Merge 964df31c7f into c8d45ebfd6

<!-- devel-freezer =
{"comment-id":"2460595245","freezing-tag":"v257-rc1"} -->

.github/workflows/build_test.sh

@@ -3,6 +3,8 @@
 
 set -ex
 
+shopt -s nullglob
+
 info() { echo -e "\033[33;1m$1\033[0m"; }
 fatal() { echo >&2 -e "\033[31;1m$1\033[0m"; exit 1; }
 success() { echo >&2 -e "\033[32;1m$1\033[0m"; }
@@ -12,7 +14,7 @@ ARGS=(
     "--optimization=s -Dutmp=false"
     "--optimization=2 -Dc_args=-Wmaybe-uninitialized -Ddns-over-tls=openssl"
     "--optimization=3 -Db_lto=true -Ddns-over-tls=false"
-    "--optimization=3 -Db_lto=false -Dtpm2=disabled -Dlibfido2=disabled -Dp11kit=disabled"
+    "--optimization=3 -Db_lto=false -Dtpm2=disabled -Dlibfido2=disabled -Dp11kit=disabled -Defi=false -Dbootloader=disabled"
     "--optimization=3 -Dfexecve=true -Dstandalone-binaries=true -Dstatic-libsystemd=true -Dstatic-libudev=true"
     "-Db_ndebug=true"
 )
@@ -45,7 +47,7 @@ PACKAGES=(
     libxkbcommon-dev
     libxtables-dev
     libzstd-dev
-    # mold
+    mold
     mount
     net-tools
     python3-evdev
@@ -68,14 +70,6 @@ LINKER="${LINKER:?}"
 CRYPTOLIB="${CRYPTOLIB:?}"
 RELEASE="$(lsb_release -cs)"
 
-# mold-2.2.0+ fixes some bugs breaking bootloader builds.
-# TODO: Switch to distro mold with ubuntu-24.04
-if [[ "$LINKER" == mold ]]; then
-    wget https://github.com/rui314/mold/releases/download/v2.2.0/mold-2.2.0-x86_64-linux.tar.gz
-    echo "d66e0230c562c2ba0e0b789cc5034e0fa2369cc843d0154920de4269cd94afeb  mold-2.2.0-x86_64-linux.tar.gz" | sha256sum -c
-    sudo tar -xz -C /usr --strip-components=1 -f mold-2.2.0-x86_64-linux.tar.gz
-fi
-
 # Note: As we use postfixed clang/gcc binaries, we need to override $AR
 #       as well, otherwise meson falls back to ar from binutils which
 #       doesn't work with LTO

.github/workflows/build_test.yml

@@ -33,6 +33,6 @@ jobs:
     env: ${{ matrix.env }}
     steps:
       - name: Repository checkout
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: Build check
         run: .github/workflows/build_test.sh

.github/workflows/codeql.yml

@@ -42,7 +42,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@e2b3eafc8d227b0241d48be5f425d47c2d750a13

.github/workflows/coverity.yml

@@ -22,7 +22,7 @@ jobs:
       COVERITY_SCAN_NOTIFICATION_EMAIL: "${{ secrets.COVERITY_SCAN_NOTIFICATION_EMAIL }}"
     steps:
       - name: Repository checkout
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       # Reuse the setup phase of the unit test script to avoid code duplication
       - name: Install build dependencies
         run: sudo -E .github/workflows/unit_tests.sh SETUP

.github/workflows/development_freeze.yml

@@ -30,7 +30,7 @@ jobs:
           name: Pull Request Metadata
 
       - name: Repository checkout
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           fetch-depth: 0
 

.github/workflows/differential-shellcheck.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Repository checkout
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           fetch-depth: 0
 

.github/workflows/gather-pr-metadata.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Repository checkout
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - id: metadata
         name: Gather Pull Request Metadata

.github/workflows/issue_labeler.yml

@@ -20,7 +20,7 @@ jobs:
         template: [ bug_report.yml, feature_request.yml ]
 
     steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Parse issue form
         uses: stefanbuck/github-issue-parser@1e5bdee70d4b3e066a33aa0669ab782943825f94

.github/workflows/labeler.yml

@@ -30,7 +30,7 @@ jobs:
 
     steps:
     - name: Repository checkout
-      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       if: github.event_name == 'pull_request'
 
     - name: Label PR based on policy in labeler.yml

.github/workflows/linter.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Repo checkout
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           # We need a full repo clone
           fetch-depth: 0

.github/workflows/mkosi.yml

@@ -104,8 +104,8 @@ jobs:
             relabel: yes
 
     steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - uses: systemd/mkosi@2a35f9958bc6b82d95d1eac02dc245e9bb068765
+      - uses: systemd/mkosi@8976a0abb19221e65300222f2d33067970cca0f1
 
       # Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space
       # immediately, we remove the files in the background. However, we first move them to a different location

.github/workflows/requirements.txt

@@ -1,6 +1,6 @@
-meson==1.5.2 \
+meson==1.6.0 \
-    --hash=sha256:77706e2368a00d789c097632ccf4fc39251fba56d03e1e1b262559a3c7a08f5b \
+    --hash=sha256:234a45f9206c6ee33b473ec1baaef359d20c0b89a71871d58c65a6db6d98fe74 \
-    --hash=sha256:f955e09ab0d71ef180ae85df65991d58ed8430323de7d77a37e11c9ea630910b
+    --hash=sha256:999b65f21c03541cf11365489c1fad22e2418bb0c3d50ca61139f2eec09d5496
 ninja==1.11.1.1 \
     --hash=sha256:18302d96a5467ea98b68e1cae1ae4b4fb2b2a56a82b955193c637557c7273dbd \
     --hash=sha256:185e0641bde601e53841525c4196278e9aaf4463758da6dd1e752c0a0f54136a \

.github/workflows/scorecards.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
 

.github/workflows/unit_tests.yml

@@ -30,7 +30,7 @@ jobs:
             cryptolib: gcrypt
     steps:
       - name: Repository checkout
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: Install build dependencies
         run: |
           # Drop XDG_* stuff from /etc/environment, so we don't get the user

LICENSES/README.md

@@ -69,6 +69,9 @@ The following exceptions apply:
  * the following sources are under **Public Domain** (LicenseRef-alg-sha1-public-domain):
    - src/fundamental/sha1-fundamental.c
    - src/fundamental/sha1-fundamental.h
+ * the following files are licensed under **BSD-3-Clause** license:
+   - src/boot/efi/chid.c
+   - src/boot/efi/chid.h
  * Heebo fonts under docs/fonts/ are licensed under the **SIL Open Font License 1.1**,
  * any files under test/ without an explicit license we assume non-copyrightable
    (eg: computer-generated fuzzer data)

TODO

@@ -129,6 +129,43 @@ Deprecations and removals:
 
 Features:
 
+* machined: when registering a machine, also take a relative cgroup path,
+  relative to the machine's unit. This is useful when registering unpriv
+  machines, as they might sit down the cgroup tree, below a cgroup delegation
+  boundary. Then, install an inotify watch on that cgroup to track when the
+  machine's local cgroup goes down.
+
+* resolved: report ttl in resolution replies if we know it. This data is useful
+  for tools such as wireguard which want to periodically re-resolve DNS names,
+  and might want to use the TTL has hint for that.
+
+* journald: beef up ClientContext logic to store pidfd_id of peer, to validate
+  we really use the right cache entry
+
+* journald: log client's pidfd id as a new automatic field _PIDFDID= or so.
+
+* journald: split up ClientContext cache in two: one cache keyed by pid/pidfdid
+  with process information, and another one keyed by cgroup path/cgroupid with
+  cgroup information. This way if a service consisting of many logging
+  processes can take benefit of the cgroup caching.
+
+* system lsmbpf policy that prohibits creating files owned by "nobody"
+  system-wide
+
+* system lsmpbf policy that prohibits creating or opening device nodes outside
+  of devtmpfs/tmpfs, except if they are the pseudo-devices /dev/null,
+  /dev/zero, /dev/urandom and so on.
+
+* system lsmbpf policy that enforces that block device backed mounts may only
+  be established on top of dm-crypt or dm-verity devices, or an allowlist of
+  file systems (which should probably include vfat, for compat with the ESP)
+
+* $LISTEN_PID, $MAINPID and $SYSTEMD_EXECPID env vars that the service manager
+  sets should be augmented with $LISTEN_PIDFDID, $MAINPIDFDID and
+  $SYSTEMD_EXECPIDFD (and similar for other env vars we might send).
+
+* port copy.c over to use LabelOps for all labelling.
+
 * port remaining getmntent() users over to libmount. There are subtle
   differences in the parsers (see #25371 for example), and it hence makes sense
   if we stick to one set of parsers on this, not mix both.
@@ -155,9 +192,6 @@ Features:
   sd_event_add_child(), and then get rid of many more explicit sigprocmask()
   calls.
 
-* maybe set shell.prompt.prefix credential in run0 to some warning emoji,
-  i.e. ⚠️ or ☢️ or ⚡ or 👊 or 🧑‍🔧 or so.
-
 * introduce new structure Tpm2CombinedPolicy, that combines the various TPm2
   policy bits into one structure, i.e. public key info, pcr masks, pcrlock
   stuff, pin and so on. Then pass that around in tpm2_seal() and tpm2_unseal().
@@ -1429,9 +1463,6 @@ Features:
   - "systemd-sysupdate update --all" support, that iterates through all components
     defined on the host, plus all images installed into /var/lib/machines/,
     /var/lib/portable/ and so on.
-  - figure out what to do about system extensions (i.e. they need to imply an
-    update component, since otherwise sysupdate.d/ files would override the
-    host's update files.)
   - Allow invocation with a single transfer definition, i.e. with
     --definitions= pointing to a file rather than a dir.
   - add ability to disable implicit decompression of downloaded artifacts,

docs/ENVIRONMENT.md

@@ -735,3 +735,16 @@ Tools using the Varlink protocol (such as `varlinkctl`) or sd-bus (such as
 
 * `SYSTEMD_EXIT_ON_IDLE` – Takes a boolean. When false, the exit-on-idle logic
   of these services is disabled, making it easier to debug them.
+
+`systemd-ask-password`:
+
+* `$SYSTEMD_ASK_PASSWORD_KEYRING_TIMEOUT_SEC` - takes a timespan, which controls
+  the expiration time of keys stored in the kernel keyring by `systemd-ask-password`.
+  If unset, the default expiration of 150 seconds is used. If set to `0`, keys are
+  not cached in the kernel keyring. If set to `infinity`, keys are cached without an
+  expiration time in the kernel keyring.
+
+* `SYSTEMD_ASK_PASSWORD_KEYRING_TYPE` - takes a keyring ID or one of `thread`,
+  `process`, `session`, `user`, `user-session`, or `group`. Controls the kernel
+  keyring in which `systemd-ask-password` caches the queried password. Defaults
+  to `user`.

docs/HACKING.md

@@ -44,9 +44,37 @@ or:
 $ mkosi qemu
 ```
 
-By default, the tools from your host system are used to build the image. To have
+By default, the tools from your host system are used to build the image.
-`mkosi` use the systemd tools from the `build/` directory, add the following to
+Sometimes we start using mkosi features that rely on functionality in systemd
-`mkosi.local.conf`:
+tools that's not in an official release yet. In that case, you'll need to build
+systemd from source on the host and configure mkosi to use the tools from the
+systemd build directory.
+
+To do a local build, most distributions provide very simple and convenient ways
+to install most development packages necessary to build systemd:
+
+```sh
+# Fedora
+$ sudo dnf builddep systemd
+# Debian/Ubuntu
+$ sudo apt-get build-dep systemd
+# Arch
+$ sudo pacman -S devtools
+$ pkgctl repo clone --protocol=https systemd
+$ cd systemd
+$ makepkg -seoc
+```
+
+After installing the development packages, systemd can be built from source as follows:
+
+```sh
+$ meson setup build <options>
+$ ninja -C build
+$ meson test -C build
+```
+
+To have `mkosi` use the systemd tools from the `build/` directory, add the
+following to `mkosi.local.conf`:
 
 ```conf
 [Host]
@@ -69,9 +97,9 @@ another terminal on your host (choose the right one depending on the
 distribution of the container or virtual machine):
 
 ```sh
-mkosi -t none && mkosi ssh dnf upgrade --disablerepo="*" --assumeyes "/work/build/*.rpm" # CentOS/Fedora
+mkosi -t none && mkosi ssh dnf upgrade --disablerepo="*" --assumeyes "/work/build/*.rpm"             # CentOS/Fedora
-mkosi -t none && mkosi ssh apt-get install "/work/build/*.deb" # Debian/Ubuntu
+mkosi -t none && mkosi ssh apt-get install "/work/build/*.deb"                                       # Debian/Ubuntu
-mkosi -t none && mkosi ssh pacman --upgrade --needed --noconfirm "/work/build/*.pkg.tar" # Arch Linux
+mkosi -t none && mkosi ssh pacman --upgrade --needed --noconfirm "/work/build/*.pkg.tar"             # Arch Linux
 mkosi -t none && mkosi ssh zypper --non-interactive install --allow-unsigned-rpm "/work/build/*.rpm" # OpenSUSE
 ```
 
@@ -97,29 +125,6 @@ $ git push -u <REMOTE>            # where REMOTE is your "fork" on GitHub
 
 And after that, head over to your repo on GitHub and click "Compare & pull request"
 
-If you want to do a local build without mkosi,
-most distributions also provide very simple and convenient ways to install most development packages necessary to build systemd:
-
-```sh
-# Fedora
-$ sudo dnf builddep systemd
-# Debian/Ubuntu
-$ sudo apt-get build-dep systemd
-# Arch
-$ sudo pacman -S devtools
-$ pkgctl repo clone --protocol=https systemd
-$ cd systemd
-$ makepkg -seoc
-```
-
-After installing the development packages, systemd can be built from source as follows:
-
-```sh
-$ meson setup build <options>
-$ ninja -C build
-$ meson test -C build
-```
-
 Happy hacking!
 
 ## Building distribution packages with mkosi
@@ -128,22 +133,25 @@ To build distribution packages for a specific distribution and release without
 building an actual image, the following command can be used:
 
 ```sh
-mkosi -d <distribution> -r <release> -t none -f
+mkosi -d <distribution> -r <release> -t none
 ```
 
-Afterwards the distribution packages will be located in `build/mkosi.output`. To
+Afterwards the distribution packages will be located in
-also build debuginfo packages, the following command can be used:
+`build/mkosi.builddir/<distribution>~<release>~<architecture>/`. To also build
+debuginfo packages, the following command can be used:
 
 ```sh
-mkosi -d <distribution> -r <release> -E WITH_DEBUG=1 -t none -f
+mkosi -d <distribution> -r <release> -E WITH_DEBUG=1 -t none
 ```
 
 To upgrade the systemd packages on the host system to the newer versions built
 by mkosi, run the following:
 
 ```sh
-dnf upgrade build/mkosi.output/*.rpm # Fedora/CentOS
+dnf upgrade build/mkosi.builddir/<distribution>~<release>~<architecture>/*.rpm                                           # Fedora/CentOS
-# TODO: Other distributions
+apt-get install build/mkosi.builddir/<distribution>~<release>~<architecture>/*.deb                                       # Debian/Ubuntu
+pacman --upgrade --needed --noconfirm build/mkosi.builddir/<distribution>~<release>~<architecture>/*.pkg.tar             # Arch Linux
+zypper --non-interactive install --allow-unsigned-rpm build/mkosi.builddir/<distribution>~<release>~<architecture>/*.rpm # OpenSUSE
 ```
 
 To downgrade back to the old version shipped by the distribution, run the

docs/INHIBITOR_LOCKS.md

@@ -42,8 +42,8 @@ If such a lock is taken the operation will fail (but still may be overridden if
 The InhibitDelayMaxSec= setting in [logind.conf(5)](http://www.freedesktop.org/software/systemd/man/logind.conf.html) controls the timeout for this. This is intended to be used by applications which need a synchronous way to execute actions before system suspend but shall not be allowed to block suspend indefinitely.
 This mode is only available for _sleep_ and _shutdown_ locks.
 
-3. _block-weak_ and _delay-weak_ that work as the non-weak counterparts, but that in addition may be ignored
+3. _block-weak_ that works as its non-weak counterpart, but that in addition may be ignored
-automatically and silently under certain circumstances, unlike the formers which are always respected.
+automatically and silently under certain circumstances, unlike the former which is always respected.
 
 Inhibitor locks are taken via the Inhibit() D-Bus call on the logind Manager object:
 

docs/PASSWORD_AGENTS.md

@@ -7,25 +7,30 @@ SPDX-License-Identifier: LGPL-2.1-or-later
 
 # Password Agents
 
-systemd 12 and newer support lightweight password agents which can be used to query the user for system-level passwords or passphrases.
+systemd 12 and newer support lightweight password agents which can be used to
-These are passphrases that are not related to a specific user, but to some kind of hardware or service.
+query the user for system-level passwords or passphrases.  These are
-Right now this is used exclusively for encrypted hard-disk passphrases but later on this is likely to be used to query passphrases of SSL certificates at Apache startup time as well.
+passphrases that are not related to a specific user, but to some kind of
-The basic idea is that a system component requesting a password entry can simply drop a simple .ini-style file into `/run/systemd/ask-password` which multiple different agents may watch via `inotify()`, and query the user as necessary.
+hardware or service.  This is used for encrypted hard-disk passphrases or to
-The answer is then sent back to the querier via an `AF_UNIX`/`SOCK_DGRAM` socket.
+query passphrases of SSL certificates at web server start-up time.  The basic
-Multiple agents might be running at the same time in which case they all should query the user and the agent which answers first wins.
+idea is that a system component requesting a password entry can simply drop a
-Right now systemd ships with the following passphrase agents:
+simple .ini-style file into `/run/systemd/ask-password/` which multiple
+different agents may watch via `inotify()`, and query the user as necessary.
+The answer is then sent back to the querier via an `AF_UNIX`/`SOCK_DGRAM`
+socket.  Multiple agents might be running at the same time in which case they
+all should query the user and the agent which answers first wins.  Right now
+systemd ships with the following passphrase agents:
 
 * A Plymouth agent used for querying passwords during boot-up
 * A console agent used in similar situations if Plymouth is not available
-* A GNOME agent which can be run as part of the normal user session which pops up a notification message and icon which when clicked receives the passphrase from the user.
-  This is useful and necessary in case an encrypted system hard-disk is plugged in when the machine is already up.
 * A [`wall(1)`](https://man7.org/linux/man-pages/man1/wall.1.html) agent which sends wall messages as soon as a password shall be entered.
 * A simple tty agent which is built into "`systemctl start`" (and similar commands) and asks passwords to the user during manual startup of a service
 * A simple tty agent which can be run manually to respond to all queued passwords
 
+## Implementing Agents
+
 It is easy to write additional agents. The basic algorithm to follow looks like this:
 
-* Create an inotify watch on /run/systemd/ask-password, watch for `IN_CLOSE_WRITE|IN_MOVED_TO`
+* Create an inotify watch on `/run/systemd/ask-password/`, watch for `IN_CLOSE_WRITE|IN_MOVED_TO`
 * Ignore all events on files in that directory that do not start with "`ask.`"
 * As soon as a file named "`ask.xxxx`" shows up, read it. It's a simple `.ini` file that may be parsed with the usual parsers. The `xxxx` suffix is randomized.
 * Make sure to ignore unknown `.ini` file keys in those files, so that we can easily extend the format later on.
@@ -42,23 +47,57 @@ It is easy to write additional agents. The basic algorithm to follow looks like
 * Make sure to hide a password query dialog as soon as a) the `ask.xxxx` file is deleted, watch this with inotify. b) the `NotAfter=` time elapses, if it is set `!= 0`.
 * Access to the socket is restricted to privileged users.
   To acquire the necessary privileges to send the answer back, consider using PolicyKit.
-  In fact, the GNOME agent we ship does that, and you may simply piggyback on that, by executing "`/usr/bin/pkexec /usr/lib/systemd/systemd-reply-password 1 /path/to/socket`" or "`/usr/bin/pkexec /usr/lib/systemd/systemd-reply-password 0 /path/to/socket`" and writing the password to its standard input.
+  For convenience, a reference implementation is provided: "`/usr/bin/pkexec /usr/lib/systemd/systemd-reply-password 1 /path/to/socket`" or "`/usr/bin/pkexec /usr/lib/systemd/systemd-reply-password 0 /path/to/socket`" and writing the password to its standard input.
   Use '`1`' as argument if a password was entered by the user, or '`0`' if the user canceled the request.
 * If you do not want to use PK ensure to acquire the necessary privileges in some other way and send a single datagram
   to the socket consisting of the password string either prefixed with "`+`" or with "`-`" depending on whether the password entry was successful or not.
   You may but don't have to include a final `NUL` byte in your message.
 
