mkosi: bump fedora from 42 to 43

It seems - the address sanitizer on fedora 42 reports false-positive, or - probing partitions in libblkid 2.40.4 has a bug. Not sure which causes the issue, but anyway the address sanitizer kills udev-worker when sym_blkid_partition_get_name() is called in udev-builtin-blkid.c. ``` systemd-udevd[488]: ==488==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7ffdd716e020 at pc 0x563e3ca66fcb bp 0x7ffdd716d970 sp 0x7ffdd716d968 systemd-udevd[488]: READ of size 8 at 0x7ffdd716e020 thread T0 ((udev-worker)) (snip) systemd-udevd[488]: HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork systemd-udevd[488]: (longjmp and C++ exceptions *are* supported) systemd-udevd[488]: SUMMARY: AddressSanitizer: stack-buffer-underflow (/usr/bin/udevadm+0x187fca) (BuildId: 1fb56dbdf0447aba1185d6e34560b782b76098be) (snip) systemd-udevd[488]: Command: (udev-worker) systemd-udevd[488]: ==488==ABORTING ``` Let's bump fedora from 42 to 43. Fixes mkosi fedora 42 job failures after c349edfe49dc2c4b8a79e5d08ecf7c8e93c4c909. (cherry picked from commit 97940e77a9e347085a0b174bafa90a2823f43657)
mkosi: Add stress-ng to sanitizer wrapper programs
2025-11-21 01:34:44 +01:00 · 2025-10-13 10:04:47 +02:00 · 2025-10-13 10:04:47 +02:00 · 2025-10-13 10:04:47 +02:00 · 2025-10-13 10:04:47 +02:00 · 2025-10-13 10:04:47 +02:00
72 changed files with 4984 additions and 2026 deletions
--- a/.github/workflows/mkosi.yml
+++ b/.github/workflows/mkosi.yml
@ -87,7 +87,7 @@ jobs:
            relabel: no
            vm: 0
          - distro: fedora
-            release: "42"
+            release: "43"
            sanitizers: address,undefined
            llvm: 1
            cflags: "-Og"
--- a/LICENSE.GPL2
+++ b/LICENSE.GPL2
@ -2,7 +2,7 @@
 		       Version 2, June 1991

 Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.

@ -305,7 +305,7 @@ the "copyright" line and a pointer to where the full notice is found.

    You should have received a copy of the GNU General Public License along
    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+    59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.

 Also add information on how to contact you by electronic and paper mail.

--- a/LICENSE.LGPL2.1
+++ b/LICENSE.LGPL2.1
@ -2,7 +2,7 @@
                       Version 2.1, February 1999

 Copyright (C) 1991, 1999 Free Software Foundation, Inc.
- 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ 59 Temple Place, Suite 330, Boston, MA 02111-1307  USA
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.

@ -485,7 +485,7 @@ convey the exclusion of warranty; and each file should have at least the

    You should have received a copy of the GNU Lesser General Public
    License along with this library; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307  USA

 Also add information on how to contact you by electronic and paper mail.

--- a/LICENSES/LGPL-2.0-or-later.txt
+++ b/LICENSES/LGPL-2.0-or-later.txt
@ -3,7 +3,7 @@ GNU LIBRARY GENERAL PUBLIC LICENSE
 Version 2, June 1991

 Copyright (C) 1991 Free Software Foundation, Inc.
-51 Franklin St, Fifth Floor, Boston, MA  02110-1301, USA
+59 Temple Place, Suite 330, Boston, MA 02111-1307, USA

 Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.

@ -158,7 +158,7 @@ To apply these terms, attach the following notices to the library. It is safest

     This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Library General Public License for more details.

-     You should have received a copy of the GNU Library General Public License along with this library; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301, USA.
+     You should have received a copy of the GNU Library General Public License along with this library; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.

 Also add information on how to contact you by electronic and paper mail.

--- a/hwdb.d/20-OUI.hwdb
+++ b/hwdb.d/20-OUI.hwdb
--- a/hwdb.d/20-acpi-vendor.hwdb
+++ b/hwdb.d/20-acpi-vendor.hwdb
@ -396,6 +396,9 @@ acpi:UBLX*:
 acpi:UBOO*:
 ID_VENDOR_FROM_DATABASE=Das U-Boot

+acpi:ULRV*:
+ ID_VENDOR_FROM_DATABASE=UltraRISC Technology (Shanghai) Co., Ltd
+
 acpi:VAIO*:
 ID_VENDOR_FROM_DATABASE=VAIO Corporation

--- a/hwdb.d/20-acpi-vendor.hwdb.patch
+++ b/hwdb.d/20-acpi-vendor.hwdb.patch
@ -1,5 +1,5 @@
--- 20-acpi-vendor.hwdb.base	2025-08-20 13:04:02.003302877 +0100
-+++ 20-acpi-vendor.hwdb	2025-08-20 13:04:02.007302969 +0100
+--- 20-acpi-vendor.hwdb.base	2025-09-17 09:39:11.942879943 +0100
+++ 20-acpi-vendor.hwdb	2025-09-17 09:39:11.950880802 +0100
@@ -3,6 +3,8 @@
 # Data imported from:
 #     https://uefi.org/uefi-pnp-export
@ -19,7 +19,7 @@
 acpi:AMDI*:
  ID_VENDOR_FROM_DATABASE=AMD
 
-@@ -424,6 +423,9 @@
+@@ -427,6 +426,9 @@
 acpi:AAA*:
  ID_VENDOR_FROM_DATABASE=Avolites Ltd
 
@ -29,7 +29,7 @@
 acpi:AAE*:
  ID_VENDOR_FROM_DATABASE=Anatek Electronics Inc.
 
-@@ -451,6 +453,9 @@
+@@ -454,6 +456,9 @@
 acpi:ABO*:
  ID_VENDOR_FROM_DATABASE=D-Link Systems Inc
 
@ -39,7 +39,7 @@
 acpi:ABS*:
  ID_VENDOR_FROM_DATABASE=Abaco Systems, Inc.
 
-@@ -496,7 +501,7 @@
+@@ -499,7 +504,7 @@
 acpi:ACO*:
  ID_VENDOR_FROM_DATABASE=Allion Computer Inc.
 
@ -48,7 +48,7 @@
  ID_VENDOR_FROM_DATABASE=Aspen Tech Inc
 
 acpi:ACR*:
-@@ -775,6 +780,9 @@
+@@ -778,6 +783,9 @@
 acpi:AMT*:
  ID_VENDOR_FROM_DATABASE=AMT International Industry
 
@ -58,7 +58,7 @@
 acpi:AMX*:
  ID_VENDOR_FROM_DATABASE=AMX LLC
 
-@@ -823,6 +831,9 @@
+@@ -826,6 +834,9 @@
 acpi:AOA*:
  ID_VENDOR_FROM_DATABASE=AOpen Inc.
 
@ -68,7 +68,7 @@
 acpi:AOE*:
  ID_VENDOR_FROM_DATABASE=Advanced Optics Electronics, Inc.
 
-@@ -832,6 +843,9 @@
+@@ -835,6 +846,9 @@
 acpi:AOT*:
  ID_VENDOR_FROM_DATABASE=Alcatel
 
@ -78,7 +78,7 @@
 acpi:APC*:
  ID_VENDOR_FROM_DATABASE=American Power Conversion
 
-@@ -1013,7 +1027,7 @@
+@@ -1016,7 +1030,7 @@
  ID_VENDOR_FROM_DATABASE=ALPS ALPINE CO., LTD.
 
 acpi:AUO*:
@ -87,7 +87,7 @@
 
 acpi:AUR*:
  ID_VENDOR_FROM_DATABASE=Aureal Semiconductor
-@@ -1093,6 +1107,9 @@
+@@ -1096,6 +1110,9 @@
 acpi:AXE*:
  ID_VENDOR_FROM_DATABASE=Axell Corporation
 
@ -97,7 +97,7 @@
 acpi:AXI*:
  ID_VENDOR_FROM_DATABASE=American Magnetics
 
-@@ -1252,6 +1269,9 @@
+@@ -1255,6 +1272,9 @@
 acpi:BML*:
  ID_VENDOR_FROM_DATABASE=BIOMED Lab
 
@ -107,7 +107,7 @@
 acpi:BMS*:
  ID_VENDOR_FROM_DATABASE=BIOMEDISYS
 
-@@ -1264,6 +1284,9 @@
+@@ -1267,6 +1287,9 @@
 acpi:BNO*:
  ID_VENDOR_FROM_DATABASE=Bang & Olufsen
 
@ -117,7 +117,7 @@
 acpi:BNS*:
  ID_VENDOR_FROM_DATABASE=Boulder Nonlinear Systems
 
-@@ -1510,6 +1533,9 @@
+@@ -1513,6 +1536,9 @@
 acpi:CHA*:
  ID_VENDOR_FROM_DATABASE=Chase Research PLC
 
@ -127,7 +127,7 @@
 acpi:CHD*:
  ID_VENDOR_FROM_DATABASE=ChangHong Electric Co.,Ltd
 
-@@ -1675,6 +1701,9 @@
+@@ -1678,6 +1704,9 @@
 acpi:COD*:
  ID_VENDOR_FROM_DATABASE=CODAN Pty. Ltd.
 
