope that it will be useful,
+-   but WITHOUT ANY WARRANTY; without even the implied warranty of
+-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+-   Lesser General Public License for more details.
+-
+-   You should have received a copy of the GNU Lesser General Public
+-   License along with the GNU C Library; if not, see
+-   <https://www.gnu.org/licenses/>.  */
+-
+-#define __WORDSIZE                     32
+-#define __WORDSIZE_TIME64_COMPAT32     1
+-#define __WORDSIZE32_SIZE_ULONG                0
+-#define __WORDSIZE32_PTRDIFF_LONG      0
 diff --git a/sysdeps/arm/bits/wordsize.h b/sysdeps/arm/bits/wordsize.h
 new file mode 120000
 index 0000000000..4c4a788ec2
diff --git a/meta/recipes-core/glibc/glibc/0017-Replace-echo-with-printf-builtin-in-nscd-init-script.patch b/meta/recipes-core/glibc/glibc/0017-Replace-echo-with-printf-builtin-in-nscd-init-script.patch
index d8c0b1b4ad..2af39799be 100644
--- a/meta/recipes-core/glibc/glibc/0017-Replace-echo-with-printf-builtin-in-nscd-init-script.patch
+++ b/meta/recipes-core/glibc/glibc/0017-Replace-echo-with-printf-builtin-in-nscd-init-script.patch
@@ -1,4 +1,4 @@
-From 0aac3b8ee5b13e289b6969da51de384443286a5b Mon Sep 17 00:00:00 2001
+From 7ef9358bbb184026914fb4d9ff479361b82bf6c9 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Thu, 31 Dec 2015 14:33:02 -0800
 Subject: [PATCH] Replace echo with printf builtin in nscd init script
diff --git a/meta/recipes-core/glibc/glibc/0018-sysdeps-gnu-configure.ac-Set-libc_cv_rootsbindir-onl.patch b/meta/recipes-core/glibc/glibc/0018-sysdeps-gnu-configure.ac-Set-libc_cv_rootsbindir-onl.patch
index c81f82f433..ca30edd91c 100644
--- a/meta/recipes-core/glibc/glibc/0018-sysdeps-gnu-configure.ac-Set-libc_cv_rootsbindir-onl.patch
+++ b/meta/recipes-core/glibc/glibc/0018-sysdeps-gnu-configure.ac-Set-libc_cv_rootsbindir-onl.patch
@@ -1,4 +1,4 @@
-From 7a25d4796411f22f824742092a4c2a08df99752d Mon Sep 17 00:00:00 2001
+From c43c1758baddaff1fb82afc118f7dba23af12540 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Wed, 18 Mar 2015 00:27:10 +0000
 Subject: [PATCH] sysdeps/gnu/configure.ac: Set libc_cv_rootsbindir only if its
diff --git a/meta/recipes-core/glibc/glibc/0019-timezone-Make-shell-interpreter-overridable-in-tzsel.patch b/meta/recipes-core/glibc/glibc/0019-timezone-Make-shell-interpreter-overridable-in-tzsel.patch
index d724c3e968..2e4c6ced9e 100644
--- a/meta/recipes-core/glibc/glibc/0019-timezone-Make-shell-interpreter-overridable-in-tzsel.patch
+++ b/meta/recipes-core/glibc/glibc/0019-timezone-Make-shell-interpreter-overridable-in-tzsel.patch
@@ -1,4 +1,4 @@
-From 6aa1b835d95482287851e02abd3a406cbd0ef8c7 Mon Sep 17 00:00:00 2001
+From a2179a1a5e0f6ded889d2c88cabb23c92b5a4b1e Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Thu, 9 Dec 2021 15:14:42 -0800
 Subject: [PATCH] timezone: Make shell interpreter overridable in tzselect.ksh
@@ -14,7 +14,7 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  2 files changed, 10 insertions(+)
 
 diff --git a/Makeconfig b/Makeconfig
-index 85e00cef94..643724108a 100644
+index d0108d2caa..75887b1334 100644
 --- a/Makeconfig
 +++ b/Makeconfig
 @@ -309,6 +309,15 @@ ifndef sysincludedir
@@ -34,10 +34,10 @@ index 85e00cef94..643724108a 100644
  # Commands to install files.
  ifndef INSTALL_DATA
 diff --git a/timezone/Makefile b/timezone/Makefile
-index d7acb387ba..ec79326f66 100644
+index ebe5cf73a1..b5fa38f4d7 100644
 --- a/timezone/Makefile
 +++ b/timezone/Makefile
-@@ -136,6 +136,7 @@ $(objpfx)tzselect: tzselect.ksh $(common-objpfx)config.make
+@@ -143,6 +143,7 @@ $(objpfx)tzselect: tzselect.ksh $(common-objpfx)config.make
             -e '/TZVERSION=/s|see_Makefile|"$(version)"|' \
             -e '/PKGVERSION=/s|=.*|="$(PKGVERSION)"|' \
             -e '/REPORT_BUGS_TO=/s|=.*|="$(REPORT_BUGS_TO)"|' \
diff --git a/meta/recipes-core/glibc/glibc/0020-tzselect.ksh-Use-bin-sh-default-shell-interpreter.patch b/meta/recipes-core/glibc/glibc/0020-tzselect.ksh-Use-bin-sh-default-shell-interpreter.patch
index 08c60a271b..e68e37b125 100644
--- a/meta/recipes-core/glibc/glibc/0020-tzselect.ksh-Use-bin-sh-default-shell-interpreter.patch
+++ b/meta/recipes-core/glibc/glibc/0020-tzselect.ksh-Use-bin-sh-default-shell-interpreter.patch
@@ -1,4 +1,4 @@
-From ef47e6199986c4951e681ed74f064042db1ae2e1 Mon Sep 17 00:00:00 2001
+From c86de3e8b739f20fd7211b66dc3c69b61d28d611 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Wed, 15 Dec 2021 21:47:53 -0800
 Subject: [PATCH] tzselect.ksh: Use /bin/sh default shell interpreter
@@ -16,7 +16,7 @@ Cc: Paul Eggert <eggert@cs.ucla.edu>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/timezone/tzselect.ksh b/timezone/tzselect.ksh
-index 18fce27e24..cc08efb0fb 100755
+index ca3d82c6aa..1be42814fe 100755
 --- a/timezone/tzselect.ksh
 +++ b/timezone/tzselect.ksh
 @@ -1,4 +1,4 @@
diff --git a/meta/recipes-core/glibc/glibc/0021-fix-create-thread-failed-in-unprivileged-process-BZ-.patch b/meta/recipes-core/glibc/glibc/0021-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
index d57dce125c..f1391a095c 100644
--- a/meta/recipes-core/glibc/glibc/0021-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
+++ b/meta/recipes-core/glibc/glibc/0021-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
@@ -1,4 +1,4 @@
-From 7254706544be5100843fc0a332e836fccffc9ef1 Mon Sep 17 00:00:00 2001
+From 06dd2eec0d57e1e2702069ee4c970c68fc4d3bcb Mon Sep 17 00:00:00 2001
 From: Hongxu Jia <hongxu.jia@windriver.com>
 Date: Sun, 29 Aug 2021 20:49:16 +0800
 Subject: [PATCH] fix create thread failed in unprivileged process [BZ #28287]
@@ -72,7 +72,7 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/sysdeps/unix/sysv/linux/clone-internal.c b/sysdeps/unix/sysv/linux/clone-internal.c
-index 40ef30303f..f97b1f6900 100644
+index 9a1f27d017..9a48340055 100644
 --- a/sysdeps/unix/sysv/linux/clone-internal.c
 +++ b/sysdeps/unix/sysv/linux/clone-internal.c
 @@ -98,7 +98,7 @@ __clone_internal (struct clone_args *cl_args,
diff --git a/meta/recipes-core/glibc/glibc/0022-Avoid-hardcoded-build-time-paths-in-the-output-binar.patch b/meta/recipes-core/glibc/glibc/0022-Avoid-hardcoded-build-time-paths-in-the-output-binar.patch
index b527ddffc8..a90814c63a 100644
--- a/meta/recipes-core/glibc/glibc/0022-Avoid-hardcoded-build-time-paths-in-the-output-binar.patch
+++ b/meta/recipes-core/glibc/glibc/0022-Avoid-hardcoded-build-time-paths-in-the-output-binar.patch
@@ -1,4 +1,4 @@
-From d39779afc72d34f87f052097592008cc38e20615 Mon Sep 17 00:00:00 2001
+From cd66a5301c4d84e3dbc4e30fdb9e32b341e66b3d Mon Sep 17 00:00:00 2001
 From: Richard Purdie <richard.purdie@linuxfoundation.org>
 Date: Sun, 24 Jul 2022 07:07:29 -0700
 Subject: [PATCH] Avoid hardcoded build time paths in the output binaries
@@ -14,10 +14,10 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/support/Makefile b/support/Makefile
-index 362a51f882..56d2b37058 100644
+index 59a9974539..c3f7302bcb 100644
 --- a/support/Makefile
 +++ b/support/Makefile
-@@ -228,9 +228,9 @@ libsupport-inhibit-o += .o
+@@ -238,9 +238,9 @@ libsupport-inhibit-o += .o
  endif
  
  CFLAGS-support_paths.c = \
diff --git a/meta/recipes-core/glibc/glibc/0023-aarch64-configure-Pass-mcpu-along-with-march-to-dete.patch b/meta/recipes-core/glibc/glibc/0023-aarch64-configure-Pass-mcpu-along-with-march-to-dete.patch
deleted file mode 100644
index f6523c5498..0000000000
--- a/meta/recipes-core/glibc/glibc/0023-aarch64-configure-Pass-mcpu-along-with-march-to-dete.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 73c26018ed0ecd9c807bb363cc2c2ab4aca66a82 Mon Sep 17 00:00:00 2001
-From: Szabolcs Nagy <szabolcs.nagy@arm.com>
-Date: Wed, 13 Mar 2024 14:34:14 +0000
-Subject: [PATCH] aarch64: fix check for SVE support in assembler
-
-Due to GCC bug 110901 -mcpu can override -march setting when compiling
-asm code and thus a compiler targetting a specific cpu can fail the
-configure check even when binutils gas supports SVE.
-
-The workaround is that explicit .arch directive overrides both -mcpu
-and -march, and since that's what the actual SVE memcpy uses the
-configure check should use that too even if the GCC issue is fixed
-independently.
-
-Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=73c26018ed0ecd9c807bb363cc2c2ab4aca66a82]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-Reviewed-by: Florian Weimer <fweimer@redhat.com>
----
- sysdeps/aarch64/configure    | 5 +++--
- sysdeps/aarch64/configure.ac | 5 +++--
- 2 files changed, 6 insertions(+), 4 deletions(-)
- mode change 100644 => 100755 sysdeps/aarch64/configure
-
-diff --git a/sysdeps/aarch64/configure b/sysdeps/aarch64/configure
-old mode 100644
-new mode 100755
-index ca57edce47..9606137e8d
---- a/sysdeps/aarch64/configure
-+++ b/sysdeps/aarch64/configure
-@@ -325,9 +325,10 @@ then :
-   printf %s "(cached) " >&6
- else $as_nop
-   cat > conftest.s <<\EOF
--        ptrue p0.b
-+       .arch armv8.2-a+sve
-+       ptrue p0.b
- EOF
--if { ac_try='${CC-cc} -c -march=armv8.2-a+sve conftest.s 1>&5'
-+if { ac_try='${CC-cc} -c conftest.s 1>&5'
-   { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_try\""; } >&5
-   (eval $ac_try) 2>&5
-   ac_status=$?
-diff --git a/sysdeps/aarch64/configure.ac b/sysdeps/aarch64/configure.ac
-index 27874eceb4..56d12d661d 100644
---- a/sysdeps/aarch64/configure.ac
-+++ b/sysdeps/aarch64/configure.ac
-@@ -90,9 +90,10 @@ LIBC_CONFIG_VAR([aarch64-variant-pcs], [$libc_cv_aarch64_variant_pcs])
- # Check if asm support armv8.2-a+sve
- AC_CACHE_CHECK([for SVE support in assembler], [libc_cv_aarch64_sve_asm], [dnl
- cat > conftest.s <<\EOF
--        ptrue p0.b
-+       .arch armv8.2-a+sve
-+       ptrue p0.b
- EOF
--if AC_TRY_COMMAND(${CC-cc} -c -march=armv8.2-a+sve conftest.s 1>&AS_MESSAGE_LOG_FD); then
-+if AC_TRY_COMMAND(${CC-cc} -c conftest.s 1>&AS_MESSAGE_LOG_FD); then
-   libc_cv_aarch64_sve_asm=yes
- else
-   libc_cv_aarch64_sve_asm=no
--- 
-2.44.0
-
diff --git a/meta/recipes-core/glibc/glibc/0024-qemu-stale-process.patch b/meta/recipes-core/glibc/glibc/0023-tests-Skip-2-qemu-tests-that-can-hang-in-oe-selftest.patch
index c0a467fcec..50d80ed577 100644
--- a/meta/recipes-core/glibc/glibc/0024-qemu-stale-process.patch
+++ b/meta/recipes-core/glibc/glibc/0023-tests-Skip-2-qemu-tests-that-can-hang-in-oe-selftest.patch
@@ -1,4 +1,7 @@
-glibc: Skip 2 qemu tests that can hang in oe-selftest
+From 5395ccff4478d42fab7f2bd6ba7f7188bec09ddf Mon Sep 17 00:00:00 2001
+From: Yash Shinde <Yash.Shinde@windriver.com>
+Date: Fri, 5 Apr 2024 08:24:36 -0700
+Subject: [PATCH] tests: Skip 2 qemu tests that can hang in oe-selftest
 
 qemumips and qemuppc were leaving stale processes behind after
 running glibc oe-selftest. During analysis, it was found that
@@ -9,29 +12,35 @@ Disable them so that there are no stale processes left behind.
 https://bugzilla.yoctoproject.org/show_bug.cgi?id=15423
 
 Upstream-Status: Inappropriate [oe-core specific]
+
 Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
 ---
-diff --git a/sysdeps/unix/sysv/linux/Makefile  b/sysdeps/unix/sysv/linux/Makefile
---- a/sysdeps/unix/sysv/linux/Makefile    2024-03-18 01:15:49.019202881 -0700
-+++ b/sysdeps/unix/sysv/linux/Makefile  2024-03-14 06:26:18.581404107 -0700
-@@ -222,7 +222,6 @@
-   tst-process_mrelease \
-   tst-quota \
+ sysdeps/unix/sysv/linux/Makefile | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sysdeps/unix/sysv/linux/Makefile b/sysdeps/unix/sysv/linux/Makefile
+index 8a755293b3..22dafcaad1 100644
+--- a/sysdeps/unix/sysv/linux/Makefile
++++ b/sysdeps/unix/sysv/linux/Makefile
+@@ -228,7 +228,6 @@ tests += \
    tst-rlimit-infinity \
+   tst-sched-affinity-inheritance \
+   tst-sched_setattr \
 -  tst-scm_rights \
    tst-sigtimedwait \
    tst-sync_file_range \
-   tst-sysconf-iov_max \
-@@ -233,6 +232,8 @@
+   tst-syscall-restart \
+@@ -240,6 +239,8 @@ tests += \
    tst-timerfd \
    tst-ttyname-direct \
    tst-ttyname-namespace \
 +  # Skip this test to avoid stale qemu process
 +  # tst-scm_rights \
    # tests
-
+ 
  # process_madvise requires CAP_SYS_ADMIN.
-@@ -270,9 +271,10 @@
+@@ -282,9 +283,10 @@ tests-time64 += \
    tst-ntp_gettimex-time64 \
    tst-ppoll-time64 \
    tst-prctl-time64 \
@@ -41,5 +50,5 @@ diff --git a/sysdeps/unix/sysv/linux/Makefile  b/sysdeps/unix/sysv/linux/Makefil
 +  # Skip this test to avoid stale qemu process
 +  # tst-scm_rights-time64 \
    # tests-time64
-
+ 
  tests-clone-internal = \
diff --git a/meta/recipes-core/glibc/glibc/run-ptest b/meta/recipes-core/glibc/glibc/run-ptest
deleted file mode 100755
index cb71c75682..0000000000
--- a/meta/recipes-core/glibc/glibc/run-ptest
+++ /dev/null
@@ -1,37 +0,0 @@
-#!/bin/bash
-# ptest script for glibc - to run time related tests to
-# facilitate Y2038 validation
-# Run with 'ptest-runner glibc-tests'
-
-output() {
-  retcode=$?
-  if [ $retcode -eq 0 ]
-    then echo "PASS: $i"
-  elif [ $retcode -eq 77 ]
-    then echo "SKIP: $i"
-  else echo "FAIL: $i"
-  fi
-}
-
-# Allow altering time on the target
-export GLIBC_TEST_ALLOW_TIME_SETTING="1"
-
-tst_time64=$(ls -r ${PWD}/tests/glibc-ptest/*-time64)
-
-# Remove '-time64' suffix - those tests are also time
-# related
-tst_time_tmp=$(sed -e "s/-time64$//" <<< ${tst_time64})
-
-# Do not run tests supporting only 32 bit time
-#for i in ${tst_time_tmp}
-#do
-#       $i >/dev/null 2>&1
-#       output
-#done
-
-# Run tests supporting only 64 bit time
-for i in ${tst_time64}
-do
-        $i >/dev/null 2>&1
-        output
-done
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.41.bb
index 9122472689..7771fac041 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.41.bb
@@ -16,6 +16,10 @@ CVE_STATUS[CVE-2019-1010025] = "disputed: \
 Allows for ASLR bypass so can bypass some hardening, not an exploit in itself, may allow \
 easier access for another. 'ASLR bypass itself is not a vulnerability.'"
 
+CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
+CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-4802 CVE-2025-5702 CVE-2025-5745"
+CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash"
+
 DEPENDS += "gperf-native bison-native"
 
 NATIVESDKFIXES ?= ""
@@ -48,10 +52,10 @@ SRC_URI =  "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
            file://0020-tzselect.ksh-Use-bin-sh-default-shell-interpreter.patch \
            file://0021-fix-create-thread-failed-in-unprivileged-process-BZ-.patch \
            file://0022-Avoid-hardcoded-build-time-paths-in-the-output-binar.patch \
-           file://0023-aarch64-configure-Pass-mcpu-along-with-march-to-dete.patch \
-           file://0024-qemu-stale-process.patch \
+           file://0023-tests-Skip-2-qemu-tests-that-can-hang-in-oe-selftest.patch \
+           file://0001-stdlib-Add-single-threaded-fast-path-to-rand.patch \
+           file://0001-Propagate-ffile-prefix-map-from-CFLAGS-to-ASFLAGS.patch \
 "
-S = "${WORKDIR}/git"
 B = "${WORKDIR}/build-${TARGET_SYS}"
 
 PACKAGES_DYNAMIC = ""
@@ -76,7 +80,6 @@ EXTRA_OECONF = "--enable-kernel=${OLDEST_KERNEL} \
                 --with-default-link \
                 --disable-werror \
                 --enable-fortify-source \
-                ${@bb.utils.contains_any('SELECTED_OPTIMIZATION', '-O0 -Og', '--disable-werror', '', d)} \
                 ${GLIBCPIE} \
                 ${GLIBC_EXTRA_OECONF}"
 
@@ -125,4 +128,15 @@ do_compile () {
 
 require glibc-package.inc
 
+# When upgrading glibc it's important to know if there are any new symbols
+# that pseudo needs to wrap. In the future a generalised ABI comparison tool
+# would be good, but to solve the immediate need we can simply list the
+# exported symbols to files in WORKDIR.
+do_symlist() {
+    for LIB in ${D}${base_libdir}/lib*.so.*; do
+        ${NM} --dynamic $LIB | awk --source '$2 == "T" { print $3 }' | sort > ${WORKDIR}/$(basename $LIB)-${PV}.symbols
+    done
+}
+addtask symlist after do_install
+
 BBCLASSEXTEND = "nativesdk"
diff --git a/meta/recipes-core/glibc/ldconfig-native_2.12.1.bb b/meta/recipes-core/glibc/ldconfig-native_2.12.1.bb
index 9ca95d1e52..1c475eeb8a 100644
--- a/meta/recipes-core/glibc/ldconfig-native_2.12.1.bb
+++ b/meta/recipes-core/glibc/ldconfig-native_2.12.1.bb
@@ -19,12 +19,11 @@ SRC_URI = "file://ldconfig-native-2.12.1.tar.bz2 \
            file://ldconfig-handle-.dynstr-located-in-separate-segment.patch \
 "
 
-
 FILESEXTRAPATHS =. "${FILE_DIRNAME}/${P}:"
 
 inherit native
 
-S = "${WORKDIR}/${PN}-${PV}"
+S = "${UNPACKDIR}/${PN}-${PV}"
 
 do_compile () {
         $CC ldconfig.c -std=gnu99 chroot_canon.c xmalloc.c xstrdup.c cache.c readlib.c  -I. dl-cache.c -o ldconfig
diff --git a/meta/recipes-core/ifupdown/files/0001-Define-FNM_EXTMATCH-for-musl.patch b/meta/recipes-core/ifupdown/files/0001-Define-FNM_EXTMATCH-for-musl.patch
index 6c4ed526bf..83fb706be0 100644
--- a/meta/recipes-core/ifupdown/files/0001-Define-FNM_EXTMATCH-for-musl.patch
+++ b/meta/recipes-core/ifupdown/files/0001-Define-FNM_EXTMATCH-for-musl.patch
@@ -1,4 +1,4 @@
-From 8dfbcf02e424ba1fdef587d81c9e08a37ab8c1b6 Mon Sep 17 00:00:00 2001
+From 97b196efe9671d0185d22710371acb52bb7130e2 Mon Sep 17 00:00:00 2001
 From: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com>
 Date: Tue, 2 Jul 2019 20:10:42 +0200
 Subject: [PATCH] Define FNM_EXTMATCH for musl
@@ -24,7 +24,6 @@ function); did you mean 'FNM_NOMATCH'?
 Upstream-Status: Submitted [https://salsa.debian.org/debian/ifupdown/merge_requests/5]
 
 Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com>
-
 ---
  archcommon.h | 4 ++++
  1 file changed, 4 insertions(+)
diff --git a/meta/recipes-core/ifupdown/files/0001-Makefile-do-not-use-dpkg-for-determining-OS-type.patch b/meta/recipes-core/ifupdown/files/0001-Makefile-do-not-use-dpkg-for-determining-OS-type.patch
index 6e15a25224..f84a0a1311 100644
--- a/meta/recipes-core/ifupdown/files/0001-Makefile-do-not-use-dpkg-for-determining-OS-type.patch
+++ b/meta/recipes-core/ifupdown/files/0001-Makefile-do-not-use-dpkg-for-determining-OS-type.patch
@@ -1,17 +1,16 @@
-From 7fe516cbaf9fda09d99dcb54d4645367cffc8a4d Mon Sep 17 00:00:00 2001
+From 4922e2011a0132c122df4f0cf4d66d565c749060 Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Thu, 9 Jan 2020 15:38:06 +0100
 Subject: [PATCH] Makefile: do not use dpkg for determining OS type
 
 Upstream-Status: Inappropriate [oe-core specific]
 Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
-
 ---
  Makefile | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/Makefile b/Makefile
-index 0ce2fa3..739aef2 100644
+index 9cd758b..58b4173 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -1,6 +1,6 @@
@@ -21,4 +20,4 @@ index 0ce2fa3..739aef2 100644
 +ARCH := linux
  
  BASEDIR ?= $(DESTDIR)
- 
+ PKGLIBDIR ?= /lib/ifupdown
diff --git a/meta/recipes-core/ifupdown/files/0001-ifupdown-skip-wrong-test-case.patch b/meta/recipes-core/ifupdown/files/0001-ifupdown-skip-wrong-test-case.patch
index 9ae24da51e..8aa227c8ec 100644
--- a/meta/recipes-core/ifupdown/files/0001-ifupdown-skip-wrong-test-case.patch
+++ b/meta/recipes-core/ifupdown/files/0001-ifupdown-skip-wrong-test-case.patch
@@ -1,4 +1,4 @@
-From 782d8a869c266820d0f34974436f244f67afaea7 Mon Sep 17 00:00:00 2001
+From ea48a9816643482d438e4bb276c90cd6f02847e4 Mon Sep 17 00:00:00 2001
 From: Zqiang <qiang.zhang@windriver.com>
 Date: Mon, 19 Apr 2021 14:15:45 +0800
 Subject: [PATCH] ifupdown: skip wrong test case
@@ -10,7 +10,6 @@ and are skipped directly.
 Upstream-Status: Inappropriate [oe-core specific]
 
 Signed-off-by: Zqiang <qiang.zhang@windriver.com>
-
 ---
  tests/testbuild-linux | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-core/ifupdown/files/defn2-c-man-don-t-rely-on-dpkg-architecture-to-set-a.patch b/meta/recipes-core/ifupdown/files/defn2-c-man-don-t-rely-on-dpkg-architecture-to-set-a.patch
index 7b4b761e6a..d47c50f2d5 100644
--- a/meta/recipes-core/ifupdown/files/defn2-c-man-don-t-rely-on-dpkg-architecture-to-set-a.patch
+++ b/meta/recipes-core/ifupdown/files/defn2-c-man-don-t-rely-on-dpkg-architecture-to-set-a.patch
@@ -1,4 +1,4 @@
-From fc8e8d4cb19ff30e69aa1855332544f1017f974c Mon Sep 17 00:00:00 2001
+From 68b64a5c9d466352b0c161019bd7255e31db9a4c Mon Sep 17 00:00:00 2001
 From: Paul Gortmaker <paul.gortmaker@windriver.com>
 Date: Wed, 6 Aug 2014 14:54:12 -0400
 Subject: [PATCH] defn2[c|man]: don't rely on dpkg-architecture to set arch
@@ -12,8 +12,7 @@ arch specific methods, and the end result will be strangeness
 like the loopback device not being configured/enabled.
 
 Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
-Upstream-Status: Pending
-
+Upstream-Status: Inappropriate [avoiding debian-isms]
 ---
  defn2c.pl   | 6 +++---
  defn2man.pl | 6 +++---
diff --git a/meta/recipes-core/ifupdown/files/tweak-ptest-script.patch b/meta/recipes-core/ifupdown/files/tweak-ptest-script.patch
index fa6bb84df3..c1953f0691 100644
--- a/meta/recipes-core/ifupdown/files/tweak-ptest-script.patch
+++ b/meta/recipes-core/ifupdown/files/tweak-ptest-script.patch
@@ -1,4 +1,4 @@
-From a6bb2ac5f521c678abbbdb1960d28f750f4357a6 Mon Sep 17 00:00:00 2001
+From 5eede8950e35404b109cc3cf6a53bf3c84b31cfb Mon Sep 17 00:00:00 2001
 From: Kai Kang <kai.kang@windriver.com>
 Date: Mon, 3 Feb 2020 17:33:11 +0800
 Subject: [PATCH] Tweak tests of ifupdown to make it work with oe-core ptest
@@ -7,7 +7,6 @@ Subject: [PATCH] Tweak tests of ifupdown to make it work with oe-core ptest
 Upstream-Status: Inappropriate [oe-core specific]
 
 Signed-off-by: Kai Kang <kai.kang@windriver.com>
-
 ---
  tests/testbuild-linux | 11 ++++++-----
  1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/meta/recipes-core/ifupdown/ifupdown_0.8.41.bb b/meta/recipes-core/ifupdown/ifupdown_0.8.44.bb
index 16425ea9e4..8a8f477361 100644
--- a/meta/recipes-core/ifupdown/ifupdown_0.8.41.bb
+++ b/meta/recipes-core/ifupdown/ifupdown_0.8.44.bb
@@ -16,16 +16,13 @@ SRC_URI = "git://salsa.debian.org/debian/ifupdown.git;protocol=https;branch=mast
            file://defn2-c-man-don-t-rely-on-dpkg-architecture-to-set-a.patch \
            file://tweak-ptest-script.patch \
            "
-SRCREV = "369d9d3c13a0c56ad09fd4f13b4a80eb9a94e270"
-
-S = "${WORKDIR}/git"
-
+SRCREV = "7d44f9ce6717a4a496fd46f28c52e12dbf5bafdd"
 
 inherit ptest update-alternatives
 
 do_compile () {
         chmod a+rx *.pl *.sh
-        oe_runmake 'CC=${CC}' "CFLAGS=${CFLAGS} -Wall -W -D'IFUPDOWN_VERSION=\"${PV}\"'"
+        oe_runmake 'CC=${CC}' "-Wall -W -D'IFUPDOWN_VERSION=\"${PV}\"'"
 }
 
 do_install () {
@@ -35,7 +32,7 @@ do_install () {
 
         # If volatiles are used, then we'll also need /run/network there too.
         install -d ${D}/etc/default/volatiles
-        install -m 0644 ${WORKDIR}/99_network ${D}/etc/default/volatiles
+        install -m 0644 ${UNPACKDIR}/99_network ${D}/etc/default/volatiles
 
         install -m 0755 ifup ${D}${base_sbindir}/
         ln ${D}${base_sbindir}/ifup ${D}${base_sbindir}/ifdown
diff --git a/meta/recipes-core/images/build-appliance-image_15.0.0.bb b/meta/recipes-core/images/build-appliance-image_15.0.0.bb
index 4cf55519cc..4daedfb43c 100644
--- a/meta/recipes-core/images/build-appliance-image_15.0.0.bb
+++ b/meta/recipes-core/images/build-appliance-image_15.0.0.bb
@@ -26,8 +26,8 @@ inherit core-image setuptools3 features_check
 
 REQUIRED_DISTRO_FEATURES += "xattr"
 
-SRCREV ?= "17723c6e34096a53fb186cc70cfc604bb30da8b9"
-SRC_URI = "git://git.yoctoproject.org/poky;branch=master \
+SRCREV ?= "b1b3318eff36d4d9b2d3a935dee607c4f012f992"
+SRC_URI = "git://git.yoctoproject.org/poky;branch=master;destsuffix=poky \
            file://Yocto_Build_Appliance.vmx \
            file://Yocto_Build_Appliance.vmxf \
            file://README_VirtualBox_Guest_Additions.txt \
@@ -44,10 +44,10 @@ IMAGE_CMD:ext4:append () {
 fakeroot do_populate_poky_src () {
         # Because fetch2's git's unpack uses -s cloneflag, the unpacked git repo
         # will become invalid in the target.
-        rm -rf ${WORKDIR}/git/.git
-        rm -f ${WORKDIR}/git/.gitignore
+        rm -rf ${UNPACKDIR}/poky/.git
+        rm -f ${UNPACKDIR}/poky/.gitignore
 
-        cp -R ${WORKDIR}/git ${IMAGE_ROOTFS}/home/builder/poky
+        cp -R ${UNPACKDIR}/poky ${IMAGE_ROOTFS}/home/builder/poky
 
         mkdir -p ${IMAGE_ROOTFS}/home/builder/poky/build/conf
         mkdir -p ${IMAGE_ROOTFS}/home/builder/poky/build/downloads
@@ -58,10 +58,10 @@ fakeroot do_populate_poky_src () {
         fi
 
         # Place the README_VirtualBox_Guest_Additions file in builders home folder.
-        cp ${WORKDIR}/README_VirtualBox_Guest_Additions.txt ${IMAGE_ROOTFS}/home/builder/
+        cp ${UNPACKDIR}/README_VirtualBox_Guest_Additions.txt ${IMAGE_ROOTFS}/home/builder/
 
         # Place the README_VirtualBox_Toaster file in builders home folder.
-        cp ${WORKDIR}/README_VirtualBox_Toaster.txt ${IMAGE_ROOTFS}/home/builder/
+        cp ${UNPACKDIR}/README_VirtualBox_Toaster.txt ${IMAGE_ROOTFS}/home/builder/
 
         echo "INHERIT += \"rm_work\"" >> ${IMAGE_ROOTFS}/home/builder/poky/build/conf/auto.conf
         echo "export LC_ALL=en_US.utf8" >> ${IMAGE_ROOTFS}/home/builder/.bashrc
@@ -129,10 +129,15 @@ python () {
     d.delVarFlag("do_unpack", "noexec")
 }
 
+# ${S} doesn't exist for us
+do_qa_unpack() {
+    return
+}
+
 create_bundle_files () {
         cd ${WORKDIR}
         mkdir -p Yocto_Build_Appliance
-        cp *.vmx* Yocto_Build_Appliance
+        cp ${UNPACKDIR}/*.vmx* Yocto_Build_Appliance
         ln -sf ${IMGDEPLOYDIR}/${IMAGE_NAME}.wic.vmdk Yocto_Build_Appliance/Yocto_Build_Appliance.vmdk
         ln -sf ${IMGDEPLOYDIR}/${IMAGE_NAME}.wic.vhdx Yocto_Build_Appliance/Yocto_Build_Appliance.vhdx
         ln -sf ${IMGDEPLOYDIR}/${IMAGE_NAME}.wic.vhd Yocto_Build_Appliance/Yocto_Build_Appliance.vhd
diff --git a/meta/recipes-core/images/core-image-minimal-initramfs.bb b/meta/recipes-core/images/core-image-minimal-initramfs.bb
index 36e8771c4a..4e210d1bf3 100644
--- a/meta/recipes-core/images/core-image-minimal-initramfs.bb
+++ b/meta/recipes-core/images/core-image-minimal-initramfs.bb
@@ -32,4 +32,4 @@ IMAGE_ROOTFS_SIZE = "8192"
 IMAGE_ROOTFS_EXTRA_SPACE = "0"
 
 # Use the same restriction as initramfs-module-install
-COMPATIBLE_HOST = '(x86_64.*|i.86.*|arm.*|aarch64.*|loongarch64.*)-(linux.*|freebsd.*)'
+COMPATIBLE_HOST = '(x86_64.*|i.86.*|arm.*|aarch64.*)-(linux.*|freebsd.*)'
diff --git a/meta/recipes-core/images/core-image-ptest.bb b/meta/recipes-core/images/core-image-ptest.bb
index 72081f938d..017f05f81b 100644
--- a/meta/recipes-core/images/core-image-ptest.bb
+++ b/meta/recipes-core/images/core-image-ptest.bb
@@ -23,15 +23,21 @@ IMAGE_ROOTFS_EXTRA_SPACE = "324288"
 IMAGE_ROOTFS_EXTRA_SPACE:virtclass-mcextend-mdadm = "1524288"
 IMAGE_ROOTFS_EXTRA_SPACE:virtclass-mcextend-strace = "1524288"
 IMAGE_ROOTFS_EXTRA_SPACE:virtclass-mcextend-lttng-tools = "1524288"
+IMAGE_ROOTFS_EXTRA_SPACE:virtclass-mcextend-util-linux = "1524288"
 
 # tar-ptest in particular needs more space
 IMAGE_ROOTFS_EXTRA_SPACE:virtclass-mcextend-tar = "1524288"
 
+# python3-numpy-ptest requires a lot of extra space
+IMAGE_ROOTFS_EXTRA_SPACE:virtclass-mcextend-python3-numpy = "3048576"
+
 # ptests need more memory than standard to avoid the OOM killer
 QB_MEM = "-m 1024"
 QB_MEM:virtclass-mcextend-lttng-tools = "-m 4096"
 QB_MEM:virtclass-mcextend-python3 = "-m 2048"
 QB_MEM:virtclass-mcextend-python3-cryptography = "-m 5100"
+QB_MEM:virtclass-mcextend-python3-numpy = "-m 4096"
+QB_MEM:virtclass-mcextend-tcl = "-m 5100"
 
 TEST_SUITES = "ping ssh parselogs ptest"
 
diff --git a/meta/recipes-core/images/core-image-tiny-initramfs.bb b/meta/recipes-core/images/core-image-tiny-initramfs.bb
index 7a71d55b1e..c2aa68c788 100644
--- a/meta/recipes-core/images/core-image-tiny-initramfs.bb
+++ b/meta/recipes-core/images/core-image-tiny-initramfs.bb
@@ -6,6 +6,9 @@ first 'init' program more efficiently. core-image-tiny-initramfs doesn't \
 actually generate an image but rather generates boot and rootfs artifacts \
 that can subsequently be picked up by external image generation tools such as wic."
 
+# if distro does not override VIRTUAL-RUNTIME_dev_manager and default in different, busybox is compiled without mdev support
+# however this keeps the image small by not installing heavy-weight manager and in initramfs it may not even be necessary
+# override in distro if needed
 VIRTUAL-RUNTIME_dev_manager ?= "busybox-mdev"
 
 PACKAGE_INSTALL = "initramfs-live-boot-tiny packagegroup-core-boot dropbear ${VIRTUAL-RUNTIME_base-utils} ${VIRTUAL-RUNTIME_dev_manager} base-passwd ${ROOTFS_BOOTSTRAP_INSTALL}"
diff --git a/meta/recipes-core/init-ifupdown/init-ifupdown_1.0.bb b/meta/recipes-core/init-ifupdown/init-ifupdown_1.0.bb
index 409b1c0403..da594d00b7 100644
--- a/meta/recipes-core/init-ifupdown/init-ifupdown_1.0.bb
+++ b/meta/recipes-core/init-ifupdown/init-ifupdown_1.0.bb
@@ -3,7 +3,7 @@ DESCRIPTION = "This package provides high level tools to configure network inter
 HOMEPAGE = "http://packages.debian.org/ifupdown"
 SECTION = "base"
 LICENSE = "GPL-2.0-only"
-LIC_FILES_CHKSUM = "file://${WORKDIR}/copyright;md5=3dd6192d306f582dee7687da3d8748ab"
+LIC_FILES_CHKSUM = "file://${S}/copyright;md5=3dd6192d306f582dee7687da3d8748ab"
 
 inherit update-rc.d
 
@@ -15,7 +15,7 @@ SRC_URI = "file://copyright \
            file://interfaces \
            file://nfsroot"
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 do_install () {
         install -d ${D}${sysconfdir}/init.d \
@@ -23,9 +23,9 @@ do_install () {
                         ${D}${sysconfdir}/network/if-up.d \
                         ${D}${sysconfdir}/network/if-down.d \
                         ${D}${sysconfdir}/network/if-post-down.d
-        install -m 0755 ${WORKDIR}/init ${D}${sysconfdir}/init.d/networking
-        install -m 0644 ${WORKDIR}/interfaces ${D}${sysconfdir}/network/interfaces
-        install -m 0755 ${WORKDIR}/nfsroot ${D}${sysconfdir}/network/if-pre-up.d
+        install -m 0755 ${S}/init ${D}${sysconfdir}/init.d/networking
+        install -m 0644 ${S}/interfaces ${D}${sysconfdir}/network/interfaces
+        install -m 0755 ${S}/nfsroot ${D}${sysconfdir}/network/if-pre-up.d
 }
 
 do_install:append:qemuall () {
diff --git a/meta/recipes-core/initrdscripts/initramfs-boot_1.0.bb b/meta/recipes-core/initrdscripts/initramfs-boot_1.0.bb
index 198459f2b2..e0a6319ccf 100644
--- a/meta/recipes-core/initrdscripts/initramfs-boot_1.0.bb
+++ b/meta/recipes-core/initrdscripts/initramfs-boot_1.0.bb
@@ -3,11 +3,10 @@ LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
 SRC_URI = "file://init-boot.sh"
 
-
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 do_install() {
-        install -m 0755 ${WORKDIR}/init-boot.sh ${D}/init
+        install -m 0755 ${S}/init-boot.sh ${D}/init
 
         # Create device nodes expected by some kernels in initramfs
         # before even executing /init.
diff --git a/meta/recipes-core/initrdscripts/initramfs-framework/finish b/meta/recipes-core/initrdscripts/initramfs-framework/finish
index ac0de9f996..716c2f44af 100755
--- a/meta/recipes-core/initrdscripts/initramfs-framework/finish
+++ b/meta/recipes-core/initrdscripts/initramfs-framework/finish
@@ -41,7 +41,7 @@ finish_run() {
                 mount --move /sys $ROOTFS_DIR/sys
 
                 cd $ROOTFS_DIR
-                exec switch_root -c /dev/console $ROOTFS_DIR ${bootparam_init:-/sbin/init}
+                exec switch_root $ROOTFS_DIR ${bootparam_init:-/sbin/init}
         else
                 debug "No rootfs has been set"
         fi
diff --git a/meta/recipes-core/initrdscripts/initramfs-framework/init b/meta/recipes-core/initrdscripts/initramfs-framework/init
index 567694aff7..a48b77e95e 100755
--- a/meta/recipes-core/initrdscripts/initramfs-framework/init
+++ b/meta/recipes-core/initrdscripts/initramfs-framework/init
@@ -54,20 +54,23 @@ debug() {
 }
 
 # Prints a message and start a endless loop
+# Force reboot if init_fatal_reboot bootparam is set
 fatal() {
-    echo $1 >/dev/console
-    echo >/dev/console
-
-    if [ -n "$bootparam_init_fatal_sh" ]; then
-        sh
-    else
-        while [ "true" ]; do
-                sleep 3600
-        done
-    fi
+        echo $1 >/dev/console
+        echo >/dev/console
+
+        if [ -n "$bootparam_init_fatal_reboot" ]; then
+                reboot -f
+        elif [ -n "$bootparam_init_fatal_sh" ]; then
+                sh
+        else
+                while [ "true" ]; do
+                        sleep 3600
+                done
+        fi
 }
 
-# Variables shared amoung modules
+# Variables shared among modules
 ROOTFS_DIR="/rootfs" # where to do the switch root
 MODULE_PRE_HOOKS=""  # functions to call before running each module
 MODULE_POST_HOOKS="" # functions to call after running each module
@@ -117,7 +120,7 @@ if grep -q devtmpfs /proc/filesystems; then
         mount -t devtmpfs devtmpfs /dev
 else
         if [ ! -d /dev ]; then
-                fatal "ERROR: /dev doesn't exist and kernel doesn't has devtmpfs enabled."
+                fatal "ERROR: /dev doesn't exist and kernel doesn't have devtmpfs enabled."
         fi
 fi
 
diff --git a/meta/recipes-core/initrdscripts/initramfs-framework/nfsrootfs b/meta/recipes-core/initrdscripts/initramfs-framework/nfsrootfs
index e67ee4c25d..30555aef55 100644
--- a/meta/recipes-core/initrdscripts/initramfs-framework/nfsrootfs
+++ b/meta/recipes-core/initrdscripts/initramfs-framework/nfsrootfs
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 nfsrootfs_enabled() {
-        if [ ${bootparam_root} != "/dev/nfs" ] || [ -z ${bootparam_nfsroot} ]; then
+        if [ "${bootparam_root}" != "/dev/nfs" ] || [ -z ${bootparam_nfsroot} ]; then
                 return 1
         fi
         return 0
diff --git a/meta/recipes-core/initrdscripts/initramfs-framework/rootfs b/meta/recipes-core/initrdscripts/initramfs-framework/rootfs
index e0efbe6ebe..df0cbfb091 100644
--- a/meta/recipes-core/initrdscripts/initramfs-framework/rootfs
+++ b/meta/recipes-core/initrdscripts/initramfs-framework/rootfs
@@ -33,9 +33,11 @@ rootfs_run() {
                         elif [ "`echo ${bootparam_root} | cut -c1-6`" = "LABEL=" ]; then
                                 root_label=`echo $bootparam_root | cut -c7-`
                                 bootparam_root="/dev/disk/by-label/$root_label"
+                        elif echo "${bootparam_root}" | grep -q '^ubi[0-9]\+:'; then
+                                bootparam_rootfstype="ubifs"
                         fi
 
-                        if [ -e "$bootparam_root" ]; then
+                        if [ -e "$bootparam_root" ] || [ -n "$bootparam_rootfstype" ]; then
                                 flags=""
                                 if [ -n "$bootparam_ro" ] && ! echo "$bootparam_rootflags" | grep -w -q "ro"; then
                                         if [  -n "$bootparam_rootflags" ]; then
@@ -49,6 +51,7 @@ rootfs_run() {
                                 if [ -n "$bootparam_rootfstype" ]; then
                                         flags="$flags -t$bootparam_rootfstype"
                                 fi
+                                debug "mount $flags $bootparam_root $ROOTFS_DIR"
                                 mount $flags $bootparam_root $ROOTFS_DIR
                                 if mountpoint -q $ROOTFS_DIR; then
                                         break
@@ -59,7 +62,7 @@ rootfs_run() {
                                 fi
                         fi
                 fi
-                debug "Sleeping for $delay second(s) to wait root to settle..."
+                debug "Sleeping for $delay second(s) to wait for root to settle..."
                 sleep $delay
                 C=$(( $C + 1 ))
         done
diff --git a/meta/recipes-core/initrdscripts/initramfs-framework_1.0.bb b/meta/recipes-core/initrdscripts/initramfs-framework_1.0.bb
index 39ea51ccbd..2ec03bc34c 100644
--- a/meta/recipes-core/initrdscripts/initramfs-framework_1.0.bb
+++ b/meta/recipes-core/initrdscripts/initramfs-framework_1.0.bb
@@ -4,7 +4,6 @@ LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384
 RDEPENDS:${PN} += "${VIRTUAL-RUNTIME_base-utils}"
 RRECOMMENDS:${PN} = "${VIRTUAL-RUNTIME_base-utils-syslog}"
 
-
 inherit allarch
 
 SRC_URI = "file://init \
@@ -20,37 +19,37 @@ SRC_URI = "file://init \
            file://overlayroot \
           "
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 do_install() {
     install -d ${D}/init.d
 
     # base
-    install -m 0755 ${WORKDIR}/init ${D}/init
-    install -m 0755 ${WORKDIR}/nfsrootfs ${D}/init.d/85-nfsrootfs
-    install -m 0755 ${WORKDIR}/rootfs ${D}/init.d/90-rootfs
-    install -m 0755 ${WORKDIR}/finish ${D}/init.d/99-finish
+    install -m 0755 ${S}/init ${D}/init
+    install -m 0755 ${S}/nfsrootfs ${D}/init.d/85-nfsrootfs
+    install -m 0755 ${S}/rootfs ${D}/init.d/90-rootfs
+    install -m 0755 ${S}/finish ${D}/init.d/99-finish
 
     # exec
-    install -m 0755 ${WORKDIR}/exec ${D}/init.d/89-exec
+    install -m 0755 ${S}/exec ${D}/init.d/89-exec
 
     # mdev
-    install -m 0755 ${WORKDIR}/mdev ${D}/init.d/01-mdev
+    install -m 0755 ${S}/mdev ${D}/init.d/01-mdev
 
     # udev
-    install -m 0755 ${WORKDIR}/udev ${D}/init.d/01-udev
+    install -m 0755 ${S}/udev ${D}/init.d/01-udev
 
     # e2fs
-    install -m 0755 ${WORKDIR}/e2fs ${D}/init.d/10-e2fs
+    install -m 0755 ${S}/e2fs ${D}/init.d/10-e2fs
 
     # debug
-    install -m 0755 ${WORKDIR}/debug ${D}/init.d/00-debug
+    install -m 0755 ${S}/debug ${D}/init.d/00-debug
 
     # lvm
-    install -m 0755 ${WORKDIR}/lvm ${D}/init.d/09-lvm
+    install -m 0755 ${S}/lvm ${D}/init.d/09-lvm
 
     # overlayroot needs to run after rootfs module but before finish
-    install -m 0755 ${WORKDIR}/overlayroot ${D}/init.d/91-overlayroot
+    install -m 0755 ${S}/overlayroot ${D}/init.d/91-overlayroot
 
     # Create device nodes expected by some kernels in initramfs
     # before even executing /init.
diff --git a/meta/recipes-core/initrdscripts/initramfs-live-boot-tiny_1.0.bb b/meta/recipes-core/initrdscripts/initramfs-live-boot-tiny_1.0.bb
index 847dbc0472..6b99ab1843 100644
--- a/meta/recipes-core/initrdscripts/initramfs-live-boot-tiny_1.0.bb
+++ b/meta/recipes-core/initrdscripts/initramfs-live-boot-tiny_1.0.bb
@@ -5,11 +5,10 @@ DEPENDS = "virtual/kernel"
 RDEPENDS:${PN} = "busybox-mdev"
 SRC_URI = "file://init-live.sh"
 
-
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 do_install() {
-        install -m 0755 ${WORKDIR}/init-live.sh ${D}/init
+        install -m 0755 ${S}/init-live.sh ${D}/init
         install -d ${D}/dev
         mknod -m 622 ${D}/dev/console c 5 1
 }
diff --git a/meta/recipes-core/initrdscripts/initramfs-live-boot_1.0.bb b/meta/recipes-core/initrdscripts/initramfs-live-boot_1.0.bb
index b3b991b8fd..8c8355a53e 100644
--- a/meta/recipes-core/initrdscripts/initramfs-live-boot_1.0.bb
+++ b/meta/recipes-core/initrdscripts/initramfs-live-boot_1.0.bb
@@ -5,11 +5,10 @@ DEPENDS = "virtual/kernel"
 RDEPENDS:${PN} = "udev udev-extraconf"
 SRC_URI = "file://init-live.sh"
 
-
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 do_install() {
-        install -m 0755 ${WORKDIR}/init-live.sh ${D}/init
+        install -m 0755 ${S}/init-live.sh ${D}/init
         install -d ${D}/dev
         mknod -m 622 ${D}/dev/console c 5 1
 }
diff --git a/meta/recipes-core/initrdscripts/initramfs-live-install-efi-testfs_1.0.bb b/meta/recipes-core/initrdscripts/initramfs-live-install-efi-testfs_1.0.bb
index 495eccbeda..e308727320 100644
--- a/meta/recipes-core/initrdscripts/initramfs-live-install-efi-testfs_1.0.bb
+++ b/meta/recipes-core/initrdscripts/initramfs-live-install-efi-testfs_1.0.bb
@@ -5,10 +5,10 @@ SRC_URI = "file://init-install-efi-testfs.sh"
 
 RDEPENDS:${PN} = "parted e2fsprogs-mke2fs dosfstools"
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 do_install() {
-        install -m 0755 ${WORKDIR}/init-install-efi-testfs.sh ${D}/install-efi.sh
+        install -m 0755 ${S}/init-install-efi-testfs.sh ${D}/install-efi.sh
 }
 
 INHIBIT_DEFAULT_DEPS = "1"
diff --git a/meta/recipes-core/initrdscripts/initramfs-live-install-efi_1.0.bb b/meta/recipes-core/initrdscripts/initramfs-live-install-efi_1.0.bb
index e10faadfbe..77462f4425 100644
--- a/meta/recipes-core/initrdscripts/initramfs-live-install-efi_1.0.bb
+++ b/meta/recipes-core/initrdscripts/initramfs-live-install-efi_1.0.bb
@@ -3,14 +3,13 @@ LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
 SRC_URI = "file://init-install-efi.sh"
 
-
 RDEPENDS:${PN} = "parted e2fsprogs-mke2fs dosfstools util-linux-blkid ${VIRTUAL-RUNTIME_base-utils}"
 RRECOMMENDS:${PN} = "${VIRTUAL-RUNTIME_base-utils-syslog}"
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 do_install() {
-        install -m 0755 ${WORKDIR}/init-install-efi.sh ${D}/install-efi.sh
+        install -m 0755 ${S}/init-install-efi.sh ${D}/install-efi.sh
 }
 
 # While this package maybe an allarch due to it being a
diff --git a/meta/recipes-core/initrdscripts/initramfs-live-install-testfs_1.0.bb b/meta/recipes-core/initrdscripts/initramfs-live-install-testfs_1.0.bb
index d347e323b3..05f92203cd 100644
--- a/meta/recipes-core/initrdscripts/initramfs-live-install-testfs_1.0.bb
+++ b/meta/recipes-core/initrdscripts/initramfs-live-install-testfs_1.0.bb
@@ -5,10 +5,10 @@ SRC_URI = "file://init-install-testfs.sh"
 
 RDEPENDS:${PN} = "grub parted e2fsprogs-mke2fs"
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 do_install() {
-        install -m 0755 ${WORKDIR}/init-install-testfs.sh ${D}/install.sh
+        install -m 0755 ${S}/init-install-testfs.sh ${D}/install.sh
 }
 
 INHIBIT_DEFAULT_DEPS = "1"
diff --git a/meta/recipes-core/initrdscripts/initramfs-live-install_1.0.bb b/meta/recipes-core/initrdscripts/initramfs-live-install_1.0.bb
index 9046d06c02..791bd57171 100644
--- a/meta/recipes-core/initrdscripts/initramfs-live-install_1.0.bb
+++ b/meta/recipes-core/initrdscripts/initramfs-live-install_1.0.bb
@@ -3,14 +3,13 @@ LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
 SRC_URI = "file://init-install.sh"
 
-
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 RDEPENDS:${PN} = "grub parted e2fsprogs-mke2fs util-linux-blkid ${VIRTUAL-RUNTIME_base-utils}"
 RRECOMMENDS:${PN} = "${VIRTUAL-RUNTIME_base-utils-syslog}"
 
 do_install() {
-        install -m 0755 ${WORKDIR}/init-install.sh ${D}/install.sh
+        install -m 0755 ${S}/init-install.sh ${D}/install.sh
 }
 
 # While this package maybe an allarch due to it being a 
diff --git a/meta/recipes-core/initrdscripts/initramfs-module-install-efi_1.0.bb b/meta/recipes-core/initrdscripts/initramfs-module-install-efi_1.0.bb
index b7499644f0..0283149899 100644
--- a/meta/recipes-core/initrdscripts/initramfs-module-install-efi_1.0.bb
+++ b/meta/recipes-core/initrdscripts/initramfs-module-install-efi_1.0.bb
@@ -4,14 +4,13 @@ LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384
 RDEPENDS:${PN} = "initramfs-framework-base parted e2fsprogs-mke2fs dosfstools util-linux-blkid ${VIRTUAL-RUNTIME_base-utils}"
 RRECOMMENDS:${PN} = "${VIRTUAL-RUNTIME_base-utils-syslog}"
 
-
 SRC_URI = "file://init-install-efi.sh"
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 do_install() {
     install -d ${D}/init.d
-    install -m 0755 ${WORKDIR}/init-install-efi.sh ${D}/init.d/install-efi.sh
+    install -m 0755 ${S}/init-install-efi.sh ${D}/init.d/install-efi.sh
 }
 
 FILES:${PN} = "/init.d/install-efi.sh"
diff --git a/meta/recipes-core/initrdscripts/initramfs-module-install_1.0.bb b/meta/recipes-core/initrdscripts/initramfs-module-install_1.0.bb
index 11db7124af..f44c753da0 100644
--- a/meta/recipes-core/initrdscripts/initramfs-module-install_1.0.bb
+++ b/meta/recipes-core/initrdscripts/initramfs-module-install_1.0.bb
@@ -5,18 +5,17 @@ RDEPENDS:${PN} = "initramfs-framework-base grub parted e2fsprogs-mke2fs util-lin
 RRECOMMENDS:${PN} = "${VIRTUAL-RUNTIME_base-utils-syslog}"
 
 # The same restriction as grub
-COMPATIBLE_HOST = '(x86_64.*|i.86.*|arm.*|aarch64.*|loongarch64.*)-(linux.*|freebsd.*)'
+COMPATIBLE_HOST = '(x86_64.*|i.86.*|arm.*|aarch64.*)-(linux.*|freebsd.*)'
 COMPATIBLE_HOST:armv7a = 'null'
 COMPATIBLE_HOST:armv7ve = 'null'
 
-
 SRC_URI = "file://init-install.sh"
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 do_install() {
     install -d ${D}/init.d
-    install -m 0755 ${WORKDIR}/init-install.sh ${D}/init.d/install.sh
+    install -m 0755 ${S}/init-install.sh ${D}/init.d/install.sh
 }
 
 FILES:${PN} = "/init.d/install.sh"
diff --git a/meta/recipes-core/initrdscripts/initramfs-module-setup-live_1.0.bb b/meta/recipes-core/initrdscripts/initramfs-module-setup-live_1.0.bb
index 48a779e9aa..3afbd5d47d 100644
--- a/meta/recipes-core/initrdscripts/initramfs-module-setup-live_1.0.bb
+++ b/meta/recipes-core/initrdscripts/initramfs-module-setup-live_1.0.bb
@@ -3,17 +3,16 @@ LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
 RDEPENDS:${PN} = "initramfs-framework-base udev-extraconf"
 
-
 inherit allarch
 
 FILESEXTRAPATHS:prepend := "${THISDIR}/initramfs-framework:"
 SRC_URI = "file://setup-live"
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 do_install() {
     install -d ${D}/init.d
-    install -m 0755 ${WORKDIR}/setup-live ${D}/init.d/80-setup-live
+    install -m 0755 ${S}/setup-live ${D}/init.d/80-setup-live
 }
 
 FILES:${PN} = "/init.d/80-setup-live"
diff --git a/meta/recipes-core/initscripts/init-system-helpers_1.66.bb b/meta/recipes-core/initscripts/init-system-helpers_1.68.bb
index 64e08aae68..48ac7792d3 100644
--- a/meta/recipes-core/initscripts/init-system-helpers_1.66.bb
+++ b/meta/recipes-core/initscripts/init-system-helpers_1.68.bb
@@ -16,12 +16,10 @@ SECTION = "base"
 LICENSE = "BSD-3-Clause & GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://debian/copyright;md5=c4ec20aa158fa9de26ee1accf78dcaae"
 
-SRCREV = "a5439f465dc1d1d4e12329208dc321fb806009f4"
+SRCREV = "78486a4a2a305170b66ce4d907bedadbaed10daf"
 SRC_URI = "git://salsa.debian.org/debian/init-system-helpers.git;protocol=https;branch=master"
 UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>(\d+(\.\d+)+))(?!_exp)"
 
-S = "${WORKDIR}/git"
-
 do_configure[noexec] = "1"
 do_compile[noexec] = "1"
 
diff --git a/meta/recipes-core/initscripts/initscripts-1.0/functions b/meta/recipes-core/initscripts/initscripts-1.0/functions
index 35aebd4a55..7fc19c808b 100755
--- a/meta/recipes-core/initscripts/initscripts-1.0/functions
+++ b/meta/recipes-core/initscripts/initscripts-1.0/functions
@@ -92,3 +92,24 @@ passed() {
     echo -n -e "${BRACKET}[${SUCCESS} PASS ${BRACKET}]${NORMAL}"
     return $rc
 }
+
+log_success_msg()
+{
+    echo -n $@
+    success
+    echo
+}
+
+log_failure_msg()
+{
+    echo -n $@
+    failure
+    echo
+}
+
+log_warning_msg()
+{
+    echo -n $@
+    warning
+    echo
+}
diff --git a/meta/recipes-core/initscripts/initscripts_1.0.bb b/meta/recipes-core/initscripts/initscripts_1.0.bb
index e61ac554f3..c984257c5c 100644
--- a/meta/recipes-core/initscripts/initscripts_1.0.bb
+++ b/meta/recipes-core/initscripts/initscripts_1.0.bb
@@ -35,7 +35,7 @@ SRC_URI = "file://functions \
            ${@bb.utils.contains('DISTRO_FEATURES','selinux','file://sushell','',d)} \
 "
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 SRC_URI:append:arm = " file://alignment.sh"
 SRC_URI:append:armeb = " file://alignment.sh"
@@ -53,7 +53,6 @@ RDEPENDS:${PN} = "initd-functions \
 # Recommend pn-functions so that it will be a preferred default provider for initd-functions
 RRECOMMENDS:${PN} = "${PN}-functions"
 RPROVIDES:${PN}-functions = "initd-functions"
-RCONFLICTS:${PN}-functions = "lsbinitscripts"
 FILES:${PN}-functions = "${sysconfdir}/init.d/functions*"
 FILES:${PN}-sushell = "${base_sbindir}/sushell"
 
@@ -61,9 +60,9 @@ HALTARGS ?= "-d -f"
 VARLIBMOUNTARGS ?= ""
 
 do_configure() {
-        sed -i -e "s:SED_HALTARGS:${HALTARGS}:g" ${WORKDIR}/halt
-        sed -i -e "s:SED_HALTARGS:${HALTARGS}:g" ${WORKDIR}/reboot
-        sed -i -e "s:SED_VARLIBMOUNTARGS:${VARLIBMOUNTARGS}:g" ${WORKDIR}/read-only-rootfs-hook.sh
+        sed -i -e "s:SED_HALTARGS:${HALTARGS}:g" ${S}/halt
+        sed -i -e "s:SED_HALTARGS:${HALTARGS}:g" ${S}/reboot
+        sed -i -e "s:SED_VARLIBMOUNTARGS:${VARLIBMOUNTARGS}:g" ${S}/read-only-rootfs-hook.sh
 }
 
 do_install () {
@@ -84,50 +83,50 @@ do_install () {
         # Holds state information pertaining to urandom
         install -d ${D}${localstatedir}/lib/urandom
 
-        install -m 0644    ${WORKDIR}/functions         ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/bootmisc.sh       ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/checkroot.sh      ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/halt              ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/hostname.sh       ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/mountall.sh       ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/mountnfs.sh       ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/reboot            ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/rmnologin.sh      ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/sendsigs          ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/single            ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/umountnfs.sh      ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/urandom           ${D}${sysconfdir}/init.d
+        install -m 0644    ${S}/functions               ${D}${sysconfdir}/init.d
+        install -m 0755    ${S}/bootmisc.sh     ${D}${sysconfdir}/init.d
+        install -m 0755    ${S}/checkroot.sh    ${D}${sysconfdir}/init.d
+        install -m 0755    ${S}/halt            ${D}${sysconfdir}/init.d
+        install -m 0755    ${S}/hostname.sh     ${D}${sysconfdir}/init.d
+        install -m 0755    ${S}/mountall.sh     ${D}${sysconfdir}/init.d
+        install -m 0755    ${S}/mountnfs.sh     ${D}${sysconfdir}/init.d
+        install -m 0755    ${S}/reboot          ${D}${sysconfdir}/init.d
+        install -m 0755    ${S}/rmnologin.sh    ${D}${sysconfdir}/init.d
+        install -m 0755    ${S}/sendsigs                ${D}${sysconfdir}/init.d
+        install -m 0755    ${S}/single          ${D}${sysconfdir}/init.d
+        install -m 0755    ${S}/umountnfs.sh    ${D}${sysconfdir}/init.d
+        install -m 0755    ${S}/urandom         ${D}${sysconfdir}/init.d
         sed -i ${D}${sysconfdir}/init.d/urandom -e 's,/var/,${localstatedir}/,g;s,/etc/,${sysconfdir}/,g'
-        install -m 0755    ${WORKDIR}/devpts.sh ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/devpts            ${D}${sysconfdir}/default
-        install -m 0755    ${WORKDIR}/sysfs.sh          ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/populate-volatile.sh ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/read-only-rootfs-hook.sh ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/save-rtc.sh       ${D}${sysconfdir}/init.d
-        install -m 0644    ${WORKDIR}/volatiles         ${D}${sysconfdir}/default/volatiles/00_core
-        if [ ${@ oe.types.boolean('${VOLATILE_LOG_DIR}') } = True ]; then
+        install -m 0755    ${S}/devpts.sh       ${D}${sysconfdir}/init.d
+        install -m 0755    ${S}/devpts          ${D}${sysconfdir}/default
+        install -m 0755    ${S}/sysfs.sh                ${D}${sysconfdir}/init.d
+        install -m 0755    ${S}/populate-volatile.sh ${D}${sysconfdir}/init.d
+        install -m 0755    ${S}/read-only-rootfs-hook.sh ${D}${sysconfdir}/init.d
+        install -m 0755    ${S}/save-rtc.sh     ${D}${sysconfdir}/init.d
+        install -m 0644    ${S}/volatiles               ${D}${sysconfdir}/default/volatiles/00_core
+        if ${@bb.utils.contains('FILESYSTEM_PERMS_TABLES', 'files/fs-perms-volatile-log.txt', 'true', 'false', d)}; then
                 sed -i -e '\@^d root root 0755 /var/volatile/log none$@ a\l root root 0755 /var/log /var/volatile/log' \
                         ${D}${sysconfdir}/default/volatiles/00_core
         fi
-        if [ "${VOLATILE_TMP_DIR}" != "yes" ]; then
+        if ! ${@bb.utils.contains('FILESYSTEM_PERMS_TABLES', 'files/fs-perms-volatile-tmp.txt', 'true', 'false', d)}; then
                 sed -i -e "/\<tmp\>/d" ${D}${sysconfdir}/default/volatiles/00_core
         fi
-        install -m 0755    ${WORKDIR}/dmesg.sh          ${D}${sysconfdir}/init.d
-        install -m 0644    ${WORKDIR}/logrotate-dmesg.conf ${D}${sysconfdir}/
+        install -m 0755    ${S}/dmesg.sh                ${D}${sysconfdir}/init.d
+        install -m 0644    ${S}/logrotate-dmesg.conf ${D}${sysconfdir}/
 
         if [ "${TARGET_ARCH}" = "arm" ]; then
-                install -m 0755 ${WORKDIR}/alignment.sh ${D}${sysconfdir}/init.d
+                install -m 0755 ${S}/alignment.sh       ${D}${sysconfdir}/init.d
         fi
 
         if ${@bb.utils.contains('DISTRO_FEATURES','selinux','true','false',d)}; then
                 install -d ${D}/${base_sbindir}
-                install -m 0755 ${WORKDIR}/sushell ${D}/${base_sbindir}
+                install -m 0755 ${S}/sushell ${D}/${base_sbindir}
         fi
 #
 # Install device dependent scripts
 #
-        install -m 0755 ${WORKDIR}/banner.sh    ${D}${sysconfdir}/init.d/banner.sh
-        install -m 0755 ${WORKDIR}/umountfs     ${D}${sysconfdir}/init.d/umountfs
+        install -m 0755 ${S}/banner.sh  ${D}${sysconfdir}/init.d/banner.sh
+        install -m 0755 ${S}/umountfs   ${D}${sysconfdir}/init.d/umountfs
 #
 # Create runlevel links
 #
diff --git a/meta/recipes-core/kbd/kbd/0001-Remove-non-free-Agafari-fonts.patch b/meta/recipes-core/kbd/kbd/0001-Remove-non-free-Agafari-fonts.patch
deleted file mode 100644
index de279b55f9..0000000000
--- a/meta/recipes-core/kbd/kbd/0001-Remove-non-free-Agafari-fonts.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From b757e6842f9631757f0d1a6b3833aabffa9ffeee Mon Sep 17 00:00:00 2001
-From: Alexey Gladkov <legion@kernel.org>
-Date: Thu, 29 Feb 2024 17:38:37 +0100
-Subject: [PATCH] Remove non-free Agafari fonts
-
-Based on legal analysis, we are removing non-free fonts for now. If we
-can change the license of these fonts, we will return them back.
-
-From: Stanislav Brabec <sbrabec@suse.com>
-Date: Wed, 28 Feb 2024 16:47:54 +0100
-Subject: kbd: Legal problems of Agafari fonts
-
-    The data/consolefonts/README.Ethiopic contains a notice:
-    Agafari:
-      Donated by the Ethiopian Science and Technology Commission
-      <ncic@padis.gn.apc.org> or <ncic@telecom.net.et> and may be redistributed
-      for non-commercial use under Unix environments only.
-
-    According to our legal review, it makes impossible to distribute these
-    fonts as part of any commercial products, and even makes it impossible to
-    distribute kbd sources as part of any commercial product services.
-
-    Additionally, it makes the whole kbd package incompatible with GPL, so the
-    COPYING file (created during build of the tarball) cannot declare GPL
-    version 2. It also violates section 6 of GPL (no further restrictions).
-
-    That is why several GNU/Linux distributions exclude Agafari from the
-    release. To be on a safe side, SUSE even decided to repack any source
-    tarballs before putting it to their servers.
-
-    This was probably reported to the former kbd maintainer about 20 years ago,
-    but nothing changed over years.
-
-    That is why I recommend removing Agafari fonts and removing the reference
-    to them from README.Ethiopic. Alternatively, you can ask the Ethiopian
-    Science and Technology Commission for re-licensing.
-
-Signed-off-by: Alexey Gladkov <legion@kernel.org>
-
-Upstream-Status: Backport [https://github.com/legionus/kbd/commit/b757e6842f9631757f0d1a6b3833aabffa9ffeee]
-
-[do_configure prepend added to remove binary files]
-
-Signed-off-by: Peter Marko <peter.marko@siemens.com>
----
- data/consolefonts/Agafari-12.psfu | Bin 7989 -> 0 bytes
- data/consolefonts/Agafari-14.psfu | Bin 9013 -> 0 bytes
- data/consolefonts/Agafari-16.psfu | Bin 10037 -> 0 bytes
- data/consolefonts/README.Ethiopic |   5 -----
- 4 files changed, 5 deletions(-)
- delete mode 100644 data/consolefonts/Agafari-12.psfu
- delete mode 100644 data/consolefonts/Agafari-14.psfu
- delete mode 100644 data/consolefonts/Agafari-16.psfu
-
-diff --git a/data/consolefonts/README.Ethiopic b/data/consolefonts/README.Ethiopic
-index 7502722..2810797 100644
---- a/data/consolefonts/README.Ethiopic
-+++ b/data/consolefonts/README.Ethiopic
-@@ -14,11 +14,6 @@ Ethiopic fonts:
-      restrictions below:
- 
- 
--Agafari:
--  Donated by the Ethiopian Science and Technology Commission 
--  <ncic@padis.gn.apc.org> or <ncic@telecom.net.et> and may be redistributed
--  for non-commercial use under Unix environments only.
--
- Goha and GohaClassic:
-   Donated by Yitna Firdyiwek <ybf2u@virgina.edu> of GohaTibeb Associates
-   and may be redistributed without restriction under the GNU GPL 2.0.
--- 
-2.30.2
-
diff --git a/meta/recipes-core/kbd/kbd_2.6.4.bb b/meta/recipes-core/kbd/kbd_2.8.0.bb
index 2331b51e59..ababa09918 100644
--- a/meta/recipes-core/kbd/kbd_2.6.4.bb
+++ b/meta/recipes-core/kbd/kbd_2.8.0.bb
@@ -1,6 +1,6 @@
 SUMMARY = "Keytable files and keyboard utilities"
 HOMEPAGE = "http://www.kbd-project.org/"
-DESCRIPTION = "The kbd project contains tools for managing Linux console (Linux console, virtual terminals, keyboard, etc.) – mainly, what they do is loading console fonts and keyboard maps."
+DESCRIPTION = "The kbd project contains tools for managing Linux console (Linux console, virtual terminals, keyboard, etc.) - mainly, what they do is loading console fonts and keyboard maps."
 
 # consolefonts and keymaps contain also some public domain and author notice licenses
 LICENSE = "GPL-2.0-or-later & LGPL-2.0-or-later & GPL-3.0-or-later"
@@ -24,12 +24,12 @@ RPROVIDES:${PN} = "console-tools"
 RCONFLICTS:${PN} = "console-tools"
 
 SRC_URI = "${KERNELORG_MIRROR}/linux/utils/${BPN}/${BP}.tar.xz \
-           file://0001-Remove-non-free-Agafari-fonts.patch \
            "
 
-SRC_URI[sha256sum] = "519f8d087aecca7e0a33cd084bef92c066eb19731666653dcc70c9d71aa40926"
+SRC_URI[sha256sum] = "01f5806da7d1d34f594b7b2a6ae1ab23215344cf1064e8edcd3a90fef9776a11"
 
-EXTRA_OECONF = "--disable-tests"
+# 'gzip -n' is set due to https://github.com/legionus/kbd/issues/124
+EXTRA_OECONF = "--disable-tests --enable-compress='gzip -n'"
 PACKAGECONFIG ?= "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)} \
                   "
 
@@ -45,12 +45,6 @@ FILES:${PN}-unimaps = "${datadir}/unimaps"
 
 RRECOMMENDS:${PN}-keymaps = "${PN}-keymaps-pine"
 
-# remove this when upgrading to newer version which has integrated
-# https://github.com/legionus/kbd/commit/b757e6842f9631757f0d1a6b3833aabffa9ffeee
-do_configure:prepend() {
-    rm -rf ${S}/data/consolefonts/Agafari-1*
-}
-
 do_install:append () {
     if [ "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'yes', 'no', d)}" = "yes" ] \
     && [ -f ${D}${sysconfdir}/pam.d/vlock ]; then
diff --git a/meta/recipes-core/libcgroup/libcgroup_3.1.0.bb b/meta/recipes-core/libcgroup/libcgroup_3.2.0.bb
index 4b4f19e36f..28562a5b37 100644
--- a/meta/recipes-core/libcgroup/libcgroup_3.1.0.bb
+++ b/meta/recipes-core/libcgroup/libcgroup_3.2.0.bb
@@ -12,11 +12,10 @@ inherit autotools pkgconfig github-releases
 DEPENDS = "bison-native flex-native"
 DEPENDS:append:libc-musl = " fts"
 
-SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${BP}.tar.gz \
-"
+SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${BP}.tar.gz"
 UPSTREAM_CHECK_URI = "https://github.com/libcgroup/libcgroup/tags"
 
-SRC_URI[sha256sum] = "976ec4b1e03c0498308cfd28f1b256b40858f636abc8d1f9db24f0a7ea9e1258"
+SRC_URI[sha256sum] = "9a0fc2d6c377215c3e0d849f9189ecd91fd075f1da0a24b73f56c8892e86bdfe"
 
 PACKAGECONFIG = "${@bb.utils.filter('DISTRO_FEATURES', 'pam systemd', d)}"
 PACKAGECONFIG[pam] = "--enable-pam-module-dir=${base_libdir}/security --enable-pam=yes,--enable-pam=no,libpam"
diff --git a/meta/recipes-core/libxcrypt/files/fix_cflags_handling.patch b/meta/recipes-core/libxcrypt/files/fix_cflags_handling.patch
deleted file mode 100644
index 94aa3fed49..0000000000
--- a/meta/recipes-core/libxcrypt/files/fix_cflags_handling.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 7b2a0cdc281d94a5782c37ef87040c341447b4b4 Mon Sep 17 00:00:00 2001
-From: Richard Purdie <richard.purdie@linuxfoundation.org>
-Date: Fri, 30 Apr 2021 10:35:02 +0100
-Subject: [PATCH] libxcrypt: Update to 4.4.19 release and fix symbol version
-
-If you pass CFLAGS with a leading space, " " gets passed to popen and convinces
-gcc to try and open a file called " ". This results in a confusing error message
-like:
-
-x86_64-pokysdk-linux-gcc: error: : No such file or directory
-
-Avoid this by stripping empty elements out of CFLAGS.
-
-Upstream-Status: Submitted [https://github.com/besser82/libxcrypt/pull/126]
-Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-
----
- build-aux/scripts/compute-symver-floor | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/build-aux/scripts/compute-symver-floor b/build-aux/scripts/compute-symver-floor
-index 4ec82e1..8117342 100644
---- a/build-aux/scripts/compute-symver-floor
-+++ b/build-aux/scripts/compute-symver-floor
-@@ -36,6 +36,8 @@ sub preprocessor_check {
-         die "C compiler not available\n" unless @CC;
- 
-         @CFLAGS = sh_split($ENV{CFLAGS} // q{});
-+        # Remove empty elements, particularly leading ones which cause issues with popen below
-+        @CFLAGS = grep {$_} @CFLAGS;
- 
-         # Remove empty elements, particularly leading ones which
-         # cause issues with popen below.
diff --git a/meta/recipes-core/libxcrypt/libxcrypt-compat_4.4.36.bb b/meta/recipes-core/libxcrypt/libxcrypt-compat_4.4.38.bb
index d5546ce9ba..bb4e2032dd 100644
--- a/meta/recipes-core/libxcrypt/libxcrypt-compat_4.4.36.bb
+++ b/meta/recipes-core/libxcrypt/libxcrypt-compat_4.4.38.bb
@@ -1,5 +1,5 @@
 #
-# This provides libcrypto.so.1 which contains obsolete APIs, needed for uninative in particular
+# This provides libcrypt.so.1 which contains obsolete APIs, needed for uninative in particular
 #
 
 require libxcrypt.inc
@@ -16,3 +16,4 @@ do_install:append () {
         rm -rf ${D}${libdir}/libcrypt.so
         rm -rf ${D}${datadir}
 }
+
diff --git a/meta/recipes-core/libxcrypt/libxcrypt.inc b/meta/recipes-core/libxcrypt/libxcrypt.inc
index ba93d91aef..77fec83234 100644
--- a/meta/recipes-core/libxcrypt/libxcrypt.inc
+++ b/meta/recipes-core/libxcrypt/libxcrypt.inc
@@ -9,16 +9,13 @@ LIC_FILES_CHKSUM = "file://LICENSING;md5=c0a30e2b1502c55a7f37e412cd6c6a4b \
 
 inherit autotools pkgconfig
 
-SRC_URI = "git://github.com/besser82/libxcrypt.git;branch=${SRCBRANCH};protocol=https"
-SRCREV = "f531a36aa916a22ef2ce7d270ba381e264250cbf"
+SRC_URI = "git://github.com/besser82/libxcrypt.git;branch=${SRCBRANCH};protocol=https \
+           "
+SRCREV = "55ea777e8d567e5e86ffac917c28815ac54cc341"
 SRCBRANCH ?= "master"
 
-SRC_URI += "file://fix_cflags_handling.patch"
-
 PROVIDES = "virtual/crypt"
 
-S = "${WORKDIR}/git"
-
 BUILD_CPPFLAGS = "-I${STAGING_INCDIR_NATIVE}"
 TARGET_CPPFLAGS = "-I${STAGING_DIR_TARGET}${includedir} -Wno-error"
 CPPFLAGS:append:class-nativesdk = " -Wno-error"
diff --git a/meta/recipes-core/libxcrypt/libxcrypt_4.4.36.bb b/meta/recipes-core/libxcrypt/libxcrypt_4.4.38.bb
index 79dba2f6dc..79dba2f6dc 100644
--- a/meta/recipes-core/libxcrypt/libxcrypt_4.4.36.bb
+++ b/meta/recipes-core/libxcrypt/libxcrypt_4.4.38.bb
diff --git a/meta/recipes-core/libxml/libxml2/0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch b/meta/recipes-core/libxml/libxml2/0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch
new file mode 100644
index 0000000000..6ea5adafa2
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch
@@ -0,0 +1,81 @@
+From 55ed199fdb55a1a600616ba14ad0feedcf828d86 Mon Sep 17 00:00:00 2001
+From: Peter Marko <peter.marko@siemens.com>
+Date: Mon, 26 May 2025 21:11:14 +0200
+Subject: [PATCH] Revert "cmake: Fix installation directories in
+ libxml2-config.cmake"
+
+This reverts commit 75dde50b20215a2a3a445b62f36a67c8ed337cab.
+
+Upstream-Status: Inappropriate [upstream ticket https://gitlab.gnome.org/GNOME/libxml2/-/issues/898#note_2452864]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ configure.ac            | 11 -----------
+ libxml2-config.cmake.in | 11 +++++++----
+ meson.build             |  3 ---
+ 3 files changed, 7 insertions(+), 18 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 40e75151..d21ebfe5 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1061,17 +1061,6 @@ AC_SUBST(XML_PRIVATE_LIBS)
+ AC_SUBST(XML_PRIVATE_CFLAGS)
+ AC_SUBST(XML_INCLUDEDIR)
+ 
+-# for libxml2-config.cmake.in
+-AX_RECURSIVE_EVAL(["$bindir"], [INSTALL_BINDIR])
+-AX_RECURSIVE_EVAL(["$includedir"], [INSTALL_INCLUDEDIR])
+-AX_RECURSIVE_EVAL(["$libdir"], [INSTALL_LIBDIR])
+-AC_SUBST(INSTALL_BINDIR)
+-AC_SUBST(INSTALL_INCLUDEDIR)
+-AC_SUBST(INSTALL_LIBDIR)
+-AM_SUBST_NOTMAKE(INSTALL_BINDIR)
+-AM_SUBST_NOTMAKE(INSTALL_INCLUDEDIR)
+-AM_SUBST_NOTMAKE(INSTALL_LIBDIR)
+-
+ AX_RECURSIVE_EVAL(["$sysconfdir"], [XML_SYSCONFDIR])
+ AC_DEFINE_UNQUOTED([XML_SYSCONFDIR], ["$XML_SYSCONFDIR"],
+                    [System configuration directory (/etc)])
+diff --git a/libxml2-config.cmake.in b/libxml2-config.cmake.in
+index 4945dda4..31036805 100644
+--- a/libxml2-config.cmake.in
++++ b/libxml2-config.cmake.in
+@@ -24,17 +24,20 @@
+ #   LibXml2::LibXml2          - the LibXml2 library
+ #   LibXml2::xmllint          - the xmllint command-line executable
+ 
++get_filename_component(_libxml2_rootdir ${CMAKE_CURRENT_LIST_DIR}/../../../ ABSOLUTE)
++
+ set(LIBXML2_VERSION_MAJOR  @LIBXML_MAJOR_VERSION@)
+ set(LIBXML2_VERSION_MINOR  @LIBXML_MINOR_VERSION@)
+ set(LIBXML2_VERSION_MICRO  @LIBXML_MICRO_VERSION@)
+ set(LIBXML2_VERSION_STRING "@VERSION@")
+ set(LIBXML2_DEFINITIONS    "@XML_CFLAGS@")
+-set(LIBXML2_INCLUDE_DIR    @INSTALL_INCLUDEDIR@/libxml2)
+-set(LIBXML2_LIBRARY_DIR    @INSTALL_LIBDIR@)
++set(LIBXML2_INSTALL_PREFIX ${_libxml2_rootdir})
++set(LIBXML2_INCLUDE_DIR    ${_libxml2_rootdir}/include/libxml2)
++set(LIBXML2_LIBRARY_DIR    ${_libxml2_rootdir}/lib)
+ 
+ find_library(LIBXML2_LIBRARY NAMES xml2 HINTS ${LIBXML2_LIBRARY_DIR} NO_DEFAULT_PATH)
+-find_program(LIBXML2_XMLCATALOG_EXECUTABLE NAMES xmlcatalog HINTS @INSTALL_BINDIR@ NO_DEFAULT_PATH)
+-find_program(LIBXML2_XMLLINT_EXECUTABLE NAMES xmllint HINTS @INSTALL_BINDIR@ NO_DEFAULT_PATH)
++find_program(LIBXML2_XMLCATALOG_EXECUTABLE NAMES xmlcatalog HINTS ${_libxml2_rootdir}/bin NO_DEFAULT_PATH)
++find_program(LIBXML2_XMLLINT_EXECUTABLE NAMES xmllint HINTS ${_libxml2_rootdir}/bin NO_DEFAULT_PATH)
+ 
+ set(LIBXML2_LIBRARIES ${LIBXML2_LIBRARY})
+ set(LIBXML2_INCLUDE_DIRS ${LIBXML2_INCLUDE_DIR})
+diff --git a/meson.build b/meson.build
+index 4c59211d..3e5f25d3 100644
+--- a/meson.build
++++ b/meson.build
+@@ -599,9 +599,6 @@ config_cmake = configuration_data()
+ config_cmake.set('LIBXML_MAJOR_VERSION', v_maj)
+ config_cmake.set('LIBXML_MINOR_VERSION', v_min)
+ config_cmake.set('LIBXML_MICRO_VERSION', v_mic)
+-config_cmake.set('INSTALL_BINDIR', dir_bin)
+-config_cmake.set('INSTALL_INCLUDEDIR', dir_include)
+-config_cmake.set('INSTALL_LIBDIR', dir_lib)
+ config_cmake.set('VERSION', meson.project_version())
+ config_cmake.set('WITH_HTTP', want_http.to_int().to_string())
+ config_cmake.set('WITH_ICONV', want_iconv.to_int().to_string())
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2025-6021.patch b/meta/recipes-core/libxml/libxml2/CVE-2025-6021.patch
new file mode 100644
index 0000000000..157486848b
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2025-6021.patch
@@ -0,0 +1,59 @@
+From 33d7969baf541326a35e2fbe31943c46af8c71db Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Tue, 27 May 2025 12:53:17 +0200
+Subject: [PATCH] tree: Fix integer overflow in xmlBuildQName
+
+This issue affects memory safety and might receive a CVE ID later.
+
+Fixes #926.
+
+Signed-off-by: Nick Wellnhofer <wellnhofer@aevum.de>
+
+Add '#include <stdint.h>' to assure the definition of SIZE_MAX
+CVE: CVE-2025-6021
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/acbbeef9f5dcdcc901c5f3fa14d583ef8cfd22f0]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ tree.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/tree.c b/tree.c
+index 7454b07..22ec11c 100644
+--- a/tree.c
++++ b/tree.c
+@@ -23,6 +23,7 @@
+ #include <limits.h>
+ #include <ctype.h>
+ #include <stdlib.h>
++#include <stdint.h>
+ 
+ #ifdef LIBXML_ZLIB_ENABLED
+ #include <zlib.h>
+@@ -168,10 +169,10 @@ xmlGetParameterEntityFromDtd(const xmlDtd *dtd, const xmlChar *name) {
+ xmlChar *
+ xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
+              xmlChar *memory, int len) {
+-    int lenn, lenp;
++    size_t lenn, lenp;
+     xmlChar *ret;
+ 
+-    if (ncname == NULL) return(NULL);
++    if ((ncname == NULL) || (len < 0)) return(NULL);
+     if (prefix == NULL) return((xmlChar *) ncname);
+ 
+ #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+@@ -182,8 +183,10 @@ xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
+ 
+     lenn = strlen((char *) ncname);
+     lenp = strlen((char *) prefix);
++    if (lenn >= SIZE_MAX - lenp - 1)
++        return(NULL);
+ 
+-    if ((memory == NULL) || (len < lenn + lenp + 2)) {
++    if ((memory == NULL) || ((size_t) len < lenn + lenp + 2)) {
+        ret = xmlMalloc(lenn + lenp + 2);
+        if (ret == NULL)
+            return(NULL);
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/libxml/libxml2/install-tests.patch b/meta/recipes-core/libxml/libxml2/install-tests.patch
index 478eeea81b..789aeca119 100644
--- a/meta/recipes-core/libxml/libxml2/install-tests.patch
+++ b/meta/recipes-core/libxml/libxml2/install-tests.patch
@@ -1,4 +1,4 @@
-From 0779511838a8cbd1e0f431c22f28f286a2a37b1b Mon Sep 17 00:00:00 2001
+From 8c1054eacb430472068f21e4840749c384e8e866 Mon Sep 17 00:00:00 2001
 From: Ross Burton <ross.burton@arm.com>
 Date: Mon, 5 Dec 2022 17:02:32 +0000
 Subject: [PATCH] add yocto-specific install-ptest target
@@ -12,10 +12,10 @@ Signed-off-by: Ross Burton <ross.burton@arm.com>
  1 file changed, 10 insertions(+)
 
 diff --git a/Makefile.am b/Makefile.am
-index 0a49d37..1097c63 100644
+index 4cb9a5c..8adcd7e 100644
 --- a/Makefile.am
 +++ b/Makefile.am
-@@ -27,6 +27,16 @@ check_PROGRAMS = \
+@@ -26,6 +26,16 @@ check_PROGRAMS = \
         testparser \
         testrecurse
  