-Again, it is essential that you stop showing the password box/notification/status icon if the `ask.xxx` file is removed or when `NotAfter=` elapses (if it is set `!= 0`)!
+Again, it is essential that you stop showing the password
+box/notification/status icon if the `ask.xxxx` file is removed or when
+`NotAfter=` elapses (if it is set `!= 0`)!
 
 It may happen that multiple password entries are pending at the same time.
-Your agent needs to be able to deal with that. Depending on your environment you may either choose to show all outstanding passwords at the same time or instead only one and as soon as the user has replied to that one go on to the next one.
+Your agent needs to be able to deal with that. Depending on your environment
+you may either choose to show all outstanding passwords at the same time or
+instead only one and as soon as the user has replied to that one go on to the
+next one.
 
-You may test this all with manually invoking the "`systemd-ask-password`" tool on the command line.
+If you write a system level agent, a smart way to activate it is using systemd
-Pass `--no-tty` to ensure the password is asked via the agent system.
+`.path` units.  This will ensure that systemd will watch the
-Note that only privileged users may use this tool (after all this is intended purely for system-level passwords).
+`/run/systemd/ask-password/` directory and spawn the agent as soon as that
+directory becomes non-empty.  In fact, the console, wall and Plymouth agents
+are started like this.  If systemd is used to maintain user sessions as well
+you can use a similar scheme to automatically spawn your user password agent as
+well.
 
-If you write a system level agent a smart way to activate it is using systemd `.path` units.
+## Implementing Queriers
-This will ensure that systemd will watch the `/run/systemd/ask-password` directory and spawn the agent as soon as that directory becomes non-empty.
+
-In fact, the console, wall and Plymouth agents are started like this.
+It's also easy to implement applications that want to query passwords this way
-If systemd is used to maintain user sessions as well you can use a similar scheme to automatically spawn your user password agent as well.
+(i.e. client for the agents above). Simply bind an `AF_UNIX`/`SOCK_DGRAM`
-(As of this moment we have not switched any DE over to use systemd for session management, however.)
+socket somewhere (suggestion: you can do this in `/run/systemd/ask-password/`
+under a randomized socket name, not beginning with `ask.`). Then, create an
+`/run/systemd/ask-password/ask.xxxx` (replace the `xxxx` by some randomized
+string) file, with the appropriate `Message=`, `PID=`, `Icon=`, `Echo=`,
+`NotAfter=` fields in the `[Ask]` section. Most importantly, include `Socket=`
+pointing to your socket entrypoint. Then, just wait until the password is
+delivered to you on the socket. Finally, don't forget to remove the file and
+the socket once done.
+
+## Testing
+
+You may test agents by manually invoking the "`systemd-ask-password`" tool from
+a shell.  Pass `--no-tty` to ensure the password is asked via the agent system.
+
+You may test queriers by manually invoking the
+"`systemd-tty-ask-password-agent`" from a shell.
+
+## Unprivileged Per-User Password Agents
+
+Starting with systemd v257 the scheme is extended to per-user password
+agents. A second per-user directory `$XDG_RUNTIME_DIR/systemd/ask-password/` is
+now available, with the same protocol as the system-wide
+counterpart. Unprivileged, per-directory agents should watch this directory in
+parallel to the system-wide one. Unprivileged queriers (i.e. clients to these
+agents) should pick the per-user directory to place their password request
+files in.

docs/RELEASE.md

@@ -15,18 +15,19 @@ SPDX-License-Identifier: LGPL-2.1-or-later
 6. [RC1] Update library numbers in `meson.build`
 7. Update version number in `meson.version` (e.g. from `256~devel` to `256~rc1` or from `256~rc3` to `256`). Note that this uses a tilde (\~) instead of a hyphen (-) because tildes sort lower in version comparisons according to the [version format specification](https://uapi-group.org/specifications/specs/version_format_specification/), and we want `255~rc1` to sort lower than `255`.
 8. Check dbus docs with `ninja -C build update-dbus-docs`
-9. Update translation strings (`ninja -C build systemd-pot`, `ninja -C build systemd-update-po`) - drop the header comments from `systemd.pot` + re-add SPDX before committing. If the only change in a file is the 'POT-Creation-Date' field, then ignore that file.
+9. Check manpages list with `ninja -C build update-man-rules`
-10. Tag the release: `version="v$(sed 's/~/-/g' meson.version)" && git tag -s "${version}" -m "systemd ${version}"` (tildes are replaced with hyphens, because git doesn't accept the former).
+10. Update translation strings (`ninja -C build systemd-pot`, `ninja -C build systemd-update-po`) - drop the header comments from `systemd.pot` + re-add SPDX before committing. If the only change in a file is the 'POT-Creation-Date' field, then ignore that file.
-11. Do `ninja -C build`
+11. Tag the release: `version="v$(sed 's/~/-/g' meson.version)" && git tag -s "${version}" -m "systemd ${version}"` (tildes are replaced with hyphens, because git doesn't accept the former).
-12. Make sure that the version string and package string match: `build/systemctl --version`
+12. Do `ninja -C build`
-13. [FINAL] Close the github milestone and open a new one (https://github.com/systemd/systemd/milestones)
+13. Make sure that the version string and package string match: `build/systemctl --version`
-14. "Draft" a new release on github (https://github.com/systemd/systemd/releases/new), mark "This is a pre-release" if appropriate.
+14. [FINAL] Close the github milestone and open a new one (https://github.com/systemd/systemd/milestones)
-15. Check that announcement to systemd-devel, with a copy&paste from NEWS, was sent. This should happen automatically.
+15. "Draft" a new release on github (https://github.com/systemd/systemd/releases/new), mark "This is a pre-release" if appropriate.
-16. Update IRC topic (`/msg chanserv TOPIC #systemd Version NNN released | Online resources https://systemd.io/`)
+16. Check that announcement to systemd-devel, with a copy&paste from NEWS, was sent. This should happen automatically.
-17. [FINAL] Create an empty -stable branch: `git push systemd origin/main:refs/heads/v${version}-stable`.
+17. Update IRC topic (`/msg chanserv TOPIC #systemd Version NNN released | Online resources https://systemd.io/`)
-18. [FINAL] Build and upload the documentation (on the -stable branch): `ninja -C build doc-sync`
+18. [FINAL] Create an empty -stable branch: `git push systemd origin/main:refs/heads/v${version}-stable`.
+19. [FINAL] Build and upload the documentation (on the -stable branch): `ninja -C build doc-sync`
 20. [FINAL] Change the Github Pages branch to the newly created branch (https://github.com/systemd/systemd/settings/pages) and set the 'Custom domain' to 'systemd.io'
-21. [FINAL] Update version number in `meson.version` to the devel version of the next release (e.g. from `v256` to `v257~devel`)
+21. [FINAL] Update version number in `meson.version` to the devel version of the next release (e.g. from `256` to `257~devel`)
 
 # Steps to a Successful Stable Release
 

docs/TPM2_PCR_MEASUREMENTS.md

@@ -41,7 +41,7 @@ used for new, additional measurements.
 
 ## PCR Measurements Made by `systemd-boot` (UEFI)
 
-### PCS 5, `EV_EVENT_TAG`, "loader.conf"
+### PCS 5, `EV_EVENT_TAG`, `loader.conf`
 
 The content of `systemd-boot`'s configuration file, `loader/loader.conf`, is
 measured as a tagged event.
@@ -52,7 +52,7 @@ measured as a tagged event.
 
 → **Measured hash** covers the content of `loader.conf` as it is read from the ESP.
 
-### PCR 12, `EV_IPL`, "Kernel Command Line"
+### PCR 12, `EV_IPL`, kernel command line
 
 If the kernel command line was specified explicitly (by the user or in a Boot
 Loader Specification Type #1 file), the kernel command line passed to the
@@ -70,7 +70,7 @@ trailing NUL bytes).
 
 ## PCR Measurements Made by `systemd-stub` (UEFI)
 
-### PCR 11, `EV_IPL`, "PE Section Name"
+### PCR 11, `EV_IPL`, PE section name
 
 A measurement is made for each PE section of the UKI that is defined by the
 [UKI
@@ -87,7 +87,7 @@ both types of records appear interleaved in the event log.
 
 → **Measured hash** covers the PE section name in ASCII (*including* a trailing NUL byte!).
 
-### PCR 11, `EV_IPL`, "PE Section Data"
+### PCR 11, `EV_IPL`, PE section data
 
 Happens once for each UKI-defined PE section of the UKI, in the canonical UKI
 PE section order, as per the UKI specification, see above.
@@ -96,7 +96,7 @@ PE section order, as per the UKI specification, see above.
 
 → **Measured hash** covers the (binary) PE section contents.
 
-### PCR 12, `EV_IPL`, "Kernel Command Line"
+### PCR 12, `EV_IPL`, kernel command line
 
 Might happen up to three times, for kernel command lines from:
 
@@ -110,37 +110,37 @@ UTF-16.
 → **Measured hash** covers the literal kernel command line in UTF-16 (without any
 trailing NUL bytes).
 
-### PCR 12, `EV_EVENT_TAG`, "Devicetrees"
+### PCR 12, `EV_EVENT_TAG`, DeviceTrees
 
-Devicetree addons are measured individually as a tagged event.
+DeviceTree addons are measured individually as a tagged event.
 
 → **Event Tag** `0x6c46f751`
 
-→ **Description** the addon filename.
+→ **Description** is the addon filename.
 
-→ **Measured hash** covers the content of the Devicetree.
+→ **Measured hash** covers the content of the DeviceTree.
 
-### PCR 12, `EV_EVENT_TAG`, "Initrd addons"
+### PCR 12, `EV_EVENT_TAG`, initrd addons
 
 Initrd addons are measured individually as a tagged event.
 
 → **Event Tag** `0x49dffe0f`
 
-→ **Description** the addon filename.
+→ **Description** is the addon filename.
 
 → **Measured hash** covers the contents of the initrd.
 
-### PCR 12, `EV_EVENT_TAG`, "Ucode addons"
+### PCR 12, `EV_EVENT_TAG`, ucode addons
 
 Ucode addons are measured individually as a tagged event.
 
 → **Event Tag** `0xdac08e1a`
 
-→ **Description** the addon filename.
+→ **Description** is the addon filename.
 
 → **Measured hash** covers the contents of the ucode initrd.
 
-### PCR 12, `EV_IPL`, "Per-UKI Credentials initrd"
+### PCR 12, `EV_IPL`, per-uki credentials initrd
 
 → **Description** in the event log record is the constant string "Credentials
 initrd" in UTF-16.
@@ -148,7 +148,7 @@ initrd" in UTF-16.
 → **Measured hash** covers the per-UKI credentials cpio archive (which is generated
  on-the-fly by `systemd-stub`).
 
-### PCR 12, `EV_IPL`, "Global Credentials initrd"
+### PCR 12, `EV_IPL`, global credentials initrd
 
 → **Description** in the event log record is the constant string "Global
 credentials initrd" in UTF-16.
@@ -156,7 +156,7 @@ credentials initrd" in UTF-16.
 → **Measured hash** covers the global credentials cpio archive (which is generated
 on-the-fly by `systemd-stub`).
 
-### PCR 13, `EV_IPL`, "sysext initrd"
+### PCR 13, `EV_IPL`, sysext initrd
 
 → **Description** in the event log record is the constant string "System extension
 initrd" in UTF-16.
@@ -166,7 +166,7 @@ on-the-fly by `systemd-stub`).
 
 ## PCR Measurements Made by `systemd-pcrextend` (Userspace)
 
-### PCR 11, "Boot Phases"
+### PCR 11, boot phases
 
 The `systemd-pcrphase.service`, `systemd-pcrphase-initrd.service`,
 `systemd-pcrphase-sysinit.service` services will measure the boot phase reached
@@ -178,7 +178,7 @@ choose to define additional/different phases.)
 → **Measured hash** covers the phase string (in UTF-8, without trailing NUL
 bytes).
 
-### PCR 15, "Machine ID"
+### PCR 15, machine ID
 
 The `systemd-pcrmachine.service` service will measure the machine ID (as read
 from `/etc/machine-id`) during boot.
@@ -187,7 +187,7 @@ from `/etc/machine-id`) during boot.
 formatted in hexadecimal lowercase characters (in UTF-8, without trailing NUL
 bytes).
 
-### PCR 15, "File System"
+### PCR 15, file system
 
 The `systemd-pcrfs-root.service` and `systemd-pcrfs@.service` services will
 measure a string identifying a specific file system, typically covering the
@@ -200,7 +200,7 @@ without trailing NUL bytes).
 
 ## PCR Measurements Made by `systemd-cryptsetup` (Userspace)
 
-### PCR 15, "Volume Key"
+### PCR 15, volume key
 
 The `systemd-cryptsetup@.service` service will measure a key derived from the
 LUKS volume key of a specific encrypted volume, typically covering the backing

docs/USER_RECORD.md

@@ -597,6 +597,17 @@ The salt to pass to the FIDO2 device is found in `fido2HmacSalt`.
 The only supported recovery key type at the moment is `modhex64`, for details see the description of `recoveryKey` below.
 An account may have any number of recovery keys defined, and the array should have one entry for each.
 
+`selfModifiableFields` → An array of strings, each corresponding to a field name that can appear
+in the `regular` or `perMachine` sections. The user may be allowed to edit any field in this list
+without authenticating as an administrator. Note that the user will only be allowed to edit fields
+in `perMachine` sections that match the machine the user is performing the edit from.
+
+`selfModifiableBlobs` → Similar to `selfModifiableFields`, but it lists blobs that the user
+is allowed to edit.
+
+`selfModifiablePrivileged` →  Similar to `selfModifiableFields`, but it lists fields in
+the `privileged` section that the user is allowed to edit.
+
 `privileged` → An object, which contains the fields of the `privileged` section
 of the user record, see below.
 
@@ -754,7 +765,7 @@ All other fields that may be used in this section are identical to the equally n
 `autoLogin`, `preferredSessionType`, `preferredSessionLauncher`, `stopDelayUSec`, `killProcesses`,
 `passwordChangeMinUSec`, `passwordChangeMaxUSec`, `passwordChangeWarnUSec`,
 `passwordChangeInactiveUSec`, `passwordChangeNow`, `pkcs11TokenUri`,
-`fido2HmacCredential`.
+`fido2HmacCredential`, `selfModifiableFields`, `selfModifiableBlobs`, `selfModifiablePrivileged`.
 
 ## Fields in the `binding` section
 

hwdb.d/20-acpi-vendor.hwdb

@@ -102,6 +102,9 @@ acpi:DMST*:
 acpi:DNBK*:
  ID_VENDOR_FROM_DATABASE=Dynabook Inc.
 
+acpi:DSHR*:
+ ID_VENDOR_FROM_DATABASE=3mdeb
+
 acpi:DSUO*:
  ID_VENDOR_FROM_DATABASE=Shenzhen DSO Microelectronics Co.,Ltd.
 
@@ -189,6 +192,9 @@ acpi:ILIT*:
 acpi:IMPJ*:
  ID_VENDOR_FROM_DATABASE=Impinj
 
+acpi:INIT*:
+ ID_VENDOR_FROM_DATABASE=INIT - Innovative Informatikanwendungen GmbH
+
 acpi:INSY*:
  ID_VENDOR_FROM_DATABASE=Insyde Software
 
@@ -309,6 +315,9 @@ acpi:RKCP*:
 acpi:RPIL*:
  ID_VENDOR_FROM_DATABASE=Raspberry Pi
 
+acpi:RSCV*:
+ ID_VENDOR_FROM_DATABASE=RISC-V International
+
 acpi:RVOS*:
  ID_VENDOR_FROM_DATABASE=Rivos Inc.
 
@@ -318,6 +327,9 @@ acpi:RZSN*:
 acpi:SECC*:
  ID_VENDOR_FROM_DATABASE=Seiko Epson Corporation
 
+acpi:SGSN*:
+ ID_VENDOR_FROM_DATABASE=SigmaSense, LLC
+
 acpi:SHRP*:
  ID_VENDOR_FROM_DATABASE=Sharp Corporation
 
@@ -360,6 +372,9 @@ acpi:VAIO*:
 acpi:VFSI*:
  ID_VENDOR_FROM_DATABASE=Validity Sensors, Inc
 
+acpi:VNTN*:
+ ID_VENDOR_FROM_DATABASE=Ventana Micro Systems
+
 acpi:VSHY*:
  ID_VENDOR_FROM_DATABASE=Vishay Intertechnology, Inc.
 
@@ -489,6 +504,9 @@ acpi:ADD*:
 acpi:ADE*:
  ID_VENDOR_FROM_DATABASE=Arithmos, Inc.
 
+acpi:ADG*:
+ ID_VENDOR_FROM_DATABASE=Airdrop Gaming LLC
+
 acpi:ADH*:
  ID_VENDOR_FROM_DATABASE=Aerodata Holdings Ltd
 
@@ -1524,6 +1542,9 @@ acpi:CHY*:
 acpi:CIC*:
  ID_VENDOR_FROM_DATABASE=Comm. Intelligence Corporation
 
+acpi:CID*:
+ ID_VENDOR_FROM_DATABASE=Indicates an identity defined by CTS/DID Standards other than EDID
+
 acpi:CIE*:
  ID_VENDOR_FROM_DATABASE=Convergent Engineering, Inc.
 
@@ -2250,6 +2271,9 @@ acpi:DTK*:
 acpi:DTL*:
  ID_VENDOR_FROM_DATABASE=e-Net Inc
 
+acpi:DTM*:
+ ID_VENDOR_FROM_DATABASE=Daten Tecnologia
+
 acpi:DTN*:
  ID_VENDOR_FROM_DATABASE=Datang  Telephone Co
 
@@ -4140,6 +4164,9 @@ acpi:LAS*:
 acpi:LAV*:
  ID_VENDOR_FROM_DATABASE=Lava Computer MFG Inc
 
+acpi:LBC*:
+ ID_VENDOR_FROM_DATABASE=LABAU Technology Corp.
+
 acpi:LBO*:
  ID_VENDOR_FROM_DATABASE=Lubosoft
 
@@ -6417,6 +6444,9 @@ acpi:SHR*:
 acpi:SHT*:
  ID_VENDOR_FROM_DATABASE=Shin Ho Tech
 
+acpi:SHU*:
+ ID_VENDOR_FROM_DATABASE=Shure Inc.
+
 acpi:SIA*:
  ID_VENDOR_FROM_DATABASE=SIEMENS AG
 
@@ -7944,6 +7974,9 @@ acpi:XIT*:
 acpi:XLX*:
  ID_VENDOR_FROM_DATABASE=Xilinx, Inc.
 
+acpi:XMI*:
+ ID_VENDOR_FROM_DATABASE=Xiaomi Corporation
+
 acpi:XMM*:
  ID_VENDOR_FROM_DATABASE=C3PO S.L.
 

hwdb.d/20-acpi-vendor.hwdb.patch

@@ -1,5 +1,5 @@
---- 20-acpi-vendor.hwdb.base	2024-06-11 18:28:44.326630949 +0100
+--- 20-acpi-vendor.hwdb.base	2024-11-06 10:40:14.734611315 +0000
-+++ 20-acpi-vendor.hwdb	2024-06-11 18:28:44.334631113 +0100
++++ 20-acpi-vendor.hwdb	2024-11-06 10:40:14.738611667 +0000
 @@ -3,6 +3,8 @@
  # Data imported from:
  #     https://uefi.org/uefi-pnp-export
@@ -19,7 +19,7 @@
  acpi:AMDI*:
   ID_VENDOR_FROM_DATABASE=AMD
  
-@@ -379,6 +378,9 @@
+@@ -394,6 +393,9 @@
  acpi:AAA*:
   ID_VENDOR_FROM_DATABASE=Avolites Ltd
  
@@ -29,7 +29,7 @@
  acpi:AAE*:
   ID_VENDOR_FROM_DATABASE=Anatek Electronics Inc.
  