@ -137,7 +137,7 @@
 acpi:COI*:
  ID_VENDOR_FROM_DATABASE=Codec Inc.
 
-@@ -2093,7 +2122,7 @@
+@@ -2096,7 +2125,7 @@
  ID_VENDOR_FROM_DATABASE=Dragon Information Technology
 
 acpi:DJE*:
@ -146,7 +146,7 @@
 
 acpi:DJP*:
  ID_VENDOR_FROM_DATABASE=Maygay Machines, Ltd
-@@ -2446,6 +2475,9 @@
+@@ -2449,6 +2478,9 @@
 acpi:EIN*:
  ID_VENDOR_FROM_DATABASE=Elegant Invention
 
@ -156,7 +156,7 @@
 acpi:EKA*:
  ID_VENDOR_FROM_DATABASE=MagTek Inc.
 
-@@ -2716,6 +2748,9 @@
+@@ -2719,6 +2751,9 @@
 acpi:FCG*:
  ID_VENDOR_FROM_DATABASE=First International Computer Ltd
 
@ -166,7 +166,7 @@
 acpi:FCS*:
  ID_VENDOR_FROM_DATABASE=Focus Enhancements, Inc.
 
-@@ -3092,7 +3127,7 @@
+@@ -3095,7 +3130,7 @@
  ID_VENDOR_FROM_DATABASE=General Standards Corporation
 
 acpi:GSM*:
@ -175,7 +175,7 @@
 
 acpi:GSN*:
  ID_VENDOR_FROM_DATABASE=Grandstream Networks, Inc.
-@@ -3202,6 +3237,9 @@
+@@ -3205,6 +3240,9 @@
 acpi:HEC*:
  ID_VENDOR_FROM_DATABASE=Hisense Electric Co., Ltd.
 
@ -185,7 +185,7 @@
 acpi:HEL*:
  ID_VENDOR_FROM_DATABASE=Hitachi Micro Systems Europe Ltd
 
-@@ -3337,6 +3375,9 @@
+@@ -3340,6 +3378,9 @@
 acpi:HSD*:
  ID_VENDOR_FROM_DATABASE=HannStar Display Corp
 
@ -195,7 +195,7 @@
 acpi:HSM*:
  ID_VENDOR_FROM_DATABASE=AT&T Microelectronics
 
-@@ -3463,6 +3504,9 @@
+@@ -3466,6 +3507,9 @@
 acpi:ICI*:
  ID_VENDOR_FROM_DATABASE=Infotek Communication Inc
 
@ -205,7 +205,7 @@
 acpi:ICM*:
  ID_VENDOR_FROM_DATABASE=Intracom SA
 
-@@ -3559,6 +3603,9 @@
+@@ -3562,6 +3606,9 @@
 acpi:IKE*:
  ID_VENDOR_FROM_DATABASE=Ikegami Tsushinki Co. Ltd.
 
@ -215,7 +215,7 @@
 acpi:IKS*:
  ID_VENDOR_FROM_DATABASE=Ikos Systems Inc
 
-@@ -3607,6 +3654,9 @@
+@@ -3610,6 +3657,9 @@
 acpi:IMX*:
  ID_VENDOR_FROM_DATABASE=arpara Technology Co., Ltd.
 
@ -225,7 +225,7 @@
 acpi:INA*:
  ID_VENDOR_FROM_DATABASE=Inventec Corporation
 
-@@ -4135,6 +4185,9 @@
+@@ -4138,6 +4188,9 @@
 acpi:LAN*:
  ID_VENDOR_FROM_DATABASE=Sodeman Lancom Inc
 
@ -235,7 +235,7 @@
 acpi:LAS*:
  ID_VENDOR_FROM_DATABASE=LASAT Comm. A/S
 
-@@ -4186,6 +4239,9 @@
+@@ -4189,6 +4242,9 @@
 acpi:LED*:
  ID_VENDOR_FROM_DATABASE=Long Engineering Design Inc
 
@ -245,7 +245,7 @@
 acpi:LEG*:
  ID_VENDOR_FROM_DATABASE=Legerity, Inc
 
-@@ -4204,6 +4260,9 @@
+@@ -4207,6 +4263,9 @@
 acpi:LGD*:
  ID_VENDOR_FROM_DATABASE=LG Display
 
@ -255,7 +255,7 @@
 acpi:LGI*:
  ID_VENDOR_FROM_DATABASE=Logitech Inc
 
-@@ -4270,6 +4329,9 @@
+@@ -4273,6 +4332,9 @@
 acpi:LND*:
  ID_VENDOR_FROM_DATABASE=Land Computer Company Ltd
 
@ -265,7 +265,7 @@
 acpi:LNK*:
  ID_VENDOR_FROM_DATABASE=Link Tech Inc
 
-@@ -4304,7 +4366,7 @@
+@@ -4307,7 +4369,7 @@
  ID_VENDOR_FROM_DATABASE=Design Technology
 
 acpi:LPL*:
@ -274,7 +274,7 @@
 
 acpi:LSC*:
  ID_VENDOR_FROM_DATABASE=LifeSize Communications
-@@ -4480,6 +4542,9 @@
+@@ -4483,6 +4545,9 @@
 acpi:MCX*:
  ID_VENDOR_FROM_DATABASE=Millson Custom Solutions Inc.
 
@ -284,7 +284,7 @@
 acpi:MDA*:
  ID_VENDOR_FROM_DATABASE=Media4 Inc
 
-@@ -4726,6 +4791,9 @@
+@@ -4729,6 +4794,9 @@
 acpi:MOM*:
  ID_VENDOR_FROM_DATABASE=Momentum Data Systems
 
@ -294,7 +294,7 @@
 acpi:MOS*:
  ID_VENDOR_FROM_DATABASE=Moses Corporation
 
-@@ -4966,6 +5034,9 @@
+@@ -4969,6 +5037,9 @@
 acpi:NAL*:
  ID_VENDOR_FROM_DATABASE=Network Alchemy
 
@ -304,7 +304,7 @@
 acpi:NAT*:
  ID_VENDOR_FROM_DATABASE=NaturalPoint Inc.
 
-@@ -5506,6 +5577,9 @@
+@@ -5509,6 +5580,9 @@
 acpi:PCX*:
  ID_VENDOR_FROM_DATABASE=PC Xperten
 
@ -314,7 +314,7 @@
 acpi:PDM*:
  ID_VENDOR_FROM_DATABASE=Psion Dacom Plc.
 
-@@ -5569,9 +5643,6 @@
+@@ -5572,9 +5646,6 @@
 acpi:PHE*:
  ID_VENDOR_FROM_DATABASE=Philips Medical Systems Boeblingen GmbH
 
@ -324,7 +324,7 @@
 acpi:PHL*:
  ID_VENDOR_FROM_DATABASE=Philips Consumer Electronics Company
 
-@@ -5662,9 +5733,6 @@
+@@ -5665,9 +5736,6 @@
 acpi:PNL*:
  ID_VENDOR_FROM_DATABASE=Panelview, Inc.
 
@ -334,7 +334,7 @@
 acpi:PNR*:
  ID_VENDOR_FROM_DATABASE=Planar Systems, Inc.
 
-@@ -6142,9 +6210,6 @@
+@@ -6145,9 +6213,6 @@
 acpi:RTI*:
  ID_VENDOR_FROM_DATABASE=Rancho Tech Inc
 
@ -344,7 +344,7 @@
 acpi:RTL*:
  ID_VENDOR_FROM_DATABASE=Realtek Semiconductor Company Ltd
 
-@@ -6319,9 +6384,6 @@
+@@ -6322,9 +6387,6 @@
 acpi:SEE*:
  ID_VENDOR_FROM_DATABASE=SeeColor Corporation
 
@ -354,7 +354,7 @@
 acpi:SEI*:
  ID_VENDOR_FROM_DATABASE=Seitz & Associates Inc
 
-@@ -6805,6 +6867,9 @@
+@@ -6808,6 +6870,9 @@
 acpi:SVD*:
  ID_VENDOR_FROM_DATABASE=SVD Computer
 
@ -364,7 +364,7 @@
 acpi:SVI*:
  ID_VENDOR_FROM_DATABASE=Sun Microsystems
 
-@@ -6889,6 +6954,9 @@
+@@ -6892,6 +6957,9 @@
 acpi:SZM*:
  ID_VENDOR_FROM_DATABASE=Shenzhen MTC Co., Ltd
 
@ -374,7 +374,7 @@
 acpi:TAA*:
  ID_VENDOR_FROM_DATABASE=Tandberg
 
-@@ -6979,6 +7047,9 @@
+@@ -6982,6 +7050,9 @@
 acpi:TDG*:
  ID_VENDOR_FROM_DATABASE=Six15 Technologies
 
@ -384,7 +384,7 @@
 acpi:TDM*:
  ID_VENDOR_FROM_DATABASE=Tandem Computer Europe Inc
 
-@@ -7021,6 +7092,9 @@
+@@ -7024,6 +7095,9 @@
 acpi:TEV*:
  ID_VENDOR_FROM_DATABASE=Televés, S.A.
 