@@ -29,6 +29,6 @@ index 0a49d37..1097c63 100644
 +       cp -r $(srcdir)/result $(DESTDIR)$(ptestdir)
 +       cp -r $(srcdir)/python/tests $(DESTDIR)$(ptestdir)/python
 +
- bin_PROGRAMS = xmllint xmlcatalog
+ bin_PROGRAMS = xmllint
  
  bin_SCRIPTS = xml2-config
diff --git a/meta/recipes-core/libxml/libxml2/run-ptest b/meta/recipes-core/libxml/libxml2/run-ptest
index f252a78f17..cbbdd5592f 100755
--- a/meta/recipes-core/libxml/libxml2/run-ptest
+++ b/meta/recipes-core/libxml/libxml2/run-ptest
@@ -5,7 +5,7 @@ set -e
 export LC_ALL=en_US.UTF-8
 
 # testModule isn't that useful and hard-codes buildtree, so we don't run that
-TESTS="runtest runsuite testrecurse testchar testdict testThreads runxmlconf testapi"
+TESTS="runtest runsuite testrecurse testchar testdict runxmlconf testapi testlimits testparser"
 
 for T in $TESTS; do
     echo Running $T
diff --git a/meta/recipes-core/libxml/libxml2_2.12.6.bb b/meta/recipes-core/libxml/libxml2_2.14.3.bb
index 14fcff7fa4..4baab59186 100644
--- a/meta/recipes-core/libxml/libxml2_2.12.6.bb
+++ b/meta/recipes-core/libxml/libxml2_2.14.3.bb
@@ -4,10 +4,9 @@ HOMEPAGE = "https://gitlab.gnome.org/GNOME/libxml2"
 BUGTRACKER = "http://bugzilla.gnome.org/buglist.cgi?product=libxml2"
 SECTION = "libs"
 LICENSE = "MIT"
-LIC_FILES_CHKSUM = "file://Copyright;md5=fec7ecfe714722b2bb0aaff7d200c701 \
+LIC_FILES_CHKSUM = "file://Copyright;md5=5873615e8a9ecbf5c8857c4312ee05d6 \
                     file://dict.c;beginline=6;endline=15;md5=2b4b7b827d2d8b080372433c4c9c85b6 \
                     file://list.c;beginline=4;endline=13;md5=b9c25b021ccaf287e50060602d20f3a7 \
-                    file://trio.c;beginline=5;endline=14;md5=cd4f61e27f88c1d43df112966b1cd28f \
                     "
 
 DEPENDS = "zlib virtual/libiconv"
@@ -18,9 +17,11 @@ inherit gnomebase
 SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testtar \
            file://run-ptest \
            file://install-tests.patch \
+           file://0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch \
+           file://CVE-2025-6021.patch \
            "
 
-SRC_URI[archive.sha256sum] = "889c593a881a3db5fdd96cc9318c87df34eb648edfc458272ad46fd607353fbb"
+SRC_URI[archive.sha256sum] = "6de55cacc8c2bc758f2ef6f93c313cb30e4dd5d84ac5d3c7ccbd9344d8cc6833"
 SRC_URI[testtar.sha256sum] = "c6b2d42ee50b8b236e711a97d68e6c4b5c8d83e69a2be4722379f08702ea7273"
 
 # Disputed as a security issue, but fixed in d39f780
@@ -28,11 +29,8 @@ CVE_STATUS[CVE-2023-45322] = "disputed: issue requires memory allocation to fail
 
 BINCONFIG = "${bindir}/xml2-config"
 
-PACKAGECONFIG ??= "python \
-    ${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)} \
-"
+PACKAGECONFIG ??= "python"
 PACKAGECONFIG[python] = "--with-python=${PYTHON},--without-python,python3"
-PACKAGECONFIG[ipv6] = "--enable-ipv6,--disable-ipv6,"
 
 inherit autotools pkgconfig binconfig-disabled ptest
 
@@ -52,7 +50,7 @@ RDEPENDS:${PN}-ptest:append:libc-glibc = " glibc-gconv-ebcdic-us \
                                          "
 
 # WARNING: zlib is required for RPM use
-EXTRA_OECONF = "--without-debug --without-legacy --with-catalog --with-c14n --without-lzma --with-fexceptions"
+EXTRA_OECONF = "--without-debug --without-legacy --with-catalog --with-c14n --without-lzma"
 EXTRA_OECONF:class-native = "--without-legacy --with-c14n --without-lzma --with-zlib"
 EXTRA_OECONF:class-nativesdk = "--without-legacy --with-c14n --without-lzma --with-zlib"
 EXTRA_OECONF:linuxstdbase = "--with-debug --with-legacy --with-c14n --without-lzma --with-zlib"
diff --git a/meta/recipes-core/meta/build-sysroots.bb b/meta/recipes-core/meta/build-sysroots.bb
index db05c111ab..b0b8fb3c79 100644
--- a/meta/recipes-core/meta/build-sysroots.bb
+++ b/meta/recipes-core/meta/build-sysroots.bb
@@ -7,7 +7,7 @@ STANDALONE_SYSROOT_NATIVE = "${STAGING_DIR}/${BUILD_ARCH}"
 PACKAGE_ARCH = "${MACHINE_ARCH}"
 EXCLUDE_FROM_WORLD = "1"
 
-inherit nopackages
+inherit nopackages nospdx
 deltask fetch
 deltask unpack
 deltask patch
@@ -17,9 +17,6 @@ deltask configure
 deltask compile
 deltask install
 deltask populate_sysroot
-deltask create_spdx
-deltask collect_spdx_deps
-deltask create_runtime_spdx
 deltask recipe_qa
 
 do_build_warn () {
diff --git a/meta/recipes-core/meta/buildtools-docs-tarball.bb b/meta/recipes-core/meta/buildtools-docs-tarball.bb
index 72648e3b1c..98d47f7b71 100644
--- a/meta/recipes-core/meta/buildtools-docs-tarball.bb
+++ b/meta/recipes-core/meta/buildtools-docs-tarball.bb
@@ -7,12 +7,16 @@ LICENSE = "MIT"
 # Add nativesdk equivalent of build-essentials
 TOOLCHAIN_HOST_TASK += "\
     nativesdk-python3-sphinx \
+    nativesdk-python3-sphinx-argparse \
+    nativesdk-python3-sphinx-copybutton \
     nativesdk-python3-sphinx-rtd-theme \
     nativesdk-python3-pyyaml \
+    nativesdk-rsvg \
     "
 
 TOOLCHAIN_OUTPUTNAME = "${SDK_ARCH}-buildtools-docs-nativesdk-standalone-${DISTRO_VERSION}"
 
 SDK_TITLE = "Docs Build tools tarball"
 
-TESTSDK_CASES = "buildtools-docs-cases"
+# Directory that contains testcases
+TESTSDK_CASE_DIRS = "buildtools-docs"
\ No newline at end of file
diff --git a/meta/recipes-core/meta/buildtools-tarball.bb b/meta/recipes-core/meta/buildtools-tarball.bb
index dc075763e6..02117ab84d 100644
--- a/meta/recipes-core/meta/buildtools-tarball.bb
+++ b/meta/recipes-core/meta/buildtools-tarball.bb
@@ -11,6 +11,7 @@ TOOLCHAIN_HOST_TASK ?= "\
     nativesdk-python3-git \
     nativesdk-python3-jinja2 \
     nativesdk-python3-testtools \
+    nativesdk-python3-pip \
     nativesdk-python3-setuptools \
     nativesdk-python3-subunit \
     nativesdk-python3-pyyaml \
@@ -72,12 +73,6 @@ create_sdk_files:append () {
         touch $script
         echo 'export PATH="${SDKPATHNATIVE}${bindir_nativesdk}:${SDKPATHNATIVE}${sbindir_nativesdk}:${SDKPATHNATIVE}${base_bindir_nativesdk}:${SDKPATHNATIVE}${base_sbindir_nativesdk}:$PATH"' >> $script
         echo 'export OECORE_NATIVE_SYSROOT="${SDKPATHNATIVE}"' >> $script
-        if [ -e "${SDK_OUTPUT}${SDKPATHNATIVE}${sysconfdir}/ssl/certs/ca-certificates.crt" ]; then
-                echo 'export GIT_SSL_CAINFO="${SDKPATHNATIVE}${sysconfdir}/ssl/certs/ca-certificates.crt"' >>$script
-                echo 'export SSL_CERT_FILE="${SDKPATHNATIVE}${sysconfdir}/ssl/certs/ca-certificates.crt"' >>$script
-                echo 'export REQUESTS_CA_BUNDLE="${SDKPATHNATIVE}${sysconfdir}/ssl/certs/ca-certificates.crt"' >>$script
-                echo 'export CURL_CA_BUNDLE="${SDKPATHNATIVE}${sysconfdir}/ssl/certs/ca-certificates.crt"' >>$script
-        fi
         echo 'HOST_PKG_PATH=$(command -p pkg-config --variable=pc_path pkg-config 2>/dev/null)' >>$script
         echo 'export PKG_CONFIG_LIBDIR=${SDKPATHNATIVE}/${libdir}/pkgconfig:${SDKPATHNATIVE}/${datadir}/pkgconfig:${HOST_PKG_PATH:-/usr/lib/pkgconfig:/usr/share/pkgconfig}' >>$script
         echo 'unset HOST_PKG_PATH'
@@ -85,14 +80,35 @@ create_sdk_files:append () {
         toolchain_create_sdk_version ${SDK_OUTPUT}/${SDKPATH}/version-${SDK_SYS}
 
         cat >> $script <<EOF
+# Detect host ca file/path, export for envfile to use
+# /etc/ssl/certs/ca-certificates.crt Debian systems
+# /etc/pki/tls/certs/ca-bundle.crt Fedora systems
+# /etc/ssl/ca-bundle.pem Suse systems
+export CAFILE
+export CAPATH
+for a in /etc/ssl/certs/ca-certificates.crt \
+    /etc/pki/tls/certs/ca-bundle.crt \
+    /etc/ssl/ca-bundle.pem ; do
+    if test -f "\$a"; then
+        CAFILE="\$a"
+        break
+    fi
+done
+
+a="/etc/ssl/certs"
+if test -d "\$a" && ls "\$a"/[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f].0 >/dev/null 2>/dev/null; then
+    CAPATH="\$a"
+fi
+
 if [ -d "\$OECORE_NATIVE_SYSROOT/environment-setup.d" ]; then
         for envfile in \$OECORE_NATIVE_SYSROOT/environment-setup.d/*.sh; do
                 . \$envfile
         done
 fi
+
 # We have to unset this else it can confuse oe-selftest and other tools
 # which may also use the overlapping namespace.
-unset OECORE_NATIVE_SYSROOT
+unset OECORE_NATIVE_SYSROOT CAFILE CAPATH
 EOF
 
         if [ "${SDKMACHINE}" = "i686" ]; then
@@ -108,19 +124,7 @@ TOOLCHAIN_NEED_CONFIGSITE_CACHE = ""
 # The recipe doesn't need any default deps
 INHIBIT_DEFAULT_DEPS = "1"
 
-# Directory in testsdk that contains testcases
-TESTSDK_CASES = "buildtools-cases"
+inherit testsdk
 
-python do_testsdk() {
-    import oeqa.sdk.testsdk
-    testsdk = oeqa.sdk.testsdk.TestSDK()
-
-    cases_path = os.path.join(os.path.abspath(os.path.dirname(oeqa.sdk.testsdk.__file__)), d.getVar("TESTSDK_CASES"))
-    testsdk.context_executor_class.default_cases = cases_path
-
-    testsdk.run(d)
-}
-addtask testsdk
-do_testsdk[nostamp] = "1"
-do_testsdk[network] = "1"
-do_testsdk[depends] += "xz-native:do_populate_sysroot"
+# Directory that contains testcases
+TESTSDK_CASE_DIRS = "buildtools"
\ No newline at end of file
diff --git a/meta/recipes-core/meta/cve-update-db-native.bb b/meta/recipes-core/meta/cve-update-db-native.bb
new file mode 100644
index 0000000000..86cd1a1a21
--- /dev/null
+++ b/meta/recipes-core/meta/cve-update-db-native.bb
@@ -0,0 +1,404 @@
+SUMMARY = "Updates the NVD CVE database"
+LICENSE = "MIT"
+
+INHIBIT_DEFAULT_DEPS = "1"
+
+inherit native
+
+deltask do_patch
+deltask do_configure
+deltask do_compile
+deltask do_install
+deltask do_populate_sysroot
+
+NVDCVE_URL ?= "https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-"
+FKIE_URL ?= "https://github.com/fkie-cad/nvd-json-data-feeds/releases/latest/download/CVE-"
+
+# CVE database update interval, in seconds. By default: once a day (24*60*60).
+# Use 0 to force the update
+# Use a negative value to skip the update
+CVE_DB_UPDATE_INTERVAL ?= "86400"
+
+# Timeout for blocking socket operations, such as the connection attempt.
+CVE_SOCKET_TIMEOUT ?= "60"
+
+CVE_CHECK_DB_DLDIR_FILE ?= "${DL_DIR}/CVE_CHECK2/${CVE_CHECK_DB_FILENAME}"
+CVE_CHECK_DB_DLDIR_LOCK ?= "${CVE_CHECK_DB_DLDIR_FILE}.lock"
+
+CVE_DB_TEMP_FILE ?= "${CVE_CHECK_DB_DLDIR_FILE}.tmp"
+
+python () {
+    if not bb.data.inherits_class("cve-check", d):
+        raise bb.parse.SkipRecipe("Skip recipe when cve-check class is not loaded.")
+}
+
+python do_fetch() {
+    """
+    Update NVD database with json data feed
+    """
+    import bb.utils
+    import bb.progress
+    import shutil
+
+    bb.utils.export_proxies(d)
+
+    db_file = d.getVar("CVE_CHECK_DB_DLDIR_FILE")
+    db_dir = os.path.dirname(db_file)
+    db_tmp_file = d.getVar("CVE_DB_TEMP_FILE")
+
+    cleanup_db_download(db_file, db_tmp_file)
+
+    # The NVD database changes once a day, so no need to update more frequently
+    # Allow the user to force-update
+    try:
+        import time
+        update_interval = int(d.getVar("CVE_DB_UPDATE_INTERVAL"))
+        if update_interval < 0:
+            bb.note("CVE database update skipped")
+            return
+        if time.time() - os.path.getmtime(db_file) < update_interval:
+            bb.debug(2, "Recently updated, skipping")
+            return
+
+    except OSError:
+        pass
+
+    bb.utils.mkdirhier(db_dir)
+    if os.path.exists(db_file):
+        shutil.copy2(db_file, db_tmp_file)
+
+    if update_db_file(db_tmp_file, d) == True:
+        # Update downloaded correctly, can swap files
+        shutil.move(db_tmp_file, db_file)
+    else:
+        # Update failed, do not modify the database
+        bb.note("CVE database update failed")
+        os.remove(db_tmp_file)
+}
+
+do_fetch[lockfiles] += "${CVE_CHECK_DB_DLDIR_LOCK}"
+do_fetch[file-checksums] = ""
+do_fetch[vardeps] = ""
+
+python do_unpack() {
+    import shutil
+    shutil.copyfile(d.getVar("CVE_CHECK_DB_DLDIR_FILE"), d.getVar("CVE_CHECK_DB_FILE"))
+}
+do_unpack[lockfiles] += "${CVE_CHECK_DB_DLDIR_LOCK} ${CVE_CHECK_DB_FILE_LOCK}"
+
+def cleanup_db_download(db_file, db_tmp_file):
+    """
+    Cleanup the download space from possible failed downloads
+    """
+
+    # Clean up the updates done on the main file
+    # Remove it only if a journal file exists - it means a complete re-download
+    if os.path.exists("{0}-journal".format(db_file)):
+        # If a journal is present the last update might have been interrupted. In that case,
+        # just wipe any leftovers and force the DB to be recreated.
+        os.remove("{0}-journal".format(db_file))
+
+        if os.path.exists(db_file):
+            os.remove(db_file)
+
+    # Clean-up the temporary file downloads, we can remove both journal
+    # and the temporary database
+    if os.path.exists("{0}-journal".format(db_tmp_file)):
+        # If a journal is present the last update might have been interrupted. In that case,
+        # just wipe any leftovers and force the DB to be recreated.
+        os.remove("{0}-journal".format(db_tmp_file))
+
+    if os.path.exists(db_tmp_file):
+        os.remove(db_tmp_file)
+
+def db_file_names(d, year, is_nvd):
+    if is_nvd:
+        year_url = d.getVar('NVDCVE_URL') + str(year)
+        meta_url = year_url + ".meta"
+        json_url = year_url + ".json.gz"
+        return json_url, meta_url
+    year_url = d.getVar('FKIE_URL') + str(year)
+    meta_url = year_url + ".meta"
+    json_url = year_url + ".json.xz"
+    return json_url, meta_url
+
+def host_db_name(d, is_nvd):
+    if is_nvd:
+        return "nvd.nist.gov"
+    return "github.com"
+
+def db_decompress(d, data, is_nvd):
+    import gzip, lzma
+
+    if is_nvd:
+        return gzip.decompress(data).decode('utf-8')
+    # otherwise
+    return lzma.decompress(data)
+
+def update_db_file(db_tmp_file, d):
+    """
+    Update the given database file
+    """
+    import bb.utils, bb.progress
+    from datetime import date
+    import urllib, gzip, sqlite3
+
+    YEAR_START = 2002
+    cve_socket_timeout = int(d.getVar("CVE_SOCKET_TIMEOUT"))
+    is_nvd = d.getVar("NVD_DB_VERSION") == "NVD1"
+
+    # Connect to database
+    conn = sqlite3.connect(db_tmp_file)
+    initialize_db(conn)
+
+    with bb.progress.ProgressHandler(d) as ph, open(os.path.join(d.getVar("TMPDIR"), 'cve_check'), 'a') as cve_f:
+        total_years = date.today().year + 1 - YEAR_START
+        for i, year in enumerate(range(YEAR_START, date.today().year + 1)):
+            bb.debug(2, "Updating %d" % year)
+            ph.update((float(i + 1) / total_years) * 100)
+            json_url, meta_url = db_file_names(d, year, is_nvd)
+
+            # Retrieve meta last modified date
+            try:
+                response = urllib.request.urlopen(meta_url, timeout=cve_socket_timeout)
+            except urllib.error.URLError as e:
+                cve_f.write('Warning: CVE db update error, Unable to fetch CVE data.\n\n')
+                bb.warn("Failed to fetch CVE data (%s)" % e)
+                import socket
+                result = socket.getaddrinfo(host_db_name(d, is_nvd), 443, proto=socket.IPPROTO_TCP)
+                bb.warn("Host IPs are %s" % (", ".join(t[4][0] for t in result)))
+                return False
+
+            if response:
+                for l in response.read().decode("utf-8").splitlines():
+                    key, value = l.split(":", 1)
+                    if key == "lastModifiedDate":
+                        last_modified = value
+                        break
+                else:
+                    bb.warn("Cannot parse CVE metadata, update failed")
+                    return False
+
+            # Compare with current db last modified date
+            cursor = conn.execute("select DATE from META where YEAR = ?", (year,))
+            meta = cursor.fetchone()
+            cursor.close()
+
+            if not meta or meta[0] != last_modified:
+                bb.debug(2, "Updating entries")
+                # Clear products table entries corresponding to current year
+                conn.execute("delete from PRODUCTS where ID like ?", ('CVE-%d%%' % year,)).close()
+
+                # Update db with current year json file
+                try:
+                    response = urllib.request.urlopen(json_url, timeout=cve_socket_timeout)
+                    if response:
+                        update_db(d, conn, db_decompress(d, response.read(), is_nvd))
+                    conn.execute("insert or replace into META values (?, ?)", [year, last_modified]).close()
+                except urllib.error.URLError as e:
+                    cve_f.write('Warning: CVE db update error, CVE data is outdated.\n\n')
+                    bb.warn("Cannot parse CVE data (%s), update failed" % e.reason)
+                    return False
+            else:
+                bb.debug(2, "Already up to date (last modified %s)" % last_modified)
+            # Update success, set the date to cve_check file.
+            if year == date.today().year:
+                cve_f.write('CVE database update : %s\n\n' % date.today())
+
+        conn.commit()
+        conn.close()
+        return True
+
+def initialize_db(conn):
+    with conn:
+        c = conn.cursor()
+
+        c.execute("CREATE TABLE IF NOT EXISTS META (YEAR INTEGER UNIQUE, DATE TEXT)")
+
+        c.execute("CREATE TABLE IF NOT EXISTS NVD (ID TEXT UNIQUE, SUMMARY TEXT, \
+            SCOREV2 TEXT, SCOREV3 TEXT, SCOREV4 TEXT, MODIFIED INTEGER, VECTOR TEXT, VECTORSTRING TEXT)")
+
+        c.execute("CREATE TABLE IF NOT EXISTS PRODUCTS (ID TEXT, \
+            VENDOR TEXT, PRODUCT TEXT, VERSION_START TEXT, OPERATOR_START TEXT, \
+            VERSION_END TEXT, OPERATOR_END TEXT)")
+        c.execute("CREATE INDEX IF NOT EXISTS PRODUCT_ID_IDX on PRODUCTS(ID);")
+
+        c.close()
+
+def parse_node_and_insert(conn, node, cveId, is_nvd):
+    # Parse children node if needed
+    for child in node.get('children', ()):
+        parse_node_and_insert(conn, child, cveId, is_nvd)
+
+    def cpe_generator(is_nvd):
+        match_string = "cpeMatch"
+        cpe_string = 'criteria'
+        if is_nvd:
+            match_string = "cpe_match"
+            cpe_string = 'cpe23Uri'
+
+        for cpe in node.get(match_string, ()):
+            if not cpe['vulnerable']:
+                return
+            cpe23 = cpe.get(cpe_string)
+            if not cpe23:
+                return
+            cpe23 = cpe23.split(':')
+            if len(cpe23) < 6:
+                return
+            vendor = cpe23[3]
+            product = cpe23[4]
+            version = cpe23[5]
+
+            if cpe23[6] == '*' or cpe23[6] == '-':
+                version_suffix = ""
+            else:
+                version_suffix = "_" + cpe23[6]
+
+            if version != '*' and version != '-':
+                # Version is defined, this is a '=' match
+                yield [cveId, vendor, product, version + version_suffix, '=', '', '']
+            elif version == '-':
+                # no version information is available
+                yield [cveId, vendor, product, version, '', '', '']
+            else:
+                # Parse start version, end version and operators
+                op_start = ''
+                op_end = ''
+                v_start = ''
+                v_end = ''
+
+                if 'versionStartIncluding' in cpe:
+                    op_start = '>='
+                    v_start = cpe['versionStartIncluding']
+
+                if 'versionStartExcluding' in cpe:
+                    op_start = '>'
+                    v_start = cpe['versionStartExcluding']
+
+                if 'versionEndIncluding' in cpe:
+                    op_end = '<='
+                    v_end = cpe['versionEndIncluding']
+
+                if 'versionEndExcluding' in cpe:
+                    op_end = '<'
+                    v_end = cpe['versionEndExcluding']
+
+                if op_start or op_end or v_start or v_end:
+                    yield [cveId, vendor, product, v_start, op_start, v_end, op_end]
+                else:
+                    # This is no version information, expressed differently.
+                    # Save processing by representing as -.
+                    yield [cveId, vendor, product, '-', '', '', '']
+
+    conn.executemany("insert into PRODUCTS values (?, ?, ?, ?, ?, ?, ?)", cpe_generator(is_nvd)).close()
+
+def update_db_nvdjson(conn, jsondata):
+    import json
+    root = json.loads(jsondata)
+
+    for elt in root['CVE_Items']:
+        if not elt['impact']:
+            continue
+
+        accessVector = None
+        vectorString = None
+        cvssv2 = 0.0
+        cvssv3 = 0.0
+        cvssv4 = 0.0
+        cveId = elt['cve']['CVE_data_meta']['ID']
+        cveDesc = elt['cve']['description']['description_data'][0]['value']
+        date = elt['lastModifiedDate']
+        try:
+            accessVector = elt['impact']['baseMetricV2']['cvssV2']['accessVector']
+            vectorString = elt['impact']['baseMetricV2']['cvssV2']['vectorString']
+            cvssv2 = elt['impact']['baseMetricV2']['cvssV2']['baseScore']
+        except KeyError:
+            cvssv2 = 0.0
+        try:
+            accessVector = accessVector or elt['impact']['baseMetricV3']['cvssV3']['attackVector']
+            vectorString = vectorString or elt['impact']['baseMetricV3']['cvssV3']['vectorString']
+            cvssv3 = elt['impact']['baseMetricV3']['cvssV3']['baseScore']
+        except KeyError:
+            accessVector = accessVector or "UNKNOWN"
+            cvssv3 = 0.0
+
+        conn.execute("insert or replace into NVD values (?, ?, ?, ?, ?, ?, ?, ?)",
+                [cveId, cveDesc, cvssv2, cvssv3, cvssv4, date, accessVector, vectorString]).close()
+
+        configurations = elt['configurations']['nodes']
+        for config in configurations:
+            parse_node_and_insert(conn, config, cveId, True)
+
+def update_db_fkie(conn, jsondata):
+    import json
+    root = json.loads(jsondata)
+
+    for elt in root['cve_items']:
+        if not 'vulnStatus' in elt or elt['vulnStatus'] == 'Rejected':
+            continue
+
+        if not 'configurations' in elt:
+            continue
+
+        accessVector = None
+        vectorString = None
+        cvssv2 = 0.0
+        cvssv3 = 0.0
+        cvssv4 = 0.0
+        cveId = elt['id']
+        cveDesc = elt['descriptions'][0]['value']
+        date = elt['lastModified']
+        try:
+            for m in elt['metrics']['cvssMetricV2']:
+                if m['type'] == 'Primary':
+                    accessVector = m['cvssData']['accessVector']
+                    vectorString = m['cvssData']['vectorString']
+                    cvssv2 = m['cvssData']['baseScore']
+        except KeyError:
+            cvssv2 = 0.0
+        try:
+            for m in elt['metrics']['cvssMetricV30']:
+                if m['type'] == 'Primary':
+                    accessVector = m['cvssData']['accessVector']
+                    vectorString = m['cvssData']['vectorString']
+                    cvssv3 = m['cvssData']['baseScore']
+        except KeyError:
+            accessVector = accessVector or "UNKNOWN"
+            cvssv3 = 0.0
+        try:
+            for m in elt['metrics']['cvssMetricV31']:
+                if m['type'] == 'Primary':
+                    accessVector = m['cvssData']['accessVector']
+                    vectorString = m['cvssData']['vectorString']
+                    cvssv3 = m['cvssData']['baseScore']
+        except KeyError:
+            accessVector = accessVector or "UNKNOWN"
+            cvssv3 = 0.0
+        try:
+            for m in elt['metrics']['cvssMetricV40']:
+                if m['type'] == 'Primary':
+                    accessVector = m['cvssData']['accessVector']
+                    vectorString = m['cvssData']['vectorString']
+                    cvssv4 = m['cvssData']['baseScore']
+        except KeyError:
+            accessVector = accessVector or "UNKNOWN"
+            cvssv4 = 0.0
+
+        conn.execute("insert or replace into NVD values (?, ?, ?, ?, ?, ?, ?, ?)",
+                [cveId, cveDesc, cvssv2, cvssv3, cvssv4, date, accessVector, vectorString]).close()
+
+        for config in elt['configurations']:
+            # This is suboptimal as it doesn't handle AND/OR and negate, but is better than nothing
+            for node in config["nodes"]:
+                parse_node_and_insert(conn, node, cveId, False)
+
+def update_db(d, conn, jsondata):
+    if (d.getVar("NVD_DB_VERSION") == "FKIE"):
+        return update_db_fkie(conn, jsondata)
+    else:
+        return update_db_nvdjson(conn, jsondata)
+
+do_fetch[nostamp] = "1"
+
+EXCLUDE_FROM_WORLD = "1"
diff --git a/meta/recipes-core/meta/cve-update-nvd2-native.bb b/meta/recipes-core/meta/cve-update-nvd2-native.bb
index 1901641965..32a14a932b 100644
--- a/meta/recipes-core/meta/cve-update-nvd2-native.bb
+++ b/meta/recipes-core/meta/cve-update-nvd2-native.bb
@@ -8,7 +8,6 @@ INHIBIT_DEFAULT_DEPS = "1"
 
 inherit native
 
-deltask do_unpack
 deltask do_patch
 deltask do_configure
 deltask do_compile
@@ -35,7 +34,9 @@ CVE_DB_INCR_UPDATE_AGE_THRES ?= "10368000"
 # Number of attempts for each http query to nvd server before giving up
 CVE_DB_UPDATE_ATTEMPTS ?= "5"
 
-CVE_DB_TEMP_FILE ?= "${CVE_CHECK_DB_DIR}/temp_nvdcve_2.db"
+CVE_CHECK_DB_DLDIR_FILE ?= "${DL_DIR}/CVE_CHECK2/${CVE_CHECK_DB_FILENAME}"
+CVE_CHECK_DB_DLDIR_LOCK ?= "${CVE_CHECK_DB_DLDIR_FILE}.lock"
+CVE_CHECK_DB_TEMP_FILE ?= "${CVE_CHECK_DB_FILE}.tmp"
 
 python () {
     if not bb.data.inherits_class("cve-check", d):
@@ -52,9 +53,9 @@ python do_fetch() {
 
     bb.utils.export_proxies(d)
 
-    db_file = d.getVar("CVE_CHECK_DB_FILE")
+    db_file = d.getVar("CVE_CHECK_DB_DLDIR_FILE")
     db_dir = os.path.dirname(db_file)
-    db_tmp_file = d.getVar("CVE_DB_TEMP_FILE")
+    db_tmp_file = d.getVar("CVE_CHECK_DB_TEMP_FILE")
 
     cleanup_db_download(db_file, db_tmp_file)
     # By default let's update the whole database (since time 0)
@@ -67,6 +68,8 @@ python do_fetch() {
         update_interval = int(d.getVar("CVE_DB_UPDATE_INTERVAL"))
         if update_interval < 0:
             bb.note("CVE database update skipped")
+            if not os.path.exists(db_file):
+                bb.error("CVE database %s not present, database fetch/update skipped" % db_file)
             return
         if time.time() - os.path.getmtime(db_file) < update_interval:
             bb.note("CVE database recently updated, skipping")
@@ -76,7 +79,11 @@ python do_fetch() {
     except OSError:
         pass
 
+    if bb.utils.to_boolean(d.getVar("BB_NO_NETWORK")):
+        bb.error("BB_NO_NETWORK attempted to disable fetch, this recipe uses CVE_DB_UPDATE_INTERVAL to control download, set to '-1' to disable fetch or update")
+
     bb.utils.mkdirhier(db_dir)
+    bb.utils.mkdirhier(os.path.dirname(db_tmp_file))
     if os.path.exists(db_file):
         shutil.copy2(db_file, db_tmp_file)
 
@@ -89,10 +96,16 @@ python do_fetch() {
         os.remove(db_tmp_file)
 }
 
-do_fetch[lockfiles] += "${CVE_CHECK_DB_FILE_LOCK}"
+do_fetch[lockfiles] += "${CVE_CHECK_DB_DLDIR_LOCK}"
 do_fetch[file-checksums] = ""
 do_fetch[vardeps] = ""
 
+python do_unpack() {
+    import shutil
+    shutil.copyfile(d.getVar("CVE_CHECK_DB_DLDIR_FILE"), d.getVar("CVE_CHECK_DB_FILE"))
+}
+do_unpack[lockfiles] += "${CVE_CHECK_DB_DLDIR_LOCK} ${CVE_CHECK_DB_FILE_LOCK}"
+
 def cleanup_db_download(db_file, db_tmp_file):
     """
     Cleanup the download space from possible failed downloads
@@ -216,6 +229,11 @@ def update_db_file(db_tmp_file, d, database_time):
                 # We haven't managed to download data
                 return False
 
+            # hack for json5 style responses
+            if raw_data[-3:] == ',]}':
+                bb.note("Removing trailing ',' from nvd response")
+                raw_data = raw_data[:-3] + ']}'
+
             data = json.loads(raw_data)
 
             index = data["startIndex"]
@@ -247,7 +265,7 @@ def initialize_db(conn):
         c.execute("CREATE TABLE IF NOT EXISTS META (YEAR INTEGER UNIQUE, DATE TEXT)")
 
         c.execute("CREATE TABLE IF NOT EXISTS NVD (ID TEXT UNIQUE, SUMMARY TEXT, \
-            SCOREV2 TEXT, SCOREV3 TEXT, MODIFIED INTEGER, VECTOR TEXT, VECTORSTRING TEXT)")
+            SCOREV2 TEXT, SCOREV3 TEXT, SCOREV4 TEXT, MODIFIED INTEGER, VECTOR TEXT, VECTORSTRING TEXT)")
 
         c.execute("CREATE TABLE IF NOT EXISTS PRODUCTS (ID TEXT, \
             VENDOR TEXT, PRODUCT TEXT, VERSION_START TEXT, OPERATOR_START TEXT, \
@@ -323,7 +341,7 @@ def update_db(conn, elt):
     accessVector = None
     vectorString = None
     cveId = elt['cve']['id']
-    if elt['cve']['vulnStatus'] ==  "Rejected":
+    if elt['cve'].get('vulnStatus') ==  "Rejected":
         c = conn.cursor()
         c.execute("delete from PRODUCTS where ID = ?;", [cveId])
         c.execute("delete from NVD where ID = ?;", [cveId])
@@ -353,12 +371,18 @@ def update_db(conn, elt):
         cvssv3 = cvssv3 or elt['cve']['metrics']['cvssMetricV31'][0]['cvssData']['baseScore']
     except KeyError:
         pass
+    cvssv3 = cvssv3 or 0.0
+    try:
+        accessVector = accessVector or elt['cve']['metrics']['cvssMetricV40'][0]['cvssData']['attackVector']
+        vectorString = vectorString or elt['cve']['metrics']['cvssMetricV40'][0]['cvssData']['vectorString']
+        cvssv4 = elt['cve']['metrics']['cvssMetricV40'][0]['cvssData']['baseScore']
+    except KeyError:
+        cvssv4 = 0.0
     accessVector = accessVector or "UNKNOWN"
     vectorString = vectorString or "UNKNOWN"
-    cvssv3 = cvssv3 or 0.0
 
-    conn.execute("insert or replace into NVD values (?, ?, ?, ?, ?, ?, ?)",
-                [cveId, cveDesc, cvssv2, cvssv3, date, accessVector, vectorString]).close()
+    conn.execute("insert or replace into NVD values (?, ?, ?, ?, ?, ?, ?, ?)",
+                [cveId, cveDesc, cvssv2, cvssv3, cvssv4, date, accessVector, vectorString]).close()
 
     try:
         # Remove any pre-existing CVE configuration. Even for partial database
diff --git a/meta/recipes-core/meta/meta-environment.bb b/meta/recipes-core/meta/meta-environment.bb
index 65436bc3e6..e259099313 100644
--- a/meta/recipes-core/meta/meta-environment.bb
+++ b/meta/recipes-core/meta/meta-environment.bb
@@ -70,7 +70,7 @@ do_install() {
 
 PN = "meta-environment-${MACHINE}"
 PACKAGES = "${PN}"
-FILES:${PN}= " \
+FILES:${PN} = " \
     ${SDKPATH}/* \
     "
 
diff --git a/meta/recipes-core/meta/meta-ide-support.bb b/meta/recipes-core/meta/meta-ide-support.bb
index d85aa120c0..7ed422ce4d 100644
--- a/meta/recipes-core/meta/meta-ide-support.bb
+++ b/meta/recipes-core/meta/meta-ide-support.bb
@@ -1,6 +1,7 @@
 SUMMARY = "Integrated Development Environment support"
 DESCRIPTION = "Meta package for ensuring the build directory contains all appropriate toolchain packages for using an IDE"
 LICENSE = "MIT"
+PACKAGE_ARCH = "${MACHINE_ARCH}"
 
 DEPENDS = "virtual/libc gdb-cross-${TARGET_ARCH} qemu-native qemu-helper-native unfs3-native cmake-native autoconf-native automake-native meson-native intltool-native pkgconfig-native"
 RM_WORK_EXCLUDE += "${PN}"
diff --git a/meta/recipes-core/meta/meta-toolchain.bb b/meta/recipes-core/meta/meta-toolchain.bb
index 260e03934e..1b108f0a1c 100644
--- a/meta/recipes-core/meta/meta-toolchain.bb
+++ b/meta/recipes-core/meta/meta-toolchain.bb
@@ -1,5 +1,4 @@
 SUMMARY = "Meta package for building a installable toolchain"
 LICENSE = "MIT"
 
-
 inherit populate_sdk
diff --git a/meta/recipes-core/meta/meta-world-pkgdata.bb b/meta/recipes-core/meta/meta-world-pkgdata.bb
index 0438bf6138..1bfaf2c1e3 100644
--- a/meta/recipes-core/meta/meta-world-pkgdata.bb
+++ b/meta/recipes-core/meta/meta-world-pkgdata.bb
@@ -27,14 +27,13 @@ python do_collect_packagedata() {
     oe.copy_buildsystem.generate_locked_sigs(sigfile, d)
 }
 
+inherit nospdx nopackages
 deltask do_fetch
 deltask do_unpack
 deltask do_patch
 deltask do_configure
 deltask do_compile
 deltask do_install
-deltask do_create_spdx
-deltask do_create_spdx_runtime
 
 do_prepare_recipe_sysroot[deptask] = ""
 
diff --git a/meta/recipes-core/meta/nativesdk-buildtools-perl-dummy.bb b/meta/recipes-core/meta/nativesdk-buildtools-perl-dummy.bb
index bb4e746237..0ba1ca6e42 100644
--- a/meta/recipes-core/meta/nativesdk-buildtools-perl-dummy.bb
+++ b/meta/recipes-core/meta/nativesdk-buildtools-perl-dummy.bb
@@ -2,6 +2,7 @@ DUMMYARCH = "buildtools-dummy-${SDKPKGSUFFIX}"
 
 DUMMYPROVIDES_PACKAGES = "\
     nativesdk-perl \
+    nativesdk-perl-dev \
     nativesdk-libxml-parser-perl \
     nativesdk-perl-module-bytes \
     nativesdk-perl-module-carp \
@@ -9,6 +10,7 @@ DUMMYPROVIDES_PACKAGES = "\
     nativesdk-perl-module-data-dumper \
     nativesdk-perl-module-errno \
     nativesdk-perl-module-exporter \
+    nativesdk-perl-module-feature \
     nativesdk-perl-module-file-basename \
     nativesdk-perl-module-file-compare \
     nativesdk-perl-module-file-copy \
@@ -16,15 +18,18 @@ DUMMYPROVIDES_PACKAGES = "\
     nativesdk-perl-module-file-glob \
     nativesdk-perl-module-file-path \
     nativesdk-perl-module-file-spec \
+    nativesdk-perl-module-file-spec-unix \
     nativesdk-perl-module-file-stat \
     nativesdk-perl-module-file-temp \
     nativesdk-perl-module-getopt-long \
+    nativesdk-perl-module-integer \
     nativesdk-perl-module-io-file \
     nativesdk-perl-module-list-util \
     nativesdk-perl-module-overloading \
     nativesdk-perl-module-posix \
     nativesdk-perl-module-scalar-util \
     nativesdk-perl-module-strict \
+    nativesdk-perl-module-symbol \
     nativesdk-perl-module-text-parsewords \
     nativesdk-perl-module-thread-queue \
     nativesdk-perl-module-threads \
@@ -36,7 +41,6 @@ DUMMYPROVIDES = "\
     /usr/bin/perl \
     "
 
-
 require dummy-sdk-package.inc
 
 inherit nativesdk
diff --git a/meta/recipes-core/meta/signing-keys.bb b/meta/recipes-core/meta/signing-keys.bb
index 107a39d658..94f4032911 100644
--- a/meta/recipes-core/meta/signing-keys.bb
+++ b/meta/recipes-core/meta/signing-keys.bb
@@ -4,7 +4,6 @@
 SUMMARY = "Makes public keys of the signing keys available"
 LICENSE = "MIT"
 
-
 inherit allarch deploy
 
 EXCLUDE_FROM_WORLD = "1"
diff --git a/meta/recipes-core/meta/uninative-tarball.bb b/meta/recipes-core/meta/uninative-tarball.bb
index 7eebcaf11a..0dbc698ccd 100644
--- a/meta/recipes-core/meta/uninative-tarball.bb
+++ b/meta/recipes-core/meta/uninative-tarball.bb
@@ -51,13 +51,14 @@ fakeroot create_sdk_files() {
         sed -i -e "s:##DEFAULT_INSTALL_DIR##:$escaped_sdkpath:" ${SDK_OUTPUT}/${SDKPATH}/relocate_sdk.py
 }
 
-
 fakeroot archive_sdk() {
         cd ${SDK_OUTPUT}/${SDKPATH}
 
         DEST="./${SDK_ARCH}-${SDK_OS}"
         mv sysroots/${SDK_SYS} $DEST
         rm sysroots -rf
+        # There is a check in meta/files/toolchain-shar-extract.sh -- make sure to
+        # keep that check up to date if changing the `1024`
         patchelf --set-interpreter ${@''.join('a' for n in range(1024))} $DEST/usr/bin/patchelf
         mv $DEST/usr/bin/patchelf $DEST/usr/bin/patchelf-uninative
         ${SDK_ARCHIVE_CMD}
diff --git a/meta/recipes-core/meta/wic-tools.bb b/meta/recipes-core/meta/wic-tools.bb
index 76494e7fca..fa983ed5f1 100644
--- a/meta/recipes-core/meta/wic-tools.bb
+++ b/meta/recipes-core/meta/wic-tools.bb
@@ -7,7 +7,7 @@ DEPENDS = "\
            mtools-native bmaptool-native grub-native cdrtools-native \
            btrfs-tools-native squashfs-tools-native pseudo-native \
            e2fsprogs-native util-linux-native tar-native erofs-utils-native \
-           virtual/${TARGET_PREFIX}binutils \
+           virtual/cross-binutils \
            "
 DEPENDS:append:x86 = " syslinux-native syslinux grub-efi systemd-boot"
 DEPENDS:append:x86-64 = " syslinux-native syslinux grub-efi systemd-boot"
diff --git a/meta/recipes-core/musl/bsd-headers.bb b/meta/recipes-core/musl/bsd-headers.bb
index 887a816031..ad9ba81e4f 100644
--- a/meta/recipes-core/musl/bsd-headers.bb
+++ b/meta/recipes-core/musl/bsd-headers.bb
@@ -15,7 +15,7 @@ do_compile[noexec] = "1"
 
 INHIBIT_DEFAULT_DEPS = "1"
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 do_install() {
         install -Dm 0644 ${S}/sys-queue.h ${D}${includedir}/sys/queue.h
diff --git a/meta/recipes-core/musl/gcompat_git.bb b/meta/recipes-core/musl/gcompat_git.bb
index 40fe8c6a5f..6f9710e71a 100644
--- a/meta/recipes-core/musl/gcompat_git.bb
+++ b/meta/recipes-core/musl/gcompat_git.bb
@@ -16,8 +16,6 @@ SRC_URI:append:powerpc = "\
 PV = "1.1.0"
 SRCREV = "b7bfe0b08c52fdc72e0c1d9d4dcb2129f1642bd6"
 
-S = "${WORKDIR}/git"
-
 inherit pkgconfig linuxloader siteinfo
 
 DEPENDS += "musl-obstack"
diff --git a/meta/recipes-core/musl/libc-test_git.bb b/meta/recipes-core/musl/libc-test_git.bb
index 619a959fd2..71a111cfa4 100644
--- a/meta/recipes-core/musl/libc-test_git.bb
+++ b/meta/recipes-core/musl/libc-test_git.bb
@@ -18,8 +18,6 @@ SRC_URI = " \
 
 PV = "0+git"
 
-S = "${WORKDIR}/git"
-
 # libc-test 'make' or 'make run' command is designed to build and run tests. It
 # reports both build and test failures. The commands should be run on target.
 do_compile() {
@@ -50,7 +48,7 @@ do_install () {
 }
 
 do_install_ptest_base:append() {
-    install -Dm 0755 ${WORKDIR}/run-libc-ptests ${D}${PTEST_PATH}/run-libc-ptests
+    install -Dm 0755 ${UNPACKDIR}/run-libc-ptests ${D}${PTEST_PATH}/run-libc-ptests
 }
 
 COMPATIBLE_HOST = "null"
diff --git a/meta/recipes-core/musl/libssp-nonshared.bb b/meta/recipes-core/musl/libssp-nonshared.bb
index 3faf8f00c3..4bcbaef7ea 100644
--- a/meta/recipes-core/musl/libssp-nonshared.bb
+++ b/meta/recipes-core/musl/libssp-nonshared.bb
@@ -11,13 +11,13 @@ SRC_URI = "file://stack_chk.c"
 
 INHIBIT_DEFAULT_DEPS = "1"
 
-DEPENDS = "virtual/${TARGET_PREFIX}binutils \
-           virtual/${TARGET_PREFIX}gcc \
+DEPENDS = "virtual/cross-binutils \
+           virtual/cross-cc \
 "
 
 do_configure[noexec] = "1"
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 do_compile() {
         ${CC} ${CPPFLAGS} ${CFLAGS} -fPIE -c stack_chk.c -o stack_chk.o
diff --git a/meta/recipes-core/musl/libucontext_1.2.bb b/meta/recipes-core/musl/libucontext_1.3.2.bb
index 4e34df1439..c5b802207b 100644
--- a/meta/recipes-core/musl/libucontext_1.2.bb
+++ b/meta/recipes-core/musl/libucontext_1.3.2.bb
@@ -8,12 +8,10 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=ebea527af0602d509b7f4c49533fb1bd"
 SECTION = "libs"
 DEPENDS = ""
 
-SRCREV = "4dde3417b4bb4b1b1545bd913be337680b5e28c3"
+SRCREV = "a0323579ac50b9a9d4033754d089f1fed0f59a00"
 SRC_URI = "git://github.com/kaniini/libucontext;branch=master;protocol=https \
            "
 
-S = "${WORKDIR}/git"
-
 COMPATIBLE_HOST = ".*-musl.*"
 
 valid_archs = " \
@@ -50,3 +48,9 @@ def map_kernel_arch(a, d):
 
 EXTRA_OEMESON = "-Dcpu=${@map_kernel_arch(d.getVar('TARGET_ARCH'), d)}"
 inherit meson
+
+ARM_TARGET_CPPFLAGS = ""
+ARM_TARGET_CPPFLAGS:append:arm = "${@bb.utils.contains('TARGET_FPU', 'hard', ' -DFORCE_HARD_FLOAT', '', d)}"
+ARM_TARGET_CPPFLAGS:append:arm = "${@bb.utils.contains('TARGET_FPU', 'soft', ' -DFORCE_SOFT_FLOAT', '', d)}"
+
+TARGET_CPPFLAGS .= "${ARM_TARGET_CPPFLAGS}"
diff --git a/meta/recipes-core/musl/musl-legacy-error.bb b/meta/recipes-core/musl/musl-legacy-error.bb
index 5ce5a233ab..b40075c0b6 100644
--- a/meta/recipes-core/musl/musl-legacy-error.bb
+++ b/meta/recipes-core/musl/musl-legacy-error.bb
@@ -13,7 +13,7 @@ do_compile[noexec] = "1"
 
 INHIBIT_DEFAULT_DEPS = "1"
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 do_install() {
         install -Dm 0644 ${S}/error.h -t ${D}${includedir}
diff --git a/meta/recipes-core/musl/musl-locales_git.bb b/meta/recipes-core/musl/musl-locales_git.bb
index 1373c60daf..c8510596cf 100644
--- a/meta/recipes-core/musl/musl-locales_git.bb
+++ b/meta/recipes-core/musl/musl-locales_git.bb
@@ -12,8 +12,6 @@ SRC_URI = "git://git.adelielinux.org/adelie/musl-locales;protocol=https;branch=m
 PV = "1.0+git"
 SRCREV = "5663f5bfd30bf9e1e0ba3fc5fe2da6725969f30e"
 
-S = "${WORKDIR}/git"
-
 DEPENDS = "virtual/libintl gettext-native"
 
 PROVIDES = "virtual/libc-locale"
@@ -82,4 +80,21 @@ FILES:locale-base-ru-ru += "${datadir}/i18n/locales/musl/ru_RU.UTF-8"
 FILES:locale-base-sr-rs += "${datadir}/i18n/locales/musl/sr_RS.UTF-8"
 FILES:locale-base-sv-se += "${datadir}/i18n/locales/musl/sv_SE.UTF-8"
 
+RRECOMMENDS:locale-base-cs-cz += "${PN}"
+RRECOMMENDS:locale-base-de-ch += "${PN}"
+RRECOMMENDS:locale-base-de-de += "${PN}"
+RRECOMMENDS:locale-base-en-gb += "${PN}"
+RRECOMMENDS:locale-base-en-us += "${PN}"
+RRECOMMENDS:locale-base-es-es += "${PN}"
+RRECOMMENDS:locale-base-fi-fi += "${PN}"
+RRECOMMENDS:locale-base-fr-ca += "${PN}"
+RRECOMMENDS:locale-base-fr-fr += "${PN}"
+RRECOMMENDS:locale-base-it-it += "${PN}"
+RRECOMMENDS:locale-base-nb-no += "${PN}"
+RRECOMMENDS:locale-base-nl-nl += "${PN}"
+RRECOMMENDS:locale-base-pt-br += "${PN}"
+RRECOMMENDS:locale-base-ru-ru += "${PN}"
+RRECOMMENDS:locale-base-sr-sr += "${PN}"
+RRECOMMENDS:locale-base-sv-se += "${PN}"
+
 UPSTREAM_CHECK_COMMITS = "1"
diff --git a/meta/recipes-core/musl/musl-obstack.bb b/meta/recipes-core/musl/musl-obstack.bb
index 4c71a141b2..d8a5ae8d82 100644
--- a/meta/recipes-core/musl/musl-obstack.bb
+++ b/meta/recipes-core/musl/musl-obstack.bb
@@ -16,7 +16,5 @@ UPSTREAM_CHECK_COMMITS = "1"
 
 inherit autotools pkgconfig
 
-S = "${WORKDIR}/git"
-
 COMPATIBLE_HOST = ".*-musl.*"
 
diff --git a/meta/recipes-core/musl/musl-utils.bb b/meta/recipes-core/musl/musl-utils.bb
index 8280333daf..4b685640c8 100644
--- a/meta/recipes-core/musl/musl-utils.bb
+++ b/meta/recipes-core/musl/musl-utils.bb
@@ -17,8 +17,6 @@ UPSTREAM_CHECK_COMMITS = "1"
 
 inherit autotools
 
-S = "${WORKDIR}/git"
-
 PACKAGES =+ "${PN}-iconv"
 
 FILES:${PN}-iconv = "${bindir}/iconv"
diff --git a/meta/recipes-core/musl/musl.inc b/meta/recipes-core/musl/musl.inc
index 6ca52b186a..ce45de2d23 100644
--- a/meta/recipes-core/musl/musl.inc
+++ b/meta/recipes-core/musl/musl.inc
@@ -9,7 +9,7 @@ standards-conformance and safety."
 HOMEPAGE = "http://www.musl-libc.org/"
 LICENSE = "MIT"
 SECTION = "libs"
-LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=b03f1cc25363d094011f8f4fd8bcfb68"
+LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=0c2904cdc34777fb4067732bae145506"
 
 INHIBIT_DEFAULT_DEPS = "1"
 
@@ -25,10 +25,13 @@ MIPS_INSTRUCTION_SET = "mips"
 ARM_INSTRUCTION_SET:armv5 = "arm"
 ARM_INSTRUCTION_SET:armv4 = "arm"
 
-# 1.2.4 doesn't support riscv32
-COMPATIBLE_HOST:riscv32 = "null"
-
 # Enable out of tree build
 B = "${WORKDIR}/build"
 
 do_configure[cleandirs] = "${B}"
+
+python () {
+    multilibs = d.getVar("MULTILIBS")
+    if multilibs:
+        raise bb.parse.SkipRecipe("musl is not compatible with multilibs")
+}
diff --git a/meta/recipes-core/musl/musl/0001-Make-dynamic-linker-a-relative-symlink-to-libc.patch b/meta/recipes-core/musl/musl/0001-Make-dynamic-linker-a-relative-symlink-to-libc.patch
index 8b097f3276..06ab27f0eb 100644
--- a/meta/recipes-core/musl/musl/0001-Make-dynamic-linker-a-relative-symlink-to-libc.patch
+++ b/meta/recipes-core/musl/musl/0001-Make-dynamic-linker-a-relative-symlink-to-libc.patch
@@ -1,4 +1,4 @@
-From f95b6fd0475a95c00e886219271cb5c93838e3c3 Mon Sep 17 00:00:00 2001
+From 665ecc610c261d5e98710aa0c6ccf6e4991eaf58 Mon Sep 17 00:00:00 2001
 From: Amarnath Valluri <amarnath.valluri@intel.com>
 Date: Wed, 18 Jan 2017 16:14:37 +0200
 Subject: [PATCH 1/2] Make dynamic linker a relative symlink to libc
@@ -35,7 +35,7 @@ index e8cc4436..466d9afd 100644
  install-libs: $(ALL_LIBS:lib/%=$(DESTDIR)$(libdir)/%) $(if $(SHARED_LIBS),$(DESTDIR)$(LDSO_PATHNAME),)
  
 diff --git a/tools/install.sh b/tools/install.sh
-index d913b60b..b6a7f797 100755
+index 855a8ca2..a2e6a5eb 100755
 --- a/tools/install.sh
 +++ b/tools/install.sh
 @@ -6,18 +6,20 @@
@@ -61,15 +61,15 @@ index d913b60b..b6a7f797 100755
  m) mode=$OPTARG ;;
  ?) usage ;;
  esac
-@@ -48,7 +50,7 @@ trap 'rm -f "$tmp"' EXIT INT QUIT TERM HUP
- umask 077
+@@ -49,7 +51,7 @@ umask 077
  
  if test "$symlink" ; then
+ umask 000
 -ln -s "$1" "$tmp"
 +ln $symlinkflags "$1" "$tmp"
+ umask 077
  else
  cat < "$1" > "$tmp"
- chmod "$mode" "$tmp"
 -- 
-2.37.2
+2.43.0
 
diff --git a/meta/recipes-core/musl/musl/0001-Update-syscalls-for-r32-rv64-from-kernel-6.4-through.patch b/meta/recipes-core/musl/musl/0001-Update-syscalls-for-r32-rv64-from-kernel-6.4-through.patch
new file mode 100644
index 0000000000..78ba903ca6
--- /dev/null
+++ b/meta/recipes-core/musl/musl/0001-Update-syscalls-for-r32-rv64-from-kernel-6.4-through.patch
@@ -0,0 +1,70 @@
+From 31dce8e958f5185e7fda653214da12bbc75f244e Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Wed, 4 Dec 2024 11:16:43 -0800
+Subject: [PATCH] Update syscalls for r32/rv64 from kernel 6.4 through 6.10
+
+Upstream-Status: Submitted [https://www.openwall.com/lists/musl/2024/12/04/3]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ arch/riscv32/bits/syscall.h.in | 11 +++++++++++
+ arch/riscv64/bits/syscall.h.in | 11 +++++++++++
+ 2 files changed, 22 insertions(+)
+
+diff --git a/arch/riscv32/bits/syscall.h.in b/arch/riscv32/bits/syscall.h.in
+index 9228d840..a54d9ffc 100644
+--- a/arch/riscv32/bits/syscall.h.in
++++ b/arch/riscv32/bits/syscall.h.in
+@@ -216,6 +216,7 @@
+ #define __NR_perf_event_open 241
+ #define __NR_accept4 242
+ #define __NR_arch_specific_syscall 244
++#define __NR_riscv_hwprobe 258
+ #define __NR_prlimit64 261
+ #define __NR_fanotify_init 262
+ #define __NR_fanotify_mark 263
+@@ -295,6 +296,16 @@
+ #define __NR_cachestat         451
+ #define __NR_fchmodat2         452
+ #define __NR_futex __NR_futex_time64
++#define __NR_map_shadow_stack 453
++#define __NR_futex_wake 454
++#define __NR_futex_wait 455
++#define __NR_futex_requeue 456
++#define __NR_statmount 457
++#define __NR_listmount 458
++#define __NR_lsm_get_self_attr 459
++#define __NR_lsm_list_modules 461
++#define __NR_lsm_set_self_attr 460
++#define __NR_mseal 462
+ 
+ #define __NR_sysriscv __NR_arch_specific_syscall
+ #define __NR_riscv_flush_icache (__NR_sysriscv + 15)
+diff --git a/arch/riscv64/bits/syscall.h.in b/arch/riscv64/bits/syscall.h.in
+index e362bd0e..6991a89c 100644
+--- a/arch/riscv64/bits/syscall.h.in
++++ b/arch/riscv64/bits/syscall.h.in
+@@ -242,6 +242,7 @@
+ #define __NR_accept4 242
+ #define __NR_recvmmsg 243
+ #define __NR_arch_specific_syscall 244
++#define __NR_riscv_hwprobe 258
+ #define __NR_wait4 260
+ #define __NR_prlimit64 261
+ #define __NR_fanotify_init 262
+@@ -304,6 +305,16 @@
+ #define __NR_set_mempolicy_home_node   450
+ #define __NR_cachestat         451
+ #define __NR_fchmodat2         452
++#define __NR_map_shadow_stack 453
++#define __NR_futex_wake 454
++#define __NR_futex_wait 455
++#define __NR_futex_requeue 456
++#define __NR_statmount 457
++#define __NR_listmount 458
++#define __NR_lsm_get_self_attr 459
++#define __NR_lsm_list_modules 461
++#define __NR_lsm_set_self_attr 460
++#define __NR_mseal 462
+ 
+ #define __NR_sysriscv __NR_arch_specific_syscall
+ #define __NR_riscv_flush_icache (__NR_sysriscv + 15)
diff --git a/meta/recipes-core/musl/musl/0002-ldso-Use-syslibdir-and-libdir-as-default-pathes-to-l.patch b/meta/recipes-core/musl/musl/0002-ldso-Use-syslibdir-and-libdir-as-default-pathes-to-l.patch
index 59bfae5a27..04630b32ee 100644
--- a/meta/recipes-core/musl/musl/0002-ldso-Use-syslibdir-and-libdir-as-default-pathes-to-l.patch
+++ b/meta/recipes-core/musl/musl/0002-ldso-Use-syslibdir-and-libdir-as-default-pathes-to-l.patch
@@ -1,4 +1,4 @@
-From 3cce8716c6c3ae2e0c835caeac3780ec35090b2d Mon Sep 17 00:00:00 2001
+From e27de983ef70257ca1fd7f5096eea41613612ecf Mon Sep 17 00:00:00 2001
 From: Serhey Popovych <serhe.popovych@gmail.com>
 Date: Tue, 11 Dec 2018 05:44:20 -0500
 Subject: [PATCH 2/2] ldso: Use syslibdir and libdir as default pathes to
@@ -36,10 +36,10 @@ index 466d9afd..d2f458fa 100644
  
  LDFLAGS_ALL = $(LDFLAGS_AUTO) $(LDFLAGS)
 diff --git a/ldso/dynlink.c b/ldso/dynlink.c
-index cc677952..b0e8815b 100644
+index 324aa859..7d3ab44c 100644
 --- a/ldso/dynlink.c
 +++ b/ldso/dynlink.c
-@@ -29,6 +29,8 @@
+@@ -35,6 +35,8 @@ static size_t ldso_page_size;
  #define realloc __libc_realloc
  #define free __libc_free
  
@@ -48,7 +48,7 @@ index cc677952..b0e8815b 100644
  static void error_impl(const char *, ...);
  static void error_noop(const char *, ...);
  static void (*error)(const char *, ...) = error_noop;
-@@ -1097,7 +1099,7 @@ static struct dso *load_library(const char *name, struct dso *needed_by)
+@@ -1159,7 +1161,7 @@ static struct dso *load_library(const char *name, struct dso *needed_by)
                                         sys_path = "";
                                 }
                         }
@@ -58,5 +58,5 @@ index cc677952..b0e8815b 100644
                 }
                 pathname = buf;
 -- 
-2.37.2
+2.43.0
 
diff --git a/meta/recipes-core/musl/musl/0003-elf.h-add-typedefs-for-Elf64_Relr-and-Elf32_Relr.patch b/meta/recipes-core/musl/musl/0003-elf.h-add-typedefs-for-Elf64_Relr-and-Elf32_Relr.patch
deleted file mode 100644
index 45d40cd5b4..0000000000
--- a/meta/recipes-core/musl/musl/0003-elf.h-add-typedefs-for-Elf64_Relr-and-Elf32_Relr.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 65b0ac0d998bf0f36924a7c27ed9e702b2a5a453 Mon Sep 17 00:00:00 2001
-From: Violet Purcell <vimproved@inventati.org>
-Date: Sat, 4 Nov 2023 12:09:20 -0400
-Subject: [PATCH] elf.h: add typedefs for Elf64_Relr and Elf32_Relr
-
-These were overlooked when DT_RELR was added in commit
-d32dadd60efb9d3b255351a3b532f8e4c3dd0db1, potentially breaking
-software that treats presence of the DT_RELR macro as implying they
-exist.
-
-Upstream-Status: Backport [1.2.5]
-
-Signed-off-by: Zang Ruochen <zangruochen@loongson.cn>
-
----
- include/elf.h | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/include/elf.h b/include/elf.h
-index 23f2c4bc..72d17c3a 100644
---- a/include/elf.h
-+++ b/include/elf.h
-@@ -558,6 +558,11 @@ typedef struct {
- 
- 
- 
-+typedef Elf32_Word Elf32_Relr;
-+typedef Elf64_Xword Elf64_Relr;
-+
-+
-+
- #define ELF32_R_SYM(val)               ((val) >> 8)
- #define ELF32_R_TYPE(val)              ((val) & 0xff)
- #define ELF32_R_INFO(sym, type)                (((sym) << 8) + ((type) & 0xff))
--- 
-2.25.1
-
diff --git a/meta/recipes-core/musl/musl_git.bb b/meta/recipes-core/musl/musl_git.bb
index 324269a968..51e429b093 100644
--- a/meta/recipes-core/musl/musl_git.bb
+++ b/meta/recipes-core/musl/musl_git.bb
@@ -4,24 +4,22 @@
 require musl.inc
 inherit linuxloader
 
-SRCREV = "79bdacff83a6bd5b70ff5ae5eb8b6de82c2f7c30"
+SRCREV = "ae3a8c93a663b553e65f096498937083dad210d2"
 
-BASEVER = "1.2.4"
+BASEVER = "1.2.5"
 
 PV = "${BASEVER}+git"
 
-SRC_URI = "git://git.etalabs.net/git/musl;branch=master;protocol=https \
+SRC_URI = "git://git.musl-libc.org/musl;branch=master \
            file://0001-Make-dynamic-linker-a-relative-symlink-to-libc.patch \
            file://0002-ldso-Use-syslibdir-and-libdir-as-default-pathes-to-l.patch \
-           file://0003-elf.h-add-typedefs-for-Elf64_Relr-and-Elf32_Relr.patch \
+           file://0001-Update-syscalls-for-r32-rv64-from-kernel-6.4-through.patch \
           "
 
-S = "${WORKDIR}/git"
-
 PROVIDES += "virtual/libc virtual/libiconv virtual/libintl virtual/crypt"
 
-DEPENDS = "virtual/${TARGET_PREFIX}binutils \
-           virtual/${TARGET_PREFIX}gcc \
+DEPENDS = "virtual/cross-binutils \
+           virtual/cross-cc \
            libgcc-initial \
            linux-libc-headers \
            bsd-headers \
@@ -30,7 +28,7 @@ DEPENDS = "virtual/${TARGET_PREFIX}binutils \
 GLIBC_LDSO = "${@get_glibc_loader(d)}"
 MUSL_LDSO_ARCH = "${@get_musl_loader_arch(d)}"
 
-export CROSS_COMPILE="${TARGET_PREFIX}"
+export CROSS_COMPILE = "${TARGET_PREFIX}"
 
 LDFLAGS += "-Wl,-soname,libc.so"
 