-@@ -406,6 +408,9 @@
+@@ -421,6 +423,9 @@
  acpi:ABO*:
   ID_VENDOR_FROM_DATABASE=D-Link Systems Inc
  
@@ -39,7 +39,7 @@
  acpi:ABS*:
   ID_VENDOR_FROM_DATABASE=Abaco Systems, Inc.
  
-@@ -451,7 +456,7 @@
+@@ -466,7 +471,7 @@
  acpi:ACO*:
   ID_VENDOR_FROM_DATABASE=Allion Computer Inc.
  
@@ -48,7 +48,7 @@
   ID_VENDOR_FROM_DATABASE=Aspen Tech Inc
  
  acpi:ACR*:
-@@ -727,6 +732,9 @@
+@@ -745,6 +750,9 @@
  acpi:AMT*:
   ID_VENDOR_FROM_DATABASE=AMT International Industry
  
@@ -58,7 +58,7 @@
  acpi:AMX*:
   ID_VENDOR_FROM_DATABASE=AMX LLC
  
-@@ -775,6 +783,9 @@
+@@ -793,6 +801,9 @@
  acpi:AOA*:
   ID_VENDOR_FROM_DATABASE=AOpen Inc.
  
@@ -68,7 +68,7 @@
  acpi:AOE*:
   ID_VENDOR_FROM_DATABASE=Advanced Optics Electronics, Inc.
  
-@@ -784,6 +795,9 @@
+@@ -802,6 +813,9 @@
  acpi:AOT*:
   ID_VENDOR_FROM_DATABASE=Alcatel
  
@@ -78,7 +78,7 @@
  acpi:APC*:
   ID_VENDOR_FROM_DATABASE=American Power Conversion
  
-@@ -965,7 +979,7 @@
+@@ -983,7 +997,7 @@
   ID_VENDOR_FROM_DATABASE=ALPS ALPINE CO., LTD.
  
  acpi:AUO*:
@@ -87,7 +87,7 @@
  
  acpi:AUR*:
   ID_VENDOR_FROM_DATABASE=Aureal Semiconductor
-@@ -1045,6 +1059,9 @@
+@@ -1063,6 +1077,9 @@
  acpi:AXE*:
   ID_VENDOR_FROM_DATABASE=Axell Corporation
  
@@ -97,7 +97,7 @@
  acpi:AXI*:
   ID_VENDOR_FROM_DATABASE=American Magnetics
  
-@@ -1201,6 +1218,9 @@
+@@ -1219,6 +1236,9 @@
  acpi:BML*:
   ID_VENDOR_FROM_DATABASE=BIOMED Lab
  
@@ -107,7 +107,7 @@
  acpi:BMS*:
   ID_VENDOR_FROM_DATABASE=BIOMEDISYS
  
-@@ -1213,6 +1233,9 @@
+@@ -1231,6 +1251,9 @@
  acpi:BNO*:
   ID_VENDOR_FROM_DATABASE=Bang & Olufsen
  
@@ -117,7 +117,7 @@
  acpi:BNS*:
   ID_VENDOR_FROM_DATABASE=Boulder Nonlinear Systems
  
-@@ -1459,6 +1482,9 @@
+@@ -1477,6 +1500,9 @@
  acpi:CHA*:
   ID_VENDOR_FROM_DATABASE=Chase Research PLC
  
@@ -127,7 +127,7 @@
  acpi:CHD*:
   ID_VENDOR_FROM_DATABASE=ChangHong Electric Co.,Ltd
  
-@@ -1621,6 +1647,9 @@
+@@ -1642,6 +1668,9 @@
  acpi:COD*:
   ID_VENDOR_FROM_DATABASE=CODAN Pty. Ltd.
  
@@ -137,7 +137,7 @@
  acpi:COI*:
   ID_VENDOR_FROM_DATABASE=Codec Inc.
  
-@@ -2042,7 +2071,7 @@
+@@ -2063,7 +2092,7 @@
   ID_VENDOR_FROM_DATABASE=Dragon Information Technology
  
  acpi:DJE*:
@@ -146,7 +146,7 @@
  
  acpi:DJP*:
   ID_VENDOR_FROM_DATABASE=Maygay Machines, Ltd
-@@ -2392,6 +2421,9 @@
+@@ -2416,6 +2445,9 @@
  acpi:EIN*:
   ID_VENDOR_FROM_DATABASE=Elegant Invention
  
@@ -156,7 +156,7 @@
  acpi:EKA*:
   ID_VENDOR_FROM_DATABASE=MagTek Inc.
  
-@@ -2662,6 +2694,9 @@
+@@ -2686,6 +2718,9 @@
  acpi:FCG*:
   ID_VENDOR_FROM_DATABASE=First International Computer Ltd
  
@@ -166,7 +166,7 @@
  acpi:FCS*:
   ID_VENDOR_FROM_DATABASE=Focus Enhancements, Inc.
  
-@@ -3038,7 +3073,7 @@
+@@ -3062,7 +3097,7 @@
   ID_VENDOR_FROM_DATABASE=General Standards Corporation
  
  acpi:GSM*:
@@ -175,7 +175,7 @@
  
  acpi:GSN*:
   ID_VENDOR_FROM_DATABASE=Grandstream Networks, Inc.
-@@ -3148,6 +3183,9 @@
+@@ -3172,6 +3207,9 @@
  acpi:HEC*:
   ID_VENDOR_FROM_DATABASE=Hisense Electric Co., Ltd.
  
@@ -185,7 +185,7 @@
  acpi:HEL*:
   ID_VENDOR_FROM_DATABASE=Hitachi Micro Systems Europe Ltd
  
-@@ -3283,6 +3321,9 @@
+@@ -3307,6 +3345,9 @@
  acpi:HSD*:
   ID_VENDOR_FROM_DATABASE=HannStar Display Corp
  
@@ -195,7 +195,7 @@
  acpi:HSM*:
   ID_VENDOR_FROM_DATABASE=AT&T Microelectronics
  
-@@ -3409,6 +3450,9 @@
+@@ -3433,6 +3474,9 @@
  acpi:ICI*:
   ID_VENDOR_FROM_DATABASE=Infotek Communication Inc
  
@@ -205,7 +205,7 @@
  acpi:ICM*:
   ID_VENDOR_FROM_DATABASE=Intracom SA
  
-@@ -3505,6 +3549,9 @@
+@@ -3529,6 +3573,9 @@
  acpi:IKE*:
   ID_VENDOR_FROM_DATABASE=Ikegami Tsushinki Co. Ltd.
  
@@ -215,7 +215,7 @@
  acpi:IKS*:
   ID_VENDOR_FROM_DATABASE=Ikos Systems Inc
  
-@@ -3553,6 +3600,9 @@
+@@ -3577,6 +3624,9 @@
  acpi:IMX*:
   ID_VENDOR_FROM_DATABASE=arpara Technology Co., Ltd.
  
@@ -225,7 +225,7 @@
  acpi:INA*:
   ID_VENDOR_FROM_DATABASE=Inventec Corporation
  
-@@ -4081,6 +4131,9 @@
+@@ -4105,6 +4155,9 @@
  acpi:LAN*:
   ID_VENDOR_FROM_DATABASE=Sodeman Lancom Inc
  
@@ -235,7 +235,7 @@
  acpi:LAS*:
   ID_VENDOR_FROM_DATABASE=LASAT Comm. A/S
  
-@@ -4129,6 +4182,9 @@
+@@ -4156,6 +4209,9 @@
  acpi:LED*:
   ID_VENDOR_FROM_DATABASE=Long Engineering Design Inc
  
@@ -245,7 +245,7 @@
  acpi:LEG*:
   ID_VENDOR_FROM_DATABASE=Legerity, Inc
  
-@@ -4147,6 +4203,9 @@
+@@ -4174,6 +4230,9 @@
  acpi:LGD*:
   ID_VENDOR_FROM_DATABASE=LG Display
  
@@ -255,7 +255,7 @@
  acpi:LGI*:
   ID_VENDOR_FROM_DATABASE=Logitech Inc
  
-@@ -4213,6 +4272,9 @@
+@@ -4240,6 +4299,9 @@
  acpi:LND*:
   ID_VENDOR_FROM_DATABASE=Land Computer Company Ltd
  
@@ -265,7 +265,7 @@
  acpi:LNK*:
   ID_VENDOR_FROM_DATABASE=Link Tech Inc
  
-@@ -4247,7 +4309,7 @@
+@@ -4274,7 +4336,7 @@
   ID_VENDOR_FROM_DATABASE=Design Technology
  
  acpi:LPL*:
@@ -274,7 +274,7 @@
  
  acpi:LSC*:
   ID_VENDOR_FROM_DATABASE=LifeSize Communications
-@@ -4423,6 +4485,9 @@
+@@ -4450,6 +4512,9 @@
  acpi:MCX*:
   ID_VENDOR_FROM_DATABASE=Millson Custom Solutions Inc.
  
@@ -284,7 +284,7 @@
  acpi:MDA*:
   ID_VENDOR_FROM_DATABASE=Media4 Inc
  
-@@ -4669,6 +4734,9 @@
+@@ -4696,6 +4761,9 @@
  acpi:MOM*:
   ID_VENDOR_FROM_DATABASE=Momentum Data Systems
  
@@ -294,7 +294,7 @@
  acpi:MOS*:
   ID_VENDOR_FROM_DATABASE=Moses Corporation
  
-@@ -4909,6 +4977,9 @@
+@@ -4936,6 +5004,9 @@
  acpi:NAL*:
   ID_VENDOR_FROM_DATABASE=Network Alchemy
  
@@ -304,7 +304,7 @@
  acpi:NAT*:
   ID_VENDOR_FROM_DATABASE=NaturalPoint Inc.
  
-@@ -5449,6 +5520,9 @@
+@@ -5476,6 +5547,9 @@
  acpi:PCX*:
   ID_VENDOR_FROM_DATABASE=PC Xperten
  
@@ -314,7 +314,7 @@
  acpi:PDM*:
   ID_VENDOR_FROM_DATABASE=Psion Dacom Plc.
  
-@@ -5512,9 +5586,6 @@
+@@ -5539,9 +5613,6 @@
  acpi:PHE*:
   ID_VENDOR_FROM_DATABASE=Philips Medical Systems Boeblingen GmbH
  
@@ -324,7 +324,7 @@
  acpi:PHL*:
   ID_VENDOR_FROM_DATABASE=Philips Consumer Electronics Company
  
-@@ -5605,9 +5676,6 @@
+@@ -5632,9 +5703,6 @@
  acpi:PNL*:
   ID_VENDOR_FROM_DATABASE=Panelview, Inc.
  
@@ -334,7 +334,7 @@
  acpi:PNR*:
   ID_VENDOR_FROM_DATABASE=Planar Systems, Inc.
  
-@@ -6085,9 +6153,6 @@
+@@ -6112,9 +6180,6 @@
  acpi:RTI*:
   ID_VENDOR_FROM_DATABASE=Rancho Tech Inc
  
@@ -344,7 +344,7 @@
  acpi:RTL*:
   ID_VENDOR_FROM_DATABASE=Realtek Semiconductor Company Ltd
  
-@@ -6262,9 +6327,6 @@
+@@ -6289,9 +6354,6 @@
  acpi:SEE*:
   ID_VENDOR_FROM_DATABASE=SeeColor Corporation
  
@@ -354,7 +354,7 @@
  acpi:SEI*:
   ID_VENDOR_FROM_DATABASE=Seitz & Associates Inc
  
-@@ -6745,6 +6807,9 @@
+@@ -6775,6 +6837,9 @@
  acpi:SVD*:
   ID_VENDOR_FROM_DATABASE=SVD Computer
  
@@ -364,7 +364,7 @@
  acpi:SVI*:
   ID_VENDOR_FROM_DATABASE=Sun Microsystems
  
-@@ -6829,6 +6894,9 @@
+@@ -6859,6 +6924,9 @@
  acpi:SZM*:
   ID_VENDOR_FROM_DATABASE=Shenzhen MTC Co., Ltd
  
@@ -374,7 +374,7 @@
  acpi:TAA*:
   ID_VENDOR_FROM_DATABASE=Tandberg
  
-@@ -6919,6 +6987,9 @@
+@@ -6949,6 +7017,9 @@
  acpi:TDG*:
   ID_VENDOR_FROM_DATABASE=Six15 Technologies
  
@@ -384,7 +384,7 @@
  acpi:TDM*:
   ID_VENDOR_FROM_DATABASE=Tandem Computer Europe Inc
  
-@@ -6961,6 +7032,9 @@
+@@ -6991,6 +7062,9 @@
  acpi:TEV*:
   ID_VENDOR_FROM_DATABASE=Televés, S.A.
  
@@ -394,7 +394,7 @@
  acpi:TEZ*:
   ID_VENDOR_FROM_DATABASE=Tech Source Inc.
  
-@@ -7090,9 +7164,6 @@
+@@ -7120,9 +7194,6 @@
  acpi:TNC*:
   ID_VENDOR_FROM_DATABASE=TNC Industrial Company Ltd
  
@@ -404,7 +404,7 @@
  acpi:TNM*:
   ID_VENDOR_FROM_DATABASE=TECNIMAGEN SA
  
-@@ -7402,14 +7473,14 @@
+@@ -7432,14 +7503,14 @@
  acpi:UNC*:
   ID_VENDOR_FROM_DATABASE=Unisys Corporation
  
@@ -425,7 +425,7 @@
  
  acpi:UNI*:
   ID_VENDOR_FROM_DATABASE=Uniform Industry Corp.
-@@ -7444,6 +7515,9 @@
+@@ -7474,6 +7545,9 @@
  acpi:USA*:
   ID_VENDOR_FROM_DATABASE=Utimaco Safeware AG
  
@@ -435,7 +435,7 @@
  acpi:USD*:
   ID_VENDOR_FROM_DATABASE=U.S. Digital Corporation
  
-@@ -7705,9 +7779,6 @@
+@@ -7735,9 +7809,6 @@
  acpi:WAL*:
   ID_VENDOR_FROM_DATABASE=Wave Access
  
@@ -445,7 +445,7 @@
  acpi:WAV*:
   ID_VENDOR_FROM_DATABASE=Wavephore
  
-@@ -7835,7 +7906,7 @@
+@@ -7865,7 +7936,7 @@
   ID_VENDOR_FROM_DATABASE=WyreStorm Technologies LLC
  
  acpi:WYS*:
@@ -454,7 +454,7 @@
  
  acpi:WYT*:
   ID_VENDOR_FROM_DATABASE=Wooyoung Image & Information Co.,Ltd.
-@@ -7849,9 +7920,6 @@
+@@ -7879,9 +7950,6 @@
  acpi:XDM*:
   ID_VENDOR_FROM_DATABASE=XDM Ltd.
  
@@ -464,7 +464,7 @@
  acpi:XES*:
   ID_VENDOR_FROM_DATABASE=Extreme Engineering Solutions, Inc.
  
-@@ -7882,9 +7950,6 @@
+@@ -7915,9 +7983,6 @@
  acpi:XNT*:
   ID_VENDOR_FROM_DATABASE=XN Technologies, Inc.
  
@@ -474,7 +474,7 @@
  acpi:XQU*:
   ID_VENDOR_FROM_DATABASE=SHANGHAI SVA-DAV ELECTRONICS CO., LTD
  
-@@ -7951,6 +8016,9 @@
+@@ -7984,6 +8049,9 @@
  acpi:ZBX*:
   ID_VENDOR_FROM_DATABASE=Zebax Technologies
  

hwdb.d/20-usb-vendor-model.hwdb

@@ -7142,6 +7142,9 @@ usb:v045Ep02E6*
 usb:v045Ep02EA*
  ID_MODEL_FROM_DATABASE=Xbox One Controller
 
+usb:v045Ep02F3*
+ ID_MODEL_FROM_DATABASE=Xbox One Chatpad
+
 usb:v045Ep02FD*
  ID_MODEL_FROM_DATABASE=Xbox One S Controller [Bluetooth]
 
@@ -14919,7 +14922,7 @@ usb:v04BFp1302*
  ID_MODEL_FROM_DATABASE=i3 Gateway
 
 usb:v04BFp1303*
- ID_MODEL_FROM_DATABASE=3 Micro Module
+ ID_MODEL_FROM_DATABASE=i3 Micro Module
 
 usb:v04BFp1304*
  ID_MODEL_FROM_DATABASE=i3 Module
@@ -19241,6 +19244,9 @@ usb:v04F9p2061*
 usb:v04F9p2064*
  ID_MODEL_FROM_DATABASE=PT-P700 P-touch Label Printer RemovableDisk
 
+usb:v04F9p2065*
+ ID_MODEL_FROM_DATABASE=PT-P750W P-Touch Label Writer
+
 usb:v04F9p2074*
  ID_MODEL_FROM_DATABASE=PT-D600 P-touch Label Printer
 
@@ -22259,6 +22265,9 @@ usb:v056Ap03EC*
 usb:v056Ap03ED*
  ID_MODEL_FROM_DATABASE=DTC121 [DTC121] touchscreen
 
+usb:v056Ap03F0*
+ ID_MODEL_FROM_DATABASE=DTH135 [Movink 13]
+
 usb:v056Ap0400*
  ID_MODEL_FROM_DATABASE=PenPartner 4x5
 
@@ -27089,6 +27098,9 @@ usb:v05E3p0760*
 usb:v05E3p0761*
  ID_MODEL_FROM_DATABASE=Genesys Mass Storage Device
 
+usb:v05E3p0769*
+ ID_MODEL_FROM_DATABASE=SPR2801S [Lightspeeur 2801]
+
 usb:v05E3p0780*
  ID_MODEL_FROM_DATABASE=USBFS DFU Adapter
 
@@ -32634,7 +32646,7 @@ usb:v079Bp005F*
  ID_MODEL_FROM_DATABASE=Laser Pro LL [MFPrinter]
 
 usb:v079Bp0062*
- ID_MODEL_FROM_DATABASE=XG-76NA 802.11bg
+ ID_MODEL_FROM_DATABASE=XG-76NA / XG-760N 802.11b/g Wireless adapter
 
 usb:v079Bp0078*
  ID_MODEL_FROM_DATABASE=Laser Pro Monochrome MFP
@@ -33446,6 +33458,9 @@ usb:v07CAp1830*
 usb:v07CAp1871*
  ID_MODEL_FROM_DATABASE=TD310 DVB-T/T2/C dongle
 
+usb:v07CAp2553*
+ ID_MODEL_FROM_DATABASE=Live Gamer Ultra 2.1
+
 usb:v07CAp3835*
  ID_MODEL_FROM_DATABASE=AVerTV Volar Green HD (A835B)
 
@@ -33479,6 +33494,9 @@ usb:v07CApB800*
 usb:v07CApC039*
  ID_MODEL_FROM_DATABASE=DVD EZMaker 7
 
+usb:v07CApD553*
+ ID_MODEL_FROM_DATABASE=Live Gamer Ultra Pro-RGB
+
 usb:v07CApE880*
  ID_MODEL_FROM_DATABASE=MPEG-2 Capture Device (E880)
 
@@ -36798,7 +36816,7 @@ usb:v0930p0B05*
  ID_MODEL_FROM_DATABASE=PX1220E-1G25 External hard drive
 
 usb:v0930p0B09*
- ID_MODEL_FROM_DATABASE=PX1396E-3T01 External hard drive
+ ID_MODEL_FROM_DATABASE=PX139xE 3.5 External HDD
 
 usb:v0930p0B1A*
  ID_MODEL_FROM_DATABASE=STOR.E ALU 2S
@@ -37199,6 +37217,9 @@ usb:v0944p0117*
 usb:v0944p012F*
  ID_MODEL_FROM_DATABASE=SQ-1
 
+usb:v0944p0154*
+ ID_MODEL_FROM_DATABASE=NTS-1 digital kit mkII
+
 usb:v0944p0203*
  ID_MODEL_FROM_DATABASE=KRONOS
 
@@ -38951,6 +38972,9 @@ usb:v0A5Cp5804*
 usb:v0A5Cp5832*
  ID_MODEL_FROM_DATABASE=BCM5880 Secure Applications Processor Smartcard reader
 
+usb:v0A5Cp5843*
+ ID_MODEL_FROM_DATABASE=BCM58200 ControlVault 3 (FingerPrint sensor + Contacted SmartCard)
+
 usb:v0A5Cp6300*
  ID_MODEL_FROM_DATABASE=Pirelli Remote NDIS Device
 
@@ -38999,6 +39023,12 @@ usb:v0A5Fp0027*
 usb:v0A5Fp0050*
  ID_MODEL_FROM_DATABASE=P120i / WM120i
 
+usb:v0A5Fp0062*
+ ID_MODEL_FROM_DATABASE=GK420d Label Printer
+
+usb:v0A5Fp0065*
+ ID_MODEL_FROM_DATABASE=ZM400 Label Printer
+
 usb:v0A5Fp0080*
  ID_MODEL_FROM_DATABASE=GK420d Label Printer
 
@@ -39014,6 +39044,9 @@ usb:v0A5Fp008B*
 usb:v0A5Fp008C*
  ID_MODEL_FROM_DATABASE=ZP 450 Printer
 
+usb:v0A5Fp00A1*
+ ID_MODEL_FROM_DATABASE=TLP2824 Plus
+
 usb:v0A5Fp00D1*
  ID_MODEL_FROM_DATABASE=GC420d Label Printer
 
@@ -39044,6 +39077,9 @@ usb:v0A66*
 usb:v0A67*
  ID_VENDOR_FROM_DATABASE=Medeli Electronics Co., Ltd
 
+usb:v0A67pFFFF*
+ ID_MODEL_FROM_DATABASE=LCS Audio
+
 usb:v0A68*
  ID_VENDOR_FROM_DATABASE=Comaide Corp.
 