@ -394,7 +394,7 @@
 acpi:TEZ*:
  ID_VENDOR_FROM_DATABASE=Tech Source Inc.
 
-@@ -7150,9 +7224,6 @@
+@@ -7153,9 +7227,6 @@
 acpi:TNC*:
  ID_VENDOR_FROM_DATABASE=TNC Industrial Company Ltd
 
@ -404,7 +404,7 @@
 acpi:TNM*:
  ID_VENDOR_FROM_DATABASE=TECNIMAGEN SA
 
-@@ -7465,14 +7536,14 @@
+@@ -7468,14 +7539,14 @@
 acpi:UNC*:
  ID_VENDOR_FROM_DATABASE=Unisys Corporation
 
@ -425,7 +425,7 @@
 
 acpi:UNI*:
  ID_VENDOR_FROM_DATABASE=Uniform Industry Corp.
-@@ -7507,6 +7578,9 @@
+@@ -7510,6 +7581,9 @@
 acpi:USA*:
  ID_VENDOR_FROM_DATABASE=Utimaco Safeware AG
 
@ -435,7 +435,7 @@
 acpi:USD*:
  ID_VENDOR_FROM_DATABASE=U.S. Digital Corporation
 
-@@ -7768,9 +7842,6 @@
+@@ -7771,9 +7845,6 @@
 acpi:WAL*:
  ID_VENDOR_FROM_DATABASE=Wave Access
 
@ -445,7 +445,7 @@
 acpi:WAV*:
  ID_VENDOR_FROM_DATABASE=Wavephore
 
-@@ -7898,7 +7969,7 @@
+@@ -7901,7 +7972,7 @@
  ID_VENDOR_FROM_DATABASE=WyreStorm Technologies LLC
 
 acpi:WYS*:
@ -454,7 +454,7 @@
 
 acpi:WYT*:
  ID_VENDOR_FROM_DATABASE=Wooyoung Image & Information Co.,Ltd.
-@@ -7912,9 +7983,6 @@
+@@ -7915,9 +7986,6 @@
 acpi:XDM*:
  ID_VENDOR_FROM_DATABASE=XDM Ltd.
 
@ -464,7 +464,7 @@
 acpi:XES*:
  ID_VENDOR_FROM_DATABASE=Extreme Engineering Solutions, Inc.
 
-@@ -7948,9 +8016,6 @@
+@@ -7951,9 +8019,6 @@
 acpi:XNT*:
  ID_VENDOR_FROM_DATABASE=XN Technologies, Inc.
 
@ -474,7 +474,7 @@
 acpi:XQU*:
  ID_VENDOR_FROM_DATABASE=SHANGHAI SVA-DAV ELECTRONICS CO., LTD
 
-@@ -8017,6 +8082,9 @@
+@@ -8020,6 +8085,9 @@
 acpi:ZBX*:
  ID_VENDOR_FROM_DATABASE=Zebax Technologies
 
--- a/hwdb.d/20-usb-vendor-model.hwdb
+++ b/hwdb.d/20-usb-vendor-model.hwdb
@ -40403,9 +40403,15 @@ usb:v0B0Dp0000*
 usb:v0B0E*
 ID_VENDOR_FROM_DATABASE=GN Netcom

+usb:v0B0Ep0301*
+ ID_MODEL_FROM_DATABASE=Jabra EVOLVE 20
+
 usb:v0B0Ep0305*
 ID_MODEL_FROM_DATABASE=Jabra EVOLVE Link MS

+usb:v0B0Ep030C*
+ ID_MODEL_FROM_DATABASE=Jabra EVOLVE 65
+
 usb:v0B0Ep0311*
 ID_MODEL_FROM_DATABASE=Jabra EVOLVE 65

@ -40460,6 +40466,21 @@ usb:v0B0Ep2456*
 usb:v0B0Ep245E*
 ID_MODEL_FROM_DATABASE=Jabra Link 370

+usb:v0B0Ep248A*
+ ID_MODEL_FROM_DATABASE=Jabra Elite 85h
+
+usb:v0B0Ep24B8*
+ ID_MODEL_FROM_DATABASE=Jabra Evolve2 65
+
+usb:v0B0Ep24BB*
+ ID_MODEL_FROM_DATABASE=Jabra Evolve2 85
+
+usb:v0B0Ep24C9*
+ ID_MODEL_FROM_DATABASE=Jabra Link 380
+
+usb:v0B0Ep24CA*
+ ID_MODEL_FROM_DATABASE=Jabra Link 380
+
 usb:v0B0Ep620C*
 ID_MODEL_FROM_DATABASE=Jabra BT620s

--- a/hwdb.d/60-sensor.hwdb
+++ b/hwdb.d/60-sensor.hwdb
@ -778,6 +778,10 @@ sensor:modalias:acpi:*BOSC0200*:dmi:*:svnLENOVO*:pn80XE:*
 sensor:modalias:acpi:*BOSC0200*:dmi:*:svnLENOVO*:pn80U1:*
 ACCEL_MOUNT_MATRIX=0, -1, 0; -1, 0, 0; 0, 0, 1

+# Legion Go
+sensor:modalias:platform:HID-SENSOR-200073:dmi:*svnLENOVO:pn83E1:*
+ ACCEL_MOUNT_MATRIX=0,1,0;-1,0,0;0,0,1
+
 # Yoga 300-11IBR, display sensor
 sensor:modalias:acpi:DUAL250E*:dmi:*:svnLENOVO:*:pvrLenovoYoga300-11IBR:*
 ACCEL_MOUNT_MATRIX=0, -1, 0; -1, 0, 0; 0, 0, 1
@ -1050,6 +1054,11 @@ sensor:modalias:acpi:KIOX010A*:dmi:bvn*:bvr*:svnPositivoTecnologiaSA:pn*:pvr*:rv
 ACCEL_MOUNT_MATRIX=-1, 0, 0; 0, 1, 0; 0, 0, 1
 ACCEL_LOCATION=display

+# Positivo Duo K116J
+sensor:modalias:acpi:MDA6655*:dmi:bvn*:bvr*:svnPositivoTecnologiaSA:pn*:pvr*:rvnPositivoTecnologiaSA:rnK116J*
+ ACCEL_MOUNT_MATRIX=0, 1, 0; 1, 0, 0; 0, 0, 1
+ ACCEL_LOCATION=display
+
 ########################################
 # Predia
 #########################################
--- a/hwdb.d/70-analyzers.hwdb
+++ b/hwdb.d/70-analyzers.hwdb
@ -16,6 +16,61 @@
 usb:v1209p4D69*
 ID_SIGNAL_ANALYZER=1

+###########################################################
+# Hantek DSO-6022 oscilloscopes and compatible devices
+###########################################################
+# Hantek DSO-6022BE w/o FW
+usb:v04B4p6022*
+ ID_SIGNAL_ANALYZER=1
+
+# Hantek DSO-6022BE with FW
+usb:v04B5p6022*
+ ID_SIGNAL_ANALYZER=1
+
+# Hantek DSO-6022BL w/o FW
+usb:v04B4p602A*
+ ID_SIGNAL_ANALYZER=1
+
+# Hantek DSO-6022BL with FW
+usb:v04B5p602A*
+ ID_SIGNAL_ANALYZER=1
+
+# Hantek DSO-6021 w/o FW
+usb:v04B4p6021*
+ ID_SIGNAL_ANALYZER=1
+
+# Hantek DSO-6021 with FW
+usb:v04B5p6021*
+ ID_SIGNAL_ANALYZER=1
+
+# Voltcraft DSO-2020, w/o FW, becomes DSO-6022BE with FW
+usb:v04B4p2020*
+ ID_SIGNAL_ANALYZER=1
+
+# YiXingDianZiKeJi MDSO w/o FW
+usb:vD4A2p5660*
+ ID_SIGNAL_ANALYZER=1
+
+# YiXingDianZiKeJi MDSO with FW
+usb:v1D50p608E*
+ ID_SIGNAL_ANALYZER=1
+
+# BUUDAI DDS120 w/o FW
+usb:v8102p8102*
+ ID_SIGNAL_ANALYZER=1
+
+# BUUDAI DDS120 with FW
+usb:v04B5p0120*
+ ID_SIGNAL_ANALYZER=1
+
+# Instrustar isds-205b w/o FW
+usb:vD4A2p5661*
+ ID_SIGNAL_ANALYZER=1
+
+# Instrustar isds-205b with FW
+usb:v1D50p1D50*
+ ID_SIGNAL_ANALYZER=1
+
 ###########################################################
 # Total Phase
 ###########################################################
--- a/hwdb.d/70-mouse.hwdb
+++ b/hwdb.d/70-mouse.hwdb
@ -821,6 +821,20 @@ mouse:usb:v22d4p1308:name:Laview Technology Mionix Avior 7000:*
 mouse:usb:v0e8fp00a7:name:DaKai 2.4G RX:*
 MOUSE_DPI=*800@126 1600@126