diff --git a/meta/recipes-core/ncurses/files/0001-Fix-CVE-2023-29491.patch b/meta/recipes-core/ncurses/files/0001-Fix-CVE-2023-29491.patch
deleted file mode 100644
index 1232c8c2a8..0000000000
--- a/meta/recipes-core/ncurses/files/0001-Fix-CVE-2023-29491.patch
+++ /dev/null
@@ -1,462 +0,0 @@
-From 3d54a41f12e9aa059f06e66e72d872f2283395b6 Mon Sep 17 00:00:00 2001
-From: Chen Qi <Qi.Chen@windriver.com>
-Date: Sun, 30 Jul 2023 21:14:00 -0700
-Subject: [PATCH] Fix CVE-2023-29491
-
-CVE: CVE-2023-29491
-
-Upstream-Status: Backport [http://ncurses.scripts.mit.edu/?p=ncurses.git;a=commitdiff;h=eb51b1ea1f75a0ec17c9c5937cb28df1e8eeec56]
-
-Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
----
- ncurses/tinfo/lib_tgoto.c  |  10 +++-
- ncurses/tinfo/lib_tparm.c  | 116 ++++++++++++++++++++++++++++++++-----
- ncurses/tinfo/read_entry.c |   3 +
- progs/tic.c                |   6 ++
- progs/tparm_type.c         |   9 +++
- progs/tparm_type.h         |   2 +
- progs/tput.c               |  61 ++++++++++++++++---
- 7 files changed, 185 insertions(+), 22 deletions(-)
-
-diff --git a/ncurses/tinfo/lib_tgoto.c b/ncurses/tinfo/lib_tgoto.c
-index 9cf5e100..c50ed4df 100644
---- a/ncurses/tinfo/lib_tgoto.c
-+++ b/ncurses/tinfo/lib_tgoto.c
-@@ -207,6 +207,14 @@ tgoto(const char *string, int x, int y)
-        result = tgoto_internal(string, x, y);
-     else
- #endif
--       result = TIPARM_2(string, y, x);
-+    if ((result = TIPARM_2(string, y, x)) == NULL) {
-+       /*
-+        * Because termcap did not provide a more general solution such as
-+        * tparm(), it was necessary to handle single-parameter capabilities
-+        * using tgoto().  The internal _nc_tiparm() function returns a NULL
-+        * for that case; retry for the single-parameter case.
-+        */
-+       result = TIPARM_1(string, y);
-+    }
-     returnPtr(result);
- }
-diff --git a/ncurses/tinfo/lib_tparm.c b/ncurses/tinfo/lib_tparm.c
-index d9bdfd8f..a10a3877 100644
---- a/ncurses/tinfo/lib_tparm.c
-+++ b/ncurses/tinfo/lib_tparm.c
-@@ -1086,6 +1086,64 @@ tparam_internal(TPARM_STATE *tps, const char *string, TPARM_DATA *data)
-     return (TPS(out_buff));
- }
- 
-+#ifdef CUR
-+/*
-+ * Only a few standard capabilities accept string parameters.  The others that
-+ * are parameterized accept only numeric parameters.
-+ */
-+static bool
-+check_string_caps(TPARM_DATA *data, const char *string)
-+{
-+    bool result = FALSE;
-+
-+#define CHECK_CAP(name) (VALID_STRING(name) && !strcmp(name, string))
-+
-+    /*
-+     * Disallow string parameters unless we can check them against a terminal
-+     * description.
-+     */
-+    if (cur_term != NULL) {
-+       int want_type = 0;
-+
-+       if (CHECK_CAP(pkey_key))
-+           want_type = 2;      /* function key #1, type string #2 */
-+       else if (CHECK_CAP(pkey_local))
-+           want_type = 2;      /* function key #1, execute string #2 */
-+       else if (CHECK_CAP(pkey_xmit))
-+           want_type = 2;      /* function key #1, transmit string #2 */
-+       else if (CHECK_CAP(plab_norm))
-+           want_type = 2;      /* label #1, show string #2 */
-+       else if (CHECK_CAP(pkey_plab))
-+           want_type = 6;      /* function key #1, type string #2, show string #3 */
-+#if NCURSES_XNAMES
-+       else {
-+           char *check;
-+
-+           check = tigetstr("Cs");
-+           if (CHECK_CAP(check))
-+               want_type = 1;  /* style #1 */
-+
-+           check = tigetstr("Ms");
-+           if (CHECK_CAP(check))
-+               want_type = 3;  /* storage unit #1, content #2 */
-+       }
-+#endif
-+
-+       if (want_type == data->tparm_type) {
-+           result = TRUE;
-+       } else {
-+           T(("unexpected string-parameter"));
-+       }
-+    }
-+    return result;
-+}
-+
-+#define ValidCap() (myData.tparm_type == 0 || \
-+                   check_string_caps(&myData, string))
-+#else
-+#define ValidCap() 1
-+#endif
-+
- #if NCURSES_TPARM_VARARGS
- 
- NCURSES_EXPORT(char *)
-@@ -1100,7 +1158,7 @@ tparm(const char *string, ...)
-     tps->tname = "tparm";
- #endif /* TRACE */
- 
--    if (tparm_setup(cur_term, string, &myData) == OK) {
-+    if (tparm_setup(cur_term, string, &myData) == OK && ValidCap()) {
-        va_list ap;
- 
-        va_start(ap, string);
-@@ -1135,7 +1193,7 @@ tparm(const char *string,
-     tps->tname = "tparm";
- #endif /* TRACE */
- 
--    if (tparm_setup(cur_term, string, &myData) == OK) {
-+    if (tparm_setup(cur_term, string, &myData) == OK && ValidCap()) {
- 
-        myData.param[0] = a1;
-        myData.param[1] = a2;
-@@ -1166,7 +1224,7 @@ tiparm(const char *string, ...)
-     tps->tname = "tiparm";
- #endif /* TRACE */
- 
--    if (tparm_setup(cur_term, string, &myData) == OK) {
-+    if (tparm_setup(cur_term, string, &myData) == OK && ValidCap()) {
-        va_list ap;
- 
-        va_start(ap, string);
-@@ -1179,7 +1237,25 @@ tiparm(const char *string, ...)
- }
- 
- /*
-- * The internal-use flavor ensures that the parameters are numbers, not strings
-+ * The internal-use flavor ensures that parameters are numbers, not strings.
-+ * In addition to ensuring that they are numbers, it ensures that the parameter
-+ * count is consistent with intended usage.
-+ *
-+ * Unlike the general-purpose tparm/tiparm, these internal calls are fairly
-+ * well defined:
-+ *
-+ * expected == 0 - not applicable
-+ * expected == 1 - set color, or vertical/horizontal addressing
-+ * expected == 2 - cursor addressing
-+ * expected == 4 - initialize color or color pair
-+ * expected == 9 - set attributes
-+ *
-+ * Only for the last case (set attributes) should a parameter be optional.
-+ * Also, a capability which calls for more parameters than expected should be
-+ * ignored.
-+ *
-+ * Return a null if the parameter-checks fail.  Otherwise, return a pointer to
-+ * the formatted capability string.
-  */
- NCURSES_EXPORT(char *)
- _nc_tiparm(int expected, const char *string, ...)
-@@ -1189,22 +1265,36 @@ _nc_tiparm(int expected, const char *string, ...)
-     char *result = NULL;
- 
-     _nc_tparm_err = 0;
-+    T((T_CALLED("_nc_tiparm(%d, %s, ...)"), expected, _nc_visbuf(string)));
- #ifdef TRACE
-     tps->tname = "_nc_tiparm";
- #endif /* TRACE */
- 
--    if (tparm_setup(cur_term, string, &myData) == OK
--       && myData.num_actual <= expected
--       && myData.tparm_type == 0) {
--       va_list ap;
-+    if (tparm_setup(cur_term, string, &myData) == OK && ValidCap()) {
-+       if (myData.num_actual == 0) {
-+           T(("missing parameter%s, expected %s%d",
-+              expected > 1 ? "s" : "",
-+              expected == 9 ? "up to " : "",
-+              expected));
-+       } else if (myData.num_actual > expected) {
-+           T(("too many parameters, have %d, expected %d",
-+              myData.num_actual,
-+              expected));
-+       } else if (expected != 9 && myData.num_actual != expected) {
-+           T(("expected %d parameters, have %d",
-+              myData.num_actual,
-+              expected));
-+       } else {
-+           va_list ap;
- 
--       va_start(ap, string);
--       tparm_copy_valist(&myData, FALSE, ap);
--       va_end(ap);
-+           va_start(ap, string);
-+           tparm_copy_valist(&myData, FALSE, ap);
-+           va_end(ap);
- 
--       result = tparam_internal(tps, string, &myData);
-+           result = tparam_internal(tps, string, &myData);
-+       }
-     }
--    return result;
-+    returnPtr(result);
- }
- 
- /*
-diff --git a/ncurses/tinfo/read_entry.c b/ncurses/tinfo/read_entry.c
-index 2b1875ed..341337d2 100644
---- a/ncurses/tinfo/read_entry.c
-+++ b/ncurses/tinfo/read_entry.c
-@@ -323,6 +323,9 @@ _nc_read_termtype(TERMTYPE2 *ptr, char *buffer, int limit)
-        || bool_count < 0
-        || num_count < 0
-        || str_count < 0
-+       || bool_count > BOOLCOUNT
-+       || num_count > NUMCOUNT
-+       || str_count > STRCOUNT
-        || str_size < 0) {
-        returnDB(TGETENT_NO);
-     }
-diff --git a/progs/tic.c b/progs/tic.c
-index 93a0b491..888927e2 100644
---- a/progs/tic.c
-+++ b/progs/tic.c
-@@ -2270,9 +2270,15 @@ check_1_infotocap(const char *name, NCURSES_CONST char *value, int count)
- 
-     _nc_reset_tparm(NULL);
-     switch (actual) {
-+    case Str:
-+       result = TPARM_1(value, strings[1]);
-+       break;
-     case Num_Str:
-        result = TPARM_2(value, numbers[1], strings[2]);
-        break;
-+    case Str_Str:
-+       result = TPARM_2(value, strings[1], strings[2]);
-+       break;
-     case Num_Str_Str:
-        result = TPARM_3(value, numbers[1], strings[2], strings[3]);
-        break;
-diff --git a/progs/tparm_type.c b/progs/tparm_type.c
-index 3da4a077..644aa62a 100644
---- a/progs/tparm_type.c
-+++ b/progs/tparm_type.c
-@@ -47,6 +47,7 @@ tparm_type(const char *name)
-        {code, {longname} }, \
-        {code, {ti} }, \
-        {code, {tc} }
-+#define XD(code, onlyname) TD(code, onlyname, onlyname, onlyname)
-     TParams result = Numbers;
-     /* *INDENT-OFF* */
-     static const struct {
-@@ -58,6 +59,10 @@ tparm_type(const char *name)
-        TD(Num_Str,     "pkey_xmit",    "pfx",          "px"),
-        TD(Num_Str,     "plab_norm",    "pln",          "pn"),
-        TD(Num_Str_Str, "pkey_plab",    "pfxl",         "xl"),
-+#if NCURSES_XNAMES
-+       XD(Str,         "Cs"),
-+       XD(Str_Str,     "Ms"),
-+#endif
-     };
-     /* *INDENT-ON* */
- 
-@@ -80,12 +85,16 @@ guess_tparm_type(int nparam, char **p_is_s)
-     case 1:
-        if (!p_is_s[0])
-            result = Numbers;
-+       if (p_is_s[0])
-+           result = Str;
-        break;
-     case 2:
-        if (!p_is_s[0] && !p_is_s[1])
-            result = Numbers;
-        if (!p_is_s[0] && p_is_s[1])
-            result = Num_Str;
-+       if (p_is_s[0] && p_is_s[1])
-+           result = Str_Str;
-        break;
-     case 3:
-        if (!p_is_s[0] && !p_is_s[1] && !p_is_s[2])
-diff --git a/progs/tparm_type.h b/progs/tparm_type.h
-index 7c102a30..af5bcf0f 100644
---- a/progs/tparm_type.h
-+++ b/progs/tparm_type.h
-@@ -45,8 +45,10 @@
- typedef enum {
-     Other = -1
-     ,Numbers = 0
-+    ,Str
-     ,Num_Str
-     ,Num_Str_Str
-+    ,Str_Str
- } TParams;
- 
- extern TParams tparm_type(const char *name);
-diff --git a/progs/tput.c b/progs/tput.c
-index 4cd0c5ba..41508b72 100644
---- a/progs/tput.c
-+++ b/progs/tput.c
-@@ -1,5 +1,5 @@
- /****************************************************************************
-- * Copyright 2018-2021,2022 Thomas E. Dickey                                *
-+ * Copyright 2018-2022,2023 Thomas E. Dickey                                *
-  * Copyright 1998-2016,2017 Free Software Foundation, Inc.                  *
-  *                                                                          *
-  * Permission is hereby granted, free of charge, to any person obtaining a  *
-@@ -47,12 +47,15 @@
- #include <transform.h>
- #include <tty_settings.h>
- 
--MODULE_ID("$Id: tput.c,v 1.99 2022/02/26 23:19:31 tom Exp $")
-+MODULE_ID("$Id: tput.c,v 1.102 2023/04/08 16:26:36 tom Exp $")
- 
- #define PUTS(s)                fputs(s, stdout)
- 
- const char *_nc_progname = "tput";
- 
-+static bool opt_v = FALSE;     /* quiet, do not show warnings */
-+static bool opt_x = FALSE;     /* clear scrollback if possible */
-+
- static bool is_init = FALSE;
- static bool is_reset = FALSE;
- static bool is_clear = FALSE;
-@@ -81,6 +84,7 @@ usage(const char *optstring)
-        KEEP("  -S <<       read commands from standard input")
-        KEEP("  -T TERM     use this instead of $TERM")
-        KEEP("  -V          print curses-version")
-+       KEEP("  -v          verbose, show warnings")
-        KEEP("  -x          do not try to clear scrollback")
-        KEEP("")
-        KEEP("Commands:")
-@@ -148,7 +152,7 @@ exit_code(int token, int value)
-  * Returns nonzero on error.
-  */
- static int
--tput_cmd(int fd, TTY * settings, bool opt_x, int argc, char **argv, int *used)
-+tput_cmd(int fd, TTY * settings, int argc, char **argv, int *used)
- {
-     NCURSES_CONST char *name;
-     char *s;
-@@ -231,7 +235,9 @@ tput_cmd(int fd, TTY * settings, bool opt_x, int argc, char **argv, int *used)
-     } else if (VALID_STRING(s)) {
-        if (argc > 1) {
-            int k;
-+           int narg;
-            int analyzed;
-+           int provided;
-            int popcount;
-            long numbers[1 + NUM_PARM];
-            char *strings[1 + NUM_PARM];
-@@ -271,14 +277,45 @@ tput_cmd(int fd, TTY * settings, bool opt_x, int argc, char **argv, int *used)
- 
-            popcount = 0;
-            _nc_reset_tparm(NULL);
-+           /*
-+            * Count the number of numeric parameters which are provided.
-+            */
-+           provided = 0;
-+           for (narg = 1; narg < argc; ++narg) {
-+               char *ending = NULL;
-+               long check = strtol(argv[narg], &ending, 10);
-+               if (check < 0 || ending == argv[narg] || *ending != '\0')
-+                   break;
-+               provided = narg;
-+           }
-            switch (paramType) {
-+           case Str:
-+               s = TPARM_1(s, strings[1]);
-+               analyzed = 1;
-+               if (provided == 0 && argc >= 1)
-+                   provided++;
-+               break;
-+           case Str_Str:
-+               s = TPARM_2(s, strings[1], strings[2]);
-+               analyzed = 2;
-+               if (provided == 0 && argc >= 1)
-+                   provided++;
-+               if (provided == 1 && argc >= 2)
-+                   provided++;
-+               break;
-            case Num_Str:
-                s = TPARM_2(s, numbers[1], strings[2]);
-                analyzed = 2;
-+               if (provided == 1 && argc >= 2)
-+                   provided++;
-                break;
-            case Num_Str_Str:
-                s = TPARM_3(s, numbers[1], strings[2], strings[3]);
-                analyzed = 3;
-+               if (provided == 1 && argc >= 2)
-+                   provided++;
-+               if (provided == 2 && argc >= 3)
-+                   provided++;
-                break;
-            case Numbers:
-                analyzed = _nc_tparm_analyze(NULL, s, p_is_s, &popcount);
-@@ -316,7 +353,13 @@ tput_cmd(int fd, TTY * settings, bool opt_x, int argc, char **argv, int *used)
-            if (analyzed < popcount) {
-                analyzed = popcount;
-            }
--           *used += analyzed;
-+           if (opt_v && (analyzed != provided)) {
-+               fprintf(stderr, "%s: %s parameters for \"%s\"\n",
-+                       _nc_progname,
-+                       (analyzed < provided ? "extra" : "missing"),
-+                       argv[0]);
-+           }
-+           *used += provided;
-        }
- 
-        /* use putp() in order to perform padding */
-@@ -339,7 +382,6 @@ main(int argc, char **argv)
-     int used;
-     TTY old_settings;
-     TTY tty_settings;
--    bool opt_x = FALSE;                /* clear scrollback if possible */
-     bool is_alias;
-     bool need_tty;
- 
-@@ -348,7 +390,7 @@ main(int argc, char **argv)
- 
-     term = getenv("TERM");
- 
--    while ((c = getopt(argc, argv, is_alias ? "T:Vx" : "ST:Vx")) != -1) {
-+    while ((c = getopt(argc, argv, is_alias ? "T:Vvx" : "ST:Vvx")) != -1) {
-        switch (c) {
-        case 'S':
-            cmdline = FALSE;
-@@ -361,6 +403,9 @@ main(int argc, char **argv)
-        case 'V':
-            puts(curses_version());
-            ExitProgram(EXIT_SUCCESS);
-+       case 'v':               /* verbose */
-+           opt_v = TRUE;
-+           break;
-        case 'x':               /* do not try to clear scrollback */
-            opt_x = TRUE;
-            break;
-@@ -404,7 +449,7 @@ main(int argc, char **argv)
-            usage(NULL);
-        while (argc > 0) {
-            tty_settings = old_settings;
--           code = tput_cmd(fd, &tty_settings, opt_x, argc, argv, &used);
-+           code = tput_cmd(fd, &tty_settings, argc, argv, &used);
-            if (code != 0)
-                break;
-            argc -= used;
-@@ -439,7 +484,7 @@ main(int argc, char **argv)
-        while (argnum > 0) {
-            int code;
-            tty_settings = old_settings;
--           code = tput_cmd(fd, &tty_settings, opt_x, argnum, argnow, &used);
-+           code = tput_cmd(fd, &tty_settings, argnum, argnow, &used);
-            if (code != 0) {
-                if (result == 0)
-                    result = ErrSystem(0);      /* will return value >4 */
--- 
-2.40.0
-
diff --git a/meta/recipes-core/ncurses/files/0001-Updating-reset-code-ncurses-6.4-patch-20231104.patch b/meta/recipes-core/ncurses/files/0001-Updating-reset-code-ncurses-6.4-patch-20231104.patch
deleted file mode 100644
index 121db6bffe..0000000000
--- a/meta/recipes-core/ncurses/files/0001-Updating-reset-code-ncurses-6.4-patch-20231104.patch
+++ /dev/null
@@ -1,499 +0,0 @@
-From 135d37072755704b8d018e5de74e62ff3f28c930 Mon Sep 17 00:00:00 2001
-From: Thomas E. Dickey <dickey@invisible-island.net>
-Date: Sun, 5 Nov 2023 05:54:54 +0530
-Subject: [PATCH] Updating reset code - ncurses 6.4 - patch 20231104
-
-+ modify reset command to avoid altering clocal if the terminal uses a
-  modem (prompted by discussion with Werner Fink, Michal Suchanek,
-  OpenSUSE #1201384, Debian #60377).
-+ build-fixes for --with-caps variations.
-+ correct a couple of section-references in INSTALL.
-
-Signed-off-by: Thomas E. Dickey <dickey@invisible-island.net>
-
-Upstream-Status: Backport [https://ncurses.scripts.mit.edu/?p=ncurses.git;a=commitdiff;h=135d37072755704b8d018e5de74e62ff3f28c930]
-
-Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
----
- INSTALL                   |   8 +-
- include/curses.events     |   2 +-
- ncurses/tinfo/lib_tparm.c |   2 +
- progs/reset_cmd.c         | 281 +++++++++++++++++++++-----------------
- progs/tabs.c              |  10 +-
- progs/tic.c               |   4 +
- 6 files changed, 176 insertions(+), 131 deletions(-)
-
-diff --git a/INSTALL b/INSTALL
-index d9c1dd12..d0a39af0 100644
---- a/INSTALL
-+++ b/INSTALL
-@@ -47,7 +47,7 @@ If you are converting from BSD curses and do not have root access, be sure
- to read the BSD CONVERSION NOTES section below.
-
- If you are trying to build applications using gpm with ncurses,
--read the USING NCURSES WITH GPM section below.
-+read the USING GPM section below.
-
- If you are cross-compiling, see the note below on BUILDING WITH A CROSS-COMPILER.
-
-@@ -79,7 +79,7 @@ INSTALLATION PROCEDURE:
-     The --prefix option to configure changes the root directory for installing
-     ncurses.  The default is normally in subdirectories of /usr/local, except
-     for systems where ncurses is normally installed as a system library (see
--    "IF YOU ARE A SYSTEM INTEGRATOR").  Use --prefix=/usr to replace your
-+    "FOR SYSTEM INTEGRATORS").  Use --prefix=/usr to replace your
-     default curses distribution.
-
-     The package gets installed beneath the --prefix directory as follows:
-@@ -176,7 +176,7 @@ INSTALLATION PROCEDURE:
-     You can make curses and terminfo fall back to an existing file of termcap
-     definitions by configuring with --enable-termcap.  If you do this, the
-     library will search /etc/termcap before the terminfo database, and will
--    also interpret the contents of the TERM environment variable.  See the
-+    also interpret the contents of the $TERM environment variable.  See the
-     section BSD CONVERSION NOTES below.
-
- 3.  Type `make'.  Ignore any warnings, no error messages should be produced.
-@@ -1231,7 +1231,7 @@ CONFIGURE OPTIONS:
-        Specify a search-list of terminfo directories which will be compiled
-        into the ncurses library (default: DATADIR/terminfo)
-
--       This is a colon-separated list, like the TERMINFO_DIRS environment
-+       This is a colon-separated list, like the $TERMINFO_DIRS environment
-        variable.
-
-     --with-termlib[=XXX]
-diff --git a/include/curses.events b/include/curses.events
-index 25a2583f..468bde18 100644
---- a/include/curses.events
-+++ b/include/curses.events
-@@ -50,6 +50,6 @@ typedef struct
- extern NCURSES_EXPORT(int) wgetch_events (WINDOW *, _nc_eventlist *) GCC_DEPRECATED(experimental option); /* experimental */
- extern NCURSES_EXPORT(int) wgetnstr_events (WINDOW *,char *,int,_nc_eventlist *) GCC_DEPRECATED(experimental option); /* experimental */
-
--#define KEY_EVENT      0633            /* We were interrupted by an event */
-+#define KEY_EVENT      0634            /* We were interrupted by an event */
-
- #endif /* NCURSES_WGETCH_EVENTS */
-diff --git a/ncurses/tinfo/lib_tparm.c b/ncurses/tinfo/lib_tparm.c
-index a10a3877..cd972c0f 100644
---- a/ncurses/tinfo/lib_tparm.c
-+++ b/ncurses/tinfo/lib_tparm.c
-@@ -1113,8 +1113,10 @@ check_string_caps(TPARM_DATA *data, const char *string)
-            want_type = 2;      /* function key #1, transmit string #2 */
-        else if (CHECK_CAP(plab_norm))
-            want_type = 2;      /* label #1, show string #2 */
-+#ifdef pkey_plab
-        else if (CHECK_CAP(pkey_plab))
-            want_type = 6;      /* function key #1, type string #2, show string #3 */
-+#endif
- #if NCURSES_XNAMES
-        else {
-            char *check;
-diff --git a/progs/reset_cmd.c b/progs/reset_cmd.c
-index eff3af72..aec4b077 100644
---- a/progs/reset_cmd.c
-+++ b/progs/reset_cmd.c
-@@ -75,6 +75,9 @@ MODULE_ID("$Id: reset_cmd.c,v 1.28 2021/10/02 18:08:44 tom Exp $")
- # endif
- #endif
-
-+#define set_flags(target, mask)    target |= mask
-+#define clear_flags(target, mask)  target &= ~((unsigned)(mask))
-+
- static FILE *my_file;
-
- static bool use_reset = FALSE; /* invoked as reset */
-@@ -188,6 +191,79 @@ out_char(int c)
- #define reset_char(item, value) \
-     tty_settings->c_cc[item] = CHK(tty_settings->c_cc[item], value)
-
-+/*
-+ * Simplify ifdefs
-+ */
-+#ifndef BSDLY
-+#define BSDLY 0
-+#endif
-+#ifndef CRDLY
-+#define CRDLY 0
-+#endif
-+#ifndef ECHOCTL
-+#define ECHOCTL 0
-+#endif
-+#ifndef ECHOKE
-+#define ECHOKE 0
-+#endif
-+#ifndef ECHOPRT
-+#define ECHOPRT 0
-+#endif
-+#ifndef FFDLY
-+#define FFDLY 0
-+#endif
-+#ifndef IMAXBEL
-+#define IMAXBEL 0
-+#endif
-+#ifndef IUCLC
-+#define IUCLC 0
-+#endif
-+#ifndef IXANY
-+#define IXANY 0
-+#endif
-+#ifndef NLDLY
-+#define NLDLY 0
-+#endif
-+#ifndef OCRNL
-+#define OCRNL 0
-+#endif
-+#ifndef OFDEL
-+#define OFDEL 0
-+#endif
-+#ifndef OFILL
-+#define OFILL 0
-+#endif
-+#ifndef OLCUC
-+#define OLCUC 0
-+#endif
-+#ifndef ONLCR
-+#define ONLCR 0
-+#endif
-+#ifndef ONLRET
-+#define ONLRET 0
-+#endif
-+#ifndef ONOCR
-+#define ONOCR 0
-+#endif
-+#ifndef OXTABS
-+#define OXTABS 0
-+#endif
-+#ifndef TAB3
-+#define TAB3 0
-+#endif
-+#ifndef TABDLY
-+#define TABDLY 0
-+#endif
-+#ifndef TOSTOP
-+#define TOSTOP 0
-+#endif
-+#ifndef VTDLY
-+#define VTDLY 0
-+#endif
-+#ifndef XCASE
-+#define XCASE 0
-+#endif
-+
- /*
-  * Reset the terminal mode bits to a sensible state.  Very useful after
-  * a child program dies in raw mode.
-@@ -195,6 +271,10 @@ out_char(int c)
- void
- reset_tty_settings(int fd, TTY * tty_settings, int noset)
- {
-+    unsigned mask;
-+#ifdef TIOCMGET
-+    int modem_bits;
-+#endif
-     GET_TTY(fd, tty_settings);
-
- #ifdef TERMIOS
-@@ -228,106 +308,65 @@ reset_tty_settings(int fd, TTY * tty_settings, int noset)
-     reset_char(VWERASE, CWERASE);
- #endif
-
--    tty_settings->c_iflag &= ~((unsigned) (IGNBRK
--                                          | PARMRK
--                                          | INPCK
--                                          | ISTRIP
--                                          | INLCR
--                                          | IGNCR
--#ifdef IUCLC
--                                          | IUCLC
--#endif
--#ifdef IXANY
--                                          | IXANY
--#endif
--                                          | IXOFF));
--
--    tty_settings->c_iflag |= (BRKINT
--                             | IGNPAR
--                             | ICRNL
--                             | IXON
--#ifdef IMAXBEL
--                             | IMAXBEL
--#endif
--       );
--
--    tty_settings->c_oflag &= ~((unsigned) (0
--#ifdef OLCUC
--                                          | OLCUC
--#endif
--#ifdef OCRNL
--                                          | OCRNL
--#endif
--#ifdef ONOCR
--                                          | ONOCR
--#endif
--#ifdef ONLRET
--                                          | ONLRET
--#endif
--#ifdef OFILL
--                                          | OFILL
--#endif
--#ifdef OFDEL
--                                          | OFDEL
--#endif
--#ifdef NLDLY
--                                          | NLDLY
--#endif
--#ifdef CRDLY
--                                          | CRDLY
--#endif
--#ifdef TABDLY
--                                          | TABDLY
--#endif
--#ifdef BSDLY
--                                          | BSDLY
--#endif
--#ifdef VTDLY
--                                          | VTDLY
--#endif
--#ifdef FFDLY
--                                          | FFDLY
--#endif
--                              ));
--
--    tty_settings->c_oflag |= (OPOST
--#ifdef ONLCR
--                             | ONLCR
--#endif
--       );
--
--    tty_settings->c_cflag &= ~((unsigned) (CSIZE
--                                          | CSTOPB
--                                          | PARENB
--                                          | PARODD
--                                          | CLOCAL));
--    tty_settings->c_cflag |= (CS8 | CREAD);
--    tty_settings->c_lflag &= ~((unsigned) (ECHONL
--                                          | NOFLSH
--#ifdef TOSTOP
--                                          | TOSTOP
--#endif
--#ifdef ECHOPTR
--                                          | ECHOPRT
--#endif
--#ifdef XCASE
--                                          | XCASE
--#endif
--                              ));
--
--    tty_settings->c_lflag |= (ISIG
--                             | ICANON
--                             | ECHO
--                             | ECHOE
--                             | ECHOK
--#ifdef ECHOCTL
--                             | ECHOCTL
--#endif
--#ifdef ECHOKE
--                             | ECHOKE
--#endif
--       );
--#endif
-+    clear_flags(tty_settings->c_iflag, (IGNBRK
-+                                       | PARMRK
-+                                       | INPCK
-+                                       | ISTRIP
-+                                       | INLCR
-+                                       | IGNCR
-+                                       | IUCLC
-+                                       | IXANY
-+                                       | IXOFF));
-+
-+    set_flags(tty_settings->c_iflag, (BRKINT
-+                                     | IGNPAR
-+                                     | ICRNL
-+                                     | IXON
-+                                     | IMAXBEL));
-+
-+    clear_flags(tty_settings->c_oflag, (0
-+                                       | OLCUC
-+                                       | OCRNL
-+                                       | ONOCR
-+                                       | ONLRET
-+                                       | OFILL
-+                                       | OFDEL
-+                                       | NLDLY
-+                                       | CRDLY
-+                                       | TABDLY
-+                                       | BSDLY
-+                                       | VTDLY
-+                                       | FFDLY));
-+
-+    set_flags(tty_settings->c_oflag, (OPOST
-+                                     | ONLCR));
-+
-+    mask = (CSIZE | CSTOPB | PARENB | PARODD);
-+#ifdef TIOCMGET
-+    /* leave clocal alone if this appears to use a modem */
-+    if (ioctl(fd, TIOCMGET, &modem_bits) == -1)
-+       mask |= CLOCAL;
-+#else
-+    /* cannot check - use the behavior from tset */
-+    mask |= CLOCAL;
-+#endif
-+    clear_flags(tty_settings->c_cflag, mask);
-+
-+    set_flags(tty_settings->c_cflag, (CS8 | CREAD));
-+    clear_flags(tty_settings->c_lflag, (ECHONL
-+                                       | NOFLSH
-+                                       | TOSTOP
-+                                       | ECHOPRT
-+                                       | XCASE));
-+
-+    set_flags(tty_settings->c_lflag, (ISIG
-+                                     | ICANON
-+                                     | ECHO
-+                                     | ECHOE
-+                                     | ECHOK
-+                                     | ECHOCTL
-+                                     | ECHOKE));
-+#endif /* TERMIOS */
-
-     if (!noset) {
-        SET_TTY(fd, tty_settings);
-@@ -402,29 +441,23 @@ set_conversions(TTY * tty_settings)
- #if defined(EXP_WIN32_DRIVER)
-     /* FIXME */
- #else
--#ifdef ONLCR
--    tty_settings->c_oflag |= ONLCR;
--#endif
--    tty_settings->c_iflag |= ICRNL;
--    tty_settings->c_lflag |= ECHO;
--#ifdef OXTABS
--    tty_settings->c_oflag |= OXTABS;
--#endif /* OXTABS */
-+    set_flags(tty_settings->c_oflag, ONLCR);
-+    set_flags(tty_settings->c_iflag, ICRNL);
-+    set_flags(tty_settings->c_lflag, ECHO);
-+    set_flags(tty_settings->c_oflag, OXTABS);
-
-     /* test used to be tgetflag("NL") */
-     if (VALID_STRING(newline) && newline[0] == '\n' && !newline[1]) {
-        /* Newline, not linefeed. */
--#ifdef ONLCR
--       tty_settings->c_oflag &= ~((unsigned) ONLCR);
--#endif
--       tty_settings->c_iflag &= ~((unsigned) ICRNL);
-+        clear_flags(tty_settings->c_oflag, ONLCR);
-+        clear_flags(tty_settings->c_iflag, ICRNL);
-     }
--#ifdef OXTABS
-+#if OXTABS
-     /* test used to be tgetflag("pt") */
-     if (VALID_STRING(set_tab) && VALID_STRING(clear_all_tabs))
--       tty_settings->c_oflag &= ~OXTABS;
-+       clear_flags(tty_settings->c_oflag, OXTABS);
- #endif /* OXTABS */
--    tty_settings->c_lflag |= (ECHOE | ECHOK);
-+    set_flags(tty_settings->c_lflag, (ECHOE | ECHOK));
- #endif
- }
-
-@@ -490,7 +523,7 @@ send_init_strings(int fd GCC_UNUSED, TTY * old_settings)
-     bool need_flush = FALSE;
-
-     (void) old_settings;
--#ifdef TAB3
-+#if TAB3
-     if (old_settings != 0 &&
-        old_settings->c_oflag & (TAB3 | ONLCR | OCRNL | ONLRET)) {
-        old_settings->c_oflag &= (TAB3 | ONLCR | OCRNL | ONLRET);
-@@ -512,22 +545,22 @@ send_init_strings(int fd GCC_UNUSED, TTY * old_settings)
-
-        if (VALID_STRING(clear_margins)) {
-            need_flush |= sent_string(clear_margins);
--       } else
-+       }
- #if defined(set_lr_margin)
--       if (VALID_STRING(set_lr_margin)) {
-+       else if (VALID_STRING(set_lr_margin)) {
-            need_flush |= sent_string(TIPARM_2(set_lr_margin, 0, columns - 1));
--       } else
-+       }
- #endif
- #if defined(set_left_margin_parm) && defined(set_right_margin_parm)
--           if (VALID_STRING(set_left_margin_parm)
--               && VALID_STRING(set_right_margin_parm)) {
-+       else if (VALID_STRING(set_left_margin_parm)
-+                && VALID_STRING(set_right_margin_parm)) {
-            need_flush |= sent_string(TIPARM_1(set_left_margin_parm, 0));
-            need_flush |= sent_string(TIPARM_1(set_right_margin_parm,
-                                               columns - 1));
--       } else
-+       }
- #endif
--           if (VALID_STRING(set_left_margin)
--               && VALID_STRING(set_right_margin)) {
-+       else if (VALID_STRING(set_left_margin)
-+                && VALID_STRING(set_right_margin)) {
-            need_flush |= to_left_margin();
-            need_flush |= sent_string(set_left_margin);
-            if (VALID_STRING(parm_right_cursor)) {
-diff --git a/progs/tabs.c b/progs/tabs.c
-index 7378d116..d904330b 100644
---- a/progs/tabs.c
-+++ b/progs/tabs.c
-@@ -370,7 +370,9 @@ do_set_margin(int margin, bool no_op)
-            }
-            tputs(set_left_margin, 1, putch);
-        }
--    } else if (VALID_STRING(set_left_margin_parm)) {
-+    }
-+#if defined(set_left_margin_parm) && defined(set_right_margin_parm)
-+    else if (VALID_STRING(set_left_margin_parm)) {
-        result = TRUE;
-        if (!no_op) {
-            if (VALID_STRING(set_right_margin_parm)) {
-@@ -379,12 +381,16 @@ do_set_margin(int margin, bool no_op)
-                tputs(TIPARM_2(set_left_margin_parm, margin, max_cols), 1, putch);
-            }
-        }
--    } else if (VALID_STRING(set_lr_margin)) {
-+    }
-+#endif
-+#if defined(set_lr_margin)
-+    else if (VALID_STRING(set_lr_margin)) {
-        result = TRUE;
-        if (!no_op) {
-            tputs(TIPARM_2(set_lr_margin, margin, max_cols), 1, putch);
-        }
-     }
-+#endif
-     return result;
- }
-
-diff --git a/progs/tic.c b/progs/tic.c
-index 888927e2..78b568fa 100644
---- a/progs/tic.c
-+++ b/progs/tic.c
-@@ -3142,6 +3142,7 @@ guess_ANSI_VTxx(TERMTYPE2 *tp)
-  * In particular, any ECMA-48 terminal should support these, though the details
-  * for u9 are implementation dependent.
-  */
-+#if defined(user6) && defined(user7) && defined(user8) && defined(user9)
- static void
- check_user_6789(TERMTYPE2 *tp)
- {
-@@ -3177,6 +3178,9 @@ check_user_6789(TERMTYPE2 *tp)
-        break;
-     }
- }
-+#else
-+#define check_user_6789(tp)    /* nothing */
-+#endif
-
- /* other sanity-checks (things that we don't want in the normal
-  * logic that reads a terminfo entry)
---
-2.40.0
diff --git a/meta/recipes-core/ncurses/files/0001-tic-hang.patch b/meta/recipes-core/ncurses/files/0001-tic-hang.patch
index f98a943e5c..8cb92a3939 100644
--- a/meta/recipes-core/ncurses/files/0001-tic-hang.patch
+++ b/meta/recipes-core/ncurses/files/0001-tic-hang.patch
@@ -1,7 +1,7 @@
-From 168ba7a681be73ac024438e33e14fde1d5aea97d Mon Sep 17 00:00:00 2001
+From a51a53f0eecfd4d083aba8dfcd47c65e93978ff1 Mon Sep 17 00:00:00 2001
 From: Hongxu Jia <hongxu.jia@windriver.com>
 Date: Fri, 30 Mar 2018 10:02:24 +0800
-Subject: [PATCH 1/2] tic hang
+Subject: [PATCH] tic hang
 
 Upstream-Status: Inappropriate [configuration]
 
@@ -17,10 +17,10 @@ Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
  1 file changed, 5 insertions(+), 6 deletions(-)
 
 diff --git a/misc/terminfo.src b/misc/terminfo.src
-index 84f4810..6b385ec 100644
+index 5d575b8e..f9cc6880 100644
 --- a/misc/terminfo.src
 +++ b/misc/terminfo.src
-@@ -5562,12 +5562,11 @@ konsole-xf3x|KDE console window with keyboard for XFree86 3.x xterm,
+@@ -6518,12 +6518,11 @@ konsole-xf3x|KDE console window with keyboard for XFree86 3.x xterm,
  # The value for kbs (see konsole-vt100) reflects local customization rather
  # than the settings used for XFree86 xterm.
  konsole-xf4x|KDE console window with keyboard for XFree86 4.x xterm,
@@ -38,6 +38,3 @@ index 84f4810..6b385ec 100644
  
  # Obsolete: vt100.keymap
  # KDE's "vt100" keyboard has no relationship to any terminal that DEC made, but
--- 
-1.8.3.1
-
diff --git a/meta/recipes-core/ncurses/files/0002-configure-reproducible.patch b/meta/recipes-core/ncurses/files/0002-configure-reproducible.patch
index 66f26c06ab..11ca66c8e8 100644
--- a/meta/recipes-core/ncurses/files/0002-configure-reproducible.patch
+++ b/meta/recipes-core/ncurses/files/0002-configure-reproducible.patch
@@ -1,4 +1,4 @@
-From ec87e53066a9942e9aaba817d71268342f5e83b9 Mon Sep 17 00:00:00 2001
+From 63cf58044f4ab3297c5a2d0e132e87ebfa80c753 Mon Sep 17 00:00:00 2001
 From: Hongxu Jia <hongxu.jia@windriver.com>
 Date: Wed, 16 Aug 2017 14:45:27 +0800
 Subject: [PATCH] configure: reproducible
@@ -13,16 +13,15 @@ Signed-off-by: Juro Bystricky <juro.bystricky@intel.com>
 Rebase to 6.1
 
 Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
-
 ---
  configure | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/configure b/configure
-index 421cf859..a1b7840d 100755
+index 488d93fc..005d44e2 100755
 --- a/configure
 +++ b/configure
-@@ -5072,7 +5072,7 @@ else
+@@ -5129,7 +5129,7 @@ else
                 ;;
         (*)
                 cf_cv_ar_flags=unknown
diff --git a/meta/recipes-core/ncurses/files/0003-gen-pkgconfig.in-Do-not-include-LDFLAGS-in-generated.patch b/meta/recipes-core/ncurses/files/0003-gen-pkgconfig.in-Do-not-include-LDFLAGS-in-generated.patch
index a15694d4d4..d89399bbe5 100644
--- a/meta/recipes-core/ncurses/files/0003-gen-pkgconfig.in-Do-not-include-LDFLAGS-in-generated.patch
+++ b/meta/recipes-core/ncurses/files/0003-gen-pkgconfig.in-Do-not-include-LDFLAGS-in-generated.patch
@@ -1,4 +1,4 @@
-From 10cd0c12a6e14fb4f0498c299c1dd32720b710da Mon Sep 17 00:00:00 2001
+From 5962a5ee2885f67a396f7e8955ac1bbd7f15d4aa Mon Sep 17 00:00:00 2001
 From: Nathan Rossi <nathan@nathanrossi.com>
 Date: Mon, 14 Dec 2020 13:39:02 +1000
 Subject: [PATCH] gen-pkgconfig.in: Do not include LDFLAGS in generated pc
@@ -10,13 +10,12 @@ includes build host specific paths and options (e.g. uninative and
 
 Upstream-Status: Inappropriate [OE Specific]
 Signed-off-by: Nathan Rossi <nathan@nathanrossi.com>
-
 ---
  misc/gen-pkgconfig.in | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/misc/gen-pkgconfig.in b/misc/gen-pkgconfig.in
-index a45dd54f..85273054 100644
+index 89a5cd4a..07d94d17 100644
 --- a/misc/gen-pkgconfig.in
 +++ b/misc/gen-pkgconfig.in
 @@ -83,7 +83,7 @@ if [ "$includedir" != "/usr/include" ]; then
diff --git a/meta/recipes-core/ncurses/files/exit_prototype.patch b/meta/recipes-core/ncurses/files/exit_prototype.patch
index fd961512e0..299852d2c0 100644
--- a/meta/recipes-core/ncurses/files/exit_prototype.patch
+++ b/meta/recipes-core/ncurses/files/exit_prototype.patch
@@ -1,28 +1,27 @@
-From 4a769a441d7e57a23017c3037cde3e53fb9f35fe Mon Sep 17 00:00:00 2001
+From af798dceafec8a9ea3f83fc250d784511ca0a29c Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Tue, 30 Aug 2022 15:58:32 -0700
 Subject: [PATCH] Add needed headers for including mbstate_t and exit()
 
 Upstream-Status: Inappropriate [Reconfigure will solve it]
 Signed-off-by: Khem Raj <raj.khem@gmail.com>
-
 ---
  configure | 2 ++
  1 file changed, 2 insertions(+)
 
 diff --git a/configure b/configure
-index f377f551..163f8899 100755
+index 005d44e2..72fa6c23 100755
 --- a/configure
 +++ b/configure
-@@ -3423,6 +3423,7 @@ rm -f "conftest.$ac_objext" "conftest.$ac_ext"
+@@ -3462,6 +3462,7 @@ rm -f "conftest.$ac_objext" "conftest.$ac_ext"
    cat >"conftest.$ac_ext" <<_ACEOF
- #line 3424 "configure"
+ #line 3463 "configure"
  #include "confdefs.h"
 +#include <stdlib.h>
  $ac_declaration
  int
  main (void)
-@@ -13111,6 +13112,7 @@ cat >"conftest.$ac_ext" <<_ACEOF
+@@ -13533,6 +13534,7 @@ cat >"conftest.$ac_ext" <<_ACEOF
  #include <stdlib.h>
  #include <stdarg.h>
  #include <stdio.h>
diff --git a/meta/recipes-core/ncurses/ncurses.inc b/meta/recipes-core/ncurses/ncurses.inc
index 761b6a3d31..951f96beb5 100644
--- a/meta/recipes-core/ncurses/ncurses.inc
+++ b/meta/recipes-core/ncurses/ncurses.inc
@@ -2,7 +2,7 @@ SUMMARY = "The New Curses library"
 DESCRIPTION = "SVr4 and XSI-Curses compatible curses library and terminfo tools including tic, infocmp, captoinfo. Supports color, multiple highlights, forms-drawing characters, and automatic recognition of keypad and function-key sequences. Extensions include resizable windows and mouse support on both xterm and Linux console using the gpm library."
 HOMEPAGE = "http://www.gnu.org/software/ncurses/ncurses.html"
 LICENSE = "MIT"
-LIC_FILES_CHKSUM = "file://COPYING;md5=c5a4600fdef86384c41ca33ecc70a4b8;endline=27"
+LIC_FILES_CHKSUM = "file://COPYING;md5=6f291ee54551d9d8d992ecd623fe4bc7;endline=27"
 SECTION = "libs"
 DEPENDS = "ncurses-native"
 DEPENDS:class-native = ""
@@ -13,15 +13,13 @@ BINCONFIG = "${bindir}/ncurses5-config ${bindir}/ncursesw5-config \
 inherit autotools binconfig-disabled multilib_header pkgconfig
 
 # Upstream has useful patches at times at ftp://invisible-island.net/ncurses/
-SRC_URI = "git://github.com/mirror/ncurses.git;protocol=https;branch=master"
+SRC_URI = "git://github.com/ThomasDickey/ncurses-snapshots.git;protocol=https;branch=master"
 
 EXTRA_AUTORECONF = "-I m4"
 
 CACHED_CONFIGUREVARS = "cf_cv_func_nanosleep=yes"
 CACHED_CONFIGUREVARS:append:linux = " cf_cv_working_poll=yes"
 
-EXTRASITECONFIG = "CFLAGS='${CFLAGS} -I${SYSROOT_DESTDIR}${includedir}'"
-
 # Whether to enable separate widec libraries; must be 'true' or 'false'
 #
 # TODO: remove this variable when widec is supported in every setup?
@@ -30,6 +28,9 @@ ENABLE_WIDEC ?= "true"
 # _GNU_SOURCE is required for widec stuff and is not detected automatically
 CPPFLAGS += "-D_GNU_SOURCE"
 
+# Check if we still need it when next release (6.6) happens
+CFLAGS += "-std=gnu17"
+
 # natives don't generally look in base_libdir
 base_libdir:class-native = "${libdir}"
 
@@ -72,6 +73,7 @@ ncurses_configure() {
                 --without-debug \
                 --without-ada \
                 --without-gpm \
+                --with-xterm-kbs=del \
                 --enable-hard-tabs \
                 --enable-xmc-glitch \
                 --enable-colorfgbg \
@@ -173,7 +175,6 @@ do_install() {
         oe_runmake -C narrowc ${_install_cfgs} \
                 install.data
 
-
         ! ${ENABLE_WIDEC} || \
             oe_runmake -C widec ${_install_cfgs} ${_install_opts}
 
@@ -181,7 +182,7 @@ do_install() {
 
         # include some basic terminfo files
         # stolen ;) from gentoo and modified a bit
-        for x in ansi console dumb linux rxvt screen screen-256color sun vt52 vt100 vt102 vt200 vt220 xterm-color xterm-xfree86 xterm-256color
+        for x in alacritty ansi console dumb linux rxvt screen screen-256color sun vt52 vt100 vt102 vt200 vt220 xterm-color xterm-xfree86 xterm-256color
         do
                 local termfile="$(find "${D}${datadir}/terminfo/" -name "${x}" 2>/dev/null)"
                 local basedir="$(basename $(dirname "${termfile}"))"
@@ -261,7 +262,6 @@ python populate_packages:prepend () {
         do_split_packages(d, base_libdir, r'^lib(.*)\.so\..*', pnbase, 'ncurses %s library', prepend=True, extra_depends = '', allow_links=True)
 }
 
-
 inherit update-alternatives
 
 ALTERNATIVE_PRIORITY = "100"
diff --git a/meta/recipes-core/ncurses/ncurses_6.4.bb b/meta/recipes-core/ncurses/ncurses_6.5.bb
index 2c621525f9..bba3495266 100644
--- a/meta/recipes-core/ncurses/ncurses_6.4.bb
+++ b/meta/recipes-core/ncurses/ncurses_6.5.bb
@@ -4,14 +4,11 @@ SRC_URI += "file://0001-tic-hang.patch \
            file://0002-configure-reproducible.patch \
            file://0003-gen-pkgconfig.in-Do-not-include-LDFLAGS-in-generated.patch \
            file://exit_prototype.patch \
-           file://0001-Fix-CVE-2023-29491.patch \
-           file://0001-Updating-reset-code-ncurses-6.4-patch-20231104.patch \
            "
 # commit id corresponds to the revision in package version
-SRCREV = "79b9071f2be20a24c7be031655a5638f6032f29f"
-S = "${WORKDIR}/git"
+SRCREV = "1c55d64d9d3e00399a21f04e9cac1e472ab5f70a"
 EXTRA_OECONF += "--with-abi-version=5"
-UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+(\.\d+)+)$"
+UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>\d+_\d+)$"
 
 # This is needed when using patchlevel versions like 6.1+20181013
 #CVE_VERSION = "${@d.getVar("PV").split('+')[0]}.${@d.getVar("PV").split('+')[1]}"
diff --git a/meta/recipes-core/ncurses/site_config/headers b/meta/recipes-core/ncurses/site_config/headers
deleted file mode 100644
index 087b7bfd5e..0000000000
--- a/meta/recipes-core/ncurses/site_config/headers
+++ /dev/null
@@ -1,5 +0,0 @@
-curses.h
-ncurses/curses.h
-ncurses.h
-ncurses/termcap.h
-
diff --git a/meta/recipes-core/netbase/netbase_6.4.bb b/meta/recipes-core/netbase/netbase_6.5.bb
index 5a448a4b91..c6cf798421 100644
--- a/meta/recipes-core/netbase/netbase_6.4.bb
+++ b/meta/recipes-core/netbase/netbase_6.5.bb
@@ -10,7 +10,7 @@ SRC_URI = "${DEBIAN_MIRROR}/main/n/${BPN}/${BPN}_${PV}.tar.xz"
 
 inherit allarch
 
-SRC_URI[sha256sum] = "fa6621826ff1150e581bd90bc3c8a4ecafe5df90404f207db6dcdf2c75f26ad7"
+SRC_URI[sha256sum] = "9116047aebbaa1698934052d01c6e09b4c3aed643e93df63d2ddcbec243c26d1"
 
 UPSTREAM_CHECK_URI = "${DEBIAN_MIRROR}/main/n/netbase/"
 
@@ -22,4 +22,4 @@ do_install () {
         install -m 0644 ${S}/etc/ethertypes ${D}${sysconfdir}/ethertypes
 }
 
-S = "${WORKDIR}/netbase"
+S = "${UNPACKDIR}/netbase"
diff --git a/meta/recipes-core/newlib/libgloss_git.bb b/meta/recipes-core/newlib/libgloss_git.bb
index 7e34e33c7a..92bb81050b 100644
--- a/meta/recipes-core/newlib/libgloss_git.bb
+++ b/meta/recipes-core/newlib/libgloss_git.bb
@@ -6,7 +6,6 @@ FILESEXTRAPATHS:prepend := "${THISDIR}/libgloss:"
 
 SRC_URI:append = " file://libgloss-build-without-nostdinc.patch"
 SRC_URI:append:powerpc = " file://fix-rs6000-crt0.patch"
-SRC_URI:append:powerpc = " file://fix-rs6000-cflags.patch"
 
 do_configure() {
         ${S}/libgloss/configure ${EXTRA_OECONF}
@@ -22,8 +21,12 @@ do_install:append() {
         install -d ${D}${libdir}
         mv -v ${D}${prefix}/${TARGET_SYS}/lib/* ${D}${libdir}
 
-        # Remove original directory
-        rmdir -p --ignore-fail-on-non-empty ${D}${prefix}/${TARGET_SYS}/lib
+        # Remove original directory
+        rmdir -p --ignore-fail-on-non-empty ${D}${prefix}/${TARGET_SYS}/lib
+        # Remove empty include dir
+        rmdir ${D}/${prefix}/${TARGET_SYS}/include
+        rmdir ${D}/${prefix}/${TARGET_SYS}/
+
 }
 
 # Split packages correctly
diff --git a/meta/recipes-core/newlib/newlib.inc b/meta/recipes-core/newlib/newlib.inc
index 6113f5e831..a8794dd1d9 100644
--- a/meta/recipes-core/newlib/newlib.inc
+++ b/meta/recipes-core/newlib/newlib.inc
@@ -8,26 +8,32 @@ LIC_FILES_CHKSUM = " \
                 file://COPYING;md5=59530bdf33659b29e73d4adb9f9f6552 \
                 file://COPYING3.LIB;md5=6a6a8e020838b23406c81b19c1d46df6 \
                 file://COPYING3;md5=d32239bcb673463ab874e80d47fae504 \
-                file://COPYING.LIBGLOSS;md5=c0469b6ebb847a75781066be515f032d \
+                file://COPYING.LIBGLOSS;md5=faa6f6ad545714df2a7d1276ed899f15 \
                 file://COPYING.LIB;md5=2d5025d4aa3495befef8f17206a5b0a1 \
-                file://COPYING.NEWLIB;md5=4f1a15846ffee91e352418563e1bce27 \
+                file://COPYING.NEWLIB;md5=61255563bbcda142f581b94591b6a589 \
                 file://newlib/libc/posix/COPYRIGHT;md5=103468ff1982be840fdf4ee9f8b51bbf \
                 "
 
-BASEVER = "4.4.0"
+BASEVER = "4.5.0"
 PV = "${BASEVER}+git"
 SRC_URI = "git://sourceware.org/git/newlib-cygwin.git;protocol=https;branch=main"
-SRCREV="ad11e2587f83d61357a32c61c36d72ea4f39315e"
+SRCREV = "5e5e51f1dc56a99eb4648c28e00d73b6ea44a8b0"
 
 INHIBIT_DEFAULT_DEPS = "1"
-DEPENDS = "virtual/${TARGET_PREFIX}gcc"
+DEPENDS = "virtual/cross-cc"
 
-S = "${WORKDIR}/git"
 B = "${WORKDIR}/build"
 
 ## disable stdlib
 TARGET_CC_ARCH:append = " -nostdlib"
 
+# Both the C library and the application should share the same mcmodel.
+# Use the medium-any code model for the RISC-V 64 bit implementation,
+# since medlow can only access addresses below 0x80000000 and RAM
+# starts at 0x80000000 on RISC-V 64
+# Keep RISC-V 32 using -mcmodel=medlow (symbols lie between -2GB:2GB)
+TARGET_CFLAGS:append:qemuriscv64 = " -mcmodel=medany"
+
 EXTRA_OECONF = " \
                 --build=${BUILD_SYS}  \
                 --target=${TARGET_SYS} \
diff --git a/meta/recipes-core/os-release/os-release.bb b/meta/recipes-core/os-release/os-release.bb
index 8906906bc3..e1906d05d8 100644
--- a/meta/recipes-core/os-release/os-release.bb
+++ b/meta/recipes-core/os-release/os-release.bb
@@ -24,7 +24,7 @@ ID = "${DISTRO}"
 NAME = "${DISTRO_NAME}"
 VERSION = "${DISTRO_VERSION}${@' (%s)' % DISTRO_CODENAME if 'DISTRO_CODENAME' in d else ''}"
 VERSION_ID = "${DISTRO_VERSION}"
-VERSION_CODENAME = "${DISTRO_CODENAME}"
+VERSION_CODENAME = "${@d.getVar('DISTRO_CODENAME') or ''}"
 PRETTY_NAME = "${DISTRO_NAME} ${VERSION}"
 
 # The vendor field is hardcoded to "openembedded" deliberately. We'd
@@ -38,7 +38,7 @@ PRETTY_NAME = "${DISTRO_NAME} ${VERSION}"
 # the CPE.
 
 CPE_DISTRO ??= "${DISTRO}"
-CPE_NAME="cpe:/o:openembedded:${CPE_DISTRO}:${VERSION_ID}"
+CPE_NAME = "cpe:/o:openembedded:${CPE_DISTRO}:${VERSION_ID}"
 
 BUILD_ID ?= "${DATETIME}"
 BUILD_ID[vardepsexclude] = "DATETIME"
diff --git a/meta/recipes-core/ovmf/ovmf-shell-image.bb b/meta/recipes-core/ovmf/ovmf-shell-image.bb
index 4d7958eb5f..5aafba97e0 100644
--- a/meta/recipes-core/ovmf/ovmf-shell-image.bb
+++ b/meta/recipes-core/ovmf/ovmf-shell-image.bb
@@ -1,5 +1,5 @@
 SUMMARY = "boot image with UEFI shell and tools"
-COMPATIBLE_HOST:class-target='(i.86|x86_64).*'
+COMPATIBLE_HOST:class-target = '(i.86|x86_64).*'
 
 # For this image recipe, only the wic format with a
 # single vfat partition makes sense. Because we have no
diff --git a/meta/recipes-core/ovmf/ovmf/0001-ovmf-update-path-to-native-BaseTools.patch b/meta/recipes-core/ovmf/ovmf/0001-ovmf-update-path-to-native-BaseTools.patch
index 490d9e8046..cee5042846 100644
--- a/meta/recipes-core/ovmf/ovmf/0001-ovmf-update-path-to-native-BaseTools.patch
+++ b/meta/recipes-core/ovmf/ovmf/0001-ovmf-update-path-to-native-BaseTools.patch
@@ -1,4 +1,4 @@
-From d8df6b6433351763e1db791dd84d432983d2b249 Mon Sep 17 00:00:00 2001
+From 61583b59620946683551f43c6110e656604a252f Mon Sep 17 00:00:00 2001
 From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
 Date: Thu, 9 Jun 2016 02:23:01 -0700
 Subject: [PATCH 1/4] ovmf: update path to native BaseTools
@@ -16,7 +16,7 @@ Upstream-Status: Inappropriate [oe-core cross compile specific]
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/OvmfPkg/build.sh b/OvmfPkg/build.sh
-index b0334fb76e..094f86f096 100755
+index 279f0d099a..285f061bf4 100755
 --- a/OvmfPkg/build.sh
 +++ b/OvmfPkg/build.sh
 @@ -24,7 +24,7 @@ then
@@ -29,5 +29,5 @@ index b0334fb76e..094f86f096 100755
    source edksetup.sh BaseTools
  else
 -- 
-2.30.2
+2.39.5
 
diff --git a/meta/recipes-core/ovmf/ovmf/0002-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch b/meta/recipes-core/ovmf/ovmf/0002-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch
index eeedc9e20f..11d97c739a 100644
--- a/meta/recipes-core/ovmf/ovmf/0002-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch
+++ b/meta/recipes-core/ovmf/ovmf/0002-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch
@@ -1,7 +1,7 @@
-From ac9df4fb92965f1f95a5bdbde5f2f86d0c569711 Mon Sep 17 00:00:00 2001
+From aacbf7c91732b9959e569e90844cf9de078b2f14 Mon Sep 17 00:00:00 2001
 From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
 Date: Fri, 26 Jul 2019 17:34:26 -0400
-Subject: [PATCH] BaseTools: makefile: adjust to build in under bitbake
+Subject: [PATCH 2/4] BaseTools: makefile: adjust to build in under bitbake
 
 Prepend the build flags with those of bitbake. This is to build
 using the bitbake native sysroot include and library directories.
@@ -65,5 +65,5 @@ index d369908a09..22c670f316 100644
  #

  # Snow Leopard  is a 32-bit and 64-bit environment. uname -m returns i386, but gcc defaults

 -- 
-2.30.2
+2.39.5
 
diff --git a/meta/recipes-core/ovmf/ovmf/0003-debug-prefix-map.patch b/meta/recipes-core/ovmf/ovmf/0003-debug-prefix-map.patch
index c0c763c1cf..4a20548c61 100644
--- a/meta/recipes-core/ovmf/ovmf/0003-debug-prefix-map.patch
+++ b/meta/recipes-core/ovmf/ovmf/0003-debug-prefix-map.patch
@@ -1,4 +1,4 @@
-From 03e536b20d0b72cf078052f6748de8df3836625c Mon Sep 17 00:00:00 2001
+From 96fa2a7f2f54f1e6330275b5eba07e1efdbd865b Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Mon, 14 Jun 2021 19:56:28 +0200
 Subject: [PATCH 3/4] debug prefix map
@@ -21,20 +21,18 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
  BaseTools/Conf/tools_def.template | 18 +++++++++---------
  1 file changed, 9 insertions(+), 9 deletions(-)
 
-diff --git a/BaseTools/Conf/tools_def.template b/BaseTools/Conf/tools_def.template
-index 503a6687c1..10ac38ef9e 100755
 --- a/BaseTools/Conf/tools_def.template
 +++ b/BaseTools/Conf/tools_def.template
-@@ -739,7 +739,7 @@ NOOPT_*_*_OBJCOPY_ADDDEBUGFLAG     = --add-gnu-debuglink="$(DEBUG_DIR)/$(MODULE_
- *_*_*_DTCPP_PATH                   = DEF(DTCPP_BIN)

+@@ -920,7 +920,7 @@ NOOPT_*_*_OBJCOPY_ADDDEBUGFLAG     = --a
  *_*_*_DTC_PATH                     = DEF(DTC_BIN)

  

--DEFINE GCC_ALL_CC_FLAGS            = -g -Os -fshort-wchar -fno-builtin -fno-strict-aliasing -Wall -Werror -Wno-array-bounds -include AutoGen.h -fno-common

-+DEFINE GCC_ALL_CC_FLAGS            = -g -Os -fshort-wchar -fno-builtin -fno-strict-aliasing -Wall -Werror -Wno-array-bounds -include AutoGen.h -fno-common ENV(GCC_PREFIX_MAP)

- DEFINE GCC_ARM_CC_FLAGS            = DEF(GCC_ALL_CC_FLAGS) -mlittle-endian -mabi=aapcs -fno-short-enums -funsigned-char -ffunction-sections -fdata-sections -fomit-frame-pointer -Wno-address -mthumb -fno-pic -fno-pie

- DEFINE GCC_LOONGARCH64_CC_FLAGS    = DEF(GCC_ALL_CC_FLAGS) -mabi=lp64d -fno-asynchronous-unwind-tables -fno-plt -Wno-address -fno-short-enums -fsigned-char -ffunction-sections -fdata-sections

- DEFINE GCC_ARM_CC_XIPFLAGS         = -mno-unaligned-access

-@@ -759,8 +759,8 @@ DEFINE GCC_ARM_ASLDLINK_FLAGS      = DEF(GCC_ARM_DLINK_FLAGS) -Wl,--entry,Refere
+ # All supported GCC archs except LOONGARCH64 support -mstack-protector-guard=global, so set that on everything except LOONGARCH64

+-DEFINE GCC_ALL_CC_FLAGS            = -g -Os -fshort-wchar -fno-builtin -fno-strict-aliasing -Wall -Werror -Wno-array-bounds -include AutoGen.h -fno-common -fstack-protector

++DEFINE GCC_ALL_CC_FLAGS            = -g -Os -fshort-wchar -fno-builtin -fno-strict-aliasing -Wall -Werror -Wno-array-bounds -include AutoGen.h -fno-common -fstack-protector ENV(GCC_PREFIX_MAP)

+ DEFINE GCC_IA32_X64_CC_FLAGS       = -mstack-protector-guard=global

+ DEFINE GCC_ARM_CC_FLAGS            = DEF(GCC_ALL_CC_FLAGS) -mlittle-endian -mabi=aapcs -fno-short-enums -funsigned-char -ffunction-sections -fdata-sections -fomit-frame-pointer -Wno-address -mthumb -fno-pic -fno-pie -mstack-protector-guard=global

+ DEFINE GCC_LOONGARCH64_CC_FLAGS    = DEF(GCC_ALL_CC_FLAGS) -mabi=lp64d -fno-asynchronous-unwind-tables -Wno-address -fno-short-enums -fsigned-char -ffunction-sections -fdata-sections

+@@ -941,8 +941,8 @@ DEFINE GCC_ARM_ASLDLINK_FLAGS      = DEF
  DEFINE GCC_AARCH64_ASLDLINK_FLAGS  = DEF(GCC_AARCH64_DLINK_FLAGS) -Wl,--entry,ReferenceAcpiTable -u $(IMAGE_ENTRY_POINT) DEF(GCC_ARM_AARCH64_ASLDLINK_FLAGS)

  DEFINE GCC_LOONGARCH64_ASLDLINK_FLAGS = DEF(GCC_LOONGARCH64_DLINK_FLAGS) -Wl,--entry,ReferenceAcpiTable -u $(IMAGE_ENTRY_POINT)

  DEFINE GCC_IA32_X64_DLINK_FLAGS    = DEF(GCC_IA32_X64_DLINK_COMMON) --entry _$(IMAGE_ENTRY_POINT) --file-alignment 0x20 --section-alignment 0x20 -Map $(DEST_DIR_DEBUG)/$(BASE_NAME).map

@@ -45,7 +43,7 @@ index 503a6687c1..10ac38ef9e 100755
  DEFINE GCC_VFRPP_FLAGS             = -x c -E -P -DVFRCOMPILE --include $(MODULE_NAME)StrDefs.h

  DEFINE GCC_ASLPP_FLAGS             = -x c -E -include AutoGen.h

  DEFINE GCC_ASLCC_FLAGS             = -x c

-@@ -913,7 +913,7 @@ DEFINE GCC5_LOONGARCH64_PP_FLAGS           = -mabi=lp64d -march=loongarch64 DEF(
+@@ -1095,7 +1095,7 @@ DEFINE GCC5_LOONGARCH64_PP_FLAGS
  *_GCC48_IA32_DLINK2_FLAGS         = DEF(GCC48_IA32_DLINK2_FLAGS)

  *_GCC48_IA32_RC_FLAGS             = DEF(GCC_IA32_RC_FLAGS)

  *_GCC48_IA32_OBJCOPY_FLAGS        =

@@ -54,7 +52,7 @@ index 503a6687c1..10ac38ef9e 100755
  

    DEBUG_GCC48_IA32_CC_FLAGS       = DEF(GCC48_IA32_CC_FLAGS)

  RELEASE_GCC48_IA32_CC_FLAGS       = DEF(GCC48_IA32_CC_FLAGS) -Wno-unused-but-set-variable

-@@ -941,7 +941,7 @@ RELEASE_GCC48_IA32_CC_FLAGS       = DEF(GCC48_IA32_CC_FLAGS) -Wno-unused-but-set
+@@ -1123,7 +1123,7 @@ RELEASE_GCC48_IA32_CC_FLAGS       = DEF(
  *_GCC48_X64_DLINK2_FLAGS         = DEF(GCC48_X64_DLINK2_FLAGS)

  *_GCC48_X64_RC_FLAGS             = DEF(GCC_X64_RC_FLAGS)

  *_GCC48_X64_OBJCOPY_FLAGS        =

@@ -63,7 +61,7 @@ index 503a6687c1..10ac38ef9e 100755
  

    DEBUG_GCC48_X64_CC_FLAGS       = DEF(GCC48_X64_CC_FLAGS)

  RELEASE_GCC48_X64_CC_FLAGS       = DEF(GCC48_X64_CC_FLAGS) -Wno-unused-but-set-variable

-@@ -1050,7 +1050,7 @@ RELEASE_GCC48_AARCH64_CC_FLAGS   = DEF(GCC48_AARCH64_CC_FLAGS) -Wno-unused-but-s
+@@ -1232,7 +1232,7 @@ RELEASE_GCC48_AARCH64_CC_FLAGS   = DEF(G
  *_GCC49_IA32_DLINK2_FLAGS         = DEF(GCC49_IA32_DLINK2_FLAGS)

  *_GCC49_IA32_RC_FLAGS             = DEF(GCC_IA32_RC_FLAGS)

  *_GCC49_IA32_OBJCOPY_FLAGS        =

@@ -72,7 +70,7 @@ index 503a6687c1..10ac38ef9e 100755
  

    DEBUG_GCC49_IA32_CC_FLAGS       = DEF(GCC49_IA32_CC_FLAGS)

  RELEASE_GCC49_IA32_CC_FLAGS       = DEF(GCC49_IA32_CC_FLAGS) -Wno-unused-but-set-variable -Wno-unused-const-variable

-@@ -1078,7 +1078,7 @@ RELEASE_GCC49_IA32_CC_FLAGS       = DEF(GCC49_IA32_CC_FLAGS) -Wno-unused-but-set
+@@ -1260,7 +1260,7 @@ RELEASE_GCC49_IA32_CC_FLAGS       = DEF(
  *_GCC49_X64_DLINK2_FLAGS         = DEF(GCC49_X64_DLINK2_FLAGS)

  *_GCC49_X64_RC_FLAGS             = DEF(GCC_X64_RC_FLAGS)

  *_GCC49_X64_OBJCOPY_FLAGS        =

@@ -81,7 +79,7 @@ index 503a6687c1..10ac38ef9e 100755
  

    DEBUG_GCC49_X64_CC_FLAGS       = DEF(GCC49_X64_CC_FLAGS)

  RELEASE_GCC49_X64_CC_FLAGS       = DEF(GCC49_X64_CC_FLAGS) -Wno-unused-but-set-variable -Wno-unused-const-variable

-@@ -1337,7 +1337,7 @@ RELEASE_GCCNOLTO_AARCH64_DLINK_XIPFLAGS = -z common-page-size=0x20
+@@ -1519,7 +1519,7 @@ RELEASE_GCCNOLTO_AARCH64_DLINK_XIPFLAGS
  *_GCC5_IA32_DLINK2_FLAGS         = DEF(GCC5_IA32_DLINK2_FLAGS) -no-pie

  *_GCC5_IA32_RC_FLAGS             = DEF(GCC_IA32_RC_FLAGS)

  *_GCC5_IA32_OBJCOPY_FLAGS        =

@@ -90,7 +88,7 @@ index 503a6687c1..10ac38ef9e 100755
  

    DEBUG_GCC5_IA32_CC_FLAGS       = DEF(GCC5_IA32_CC_FLAGS) -flto

    DEBUG_GCC5_IA32_DLINK_FLAGS    = DEF(GCC5_IA32_X64_DLINK_FLAGS) -flto -Os -Wl,-m,elf_i386,--oformat=elf32-i386

-@@ -1369,7 +1369,7 @@ RELEASE_GCC5_IA32_DLINK_FLAGS    = DEF(GCC5_IA32_X64_DLINK_FLAGS) -flto -Os -Wl,
+@@ -1551,7 +1551,7 @@ RELEASE_GCC5_IA32_DLINK_FLAGS    = DEF(G
  *_GCC5_X64_DLINK2_FLAGS          = DEF(GCC5_X64_DLINK2_FLAGS)

  *_GCC5_X64_RC_FLAGS              = DEF(GCC_X64_RC_FLAGS)

  *_GCC5_X64_OBJCOPY_FLAGS         =

@@ -99,6 +97,3 @@ index 503a6687c1..10ac38ef9e 100755
  

    DEBUG_GCC5_X64_CC_FLAGS        = DEF(GCC5_X64_CC_FLAGS) -flto -DUSING_LTO

    DEBUG_GCC5_X64_DLINK_FLAGS     = DEF(GCC5_X64_DLINK_FLAGS) -flto -Os

--- 
-2.30.2
-
diff --git a/meta/recipes-core/ovmf/ovmf/0004-reproducible.patch b/meta/recipes-core/ovmf/ovmf/0004-reproducible.patch
index c3fdc3d863..0ddb86f530 100644
--- a/meta/recipes-core/ovmf/ovmf/0004-reproducible.patch
+++ b/meta/recipes-core/ovmf/ovmf/0004-reproducible.patch
@@ -1,4 +1,4 @@
-From c59850367a190d70dec43e0a66f399a4d8a5ffed Mon Sep 17 00:00:00 2001
+From fc2d3c17ff2a7b39e8d47b788eeaac5e1487cdee Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Mon, 14 Jun 2021 19:57:30 +0200
 Subject: [PATCH 4/4] reproducible
@@ -34,13 +34,11 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
  .../Source/Python/AutoGen/ModuleAutoGen.py    |  5 +++-
  4 files changed, 24 insertions(+), 16 deletions(-)
 
-diff --git a/BaseTools/Source/C/GenFw/Elf64Convert.c b/BaseTools/Source/C/GenFw/Elf64Convert.c
-index 9c17c90b16..fcc7864141 100644
 --- a/BaseTools/Source/C/GenFw/Elf64Convert.c
 +++ b/BaseTools/Source/C/GenFw/Elf64Convert.c
-@@ -15,6 +15,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
- #ifndef __GNUC__

+@@ -15,6 +15,8 @@ SPDX-License-Identifier: BSD-2-Clause-Pa
  #include <windows.h>

+ #undef RUNTIME_FUNCTION

  #include <io.h>

 +#else

 +#define _GNU_SOURCE

@@ -56,7 +54,7 @@ index 9c17c90b16..fcc7864141 100644
  

    //

    // Add more space in the .debug data region for the DllCharacteristicsEx

-@@ -2261,7 +2263,7 @@ WriteDebug64 (
+@@ -2310,7 +2312,7 @@ WriteDebug64 (
    EFI_IMAGE_DEBUG_CODEVIEW_NB10_ENTRY         *Nb10;

    EFI_IMAGE_DEBUG_EX_DLLCHARACTERISTICS_ENTRY *DllEntry;

  

@@ -65,7 +63,7 @@ index 9c17c90b16..fcc7864141 100644
  

    NtHdr = (EFI_IMAGE_OPTIONAL_HEADER_UNION *)(mCoffFile + mNtHdrOffset);

    DataDir = &NtHdr->Pe32Plus.OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_DEBUG];

-@@ -2294,7 +2296,7 @@ WriteDebug64 (
+@@ -2343,7 +2345,7 @@ WriteDebug64 (
  

    Nb10 = (EFI_IMAGE_DEBUG_CODEVIEW_NB10_ENTRY*)(Dir + 1);

    Nb10->Signature = CODEVIEW_SIGNATURE_NB10;

@@ -74,8 +72,6 @@ index 9c17c90b16..fcc7864141 100644
  }

  

  STATIC

-diff --git a/BaseTools/Source/Python/AutoGen/BuildEngine.py b/BaseTools/Source/Python/AutoGen/BuildEngine.py
-index 752a1a1f6a..02054cccf8 100644
 --- a/BaseTools/Source/Python/AutoGen/BuildEngine.py
 +++ b/BaseTools/Source/Python/AutoGen/BuildEngine.py
 @@ -70,6 +70,9 @@ class TargetDescBlock(object):
@@ -88,11 +84,9 @@ index 752a1a1f6a..02054cccf8 100644
      def AddInput(self, Input):

          if Input not in self.Inputs:

              self.Inputs.append(Input)

-diff --git a/BaseTools/Source/Python/AutoGen/GenMake.py b/BaseTools/Source/Python/AutoGen/GenMake.py
-index daec9c6d54..0e8cc20efe 100755
 --- a/BaseTools/Source/Python/AutoGen/GenMake.py
 +++ b/BaseTools/Source/Python/AutoGen/GenMake.py
-@@ -575,7 +575,7 @@ cleanlib:
+@@ -576,7 +576,7 @@ cleanlib:
                  os.remove(RespFileList)

  

          # convert source files and binary files to build targets

@@ -101,7 +95,7 @@ index daec9c6d54..0e8cc20efe 100755
          if len(self.ResultFileList) == 0 and len(MyAgo.SourceFileList) != 0:

              EdkLogger.error("build", AUTOGEN_ERROR, "Nothing to build",

                              ExtraData="[%s]" % str(MyAgo))

-@@ -726,7 +726,7 @@ cleanlib:
+@@ -727,7 +727,7 @@ cleanlib:
          OutputFile = ''

          DepsFileList = []

  

@@ -110,7 +104,7 @@ index daec9c6d54..0e8cc20efe 100755
              if Cmd[2]:

                  for CopyCmd in Cmd[2]:

                      Src, Dst = CopyCmd

-@@ -759,7 +759,7 @@ cleanlib:
+@@ -760,7 +760,7 @@ cleanlib:
              self.BuildTargetList.append('\t%s' % CmdString)

  

              self.ParseSecCmd(DepsFileList, Cmd[1])

@@ -119,7 +113,7 @@ index daec9c6d54..0e8cc20efe 100755
                  self.BuildTargetList.append('%s : %s' % (self.ReplaceMacro(SecOutputFile), self.ReplaceMacro(SecDepsFile)))

                  self.BuildTargetList.append('\t%s' % self.ReplaceMacro(SecCmd))

              self.FfsOutputFileList = []

-@@ -798,13 +798,13 @@ cleanlib:
+@@ -799,13 +799,13 @@ cleanlib:
  

      def CommandExceedLimit(self):

          FlagDict = {

@@ -140,7 +134,7 @@ index daec9c6d54..0e8cc20efe 100755
                     }

  

          RespDict = {}

-@@ -1007,9 +1007,9 @@ cleanlib:
+@@ -1019,9 +1019,9 @@ cleanlib:
                  if not self.ObjTargetDict.get(T.Target.SubDir):

                      self.ObjTargetDict[T.Target.SubDir] = set()

                  self.ObjTargetDict[T.Target.SubDir].add(NewFile)

@@ -152,8 +146,6 @@ index daec9c6d54..0e8cc20efe 100755
                  # Generate related macros if needed

                  if T.GenFileListMacro and T.FileListMacro not in self.FileListMacros:

                      self.FileListMacros[T.FileListMacro] = []

-diff --git a/BaseTools/Source/Python/AutoGen/ModuleAutoGen.py b/BaseTools/Source/Python/AutoGen/ModuleAutoGen.py
-index d05410b329..99b3f64aba 100755
 --- a/BaseTools/Source/Python/AutoGen/ModuleAutoGen.py
 +++ b/BaseTools/Source/Python/AutoGen/ModuleAutoGen.py
 @@ -1474,6 +1474,9 @@ class ModuleAutoGen(AutoGen):
@@ -175,6 +167,3 @@ index d05410b329..99b3f64aba 100755
  

          # Ignore generating makefile when it is a binary module

          if self.IsBinaryModule:

--- 
-2.30.2
-
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-1.patch b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-1.patch
new file mode 100644
index 0000000000..066dfa0ff0
--- /dev/null
+++ b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-1.patch
@@ -0,0 +1,43 @@
+From 2c8fb3e5164effc8a370e800fe91db7341e69116 Mon Sep 17 00:00:00 2001
+From: Doug Flick <dougflick@microsoft.com>
+Date: Mon, 7 Apr 2025 11:23:41 -0700
+Subject: [PATCH 1/4] SecurityPkg: Update SecurityFixes.yaml for CVE-2024-38797
+
+This commit updates the SecurityFixes.yaml file to include
+information about the CVE-2024-38797 vulnerability.
+
+Signed-off-by: Doug Flick <DougFlick@microsoft.com>
+
+CVE: CVE-2024-38797
+Upstream-Status: Backport [https://github.com/tianocore/edk2/pull/10928/commits/519366f542e9370bee982b1c3687ffedb5cabc21]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ SecurityPkg/SecurityFixes.yaml | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/SecurityPkg/SecurityFixes.yaml b/SecurityPkg/SecurityFixes.yaml
+index b4006b4..06b597a 100644
+--- a/SecurityPkg/SecurityFixes.yaml
++++ b/SecurityPkg/SecurityFixes.yaml
+@@ -40,3 +40,18 @@ CVE_2022_36764:
+     - Library\DxeTpmMeasureBootLib\DxeTpmMeasureBootLib.c

+   links:

+     - https://bugzilla.tianocore.org/show_bug.cgi?id=4118

++CVE_2024_38797:

++  commit-titles:

++    - "SecurityPkg: Out of bound read in HashPeImageByType()"

++    - "SecurityPkg: Improving HashPeImageByType () logic"

++    - "SecurityPkg: Improving SecureBootConfigImpl:HashPeImageByType () logic"

++  cve: CVE-2024-38797

++  date_reported: 2024-06-04 12:00 UTC

++  description: Out of bound read in HashPeImageByType()

++  note:

++  files_impacted:

++    - SecurityPkg\Library\DxeImageVerificationLib\DxeImageVerificationLib.c

++    - SecurityPkg\VariableAuthenticated\SecureBootConfigDxe\SecureBootConfigImpl.c

++  links:

++    - https://bugzilla.tianocore.org/show_bug.cgi?id=2214

++    - https://github.com/tianocore/edk2/security/advisories/GHSA-4wjw-6xmf-44xf

+-- 
+2.34.1
+
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-2.patch b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-2.patch
new file mode 100644
index 0000000000..9bf6645681
--- /dev/null
+++ b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-2.patch
@@ -0,0 +1,63 @@
+From 1a7be26382c4a34504875f094e15fe371d44192e Mon Sep 17 00:00:00 2001
+From: Doug Flick <dougflick@microsoft.com>
+Date: Thu, 3 Oct 2024 09:37:18 -0700
+Subject: [PATCH 2/4] SecurityPkg: Out of bound read in HashPeImageByType()
+
+In HashPeImageByType(), the hash of PE/COFF image is calculated.
+This function may get untrusted input.
+
+Inside this function, the following code verifies the loaded image has
+the correct format, by reading the second byte of the buffer.
+
+```c
+  if ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) {
+        ...
+  }
+```
+
+The input image is not trusted and that may not have the second byte to
+read. So this poses an out of bound read error.
+
+With below fix we are assuring that we don't do out of bound read. i.e,
+we make sure that AuthDataSize is greater than 1.
+
+```c
+  if (AuthDataSize > 1
+      && (*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE){
+    ...
+  }
+```
+
+AuthDataSize size is verified before reading the second byte.
+So if AuthDataSize is less than 2, the second byte will not be read, and
+the out of bound read situation won't occur.
+
+Tested the patch on real platform with and without TPM connected and
+verified image is booting fine.
+
+Authored-by: Raj AlwinX Selvaraj <Alw...@intel.com>
+Signed-off-by: Doug Flick <DougFlick@microsoft.com>
+
+CVE: CVE-2024-38797
+Upstream-Status: Backport [https://github.com/tianocore/edk2/pull/10928/commits/2dcdb41b564aa3cb846644b4b1722a0b3ae5e06b]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ .../Library/DxeImageVerificationLib/DxeImageVerificationLib.c   | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index b05da19..2afa2c9 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
++++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -642,7 +642,7 @@ HashPeImageByType (
+     //    This field has the fixed offset (+32) in final Authenticode ASN.1 data.

+     //    Fixed offset (+32) is calculated based on two bytes of length encoding.

+     //

+-    if ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) {

++    if ((AuthDataSize > 1) && ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE)) {

+       //

+       // Only support two bytes of Long Form of Length Encoding.

+       //

+-- 
+2.34.1
+
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-3.patch b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-3.patch
new file mode 100644
index 0000000000..169c78daab
--- /dev/null
+++ b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-3.patch
@@ -0,0 +1,99 @@
+From 4db363db013a92937431234252fc9d84e44fc120 Mon Sep 17 00:00:00 2001
+From: Doug Flick <dougflick@microsoft.com>
+Date: Thu, 3 Oct 2024 10:16:57 -0700
+Subject: [PATCH 3/4] SecurityPkg: Improving HashPeImageByType () logic
+
+Namely:
+
+(1) The TWO_BYTE_ENCODE check is independent of Index. If it evalutes
+    to TRUE for Index==0, then it will evaluate to TRUE for all other
+    Index values as well. As a result, the (Index == HASHALG_MAX)
+    condition will fire after the loop, and we'll return
+    EFI_UNSUPPORTED.
+
+    While this is correct, functionally speaking, it is wasteful to
+    keep re-checking TWO_BYTE_ENCODE in the loop body. The check
+    should be made at the top of the function, and EFI_UNSUPPORTED
+    should be returned at once, if appropriate.
+
+(2) If the hash algorithm selected by Index has such a large OID that
+    the OID comparison cannot even be performed (because AuthDataSize
+    is not large enough for containing the OID in question, starting
+    at offset 32), then the function returns EFI_UNSUPPORTED at once.
+
+    This is bogus; this case should simply be treated as an OID
+    mismatch, and the loop should advance to the next Index value /
+    hash algorithm candidate. A remaining hash algo may have a shorter
+    OID and yield an OID match.
+
+Signed-off-by: Doug Flick <DougFlick@microsoft.com>
+
+CVE: CVE-2024-38797
+Upstream-Status: Backport [https://github.com/tianocore/edk2/pull/10928/commits/5df518ec510324f48ed1cf0376150960644b41f0]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ .../DxeImageVerificationLib.c                 | 37 ++++++++++---------
+ 1 file changed, 19 insertions(+), 18 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index 2afa2c9..2eca39d 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
++++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -618,6 +618,7 @@ Done:
+   @param[in]  AuthDataSize        Size of the Authenticode Signature in bytes.

+ 

+   @retval EFI_UNSUPPORTED             Hash algorithm is not supported.

++  @retval EFI_BAD_BUFFER_SIZE         AuthData provided is invalid size.

+   @retval EFI_SUCCESS                 Hash successfully.

+ 

+ **/

+@@ -629,28 +630,28 @@ HashPeImageByType (
+ {

+   UINT8  Index;

+ 

+-  for (Index = 0; Index < HASHALG_MAX; Index++) {

++  //

++  // Check the Hash algorithm in PE/COFF Authenticode.

++  //    According to PKCS#7 Definition:

++  //        SignedData ::= SEQUENCE {

++  //            version Version,

++  //            digestAlgorithms DigestAlgorithmIdentifiers,

++  //            contentInfo ContentInfo,

++  //            .... }

++  //    The DigestAlgorithmIdentifiers can be used to determine the hash algorithm in PE/COFF hashing

++  //    This field has the fixed offset (+32) in final Authenticode ASN.1 data.

++  //    Fixed offset (+32) is calculated based on two bytes of length encoding.

++  //

++  if ((AuthDataSize > 1) && ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE)) {

+     //

+-    // Check the Hash algorithm in PE/COFF Authenticode.

+-    //    According to PKCS#7 Definition:

+-    //        SignedData ::= SEQUENCE {

+-    //            version Version,

+-    //            digestAlgorithms DigestAlgorithmIdentifiers,

+-    //            contentInfo ContentInfo,

+-    //            .... }

+-    //    The DigestAlgorithmIdentifiers can be used to determine the hash algorithm in PE/COFF hashing

+-    //    This field has the fixed offset (+32) in final Authenticode ASN.1 data.

+-    //    Fixed offset (+32) is calculated based on two bytes of length encoding.

++    // Only support two bytes of Long Form of Length Encoding.

+     //

+-    if ((AuthDataSize > 1) && ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE)) {

+-      //

+-      // Only support two bytes of Long Form of Length Encoding.

+-      //

+-      continue;

+-    }

++    return EFI_BAD_BUFFER_SIZE;

++  }

+ 

++  for (Index = 0; Index < HASHALG_MAX; Index++) {

+     if (AuthDataSize < 32 + mHash[Index].OidLength) {

+-      return EFI_UNSUPPORTED;

++      continue;

+     }

+ 

+     if (CompareMem (AuthData + 32, mHash[Index].OidValue, mHash[Index].OidLength) == 0) {

+-- 
+2.34.1
+
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-4.patch b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-4.patch
new file mode 100644
index 0000000000..86bc950e7d
--- /dev/null
+++ b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-4.patch
@@ -0,0 +1,97 @@
+From cb3342702c5c1f8a4ddbb6d503a98ed720d14eb3 Mon Sep 17 00:00:00 2001
+From: Doug Flick <dougflick@microsoft.com>
+Date: Fri, 17 Jan 2025 11:30:17 -0800
+Subject: [PATCH 4/4] SecurityPkg: Improving
+ SecureBootConfigImpl:HashPeImageByType () logic
+
+Namely:
+
+(1) The TWO_BYTE_ENCODE check is independent of Index. If it evalutes
+    to TRUE for Index==0, then it will evaluate to TRUE for all other
+    Index values as well. As a result, the (Index == HASHALG_MAX)
+    condition will fire after the loop, and we'll return
+    EFI_UNSUPPORTED.
+
+    While this is correct, functionally speaking, it is wasteful to
+    keep re-checking TWO_BYTE_ENCODE in the loop body. The check
+    should be made at the top of the function, and EFI_UNSUPPORTED
+    should be returned at once, if appropriate.
+
+(2) If the hash algorithm selected by Index has such a large OID that
+    the OID comparison cannot even be performed (because AuthDataSize
+    is not large enough for containing the OID in question, starting
+    at offset 32), then the function returns EFI_UNSUPPORTED at once.
+
+    This is bogus; this case should simply be treated as an OID
+    mismatch, and the loop should advance to the next Index value /
+    hash algorithm candidate. A remaining hash algo may have a shorter
+    OID and yield an OID match.
+
+Signed-off-by: Doug Flick <DougFlick@microsoft.com>
+
+CVE: CVE-2024-38797
+Upstream-Status: Backport [https://github.com/tianocore/edk2/pull/10928/commits/8676572908b950dd4d1f8985006011be99c0a5b6]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ .../SecureBootConfigImpl.c                    | 37 +++++++++++--------
+ 1 file changed, 21 insertions(+), 16 deletions(-)
+
+diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
+index 6d4560c..155e755 100644
+--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
++++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
+@@ -2096,30 +2096,35 @@ HashPeImageByType (
+ {

+   UINT8                     Index;

+   WIN_CERTIFICATE_EFI_PKCS  *PkcsCertData;

++  UINT32                    PkcsCertSize;

+ 

+   PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *)(mImageBase + mSecDataDir->Offset);

++  PkcsCertSize = mSecDataDir->SizeOfCert;

+ 

+-  for (Index = 0; Index < HASHALG_MAX; Index++) {

++  //

++  // Check the Hash algorithm in PE/COFF Authenticode.

++  //    According to PKCS#7 Definition:

++  //        SignedData ::= SEQUENCE {

++  //            version Version,

++  //            digestAlgorithms DigestAlgorithmIdentifiers,

++  //            contentInfo ContentInfo,

++  //            .... }

++  //    The DigestAlgorithmIdentifiers can be used to determine the hash algorithm in PE/COFF hashing

++  //    This field has the fixed offset (+32) in final Authenticode ASN.1 data.

++  //    Fixed offset (+32) is calculated based on two bytes of length encoding.

++  //

++  if ((PkcsCertSize > 1) && ((*(PkcsCertData->CertData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE)) {

+     //

+-    // Check the Hash algorithm in PE/COFF Authenticode.

+-    //    According to PKCS#7 Definition:

+-    //        SignedData ::= SEQUENCE {

+-    //            version Version,

+-    //            digestAlgorithms DigestAlgorithmIdentifiers,

+-    //            contentInfo ContentInfo,

+-    //            .... }

+-    //    The DigestAlgorithmIdentifiers can be used to determine the hash algorithm in PE/COFF hashing

+-    //    This field has the fixed offset (+32) in final Authenticode ASN.1 data.

+-    //    Fixed offset (+32) is calculated based on two bytes of length encoding.

++    // Only support two bytes of Long Form of Length Encoding.

+     //

+-    if ((*(PkcsCertData->CertData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) {

+-      //

+-      // Only support two bytes of Long Form of Length Encoding.

+-      //

++    return EFI_BAD_BUFFER_SIZE;

++  }

++

++  for (Index = 0; Index < HASHALG_MAX; Index++) {

++    if (PkcsCertSize < 32 + mHash[Index].OidLength) {

+       continue;

+     }

+ 

+-    //

+     if (CompareMem (PkcsCertData->CertData + 32, mHash[Index].OidValue, mHash[Index].OidLength) == 0) {

+       break;

+     }

+-- 
+2.34.1
+
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2025-2295.patch b/meta/recipes-core/ovmf/ovmf/CVE-2025-2295.patch
new file mode 100644
index 0000000000..038a3f2dbc
--- /dev/null
+++ b/meta/recipes-core/ovmf/ovmf/CVE-2025-2295.patch
@@ -0,0 +1,56 @@
+From 4b028816b5619ede6c3720664478055e09151516 Mon Sep 17 00:00:00 2001
+From: Madhavan <madavtechy@gmail.com>
+Date: Fri, 14 Mar 2025 14:15:13 -0400
+Subject: [PATCH] NetworkPkg/IScsiDxe:Fix for Remote Memory Exposure in ISCSI
+ bz4206
+
+Used SafeUint32Add to calculate and validate OutTransferLength with
+boundary check in IScsiOnR2TRcvd to avoid integer overflow
+
+Signed-off-by: Madhavan <madavtechy@gmail.com>
+
+CVE: CVE-2025-2295
+Upstream-Status: Backport [https://github.com/tianocore/edk2/commit/17cdc512f02a2dfd1b9e24133da56fdda099abda]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ NetworkPkg/IScsiDxe/IScsiProto.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/NetworkPkg/IScsiDxe/IScsiProto.c b/NetworkPkg/IScsiDxe/IScsiProto.c
+index ef587649a0..fb48e6304d 100644
+--- a/NetworkPkg/IScsiDxe/IScsiProto.c
++++ b/NetworkPkg/IScsiDxe/IScsiProto.c
+@@ -1,7 +1,7 @@
+ /** @file

+   The implementation of iSCSI protocol based on RFC3720.