@@ -39678,7 +39714,7 @@ usb:v0AC9p0001*
  ID_MODEL_FROM_DATABASE=BACKPACK  2 Cable
 
 usb:v0AC9p0010*
- ID_MODEL_FROM_DATABASE=BACKPACK
+ ID_MODEL_FROM_DATABASE=BACKPACK CD Drive
 
 usb:v0AC9p0011*
  ID_MODEL_FROM_DATABASE=Backpack 40GB Hard Drive
@@ -39689,6 +39725,9 @@ usb:v0AC9p0110*
 usb:v0AC9p0111*
  ID_MODEL_FROM_DATABASE=BackPack
 
+usb:v0AC9p10FF*
+ ID_MODEL_FROM_DATABASE=BACKPACK
+
 usb:v0AC9p1234*
  ID_MODEL_FROM_DATABASE=BACKPACK
 
@@ -39864,7 +39903,7 @@ usb:v0AECp3216*
  ID_MODEL_FROM_DATABASE=HS Card Reader
 
 usb:v0AECp3260*
- ID_MODEL_FROM_DATABASE=7-in-1 Card Reader
+ ID_MODEL_FROM_DATABASE=ND3260 7-in-1 Card Reader
 
 usb:v0AECp5010*
  ID_MODEL_FROM_DATABASE=ND5010 Card Reader
@@ -40085,6 +40124,9 @@ usb:v0B05p17A1*
 usb:v0B05p17AB*
  ID_MODEL_FROM_DATABASE=USB-N13 802.11n Network Adapter (rev. B1) [Realtek RTL8192CU]
 
+usb:v0B05p17B5*
+ ID_MODEL_FROM_DATABASE=Broadcom BCM20702A0 Bluetooth
+
 usb:v0B05p17BA*
  ID_MODEL_FROM_DATABASE=N10 Nano 802.11n Network Adapter [Realtek RTL8192CU]
 

hwdb.d/60-autosuspend-fingerprint-reader.hwdb

@@ -83,6 +83,9 @@ usb:v1C7Ap0571*
 
 # Supported by libfprint driver egismoc
 usb:v1C7Ap0582*
+usb:v1C7Ap0583*
+usb:v1C7Ap0586*
+usb:v1C7Ap0587*
 usb:v1C7Ap05A1*
  ID_AUTOSUSPEND=1
  ID_PERSIST=0
@@ -160,6 +163,7 @@ usb:v04F3p0C88*
 usb:v04F3p0C8C*
 usb:v04F3p0C8D*
 usb:v04F3p0C99*
+usb:v04F3p0C9F*
  ID_AUTOSUSPEND=1
  ID_PERSIST=0
 
@@ -181,6 +185,8 @@ usb:v10A5pA305*
 usb:v10A5pDA04*
 usb:v10A5pD805*
 usb:v10A5pD205*
+usb:v10A5p9524*
+usb:v10A5p9544*
  ID_AUTOSUSPEND=1
  ID_PERSIST=0
 
@@ -204,6 +210,7 @@ usb:v27C6p63AC*
 usb:v27C6p63BC*
 usb:v27C6p63CC*
 usb:v27C6p6496*
+usb:v27C6p650A*
 usb:v27C6p650C*
 usb:v27C6p6582*
 usb:v27C6p6584*
@@ -213,6 +220,8 @@ usb:v27C6p6594*
 usb:v27C6p659A*
 usb:v27C6p659C*
 usb:v27C6p6A94*
+usb:v27C6p6512*
+usb:v27C6p689A*
  ID_AUTOSUSPEND=1
  ID_PERSIST=0
 
@@ -223,6 +232,7 @@ usb:v298Dp1010*
 
 # Supported by libfprint driver realtek
 usb:v0BDAp5813*
+usb:v0BDAp5816*
  ID_AUTOSUSPEND=1
  ID_PERSIST=0
 
@@ -232,6 +242,7 @@ usb:v06CBp00DF*
 usb:v06CBp00F9*
 usb:v06CBp00FC*
 usb:v06CBp00C2*
+usb:v06CBp00C4*
 usb:v06CBp0100*
 usb:v06CBp00F0*
 usb:v06CBp0103*
@@ -244,6 +255,8 @@ usb:v06CBp015F*
 usb:v06CBp0104*
 usb:v06CBp0173*
 usb:v06CBp0106*
+usb:v06CBp019D*
+usb:v06CBp00C6*
  ID_AUTOSUSPEND=1
  ID_PERSIST=0
 
@@ -340,7 +353,6 @@ usb:v06CBp00A8*
 usb:v06CBp00B7*
 usb:v06CBp00BB*
 usb:v06CBp00BE*
-usb:v06CBp00C4*
 usb:v06CBp00CB*
 usb:v06CBp00C9*
 usb:v06CBp00D8*

hwdb.d/70-av-production.hwdb

@@ -71,6 +71,10 @@ usb:v0FD9p006D*
 usb:v0FD9p0080*
  ID_AV_PRODUCTION_CONTROLLER=1
 
+# Stream Deck Neo
+usb:v0FD9p009A*
+ ID_AV_PRODUCTION_CONTROLLER=1
+
 # Stream Deck Plus
 usb:v0FD9p0084*
  ID_AV_PRODUCTION_CONTROLLER=1

hwdb.d/acpi_id_registry.csv

@@ -122,4 +122,9 @@ IDEMIA,IDEM,06/26/2018
 "ILI Technology Corp",ILIT,06/20/2023
 "Hangzhou hj-micro Technology Co., Ltd",HJMC,07/31/2023
 "Vervent Audio Group",NAIM,01/04/2024
-"Das U-Boot",UBOO,02/14/2024
+"Das U-Boot",UBOO,02/14/2024
+3mdeb,DSHR,06/13/2024
+"SigmaSense, LLC",SGSN,06/13/2024
+"INIT - Innovative Informatikanwendungen GmbH",INIT,08/28/2024
+"RISC-V International",RSCV,10/23/2023
+"Ventana Micro Systems",VNTN,09/16/2024

hwdb.d/pnp_id_registry.csv

@@ -2548,4 +2548,10 @@ DemoPad Software Ltd,DEM,01/04/2024
 "Somnium Space Ltd.",SMN,02/29/2024
 "Raspberry PI",RPL,05/07/2024
 "DEIF A/S",DEF,05/10/2024
-"Moka International limited",MOK,05/23/2024
+"Moka International limited",MOK,05/23/2024
+"Shure Inc.",SHU,06/13/2024
+"Indicates an identity defined by CTS/DID Standards other than EDID",CID,06/28/2024
+"Daten Tecnologia",DTM,06/15/2024
+"LABAU Technology Corp.",LBC,08/05/2024
+"Xiaomi Corporation",XMI,08/05/2024
+"Airdrop Gaming LLC",ADG,09/03/2024

hwdb.d/usb.ids

@@ -9,8 +9,8 @@
 #	The latest version can be obtained from
 #		http://www.linux-usb.org/usb.ids
 #
-# Version: 2024.03.18
+# Version: 2024.07.04
-# Date:    2024-03-18 20:34:02
+# Date:    2024-07-04 20:34:02
 #
 
 # Vendors, devices and interfaces. Please keep sorted.
@@ -2400,6 +2400,7 @@
 	02e3  Xbox One Elite Controller
 	02e6  Xbox Wireless Adapter for Windows
 	02ea  Xbox One Controller
+	02f3  Xbox One Chatpad
 	02fd  Xbox One S Controller [Bluetooth]
 	02fe  Xbox Wireless Adapter for Windows
 	0306  Surface Pro 7 SD Card Reader
@@ -4992,7 +4993,7 @@
 	0a28  INDI AV-IN Device
 	1301  Network Controller
 	1302  i3 Gateway
-	1303  3 Micro Module
+	1303  i3 Micro Module
 	1304  i3 Module
 	1305  i3 Multi Sensing Module
 04c1  U.S. Robotics (3Com)
@@ -6433,6 +6434,7 @@
 	2060  PT-E550W P-touch Label Printer
 	2061  PT-P700 P-touch Label Printer
 	2064  PT-P700 P-touch Label Printer RemovableDisk
+	2065  PT-P750W P-Touch Label Writer
 	2074  PT-D600 P-touch Label Printer
 	209b  QL-800 Label Printer
 	209c  QL-810W Label Printer
@@ -7439,6 +7441,7 @@
 	03dd  PTH-460 [Intuos Pro BT (S)] tablet
 	03ec  DTH134 [DTH134] touchscreen
 	03ed  DTC121 [DTC121] touchscreen
+	03f0  DTH135 [Movink 13]
 	0400  PenPartner 4x5
 	4001  TPC4001
 	4004  TPC4004
@@ -9049,6 +9052,7 @@
 	0752  micros Reader
 	0760  USB 2.0 Card Reader/Writer
 	0761  Genesys Mass Storage Device
+	0769  SPR2801S [Lightspeeur 2801]
 	0780  USBFS DFU Adapter
 	07a0  Pen Flash
 	0880  Wasp (SL-6612)
@@ -10898,7 +10902,7 @@
 	0056  Agfa AP1100 Photo Printer
 	005d  Mobile Mass Storage
 	005f  Laser Pro LL [MFPrinter]
-	0062  XG-76NA 802.11bg
+	0062  XG-76NA / XG-760N 802.11b/g Wireless adapter
 	0078  Laser Pro Monochrome MFP
 079d  Alfadata Computer Corp.
 	0201  GamePort Adapter
@@ -11169,6 +11173,7 @@
 	1228  MPEG-2 Capture Device (M038)
 	1830  AVerTV Volar Video Capture (H830)
 	1871  TD310 DVB-T/T2/C dongle
+	2553  Live Gamer Ultra 2.1
 	3835  AVerTV Volar Green HD (A835B)
 	850a  AverTV Volar Black HD (A850)
 	850b  AverTV Red HD+ (A850T)
@@ -11180,6 +11185,7 @@
 	b300  A300 DVB-T TV receiver
 	b800  MR800 FM Radio
 	c039  DVD EZMaker 7
+	d553  Live Gamer Ultra Pro-RGB
 	e880  MPEG-2 Capture Device (E880)
 	e882  MPEG-2 Capture Device (E882)
 07cb  Kingmax Technology, Inc.
@@ -12286,7 +12292,7 @@
 	0a0b  WLU5053 802.11abgn Wireless Module [Broadcom BCM43236B]
 	0a13  AX88179 Gigabit Ethernet [Toshiba]
 	0b05  PX1220E-1G25 External hard drive
-	0b09  PX1396E-3T01 External hard drive
+	0b09  PX139xE 3.5 External HDD
 	0b1a  STOR.E ALU 2S
 	1300  Wireless Broadband (CDMA EV-DO) SM-Bus Minicard Status Port
 	1301  Wireless Broadband (CDMA EV-DO) Minicard Status Port
@@ -12420,6 +12426,7 @@
 	010f  nanoKONTROL studio controller
 	0117  nanoKONTROL2 MIDI Controller
 	012f  SQ-1
+	0154  NTS-1 digital kit mkII
 	0203  KRONOS
 	0f03  K-Series K61P MIDI studio controller
 0945  Pasco Scientific
@@ -13004,6 +13011,7 @@
 	5803  BCM5880 Secure Applications Processor with secure keyboard
 	5804  BCM5880 Secure Applications Processor with fingerprint swipe sensor
 	5832  BCM5880 Secure Applications Processor Smartcard reader
+	5843  BCM58200 ControlVault 3 (FingerPrint sensor + Contacted SmartCard)
 	6300  Pirelli Remote NDIS Device
 	6410  BCM20703A1 Bluetooth 4.1 + LE
 	bd11  BCM4320 802.11bg Wireless Adapter
@@ -13020,11 +13028,14 @@
 	0009  LP2844 Printer
 	0027  ZTC LP2844-Z-200dpi
 	0050  P120i / WM120i
+	0062  GK420d Label Printer
+	0065  ZM400 Label Printer
 	0080  GK420d Label Printer
 	0081  GK420t Label Printer
 	0084  GX420d Desktop Label Printer
 	008b  HC100 wristbands Printer
 	008c  ZP 450 Printer
+	00a1  TLP2824 Plus
 	00d1  GC420d Label Printer
 	0110  ZD500 Desktop Label Printer
 	011c  ZD410 Direct Thermal Label Printer
@@ -13035,6 +13046,7 @@
 	0010  MPMan MP-F40 MP3 Player
 0a66  ClearCube Technology
 0a67  Medeli Electronics Co., Ltd
+	ffff  LCS Audio
 0a68  Comaide Corp.
 0a69  Chroma ate, Inc.
 0a6b  Green House Co., Ltd
@@ -13246,10 +13258,11 @@
 0ac9  Micro Solutions, Inc.
 	0000  Backpack CD-ReWriter
 	0001  BACKPACK  2 Cable
-	0010  BACKPACK
+	0010  BACKPACK CD Drive
 	0011  Backpack 40GB Hard Drive
 	0110  BACKPACK
 	0111  BackPack
+	10ff  BACKPACK
 	1234  BACKPACK
 0aca  OPEN Networks Ltd
 	1060  OPEN NT1 Plus II
@@ -13308,7 +13321,7 @@
 	3102  MemoryStick Card Reader
 	3201  MMC/SD+MemoryStick Card Reader
 	3216  HS Card Reader
-	3260  7-in-1 Card Reader
+	3260  ND3260 7-in-1 Card Reader
 	5010  ND5010 Card Reader
 0af0  Option
 	5000  UMTS Card
@@ -13382,6 +13395,7 @@
 	17a0  Xonar U3 sound card
 	17a1  Eee Note EA800 (mass storage mode)
 	17ab  USB-N13 802.11n Network Adapter (rev. B1) [Realtek RTL8192CU]
+	17b5  Broadcom BCM20702A0 Bluetooth
 	17ba  N10 Nano 802.11n Network Adapter [Realtek RTL8192CU]
 	17c2  ROG Spitfire
 	17c7  WL-330NUL

man/bootctl.xml

@@ -526,6 +526,31 @@
         <xi:include href="version-info.xml" xpointer="v253"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--secure-boot-auto-enroll=yes|no</option></term>
+        <term><option>--private-key=<replaceable>PATH/URI</replaceable></option></term>
+        <term><option>--private-key-source=<replaceable>TYPE[:NAME]</replaceable></option></term>
+        <term><option>--certificate=<replaceable>PATH</replaceable></option></term>
+
+        <listitem><para>Configure the ESP for secure boot auto-enrollment when invoking the
+        <command>install</command> command. Takes a boolean argument. Disabled by default. Enabling this
+        option will make <command>bootctl</command> populate the ESP with signed <literal>PK</literal>,
+        <literal>KEK</literal> and <literal>db</literal> signature databases, each containing the given
+        certificate in <literal>DER</literal> format as their only entry. These secure boot signature
+        databases will be picked up and enrolled by <command>systemd-boot</command> if secure boot is in
+        setup mode and secure boot auto-enrollment is enabled.</para>
+
+        <para>When specifying this option, a certificate and private key have to be provided as well using
+        the <option>--certificate=</option> and <option>--private-key=</option> options. The
+        <option>--certificate=</option> option takes a path to a PEM encoded X.509 certificate. The
+        <option>--private-key=</option> option can take a path or a URI that will be passed to the OpenSSL
+        engine or provider, as specified by <option>--private-key-source=</option> as a
+        <literal>type:name</literal> tuple, such as <literal>engine:pkcs11</literal>. The specified OpenSSL
+        signing engine or provider will be used to sign the EFI signature lists.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
       <xi:include href="standard-options.xml" xpointer="no-pager"/>
       <xi:include href="standard-options.xml" xpointer="json" />
       <xi:include href="standard-options.xml" xpointer="help"/>

man/busctl.xml

@@ -417,7 +417,8 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--num-matches=<replaceable>NUMBER</replaceable></option></term>
+        <term><option>--limit-messages=<replaceable>NUMBER</replaceable></option></term>
+        <term><option>-N <replaceable>NUMBER</replaceable></option></term>
 
         <listitem>
           <para>When used with the <command>monitor</command> command, if enabled will make

man/capsule@.service.xml

@@ -106,17 +106,17 @@
 
   <refsect1>
     <title>See Also</title>
-    <para>
+    <para><simplelist type="inline">
-      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-      <citerefentry><refentrytitle>user@.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+      <member><citerefentry><refentrytitle>user@.service</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
-      <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+      <member><citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
-      <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+      <member><citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
-      <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+      <member><citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
-      <citerefentry><refentrytitle>systemd.special</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
+      <member><citerefentry><refentrytitle>systemd.special</refentrytitle><manvolnum>7</manvolnum></citerefentry></member>
-      <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+      <member><citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-      <citerefentry><refentrytitle>systemd-run</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+      <member><citerefentry><refentrytitle>systemd-run</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-      <citerefentry><refentrytitle>busctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+      <member><citerefentry><refentrytitle>busctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-      <citerefentry project='man-pages'><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+      <member><citerefentry project='man-pages'><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
-    </para>
+    </simplelist></para>
   </refsect1>
 </refentry>

man/coredump.conf.xml

@@ -110,14 +110,14 @@
       </varlistentry>
 
       <varlistentry>
-        <term><varname>AccessContainer=</varname></term>
+        <term><varname>EnterNamespace=</varname></term>
 
         <listitem><para>Controls whether <command>systemd-coredump</command> will attempt to use the mount tree of
-        a process that crashed within a container. Access to the container's filesystem might be necessary to generate
+        a process that crashed in PID namespace. Access to the namespace's mount tree might be necessary to generate
         a fully symbolized backtrace. If set to <literal>yes</literal>, then <command>systemd-coredump</command> will
         obtain the mount tree from corresponding mount namespace and will try to generate the stack trace using the
-        binary and libraries from the mount namespace. Note that the coredump of the containerized process might
+        binary and libraries from the mount namespace. Note that the coredump of the namespaced process might
-        still be saved in <filename>/var/lib/systemd/coredump/</filename> even if <varname>AccessContainer=</varname>
+        still be saved in <filename>/var/lib/systemd/coredump/</filename> even if <varname>EnterNamespace=</varname>
         is set to <literal>no</literal>. Defaults to <literal>no</literal>.</para>
 