+##########################################
+# Nulea
+##########################################
+
+# Note: it is possible that other devices may use the same wireless dongle,
+# as such this could require revisiting if it causes issues with other mice
+# Nulea M501 Wireless Trackball (USB Receiver)
+mouse:usb:v25a7pfa61:name:Compx 2.4G Receiver Mouse:*
+ ID_INPUT_TRACKBALL=1
+
+# Nulea M501 Wireless Trackball (Bluetooth)
+mouse:bluetooth:v000ep3412:name:Nulea BT5.0 Mouse:*
+ ID_INPUT_TRACKBALL=1
+
 ##########################################
 # Oklick
 ##########################################
--- a/hwdb.d/70-software-radio.hwdb
+++ b/hwdb.d/70-software-radio.hwdb
@ -21,6 +21,17 @@
 # Allowed properties are:
 #   ID_SOFTWARE_RADIO=0|1

+##########################################
+# Airspy
+##########################################
+# Airspy R2
+usb:v1D50p60A1*
+ ID_SOFTWARE_RADIO=1
+
+# Airspy HF+
+usb:v03EBp800C*
+ ID_SOFTWARE_RADIO=1
+
 ##########################################
 # Analog Devices
 ##########################################
@ -48,10 +59,54 @@ usb:v2500p0002*
 usb:v2500p0020*
 usb:v2500p0021*
 usb:v2500p0022*
+usb:v2500p0023*
 usb:v3923p7813*
 usb:v3923p7814*
 ID_SOFTWARE_RADIO=1

+##########################################
+# FUNcube
+##########################################
+# FUNcube Dongle Pro
+usb:v04D8pFB56*
+ ID_SOFTWARE_RADIO=1
+
+# FUNcube Dongle Pro+
+usb:v04D8pFB31*
+ ID_SOFTWARE_RADIO=1
+
+##########################################
+# Great Scott Gadgets
+##########################################
+# HackRF Jawbreaker
+usb:v1D50p604B*
+ ID_SOFTWARE_RADIO=1
+
+# HackRF One
+usb:v1D50p6089*
+ ID_SOFTWARE_RADIO=1
+
+##########################################
+# HydraSDR
+##########################################
+# HydraSDR RFOne
+usb:v38AFp0001*
+ ID_SOFTWARE_RADIO=1
+
+##########################################
+# LimeSDR
+##########################################
+# XTRX (USB3380)
+usb:v0525p3380*
+ ID_SOFTWARE_RADIO=1
+
+##########################################
+# Microtelecom
+##########################################
+# Perseus
+usb:v04B4p325C*
+ ID_SOFTWARE_RADIO=1
+
 ##########################################
 # Nuand
 ##########################################
@ -237,3 +292,34 @@ usb:v1F4DpD286*
 # PROlectrix DV107669 (FC0012)
 usb:v1F4DpD803*
 ID_SOFTWARE_RADIO=1
+
+##########################################
+# SDRplay
+##########################################
+# RSP1
+usb:v1DF7p2500*
+ ID_SOFTWARE_RADIO=1
+
+# RSP1A
+usb:v1DF7p3000*
+ ID_SOFTWARE_RADIO=1
+
+# RSP2/RSP2pro
+usb:v1DF7p3010*
+ ID_SOFTWARE_RADIO=1
+
+# RSPduo
+usb:v1DF7p3020*
+ ID_SOFTWARE_RADIO=1
+
+# RSPdx
+usb:v1DF7p3030*
+ ID_SOFTWARE_RADIO=1
+
+# RSP1B
+usb:v1DF7p3050*
+ ID_SOFTWARE_RADIO=1
+
+# RSPdxR2
+usb:v1DF7p3060*
+ ID_SOFTWARE_RADIO=1
--- a/hwdb.d/acpi_id_registry.csv
+++ b/hwdb.d/acpi_id_registry.csv
@ -137,4 +137,5 @@ IDEMIA,IDEM,06/26/2018
 "JUMPtec GmbH",JUMP,04/22/2025
 "Fsas Technologies Inc.",FSAS,04/30/2025
 "JP Morgan Chase N.A.",JPMC,05/30/2025
-"Roku, Inc.",ROKU,07/15/2025
+"Roku, Inc.",ROKU,07/15/2025
+"UltraRISC Technology (Shanghai) Co., Ltd",ULRV,09/15/2025
--- a/hwdb.d/ma-large.txt
+++ b/hwdb.d/ma-large.txt
--- a/hwdb.d/ma-medium.txt
+++ b/hwdb.d/ma-medium.txt
--- a/hwdb.d/ma-small.txt
+++ b/hwdb.d/ma-small.txt
--- a/hwdb.d/usb.ids
+++ b/hwdb.d/usb.ids
@ -9,8 +9,8 @@
 #	The latest version can be obtained from
 #		http://www.linux-usb.org/usb.ids
 #
-# Version: 2025.07.26
-# Date:    2025-07-26 20:34:01
+# Version: 2025.09.15
+# Date:    2025-09-15 20:34:02
 #

 # Vendors, devices and interfaces. Please keep sorted.
@ -13488,7 +13488,9 @@
 0b0d  ProjectLab
 	0000  CenturyCD
 0b0e  GN Netcom
+	0301  Jabra EVOLVE 20
 	0305  Jabra EVOLVE Link MS
+	030c  Jabra EVOLVE 65
 	0311  Jabra EVOLVE 65
 	0312  enc060:Buttons Volume up/down/mute + phone [Jabra]
 	0343  Jabra UC VOICE 150a
@ -13507,6 +13509,11 @@
 	2007  GN 2000 Stereo Corded Headset
 	2456  Jabra SPEAK 810
 	245e  Jabra Link 370
+	248a  Jabra Elite 85h
+	24b8  Jabra Evolve2 65
+	24bb  Jabra Evolve2 85
+	24c9  Jabra Link 380
+	24ca  Jabra Link 380
 	620c  Jabra BT620s
 	9330  Jabra GN9330 Headset
 	a346  Jabra Engage 75 Stereo
--- a/man/homectl.xml
+++ b/man/homectl.xml
@ -179,6 +179,16 @@
        <xi:include href="version-info.xml" xpointer="v256"/></listitem>
      </varlistentry>

+      <varlistentry>
+        <term><option>--prompt-new-user</option></term>
+
+        <listitem><para>If used in conjunction with <command>firstboot</command> and no regular user account
+        exists on the system so far the tool will interactively query for user information and create an
+        account.</para>
+
+        <xi:include href="version-info.xml" xpointer="v256"/></listitem>
+      </varlistentry>
+
      <xi:include href="user-system-options.xml" xpointer="host" />
      <xi:include href="user-system-options.xml" xpointer="machine" />

@ -1212,9 +1222,10 @@

        <listitem><para>This command is supposed to be invoked during the initial boot of the system. It
        checks whether any regular home area exists so far, and if not queries the user interactively on the
-        console for user name and password and creates one. Alternatively, if one or more service credentials
-        whose name starts with <literal>home.create.</literal> are passed to the command (containing a user
-        record in JSON format) these users are automatically created at boot.</para>
+        console for user name and password and creates one (only if <option>--prompt-new-user</option> is
+        specified). Alternatively, if one or more service credentials whose name starts with
+        <literal>home.create.</literal> are passed to the command (containing a user record in JSON format)
+        these users are automatically created at boot.</para>

        <para>This command is invoked by the <filename>systemd-homed-firstboot.service</filename> service
        unit.</para>
--- a/man/journalctl.xml
+++ b/man/journalctl.xml
@ -737,8 +737,8 @@
      <varlistentry>
        <term><option>--no-hostname</option></term>

-        <listitem><para>Do not show the hostname field of log messages originating from the local host. This
-        switch has an effect only on the <option>short</option> family of output modes (see above).</para>
+        <listitem><para>Do not show the hostname field of log messages. This switch has an effect only on the
+        <option>short</option> family of output modes (see above).</para>

        <para>Note: this option does not remove occurrences of the hostname from log entries themselves, so
        it does not prevent the hostname from being visible in the logs.</para>
--- a/man/sd-journal.xml
+++ b/man/sd-journal.xml
@ -75,13 +75,14 @@
  <refsect1>
    <title>Thread safety</title>

-    <para>Functions that operate on <structname>sd_journal</structname> objects are thread agnostic — given
-    <structname>sd_journal</structname> pointer may only be used from one specific thread at all times (and it has to
-    be the very same one during the entire lifetime of the object), but multiple, independent threads may use multiple,
-    independent objects safely. Other functions — those that are used to send entries to the journal, like
-    <citerefentry><refentrytitle>sd_journal_print</refentrytitle><manvolnum>3</manvolnum></citerefentry> and similar,
-    or those that are used to retrieve global information like
-    <citerefentry><refentrytitle>sd_journal_stream_fd</refentrytitle><manvolnum>3</manvolnum></citerefentry> and
+    <para>Functions that operate on <structname>sd_journal</structname> objects are thread agnostic — a given
+    <structname>sd_journal</structname> pointer may only be used from one thread at a time, but multiple
+    independent threads may use multiple objects concurrently. Some functions — those that are used to send
+    entries to the journal, like
+    <citerefentry><refentrytitle>sd_journal_print</refentrytitle><manvolnum>3</manvolnum></citerefentry> and
+    similar, or those that are used to retrieve global information like
+    <citerefentry><refentrytitle>sd_journal_stream_fd</refentrytitle><manvolnum>3</manvolnum></citerefentry>
+    and
    <citerefentry><refentrytitle>sd_journal_get_catalog_for_message_id</refentrytitle><manvolnum>3</manvolnum></citerefentry>
    — are fully thread-safe and may be called from multiple threads in parallel.</para>
  </refsect1>
--- a/man/sd-login.xml
+++ b/man/sd-login.xml
@ -41,10 +41,10 @@
    system.</para>