+ 

+-Copyright (c) 2004 - 2018, Intel Corporation. All rights reserved.<BR>

++Copyright (c) 2004 - 2025, Intel Corporation. All rights reserved.<BR>

+ SPDX-License-Identifier: BSD-2-Clause-Patent

+ 

+ **/

+@@ -2682,6 +2682,7 @@ IScsiOnR2TRcvd (
+   EFI_STATUS               Status;

+   ISCSI_XFER_CONTEXT       *XferContext;

+   UINT8                    *Data;

++  UINT32                   TransferLength;

+ 

+   R2THdr = (ISCSI_READY_TO_TRANSFER *)NetbufGetByte (Pdu, 0, NULL);

+   if (R2THdr == NULL) {

+@@ -2712,7 +2713,12 @@ IScsiOnR2TRcvd (
+   XferContext->Offset            = R2THdr->BufferOffset;

+   XferContext->DesiredLength     = R2THdr->DesiredDataTransferLength;

+ 

+-  if (((XferContext->Offset + XferContext->DesiredLength) > Packet->OutTransferLength) ||

++  Status = SafeUint32Add (XferContext->Offset, XferContext->DesiredLength, &TransferLength);

++  if (EFI_ERROR (Status)) {

++    return EFI_PROTOCOL_ERROR;

++  }

++

++  if ((TransferLength > Packet->OutTransferLength) ||

+       (XferContext->DesiredLength > Tcb->Conn->Session->MaxBurstLength)

+       )

+   {

+-- 
+2.48.1
+
diff --git a/meta/recipes-core/ovmf/ovmf_git.bb b/meta/recipes-core/ovmf/ovmf_git.bb
index 35ca8d1834..08879966c3 100644
--- a/meta/recipes-core/ovmf/ovmf_git.bb
+++ b/meta/recipes-core/ovmf/ovmf_git.bb
@@ -12,6 +12,7 @@ LIC_FILES_CHKSUM = "file://OvmfPkg/License.txt;md5=06357ddc23f46577c2aeaeaf7b776
 PACKAGECONFIG ??= ""
 PACKAGECONFIG += "${@bb.utils.contains('MACHINE_FEATURES', 'tpm', 'tpm', '', d)}"
 PACKAGECONFIG += "${@bb.utils.contains('MACHINE_FEATURES', 'tpm2', 'tpm', '', d)}"
+PACKAGECONFIG[debug] = ",,,"
 PACKAGECONFIG[secureboot] = ",,,"
 PACKAGECONFIG[tpm] = "-D TPM_ENABLE=TRUE,-D TPM_ENABLE=FALSE,,"
 
@@ -24,10 +25,15 @@ SRC_URI = "gitsm://github.com/tianocore/edk2.git;branch=master;protocol=https \
            file://0002-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch \
            file://0003-debug-prefix-map.patch \
            file://0004-reproducible.patch \
+           file://CVE-2025-2295.patch \
+           file://CVE-2024-38797-1.patch \
+           file://CVE-2024-38797-2.patch \
+           file://CVE-2024-38797-3.patch \
+           file://CVE-2024-38797-4.patch \
            "
 
-PV = "edk2-stable202402"
-SRCREV = "edc6681206c1a8791981a2f911d2fb8b3d2f5768"
+PV = "edk2-stable202502"
+SRCREV = "fbe0805b2091393406952e84724188f8c1941837"
 UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>edk2-stable.*)"
 
 CVE_PRODUCT = "edk2"
@@ -48,17 +54,15 @@ inherit deploy
 
 PARALLEL_MAKE = ""
 
-S = "${WORKDIR}/git"
-
 DEPENDS = "nasm-native acpica-native ovmf-native util-linux-native"
 
-EDK_TOOLS_DIR="edk2_basetools"
+EDK_TOOLS_DIR = "edk2_basetools"
 
 # OVMF has trouble building with the default optimization of -O2.
-BUILD_OPTIMIZATION="-pipe"
+BUILD_OPTIMIZATION = ""
 
 # OVMF supports IA only, although it could conceivably support ARM someday.
-COMPATIBLE_HOST:class-target='(i.86|x86_64).*'
+COMPATIBLE_HOST:class-target = '(i.86|x86_64).*'
 
 # Additional build flags for OVMF with Secure Boot.
 # Fedora also uses "-D SMM_REQUIRE -D EXCLUDE_SHELL_FROM_FD".
@@ -67,6 +71,8 @@ OVMF_SECURE_BOOT_FLAGS = "-DSECURE_BOOT_ENABLE=TRUE ${OVMF_SECURE_BOOT_EXTRA_FLA
 
 export PYTHON_COMMAND = "${HOSTTOOLS_DIR}/python3"
 
+OVMF_BUILD_TYPE = "${@bb.utils.contains('PACKAGECONFIG', 'debug', 'DEBUG', 'RELEASE', d)}"
+
 do_patch[postfuncs] += "fix_basetools_location"
 fix_basetools_location () {
 }
@@ -139,7 +145,7 @@ fix_toolchain:append:class-native() {
 export NASM_PREFIX_MAP = "--debug-prefix-map=${WORKDIR}=${TARGET_DBGSRC_DIR}"
 export GCC_PREFIX_MAP = "${DEBUG_PREFIX_MAP} -Wno-stringop-overflow -Wno-maybe-uninitialized"
 
-GCC_VER="$(${CC} -v 2>&1 | tail -n1 | awk '{print $3}')"
+GCC_VER = "$(${CC} -v 2>&1 | tail -n1 | awk '{print $3}')"
 
 fixup_target_tools() {
     case ${1} in
@@ -200,11 +206,11 @@ do_compile:class-target() {
     fi
     FIXED_GCCVER=$(fixup_target_tools ${GCC_VER})
     bbnote FIXED_GCCVER is ${FIXED_GCCVER}
-    build_dir="${S}/Build/Ovmf$OVMF_DIR_SUFFIX/RELEASE_${FIXED_GCCVER}"
+    build_dir="${S}/Build/Ovmf$OVMF_DIR_SUFFIX/${OVMF_BUILD_TYPE}_${FIXED_GCCVER}"
 
     bbnote "Building without Secure Boot."
     rm -rf ${S}/Build/Ovmf$OVMF_DIR_SUFFIX
-    ${S}/OvmfPkg/build.sh $PARALLEL_JOBS -a $OVMF_ARCH -b RELEASE -t ${FIXED_GCCVER} ${PACKAGECONFIG_CONFARGS}
+    ${S}/OvmfPkg/build.sh $PARALLEL_JOBS -a $OVMF_ARCH -b ${OVMF_BUILD_TYPE} -t ${FIXED_GCCVER} ${PACKAGECONFIG_CONFARGS}
     ln ${build_dir}/FV/OVMF.fd ${WORKDIR}/ovmf/ovmf.fd
     ln ${build_dir}/FV/OVMF_CODE.fd ${WORKDIR}/ovmf/ovmf.code.fd
     ln ${build_dir}/FV/OVMF_VARS.fd ${WORKDIR}/ovmf/ovmf.vars.fd
@@ -214,7 +220,7 @@ do_compile:class-target() {
         # Repeat build with the Secure Boot flags.
         bbnote "Building with Secure Boot."
         rm -rf ${S}/Build/Ovmf$OVMF_DIR_SUFFIX
-        ${S}/OvmfPkg/build.sh $PARALLEL_JOBS -a $OVMF_ARCH -b RELEASE -t ${FIXED_GCCVER} ${PACKAGECONFIG_CONFARGS} ${OVMF_SECURE_BOOT_FLAGS}
+        ${S}/OvmfPkg/build.sh $PARALLEL_JOBS -a $OVMF_ARCH -b ${OVMF_BUILD_TYPE} -t ${FIXED_GCCVER} ${PACKAGECONFIG_CONFARGS} ${OVMF_SECURE_BOOT_FLAGS}
         ln ${build_dir}/FV/OVMF.fd ${WORKDIR}/ovmf/ovmf.secboot.fd
         ln ${build_dir}/FV/OVMF_CODE.fd ${WORKDIR}/ovmf/ovmf.secboot.code.fd
         ln ${build_dir}/${OVMF_ARCH}/EnrollDefaultKeys.efi ${WORKDIR}/ovmf/
@@ -223,6 +229,7 @@ do_compile:class-target() {
 
 do_install:class-native() {
     install -d ${D}/${bindir}/edk2_basetools
+    find ${S}/BaseTools -name \*.pyc -exec rm -rf \{\} \;
     cp -r ${S}/BaseTools ${D}/${bindir}/${EDK_TOOLS_DIR}
 }
 
diff --git a/meta/recipes-core/packagegroups/packagegroup-base.bb b/meta/recipes-core/packagegroups/packagegroup-base.bb
index 70a1035003..fd61ba4437 100644
--- a/meta/recipes-core/packagegroups/packagegroup-base.bb
+++ b/meta/recipes-core/packagegroups/packagegroup-base.bb
@@ -39,9 +39,6 @@ PACKAGES = ' \
             \
             '
 
-# Override by distro if needed
-VIRTUAL-RUNTIME_keymaps ?= "keymaps"
-
 #
 # packagegroup-base contain stuff needed for base system (machine related)
 #
@@ -75,7 +72,6 @@ RDEPENDS:packagegroup-base = "\
     ${@bb.utils.contains('DISTRO_FEATURES', 'zeroconf', 'packagegroup-base-zeroconf', '',d)} \
     "
 
-
 RRECOMMENDS:packagegroup-base = "\
     kernel-module-nls-utf8 \
     kernel-module-input \
@@ -122,7 +118,7 @@ python __anonymous () {
 # packages added by distribution
 #
 SUMMARY:packagegroup-distro-base = "${DISTRO} extras"
-DEPENDS_packagegroup-distro-base = "${DISTRO_EXTRA_DEPENDS}"
+DEPENDS:packagegroup-distro-base = "${DISTRO_EXTRA_DEPENDS}"
 RDEPENDS:packagegroup-distro-base = "${DISTRO_EXTRA_RDEPENDS}"
 RRECOMMENDS:packagegroup-distro-base = "${DISTRO_EXTRA_RRECOMMENDS}"
 
diff --git a/meta/recipes-core/packagegroups/packagegroup-core-boot.bb b/meta/recipes-core/packagegroups/packagegroup-core-boot.bb
index fecc3334ea..5cdd161811 100644
--- a/meta/recipes-core/packagegroups/packagegroup-core-boot.bb
+++ b/meta/recipes-core/packagegroups/packagegroup-core-boot.bb
@@ -9,10 +9,6 @@ PACKAGE_ARCH = "${MACHINE_ARCH}"
 
 inherit packagegroup
 
-# Distro can override the following VIRTUAL-RUNTIME providers:
-VIRTUAL-RUNTIME_dev_manager ?= "udev"
-VIRTUAL-RUNTIME_keymaps ?= "keymaps"
-
 EFI_PROVIDER ??= "grub-efi"
 
 SYSVINIT_SCRIPTS = "${@bb.utils.contains('MACHINE_FEATURES', 'rtc', '${VIRTUAL-RUNTIME_base-utils-hwclock}', '', d)} \
diff --git a/meta/recipes-core/packagegroups/packagegroup-core-tools-debug.bb b/meta/recipes-core/packagegroups/packagegroup-core-tools-debug.bb
index 56ff1d2b06..f19fd64ec1 100644
--- a/meta/recipes-core/packagegroups/packagegroup-core-tools-debug.bb
+++ b/meta/recipes-core/packagegroups/packagegroup-core-tools-debug.bb
@@ -8,7 +8,6 @@ PACKAGE_ARCH = "${TUNE_PKGARCH}"
 
 inherit packagegroup
 
-
 MTRACE = ""
 MTRACE:libc-glibc = "libc-mtrace"
 
diff --git a/meta/recipes-core/packagegroups/packagegroup-core-tools-profile.bb b/meta/recipes-core/packagegroups/packagegroup-core-tools-profile.bb
index b3a24b71de..54915e4f0c 100644
--- a/meta/recipes-core/packagegroups/packagegroup-core-tools-profile.bb
+++ b/meta/recipes-core/packagegroups/packagegroup-core-tools-profile.bb
@@ -4,7 +4,6 @@
 
 SUMMARY = "Profiling tools"
 
-
 PACKAGE_ARCH = "${MACHINE_ARCH}"
 
 inherit packagegroup
@@ -50,12 +49,12 @@ VALGRIND:armv4 = ""
 VALGRIND:armv5 = ""
 VALGRIND:armv6 = ""
 VALGRIND:armeb = ""
-VALGRIND:aarch64 = ""
 VALGRIND:riscv64 = ""
 VALGRIND:riscv32 = ""
 VALGRIND:powerpc = "${@bb.utils.contains('TARGET_FPU', 'soft', '', 'valgrind', d)}"
 VALGRIND:linux-gnux32 = ""
 VALGRIND:linux-gnun32 = ""
+VALGRIND:loongarch64 = ""
 
 RDEPENDS:${PN} = "\
     ${PROFILETOOLS} \
diff --git a/meta/recipes-core/packagegroups/packagegroup-core-tools-testapps.bb b/meta/recipes-core/packagegroups/packagegroup-core-tools-testapps.bb
index 34af40a43f..25561f6878 100644
--- a/meta/recipes-core/packagegroups/packagegroup-core-tools-testapps.bb
+++ b/meta/recipes-core/packagegroups/packagegroup-core-tools-testapps.bb
@@ -4,7 +4,6 @@
 
 SUMMARY = "Testing tools/applications"
 
-
 PACKAGE_ARCH = "${MACHINE_ARCH}"
 
 inherit packagegroup
@@ -13,9 +12,11 @@ inherit packagegroup
 KEXECTOOLS ?= "kexec"
 KEXECTOOLS:e5500-64b ?= ""
 KEXECTOOLS:microblaze ?= ""
+KEXECTOOLS:mipsarcho32 ?= ""
 KEXECTOOLS:nios2 ?= ""
 KEXECTOOLS:riscv64 ?= ""
 KEXECTOOLS:riscv32 ?= ""
+KEXECTOOLS:loongarch64 ?= ""
 
 # go does not support ppc32, only ppc64
 # https://github.com/golang/go/issues/22885
@@ -44,7 +45,6 @@ X11TOOLS = "\
     "
 
 RDEPENDS:${PN} = "\
-    blktool \
     ${KEXECTOOLS} \
     alsa-utils-amixer \
     alsa-utils-aplay \
diff --git a/meta/recipes-core/packagegroups/packagegroup-rust-cross-canadian.bb b/meta/recipes-core/packagegroups/packagegroup-rust-cross-canadian.bb
index bb10a2d34f..7e220d2cce 100644
--- a/meta/recipes-core/packagegroups/packagegroup-rust-cross-canadian.bb
+++ b/meta/recipes-core/packagegroups/packagegroup-rust-cross-canadian.bb
@@ -5,7 +5,7 @@ inherit cross-canadian packagegroup
 
 PACKAGEGROUP_DISABLE_COMPLEMENTARY = "1"
 
-RUST="rust-cross-canadian-${TRANSLATED_TARGET_ARCH}"
+RUST = "rust-cross-canadian-${TRANSLATED_TARGET_ARCH}"
 
 RDEPENDS:${PN} = " \
     ${@all_multilib_tune_values(d, 'RUST')} \
diff --git a/meta/recipes-core/packagegroups/packagegroup-self-hosted.bb b/meta/recipes-core/packagegroups/packagegroup-self-hosted.bb
index df71695a97..c386267781 100644
--- a/meta/recipes-core/packagegroups/packagegroup-self-hosted.bb
+++ b/meta/recipes-core/packagegroups/packagegroup-self-hosted.bb
@@ -107,7 +107,6 @@ RDEPENDS:packagegroup-self-hosted-debug = " \
     ${STRACE} \
     tcf-agent"
 
-
 RDEPENDS:packagegroup-self-hosted-extended = "\
     bzip2 \
     chrpath \
@@ -178,7 +177,6 @@ RDEPENDS:packagegroup-self-hosted-extended = "\
     zstd \
     "
 
-
 RDEPENDS:packagegroup-self-hosted-graphics = "\
     adwaita-icon-theme \
     builder \
diff --git a/meta/recipes-core/picolibc/picolibc-helloworld_git.bb b/meta/recipes-core/picolibc/picolibc-helloworld_git.bb
new file mode 100644
index 0000000000..573a571c24
--- /dev/null
+++ b/meta/recipes-core/picolibc/picolibc-helloworld_git.bb
@@ -0,0 +1,40 @@
+require picolibc.inc
+
+# baremetal-image overrides
+BAREMETAL_BINNAME ?= "hello_picolibc_${MACHINE}"
+IMAGE_LINK_NAME ?= "baremetal-picolibc-image-${MACHINE}"
+IMAGE_NAME_SUFFIX ?= ""
+QB_DEFAULT_KERNEL ?= "${IMAGE_LINK_NAME}.elf"
+
+inherit baremetal-image
+
+COMPATIBLE_MACHINE = "qemuarm|qemuarm64|qemuriscv32|qemuriscv64"
+
+# Use semihosting to test via QEMU
+QB_OPT_APPEND:append = " -semihosting-config enable=on"
+
+# picolibc comes with a set of linker scripts, set the file
+# according to the architecture being built.
+PICOLIBC_LINKERSCRIPT:qemuarm64 = "aarch64.ld"
+PICOLIBC_LINKERSCRIPT:qemuarm = "arm.ld"
+PICOLIBC_LINKERSCRIPT:qemuriscv32 = "riscv.ld"
+PICOLIBC_LINKERSCRIPT:qemuriscv64 = "riscv.ld"
+
+# Simple compile function that manually exemplifies usage; as noted,
+# use a custom linker script, the GCC specs provided by picolibc
+# and semihost to be able to test via QEMU's monitor
+do_compile(){
+    ${CC} ${CFLAGS} ${LDFLAGS} --verbose -T${S}/hello-world/${PICOLIBC_LINKERSCRIPT} -specs=picolibc.specs --oslib=semihost -o ${BAREMETAL_BINNAME}.elf ${S}/hello-world/hello-world.c
+    ${OBJCOPY} -O binary ${BAREMETAL_BINNAME}.elf ${BAREMETAL_BINNAME}.bin
+}
+
+do_install(){
+    install -d ${D}/${base_libdir}/firmware
+    install -m 755 ${B}/${BAREMETAL_BINNAME}.elf ${D}/${base_libdir}/firmware/${BAREMETAL_BINNAME}.elf
+    install -m 755 ${B}/${BAREMETAL_BINNAME}.bin ${D}/${base_libdir}/firmware/${BAREMETAL_BINNAME}.bin
+}
+
+FILES:${PN} += " \
+    ${base_libdir}/firmware/${BAREMETAL_BINNAME}.elf \
+    ${base_libdir}/firmware/${BAREMETAL_BINNAME}.bin \
+"
diff --git a/meta/recipes-core/picolibc/picolibc.inc b/meta/recipes-core/picolibc/picolibc.inc
new file mode 100644
index 0000000000..68c32894a7
--- /dev/null
+++ b/meta/recipes-core/picolibc/picolibc.inc
@@ -0,0 +1,20 @@
+SUMMARY = "C Libraries for Smaller Embedded Systems"
+HOMEPAGE = "https://keithp.com/picolibc"
+DESCRIPTION = "Picolibc is a set of standard C libraries, both libc and libm, designed for smaller embedded systems with limited ROM and RAM. Picolibc includes code from Newlib and AVR Libc."
+SECTION = "libs"
+
+# Newlib based code but GPL related bits removed, test/printf-tests.c and test/testcases.c
+# are GPLv2 and GeneratePicolibcCrossFile.sh is AGPL3 but not part of the artifacts.
+LICENSE = "BSD-2-Clause & BSD-3-Clause"
+LIC_FILES_CHKSUM = " \
+                file://COPYING.GPL2;md5=59530bdf33659b29e73d4adb9f9f6552 \
+                file://COPYING.NEWLIB;md5=08ae03456feb75b81cfdb359e0f1ef85 \
+                file://COPYING.picolibc;md5=e50fa9458a40929689861ed472d46bc7 \
+                "
+
+BASEVER = "1.8.6"
+PV = "${BASEVER}+git"
+SRC_URI = "git://github.com/picolibc/picolibc.git;protocol=https;branch=main"
+SRCREV = "764ef4e401a8f4c6a86ab723533841f072885a5b"
+
+B = "${WORKDIR}/build"
diff --git a/meta/recipes-core/picolibc/picolibc/avoid_polluting_cross_directories.patch b/meta/recipes-core/picolibc/picolibc/avoid_polluting_cross_directories.patch
new file mode 100644
index 0000000000..da6460c95c
--- /dev/null
+++ b/meta/recipes-core/picolibc/picolibc/avoid_polluting_cross_directories.patch
@@ -0,0 +1,119 @@
+Upstream-Status: Pending
+
+Picolibc uses its own specs file: picolibc.specs to facilitate compilation, this
+needs to be passed down to GCC via the -specs argument.
+
+Using this specs file overrides some of the default options our toolchain was
+built with, in this case, they modify the include_dir and lib_dir paths used for
+compilation, their intention was to add support for -picolibc-prefix and
+-picolibc-buildtype arguments via the C preprocessor.
+
+-isystem %{-picolibc-prefix=*:%*/include/; -picolibc-buildtype=*:/usr/include/%*; :/usr/include} %(picolibc_cpp)
+
+This had the unwanted effect of defaulting to /usr/include for include_dir if
+those arguments are not being passed, this works fine for their flow but for us
+it pollutes the include directories with paths from the host. The same effect is
+applicable for lib_dir and for the c runtime file.
+
+Our toolchain relies on --sysroot to avoid using any paths from the host, here we
+manually add support for a third possible argument: -sysroot , if this is passed
+then the paths used by the compiler will be relative to the path passed by the
+--sysroot= cmdline argument, setting back the behavior that we intended in the
+first place.
+
+
+Signed-off-by: Alejandro Enedino Hernandez Samaniego <alejandro@enedino.org>
+
+Index: git/meson.build
+===================================================================
+--- git.orig/meson.build
++++ git/meson.build
+@@ -622,12 +622,13 @@ else
+ #
+ picolibc_prefix_format = '-picolibc-prefix=*:@0@'
+ picolibc_buildtype_format = '-picolibc-buildtype=*:@0@'
++sysroot_format = '-sysroot=*:@0@'
+ gen_format = '@0@'
+ 
+ #
+ # How to glue the three options together
+ #
+-specs_option_format = '%{@0@; @1@; :@2@}'
++specs_option_format = '%{@0@; @1@; @2@; :@3@}'
+ 
+ #
+ # Build the -isystem value
+@@ -639,10 +640,13 @@ isystem_prefix = picolibc_prefix_format.
+ buildtype_include_dir = specs_prefix_format.format(get_option('includedir') / '%*')
+ isystem_buildtype = picolibc_buildtype_format.format(buildtype_include_dir)
+ 
++sysroot_include_dir = '%*'
++isystem_sysroot = sysroot_format.format(sysroot_include_dir)
++
+ gen_include_dir = specs_prefix_format.format(get_option('includedir'))
+ isystem_gen = gen_format.format(gen_include_dir)
+ 
+-specs_isystem = '-isystem ' + specs_option_format.format(isystem_prefix, isystem_buildtype, isystem_gen)
++specs_isystem = '-isystem ' + specs_option_format.format(isystem_prefix, isystem_buildtype, isystem_sysroot, isystem_gen)
+ 
+ #
+ # Build the non-multilib -L value
+@@ -654,10 +658,13 @@ lib_prefix = picolibc_prefix_format.form
+ buildtype_lib_dir = specs_prefix_format.format(get_option('libdir') / '%*')
+ lib_buildtype = picolibc_buildtype_format.format(buildtype_lib_dir)
+ 
++sysroot_lib_dir = '%*'
++lib_sysroot = sysroot_format.format(sysroot_lib_dir)
++
+ gen_lib_dir = specs_prefix_format.format(get_option('libdir'))
+ lib_gen = gen_format.format(gen_lib_dir)
+ 
+-specs_libpath = '-L' + specs_option_format.format(lib_prefix, lib_buildtype, lib_gen)
++specs_libpath = '-L' + specs_option_format.format(lib_prefix, lib_buildtype, lib_sysroot, lib_gen)
+ 
+ #
+ # Build the non-multilib *startfile options
+@@ -669,6 +676,9 @@ crt0_prefix = picolibc_prefix_format.for
+ buildtype_crt0_path = specs_prefix_format.format(get_option('libdir') / '%*' / crt0_expr)
+ crt0_buildtype = picolibc_buildtype_format.format(buildtype_crt0_path)
+ 
++sysroot_crt0_path = '%*' + '/' + get_option('libdir') + '/' + '%*' + '/' + crt0_expr
++crt0_sysroot = picolibc_buildtype_format.format(sysroot_crt0_path)
++
+ gen_crt0_path = specs_prefix_format.format(get_option('libdir') / crt0_expr)
+ crt0_gen = gen_format.format(gen_crt0_path)
+ 
+@@ -686,10 +696,13 @@ if enable_multilib
+   buildtype_multilib_dir = specs_prefix_format.format(get_option('libdir') / '%*/%M')
+   multilib_buildtype = picolibc_buildtype_format.format(buildtype_multilib_dir)
+ 
++  sysroot_multilib_dir = '%*' + '/' + get_option('libdir') + '/' + '%*/%M'
++  multilib_sysroot = sysroot_format.format(sysroot_multilib_dir)
++  
+   gen_multilib_dir = specs_prefix_format.format(get_option('libdir') / '%M')
+   multilib_gen = gen_format.format(gen_multilib_dir)
+ 
+-  specs_multilibpath = '-L' + specs_option_format.format(multilib_prefix, multilib_buildtype, multilib_gen)
++  specs_multilibpath = '-L' + specs_option_format.format(multilib_prefix, multilib_buildtype, multilib_sysroot, multilib_gen)
+ 
+   #
+   # Prepend the multilib -L option to the non-multilib option
+@@ -705,6 +718,9 @@ if enable_multilib
+   buildtype_multilib_crt0_path = specs_prefix_format.format(get_option('libdir') / '%*/%M' / crt0_expr)
+   crt0_buildtype = picolibc_buildtype_format.format(buildtype_multilib_crt0_path)
+ 
++  sysroot_multilib_crt0_path = '%*' + prefix + '/' + get_option('libdir') + '/' + '/%M' + '/' + crt0_expr
++  crt0_sysroot = sysroot_format.format(sysroot_multilib_crt0_path)
++  
+   gen_multilib_crt0_path = specs_prefix_format.format(get_option('libdir') / '%M' / crt0_expr)
+   crt0_gen = gen_format.format(gen_multilib_crt0_path)
+ endif
+@@ -714,7 +730,7 @@ endif
+ # above. As there's only one value, it's either the
+ # multilib path or the non-multilib path
+ #
+-specs_startfile = specs_option_format.format(crt0_prefix, crt0_buildtype, crt0_gen)
++specs_startfile = specs_option_format.format(crt0_prefix, crt0_buildtype, crt0_sysroot, crt0_gen)
+ endif
+ 
+ specs_data = configuration_data()
diff --git a/meta/recipes-core/picolibc/picolibc/no-early-compiler-checks.cross b/meta/recipes-core/picolibc/picolibc/no-early-compiler-checks.cross
new file mode 100644
index 0000000000..87bfbad3c5
--- /dev/null
+++ b/meta/recipes-core/picolibc/picolibc/no-early-compiler-checks.cross
@@ -0,0 +1,6 @@
+# We need to explicitly bypass mesons sanity check to avoid early compiler errors
+# otherwise meson will try to compile AND run test applications:
+# ../git/meson.build:35:0: ERROR: Executables created by c compiler are not runnable...
+
+[properties]
+skip_sanity_check=true
\ No newline at end of file
diff --git a/meta/recipes-core/picolibc/picolibc_git.bb b/meta/recipes-core/picolibc/picolibc_git.bb
new file mode 100644
index 0000000000..eaa6c8de1e
--- /dev/null
+++ b/meta/recipes-core/picolibc/picolibc_git.bb
@@ -0,0 +1,34 @@
+require picolibc.inc
+
+INHIBIT_DEFAULT_DEPS = "1"
+DEPENDS = "virtual/cross-cc"
+
+PROVIDES += "virtual/libc virtual/libiconv virtual/libintl"
+
+COMPATIBLE_HOST:libc-musl:class-target = "null"
+COMPATIBLE_HOST:libc-glibc:class-target = "null"
+COMPATIBLE_MACHINE = "qemuarm|qemuarm64|qemuriscv32|qemuriscv64"
+
+SRC_URI:append = " file://avoid_polluting_cross_directories.patch"
+SRC_URI:append = " file://no-early-compiler-checks.cross"
+
+# This is being added by picolibc meson files as well to avoid
+# early compiler tests from failing, cant remember why I added it
+# to the newlib recipe but I would assume it was for the same reason
+TARGET_CC_ARCH:append = " -nostdlib"
+
+# When using RISCV64 use medany for both C library and application recipes
+TARGET_CFLAGS:append:qemuriscv64 = " -mcmodel=medany"
+
+inherit meson
+
+MESON_CROSS_FILE:append = " --cross-file=${UNPACKDIR}/no-early-compiler-checks.cross"
+
+PACKAGECONFIG ??= " specsdir"
+# Install GCC specs on libdir
+PACKAGECONFIG[specsdir] = "-Dspecsdir=${libdir},-Dspecsdir=none"
+
+FILES:${PN}-dev:append = " ${libdir}/*.specs ${libdir}/*.ld"
+
+# No rpm package is actually created but -dev depends on it, avoid dnf error
+DEV_PKG_DEPENDENCY:libc-picolibc = ""
diff --git a/meta/recipes-core/psplash/files/fb.rules b/meta/recipes-core/psplash/files/fb.rules
new file mode 100644
index 0000000000..accdb8386c
--- /dev/null
+++ b/meta/recipes-core/psplash/files/fb.rules
@@ -0,0 +1 @@
+SUBSYSTEM=="graphics", KERNEL=="fb[0-9]*", TAG+="systemd", ENV{SYSTEMD_WANTS}+="psplash-start@%k.service psplash-systemd.service"
diff --git a/meta/recipes-core/psplash/files/psplash-init b/meta/recipes-core/psplash/files/psplash-init
index e0f80bcdc0..e0f80bcdc0 100755..100644
--- a/meta/recipes-core/psplash/files/psplash-init
+++ b/meta/recipes-core/psplash/files/psplash-init
diff --git a/meta/recipes-core/psplash/files/psplash-start.service b/meta/recipes-core/psplash/files/psplash-start@.service
index bec9368427..1bc3642fc2 100644
--- a/meta/recipes-core/psplash/files/psplash-start.service
+++ b/meta/recipes-core/psplash/files/psplash-start@.service
@@ -3,11 +3,10 @@ Description=Start psplash boot splash screen
 DefaultDependencies=no
 RequiresMountsFor=/run
 ConditionFileIsExecutable=/usr/bin/psplash
+After=dev-%i.device
+Wants=dev-%i.device
 
 [Service]
 Type=notify
 ExecStart=/usr/bin/psplash
 RemainAfterExit=yes
-
-[Install]
-WantedBy=sysinit.target
diff --git a/meta/recipes-core/psplash/files/psplash-systemd.service b/meta/recipes-core/psplash/files/psplash-systemd.service
index e93e3deb35..15a894d577 100644
--- a/meta/recipes-core/psplash/files/psplash-systemd.service
+++ b/meta/recipes-core/psplash/files/psplash-systemd.service
@@ -1,14 +1,13 @@
 [Unit]
 Description=Start psplash-systemd progress communication helper
 DefaultDependencies=no
-After=psplash-start.service
-Requires=psplash-start.service
+After=psplash-start@fb0.service
+Requires=psplash-start@fb0.service
 RequiresMountsFor=/run
 ConditionFileIsExecutable=/usr/bin/psplash
+ConditionFileIsExecutable=/usr/bin/psplash-systemd
+ConditionPathExists=/run/psplash_fifo
 
 [Service]
-ExecStart=/usr/bin/psplash-systemd
+ExecStart=-/usr/bin/psplash-systemd
 RemainAfterExit=yes
-
-[Install]
-WantedBy=sysinit.target
diff --git a/meta/recipes-core/psplash/psplash_git.bb b/meta/recipes-core/psplash/psplash_git.bb
index 40937098e6..3be0e26a0c 100644
--- a/meta/recipes-core/psplash/psplash_git.bb
+++ b/meta/recipes-core/psplash/psplash_git.bb
@@ -6,13 +6,14 @@ LICENSE = "GPL-2.0-or-later"
 LIC_FILES_CHKSUM = "file://psplash.h;beginline=1;endline=8;md5=8f232c1e95929eacab37f00900580224"
 DEPENDS = "gdk-pixbuf-native"
 
-SRCREV = "ecc1913756698d0c87ad8fa10e44b29537f09ad1"
+SRCREV = "53ae74a36bf17675228552abb927d2f981940a6a"
 PV = "0.1+git"
 
 SRC_URI = "git://git.yoctoproject.org/${BPN};branch=master;protocol=https \
            file://psplash-init \
-           file://psplash-start.service \
+           file://psplash-start@.service \
            file://psplash-systemd.service \
+           file://fb.rules \
            ${SPLASH_IMAGES}"
 UPSTREAM_CHECK_COMMITS = "1"
 
@@ -61,8 +62,6 @@ python __anonymous() {
             d.appendVar("RDEPENDS:%s" % pn, " %s" % ep)
 }
 
-S = "${WORKDIR}/git"
-
 inherit autotools pkgconfig update-rc.d update-alternatives systemd
 
 PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)} progress-bar fullscreen"
@@ -80,7 +79,7 @@ python do_compile () {
     import subprocess
 
     # Build a separate executable for each splash image
-    workdir = d.getVar('WORKDIR')
+    workdir = d.getVar('UNPACKDIR')
     convertscript = "%s/make-image-header.sh" % d.getVar('S')
     destfile = "%s/psplash-poky-img.h" % d.getVar('B')
     localfiles = d.getVar('SPLASH_LOCALPATHS').split()
@@ -103,7 +102,7 @@ python do_compile () {
 do_install:append() {
         if ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'true', 'false', d)}; then
                 install -d ${D}${sysconfdir}/init.d/
-                install -m 0755 ${WORKDIR}/psplash-init ${D}${sysconfdir}/init.d/psplash.sh
+                install -m 0755 ${UNPACKDIR}/psplash-init ${D}${sysconfdir}/init.d/psplash.sh
 
                 # make fifo for psplash
                 install -d ${D}/mnt
@@ -112,8 +111,10 @@ do_install:append() {
 
         if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
                 install -d ${D}${systemd_system_unitdir}
-                install -m 644 ${WORKDIR}/psplash-start.service ${D}/${systemd_system_unitdir}
-                install -m 644 ${WORKDIR}/psplash-systemd.service ${D}/${systemd_system_unitdir}
+                install -m 644 ${UNPACKDIR}/psplash-start@.service ${D}/${systemd_system_unitdir}
+                install -m 644 ${UNPACKDIR}/psplash-systemd.service ${D}/${systemd_system_unitdir}
+                install -d ${D}${sysconfdir}/udev/rules.d
+                install -m 0644 ${UNPACKDIR}/fb.rules ${D}${sysconfdir}/udev/rules.d/
         fi
 
         install -d ${D}${bindir}
@@ -124,7 +125,7 @@ do_install:append() {
 }
 
 SYSTEMD_PACKAGES = "${@bb.utils.contains('DISTRO_FEATURES','systemd','${PN}','',d)}"
-SYSTEMD_SERVICE:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'systemd', 'psplash-start.service psplash-systemd.service', '', d)}"
+SYSTEMD_SERVICE:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'systemd', 'psplash-start@.service psplash-systemd.service', '', d)}"
 
 INITSCRIPT_NAME = "psplash.sh"
 INITSCRIPT_PARAMS = "start 0 S . stop 20 0 1 6 ."
diff --git a/meta/recipes-core/readline/files/inputrc b/meta/recipes-core/readline/files/inputrc
index b5c4c8af24..4a2874bccc 100644
--- a/meta/recipes-core/readline/files/inputrc
+++ b/meta/recipes-core/readline/files/inputrc
@@ -24,12 +24,12 @@ set output-meta on
 $if mode=emacs
 
 # allow the use of the Home/End keys
-# "\e[1~": beginning-of-line
-# "\e[4~": end-of-line
+"\e[1~": beginning-of-line
+"\e[4~": end-of-line
 
 # allow the use of the Delete/Insert keys
-# "\e[3~": delete-char
-# "\e[2~": quoted-insert
+"\e[3~": delete-char
+"\e[2~": quoted-insert
 
 # mappings for "page up" and "page down" to step to the beginning/end 
 # of the history
diff --git a/meta/recipes-core/readline/readline.inc b/meta/recipes-core/readline/readline.inc
index 4aefc5636d..555bd0876f 100644
--- a/meta/recipes-core/readline/readline.inc
+++ b/meta/recipes-core/readline/readline.inc
@@ -38,7 +38,7 @@ do_install:append () {
         rmdir ${D}${datadir}/${BPN} || true
 
         install -m 0755 -d ${D}${sysconfdir}
-        install -m 0644 ${WORKDIR}/inputrc ${D}${sysconfdir}/inputrc
+        install -m 0644 ${UNPACKDIR}/inputrc ${D}${sysconfdir}/inputrc
 }
 
 BBCLASSEXTEND = "native nativesdk"
@@ -54,4 +54,4 @@ ALTERNATIVE_LINK_NAME[history.3] = "${mandir}/man3/history.3"
 # OpenSuse injects versions into libreadline leading to conficits between our native one and theirs
 # see their spec file for where this is injected. Extra versioning is harmless so we just do the same.
 SRC_URI:append:class-native = " file://rl-native.map"
-LDFLAGS:append:class-native = " -Wl,--version-script=${WORKDIR}/rl-native.map"
+LDFLAGS:append:class-native = " -Wl,--version-script=${UNPACKDIR}/rl-native.map"
diff --git a/meta/recipes-core/readline/readline/0001-Add-fix-for-packages-that-are-not-compatible-with-C2.patch b/meta/recipes-core/readline/readline/0001-Add-fix-for-packages-that-are-not-compatible-with-C2.patch
new file mode 100644
index 0000000000..3bb4d53960
--- /dev/null
+++ b/meta/recipes-core/readline/readline/0001-Add-fix-for-packages-that-are-not-compatible-with-C2.patch
@@ -0,0 +1,29 @@
+From 9459ee899a291c55f08341df63e9a1b9b7af200a Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sun, 16 Mar 2025 12:48:46 -0700
+Subject: [PATCH] Add fix for packages that are not compatible with C23
+
+Fixes builds with GCC-15
+Sourced from Fedora: https://src.fedoraproject.org/rpms/readline/c/c47eb813afb942128253213ad5b8221770557e48?branch=rawhide
+
+Help getting packages like bluez5 building
+
+Upstream-Status: Submitted [https://lists.gnu.org/archive/html/bug-readline/2025-03/msg00001.html]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ rlstdc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/rlstdc.h b/rlstdc.h
+index 2aaa30b..a7a0ef3 100644
+--- a/rlstdc.h
++++ b/rlstdc.h
+@@ -44,7 +44,7 @@
+ 
+ /* Moved from config.h.in because readline.h:rl_message depends on these
+    defines. */
+-#if defined (__STDC__) && defined (HAVE_STDARG_H)
++#if defined (__STDC__)
+ #  define PREFER_STDARG
+ #  define USE_VARARGS
+ #else
diff --git a/meta/recipes-core/readline/readline/norpath.patch b/meta/recipes-core/readline/readline/norpath.patch
index 5d71582b70..34534aff0a 100644
--- a/meta/recipes-core/readline/readline/norpath.patch
+++ b/meta/recipes-core/readline/readline/norpath.patch
@@ -6,11 +6,17 @@ Upstream-Status: Inappropriate
 
 RP 2012/2/23
 
-Index: readline-6.2/support/shobj-conf
-===================================================================
---- readline-6.2.orig/support/shobj-conf        2012-02-23 11:06:37.193179379 +0000
-+++ readline-6.2/support/shobj-conf     2012-02-23 11:06:50.049178918 +0000
-@@ -114,7 +114,7 @@
+Rebase to 8.2.13
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ support/shobj-conf | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/support/shobj-conf b/support/shobj-conf
+index cd7634d..029123a 100644
+--- a/support/shobj-conf
++++ b/support/shobj-conf
+@@ -128,7 +128,7 @@ linux*-*|gnu*-*|k*bsd*-gnu-*|midnightbsd*|freebsd*|dragonfly*)
         SHOBJ_LD='${CC}'
         SHOBJ_LDFLAGS='-shared -Wl,-soname,$@'
  
@@ -19,3 +25,6 @@ Index: readline-6.2/support/shobj-conf
         SHLIB_LIBVERSION='$(SHLIB_LIBSUFF).$(SHLIB_MAJOR)$(SHLIB_MINOR)'
         ;;
  
+-- 
+2.27.0
+
diff --git a/meta/recipes-core/readline/readline/readline82-001.patch b/meta/recipes-core/readline/readline/readline82-001.patch
deleted file mode 100644
index 4e9839db9c..0000000000
--- a/meta/recipes-core/readline/readline/readline82-001.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-                           READLINE PATCH REPORT
-                           =====================
-
-Readline-Release: 8.2
-Patch-ID: readline82-001
-
-Bug-Reported-by:        Kan-Ru Chen <koster@debian.org>
-Bug-Reference-ID:
-Bug-Reference-URL:      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1021109
-
-Bug-Description:
-
-Starting a readline application with an invalid locale specification for
-LC_ALL/LANG/LC_CTYPE can cause it crash on the first call to readline.
-
-Patch (apply with `patch -p0'):
-
-Upstream-Status: Submitted [https://ftp.gnu.org/gnu/readline/readline-8.2-patches/]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-
-*** ../readline-8.2-patched/nls.c       2022-08-15 09:38:51.000000000 -0400
---- nls.c       2022-10-05 09:23:22.000000000 -0400
-***************
-*** 142,145 ****
---- 142,149 ----
-      lspec = "";
-    ret = setlocale (LC_CTYPE, lspec);  /* ok, since it does not change locale */
-+   if (ret == 0 || *ret == 0)
-+     ret = setlocale (LC_CTYPE, (char *)NULL);
-+   if (ret == 0 || *ret == 0)
-+     ret = RL_DEFAULT_LOCALE;
-  #else
-    ret = (lspec == 0 || *lspec == 0) ? RL_DEFAULT_LOCALE : lspec;
-
-*** ../readline-8.2/patchlevel  2013-11-15 08:11:11.000000000 -0500
---- patchlevel  2014-03-21 08:28:40.000000000 -0400
-***************
-*** 1,3 ****
-  # Do not edit -- exists only for use by patch
-  
-! 0
---- 1,3 ----
-  # Do not edit -- exists only for use by patch
-  
-! 1
diff --git a/meta/recipes-core/readline/readline/readline82-002.patch b/meta/recipes-core/readline/readline/readline82-002.patch
deleted file mode 100644
index 5629685dc1..0000000000
--- a/meta/recipes-core/readline/readline/readline82-002.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-                           READLINE PATCH REPORT
-                           =====================
-
-Readline-Release: 8.2
-Patch-ID: readline82-002
-
-Bug-Reported-by:        srobertson@peratonlabs.com
-Bug-Reference-ID:
-Bug-Reference-URL:      https://lists.gnu.org/archive/html/bug-bash/2022-09/msg00049.html
-
-Bug-Description:
-
-It's possible for readline to try to zero out a line that's not null-
-terminated, leading to a memory fault.
-
-Patch (apply with `patch -p0'):
-
-Upstream-Status: Submitted [https://ftp.gnu.org/gnu/readline/readline-8.2-patches/]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-
-*** ../readline-8.2-patched/display.c   2022-04-05 10:47:31.000000000 -0400
---- display.c   2022-12-13 13:11:22.000000000 -0500
-***************
-*** 2684,2692 ****
-  
-    if (visible_line)
-!     {
-!       temp = visible_line;
-!       while (*temp)
-!       *temp++ = '\0';
-!     }
-    rl_on_new_line ();
-    forced_display++;
---- 2735,2740 ----
-  
-    if (visible_line)
-!     memset (visible_line, 0, line_size);
-! 
-    rl_on_new_line ();
-    forced_display++;
-*** ../readline-8.2/patchlevel  2013-11-15 08:11:11.000000000 -0500
---- patchlevel  2014-03-21 08:28:40.000000000 -0400
-***************
-*** 1,3 ****
-  # Do not edit -- exists only for use by patch
-  
-! 1
---- 1,3 ----
-  # Do not edit -- exists only for use by patch
-  
-! 2
diff --git a/meta/recipes-core/readline/readline/readline82-003.patch b/meta/recipes-core/readline/readline/readline82-003.patch
deleted file mode 100644
index 61570bf4f4..0000000000
--- a/meta/recipes-core/readline/readline/readline82-003.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-                           READLINE PATCH REPORT
-                           =====================
-
-Readline-Release: 8.2
-Patch-ID: readline82-003
-
-Bug-Reported-by:        Stefan Klinger <readline-gnu.org@stefan-klinger.de>
-Bug-Reference-ID:
-Bug-Reference-URL:      https://lists.gnu.org/archive/html/bug-readline/2023-08/msg00018.html
-
-Bug-Description:
-
-Patch (apply with `patch -p0'):
-
-The custom color prefix that readline uses to color possible completions
-must have a leading `.'.
-
-Upstream-Status: Submitted [https://ftp.gnu.org/gnu/readline/readline-8.2-patches/]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-
-*** ../readline-8.2-patched/colors.c    2021-12-08 11:38:25.000000000 -0500
---- colors.c    2023-08-28 16:40:04.000000000 -0400
-***************
-*** 74,78 ****
-  static void restore_default_color (void);
-  
-! #define RL_COLOR_PREFIX_EXTENSION     "readline-colored-completion-prefix"
-  
-  COLOR_EXT_TYPE *_rl_color_ext_list = 0;
---- 74,78 ----
-  static void restore_default_color (void);
-  
-! #define RL_COLOR_PREFIX_EXTENSION     ".readline-colored-completion-prefix"
-  
-  COLOR_EXT_TYPE *_rl_color_ext_list = 0;
-*** ../readline-8.2/patchlevel  2013-11-15 08:11:11.000000000 -0500
---- patchlevel  2014-03-21 08:28:40.000000000 -0400
-***************
-*** 1,3 ****
-  # Do not edit -- exists only for use by patch
-  
-! 2
---- 1,3 ----
-  # Do not edit -- exists only for use by patch
-  
-! 3
diff --git a/meta/recipes-core/readline/readline/readline82-004.patch b/meta/recipes-core/readline/readline/readline82-004.patch
deleted file mode 100644
index cedc3d0fe4..0000000000
--- a/meta/recipes-core/readline/readline/readline82-004.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-                           READLINE PATCH REPORT
-                           =====================
-
-Readline-Release: 8.2
-Patch-ID: readline82-004
-
-Bug-Reported-by:        Henry Bent <henry.r.bent@gmail.com>
-Bug-Reference-ID:
-Bug-Reference-URL:      https://lists.gnu.org/archive/html/bug-bash/2022-11/msg00044.html
-
-Bug-Description:
-
-Patch (apply with `patch -p0'):
-
-There are systems that supply one of select or pselect, but not both.
-
-Upstream-Status: Submitted [https://ftp.gnu.org/gnu/readline/readline-8.2-patches/]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-
-*** ../readline-8.2-patched/input.c     2022-04-08 15:43:24.000000000 -0400
---- input.c     2022-11-28 09:41:08.000000000 -0500
-***************
-*** 152,156 ****
---- 152,158 ----
-  int _rl_timeout_init (void);
-  int _rl_timeout_sigalrm_handler (void);
-+ #if defined (RL_TIMEOUT_USE_SELECT)
-  int _rl_timeout_select (int, fd_set *, fd_set *, fd_set *, const struct timeval *, const sigset_t *);
-+ #endif
-  
-  static void _rl_timeout_handle (void);
-***************
-*** 249,253 ****
-    int chars_avail, k;
-    char input;
-! #if defined(HAVE_SELECT)
-    fd_set readfds, exceptfds;
-    struct timeval timeout;
---- 251,255 ----
-    int chars_avail, k;
-    char input;
-! #if defined (HAVE_PSELECT) || defined (HAVE_SELECT)
-    fd_set readfds, exceptfds;
-    struct timeval timeout;
-***************
-*** 806,810 ****
-    unsigned char c;
-    int fd;
-! #if defined (HAVE_PSELECT)
-    sigset_t empty_set;
-    fd_set readfds;
---- 815,819 ----
-    unsigned char c;
-    int fd;
-! #if defined (HAVE_PSELECT) || defined (HAVE_SELECT)
-    sigset_t empty_set;
-    fd_set readfds;
-*** ../readline-8.2/patchlevel  2013-11-15 08:11:11.000000000 -0500
---- patchlevel  2014-03-21 08:28:40.000000000 -0400
-***************
-*** 1,3 ****
-  # Do not edit -- exists only for use by patch
-  
-! 3
---- 1,3 ----
-  # Do not edit -- exists only for use by patch
-  
-! 4
diff --git a/meta/recipes-core/readline/readline/readline82-005.patch b/meta/recipes-core/readline/readline/readline82-005.patch
deleted file mode 100644
index 69c2e4f77a..0000000000
--- a/meta/recipes-core/readline/readline/readline82-005.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-                           READLINE PATCH REPORT
-                           =====================
-
-Readline-Release: 8.2
-Patch-ID: readline82-005
-
-Bug-Reported-by:        Simon Marchi <simon.marchi@polymtl.ca>
-Bug-Reference-ID:
-Bug-Reference-URL:      https://lists.gnu.org/archive/html/bug-readline/2022-09/msg00005.html
-
-Bug-Description:
-
-If an application is using readline in callback mode, and a signal arrives
-after readline checks for it in rl_callback_read_char() but before it
-restores the application's signal handlers, it won't get processed until the
-next time the application calls rl_callback_read_char(). Readline needs to
-check for and resend any pending signals after restoring the application's
-signal handlers.
-
-Patch (apply with `patch -p0'):
-
-Upstream-Status: Submitted [https://ftp.gnu.org/gnu/readline/readline-8.2-patches/]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-
-*** ../readline-8.2-patched/callback.c  2022-04-29 12:02:56.000000000 -0400
---- callback.c  2022-10-11 10:59:06.000000000 -0400
-***************
-*** 116,120 ****
-    do { \
-      if (rl_persistent_signal_handlers == 0) \
-!       rl_clear_signals (); \
-      return; \
-    } while (0)
---- 116,123 ----
-    do { \
-      if (rl_persistent_signal_handlers == 0) \
-!       { \
-!         rl_clear_signals (); \
-!         if (_rl_caught_signal) _rl_signal_handler (_rl_caught_signal); \
-!       } \
-      return; \
-    } while (0)
-*** ../readline-8.2/patchlevel  2013-11-15 08:11:11.000000000 -0500
---- patchlevel  2014-03-21 08:28:40.000000000 -0400
-***************
-*** 1,3 ****
-  # Do not edit -- exists only for use by patch
-  
-! 4
---- 1,3 ----
-  # Do not edit -- exists only for use by patch
-  
-! 5
diff --git a/meta/recipes-core/readline/readline/readline82-006.patch b/meta/recipes-core/readline/readline/readline82-006.patch
deleted file mode 100644
index d66afe82c9..0000000000
--- a/meta/recipes-core/readline/readline/readline82-006.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-                           READLINE PATCH REPORT
-                           =====================
-
-Readline-Release: 8.2
-Patch-ID: readline82-006
-
-Bug-Reported-by:        Tom de Vries <tdevries@suse.de>
-Bug-Reference-ID:
-Bug-Reference-URL:      https://lists.gnu.org/archive/html/bug-readline/2022-09/msg00001.html
-
-Bug-Description:
-
-This is a variant of the same issue as the one fixed by patch 5. In this
-case, the signal arrives and is pending before readline calls rl_getc().
-When this happens, the pending signal will be handled by the loop, but may
-alter or destroy some state that the callback uses. Readline needs to treat
-this case the same way it would if a signal interrupts pselect/select, so
-compound operations like searches and reading numeric arguments get cleaned
-up properly.
-
-Patch (apply with `patch -p0'):
-
-Upstream-Status: Submitted [https://ftp.gnu.org/gnu/readline/readline-8.2-patches/]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-
-*** ../readline-8.2-patched/input.c     2022-12-22 16:15:48.000000000 -0500
---- input.c     2023-01-10 11:53:45.000000000 -0500
-***************
-*** 812,816 ****
-  rl_getc (FILE *stream)
-  {
-!   int result;
-    unsigned char c;
-    int fd;
---- 812,816 ----
-  rl_getc (FILE *stream)
-  {
-!   int result, ostate, osig;
-    unsigned char c;
-    int fd;
-***************
-*** 823,828 ****
---- 823,842 ----
-    while (1)
-      {
-+       osig = _rl_caught_signal;
-+       ostate = rl_readline_state;
-+ 
-        RL_CHECK_SIGNALS ();
-  
-+ #if defined (READLINE_CALLBACKS)
-+       /* Do signal handling post-processing here, but just in callback mode
-+        for right now because the signal cleanup can change some of the
-+        callback state, and we need to either let the application have a
-+        chance to react or abort some current operation that gets cleaned
-+        up by rl_callback_sigcleanup(). If not, we'll just run through the
-+        loop again. */
-+       if (osig != 0 && (ostate & RL_STATE_CALLBACK))
-+       goto postproc_signal;
-+ #endif
-+ 
-        /* We know at this point that _rl_caught_signal == 0 */
-  
-***************
-*** 888,891 ****
---- 902,908 ----
-  
-  handle_error:
-+       osig = _rl_caught_signal;
-+       ostate = rl_readline_state;
-+ 
-        /* If the error that we received was EINTR, then try again,
-         this is simply an interrupted system call to read ().  We allow
-***************
-*** 928,933 ****
---- 945,959 ----
-  #endif  /* SIGALRM */
-  
-+ postproc_signal:
-+       /* POSIX says read(2)/pselect(2)/select(2) don't return EINTR for any
-+        reason other than being interrupted by a signal, so we can safely
-+        call the application's signal event hook. */
-        if (rl_signal_event_hook)
-        (*rl_signal_event_hook) ();
-+ #if defined (READLINE_CALLBACKS)
-+       else if (osig == SIGINT && (ostate & RL_STATE_CALLBACK) && (ostate & (RL_STATE_ISEARCH|RL_STATE_NSEARCH|RL_STATE_NUMERICARG)))
-+         /* just these cases for now */
-+         _rl_abort_internal ();
-+ #endif
-      }
-  }
-*** ../readline-8.2/patchlevel  2013-11-15 08:11:11.000000000 -0500
---- patchlevel  2014-03-21 08:28:40.000000000 -0400
-***************
-*** 1,3 ****
-  # Do not edit -- exists only for use by patch
-  
-! 5
---- 1,3 ----
-  # Do not edit -- exists only for use by patch
-  
-! 6
diff --git a/meta/recipes-core/readline/readline/readline82-007.patch b/meta/recipes-core/readline/readline/readline82-007.patch
deleted file mode 100644
index 9fa1ccb552..0000000000
--- a/meta/recipes-core/readline/readline/readline82-007.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-                           READLINE PATCH REPORT
-                           =====================
-
-Readline-Release: 8.2
-Patch-ID: readline82-007
-
-Bug-Reported-by:        Kevin Pulo <kev@pulo.com.au>
-Bug-Reference-ID:
-Bug-Reference-URL:      https://lists.gnu.org/archive/html/bug-readline/2022-11/msg00002.html
-
-Bug-Description:
-
-If readline is called with no prompt, it should display a newline if return
-is typed on an empty line. It should still suppress the final newline if
-return is typed on the last (empty) line of a multi-line command.
-
-Patch (apply with `patch -p0'):
-
-Upstream-Status: Submitted [https://ftp.gnu.org/gnu/readline/readline-8.2-patches/]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-
-*** ../readline-8.2-patched/display.c   2022-04-05 10:47:31.000000000 -0400
---- display.c   2022-12-13 13:11:22.000000000 -0500
-***************
-*** 3342,3348 ****
-                 &last_face[_rl_screenwidth - 1 + woff], 1);
-      }
-!   _rl_vis_botlin = 0;
-!   if (botline_length > 0 || _rl_last_c_pos > 0)
-      rl_crlf ();
-    fflush (rl_outstream);
-    rl_display_fixed++;
---- 3394,3400 ----
-                 &last_face[_rl_screenwidth - 1 + woff], 1);
-      }
-!   if ((_rl_vis_botlin == 0 && botline_length == 0) || botline_length > 0 || _rl_last_c_pos > 0)
-      rl_crlf ();
-+   _rl_vis_botlin = 0;
-    fflush (rl_outstream);
-    rl_display_fixed++;
-*** ../readline-8.2/patchlevel  2013-11-15 08:11:11.000000000 -0500
---- patchlevel  2014-03-21 08:28:40.000000000 -0400
-***************
-*** 1,3 ****
-  # Do not edit -- exists only for use by patch
-  
-! 6
---- 1,3 ----
-  # Do not edit -- exists only for use by patch
-  
-! 7
diff --git a/meta/recipes-core/readline/readline/readline82-008.patch b/meta/recipes-core/readline/readline/readline82-008.patch
deleted file mode 100644
index 660cb1e00b..0000000000
--- a/meta/recipes-core/readline/readline/readline82-008.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-                           READLINE PATCH REPORT
-                           =====================
-
-Readline-Release: 8.2
-Patch-ID: readline82-008
-
-Bug-Reported-by:
-Bug-Reference-ID:
-Bug-Reference-URL:
-
-Bug-Description:
-
-Add missing prototypes for several function declarations.
-
-Patch (apply with `patch -p0'):
-
-Upstream-Status: Submitted [https://ftp.gnu.org/gnu/readline/readline-8.2-patches/]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-
-*** ../readline-8.2-patched/text.c      Wed Oct 27 11:03:59 2021
---- text.c      Thu Nov 16 16:24:58 2023
-***************
-*** 1765,1770 ****
-  #if defined (READLINE_CALLBACKS)
-  static int
-! _rl_char_search_callback (data)
-!      _rl_callback_generic_arg *data;
-  {
-    _rl_callback_func = 0;
---- 1765,1769 ----
-  #if defined (READLINE_CALLBACKS)
-  static int
-! _rl_char_search_callback (_rl_callback_generic_arg *data)
-  {
-    _rl_callback_func = 0;
-*** ../readline-8.2-patched/bind.c      Wed Feb  9 11:02:22 2022
---- bind.c      Thu Nov 16 16:25:17 2023
-***************
-*** 1168,1174 ****
-  
-  static int
-! parse_comparison_op (s, indp)
-!      const char *s;
-!      int *indp;
-  {
-    int i, peekc, op;
---- 1168,1172 ----
-  
-  static int
-! parse_comparison_op (const char *s, int *indp)
-  {
-    int i, peekc, op;
-*** ../readline-8.2-patched/rltty.c     Fri Feb 18 11:14:22 2022
---- rltty.c     Thu Nov 16 16:25:36 2023
-***************
-*** 81,86 ****
-     to get the tty settings. */
-  static void
-! set_winsize (tty)
-!      int tty;
-  {
-  #if defined (TIOCGWINSZ)
---- 81,85 ----
-     to get the tty settings. */
-  static void
-! set_winsize (int tty)
-  {
-  #if defined (TIOCGWINSZ)
-
-*** ../readline-8.2/patchlevel  2013-11-15 08:11:11.000000000 -0500
---- patchlevel  2014-03-21 08:28:40.000000000 -0400
-***************
-*** 1,3 ****
-  # Do not edit -- exists only for use by patch
-  
-! 7
---- 1,3 ----
-  # Do not edit -- exists only for use by patch
-  
-! 8
diff --git a/meta/recipes-core/readline/readline/readline82-009.patch b/meta/recipes-core/readline/readline/readline82-009.patch
deleted file mode 100644
index 1fcf7b3535..0000000000
--- a/meta/recipes-core/readline/readline/readline82-009.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-                           READLINE PATCH REPORT
-                           =====================
-
-Readline-Release: 8.2
-Patch-ID: readline82-009
-
-Bug-Reported-by:        Stefan H. Holek <stefan@epy.co.at>
-Bug-Reference-ID:       <50F8DA45-B7F3-4DE1-AB94-19AE42649CDC@epy.co.at>
-Bug-Reference-URL:      https://lists.gnu.org/archive/html/bug-readline/2022-10/msg00021.html
-
-Bug-Description:
-
-Fix issue where the directory name portion of the word to be completed (the
-part that is passed to opendir()) requires both tilde expansion and dequoting.
-Readline only performed tilde expansion in this case, so filename completion
-would fail.
-
-Patch (apply with `patch -p0'):
-
-Upstream-Status: Submitted [https://ftp.gnu.org/gnu/readline/readline-8.2-patches/]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-
-*** ../readline-8.2-patched/complete.c  2022-04-05 10:47:06.000000000 -0400
---- complete.c  2022-10-26 15:08:51.000000000 -0400
-***************
-*** 2527,2531 ****
-          xfree (dirname);
-          dirname = temp;
-!         tilde_dirname = 1;
-        }
-  
---- 2527,2532 ----
-          xfree (dirname);
-          dirname = temp;
-!         if (*dirname != '~')
-!           tilde_dirname = 1;  /* indicate successful tilde expansion */
-        }
-  
-***************
-*** 2546,2554 ****
-          users_dirname = savestring (dirname);
-        }
-!       else if (tilde_dirname == 0 && rl_completion_found_quote && rl_filename_dequoting_function)
-        {
-!         /* delete single and double quotes */
-          xfree (dirname);
-!         dirname = savestring (users_dirname);
-        }
-        directory = opendir (dirname);
---- 2547,2560 ----
-          users_dirname = savestring (dirname);
-        }
-!       else if (rl_completion_found_quote && rl_filename_dequoting_function)
-        {
-!         /* We already ran users_dirname through the dequoting function.
-!            If tilde_dirname == 1, we successfully performed tilde expansion
-!            on dirname. Now we need to reconcile those results. We either
-!            just copy the already-dequoted users_dirname or tilde expand it
-!            if we tilde-expanded dirname. */
-!         temp = tilde_dirname ? tilde_expand (users_dirname) : savestring (users_dirname);
-          xfree (dirname);
-!         dirname = temp;
-        }
-        directory = opendir (dirname);
-
-*** ../readline-8.2/patchlevel  2013-11-15 08:11:11.000000000 -0500
---- patchlevel  2014-03-21 08:28:40.000000000 -0400
-***************
-*** 1,3 ****
-  # Do not edit -- exists only for use by patch
-  
-! 8
---- 1,3 ----
-  # Do not edit -- exists only for use by patch
-  
-! 9
diff --git a/meta/recipes-core/readline/readline/readline82-010.patch b/meta/recipes-core/readline/readline/readline82-010.patch
deleted file mode 100644
index 6152953e91..0000000000
--- a/meta/recipes-core/readline/readline/readline82-010.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-                           READLINE PATCH REPORT
-                           =====================
-
-Readline-Release: 8.2
-Patch-ID: readline82-010
-
-Bug-Reported-by:        Martin Castillo <castilma@uni-bremen.de>
-Bug-Reference-ID:       <2d42153b-cf65-caba-dff1-cd3bc6268c7e@uni-bremen.de>
-Bug-Reference-URL:      https://lists.gnu.org/archive/html/bug-readline/2023-01/msg00000.html
-
-Bug-Description:
-
-Fix the case where text to be completed from the line buffer (quoted) is
-compared to the common prefix of the possible matches (unquoted) and the
-quoting makes the former appear to be longer than the latter. Readline
-assumes the match doesn't add any characters to the word and doesn't display
-multiple matches.
-
-Patch (apply with `patch -p0'):
-
-Upstream-Status: Submitted [https://ftp.gnu.org/gnu/readline/readline-8.2-patches/]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-
-*** ../readline-8.2-patched/complete.c  Tue Apr  5 10:47:06 2022
---- complete.c  Sat Jan  7 14:19:45 2023
-***************
-*** 2032,2038 ****
-    text = rl_copy_text (start, end);
-    matches = gen_completion_matches (text, start, end, our_func, found_quote, quote_char);
-    /* nontrivial_lcd is set if the common prefix adds something to the word
-       being completed. */
-!   nontrivial_lcd = matches && compare_match (text, matches[0]) != 0;
-    if (what_to_do == '!' || what_to_do == '@')
-      tlen = strlen (text);
---- 2038,2060 ----
-    text = rl_copy_text (start, end);
-    matches = gen_completion_matches (text, start, end, our_func, found_quote, quote_char);
-+   /* If TEXT contains quote characters, it will be dequoted as part of
-+      generating the matches, and the matches will not contain any quote
-+      characters. We need to dequote TEXT before performing the comparison.
-+      Since compare_match performs the dequoting, and we only want to do it
-+      once, we don't call compare_matches after dequoting TEXT; we call
-+      strcmp directly. */
-    /* nontrivial_lcd is set if the common prefix adds something to the word
-       being completed. */
-!   if (rl_filename_completion_desired && rl_filename_quoting_desired &&
-!       rl_completion_found_quote && rl_filename_dequoting_function)
-!     {
-!       char *t;
-!       t = (*rl_filename_dequoting_function) (text, rl_completion_quote_character);
-!       xfree (text);
-!       text = t;
-!       nontrivial_lcd = matches && strcmp (text, matches[0]) != 0;
-!     }
-!   else
-!     nontrivial_lcd = matches && strcmp (text, matches[0]) != 0;
-    if (what_to_do == '!' || what_to_do == '@')
-      tlen = strlen (text);
-
-*** ../readline-8.2/patchlevel  2013-11-15 08:11:11.000000000 -0500
---- patchlevel  2014-03-21 08:28:40.000000000 -0400
-***************
-*** 1,3 ****
-  # Do not edit -- exists only for use by patch
-  
-! 9
---- 1,3 ----
-  # Do not edit -- exists only for use by patch
-  
-! 10
diff --git a/meta/recipes-core/readline/readline_8.2.13.bb b/meta/recipes-core/readline/readline_8.2.13.bb
new file mode 100644
index 0000000000..19b5cb6f58
--- /dev/null
+++ b/meta/recipes-core/readline/readline_8.2.13.bb
@@ -0,0 +1,7 @@
+require readline.inc
+
+SRC_URI += "file://norpath.patch \
+            file://0001-Add-fix-for-packages-that-are-not-compatible-with-C2.patch \
+            "
+
+SRC_URI[archive.sha256sum] = "0e5be4d2937e8bd9b7cd60d46721ce79f88a33415dd68c2d738fb5924638f656"
diff --git a/meta/recipes-core/readline/readline_8.2.bb b/meta/recipes-core/readline/readline_8.2.bb
deleted file mode 100644
index f0dba31251..0000000000
--- a/meta/recipes-core/readline/readline_8.2.bb
+++ /dev/null
@@ -1,17 +0,0 @@
-require readline.inc
-
-SRC_URI += "  file://norpath.patch"
-
-SRC_URI += "file://readline82-001.patch;striplevel=0 \
-            file://readline82-002.patch;striplevel=0 \
-            file://readline82-003.patch;striplevel=0 \
-            file://readline82-004.patch;striplevel=0 \
-            file://readline82-005.patch;striplevel=0 \
-            file://readline82-006.patch;striplevel=0 \
-            file://readline82-007.patch;striplevel=0 \
-            file://readline82-008.patch;striplevel=0 \
-            file://readline82-009.patch;striplevel=0 \
-            file://readline82-010.patch;striplevel=0 \
-           "
-
-SRC_URI[archive.sha256sum] = "3feb7171f16a84ee82ca18a36d7b9be109a52c04f492a053331d7d1095007c35"
diff --git a/meta/recipes-core/seatd/seatd/init b/meta/recipes-core/seatd/seatd/init
index 0589c765ac..405000c16f 100644
--- a/meta/recipes-core/seatd/seatd/init
+++ b/meta/recipes-core/seatd/seatd/init
@@ -15,7 +15,7 @@ killproc() {
 
 case "$1" in
   start)
-        seatd -g video -n 1 > /tmp/seatd-start-notify &
+        seatd -g seat -n 1 > /tmp/seatd-start-notify &
         [ -s /tmp/seatd-start-notify ] && exit 0
         sleep 0.1
         [ -s /tmp/seatd-start-notify ] && exit 0
diff --git a/meta/recipes-core/seatd/seatd_0.8.0.bb b/meta/recipes-core/seatd/seatd_0.8.0.bb
deleted file mode 100644
index 14c5b1b7ae..0000000000
--- a/meta/recipes-core/seatd/seatd_0.8.0.bb
+++ /dev/null
@@ -1,35 +0,0 @@
-SUMMARY = "A minimal seat management daemon, and a universal seat management library."
-DESCRIPTION = "Seat management takes care of mediating access to shared devices (graphics, input), without requiring the applications needing access to be root."
-HOMEPAGE = "https://git.sr.ht/~kennylevinsen/seatd"
-
-LICENSE = "MIT"
-
-LIC_FILES_CHKSUM = "file://LICENSE;md5=715a99d2dd552e6188e74d4ed2914d5a"
-
-SRC_URI = "git://git.sr.ht/~kennylevinsen/seatd;protocol=https;branch=master \
-           file://init"
-SRCREV = "3e9ef69f14f630a719dd464f3c90a7932f1c8296"
-S = "${WORKDIR}/git"
-
-inherit meson pkgconfig update-rc.d
-
-# https://www.openwall.com/lists/musl/2020/01/20/3
-CFLAGS:append:libc-musl:powerpc64le = " -Wno-error=overflow"
-
-PACKAGECONFIG ?= " \
-        ${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)} \
-        libseat-builtin \
-"
-
-PACKAGECONFIG[libseat-builtin] = "-Dlibseat-builtin=enabled,-Dlibseat-builtin=disabled"
-PACKAGECONFIG[systemd] = ",,systemd"
-
-do_install:append() {
-        if [ "${VIRTUAL-RUNTIME_init_manager}" != "systemd" ]; then
-                install -Dm755 ${WORKDIR}/init ${D}/${sysconfdir}/init.d/seatd
-        fi
-}
-
-INITSCRIPT_NAME = "seatd"
-INITSCRIPT_PARAMS = "start 9 5 2 . stop 20 0 1 6 ."
-INHIBIT_UPDATERCD_BBCLASS = "${@oe.utils.conditional('VIRTUAL-RUNTIME_init_manager', 'systemd', '1', '', d)}"
diff --git a/meta/recipes-core/seatd/seatd_0.9.1.bb b/meta/recipes-core/seatd/seatd_0.9.1.bb
new file mode 100644
index 0000000000..3be27dda9d
--- /dev/null
+++ b/meta/recipes-core/seatd/seatd_0.9.1.bb
@@ -0,0 +1,48 @@
+SUMMARY = "A minimal seat management daemon, and a universal seat management library."
+DESCRIPTION = "Seat management takes care of mediating access to shared devices (graphics, input), without requiring the applications needing access to be root."
+HOMEPAGE = "https://git.sr.ht/~kennylevinsen/seatd"
+
+LICENSE = "MIT"
+
+LIC_FILES_CHKSUM = "file://LICENSE;md5=715a99d2dd552e6188e74d4ed2914d5a"
+
+SRC_URI = "git://git.sr.ht/~kennylevinsen/seatd;protocol=https;branch=master \
+           file://init"
+SRCREV = "566ffeb032af42865dc1210e48cec08368059bb9"
+
+inherit meson pkgconfig systemd update-rc.d useradd
+
+# https://www.openwall.com/lists/musl/2020/01/20/3
+CFLAGS:append:libc-musl:powerpc64le = " -Wno-error=overflow"
+#../git/common/connection.c:154:55: error: comparison of integers of different signs: 'unsigned long' and 'long' [-Werror,-Wsign-compare]
+#  154 |         for (cmsg = CMSG_FIRSTHDR(msg); cmsg != NULL; cmsg = CMSG_NXTHDR(msg, cmsg)) {
+#      |                                                              ^~~~~~~~~~~~~~~~~~~~~~
+#/mnt/b/yoe/master/sources/poky/build/tmp/work/riscv64-poky-linux-musl/seatd/0.9.1/recipe-sysroot/usr/include/sys/socket.h:358:44: note: expanded from macro 'CMSG_NXTHDR'
+#  358 |         __CMSG_LEN(cmsg) + sizeof(struct cmsghdr) >= __MHDR_END(mhdr) - (unsigned char *)(cmsg) \
+#      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#1 error generated.
+CFLAGS:append:libc-musl:toolchain-clang = " -Wno-error=sign-compare"
+
+PACKAGECONFIG ?= " \
+        ${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)} \
+        libseat-builtin \
+"
+
+PACKAGECONFIG[libseat-builtin] = "-Dlibseat-builtin=enabled,-Dlibseat-builtin=disabled"
+PACKAGECONFIG[systemd] = "-Dlibseat-logind=systemd,,systemd"
+
+do_install:append() {
+        if [ "${VIRTUAL-RUNTIME_init_manager}" != "systemd" ]; then
+                install -Dm755 ${UNPACKDIR}/init ${D}/${sysconfdir}/init.d/seatd
+        fi
+        install -Dm644 ${S}/contrib/systemd/seatd.service ${D}${systemd_unitdir}/system/seatd.service
+}
+
+USERADD_PACKAGES = "${PN}"
+GROUPADD_PARAM:${PN} = "-r seat"
+
+INITSCRIPT_NAME = "seatd"
+INITSCRIPT_PARAMS = "start 9 5 2 . stop 20 0 1 6 ."
+INHIBIT_UPDATERCD_BBCLASS = "${@oe.utils.conditional('VIRTUAL-RUNTIME_init_manager', 'systemd', '1', '', d)}"
+
+SYSTEMD_SERVICE:${PN} = "seatd.service"
diff --git a/meta/recipes-core/sysfsutils/files/0001-Modify-my_strncat-function.patch b/meta/recipes-core/sysfsutils/files/0001-Modify-my_strncat-function.patch
new file mode 100644
index 0000000000..a8a49a80cd
--- /dev/null
+++ b/meta/recipes-core/sysfsutils/files/0001-Modify-my_strncat-function.patch
@@ -0,0 +1,34 @@
+From a13fc5a57ea7c6b1761bc204cb79d8ce4745f57a Mon Sep 17 00:00:00 2001
+From: songliang <YS.songliang@h3c.com>
+Date: Wed, 4 Jun 2025 15:58:53 +0800
+Subject: [PATCH] Modify "my_strncat" function
+
+The meaning of the "len" parameter in the my_strncat function is the size limit for copying characters from "from", not the size limit for "to" after copying.
+Also, the "#define safestrcat(to, from) my_strncat(to, from, sizeof(to) - strlen(to) - 1)" has already imposed a limit on max based on the size of "to".
+Modify the function to prevent truncation of content when too many bytes are passed to the my_strcat function.
+
+Upstream-Status: Submitted [https://github.com/linux-ras/sysfsutils/pull/30/commits/c2326946c0c2a4206c9b079a9fe25f7f9115295c]
+Signed-off-by: songliang <YS.songliang@h3c.com>
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ lib/sysfs_utils.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/sysfs_utils.c b/lib/sysfs_utils.c
+index 46e0849..c0176d1 100644
+--- a/lib/sysfs_utils.c
++++ b/lib/sysfs_utils.c
+@@ -375,8 +375,8 @@ char *my_strncat(char *to, const char *from, size_t max)
+ {
+        size_t i = 0;
+ 
+-       while (i < max && to[i] != '\0')
++       while (to[i] != '\0')
+                i++;
+-       my_strncpy(to+i, from, max-i);
++       my_strncpy(to+i, from, max);
+        return to;
+ }
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/sysfsutils/sysfsutils_2.1.1.bb b/meta/recipes-core/sysfsutils/sysfsutils_2.1.1.bb
index 86cc06a2cd..5040d8864e 100644
--- a/meta/recipes-core/sysfsutils/sysfsutils_2.1.1.bb
+++ b/meta/recipes-core/sysfsutils/sysfsutils_2.1.1.bb
@@ -9,12 +9,12 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=dcc19fa9307a50017fca61423a7d9754 \
                     file://cmd/GPL;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
                     file://lib/LGPL;md5=4fbd65380cdd255951079008b364516c"
 
-SRC_URI = "git://github.com/linux-ras/sysfsutils.git;protocol=https;branch=master"
+SRC_URI = "git://github.com/linux-ras/sysfsutils.git;protocol=https;branch=master \
+           file://0001-Modify-my_strncat-function.patch \
+"
 
 SRCREV = "da2f1f8500c0af6663a56ce2bff07f67e60a92e0"
 
-S = "${WORKDIR}/git"
-
 inherit autotools
 
 PACKAGES =+ "libsysfs"
diff --git a/meta/recipes-core/systemd/dlopen-deps.inc b/meta/recipes-core/systemd/dlopen-deps.inc
new file mode 100644
index 0000000000..e0b333398c
--- /dev/null
+++ b/meta/recipes-core/systemd/dlopen-deps.inc
@@ -0,0 +1,81 @@
+PACKAGEFUNCS =+ "package_generate_dlopen_deps"
+
+python package_generate_dlopen_deps() {
+    # https://systemd.io/ELF_DLOPEN_METADATA/
+
+    import struct, json
+
+    def extract_segment(filename, segment):
+        """
+        Return the named segment from the ELF.
+        """
+        import tempfile, subprocess
+
+        with tempfile.NamedTemporaryFile() as f:
+            try:
+                cmd = [d.getVar("OBJCOPY"), "--dump-section", f"{segment}={f.name}", filename]
+                subprocess.run(cmd, check=True)
+                with open(f.name, "rb") as f2:
+                    return f2.read()
+            except subprocess.CalledProcessError as e:
+                # binutils-objcopy has 0 exit code if the segment can't be found, but llvm-objcopy
+                # does not. Assume the failure isn't critical and ignore errors.
+                if e.returncode == 1:
+                    return b""
+                raise e
+
+    def parse(buffer, is_little):
+        deps = []
+        offset = 0
+        while offset < len(buffer):
+            format = f"{'<' if is_little else '>'}iii"
+            name_size, desc_size, note_type = struct.unpack_from(format, buffer, offset)
+            offset += struct.calcsize(format)
+
+            format = f"{name_size}s0i{desc_size}s0i"
+            if note_type == 0x407c0c0a:
+                name_b, desc_b = struct.unpack_from(format, buffer, offset)
+                name = name_b.strip(b"\x00").decode("ascii")
+                if name == "FDO":
+                    desc = desc_b.strip(b"\x00").decode("utf-8")
+                    deps.append(*json.loads(desc))
+            offset += struct.calcsize(format)
+        return deps
+
+    dep_map = {
+        "required": "RDEPENDS",
+        "recommended": "RRECOMMENDS",
+        "suggested": "RSUGGESTS"
+    }
+
+    shlibs = oe.package.read_shlib_providers(d)
+
+    for pkg, files in pkgfiles.items():
+        # Skip -dbg packages as we won't need to generate dependencies for those
+        # but scanning can take time
+        if pkg.endswith("-dbg"):
+            continue
+
+        for f in files:
+            # Skip symlinks, just look for real libraries
+            if cpath.islink(f):
+                continue
+
+            if ".so." in f or f.endswith(".so"):
+                try:
+                    elf = oe.qa.ELFFile(f)
+                    elf.open()
+                    for dep in parse(extract_segment(f, ".note.dlopen"), elf.isLittleEndian()):
+                        for soname in dep["soname"]:
+                            if soname in shlibs:
+                                # TODO assumes the first match is good
+                                package, version = list(shlibs[soname].values())[0]
+                                dependency = dep_map[dep["priority"]]
+                                bb.note(f"{pkg}: adding {dependency} on {package} via .note.dlopen")
+                                d.appendVar(f"{dependency}:{pkg}", f" {package} (>= {version})")
+                            else:
+                                bb.warn(f"cannot find {soname}")
+                except oe.qa.NotELFFileError as e:
+                    bb.note(f"Cannot extract ELF notes: {e}")
+                    pass
+}
diff --git a/meta/recipes-core/systemd/systemd-boot-native_255.4.bb b/meta/recipes-core/systemd/systemd-boot-native_257.6.bb
index 73db59b14e..05ebe7b63e 100644
--- a/meta/recipes-core/systemd/systemd-boot-native_255.4.bb
+++ b/meta/recipes-core/systemd/systemd-boot-native_257.6.bb
@@ -1,4 +1,5 @@
 require systemd.inc
+FILESEXTRAPATHS =. "${FILE_DIRNAME}/systemd:"
 
 inherit native
 
@@ -8,8 +9,10 @@ deltask do_compile
 do_install () {
        install -Dm 0755 ${S}/src/ukify/ukify.py ${D}${bindir}/ukify
 }
-addtask install after do_unpack
+addtask install after do_patch
 
 PACKAGES = "${PN}"
 
 FILES:${PN} = "${bindir}/ukify"
+
+RDEPENDS:${PN} += "python3-pefile-native"
diff --git a/meta/recipes-core/systemd/systemd-boot_255.4.bb b/meta/recipes-core/systemd/systemd-boot_257.6.bb
index 4ee25ee72f..c6c443f929 100644
--- a/meta/recipes-core/systemd/systemd-boot_255.4.bb
+++ b/meta/recipes-core/systemd/systemd-boot_257.6.bb
@@ -3,15 +3,15 @@ FILESEXTRAPATHS =. "${FILE_DIRNAME}/systemd:"
 
 require conf/image-uefi.conf
 
-DEPENDS = "intltool-native libcap util-linux gperf-native python3-jinja2-native python3-pyelftools-native"
+DEPENDS = "libcap util-linux gperf-native python3-jinja2-native python3-pyelftools-native"
 
 inherit meson pkgconfig gettext
 inherit deploy
 
-LDFLAGS:prepend = "${@ " ".join(d.getVar('LD').split()[1:])} "
+LDFLAGS =+ "${@ " ".join(d.getVar('LD').split()[1:])} "
 
 EFI_LD = "bfd"
-LDFLAGS:append = " -fuse-ld=${EFI_LD}"
+LDFLAGS += "-fuse-ld=${EFI_LD}"
 
 do_write_config[vardeps] += "EFI_LD"
 do_write_config:append() {
@@ -47,20 +47,28 @@ FILES:${PN} = "${EFI_FILES_PATH}/${SYSTEMD_BOOT_IMAGE}"
 
 RDEPENDS:${PN} += "virtual-systemd-bootconf"
 
+# efi portions use -mgeneral-regs-only option which conflicts with SSE
+# especially clang throws errors about it
+# error: the 'sse' unit is not supported with this instruction set
+TUNE_CCARGS:remove = "-mfpmath=sse"
+
 CFLAGS:append:libc-musl = " -D__DEFINED_wchar_t"
 
-COMPATIBLE_HOST = "(aarch64.*|arm.*|x86_64.*|i.86.*)-linux"
+# arm-poky-linux-musleabi-clang: error: unsupported option '-mgeneral-regs-only' for target 'arm-poky-linux-musleabi'
+TOOLCHAIN:arm = "gcc"
+
+COMPATIBLE_HOST = "(aarch64.*|arm.*|x86_64.*|i.86.*|riscv.*)-linux"
 COMPATIBLE_HOST:x86-x32 = "null"
 
 do_install() {
         install -d ${D}${EFI_FILES_PATH}
-        install ${B}/src/boot/efi/systemd-boot*.efi ${D}${EFI_FILES_PATH}/${SYSTEMD_BOOT_IMAGE}
+        install ${B}/src/boot/systemd-boot*.efi ${D}${EFI_FILES_PATH}/${SYSTEMD_BOOT_IMAGE}
 }
 
 do_deploy () {
-        install ${B}/src/boot/efi/systemd-boot*.efi ${DEPLOYDIR}
-        install ${B}/src/boot/efi/linux*.efi.stub ${DEPLOYDIR}
-        install ${B}/src/boot/efi/addon*.efi.stub ${DEPLOYDIR}
+        install ${B}/src/boot/systemd-boot*.efi ${DEPLOYDIR}
+        install ${B}/src/boot/linux*.efi.stub ${DEPLOYDIR}
+        install ${B}/src/boot/addon*.efi.stub ${DEPLOYDIR}
 }
 
 addtask deploy before do_build after do_compile
diff --git a/meta/recipes-core/systemd/systemd-bootconf_1.00.bb b/meta/recipes-core/systemd/systemd-bootconf_1.00.bb
index 19637546a9..5efac3e410 100644
--- a/meta/recipes-core/systemd/systemd-bootconf_1.00.bb
+++ b/meta/recipes-core/systemd/systemd-bootconf_1.00.bb
@@ -7,7 +7,7 @@ PACKAGE_ARCH = "${MACHINE_ARCH}"
 
 inherit systemd-boot-cfg
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 LABELS = "boot"
 
diff --git a/meta/recipes-core/systemd/systemd-compat-units.bb b/meta/recipes-core/systemd/systemd-compat-units.bb
index c03d97f9c9..d6da34e9b8 100644
--- a/meta/recipes-core/systemd/systemd-compat-units.bb
+++ b/meta/recipes-core/systemd/systemd-compat-units.bb
@@ -2,10 +2,9 @@ SUMMARY = "Enhances systemd compatilibity with existing SysVinit scripts"
 HOMEPAGE = "http://www.freedesktop.org/wiki/Software/systemd"
 LICENSE = "MIT"
 
-
 PACKAGE_WRITE_DEPS += "systemd-systemctl-native"
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 inherit features_check
 
@@ -25,7 +24,7 @@ SYSTEMD_DISABLED_SYSV_SERVICES = " \
   syslog.busybox \
 "
 
-pkg_postinst:${PN} () {
+pkg_postinst_ontarget:${PN} () {
 
         test -d $D${sysconfdir}/init.d  ||  exit 0
         cd $D${sysconfdir}/init.d
diff --git a/meta/recipes-core/systemd/systemd-conf_1.0.bb b/meta/recipes-core/systemd/systemd-conf_1.0.bb
index 2355936631..60066cd60a 100644
--- a/meta/recipes-core/systemd/systemd-conf_1.0.bb
+++ b/meta/recipes-core/systemd/systemd-conf_1.0.bb
@@ -21,19 +21,21 @@ SRC_URI = "\
     file://wired.network \
 "
 
+S = "${UNPACKDIR}"
+
 do_install() {
-        install -D -m0644 ${WORKDIR}/journald.conf ${D}${systemd_unitdir}/journald.conf.d/00-${PN}.conf
-        install -D -m0644 ${WORKDIR}/logind.conf ${D}${systemd_unitdir}/logind.conf.d/00-${PN}.conf
-        install -D -m0644 ${WORKDIR}/system.conf ${D}${systemd_unitdir}/system.conf.d/00-${PN}.conf
+        install -D -m0644 ${S}/journald.conf ${D}${systemd_unitdir}/journald.conf.d/00-${PN}.conf
+        install -D -m0644 ${S}/logind.conf ${D}${systemd_unitdir}/logind.conf.d/00-${PN}.conf
+        install -D -m0644 ${S}/system.conf ${D}${systemd_unitdir}/system.conf.d/00-${PN}.conf
 
         if ${@bb.utils.contains('PACKAGECONFIG', 'dhcp-ethernet', 'true', 'false', d)}; then
-                install -D -m0644 ${WORKDIR}/wired.network ${D}${systemd_unitdir}/network/80-wired.network
+                install -D -m0644 ${S}/wired.network ${D}${systemd_unitdir}/network/80-wired.network
         fi
 }
 
 # Based on change from YP bug 8141, OE commit 5196d7bacaef1076c361adaa2867be31759c1b52
 do_install:append:qemuall() {
-        install -D -m0644 ${WORKDIR}/system.conf-qemuall ${D}${systemd_unitdir}/system.conf.d/01-${PN}.conf
+        install -D -m0644 ${S}/system.conf-qemuall ${D}${systemd_unitdir}/system.conf.d/01-${PN}.conf
 }
 
 PACKAGE_ARCH = "${MACHINE_ARCH}"
diff --git a/meta/recipes-core/systemd/systemd-machine-units_1.0.bb b/meta/recipes-core/systemd/systemd-machine-units_1.0.bb
index 8df7ff7cf1..a366f199ee 100644
--- a/meta/recipes-core/systemd/systemd-machine-units_1.0.bb
+++ b/meta/recipes-core/systemd/systemd-machine-units_1.0.bb
@@ -5,7 +5,6 @@ LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda
 
 PACKAGE_ARCH = "${MACHINE_ARCH}"
 
-
 inherit systemd features_check
 REQUIRED_DISTRO_FEATURES += "usrmerge"
 SYSTEMD_SERVICE:${PN} = ""
diff --git a/meta/recipes-core/systemd/systemd-serialgetty.bb b/meta/recipes-core/systemd/systemd-serialgetty.bb
index 44a93ac684..c3fe9d5b6d 100644
--- a/meta/recipes-core/systemd/systemd-serialgetty.bb
+++ b/meta/recipes-core/systemd/systemd-serialgetty.bb
@@ -1,15 +1,13 @@
-SUMMARY = "Serial terminal support for systemd"
+SUMMARY = "Serial terminal support for systemd (using SERIAL_CONSOLES)"
 HOMEPAGE = "https://www.freedesktop.org/wiki/Software/systemd/"
 LICENSE = "GPL-2.0-or-later"
 LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/GPL-2.0-only;md5=801f80980d171dd6425610833a22dbe6"
 
-
-SERIAL_CONSOLES ?= "115200;ttyS0"
-SERIAL_TERM ?= "linux"
-
-SRC_URI = "file://serial-getty@.service"
-
-S = "${WORKDIR}"
+# Note that this recipe explicitly creates a serial-getty@ service for every tty
+# in SERIAL_CONSOLES. This is typically not always needed with systemd as it
+# will probe at boot and generate getty instances for any active consoles as
+# required.  This recipe (enabled via disabling serial-getty-generator in systemd)
+# should only be used if the generator is not appropriate.
 