         <xi:include href="version-info.xml" xpointer="v257"/>

man/crypttab.xml

@@ -950,7 +950,7 @@
         for supported formats). Defaults to 30s. Once the specified timeout elapsed authentication via
         password is attempted. Note that this timeout applies to waiting for the security device to show up —
         it does not apply to the PIN prompt for the device (should one be needed) or similar. Pass 0 to turn
-        off the time-out and wait forever.</para>
+        off the timeout and wait forever.</para>
 
         <xi:include href="version-info.xml" xpointer="v250"/></listitem>
       </varlistentry>

man/hwdb.xml

@@ -145,10 +145,8 @@ PROPERTY_WITH_SPACES=some string</programlisting>
 
   <refsect1>
     <title>See Also</title>
-    <para>
+    <para><simplelist type="inline">
-      <citerefentry>
+      <member><citerefentry><refentrytitle>systemd-hwdb</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
-        <refentrytitle>systemd-hwdb</refentrytitle><manvolnum>8</manvolnum>
+    </simplelist></para>
-      </citerefentry>
-    </para>
   </refsect1>
 </refentry>

man/libsystemd.xml

@@ -35,6 +35,7 @@
 #include <systemd/sd-login.h>
 #include <systemd/sd-messages.h>
 #include <systemd/sd-path.h>
+#include <systemd/sd-varlink.h>
     </programlisting>
 
     <cmdsynopsis>
@@ -61,8 +62,9 @@
     <citerefentry><refentrytitle>sd-id128</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
     <citerefentry><refentrytitle>sd-journal</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
     <citerefentry><refentrytitle>sd-json</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
-    and
     <citerefentry><refentrytitle>sd-login</refentrytitle><manvolnum>3</manvolnum></citerefentry>
+    and
+    <citerefentry><refentrytitle>sd-varlink</refentrytitle><manvolnum>3</manvolnum></citerefentry>
     for information about different parts of the library interface.</para>
   </refsect1>
 

man/networkctl.xml

@@ -413,14 +413,23 @@ s - Service VLAN, m - Two-port MAC Relay (TPMR)
         <term>
           <command>reload</command>
         </term>
-        <listitem><para>Reload <filename>.netdev</filename> and <filename>.network</filename> files.
+        <listitem>
-        If a new <filename>.netdev</filename> file is found, then the corresponding netdev is created.
+          <para>Reload <filename>.netdev</filename> and <filename>.network</filename> files.</para>
-        Note that even if an existing <filename>.netdev</filename> is modified or removed,
-        <command>systemd-networkd</command> does not update or remove the netdev.
-        If a new, modified or removed <filename>.network</filename> file is found, then all interfaces
-        which match the file are reconfigured.</para>
 
-        <xi:include href="version-info.xml" xpointer="v244"/></listitem>
+          <para>If a new or modified <filename>.netdev</filename> file is found, then the corresponding
+          netdev is created or updated, respectively. Note, if the corresponding interface already exists,
+          then some of new settings may not be applied. E.g., VLAN ID cannot be changed after the interface
+          was created, so changing [VLAN] <varname>Id=</varname> will not take effect if the matching VLAN
+          interface already exists. To apply such settings, the interfaces need to be removed manually before
+          reload. Also note that even if a <filename>.netdev</filename> file is removed,
+          <command>systemd-networkd</command> does not remove the existing netdev corresponding to the file.
+          </para>
+
+          <para>If a new, modified, or removed <filename>.network</filename> file is found, then all
+          interfaces that matched the file are reconfigured.</para>
+
+          <xi:include href="version-info.xml" xpointer="v244"/>
+        </listitem>
       </varlistentry>
 
       <varlistentry>

man/org.freedesktop.LogControl1.xml

@@ -89,7 +89,9 @@ node /org/freedesktop/LogControl1 {
       <citerefentry project="man-pages"><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry> call).
       </para>
 
-      <para>Those two properties are writable, so they may be set by sufficiently privileged users.</para>
+      <caution><title>Write Access</title><para>The <varname>LogLevel</varname> and
+      <varname>LogTarget</varname> properties are supposed to be writable. Care should be taken to ensure
+      that only appropriately privileged clients can modify them.</para></caution>
 
       <para><varname>SyslogIdentifier</varname> is a read-only property that shows the "syslog identifier".
       It is a short string that identifies the program that is the source of log messages that is passed to
@@ -127,6 +129,11 @@ node /org/freedesktop/LogControl1 {
       <para>This creates a simple server on the bus. It implements the LogControl1 interface by providing
       the required properties and allowing to set the writable ones. It logs at the configured log level using
       <citerefentry><refentrytitle>sd_journal_print</refentrytitle><manvolnum>3</manvolnum></citerefentry>.</para>
+
+      <para>Note that when porting this example to other D-Bus libraries it might be necessary to add manual
+      client privilege checks, as they typically do not default to the restrictive defaults of sd-bus, where
+      unprivileged access to properties is controlled via the <constant>SD_BUS_VTABLE_UNPRIVILEGED</constant>
+      flag that is opt-in rather than opt-out.</para>
     </example>
   </refsect1>
 

man/org.freedesktop.hostname1.xml

@@ -427,8 +427,6 @@ node /org/freedesktop/hostname1 {
     name.</para>
   </refsect1>
 
-  <xi:include href="org.freedesktop.locale1.xml" xpointer="versioning"/>
-
   <refsect1>
     <title>Examples</title>
 
@@ -442,12 +440,7 @@ node /org/freedesktop/hostname1 {
     </example>
   </refsect1>
 
-  <refsect1>
+  <xi:include href="org.freedesktop.locale1.xml" xpointer="versioning"/>
-    <title>See Also</title>
-
-    <para>David Zeuthen's original Fedora
-    <ulink url="https://fedoraproject.org/wiki/Features/BetterHostname">Feature page about xdg-hostname</ulink></para>
-  </refsect1>
 
   <refsect1>
     <title>History</title>
@@ -462,4 +455,16 @@ node /org/freedesktop/hostname1 {
       <varname>VSockCID</varname> were added in version 256.</para>
     </refsect2>
   </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd-hostnamed.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>hostnamectl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member>David Zeuthen's original Fedora
+      <ulink url="https://fedoraproject.org/wiki/Features/BetterHostname">Feature page about xdg-hostname</ulink></member>
+    </simplelist></para>
+  </refsect1>
 </refentry>

man/org.freedesktop.import1.xml

@@ -453,6 +453,7 @@ node /org/freedesktop/import1/transfer/_1 {
   </refsect1>
 
   <xi:include href="org.freedesktop.locale1.xml" xpointer="versioning"/>
+
   <refsect1>
     <title>History</title>
     <refsect2>
@@ -469,4 +470,13 @@ node /org/freedesktop/import1/transfer/_1 {
     </refsect2>
   </refsect1>
 
+  <refsect1>
+    <title>See Also</title>
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd-importd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>importctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+    </simplelist></para>
+  </refsect1>
+
 </refentry>

man/org.freedesktop.locale1.xml

@@ -185,4 +185,14 @@ $ gdbus introspect --system \
     <para>These D-Bus interfaces follow <ulink url="https://0pointer.de/blog/projects/versioning-dbus.html">
     the usual interface versioning guidelines</ulink>.</para>
   </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd-localed.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>localectl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+    </simplelist></para>
+  </refsect1>
+
 </refentry>

man/org.freedesktop.login1.xml

@@ -216,6 +216,7 @@ node /org/freedesktop/login1 {
       readonly t IdleSinceHint = ...;
       readonly t IdleSinceHintMonotonic = ...;
       readonly s BlockInhibited = '...';
+      readonly s BlockWeakInhibited = '...';
       readonly s DelayInhibited = '...';
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly t InhibitDelayMaxUSec = ...;
@@ -488,6 +489,8 @@ node /org/freedesktop/login1 {
 
     <variablelist class="dbus-property" generated="True" extra-ref="BlockInhibited"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="BlockWeakInhibited"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="DelayInhibited"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="InhibitDelayMaxUSec"/>
@@ -672,16 +675,18 @@ node /org/freedesktop/login1 {
 #define SD_LOGIND_SKIP_INHIBITORS                (UINT64_C(1) &lt;&lt; 4)
       </programlisting>
       <para>When the <varname>flags</varname> is 0 then these methods behave just like the versions without
-      flags. Since systemd version 256 <constant>SD_LOGIND_ROOT_CHECK_INHIBITORS</constant> (0x01) is deprecated,
+      flags. Since systemd version 257 active inhibitors are honoured by default for privileged users too.
-      and active inhibitors are always honoured by default for privileged users too, and a new flag
+      <constant>SD_LOGIND_ROOT_CHECK_INHIBITORS</constant> (0x01) now only applies to weak inhibitors, to
-      <constant>SD_LOGIND_SKIP_INHIBITORS</constant> (0x04) can be specified to bypass inhibitors. When
+      request that they honoured for privileged users too, since they ignore them by default. A new flag
-      <constant>SD_LOGIND_KEXEC_REBOOT</constant> (0x02) is set, then <function>RebootWithFlags()</function>
+      <constant>SD_LOGIND_SKIP_INHIBITORS</constant> (0x04) can be specified to bypass all types of
-      performs a kexec reboot if kexec kernel is loaded. When <constant>SD_LOGIND_SOFT_REBOOT</constant>
+      inhibitors. When <constant>SD_LOGIND_KEXEC_REBOOT</constant> (0x02) is set, then
-      (0x04) is set, or <constant>SD_LOGIND_SOFT_REBOOT_IF_NEXTROOT_SET_UP</constant> (0x08) is set and a
+      <function>RebootWithFlags()</function> performs a kexec reboot if kexec kernel is loaded. When
-      new root file system has been set up on <literal>/run/nextroot/</literal>, then
+      <constant>SD_LOGIND_SOFT_REBOOT</constant> (0x04) is set, or
-      <function>RebootWithFlags()</function> performs a userspace reboot only.
+      <constant>SD_LOGIND_SOFT_REBOOT_IF_NEXTROOT_SET_UP</constant> (0x08) is set and a new root file system
-      <constant>SD_LOGIND_SOFT_REBOOT_IF_NEXTROOT_SET_UP</constant> and
+      has been set up on <literal>/run/nextroot/</literal>, then <function>RebootWithFlags()</function>
-      <constant>SD_LOGIND_KEXEC_REBOOT</constant> can be combined, with soft-reboot having precedence.</para>
+      performs a userspace reboot only. <constant>SD_LOGIND_SOFT_REBOOT_IF_NEXTROOT_SET_UP</constant> and
+      <constant>SD_LOGIND_KEXEC_REBOOT</constant> can be combined, with soft-reboot having precedence.
+      </para>
 
       <para><function>SetRebootParameter()</function> sets a parameter for a subsequent reboot operation.
       See the description of <command>reboot</command> in
@@ -738,11 +743,10 @@ node /org/freedesktop/login1 {
       should be a short human readable string identifying the reason why the lock is taken. Finally,
       <varname>mode</varname> is either <literal>block</literal> or <literal>delay</literal> which encodes
       whether the inhibit shall be consider mandatory or whether it should just delay the operation to a
-      certain maximum time, while the <literal>block-weak</literal> and <literal>delay-weak</literal>
+      certain maximum time, while the <literal>block-weak</literal> and variants will create an inhibitor
-      variants will create an inhibitor that is automatically ignored in some circumstances. The method
+      that is automatically ignored in some circumstances. The method returns a file descriptor. The lock is
-      returns a file descriptor. The lock is released the moment this file descriptor and all its duplicates
+      released the moment this file descriptor and all its duplicates are closed. For more information on
-      are closed. For more information on the inhibition logic see
+      the inhibition logic see <ulink url="https://systemd.io/INHIBITOR_LOCKS">Inhibitor Locks</ulink>.
-      <ulink url="https://systemd.io/INHIBITOR_LOCKS">Inhibitor Locks</ulink>.
       </para>
     </refsect2>
 
@@ -804,9 +808,10 @@ node /org/freedesktop/login1 {
       timestamps of the last change of the idle hint boolean, in <constant>CLOCK_REALTIME</constant> and
       <constant>CLOCK_MONOTONIC</constant> timestamps, respectively, in microseconds since the epoch.</para>
 
-      <para>The <varname>BlockInhibited</varname> and <varname>DelayInhibited</varname> properties encode
+      <para>The <varname>BlockInhibited</varname>, <varname>BlockWeakInhibited</varname>, and
-      the currently active locks of the respective modes. They are colon separated lists of
+      <varname>DelayInhibited</varname> properties encode the currently active locks of the respective
-      <literal>shutdown</literal>, <literal>sleep</literal>, and <literal>idle</literal> (see above).</para>
+      modes. They are colon separated lists of <literal>shutdown</literal>, <literal>sleep</literal>, and
+      <literal>idle</literal> (see above).</para>
 
       <para><varname>NCurrentSessions</varname> and <varname>NCurrentInhibitors</varname> contain the number
       of currently registered sessions and inhibitors.</para>
@@ -1245,6 +1250,10 @@ node /org/freedesktop/login1/session/1 {
       readonly b IdleHint = ...;
       readonly t IdleSinceHint = ...;
       readonly t IdleSinceHintMonotonic = ...;
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly b CanIdle = ...;
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly b CanLock = ...;
       readonly b LockedHint = ...;
   };
   interface org.freedesktop.DBus.Peer { ... };
@@ -1349,6 +1358,10 @@ node /org/freedesktop/login1/session/1 {
 
     <variablelist class="dbus-property" generated="True" extra-ref="IdleSinceHintMonotonic"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="CanIdle"/>
+
+    <variablelist class="dbus-property" generated="True" extra-ref="CanLock"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="LockedHint"/>
 
     <!--End of Autogenerated section-->
@@ -1538,6 +1551,10 @@ node /org/freedesktop/login1/session/1 {
 
       <para><varname>LockedHint</varname> shows the locked hint state of this session, as set by the
       <function>SetLockedHint()</function> method described above.</para>
+
+      <para><varname>CanIdle</varname> indicates whether the session supports the idle hint
+      concept. Similarly, <varname>CanLock</varname> indicates whether the session supports the screen lock
+      concept.</para>
     </refsect2>
   </refsect1>
 
@@ -1619,10 +1636,10 @@ node /org/freedesktop/login1/session/1 {
       <function>CanSleep()</function>,
       <varname>SleepOperation</varname>, and
       <function>ListSessionsEx()</function> were added in version 256.</para>
-      <para><varname>HandleSecureAttentionKey</varname>,
+      <para><varname>HandleSecureAttentionKey</varname>, <function>SecureAttentionKey()</function>,
-      <function>SecureAttentionKey()</function>,
+      <varname>PreparingForShutdownWithMetadata</varname>, <varname>DesignatedMaintenanceTime</varname>,
-      <varname>PreparingForShutdownWithMetadata</varname>, and
+      <varname>CanIdle</varname>, <varname>CanLock</varname>,
-      <varname>DesignatedMaintenanceTime</varname> were added in version 257.</para>
+      and <varname>BlockWeakInhibited</varname> were added in version 257.</para>
     </refsect2>
     <refsect2>
       <title>Session Objects</title>
@@ -1631,4 +1648,13 @@ node /org/freedesktop/login1/session/1 {
       <para><function>SetClass()</function> was added in version 256.</para>
     </refsect2>
   </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd-logind.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>loginctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+    </simplelist></para>
+  </refsect1>
 </refentry>

man/org.freedesktop.machine1.xml

@@ -719,4 +719,13 @@ $ gdbus introspect --system \
       and <varname>SSHPrivateKeyPath</varname> were added in version 256.</para>
     </refsect2>
   </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd-machined.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+    </simplelist></para>
+  </refsect1>
 </refentry>

man/org.freedesktop.network1.xml

@@ -602,4 +602,13 @@ $ gdbus introspect --system \
       <para><varname>NamespaceNSID</varname> was added in version 256.</para>
     </refsect2>
   </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>networkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+    </simplelist></para>
+  </refsect1>
 </refentry>

man/org.freedesktop.oom1.xml

@@ -103,4 +103,14 @@ node /org/freedesktop/oom1 {
       <para><function>Killed()</function> was added in version 252.</para>
     </refsect2>
   </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd-oomd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>oomctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+    </simplelist></para>
+  </refsect1>
+
 </refentry>

man/org.freedesktop.portable1.xml

@@ -591,4 +591,13 @@ node /org/freedesktop/portable1 {
       <para><function>ReattachWithExtensions()</function> was added in version 254.</para>
     </refsect2>
   </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd-portabled.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>portablectl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+    </simplelist></para>
+  </refsect1>
 </refentry>

man/org.freedesktop.resolve1.xml

@@ -935,4 +935,13 @@ $ gdbus introspect --system \
   </refsect1>
 
   <xi:include href="org.freedesktop.locale1.xml" xpointer="versioning"/>
+
+  <refsect1>
+    <title>See Also</title>
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>resolvectl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+    </simplelist></para>
+  </refsect1>
 </refentry>

man/org.freedesktop.systemd1.xml

@@ -3251,6 +3251,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b ProtectControlGroups = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly s ProtectControlGroupsEx = '...';
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateNetwork = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateUsers = ...;
@@ -3261,6 +3263,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateIPC = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly s PrivatePIDs = '...';
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s ProtectHome = '...';
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s ProtectSystem = '...';
@@ -3868,8 +3872,6 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
 
     <!--property ProtectKernelLogs is not documented!-->
 
-    <!--property ProtectControlGroups is not documented!-->
-
     <!--property PrivateNetwork is not documented!-->
 
     <!--property PrivateUsers is not documented!-->
@@ -4572,6 +4574,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
 
     <variablelist class="dbus-property" generated="True" extra-ref="ProtectControlGroups"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="ProtectControlGroupsEx"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateNetwork"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateUsers"/>
@@ -4582,6 +4586,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
 
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateIPC"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="PrivatePIDs"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="ProtectHome"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="ProtectSystem"/>
@@ -4845,8 +4851,12 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
       <varname>CacheDirectorySymlink</varname> and  <varname>LogsDirectorySymlink</varname> respectively
       implement the destination parameter of the unit files settings <varname>RuntimeDirectory</varname>,
       <varname>StateDirectory</varname>, <varname>CacheDirectory</varname> and <varname>LogsDirectory</varname>,
-      which will create a symlink of the given name to the respective directory. The messages take an unused
+      which will create a symlink of the given name to the respective directory. The messages take a
-      <varname>flags</varname> parameter, reserved for future backward-compatible changes.</para>
+      <varname>flags</varname> parameter that make the directory read only:</para>
+
+      <programlisting>
+#define SD_EXEC_DIRECTORY_READ_ONLY            (UINT64_C(1) &lt;&lt; 0)
+      </programlisting>
 
       <para><varname>ExtraFileDescriptorNames</varname> contains file descriptor names passed to the service via
       the <varname>ExtraFileDescriptors</varname> property in the <function>StartTransientUnit()</function>
@@ -4858,6 +4868,17 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
       unit file setting <varname>ManagedOOMMemoryPressureDurationSec=</varname> listed in
       <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
       Note the time unit is expressed in <literal>μs</literal>.</para>
+
+      <para><varname>ProtectControlGroupsEx</varname> implement the destination parameter of the
+      unit file setting <varname>ProtectControlGroups=</varname> listed in
+      <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+      Unlike boolean <varname>ProtectControlGroups</varname>, <varname>ProtectControlGroupsEx</varname>
+      is a string type.</para>
+
+      <para><varname>PrivatePIDs</varname> implements the destination parameter of the
+      unit file setting <varname>PrivatePIDs=</varname> listed in
+      <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+      Note <varname>PrivatePIDs</varname> is a string type to allow adding more values in the future.</para>
     </refsect2>
   </refsect1>
 
@@ -5415,6 +5436,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b ProtectControlGroups = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly s ProtectControlGroupsEx = '...';
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateNetwork = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateUsers = ...;
@@ -5425,6 +5448,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateIPC = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly s PrivatePIDs = '...';
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s ProtectHome = '...';
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s ProtectSystem = '...';
@@ -6044,8 +6069,6 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket {
 
     <!--property ProtectKernelLogs is not documented!-->
 
-    <!--property ProtectControlGroups is not documented!-->
-
     <!--property PrivateNetwork is not documented!-->
 