    <para>Note that these APIs only allow purely passive access and
-    monitoring of seats, sessions and users. To actively make changes
+    monitoring of seats, sessions, and users. To actively make changes
    to the seat configuration, terminate login sessions, or switch
    session on a seat you need to utilize the D-Bus API of
-    systemd-logind, instead.</para>
+    systemd-logind instead.</para>

    <para>These functions synchronously access data in
    <filename>/proc/</filename>, <filename>/sys/fs/cgroup/</filename>
@ -62,7 +62,7 @@
    other.</para>

    <para>If the functions return string arrays, these are generally
-    <constant>NULL</constant> terminated and need to be freed by the
+    <constant>NULL</constant>-terminated and need to be freed by the
    caller with the libc
    <citerefentry project='man-pages'><refentrytitle>free</refentrytitle><manvolnum>3</manvolnum></citerefentry>
    call after use, including the strings referenced therein.
--- a/man/sd_bus_can_send.xml
+++ b/man/sd_bus_can_send.xml
@ -27,7 +27,7 @@
      <funcsynopsisinfo>#include &lt;systemd/sd-bus.h&gt;</funcsynopsisinfo>

      <funcprototype>
-        <funcdef>void <function>sd_bus_can_send</function></funcdef>
+        <funcdef>int <function>sd_bus_can_send</function></funcdef>
        <paramdef>sd_bus *<parameter>bus</parameter></paramdef>
        <paramdef>char <parameter>type</parameter></paramdef>
      </funcprototype>
--- a/man/sd_bus_track_new.xml
+++ b/man/sd_bus_track_new.xml
@ -33,6 +33,12 @@
    <funcsynopsis>
      <funcsynopsisinfo>#include &lt;systemd/sd-bus.h&gt;</funcsynopsisinfo>

+      <funcprototype>
+        <funcdef>typedef int (*<function>sd_bus_track_handler_t</function>)</funcdef>
+        <paramdef>sd_bus_track *<parameter>track</parameter></paramdef>
+        <paramdef>void *<parameter>userdata</parameter></paramdef>
+      </funcprototype>
+
      <funcprototype>
        <funcdef>int <function>sd_bus_track_new</function></funcdef>
        <paramdef>sd_bus* <parameter>bus</parameter></paramdef>
@ -221,6 +227,7 @@
  <refsect1>
    <title>History</title>
    <para><function>sd_bus_track_new()</function>,
+    <function>sd_bus_track_handler_t()</function>,
    <function>sd_bus_track_ref()</function>,
    <function>sd_bus_track_unref()</function>,
    <function>sd_bus_track_unrefp()</function>,
--- a/man/sd_journal_get_catalog.xml
+++ b/man/sd_journal_get_catalog.xml
@ -84,14 +84,12 @@
  <refsect1>
    <title>Notes</title>

-    <para>Function <function>sd_journal_get_catalog()</function> is thread-agnostic and only
-    a single specific thread may operate on a given object during its entire lifetime. It is safe to allocate multiple
-    independent objects and use each from a specific thread in parallel. However, it is not safe to allocate such an
-    object in one thread, and operate or free it from any other, even if locking is used to ensure these threads do not
-    operate on it at the very same time.</para>
+    <para>Function <function>sd_journal_get_catalog()</function> is thread-agnostic and only a single thread
+    may operate on a given object at any given time. Multiple independent objects may be used from different
+    threads in parallel.</para>

-    <para>Function <function>sd_journal_get_catalog_for_message_id()</function> is are thread-safe and may be called in
-    parallel from multiple threads.</para>
+    <para>Function <function>sd_journal_get_catalog_for_message_id()</function> is thread-safe and may be
+    called from multiple threads in parallel.</para>

    <xi:include href="libsystemd-pkgconfig.xml" xpointer="pkgconfig-text"/>
  </refsect1>
--- a/man/systemd-userdbd.service.xml
+++ b/man/systemd-userdbd.service.xml
@ -35,7 +35,9 @@
    compatibility. It may also pick up statically defined JSON user/group records from files in
    <filename>/etc/userdb/</filename>, <filename>/run/userdb/</filename>,
    <filename>/run/host/userdb/</filename> and <filename>/usr/lib/userdb/</filename> with the
-    <literal>.user</literal> or <literal>.group</literal> extension.</para>
+    <literal>.user</literal> or <literal>.group</literal> extension. For more details about the extensions
+    read the <citerefentry><refentrytitle>nss-systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+    manpage.</para>

    <para>Most of <command>systemd-userdbd</command>'s functionality is accessible through the
    <citerefentry><refentrytitle>userdbctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
--- a/man/systemd.resource-control.xml
+++ b/man/systemd.resource-control.xml
@ -583,7 +583,7 @@ CPUWeight=20   DisableControllers=cpu              /          \
          an absolute number of tasks or a percentage value that is taken relative to the configured maximum
          number of tasks on the system. If assigned the special value <literal>infinity</literal>, no tasks
          limit is applied. This controls the <literal>pids.max</literal> control group attribute. For
-          details about this control group attribute, the
+          details about this control group attribute, see the
          <ulink url="https://docs.kernel.org/admin-guide/cgroup-v2.html#pid">pids controller
          </ulink>.
          The effective configuration is reported as <varname>EffectiveTasksMax=</varname>.</para>
--- a/man/threads-aware.xml
+++ b/man/threads-aware.xml
@ -6,10 +6,9 @@
 <refsect1>
  <title/>

-  <para id="strict">All functions listed here are thread-agnostic and only a single specific thread may operate on a
-  given object during its entire lifetime. It is safe to allocate multiple independent objects and use each from a
-  specific thread in parallel. However, it is not safe to allocate such an object in one thread, and operate or free it
-  from any other, even if locking is used to ensure these threads do not operate on it at the very same time.</para>
+  <para id="strict">All functions listed here are thread-agnostic and only a single thread may operate on a
+  given object at any given time. Different threads may access the same object at different times. Multiple
+  independent objects may be used from different threads in parallel.</para>

  <para id="safe">All functions listed here are thread-safe and may be called in parallel from multiple threads.</para>

--- a/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf
+++ b/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf
@ -37,6 +37,7 @@ Packages=
        btrfs-progs
        apt
        bind9-dnsutils
+        bsdutils
        cryptsetup-bin
        dbus-broker
        dbus-user-session
--- a/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/knot.conf
+++ b/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/knot.conf
@ -0,0 +1,26 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+# New package needed for TEST-75-RESOLVED
+
+[TriggerMatch]
+Distribution=debian
+Release=!bullseye
+Release=!bookworm
+Release=!trixie
+# TODO: drop once Duke ships
+Release=!oldstable
+# TODO: drop once Forky ships
+Release=!stable
+
+[TriggerMatch]
+Distribution=ubuntu
+Release=!jammy
+Release=!noble
+Release=!plucky
+Release=!questing
+
+[TriggerMatch]
+Distribution=kali
+
+[Content]
+Packages=knot-keymgr
--- a/mkosi/mkosi.sanitizers/mkosi.postinst
+++ b/mkosi/mkosi.sanitizers/mkosi.postinst
@ -75,6 +75,7 @@ wrap=(
    setpriv
    sshd
    stat
+    stress-ng
    su
    tar
    tgtd
--- a/shell-completion/zsh/_journalctl
+++ b/shell-completion/zsh/_journalctl
@ -99,7 +99,7 @@ _arguments -s \
    '(- *)'{-h,--help}'[Show this help]' \
    '(- *)--version[Show package version]' \
    '--no-pager[Do not pipe output into a pager]' \
-    --no-hostname"[Don't show the hostname of local log messages]" \
+    --no-hostname"[Don't show the hostname of log messages]" \
    '(-l --full)'{-l,--full}'[Show long fields in full]' \
    '(-a --all)'{-a,--all}'[Show all fields, including long and unprintable]' \
    '(-f --follow)'{-f,--follow}'[Follow journal]' \
--- a/src/basic/efivars.c
+++ b/src/basic/efivars.c
@ -6,6 +6,7 @@
 #include <linux/fs.h>
 #include <stdlib.h>
 #include <sys/stat.h>
+#include <sys/uio.h>
 #include <unistd.h>

 #include "sd-id128.h"
@ -37,12 +38,7 @@ int efi_get_variable(
                void **ret_value,
                size_t *ret_size) {