 # As this package is tied to systemd, only build it when we're also building systemd.
 inherit features_check
@@ -19,11 +17,7 @@ REQUIRED_DISTRO_FEATURES += "usrmerge"
 do_install() {
         if [ ! -z "${SERIAL_CONSOLES}" ] ; then
                 default_baudrate=`echo "${SERIAL_CONSOLES}" | sed 's/\;.*//'`
-                install -d ${D}${systemd_system_unitdir}/
                 install -d ${D}${sysconfdir}/systemd/system/getty.target.wants/
-                install -m 0644 ${WORKDIR}/serial-getty@.service ${D}${systemd_system_unitdir}/
-                sed -i -e "s/\@BAUDRATE\@/$default_baudrate/g" ${D}${systemd_system_unitdir}/serial-getty@.service
-                sed -i -e "s/\@TERM\@/${SERIAL_TERM}/g" ${D}${systemd_system_unitdir}/serial-getty@.service
 
                 tmp="${SERIAL_CONSOLES}"
                 for entry in $tmp ; do
@@ -35,7 +29,7 @@ do_install() {
                                         ${D}${sysconfdir}/systemd/system/getty.target.wants/serial-getty@$ttydev.service
                         else
                                 # install custom service file for the non-default baudrate
-                                install -m 0644 ${WORKDIR}/serial-getty@.service ${D}${systemd_system_unitdir}/serial-getty$baudrate@.service
+                                install -m 0644 ${S}/serial-getty@.service ${D}${systemd_system_unitdir}/serial-getty$baudrate@.service
                                 sed -i -e "s/\@BAUDRATE\@/$baudrate/g" ${D}${systemd_system_unitdir}/serial-getty$baudrate@.service
                                 # enable the service
                                 ln -sf ${systemd_system_unitdir}/serial-getty$baudrate@.service \
@@ -46,7 +40,7 @@ do_install() {
 }
 
 # This is a machine specific file
-FILES:${PN} = "${systemd_system_unitdir}/*.service ${sysconfdir}"
 PACKAGE_ARCH = "${MACHINE_ARCH}"
+FILES:${PN} = "${sysconfdir}"
 
 ALLOW_EMPTY:${PN} = "1"
diff --git a/meta/recipes-core/systemd/systemd-serialgetty/serial-getty@.service b/meta/recipes-core/systemd/systemd-serialgetty/serial-getty@.service
deleted file mode 100644
index b16fe1188e..0000000000
--- a/meta/recipes-core/systemd/systemd-serialgetty/serial-getty@.service
+++ /dev/null
@@ -1,45 +0,0 @@
-#  SPDX-License-Identifier: LGPL-2.1+
-#
-#  This file is part of systemd.
-#
-#  systemd is free software; you can redistribute it and/or modify it
-#  under the terms of the GNU Lesser General Public License as published by
-#  the Free Software Foundation; either version 2.1 of the License, or
-#  (at your option) any later version.
-
-[Unit]
-Description=Serial Getty on %I
-Documentation=man:agetty(8) man:systemd-getty-generator(8)
-Documentation=http://0pointer.de/blog/projects/serial-console.html
-PartOf=dev-%i.device
-ConditionPathExists=/dev/%i
-After=dev-%i.device systemd-user-sessions.service plymouth-quit-wait.service getty-pre.target
-After=rc-local.service
-
-# If additional gettys are spawned during boot then we should make
-# sure that this is synchronized before getty.target, even though
-# getty.target didn't actually pull it in.
-Before=getty.target
-IgnoreOnIsolate=yes
-
-# IgnoreOnIsolate causes issues with sulogin, if someone isolates
-# rescue.target or starts rescue.service from multi-user.target or
-# graphical.target.
-Conflicts=rescue.service
-Before=rescue.service
-
-[Service]
-Environment="TERM=@TERM@"
-ExecStart=-/sbin/agetty -8 -L %I @BAUDRATE@ $TERM
-Type=idle
-Restart=always
-UtmpIdentifier=%I
-TTYPath=/dev/%I
-TTYReset=yes
-TTYVHangup=yes
-KillMode=process
-IgnoreSIGPIPE=no
-SendSIGHUP=yes
-
-[Install]
-WantedBy=getty.target
diff --git a/meta/recipes-core/systemd/systemd-systemctl-native.bb b/meta/recipes-core/systemd/systemd-systemctl-native.bb
deleted file mode 100644
index 54283bcba1..0000000000
--- a/meta/recipes-core/systemd/systemd-systemctl-native.bb
+++ /dev/null
@@ -1,16 +0,0 @@
-SUMMARY = "Wrapper for enabling systemd services"
-
-LICENSE = "MIT"
-LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
-
-
-inherit native
-
-SRC_URI = "file://systemctl"
-
-S = "${WORKDIR}"
-
-do_install() {
-        install -d ${D}${bindir}
-        install -m 0755 ${WORKDIR}/systemctl ${D}${bindir}
-}
diff --git a/meta/recipes-core/systemd/systemd-systemctl-native_257.6.bb b/meta/recipes-core/systemd/systemd-systemctl-native_257.6.bb
new file mode 100644
index 0000000000..041a040a26
--- /dev/null
+++ b/meta/recipes-core/systemd/systemd-systemctl-native_257.6.bb
@@ -0,0 +1,16 @@
+SUMMARY = "Systemctl executable from systemd"
+
+require systemd.inc
+
+DEPENDS = "gperf-native libcap-native util-linux-native python3-jinja2-native"
+
+inherit pkgconfig meson native
+
+MESON_TARGET = "systemctl:executable"
+MESON_INSTALL_TAGS = "systemctl"
+EXTRA_OEMESON += "-Dlink-systemctl-shared=false"
+
+# Systemctl is supposed to operate on target, but the target sysroot is not
+# determined at run-time, but rather set during configure
+# More details are here https://github.com/systemd/systemd/issues/35897#issuecomment-2665405887
+EXTRA_OEMESON += "--sysconfdir ${sysconfdir_native}"
diff --git a/meta/recipes-core/systemd/systemd-systemctl/systemctl b/meta/recipes-core/systemd/systemd-systemctl/systemctl
deleted file mode 100755
index 2229bc7b6d..0000000000
--- a/meta/recipes-core/systemd/systemd-systemctl/systemctl
+++ /dev/null
@@ -1,362 +0,0 @@
-#!/usr/bin/env python3
-"""systemctl: subset of systemctl used for image construction
-
-Mask/preset systemd units
-"""
-
-import argparse
-import fnmatch
-import os
-import re
-import sys
-
-from collections import namedtuple
-from itertools import chain
-from pathlib import Path
-
-version = 1.0
-
-ROOT = Path("/")
-SYSCONFDIR = Path("etc")
-BASE_LIBDIR = Path("lib")
-LIBDIR = Path("usr", "lib")
-
-locations = list()
-
-
-class SystemdFile():
-    """Class representing a single systemd configuration file"""
-
-    _clearable_keys = ['WantedBy']
-
-    def __init__(self, root, path, instance_unit_name):
-        self.sections = dict()
-        self._parse(root, path)
-        dirname = os.path.basename(path.name) + ".d"
-        for location in locations:
-            files = (root / location / "system" / dirname).glob("*.conf")
-            if instance_unit_name:
-                inst_dirname = instance_unit_name + ".d"
-                files = chain(files, (root / location / "system" / inst_dirname).glob("*.conf"))
-            for path2 in sorted(files):
-                self._parse(root, path2)
-
-    def _parse(self, root, path):
-        """Parse a systemd syntax configuration file
-
-        Args:
-            path: A pathlib.Path object pointing to the file
-
-        """
-        skip_re = re.compile(r"^\s*([#;]|$)")
-        section_re = re.compile(r"^\s*\[(?P<section>.*)\]")
-        kv_re = re.compile(r"^\s*(?P<key>[^\s]+)\s*=\s*(?P<value>.*)")
-        section = None
-
-        if path.is_symlink():
-            try:
-                path.resolve()
-            except FileNotFoundError:
-                # broken symlink, try relative to root
-                path = root / Path(os.readlink(str(path))).relative_to(ROOT)
-
-        with path.open() as f:
-            for line in f:
-                if skip_re.match(line):
-                    continue
-
-                line = line.strip()
-                m = section_re.match(line)
-                if m:
-                    if m.group('section') not in self.sections:
-                        section = dict()
-                        self.sections[m.group('section')] = section
-                    else:
-                        section = self.sections[m.group('section')]
-                    continue
-
-                while line.endswith("\\"):
-                    line += f.readline().rstrip("\n")
-
-                m = kv_re.match(line)
-                k = m.group('key')
-                v = m.group('value')
-                if k not in section:
-                    section[k] = list()
-
-                # If we come across a "key=" line for a "clearable key", then
-                # forget all preceding assignments. This works because we are
-                # processing files in correct parse order.
-                if k in self._clearable_keys and not v:
-                    del section[k]
-                    continue
-
-                section[k].extend(v.split())
-
-    def get(self, section, prop):
-        """Get a property from section
-
-        Args:
-            section: Section to retrieve property from
-            prop: Property to retrieve
-
-        Returns:
-            List representing all properties of type prop in section.
-
-        Raises:
-            KeyError: if ``section`` or ``prop`` not found
-        """
-        return self.sections[section][prop]
-
-
-class Presets():
-    """Class representing all systemd presets"""
-    def __init__(self, scope, root):
-        self.directives = list()
-        self._collect_presets(scope, root)
-
-    def _parse_presets(self, presets):
-        """Parse presets out of a set of preset files"""
-        skip_re = re.compile(r"^\s*([#;]|$)")
-        directive_re = re.compile(r"^\s*(?P<action>enable|disable)\s+(?P<unit_name>(.+))")
-
-        Directive = namedtuple("Directive", "action unit_name")
-        for preset in presets:
-            with preset.open() as f:
-                for line in f:
-                    m = directive_re.match(line)
-                    if m:
-                        directive = Directive(action=m.group('action'),
-                                              unit_name=m.group('unit_name'))
-                        self.directives.append(directive)
-                    elif skip_re.match(line):
-                        pass
-                    else:
-                        sys.exit("Unparsed preset line in {}".format(preset))
-
-    def _collect_presets(self, scope, root):
-        """Collect list of preset files"""
-        presets = dict()
-        for location in locations:
-            paths = (root / location / scope).glob("*.preset")
-            for path in paths:
-                # earlier names override later ones
-                if path.name not in presets:
-                    presets[path.name] = path
-
-        self._parse_presets([v for k, v in sorted(presets.items())])
-
-    def state(self, unit_name):
-        """Return state of preset for unit_name
-
-        Args:
-            presets: set of presets
-            unit_name: name of the unit
-
-        Returns:
-            None: no matching preset
-            `enable`: unit_name is enabled
-            `disable`: unit_name is disabled
-        """
-        for directive in self.directives:
-            if fnmatch.fnmatch(unit_name, directive.unit_name):
-                return directive.action
-
-        return None
-
-
-def add_link(path, target):
-    try:
-        path.parent.mkdir(parents=True)
-    except FileExistsError:
-        pass
-    if not path.is_symlink():
-        print("ln -s {} {}".format(target, path))
-        path.symlink_to(target)
-
-
-class SystemdUnitNotFoundError(Exception):
-    def __init__(self, path, unit):
-        self.path = path
-        self.unit = unit
-
-
-class SystemdUnit():
-    def __init__(self, root, unit):
-        self.root = root
-        self.unit = unit
-        self.config = None
-
-    def _path_for_unit(self, unit):
-        for location in locations:
-            path = self.root / location / "system" / unit
-            if path.exists() or path.is_symlink():
-                return path
-
-        raise SystemdUnitNotFoundError(self.root, unit)
-
-    def _process_deps(self, config, service, location, prop, dirstem, instance):
-        systemdir = self.root / SYSCONFDIR / "systemd" / "system"
-
-        target = ROOT / location.relative_to(self.root)
-        try:
-            for dependent in config.get('Install', prop):
-                # expand any %i to instance (ignoring escape sequence %%)
-                dependent = re.sub("([^%](%%)*)%i", "\\g<1>{}".format(instance), dependent)
-                wants = systemdir / "{}.{}".format(dependent, dirstem) / service
-                add_link(wants, target)
-
-        except KeyError:
-            pass
-
-    def enable(self, units_enabled=[]):
-        # if we're enabling an instance, first extract the actual instance
-        # then figure out what the template unit is
-        template = re.match(r"[^@]+@(?P<instance>[^\.]*)\.", self.unit)
-        instance_unit_name = None
-        if template:
-            instance = template.group('instance')
-            if instance != "":
-                instance_unit_name = self.unit
-            unit = re.sub(r"@[^\.]*\.", "@.", self.unit, 1)
-        else:
-            instance = None
-            unit = self.unit
-
-        path = self._path_for_unit(unit)
-
-        if path.is_symlink():
-            # ignore aliases
-            return
-
-        config = SystemdFile(self.root, path, instance_unit_name)
-        if instance == "":
-            try:
-                default_instance = config.get('Install', 'DefaultInstance')[0]
-            except KeyError:
-                # no default instance, so nothing to enable
-                return
-
-            service = self.unit.replace("@.",
-                                        "@{}.".format(default_instance))
-        else:
-            service = self.unit
-
-        self._process_deps(config, service, path, 'WantedBy', 'wants', instance)
-        self._process_deps(config, service, path, 'RequiredBy', 'requires', instance)
-
-        try:
-            for also in config.get('Install', 'Also'):
-                try:
-                     units_enabled.append(unit)
-                     if also not in units_enabled:
-                        SystemdUnit(self.root, also).enable(units_enabled)
-                except SystemdUnitNotFoundError as e:
-                    sys.exit("Error: Systemctl also enable issue with  %s (%s)" % (service, e.unit))
-
-        except KeyError:
-            pass
-
-        systemdir = self.root / SYSCONFDIR / "systemd" / "system"
-        target = ROOT / path.relative_to(self.root)
-        try:
-            for dest in config.get('Install', 'Alias'):
-                alias = systemdir / dest
-                add_link(alias, target)
-
-        except KeyError:
-            pass
-
-    def mask(self):
-        systemdir = self.root / SYSCONFDIR / "systemd" / "system"
-        add_link(systemdir / self.unit, "/dev/null")
-
-
-def collect_services(root):
-    """Collect list of service files"""
-    services = set()
-    for location in locations:
-        paths = (root / location / "system").glob("*")
-        for path in paths:
-            if path.is_dir():
-                continue
-            services.add(path.name)
-
-    return services
-
-
-def preset_all(root):
-    presets = Presets('system-preset', root)
-    services = collect_services(root)
-
-    for service in services:
-        state = presets.state(service)
-
-        if state == "enable" or state is None:
-            try:
-                SystemdUnit(root, service).enable()
-            except SystemdUnitNotFoundError:
-                sys.exit("Error: Systemctl preset_all issue in %s" % service)
-
-    # If we populate the systemd links we also create /etc/machine-id, which
-    # allows systemd to boot with the filesystem read-only before generating
-    # a real value and then committing it back.
-    #
-    # For the stateless configuration, where /etc is generated at runtime
-    # (for example on a tmpfs), this script shouldn't run at all and we
-    # allow systemd to completely populate /etc.
-    (root / SYSCONFDIR / "machine-id").touch()
-
-
-def main():
-    if sys.version_info < (3, 4, 0):
-        sys.exit("Python 3.4 or greater is required")
-
-    parser = argparse.ArgumentParser()
-    parser.add_argument('command', nargs='?', choices=['enable', 'mask',
-                                                     'preset-all'])
-    parser.add_argument('service', nargs=argparse.REMAINDER)
-    parser.add_argument('--root')
-    parser.add_argument('--preset-mode',
-                        choices=['full', 'enable-only', 'disable-only'],
-                        default='full')
-
-    args = parser.parse_args()
-
-    root = Path(args.root) if args.root else ROOT
-
-    locations.append(SYSCONFDIR / "systemd")
-    # Handle the usrmerge case by ignoring /lib when it's a symlink
-    if not (root / BASE_LIBDIR).is_symlink():
-        locations.append(BASE_LIBDIR / "systemd")
-    locations.append(LIBDIR / "systemd")
-
-    command = args.command
-    if not command:
-        parser.print_help()
-        return 0
-
-    if command == "mask":
-        for service in args.service:
-            try:
-                SystemdUnit(root, service).mask()
-            except SystemdUnitNotFoundError as e:
-                sys.exit("Error: Systemctl main mask issue in %s (%s)" % (service, e.unit))
-    elif command == "enable":
-        for service in args.service:
-            try:
-                SystemdUnit(root, service).enable()
-            except SystemdUnitNotFoundError as e:
-                sys.exit("Error: Systemctl main enable issue in %s (%s)" % (service, e.unit))
-    elif command == "preset-all":
-        if len(args.service) != 0:
-            sys.exit("Too many arguments.")
-        if args.preset_mode != "enable-only":
-            sys.exit("Only enable-only is supported as preset-mode.")
-        preset_all(root)
-    else:
-        raise RuntimeError()
-
-
-if __name__ == '__main__':
-    main()
diff --git a/meta/recipes-core/systemd/systemd.inc b/meta/recipes-core/systemd/systemd.inc
index a35db5091e..101457140f 100644
--- a/meta/recipes-core/systemd/systemd.inc
+++ b/meta/recipes-core/systemd/systemd.inc
@@ -15,8 +15,8 @@ LICENSE:libsystemd = "LGPL-2.1-or-later"
 LIC_FILES_CHKSUM = "file://LICENSE.GPL2;md5=751419260aa954499f7abaabaa882bbe \
                     file://LICENSE.LGPL2.1;md5=4fbd65380cdd255951079008b364516c"
 
-SRCREV = "387a14a7b67b8b76adaed4175e14bb7e39b2f738"
-SRCBRANCH = "v255-stable"
-SRC_URI = "git://github.com/systemd/systemd-stable.git;protocol=https;branch=${SRCBRANCH}"
+SRCREV = "00a12c234e2506f5cab683460199575f13c454db"
+SRCBRANCH = "v257-stable"
+SRC_URI = "git://github.com/systemd/systemd.git;protocol=https;branch=${SRCBRANCH};tag=v${PV}"
 
-S = "${WORKDIR}/git"
+CVE_PRODUCT = "systemd"
diff --git a/meta/recipes-core/systemd/systemd/00-create-volatile.conf b/meta/recipes-core/systemd/systemd/00-create-volatile.conf
index c4277221a2..1092bda010 100644
--- a/meta/recipes-core/systemd/systemd/00-create-volatile.conf
+++ b/meta/recipes-core/systemd/systemd/00-create-volatile.conf
@@ -1,8 +1,9 @@
-#This goes hand-in-hand with the base-files of OE-Core. The file must
-# be sorted before 'systemd.conf' becuase this attempts to create a file
+# This goes hand-in-hand with the base-files of OE-Core. The file must
+# be sorted before 'systemd.conf' because this attempts to create a file
 # inside /var/log.
 
 
 d               /run/lock               1777    -       -       -
 d               /var/volatile/log               -       -       -       -
 d               /var/volatile/tmp               1777    -       -
+L               /var/tmp                -       -       -       -       /var/volatile/tmp
diff --git a/meta/recipes-core/systemd/systemd/0001-Do-not-create-var-log-README.patch b/meta/recipes-core/systemd/systemd/0001-Do-not-create-var-log-README.patch
new file mode 100644
index 0000000000..850e356b2f
--- /dev/null
+++ b/meta/recipes-core/systemd/systemd/0001-Do-not-create-var-log-README.patch
@@ -0,0 +1,30 @@
+From 425ad51e727058b48dd4580fd6afe7e51e96a28a Mon Sep 17 00:00:00 2001
+From: Peter Kjellerstedt <pkj@axis.com>
+Date: Tue, 21 Jan 2025 05:02:00 +0100
+Subject: [PATCH] Do not create /var/log/README
+
+/var/log/README is a link to /usr/share/doc/systemd/README.logs. The
+latter is packaged in systemd-doc and likely not installed, which leaves
+/var/log/README as a dead link. Since /var/log/README is not very
+useful, just remove it.
+
+Upstream-Status: Inappropriate [OE specific]
+Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
+---
+ tmpfiles.d/legacy.conf.in | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/tmpfiles.d/legacy.conf.in b/tmpfiles.d/legacy.conf.in
+index b475500e58..650c91a8da 100644
+--- a/tmpfiles.d/legacy.conf.in
++++ b/tmpfiles.d/legacy.conf.in
+@@ -13,9 +13,6 @@
+ 
+ d /run/lock 0755 root root -
+ L /var/lock - - - - ../run/lock
+-{% if CREATE_LOG_DIRS %}
+-L$ /var/log/README - - - - ../..{{DOC_DIR}}/README.logs
+-{% endif %}
+ 
+ {% if HAVE_SYSV_COMPAT %}
+ # /run/lock/subsys is used for serializing SysV service execution, and
diff --git a/meta/recipes-core/systemd/systemd/0002-binfmt-Don-t-install-dependency-links-at-install-tim.patch b/meta/recipes-core/systemd/systemd/0001-binfmt-Don-t-install-dependency-links-at-install-tim.patch
index be231cf6b2..5101f9227e 100644
--- a/meta/recipes-core/systemd/systemd/0002-binfmt-Don-t-install-dependency-links-at-install-tim.patch
+++ b/meta/recipes-core/systemd/systemd/0001-binfmt-Don-t-install-dependency-links-at-install-tim.patch
@@ -1,7 +1,7 @@
-From 29a58009a172e369ad7166e16dab2f4945c6b0d2 Mon Sep 17 00:00:00 2001
+From e5fd143f215f072404c544f694cb026a4231503e Mon Sep 17 00:00:00 2001
 From: Chen Qi <Qi.Chen@windriver.com>
 Date: Thu, 21 Feb 2019 16:23:24 +0800
-Subject: [PATCH 1/2] binfmt: Don't install dependency links at install time
+Subject: [PATCH 01/26] binfmt: Don't install dependency links at install time
  for the binfmt services
 
 use [Install] blocks so that they get created when the service is enabled
@@ -25,10 +25,10 @@ Signed-off-by: Scott Murray <scott.murray@konsulko.com>
  3 files changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/units/meson.build b/units/meson.build
-index e7bfb7f838..1d5ec4b178 100644
+index 96f4852741..0a3a4fee67 100644
 --- a/units/meson.build
 +++ b/units/meson.build
-@@ -154,7 +154,6 @@ units = [
+@@ -156,7 +156,6 @@ units = [
          {
            'file' : 'proc-sys-fs-binfmt_misc.automount',
            'conditions' : ['ENABLE_BINFMT'],
@@ -36,7 +36,7 @@ index e7bfb7f838..1d5ec4b178 100644
          },
          {
            'file' : 'proc-sys-fs-binfmt_misc.mount',
-@@ -251,7 +250,6 @@ units = [
+@@ -258,7 +257,6 @@ units = [
          {
            'file' : 'systemd-binfmt.service.in',
            'conditions' : ['ENABLE_BINFMT'],
@@ -45,7 +45,7 @@ index e7bfb7f838..1d5ec4b178 100644
          {
            'file' : 'systemd-bless-boot.service.in',
 diff --git a/units/proc-sys-fs-binfmt_misc.automount b/units/proc-sys-fs-binfmt_misc.automount
-index 5d212015a5..6c2900ca77 100644
+index 7ec21e76c9..fee4d1345f 100644
 --- a/units/proc-sys-fs-binfmt_misc.automount
 +++ b/units/proc-sys-fs-binfmt_misc.automount
 @@ -22,3 +22,6 @@ Before=shutdown.target
@@ -56,11 +56,11 @@ index 5d212015a5..6c2900ca77 100644
 +[Install]
 +WantedBy=sysinit.target
 diff --git a/units/systemd-binfmt.service.in b/units/systemd-binfmt.service.in
-index 6861c76674..531e9fbd90 100644
+index 318bf8efc2..6ef684861d 100644
 --- a/units/systemd-binfmt.service.in
 +++ b/units/systemd-binfmt.service.in
 @@ -14,6 +14,7 @@ Documentation=https://docs.kernel.org/admin-guide/binfmt-misc.html
- Documentation=https://www.freedesktop.org/wiki/Software/systemd/APIFileSystems
+ Documentation=https://systemd.io/API_FILE_SYSTEMS
  DefaultDependencies=no
  Conflicts=shutdown.target
 +Wants=proc-sys-fs-binfmt_misc.automount
diff --git a/meta/recipes-core/systemd/systemd/0008-implment-systemd-sysv-install-for-OE.patch b/meta/recipes-core/systemd/systemd/0002-implment-systemd-sysv-install-for-OE.patch
index acff18dc43..d8bb572261 100644
--- a/meta/recipes-core/systemd/systemd/0008-implment-systemd-sysv-install-for-OE.patch
+++ b/meta/recipes-core/systemd/systemd/0002-implment-systemd-sysv-install-for-OE.patch
@@ -1,7 +1,7 @@
-From 5712d56f1cd654d2e5d2e9117ff77fe4c299f76b Mon Sep 17 00:00:00 2001
+From fab8c573d06340868f070446118673b1c23584c5 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Sat, 5 Sep 2015 06:31:47 +0000
-Subject: [PATCH] implment systemd-sysv-install for OE
+Subject: [PATCH 02/26] implment systemd-sysv-install for OE
 
 Use update-rc.d for enabling/disabling and status command
 to check the status of the sysv service
@@ -39,5 +39,5 @@ index cb58d8243b..000bdf6165 100755
      *)
          usage ;;
 -- 
-2.39.2
+2.34.1
 
diff --git a/meta/recipes-core/systemd/systemd/0001-missing_type.h-add-comparison_fn_t.patch b/meta/recipes-core/systemd/systemd/0003-missing_type.h-add-comparison_fn_t.patch
index 2aa5dee6b5..f2094eb71d 100644
--- a/meta/recipes-core/systemd/systemd/0001-missing_type.h-add-comparison_fn_t.patch
+++ b/meta/recipes-core/systemd/systemd/0003-missing_type.h-add-comparison_fn_t.patch
@@ -1,7 +1,7 @@
-From 01195eb9f7d59139fb45df506ac6b3968c14a57f Mon Sep 17 00:00:00 2001
+From f99ef6c4407b56e8d15455fe27eb732ada87215b Mon Sep 17 00:00:00 2001
 From: Chen Qi <Qi.Chen@windriver.com>
 Date: Mon, 25 Feb 2019 13:55:12 +0800
-Subject: [PATCH 01/22] missing_type.h: add comparison_fn_t
+Subject: [PATCH 03/26] missing_type.h: add comparison_fn_t
 
 Make it work with musl where comparison_fn_t and is not provided.
 
@@ -21,12 +21,12 @@ Signed-off-by: Jiaqing Zhao <jiaqing.zhao@linux.intel.com>
  3 files changed, 6 insertions(+)
 
 diff --git a/src/basic/missing_type.h b/src/basic/missing_type.h
-index f6233090a9..6c0456349d 100644
+index 1d17705c35..fc33b76ec1 100644
 --- a/src/basic/missing_type.h
 +++ b/src/basic/missing_type.h
 @@ -10,3 +10,7 @@
  #if !HAVE_CHAR16_T
- #define char16_t uint16_t
+ #  define char16_t uint16_t
  #endif
 +
 +#ifndef __GLIBC__
@@ -45,10 +45,10 @@ index 9c818bd747..ef10c8be2c 100644
  /* This is the same as glibc's internal __compar_d_fn_t type. glibc exports a public comparison_fn_t, for the
   * external type __compar_fn_t, but doesn't do anything similar for __compar_d_fn_t. Let's hence do that
 diff --git a/src/libsystemd/sd-journal/catalog.c b/src/libsystemd/sd-journal/catalog.c
-index ae91534198..7f67eea38b 100644
+index 7dcc35d8d5..87b8d6aad6 100644
 --- a/src/libsystemd/sd-journal/catalog.c
 +++ b/src/libsystemd/sd-journal/catalog.c
-@@ -28,6 +28,7 @@
+@@ -29,6 +29,7 @@
  #include "string-util.h"
  #include "strv.h"
  #include "tmpfile-util.h"
diff --git a/meta/recipes-core/systemd/systemd/0003-src-basic-missing.h-check-for-missing-strndupa.patch b/meta/recipes-core/systemd/systemd/0003-src-basic-missing.h-check-for-missing-strndupa.patch
deleted file mode 100644
index 5595b5bc23..0000000000
--- a/meta/recipes-core/systemd/systemd/0003-src-basic-missing.h-check-for-missing-strndupa.patch
+++ /dev/null
@@ -1,699 +0,0 @@
-From 87f1d38f40c5fe9cadf2b2de442473e4e5605788 Mon Sep 17 00:00:00 2001
-From: Chen Qi <Qi.Chen@windriver.com>
-Date: Mon, 25 Feb 2019 14:18:21 +0800
-Subject: [PATCH 03/22] src/basic/missing.h: check for missing strndupa
-
-include missing.h  for definition of strndupa
-
-Upstream-Status: Inappropriate [musl specific]
-
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
-[Rebased for v242]
-Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
-[rebased for systemd 243]
-Signed-off-by: Scott Murray <scott.murray@konsulko.com>
-Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
-[rebased for systemd 244]
-[Rebased for v247]
-Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com>
-[Rebased for v254]
-Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
-[Rebased for v255.1]
----
- meson.build                                |  1 +
- src/backlight/backlight.c                  |  1 +
- src/basic/cgroup-util.c                    |  1 +
- src/basic/env-util.c                       |  1 +
- src/basic/log.c                            |  1 +
- src/basic/missing_stdlib.h                 | 12 ++++++++++++
- src/basic/mkdir.c                          |  1 +
- src/basic/mountpoint-util.c                |  1 +
- src/basic/parse-util.c                     |  1 +
- src/basic/path-lookup.c                    |  1 +
- src/basic/percent-util.c                   |  1 +
- src/basic/proc-cmdline.c                   |  1 +
- src/basic/procfs-util.c                    |  1 +
- src/basic/time-util.c                      |  1 +
- src/boot/bless-boot.c                      |  1 +
- src/core/dbus-cgroup.c                     |  1 +
- src/core/dbus-execute.c                    |  1 +
- src/core/dbus-util.c                       |  1 +
- src/core/execute.c                         |  1 +
- src/core/kmod-setup.c                      |  1 +
- src/core/service.c                         |  1 +
- src/coredump/coredump-vacuum.c             |  1 +
- src/fstab-generator/fstab-generator.c      |  1 +
- src/journal-remote/journal-remote-main.c   |  1 +
- src/journal/journalctl.c                   |  1 +
- src/libsystemd/sd-bus/bus-message.c        |  1 +
- src/libsystemd/sd-bus/bus-objects.c        |  1 +
- src/libsystemd/sd-bus/bus-socket.c         |  1 +
- src/libsystemd/sd-bus/sd-bus.c             |  1 +
- src/libsystemd/sd-bus/test-bus-benchmark.c |  1 +
- src/libsystemd/sd-journal/sd-journal.c     |  1 +
- src/login/pam_systemd.c                    |  1 +
- src/network/generator/network-generator.c  |  1 +
- src/nspawn/nspawn-settings.c               |  1 +
- src/nss-mymachines/nss-mymachines.c        |  1 +
- src/portable/portable.c                    |  1 +
- src/resolve/resolvectl.c                   |  1 +
- src/shared/bus-get-properties.c            |  1 +
- src/shared/bus-unit-procs.c                |  1 +
- src/shared/bus-unit-util.c                 |  1 +
- src/shared/bus-util.c                      |  1 +
- src/shared/dns-domain.c                    |  1 +
- src/shared/journal-importer.c              |  1 +
- src/shared/logs-show.c                     |  1 +
- src/shared/pager.c                         |  1 +
- src/socket-proxy/socket-proxyd.c           |  1 +
- src/test/test-hexdecoct.c                  |  1 +
- src/udev/udev-builtin-net_id.c             |  1 +
- src/udev/udev-builtin-path_id.c            |  1 +
- src/udev/udev-event.c                      |  1 +
- src/udev/udev-rules.c                      |  1 +
- 51 files changed, 62 insertions(+)
-
-diff --git a/meson.build b/meson.build
-index 01fd3ffc19..61a872b753 100644
---- a/meson.build
-+++ b/meson.build
-@@ -567,6 +567,7 @@ foreach ident : ['secure_getenv', '__secure_getenv']
- endforeach
- 
- foreach ident : [
-+        ['strndupa' ,         '''#include <string.h>'''],
-         ['memfd_create',      '''#include <sys/mman.h>'''],
-         ['gettid',            '''#include <sys/types.h>
-                                  #include <unistd.h>'''],
-diff --git a/src/backlight/backlight.c b/src/backlight/backlight.c
-index 5ac9f904a9..99d5122dd7 100644
---- a/src/backlight/backlight.c
-+++ b/src/backlight/backlight.c
-@@ -20,6 +20,7 @@
- #include "string-util.h"
- #include "strv.h"
- #include "terminal-util.h"
-+#include "missing_stdlib.h"
- 
- #define PCI_CLASS_GRAPHICS_CARD 0x30000
- 
-diff --git a/src/basic/cgroup-util.c b/src/basic/cgroup-util.c
-index 18b16ecc0e..d2be79622f 100644
---- a/src/basic/cgroup-util.c
-+++ b/src/basic/cgroup-util.c
-@@ -38,6 +38,7 @@
- #include "unit-name.h"
- #include "user-util.h"
- #include "xattr-util.h"
-+#include "missing_stdlib.h"
- 
- static int cg_enumerate_items(const char *controller, const char *path, FILE **ret, const char *item) {
-         _cleanup_free_ char *fs = NULL;
-diff --git a/src/basic/env-util.c b/src/basic/env-util.c
-index d3bf73385f..16b17358ca 100644
---- a/src/basic/env-util.c
-+++ b/src/basic/env-util.c
-@@ -19,6 +19,7 @@
- #include "string-util.h"
- #include "strv.h"
- #include "utf8.h"
-+#include "missing_stdlib.h"
- 
- /* We follow bash for the character set. Different shells have different rules. */
- #define VALID_BASH_ENV_NAME_CHARS               \
-diff --git a/src/basic/log.c b/src/basic/log.c
-index 1470611a75..9924ec2b9a 100644
---- a/src/basic/log.c
-+++ b/src/basic/log.c
-@@ -40,6 +40,7 @@
- #include "terminal-util.h"
- #include "time-util.h"
- #include "utf8.h"
-+#include "missing_stdlib.h"
- 
- #define SNDBUF_SIZE (8*1024*1024)
- #define IOVEC_MAX 256U
-diff --git a/src/basic/missing_stdlib.h b/src/basic/missing_stdlib.h
-index 8c76f93eb2..9068bfb4f0 100644
---- a/src/basic/missing_stdlib.h
-+++ b/src/basic/missing_stdlib.h
-@@ -11,3 +11,15 @@
- #    error "neither secure_getenv nor __secure_getenv are available"
- #  endif
- #endif
-+
-+/* string.h */
-+#if ! HAVE_STRNDUPA
-+#define strndupa(s, n) \
-+  ({ \
-+    const char *__old = (s); \
-+    size_t __len = strnlen(__old, (n)); \
-+    char *__new = (char *)alloca(__len + 1); \
-+    __new[__len] = '\0'; \
-+    (char *)memcpy(__new, __old, __len); \
-+  })
-+#endif
-diff --git a/src/basic/mkdir.c b/src/basic/mkdir.c
-index c770e5ed32..1fd8816cd0 100644
---- a/src/basic/mkdir.c
-+++ b/src/basic/mkdir.c
-@@ -16,6 +16,7 @@
- #include "stat-util.h"
- #include "stdio-util.h"
- #include "user-util.h"
-+#include "missing_stdlib.h"
- 
- int mkdirat_safe_internal(
-                 int dir_fd,
-diff --git a/src/basic/mountpoint-util.c b/src/basic/mountpoint-util.c
-index bf67f7e01a..409f8d8a73 100644
---- a/src/basic/mountpoint-util.c
-+++ b/src/basic/mountpoint-util.c
-@@ -18,6 +18,7 @@
- #include "missing_stat.h"
- #include "missing_syscall.h"
- #include "mkdir.h"
-+#include "missing_stdlib.h"
- #include "mountpoint-util.h"
- #include "nulstr-util.h"
- #include "parse-util.h"
-diff --git a/src/basic/parse-util.c b/src/basic/parse-util.c
-index 0430e33e40..f3728de026 100644
---- a/src/basic/parse-util.c
-+++ b/src/basic/parse-util.c
-@@ -18,6 +18,7 @@
- #include "stat-util.h"
- #include "string-util.h"
- #include "strv.h"
-+#include "missing_stdlib.h"
- 
- int parse_boolean(const char *v) {
-         if (!v)
-diff --git a/src/basic/path-lookup.c b/src/basic/path-lookup.c
-index 4e3d59fc56..726e240df0 100644
---- a/src/basic/path-lookup.c
-+++ b/src/basic/path-lookup.c
-@@ -16,6 +16,7 @@
- #include "strv.h"
- #include "tmpfile-util.h"
- #include "user-util.h"
-+#include "missing_stdlib.h"
- 
- int xdg_user_runtime_dir(char **ret, const char *suffix) {
-         const char *e;
-diff --git a/src/basic/percent-util.c b/src/basic/percent-util.c
-index cab9d0eaea..5f6ca258e9 100644
---- a/src/basic/percent-util.c
-+++ b/src/basic/percent-util.c
-@@ -3,6 +3,7 @@
- #include "percent-util.h"
- #include "string-util.h"
- #include "parse-util.h"
-+#include "missing_stdlib.h"
- 
- static int parse_parts_value_whole(const char *p, const char *symbol) {
-         const char *pc, *n;
-diff --git a/src/basic/proc-cmdline.c b/src/basic/proc-cmdline.c
-index 522d8de1f4..7c129dc0fc 100644
---- a/src/basic/proc-cmdline.c
-+++ b/src/basic/proc-cmdline.c
-@@ -16,6 +16,7 @@
- #include "string-util.h"
- #include "strv.h"
- #include "virt.h"
-+#include "missing_stdlib.h"
- 
- int proc_cmdline_filter_pid1_args(char **argv, char ***ret) {
-         enum {
-diff --git a/src/basic/procfs-util.c b/src/basic/procfs-util.c
-index d7cfcd9105..6cb0ddf575 100644
---- a/src/basic/procfs-util.c
-+++ b/src/basic/procfs-util.c
-@@ -12,6 +12,7 @@
- #include "procfs-util.h"
- #include "stdio-util.h"
- #include "string-util.h"
-+#include "missing_stdlib.h"
- 
- int procfs_get_pid_max(uint64_t *ret) {
-         _cleanup_free_ char *value = NULL;
-diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index f9014dc560..1d7840a5b5 100644
---- a/src/basic/time-util.c
-+++ b/src/basic/time-util.c
-@@ -27,6 +27,7 @@
- #include "string-util.h"
- #include "strv.h"
- #include "time-util.h"
-+#include "missing_stdlib.h"
- 
- static clockid_t map_clock_id(clockid_t c) {
- 
-diff --git a/src/boot/bless-boot.c b/src/boot/bless-boot.c
-index 0c0b4f23c7..68fe5ca509 100644
---- a/src/boot/bless-boot.c
-+++ b/src/boot/bless-boot.c
-@@ -22,6 +22,7 @@
- #include "terminal-util.h"
- #include "verbs.h"
- #include "virt.h"
-+#include "missing_stdlib.h"
- 
- static char **arg_path = NULL;
- 
-diff --git a/src/core/dbus-cgroup.c b/src/core/dbus-cgroup.c
-index 4237e694c0..05f9d9d9a9 100644
---- a/src/core/dbus-cgroup.c
-+++ b/src/core/dbus-cgroup.c
-@@ -25,6 +25,7 @@
- #include "parse-util.h"
- #include "path-util.h"
- #include "percent-util.h"
-+#include "missing_stdlib.h"
- #include "socket-util.h"
- 
- BUS_DEFINE_PROPERTY_GET(bus_property_get_tasks_max, "t", CGroupTasksMax, cgroup_tasks_max_resolve);
-diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c
-index 4daa1cefd3..2c77901471 100644
---- a/src/core/dbus-execute.c
-+++ b/src/core/dbus-execute.c
-@@ -42,6 +42,7 @@
- #include "unit-printf.h"
- #include "user-util.h"
- #include "utf8.h"
-+#include "missing_stdlib.h"
- 
- BUS_DEFINE_PROPERTY_GET_ENUM(bus_property_get_exec_output, exec_output, ExecOutput);
- static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_exec_input, exec_input, ExecInput);
-diff --git a/src/core/dbus-util.c b/src/core/dbus-util.c
-index d680a64268..e59f48103e 100644
---- a/src/core/dbus-util.c
-+++ b/src/core/dbus-util.c
-@@ -9,6 +9,7 @@
- #include "unit-printf.h"
- #include "user-util.h"
- #include "unit.h"
-+#include "missing_stdlib.h"
- 
- int bus_property_get_triggered_unit(
-                 sd_bus *bus,
-diff --git a/src/core/execute.c b/src/core/execute.c
-index ef0bf88687..bd3da0c401 100644
---- a/src/core/execute.c
-+++ b/src/core/execute.c
-@@ -72,6 +72,7 @@
- #include "unit-serialize.h"
- #include "user-util.h"
- #include "utmp-wtmp.h"
-+#include "missing_stdlib.h"
- 
- static bool is_terminal_input(ExecInput i) {
-         return IN_SET(i,
-diff --git a/src/core/kmod-setup.c b/src/core/kmod-setup.c
-index b8e3f7aadd..8ce8ca68d8 100644
---- a/src/core/kmod-setup.c
-+++ b/src/core/kmod-setup.c
-@@ -13,6 +13,7 @@
- #include "string-util.h"
- #include "strv.h"
- #include "virt.h"
-+#include "missing_stdlib.h"
- 
- #if HAVE_KMOD
- #include "module-util.h"
-diff --git a/src/core/service.c b/src/core/service.c
-index b9eb40c555..268fe7573b 100644
---- a/src/core/service.c
-+++ b/src/core/service.c
-@@ -45,6 +45,7 @@
- #include "unit-name.h"
- #include "unit.h"
- #include "utf8.h"
-+#include "missing_stdlib.h"
- 
- #define service_spawn(...) service_spawn_internal(__func__, __VA_ARGS__)
- 
-diff --git a/src/coredump/coredump-vacuum.c b/src/coredump/coredump-vacuum.c
-index 7e0c98cb7d..978a7f5874 100644
---- a/src/coredump/coredump-vacuum.c
-+++ b/src/coredump/coredump-vacuum.c
-@@ -17,6 +17,7 @@
- #include "string-util.h"
- #include "time-util.h"
- #include "user-util.h"
-+#include "missing_stdlib.h"
- 
- #define DEFAULT_MAX_USE_LOWER (uint64_t) (1ULL*1024ULL*1024ULL)           /* 1 MiB */
- #define DEFAULT_MAX_USE_UPPER (uint64_t) (4ULL*1024ULL*1024ULL*1024ULL)   /* 4 GiB */
-diff --git a/src/fstab-generator/fstab-generator.c b/src/fstab-generator/fstab-generator.c
-index 016f3baa7f..b1def81313 100644
---- a/src/fstab-generator/fstab-generator.c
-+++ b/src/fstab-generator/fstab-generator.c
-@@ -37,6 +37,7 @@
- #include "unit-name.h"
- #include "virt.h"
- #include "volatile-util.h"
-+#include "missing_stdlib.h"
- 
- typedef enum MountPointFlags {
-         MOUNT_NOAUTO    = 1 << 0,
-diff --git a/src/journal-remote/journal-remote-main.c b/src/journal-remote/journal-remote-main.c
-index da0f20d3ce..f22ce41908 100644
---- a/src/journal-remote/journal-remote-main.c
-+++ b/src/journal-remote/journal-remote-main.c
-@@ -27,6 +27,7 @@
- #include "stat-util.h"
- #include "string-table.h"
- #include "strv.h"
-+#include "missing_stdlib.h"
- 
- #define PRIV_KEY_FILE CERTIFICATE_ROOT "/private/journal-remote.pem"
- #define CERT_FILE     CERTIFICATE_ROOT "/certs/journal-remote.pem"
-diff --git a/src/journal/journalctl.c b/src/journal/journalctl.c
-index 7f3dcd56a4..41b7cbaaf1 100644
---- a/src/journal/journalctl.c
-+++ b/src/journal/journalctl.c
-@@ -77,6 +77,7 @@
- #include "unit-name.h"
- #include "user-util.h"
- #include "varlink.h"
-+#include "missing_stdlib.h"
- 
- #define DEFAULT_FSS_INTERVAL_USEC (15*USEC_PER_MINUTE)
- #define PROCESS_INOTIFY_INTERVAL 1024   /* Every 1,024 messages processed */
-diff --git a/src/libsystemd/sd-bus/bus-message.c b/src/libsystemd/sd-bus/bus-message.c
-index ff0228081f..9066fcb133 100644
---- a/src/libsystemd/sd-bus/bus-message.c
-+++ b/src/libsystemd/sd-bus/bus-message.c
-@@ -19,6 +19,7 @@
- #include "strv.h"
- #include "time-util.h"
- #include "utf8.h"
-+#include "missing_stdlib.h"
- 
- static int message_append_basic(sd_bus_message *m, char type, const void *p, const void **stored);
- static int message_parse_fields(sd_bus_message *m);
-diff --git a/src/libsystemd/sd-bus/bus-objects.c b/src/libsystemd/sd-bus/bus-objects.c
-index c25c40ff37..57a5da704f 100644
---- a/src/libsystemd/sd-bus/bus-objects.c
-+++ b/src/libsystemd/sd-bus/bus-objects.c
-@@ -11,6 +11,7 @@
- #include "missing_capability.h"
- #include "string-util.h"
- #include "strv.h"
-+#include "missing_stdlib.h"
- 
- static int node_vtable_get_userdata(
-                 sd_bus *bus,
-diff --git a/src/libsystemd/sd-bus/bus-socket.c b/src/libsystemd/sd-bus/bus-socket.c
-index 3c59d0d615..746922d46f 100644
---- a/src/libsystemd/sd-bus/bus-socket.c
-+++ b/src/libsystemd/sd-bus/bus-socket.c
-@@ -29,6 +29,7 @@
- #include "string-util.h"
- #include "user-util.h"
- #include "utf8.h"
-+#include "missing_stdlib.h"
- 
- #define SNDBUF_SIZE (8*1024*1024)
- 
-diff --git a/src/libsystemd/sd-bus/sd-bus.c b/src/libsystemd/sd-bus/sd-bus.c
-index 4a0259f8bb..aaa90d2223 100644
---- a/src/libsystemd/sd-bus/sd-bus.c
-+++ b/src/libsystemd/sd-bus/sd-bus.c
-@@ -46,6 +46,7 @@
- #include "string-util.h"
- #include "strv.h"
- #include "user-util.h"
-+#include "missing_stdlib.h"
- 
- #define log_debug_bus_message(m)                                         \
-         do {                                                             \
-diff --git a/src/libsystemd/sd-bus/test-bus-benchmark.c b/src/libsystemd/sd-bus/test-bus-benchmark.c
-index d988588de0..458df8df9a 100644
---- a/src/libsystemd/sd-bus/test-bus-benchmark.c
-+++ b/src/libsystemd/sd-bus/test-bus-benchmark.c
-@@ -14,6 +14,7 @@
- #include "string-util.h"
- #include "tests.h"
- #include "time-util.h"
-+#include "missing_stdlib.h"
- 
- #define MAX_SIZE (2*1024*1024)
- 
-diff --git a/src/libsystemd/sd-journal/sd-journal.c b/src/libsystemd/sd-journal/sd-journal.c
-index 6b9ff0a4ed..4a5027ad0f 100644
---- a/src/libsystemd/sd-journal/sd-journal.c
-+++ b/src/libsystemd/sd-journal/sd-journal.c
-@@ -44,6 +44,7 @@
- #include "strv.h"
- #include "syslog-util.h"
- #include "uid-alloc-range.h"
-+#include "missing_stdlib.h"
- 
- #define JOURNAL_FILES_RECHECK_USEC (2 * USEC_PER_SEC)
- 
-diff --git a/src/login/pam_systemd.c b/src/login/pam_systemd.c
-index b8da266e27..4bb8dd9496 100644
---- a/src/login/pam_systemd.c
-+++ b/src/login/pam_systemd.c
-@@ -35,6 +35,7 @@
- #include "login-util.h"
- #include "macro.h"
- #include "missing_syscall.h"
-+#include "missing_stdlib.h"
- #include "pam-util.h"
- #include "parse-util.h"
- #include "path-util.h"
-diff --git a/src/network/generator/network-generator.c b/src/network/generator/network-generator.c
-index 48527a2c73..9777fe0561 100644
---- a/src/network/generator/network-generator.c
-+++ b/src/network/generator/network-generator.c
-@@ -14,6 +14,7 @@
- #include "string-table.h"
- #include "string-util.h"
- #include "strv.h"
-+#include "missing_stdlib.h"
- 
- /*
-   # .network
-diff --git a/src/nspawn/nspawn-settings.c b/src/nspawn/nspawn-settings.c
-index 161b1c1c70..ba1c459f78 100644
---- a/src/nspawn/nspawn-settings.c
-+++ b/src/nspawn/nspawn-settings.c
-@@ -16,6 +16,7 @@
- #include "string-util.h"
- #include "strv.h"
- #include "user-util.h"
-+#include "missing_stdlib.h"
- 
- Settings *settings_new(void) {
-         Settings *s;
-diff --git a/src/nss-mymachines/nss-mymachines.c b/src/nss-mymachines/nss-mymachines.c
-index c64e79bdff..eda26b0b9a 100644
---- a/src/nss-mymachines/nss-mymachines.c
-+++ b/src/nss-mymachines/nss-mymachines.c
-@@ -21,6 +21,7 @@
- #include "nss-util.h"
- #include "signal-util.h"
- #include "string-util.h"
-+#include "missing_stdlib.h"
- 
- static void setup_logging_once(void) {
-         static pthread_once_t once = PTHREAD_ONCE_INIT;
-diff --git a/src/portable/portable.c b/src/portable/portable.c
-index d4b448a627..bb26623565 100644
---- a/src/portable/portable.c
-+++ b/src/portable/portable.c
-@@ -40,6 +40,7 @@
- #include "strv.h"
- #include "tmpfile-util.h"
- #include "user-util.h"
-+#include "missing_stdlib.h"
- 
- /* Markers used in the first line of our 20-portable.conf unit file drop-in to determine, that a) the unit file was
-  * dropped there by the portable service logic and b) for which image it was dropped there. */
-diff --git a/src/resolve/resolvectl.c b/src/resolve/resolvectl.c
-index afa537f160..32ccee4ae5 100644
---- a/src/resolve/resolvectl.c
-+++ b/src/resolve/resolvectl.c
-@@ -48,6 +48,7 @@
- #include "varlink.h"
- #include "verb-log-control.h"
- #include "verbs.h"
-+#include "missing_stdlib.h"
- 
- static int arg_family = AF_UNSPEC;
- static int arg_ifindex = 0;
-diff --git a/src/shared/bus-get-properties.c b/src/shared/bus-get-properties.c
-index 53e5d6b99f..851ecd5644 100644
---- a/src/shared/bus-get-properties.c
-+++ b/src/shared/bus-get-properties.c
-@@ -4,6 +4,7 @@
- #include "rlimit-util.h"
- #include "stdio-util.h"
- #include "string-util.h"
-+#include "missing_stdlib.h"
- 
- int bus_property_get_bool(
-                 sd_bus *bus,
-diff --git a/src/shared/bus-unit-procs.c b/src/shared/bus-unit-procs.c
-index 8b462b5627..183ce1c18e 100644
---- a/src/shared/bus-unit-procs.c
-+++ b/src/shared/bus-unit-procs.c
-@@ -11,6 +11,7 @@
- #include "sort-util.h"
- #include "string-util.h"
- #include "terminal-util.h"
-+#include "missing_stdlib.h"
- 
- struct CGroupInfo {
-         char *cgroup_path;
-diff --git a/src/shared/bus-unit-util.c b/src/shared/bus-unit-util.c
-index 4ee9706847..30c8084847 100644
---- a/src/shared/bus-unit-util.c
-+++ b/src/shared/bus-unit-util.c
-@@ -50,6 +50,7 @@
- #include "unit-def.h"
- #include "user-util.h"
- #include "utf8.h"
-+#include "missing_stdlib.h"
- 
- int bus_parse_unit_info(sd_bus_message *message, UnitInfo *u) {
-         assert(message);
-diff --git a/src/shared/bus-util.c b/src/shared/bus-util.c
-index 4123152d93..74f148c8b4 100644
---- a/src/shared/bus-util.c
-+++ b/src/shared/bus-util.c
-@@ -24,6 +24,7 @@
- #include "path-util.h"
- #include "socket-util.h"
- #include "stdio-util.h"
-+#include "missing_stdlib.h"
- 
- static int name_owner_change_callback(sd_bus_message *m, void *userdata, sd_bus_error *ret_error) {
-         sd_event *e = ASSERT_PTR(userdata);
-diff --git a/src/shared/dns-domain.c b/src/shared/dns-domain.c
-index b41c9b06ca..e69050a507 100644
---- a/src/shared/dns-domain.c
-+++ b/src/shared/dns-domain.c
-@@ -18,6 +18,7 @@
- #include "string-util.h"
- #include "strv.h"
- #include "utf8.h"
-+#include "missing_stdlib.h"
- 
- int dns_label_unescape(const char **name, char *dest, size_t sz, DNSLabelFlags flags) {
-         const char *n;
-diff --git a/src/shared/journal-importer.c b/src/shared/journal-importer.c
-index 83e9834bbf..74eaae6f5e 100644
---- a/src/shared/journal-importer.c
-+++ b/src/shared/journal-importer.c
-@@ -16,6 +16,7 @@
- #include "string-util.h"
- #include "strv.h"
- #include "unaligned.h"
-+#include "missing_stdlib.h"
- 
- enum {
-         IMPORTER_STATE_LINE = 0,    /* waiting to read, or reading line */
-diff --git a/src/shared/logs-show.c b/src/shared/logs-show.c
-index a5d04003bd..10392c132d 100644
---- a/src/shared/logs-show.c
-+++ b/src/shared/logs-show.c
-@@ -41,6 +41,7 @@
- #include "time-util.h"
- #include "utf8.h"
- #include "web-util.h"
-+#include "missing_stdlib.h"
- 
- /* up to three lines (each up to 100 characters) or 300 characters, whichever is less */
- #define PRINT_LINE_THRESHOLD 3
-diff --git a/src/shared/pager.c b/src/shared/pager.c
-index 19deefab56..6b6d0af1a0 100644
---- a/src/shared/pager.c
-+++ b/src/shared/pager.c
-@@ -25,6 +25,7 @@
- #include "string-util.h"
- #include "strv.h"
- #include "terminal-util.h"
-+#include "missing_stdlib.h"
- 
- static pid_t pager_pid = 0;
- 
-diff --git a/src/socket-proxy/socket-proxyd.c b/src/socket-proxy/socket-proxyd.c
-index 287fd6c181..8f8d5493da 100644
---- a/src/socket-proxy/socket-proxyd.c
-+++ b/src/socket-proxy/socket-proxyd.c
-@@ -27,6 +27,7 @@
- #include "set.h"
- #include "socket-util.h"
- #include "string-util.h"
-+#include "missing_stdlib.h"
- 
- #define BUFFER_SIZE (256 * 1024)
- 
-diff --git a/src/test/test-hexdecoct.c b/src/test/test-hexdecoct.c
-index f884008660..987e180697 100644
---- a/src/test/test-hexdecoct.c
-+++ b/src/test/test-hexdecoct.c
-@@ -7,6 +7,7 @@
- #include "macro.h"
- #include "random-util.h"
- #include "string-util.h"
-+#include "missing_stdlib.h"
- #include "tests.h"
- 
- TEST(hexchar) {
-diff --git a/src/udev/udev-builtin-net_id.c b/src/udev/udev-builtin-net_id.c
-index 91b40088f4..f528a46b8e 100644
---- a/src/udev/udev-builtin-net_id.c
-+++ b/src/udev/udev-builtin-net_id.c
-@@ -39,6 +39,7 @@
- #include "strv.h"
- #include "strxcpyx.h"
- #include "udev-builtin.h"
-+#include "missing_stdlib.h"
- 
- #define ONBOARD_14BIT_INDEX_MAX ((1U << 14) - 1)
- #define ONBOARD_16BIT_INDEX_MAX ((1U << 16) - 1)
-diff --git a/src/udev/udev-builtin-path_id.c b/src/udev/udev-builtin-path_id.c
-index 467c9a6ad3..f74dae60af 100644
---- a/src/udev/udev-builtin-path_id.c
-+++ b/src/udev/udev-builtin-path_id.c
-@@ -24,6 +24,7 @@
- #include "sysexits.h"
- #include "udev-builtin.h"
- #include "udev-util.h"
-+#include "missing_stdlib.h"
- 
- _printf_(2,3)
- static void path_prepend(char **path, const char *fmt, ...) {
-diff --git a/src/udev/udev-event.c b/src/udev/udev-event.c
-index ed22c8b679..19ebe20237 100644
---- a/src/udev/udev-event.c
-+++ b/src/udev/udev-event.c
-@@ -16,6 +16,7 @@
- #include "udev-util.h"
- #include "udev-watch.h"
- #include "user-util.h"
-+#include "missing_stdlib.h"
- 
- UdevEvent *udev_event_new(sd_device *dev, usec_t exec_delay_usec, sd_netlink *rtnl, int log_level) {
-         UdevEvent *event;
-diff --git a/src/udev/udev-rules.c b/src/udev/udev-rules.c
-index 5f12002394..febe345b4c 100644
---- a/src/udev/udev-rules.c
-+++ b/src/udev/udev-rules.c
-@@ -41,6 +41,7 @@
- #include "udev-util.h"
- #include "user-util.h"
- #include "virt.h"
-+#include "missing_stdlib.h"
- 
- #define RULES_DIRS ((const char* const*) CONF_PATHS_STRV("udev/rules.d"))
- 
--- 
-2.34.1
-
diff --git a/meta/recipes-core/systemd/systemd/0002-add-fallback-parse_printf_format-implementation.patch b/meta/recipes-core/systemd/systemd/0004-add-fallback-parse_printf_format-implementation.patch
index 900a931632..47b8583e7a 100644
--- a/meta/recipes-core/systemd/systemd/0002-add-fallback-parse_printf_format-implementation.patch
+++ b/meta/recipes-core/systemd/systemd/0004-add-fallback-parse_printf_format-implementation.patch
@@ -1,7 +1,7 @@
-From 872b72739e62123867ce6c4f82aa37de24cc3f75 Mon Sep 17 00:00:00 2001
+From 34fe809cf686c1a81db5f3f027e33fece350ba0b Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Sat, 22 May 2021 20:26:24 +0200
-Subject: [PATCH 02/22] add fallback parse_printf_format implementation
+Subject: [PATCH 04/26] add fallback parse_printf_format implementation
 
 Upstream-Status: Inappropriate [musl specific]
 
@@ -22,22 +22,22 @@ Signed-off-by: Scott Murray <scott.murray@konsulko.com>
  create mode 100644 src/basic/parse-printf-format.h
 
 diff --git a/meson.build b/meson.build
-index 7419e2b0b0..01fd3ffc19 100644
+index bffda86845..4146f4beef 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -725,6 +725,7 @@ endif
- foreach header : ['crypt.h',
+@@ -770,6 +770,7 @@ foreach header : ['crypt.h',
+                   'linux/ioprio.h',
                    'linux/memfd.h',
-                   'linux/vm_sockets.h',
+                   'linux/time_types.h',
 +                  'printf.h',
                    'sys/auxv.h',
+                   'sys/sdt.h',
                    'threads.h',
-                   'valgrind/memcheck.h',
 diff --git a/src/basic/meson.build b/src/basic/meson.build
-index d7450d8b44..c3e3daf4bd 100644
+index e02f787c75..9435df895d 100644
 --- a/src/basic/meson.build
 +++ b/src/basic/meson.build
-@@ -183,6 +183,11 @@ endforeach
+@@ -188,6 +188,11 @@ endforeach
  
  basic_sources += generated_gperf_headers
  
@@ -392,7 +392,7 @@ index 0000000000..47be7522d7
 +
 +#endif /* HAVE_PRINTF_H */
 diff --git a/src/basic/stdio-util.h b/src/basic/stdio-util.h
-index 4e93ac90c9..f9deb6f662 100644
+index 0a2239d022..43a765dacd 100644
 --- a/src/basic/stdio-util.h
 +++ b/src/basic/stdio-util.h
 @@ -1,12 +1,12 @@
@@ -408,9 +408,9 @@ index 4e93ac90c9..f9deb6f662 100644
 +#include "parse-printf-format.h"
  
  _printf_(3, 4)
- static inline char *snprintf_ok(char *buf, size_t len, const char *format, ...) {
+ static inline char* snprintf_ok(char *buf, size_t len, const char *format, ...) {
 diff --git a/src/libsystemd/sd-journal/journal-send.c b/src/libsystemd/sd-journal/journal-send.c
-index be23b2fe75..69a2eb6404 100644
+index 7d02b57d7b..75e8e08add 100644
 --- a/src/libsystemd/sd-journal/journal-send.c
 +++ b/src/libsystemd/sd-journal/journal-send.c
 @@ -2,7 +2,6 @@
diff --git a/meta/recipes-core/systemd/systemd/0004-don-t-fail-if-GLOB_BRACE-and-GLOB_ALTDIRFUNC-is-not-.patch b/meta/recipes-core/systemd/systemd/0005-don-t-fail-if-GLOB_BRACE-and-GLOB_ALTDIRFUNC-is-not-.patch
index 15877bea88..1b5e0d54c4 100644
--- a/meta/recipes-core/systemd/systemd/0004-don-t-fail-if-GLOB_BRACE-and-GLOB_ALTDIRFUNC-is-not-.patch
+++ b/meta/recipes-core/systemd/systemd/0005-don-t-fail-if-GLOB_BRACE-and-GLOB_ALTDIRFUNC-is-not-.patch
@@ -1,7 +1,7 @@
-From 5325ab5813617f35f03806ec420829dde7104387 Mon Sep 17 00:00:00 2001
+From d368a0317c747961f69a455a09a3de3fd13410a2 Mon Sep 17 00:00:00 2001
 From: Chen Qi <Qi.Chen@windriver.com>
 Date: Mon, 25 Feb 2019 14:56:21 +0800
-Subject: [PATCH 04/22] don't fail if GLOB_BRACE and GLOB_ALTDIRFUNC is not
+Subject: [PATCH 05/26] don't fail if GLOB_BRACE and GLOB_ALTDIRFUNC is not
  defined
 
 If the standard library doesn't provide brace
@@ -64,11 +64,11 @@ index 802ca8c655..23818a67c6 100644
                  return -ENOENT;
          if (k == GLOB_NOSPACE)
 diff --git a/src/test/test-glob-util.c b/src/test/test-glob-util.c
-index 9b3e73cce0..3790ba3be5 100644
+index 49d71f15c7..0a49ebcc17 100644
 --- a/src/test/test-glob-util.c
 +++ b/src/test/test-glob-util.c
 @@ -34,6 +34,12 @@ TEST(glob_first) {
-         assert_se(first == NULL);
+         ASSERT_NULL(first);
  }
  
 +/* Don't fail if the standard library
@@ -115,7 +115,7 @@ index 9b3e73cce0..3790ba3be5 100644
  
          (void) rm_rf(template, REMOVE_ROOT|REMOVE_PHYSICAL);
 diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
-index 230ec09b97..2cc5f391d7 100644
+index 86bf16356d..da552dbaab 100644
 --- a/src/tmpfiles/tmpfiles.c
 +++ b/src/tmpfiles/tmpfiles.c
 @@ -73,6 +73,12 @@
@@ -131,7 +131,7 @@ index 230ec09b97..2cc5f391d7 100644
  /* This reads all files listed in /etc/tmpfiles.d/?*.conf and creates
   * them in the file system. This is intended to be used to create
   * properly owned directories beneath /tmp, /var/tmp, /run, which are
-@@ -2434,7 +2440,9 @@ finish:
+@@ -2573,7 +2579,9 @@ finish:
  
  static int glob_item(Context *c, Item *i, action_t action) {
          _cleanup_globfree_ glob_t g = {
@@ -139,9 +139,9 @@ index 230ec09b97..2cc5f391d7 100644
                  .gl_opendir = (void *(*)(const char *)) opendir_nomod,
 +#endif
          };
-         int r = 0, k;
+         int r;
  
-@@ -2461,7 +2469,9 @@ static int glob_item_recursively(
+@@ -2601,7 +2609,9 @@ static int glob_item_recursively(
                  fdaction_t action) {
  
          _cleanup_globfree_ glob_t g = {
@@ -149,7 +149,7 @@ index 230ec09b97..2cc5f391d7 100644
                  .gl_opendir = (void *(*)(const char *)) opendir_nomod,
 +#endif
          };
-         int r = 0, k;
+         int r;
  
 -- 
 2.34.1
diff --git a/meta/recipes-core/systemd/systemd/0005-add-missing-FTW_-macros-for-musl.patch b/meta/recipes-core/systemd/systemd/0006-add-missing-FTW_-macros-for-musl.patch
index a1dfca22cd..578411c4cf 100644
--- a/meta/recipes-core/systemd/systemd/0005-add-missing-FTW_-macros-for-musl.patch
+++ b/meta/recipes-core/systemd/systemd/0006-add-missing-FTW_-macros-for-musl.patch
@@ -1,7 +1,7 @@
-From dad7f897c0de654fa5592fda3e90f874639849f9 Mon Sep 17 00:00:00 2001
+From 54b6e10aea2b0fb52782c3a71f06654a89b46bff Mon Sep 17 00:00:00 2001
 From: Chen Qi <Qi.Chen@windriver.com>
 Date: Mon, 25 Feb 2019 15:00:06 +0800
-Subject: [PATCH 05/22] add missing FTW_ macros for musl
+Subject: [PATCH 06/26] add missing FTW_ macros for musl
 
 This is to avoid build failures like below for musl.
 
@@ -16,7 +16,7 @@ Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
  2 files changed, 5 insertions(+)
 
 diff --git a/src/basic/missing_type.h b/src/basic/missing_type.h
-index 6c0456349d..73a5b90e3c 100644
+index fc33b76ec1..34a36d83f0 100644
 --- a/src/basic/missing_type.h
 +++ b/src/basic/missing_type.h
 @@ -14,3 +14,7 @@
diff --git a/meta/recipes-core/systemd/systemd/0006-Use-uintmax_t-for-handling-rlim_t.patch b/meta/recipes-core/systemd/systemd/0007-Use-uintmax_t-for-handling-rlim_t.patch
index 4be14b72ec..b4a570e1f5 100644
--- a/meta/recipes-core/systemd/systemd/0006-Use-uintmax_t-for-handling-rlim_t.patch
+++ b/meta/recipes-core/systemd/systemd/0007-Use-uintmax_t-for-handling-rlim_t.patch
@@ -1,7 +1,7 @@
-From 96e975a2412a20e5f80bd3ab144057d275eb8597 Mon Sep 17 00:00:00 2001
+From 85d8c4c27e855d54c1740902a836c8f2aea9bebc Mon Sep 17 00:00:00 2001
 From: Chen Qi <Qi.Chen@windriver.com>
 Date: Mon, 25 Feb 2019 15:12:41 +0800
-Subject: [PATCH 06/22] Use uintmax_t for handling rlim_t
+Subject: [PATCH 07/26] Use uintmax_t for handling rlim_t
 
 PRIu{32,64} is not right format to represent rlim_t type
 therefore use %ju and typecast the rlim_t variables to
@@ -27,10 +27,10 @@ Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
  3 files changed, 9 insertions(+), 15 deletions(-)
 
 diff --git a/src/basic/format-util.h b/src/basic/format-util.h
-index 8719df3e29..9becc96066 100644
+index b528c005ca..41c4c095be 100644
 --- a/src/basic/format-util.h
 +++ b/src/basic/format-util.h
-@@ -34,13 +34,7 @@ assert_cc(sizeof(gid_t) == sizeof(uint32_t));
+@@ -41,13 +41,7 @@ assert_cc(sizeof(gid_t) == sizeof(uint32_t));
  #  error Unknown timex member size
  #endif
  
@@ -46,10 +46,10 @@ index 8719df3e29..9becc96066 100644
  #if SIZEOF_DEV_T == 8
  #  define DEV_FMT "%" PRIu64
 diff --git a/src/basic/rlimit-util.c b/src/basic/rlimit-util.c
-index c1f0b2b974..61c5412582 100644
+index a9f7b87f28..059c67731d 100644
 --- a/src/basic/rlimit-util.c
 +++ b/src/basic/rlimit-util.c
-@@ -44,7 +44,7 @@ int setrlimit_closest(int resource, const struct rlimit *rlim) {
+@@ -47,7 +47,7 @@ int setrlimit_closest(int resource, const struct rlimit *rlim) {
              fixed.rlim_max == highest.rlim_max)
                  return 0;
  
@@ -58,7 +58,7 @@ index c1f0b2b974..61c5412582 100644
  
          return RET_NERRNO(setrlimit(resource, &fixed));
  }
-@@ -307,13 +307,13 @@ int rlimit_format(const struct rlimit *rl, char **ret) {
+@@ -310,13 +310,13 @@ int rlimit_format(const struct rlimit *rl, char **ret) {
          if (rl->rlim_cur >= RLIM_INFINITY && rl->rlim_max >= RLIM_INFINITY)
                  r = free_and_strdup(&s, "infinity");
          else if (rl->rlim_cur >= RLIM_INFINITY)
@@ -76,7 +76,7 @@ index c1f0b2b974..61c5412582 100644
          if (r < 0)
                  return -ENOMEM;
  
-@@ -422,7 +422,7 @@ int rlimit_nofile_safe(void) {
+@@ -425,7 +425,7 @@ int rlimit_nofile_safe(void) {
          rl.rlim_max = MIN(rl.rlim_max, (rlim_t) read_nr_open());
          rl.rlim_cur = MIN((rlim_t) FD_SETSIZE, rl.rlim_max);
          if (setrlimit(RLIMIT_NOFILE, &rl) < 0)
@@ -86,10 +86,10 @@ index c1f0b2b974..61c5412582 100644
          return 1;
  }
 diff --git a/src/core/execute.c b/src/core/execute.c
-index bd3da0c401..df1870fd2f 100644
+index 3d55b0b772..4824ff159e 100644
 --- a/src/core/execute.c
 +++ b/src/core/execute.c
-@@ -1045,9 +1045,9 @@ void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) {
+@@ -1162,9 +1162,9 @@ void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) {
          for (unsigned i = 0; i < RLIM_NLIMITS; i++)
                  if (c->rlimit[i]) {
                          fprintf(f, "%sLimit%s: " RLIM_FMT "\n",
diff --git a/meta/recipes-core/systemd/systemd/0007-don-t-pass-AT_SYMLINK_NOFOLLOW-flag-to-faccessat.patch b/meta/recipes-core/systemd/systemd/0007-don-t-pass-AT_SYMLINK_NOFOLLOW-flag-to-faccessat.patch
deleted file mode 100644
index 8d6084239e..0000000000
--- a/meta/recipes-core/systemd/systemd/0007-don-t-pass-AT_SYMLINK_NOFOLLOW-flag-to-faccessat.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-From 4842cff4f1329f0b5034b529d56f8ad1f234ac4c Mon Sep 17 00:00:00 2001
-From: Andre McCurdy <armccurdy@gmail.com>
-Date: Tue, 10 Oct 2017 14:33:30 -0700
-Subject: [PATCH 07/22] don't pass AT_SYMLINK_NOFOLLOW flag to faccessat()
-
-Avoid using AT_SYMLINK_NOFOLLOW flag. It doesn't seem like the right
-thing to do and it's not portable (not supported by musl). See:
-
-  http://lists.landley.net/pipermail/toybox-landley.net/2014-September/003610.html
-  http://www.openwall.com/lists/musl/2015/02/05/2
-
-Note that laccess() is never passing AT_EACCESS so a lot of the
-discussion in the links above doesn't apply. Note also that
-(currently) all systemd callers of laccess() pass mode as F_OK, so
-only check for existence of a file, not access permissions.
-Therefore, in this case, the only distiction between faccessat()
-with (flag == 0) and (flag == AT_SYMLINK_NOFOLLOW) is the behaviour
-for broken symlinks; laccess() on a broken symlink will succeed with
-(flag == AT_SYMLINK_NOFOLLOW) and fail (flag == 0).
-
-The laccess() macros was added to systemd some time ago and it's not
-clear if or why it needs to return success for broken symlinks. Maybe
-just historical and not actually necessary or desired behaviour?
-
-Upstream-Status: Inappropriate [musl specific]
-
-Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
----
- src/basic/fs-util.h          | 21 ++++++++++++++++++++-
- src/shared/base-filesystem.c |  6 +++---
- 2 files changed, 23 insertions(+), 4 deletions(-)
-
-diff --git a/src/basic/fs-util.h b/src/basic/fs-util.h
-index 1023ab73ca..c78ff6f27f 100644
---- a/src/basic/fs-util.h
-+++ b/src/basic/fs-util.h
-@@ -49,8 +49,27 @@ int futimens_opath(int fd, const struct timespec ts[2]);
- int fd_warn_permissions(const char *path, int fd);
- int stat_warn_permissions(const char *path, const struct stat *st);
- 
-+/*
-+   Avoid using AT_SYMLINK_NOFOLLOW flag. It doesn't seem like the right thing to
-+   do and it's not portable (not supported by musl). See:
-+
-+     http://lists.landley.net/pipermail/toybox-landley.net/2014-September/003610.html
-+     http://www.openwall.com/lists/musl/2015/02/05/2
-+
-+   Note that laccess() is never passing AT_EACCESS so a lot of the discussion in
-+   the links above doesn't apply. Note also that (currently) all systemd callers
-+   of laccess() pass mode as F_OK, so only check for existence of a file, not
-+   access permissions. Therefore, in this case, the only distiction between
-+   faccessat() with (flag == 0) and (flag == AT_SYMLINK_NOFOLLOW) is the
-+   behaviour for broken symlinks; laccess() on a broken symlink will succeed
-+   with (flag == AT_SYMLINK_NOFOLLOW) and fail (flag == 0).
-+
-+   The laccess() macros was added to systemd some time ago and it's not clear if
-+   or why it needs to return success for broken symlinks. Maybe just historical
-+   and not actually necessary or desired behaviour?
-+*/
- #define laccess(path, mode)                                             \
--        RET_NERRNO(faccessat(AT_FDCWD, (path), (mode), AT_SYMLINK_NOFOLLOW))
-+        RET_NERRNO(faccessat(AT_FDCWD, (path), (mode), 0))
- 
- int touch_file(const char *path, bool parents, usec_t stamp, uid_t uid, gid_t gid, mode_t mode);
- 
-diff --git a/src/shared/base-filesystem.c b/src/shared/base-filesystem.c
-index 569ef466c3..7ae921a113 100644
---- a/src/shared/base-filesystem.c
-+++ b/src/shared/base-filesystem.c
-@@ -145,7 +145,7 @@ int base_filesystem_create_fd(int fd, const char *root, uid_t uid, gid_t gid) {
-         /* The "root" parameter is decoration only – it's only used as part of log messages */
- 
-         for (size_t i = 0; i < ELEMENTSOF(table); i++) {
--                if (faccessat(fd, table[i].dir, F_OK, AT_SYMLINK_NOFOLLOW) >= 0)
-+                if (faccessat(fd, table[i].dir, F_OK, 0) >= 0)
-                         continue;
- 
-                 if (table[i].target) { /* Create as symlink? */
-@@ -153,7 +153,7 @@ int base_filesystem_create_fd(int fd, const char *root, uid_t uid, gid_t gid) {
- 
-                         /* check if one of the targets exists */
-                         NULSTR_FOREACH(s, table[i].target) {
--                                if (faccessat(fd, s, F_OK, AT_SYMLINK_NOFOLLOW) < 0)
-+                                if (faccessat(fd, s, F_OK, 0) < 0)
-                                         continue;
- 
-                                 /* check if a specific file exists at the target path */
-@@ -164,7 +164,7 @@ int base_filesystem_create_fd(int fd, const char *root, uid_t uid, gid_t gid) {
-                                         if (!p)
-                                                 return log_oom();
- 
--                                        if (faccessat(fd, p, F_OK, AT_SYMLINK_NOFOLLOW) < 0)
-+                                        if (faccessat(fd, p, F_OK, 0) < 0)
-                                                 continue;
-                                 }
- 
--- 
-2.34.1
-
diff --git a/meta/recipes-core/systemd/systemd/0008-Define-glibc-compatible-basename-for-non-glibc-syste.patch b/meta/recipes-core/systemd/systemd/0008-Define-glibc-compatible-basename-for-non-glibc-syste.patch
index c1a8bb19fe..22e2ceadcc 100644
--- a/meta/recipes-core/systemd/systemd/0008-Define-glibc-compatible-basename-for-non-glibc-syste.patch
+++ b/meta/recipes-core/systemd/systemd/0008-Define-glibc-compatible-basename-for-non-glibc-syste.patch
@@ -1,7 +1,7 @@
-From bab07e779ff23d5593bb118efaaa31b60a6dce87 Mon Sep 17 00:00:00 2001
+From f4cd939c7cc1ce0a59bab2693768f2c95d9ced00 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Sun, 27 May 2018 08:36:44 -0700
-Subject: [PATCH 08/22] Define glibc compatible basename() for non-glibc
+Subject: [PATCH 08/26] Define glibc compatible basename() for non-glibc
  systems
 
 Fixes builds with musl, even though systemd is adamant about
@@ -15,10 +15,10 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  1 file changed, 4 insertions(+)
 
 diff --git a/src/basic/string-util.h b/src/basic/string-util.h
-index b6d8be3083..0a29036c4c 100644
+index cc6aa183c0..0b035125cd 100644
 --- a/src/basic/string-util.h
 +++ b/src/basic/string-util.h
-@@ -26,6 +26,10 @@
+@@ -27,6 +27,10 @@
  #define URI_UNRESERVED      ALPHANUMERICAL "-._~"       /* [RFC3986] */
  #define URI_VALID           URI_RESERVED URI_UNRESERVED /* [RFC3986] */
  
diff --git a/meta/recipes-core/systemd/systemd/0009-Do-not-disable-buffering-when-writing-to-oom_score_a.patch b/meta/recipes-core/systemd/systemd/0009-Do-not-disable-buffering-when-writing-to-oom_score_a.patch
index 3ff0177ae3..8e3eb15b54 100644
--- a/meta/recipes-core/systemd/systemd/0009-Do-not-disable-buffering-when-writing-to-oom_score_a.patch
+++ b/meta/recipes-core/systemd/systemd/0009-Do-not-disable-buffering-when-writing-to-oom_score_a.patch
@@ -1,7 +1,7 @@
-From 25093c5017725b8577c444dfea0f42ad85b43522 Mon Sep 17 00:00:00 2001
+From 6959db351fdd551d46e22667deec6032552b2662 Mon Sep 17 00:00:00 2001
 From: Chen Qi <Qi.Chen@windriver.com>
 Date: Wed, 4 Jul 2018 15:00:44 +0800
-Subject: [PATCH 09/22] Do not disable buffering when writing to oom_score_adj
+Subject: [PATCH 09/26] Do not disable buffering when writing to oom_score_adj
 
 On musl, disabling buffering when writing to oom_score_adj will
 cause the following error.
@@ -24,10 +24,10 @@ Signed-off-by: Scott Murray <scott.murray@konsulko.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/basic/process-util.c b/src/basic/process-util.c
-index 201c5596ae..ea51595b6c 100644
+index 3253a9c3fb..772c4082a1 100644
 --- a/src/basic/process-util.c
 +++ b/src/basic/process-util.c
-@@ -1716,7 +1716,7 @@ int set_oom_score_adjust(int value) {
+@@ -1848,7 +1848,7 @@ int set_oom_score_adjust(int value) {
          xsprintf(t, "%i", value);
  
          return write_string_file("/proc/self/oom_score_adj", t,
diff --git a/meta/recipes-core/systemd/systemd/0010-distinguish-XSI-compliant-strerror_r-from-GNU-specif.patch b/meta/recipes-core/systemd/systemd/0010-distinguish-XSI-compliant-strerror_r-from-GNU-specif.patch
index cf59ac7d06..0dfb77890e 100644
--- a/meta/recipes-core/systemd/systemd/0010-distinguish-XSI-compliant-strerror_r-from-GNU-specif.patch
+++ b/meta/recipes-core/systemd/systemd/0010-distinguish-XSI-compliant-strerror_r-from-GNU-specif.patch
@@ -1,7 +1,7 @@
-From 2adbe9773cd65c48eec9df96868d4a738927c8d9 Mon Sep 17 00:00:00 2001
+From b7f6c245b4ae72999f23eecc2bbb6d6fb8db667c Mon Sep 17 00:00:00 2001
 From: Chen Qi <Qi.Chen@windriver.com>
 Date: Tue, 10 Jul 2018 15:40:17 +0800
-Subject: [PATCH 10/22] distinguish XSI-compliant strerror_r from GNU-specifi
+Subject: [PATCH 10/26] distinguish XSI-compliant strerror_r from GNU-specifi
  strerror_r
 
 XSI-compliant strerror_r and GNU-specifi strerror_r are different.
@@ -24,10 +24,10 @@ Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
  2 files changed, 15 insertions(+), 1 deletion(-)
 
 diff --git a/src/libsystemd/sd-bus/bus-error.c b/src/libsystemd/sd-bus/bus-error.c
-index 77b2e1a0fd..fdba0e0142 100644
+index 58c24d25c0..69a0d09d42 100644
 --- a/src/libsystemd/sd-bus/bus-error.c
 +++ b/src/libsystemd/sd-bus/bus-error.c
-@@ -408,7 +408,12 @@ static void bus_error_strerror(sd_bus_error *e, int error) {
+@@ -405,7 +405,12 @@ static void bus_error_strerror(sd_bus_error *e, int error) {
                          return;
  
                  errno = 0;
@@ -40,7 +40,7 @@ index 77b2e1a0fd..fdba0e0142 100644
                  if (errno == ERANGE || strlen(x) >= k - 1) {
                          free(m);
                          k *= 2;
-@@ -593,8 +598,12 @@ const char* _bus_error_message(const sd_bus_error *e, int error, char buf[static
+@@ -590,8 +595,12 @@ const char* _bus_error_message(const sd_bus_error *e, int error, char buf[static
  
          if (e && e->message)
                  return e->message;
@@ -55,7 +55,7 @@ index 77b2e1a0fd..fdba0e0142 100644
  
  static bool map_ok(const sd_bus_error_map *map) {
 diff --git a/src/libsystemd/sd-journal/journal-send.c b/src/libsystemd/sd-journal/journal-send.c
-index 69a2eb6404..1561859650 100644
+index 75e8e08add..41e5c7c2b8 100644
 --- a/src/libsystemd/sd-journal/journal-send.c
 +++ b/src/libsystemd/sd-journal/journal-send.c
 @@ -361,7 +361,12 @@ static int fill_iovec_perror_and_send(const char *message, int skip, struct iove
diff --git a/meta/recipes-core/systemd/systemd/0011-avoid-redefinition-of-prctl_mm_map-structure.patch b/meta/recipes-core/systemd/systemd/0011-avoid-redefinition-of-prctl_mm_map-structure.patch
index e481b2e2e4..16d741cf87 100644
--- a/meta/recipes-core/systemd/systemd/0011-avoid-redefinition-of-prctl_mm_map-structure.patch
+++ b/meta/recipes-core/systemd/systemd/0011-avoid-redefinition-of-prctl_mm_map-structure.patch
@@ -1,7 +1,7 @@
-From 49c446cfb78cf74a909bed8c3798b77a5469866a Mon Sep 17 00:00:00 2001
+From 43b0269e850a2fbcb6ca615258aa8f8a9b4f6a9d Mon Sep 17 00:00:00 2001
 From: Chen Qi <Qi.Chen@windriver.com>
 Date: Mon, 25 Feb 2019 15:44:54 +0800
-Subject: [PATCH 11/22] avoid redefinition of prctl_mm_map structure
+Subject: [PATCH 11/26] avoid redefinition of prctl_mm_map structure
 
 Fix the following compile failure:
 error: redefinition of 'struct prctl_mm_map'
@@ -14,7 +14,7 @@ Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/src/basic/missing_prctl.h b/src/basic/missing_prctl.h
-index 7d9e395c92..88c2d7dfac 100644
+index 2c9f9f6c50..65a984b564 100644
 --- a/src/basic/missing_prctl.h
 +++ b/src/basic/missing_prctl.h
 @@ -1,7 +1,9 @@
@@ -25,8 +25,8 @@ index 7d9e395c92..88c2d7dfac 100644
  #include <linux/prctl.h>
 +#endif
  
- /* 58319057b7847667f0c9585b9de0e8932b0fdb08 (4.3) */
- #ifndef PR_CAP_AMBIENT
+ #include "macro.h"
+ 
 -- 
 2.34.1
 
diff --git a/meta/recipes-core/systemd/systemd/0012-do-not-disable-buffer-in-writing-files.patch b/meta/recipes-core/systemd/systemd/0012-do-not-disable-buffer-in-writing-files.patch
index 66be79077e..0bbc6bbac7 100644
--- a/meta/recipes-core/systemd/systemd/0012-do-not-disable-buffer-in-writing-files.patch
+++ b/meta/recipes-core/systemd/systemd/0012-do-not-disable-buffer-in-writing-files.patch
@@ -1,7 +1,7 @@
-From e4885a8e60f883d9217e26e1db3754c2906aca31 Mon Sep 17 00:00:00 2001
+From eaf26fdad00448b8cd336eb5db51e0baa8d8e588 Mon Sep 17 00:00:00 2001
 From: Chen Qi <Qi.Chen@windriver.com>
-Date: Fri, 1 Mar 2019 15:22:15 +0800
-Subject: [PATCH 12/22] do not disable buffer in writing files
+Date: Mon, 16 Dec 2024 14:37:25 +0800
+Subject: [PATCH 12/26] do not disable buffer in writing files
 