     <!--property PrivateUsers is not documented!-->
@@ -6720,6 +6743,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket {
 
     <variablelist class="dbus-property" generated="True" extra-ref="ProtectControlGroups"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="ProtectControlGroupsEx"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateNetwork"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateUsers"/>
@@ -6730,6 +6755,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket {
 
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateIPC"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="PrivatePIDs"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="ProtectHome"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="ProtectSystem"/>
@@ -7416,6 +7443,8 @@ node /org/freedesktop/systemd1/unit/home_2emount {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b ProtectControlGroups = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly s ProtectControlGroupsEx = '...';
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateNetwork = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateUsers = ...;
@@ -7426,6 +7455,8 @@ node /org/freedesktop/systemd1/unit/home_2emount {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateIPC = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly s PrivatePIDs = '...';
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s ProtectHome = '...';
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s ProtectSystem = '...';
@@ -7971,8 +8002,6 @@ node /org/freedesktop/systemd1/unit/home_2emount {
 
     <!--property ProtectKernelLogs is not documented!-->
 
-    <!--property ProtectControlGroups is not documented!-->
-
     <!--property PrivateNetwork is not documented!-->
 
     <!--property PrivateUsers is not documented!-->
@@ -8559,6 +8588,8 @@ node /org/freedesktop/systemd1/unit/home_2emount {
 
     <variablelist class="dbus-property" generated="True" extra-ref="ProtectControlGroups"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="ProtectControlGroupsEx"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateNetwork"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateUsers"/>
@@ -8569,6 +8600,8 @@ node /org/freedesktop/systemd1/unit/home_2emount {
 
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateIPC"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="PrivatePIDs"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="ProtectHome"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="ProtectSystem"/>
@@ -9384,6 +9417,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b ProtectControlGroups = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly s ProtectControlGroupsEx = '...';
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateNetwork = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateUsers = ...;
@@ -9394,6 +9429,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateIPC = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly s PrivatePIDs = '...';
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s ProtectHome = '...';
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s ProtectSystem = '...';
@@ -9925,8 +9962,6 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap {
 
     <!--property ProtectKernelLogs is not documented!-->
 
-    <!--property ProtectControlGroups is not documented!-->
-
     <!--property PrivateNetwork is not documented!-->
 
     <!--property PrivateUsers is not documented!-->
@@ -10499,6 +10534,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap {
 
     <variablelist class="dbus-property" generated="True" extra-ref="ProtectControlGroups"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="ProtectControlGroupsEx"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateNetwork"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateUsers"/>
@@ -10509,6 +10546,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap {
 
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateIPC"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="PrivatePIDs"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="ProtectHome"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="ProtectSystem"/>
@@ -12262,8 +12301,10 @@ $ gdbus introspect --system --dest org.freedesktop.systemd1 \
       <varname>ImportCredentialEx</varname>,
       <varname>ExtraFileDescriptorNames</varname>,
       <varname>ManagedOOMMemoryPressureDurationUSec</varname>,
-      <varname>BindLogSockets</varname>, and
+      <varname>BindLogSockets</varname>,
-      <varname>PrivateUsersEx</varname> were added in version 257.</para>
+      <varname>ProtectControlGroupsEx</varname>,
+      <varname>PrivateUsersEx</varname>, and
+      <varname>PrivatePIDs</varname> were added in version 257.</para>
     </refsect2>
     <refsect2>
       <title>Socket Unit Objects</title>
@@ -12302,8 +12343,11 @@ $ gdbus introspect --system --dest org.freedesktop.systemd1 \
       <varname>PassFileDescriptorsToExec</varname> were added in version 256.</para>
       <para><varname>PrivateTmpEx</varname>,
       <varname>ImportCredentialEx</varname>,
-      <varname>BindLogSockets</varname>, and
+      <varname>BindLogSockets</varname>,
-      <varname>PrivateUsersEx</varname> were added in version 257.</para>
+      <varname>PrivateUsersEx</varname>,
+      <varname>ManagedOOMMemoryPressureDurationUSec</varname>,
+      <varname>ProtectControlGroupsEx</varname>, and
+      <varname>PrivatePIDs</varname> were added in version 257.</para>
     </refsect2>
     <refsect2>
       <title>Mount Unit Objects</title>
@@ -12339,8 +12383,11 @@ $ gdbus introspect --system --dest org.freedesktop.systemd1 \
       <varname>MemoryZSwapWriteback</varname> were added in version 256.</para>
       <para><varname>PrivateTmpEx</varname>,
       <varname>ImportCredentialEx</varname>,
-      <varname>BindLogSockets</varname>, and
+      <varname>BindLogSockets</varname>,
-      <varname>PrivateUsersEx</varname> were added in version 257.</para>
+      <varname>PrivateUsersEx</varname>,
+      <varname>ManagedOOMMemoryPressureDurationUSec</varname>,
+      <varname>ProtectControlGroupsEx</varname>, and
+      <varname>PrivatePIDs</varname> were added in version 257.</para>
     </refsect2>
     <refsect2>
       <title>Swap Unit Objects</title>
@@ -12376,8 +12423,11 @@ $ gdbus introspect --system --dest org.freedesktop.systemd1 \
       <varname>MemoryZSwapWriteback</varname> were added in version 256.</para>
       <para><varname>PrivateTmpEx</varname>,
       <varname>ImportCredentialEx</varname>,
-      <varname>BindLogSockets</varname>, and
+      <varname>BindLogSockets</varname>,
-      <varname>PrivateUsersEx</varname> were added in version 257.</para>
+      <varname>PrivateUsersEx</varname>,
+      <varname>ManagedOOMMemoryPressureDurationUSec</varname>,
+      <varname>ProtectControlGroupsEx</varname>, and
+      <varname>PrivatePIDs</varname> were added in version 257.</para>
     </refsect2>
     <refsect2>
       <title>Slice Unit Objects</title>
@@ -12439,4 +12489,13 @@ $ gdbus introspect --system --dest org.freedesktop.systemd1 \
       <para><varname>DeferReactivation</varname> was added in version 257.</para>
     </refsect2>
   </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+    </simplelist></para>
+  </refsect1>
+
 </refentry>

man/org.freedesktop.sysupdate1.xml

@@ -3,7 +3,7 @@
   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" >
 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
 
-<refentry id="org.freedesktop.sysupdate1" conditional='ENABLE_SYSUPDATE'
+<refentry id="org.freedesktop.sysupdate1" conditional='ENABLE_SYSUPDATED'
     xmlns:xi="http://www.w3.org/2001/XInclude">
   <refentryinfo>
     <title>org.freedesktop.sysupdate1</title>
@@ -27,6 +27,9 @@
     <citerefentry><refentrytitle>systemd-sysupdated.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
     is a system service that allows unprivileged clients to update the system. This page describes the D-Bus
     interface.</para>
+
+    <para><emphasis>WARNING!</emphasis> This API is currently <emphasis>unstable</emphasis> and is thus subject
+    to breaking changes between versions of systemd.</para>
   </refsect1>
 
   <refsect1>
@@ -122,9 +125,18 @@ node /org/freedesktop/sysupdate1/target/host {
              out s new_version,
              out t job_id,
              out o job_path);
-      Vacuum(out u count);
+      Vacuum(out u instances,
+             out u disabled_transfers);
       GetAppStream(out as appstream);
       GetVersion(out s version);
+      ListFeatures(in  t flags,
+                   out as features);
+      DescribeFeature(in  s feature,
+                      in  t flags,
+                      out s json);
+      SetFeatureEnabled(in  s feature,
+                        in  i enabled,
+                        in  t flags);
     properties:
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s Class = '...';
@@ -159,6 +171,12 @@ node /org/freedesktop/sysupdate1/target/host {
 
     <variablelist class="dbus-method" generated="True" extra-ref="GetVersion()"/>
 
+    <variablelist class="dbus-method" generated="True" extra-ref="ListFeatures()"/>
+
+    <variablelist class="dbus-method" generated="True" extra-ref="DescribeFeature()"/>
+
+    <variablelist class="dbus-method" generated="True" extra-ref="SetFeatureEnabled()"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="Class"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="Name"/>
@@ -231,12 +249,12 @@ node /org/freedesktop/sysupdate1/target/host {
         </varlistentry>
 
         <varlistentry>
-          <term><literal>changelog_urls</literal></term>
+          <term><literal>changelogUrls</literal></term>
-          <listitem><para>A list of strings that contain user-presentable URLs to ChangeLogs associated with
+          <listitem><para>A list of strings that contain user-presentable URLs to change logs associated with
           this version.</para></listitem>
         </varlistentry>
       </variablelist>
-      
+
       <para><function>CheckNew()</function> checks if a newer version is available for this target. This
       method pulls metadata from the network. If a newer version is found, this method returns the
       version number. If no newer version is found, this method returns an empty string. Use
@@ -273,6 +291,68 @@ node /org/freedesktop/sysupdate1/target/host {
       <varname>IMAGE_VERSION</varname> in <filename>/etc/os-release</filename>. If the target has no current
       version, the function will return an empty string.</para>
 
+      <para><function>ListFeatures()</function> returns a list of this target's optional features, by ID.
+      The <varname>flags</varname> argument is added for future extensibility, and must be set to 0.
+      If the target has no optional features, the method returns an empty array.</para>
+
+      <para><function>DescribeFeature()</function> returns all known information about a given optional feature.
+      The <varname>feature</varname> argument is used to pass the ID of the feature to be described.
+      The <varname>flags</varname> argument is added for future extensibility, and must be set to 0.
+      The returned JSON object contains several known keys. More keys may be added in the future.
+      The currently known keys are as follows:</para>
+
+      <variablelist>
+        <varlistentry>
+          <term><literal>name</literal></term>
+          <listitem><para>A string containing the feature's name.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><literal>description</literal></term>
+          <listitem><para>An optional string that contains a user-presentable description that identifies
+          this feature</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><literal>enabled</literal></term>
+          <listitem><para>A boolean indicating whether this feature is enabled.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><literal>documentationUrl</literal></term>
+          <listitem><para>An optional string that contains a user-presentable HTTP/HTTPS URL to documentation
+          about this feature.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><literal>appstreamUrl</literal></term>
+          <listitem><para>An optional string that contains an HTTP/HTTPS URL to an
+          <ulink url="https://wwww.freedesktop.org/software/appstream/docs/chap-CatalogData.html">appstream
+          catalog</ulink> XML file containing metadata about this feature.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><literal>transfers</literal></term>
+          <listitem><para>An optional array of strings that list which transfer definitions belong to this
+          feature.</para></listitem>
+        </varlistentry>
+      </variablelist>
+
+      <para><function>SetFeatureEnabled()</function> writes an appropriate drop-in file to enable or disable
+      the specified optional feature.
+      If <varname>enable</varname> is zero, the feature is disabled. When greater than zero, the feature is
+      enabled. When less than zero, the feature is reset to the distribution's default.
+      The <varname>flags</varname> argument is added for future extensibility, and must be set to 0.
+      The feature does not have to exist; this allows for graceful handling of masked features, and for
+      preemptive decisions to be made about features that are planned to appear in future releases of the OS.
+      The drop-in will have a filename of <literal>50-systemd-sysupdate-enabled.conf</literal>.
+      This method only changes configuration files; to actually apply the changes, clients will need to
+      call <function>Update()</function>.
+      Depending on the exact needs of the client, it can choose to update the system to the latest available
+      version, or it can extend the newest existing installation in-place (by passing in the version returned
+      by <varname>GetVersion()</varname>).
+      For now, this method only works with the <literal>host</literal> target.</para>
+
     </refsect2>
 
     <refsect2>
@@ -327,8 +407,13 @@ node /org/freedesktop/sysupdate1/target/host {
       <interfacename>org.freedesktop.sysupdate1.vacuum</interfacename>. By default, this action requires
       administrator authentication.</para>
 
-      <para><function>GetAppStream()</function> and <function>GetVersion()</function> are unauthenticated and
+      <para><function>SetFeatureEnabled()</function> uses the polkit action
-      may be called by anybody.</para>
+      <interfacename>org.freedesktop.sysupdate1.manage-features</interfacename>. By default, this action
+      requires administrator authentication.</para>
+
+      <para><function>GetAppStream()</function>, <function>GetVersion()</function>,
+      <function>ListFeatures()</function>, and <function>DescribeFeature()</function>
+      are unauthenticated and may be called by anybody.</para>
 
       <para>All methods called on this interface expose additional variables to the polkit rules.
       <literal>class</literal> contains the class of the Target being acted upon, and <literal>name</literal>
@@ -409,9 +494,9 @@ node /org/freedesktop/sysupdate1/job/_1 {
 
       <para>The <varname>Id</varname> property exposes the numeric job ID of the job object.</para>
 
-      <para>The <varname>Type</varname> property exposes the type of operation (one of: <literal>list</literal>,
+      <para>The <varname>Type</varname> property exposes the type of operation (one of:
-      <literal>describe</literal>, <literal>check-new</literal>, <literal>update</literal>, or <literal>vacuum</literal>).
+      <literal>list</literal>, <literal>describe</literal>, <literal>check-new</literal>,
-      </para>
+      <literal>update</literal>, <literal>vacuum</literal>, or <literal>describe-feature</literal>).</para>
 
       <para>The <varname>Offline</varname> property exposes whether the job is permitted to access
       the network or not.</para>
@@ -481,6 +566,9 @@ node /org/freedesktop/sysupdate1/job/_1 {
       <function>Vacuum()</function>,
       <function>GetAppStream()</function>,
       <function>GetVersion()</function>,
+      <function>ListFeatures()</function>,
+      <function>DescribeFeature()</function>,
+      <function>SetFeatureEnabled()</function>,
       <varname>Class</varname>,
       <varname>Name</varname>, and
       <varname>Path</varname> were added in version 257.</para>
@@ -494,4 +582,13 @@ node /org/freedesktop/sysupdate1/job/_1 {
       <varname>Progress</varname> were added in version 257.</para>
     </refsect2>
   </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd-sysupdated.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>updatectl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+    </simplelist></para>
+  </refsect1>
 </refentry>

man/org.freedesktop.timedate1.xml

@@ -194,7 +194,11 @@ $ gdbus introspect --system \
 
   <refsect1>
     <title>See Also</title>
-
+    <para><simplelist type="inline">
-      <para><ulink url="https://lists.freedesktop.org/archives/systemd-devel/2011-May/002526.html">More information on how the system clock and RTC interact</ulink></para>
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd-timedate.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>timedatectl.service</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><ulink url="https://lists.freedesktop.org/archives/systemd-devel/2011-May/002526.html">More information on how the system clock and RTC interact</ulink></member>
+    </simplelist></para>
   </refsect1>
 </refentry>

man/org.freedesktop.timesync1.xml

@@ -153,4 +153,11 @@ $ gdbus introspect --system \
 
   <xi:include href="org.freedesktop.locale1.xml" xpointer="versioning"/>
 
+  <refsect1>
+    <title>See Also</title>
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd-timesync.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+    </simplelist></para>
+  </refsect1>
 </refentry>

man/pstore.conf.xml

@@ -91,9 +91,9 @@
 
   <refsect1>
     <title>See Also</title>
-    <para>
+    <para><simplelist type="inline">
-      <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+      <member><citerefentry><refentrytitle>systemd-pstore.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
-    </para>
+    </simplelist></para>
   </refsect1>
 
 </refentry>

man/rules/meson.build

@@ -65,7 +65,7 @@ manpages = [
  ['org.freedesktop.portable1', '5', [], 'ENABLE_PORTABLED'],
  ['org.freedesktop.resolve1', '5', [], 'ENABLE_RESOLVE'],
  ['org.freedesktop.systemd1', '5', [], ''],
- ['org.freedesktop.sysupdate1', '5', [], 'ENABLE_SYSUPDATE'],
+ ['org.freedesktop.sysupdate1', '5', [], 'ENABLE_SYSUPDATED'],
  ['org.freedesktop.timedate1', '5', [], 'ENABLE_TIMEDATED'],
  ['org.freedesktop.timesync1', '5', [], 'ENABLE_TIMESYNCD'],
  ['os-release', '5', ['extension-release', 'initrd-release'], ''],
@@ -155,6 +155,7 @@ manpages = [
  ['sd-journal', '3', [], ''],
  ['sd-json', '3', [], ''],
  ['sd-login', '3', [], 'HAVE_PAM'],
+ ['sd-varlink', '3', [], ''],
  ['sd_booted', '3', [], ''],
  ['sd_bus_add_match',
   '3',
@@ -1068,6 +1069,7 @@ manpages = [
   'ENABLE_RFKILL'],
  ['systemd-run-generator', '8', [], ''],
  ['systemd-run', '1', [], ''],
+ ['systemd-sbsign', '1', [], ''],
  ['systemd-sleep.conf', '5', ['sleep.conf.d'], ''],
  ['systemd-socket-activate', '1', [], ''],
  ['systemd-socket-proxyd', '8', [], ''],
@@ -1107,7 +1109,7 @@ manpages = [
  ['systemd-sysupdated.service',
   '8',
   ['systemd-sysupdated'],
-  'ENABLE_SYSUPDATE'],
+  'ENABLE_SYSUPDATED'],
  ['systemd-sysusers', '8', ['systemd-sysusers.service'], ''],
  ['systemd-sysv-generator', '8', [], 'HAVE_SYSV_COMPAT'],
  ['systemd-time-wait-sync.service',
@@ -1192,6 +1194,7 @@ manpages = [
  ['systemd.unit', '5', [], ''],
  ['systemd.v', '7', [], ''],
  ['sysupdate.d', '5', [], 'ENABLE_SYSUPDATE'],
+ ['sysupdate.features', '5', [], 'ENABLE_SYSUPDATE'],
  ['sysusers.d', '5', [], 'ENABLE_SYSUSERS'],
  ['telinit', '8', [], 'HAVE_SYSV_COMPAT'],
  ['timedatectl', '1', [], 'ENABLE_TIMEDATECTL'],
@@ -1285,7 +1288,7 @@ manpages = [
  ['udev_new', '3', ['udev_ref', 'udev_unref'], ''],
  ['udevadm', '8', [], ''],
  ['ukify', '1', [], 'ENABLE_UKIFY'],
- ['updatectl', '1', [], 'ENABLE_SYSUPDATE'],
+ ['updatectl', '1', [], 'ENABLE_SYSUPDATED'],
  ['user@.service',
   '5',
   ['systemd-user-runtime-dir', 'user-runtime-dir@.service'],

man/run0.xml

@@ -192,6 +192,35 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--pty</option></term>
+        <term><option>--pipe</option></term>
+
+        <listitem><para>Request allocation of a pseudo TTY for the <command>run0</command> session (in case
+        of <option>--pty</option>), or request passing the caller's STDIO file descriptors directly through
+        (in case of <option>--pipe</option>). If neither switch is specified, or if both switches are
+        specified, the mode will be picked automatically: if standard input, standard output and standard
+        error output are all connected to a TTY then a pseudo TTY is allocated, otherwise the relevant file
+        descriptors are passed through directly.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--shell-prompt-prefix=<replaceable>STRING</replaceable></option></term>
+
+        <listitem><para>Set a shell prompt prefix string. This ultimately controls the
+        <varname>$SHELL_PROMPT_PREFIX</varname> environment variable for the invoked program, which is
+        typically imported into the shell prompt. By default – if emojis are supported – a superhero emoji is
+        shown (🦸). This default may also be changed (or turned off) by passing the
+        <varname>$SYSTEMD_RUN_SHELL_PROMPT_PREFIX</varname> environment variable to <varname>run0</varname>,
+        see below. Set to an empty string to disable shell prompt prefixing.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><option>--machine=</option></term>
 
@@ -256,7 +285,30 @@
 
         <xi:include href="version-info.xml" xpointer="v256"/></listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><varname>$SHELL_PROMPT_PREFIX</varname></term>
+        <listitem><para>By default set to the superhero emoji (if supported), but may be overridden with the
+        <varname>$SYSTEMD_RUN_SHELL_PROMPT_PREFIX</varname> environment variable (see below), or the
+        <option>--shell-prompt-prefix=</option> switch (see above).</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
     </variablelist>
+
+    <para>The following variables may be passed to <command>run0</command>:</para>
+
+    <variablelist>
+      <varlistentry>
+        <term><varname>$SYSTEMD_RUN_SHELL_PROMPT_PREFIX</varname></term>
+        <listitem><para>If set, overrides the default shell prompt prefix that <command>run0</command> sets
+        for the invoked shell (the superhero emoji). Set to an empty string to disable shell prompt
+        prefixing.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+    </variablelist>
+
   </refsect1>
 