-        _cleanup_close_ int fd = -EBADF;
-        _cleanup_free_ void *buf = NULL;
-        struct stat st;
        usec_t begin = 0; /* Unnecessary initialization to appease gcc */
-        uint32_t a;
-        ssize_t n;

        assert(variable);

@ -62,79 +58,100 @@ int efi_get_variable(
                begin = now(CLOCK_MONOTONIC);
        }

-        fd = open(p, O_RDONLY|O_NOCTTY|O_CLOEXEC);
+        _cleanup_close_ int fd = open(p, O_RDONLY|O_NOCTTY|O_CLOEXEC);
        if (fd < 0)
                return log_debug_errno(errno, "open(\"%s\") failed: %m", p);

-        if (fstat(fd, &st) < 0)
-                return log_debug_errno(errno, "fstat(\"%s\") failed: %m", p);
-        if (st.st_size < 4)
-                return log_debug_errno(SYNTHETIC_ERRNO(ENODATA), "EFI variable %s is shorter than 4 bytes, refusing.", p);
-        if (st.st_size > 4*1024*1024 + 4)
-                return log_debug_errno(SYNTHETIC_ERRNO(E2BIG), "EFI variable %s is ridiculously large, refusing.", p);
+        uint32_t attr;
+        _cleanup_free_ char *buf = NULL;
+        ssize_t n;

-        if (ret_value || ret_attribute) {
-                /* The kernel ratelimits reads from the efivarfs because EFI is inefficient, and we'll
-                 * occasionally fail with EINTR here. A slowdown is better than a failure for us, so
-                 * retry a few times and eventually fail with -EBUSY.
-                 *
-                 * See https://github.com/torvalds/linux/blob/master/fs/efivarfs/file.c#L75
-                 * and
-                 * https://github.com/torvalds/linux/commit/bef3efbeb897b56867e271cdbc5f8adaacaeb9cd.
-                 */
-                for (unsigned try = 0;; try++) {
-                        n = read(fd, &a, sizeof(a));
-                        if (n >= 0)
-                                break;
-                        log_debug_errno(errno, "Reading from \"%s\" failed: %m", p);
-                        if (errno != EINTR)
-                                return -errno;
-                        if (try >= EFI_N_RETRIES_TOTAL)
-                                return -EBUSY;
+        /* The kernel ratelimits reads from the efivarfs because EFI is inefficient, and we'll occasionally
+         * fail with EINTR here. A slowdown is better than a failure for us, so retry a few times and
+         * eventually fail with -EBUSY.
+         *
+         * See https://github.com/torvalds/linux/blob/master/fs/efivarfs/file.c#L75 and
+         * https://github.com/torvalds/linux/commit/bef3efbeb897b56867e271cdbc5f8adaacaeb9cd.
+         *
+         * The variable may also be overwritten between the stat and read. If we find out that the new
+         * contents are longer, try again.
+         */
+        for (unsigned try = 0;; try++) {
+                struct stat st;

-                        if (try >= EFI_N_RETRIES_NO_DELAY)
-                                (void) usleep_safe(EFI_RETRY_DELAY);
-                }
-
-                /* Unfortunately kernel reports EOF if there's an inconsistency between efivarfs var list
-                 * and what's actually stored in firmware, c.f. #34304. A zero size env var is not allowed in
-                 * efi and hence the variable doesn't really exist in the backing store as long as it is zero
-                 * sized, and the kernel calls this "uncommitted". Hence we translate EOF back to ENOENT here,
-                 * as with kernel behavior before
-                 * https://github.com/torvalds/linux/commit/3fab70c165795431f00ddf9be8b84ddd07bd1f8f
-                 *
-                 * If the kernel changes behaviour (to flush dentries on resume), we can drop
-                 * this at some point in the future. But note that the commit is 11
-                 * years old at this point so we'll need to deal with the current behaviour for
-                 * a long time.
-                 */
-                if (n == 0)
+                if (fstat(fd, &st) < 0)
+                        return log_debug_errno(errno, "fstat(\"%s\") failed: %m", p);
+                if (st.st_size == 0)
                        return log_debug_errno(SYNTHETIC_ERRNO(ENOENT),
                                               "EFI variable %s is uncommitted", p);
+                if (st.st_size < 4)
+                        return log_debug_errno(SYNTHETIC_ERRNO(ENODATA), "EFI variable %s is shorter than 4 bytes, refusing.", p);
+                if (st.st_size > 4*1024*1024 + 4)
+                        return log_debug_errno(SYNTHETIC_ERRNO(E2BIG), "EFI variable %s is ridiculously large, refusing.", p);

-                if (n != sizeof(a))
-                        return log_debug_errno(SYNTHETIC_ERRNO(EIO),
-                                               "Read %zi bytes from EFI variable %s, expected %zu.",  n, p, sizeof(a));
+                if (!ret_attribute && !ret_value) {
+                        /* No need to read anything, return the reported size. */
+                        n = st.st_size;
+                        break;
+                }
+
+                /* We want +1 for the read call, and +3 for the additional terminating bytes added below. */
+                char *t = realloc(buf, (size_t) st.st_size + MAX(1, 3));
+                if (!t)
+                        return -ENOMEM;
+                buf = t;
+
+                const struct iovec iov[] = {
+                        { &attr, sizeof(attr) },
+                        { buf, (size_t) st.st_size + 1 },
+                };
+
+                n = readv(fd, iov, 2);
+                assert(n <= st.st_size + 1);
+                if (n == st.st_size + 1)
+                        /* We need to try again with a bigger buffer. */
+                        continue;
+                if (n >= 0)
+                        break;
+
+                log_debug_errno(errno, "Reading from \"%s\" failed: %m", p);
+                if (errno != EINTR)
+                        return -errno;
+                if (try >= EFI_N_RETRIES_TOTAL)
+                        return -EBUSY;
+                if (try >= EFI_N_RETRIES_NO_DELAY)
+                        (void) usleep_safe(EFI_RETRY_DELAY);
        }

+        /* Unfortunately kernel reports EOF if there's an inconsistency between efivarfs var list and
+         * what's actually stored in firmware, c.f. #34304. A zero size env var is not allowed in EFI
+         * and hence the variable doesn't really exist in the backing store as long as it is zero
+         * sized, and the kernel calls this "uncommitted". Hence we translate EOF back to ENOENT
+         * here, as with kernel behavior before
+         * https://github.com/torvalds/linux/commit/3fab70c165795431f00ddf9be8b84ddd07bd1f8f.
+         *
+         * If the kernel changes behaviour (to flush dentries on resume), we can drop this at some
+         * point in the future. But note that the commit is 11 years old at this point so we'll need
+         * to deal with the current behaviour for a long time.
+         */
+        if (n == 0)
+                return log_debug_errno(SYNTHETIC_ERRNO(ENOENT),
+                                       "EFI variable %s is uncommitted", p);
+        if (n < 4)
+                return log_debug_errno(SYNTHETIC_ERRNO(EIO),
+                                       "Read %zi bytes from EFI variable %s, expected >= 4", n, p);
+
+        if (ret_attribute)
+                *ret_attribute = attr;
        if (ret_value) {
-                buf = malloc(st.st_size - 4 + 3);
-                if (!buf)
-                        return -ENOMEM;
-
-                n = read(fd, buf, (size_t) st.st_size - 4);
-                if (n < 0)
-                        return log_debug_errno(errno, "Failed to read value of EFI variable %s: %m", p);
-                assert(n <= st.st_size - 4);
-
-                /* Always NUL-terminate (3 bytes, to properly protect UTF-16, even if truncated in the middle
-                 * of a character) */
-                ((char*) buf)[n] = 0;
-                ((char*) buf)[n + 1] = 0;
-                ((char*) buf)[n + 2] = 0;
-        } else
-                /* Assume that the reported size is accurate */
-                n = st.st_size - 4;
+                assert(buf);
+                /* Always NUL-terminate (3 bytes, to properly protect UTF-16, even if truncated in
+                 * the middle of a character) */
+                buf[n - 4] = 0;
+                buf[n - 4 + 1] = 0;
+                buf[n - 4 + 2] = 0;
+                *ret_value = TAKE_PTR(buf);
+        }

        if (DEBUG_LOGGING) {
                usec_t end = now(CLOCK_MONOTONIC);
@ -146,14 +163,8 @@ int efi_get_variable(
        /* Note that efivarfs interestingly doesn't require ftruncate() to update an existing EFI variable
         * with a smaller value. */

-        if (ret_attribute)
-                *ret_attribute = a;
-
-        if (ret_value)
-                *ret_value = TAKE_PTR(buf);
-
        if (ret_size)
-                *ret_size = n;
+                *ret_size = n - 4;

        return 0;
 }
--- a/src/basic/fd-util.c
+++ b/src/basic/fd-util.c
@ -1058,10 +1058,9 @@ int fd_get_diskseq(int fd, uint64_t *ret) {
 }

 int path_is_root_at(int dir_fd, const char *path) {
-        _cleanup_close_ int fd = -EBADF, pfd = -EBADF;
-
        assert(dir_fd >= 0 || dir_fd == AT_FDCWD);