 Do not disable buffer in writing files, otherwise we get
 failure at boot for musl like below.
@@ -22,80 +22,43 @@ Signed-off-by: Scott Murray <scott.murray@konsulko.com>
 Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
 [rebased for systemd 255.1]
 ---
- src/basic/cgroup-util.c              | 12 ++++++------
+ src/basic/cgroup-util.c              |  4 ++--
  src/basic/namespace-util.c           |  4 ++--
  src/basic/procfs-util.c              |  4 ++--
  src/basic/sysctl-util.c              |  2 +-
  src/binfmt/binfmt.c                  |  6 +++---
  src/core/cgroup.c                    |  2 +-
+ src/core/ipe-setup.c                 |  2 +-
  src/core/main.c                      |  2 +-
- src/core/smack-setup.c               |  8 ++++----
+ src/core/smack-setup.c               |  6 +++---
  src/home/homework.c                  |  2 +-
  src/libsystemd/sd-device/sd-device.c |  2 +-
  src/nspawn/nspawn-cgroup.c           |  2 +-
  src/nspawn/nspawn.c                  |  6 +++---
  src/shared/binfmt-util.c             |  2 +-
- src/shared/cgroup-setup.c            |  4 ++--
- src/shared/coredump-util.c           |  4 ++--
+ src/shared/cgroup-setup.c            | 12 ++++++------
+ src/shared/coredump-util.c           |  2 +-
  src/shared/hibernate-util.c          |  4 ++--
  src/shared/smack-util.c              |  2 +-
- src/shared/watchdog.c                |  2 +-
- src/sleep/sleep.c                    |  4 ++--
+ src/sleep/sleep.c                    |  2 +-
  src/storagetm/storagetm.c            | 24 ++++++++++++------------
- src/udev/udev-rules.c                |  1 -
  src/vconsole/vconsole-setup.c        |  2 +-
- 22 files changed, 50 insertions(+), 51 deletions(-)
+ 21 files changed, 47 insertions(+), 47 deletions(-)
 
 diff --git a/src/basic/cgroup-util.c b/src/basic/cgroup-util.c
-index d2be79622f..e65fecb68d 100644
+index 309dccb45a..7aec5072a0 100644
 --- a/src/basic/cgroup-util.c
 +++ b/src/basic/cgroup-util.c
-@@ -417,7 +417,7 @@ int cg_kill_kernel_sigkill(const char *path) {
+@@ -495,7 +495,7 @@ int cg_kill_kernel_sigkill(const char *path) {
          if (r < 0)
                  return r;
  
 -        r = write_string_file(killfile, "1", WRITE_STRING_FILE_DISABLE_BUFFER);
 +        r = write_string_file(killfile, "1", 0);
          if (r < 0)
-                 return r;
- 
-@@ -843,7 +843,7 @@ int cg_install_release_agent(const char *controller, const char *agent) {
- 
-         sc = strstrip(contents);
-         if (isempty(sc)) {
--                r = write_string_file(fs, agent, WRITE_STRING_FILE_DISABLE_BUFFER);
-+                r = write_string_file(fs, agent, 0);
-                 if (r < 0)
-                         return r;
-         } else if (!path_equal(sc, agent))
-@@ -861,7 +861,7 @@ int cg_install_release_agent(const char *controller, const char *agent) {
+                 return log_debug_errno(r, "Failed to write to cgroup.kill for cgroup '%s': %m", path);
  
-         sc = strstrip(contents);
-         if (streq(sc, "0")) {
--                r = write_string_file(fs, "1", WRITE_STRING_FILE_DISABLE_BUFFER);
-+                r = write_string_file(fs, "1", 0);
-                 if (r < 0)
-                         return r;
- 
-@@ -888,7 +888,7 @@ int cg_uninstall_release_agent(const char *controller) {
-         if (r < 0)
-                 return r;
- 
--        r = write_string_file(fs, "0", WRITE_STRING_FILE_DISABLE_BUFFER);
-+        r = write_string_file(fs, "0", 0);
-         if (r < 0)
-                 return r;
- 
-@@ -898,7 +898,7 @@ int cg_uninstall_release_agent(const char *controller) {
-         if (r < 0)
-                 return r;
- 
--        r = write_string_file(fs, "", WRITE_STRING_FILE_DISABLE_BUFFER);
-+        r = write_string_file(fs, "", 0);
-         if (r < 0)
-                 return r;
- 
-@@ -1814,7 +1814,7 @@ int cg_set_attribute(const char *controller, const char *path, const char *attri
+@@ -1721,7 +1721,7 @@ int cg_set_attribute(const char *controller, const char *path, const char *attri
          if (r < 0)
                  return r;
  
@@ -105,29 +68,29 @@ index d2be79622f..e65fecb68d 100644
  
  int cg_get_attribute(const char *controller, const char *path, const char *attribute, char **ret) {
 diff --git a/src/basic/namespace-util.c b/src/basic/namespace-util.c
-index 2101f617ad..63817bae17 100644
+index 332e8cdfd5..804498127d 100644
 --- a/src/basic/namespace-util.c
 +++ b/src/basic/namespace-util.c
-@@ -227,12 +227,12 @@ int userns_acquire(const char *uid_map, const char *gid_map) {
+@@ -359,12 +359,12 @@ int userns_acquire(const char *uid_map, const char *gid_map) {
                  freeze();
  
          xsprintf(path, "/proc/" PID_FMT "/uid_map", pid);
 -        r = write_string_file(path, uid_map, WRITE_STRING_FILE_DISABLE_BUFFER);
 +        r = write_string_file(path, uid_map, 0);
          if (r < 0)
-                 return log_error_errno(r, "Failed to write UID map: %m");
+                 return log_debug_errno(r, "Failed to write UID map: %m");
  
          xsprintf(path, "/proc/" PID_FMT "/gid_map", pid);
 -        r = write_string_file(path, gid_map, WRITE_STRING_FILE_DISABLE_BUFFER);
 +        r = write_string_file(path, gid_map, 0);
          if (r < 0)
-                 return log_error_errno(r, "Failed to write GID map: %m");
+                 return log_debug_errno(r, "Failed to write GID map: %m");
  
 diff --git a/src/basic/procfs-util.c b/src/basic/procfs-util.c
-index 6cb0ddf575..247cf9e1d1 100644
+index d7cfcd9105..58fb5918a3 100644
 --- a/src/basic/procfs-util.c
 +++ b/src/basic/procfs-util.c
-@@ -64,13 +64,13 @@ int procfs_tasks_set_limit(uint64_t limit) {
+@@ -63,13 +63,13 @@ int procfs_tasks_set_limit(uint64_t limit) {
           * decrease it, as threads-max is the much more relevant sysctl. */
          if (limit > pid_max-1) {
                  sprintf(buffer, "%" PRIu64, limit+1); /* Add one, since PID 0 is not a valid PID */
@@ -144,15 +107,15 @@ index 6cb0ddf575..247cf9e1d1 100644
                  uint64_t threads_max;
  
 diff --git a/src/basic/sysctl-util.c b/src/basic/sysctl-util.c
-index b66a6622ae..8d1c93008a 100644
+index 2feb4917d7..4c74620a00 100644
 --- a/src/basic/sysctl-util.c
 +++ b/src/basic/sysctl-util.c
-@@ -58,7 +58,7 @@ int sysctl_write(const char *property, const char *value) {
- 
-         log_debug("Setting '%s' to '%s'", p, value);
+@@ -97,7 +97,7 @@ int sysctl_write_full(const char *property, const char *value, Hashmap **shadow)
+         if (r < 0)
+                 return r;
  
 -        return write_string_file(p, value, WRITE_STRING_FILE_VERIFY_ON_FAILURE | WRITE_STRING_FILE_DISABLE_BUFFER | WRITE_STRING_FILE_SUPPRESS_REDUNDANT_VIRTUAL);
-+        return write_string_file(p, value, WRITE_STRING_FILE_VERIFY_ON_FAILURE | WRITE_STRING_FILE_SUPPRESS_REDUNDANT_VIRTUAL);
++        return write_string_file(p, value, WRITE_STRING_FILE_VERIFY_ON_FAILURE | 0 | WRITE_STRING_FILE_SUPPRESS_REDUNDANT_VIRTUAL);
  }
  
  int sysctl_writef(const char *property, const char *format, ...) {
@@ -188,23 +151,36 @@ index d21f3f79ff..258607cc7e 100644
                          log_warning_errno(r, "Failed to flush binfmt_misc rules, ignoring: %m");
                  else
 diff --git a/src/core/cgroup.c b/src/core/cgroup.c
-index 61ac4df1a6..ea18970196 100644
+index 6933aae54d..ab6fccc0e4 100644
 --- a/src/core/cgroup.c
 +++ b/src/core/cgroup.c
-@@ -4578,7 +4578,7 @@ int unit_cgroup_freezer_action(Unit *u, FreezerAction action) {
-                         u->freezer_state = FREEZER_THAWING;
-         }
+@@ -5175,7 +5175,7 @@ int unit_cgroup_freezer_action(Unit *u, FreezerAction action) {
+         if (r < 0)
+                 return r;
  
--        r = write_string_file(path, one_zero(action == FREEZER_FREEZE), WRITE_STRING_FILE_DISABLE_BUFFER);
-+        r = write_string_file(path, one_zero(action == FREEZER_FREEZE), 0);
+-        r = write_string_file(path, one_zero(objective == FREEZER_FROZEN), WRITE_STRING_FILE_DISABLE_BUFFER);
++        r = write_string_file(path, one_zero(objective == FREEZER_FROZEN), 0);
          if (r < 0)
                  return r;
  
+diff --git a/src/core/ipe-setup.c b/src/core/ipe-setup.c
+index 4648d43829..80d03d87d4 100644
+--- a/src/core/ipe-setup.c
++++ b/src/core/ipe-setup.c
+@@ -94,7 +94,7 @@ int ipe_setup(void) {
+                 if (!activate_path)
+                         return log_oom();
+ 
+-                r = write_string_file(activate_path, "1", WRITE_STRING_FILE_DISABLE_BUFFER);
++                r = write_string_file(activate_path, "1", 0);
+                 if (r == -ESTALE) {
+                         log_debug_errno(r,
+                                         "IPE policy %s is already loaded with a version that is equal or higher, skipping.",
 diff --git a/src/core/main.c b/src/core/main.c
-index 3f71cc0947..0e5aec3e9e 100644
+index 172742c769..e68ce2a6d8 100644
 --- a/src/core/main.c
 +++ b/src/core/main.c
-@@ -1678,7 +1678,7 @@ static void initialize_core_pattern(bool skip_setup) {
+@@ -1826,7 +1826,7 @@ static void initialize_core_pattern(bool skip_setup) {
          if (getpid_cached() != 1)
                  return;
  
@@ -214,7 +190,7 @@ index 3f71cc0947..0e5aec3e9e 100644
                  log_warning_errno(r, "Failed to write '%s' to /proc/sys/kernel/core_pattern, ignoring: %m",
                                    arg_early_core_pattern);
 diff --git a/src/core/smack-setup.c b/src/core/smack-setup.c
-index 7ea902b6f9..1aef2988d0 100644
+index 7ea902b6f9..ee4cd56023 100644
 --- a/src/core/smack-setup.c
 +++ b/src/core/smack-setup.c
 @@ -321,17 +321,17 @@ int mac_smack_setup(bool *loaded_policy) {
@@ -230,8 +206,7 @@ index 7ea902b6f9..1aef2988d0 100644
          if (r < 0)
                  log_warning_errno(r, "Failed to set SMACK ambient label \"" SMACK_RUN_LABEL "\": %m");
          r = write_string_file("/sys/fs/smackfs/netlabel",
--                              "0.0.0.0/0 " SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER);
-+                              "0.0.0.0/0 " SMACK_RUN_LABEL, 0);
+                               "0.0.0.0/0 " SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER);
          if (r < 0)
                  log_warning_errno(r, "Failed to set SMACK netlabel rule \"0.0.0.0/0 " SMACK_RUN_LABEL "\": %m");
 -        r = write_string_file("/sys/fs/smackfs/netlabel", "127.0.0.1 -CIPSO", WRITE_STRING_FILE_DISABLE_BUFFER);
@@ -240,23 +215,23 @@ index 7ea902b6f9..1aef2988d0 100644
                  log_warning_errno(r, "Failed to set SMACK netlabel rule \"127.0.0.1 -CIPSO\": %m");
  #endif
 diff --git a/src/home/homework.c b/src/home/homework.c
-index 066483e342..5f92dd7064 100644
+index 00e74894b3..7457113efe 100644
 --- a/src/home/homework.c
 +++ b/src/home/homework.c
-@@ -278,7 +278,7 @@ static void drop_caches_now(void) {
-          * for details. We write "2" into /proc/sys/vm/drop_caches to ensure dentries/inodes are flushed, but
+@@ -304,7 +304,7 @@ static void drop_caches_now(void) {
+          * for details. We write "3" into /proc/sys/vm/drop_caches to ensure dentries/inodes are flushed, but
           * not more. */
  
--        r = write_string_file("/proc/sys/vm/drop_caches", "2\n", WRITE_STRING_FILE_DISABLE_BUFFER);
-+        r = write_string_file("/proc/sys/vm/drop_caches", "2\n", 0);
+-        r = write_string_file("/proc/sys/vm/drop_caches", "3\n", WRITE_STRING_FILE_DISABLE_BUFFER);
++        r = write_string_file("/proc/sys/vm/drop_caches", "3\n", 0);
          if (r < 0)
                  log_warning_errno(r, "Failed to drop caches, ignoring: %m");
          else
 diff --git a/src/libsystemd/sd-device/sd-device.c b/src/libsystemd/sd-device/sd-device.c
-index 2fbc619a34..09d9591e37 100644
+index 01fa90b1ff..83ab655bf4 100644
 --- a/src/libsystemd/sd-device/sd-device.c
 +++ b/src/libsystemd/sd-device/sd-device.c
-@@ -2516,7 +2516,7 @@ _public_ int sd_device_set_sysattr_value(sd_device *device, const char *sysattr,
+@@ -2564,7 +2564,7 @@ _public_ int sd_device_set_sysattr_value(sd_device *device, const char *sysattr,
          if (!value)
                  return -ENOMEM;
  
@@ -266,23 +241,23 @@ index 2fbc619a34..09d9591e37 100644
                  /* On failure, clear cache entry, as we do not know how it fails. */
                  device_remove_cached_sysattr_value(device, sysattr);
 diff --git a/src/nspawn/nspawn-cgroup.c b/src/nspawn/nspawn-cgroup.c
-index a5002437c6..b12e6cd9c9 100644
+index 4f28b4a225..c899c218b2 100644
 --- a/src/nspawn/nspawn-cgroup.c
 +++ b/src/nspawn/nspawn-cgroup.c
-@@ -124,7 +124,7 @@ int sync_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t uid_shift) {
+@@ -93,7 +93,7 @@ int sync_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t uid_shift) {
          fn = strjoina(tree, cgroup, "/cgroup.procs");
  
          sprintf(pid_string, PID_FMT, pid);
 -        r = write_string_file(fn, pid_string, WRITE_STRING_FILE_DISABLE_BUFFER|WRITE_STRING_FILE_MKDIR_0755);
-+        r = write_string_file(fn, pid_string, WRITE_STRING_FILE_MKDIR_0755);
++        r = write_string_file(fn, pid_string, 0|WRITE_STRING_FILE_MKDIR_0755);
          if (r < 0) {
                  log_error_errno(r, "Failed to move process: %m");
                  goto finish;
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 6ab604d3dc..bbec6b686c 100644
+index 500725d35f..745b6815db 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -2688,7 +2688,7 @@ static int reset_audit_loginuid(void) {
+@@ -2857,7 +2857,7 @@ static int reset_audit_loginuid(void) {
          if (streq(p, "4294967295"))
                  return 0;
  
@@ -291,7 +266,7 @@ index 6ab604d3dc..bbec6b686c 100644
          if (r < 0) {
                  log_error_errno(r,
                                  "Failed to reset audit login UID. This probably means that your kernel is too\n"
-@@ -4141,7 +4141,7 @@ static int setup_uid_map(
+@@ -4588,7 +4588,7 @@ static int setup_uid_map(
                  return log_oom();
  
          xsprintf(uid_map, "/proc/" PID_FMT "/uid_map", pid);
@@ -300,7 +275,7 @@ index 6ab604d3dc..bbec6b686c 100644
          if (r < 0)
                  return log_error_errno(r, "Failed to write UID map: %m");
  
-@@ -4151,7 +4151,7 @@ static int setup_uid_map(
+@@ -4598,7 +4598,7 @@ static int setup_uid_map(
                  return log_oom();
  
          xsprintf(uid_map, "/proc/" PID_FMT "/gid_map", pid);
@@ -323,10 +298,10 @@ index a26175474b..1413a9c72c 100644
                  return log_warning_errno(r, "Failed to unregister binfmt_misc entries: %m");
  
 diff --git a/src/shared/cgroup-setup.c b/src/shared/cgroup-setup.c
-index 934a16eaf3..c921ced861 100644
+index 49d40f60d8..0f4aa8512a 100644
 --- a/src/shared/cgroup-setup.c
 +++ b/src/shared/cgroup-setup.c
-@@ -351,7 +351,7 @@ int cg_attach(const char *controller, const char *path, pid_t pid) {
+@@ -369,7 +369,7 @@ int cg_attach(const char *controller, const char *path, pid_t pid) {
  
          xsprintf(c, PID_FMT "\n", pid);
  
@@ -335,29 +310,56 @@ index 934a16eaf3..c921ced861 100644
          if (r == -EOPNOTSUPP && cg_is_threaded(path) > 0)
                  /* When the threaded mode is used, we cannot read/write the file. Let's return recognizable error. */
                  return -EUCLEAN;
-@@ -966,7 +966,7 @@ int cg_enable_everywhere(
-                                         return log_debug_errno(errno, "Failed to open cgroup.subtree_control file of %s: %m", p);
-                         }
- 
--                        r = write_string_stream(f, s, WRITE_STRING_FILE_DISABLE_BUFFER);
-+                        r = write_string_stream(f, s, 0);
-                         if (r < 0) {
-                                 log_debug_errno(r, "Failed to %s controller %s for %s (%s): %m",
-                                                 FLAGS_SET(mask, bit) ? "enable" : "disable", n, p, fs);
-diff --git a/src/shared/coredump-util.c b/src/shared/coredump-util.c
-index 805503f366..01a7ccb291 100644
---- a/src/shared/coredump-util.c
-+++ b/src/shared/coredump-util.c
-@@ -163,7 +163,7 @@ int set_coredump_filter(uint64_t value) {
-         xsprintf(t, "0x%"PRIx64, value);
+@@ -399,7 +399,7 @@ int cg_fd_attach(int fd, pid_t pid) {
+ 
+         xsprintf(c, PID_FMT "\n", pid);
  
-         return write_string_file("/proc/self/coredump_filter", t,
--                                 WRITE_STRING_FILE_VERIFY_ON_FAILURE|WRITE_STRING_FILE_DISABLE_BUFFER);
-+                                 0);
+-        return write_string_file_at(fd, "cgroup.procs", c, WRITE_STRING_FILE_DISABLE_BUFFER);
++        return write_string_file_at(fd, "cgroup.procs", c, 0);
  }
  
- /* Turn off core dumps but only if we're running outside of a container. */
-@@ -173,7 +173,7 @@ void disable_coredumps(void) {
+ int cg_attach_fallback(const char *controller, const char *path, pid_t pid) {
+@@ -1049,7 +1049,7 @@ int cg_install_release_agent(const char *controller, const char *agent) {
+ 
+         sc = strstrip(contents);
+         if (isempty(sc)) {
+-                r = write_string_file(fs, agent, WRITE_STRING_FILE_DISABLE_BUFFER);
++                r = write_string_file(fs, agent, 0);
+                 if (r < 0)
+                         return r;
+         } else if (!path_equal(sc, agent))
+@@ -1067,7 +1067,7 @@ int cg_install_release_agent(const char *controller, const char *agent) {
+ 
+         sc = strstrip(contents);
+         if (streq(sc, "0")) {
+-                r = write_string_file(fs, "1", WRITE_STRING_FILE_DISABLE_BUFFER);
++                r = write_string_file(fs, "1", 0);
+                 if (r < 0)
+                         return r;
+ 
+@@ -1094,7 +1094,7 @@ int cg_uninstall_release_agent(const char *controller) {
+         if (r < 0)
+                 return r;
+ 
+-        r = write_string_file(fs, "0", WRITE_STRING_FILE_DISABLE_BUFFER);
++        r = write_string_file(fs, "0", 0);
+         if (r < 0)
+                 return r;
+ 
+@@ -1104,7 +1104,7 @@ int cg_uninstall_release_agent(const char *controller) {
+         if (r < 0)
+                 return r;
+ 
+-        r = write_string_file(fs, "", WRITE_STRING_FILE_DISABLE_BUFFER);
++        r = write_string_file(fs, "", 0);
+         if (r < 0)
+                 return r;
+ 
+diff --git a/src/shared/coredump-util.c b/src/shared/coredump-util.c
+index 805503f366..3234a1d76e 100644
+--- a/src/shared/coredump-util.c
++++ b/src/shared/coredump-util.c
+@@ -180,7 +180,7 @@ void disable_coredumps(void) {
          if (detect_container() > 0)
                  return;
  
@@ -367,10 +369,10 @@ index 805503f366..01a7ccb291 100644
                  log_debug_errno(r, "Failed to turn off coredumps, ignoring: %m");
  }
 diff --git a/src/shared/hibernate-util.c b/src/shared/hibernate-util.c
-index 3eb13d48f6..d09b901be1 100644
+index 1213fdc2c7..4c26e6a4ee 100644
 --- a/src/shared/hibernate-util.c
 +++ b/src/shared/hibernate-util.c
-@@ -481,7 +481,7 @@ int write_resume_config(dev_t devno, uint64_t offset, const char *device) {
+@@ -498,7 +498,7 @@ int write_resume_config(dev_t devno, uint64_t offset, const char *device) {
  
          /* We write the offset first since it's safer. Note that this file is only available in 4.17+, so
           * fail gracefully if it doesn't exist and we're only overwriting it with 0. */
@@ -379,7 +381,7 @@ index 3eb13d48f6..d09b901be1 100644
          if (r == -ENOENT) {
                  if (offset != 0)
                          return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
-@@ -497,7 +497,7 @@ int write_resume_config(dev_t devno, uint64_t offset, const char *device) {
+@@ -514,7 +514,7 @@ int write_resume_config(dev_t devno, uint64_t offset, const char *device) {
                  log_debug("Wrote resume_offset=%s for device '%s' to /sys/power/resume_offset.",
                            offset_str, device);
  
@@ -389,7 +391,7 @@ index 3eb13d48f6..d09b901be1 100644
                  return log_error_errno(r,
                                         "Failed to write device '%s' (%s) to /sys/power/resume: %m",
 diff --git a/src/shared/smack-util.c b/src/shared/smack-util.c
-index 1f88e724d0..feb18b320a 100644
+index d0a79b2635..0c82d9943a 100644
 --- a/src/shared/smack-util.c
 +++ b/src/shared/smack-util.c
 @@ -113,7 +113,7 @@ int mac_smack_apply_pid(pid_t pid, const char *label) {
@@ -401,46 +403,24 @@ index 1f88e724d0..feb18b320a 100644
          if (r < 0)
                  return r;
  
-diff --git a/src/shared/watchdog.c b/src/shared/watchdog.c
-index 4c1a968718..6faf6806a5 100644
---- a/src/shared/watchdog.c
-+++ b/src/shared/watchdog.c
-@@ -93,7 +93,7 @@ static int set_pretimeout_governor(const char *governor) {
- 
-         r = write_string_file(sys_fn,
-                               governor,
--                              WRITE_STRING_FILE_DISABLE_BUFFER | WRITE_STRING_FILE_VERIFY_ON_FAILURE | WRITE_STRING_FILE_VERIFY_IGNORE_NEWLINE);
-+                              WRITE_STRING_FILE_VERIFY_ON_FAILURE | WRITE_STRING_FILE_VERIFY_IGNORE_NEWLINE);
-         if (r < 0)
-                 return log_error_errno(r, "Failed to set pretimeout_governor to '%s': %m", governor);
- 
 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index 21af3e9e52..6d4b84b5d5 100644
+index 181bb4ccef..2dbb3f4bc6 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
-@@ -137,7 +137,7 @@ static int write_state(int fd, char * const *states) {
-                 if (k < 0)
-                         return RET_GATHER(r, k);
- 
--                k = write_string_stream(f, *state, WRITE_STRING_FILE_DISABLE_BUFFER);
-+                k = write_string_stream(f, *state, 0);
-                 if (k >= 0) {
-                         log_debug("Using sleep state '%s'.", *state);
-                         return 0;
-@@ -155,7 +155,7 @@ static int write_mode(char * const *modes) {
-         STRV_FOREACH(mode, modes) {
-                 int k;
+@@ -158,7 +158,7 @@ static int write_mode(const char *path, char * const *modes) {
+         assert(path);
  
--                k = write_string_file("/sys/power/disk", *mode, WRITE_STRING_FILE_DISABLE_BUFFER);
-+                k = write_string_file("/sys/power/disk", *mode, 0);
-                 if (k >= 0) {
-                         log_debug("Using sleep disk mode '%s'.", *mode);
+         STRV_FOREACH(mode, modes) {
+-                r = write_string_file(path, *mode, WRITE_STRING_FILE_DISABLE_BUFFER);
++                r = write_string_file(path, *mode, 0);
+                 if (r >= 0) {
+                         log_debug("Using sleep mode '%s' for %s.", *mode, path);
                          return 0;
 diff --git a/src/storagetm/storagetm.c b/src/storagetm/storagetm.c
-index ae63baaf79..82eeca479a 100644
+index ca8e886d37..5c27c54f09 100644
 --- a/src/storagetm/storagetm.c
 +++ b/src/storagetm/storagetm.c
-@@ -186,7 +186,7 @@ static int nvme_subsystem_unlink(NvmeSubsystem *s) {
+@@ -197,7 +197,7 @@ static int nvme_subsystem_unlink(NvmeSubsystem *s) {
                                          if (!enable_fn)
                                                  return log_oom();
  
@@ -449,7 +429,7 @@ index ae63baaf79..82eeca479a 100644
                                          if (r < 0)
                                                  log_warning_errno(r, "Failed to disable namespace '%s' of NVME subsystem '%s', ignoring: %m", e->d_name, s->name);
  
-@@ -254,7 +254,7 @@ static int nvme_subsystem_write_metadata(int subsystem_fd, sd_device *device) {
+@@ -265,7 +265,7 @@ static int nvme_subsystem_write_metadata(int subsystem_fd, sd_device *device) {
                  _cleanup_free_ char *truncated = strndup(w, 40); /* kernel refuses more than 40 chars (as per nvme spec) */
  
                  /* The default string stored in 'attr_model' is "Linux" btw. */
@@ -458,7 +438,7 @@ index ae63baaf79..82eeca479a 100644
                  if (r < 0)
                          log_warning_errno(r, "Failed to set model of subsystem to '%s', ignoring: %m", w);
          }
-@@ -268,7 +268,7 @@ static int nvme_subsystem_write_metadata(int subsystem_fd, sd_device *device) {
+@@ -279,7 +279,7 @@ static int nvme_subsystem_write_metadata(int subsystem_fd, sd_device *device) {
                          return log_oom();
  
                   /* The default string stored in 'attr_firmware' is `uname -r` btw, but truncated to 8 chars. */
@@ -467,7 +447,7 @@ index ae63baaf79..82eeca479a 100644
                  if (r < 0)
                          log_warning_errno(r, "Failed to set model of subsystem to '%s', ignoring: %m", truncated);
          }
-@@ -295,7 +295,7 @@ static int nvme_subsystem_write_metadata(int subsystem_fd, sd_device *device) {
+@@ -306,7 +306,7 @@ static int nvme_subsystem_write_metadata(int subsystem_fd, sd_device *device) {
                  if (!truncated)
                          return log_oom();
  
@@ -476,7 +456,7 @@ index ae63baaf79..82eeca479a 100644
                  if (r < 0)
                          log_warning_errno(r, "Failed to set serial of subsystem to '%s', ignoring: %m", truncated);
          }
-@@ -345,7 +345,7 @@ static int nvme_namespace_write_metadata(int namespace_fd, sd_device *device, co
+@@ -356,7 +356,7 @@ static int nvme_namespace_write_metadata(int namespace_fd, sd_device *device, co
                  id = id128_digest(j, l);
          }
  
@@ -485,7 +465,7 @@ index ae63baaf79..82eeca479a 100644
          if (r < 0)
                  log_warning_errno(r, "Failed to set uuid of namespace to '%s', ignoring: %m", SD_ID128_TO_UUID_STRING(id));
  
-@@ -408,7 +408,7 @@ static int nvme_subsystem_add(const char *node, int consumed_fd, sd_device *devi
+@@ -419,7 +419,7 @@ static int nvme_subsystem_add(const char *node, int consumed_fd, sd_device *devi
          if (subsystem_fd < 0)
                  return log_error_errno(subsystem_fd, "Failed to create NVME subsystem '%s': %m", j);
  
@@ -494,7 +474,7 @@ index ae63baaf79..82eeca479a 100644
          if (r < 0)
                  return log_error_errno(r, "Failed to set 'attr_allow_any_host' flag: %m");
  
-@@ -423,11 +423,11 @@ static int nvme_subsystem_add(const char *node, int consumed_fd, sd_device *devi
+@@ -434,11 +434,11 @@ static int nvme_subsystem_add(const char *node, int consumed_fd, sd_device *devi
  
          /* We use /proc/$PID/fd/$FD rather than /proc/self/fd/$FD, because this string is visible to others
           * via configfs, and by including the PID it's clear to who the stuff belongs. */
@@ -508,7 +488,7 @@ index ae63baaf79..82eeca479a 100644
          if (r < 0)
                  return log_error_errno(r, "Failed to write 'enable' attribute: %m");
  
-@@ -557,19 +557,19 @@ static int nvme_port_add_portnr(
+@@ -568,19 +568,19 @@ static int nvme_port_add_portnr(
                  return 0;
          }
  
@@ -532,23 +512,11 @@ index ae63baaf79..82eeca479a 100644
          if (r < 0)
                  return log_error_errno(r, "Failed to set IP address on NVME port %" PRIu16 ": %m", portnr);
  
-diff --git a/src/udev/udev-rules.c b/src/udev/udev-rules.c
-index febe345b4c..a90b610ba1 100644
---- a/src/udev/udev-rules.c
-+++ b/src/udev/udev-rules.c
-@@ -2711,7 +2711,6 @@ static int udev_rule_apply_token_to_event(
-                 log_event_debug(dev, token, "ATTR '%s' writing '%s'", buf, value);
-                 r = write_string_file(buf, value,
-                                       WRITE_STRING_FILE_VERIFY_ON_FAILURE |
--                                      WRITE_STRING_FILE_DISABLE_BUFFER |
-                                       WRITE_STRING_FILE_AVOID_NEWLINE |
-                                       WRITE_STRING_FILE_VERIFY_IGNORE_NEWLINE);
-                 if (r < 0)
 diff --git a/src/vconsole/vconsole-setup.c b/src/vconsole/vconsole-setup.c
-index 4d82c65f0a..3a3d861b83 100644
+index ba742dda69..6f20e81615 100644
 --- a/src/vconsole/vconsole-setup.c
 +++ b/src/vconsole/vconsole-setup.c
-@@ -261,7 +261,7 @@ static int toggle_utf8_vc(const char *name, int fd, bool utf8) {
+@@ -277,7 +277,7 @@ static int toggle_utf8_vc(const char *name, int fd, bool utf8) {
  static int toggle_utf8_sysfs(bool utf8) {
          int r;
  
diff --git a/meta/recipes-core/systemd/systemd/0013-Handle-__cpu_mask-usage.patch b/meta/recipes-core/systemd/systemd/0013-Handle-__cpu_mask-usage.patch
index 43f75373a6..35009cba42 100644
--- a/meta/recipes-core/systemd/systemd/0013-Handle-__cpu_mask-usage.patch
+++ b/meta/recipes-core/systemd/systemd/0013-Handle-__cpu_mask-usage.patch
@@ -1,7 +1,7 @@
-From 2f90f8463423cfbb7e83fcef42f1071018c3b56e Mon Sep 17 00:00:00 2001
+From ab4fda874b26542de96720db58cb0e8704a40108 Mon Sep 17 00:00:00 2001
 From: Scott Murray <scott.murray@konsulko.com>
 Date: Fri, 13 Sep 2019 19:26:27 -0400
-Subject: [PATCH 13/22] Handle __cpu_mask usage
+Subject: [PATCH 13/26] Handle __cpu_mask usage
 
 Fixes errors:
 
@@ -24,7 +24,7 @@ Signed-off-by: Scott Murray <scott.murray@konsulko.com>
  2 files changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/src/shared/cpu-set-util.h b/src/shared/cpu-set-util.h
-index 3c63a58826..4c2d4347fc 100644
+index 2c477d8a01..c026ce77a6 100644
 --- a/src/shared/cpu-set-util.h
 +++ b/src/shared/cpu-set-util.h
 @@ -6,6 +6,8 @@
diff --git a/meta/recipes-core/systemd/systemd/0014-Handle-missing-gshadow.patch b/meta/recipes-core/systemd/systemd/0014-Handle-missing-gshadow.patch
index a751e1ba6f..0aabae6d82 100644
--- a/meta/recipes-core/systemd/systemd/0014-Handle-missing-gshadow.patch
+++ b/meta/recipes-core/systemd/systemd/0014-Handle-missing-gshadow.patch
@@ -1,7 +1,7 @@
-From b7c827bb44edbb6251c9fcdb80aa03982c0e7bf3 Mon Sep 17 00:00:00 2001
+From c5165f6adf8a9cfe8c0784c598b87d7d7e8b7d1a Mon Sep 17 00:00:00 2001
 From: Alex Kiernan <alex.kiernan@gmail.com>
 Date: Tue, 10 Mar 2020 11:05:20 +0000
-Subject: [PATCH 14/22] Handle missing gshadow
+Subject: [PATCH 14/26] Handle missing gshadow
 
 gshadow usage is now present in the userdb code. Mask all uses of it to
 allow compilation on musl
@@ -17,10 +17,10 @@ Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com>
  3 files changed, 30 insertions(+), 1 deletion(-)
 
 diff --git a/src/shared/user-record-nss.c b/src/shared/user-record-nss.c
-index 414a49331b..1a4e1b628c 100644
+index 9223a2e6ca..f9eb1a5b64 100644
 --- a/src/shared/user-record-nss.c
 +++ b/src/shared/user-record-nss.c
-@@ -329,8 +329,10 @@ int nss_group_to_group_record(
+@@ -286,8 +286,10 @@ int nss_group_to_group_record(
          if (isempty(grp->gr_name))
                  return -EINVAL;
  
@@ -31,7 +31,7 @@ index 414a49331b..1a4e1b628c 100644
  
          g = group_record_new();
          if (!g)
-@@ -346,6 +348,7 @@ int nss_group_to_group_record(
+@@ -303,6 +305,7 @@ int nss_group_to_group_record(
  
          g->gid = grp->gr_gid;
  
@@ -39,15 +39,15 @@ index 414a49331b..1a4e1b628c 100644
          if (sgrp) {
                  if (looks_like_hashed_password(utf8_only(sgrp->sg_passwd))) {
                          g->hashed_password = strv_new(sgrp->sg_passwd);
-@@ -361,6 +364,7 @@ int nss_group_to_group_record(
+@@ -318,6 +321,7 @@ int nss_group_to_group_record(
                  if (r < 0)
                          return r;
          }
 +#endif
  
-         r = json_build(&g->json, JSON_BUILD_OBJECT(
-                                        JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING(g->group_name)),
-@@ -387,6 +391,7 @@ int nss_sgrp_for_group(const struct group *grp, struct sgrp *ret_sgrp, char **re
+         r = sd_json_buildo(
+                         &g->json,
+@@ -345,6 +349,7 @@ int nss_sgrp_for_group(const struct group *grp, struct sgrp *ret_sgrp, char **re
          assert(ret_sgrp);
          assert(ret_buffer);
  
@@ -55,7 +55,7 @@ index 414a49331b..1a4e1b628c 100644
          for (;;) {
                  _cleanup_free_ char *buf = NULL;
                  struct sgrp sgrp, *result;
-@@ -415,6 +420,9 @@ int nss_sgrp_for_group(const struct group *grp, struct sgrp *ret_sgrp, char **re
+@@ -373,6 +378,9 @@ int nss_sgrp_for_group(const struct group *grp, struct sgrp *ret_sgrp, char **re
                  buflen *= 2;
                  buf = mfree(buf);
          }
@@ -65,25 +65,25 @@ index 414a49331b..1a4e1b628c 100644
  }
  
  int nss_group_record_by_name(
-@@ -426,7 +434,9 @@ int nss_group_record_by_name(
-         struct group grp, *result;
+@@ -383,7 +391,9 @@ int nss_group_record_by_name(
+         _cleanup_free_ char *sbuf = NULL;
+         _cleanup_free_ struct group *result = NULL;
          bool incomplete = false;
-         size_t buflen = 4096;
 +#if ENABLE_GSHADOW
          struct sgrp sgrp, *sresult = NULL;
 +#endif
          int r;
  
          assert(name);
-@@ -455,6 +465,7 @@ int nss_group_record_by_name(
-                 buf = mfree(buf);
-         }
+@@ -392,6 +402,7 @@ int nss_group_record_by_name(
+         if (r < 0)
+                 return r;
  
 +#if ENABLE_GSHADOW
          if (with_shadow) {
                  r = nss_sgrp_for_group(result, &sgrp, &sbuf);
                  if (r < 0) {
-@@ -466,6 +477,9 @@ int nss_group_record_by_name(
+@@ -403,6 +414,9 @@ int nss_group_record_by_name(
                  incomplete = true;
  
          r = nss_group_to_group_record(result, sresult, ret);
@@ -93,25 +93,24 @@ index 414a49331b..1a4e1b628c 100644
          if (r < 0)
                  return r;
  
-@@ -483,7 +497,9 @@ int nss_group_record_by_gid(
-         struct group grp, *result;
+@@ -419,13 +433,16 @@ int nss_group_record_by_gid(
+         _cleanup_free_ char *sbuf = NULL;
+         _cleanup_free_ struct group *result = NULL;
          bool incomplete = false;
-         size_t buflen = 4096;
 +#if ENABLE_GSHADOW
          struct sgrp sgrp, *sresult = NULL;
 +#endif
          int r;
  
-         for (;;) {
-@@ -509,6 +525,7 @@ int nss_group_record_by_gid(
-                 buf = mfree(buf);
-         }
+         r = getgrgid_malloc(gid, &result);
+         if (r < 0)
+                 return r;
  
 +#if ENABLE_GSHADOW
          if (with_shadow) {
                  r = nss_sgrp_for_group(result, &sgrp, &sbuf);
                  if (r < 0) {
-@@ -520,6 +537,9 @@ int nss_group_record_by_gid(
+@@ -437,6 +454,9 @@ int nss_group_record_by_gid(
                  incomplete = true;
  
          r = nss_group_to_group_record(result, sresult, ret);
@@ -138,10 +137,10 @@ index 22ab04d6ee..4e52e7a911 100644
  #include <shadow.h>
  
 diff --git a/src/shared/userdb.c b/src/shared/userdb.c
-index f60d48ace4..e878199a28 100644
+index ff83d4bf90..54d36cc706 100644
 --- a/src/shared/userdb.c
 +++ b/src/shared/userdb.c
-@@ -1038,13 +1038,15 @@ int groupdb_iterator_get(UserDBIterator *iterator, GroupRecord **ret) {
+@@ -1042,13 +1042,15 @@ int groupdb_iterator_get(UserDBIterator *iterator, GroupRecord **ret) {
                  if (gr) {
                          _cleanup_free_ char *buffer = NULL;
                          bool incomplete = false;
@@ -158,7 +157,7 @@ index f60d48ace4..e878199a28 100644
                          if (!FLAGS_SET(iterator->flags, USERDB_SUPPRESS_SHADOW)) {
                                  r = nss_sgrp_for_group(gr, &sgrp, &buffer);
                                  if (r < 0) {
-@@ -1057,6 +1059,9 @@ int groupdb_iterator_get(UserDBIterator *iterator, GroupRecord **ret) {
+@@ -1061,6 +1063,9 @@ int groupdb_iterator_get(UserDBIterator *iterator, GroupRecord **ret) {
                          }
  
                          r = nss_group_to_group_record(gr, r >= 0 ? &sgrp : NULL, ret);
diff --git a/meta/recipes-core/systemd/systemd/0015-missing_syscall.h-Define-MIPS-ABI-defines-for-musl.patch b/meta/recipes-core/systemd/systemd/0015-missing_syscall.h-Define-MIPS-ABI-defines-for-musl.patch
index e112766a9b..1443c5082b 100644
--- a/meta/recipes-core/systemd/systemd/0015-missing_syscall.h-Define-MIPS-ABI-defines-for-musl.patch
+++ b/meta/recipes-core/systemd/systemd/0015-missing_syscall.h-Define-MIPS-ABI-defines-for-musl.patch
@@ -1,7 +1,7 @@
-From 3dc9d9d410bcce54fddfd94f43f7f77f3aa8e281 Mon Sep 17 00:00:00 2001
+From ef9ad83759f78de983d2d7c4f95bc48b83bb8f66 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Mon, 12 Apr 2021 23:44:53 -0700
-Subject: [PATCH 15/22] missing_syscall.h: Define MIPS ABI defines for musl
+Subject: [PATCH 15/26] missing_syscall.h: Define MIPS ABI defines for musl
 
 musl does not define _MIPS_SIM_ABI32, _MIPS_SIM_NABI32, _MIPS_SIM_ABI64
 unlike glibc where these are provided by libc headers, therefore define
@@ -15,8 +15,6 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  src/shared/base-filesystem.c | 1 +
  2 files changed, 7 insertions(+)
 
-diff --git a/src/basic/missing_syscall.h b/src/basic/missing_syscall.h
-index d795efd8f2..d6729d3c1d 100644
 --- a/src/basic/missing_syscall.h
 +++ b/src/basic/missing_syscall.h
 @@ -20,6 +20,12 @@
@@ -31,9 +29,7 @@ index d795efd8f2..d6729d3c1d 100644
 +
  #include "macro.h"
  #include "missing_keyctl.h"
- #include "missing_stat.h"
-diff --git a/src/shared/base-filesystem.c b/src/shared/base-filesystem.c
-index 7ae921a113..0ef9d1fd39 100644
+ #include "missing_sched.h"
 --- a/src/shared/base-filesystem.c
 +++ b/src/shared/base-filesystem.c
 @@ -20,6 +20,7 @@
@@ -42,8 +38,5 @@ index 7ae921a113..0ef9d1fd39 100644
  #include "user-util.h"
 +#include "missing_syscall.h"
  
- typedef struct BaseFilesystem {
-         const char *dir;      /* directory or symlink to create */
--- 
-2.34.1
-
+ typedef enum BaseFilesystemFlags {
+         BASE_FILESYSTEM_IGNORE_ON_FAILURE = 1 << 0,
diff --git a/meta/recipes-core/systemd/systemd/0016-pass-correct-parameters-to-getdents64.patch b/meta/recipes-core/systemd/systemd/0016-pass-correct-parameters-to-getdents64.patch
index 0be817e62d..b802106155 100644
--- a/meta/recipes-core/systemd/systemd/0016-pass-correct-parameters-to-getdents64.patch
+++ b/meta/recipes-core/systemd/systemd/0016-pass-correct-parameters-to-getdents64.patch
@@ -1,7 +1,7 @@
-From 0994b59dba9f248ad31cb7087046dc00b72cb4ea Mon Sep 17 00:00:00 2001
+From 9079b158779a9c395c24f882f72a1c734795045d Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Fri, 21 Jan 2022 15:15:11 -0800
-Subject: [PATCH 16/22] pass correct parameters to getdents64
+Subject: [PATCH 16/26] pass correct parameters to getdents64
 
 Fixes
 ../git/src/basic/recurse-dir.c:57:40: error: incompatible pointer types passing 'uint8_t *' (aka 'unsigned char *') to parameter of type 'struct dirent *' [-Werror,-Wincompatible-pointer-types]
@@ -20,10 +20,10 @@ Signed-off-by: Jiaqing Zhao <jiaqing.zhao@linux.intel.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/basic/recurse-dir.c b/src/basic/recurse-dir.c
-index 5e98b7a5d8..aef065047b 100644
+index 378fd92b06..5b567b457d 100644
 --- a/src/basic/recurse-dir.c
 +++ b/src/basic/recurse-dir.c
-@@ -55,7 +55,7 @@ int readdir_all(int dir_fd,
+@@ -56,7 +56,7 @@ int readdir_all(int dir_fd,
                  bs = MIN(MALLOC_SIZEOF_SAFE(de) - offsetof(DirectoryEntries, buffer), (size_t) SSIZE_MAX);
                  assert(bs > de->buffer_size);
  
diff --git a/meta/recipes-core/systemd/systemd/0017-Adjust-for-musl-headers.patch b/meta/recipes-core/systemd/systemd/0017-Adjust-for-musl-headers.patch
index 4176522a1c..5a2bc3c552 100644
--- a/meta/recipes-core/systemd/systemd/0017-Adjust-for-musl-headers.patch
+++ b/meta/recipes-core/systemd/systemd/0017-Adjust-for-musl-headers.patch
@@ -1,7 +1,7 @@
-From 3c094d443ca30f19114392fd8ef274af6eabc12d Mon Sep 17 00:00:00 2001
+From be9d8f221ab9d31c0df8b2b3e66172bb9bc0f71f Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Fri, 21 Jan 2022 22:19:37 -0800
-Subject: [PATCH 17/22] Adjust for musl headers
+Subject: [PATCH 17/26] Adjust for musl headers
 
 Upstream-Status: Inappropriate [musl specific]
 
@@ -10,11 +10,12 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
 [Rebased for v255.1]
 Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
 ---
+ src/basic/linux/ethtool.h                     | 3 ++-
  src/libsystemd-network/sd-dhcp6-client.c      | 2 +-
  src/network/netdev/bareudp.c                  | 2 +-
  src/network/netdev/batadv.c                   | 2 +-
  src/network/netdev/bond.c                     | 2 +-
- src/network/netdev/bridge.c                   | 2 +-
+ src/network/netdev/bridge.c                   | 3 ++-
  src/network/netdev/dummy.c                    | 2 +-
  src/network/netdev/geneve.c                   | 2 +-
  src/network/netdev/ifb.c                      | 2 +-
@@ -34,7 +35,6 @@ Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
  src/network/netdev/vxlan.c                    | 2 +-
  src/network/netdev/wireguard.c                | 2 +-
  src/network/netdev/xfrm.c                     | 2 +-
- src/network/networkd-bridge-mdb.c             | 4 ++--
  src/network/networkd-dhcp-common.c            | 3 ++-
  src/network/networkd-dhcp-prefix-delegation.c | 3 ++-
  src/network/networkd-dhcp-server.c            | 2 +-
@@ -42,16 +42,28 @@ Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
  src/network/networkd-ipv6ll.c                 | 2 +-
  src/network/networkd-link.c                   | 2 +-
  src/network/networkd-ndisc.c                  | 2 +-
- src/network/networkd-route.c                  | 8 ++++----
  src/network/networkd-setlink.c                | 2 +-
  src/network/networkd-sysctl.c                 | 2 +-
- src/shared/linux/ethtool.h                    | 3 ++-
  src/shared/netif-util.c                       | 2 +-
  src/udev/udev-builtin-net_id.c                | 2 +-
- 38 files changed, 45 insertions(+), 42 deletions(-)
+ 36 files changed, 40 insertions(+), 36 deletions(-)
 
+diff --git a/src/basic/linux/ethtool.h b/src/basic/linux/ethtool.h
+index a32293ba20..2aad67e9c0 100644
+--- a/src/basic/linux/ethtool.h
++++ b/src/basic/linux/ethtool.h
+@@ -16,7 +16,8 @@
+ 
+ #include <linux/const.h>
+ #include <linux/types.h>
+-#include <linux/if_ether.h>
++#include <netinet/if_ether.h>
++//#include <linux/if_ether.h>
+ 
+ #include <limits.h> /* for INT_MAX */
+ 
 diff --git a/src/libsystemd-network/sd-dhcp6-client.c b/src/libsystemd-network/sd-dhcp6-client.c
-index c20367dfc9..b8d4cd8c2a 100644
+index 3e992d7cad..c7e1ff4dbf 100644
 --- a/src/libsystemd-network/sd-dhcp6-client.c
 +++ b/src/libsystemd-network/sd-dhcp6-client.c
 @@ -5,7 +5,7 @@
@@ -64,7 +76,7 @@ index c20367dfc9..b8d4cd8c2a 100644
  
  #include "sd-dhcp6-client.h"
 diff --git a/src/network/netdev/bareudp.c b/src/network/netdev/bareudp.c
-index 1df886573b..c8b6714726 100644
+index e122abd97f..c120c2969b 100644
 --- a/src/network/netdev/bareudp.c
 +++ b/src/network/netdev/bareudp.c
 @@ -2,7 +2,7 @@
@@ -77,7 +89,7 @@ index 1df886573b..c8b6714726 100644
  #include "bareudp.h"
  #include "netlink-util.h"
 diff --git a/src/network/netdev/batadv.c b/src/network/netdev/batadv.c
-index 26da0231d4..2e8002af8c 100644
+index 9806d8eb7c..19c3d881c2 100644
 --- a/src/network/netdev/batadv.c
 +++ b/src/network/netdev/batadv.c
 @@ -3,7 +3,7 @@
@@ -90,7 +102,7 @@ index 26da0231d4..2e8002af8c 100644
  #include "batadv.h"
  #include "fileio.h"
 diff --git a/src/network/netdev/bond.c b/src/network/netdev/bond.c
-index 4d75a0d6bf..985b3197e0 100644
+index b866940b7a..a0eaf0a866 100644
 --- a/src/network/netdev/bond.c
 +++ b/src/network/netdev/bond.c
 @@ -1,7 +1,7 @@
@@ -103,20 +115,21 @@ index 4d75a0d6bf..985b3197e0 100644
  #include "alloc-util.h"
  #include "bond.h"
 diff --git a/src/network/netdev/bridge.c b/src/network/netdev/bridge.c
-index 3e394edadf..f12f667687 100644
+index d3ba4989d9..4f7301c4f1 100644
 --- a/src/network/netdev/bridge.c
 +++ b/src/network/netdev/bridge.c
-@@ -2,7 +2,7 @@
+@@ -2,7 +2,8 @@
  
+ /* Make sure the net/if.h header is included before any linux/ one */
  #include <net/if.h>
- #include <netinet/in.h>
 -#include <linux/if_arp.h>
++#include <netinet/in.h>
 +//#include <linux/if_arp.h>
  #include <linux/if_bridge.h>
+ #include <netinet/in.h>
  
- #include "bridge.h"
 diff --git a/src/network/netdev/dummy.c b/src/network/netdev/dummy.c
-index 00df1d2787..77b506b422 100644
+index 8b2893d5b4..412123f036 100644
 --- a/src/network/netdev/dummy.c
 +++ b/src/network/netdev/dummy.c
 @@ -1,6 +1,6 @@
@@ -128,18 +141,18 @@ index 00df1d2787..77b506b422 100644
  #include "dummy.h"
  
 diff --git a/src/network/netdev/geneve.c b/src/network/netdev/geneve.c
-index bc655ec7ff..a77e8e17e4 100644
+index 1d68be9bc8..539151c49e 100644
 --- a/src/network/netdev/geneve.c
 +++ b/src/network/netdev/geneve.c
 @@ -2,7 +2,7 @@
  
+ /* Make sure the net/if.h header is included before any linux/ one */
  #include <net/if.h>
- #include <netinet/in.h>
 -#include <linux/if_arp.h>
 +//#include <linux/if_arp.h>
+ #include <netinet/in.h>
  
  #include "alloc-util.h"
- #include "conf-parser.h"
 diff --git a/src/network/netdev/ifb.c b/src/network/netdev/ifb.c
 index d7ff44cb9e..e037629ae4 100644
 --- a/src/network/netdev/ifb.c
@@ -154,7 +167,7 @@ index d7ff44cb9e..e037629ae4 100644
  #include "ifb.h"
  
 diff --git a/src/network/netdev/ipoib.c b/src/network/netdev/ipoib.c
-index d5fe299b7b..c9c8002eac 100644
+index 6932c62e2a..fc458da9e8 100644
 --- a/src/network/netdev/ipoib.c
 +++ b/src/network/netdev/ipoib.c
 @@ -1,6 +1,6 @@
@@ -166,11 +179,11 @@ index d5fe299b7b..c9c8002eac 100644
  
  #include "ipoib.h"
 diff --git a/src/network/netdev/ipvlan.c b/src/network/netdev/ipvlan.c
-index 05d5d010f6..d440f49537 100644
+index 6e50f72aaa..49acfee25e 100644
 --- a/src/network/netdev/ipvlan.c
 +++ b/src/network/netdev/ipvlan.c
-@@ -2,7 +2,7 @@
- 
+@@ -3,7 +3,7 @@
+ /* Make sure the net/if.h header is included before any linux/ one */
  #include <net/if.h>
  #include <netinet/in.h>
 -#include <linux/if_arp.h>
@@ -179,7 +192,7 @@ index 05d5d010f6..d440f49537 100644
  #include "conf-parser.h"
  #include "ipvlan.h"
 diff --git a/src/network/netdev/macsec.c b/src/network/netdev/macsec.c
-index 17d6acefb6..679d0984f9 100644
+index 6dd434f803..f9fbe9f51a 100644
 --- a/src/network/netdev/macsec.c
 +++ b/src/network/netdev/macsec.c
 @@ -1,7 +1,7 @@
@@ -192,11 +205,11 @@ index 17d6acefb6..679d0984f9 100644
  #include <linux/if_macsec.h>
  #include <linux/genetlink.h>
 diff --git a/src/network/netdev/macvlan.c b/src/network/netdev/macvlan.c
-index 203807e3a5..8ab09a387e 100644
+index fd112b58e1..b038740bda 100644
 --- a/src/network/netdev/macvlan.c
 +++ b/src/network/netdev/macvlan.c
-@@ -2,7 +2,7 @@
- 
+@@ -3,7 +3,7 @@
+ /* Make sure the net/if.h header is included before any linux/ one */
  #include <net/if.h>
  #include <netinet/in.h>
 -#include <linux/if_arp.h>
@@ -205,11 +218,11 @@ index 203807e3a5..8ab09a387e 100644
  #include "conf-parser.h"
  #include "macvlan.h"
 diff --git a/src/network/netdev/netdev.c b/src/network/netdev/netdev.c
-index 57127a861a..7f787d0b9f 100644
+index c2986aafb5..147f1c95d0 100644
 --- a/src/network/netdev/netdev.c
 +++ b/src/network/netdev/netdev.c
-@@ -2,7 +2,7 @@
- 
+@@ -3,7 +3,7 @@
+ /* Make sure the net/if.h header is included before any linux/ one */
  #include <net/if.h>
  #include <netinet/in.h>
 -#include <linux/if_arp.h>
@@ -218,7 +231,7 @@ index 57127a861a..7f787d0b9f 100644
  
  #include "alloc-util.h"
 diff --git a/src/network/netdev/netdevsim.c b/src/network/netdev/netdevsim.c
-index 15d5c132f9..a3ffa48b15 100644
+index 59958c3bbe..61169016b0 100644
 --- a/src/network/netdev/netdevsim.c
 +++ b/src/network/netdev/netdevsim.c
 @@ -1,6 +1,6 @@
@@ -242,7 +255,7 @@ index ff372092e6..eef66811f4 100644
  #include "nlmon.h"
  
 diff --git a/src/network/netdev/tunnel.c b/src/network/netdev/tunnel.c
-index db84e7cf6e..93d5642962 100644
+index af05cfda81..f659bed3a6 100644
 --- a/src/network/netdev/tunnel.c
 +++ b/src/network/netdev/tunnel.c
 @@ -2,7 +2,7 @@
@@ -267,46 +280,47 @@ index 380547ee1e..137c1adf8a 100644
  #include "vcan.h"
  
 diff --git a/src/network/netdev/veth.c b/src/network/netdev/veth.c
-index e0f5b4ebb1..8a424ed03d 100644
+index 54d3b59734..f3f75e22b5 100644
 --- a/src/network/netdev/veth.c
 +++ b/src/network/netdev/veth.c
 @@ -3,7 +3,7 @@
- #include <errno.h>
+ /* Make sure the net/if.h header is included before any linux/ one */
  #include <net/if.h>
- #include <netinet/in.h>
+ #include <errno.h>
 -#include <linux/if_arp.h>
 +//#include <linux/if_arp.h>
  #include <linux/veth.h>
+ #include <netinet/in.h>
  
- #include "netlink-util.h"
 diff --git a/src/network/netdev/vlan.c b/src/network/netdev/vlan.c
-index 2390206993..efec630e30 100644
+index 60e49a5b8a..266fd58813 100644
 --- a/src/network/netdev/vlan.c
 +++ b/src/network/netdev/vlan.c
-@@ -2,7 +2,7 @@
- 
- #include <errno.h>
+@@ -3,7 +3,7 @@
+ /* Make sure the net/if.h header is included before any linux/ one */
  #include <net/if.h>
+ #include <errno.h>
 -#include <linux/if_arp.h>
 +//#include <linux/if_arp.h>
  #include <linux/if_vlan.h>
  
  #include "parse-util.h"
 diff --git a/src/network/netdev/vrf.c b/src/network/netdev/vrf.c
-index b75ec2bcc6..6aeeea640b 100644
+index c35419f859..4d1d3ef141 100644
 --- a/src/network/netdev/vrf.c
 +++ b/src/network/netdev/vrf.c
-@@ -2,7 +2,7 @@
+@@ -2,8 +2,8 @@
  
+ /* Make sure the net/if.h header is included before any linux/ one */
  #include <net/if.h>
- #include <netinet/in.h>
 -#include <linux/if_arp.h>
+ #include <netinet/in.h>
 +//#include <linux/if_arp.h>
  
  #include "vrf.h"
  
 diff --git a/src/network/netdev/vxcan.c b/src/network/netdev/vxcan.c
-index c0343f45b6..f9e718f40b 100644
+index 2de89b8e24..ce1b8f9b69 100644
 --- a/src/network/netdev/vxcan.c
 +++ b/src/network/netdev/vxcan.c
 @@ -1,7 +1,7 @@
@@ -319,11 +333,11 @@ index c0343f45b6..f9e718f40b 100644
  #include "vxcan.h"
  
 diff --git a/src/network/netdev/vxlan.c b/src/network/netdev/vxlan.c
-index b11fdbbd0d..a971a917f0 100644
+index d8a066370d..8f94eeb763 100644
 --- a/src/network/netdev/vxlan.c
 +++ b/src/network/netdev/vxlan.c
-@@ -2,7 +2,7 @@
- 
+@@ -3,7 +3,7 @@
+ /* Make sure the net/if.h header is included before any linux/ one */
  #include <net/if.h>
  #include <netinet/in.h>
 -#include <linux/if_arp.h>
@@ -332,18 +346,18 @@ index b11fdbbd0d..a971a917f0 100644
  #include "conf-parser.h"
  #include "alloc-util.h"
 diff --git a/src/network/netdev/wireguard.c b/src/network/netdev/wireguard.c
-index 4c7d837c41..6df6dfb816 100644
+index 8d1dddf828..5182783f45 100644
 --- a/src/network/netdev/wireguard.c
 +++ b/src/network/netdev/wireguard.c
-@@ -6,7 +6,7 @@
- #include <sys/ioctl.h>
+@@ -5,7 +5,7 @@
+ 
+ /* Make sure the net/if.h header is included before any linux/ one */
  #include <net/if.h>
- #include <netinet/in.h>
 -#include <linux/if_arp.h>
 +//#include <linux/if_arp.h>
  #include <linux/ipv6_route.h>
- 
- #include "sd-resolve.h"
+ #include <netinet/in.h>
+ #include <sys/ioctl.h>
 diff --git a/src/network/netdev/xfrm.c b/src/network/netdev/xfrm.c
 index 905bfc0bdf..39e34dbb3b 100644
 --- a/src/network/netdev/xfrm.c
@@ -356,29 +370,8 @@ index 905bfc0bdf..39e34dbb3b 100644
  
  #include "missing_network.h"
  #include "xfrm.h"
-diff --git a/src/network/networkd-bridge-mdb.c b/src/network/networkd-bridge-mdb.c
-index bd1a9745dc..949d3da029 100644
---- a/src/network/networkd-bridge-mdb.c
-+++ b/src/network/networkd-bridge-mdb.c
-@@ -1,7 +1,5 @@
- /* SPDX-License-Identifier: LGPL-2.1-or-later */
- 
--#include <net/if.h>
--#include <linux/if_bridge.h>
- 
- #include "netlink-util.h"
- #include "networkd-bridge-mdb.h"
-@@ -11,6 +9,8 @@
- #include "networkd-queue.h"
- #include "string-util.h"
- #include "vlan-util.h"
-+#include <net/if.h>
-+#include <linux/if_bridge.h>
- 
- #define STATIC_BRIDGE_MDB_ENTRIES_PER_NETWORK_MAX 1024U
- 
 diff --git a/src/network/networkd-dhcp-common.c b/src/network/networkd-dhcp-common.c
-index 080b15387c..efe8283957 100644
+index 8b64dfe8f0..caa2885728 100644
 --- a/src/network/networkd-dhcp-common.c
 +++ b/src/network/networkd-dhcp-common.c
 @@ -1,7 +1,8 @@
@@ -392,7 +385,7 @@ index 080b15387c..efe8283957 100644
  #include "bus-error.h"
  #include "bus-locator.h"
 diff --git a/src/network/networkd-dhcp-prefix-delegation.c b/src/network/networkd-dhcp-prefix-delegation.c
-index af2fe9efcd..511565700f 100644
+index 16426de981..3d8efc05f1 100644
 --- a/src/network/networkd-dhcp-prefix-delegation.c
 +++ b/src/network/networkd-dhcp-prefix-delegation.c
 @@ -1,6 +1,5 @@
@@ -402,7 +395,7 @@ index af2fe9efcd..511565700f 100644
  
  #include "dhcp6-lease-internal.h"
  #include "hashmap.h"
-@@ -20,6 +19,8 @@
+@@ -21,6 +20,8 @@
  #include "strv.h"
  #include "tunnel.h"
  
@@ -412,7 +405,7 @@ index af2fe9efcd..511565700f 100644
          assert(link);
  
 diff --git a/src/network/networkd-dhcp-server.c b/src/network/networkd-dhcp-server.c
-index 607fe0053c..9ce4005874 100644
+index c35102af74..3be469ae16 100644
 --- a/src/network/networkd-dhcp-server.c
 +++ b/src/network/networkd-dhcp-server.c
 @@ -1,7 +1,7 @@
@@ -425,7 +418,7 @@ index 607fe0053c..9ce4005874 100644
  
  #include "sd-dhcp-server.h"
 diff --git a/src/network/networkd-dhcp4.c b/src/network/networkd-dhcp4.c
-index efbae6d868..1ea2151d50 100644
+index d94ac1a213..b8fe82cb6a 100644
 --- a/src/network/networkd-dhcp4.c
 +++ b/src/network/networkd-dhcp4.c
 @@ -3,7 +3,7 @@
@@ -436,9 +429,9 @@ index efbae6d868..1ea2151d50 100644
 +//#include <linux/if_arp.h>
  
  #include "alloc-util.h"
- #include "dhcp-client-internal.h"
+ #include "device-private.h"
 diff --git a/src/network/networkd-ipv6ll.c b/src/network/networkd-ipv6ll.c
-index 32229a3fc7..662a345d6e 100644
+index 04f51ab530..c4580754f7 100644
 --- a/src/network/networkd-ipv6ll.c
 +++ b/src/network/networkd-ipv6ll.c
 @@ -1,7 +1,7 @@
@@ -451,10 +444,10 @@ index 32229a3fc7..662a345d6e 100644
  #include "in-addr-util.h"
  #include "networkd-address.h"
 diff --git a/src/network/networkd-link.c b/src/network/networkd-link.c
-index ee5f0f2c0a..ea5269a2de 100644
+index 3c042e6c18..05fe2cb900 100644
 --- a/src/network/networkd-link.c
 +++ b/src/network/networkd-link.c
-@@ -3,7 +3,7 @@
+@@ -4,7 +4,7 @@
  #include <net/if.h>
  #include <netinet/in.h>
  #include <linux/if.h>
@@ -464,7 +457,7 @@ index ee5f0f2c0a..ea5269a2de 100644
  #include <linux/netdevice.h>
  #include <sys/socket.h>
 diff --git a/src/network/networkd-ndisc.c b/src/network/networkd-ndisc.c
-index ab9eeb13a5..dd96fe7483 100644
+index 33e86fb04e..51292871fc 100644
 --- a/src/network/networkd-ndisc.c
 +++ b/src/network/networkd-ndisc.c
 @@ -6,7 +6,7 @@
@@ -476,33 +469,8 @@ index ab9eeb13a5..dd96fe7483 100644
  
  #include "sd-ndisc.h"
  
-diff --git a/src/network/networkd-route.c b/src/network/networkd-route.c
-index 7218d799fc..30d5574eae 100644
---- a/src/network/networkd-route.c
-+++ b/src/network/networkd-route.c
-@@ -1,9 +1,5 @@
- /* SPDX-License-Identifier: LGPL-2.1-or-later */
- 
--#include <linux/icmpv6.h>
--#include <linux/ipv6_route.h>
--#include <linux/nexthop.h>
--
- #include "alloc-util.h"
- #include "event-util.h"
- #include "netlink-util.h"
-@@ -21,6 +17,10 @@
- #include "vrf.h"
- #include "wireguard.h"
- 
-+#include <linux/icmpv6.h>
-+#include <linux/ipv6_route.h>
-+#include <linux/nexthop.h>
-+
- int route_new(Route **ret) {
-         _cleanup_(route_freep) Route *route = NULL;
- 
 diff --git a/src/network/networkd-setlink.c b/src/network/networkd-setlink.c
-index 2298f9ea3a..7d5f87de53 100644
+index 8519e6e7a0..7aca2bbecc 100644
 --- a/src/network/networkd-setlink.c
 +++ b/src/network/networkd-setlink.c
 @@ -2,7 +2,7 @@
@@ -512,10 +480,10 @@ index 2298f9ea3a..7d5f87de53 100644
 -#include <linux/if_arp.h>
 +//#include <linux/if_arp.h>
  #include <linux/if_bridge.h>
+ #include <linux/ipv6.h>
  
- #include "missing_network.h"
 diff --git a/src/network/networkd-sysctl.c b/src/network/networkd-sysctl.c
-index 2b226b2e2a..f12a474e2f 100644
+index 10a35bc44b..84c6b68ee4 100644
 --- a/src/network/networkd-sysctl.c
 +++ b/src/network/networkd-sysctl.c
 @@ -2,7 +2,7 @@
@@ -525,24 +493,10 @@ index 2b226b2e2a..f12a474e2f 100644
 -#include <linux/if_arp.h>
 +//#include <linux/if_arp.h>
  
- #include "missing_network.h"
- #include "networkd-link.h"
-diff --git a/src/shared/linux/ethtool.h b/src/shared/linux/ethtool.h
-index 3d1da515c0..3fca9a4faf 100644
---- a/src/shared/linux/ethtool.h
-+++ b/src/shared/linux/ethtool.h
-@@ -16,7 +16,8 @@
- 
- #include <linux/const.h>
- #include <linux/types.h>
--#include <linux/if_ether.h>
-+#include <netinet/if_ether.h>
-+//#include <linux/if_ether.h>
- 
- #include <limits.h> /* for INT_MAX */
+ #include "sd-messages.h"
  
 diff --git a/src/shared/netif-util.c b/src/shared/netif-util.c
-index f56c5646c1..5af28ff119 100644
+index 978ce42341..899b5f613f 100644
 --- a/src/shared/netif-util.c
 +++ b/src/shared/netif-util.c
 @@ -1,7 +1,7 @@
@@ -555,10 +509,10 @@ index f56c5646c1..5af28ff119 100644
  #include "arphrd-util.h"
  #include "device-util.h"
 diff --git a/src/udev/udev-builtin-net_id.c b/src/udev/udev-builtin-net_id.c
-index f528a46b8e..830318cda5 100644
+index 09c04b9a7f..4686897dbf 100644
 --- a/src/udev/udev-builtin-net_id.c
 +++ b/src/udev/udev-builtin-net_id.c
-@@ -18,7 +18,7 @@
+@@ -19,7 +19,7 @@
  #include <stdarg.h>
  #include <unistd.h>
  #include <linux/if.h>
diff --git a/meta/recipes-core/systemd/systemd/0018-test-bus-error-strerror-is-assumed-to-be-GNU-specifi.patch b/meta/recipes-core/systemd/systemd/0018-test-bus-error-strerror-is-assumed-to-be-GNU-specifi.patch
index 75f6b9094a..a92b8cc80f 100644
--- a/meta/recipes-core/systemd/systemd/0018-test-bus-error-strerror-is-assumed-to-be-GNU-specifi.patch
+++ b/meta/recipes-core/systemd/systemd/0018-test-bus-error-strerror-is-assumed-to-be-GNU-specifi.patch
@@ -1,7 +1,7 @@
-From be02bd0876a061728661535a709d313e39fe1ac3 Mon Sep 17 00:00:00 2001
+From 349f9a0f9ecfc6575a3d9eeaffe89536e6a43914 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Tue, 8 Nov 2022 13:31:34 -0800
-Subject: [PATCH 18/22] test-bus-error: strerror() is assumed to be GNU
+Subject: [PATCH 18/26] test-bus-error: strerror() is assumed to be GNU
  specific version mark it so
 
 Upstream-Status: Inappropriate [Upstream systemd only supports glibc]
@@ -13,7 +13,7 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  2 files changed, 4 insertions(+), 1 deletion(-)
 
 diff --git a/src/libsystemd/sd-bus/test-bus-error.c b/src/libsystemd/sd-bus/test-bus-error.c
-index a55f3f9856..4123bf3da0 100644
+index 91045c06c2..a06b9bac0c 100644
 --- a/src/libsystemd/sd-bus/test-bus-error.c
 +++ b/src/libsystemd/sd-bus/test-bus-error.c
 @@ -99,7 +99,9 @@ TEST(error) {
@@ -27,7 +27,7 @@ index a55f3f9856..4123bf3da0 100644
          assert_se(sd_bus_error_get_errno(&error) == EBUSY);
          assert_se(sd_bus_error_is_set(&error));
 diff --git a/src/test/test-errno-util.c b/src/test/test-errno-util.c
-index 376d532281..967cfd4d67 100644
+index ab463bd1b3..e2ebcaaf33 100644
 --- a/src/test/test-errno-util.c
 +++ b/src/test/test-errno-util.c
 @@ -4,7 +4,7 @@
diff --git a/meta/recipes-core/systemd/systemd/0019-errno-util-Make-STRERROR-portable-for-musl.patch b/meta/recipes-core/systemd/systemd/0019-errno-util-Make-STRERROR-portable-for-musl.patch
index e038b73678..56083cc7b3 100644
--- a/meta/recipes-core/systemd/systemd/0019-errno-util-Make-STRERROR-portable-for-musl.patch
+++ b/meta/recipes-core/systemd/systemd/0019-errno-util-Make-STRERROR-portable-for-musl.patch
@@ -1,7 +1,7 @@
-From 46d80840bfe37e67d4f18c37a77751ea1fe63a07 Mon Sep 17 00:00:00 2001
+From 28fa1d5f56c6ddee9e336e6f2051c55e9f2f98b4 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Mon, 23 Jan 2023 23:39:46 -0800
-Subject: [PATCH 19/22] errno-util: Make STRERROR portable for musl
+Subject: [PATCH 19/26] errno-util: Make STRERROR portable for musl
 
 Sadly, systemd has decided to use yet another GNU extention in a macro
 lets make this such that we can use XSI compliant strerror_r() for
@@ -11,11 +11,11 @@ Upstream-Status: Inappropriate [musl specific]
 
 Signed-off-by: Khem Raj <raj.khem@gmail.com>
 ---
- src/basic/errno-util.h | 12 ++++++++++--
- 1 file changed, 10 insertions(+), 2 deletions(-)
+ src/basic/errno-util.h | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
 
 diff --git a/src/basic/errno-util.h b/src/basic/errno-util.h
-index 27804e6382..274c1c6ef1 100644
+index 48b76e4bf7..6e7653e2d9 100644
 --- a/src/basic/errno-util.h
 +++ b/src/basic/errno-util.h
 @@ -15,8 +15,16 @@
@@ -23,9 +23,8 @@ index 27804e6382..274c1c6ef1 100644
   *
   * Note that we use the GNU variant of strerror_r() here. */
 -#define STRERROR(errnum) strerror_r(abs(errnum), (char[ERRNO_BUF_LEN]){}, ERRNO_BUF_LEN)
--
 +static inline const char * STRERROR(int errnum);
-+
+ 
 +static inline const char * STRERROR(int errnum) {
 +#ifdef __GLIBC__
 +        return strerror_r(abs(errnum), (char[ERRNO_BUF_LEN]){}, ERRNO_BUF_LEN);
diff --git a/meta/recipes-core/systemd/systemd/0020-sd-event-Make-malloc_trim-conditional-on-glibc.patch b/meta/recipes-core/systemd/systemd/0020-sd-event-Make-malloc_trim-conditional-on-glibc.patch
index b83fffe793..16df44cd86 100644
--- a/meta/recipes-core/systemd/systemd/0020-sd-event-Make-malloc_trim-conditional-on-glibc.patch
+++ b/meta/recipes-core/systemd/systemd/0020-sd-event-Make-malloc_trim-conditional-on-glibc.patch
@@ -1,7 +1,7 @@
-From 9eb4867b4e2dbdb2484ae854022aff97e2f0feb3 Mon Sep 17 00:00:00 2001
+From 66de8a53849f76f5596327c38ae5f002b9f534cd Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Wed, 2 Aug 2023 12:06:27 -0700
-Subject: [PATCH 20/22] sd-event: Make malloc_trim() conditional on glibc
+Subject: [PATCH 20/26] sd-event: Make malloc_trim() conditional on glibc
 
 musl does not have this API
 
@@ -12,10 +12,10 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/src/libsystemd/sd-event/sd-event.c b/src/libsystemd/sd-event/sd-event.c
-index 288798a0dc..6419a7f216 100644
+index 7aea7d2581..d3f4001f53 100644
 --- a/src/libsystemd/sd-event/sd-event.c
 +++ b/src/libsystemd/sd-event/sd-event.c
-@@ -1874,7 +1874,7 @@ _public_ int sd_event_add_exit(
+@@ -1881,7 +1881,7 @@ _public_ int sd_event_add_exit(
  }
  
  _public_ int sd_event_trim_memory(void) {
@@ -24,7 +24,7 @@ index 288798a0dc..6419a7f216 100644
  
          /* A default implementation of a memory pressure callback. Simply releases our own allocation caches
           * and glibc's. This is automatically used when people call sd_event_add_memory_pressure() with a
-@@ -1888,7 +1888,9 @@ _public_ int sd_event_trim_memory(void) {
+@@ -1895,7 +1895,9 @@ _public_ int sd_event_trim_memory(void) {
  
          usec_t before_timestamp = now(CLOCK_MONOTONIC);
          hashmap_trim_pools();
diff --git a/meta/recipes-core/systemd/systemd/0021-shared-Do-not-use-malloc_info-on-musl.patch b/meta/recipes-core/systemd/systemd/0021-shared-Do-not-use-malloc_info-on-musl.patch
index 7eff069bb7..7ab56ef8fb 100644
--- a/meta/recipes-core/systemd/systemd/0021-shared-Do-not-use-malloc_info-on-musl.patch
+++ b/meta/recipes-core/systemd/systemd/0021-shared-Do-not-use-malloc_info-on-musl.patch
@@ -1,7 +1,7 @@
-From 502597b9ddd6b145541b23fadca0b1d3ca9f6367 Mon Sep 17 00:00:00 2001
+From 93d13363c605fb2de484f38f3726f8fbad1c3540 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Wed, 2 Aug 2023 12:20:40 -0700
-Subject: [PATCH 21/22] shared: Do not use malloc_info on musl
+Subject: [PATCH 21/26] shared: Do not use malloc_info on musl
 
 Upstream-Status: Inappropriate [musl-specific]
 Signed-off-by: Khem Raj <raj.khem@gmail.com>
@@ -11,10 +11,10 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  2 files changed, 5 insertions(+), 4 deletions(-)
 
 diff --git a/src/shared/bus-util.c b/src/shared/bus-util.c
-index 74f148c8b4..2d862a123d 100644
+index ff80e580fc..a628a29d0c 100644
 --- a/src/shared/bus-util.c
 +++ b/src/shared/bus-util.c
-@@ -611,15 +611,16 @@ static int method_dump_memory_state_by_fd(sd_bus_message *message, void *userdat
+@@ -787,15 +787,16 @@ static int method_dump_memory_state_by_fd(sd_bus_message *message, void *userdat
          _cleanup_close_ int fd = -EBADF;
          size_t dump_size;
          FILE *f;
diff --git a/meta/recipes-core/systemd/systemd/0022-avoid-missing-LOCK_EX-declaration.patch b/meta/recipes-core/systemd/systemd/0022-avoid-missing-LOCK_EX-declaration.patch
index 24f3bf74a0..d06967f8d5 100644
--- a/meta/recipes-core/systemd/systemd/0022-avoid-missing-LOCK_EX-declaration.patch
+++ b/meta/recipes-core/systemd/systemd/0022-avoid-missing-LOCK_EX-declaration.patch
@@ -1,7 +1,7 @@
-From fd52f1764647e03a35e8f0ed0ef952049073ccbd Mon Sep 17 00:00:00 2001
+From 5b8df64993b68a5a4af0f214d8cae77f4e716593 Mon Sep 17 00:00:00 2001
 From: Chen Qi <Qi.Chen@windriver.com>
 Date: Tue, 2 Jan 2024 11:03:27 +0800
-Subject: [PATCH 22/22] avoid missing LOCK_EX declaration
+Subject: [PATCH 22/26] avoid missing LOCK_EX declaration
 
 This only happens on MUSL. Include sys/file.h to avoid compilation
 error about missing LOCK_EX declaration.
@@ -10,15 +10,28 @@ Upstream-Status: Inappropriate [musl specific]
 
 Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
 ---
+ src/basic/fd-util.h    | 1 +
  src/core/exec-invoke.c | 1 +
  src/shared/dev-setup.h | 1 +
- 2 files changed, 2 insertions(+)
+ 3 files changed, 3 insertions(+)
 
+diff --git a/src/basic/fd-util.h b/src/basic/fd-util.h
+index 93b254c680..5f0b1a816d 100644
+--- a/src/basic/fd-util.h
++++ b/src/basic/fd-util.h
+@@ -6,6 +6,7 @@
+ #include <stdbool.h>
+ #include <stdio.h>
+ #include <sys/socket.h>
++#include <sys/file.h>
+ 
+ #include "macro.h"
+ #include "missing_fcntl.h"
 diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c
-index 70d963e269..7084811439 100644
+index 9d636f5529..6be43caa57 100644
 --- a/src/core/exec-invoke.c
 +++ b/src/core/exec-invoke.c
-@@ -4,6 +4,7 @@
+@@ -5,6 +5,7 @@
  #include <sys/ioctl.h>
  #include <sys/mount.h>
  #include <sys/prctl.h>
@@ -27,7 +40,7 @@ index 70d963e269..7084811439 100644
  #if HAVE_PAM
  #include <security/pam_appl.h>
 diff --git a/src/shared/dev-setup.h b/src/shared/dev-setup.h
-index 5339bc4e5e..0697495f23 100644
+index 92ba6cf764..ba01a0ae55 100644
 --- a/src/shared/dev-setup.h
 +++ b/src/shared/dev-setup.h
 @@ -2,6 +2,7 @@
@@ -36,7 +49,7 @@ index 5339bc4e5e..0697495f23 100644
  #include <sys/types.h>
 +#include <sys/file.h>
  
- int lock_dev_console(void);
+ int dev_setup(const char *prefix, uid_t uid, gid_t gid);
  