   <refsect1>

man/sd-bus.xml

@@ -179,6 +179,9 @@
       <member><citerefentry><refentrytitle>sd_bus_track_new</refentrytitle><manvolnum>3</manvolnum></citerefentry></member>
     </simplelist>
     for more information about the functions available.</para>
+
+    <para>The <citerefentry><refentrytitle>busctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> tool
+    makes the functionality implemented by sd-bus available from the command line.</para>
   </refsect1>
 
   <xi:include href="libsystemd-pkgconfig.xml" />
@@ -189,9 +192,10 @@
       <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>sd-event</refentrytitle><manvolnum>3</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>busctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>sd-varlink</refentrytitle><manvolnum>3</manvolnum></citerefentry></member>
       <member><citerefentry project='man-pages'><refentrytitle>dbus-daemon</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
       <member><citerefentry project='man-pages'><refentrytitle>dbus-send</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry project='die-net'><refentrytitle>pkg-config</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
     </simplelist></para>
   </refsect1>
-
 </refentry>

man/sd-json.xml

@@ -84,7 +84,8 @@
   <refsect1>
     <title>See Also</title>
     <para><simplelist type="inline">
-      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>,
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>sd-varlink</refentrytitle><manvolnum>3</manvolnum></citerefentry></member>
       <member><citerefentry project='die-net'><refentrytitle>pkg-config</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
     </simplelist></para>
   </refsect1>

man/sd-varlink.xml

@@ -0,0 +1,64 @@
+<?xml version='1.0'?> <!--*-nxml-*-->
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+  "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
+<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
+
+<refentry id="sd-varlink"
+  xmlns:xi="http://www.w3.org/2001/XInclude">
+
+  <refentryinfo>
+    <title>sd-varlink</title>
+    <productname>systemd</productname>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>sd-varlink</refentrytitle>
+    <manvolnum>3</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>sd-varlink</refname>
+    <refpurpose>APIs for Varlink IPC</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <funcsynopsis>
+      <funcsynopsisinfo>#include &lt;systemd/sd-varlink.h&gt;</funcsynopsisinfo>
+    </funcsynopsis>
+
+    <cmdsynopsis>
+      <command>pkg-config --cflags --libs libsystemd</command>
+    </cmdsynopsis>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+
+    <para><filename>sd-varlink.h</filename> is part of
+    <citerefentry><refentrytitle>libsystemd</refentrytitle><manvolnum>3</manvolnum></citerefentry> and
+    provides APIs for implementing Varlink IPC clients and services. See <ulink url="https://varlink.org/"/>
+    for more information about Varlink IPC.</para>
+
+    <para>Varlink IPC uses <ulink url="https://json.org/">JSON</ulink> as marshalling format. The sd-varlink
+    API relies on the
+    <citerefentry><refentrytitle>sd-json</refentrytitle><manvolnum>3</manvolnum></citerefentry> API for JSON
+    serialization, deserialization and manipulation.</para>
+
+    <para>The <citerefentry><refentrytitle>varlinkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> tool
+    makes the functionality implemented by sd-varlink available from the command line.</para>
+  </refsect1>
+
+  <xi:include href="libsystemd-pkgconfig.xml" />
+
+  <refsect1>
+    <title>See Also</title>
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>sd-event</refentrytitle><manvolnum>3</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>sd-json</refentrytitle><manvolnum>3</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>varlinkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>sd-bus</refentrytitle><manvolnum>3</manvolnum></citerefentry></member>
+      <member><citerefentry project='die-net'><refentrytitle>pkg-config</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+    </simplelist></para>
+  </refsect1>
+</refentry>

man/sd_bus_get_fd.xml

@@ -66,8 +66,8 @@
     <constant>POLLIN</constant>, <constant>POLLOUT</constant>, … events, or negative on error.
     </para>
 
-    <para><function>sd_bus_get_timeout()</function> returns the <emphasis>absolute</emphasis> time-out in μs,
+    <para><function>sd_bus_get_timeout()</function> returns the <emphasis>absolute</emphasis> timeout in μs,
-    from which the relative time-out to pass to <function>poll()</function> (or a similar call) can be
+    from which the relative timeout to pass to <function>poll()</function> (or a similar call) can be
     derived, when waiting for events on the specified bus connection. The returned timeout may be zero, in
     which case a subsequent I/O polling call should be invoked in non-blocking mode. The returned timeout may
     be <constant>UINT64_MAX</constant> in which case the I/O polling call may block indefinitely, without any

man/sd_bus_pending_method_calls.xml

@@ -40,7 +40,7 @@
     <para><function>sd_bus_pending_method_calls()</function> returns the number of currently pending outgoing
     method calls, i.e. method calls enqueued with
     <citerefentry><refentrytitle>sd_bus_call_async</refentrytitle><manvolnum>3</manvolnum></citerefentry> for
-    which no reply has been received yet, and which have not reached a time-out yet.</para>
+    which no reply has been received yet, and which have not reached a timeout yet.</para>
 
     <para>The <parameter>bus</parameter> argument may be <constant>NULL</constant>, in which case zero is
     returned.</para>

man/sd_device_get_syspath.xml

@@ -113,7 +113,7 @@
       <funcprototype>
         <funcdef>int <function>sd_device_get_device_id</function></funcdef>
         <paramdef>sd_device *<parameter>device</parameter></paramdef>
-        <paramdef>uint64_t *<parameter>ret</parameter></paramdef>
+        <paramdef>const char **<parameter>ret</parameter></paramdef>
       </funcprototype>
 
     </funcsynopsis>
@@ -250,9 +250,10 @@
   <refsect1>
     <title>See Also</title>
 
-    <para>
+    <para><simplelist type="inline">
-      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-    </para>
+      <member><citerefentry><refentrytitle>sd-device</refentrytitle><manvolnum>3</manvolnum></citerefentry></member>
+    </simplelist></para>
   </refsect1>
 
 </refentry>

man/sd_event_exit.xml

@@ -83,7 +83,7 @@
     <citerefentry><refentrytitle>sd_event_add_signal</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
     …) has the effect of <function>sd_event_exit()</function> being invoked once the event source triggers,
     with the specified userdata pointer cast to an integer as the exit code parameter. This is useful to
-    automatically terminate an event loop after some condition, such as a time-out or reception of
+    automatically terminate an event loop after some condition, such as a timeout or reception of
     <constant>SIGTERM</constant> or similar. See the documentation for the respective constructor call for
     details.</para>
   </refsect1>

man/sd_journal_has_runtime_files.xml

@@ -77,9 +77,10 @@
 
   <refsect1>
     <title>See Also</title>
-    <para>
+    <para><simplelist type="inline">
-      <citerefentry><refentrytitle>sd-journal</refentrytitle><manvolnum>3</manvolnum></citerefentry>
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-    </para>
+      <member><citerefentry><refentrytitle>sd-journal</refentrytitle><manvolnum>3</manvolnum></citerefentry></member>
+    </simplelist></para>
   </refsect1>
 
 </refentry>

man/sd_notify.xml

@@ -291,12 +291,35 @@
       <varlistentry>
         <term>MAINPID=…</term>
 
-        <listitem><para>The main process ID (PID) of the service, in case the service manager did not fork
+        <listitem><para>Change the main process ID (PID) of the service. This is especially useful in the case
-        off the process itself. Example: <literal>MAINPID=4711</literal>.</para>
+        where the real main process isn't directly forked off by the service manager.
+        Example: <literal>MAINPID=4711</literal>.</para>
 
         <xi:include href="version-info.xml" xpointer="v233"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term>MAINPIDFDID=…</term>
+
+        <listitem><para>The pidfd inode number of the new main process (specified through <varname>MAINPID=</varname>).
+        This information can be acquired through
+        <citerefentry project='man-pages'><refentrytitle>fstat</refentrytitle><manvolnum>2</manvolnum></citerefentry>
+        on the pidfd and is used to identify the process in a race-free fashion. Alternatively,
+        a pidfd can be sent directly to the service manager (see <varname>MAINPIDFD=1</varname> below).</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>MAINPIDFD=1</term>
+
+        <listitem><para>Similar to <varname>MAINPID=</varname> with <varname>MAINPIDFDID=</varname>, but
+        the process is referenced directly by the pidfd passed to the service manager. This is useful
+        if pidfd id is not supported on the system. Exactly one fd is expected for this notification.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>WATCHDOG=1</term>
 
@@ -476,6 +499,26 @@
     successfully. Specifically, no error is returned when a file descriptor is attempted to be stored using
     <varname>FDSTORE=1</varname> but the service is not actually configured to permit storing of file
     descriptors (see above).</para>
+
+    <refsect2 id='errors'>
+      <title>Errors</title>
+
+      <para>Returned errors may indicate the following problems:</para>
+
+      <variablelist>
+        <varlistentry>
+          <term><constant>-E2BIG</constant></term>
+
+          <listitem><para>More file descriptors passed at once than the system allows. On Linux the number of
+          file descriptors that may be passed across <constant>AF_UNIX</constant> sockets at once is 253, see
+          <citerefentry
+          project='man-pages'><refentrytitle>unix</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
+          details.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+        </varlistentry>
+      </variablelist>
+    </refsect2>
   </refsect1>
 
   <refsect1>

man/sd_path_lookup.xml

@@ -226,10 +226,11 @@
 
   <refsect1>
     <title>See Also</title>
-
+    <para><simplelist type="inline">
-    <para>
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-      <citerefentry><refentrytitle>systemd-path</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+      <member><citerefentry><refentrytitle>sd-path</refentrytitle><manvolnum>3</manvolnum></citerefentry></member>
-    </para>
+      <member><citerefentry><refentrytitle>systemd-path</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+    </simplelist></para>
   </refsect1>
 
 </refentry>

man/systemd-ac-power.xml

@@ -75,9 +75,9 @@
 
   <refsect1>
     <title>See Also</title>
-    <para>
+    <para><simplelist type="inline">
-      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-    </para>
+    </simplelist></para>
   </refsect1>
 
 </refentry>

man/systemd-ask-password.xml

@@ -30,26 +30,22 @@
   <refsect1>
     <title>Description</title>
 
-    <para><command>systemd-ask-password</command> may be used to query
+    <para><command>systemd-ask-password</command> may be used to query a password or passphrase interactively
-    a system password or passphrase from the user, using a question
+    from the user, using a question prompt specified on the command line. When run from a TTY it will query a
-    message specified on the command line. When run from a TTY it will
+    password on the TTY and print it to standard output. When run with no TTY or with
-    query a password on the TTY and print it to standard output. When
+    <option>--no-tty</option> it will use a system-wide or per-user agent-based query mechanism, which allows
-    run with no TTY or with <option>--no-tty</option> it will use the
+    active users to respond via several agents, listed below.</para>
-    system-wide query mechanism, which allows active users to respond via
-    several agents, listed below.</para>
 
-    <para>The purpose of this tool is to query system-wide passwords
+    <para>The purpose of this tool is to query system-wide or per-user passwords — the former includes
-    — that is passwords not attached to a specific user account.
+    passwords possibly not associated to a specific user account.  Examples include: unlocking encrypted hard
-    Examples include: unlocking encrypted hard disks when they are
+    disks when they are plugged in or at boot, entering an SSL certificate passphrase for web and VPN
-    plugged in or at boot, entering an SSL certificate passphrase for
+    servers.</para>
-    web and VPN servers.</para>
 
-    <para>Existing agents are:
+    <para>Existing system-level agents are:
     <itemizedlist>
 
-      <listitem><para>A boot-time password agent asking the user for
+      <listitem><para>A boot-time password agent asking the user for passwords using <citerefentry
-      passwords using
+      project='die-net'><refentrytitle>plymouth</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-      <citerefentry project='die-net'><refentrytitle>plymouth</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
       </para></listitem>
 
       <listitem><para>A boot-time password agent querying the user
@@ -77,17 +73,15 @@
     all the agents listed above (except for the last one), run as privileged
     system services. The last one also needs elevated privileges, so
     should be run through
-    <citerefentry project='die-net'><refentrytitle>sudo</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+    <citerefentry><refentrytitle>run0</refentrytitle><manvolnum>1</manvolnum></citerefentry>
     or similar.</para>
 
-    <para>Additional password agents may be implemented according to
+    <para>Additional password agents may be implemented according to the <ulink
-    the <ulink url="https://systemd.io/PASSWORD_AGENTS/">systemd Password Agent
+    url="https://systemd.io/PASSWORD_AGENTS/">systemd Password Agent Specification</ulink>.</para>
-    Specification</ulink>.</para>
 
     <para>If a password is queried on a TTY, the user may press TAB to
     hide the asterisks normally shown for each character typed.
     Pressing Backspace as first key achieves the same effect.</para>
-
   </refsect1>
 
   <refsect1>
@@ -241,6 +235,17 @@
         <xi:include href="version-info.xml" xpointer="v249"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--user</option></term>
+        <term><option>--system</option></term>
+
+        <listitem><para>Controls whether to query the system-wide or the per-user password agents. By default
+        if invoked privileged the system-wide agents are queried, otherwise the per-user ones. These options
+        allow to override this automatic behaviour.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
       <xi:include href="standard-options.xml" xpointer="help" />
     </variablelist>
 

man/systemd-backlight@.service.xml

@@ -71,9 +71,9 @@
 
   <refsect1>
     <title>See Also</title>
-    <para>
+    <para><simplelist type="inline">
-      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-    </para>
+    </simplelist></para>
   </refsect1>
 
 </refentry>

man/systemd-battery-check.service.xml

@@ -83,9 +83,9 @@
 
   <refsect1>
     <title>See Also</title>
-    <para>
+    <para><simplelist type="inline">
-      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-    </para>
+    </simplelist></para>
   </refsect1>
 
 </refentry>

man/systemd-bsod.service.xml

@@ -79,9 +79,9 @@
 
   <refsect1>
     <title>See Also</title>
-    <para>
+    <para><simplelist type="inline">
-      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-    </para>
+    </simplelist></para>
   </refsect1>
 
 </refentry>

man/systemd-hostnamed.service.xml

@@ -76,6 +76,7 @@
       <member><citerefentry><refentrytitle>machine-info</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>hostnamectl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>sethostname</refentrytitle><manvolnum>2</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>org.freedesktop.hostname1</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
     </simplelist></para>
   </refsect1>
 

man/systemd-hwdb.xml

@@ -83,8 +83,9 @@
 
   <refsect1>
     <title>See Also</title>
-    <para><citerefentry>
+    <para>
-        <refentrytitle>hwdb</refentrytitle><manvolnum>7</manvolnum>
+      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
-    </citerefentry></para>
+      <citerefentry><refentrytitle>hwdb</refentrytitle><manvolnum>7</manvolnum></citerefentry>
+    </para>
   </refsect1>
 </refentry>

man/systemd-importd.service.xml

@@ -50,6 +50,7 @@
       <member><citerefentry><refentrytitle>importctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>systemd-machined.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>org.freedesktop.import1</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
     </simplelist></para>
   </refsect1>
 

man/systemd-inhibit.xml

@@ -92,13 +92,12 @@
       <varlistentry>
         <term><option>--mode=</option></term>
 
-        <listitem><para>Takes <literal>block</literal>, <literal>delay</literal>,
+        <listitem><para>Takes <literal>block</literal>, <literal>delay</literal>, or
-        <literal>block-weak</literal> or <literal>delay-weak</literal> and describes how the lock is
+        <literal>block-weak</literal> and describes how the lock is applied. If <literal>block</literal> is
-        applied. If <literal>block</literal> is used (the default), the lock prohibits any of the requested
+        used (the default), the lock prohibits any of the requested operations without time limit, and only
-        operations without time limit, and only privileged users may override it. If
+        privileged users may override it. If <literal>delay</literal> is used, the lock can only delay the
-        <literal>delay</literal> is used, the lock can only delay the requested operations for a limited
+        requested operations for a limited time. If the time elapses, the lock is ignored and the operation
-        time. If the time elapses, the lock is ignored and the operation executed. The time limit may be
+        executed. The time limit may be specified in
-        specified in
         <citerefentry><refentrytitle>logind.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
         Note that <literal>delay</literal> is only available for <literal>sleep</literal> and
         <literal>shutdown</literal>. In addition, the weak variants will automatically and silently be

man/systemd-initctl.service.xml

@@ -41,9 +41,9 @@
 
   <refsect1>
     <title>See Also</title>
-    <para>
+    <para><simplelist type="inline">
-      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-    </para>
+    </simplelist></para>
   </refsect1>
 
 </refentry>

man/systemd-localed.service.xml

@@ -55,6 +55,7 @@
       <member><citerefentry><refentrytitle>vconsole.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
       <member><citerefentry project='man-pages'><refentrytitle>localectl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
       <member><citerefentry project='mankier'><refentrytitle>loadkeys</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>org.freedesktop.locale1</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
     </simplelist></para>
   </refsect1>
 

man/systemd-logind.service.xml

@@ -104,6 +104,7 @@
       <member><citerefentry><refentrytitle>logind.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>pam_systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>sd-login</refentrytitle><manvolnum>3</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>org.freedesktop.login1</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
     </simplelist></para>
   </refsect1>
 

man/systemd-machined.service.xml

@@ -135,6 +135,7 @@
       <member><citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>nss-mymachines</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>systemd.special</refentrytitle><manvolnum>7</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>org.freedesktop.machine1</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
     </simplelist></para>
   </refsect1>
 

man/systemd-measure.xml

@@ -77,7 +77,7 @@
         <option>--osrel=</option>, <option>--cmdline=</option>, <option>--initrd=</option>,
         <option>--ucode=</option>, <option>--splash=</option>, <option>--dtb=</option>,
         <option>--uname=</option>, <option>--sbat=</option>, <option>--pcrpkey=</option>,
-        <option>--profile=</option>, see below.  Only <option>--linux=</option> is mandatory. (Alternatively,
+        <option>--profile=</option>, <option>--dtbauto=</option>, <option>--hwids=</option>, see below.  Only <option>--linux=</option> is mandatory. (Alternatively,
         specify <option>--current</option> to use the current values of PCR register 11 instead.)</para>
 
         <xi:include href="version-info.xml" xpointer="v252"/>
@@ -125,6 +125,8 @@
         <term><option>--sbat=<replaceable>PATH</replaceable></option></term>
         <term><option>--pcrpkey=<replaceable>PATH</replaceable></option></term>
         <term><option>--profile=<replaceable>PATH</replaceable></option></term>
+        <term><option>--dtbauto=<replaceable>PATH</replaceable></option></term>
+        <term><option>--hwids=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>When used with the <command>calculate</command> or <command>sign</command> verb,
         configures the files to read the unified kernel image components from. Each option corresponds with
@@ -134,7 +136,7 @@
 
         <xi:include href="version-info.xml" xpointer="v252"/>
 
-        <para id="v257">With the exception of <option>--profile=</option>, which has been added in version
+        <para id="v257">With the exception of <option>--profile=</option>, <option>--dtbauto=</option> and <option>--hwids=</option>, which have been added in version
         257.</para></listitem>
       </varlistentry>
 
@@ -264,13 +266,15 @@
     <example>
       <title>Generate a unified kernel image, and calculate the expected TPM PCR 11 value</title>
 