+        _cleanup_close_ int fd = -EBADF;
        if (!isempty(path)) {
                fd = openat(dir_fd, path, O_PATH|O_DIRECTORY|O_CLOEXEC);
                if (fd < 0)
@ -1070,19 +1069,19 @@ int path_is_root_at(int dir_fd, const char *path) {
                dir_fd = fd;
        }

-        pfd = openat(dir_fd, "..", O_PATH|O_DIRECTORY|O_CLOEXEC);
-        if (pfd < 0)
-                return errno == ENOTDIR ? false : -errno;
+        _cleanup_close_ int root_fd = openat(AT_FDCWD, "/", O_PATH|O_DIRECTORY|O_CLOEXEC);
+        if (root_fd < 0)
+                return -errno;

-        /* Even if the parent directory has the same inode, the fd may not point to the root directory "/",
-         * and we also need to check that the mount ids are the same. Otherwise, a construct like the
-         * following could be used to trick us:
+        /* Even if the root directory has the same inode as our fd, the fd may not point to the root
+         * directory "/", and we also need to check that the mount ids are the same. Otherwise, a construct
+         * like the following could be used to trick us:
         *
-         * $ mkdir /tmp/x /tmp/x/y
-         * $ mount --bind /tmp/x /tmp/x/y
+         * $ mkdir /tmp/x
+         * $ mount --bind / /tmp/x
         */

-        return fds_are_same_mount(dir_fd, pfd);
+        return fds_are_same_mount(dir_fd, root_fd);
 }

 int fds_are_same_mount(int fd1, int fd2) {
--- a/src/basic/fs-util.c
+++ b/src/basic/fs-util.c
@ -293,15 +293,20 @@ int fchmod_opath(int fd, mode_t m) {
         * - fchmod(2) only operates on open files (i. e., fds with an open file description);
         * - fchmodat(2) does not have a flag arg like fchownat(2) does, so no way to pass AT_EMPTY_PATH;
         *   + it should not be confused with the libc fchmodat(3) interface, which adds 4th flag argument,
-         *     but does not support AT_EMPTY_PATH (only supports AT_SYMLINK_NOFOLLOW);
+         *     and supports AT_EMPTY_PATH since v2.39 (previously only supported AT_SYMLINK_NOFOLLOW). So if
+         *     the kernel has fchmodat2(2), since v2.39 glibc will call into it directly. If the kernel
+         *     doesn't, or glibc is older than v2.39, glibc's internal fallback will return EINVAL if
+         *     AT_EMPTY_PATH is passed.
         * - fchmodat2(2) supports all the AT_* flags, but is still very recent.
         *
-         * We try to use fchmodat2(), and, if it is not supported, resort
-         * to the /proc/self/fd dance. */
+         * We try to use fchmodat(3) first, and on EINVAL fall back to fchmodat2(), and, if that is also not
+         * supported, resort to the /proc/self/fd dance. */

        assert(fd >= 0);