 -- 
 2.34.1
diff --git a/meta/recipes-core/systemd/systemd/0023-include-signal.h-to-avoid-the-undeclared-error.patch b/meta/recipes-core/systemd/systemd/0023-include-signal.h-to-avoid-the-undeclared-error.patch
new file mode 100644
index 0000000000..c8bcd9e355
--- /dev/null
+++ b/meta/recipes-core/systemd/systemd/0023-include-signal.h-to-avoid-the-undeclared-error.patch
@@ -0,0 +1,27 @@
+From e39afec7e5a2f3a9de7202affab4d0340ba879d7 Mon Sep 17 00:00:00 2001
+From: Chen Qi <Qi.Chen@windriver.com>
+Date: Tue, 2 Jul 2024 22:18:47 -0700
+Subject: [PATCH 23/26] include signal.h to avoid the 'undeclared' error
+
+Upstream-Status: Inappropriate [musl specific]
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+---
+ src/basic/pidref.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/basic/pidref.h b/src/basic/pidref.h
+index 42ddf4e50b..b9cf53680f 100644
+--- a/src/basic/pidref.h
++++ b/src/basic/pidref.h
+@@ -3,6 +3,7 @@
+ 
+ typedef struct PidRef PidRef;
+ 
++#include <signal.h>
+ #include "macro.h"
+ #include "process-util.h"
+ 
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/systemd/systemd/0024-undef-stdin-for-references-using-stdin-as-a-struct-m.patch b/meta/recipes-core/systemd/systemd/0024-undef-stdin-for-references-using-stdin-as-a-struct-m.patch
new file mode 100644
index 0000000000..9532e6b9af
--- /dev/null
+++ b/meta/recipes-core/systemd/systemd/0024-undef-stdin-for-references-using-stdin-as-a-struct-m.patch
@@ -0,0 +1,48 @@
+From 5a4334fde21b896cd75b2d1a56e06a4f365e9c4d Mon Sep 17 00:00:00 2001
+From: Chen Qi <Qi.Chen@windriver.com>
+Date: Tue, 2 Jul 2024 22:44:31 -0700
+Subject: [PATCH 24/26] undef stdin for references using stdin as a struct
+ member
+
+In musl stdio.h, we have:
+include/stdio.h:#define stdin  (stdin)
+
+This causes error when a struct member is also named stdin. undef it.
+
+Upstream-Status: Inappropriate [musl specific]
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+---
+ src/shared/edit-util.c         | 2 ++
+ src/systemctl/systemctl-edit.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/src/shared/edit-util.c b/src/shared/edit-util.c
+index e37609c2e1..1b212ae7b4 100644
+--- a/src/shared/edit-util.c
++++ b/src/shared/edit-util.c
+@@ -3,6 +3,8 @@
+ #include <errno.h>
+ #include <stdio.h>
+ 
++#undef stdin
++
+ #include "alloc-util.h"
+ #include "copy.h"
+ #include "edit-util.h"
+diff --git a/src/systemctl/systemctl-edit.c b/src/systemctl/systemctl-edit.c
+index c42a31153d..7695ceeead 100644
+--- a/src/systemctl/systemctl-edit.c
++++ b/src/systemctl/systemctl-edit.c
+@@ -13,6 +13,8 @@
+ #include "systemctl.h"
+ #include "terminal-util.h"
+ 
++#undef stdin
++
+ int verb_cat(int argc, char *argv[], void *userdata) {
+         _cleanup_hashmap_free_ Hashmap *cached_id_map = NULL, *cached_name_map = NULL;
+         _cleanup_(lookup_paths_done) LookupPaths lp = {};
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/systemd/systemd/0025-adjust-header-inclusion-order-to-avoid-redeclaration.patch b/meta/recipes-core/systemd/systemd/0025-adjust-header-inclusion-order-to-avoid-redeclaration.patch
new file mode 100644
index 0000000000..d791ad2da1
--- /dev/null
+++ b/meta/recipes-core/systemd/systemd/0025-adjust-header-inclusion-order-to-avoid-redeclaration.patch
@@ -0,0 +1,288 @@
+From a90044320eecda424ed678d283ef60806c70fcda Mon Sep 17 00:00:00 2001
+From: Chen Qi <Qi.Chen@windriver.com>
+Date: Tue, 2 Jul 2024 23:23:57 -0700
+Subject: [PATCH 25/26] adjust header inclusion order to avoid redeclaration
+
+Upstream-Status: Inappropriate [musl specific]
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+---
+ src/basic/parse-util.c                | 3 ++-
+ src/libsystemd-network/ndisc-option.c | 6 +++---
+ src/libsystemd-network/sd-radv.c      | 5 +++--
+ src/network/netdev/l2tp-tunnel.c      | 9 ++++-----
+ src/network/netdev/l2tp-tunnel.h      | 6 +++---
+ src/network/netdev/wireguard.c        | 2 +-
+ src/network/networkctl-link-info.c    | 4 ++--
+ src/network/networkd-bridge-mdb.c     | 3 ++-
+ src/network/networkd-route.c          | 8 ++++----
+ src/resolve/resolved-dns-stream.c     | 5 +++--
+ src/resolve/resolved-manager.c        | 5 +++--
+ src/shared/conf-parser.c              | 3 ++-
+ 12 files changed, 32 insertions(+), 27 deletions(-)
+
+diff --git a/src/basic/parse-util.c b/src/basic/parse-util.c
+index faa5344921..0fc9d12c89 100644
+--- a/src/basic/parse-util.c
++++ b/src/basic/parse-util.c
+@@ -2,7 +2,6 @@
+ 
+ #include <errno.h>
+ #include <inttypes.h>
+-#include <linux/ipv6.h>
+ #include <net/if.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+@@ -20,6 +19,8 @@
+ #include "string-util.h"
+ #include "strv.h"
+ 
++#include <linux/ipv6.h>
++
+ int parse_boolean(const char *v) {
+         if (!v)
+                 return -EINVAL;
+diff --git a/src/libsystemd-network/ndisc-option.c b/src/libsystemd-network/ndisc-option.c
+index 3aab51f51b..feeb4c78e5 100644
+--- a/src/libsystemd-network/ndisc-option.c
++++ b/src/libsystemd-network/ndisc-option.c
+@@ -1,8 +1,5 @@
+ /* SPDX-License-Identifier: LGPL-2.1-or-later */
+ 
+-#include <linux/ipv6.h>
+-#include <netinet/icmp6.h>
+-
+ #include "dns-resolver-internal.h"
+ #include "dns-domain.h"
+ #include "ether-addr-util.h"
+@@ -16,6 +13,9 @@
+ #include "strv.h"
+ #include "unaligned.h"
+ 
++#include <linux/ipv6.h>
++#include <netinet/icmp6.h>
++
+ /* RFC does not say anything about the maximum number of options, but let's limit the number of options for
+  * safety. Typically, the number of options in an ICMPv6 message should be only a few. */
+ #define MAX_OPTIONS 128
+diff --git a/src/libsystemd-network/sd-radv.c b/src/libsystemd-network/sd-radv.c
+index f241929ad5..7cef3c3f71 100644
+--- a/src/libsystemd-network/sd-radv.c
++++ b/src/libsystemd-network/sd-radv.c
+@@ -3,8 +3,6 @@
+   Copyright © 2017 Intel Corporation. All rights reserved.
+ ***/
+ 
+-#include <linux/ipv6.h>
+-#include <netinet/icmp6.h>
+ #include <netinet/in.h>
+ #include <arpa/inet.h>
+ 
+@@ -29,6 +27,9 @@
+ #include "strv.h"
+ #include "unaligned.h"
+ 
++#include <linux/ipv6.h>
++#include <netinet/icmp6.h>
++
+ int sd_radv_new(sd_radv **ret) {
+         _cleanup_(sd_radv_unrefp) sd_radv *ra = NULL;
+ 
+diff --git a/src/network/netdev/l2tp-tunnel.c b/src/network/netdev/l2tp-tunnel.c
+index c87e44797b..437b40c114 100644
+--- a/src/network/netdev/l2tp-tunnel.c
++++ b/src/network/netdev/l2tp-tunnel.c
+@@ -1,10 +1,5 @@
+ /* SPDX-License-Identifier: LGPL-2.1-or-later */
+ 
+-#include <netinet/in.h>
+-#include <linux/if_arp.h>
+-#include <linux/l2tp.h>
+-#include <linux/genetlink.h>
+-
+ #include "conf-parser.h"
+ #include "hashmap.h"
+ #include "l2tp-tunnel.h"
+@@ -17,6 +12,10 @@
+ #include "string-table.h"
+ #include "string-util.h"
+ 
++#include <netinet/in.h>
++#include <linux/l2tp.h>
++#include <linux/genetlink.h>
++
+ static const char* const l2tp_l2spec_type_table[_NETDEV_L2TP_L2SPECTYPE_MAX] = {
+         [NETDEV_L2TP_L2SPECTYPE_NONE]    = "none",
+         [NETDEV_L2TP_L2SPECTYPE_DEFAULT] = "default",
+diff --git a/src/network/netdev/l2tp-tunnel.h b/src/network/netdev/l2tp-tunnel.h
+index c558ed49de..8419ef34c5 100644
+--- a/src/network/netdev/l2tp-tunnel.h
++++ b/src/network/netdev/l2tp-tunnel.h
+@@ -1,13 +1,13 @@
+ /* SPDX-License-Identifier: LGPL-2.1-or-later */
+ #pragma once
+ 
+-#include <netinet/in.h>
+-#include <linux/l2tp.h>
+-
+ #include "in-addr-util.h"
+ #include "netdev.h"
+ #include "networkd-util.h"
+ 
++#include <netinet/in.h>
++#include <linux/l2tp.h>
++
+ typedef enum L2tpL2specType {
+         NETDEV_L2TP_L2SPECTYPE_NONE = L2TP_L2SPECTYPE_NONE,
+         NETDEV_L2TP_L2SPECTYPE_DEFAULT = L2TP_L2SPECTYPE_DEFAULT,
+diff --git a/src/network/netdev/wireguard.c b/src/network/netdev/wireguard.c
+index 5182783f45..79b21cb4ba 100644
+--- a/src/network/netdev/wireguard.c
++++ b/src/network/netdev/wireguard.c
+@@ -5,9 +5,9 @@
+ 
+ /* Make sure the net/if.h header is included before any linux/ one */
+ #include <net/if.h>
++#include <netinet/in.h>
+ //#include <linux/if_arp.h>
+ #include <linux/ipv6_route.h>
+-#include <netinet/in.h>
+ #include <sys/ioctl.h>
+ 
+ #include "sd-resolve.h"
+diff --git a/src/network/networkctl-link-info.c b/src/network/networkctl-link-info.c
+index f356d3c231..216c442de1 100644
+--- a/src/network/networkctl-link-info.c
++++ b/src/network/networkctl-link-info.c
+@@ -1,7 +1,5 @@
+ /* SPDX-License-Identifier: LGPL-2.1-or-later */
+ 
+-#include <linux/if_tunnel.h>
+-
+ #include "bus-common-errors.h"
+ #include "bus-error.h"
+ #include "bus-util.h"
+@@ -16,6 +14,8 @@
+ #include "strxcpyx.h"
+ #include "wifi-util.h"
+ 
++#include <linux/if_tunnel.h>
++
+ /* use 128 kB for receive socket kernel queue, we shouldn't need more here */
+ #define RCVBUF_SIZE    (128*1024)
+ 
+diff --git a/src/network/networkd-bridge-mdb.c b/src/network/networkd-bridge-mdb.c
+index 358ca4d294..fe87f7c093 100644
+--- a/src/network/networkd-bridge-mdb.c
++++ b/src/network/networkd-bridge-mdb.c
+@@ -2,7 +2,6 @@
+ 
+ /* Make sure the net/if.h header is included before any linux/ one */
+ #include <net/if.h>
+-#include <linux/if_bridge.h>
+ 
+ #include "netlink-util.h"
+ #include "networkd-bridge-mdb.h"
+@@ -13,6 +12,8 @@
+ #include "string-util.h"
+ #include "vlan-util.h"
+ 
++#include <linux/if_bridge.h>
++
+ #define STATIC_BRIDGE_MDB_ENTRIES_PER_NETWORK_MAX 1024U
+ 
+ /* remove MDB entry. */
+diff --git a/src/network/networkd-route.c b/src/network/networkd-route.c
+index 0f3f79ec4f..325743bebf 100644
+--- a/src/network/networkd-route.c
++++ b/src/network/networkd-route.c
+@@ -1,9 +1,5 @@
+ /* SPDX-License-Identifier: LGPL-2.1-or-later */
+ 
+-#include <linux/if.h>
+-#include <linux/ipv6_route.h>
+-#include <linux/nexthop.h>
+-
+ #include "alloc-util.h"
+ #include "event-util.h"
+ #include "netlink-util.h"
+@@ -21,6 +17,10 @@
+ #include "vrf.h"
+ #include "wireguard.h"
+ 
++#include <linux/if.h>
++#include <linux/ipv6_route.h>
++#include <linux/nexthop.h>
++
+ static Route* route_detach_impl(Route *route) {
+         assert(route);
+         assert(!!route->network + !!route->manager + !!route->wireguard <= 1);
+diff --git a/src/resolve/resolved-dns-stream.c b/src/resolve/resolved-dns-stream.c
+index e57af66221..f66d8f0606 100644
+--- a/src/resolve/resolved-dns-stream.c
++++ b/src/resolve/resolved-dns-stream.c
+@@ -1,7 +1,5 @@
+ /* SPDX-License-Identifier: LGPL-2.1-or-later */
+ 
+-#include <linux/if_arp.h>
+-#include <netinet/tcp.h>
+ #include <unistd.h>
+ 
+ #include "alloc-util.h"
+@@ -12,6 +10,9 @@
+ #include "resolved-dns-stream.h"
+ #include "resolved-manager.h"
+ 
++//#include <linux/if_arp.h>
++#include <netinet/tcp.h>
++
+ #define DNS_STREAMS_MAX 128
+ 
+ #define DNS_QUERIES_PER_STREAM 32
+diff --git a/src/resolve/resolved-manager.c b/src/resolve/resolved-manager.c
+index dbaad81734..b988e75851 100644
+--- a/src/resolve/resolved-manager.c
++++ b/src/resolve/resolved-manager.c
+@@ -1,8 +1,6 @@
+ /* SPDX-License-Identifier: LGPL-2.1-or-later */
+ 
+ #include <fcntl.h>
+-#include <linux/ipv6.h>
+-#include <netinet/in.h>
+ #include <poll.h>
+ #include <sys/ioctl.h>
+ #include <sys/stat.h>
+@@ -46,6 +44,9 @@
+ #include "utf8.h"
+ #include "varlink-util.h"
+ 
++#include <linux/ipv6.h>
++#include <netinet/in.h>
++
+ #define SEND_TIMEOUT_USEC (200 * USEC_PER_MSEC)
+ 
+ static int manager_process_link(sd_netlink *rtnl, sd_netlink_message *mm, void *userdata) {
+diff --git a/src/shared/conf-parser.c b/src/shared/conf-parser.c
+index eaa8a5f11c..03379e7474 100644
+--- a/src/shared/conf-parser.c
++++ b/src/shared/conf-parser.c
+@@ -2,7 +2,6 @@
+ 
+ #include <errno.h>
+ #include <limits.h>
+-#include <linux/ipv6.h>
+ #include <stdint.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+@@ -47,6 +46,8 @@
+ #include "time-util.h"
+ #include "utf8.h"
+ 
++#include <linux/ipv6.h>
++
+ DEFINE_PRIVATE_HASH_OPS_WITH_VALUE_DESTRUCTOR(config_file_hash_ops_fclose,
+                                               char, path_hash_func, path_compare,
+                                               FILE, safe_fclose);
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/systemd/systemd/0026-build-path.c-avoid-boot-time-segfault-for-musl.patch b/meta/recipes-core/systemd/systemd/0026-build-path.c-avoid-boot-time-segfault-for-musl.patch
new file mode 100644
index 0000000000..a7549ee151
--- /dev/null
+++ b/meta/recipes-core/systemd/systemd/0026-build-path.c-avoid-boot-time-segfault-for-musl.patch
@@ -0,0 +1,31 @@
+From f2a7cf1d2a2bc2516a180809efd85c828cd9c7f4 Mon Sep 17 00:00:00 2001
+From: Chen Qi <Qi.Chen@windriver.com>
+Date: Wed, 3 Jul 2024 07:18:42 -0700
+Subject: [PATCH 26/26] build-path.c: avoid boot time segfault for musl
+
+This function, at runtime, should return -ENOEXEC. For musl, it
+somehow segfaults. I think it's related to getauxval, but it's
+really does not matter, just return -ENOEXEC.
+
+Upstream-Status: Inappropriate [musl specific]
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+---
+ src/basic/build-path.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/basic/build-path.c b/src/basic/build-path.c
+index b5972658df..4ef551034e 100644
+--- a/src/basic/build-path.c
++++ b/src/basic/build-path.c
+@@ -151,6 +151,7 @@ int get_build_exec_dir(char **ret) {
+          */
+ 
+         static int runpath_cached = -ERRNO_MAX-1;
++        return -ENOEXEC;
+         if (runpath_cached == -ERRNO_MAX-1) {
+                 const char *runpath = NULL;
+ 
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/systemd/systemd_255.4.bb b/meta/recipes-core/systemd/systemd_257.6.bb
index e7498c802d..5f7f20c434 100644
--- a/meta/recipes-core/systemd/systemd_255.4.bb
+++ b/meta/recipes-core/systemd/systemd_257.6.bb
@@ -4,11 +4,11 @@ PROVIDES = "udev"
 
 PE = "1"
 
-DEPENDS = "intltool-native gperf-native libcap util-linux python3-jinja2-native"
+DEPENDS = "gperf-native libcap util-linux python3-jinja2-native"
 
 SECTION = "base/shell"
 
-inherit useradd pkgconfig meson perlnative update-rc.d update-alternatives qemu systemd gettext bash-completion manpages features_check
+inherit useradd pkgconfig meson perlnative update-rc.d update-alternatives systemd gettext bash-completion manpages features_check mime
 
 # unmerged-usr support is deprecated upstream, taints the system and will be
 # removed in the near future. Fail the build if it is not enabled.
@@ -26,20 +26,19 @@ SRC_URI += " \
            file://init \
            file://99-default.preset \
            file://systemd-pager.sh \
-           file://0002-binfmt-Don-t-install-dependency-links-at-install-tim.patch \
-           file://0008-implment-systemd-sysv-install-for-OE.patch \
+           file://0001-binfmt-Don-t-install-dependency-links-at-install-tim.patch \
+           file://0002-implment-systemd-sysv-install-for-OE.patch \
+           file://0001-Do-not-create-var-log-README.patch \
            "
 
 # patches needed by musl
 SRC_URI:append:libc-musl = " ${SRC_URI_MUSL}"
 SRC_URI_MUSL = "\
-               file://0001-missing_type.h-add-comparison_fn_t.patch \
-               file://0002-add-fallback-parse_printf_format-implementation.patch \
-               file://0003-src-basic-missing.h-check-for-missing-strndupa.patch \
-               file://0004-don-t-fail-if-GLOB_BRACE-and-GLOB_ALTDIRFUNC-is-not-.patch \
-               file://0005-add-missing-FTW_-macros-for-musl.patch \
-               file://0006-Use-uintmax_t-for-handling-rlim_t.patch \
-               file://0007-don-t-pass-AT_SYMLINK_NOFOLLOW-flag-to-faccessat.patch \
+               file://0003-missing_type.h-add-comparison_fn_t.patch \
+               file://0004-add-fallback-parse_printf_format-implementation.patch \
+               file://0005-don-t-fail-if-GLOB_BRACE-and-GLOB_ALTDIRFUNC-is-not-.patch \
+               file://0006-add-missing-FTW_-macros-for-musl.patch \
+               file://0007-Use-uintmax_t-for-handling-rlim_t.patch \
                file://0008-Define-glibc-compatible-basename-for-non-glibc-syste.patch \
                file://0009-Do-not-disable-buffering-when-writing-to-oom_score_a.patch \
                file://0010-distinguish-XSI-compliant-strerror_r-from-GNU-specif.patch \
@@ -55,6 +54,10 @@ SRC_URI_MUSL = "\
                file://0020-sd-event-Make-malloc_trim-conditional-on-glibc.patch \
                file://0021-shared-Do-not-use-malloc_info-on-musl.patch \
                file://0022-avoid-missing-LOCK_EX-declaration.patch \
+               file://0023-include-signal.h-to-avoid-the-undeclared-error.patch \
+               file://0024-undef-stdin-for-references-using-stdin-as-a-struct-m.patch \
+               file://0025-adjust-header-inclusion-order-to-avoid-redeclaration.patch \
+               file://0026-build-path.c-avoid-boot-time-segfault-for-musl.patch \
                "
 
 PAM_PLUGINS = " \
@@ -65,14 +68,13 @@ PAM_PLUGINS = " \
 "
 
 PACKAGECONFIG ??= " \
-    ${@bb.utils.filter('DISTRO_FEATURES', 'acl audit efi ldconfig pam pni-names selinux smack usrmerge polkit seccomp', d)} \
+    ${@bb.utils.filter('DISTRO_FEATURES', 'acl audit apparmor efi ldconfig pam pni-names selinux smack polkit seccomp', d)} \
     ${@bb.utils.contains('DISTRO_FEATURES', 'minidebuginfo', 'coredump elfutils', '', d)} \
     ${@bb.utils.contains('DISTRO_FEATURES', 'wifi', 'rfkill', '', d)} \
     ${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'xkbcommon', '', d)} \
-    ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', '', 'link-udev-shared', d)} \
+    ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'sysvinit', 'link-udev-shared', d)} \
     backlight \
     binfmt \
-    cgroupv2 \
     gshadow \
     hibernate \
     hostnamed \
@@ -90,9 +92,9 @@ PACKAGECONFIG ??= " \
     quotacheck \
     randomseed \
     resolved \
+    serial-getty-generator \
     set-time-epoch \
     sysusers \
-    sysvinit \
     timedated \
     timesyncd \
     userdb \
@@ -128,68 +130,72 @@ TARGET_CC_ARCH:append:libc-musl = " -D__UAPI_DEF_ETHHDR=0 -D_LARGEFILE64_SOURCE"
 # systemd-serialgetty.bb - not enabled by default.
 PACKAGECONFIG[serial-getty-generator] = ""
 
-PACKAGECONFIG[acl] = "-Dacl=true,-Dacl=false,acl"
-PACKAGECONFIG[audit] = "-Daudit=true,-Daudit=false,audit"
+PACKAGECONFIG[acl] = "-Dacl=enabled,-Dacl=disabled,acl"
+PACKAGECONFIG[audit] = "-Daudit=enabled,-Daudit=disabled,audit"
+PACKAGECONFIG[apparmor] = "-Dapparmor=enabled,-Dapparmor=disabled,apparmor"
 PACKAGECONFIG[backlight] = "-Dbacklight=true,-Dbacklight=false"
 PACKAGECONFIG[binfmt] = "-Dbinfmt=true,-Dbinfmt=false"
-PACKAGECONFIG[bzip2] = "-Dbzip2=true,-Dbzip2=false,bzip2"
-PACKAGECONFIG[cgroupv2] = "-Ddefault-hierarchy=unified,-Ddefault-hierarchy=hybrid"
+PACKAGECONFIG[bpf-framework] = "-Dbpf-framework=enabled,-Dbpf-framework=disabled,clang-native bpftool-native libbpf,libbpf"
+PACKAGECONFIG[bzip2] = "-Dbzip2=enabled,-Dbzip2=disabled,bzip2"
 PACKAGECONFIG[coredump] = "-Dcoredump=true,-Dcoredump=false"
-PACKAGECONFIG[cryptsetup] = "-Dlibcryptsetup=true,-Dlibcryptsetup=false,cryptsetup,,cryptsetup"
-PACKAGECONFIG[cryptsetup-plugins] = "-Dlibcryptsetup-plugins=true,-Dlibcryptsetup-plugins=false,cryptsetup,,cryptsetup"
-PACKAGECONFIG[tpm2] = "-Dtpm2=true,-Dtpm2=false,tpm2-tss,tpm2-tss libtss2 libtss2-tcti-device"
+PACKAGECONFIG[cryptsetup] = "-Dlibcryptsetup=enabled,-Dlibcryptsetup=disabled,cryptsetup,,cryptsetup"
+PACKAGECONFIG[cryptsetup-plugins] = "-Dlibcryptsetup-plugins=enabled,-Dlibcryptsetup-plugins=disabled,cryptsetup,,cryptsetup"
+PACKAGECONFIG[tpm2] = "-Dtpm2=enabled,-Dtpm2=disabled,tpm2-tss,tpm2-tss libtss2 libtss2-tcti-device"
 # If multiple compression libraries are enabled, the format to use for compression is chosen implicitly,
 # so if you want to compress with e.g. lz4 you cannot enable zstd, so you cannot read zstd-compressed journal files.
 # This option allows to enable all compression formats for reading, but choosing a specific one for writing.
 PACKAGECONFIG[default-compression-lz4] = "-Dlz4=true -Ddefault-compression=lz4,,lz4"
 PACKAGECONFIG[default-compression-xz] = "-Dxz=true -Ddefault-compression=xz,,xz"
 PACKAGECONFIG[default-compression-zstd] = "-Dzstd=true -Ddefault-compression=zstd,,zstd"
-PACKAGECONFIG[dbus] = "-Ddbus=true,-Ddbus=false,dbus"
-PACKAGECONFIG[efi] = "-Defi=true -Dbootloader=true,-Defi=false -Dbootloader=false,python3-pyelftools-native"
-PACKAGECONFIG[elfutils] = "-Delfutils=true,-Delfutils=false,elfutils,,libelf libdw"
+PACKAGECONFIG[dbus] = "-Ddbus=enabled,-Ddbus=disabled,dbus"
+PACKAGECONFIG[efi] = "-Defi=true -Dbootloader=enabled,-Defi=false -Dbootloader=disabled,python3-pyelftools-native"
+PACKAGECONFIG[elfutils] = "-Delfutils=enabled,-Delfutils=disabled,elfutils,,libelf libdw"
+PACKAGECONFIG[fido] = "-Dlibfido2=enabled,-Dlibfido2=disabled,libfido2"
 PACKAGECONFIG[firstboot] = "-Dfirstboot=true,-Dfirstboot=false"
-PACKAGECONFIG[repart] = "-Drepart=true,-Drepart=false"
-PACKAGECONFIG[homed] = "-Dhomed=true,-Dhomed=false"
+PACKAGECONFIG[repart] = "-Drepart=enabled,-Drepart=disabled"
+PACKAGECONFIG[homed] = "-Dhomed=enabled,-Dhomed=disabled"
 # Sign the journal for anti-tampering
-PACKAGECONFIG[gcrypt] = "-Dgcrypt=true,-Dgcrypt=false,libgcrypt"
-PACKAGECONFIG[gnutls] = "-Dgnutls=true,-Dgnutls=false,gnutls"
+PACKAGECONFIG[gcrypt] = "-Dgcrypt=enabled,-Dgcrypt=disabled,libgcrypt"
+PACKAGECONFIG[gnutls] = "-Dgnutls=enabled,-Dgnutls=disabled,gnutls"
 PACKAGECONFIG[gshadow] = "-Dgshadow=true,-Dgshadow=false"
 PACKAGECONFIG[hibernate] = "-Dhibernate=true,-Dhibernate=false"
 PACKAGECONFIG[hostnamed] = "-Dhostnamed=true,-Dhostnamed=false"
 PACKAGECONFIG[idn] = "-Didn=true,-Didn=false"
 PACKAGECONFIG[ima] = "-Dima=true,-Dima=false"
 # importd requires journal-upload/xz/zlib/bzip2/gcrypt
-PACKAGECONFIG[importd] = "-Dimportd=true,-Dimportd=false,glib-2.0"
+PACKAGECONFIG[importd] = "-Dimportd=enabled,-Dimportd=disabled,glib-2.0"
 # Update NAT firewall rules
-PACKAGECONFIG[iptc] = "-Dlibiptc=true,-Dlibiptc=false,iptables"
+PACKAGECONFIG[iptc] = "-Dlibiptc=enabled,-Dlibiptc=disabled,iptables"
 PACKAGECONFIG[journal-color] = ",,,less"
-PACKAGECONFIG[journal-upload] = "-Dlibcurl=true,-Dlibcurl=false,curl"
-PACKAGECONFIG[kmod] = "-Dkmod=true,-Dkmod=false,kmod"
+PACKAGECONFIG[journal-upload] = "-Dlibcurl=enabled,-Dlibcurl=disabled,curl"
+PACKAGECONFIG[kmod] = "-Dkmod=enabled,-Dkmod=disabled,kmod,libkmod"
 PACKAGECONFIG[ldconfig] = "-Dldconfig=true,-Dldconfig=false,,ldconfig"
-PACKAGECONFIG[libidn] = "-Dlibidn=true,-Dlibidn=false,libidn,,libidn"
-PACKAGECONFIG[libidn2] = "-Dlibidn2=true,-Dlibidn2=false,libidn2,,libidn2"
+PACKAGECONFIG[libidn] = "-Dlibidn=enabled,-Dlibidn=disabled,libidn,,libidn"
+PACKAGECONFIG[libidn2] = "-Dlibidn2=enabled,-Dlibidn2=disabled,libidn2,,libidn2"
 # Link udev shared with systemd helper library.
 # If enabled the udev package depends on the systemd package (which has the needed shared library).
 PACKAGECONFIG[link-udev-shared] = "-Dlink-udev-shared=true,-Dlink-udev-shared=false"
 PACKAGECONFIG[localed] = "-Dlocaled=true,-Dlocaled=false"
 PACKAGECONFIG[logind] = "-Dlogind=true,-Dlogind=false"
-PACKAGECONFIG[lz4] = "-Dlz4=true,-Dlz4=false,lz4"
+PACKAGECONFIG[lz4] = "-Dlz4=enabled,-Dlz4=disabled,lz4"
 PACKAGECONFIG[machined] = "-Dmachined=true,-Dmachined=false"
-PACKAGECONFIG[manpages] = "-Dman=true,-Dman=false,libxslt-native xmlto-native docbook-xml-dtd4-native docbook-xsl-stylesheets-native"
-PACKAGECONFIG[microhttpd] = "-Dmicrohttpd=true,-Dmicrohttpd=false,libmicrohttpd"
+PACKAGECONFIG[manpages] = "-Dman=enabled,-Dman=disabled,python3-lxml-native libxslt-native xmlto-native docbook-xml-dtd4-native docbook-xsl-stylesheets-native"
+PACKAGECONFIG[microhttpd] = "-Dmicrohttpd=enabled,-Dmicrohttpd=disabled,libmicrohttpd"
+PACKAGECONFIG[mountfsd] = "-Dmountfsd=true,-Dmountfsd=false"
 PACKAGECONFIG[myhostname] = "-Dnss-myhostname=true,-Dnss-myhostname=false,,libnss-myhostname"
+PACKAGECONFIG[nsresourced] = "-Dnsresourced=true,-Dnsresourced=false"
 PACKAGECONFIG[networkd] = "-Dnetworkd=true,-Dnetworkd=false"
 PACKAGECONFIG[no-dns-fallback] = "-Ddns-servers="
 PACKAGECONFIG[no-ntp-fallback] = "-Dntp-servers="
 PACKAGECONFIG[nss] = "-Dnss-systemd=true,-Dnss-systemd=false,,libnss-systemd"
-PACKAGECONFIG[nss-mymachines] = "-Dnss-mymachines=true,-Dnss-mymachines=false"
-PACKAGECONFIG[nss-resolve] = "-Dnss-resolve=true,-Dnss-resolve=false"
+PACKAGECONFIG[nss-mymachines] = "-Dnss-mymachines=enabled,-Dnss-mymachines=disabled"
+PACKAGECONFIG[nss-resolve] = "-Dnss-resolve=enabled,-Dnss-resolve=disabled"
 PACKAGECONFIG[oomd] = "-Doomd=true,-Doomd=false"
-PACKAGECONFIG[openssl] = "-Dopenssl=true,-Dopenssl=false,openssl"
-PACKAGECONFIG[p11kit] = "-Dp11kit=true,-Dp11kit=false,p11-kit"
-PACKAGECONFIG[pam] = "-Dpam=true,-Dpam=false,libpam,${PAM_PLUGINS}"
-PACKAGECONFIG[pcre2] = "-Dpcre2=true,-Dpcre2=false,libpcre2"
-PACKAGECONFIG[polkit] = "-Dpolkit=true,-Dpolkit=false"
+PACKAGECONFIG[openssl] = "-Dopenssl=enabled,-Dopenssl=disabled,openssl"
+PACKAGECONFIG[p11kit] = "-Dp11kit=enabled,-Dp11kit=disabled,p11-kit"
+PACKAGECONFIG[pam] = "-Dpam=enabled,-Dpam=disabled,libpam,${PAM_PLUGINS}"
+PACKAGECONFIG[pcre2] = "-Dpcre2=enabled,-Dpcre2=disabled,libpcre2"
+PACKAGECONFIG[polkit] = "-Dpolkit=enabled,-Dpolkit=disabled"
 # If polkit is disabled and networkd+hostnamed are in use, enabling this option and
 # using dbus-broker will allow networkd to be authorized to change the
 # hostname without acquiring additional privileges
@@ -197,13 +203,13 @@ PACKAGECONFIG[polkit_hostnamed_fallback] = ",,,,dbus-broker,polkit"
 PACKAGECONFIG[portabled] = "-Dportabled=true,-Dportabled=false"
 PACKAGECONFIG[pstore] = "-Dpstore=true,-Dpstore=false"
 PACKAGECONFIG[pni-names] = ",,,"
-PACKAGECONFIG[qrencode] = "-Dqrencode=true,-Dqrencode=false,qrencode,,qrencode"
+PACKAGECONFIG[qrencode] = "-Dqrencode=enabled,-Dqrencode=disabled,qrencode,,qrencode"
 PACKAGECONFIG[quotacheck] = "-Dquotacheck=true,-Dquotacheck=false"
 PACKAGECONFIG[randomseed] = "-Drandomseed=true,-Drandomseed=false"
 PACKAGECONFIG[resolved] = "-Dresolve=true,-Dresolve=false"
 PACKAGECONFIG[rfkill] = "-Drfkill=true,-Drfkill=false"
-PACKAGECONFIG[seccomp] = "-Dseccomp=true,-Dseccomp=false,libseccomp"
-PACKAGECONFIG[selinux] = "-Dselinux=true,-Dselinux=false,libselinux,initscripts-sushell"
+PACKAGECONFIG[seccomp] = "-Dseccomp=enabled,-Dseccomp=disabled,libseccomp"
+PACKAGECONFIG[selinux] = "-Dselinux=enabled,-Dselinux=disabled,libselinux,initscripts-sushell"
 PACKAGECONFIG[smack] = "-Dsmack=true,-Dsmack=false"
 PACKAGECONFIG[sysext] = "-Dsysext=true, -Dsysext=false"
 PACKAGECONFIG[sysusers] = "-Dsysusers=true,-Dsysusers=false"
@@ -216,7 +222,6 @@ def build_epoch(d):
 PACKAGECONFIG[set-time-epoch] = "${@build_epoch(d)},-Dtime-epoch=0"
 PACKAGECONFIG[timedated] = "-Dtimedated=true,-Dtimedated=false"
 PACKAGECONFIG[timesyncd] = "-Dtimesyncd=true,-Dtimesyncd=false"
-PACKAGECONFIG[usrmerge] = "-Dsplit-usr=false,-Dsplit-usr=true"
 PACKAGECONFIG[sbinmerge] = "-Dsplit-bin=false,-Dsplit-bin=true"
 PACKAGECONFIG[userdb] = "-Duserdb=true,-Duserdb=false"
 PACKAGECONFIG[utmp] = "-Dutmp=true,-Dutmp=false"
@@ -225,30 +230,26 @@ PACKAGECONFIG[vconsole] = "-Dvconsole=true,-Dvconsole=false,,${PN}-vconsole-setu
 PACKAGECONFIG[wheel-group] = "-Dwheel-group=true, -Dwheel-group=false"
 PACKAGECONFIG[xdg-autostart] = "-Dxdg-autostart=true,-Dxdg-autostart=false"
 # Verify keymaps on locale change
-PACKAGECONFIG[xkbcommon] = "-Dxkbcommon=true,-Dxkbcommon=false,libxkbcommon"
-PACKAGECONFIG[xz] = "-Dxz=true,-Dxz=false,xz"
-PACKAGECONFIG[zlib] = "-Dzlib=true,-Dzlib=false,zlib"
-PACKAGECONFIG[zstd] = "-Dzstd=true,-Dzstd=false,zstd"
+PACKAGECONFIG[xkbcommon] = "-Dxkbcommon=enabled,-Dxkbcommon=disabled,libxkbcommon"
+PACKAGECONFIG[xz] = "-Dxz=enabled,-Dxz=disabled,xz"
+PACKAGECONFIG[zlib] = "-Dzlib=enabled,-Dzlib=disabled,zlib"
+PACKAGECONFIG[zstd] = "-Dzstd=enabled,-Dzstd=disabled,zstd"
 
 RESOLV_CONF ??= ""
 
-# Helper variables to clarify locations.  This mirrors the logic in systemd's
-# build system.
-rootprefix ?= "${root_prefix}"
-rootlibdir ?= "${base_libdir}"
-rootlibexecdir = "${rootprefix}/lib"
+# bpf-framework: pass the recipe-sysroot to the compiler used to build
+# the eBPFs, so that it can find needed system includes in there.
+CFLAGS:append = " --sysroot=${STAGING_DIR_TARGET}"
+LDFLAGS:append:aarch64 = " ${@bb.utils.contains('PACKAGECONFIG', 'openssl', '-Wl,-z,gcs-report-dynamic=none', '', d)}"
 
 EXTRA_OEMESON += "-Dnobody-user=nobody \
                   -Dnobody-group=nogroup \
-                  -Drootlibdir=${rootlibdir} \
-                  -Drootprefix=${rootprefix} \
                   -Ddefault-locale=C \
                   -Dmode=release \
                   -Dsystem-alloc-uid-min=101 \
                   -Dsystem-uid-max=999 \
                   -Dsystem-alloc-gid-min=101 \
                   -Dsystem-gid-max=999 \
-                  -Dcreate-log-dirs=false \
                   ${@bb.utils.contains('DISTRO_FEATURES', 'zeroconf', '-Ddefault-mdns=no -Ddefault-llmnr=no', '', d)} \
                   "
 
@@ -269,45 +270,56 @@ EXTRA_OEMESON += "-Dkexec-path=${sbindir}/kexec \
 # The 60 seconds is watchdog's default vaule.
 WATCHDOG_TIMEOUT ??= "60"
 
+# To make use of the hardware watchdog it is sufficient to set WATCHDOG_RUNTIME_SEC
+# (RuntimeWatchdogSec= option in /etc/systemd/system.conf) to a value like 20s
+# and the watchdog is enabled. (defaults is no hardware watchdog use)
+WATCHDOG_RUNTIME_SEC ??= ""
+
 do_install() {
         meson_do_install
-        # Change the root user's home directory in /lib/sysusers.d/basic.conf.
-        # This is done merely for backward compatibility with previous systemd recipes.
-        # systemd hardcodes root user's HOME to be "/root". Changing to use other values
-        # may have unexpected runtime behaviors.
-        if [ "${ROOT_HOME}" != "/root" ]; then
-                bbwarn "Using ${ROOT_HOME} as root user's home directory is not fully supported by systemd"
-                sed -i -e 's#/root#${ROOT_HOME}#g' ${D}${exec_prefix}/lib/sysusers.d/basic.conf
+
+        if ${@bb.utils.contains('PACKAGECONFIG', 'sysusers', 'true', 'false', d)}; then
+                # Change the root user's home directory in /lib/sysusers.d/basic.conf.
+                # This is done merely for backward compatibility with previous systemd recipes.
+                # systemd hardcodes root user's HOME to be "/root". Changing to use other values
+                # may have unexpected runtime behaviors.
+                if [ "${ROOT_HOME}" != "/root" ]; then
+                        bbwarn "Using ${ROOT_HOME} as root user's home directory is not fully supported by systemd"
+                        sed -i -e 's#/root#${ROOT_HOME}#g' ${D}${exec_prefix}/lib/sysusers.d/basic.conf
+                fi
         fi
         install -d ${D}/${base_sbindir}
-        if ${@bb.utils.contains('PACKAGECONFIG', 'serial-getty-generator', 'false', 'true', d)}; then
-                # Provided by a separate recipe
-                rm ${D}${systemd_system_unitdir}/serial-getty* -f
+
+        if ! ${@bb.utils.contains('PACKAGECONFIG', 'serial-getty-generator', 'true', 'false', d)}; then
+                # Remove the serial-getty generator and instead use explicit services
+                # created by the systemd-serialgetty recipe
+                find ${D} -name \*getty-generator\* -delete
         fi
 
         # Provide support for initramfs
-        [ ! -e ${D}/init ] && ln -s ${rootlibexecdir}/systemd/systemd ${D}/init
-        [ ! -e ${D}/${base_sbindir}/udevd ] && ln -s ${rootlibexecdir}/systemd/systemd-udevd ${D}/${base_sbindir}/udevd
+        [ ! -e ${D}/init ] && ln -s ${nonarch_libdir}/systemd/systemd ${D}/init
+        [ ! -e ${D}/${base_sbindir}/udevd ] && ln -s ${nonarch_libdir}/systemd/systemd-udevd ${D}/${base_sbindir}/udevd
 
         install -d ${D}${sysconfdir}/udev/rules.d/
         install -d ${D}${nonarch_libdir}/tmpfiles.d
-        for rule in $(find ${WORKDIR} -maxdepth 1 -type f -name "*.rules"); do
+        for rule in $(find ${UNPACKDIR} -maxdepth 1 -type f -name "*.rules"); do
                 install -m 0644 $rule ${D}${sysconfdir}/udev/rules.d/
         done
 
-        install -m 0644 ${WORKDIR}/00-create-volatile.conf ${D}${nonarch_libdir}/tmpfiles.d/
+        install -m 0644 ${UNPACKDIR}/00-create-volatile.conf ${D}${nonarch_libdir}/tmpfiles.d/
 
         if ${@bb.utils.contains('DISTRO_FEATURES','sysvinit','true','false',d)}; then
                 install -d ${D}${sysconfdir}/init.d
-                install -m 0755 ${WORKDIR}/init ${D}${sysconfdir}/init.d/systemd-udevd
-                sed -i s%@UDEVD@%${rootlibexecdir}/systemd/systemd-udevd% ${D}${sysconfdir}/init.d/systemd-udevd
+                install -m 0755 ${UNPACKDIR}/init ${D}${sysconfdir}/init.d/systemd-udevd
+                sed -i s%@UDEVD@%${nonarch_libdir}/systemd/systemd-udevd% ${D}${sysconfdir}/init.d/systemd-udevd
                 install -Dm 0755 ${S}/src/systemctl/systemd-sysv-install.SKELETON ${D}${systemd_unitdir}/systemd-sysv-install
         fi
 
-        if "${@'true' if oe.types.boolean(d.getVar('VOLATILE_LOG_DIR')) else 'false'}"; then
-                # /var/log is typically a symbolic link to inside /var/volatile,
-                # which is expected to be empty.
+        if ${@bb.utils.contains('FILESYSTEM_PERMS_TABLES', 'files/fs-perms-volatile-log.txt', 'true', 'false', d)}; then
+                # base-files recipe provides /var/log which is a symlink to /var/volatile/log
                 rm -rf ${D}${localstatedir}/log
+                printf 'L\t\t%s/log\t\t-\t-\t-\t-\t%s/volatile/log\n' "${localstatedir}" \
+                        "${localstatedir}" >>${D}${nonarch_libdir}/tmpfiles.d/00-create-volatile.conf
         elif [ -e ${D}${localstatedir}/log/journal ]; then
                 chown root:systemd-journal ${D}${localstatedir}/log/journal
 
@@ -317,9 +329,9 @@ do_install() {
 
         # if the user requests /tmp be on persistent storage (i.e. not volatile)
         # then don't use a tmpfs for /tmp
-        if [ "${VOLATILE_TMP_DIR}" != "yes" ]; then
-                rm -f ${D}${rootlibdir}/systemd/system/tmp.mount
-                rm -f ${D}${rootlibdir}/systemd/system/local-fs.target.wants/tmp.mount
+        if ! ${@bb.utils.contains('FILESYSTEM_PERMS_TABLES', 'files/fs-perms-volatile-tmp.txt', 'true', 'false', d)}; then
+                rm -f ${D}${nonarch_libdir}/systemd/system/tmp.mount
+                rm -f ${D}${nonarch_libdir}/systemd/system/local-fs.target.wants/tmp.mount
         fi
 
         install -d ${D}${systemd_system_unitdir}/graphical.target.wants
@@ -329,7 +341,7 @@ do_install() {
         install -d ${D}${systemd_system_unitdir}/rescue.target.wants
 
         # Create symlinks for systemd-update-utmp-runlevel.service
-        if ${@bb.utils.contains('PACKAGECONFIG', 'utmp', 'true', 'false', d)}; then
+        if ${@bb.utils.contains('PACKAGECONFIG', 'utmp', 'true', 'false', d)} && ${@bb.utils.contains('PACKAGECONFIG', 'sysvinit', 'true', 'false', d)}; then
                 ln -sf ../systemd-update-utmp-runlevel.service ${D}${systemd_system_unitdir}/graphical.target.wants/systemd-update-utmp-runlevel.service
                 ln -sf ../systemd-update-utmp-runlevel.service ${D}${systemd_system_unitdir}/multi-user.target.wants/systemd-update-utmp-runlevel.service
                 ln -sf ../systemd-update-utmp-runlevel.service ${D}${systemd_system_unitdir}/poweroff.target.wants/systemd-update-utmp-runlevel.service
@@ -350,7 +362,7 @@ do_install() {
                 ln -s ../run/systemd/resolve/resolv.conf ${D}${sysconfdir}/resolv-conf.systemd
         else
                 resolv_conf="${@bb.utils.contains('RESOLV_CONF', 'stub-resolv', 'run/systemd/resolve/stub-resolv.conf', 'run/systemd/resolve/resolv.conf', d)}"
-                sed -i -e "s%^L! /etc/resolv.conf.*$%L! /etc/resolv.conf - - - - ../${resolv_conf}%g" ${D}${exec_prefix}/lib/tmpfiles.d/etc.conf
+                sed -i -e "s%^L! /etc/resolv.conf.*$%L! /etc/resolv.conf - - - - ../${resolv_conf}%g" ${D}${exec_prefix}/lib/tmpfiles.d/systemd-resolve.conf
                 ln -s ../${resolv_conf} ${D}${sysconfdir}/resolv-conf.systemd
         fi
         if ${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'false', 'true', d)}; then
@@ -358,21 +370,13 @@ do_install() {
                 rm -r ${D}${sysconfdir}/X11
         fi
 
-        # If polkit is setup fixup permissions and ownership
-        if ${@bb.utils.contains('PACKAGECONFIG', 'polkit', 'true', 'false', d)}; then
-                if [ -d ${D}${datadir}/polkit-1/rules.d ]; then
-                        chmod 700 ${D}${datadir}/polkit-1/rules.d
-                        chown polkitd:root ${D}${datadir}/polkit-1/rules.d
-                fi
-        fi
-
         # If polkit is not available and a fallback was requested, install a drop-in that allows networkd to
         # request hostname changes via DBUS without elevating its privileges
         if ${@bb.utils.contains('PACKAGECONFIG', 'polkit_hostnamed_fallback', 'true', 'false', d)}; then
                 install -d ${D}${systemd_system_unitdir}/systemd-hostnamed.service.d/
-                install -m 0644 ${WORKDIR}/00-hostnamed-network-user.conf ${D}${systemd_system_unitdir}/systemd-hostnamed.service.d/
+                install -m 0644 ${UNPACKDIR}/00-hostnamed-network-user.conf ${D}${systemd_system_unitdir}/systemd-hostnamed.service.d/
                 install -d ${D}${datadir}/dbus-1/system.d/
-                install -m 0644 ${WORKDIR}/org.freedesktop.hostname1_no_polkit.conf ${D}${datadir}/dbus-1/system.d/
+                install -m 0644 ${UNPACKDIR}/org.freedesktop.hostname1_no_polkit.conf ${D}${datadir}/dbus-1/system.d/
         fi
 
         # create link for existing udev rules
@@ -380,28 +384,36 @@ do_install() {
 
         # install default policy for presets
         # https://www.freedesktop.org/wiki/Software/systemd/Preset/#howto
-        install -Dm 0644 ${WORKDIR}/99-default.preset ${D}${systemd_unitdir}/system-preset/99-default.preset
+        install -Dm 0644 ${UNPACKDIR}/99-default.preset ${D}${systemd_unitdir}/system-preset/99-default.preset
 
         # add a profile fragment to disable systemd pager with busybox less
-        install -Dm 0644 ${WORKDIR}/systemd-pager.sh ${D}${sysconfdir}/profile.d/systemd-pager.sh
+        install -Dm 0644 ${UNPACKDIR}/systemd-pager.sh ${D}${sysconfdir}/profile.d/systemd-pager.sh
 
-    if [ -n "${WATCHDOG_TIMEOUT}" ]; then
-        sed -i -e 's/#RebootWatchdogSec=10min/RebootWatchdogSec=${WATCHDOG_TIMEOUT}/' \
-            ${D}/${sysconfdir}/systemd/system.conf
-    fi
+        if [ -n "${WATCHDOG_TIMEOUT}" ]; then
+                sed -i -e 's/#RebootWatchdogSec=10min/RebootWatchdogSec=${WATCHDOG_TIMEOUT}/' \
+                        ${D}/${sysconfdir}/systemd/system.conf
+        fi
+
+        if [ -n "${WATCHDOG_RUNTIME_SEC}" ]; then
+                sed -i -e 's/#RuntimeWatchdogSec=off/RuntimeWatchdogSec=${WATCHDOG_RUNTIME_SEC}/' \
+                        ${D}/${sysconfdir}/systemd/system.conf
+        fi
 
         if ${@bb.utils.contains('PACKAGECONFIG', 'pni-names', 'true', 'false', d)}; then
-                if ! grep -q '^NamePolicy=.*mac' ${D}${rootlibexecdir}/systemd/network/99-default.link; then
-                        sed -i '/^NamePolicy=/s/$/ mac/' ${D}${rootlibexecdir}/systemd/network/99-default.link
+                if ! grep -q '^NamePolicy=.*mac' ${D}${nonarch_libdir}/systemd/network/99-default.link; then
+                        sed -i '/^NamePolicy=/s/$/ mac/' ${D}${nonarch_libdir}/systemd/network/99-default.link
                 fi
-                if ! grep -q 'AlternativeNamesPolicy=.*mac' ${D}${rootlibexecdir}/systemd/network/99-default.link; then
-                        sed -i '/AlternativeNamesPolicy=/s/$/ mac/' ${D}${rootlibexecdir}/systemd/network/99-default.link
+                if ! grep -q 'AlternativeNamesPolicy=.*mac' ${D}${nonarch_libdir}/systemd/network/99-default.link; then
+                        sed -i '/AlternativeNamesPolicy=/s/$/ mac/' ${D}${nonarch_libdir}/systemd/network/99-default.link
                 fi
+        else
+                # Actively disable Predictable Network Interface Names
+                sed -i 's/^NamePolicy=.*/NamePolicy=/;s/^AlternativeNamesPolicy=.*/AlternativeNamesPolicy=/' ${D}${nonarch_libdir}/systemd/network/99-default.link
         fi
 }
 
 python populate_packages:prepend (){
-    systemdlibdir = d.getVar("rootlibdir")
+    systemdlibdir = d.getVar("libdir")
     do_split_packages(d, systemdlibdir, r'^lib(.*)\.so\.*', 'lib%s', 'Systemd %s library', extra_depends='', allow_links=True)
 }
 PACKAGES_DYNAMIC += "^lib(udev|systemd|nss).*"
@@ -418,6 +430,8 @@ PACKAGE_BEFORE_PN = "\
     ${PN}-journal-upload \
     ${PN}-journal-remote \
     ${PN}-kernel-install \
+    ${PN}-mime \
+    ${PN}-networkd \
     ${PN}-rpm-macros \
     ${PN}-udev-rules \
     ${PN}-vconsole-setup \
@@ -446,6 +460,7 @@ SYSTEMD_PACKAGES = "${@bb.utils.contains('PACKAGECONFIG', 'binfmt', '${PN}-binfm
                     ${@bb.utils.contains('PACKAGECONFIG', 'microhttpd', '${PN}-journal-gatewayd', '', d)} \
                     ${@bb.utils.contains('PACKAGECONFIG', 'microhttpd', '${PN}-journal-remote', '', d)} \
                     ${@bb.utils.contains('PACKAGECONFIG', 'journal-upload', '${PN}-journal-upload', '', d)} \
+                    ${@bb.utils.contains('PACKAGECONFIG', 'networkd', '${PN}-networkd', '', d)} \
 "
 SYSTEMD_SERVICE:${PN}-binfmt = "systemd-binfmt.service"
 
@@ -454,13 +469,14 @@ USERADD_PACKAGES = "${PN} \
                     ${@bb.utils.contains('PACKAGECONFIG', 'microhttpd', '${PN}-journal-gatewayd', '', d)} \
                     ${@bb.utils.contains('PACKAGECONFIG', 'microhttpd', '${PN}-journal-remote', '', d)} \
                     ${@bb.utils.contains('PACKAGECONFIG', 'journal-upload', '${PN}-journal-upload', '', d)} \
+                    ${@bb.utils.contains('PACKAGECONFIG', 'networkd', '${PN}-networkd', '', d)} \
 "
 GROUPADD_PARAM:${PN} = "-r systemd-journal;"
 GROUPADD_PARAM:udev = "-r render"
 GROUPADD_PARAM:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'polkit_hostnamed_fallback', '-r systemd-hostname;', '', d)}"
 USERADD_PARAM:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'coredump', '--system -d / -M --shell /sbin/nologin systemd-coredump;', '', d)}"
-USERADD_PARAM:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'networkd', '--system -d / -M --shell /sbin/nologin systemd-network;', '', d)}"
-USERADD_PARAM:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'polkit', '--system --no-create-home --user-group --home-dir ${sysconfdir}/polkit-1 polkitd;', '', d)}"
+USERADD_PARAM:${PN}-networkd = "--system -d / -M --shell /sbin/nologin systemd-network"
+USERADD_PARAM:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'polkit', '--system --no-create-home --user-group --home-dir ${datadir}/polkit-1 polkitd;', '', d)}"
 USERADD_PARAM:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'resolved', '--system -d / -M --shell /sbin/nologin systemd-resolve;', '', d)}"
 USERADD_PARAM:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'timesyncd', '--system -d / -M --shell /sbin/nologin systemd-timesync;', '', d)}"
 USERADD_PARAM:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'oomd', '--system -d / -M --shell /sbin/nologin systemd-oom;', '', d)}"
@@ -480,7 +496,7 @@ RDEPENDS:${PN}-initramfs = "${PN}"
 
 FILES:${PN}-gui = "${bindir}/systemadm"
 
-FILES:${PN}-vconsole-setup = "${rootlibexecdir}/systemd/systemd-vconsole-setup \
+FILES:${PN}-vconsole-setup = "${nonarch_libdir}/systemd/systemd-vconsole-setup \
                               ${systemd_system_unitdir}/systemd-vconsole-setup.service \
                               ${systemd_system_unitdir}/sysinit.target.wants/systemd-vconsole-setup.service"
 
@@ -496,15 +512,14 @@ FILES:${PN}-zsh-completion = "${datadir}/zsh/site-functions"
 
 FILES:${PN}-binfmt = "${sysconfdir}/binfmt.d/ \
                       ${exec_prefix}/lib/binfmt.d \
-                      ${rootlibexecdir}/systemd/systemd-binfmt \
+                      ${nonarch_libdir}/systemd/systemd-binfmt \
                       ${systemd_system_unitdir}/proc-sys-fs-binfmt_misc.* \
                       ${systemd_system_unitdir}/systemd-binfmt.service"
 RRECOMMENDS:${PN}-binfmt = "${@bb.utils.contains('PACKAGECONFIG', 'binfmt', 'kernel-module-binfmt-misc', '', d)}"
 
 RDEPENDS:${PN}-vconsole-setup = "${@bb.utils.contains('PACKAGECONFIG', 'vconsole', 'kbd kbd-consolefonts kbd-keymaps', '', d)}"
 
-
-FILES:${PN}-journal-gatewayd = "${rootlibexecdir}/systemd/systemd-journal-gatewayd \
+FILES:${PN}-journal-gatewayd = "${nonarch_libdir}/systemd/systemd-journal-gatewayd \
                                 ${systemd_system_unitdir}/systemd-journal-gatewayd.service \
                                 ${systemd_system_unitdir}/systemd-journal-gatewayd.socket \
                                 ${systemd_system_unitdir}/sockets.target.wants/systemd-journal-gatewayd.socket \
@@ -512,20 +527,20 @@ FILES:${PN}-journal-gatewayd = "${rootlibexecdir}/systemd/systemd-journal-gatewa
                                "
 SYSTEMD_SERVICE:${PN}-journal-gatewayd = "systemd-journal-gatewayd.socket"
 
-FILES:${PN}-journal-upload = "${rootlibexecdir}/systemd/systemd-journal-upload \
+FILES:${PN}-journal-upload = "${nonarch_libdir}/systemd/systemd-journal-upload \
                               ${systemd_system_unitdir}/systemd-journal-upload.service \
                               ${sysconfdir}/systemd/journal-upload.conf \
                              "
 SYSTEMD_SERVICE:${PN}-journal-upload = "systemd-journal-upload.service"
 
-FILES:${PN}-journal-remote = "${rootlibexecdir}/systemd/systemd-journal-remote \
+FILES:${PN}-journal-remote = "${nonarch_libdir}/systemd/systemd-journal-remote \
+                              ${nonarch_libdir}/sysusers.d/systemd-remote.conf \
                               ${sysconfdir}/systemd/journal-remote.conf \
                               ${systemd_system_unitdir}/systemd-journal-remote.service \
                               ${systemd_system_unitdir}/systemd-journal-remote.socket \
                              "
 SYSTEMD_SERVICE:${PN}-journal-remote = "systemd-journal-remote.socket"
 
-
 FILES:${PN}-container = "${sysconfdir}/dbus-1/system.d/org.freedesktop.import1.conf \
                          ${sysconfdir}/dbus-1/system.d/org.freedesktop.machine1.conf \
                          ${sysconfdir}/systemd/system/multi-user.target.wants/machines.target \
@@ -545,10 +560,10 @@ FILES:${PN}-container = "${sysconfdir}/dbus-1/system.d/org.freedesktop.import1.c
                          ${systemd_system_unitdir}/systemd-machined.service \
                          ${systemd_system_unitdir}/dbus-org.freedesktop.machine1.service \
                          ${systemd_system_unitdir}/var-lib-machines.mount \
-                         ${rootlibexecdir}/systemd/systemd-import \
-                         ${rootlibexecdir}/systemd/systemd-importd \
-                         ${rootlibexecdir}/systemd/systemd-machined \
-                         ${rootlibexecdir}/systemd/systemd-pull \
+                         ${nonarch_libdir}/systemd/systemd-import \
+                         ${nonarch_libdir}/systemd/systemd-importd \
+                         ${nonarch_libdir}/systemd/systemd-machined \
+                         ${nonarch_libdir}/systemd/systemd-pull \
                          ${exec_prefix}/lib/tmpfiles.d/systemd-nspawn.conf \
                          ${exec_prefix}/lib/tmpfiles.d/README \
                          ${systemd_system_unitdir}/systemd-nspawn@.service \
@@ -586,28 +601,18 @@ FILES:${PN}-extra-utils = "\
                         ${bindir}/systemd-cgls \
                         ${bindir}/systemd-cgtop \
                         ${bindir}/systemd-stdio-bridge \
-                        ${base_bindir}/systemd-ask-password \
-                        ${base_bindir}/systemd-tty-ask-password-agent \
                         ${base_sbindir}/mount.ddi \
                         ${systemd_system_unitdir}/initrd.target.wants/systemd-pcrphase-initrd.path \
-                        ${systemd_system_unitdir}/systemd-ask-password-console.path \
-                        ${systemd_system_unitdir}/systemd-ask-password-console.service \
-                        ${systemd_system_unitdir}/systemd-ask-password-wall.path \
-                        ${systemd_system_unitdir}/systemd-ask-password-wall.service \
-                        ${systemd_system_unitdir}/sysinit.target.wants/systemd-ask-password-console.path \
-                        ${systemd_system_unitdir}/sysinit.target.wants/systemd-ask-password-wall.path \
                         ${systemd_system_unitdir}/sysinit.target.wants/systemd-pcrphase.path \
                         ${systemd_system_unitdir}/sysinit.target.wants/systemd-pcrphase-sysinit.path \
-                        ${systemd_system_unitdir}/multi-user.target.wants/systemd-ask-password-wall.path \
-                        ${rootlibexecdir}/systemd/systemd-resolve-host \
-                        ${rootlibexecdir}/systemd/systemd-ac-power \
-                        ${rootlibexecdir}/systemd/systemd-activate \
-                        ${rootlibexecdir}/systemd/systemd-measure \
-                        ${rootlibexecdir}/systemd/systemd-pcrphase \
-                        ${rootlibexecdir}/systemd/systemd-socket-proxyd \
-                        ${rootlibexecdir}/systemd/systemd-reply-password \
-                        ${rootlibexecdir}/systemd/systemd-sleep \
-                        ${rootlibexecdir}/systemd/system-sleep \
+                        ${nonarch_libdir}/systemd/systemd-resolve-host \
+                        ${nonarch_libdir}/systemd/systemd-ac-power \
+                        ${nonarch_libdir}/systemd/systemd-activate \
+                        ${nonarch_libdir}/systemd/systemd-measure \
+                        ${nonarch_libdir}/systemd/systemd-pcrphase \
+                        ${nonarch_libdir}/systemd/systemd-socket-proxyd \
+                        ${nonarch_libdir}/systemd/systemd-sleep \
+                        ${nonarch_libdir}/systemd/system-sleep \
                         ${systemd_system_unitdir}/systemd-hibernate.service \
                         ${systemd_system_unitdir}/systemd-hybrid-sleep.service \
                         ${systemd_system_unitdir}/systemd-pcrphase-initrd.service \
@@ -615,25 +620,48 @@ FILES:${PN}-extra-utils = "\
                         ${systemd_system_unitdir}/systemd-pcrphase-sysinit.service \
                         ${systemd_system_unitdir}/systemd-suspend.service \
                         ${systemd_system_unitdir}/sleep.target \
-                        ${rootlibexecdir}/systemd/systemd-initctl \
+                        ${nonarch_libdir}/systemd/systemd-initctl \
                         ${systemd_system_unitdir}/systemd-initctl.service \
                         ${systemd_system_unitdir}/systemd-initctl.socket \
                         ${systemd_system_unitdir}/sockets.target.wants/systemd-initctl.socket \
-                        ${rootlibexecdir}/systemd/system-generators/systemd-gpt-auto-generator \
-                        ${rootlibexecdir}/systemd/systemd-cgroups-agent \
+                        ${nonarch_libdir}/systemd/system-generators/systemd-gpt-auto-generator \
+                        ${nonarch_libdir}/systemd/systemd-cgroups-agent \
+"
+
+FILES:${PN}-mime = "${MIMEDIR}"
+RRECOMMENDS:${PN} += "${PN}-mime"
+
+FILES:${PN}-networkd = "\
+    ${bindir}/networkctl \
+    ${datadir}/dbus-1/system-services/org.freedesktop.network1.service \
+    ${datadir}/dbus-1/system.d/org.freedesktop.network1.conf \
+    ${datadir}/polkit-1/actions/org.freedesktop.network1.policy \
+    ${nonarch_libdir}/sysusers.d/systemd-network.conf \
+    ${nonarch_libdir}/tmpfiles.d/systemd-network.conf \
+    ${sysconfdir}/systemd/networkd.conf \
+    ${systemd_system_unitdir}/systemd-networkd* \
+    ${systemd_unitdir}/network/*.network \
+    ${systemd_unitdir}/network/*.network.example \
+    ${systemd_unitdir}/networkd.conf \
+    ${systemd_unitdir}/systemd-networkd* \
 "
+# systemd-networkd-persistent-storage.service BindsTo=systemd-networkd.service
+# systemd-networkd.service has Also=systemd-networkd-wait-online.service
+SYSTEMD_SERVICE:${PN}-networkd = "systemd-networkd.service"
+CONFFILES:${PN}-networkd = "${sysconfdir}/systemd/networkd.conf"
+RDEPENDS:${PN}-networkd += "${PN}"
+RRECOMMENDS:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'networkd', '${PN}-networkd', '', d)}"
 
 FILES:${PN}-udev-rules = "\
-                        ${rootlibexecdir}/udev/rules.d/70-uaccess.rules \
-                        ${rootlibexecdir}/udev/rules.d/71-seat.rules \
-                        ${rootlibexecdir}/udev/rules.d/73-seat-late.rules \
-                        ${rootlibexecdir}/udev/rules.d/99-systemd.rules \
+                        ${nonarch_libdir}/udev/rules.d/70-uaccess.rules \
+                        ${nonarch_libdir}/udev/rules.d/71-seat.rules \
+                        ${nonarch_libdir}/udev/rules.d/73-seat-late.rules \
+                        ${nonarch_libdir}/udev/rules.d/99-systemd.rules \
 "
 
 CONFFILES:${PN} = "${sysconfdir}/systemd/coredump.conf \
         ${sysconfdir}/systemd/journald.conf \
         ${sysconfdir}/systemd/logind.conf \
-        ${sysconfdir}/systemd/networkd.conf \
         ${sysconfdir}/systemd/pstore.conf \
         ${sysconfdir}/systemd/resolved.conf \
         ${sysconfdir}/systemd/sleep.conf \
@@ -669,8 +697,10 @@ FILES:${PN} = " ${base_bindir}/* \
                 ${sysconfdir}/init.d/README \
                 ${sysconfdir}/resolv-conf.systemd \
                 ${sysconfdir}/X11/xinit/xinitrc.d/* \
-                ${rootlibexecdir}/systemd/* \
-                ${rootlibdir}/systemd/libsystemd-core* \
+                ${sysconfdir}/ssh/ssh_config.d/20-systemd-ssh-proxy.conf \
+                ${sysconfdir}/ssh/sshd_config.d/20-systemd-userdb.conf \
+                ${nonarch_libdir}/systemd/* \
+                ${libdir}/systemd/libsystemd-core* \
                 ${libdir}/pam.d \
                 ${nonarch_libdir}/pam.d \
                 ${systemd_unitdir}/* \
@@ -695,11 +725,10 @@ FILES:${PN} = " ${base_bindir}/* \
                 ${exec_prefix}/lib/environment.d \
                 ${exec_prefix}/lib/pcrlock.d \
                 ${localstatedir} \
-                ${rootlibexecdir}/modprobe.d/systemd.conf \
-                ${rootlibexecdir}/modprobe.d/README \
+                ${nonarch_libdir}/modprobe.d/systemd.conf \
+                ${nonarch_libdir}/modprobe.d/README \
                 ${datadir}/dbus-1/system.d/org.freedesktop.timedate1.conf \
                 ${datadir}/dbus-1/system.d/org.freedesktop.locale1.conf \
-                ${datadir}/dbus-1/system.d/org.freedesktop.network1.conf \
                 ${datadir}/dbus-1/system.d/org.freedesktop.resolve1.conf \
                 ${datadir}/dbus-1/system.d/org.freedesktop.systemd1.conf \
                 ${@bb.utils.contains('PACKAGECONFIG', 'polkit_hostnamed_fallback', '${datadir}/dbus-1/system.d/org.freedesktop.hostname1_no_polkit.conf', '', d)} \
@@ -713,11 +742,11 @@ FILES:${PN} = " ${base_bindir}/* \
 
 FILES:${PN}-dev += "${base_libdir}/security/*.la ${datadir}/dbus-1/interfaces/ ${sysconfdir}/rpm/macros.systemd"
 
-RDEPENDS:${PN} += "kmod dbus util-linux-mount util-linux-umount udev (= ${EXTENDPKGV}) systemd-udev-rules util-linux-agetty util-linux-fsck util-linux-swaponoff"
-RDEPENDS:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'serial-getty-generator', '', 'systemd-serialgetty', d)}"
+RDEPENDS:${PN} += "kmod ${VIRTUAL-RUNTIME_dbus} util-linux-mount util-linux-umount udev (= ${EXTENDPKGV}) systemd-udev-rules util-linux-agetty util-linux-fsck util-linux-swaponoff util-linux-mkswap"
+RDEPENDS:${PN} += "systemd-serialgetty"
 RDEPENDS:${PN} += "volatile-binds"
 
-RRECOMMENDS:${PN} += "systemd-extra-utils \
+RRECOMMENDS:${PN} += "${PN}-extra-utils \
                       udev-hwdb \
                       e2fsprogs-e2fsck \
                       kernel-module-autofs4 kernel-module-unix kernel-module-ipv6 kernel-module-sch-fq-codel \
@@ -731,7 +760,7 @@ INSANE_SKIP:${PN}-dbg += "libdir"
 INSANE_SKIP:${PN}-doc += " libdir"
 INSANE_SKIP:libsystemd-shared += "libdir"
 
-FILES:libsystemd-shared = "${rootlibdir}/systemd/libsystemd-shared*.so"
+FILES:libsystemd-shared = "${libdir}/systemd/libsystemd-shared*.so"
 
 RPROVIDES:udev = "hotplug"
 
@@ -739,58 +768,58 @@ RDEPENDS:udev-bash-completion += "bash-completion"
 RDEPENDS:udev-hwdb += "udev"
 
 FILES:udev += "${base_sbindir}/udevd \
-               ${rootlibexecdir}/systemd/network/99-default.link \
-               ${rootlibexecdir}/systemd/systemd-udevd \
-               ${rootlibexecdir}/udev/accelerometer \
-               ${rootlibexecdir}/udev/ata_id \
-               ${rootlibexecdir}/udev/cdrom_id \
-               ${rootlibexecdir}/udev/collect \
-               ${rootlibexecdir}/udev/dmi_memory_id \
-               ${rootlibexecdir}/udev/fido_id \
-               ${rootlibexecdir}/udev/findkeyboards \
-               ${rootlibexecdir}/udev/iocost \
-               ${rootlibexecdir}/udev/keyboard-force-release.sh \
-               ${rootlibexecdir}/udev/keymap \
-               ${rootlibexecdir}/udev/mtd_probe \
-               ${rootlibexecdir}/udev/scsi_id \
-               ${rootlibexecdir}/udev/v4l_id \
-               ${rootlibexecdir}/udev/keymaps \
-               ${rootlibexecdir}/udev/rules.d/50-udev-default.rules \
-               ${rootlibexecdir}/udev/rules.d/60-autosuspend.rules \
-               ${rootlibexecdir}/udev/rules.d/60-autosuspend-chromiumos.rules \
-               ${rootlibexecdir}/udev/rules.d/60-block.rules \
-               ${rootlibexecdir}/udev/rules.d/60-cdrom_id.rules \
-               ${rootlibexecdir}/udev/rules.d/60-dmi-id.rules \
-               ${rootlibexecdir}/udev/rules.d/60-drm.rules \
-               ${rootlibexecdir}/udev/rules.d/60-evdev.rules \
-               ${rootlibexecdir}/udev/rules.d/60-fido-id.rules \
-               ${rootlibexecdir}/udev/rules.d/60-infiniband.rules \
-               ${rootlibexecdir}/udev/rules.d/60-input-id.rules \
-               ${rootlibexecdir}/udev/rules.d/60-persistent-alsa.rules \
-               ${rootlibexecdir}/udev/rules.d/60-persistent-input.rules \
-               ${rootlibexecdir}/udev/rules.d/60-persistent-storage.rules \
-               ${rootlibexecdir}/udev/rules.d/60-persistent-storage-mtd.rules \
-               ${rootlibexecdir}/udev/rules.d/60-persistent-storage-tape.rules \
-               ${rootlibexecdir}/udev/rules.d/60-persistent-v4l.rules \
-               ${rootlibexecdir}/udev/rules.d/60-sensor.rules \
-               ${rootlibexecdir}/udev/rules.d/60-serial.rules \
-               ${rootlibexecdir}/udev/rules.d/61-autosuspend-manual.rules \
-               ${rootlibexecdir}/udev/rules.d/64-btrfs.rules \
-               ${rootlibexecdir}/udev/rules.d/70-camera.rules \
-               ${rootlibexecdir}/udev/rules.d/70-joystick.rules \
-               ${rootlibexecdir}/udev/rules.d/70-memory.rules \
-               ${rootlibexecdir}/udev/rules.d/70-mouse.rules \
-               ${rootlibexecdir}/udev/rules.d/70-power-switch.rules \
-               ${rootlibexecdir}/udev/rules.d/70-touchpad.rules \
-               ${rootlibexecdir}/udev/rules.d/75-net-description.rules \
-               ${rootlibexecdir}/udev/rules.d/75-probe_mtd.rules \
-               ${rootlibexecdir}/udev/rules.d/78-sound-card.rules \
-               ${rootlibexecdir}/udev/rules.d/80-drivers.rules \
-               ${rootlibexecdir}/udev/rules.d/80-net-setup-link.rules \
-               ${rootlibexecdir}/udev/rules.d/81-net-dhcp.rules \
-               ${rootlibexecdir}/udev/rules.d/90-vconsole.rules \
-               ${rootlibexecdir}/udev/rules.d/90-iocost.rules \
-               ${rootlibexecdir}/udev/rules.d/README \
+               ${nonarch_libdir}/systemd/network/99-default.link \
+               ${nonarch_libdir}/systemd/systemd-udevd \
+               ${nonarch_libdir}/udev/accelerometer \
+               ${nonarch_libdir}/udev/ata_id \
+               ${nonarch_libdir}/udev/cdrom_id \
+               ${nonarch_libdir}/udev/collect \
+               ${nonarch_libdir}/udev/dmi_memory_id \
+               ${nonarch_libdir}/udev/fido_id \
+               ${nonarch_libdir}/udev/findkeyboards \
+               ${nonarch_libdir}/udev/iocost \
+               ${nonarch_libdir}/udev/keyboard-force-release.sh \
+               ${nonarch_libdir}/udev/keymap \
+               ${nonarch_libdir}/udev/mtd_probe \
+               ${nonarch_libdir}/udev/scsi_id \
+               ${nonarch_libdir}/udev/v4l_id \
+               ${nonarch_libdir}/udev/keymaps \
+               ${nonarch_libdir}/udev/rules.d/50-udev-default.rules \
+               ${nonarch_libdir}/udev/rules.d/60-autosuspend.rules \
+               ${nonarch_libdir}/udev/rules.d/60-autosuspend-chromiumos.rules \
+               ${nonarch_libdir}/udev/rules.d/60-block.rules \
+               ${nonarch_libdir}/udev/rules.d/60-cdrom_id.rules \
+               ${nonarch_libdir}/udev/rules.d/60-dmi-id.rules \
+               ${nonarch_libdir}/udev/rules.d/60-drm.rules \
+               ${nonarch_libdir}/udev/rules.d/60-evdev.rules \
+               ${nonarch_libdir}/udev/rules.d/60-fido-id.rules \
+               ${nonarch_libdir}/udev/rules.d/60-infiniband.rules \
+               ${nonarch_libdir}/udev/rules.d/60-input-id.rules \
+               ${nonarch_libdir}/udev/rules.d/60-persistent-alsa.rules \
+               ${nonarch_libdir}/udev/rules.d/60-persistent-input.rules \
+               ${nonarch_libdir}/udev/rules.d/60-persistent-storage.rules \
+               ${nonarch_libdir}/udev/rules.d/60-persistent-storage-mtd.rules \
+               ${nonarch_libdir}/udev/rules.d/60-persistent-storage-tape.rules \
+               ${nonarch_libdir}/udev/rules.d/60-persistent-v4l.rules \
+               ${nonarch_libdir}/udev/rules.d/60-sensor.rules \
+               ${nonarch_libdir}/udev/rules.d/60-serial.rules \
+               ${nonarch_libdir}/udev/rules.d/61-autosuspend-manual.rules \
+               ${nonarch_libdir}/udev/rules.d/64-btrfs.rules \
+               ${nonarch_libdir}/udev/rules.d/70-camera.rules \
+               ${nonarch_libdir}/udev/rules.d/70-joystick.rules \
+               ${nonarch_libdir}/udev/rules.d/70-memory.rules \
+               ${nonarch_libdir}/udev/rules.d/70-mouse.rules \
+               ${nonarch_libdir}/udev/rules.d/70-power-switch.rules \
+               ${nonarch_libdir}/udev/rules.d/70-touchpad.rules \
+               ${nonarch_libdir}/udev/rules.d/75-net-description.rules \
+               ${nonarch_libdir}/udev/rules.d/75-probe_mtd.rules \
+               ${nonarch_libdir}/udev/rules.d/78-sound-card.rules \
+               ${nonarch_libdir}/udev/rules.d/80-drivers.rules \
+               ${nonarch_libdir}/udev/rules.d/80-net-setup-link.rules \
+               ${nonarch_libdir}/udev/rules.d/81-net-dhcp.rules \
+               ${nonarch_libdir}/udev/rules.d/90-vconsole.rules \
+               ${nonarch_libdir}/udev/rules.d/90-iocost.rules \
+               ${nonarch_libdir}/udev/rules.d/README \
                ${sysconfdir}/udev \
                ${sysconfdir}/init.d/systemd-udevd \
                ${systemd_system_unitdir}/*udev* \
@@ -802,7 +831,7 @@ FILES:udev += "${base_sbindir}/udevd \
               "
 
 FILES:udev-bash-completion = "${datadir}/bash-completion/completions/udevadm"
-FILES:udev-hwdb = "${rootlibexecdir}/udev/hwdb.d \
+FILES:udev-hwdb = "${nonarch_libdir}/udev/hwdb.d \
                    "
 
 RCONFLICTS:${PN} = "tiny-init ${@bb.utils.contains('PACKAGECONFIG', 'resolved', 'resolvconf', '', d)}"
@@ -831,7 +860,9 @@ python do_warn_musl() {
 }
 addtask warn_musl before do_configure
 
-ALTERNATIVE:${PN} = "halt reboot shutdown poweroff runlevel ${@bb.utils.contains('PACKAGECONFIG', 'resolved', 'resolv-conf', '', d)}"
+ALTERNATIVE:${PN} = "halt reboot shutdown poweroff \
+                     ${@bb.utils.contains('PACKAGECONFIG', 'sysvinit', 'runlevel', '', d)} \
+                     ${@bb.utils.contains('PACKAGECONFIG', 'resolved', 'resolv-conf', '', d)}"
 
 ALTERNATIVE_TARGET[resolv-conf] = "${sysconfdir}/resolv-conf.systemd"
 ALTERNATIVE_LINK_NAME[resolv-conf] = "${sysconfdir}/resolv.conf"
@@ -857,6 +888,12 @@ ALTERNATIVE_TARGET[runlevel] = "${base_bindir}/systemctl"
 ALTERNATIVE_LINK_NAME[runlevel] = "${base_sbindir}/runlevel"
 ALTERNATIVE_PRIORITY[runlevel] ?= "300"
 
+pkg_postinst:${PN}:append () {
+        if ${@bb.utils.contains('PACKAGECONFIG', 'set-time-epoch', 'true', 'false', d)}; then
+                touch $D${nonarch_libdir}/clock-epoch
+        fi
+}
+
 pkg_postinst:${PN}:libc-glibc () {
         if ${@bb.utils.contains('PACKAGECONFIG', 'myhostname', 'true', 'false', d)}; then
                 sed -e '/^hosts:/s/\s*\<myhostname\>//' \
@@ -885,15 +922,19 @@ pkg_prerm:${PN}:libc-glibc () {
         fi
 }
 
-PACKAGE_WRITE_DEPS += "qemu-native"
+PACKAGE_WRITE_DEPS += "qemuwrapper-cross"
+
 pkg_postinst:udev-hwdb () {
         if test -n "$D"; then
-                $INTERCEPT_DIR/postinst_intercept update_udev_hwdb ${PKG} mlprefix=${MLPREFIX} binprefix=${MLPREFIX} rootlibexecdir="${rootlibexecdir}" PREFERRED_PROVIDER_udev="${PREFERRED_PROVIDER_udev}" base_bindir="${base_bindir}"
+                $INTERCEPT_DIR/postinst_intercept update_udev_hwdb ${PKG} mlprefix=${MLPREFIX} binprefix=${MLPREFIX} \
+                        rootlibexecdir="${nonarch_libdir}" PREFERRED_PROVIDER_udev="${PREFERRED_PROVIDER_udev}" base_bindir="${base_bindir}"
         else
-                udevadm hwdb --update
+                systemd-hwdb update
         fi
 }
 
 pkg_prerm:udev-hwdb () {
         rm -f $D${sysconfdir}/udev/hwdb.bin
 }
+
+require dlopen-deps.inc
diff --git a/meta/recipes-core/sysvinit/sysvinit-inittab_2.88dsf.bb b/meta/recipes-core/sysvinit/sysvinit-inittab_2.88dsf.bb
index 6bbe517df1..c77266e71e 100644
--- a/meta/recipes-core/sysvinit/sysvinit-inittab_2.88dsf.bb
+++ b/meta/recipes-core/sysvinit/sysvinit-inittab_2.88dsf.bb
@@ -2,11 +2,10 @@ SUMMARY = "Inittab configuration for SysVinit"
 LICENSE = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/GPL-2.0-only;md5=801f80980d171dd6425610833a22dbe6"
 
-
 SRC_URI = "file://inittab \
            file://start_getty"
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 INHIBIT_DEFAULT_DEPS = "1"
 
@@ -16,9 +15,9 @@ do_compile() {
 
 do_install() {
     install -d ${D}${sysconfdir}
-    install -m 0644 ${WORKDIR}/inittab ${D}${sysconfdir}/inittab
+    install -m 0644 ${S}/inittab ${D}${sysconfdir}/inittab
     install -d ${D}${base_bindir}
-    install -m 0755 ${WORKDIR}/start_getty ${D}${base_bindir}/start_getty
+    install -m 0755 ${S}/start_getty ${D}${base_bindir}/start_getty
     sed -e 's,/usr/bin,${bindir},g' -i ${D}${base_bindir}/start_getty
 
     CONSOLES="${SERIAL_CONSOLES}"
diff --git a/meta/recipes-core/sysvinit/sysvinit/0001-hddown-include-libgen.h-for-basename-API.patch b/meta/recipes-core/sysvinit/sysvinit/0001-hddown-include-libgen.h-for-basename-API.patch
deleted file mode 100644
index 5e4053bad1..0000000000
--- a/meta/recipes-core/sysvinit/sysvinit/0001-hddown-include-libgen.h-for-basename-API.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From a07c1d94e79840c59563741b45e690e77d4f3dfa Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Sun, 3 Dec 2023 20:09:30 -0800
-Subject: [PATCH] hddown: include libgen.h for basename API
-
-musl has removed the non-prototype declaration of basename from string.h [1] which now results in build errors with clang-17+ compiler
-
-include libgen.h for using the posix declaration of the funciton.
-
-Fixes
-
-hddown.c:135:8: error: incompatible integer to pointer conversion assigning to 'char *' from 'int' [-Wint-conversion]
-  135 |                         ptr = basename(lnk);
-      |                             ^ ~~~~~~~~~~~~~
-
-[1] https://git.musl-libc.org/cgit/musl/commit/?id=725e17ed6dff4d0cd22487bb64470881e86a92e7
-
-Upstream-Status: Submitted [https://github.com/slicer69/sysvinit/pull/21]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
----
- src/hddown.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/hddown.c b/src/hddown.c
-index 7a2cf28..3b31bc0 100644
---- a/src/hddown.c
-+++ b/src/hddown.c
-@@ -24,6 +24,7 @@ char *v_hddown = "@(#)hddown.c  1.02  22-Apr-2003  miquels@cistron.nl";
- #ifndef _GNU_SOURCE
- #define _GNU_SOURCE
- #endif
-+#include <libgen.h>
- #include <stdio.h>
- #include <stdlib.h>
- #include <unistd.h>
--- 
-2.43.0
-
diff --git a/meta/recipes-core/sysvinit/sysvinit/0001-include-sys-sysmacros.h-for-major-minor-defines-in-g.patch b/meta/recipes-core/sysvinit/sysvinit/0001-include-sys-sysmacros.h-for-major-minor-defines-in-g.patch
deleted file mode 100644
index 60fbd87534..0000000000
--- a/meta/recipes-core/sysvinit/sysvinit/0001-include-sys-sysmacros.h-for-major-minor-defines-in-g.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From c710a3accd1fabdb671274e1a458405282d51e0c Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Mon, 6 Aug 2018 15:38:58 -0700
-Subject: [PATCH] include sys/sysmacros.h for major/minor definitions
-
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-Upstream-Status: Pending
-
----
- src/bootlogd.c   | 1 +
- src/mountpoint.c | 1 +
- src/shutdown.c   | 1 +
- 3 files changed, 3 insertions(+)
-
-diff --git a/src/bootlogd.c b/src/bootlogd.c
-index 787db87..8b07903 100644
---- a/src/bootlogd.c
-+++ b/src/bootlogd.c
-@@ -29,6 +29,7 @@
- #include <sys/types.h>
- #include <sys/time.h>
- #include <sys/stat.h>
-+#include <sys/sysmacros.h>
- #include <sys/ioctl.h>
- #include <sys/utsname.h>
- #include <time.h>
-diff --git a/src/mountpoint.c b/src/mountpoint.c
-index 5f20522..94df7a1 100644
---- a/src/mountpoint.c
-+++ b/src/mountpoint.c
-@@ -25,6 +25,7 @@
- 
- #include <sys/types.h>
- #include <sys/stat.h>
-+#include <sys/sysmacros.h>
- #include <unistd.h>
- #include <stdlib.h>
- #include <string.h>
-diff --git a/src/shutdown.c b/src/shutdown.c
-index b744a2c..40b7faf 100644
---- a/src/shutdown.c
-+++ b/src/shutdown.c
-@@ -40,6 +40,7 @@
- #endif
- #include <sys/types.h>
- #include <sys/stat.h>
-+#include <sys/sysmacros.h>
- #include <sys/wait.h>
- #ifdef __linux__
- #include <sys/sysmacros.h>   /* brought in my LFS patch */
diff --git a/meta/recipes-core/sysvinit/sysvinit/crypt-lib.patch b/meta/recipes-core/sysvinit/sysvinit/crypt-lib.patch
index 5c39fb001b..1ac54fb667 100644
--- a/meta/recipes-core/sysvinit/sysvinit/crypt-lib.patch
+++ b/meta/recipes-core/sysvinit/sysvinit/crypt-lib.patch
@@ -1,33 +1,33 @@
-From c3a068cf24a22bea7349849ec111ae8d91a54db4 Mon Sep 17 00:00:00 2001
+From f040b04c50d13755b2063c4db0e0be0647cf5d14 Mon Sep 17 00:00:00 2001
 From: Jeff Dike <jdike@x86_64.user-mode-linux.org>
 Date: Wed, 14 Jul 2010 14:35:52 -0400
 Subject: [PATCH] sysvinit - Remove sulogin dependency on /usr/lib*/libcrypt.a
 
-Upstream-Status: Inappropriate [configuration]
-
-# The src Makefile was checking for libcrypt.a on the host, not in the
-# build environment.  This patch checks for $LCRYPT in the environment
-# and uses it if it's there.
-# - jdike@linux.intel.com
+The src Makefile was checking for libcrypt.a on the host, not in the
+build environment.  This patch checks for $LCRYPT in the environment
+and uses it if it's there.
+jdike@linux.intel.com
 
+Upstream-Status: Inappropriate [configuration]
 ---
- src/Makefile | 11 ++---------
- 1 file changed, 2 insertions(+), 9 deletions(-)
+ src/Makefile | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
 
 diff --git a/src/Makefile b/src/Makefile
-index 5b1a5a2..b686394 100644
+index 6d9f01c..b12a233 100644
 --- a/src/Makefile
 +++ b/src/Makefile
-@@ -97,15 +97,8 @@ else
+@@ -97,16 +97,8 @@ else
+   SULOGINLIBS  =
  endif
  