-      <programlisting>$ ukify --output=vmlinux.efi \
+      <programlisting>$ ukify build \
+     --linux=vmlinux \
+     --initrd=initrd.cpio \
      --os-release=@os-release.txt \
      --cmdline=@cmdline.txt \
      --splash=splash.bmp \
      --devicetree=devicetree.dtb \
      --measure \
-     vmlinux initrd.cpio
+     --output=vmlinux.efi
 11:sha1=d775a7b4482450ac77e03ee19bda90bd792d6ec7
 11:sha256=bc6170f9ce28eb051ab465cd62be8cf63985276766cf9faf527ffefb66f45651
 11:sha384=1cf67dff4757e61e5...7f49ad720be02fd07263e1f93061243aec599d1ee4b4
@@ -289,7 +293,7 @@
       <programlisting>$ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out tpm2-pcr-private-key.pem
 ..+.+++++++++......+.........+......+.......+....+.....+.+...+..........
 $ openssl rsa -pubout -in tpm2-pcr-private-key.pem -out tpm2-pcr-public-key.pem
-# systemd-measure sign \
+$ systemd-measure sign \
      --linux=vmlinux \
      --osrel=os-release.txt \
      --cmdline=cmdline.txt \
@@ -301,7 +305,9 @@ $ openssl rsa -pubout -in tpm2-pcr-private-key.pem -out tpm2-pcr-public-key.pem
      --bank=sha256 \
      --private-key=tpm2-pcr-private-key.pem \
      --public-key=tpm2-pcr-public-key.pem >tpm2-pcr-signature.json
-# ukify --output=vmlinuz.efi \
+$ ukify build \
+     --linux=vmlinux \
+     --initrd=initrd.cpio \
      --os-release=@os-release.txt \
      --cmdline=@cmdline.txt \
      --splash=splash.bmp \
@@ -309,7 +315,7 @@ $ openssl rsa -pubout -in tpm2-pcr-private-key.pem -out tpm2-pcr-public-key.pem
      --pcr-private-key=tpm2-pcr-private-key.pem \
      --pcr-public-key=tpm2-pcr-public-key.pem \
      --pcr-banks=sha1,sha256 \
-     vmlinux initrd.cpio</programlisting>
+     --output=vmlinuz.efi</programlisting>
 
      <para>Later on, enroll the signed PCR policy on a LUKS volume:</para>
 
@@ -345,7 +351,9 @@ $ openssl rsa -pubout -in tpm2-pcr-private-key.pem -out tpm2-pcr-public-key.pem
 $ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out tpm2-pcr-private-key-initrd.pem
 ..+.......++........+........+......+........+....+.....+.+..+..........
 $ openssl rsa -pubout -in tpm2-pcr-private-key-initrd.pem -out tpm2-pcr-public-key-initrd.pem
-# ukify --output vmlinux-1.2.3.efi \
+$ ukify build \
+     --linux=vmlinux-1.2.3 \
+     --initrd=initrd.cpio \
      --os-release=@os-release.txt \
      --cmdline=@cmdline.txt \
      --splash=splash.bmp \
@@ -357,8 +365,8 @@ $ openssl rsa -pubout -in tpm2-pcr-private-key-initrd.pem -out tpm2-pcr-public-k
      --pcr-private-key=tpm2-pcr-private-key-initrd.pem \
      --pcr-public-key=tpm2-pcr-public-key-initrd.pem \
      --phases=enter-initrd \
-     vmlinux-1.2.3 initrd.cpio \
+     --uname=1.2.3 \
-     --uname=1.2.3
+     --output=vmlinux-1.2.3.efi
 + /usr/lib/systemd/systemd-measure sign --linux=vmlinux-1.2.3 \
 --osrel=os-release.txt --cmdline=cmdline.txt --dtb=devicetree.dtb \
 --splash=splash.bmp --initrd=initrd.cpio --bank=sha1 --bank=sha256 \

man/systemd-mountfsd.service.xml

@@ -62,9 +62,9 @@
 
   <refsect1>
     <title>See Also</title>
-    <para>
+    <para><simplelist type="inline">
-      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-      <citerefentry><refentrytitle>systemd-nsresourced.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+      <member><citerefentry><refentrytitle>systemd-nsresourced.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
-    </para>
+    </simplelist></para>
   </refsect1>
 </refentry>

man/systemd-networkd.service.xml

@@ -63,6 +63,12 @@
     <para><command>systemd-networkd</command> may be introspected and controlled at runtime using
     <citerefentry><refentrytitle>networkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
     </para>
+
+    <para>See
+    <citerefentry><refentrytitle>org.freedesktop.network1</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+    and
+    <citerefentry><refentrytitle>org.freedesktop.LogControl1</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+    for a description of the D-Bus API.</para>
   </refsect1>
 
   <refsect1><title>Configuration Files</title>
@@ -91,6 +97,7 @@
       <member><citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>systemd-networkd-wait-online.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>systemd-network-generator.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>org.freedesktop.network1</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
     </simplelist></para>
   </refsect1>
 

man/systemd-nsresourced.service.xml

@@ -69,13 +69,13 @@
 
   <refsect1>
     <title>See Also</title>
-    <para>
+    <para><simplelist type="inline">
-      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-      <citerefentry><refentrytitle>systemd-mountfsd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+      <member><citerefentry><refentrytitle>systemd-mountfsd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
-      <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+      <member><citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-      <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+      <member><citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
-      <citerefentry><refentrytitle>systemd-dissect</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+      <member><citerefentry><refentrytitle>systemd-dissect</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-      <citerefentry project='man-pages'><refentrytitle>user_namespaces</refentrytitle><manvolnum>7</manvolnum></citerefentry>
+      <member><citerefentry project='man-pages'><refentrytitle>user_namespaces</refentrytitle><manvolnum>7</manvolnum></citerefentry></member>
-    </para>
+    </simplelist></para>
   </refsect1>
 </refentry>

man/systemd-oomd.service.xml

@@ -57,6 +57,12 @@
 
     <para>See <citerefentry><refentrytitle>oomd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
     for more information about the configuration of this service.</para>
+
+    <para>See
+    <citerefentry><refentrytitle>org.freedesktop.oom1</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+    and
+    <citerefentry><refentrytitle>org.freedesktop.LogControl1</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+    for a description of the D-Bus API.</para>
   </refsect1>
 
   <refsect1>
@@ -129,6 +135,7 @@
       <member><citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>oomd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>oomctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>org.freedesktop.oom1</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
     </simplelist></para>
   </refsect1>
 </refentry>

man/systemd-portabled.service.xml

@@ -37,6 +37,12 @@
 
     <para>See the <ulink url="https://systemd.io/PORTABLE_SERVICES">Portable Services</ulink> page
     for details about the concepts this service implements.</para>
+
+    <para>See
+    <citerefentry><refentrytitle>org.freedesktop.portable1</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+    and
+    <citerefentry><refentrytitle>org.freedesktop.LogControl1</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+    for a description of the D-Bus API.</para>
   </refsect1>
 
   <refsect1>

man/systemd-poweroff.service.xml

@@ -44,7 +44,7 @@
     <filename>kexec.target</filename> to execute the respective actions.</para>
 
     <para>When these services are run, they ensure that PID 1 is replaced by the
-    <filename>/usr/lib/systemd/systemd-shutdown</filename> tool which is then responsible for the actual
+    <filename>/usr/lib/systemd/systemd-shutdown</filename> binary which is then responsible for the actual
     shutdown. Before shutting down, this binary will try to unmount all remaining file systems (or at least
     remount them read-only), disable all remaining swap devices, detach all remaining storage devices and
     kill all remaining processes.</para>
@@ -58,12 +58,12 @@
     <filename>/usr/lib/systemd/system-shutdown/</filename> and pass one arguments to them: either
     <literal>poweroff</literal>, <literal>halt</literal>, <literal>reboot</literal>, or
     <literal>kexec</literal>, depending on the chosen action. All executables in this directory are executed
-    in parallel, and execution of the action is not continued before all executables finished. Note that
+    in parallel, and execution of the action is not continued before all executables finished. (A safety
-    these executables are run <emphasis>after</emphasis> all services have been shut down, and after most
+    timeout of 90s is applied however.) Note that these executables are run <emphasis>after</emphasis> all
-    mounts have been unmounted (the root file system as well as <filename>/run/</filename> and various API
+    services have been shut down, and after most mounts have been unmounted (the root file system as well as
-    file systems are still around though). This means any programs dropped into this directory must be
+    <filename>/run/</filename> and various API file systems are still around though). This means any programs
-    prepared to run in such a limited execution environment and not rely on external services or hierarchies
+    dropped into this directory must be prepared to run in such a limited execution environment and not rely
-    such as <filename>/var/</filename> to be around (or writable).</para>
+    on external services or hierarchies such as <filename>/var/</filename> to be around (or writable).</para>
 
     <para>Note that <filename>systemd-poweroff.service</filename> (and the related units) should never be
     executed directly. Instead, trigger system shutdown with a command such as <literal>systemctl

man/systemd-pstore.service.xml

@@ -107,8 +107,8 @@
 
   <refsect1>
     <title>See Also</title>
-    <para>
+    <para><simplelist type="inline">
-      <citerefentry><refentrytitle>pstore.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      <member><citerefentry><refentrytitle>pstore.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
-    </para>
+    </simplelist></para>
   </refsect1>
 </refentry>

man/systemd-resolved.service.xml

@@ -516,6 +516,7 @@ search foobar.com barbar.com
       <member><citerefentry project='man-pages'><refentrytitle>hosts</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>org.freedesktop.resolve1</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
     </simplelist></para>
   </refsect1>
 

man/systemd-rfkill.service.xml

@@ -60,9 +60,9 @@
 
   <refsect1>
     <title>See Also</title>
-    <para>
+    <para><simplelist type="inline">
-      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-    </para>
+    </simplelist></para>
   </refsect1>
 
 </refentry>

man/systemd-sbsign.xml

@@ -0,0 +1,111 @@
+<?xml version='1.0'?> <!--*-nxml-*-->
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+  "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
+<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
+
+<refentry id="systemd-sbsign"
+    xmlns:xi="http://www.w3.org/2001/XInclude">
+  <refentryinfo>
+    <title>systemd-sbsign</title>
+    <productname>systemd</productname>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>systemd-sbsign</refentrytitle>
+    <manvolnum>1</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>systemd-sbsign</refname>
+    <refpurpose>Sign PE binaries for EFI Secure Boot</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <cmdsynopsis>
+      <command>systemd-sbsign</command>
+      <arg choice="opt" rep="repeat">OPTIONS</arg>
+      <arg choice="req">COMMAND</arg>
+    </cmdsynopsis>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+
+    <para><command>systemd-sbsign</command> can be used to sign PE binaries for EFI Secure Boot.</para>
+  </refsect1>
+
+  <refsect1>
+    <title>Commands</title>
+
+    <variablelist>
+      <varlistentry>
+        <term><option>sign</option></term>
+
+        <listitem><para>Signs the given PE binary for EFI Secure Boot. Takes a path to a PE binary as its
+        argument. If the PE binary already has a certificate table, the new signature will be added to it.
+        Otherwise a new certificate table will be created. The signed PE binary will be written to the path
+        specified with <option>--output=</option>.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>validate-key</option></term>
+
+        <listitem><para>Checks that we can load the private key specified with
+        <option>--private-key=</option>. </para>
+
+        <para>As a side effect, if the private key is loaded from a PIN-protected hardware token, this
+        command can be used to cache the PIN in the kernel keyring. The
+        <varname>$SYSTEMD_ASK_PASSWORD_KEYRING_TIMEOUT_SEC</varname> and
+        <varname>$SYSTEMD_ASK_PASSWORD_KEYRING_TYPE</varname> environment variables can be used to control
+        how long and in which kernel keyring the PIN is cached.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1>
+    <title>Options</title>
+    <para>The following options are understood:</para>
+
+    <variablelist>
+      <varlistentry>
+        <term><option>--output=<replaceable>PATH</replaceable></option></term>
+
+        <listitem><para>Specifies the path where to write the signed PE binary.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--private-key=<replaceable>PATH/URI</replaceable></option></term>
+        <term><option>--private-key-source=<replaceable>TYPE</replaceable>[:<replaceable>NAME</replaceable>]</option></term>
+        <term><option>--certificate=<replaceable>PATH</replaceable></option></term>
+
+        <listitem><para>Set the Secure Boot private key and certificate for use with the
+        <command>sign</command>. The <option>--certificate=</option> option takes a path to a PEM encoded
+        X.509 certificate. The <option>--private-key=</option> option can take a path or a URI that will be
+        passed to the OpenSSL engine or provider, as specified by <option>--private-key-source=</option> as a
+        <literal>type:name</literal> tuple, such as <literal>engine:pkcs11</literal>. The specified OpenSSL
+        signing engine or provider will be used to sign the PE binary.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
+      <xi:include href="standard-options.xml" xpointer="no-pager"/>
+      <xi:include href="standard-options.xml" xpointer="help"/>
+      <xi:include href="standard-options.xml" xpointer="version"/>
+    </variablelist>
+  </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>bootctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+    </simplelist></para>
+  </refsect1>
+</refentry>

man/systemd-stub.xml

@@ -59,44 +59,66 @@
       <!-- Let's keep this in the canonical order we also measure the sections by, i.e. as in
            src/fundamental/uki.h's UnifiedSection enum -->
 
-      <listitem><para>A <literal>.linux</literal> section with the ELF Linux kernel
+      <listitem><para>A <literal>.linux</literal> section with the ELF Linux kernel image.
-      image. (Required)</para></listitem>
+      This section is required.</para></listitem>
 
-      <listitem><para>An <literal>.osrel</literal> section with OS release information, i.e. the contents of
+      <listitem><para>An optional <literal>.osrel</literal> section with OS release information, i.e. the
-      the <citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry> file
+      contents of the
-      of the OS the kernel belongs to.</para></listitem>
+      <citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry> file of
+      the OS the kernel belongs to.</para></listitem>
 
-      <listitem><para>A <literal>.cmdline</literal> section with the kernel command line to pass to the
+      <listitem><para>An optional <literal>.cmdline</literal> section with the kernel command line to pass to
-      invoked kernel.</para></listitem>
+      the invoked kernel.</para></listitem>
 
-      <listitem><para>An <literal>.initrd</literal> section with the initrd.</para></listitem>
+      <listitem><para>An optional <literal>.initrd</literal> section with the initrd.</para></listitem>
 
-      <listitem><para>A <literal>.ucode</literal> section with an initrd containing microcode, to be handed
+      <listitem><para>An optional <literal>.ucode</literal> section with an initrd containing microcode, to
-      to the kernel before any other initrd. This initrd must not be compressed.</para></listitem>
+      be handed to the kernel before any other initrd. This initrd must not be compressed.</para></listitem>
 
-      <listitem><para>A <literal>.splash</literal> section with an image (in the Windows
+      <listitem><para>An optional <literal>.splash</literal> section with an image (in the Windows
       <filename>.BMP</filename> format) to show on screen before invoking the kernel.</para></listitem>
 
-      <listitem><para>A <literal>.dtb</literal> section with a compiled binary DeviceTree.</para></listitem>
+      <listitem><para>An optional <literal>.dtb</literal> section with a compiled binary DeviceTree.
+      </para></listitem>
 
-      <listitem><para>A <literal>.uname</literal> section with the kernel version information, i.e. the
+      <listitem><para>Zero or more <literal>.dtbauto</literal> sections. <filename>systemd-stub</filename>
-      output of <command>uname -r</command> for the kernel included in the <literal>.linux</literal>
+      will always use the first matching one. The match is performed by taking the first DeviceTree's
+      <varname>compatible</varname> string supplied by the firmware in configuration tables and comparing it
+      with the first <varname>compatible</varname> string from each of the <literal>.dtbauto</literal>
+      sections. If the firmware does not provide a DeviceTree, the match is done using the
+      <varname>.hwids</varname> section instead. After selecting a <literal>.hwids</literal> section (see the
+      description below), the <varname>compatible</varname> string from that section will be used to perform
+      the same matching procedure. If a match is found, that <literal>.dtbauto</literal> section will be
+      loaded and will override <varname>.dtb</varname> if present.</para></listitem>
+
+      <listitem><para>Zero or more <literal>.hwids</literal> sections with hardware IDs of the machines to
+      match DeviceTrees. <filename>systemd-stub</filename> will use the SMBIOS data to calculate hardware IDs
+      of the machine (as per <ulink
+      url="https://learn.microsoft.com/en-us/windows-hardware/drivers/install/specifying-hardware-ids-for-a-computer">specification</ulink>),
+      and then it will try to find any of them in each of the <literal>.hwids</literal> sections. The first
+      matching section will be used.</para></listitem>
+
+      <listitem><para>An optional <literal>.uname</literal> section with the kernel version information, i.e.
+      the output of <command>uname -r</command> for the kernel included in the <literal>.linux</literal>
       section.</para></listitem>
 
-      <listitem><para>An <literal>.sbat</literal> section with
+      <listitem><para>An optional <literal>.sbat</literal> section with
-      <ulink url="https://github.com/rhboot/shim/blob/main/SBAT.md">SBAT</ulink> revocation
+      <ulink url="https://github.com/rhboot/shim/blob/main/SBAT.md">SBAT</ulink> revocation metadata.
-      metadata.</para></listitem>
+      </para></listitem>
 
-      <listitem><para>A <literal>.pcrsig</literal> section with a set of cryptographic signatures for the
+      <listitem><para>An optional <literal>.pcrsig</literal> section with a set of cryptographic signatures
-      expected TPM2 PCR values after the kernel has been booted, in JSON format. This is useful for
+      for the expected TPM2 PCR values after the kernel has been booted, in JSON format. This is useful for
       implementing TPM2 policies that bind disk encryption and similar to kernels that are signed by a
       specific key.</para></listitem>
 
-      <listitem><para>A <literal>.pcrpkey</literal> section with a public key in the PEM format matching the
+      <listitem><para>An optional <literal>.pcrpkey</literal> section with a public key in the PEM format
-      signature data in the <literal>.pcrsig</literal> section.</para></listitem>
+      matching the signature data in the <literal>.pcrsig</literal> section.</para></listitem>
     </itemizedlist>
 
-    <para>In a basic UKI, the sections listed above appear at most once. In a multi-profile UKI,
+    <!-- FIXME: how does .dtauto/.hwids matching interact with profiles? -->
+
+    <para>In a basic UKI, the sections listed above appear at most once, with the exception of
+    <literal>.dtbauto</literal> and <literal>.hwids</literal> sections. In a multi-profile UKI,
     multiple sets of these sections are present in a single file and form "profiles",
     one of which can be selected at boot. For this, the PE section <literal>.profile</literal> is
     defined to be used as the separator between sets of sections. The
@@ -192,7 +214,7 @@
       <listitem><para>Similarly, files
       <filename><replaceable>foo</replaceable>.efi.extra.d/*.addon.efi</filename> are loaded and verified as
       PE binaries and specific sections are loaded from them. Addons are used to pass additional kernel
-      command line parameters (<literal>.cmdline</literal> section), or Devicetree blobs
+      command line parameters (<literal>.cmdline</literal> section), or DeviceTree blobs
       (<literal>.dtb</literal> section), additional initrds (<literal>.initrd</literal> section),
       and microcode updates (<literal>.ucode</literal> section). Addons allow those resources to be passed
       regardless of the kernel version being booted, for example allowing platform vendors to ship

man/systemd-sysupdate.xml

@@ -106,6 +106,16 @@
         <xi:include href="version-info.xml" xpointer="v251"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>features</option> <optional><replaceable>FEATURE</replaceable></optional></term>
+
+        <listitem><para>If invoked without an argument, enumerates optional features and shows a summarizing
+        table, including which features are enabled or disabled. If a feature argument is specified, shows
+        details about the specific feature, including the transfers that are controlled by the feature.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><option>check-new</option></term>
 

man/systemd-sysupdated.service.xml

@@ -3,7 +3,7 @@
   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
 
-<refentry id="systemd-sysupdated.service" conditional='ENABLE_SYSUPDATE'>
+<refentry id="systemd-sysupdated.service" conditional='ENABLE_SYSUPDATED'>
 
   <refentryinfo>
     <title>systemd-sysupdated.service</title>
@@ -45,11 +45,12 @@
 
   <refsect1>
     <title>See Also</title>
-    <para>
+    <para><simplelist type="inline">
-      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-      <citerefentry><refentrytitle>systemd-sysupdate</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+      <member><citerefentry><refentrytitle>systemd-sysupdate</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
-      <citerefentry><refentrytitle>updatectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+      <member><citerefentry><refentrytitle>updatectl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
-    </para>
+      <member><citerefentry><refentrytitle>org.freedesktop.sysupdate1</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
+    </simplelist></para>
   </refsect1>
 
 </refentry>