- # Additional libs for GNU libc.
--ifneq ($(wildcard $(ROOT)/usr/lib*/libcrypt.*),)
+-# Additional libs for GNU libc.
+-ifneq ($(wildcard $(ROOT)/$(usrdir)/lib*/libcrypt.*),)
 -  SULOGINLIBS  += -lcrypt
 -endif
 -
 -# Additional libs for GNU libc / multiarch on Debian based systems.
--ifneq ($(wildcard $(ROOT)/usr/lib/*/libcrypt.*),)
+-ifneq ($(wildcard $(ROOT)/$(usrdir)/lib/*/libcrypt.*),)
 -ifneq ($(findstring -lcrypt, $(SULOGINLIBS)), -lcrypt)
 -  SULOGINLIBS  += -lcrypt
 -endif
diff --git a/meta/recipes-core/sysvinit/sysvinit/install.patch b/meta/recipes-core/sysvinit/sysvinit/install.patch
deleted file mode 100644
index bc6d493c2b..0000000000
--- a/meta/recipes-core/sysvinit/sysvinit/install.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From 5e35aa105e7a2e85db2a89fee4114090b1ac55be Mon Sep 17 00:00:00 2001
-From: Qing He <qing.he@intel.com>
-Date: Fri, 18 Jun 2010 09:40:30 +0800
-Subject: [PATCH] sysvinit: upgrade to version 2.88dsf
-
-Upstream-Status: Submitted [https://github.com/slicer69/sysvinit/pull/13]
-
----
- src/Makefile | 53 +++++++++++++++++++++++++++++-----------------------
- 1 file changed, 30 insertions(+), 23 deletions(-)
-
-diff --git a/src/Makefile b/src/Makefile
-index 1b368dc..5b1a5a2 100644
---- a/src/Makefile
-+++ b/src/Makefile
-@@ -77,7 +77,14 @@ else
-   INSTALL_DATA = install -m 644
- endif
- INSTALL_DIR    = install -m 755 -d
--MANDIR         = /usr/share/man
-+
-+ROOT         ?=
-+base_bindir  ?= /bin
-+base_sbindir ?= /sbin
-+bindir       ?= /usr/bin
-+sysconfdir   ?= /etc
-+includedir   ?= /usr/include
-+mandir       ?= /usr/share/man
- 
- ifeq ($(WITH_SELINUX),yes)
-   SELINUX_DEF  =  -DWITH_SELINUX
-@@ -191,43 +198,43 @@ clobber:  cleanobjs
- distclean:     clobber
- 
- install:       all
--               $(INSTALL_DIR) $(ROOT)/bin/ $(ROOT)/sbin/
--               $(INSTALL_DIR) $(ROOT)/usr/bin/
-+               $(INSTALL_DIR) $(ROOT)$(base_bindir)/ $(ROOT)$(base_sbindir)/
-+               $(INSTALL_DIR) $(ROOT)$(bindir)/
-                for i in $(BIN); do \
--                       $(INSTALL_EXEC) $$i $(ROOT)/bin/ ; \
-+                       $(INSTALL_EXEC) $$i $(ROOT)$(base_bindir)/ ; \
-                done
-                for i in $(SBIN); do \
--                       $(INSTALL_EXEC) $$i $(ROOT)/sbin/ ; \
-+                       $(INSTALL_EXEC) $$i $(ROOT)$(base_sbindir)/ ; \
-                done
-                for i in $(USRBIN); do \
--                       $(INSTALL_EXEC) $$i $(ROOT)/usr/bin/ ; \
-+                       $(INSTALL_EXEC) $$i $(ROOT)$(bindir)/ ; \
-                done
-                # $(INSTALL_DIR) $(ROOT)/etc/
-                $(INSTALL_DIR) $(ROOT)/etc/inittab.d
-                # $(INSTALL_EXEC) ../doc/initscript.sample $(ROOT)/etc/
--               ln -sf halt $(ROOT)/sbin/reboot
--               ln -sf halt $(ROOT)/sbin/poweroff
--               ln -sf init $(ROOT)/sbin/telinit
--               ln -sf /sbin/killall5 $(ROOT)/bin/pidof
--               if [ ! -f $(ROOT)/usr/bin/lastb ]; then \
--                       ln -sf last $(ROOT)/usr/bin/lastb; \
-+               ln -sf halt $(ROOT)$(base_sbindir)/reboot
-+               ln -sf halt $(ROOT)$(base_sbindir)/poweroff
-+               ln -sf init $(ROOT)$(base_sbindir)/telinit
-+               ln -sf $(base_sbindir)/killall5 $(ROOT)$(base_bindir)/pidof
-+               if [ ! -f $(ROOT)$(bindir)/lastb ]; then \
-+                       ln -sf last $(ROOT)$(bindir)/lastb; \
-                fi
--               $(INSTALL_DIR) $(ROOT)/usr/include/
--               $(INSTALL_DATA) initreq.h $(ROOT)/usr/include/
--               $(INSTALL_DIR) $(ROOT)$(MANDIR)/man1/
--               $(INSTALL_DIR) $(ROOT)$(MANDIR)/man5/
--               $(INSTALL_DIR) $(ROOT)$(MANDIR)/man8/
-+               $(INSTALL_DIR) $(ROOT)$(includedir)/
-+               $(INSTALL_DATA) initreq.h $(ROOT)$(includedir)/
-+               $(INSTALL_DIR) $(ROOT)$(mandir)/man1/
-+               $(INSTALL_DIR) $(ROOT)$(mandir)/man5/
-+               $(INSTALL_DIR) $(ROOT)$(mandir)/man8/
-                for man in $(MAN1); do \
--                       $(INSTALL_DATA) ../man/$$man $(ROOT)$(MANDIR)/man1/; \
--                       sed -i "1{ $(MANDB); }" $(ROOT)$(MANDIR)/man1/$$man ; \
-+                       $(INSTALL_DATA) ../man/$$man $(ROOT)$(mandir)/man1/; \
-+                       sed -i "1{ $(MANDB); }" $(ROOT)$(mandir)/man1/$$man ; \
-                done
-                for man in $(MAN5); do \
--                       $(INSTALL_DATA) ../man/$$man $(ROOT)$(MANDIR)/man5/; \
--                       sed -i "1{ $(MANDB); }" $(ROOT)$(MANDIR)/man5/$$man ; \
-+                       $(INSTALL_DATA) ../man/$$man $(ROOT)$(mandir)/man5/; \
-+                       sed -i "1{ $(MANDB); }" $(ROOT)$(mandir)/man5/$$man ; \
-                done
-                for man in $(MAN8); do \
--                       $(INSTALL_DATA) ../man/$$man $(ROOT)$(MANDIR)/man8/; \
--                       sed -i "1{ $(MANDB); }" $(ROOT)$(MANDIR)/man8/$$man ; \
-+                       $(INSTALL_DATA) ../man/$$man $(ROOT)$(mandir)/man8/; \
-+                       sed -i "1{ $(MANDB); }" $(ROOT)$(mandir)/man8/$$man ; \
-                done
- ifeq ($(ROOT),)
-                #
diff --git a/meta/recipes-core/sysvinit/sysvinit/pidof-add-m-option.patch b/meta/recipes-core/sysvinit/sysvinit/pidof-add-m-option.patch
deleted file mode 100644
index 8ef292ed12..0000000000
--- a/meta/recipes-core/sysvinit/sysvinit/pidof-add-m-option.patch
+++ /dev/null
@@ -1,191 +0,0 @@
-From 0e441712d0e366a0384ff3fa879f5a2d2607c24f Mon Sep 17 00:00:00 2001
-From: Hongxu Jia <hongxu.jia@windriver.com>
-Date: Wed, 24 Jul 2013 17:07:22 +0800
-Subject: [PATCH] pidof: add -m option
-
-When used with -o, will also omit any processes that have the same
-argv[0] and argv[1] as any explicitly omitted process ids. This can be
-used to avoid multiple shell scripts concurrently calling pidof returning
-each other's pids.
-
-https://bugzilla.redhat.com/show_bug.cgi?id=883856
-
-Upstream-Status: Backport
-Imported patch from: https://bugzilla.redhat.com/attachment.cgi?id=658166
-
-Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
-
----
- man/pidof.8    |  6 +++++
- src/killall5.c | 62 +++++++++++++++++++++++++++++++++++++++++++++++---
- 2 files changed, 65 insertions(+), 3 deletions(-)
-
-diff --git a/man/pidof.8 b/man/pidof.8
-index 6866cb3..a87d878 100644
---- a/man/pidof.8
-+++ b/man/pidof.8
-@@ -25,6 +25,7 @@ pidof - find the process ID of a running program
- .RB [ \-n ]
- .RB [ \-x ]
- .RB [ \-z ]
-+.RB [ \-m ]
- .RB [ \-o
- .IR omitpid[,omitpid...] ]
- .RB [ \-o
-@@ -77,6 +78,11 @@ is shown. The default separator is a space.
- Tells \fIpidof\fP to omit processes with that process id. The special
- pid \fB%PPID\fP can be used to name the parent process of the \fBpidof\fP
- program, in other words the calling shell or shell script.
-+.IP -m
-+When used with -o, will also omit any processes that have the same
-+argv[0] and argv[1] as any explicitly omitted process ids. This can be
-+used to avoid multiple shell scripts concurrently calling pidof returning
-+each other's pids.
- .SH "EXIT STATUS"
- .TP
- .B 0
-diff --git a/src/killall5.c b/src/killall5.c
-index b0728fa..72289e3 100644
---- a/src/killall5.c
-+++ b/src/killall5.c
-@@ -121,6 +121,7 @@ typedef struct _s_nfs
- 
- /* List of processes. */
- PROC *plist;
-+PROC *olist;
- 
- /* List of processes to omit. */
- OMIT *omit;
-@@ -356,6 +357,20 @@ static void clear_mnt(void)
-        }
- }
- 
-+static void clear_omit(void)
-+{
-+       OMIT *o;
-+       PROC *p;
-+       for (o = omit; o; o = omit) {
-+               omit = omit->next;
-+               free(o);
-+       }
-+       for (p = olist; p; p = olist) {
-+               olist = olist->next;
-+               free(p);
-+       }
-+}
-+
- /*
-  *     Check if path is a shadow off a NFS partition.
-  */
-@@ -481,6 +496,7 @@ int readproc()
-        DIR             *dir;
-        FILE            *fp;
-        PROC            *p, *n;
-+       OMIT            *o, *m;
-        struct dirent   *d;
-        char            path[PATH_MAX+1];
-        char            buf[PATH_MAX+1];
-@@ -670,6 +686,17 @@ int readproc()
-                p->next = plist;
-                plist = p;
-                p->pid = pid;
-+               /* Could be smarter, but it's a small list. */
-+               m = omit;
-+               for (o = omit; m; o = m) {
-+                       m = o->next;
-+                       if (o->pid == p->pid) {
-+                               n = (PROC*)xmalloc(sizeof(PROC));
-+                               *n = *p;
-+                               n->next = olist;
-+                               olist = n;
-+                       }
-+               }
-        }
-        closedir(dir);
- 
-@@ -870,6 +897,26 @@ PIDQ_HEAD *pidof(char *prog)
-        return q;
- }
- 
-+int matches(PROC *o, PROC *p)
-+{
-+       int ret = 0;
-+       char *oargv1, *pargv1;
-+       if ((o->argv0 && p->argv0 && !strcmp(o->argv0,p->argv0))) {
-+               if (o->argv1 && p->argv1) {
-+                       if ((oargv1 = canonicalize_file_name(o->argv1)) == NULL)
-+                               oargv1 = strdup(o->argv1);
-+                       if ((pargv1 = canonicalize_file_name(p->argv1)) == NULL)
-+                               pargv1 = strdup(p->argv1);
-+                       if (! strcmp(oargv1, pargv1)) {
-+                               ret = 1;
-+                       }
-+                       free(oargv1);
-+                       free(pargv1);
-+               }
-+       }
-+       return ret;
-+}
-+
- /* Give usage message and exit. */
- void usage(void)
- {
-@@ -920,6 +967,7 @@ void nsyslog(int pri, char *fmt, ...)
- #define PIDOF_OMIT     0x02
- #define PIDOF_NETFS    0x04
- #define PIDOF_QUIET     0x08
-+#define PIDOF_OMIT_OMIT_MATCHES        0x08
- 
- /*
-  *     Pidof functionality.
-@@ -937,6 +985,7 @@ int main_pidof(int argc, char **argv)
-        char            tmp[512];
-         char            sep = ' ';
- 
-+       olist = (PROC*)0;
-        omit = (OMIT*)0;
-        nlist = (NFS*)0;
-        opterr = 0;
-@@ -944,7 +993,7 @@ int main_pidof(int argc, char **argv)
-        if ((token = getenv("PIDOF_NETFS")) && (strcmp(token,"no") != 0))
-                flags |= PIDOF_NETFS;
- 
--       while ((opt = getopt(argc,argv,"qhco:d:sxzn")) != EOF) switch (opt) {
-+       while ((opt = getopt(argc,argv,"qhcmo:d:sxzn")) != EOF) switch (opt) {
-                case '?':
-                        nsyslog(LOG_ERR,"invalid options on command line!\n");
-                        closelog();
-@@ -995,6 +1044,9 @@ int main_pidof(int argc, char **argv)
-                 case 'z':
-                         list_dz_processes = TRUE;
-                         break;
-+               case 'm':
-+                       flags |= PIDOF_OMIT_OMIT_MATCHES;
-+                       break;
-                case 'n':
-                        flags |= PIDOF_NETFS;
-                        break;
-@@ -1026,10 +1078,13 @@ int main_pidof(int argc, char **argv)
-                        pid_t spid = 0;
-                        while ((p = get_next_from_pid_q(q))) {
-                                if ((flags & PIDOF_OMIT) && omit) {
--                                       OMIT * optr;
--                                       for (optr = omit; optr; optr = optr->next) {
-+                                       PROC * optr;
-+                                       for (optr = olist; optr; optr = optr->next) {
-                                                if (optr->pid == p->pid)
-                                                        break;
-+                                               if (flags & PIDOF_OMIT_OMIT_MATCHES)
-+                                                       if (matches(optr, p))
-+                                                               break;
-                                        }
- 
-                                        /*
-@@ -1071,6 +1126,7 @@ int main_pidof(int argc, char **argv)
-                printf("\n");
-         }
- 
-+       clear_omit();
-        clear_mnt();
- 
-        closelog();
diff --git a/meta/recipes-core/sysvinit/sysvinit/realpath.patch b/meta/recipes-core/sysvinit/sysvinit/realpath.patch
deleted file mode 100644
index b559aa3b49..0000000000
--- a/meta/recipes-core/sysvinit/sysvinit/realpath.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From eb158c97f19d473d01befe96359a7f93ae834517 Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Thu, 19 Nov 2015 00:10:03 +0000
-Subject: [PATCH] Fix build on musl use realpath() API its available on all
- libcs
-
-realpath() API doesnt work on systems with PATH_MAX set to be unlimited e.g. GNU/Hurd
-However for Linux it should always work
-
-Upstream-Status: Inappropriate [Linux specific]
-
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-
----
- src/killall5.c   | 4 ++--
- src/mountpoint.c | 1 +
- src/wall.c       | 1 +
- 3 files changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/src/killall5.c b/src/killall5.c
-index a664954..9798423 100644
---- a/src/killall5.c
-+++ b/src/killall5.c
-@@ -977,9 +977,9 @@ int matches(PROC *o, PROC *p)
-        char *oargv1, *pargv1;
-        if ((o->argv0 && p->argv0 && !strcmp(o->argv0,p->argv0))) {
-                if (o->argv1 && p->argv1) {
--                       if ((oargv1 = canonicalize_file_name(o->argv1)) == NULL)
-+                       if ((oargv1 = realpath(o->argv1, NULL)) == NULL)
-                                oargv1 = strdup(o->argv1);
--                       if ((pargv1 = canonicalize_file_name(p->argv1)) == NULL)
-+                       if ((pargv1 = realpath(p->argv1, NULL)) == NULL)
-                                pargv1 = strdup(p->argv1);
-                        if (! strcmp(oargv1, pargv1)) {
-                                ret = 1;
-diff --git a/src/mountpoint.c b/src/mountpoint.c
-index b24335e..5f20522 100644
---- a/src/mountpoint.c
-+++ b/src/mountpoint.c
-@@ -23,6 +23,7 @@
-  *             Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-  */
- 
-+#include <sys/types.h>
- #include <sys/stat.h>
- #include <unistd.h>
- #include <stdlib.h>
-diff --git a/src/wall.c b/src/wall.c
-index d3a2c70..00826e9 100644
---- a/src/wall.c
-+++ b/src/wall.c
-@@ -30,6 +30,7 @@
- #include <pwd.h>
- #include <syslog.h>
- #include <sys/types.h>
-+#include <time.h>
- #include "init.h"
- 
- 
diff --git a/meta/recipes-core/sysvinit/sysvinit/sysvinit_remove_linux_fs.patch b/meta/recipes-core/sysvinit/sysvinit/sysvinit_remove_linux_fs.patch
deleted file mode 100644
index 89d65c23b7..0000000000
--- a/meta/recipes-core/sysvinit/sysvinit/sysvinit_remove_linux_fs.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-# From glibc 2.36, <linux/mount.h> (included from <linux/fs.h>) and 
-# <sys/mount.h> (included from glibc) are no longer compatible:
-# https://sourceware.org/glibc/wiki/Release/2.36#Usage_of_.3Clinux.2Fmount.h.3E_and_.3Csys.2Fmount.h.3E
-
-Upstream-Status: Pending
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-
---- sysvinit-3.04/src/sulogin.c.orig    2022-08-07 23:07:42.952576274 +0200
-+++ sysvinit-3.04/src/sulogin.c 2022-08-07 23:08:26.511470983 +0200
-@@ -51,7 +51,6 @@
- #ifdef __linux__
- #  include <sys/statfs.h>
- #  include <sys/mount.h>
--#  include <linux/fs.h>
- #  include <linux/magic.h>
- #  include <linux/major.h>
- #  ifndef TMPFS_MAGIC
diff --git a/meta/recipes-core/sysvinit/sysvinit_3.04.bb b/meta/recipes-core/sysvinit/sysvinit_3.14.bb
index 6a612468f3..d4bb797624 100644
--- a/meta/recipes-core/sysvinit/sysvinit_3.04.bb
+++ b/meta/recipes-core/sysvinit/sysvinit_3.14.bb
@@ -9,25 +9,20 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=751419260aa954499f7abaabaa882bbe \
 
 RDEPENDS:${PN} = "${PN}-inittab"
 
-SRC_URI = "${SAVANNAH_GNU_MIRROR}/sysvinit/sysvinit-${PV}.tar.xz \
-           file://install.patch \
+GITHUB_BASE_URI = "https://github.com/slicer69/${BPN}/releases/"
+SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/${BP}.tar.xz \
            file://crypt-lib.patch \
-           file://pidof-add-m-option.patch \
-           file://realpath.patch \
-           file://0001-include-sys-sysmacros.h-for-major-minor-defines-in-g.patch \
-           file://sysvinit_remove_linux_fs.patch \
            file://rcS-default \
            file://rc \
            file://rcS \
            file://bootlogd.init \
            file://01_bootlogd \
-           file://0001-hddown-include-libgen.h-for-basename-API.patch \
            "
-SRC_URI[sha256sum] = "2a621fe6e4528bc91308b74867ddaaebbdf7753f02395c0c5bae817bd2b7e3a5"
+SRC_URI[sha256sum] = "c90874b8c054a35991fb8c4d30c443ed1e9b1815ff6165c7b483f558be4e4b53"
 
-S = "${WORKDIR}/sysvinit-${PV}"
+S = "${UNPACKDIR}/sysvinit-${PV}"
 
-inherit update-alternatives features_check
+inherit update-alternatives features_check github-releases
 DEPENDS:append = " update-rc.d-native base-passwd virtual/crypt"
 do_package_setscene[depends] = "${MLPREFIX}base-passwd:do_populate_sysroot"
 
@@ -97,18 +92,18 @@ do_install () {
 
         sed -e \
                 's:#PSPLASH_TEXT#:${@bb.utils.contains("PACKAGECONFIG","psplash-text-updates","yes","no", d)}:g' \
-                ${WORKDIR}/rcS-default > ${D}${sysconfdir}/default/rcS
+                ${UNPACKDIR}/rcS-default > ${D}${sysconfdir}/default/rcS
         chmod 0644 ${D}${sysconfdir}/default/rcS
-        install -m 0755    ${WORKDIR}/rc                ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/rcS               ${D}${sysconfdir}/init.d
-        install -m 0755    ${WORKDIR}/bootlogd.init     ${D}${sysconfdir}/init.d/bootlogd
+        install -m 0755    ${UNPACKDIR}/rc              ${D}${sysconfdir}/init.d
+        install -m 0755    ${UNPACKDIR}/rcS             ${D}${sysconfdir}/init.d
+        install -m 0755    ${UNPACKDIR}/bootlogd.init     ${D}${sysconfdir}/init.d/bootlogd
         ln -sf bootlogd ${D}${sysconfdir}/init.d/stop-bootlogd
 
         update-rc.d -r ${D} bootlogd start 07 S .
         update-rc.d -r ${D} stop-bootlogd start 99 2 3 4 5 .
 
         install -d ${D}${sysconfdir}/default/volatiles
-        install -m 0644 ${WORKDIR}/01_bootlogd ${D}${sysconfdir}/default/volatiles
+        install -m 0644 ${UNPACKDIR}/01_bootlogd ${D}${sysconfdir}/default/volatiles
 
         chown root:shutdown ${D}${base_sbindir}/halt ${D}${base_sbindir}/shutdown
         chmod o-x,u+s ${D}${base_sbindir}/halt ${D}${base_sbindir}/shutdown
diff --git a/meta/recipes-core/ttyrun/ttyrun_2.32.0.bb b/meta/recipes-core/ttyrun/ttyrun_2.38.0.bb
index 9a8be15dab..90380e51ea 100644
--- a/meta/recipes-core/ttyrun/ttyrun_2.32.0.bb
+++ b/meta/recipes-core/ttyrun/ttyrun_2.38.0.bb
@@ -6,10 +6,10 @@ HOMEPAGE = "https://github.com/ibm-s390-linux/s390-tools"
 LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=f5118f167b055bfd7c3450803f1847af"
 
-SRC_URI = "git://github.com/ibm-s390-linux/s390-tools;protocol=https;branch=master"
-SRCREV = "9eea78b3ad8ab3710fb3b2d80b9cd058d7c8aba7"
+SRC_URI = "git://github.com/ibm-s390-linux/s390-tools;protocol=https;branch=master;tag=v${PV}"
+SRCREV = "660bab6e68fded26b2117e1dcec0844549a22fed"
 
-S = "${WORKDIR}/git"
+CVE_PRODUCT = "s390-tools"
 
 EXTRA_OEMAKE = "\
     V=1 \
diff --git a/meta/recipes-core/udev/eudev/0001-random-util.c-sync-dev_urandom-implementation-to-sys.patch b/meta/recipes-core/udev/eudev/0001-random-util.c-sync-dev_urandom-implementation-to-sys.patch
new file mode 100644
index 0000000000..668aa731ac
--- /dev/null
+++ b/meta/recipes-core/udev/eudev/0001-random-util.c-sync-dev_urandom-implementation-to-sys.patch
@@ -0,0 +1,138 @@
+From 95c871b7b912f39539777ac222ef7f8798bb0225 Mon Sep 17 00:00:00 2001
+From: Masahisa Kojima <kojima.masahisa@socionext.com>
+Date: Thu, 25 Apr 2024 17:23:10 +0900
+Subject: [PATCH] random-util.c: sync dev_urandom implementation to
+ systemd-udev
+
+Current dev_urandom() assumes that reading /dev/urandom
+will never block regardless if the random pool is fully
+initialized or not.
+This assumption is no longer applicable since linux kerrnel
+enforces the /dev/urandom entropy initialization from
+v5.18-rc2 with the commit:
+48bff1053c17 ("random: opportunistically initialize on /dev/urandom reads").
+
+With this, when we use the linux v5.18-rc2 or later,
+dev_urandom() will block if enough random pool is not supplied.
+It causes the boot delay, typically 1024msec(4msec * 256 = 1024msec)
+delay to fill the 256 bits entropy for the case CONFIG_HZ=250.
+
+To prevent this boot delay, this commit syncs dev_urandom()
+implementation to the systemd-udev.
+The systemd-udev implementation of reading /dev/urandom is as follows.
+ - Try to get random with calling getrandom(GRND_INSECURE)
+ - If kernel does not support GRND_INSECURE, fallback to GRND_NONBLOCK
+ - If enough entropy is not supplied, fallback to reading /dev/urandom,
+   this will block when the kernel version is v5.18-rc2 or later
+
+With this modification, dev_urandom() tries not to block
+as much as possible.
+
+This modification still keeps the backword compatibility,
+dev_random() will never block if the commit(48bff1053c17) is not
+applied to the linux kernel, the behavior is same as before
+in this case.
+
+Upstream-Status: Backport [a49a3aaa460add6ae7ea208b4cac630e56fe1180]
+Signed-off-by: Masahisa Kojima <kojima.masahisa@socionext.com>
+---
+ src/shared/missing.h     |  4 +++
+ src/shared/random-util.c | 70 ++++++++++++++++++----------------------
+ 2 files changed, 35 insertions(+), 39 deletions(-)
+
+diff --git a/src/shared/missing.h b/src/shared/missing.h
+index 1967840cdbf3..1caec0f9207c 100644
+--- a/src/shared/missing.h
++++ b/src/shared/missing.h
+@@ -79,6 +79,10 @@ static inline int getrandom(void *buffer, size_t count, unsigned flags) {
+ #define GRND_RANDOM 0x0002
+ #endif
+ 
++#ifndef GRND_INSECURE
++#define GRND_INSECURE 0x0004
++#endif
++
+ #ifndef BTRFS_IOCTL_MAGIC
+ #define BTRFS_IOCTL_MAGIC 0x94
+ #endif
+diff --git a/src/shared/random-util.c b/src/shared/random-util.c
+index 01a28c8ef4e9..852b00e4ce2b 100644
+--- a/src/shared/random-util.c
++++ b/src/shared/random-util.c
+@@ -31,45 +31,37 @@
+ #include "util.h"
+ 
+ int dev_urandom(void *p, size_t n) {
+-        static int have_syscall = -1;
+-
+-        _cleanup_close_ int fd = -1;
+-        int r;
+-
+-        /* Gathers some randomness from the kernel. This call will
+-         * never block, and will always return some data from the
+-         * kernel, regardless if the random pool is fully initialized
+-         * or not. It thus makes no guarantee for the quality of the
+-         * returned entropy, but is good enough for or usual usecases
+-         * of seeding the hash functions for hashtable */
+-
+-        /* Use the getrandom() syscall unless we know we don't have
+-         * it, or when the requested size is too large for it. */
+-        if (have_syscall != 0 || (size_t) (int) n != n) {
+-                r = getrandom(p, n, GRND_NONBLOCK);
+-                if (r == (int) n) {
+-                        have_syscall = true;
+-                        return 0;
+-                }
+-
+-                if (r < 0) {
+-                        if (errno == ENOSYS)
+-                                /* we lack the syscall, continue with
+-                                 * reading from /dev/urandom */
+-                                have_syscall = false;
+-                        else if (errno == EAGAIN)
+-                                /* not enough entropy for now. Let's
+-                                 * remember to use the syscall the
+-                                 * next time, again, but also read
+-                                 * from /dev/urandom for now, which
+-                                 * doesn't care about the current
+-                                 * amount of entropy.  */
+-                                have_syscall = true;
+-                        else
+-                                return -errno;
+-                } else
+-                        /* too short read? */
+-                        return -ENODATA;
++        static bool have_getrandom = true, have_grndinsecure = true;
++        _cleanup_close_ int fd = -EBADF;
++
++        if (n == 0)
++                return 0;
++
++        for (;;) {
++                ssize_t l;
++
++                if (!have_getrandom)
++                        break;
++
++                l = getrandom(p, n, have_grndinsecure ? GRND_INSECURE : GRND_NONBLOCK);
++                if (l > 0) {
++                        if ((size_t) l == n)
++                                return 0; /* Done reading, success. */
++                        p = (uint8_t *) p + l;
++                        n -= l;
++                        continue; /* Interrupted by a signal; keep going. */
++                } else if (l == 0)
++                        break; /* Weird, so fallback to /dev/urandom. */
++                else if (errno == ENOSYS) {
++                        have_getrandom = false;
++                        break; /* No syscall, so fallback to /dev/urandom. */
++                } else if (errno == EINVAL && have_grndinsecure) {
++                        have_grndinsecure = false;
++                        continue; /* No GRND_INSECURE; fallback to GRND_NONBLOCK. */
++                } else if (errno == EAGAIN && !have_grndinsecure)
++                        break; /* Will block, but no GRND_INSECURE, so fallback to /dev/urandom. */
++
++                break; /* Unexpected, so just give up and fallback to /dev/urandom. */
+         }
+ 
+         fd = open("/dev/urandom", O_RDONLY|O_CLOEXEC|O_NOCTTY);
diff --git a/meta/recipes-core/udev/eudev/init b/meta/recipes-core/udev/eudev/init
index 477a525b21..790cd3b933 100644
--- a/meta/recipes-core/udev/eudev/init
+++ b/meta/recipes-core/udev/eudev/init
@@ -27,8 +27,7 @@ make_static_nodes () {
     [ -e /lib/modules/$(uname -r)/modules.devname ] || return 0
     [ -x @KMOD@ ] || return 0
 
-    #output to /proc/self/fd/1 since /dev/stdout not created by udevd yet
-    @KMOD@ static-nodes --format=tmpfiles --output=/proc/self/fd/1 |
+    @KMOD@ static-nodes --format=tmpfiles |
     while read TTYPE TPATH TMODE TUSER TGROUP TAGE TARG; do
     case "${TTYPE}" in
     'd')
diff --git a/meta/recipes-core/udev/eudev_3.2.14.bb b/meta/recipes-core/udev/eudev_3.2.14.bb
index 18696679c8..a2d222e655 100644
--- a/meta/recipes-core/udev/eudev_3.2.14.bb
+++ b/meta/recipes-core/udev/eudev_3.2.14.bb
@@ -13,13 +13,14 @@ SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${BP}.tar.gz \
            file://netifnames.patch \
            file://init \
            file://local.rules \
+           file://0001-random-util.c-sync-dev_urandom-implementation-to-sys.patch \
            "
 
 SRC_URI[sha256sum] = "8da4319102f24abbf7fff5ce9c416af848df163b29590e666d334cc1927f006f"
 
 GITHUB_BASE_URI = "https://github.com/eudev-project/eudev/releases"
 
-inherit autotools update-rc.d qemu pkgconfig features_check manpages github-releases
+inherit autotools update-rc.d pkgconfig features_check manpages github-releases
 
 CONFLICT_DISTRO_FEATURES = "systemd"
 
@@ -42,12 +43,12 @@ PACKAGECONFIG[selinux] = "--enable-selinux,--disable-selinux,libselinux"
 
 do_install:append() {
         install -d ${D}${sysconfdir}/init.d
-        install -m 0755 ${WORKDIR}/init ${D}${sysconfdir}/init.d/udev
+        install -m 0755 ${UNPACKDIR}/init ${D}${sysconfdir}/init.d/udev
         sed -i s%@UDEVD@%${base_sbindir}/udevd% ${D}${sysconfdir}/init.d/udev
         sed -i s%@KMOD@%${base_bindir}/kmod% ${D}${sysconfdir}/init.d/udev
 
         install -d ${D}${sysconfdir}/udev/rules.d
-        install -m 0644 ${WORKDIR}/local.rules ${D}${sysconfdir}/udev/rules.d/local.rules
+        install -m 0644 ${UNPACKDIR}/local.rules ${D}${sysconfdir}/udev/rules.d/local.rules
 
         # Use classic network interface naming scheme if no 'pni-names' distro feature
         if ${@bb.utils.contains('DISTRO_FEATURES', 'pni-names', 'false', 'true', d)}; then
@@ -76,7 +77,7 @@ RDEPENDS:${PN} += "kmod"
 RPROVIDES:${PN} = "hotplug udev"
 RPROVIDES:${PN}-hwdb += "udev-hwdb"
 
-PACKAGE_WRITE_DEPS += "qemu-native"
+PACKAGE_WRITE_DEPS += "qemuwrapper-cross"
 pkg_postinst:${PN}-hwdb () {
         if test -n "$D"; then
                 $INTERCEPT_DIR/postinst_intercept update_udev_hwdb ${PKG} mlprefix=${MLPREFIX} binprefix=${MLPREFIX}
diff --git a/meta/recipes-core/udev/udev-extraconf/mount.sh b/meta/recipes-core/udev/udev-extraconf/mount.sh
index c19e2aa68a..0cbae48729 100644
--- a/meta/recipes-core/udev/udev-extraconf/mount.sh
+++ b/meta/recipes-core/udev/udev-extraconf/mount.sh
@@ -83,11 +83,11 @@ automount_systemd() {
 
     MOUNT="$MOUNT -o silent"
 
-    # If filesystemtype is vfat, change the ownership group to 'disk', and
+    # If filesystemtype is vfat, change the ownership group to mount group, and
     # grant it with  w/r/x permissions.
     case $ID_FS_TYPE in
     vfat|fat)
-        MOUNT="$MOUNT -o umask=007,gid=`awk -F':' '/^disk/{print $3}' /etc/group`"
+        MOUNT="$MOUNT -o umask=007,gid=`awk -F':' '/^@MOUNT_GROUP@:/{print $3}' /etc/group`"
         ;;
     swap)
         return ;;
@@ -98,7 +98,7 @@ automount_systemd() {
         ;;
     esac
 
-    if ! $MOUNT --no-block -t auto $DEVNAME "$MOUNT_BASE/$name"
+    if ! $MOUNT --collect --no-block -t auto $DEVNAME "$MOUNT_BASE/$name"
     then
         #logger "mount.sh/automount" "$MOUNT -t auto $DEVNAME \"$MOUNT_BASE/$name\" failed!"
         rm_dir "$MOUNT_BASE/$name"
@@ -138,11 +138,11 @@ automount() {
                 MOUNT="$MOUNT -o silent"
         fi
 
-        # If filesystem type is vfat, change the ownership group to 'disk', and
+        # If filesystem type is vfat, change the ownership group to mount group, and
         # grant it with  w/r/x permissions.
         case $ID_FS_TYPE in
         vfat|fat)
-                MOUNT="$MOUNT -o umask=007,gid=`awk -F':' '/^disk/{print $3}' /etc/group`"
+                MOUNT="$MOUNT -o umask=007,gid=`awk -F':' '/^@MOUNT_GROUP@:/{print $3}' /etc/group`"
                 ;;
         swap)
                 return ;;
diff --git a/meta/recipes-core/udev/udev-extraconf/network.sh b/meta/recipes-core/udev/udev-extraconf/network.sh
index 3ee92714af..500e60ae61 100644
--- a/meta/recipes-core/udev/udev-extraconf/network.sh
+++ b/meta/recipes-core/udev/udev-extraconf/network.sh
@@ -6,44 +6,12 @@ echo "$INTERFACE" | grep -q wifi && exit 0
 # udevd does clearenv(). Export shell PATH to children.
 export PATH
 
-# Check if /etc/init.d/network has been run yet to see if we are 
-# called by starting /etc/rcS.d/S03udev and not by hotplugging a device
-#
-# At this stage, network interfaces should not be brought up
-# automatically because:
-# a)    /etc/init.d/network has not been run yet (security issue)
-# b)    /var has not been populated yet so /etc/resolv,conf points to 
-#       oblivion, making the network unusable
-#
-
-spoofp="`grep ^spoofprotect /etc/network/options`"
-if test -z "$spoofp"
-then
-        # This is the default from /etc/init.d/network
-        spoofp_val=yes
-else
-        spoofp_val=${spoofp#spoofprotect=}
-fi
-
-test "$spoofp_val" = yes && spoofp_val=1 || spoofp_val=0
-
-# I think it is safe to assume that "lo" will always be there ;)
-if test "`cat /proc/sys/net/ipv4/conf/lo/rp_filter`" != "$spoofp_val" -a -n "$spoofp_val"
-then
-        echo "$INTERFACE" >> /dev/udev_network_queue    
-        exit 0
-fi
-
-#
-# Code taken from pcmcia-cs:/etc/pcmcia/network
-#
-
 # if this interface has an entry in /etc/network/interfaces, let ifupdown
 # handle it
 if grep -q "iface \+$INTERFACE" /etc/network/interfaces; then
   case $ACTION in
     add)
-        ifconfig | grep -q "^$INTERFACE" || ifup $INTERFACE
+        ip addr show dev "$INTERFACE" up | grep -q "$INTERFACE" || ifup $INTERFACE
         ;;
     remove)
         ifdown $INTERFACE
diff --git a/meta/recipes-core/udev/udev-extraconf_1.1.bb b/meta/recipes-core/udev/udev-extraconf_1.1.bb
index 30f1fe76d0..2ba6606c05 100644
--- a/meta/recipes-core/udev/udev-extraconf_1.1.bb
+++ b/meta/recipes-core/udev/udev-extraconf_1.1.bb
@@ -13,28 +13,31 @@ SRC_URI = " \
        file://localextra.rules \
 "
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 MOUNT_BASE = "/run/media"
+MOUNT_GROUP ?= "disk"
 
 do_install() {
     install -d ${D}${sysconfdir}/udev/rules.d
 
-    install -m 0644 ${WORKDIR}/automount.rules     ${D}${sysconfdir}/udev/rules.d/automount.rules
-    install -m 0644 ${WORKDIR}/autonet.rules       ${D}${sysconfdir}/udev/rules.d/autonet.rules
-    install -m 0644 ${WORKDIR}/localextra.rules    ${D}${sysconfdir}/udev/rules.d/localextra.rules
+    install -m 0644 ${S}/automount.rules     ${D}${sysconfdir}/udev/rules.d/automount.rules
+    install -m 0644 ${S}/autonet.rules       ${D}${sysconfdir}/udev/rules.d/autonet.rules
+    install -m 0644 ${S}/localextra.rules    ${D}${sysconfdir}/udev/rules.d/localextra.rules
 
     install -d ${D}${sysconfdir}/udev/mount.ignorelist.d
-    install -m 0644 ${WORKDIR}/mount.ignorelist     ${D}${sysconfdir}/udev/
+    install -m 0644 ${S}/mount.ignorelist     ${D}${sysconfdir}/udev/
 
     install -d ${D}${sysconfdir}/udev/scripts/
 
-    install -m 0755 ${WORKDIR}/mount.sh ${D}${sysconfdir}/udev/scripts/mount.sh
-    sed -i 's|@systemd_unitdir@|${systemd_unitdir}|g' ${D}${sysconfdir}/udev/scripts/mount.sh
-    sed -i 's|@base_sbindir@|${base_sbindir}|g' ${D}${sysconfdir}/udev/scripts/mount.sh
-    sed -i 's|@MOUNT_BASE@|${MOUNT_BASE}|g' ${D}${sysconfdir}/udev/scripts/mount.sh
+    install -m 0755 ${S}/mount.sh ${D}${sysconfdir}/udev/scripts/mount.sh
+    sed -e 's|@systemd_unitdir@|${systemd_unitdir}|g' \
+        -e 's|@base_sbindir@|${base_sbindir}|g' \
+        -e 's|@MOUNT_BASE@|${MOUNT_BASE}|g' \
+        -e 's|@MOUNT_GROUP@|${MOUNT_GROUP}|g' \
+        -i ${D}${sysconfdir}/udev/scripts/mount.sh
 
-    install -m 0755 ${WORKDIR}/network.sh ${D}${sysconfdir}/udev/scripts
+    install -m 0755 ${S}/network.sh ${D}${sysconfdir}/udev/scripts
 }
 
 pkg_postinst:${PN} () {
diff --git a/meta/recipes-core/update-rc.d/update-rc.d_0.8.bb b/meta/recipes-core/update-rc.d/update-rc.d_0.8.bb
index ba622fe716..124b7d32a2 100644
--- a/meta/recipes-core/update-rc.d/update-rc.d_0.8.bb
+++ b/meta/recipes-core/update-rc.d/update-rc.d_0.8.bb
@@ -8,11 +8,10 @@ LIC_FILES_CHKSUM = "file://update-rc.d;beginline=5;endline=15;md5=d40a07c27f5354
 
 SRC_URI = "git://git.yoctoproject.org/update-rc.d;branch=master;protocol=https"
 SRCREV = "b8f950105010270a768aa12245d6abf166346015"
+PV .= "+git"
 
 UPSTREAM_CHECK_COMMITS = "1"
 
-S = "${WORKDIR}/git"
-
 inherit allarch
 
 do_compile() {
diff --git a/meta/recipes-core/util-linux/util-linux-libuuid_2.39.3.bb b/meta/recipes-core/util-linux/util-linux-libuuid_2.41.bb
index ec04c1d384..5ad2997c27 100644
--- a/meta/recipes-core/util-linux/util-linux-libuuid_2.39.3.bb
+++ b/meta/recipes-core/util-linux/util-linux-libuuid_2.41.bb
@@ -3,15 +3,17 @@
 
 require util-linux.inc
 
+LICENSE = "BSD-3-Clause"
+LIC_FILES_CHKSUM = "file://libuuid/COPYING;md5=6d2cafc999feb2c2de84d4d24b23290c \
+                    file://Documentation/licenses/COPYING.BSD-3-Clause;md5=58dcd8452651fc8b07d1f65ce07ca8af"
+
 inherit autotools gettext pkgconfig
 
-S = "${WORKDIR}/util-linux-${PV}"
+S = "${UNPACKDIR}/util-linux-${PV}"
 
 EXTRA_AUTORECONF += "--exclude=gtkdocize"
 EXTRA_OECONF += "--disable-all-programs --enable-libuuid"
 
-LICENSE = "BSD-3-Clause"
-
 do_install:append() {
         rm -rf ${D}${datadir} ${D}${bindir} ${D}${base_bindir} ${D}${sbindir} ${D}${base_sbindir} ${D}${exec_prefix}/sbin
 }
diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc
index d506783f9a..111f29cb92 100644
--- a/meta/recipes-core/util-linux/util-linux.inc
+++ b/meta/recipes-core/util-linux/util-linux.inc
@@ -6,31 +6,9 @@ disk partitioning, kernel message management, filesystem creation, and system lo
 
 SECTION = "base"
 
-LICENSE = "GPL-1.0-or-later & GPL-2.0-or-later & LGPL-2.1-or-later & BSD-2-Clause & BSD-3-Clause & BSD-4-Clause & MIT"
-LICENSE:${PN}-fcntl-lock = "MIT"
-LICENSE:${PN}-fdisk = "GPL-1.0-or-later"
-LICENSE:${PN}-libblkid = "LGPL-2.1-or-later"
-LICENSE:${PN}-libfdisk = "LGPL-2.1-or-later"
-LICENSE:${PN}-libmount = "LGPL-2.1-or-later"
-LICENSE:${PN}-libsmartcols = "LGPL-2.1-or-later"
-
-LIC_FILES_CHKSUM = "file://README.licensing;md5=cc80239f106687ab39ef0271ff5cf4ba \
-                    file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
-                    file://Documentation/licenses/COPYING.GPL-2.0-or-later;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
-                    file://Documentation/licenses/COPYING.LGPL-2.1-or-later;md5=4fbd65380cdd255951079008b364516c \
-                    file://Documentation/licenses/COPYING.BSD-3-Clause;md5=58dcd8452651fc8b07d1f65ce07ca8af \
-                    file://Documentation/licenses/COPYING.BSD-4-Clause-UC;md5=263860f8968d8bafa5392cab74285262 \
-                    file://libuuid/COPYING;md5=6d2cafc999feb2c2de84d4d24b23290c \
-                    file://libmount/COPYING;md5=7c7e39fb7d70ffe5d693a643e29987c2 \
-                    file://libblkid/COPYING;md5=693bcbbe16d3a4a4b37bc906bc01cc04 \
-                    file://libfdisk/COPYING;md5=693bcbbe16d3a4a4b37bc906bc01cc04 \
-                    file://libsmartcols/COPYING;md5=693bcbbe16d3a4a4b37bc906bc01cc04 \
-                    "
-
 FILESEXTRAPATHS:prepend := "${THISDIR}/util-linux:"
 MAJOR_VERSION = "${@'.'.join(d.getVar('PV').split('.')[0:2])}"
 SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-linux-${PV}.tar.xz \
-           file://mit-license.patch \
            file://configure-sbindir.patch \
            file://runuser.pamd \
            file://runuser-l.pamd \
@@ -38,8 +16,12 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
            file://run-ptest \
            file://display_testname_for_subtest.patch \
            file://avoid_parallel_tests.patch \
-           file://0001-login-utils-include-libgen.h-for-basename-API.patch \
            file://fcntl-lock.c \
+           file://0001-tests-ts-kill-decode-avoid-using-shell-built-in-kill.patch \
+           file://0001-lsfd-mkfds-foreign-sockets-skip-when-lacking-sock_di.patch \
+           file://0001-ts-kill-decode-use-RTMIN-from-kill-L-instead-of-hard.patch \
            "
 
-SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f"
+SRC_URI[sha256sum] = "81ee93b3cfdfeb7d7c4090cedeba1d7bbce9141fd0b501b686b3fe475ddca4c6"
+
+CVE_PRODUCT = "util-linux"
diff --git a/meta/recipes-core/util-linux/util-linux/0001-login-utils-include-libgen.h-for-basename-API.patch b/meta/recipes-core/util-linux/util-linux/0001-login-utils-include-libgen.h-for-basename-API.patch
deleted file mode 100644
index 6258710e1e..0000000000
--- a/meta/recipes-core/util-linux/util-linux/0001-login-utils-include-libgen.h-for-basename-API.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From d44e3ad1f6f8b5c1b3098bb7d537943a4c21d22f Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Sun, 3 Dec 2023 19:59:46 -0800
-Subject: [PATCH] login-utils: include libgen.h for basename API
-
-musl has removed the non-prototype declaration of basename from string.h [1] which now results in build errors with clang-17+ compiler
-
-include libgen.h for using the posix declaration of the funciton.
-
-Fixes
-
-../util-linux-2.39.2/login-utils/su-common.c:847:20: error: call to undeclared function 'basename'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
-  847 |                 shell_basename = basename(shell);
-      |                                  ^
-
-[1] https://git.musl-libc.org/cgit/musl/commit/?id=725e17ed6dff4d0cd22487bb64470881e86a92e7
-
-Upstream-Status: Submitted [https://github.com/util-linux/util-linux/pull/2615]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-
----
- login-utils/su-common.c | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/login-utils/su-common.c b/login-utils/su-common.c
-index b674920..3297c78 100644
---- a/login-utils/su-common.c
-+++ b/login-utils/su-common.c
-@@ -26,6 +26,7 @@
- #include <sys/types.h>
- #include <pwd.h>
- #include <grp.h>
-+#include <libgen.h>
- #include <security/pam_appl.h>
- #ifdef HAVE_SECURITY_PAM_MISC_H
- # include <security/pam_misc.h>
-@@ -840,17 +841,20 @@ static void run_shell(
-                                su->simulate_login ? " login" : "",
-                                su->fast_startup ? " fast-start" : ""));
- 
-+  char* tmp = xstrdup(shell);
-        if (su->simulate_login) {
-                char *arg0;
-                char *shell_basename;
- 
--               shell_basename = basename(shell);
-+               shell_basename = basename(tmp);
-                arg0 = xmalloc(strlen(shell_basename) + 2);
-                arg0[0] = '-';
-                strcpy(arg0 + 1, shell_basename);
-                args[0] = arg0;
--       } else
--               args[0] = basename(shell);
-+       } else {
-+    args[0] = basename(tmp);
-+  }
-+  free(tmp);
- 
-        if (su->fast_startup)
-                args[argno++] = "-f";
diff --git a/meta/recipes-core/util-linux/util-linux/0001-lsfd-mkfds-foreign-sockets-skip-when-lacking-sock_di.patch b/meta/recipes-core/util-linux/util-linux/0001-lsfd-mkfds-foreign-sockets-skip-when-lacking-sock_di.patch
new file mode 100644
index 0000000000..e3f9112192
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/0001-lsfd-mkfds-foreign-sockets-skip-when-lacking-sock_di.patch
@@ -0,0 +1,36 @@
+From b3a1d92a9078fada31b2cf64b802edd616026766 Mon Sep 17 00:00:00 2001
+From: Chen Qi <Qi.Chen@windriver.com>
+Date: Mon, 26 May 2025 15:24:16 +0800
+Subject: [PATCH] lsfd/mkfds-foreign-sockets: skip when lacking sock_diag
+ ability
+
+The ENDPOINTS will need sock_diag ability. The kernel might not
+enable related configs. Check and skip in case of lacking such ability.
+
+Fixes: https://github.com/util-linux/util-linux/issues/3590
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+
+Upstream-Status: Submitted [https://github.com/util-linux/util-linux/pull/3591]
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+---
+ tests/ts/lsfd/mkfds-foreign-sockets | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tests/ts/lsfd/mkfds-foreign-sockets b/tests/ts/lsfd/mkfds-foreign-sockets
+index cd94da799..76138a7a6 100755
+--- a/tests/ts/lsfd/mkfds-foreign-sockets
++++ b/tests/ts/lsfd/mkfds-foreign-sockets
+@@ -30,6 +30,8 @@ ts_skip_nonroot
+ ts_skip_qemu_user
+ ts_cd "$TS_OUTDIR"
+ 
++lsfd_check_sockdiag "unix"
++
+ declare -A tcase
+ tcase[NAME]="state=connected"
+ tcase[SOCK.NETNS]=
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/util-linux/util-linux/0001-tests-ts-kill-decode-avoid-using-shell-built-in-kill.patch b/meta/recipes-core/util-linux/util-linux/0001-tests-ts-kill-decode-avoid-using-shell-built-in-kill.patch
new file mode 100644
index 0000000000..dece0e94b7
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/0001-tests-ts-kill-decode-avoid-using-shell-built-in-kill.patch
@@ -0,0 +1,36 @@
+From d2eeccf36542d506b660641a07a44f3976772897 Mon Sep 17 00:00:00 2001
+From: Chen Qi <Qi.Chen@windriver.com>
+Date: Thu, 15 May 2025 16:44:33 +0800
+Subject: [PATCH] tests/ts/kill/decode: avoid using shell built-in kill command
+
+This test case should do the same as other kill test cases, avoiding
+using shell built-in kill command.
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/d2eeccf36542d506b660641a07a44f3976772897]
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+---
+ tests/ts/kill/decode | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/tests/ts/kill/decode b/tests/ts/kill/decode
+index 03bc25ff6..57149899e 100755
+--- a/tests/ts/kill/decode
++++ b/tests/ts/kill/decode
+@@ -18,6 +18,11 @@ TS_DESC="decode functions"
+ . "$TS_TOPDIR/functions.sh"
+ ts_init "$*"
+ 
++# make sure we do not use shell built-in command
++if [ "$TS_USE_SYSTEM_COMMANDS" == "yes" ]; then
++       TS_CMD_KILL="$(which kill)"
++fi
++
+ ts_skip_qemu_user
+ 
+ ts_check_test_command "$TS_CMD_KILL"
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/util-linux/util-linux/0001-ts-kill-decode-use-RTMIN-from-kill-L-instead-of-hard.patch b/meta/recipes-core/util-linux/util-linux/0001-ts-kill-decode-use-RTMIN-from-kill-L-instead-of-hard.patch
new file mode 100644
index 0000000000..f4e2f9e745
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/0001-ts-kill-decode-use-RTMIN-from-kill-L-instead-of-hard.patch
@@ -0,0 +1,58 @@
+From c5d5e8873029d170fcab38a6fbd5d5a355574b9f Mon Sep 17 00:00:00 2001
+From: Chen Qi <Qi.Chen@windriver.com>
+Date: Wed, 4 Jun 2025 16:27:19 +0800
+Subject: [PATCH] ts/kill/decode: use RTMIN from 'kill -L' instead of
+ hardcoding 34
+
+glibc uses 34 as the value of SIGRTMIN:
+https://sourceware.org/git/?p=glibc.git;a=blob;f=signal/allocrtsig.c;h=8ed8e37dd6c41f94be6eef042ce9db1af1153228;hb=HEAD#l27 """
+static int current_rtmin = __SIGRTMIN + RESERVED_SIGRT; """
+
+musl uses 35 as the value of SIGRTMIN:
+https://git.musl-libc.org/cgit/musl/tree/src/signal/sigrtmin.c
+
+With the hardcoded 34, test case fails with the following difference:
+
+-Ignored: HUP QUIT TRAP PIPE ALRM
++Ignored: HUP QUIT TRAP PIPE ALRM 34
+
+Extract the value of RTMIN from 'kill -L' to avoid such hardcoding.
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/c5d5e8873029d170fcab38a6fbd5d5a355574b9f]
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+---
+ tests/ts/kill/decode | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/tests/ts/kill/decode b/tests/ts/kill/decode
+index 57149899e..524b4e5e2 100755
+--- a/tests/ts/kill/decode
++++ b/tests/ts/kill/decode
+@@ -53,14 +53,19 @@ ACK=
+            # Sending one more USR1 is for making the signal pending state.
+            "$TS_CMD_KILL" -USR1 "$PID"
+            "$TS_CMD_KILL" -d "$PID" | {
+-               if [[ $("$TS_CMD_KILL" --list=34) == RT0 ]]; then
++               SIGRTMIN=$("$TS_CMD_KILL" -L | grep -o '[0-9]\+ RTMIN' | cut -d " " -f 1)
++               if [[ $("$TS_CMD_KILL" --list=$SIGRTMIN) == RT0 ]]; then
+                    # See man signal(7).
+                    #   The  Linux  kernel  supports a range of 33 different real-time signals,
+                    #   numbered 32 to 64.  However, the glibc POSIX threads implementation in‐
+                    #   ternally uses two (for NPTL) or three (for LinuxThreads) real-time sig‐
+                    #   nals (see pthreads(7)), and adjusts the value of SIGRTMIN suitably  (to
+                    #   34 or 35).
+-                   sed -e s/' 32 33'// -e s/' 34'//
++                   sed_cmd="sed"
++                   for ((i=32; i<=SIGRTMIN; i++)); do
++                       sed_cmd+=" -e s/' $i'//"
++                   done
++                   eval $sed_cmd
+                else
+                    cat
+                fi
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/util-linux/util-linux/avoid_parallel_tests.patch b/meta/recipes-core/util-linux/util-linux/avoid_parallel_tests.patch
index 85ad7a5575..fe92afbc53 100644
--- a/meta/recipes-core/util-linux/util-linux/avoid_parallel_tests.patch
+++ b/meta/recipes-core/util-linux/util-linux/avoid_parallel_tests.patch
@@ -1,4 +1,4 @@
-From 0b05e4695a0616badef71dfa459a00ef6ff1b521 Mon Sep 17 00:00:00 2001
+From 43030388e831642d36cb7b9d4b63755e9696714a Mon Sep 17 00:00:00 2001
 From: Tudor Florea <tudor.florea@enea.com>
 Date: Mon, 14 Jun 2021 14:00:31 +0200
 Subject: [PATCH] util-linux: Add ptest
@@ -9,13 +9,12 @@ Revert run.sh script accordingly to serialize running tests
 
 Signed-off-by: Tudor Florea  <tudor.florea@enea.com>
 Upstream-Status: Inappropriate
-
 ---
  configure.ac | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/configure.ac b/configure.ac
-index 890212f..870e817 100644
+index 43a23a5..4a84531 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -11,7 +11,7 @@ AC_CONFIG_MACRO_DIR([m4])
diff --git a/meta/recipes-core/util-linux/util-linux/configure-sbindir.patch b/meta/recipes-core/util-linux/util-linux/configure-sbindir.patch
index 75adeca188..ebb32a6845 100644
--- a/meta/recipes-core/util-linux/util-linux/configure-sbindir.patch
+++ b/meta/recipes-core/util-linux/util-linux/configure-sbindir.patch
@@ -1,4 +1,4 @@
-From c79222a9a5e3425c55e150edc0b7ac59c573aa2f Mon Sep 17 00:00:00 2001
+From 378998bf82e3b6ff46569077b29f95e72b734681 Mon Sep 17 00:00:00 2001
 From: Phil Blundell <pb@pbcl.net>
 Date: Mon, 24 Sep 2012 07:24:51 +0100
 Subject: [PATCH] util-linux: Ensure that ${sbindir} is respected
@@ -9,16 +9,15 @@ fix the test, the [ ] syntax was getting eaten by autoconf
 Signed-off-by: Phil Blundell <pb@pbcl.net>
 Signed-off-by: Saul Wold <sgw@linux.intel.com
 Upstream-Status: Inappropriate [configuration]
-
 ---
  configure.ac | 5 ++++-
  1 file changed, 4 insertions(+), 1 deletion(-)
 
 diff --git a/configure.ac b/configure.ac
-index 36c24b4..890212f 100644
+index a5d9102..43a23a5 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -102,7 +102,10 @@ AC_SUBST([runstatedir])
+@@ -110,7 +110,10 @@ AC_SUBST([runstatedir])
  usrbin_execdir='${exec_prefix}/bin'
  AC_SUBST([usrbin_execdir])
  
diff --git a/meta/recipes-core/util-linux/util-linux/display_testname_for_subtest.patch b/meta/recipes-core/util-linux/util-linux/display_testname_for_subtest.patch
index 815ae9c915..fa4ae02bc3 100644
--- a/meta/recipes-core/util-linux/util-linux/display_testname_for_subtest.patch
+++ b/meta/recipes-core/util-linux/util-linux/display_testname_for_subtest.patch
@@ -1,20 +1,19 @@
-From fc5de1de898fd1a372a2fd2fa493dc57323a029d Mon Sep 17 00:00:00 2001
+From 728c2abd889d225535008c3e7a1eef4b8a0aeea2 Mon Sep 17 00:00:00 2001
 From: Tudor Florea <tudor.florea@enea.com>
 Date: Thu, 3 Dec 2015 04:08:00 +0100
 Subject: [PATCH] Display testname for subtest
 
 Signed-off-by: Tudor Florea <tudor.florea@enea.com>
 Upstream-Status: Pending
-
 ---
  tests/functions.sh | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/tests/functions.sh b/tests/functions.sh
-index 5a562a3..098145e 100644
+index 1d7a425..b1f0986 100644
 --- a/tests/functions.sh
 +++ b/tests/functions.sh
-@@ -437,7 +437,7 @@ function ts_init_subtest {
+@@ -455,7 +455,7 @@ function ts_init_subtest {
  
         if [ "$TS_PARSABLE" != "yes" ]; then
                 [ $TS_NSUBTESTS -eq 1 ] && echo
diff --git a/meta/recipes-core/util-linux/util-linux/mit-license.patch b/meta/recipes-core/util-linux/util-linux/mit-license.patch
deleted file mode 100644
index afbec98f18..0000000000
--- a/meta/recipes-core/util-linux/util-linux/mit-license.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 5b8fab1584017d9d9be008c23b90128bba41a7b5 Mon Sep 17 00:00:00 2001
-From: Richard Purdie <richard.purdie@linuxfoundation.org>
-Date: Thu, 28 Mar 2024 12:16:57 +0000
-Subject: [PATCH] README.licensing/flock: Add MIT license mention
-
-Looking at the license text, flock.c is under the MIT license (see
-https://spdx.org/licenses/MIT).
-
-Add an SPDX license identifier header and add to the list of licenses the
-source so everything is correctly listed/identified.
-
-Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-
-Upstream-Status: Submitted [https://github.com/util-linux/util-linux/pull/2870]
-
----
- README.licensing  | 2 ++
- sys-utils/flock.c | 4 +++-
- 2 files changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/README.licensing b/README.licensing
-index 4454f8392a..535ad34813 100644
---- a/README.licensing
-+++ b/README.licensing
-@@ -12,6 +12,8 @@ There is code under:
- 
-    * LGPL-2.1-or-later  - GNU Lesser General Public License 2.1 or any later version
- 
-+   * MIT                - MIT License
-+
-    * BSD-2-Clause       - Simplified BSD License
- 
-    * BSD-3-Clause       - BSD 3-Clause "New" or "Revised" License
-diff --git a/sys-utils/flock.c b/sys-utils/flock.c
-index fed29d7270..7d878ff810 100644
---- a/sys-utils/flock.c
-+++ b/sys-utils/flock.c
-@@ -1,4 +1,6 @@
--/*   Copyright 2003-2005 H. Peter Anvin - All Rights Reserved
-+/*   SPDX-License-Identifier: MIT
-+ *
-+ *   Copyright 2003-2005 H. Peter Anvin - All Rights Reserved
-  *
-  *   Permission is hereby granted, free of charge, to any person
-  *   obtaining a copy of this software and associated documentation
diff --git a/meta/recipes-core/util-linux/util-linux/ptest.patch b/meta/recipes-core/util-linux/util-linux/ptest.patch
index 6221de7182..ad23001cfa 100644
--- a/meta/recipes-core/util-linux/util-linux/ptest.patch
+++ b/meta/recipes-core/util-linux/util-linux/ptest.patch
@@ -1,24 +1,23 @@
-From d0a69ce80c579cbb7627a2f20e8b92e006a8d8ad Mon Sep 17 00:00:00 2001
+From 18bf6aded9b2a75185ae4b23a41cd2e4322c5e31 Mon Sep 17 00:00:00 2001
 From: Tudor Florea <tudor.florea@enea.com>
 Date: Thu, 3 Dec 2015 04:08:00 +0100
 Subject: [PATCH] Define TESTS variable
 
 Signed-off-by: Tudor Florea <tudor.florea@enea.com>
 Upstream-Status: Pending
-
 ---
  Makefile.am | 1 +
  1 file changed, 1 insertion(+)
 
 diff --git a/Makefile.am b/Makefile.am
-index effbb02..7d2bd1e 100644
+index 01e9970..c3313ff 100644
 --- a/Makefile.am
 +++ b/Makefile.am
-@@ -57,6 +57,7 @@ systemdsystemunit_DATA =
+@@ -66,6 +66,7 @@ sysusers_DATA =
  dist_bashcompletion_DATA =
  check_PROGRAMS =
  dist_check_SCRIPTS =
 +TESTS = $(check_PROGRAMS)
  
- PATHFILES =
- ADOCFILES_COMMON =
+ BUILT_SOURCES =
+ 
diff --git a/meta/recipes-core/util-linux/util-linux/run-ptest b/meta/recipes-core/util-linux/util-linux/run-ptest
index 7b6b1d1dc2..1410229172 100644
--- a/meta/recipes-core/util-linux/util-linux/run-ptest
+++ b/meta/recipes-core/util-linux/util-linux/run-ptest
@@ -22,9 +22,8 @@ modprobe loop
 # for a long description of mount namespaces in Linux
 mount --make-shared /
 
-# lsfd/option-inet has races in the test script:
-# https://github.com/util-linux/util-linux/issues/2399
-./tests/run.sh --use-system-commands --parsable --show-diff --exclude=lsfd/option-inet | sed -u '{
+# lsfd/mkfds-bpf* have issues with the gcc 15 upgrade
+./tests/run.sh --use-system-commands --parsable --show-diff --exclude='lsfd/mkfds-bpf-map lsfd/mkfds-bpf-prog' | sed -u '{
       s/^\(.*\):\(.*\) \.\.\. OK$/PASS: \1:\2/                              
       s/^\(.*\):\(.*\) \.\.\. FAILED \(.*\)$/FAIL: \1:\2 \3/                
       s/^\(.*\):\(.*\) \.\.\. SKIPPED \(.*\)$/SKIP: \1:\2 \3/               
diff --git a/meta/recipes-core/util-linux/util-linux_2.39.3.bb b/meta/recipes-core/util-linux/util-linux_2.41.bb
index 83b3f4e05b..41fb3e5951 100644
--- a/meta/recipes-core/util-linux/util-linux_2.39.3.bb
+++ b/meta/recipes-core/util-linux/util-linux_2.41.bb
@@ -1,5 +1,58 @@
 require util-linux.inc
 
+# Most of the applications and the libraries are linked with libcommon.la,
+# which uses these licenses
+LIBCOMMON_LICENSES = "LGPL-2.1-or-later & BSD-2-Clause & BSD-3-Clause & MIT"
+
+# The default license is GPL-2.0-or-later
+DEFAULT_LICENSES = "GPL-2.0-or-later & ${LIBCOMMON_LICENSES}"
+
+LICENSE = "GPL-1.0-or-later & GPL-2.0-only & GPL-2.0-or-later & LGPL-2.1-or-later & BSD-2-Clause & BSD-3-Clause & BSD-4-Clause-UC & MIT & EUPL-1.2"
+LICENSE:${PN}-bash-completion = "GPL-2.0-or-later"
+LICENSE:${PN}-dev = "${LIBCOMMON_LICENSES}"
+# All dynamic packages use ${DEFAULT_LICENSES} with the following exceptions
+LICENSE:${PN}-cal = "BSD-4-Clause-UC & ${LIBCOMMON_LICENSES}"
+LICENSE:${PN}-col = "BSD-4-Clause-UC & ${LIBCOMMON_LICENSES}"
+LICENSE:${PN}-colcrt = "BSD-4-Clause-UC"
+LICENSE:${PN}-colrm = "BSD-4-Clause-UC & ${LIBCOMMON_LICENSES}"
+LICENSE:${PN}-column = "BSD-4-Clause-UC & ${LIBCOMMON_LICENSES}"
+LICENSE:${PN}-coresched = "EUPL-1.2 & ${LIBCOMMON_LICENSES}"
+LICENSE:${PN}-fcntl-lock = "MIT"
+LICENSE:${PN}-fdisk = "GPL-1.0-or-later & ${DEFAULT_LICENSES}"
+LICENSE:${PN}-fsfreeze = "GPL-1.0-or-later"
+LICENSE:${PN}-hexdump = "BSD-4-Clause-UC & ${LIBCOMMON_LICENSES}"
+LICENSE:${PN}-kill = "BSD-4-Clause-UC & ${LIBCOMMON_LICENSES}"
+LICENSE:${PN}-libblkid = "${LIBCOMMON_LICENSES}"
+LICENSE:${PN}-libfdisk = "${LIBCOMMON_LICENSES}"
+LICENSE:${PN}-libmount = "${LIBCOMMON_LICENSES}"
+LICENSE:${PN}-libsmartcols = "${LIBCOMMON_LICENSES}"
+LICENSE:${PN}-logger = "BSD-4-Clause-UC & ${LIBCOMMON_LICENSES}"
+LICENSE:${PN}-look = "BSD-4-Clause-UC"
+LICENSE:${PN}-lscpu = "GPL-2.0-only & ${DEFAULT_LICENSES}"
+LICENSE:${PN}-mesg = "BSD-4-Clause-UC & ${LIBCOMMON_LICENSES}"
+LICENSE:${PN}-nsenter = "GPL-2.0-only & ${DEFAULT_LICENSES}"
+LICENSE:${PN}-renice = "BSD-4-Clause-UC"
+LICENSE:${PN}-rev = "BSD-4-Clause-UC"
+LICENSE:${PN}-script = "BSD-4-Clause-UC & ${LIBCOMMON_LICENSES}"
+LICENSE:${PN}-ul = "BSD-4-Clause-UC"
+LICENSE:${PN}-vipw = "BSD-4-Clause-UC & ${DEFAULT_LICENSES}"
+LICENSE:${PN}-wall = "BSD-4-Clause-UC & ${LIBCOMMON_LICENSES}"
+LICENSE:${PN}-whereis = "BSD-4-Clause-UC & ${LIBCOMMON_LICENSES}"
+LICENSE:${PN}-write = "BSD-4-Clause-UC & ${LIBCOMMON_LICENSES}"
+
+LIC_FILES_CHKSUM = "file://README.licensing;md5=55e895a80bdd4ffc65e167a76d2e7569 \
+                    file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
+                    file://Documentation/licenses/COPYING.GPL-2.0-or-later;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
+                    file://Documentation/licenses/COPYING.LGPL-2.1-or-later;md5=4fbd65380cdd255951079008b364516c \
+                    file://Documentation/licenses/COPYING.BSD-3-Clause;md5=58dcd8452651fc8b07d1f65ce07ca8af \
+                    file://Documentation/licenses/COPYING.BSD-4-Clause-UC;md5=263860f8968d8bafa5392cab74285262 \
+                    file://Documentation/licenses/COPYING.EUPL-1.2;md5=c075d2767167a2355b23392018a1cbbd \
+                    file://libmount/COPYING;md5=7c7e39fb7d70ffe5d693a643e29987c2 \
+                    file://libblkid/COPYING;md5=693bcbbe16d3a4a4b37bc906bc01cc04 \
+                    file://libfdisk/COPYING;md5=693bcbbe16d3a4a4b37bc906bc01cc04 \
+                    file://libsmartcols/COPYING;md5=693bcbbe16d3a4a4b37bc906bc01cc04 \
+                    "
+
 inherit autotools gettext manpages pkgconfig systemd update-alternatives python3-dir bash-completion ptest gtk-doc
 DEPENDS = "libcap-ng ncurses virtual/crypt zlib util-linux-libuuid"
 
@@ -11,6 +64,9 @@ python util_linux_binpackages () {
         pn = d.getVar('PN')
         d.appendVar('RRECOMMENDS:%s' % pn, ' %s' % pkg)
 
+        if not d.getVar('LICENSE:' + pkg):
+            d.setVar('LICENSE:' + pkg, '${DEFAULT_LICENSES}')
+
         if d.getVar('ALTERNATIVE:' + pkg):
             return
         if d.getVarFlag('ALTERNATIVE_LINK_NAME', modulename):
@@ -59,7 +115,8 @@ python util_linux_libpackages() {
 
 PACKAGESPLITFUNCS =+ "util_linux_libpackages"
 
-PACKAGES_DYNAMIC = "^${PN}-.*"
+PACKAGES_DYNAMIC = "^${PN}(?!.*-native)-.*"
+PACKAGES_DYNAMIC:class-native = "^${BPN}-.*-native"
 
 UTIL_LINUX_LIBDIR = "${libdir}"
 UTIL_LINUX_LIBDIR:class-target = "${base_libdir}"
@@ -90,7 +147,10 @@ EXTRA_OECONF:append = " --disable-hwclock-gplv3"
 # build host versions during development
 #
 PACKAGECONFIG ?= "pcre2"
-PACKAGECONFIG:class-target ?= "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'chfn-chsh pam', '', d)}"
+PACKAGECONFIG:class-target ?= "\
+    libmount-mountfd-support \
+    ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'chfn-chsh pam lastlog2', '', d)} \
+"
 # inherit manpages requires this to be present, however util-linux does not have
 # configuration options, and installs manpages always
 PACKAGECONFIG[manpages] = ""
@@ -106,6 +166,14 @@ PACKAGECONFIG[pcre2] = ",,libpcre2"
 PACKAGECONFIG[cryptsetup] = "--with-cryptsetup,--without-cryptsetup,cryptsetup"
 PACKAGECONFIG[chfn-chsh] = "--enable-chfn-chsh,--disable-chfn-chsh,"
 PACKAGECONFIG[selinux] = "--with-selinux,--without-selinux,libselinux"
+PACKAGECONFIG[lastlog2] = "--enable-liblastlog2,--disable-liblastlog2,sqlite3"
+# Using the new file descriptors based mount kernel API can cause rootfs remount failure with some older kernels.
+# Of currently supported LTS kernels, the old mount API should be used with:
+# - versions prior to 6.6.18 in the 6.6.y series.
+# - versions prior to 6.1.79 in the 6.1.y series.
+# - versions till at least 5.15.164 in the 5.15.y series.
+# - with 5.10.y, 5.4.y and 4.19.y series kernels, libmount seemed to use the old API regardless of this option.
+PACKAGECONFIG[libmount-mountfd-support] = "--enable-libmount-mountfd-support,--disable-libmount-mountfd-support"
 
 EXTRA_OEMAKE = "ARCH=${TARGET_ARCH} CPU= CPUOPT= 'OPT=${CFLAGS}'"
 
@@ -117,6 +185,9 @@ FILES:${PN}-mount = "${sysconfdir}/default/mountall"
 FILES:${PN}-runuser = "${sysconfdir}/pam.d/runuser*"
 FILES:${PN}-su = "${sysconfdir}/pam.d/su-l"
 CONFFILES:${PN}-su = "${sysconfdir}/pam.d/su-l"
+FILES:${PN}-lastlog2 += "${base_libdir}/security/pam_lastlog2.so \
+                         ${nonarch_libdir}/tmpfiles.d/lastlog2.conf \
+                         ${sysconfdir}/default/volatiles/99_lastlog2"
 FILES:${PN}-pylibmount = "${PYTHON_SITEPACKAGES_DIR}/libmount/pylibmount.so \
                           ${PYTHON_SITEPACKAGES_DIR}/libmount/__init__.* \
                           ${PYTHON_SITEPACKAGES_DIR}/libmount/__pycache__/*"
@@ -135,8 +206,8 @@ RDEPENDS:${PN}-dev += " util-linux-libuuid-dev"
 
 RPROVIDES:${PN}-dev = "${PN}-libblkid-dev ${PN}-libmount-dev"
 
-RDEPENDS:${PN}-bash-completion += "${PN}-lsblk"
-RDEPENDS:${PN}-ptest += "bash bc btrfs-tools coreutils e2fsprogs findutils grep iproute2 kmod procps sed socat which xz"
+RDEPENDS:${PN}-bash-completion += "${PN}-lsblk ${PN}-findmnt"
+RDEPENDS:${PN}-ptest += "bash bc btrfs-tools coreutils e2fsprogs findutils grep iproute2 kmod procps sed socat which xz diffutils"
 RRECOMMENDS:${PN}-ptest += "kernel-module-scsi-debug kernel-module-sd-mod kernel-module-loop kernel-module-algif-hash"
 RDEPENDS:${PN}-swaponoff = "${PN}-swapon ${PN}-swapoff"
 ALLOW_EMPTY:${PN}-swaponoff = "1"
@@ -147,18 +218,21 @@ SYSTEMD_AUTO_ENABLE:${PN}-uuidd = "disable"
 SYSTEMD_SERVICE:${PN}-fstrim = "fstrim.timer fstrim.service"
 SYSTEMD_AUTO_ENABLE:${PN}-fstrim = "disable"
 
+do_compile:prepend () {
+        # this is a workaround for the unnecessary remake problem. Issue and PR are as below:
+        # https://github.com/util-linux/util-linux/issues/3061
+        # https://github.com/util-linux/util-linux/pull/3064
+        # When newly release tarball contains the above fix, the following workaround could be dropped.
+        [ -e ${S}/libsmartcols/src/filter-scanner.c ] && touch ${S}/libsmartcols/src/filter-scanner.c
+        [ -e ${S}/libsmartcols/src/filter-parser.c ] && touch ${S}/libsmartcols/src/filter-parser.c
+}
+
 do_compile:append () {
-        cp ${WORKDIR}/fcntl-lock.c ${S}/fcntl-lock.c
+        cp ${UNPACKDIR}/fcntl-lock.c ${S}/fcntl-lock.c
         ${CC} ${CFLAGS} ${LDFLAGS} ${S}/fcntl-lock.c -o ${B}/fcntl-lock
 }
 
-do_install () {
-        # with ccache the timestamps on compiled files may
-        # end up earlier than on their inputs, this allows
-        # for the resultant compilation in the install step.
-        oe_runmake 'CC=${CC}' 'LD=${LD}' \
-                'LDFLAGS=${LDFLAGS}' 'DESTDIR=${D}' install
-
+do_install:append () {
         mkdir -p ${D}${base_bindir}
 
         sbinprogs="agetty ctrlaltdel cfdisk vipw vigr"
@@ -194,12 +268,24 @@ do_install () {
 do_install:append:class-target () {
         if [ "${@bb.utils.filter('PACKAGECONFIG', 'pam', d)}" ]; then
                 install -d ${D}${sysconfdir}/pam.d
-                install -m 0644 ${WORKDIR}/runuser.pamd ${D}${sysconfdir}/pam.d/runuser
-                install -m 0644 ${WORKDIR}/runuser-l.pamd ${D}${sysconfdir}/pam.d/runuser-l
+                install -m 0644 ${UNPACKDIR}/runuser.pamd ${D}${sysconfdir}/pam.d/runuser
+                install -m 0644 ${UNPACKDIR}/runuser-l.pamd ${D}${sysconfdir}/pam.d/runuser-l
                 # Required for "su -" aka "su --login" because
                 # otherwise it uses "other", which has "auth pam_deny.so"
                 # and thus prevents the operation.
                 ln -s su ${D}${sysconfdir}/pam.d/su-l
+
+                if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
+                        install -d ${D}${nonarch_libdir}/tmpfiles.d
+                        install -m 0644 ${S}/misc-utils/lastlog2-tmpfiles.conf.in \
+                                ${D}${nonarch_libdir}/tmpfiles.d/lastlog2.conf
+                fi
+
+                if ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'true', 'false', d)}; then
+                        install -d ${D}${sysconfdir}/default/volatiles
+                        echo "d root root 0755 /var/lib/lastlog none" \
+                                > ${D}${sysconfdir}/default/volatiles/99_lastlog2
+                fi
         fi
 }
 # nologin causes a conflict with shadow-native
@@ -282,8 +368,11 @@ blkid.8 eject.1 findfs.8 fsck.8 kill.1 last.1 lastb.1 libblkid.3 logger.1 mesg.1
 mountpoint.1 nologin.8 rfkill.8 sulogin.8 utmpdump.1 uuid.3 wall.1\
 "
 ALTERNATIVE:${PN}-doc += "${@bb.utils.contains('PACKAGECONFIG', 'pam', 'su.1', '', d)}"
+ALTERNATIVE:${PN}-doc += "${@bb.utils.contains('PACKAGECONFIG', 'chfn-chsh', 'chfn.1 chsh.1', '', d)}"
 
 ALTERNATIVE_LINK_NAME[blkid.8] = "${mandir}/man8/blkid.8"
+ALTERNATIVE_LINK_NAME[chfn.1] = "${mandir}/man1/chfn.1"
+ALTERNATIVE_LINK_NAME[chsh.1] = "${mandir}/man1/chsh.1"
 ALTERNATIVE_LINK_NAME[eject.1] = "${mandir}/man1/eject.1"
 ALTERNATIVE_LINK_NAME[findfs.8] = "${mandir}/man8/findfs.8"
 ALTERNATIVE_LINK_NAME[fsck.8] = "${mandir}/man8/fsck.8"
@@ -319,13 +408,15 @@ do_install_ptest() {
     cp ${S}/tests/*.sh ${D}${PTEST_PATH}/tests/
     cp -pR ${S}/tests/expected ${D}${PTEST_PATH}/tests/expected
     cp -pR ${S}/tests/ts ${D}${PTEST_PATH}/tests/
-    cp ${WORKDIR}/build/config.h ${D}${PTEST_PATH}
+    cp ${B}/config.h ${D}${PTEST_PATH}
 
     sed -i 's|@base_sbindir@|${base_sbindir}|g' ${D}${PTEST_PATH}/run-ptest
 
-    # chfn needs PAM
     if ! ${@bb.utils.contains('PACKAGECONFIG', 'pam', 'true', 'false', d)}; then
+        # chfn needs PAM
         rm -rf ${D}${PTEST_PATH}/tests/ts/chfn
+        # su is not enabled when pam is not in PACKAGECONFIG
+        rm -rf ${D}${PTEST_PATH}/tests/ts/su
     fi
     # remove raid tests, known failures and avoid dependency on mdadm therefore
     # See https://github.com/util-linux/util-linux/commit/7519c3edab120b14623931d5ddb16fdc6e7cad5d
@@ -339,6 +430,7 @@ do_install_ptest() {
 do_install_ptest:append:libc-musl() {
     for t in tests/ts/col/multibyte \
             tests/ts/lib/timeutils \
+            tests/ts/misc/enosys \
             tests/ts/dmesg/limit; do
         rm -rf ${D}${PTEST_PATH}/$t
     done
diff --git a/meta/recipes-core/volatile-binds/files/mount-copybind b/meta/recipes-core/volatile-binds/files/mount-copybind
index ddc4357615..5885880534 100755
--- a/meta/recipes-core/volatile-binds/files/mount-copybind
+++ b/meta/recipes-core/volatile-binds/files/mount-copybind
@@ -45,9 +45,11 @@ if [ -d "$mountpoint" ]; then
 
     # Fast version of calculating `dirname ${spec}`/.`basename ${spec}`-work
     overlay_workdir="${spec%/*}/.${spec##*/}-work"
-    mkdir "${overlay_workdir}"
+    if [ "$MOUNT_COPYBIND_AVOID_OVERLAYFS" != 1 ]; then
+        mkdir "${overlay_workdir}"
+    fi
 
-    # Try to mount using overlay, which is must faster than copying files.
+    # Try to mount using overlay, which is much faster than copying files.
     # If that fails, fall back to slower copy.
     if command -v selinuxenabled > /dev/null 2>&1; then
         if selinuxenabled; then
@@ -55,6 +57,7 @@ if [ -d "$mountpoint" ]; then
         fi
     fi
     if [ "$MOUNT_COPYBIND_AVOID_OVERLAYFS" = 1 ] || ! mount -t overlay overlay -olowerdir="$mountpoint",upperdir="$spec",workdir="$overlay_workdir""$mountcontext" "$mountpoint" > /dev/null 2>&1; then
+        rm -rf "$overlay_workdir"
 
         if [ "$specdir_existed" != "yes" ]; then
             cp -aPR "$mountpoint"/. "$spec/"
diff --git a/meta/recipes-core/volatile-binds/volatile-binds.bb b/meta/recipes-core/volatile-binds/volatile-binds.bb
index cca8a65fb4..857bcc93ff 100644
--- a/meta/recipes-core/volatile-binds/volatile-binds.bb
+++ b/meta/recipes-core/volatile-binds/volatile-binds.bb
@@ -9,7 +9,7 @@ SRC_URI = "\
     file://volatile-binds.service.in \
 "
 
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 
 inherit allarch systemd features_check
 
@@ -64,7 +64,6 @@ END
                "$var_lib_servicefile"
     fi
 }
-do_compile[dirs] = "${WORKDIR}"
 
 do_install () {
     install -d ${D}${base_sbindir}
@@ -82,4 +81,3 @@ do_install () {
     ln -s /dev/null ${D}${sysconfdir}/tmpfiles.d/etc.conf
     ln -s /dev/null ${D}${sysconfdir}/tmpfiles.d/home.conf
 }
-do_install[dirs] = "${WORKDIR}"
diff --git a/meta/recipes-core/zlib/site_config/headers b/meta/recipes-core/zlib/site_config/headers
deleted file mode 100644
index 50268918aa..0000000000
--- a/meta/recipes-core/zlib/site_config/headers
+++ /dev/null
@@ -1 +0,0 @@
-zlib.h
diff --git a/meta/recipes-core/zlib/zlib_1.3.1.bb b/meta/recipes-core/zlib/zlib_1.3.1.bb
index e6a81ef789..e62c50c5df 100644
--- a/meta/recipes-core/zlib/zlib_1.3.1.bb
+++ b/meta/recipes-core/zlib/zlib_1.3.1.bb
@@ -19,7 +19,7 @@ SRC_URI[sha256sum] = "9a93b2b7dfdac77ceba5a558a580e74667dd6fede4585b91eefb60f03b
 # to PREMIRRORS so it is also searched automatically.
 PREMIRRORS:append = " https://zlib.net/ https://zlib.net/fossils/"
 
-CFLAGS += "-D_REENTRANT"
+CFLAGS += "-D_REENTRANT -fPIE"
 
 RDEPENDS:${PN}-ptest += "make"
 
@@ -47,4 +47,6 @@ do_install_ptest() {
 BBCLASSEXTEND = "native nativesdk"
 
 CVE_STATUS[CVE-2023-45853] = "not-applicable-config: we don't build minizip"
-CVE_STATUS[CVE-2023-6992] = "cpe-incorrect: this CVE is for cloudflare zlib"
+
+# Adding 'CVE_PRODUCT' to avoid false detection of CVEs
+CVE_PRODUCT = "zlib:zlib gnu:zlib"