-        if (fchmodat2(fd, "", m, AT_EMPTY_PATH) >= 0)
+        if (fchmodat(fd, "", m, AT_EMPTY_PATH) >= 0)
+                return 0;
+        if (errno == EINVAL && fchmodat2(fd, "", m, AT_EMPTY_PATH) >= 0) /* glibc too old? */
                return 0;
        if (!IN_SET(errno, ENOSYS, EPERM)) /* Some container managers block unknown syscalls with EPERM */
                return -errno;
--- a/src/basic/syscall-list.txt
+++ b/src/basic/syscall-list.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind
 bpf
+breakpoint
 brk
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat
 get_mempolicy
 get_robust_list
 get_thread_area
+get_tls
 getcpu
 getcwd
 getdents
@ -403,6 +405,7 @@ set_mempolicy_home_node
 set_robust_list
 set_thread_area
 set_tid_address
+set_tls
 setdomainname
 setfsgid
 setfsgid32
@ -511,6 +514,8 @@ unlinkat
 unshare
 uretprobe
 userfaultfd
+usr26
+usr32
 ustat
 utime
 utimensat
--- a/src/basic/syscalls-arm.txt
+++ b/src/basic/syscalls-arm.txt
@ -16,9 +16,10 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	282
 bpf	386
+breakpoint	983041
 brk	45
 cachectl
-cacheflush
+cacheflush	983042
 cachestat	451
 capget	184
 capset	185
@ -113,6 +114,7 @@ futimesat	326
 get_mempolicy	320
 get_robust_list	339
 get_thread_area
+get_tls	983046
 getcpu	345
 getcwd	183
 getdents	141
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	338
 set_thread_area
 set_tid_address	256
+set_tls	983045
 setdomainname	121
 setfsgid	139
 setfsgid32	216
@ -511,6 +514,8 @@ unlinkat	328
 unshare	337
 uretprobe
 userfaultfd	388
+usr26	983043
+usr32	983044
 ustat	62
 utime
 utimensat	348
--- a/src/basic/syscalls-arm64.txt
+++ b/src/basic/syscalls-arm64.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	200
 bpf	280
+breakpoint
 brk	214
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat
 get_mempolicy	236
 get_robust_list	100
 get_thread_area
+get_tls
 getcpu	168
 getcwd	17
 getdents
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	99
 set_thread_area
 set_tid_address	96
+set_tls
 setdomainname	162
 setfsgid	152
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	35
 unshare	97
 uretprobe
 userfaultfd	282
+usr26
+usr32
 ustat
 utime
 utimensat	88
--- a/src/basic/syscalls-i386.txt
+++ b/src/basic/syscalls-i386.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	361
 bpf	357
+breakpoint
 brk	45
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat	299
 get_mempolicy	275
 get_robust_list	312
 get_thread_area	244
+get_tls
 getcpu	318
 getcwd	183
 getdents	141
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	311
 set_thread_area	243
 set_tid_address	258
+set_tls
 setdomainname	121
 setfsgid	139
 setfsgid32	216
@ -511,6 +514,8 @@ unlinkat	301
 unshare	310
 uretprobe
 userfaultfd	374
+usr26
+usr32
 ustat	62
 utime	30
 utimensat	320
--- a/src/basic/syscalls-loongarch64.txt
+++ b/src/basic/syscalls-loongarch64.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	200
 bpf	280
+breakpoint
 brk	214
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat
 get_mempolicy	236
 get_robust_list	100
 get_thread_area
+get_tls
 getcpu	168
 getcwd	17
 getdents
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	99
 set_thread_area
 set_tid_address	96
+set_tls
 setdomainname	162
 setfsgid	152
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	35
 unshare	97
 uretprobe
 userfaultfd	282
+usr26
+usr32
 ustat
 utime
 utimensat	88
--- a/src/basic/syscalls-m68k.txt
+++ b/src/basic/syscalls-m68k.txt
@ -16,6 +16,7 @@ atomic_barrier	336
 atomic_cmpxchg_32	335
 bind	358
 bpf	354
+breakpoint
 brk	45
 cachectl
 cacheflush	123
@ -113,6 +114,7 @@ futimesat	292
 get_mempolicy	269
 get_robust_list	305
 get_thread_area	333
+get_tls
 getcpu	314
 getcwd	183
 getdents	141
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	304
 set_thread_area	334
 set_tid_address	253
+set_tls
 setdomainname	121
 setfsgid	139
 setfsgid32	216
@ -511,6 +514,8 @@ unlinkat	294
 unshare	303
 uretprobe
 userfaultfd	373
+usr26
+usr32
 ustat	62
 utime	30
 utimensat	316
--- a/src/basic/syscalls-mips64.txt
+++ b/src/basic/syscalls-mips64.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	5048
 bpf	5315
+breakpoint
 brk	5012
 cachectl	5198
 cacheflush	5197
@ -113,6 +114,7 @@ futimesat	5251
 get_mempolicy	5228
 get_robust_list	5269
 get_thread_area
+get_tls
 getcpu	5271
 getcwd	5077
 getdents	5076
@ -403,6 +405,7 @@ set_mempolicy_home_node	5450
 set_robust_list	5268
 set_thread_area	5242
 set_tid_address	5212
+set_tls
 setdomainname	5166
 setfsgid	5121
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	5253
 unshare	5262
 uretprobe
 userfaultfd	5317
+usr26
+usr32
 ustat	5133
 utime	5130
 utimensat	5275
--- a/src/basic/syscalls-mips64n32.txt
+++ b/src/basic/syscalls-mips64n32.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	6048
 bpf	6319
+breakpoint
 brk	6012
 cachectl	6198
 cacheflush	6197
@ -113,6 +114,7 @@ futimesat	6255
 get_mempolicy	6232
 get_robust_list	6273
 get_thread_area
+get_tls
 getcpu	6275
 getcwd	6077
 getdents	6076
@ -403,6 +405,7 @@ set_mempolicy_home_node	6450
 set_robust_list	6272
 set_thread_area	6246
 set_tid_address	6213
+set_tls
 setdomainname	6166
 setfsgid	6121
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	6257
 unshare	6266
 uretprobe
 userfaultfd	6321
+usr26
+usr32
 ustat	6133
 utime	6130
 utimensat	6279
--- a/src/basic/syscalls-mipso32.txt
+++ b/src/basic/syscalls-mipso32.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	4169
 bpf	4355
+breakpoint
 brk	4045
 cachectl	4148
 cacheflush	4147
@ -113,6 +114,7 @@ futimesat	4292
 get_mempolicy	4269
 get_robust_list	4310
 get_thread_area
+get_tls
 getcpu	4312
 getcwd	4203
 getdents	4141
@ -403,6 +405,7 @@ set_mempolicy_home_node	4450
 set_robust_list	4309
 set_thread_area	4283
 set_tid_address	4252
+set_tls
 setdomainname	4121
 setfsgid	4139
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	4294
 unshare	4303
 uretprobe
 userfaultfd	4357
+usr26
+usr32
 ustat	4062
 utime	4030
 utimensat	4316
--- a/src/basic/syscalls-parisc.txt
+++ b/src/basic/syscalls-parisc.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	22
 bpf	341
+breakpoint
 brk	45
 cachectl
 cacheflush	356
@ -113,6 +114,7 @@ futimesat	279
 get_mempolicy	261
 get_robust_list	290
 get_thread_area
+get_tls
 getcpu	296
 getcwd	110
 getdents	141
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	289
 set_thread_area
 set_tid_address	237
+set_tls
 setdomainname	121
 setfsgid	139
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	281
 unshare	288
 uretprobe
 userfaultfd	344
+usr26
+usr32
 ustat	62
 utime	30
 utimensat	301
--- a/src/basic/syscalls-powerpc.txt
+++ b/src/basic/syscalls-powerpc.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	327
 bpf	361
+breakpoint
 brk	45
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat	290
 get_mempolicy	260
 get_robust_list	299
 get_thread_area
+get_tls
 getcpu	302
 getcwd	182
 getdents	141
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	300
 set_thread_area
 set_tid_address	232
+set_tls
 setdomainname	121
 setfsgid	139
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	292
 unshare	282
 uretprobe
 userfaultfd	364
+usr26
+usr32
 ustat	62
 utime	30
 utimensat	304
--- a/src/basic/syscalls-powerpc64.txt
+++ b/src/basic/syscalls-powerpc64.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	327
 bpf	361
+breakpoint
 brk	45
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat	290
 get_mempolicy	260
 get_robust_list	299
 get_thread_area
+get_tls
 getcpu	302
 getcwd	182
 getdents	141
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	300
 set_thread_area
 set_tid_address	232
+set_tls
 setdomainname	121
 setfsgid	139
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	292
 unshare	282
 uretprobe
 userfaultfd	364
+usr26
+usr32
 ustat	62
 utime	30
 utimensat	304
--- a/src/basic/syscalls-riscv32.txt
+++ b/src/basic/syscalls-riscv32.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	200
 bpf	280
+breakpoint
 brk	214
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat
 get_mempolicy	236
 get_robust_list	100
 get_thread_area
+get_tls
 getcpu	168
 getcwd	17
 getdents
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	99
 set_thread_area
 set_tid_address	96
+set_tls
 setdomainname	162
 setfsgid	152
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	35
 unshare	97
 uretprobe
 userfaultfd	282
+usr26
+usr32
 ustat
 utime
 utimensat
--- a/src/basic/syscalls-riscv64.txt
+++ b/src/basic/syscalls-riscv64.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	200
 bpf	280
+breakpoint
 brk	214
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat
 get_mempolicy	236
 get_robust_list	100
 get_thread_area
+get_tls
 getcpu	168
 getcwd	17
 getdents
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	99
 set_thread_area
 set_tid_address	96
+set_tls
 setdomainname	162
 setfsgid	152
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	35
 unshare	97
 uretprobe
 userfaultfd	282
+usr26
+usr32
 ustat
 utime
 utimensat	88
--- a/src/basic/syscalls-s390.txt
+++ b/src/basic/syscalls-s390.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	361
 bpf	351
+breakpoint
 brk	45
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat	292
 get_mempolicy	269
 get_robust_list	305
 get_thread_area
+get_tls
 getcpu	311
 getcwd	183
 getdents	141
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	304
 set_thread_area
 set_tid_address	252
+set_tls
 setdomainname	121
 setfsgid	139
 setfsgid32	216
@ -511,6 +514,8 @@ unlinkat	294
 unshare	303
 uretprobe
 userfaultfd	355
+usr26
+usr32
 ustat	62
 utime	30
 utimensat	315
--- a/src/basic/syscalls-s390x.txt
+++ b/src/basic/syscalls-s390x.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	361
 bpf	351
+breakpoint
 brk	45
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat	292
 get_mempolicy	269
 get_robust_list	305
 get_thread_area
+get_tls
 getcpu	311
 getcwd	183
 getdents	141
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	304
 set_thread_area
 set_tid_address	252
+set_tls
 setdomainname	121
 setfsgid	216
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	294
 unshare	303
 uretprobe
 userfaultfd	355
+usr26
+usr32
 ustat	62
 utime	30
 utimensat	315
--- a/src/basic/syscalls-sh.txt
+++ b/src/basic/syscalls-sh.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	341
 bpf	375
+breakpoint
 brk	45
 cachectl
 cacheflush	123
@ -113,6 +114,7 @@ futimesat	299
 get_mempolicy	275
 get_robust_list	312
 get_thread_area
+get_tls
 getcpu	318
 getcwd	183
 getdents	141
@ -404,6 +406,7 @@ set_mempolicy_home_node	450
 set_robust_list	311
 set_thread_area
 set_tid_address	258
+set_tls
 setdomainname	121
 setfsgid	139
 setfsgid32	216
@ -512,6 +515,8 @@ unlinkat	301
 unshare	310
 uretprobe
 userfaultfd	377
+usr26
+usr32
 ustat	62
 utime	30
 utimensat	320
--- a/src/basic/syscalls-sparc.txt
+++ b/src/basic/syscalls-sparc.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	353
 bpf	349
+breakpoint
 brk	17
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat	288
 get_mempolicy	304
 get_robust_list	301
 get_thread_area
+get_tls
 getcpu	308
 getcwd	119
 getdents	174
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	300
 set_thread_area
 set_tid_address	166
+set_tls
 setdomainname	163
 setfsgid	229
 setfsgid32	94
@ -511,6 +514,8 @@ unlinkat	290
 unshare	299
 uretprobe
 userfaultfd	352
+usr26
+usr32
 ustat	168
 utime	30
 utimensat	310
--- a/src/basic/syscalls-x86_64.txt
+++ b/src/basic/syscalls-x86_64.txt
@ -16,6 +16,7 @@ atomic_barrier
 atomic_cmpxchg_32
 bind	49
 bpf	321
+breakpoint
 brk	12
 cachectl
 cacheflush
@ -113,6 +114,7 @@ futimesat	261
 get_mempolicy	239
 get_robust_list	274
 get_thread_area	211
+get_tls
 getcpu	309
 getcwd	79
 getdents	78
@ -403,6 +405,7 @@ set_mempolicy_home_node	450
 set_robust_list	273
 set_thread_area	205
 set_tid_address	218
+set_tls
 setdomainname	171
 setfsgid	123
 setfsgid32
@ -511,6 +514,8 @@ unlinkat	263
 unshare	272
 uretprobe	335
 userfaultfd	323
+usr26
+usr32
 ustat	136
 utime	132
 utimensat	280
--- a/src/boot/boot.c
+++ b/src/boot/boot.c
@ -1359,6 +1359,10 @@ static void boot_entry_parse_tries(
        if (!strcaseeq16(counter, suffix))
                return;

+        entry->id = xasprintf("%.*ls%ls",
+                        (int) prefix_len - 1,
+                        file,
+                        suffix);
        entry->tries_left = tries_left;
        entry->tries_done = tries_done;
        entry->path = xstrdup16(path);
@ -1531,7 +1535,9 @@ static void boot_entry_add_type1(
                return;

        entry->device = device;
-        entry->id = xstrdup16(file);
+
+        if (!entry->id)
+                entry->id = xstrdup16(file);
        strtolower16(entry->id);

        config_add_entry(config, entry);
--- a/src/fundamental/macro-fundamental.h
+++ b/src/fundamental/macro-fundamental.h
@ -151,15 +151,15 @@
 #define UNIQ_T(x, uniq) CONCATENATE(__unique_prefix_, CONCATENATE(x, uniq))
 #define UNIQ __COUNTER__

-/* Note that this works differently from pthread_once(): this macro does
- * not synchronize code execution, i.e. code that is run conditionalized
- * on this macro will run concurrently to all other code conditionalized
- * the same way, there's no ordering or completion enforced. */
+/* The macro is true when the code block is called first time, and is false for the second and later times.
+ * Note that this works differently from pthread_once(): this macro does not synchronize code execution, i.e.
+ * code that is run conditionalized on this macro will run concurrently to all other code conditionalized the
+ * same way, there's no ordering or completion enforced. */
 #define ONCE __ONCE(UNIQ_T(_once_, UNIQ))
-#define __ONCE(o)                                                  \
-        ({                                                         \
-                static bool (o) = false;                           \
-                __atomic_exchange_n(&(o), true, __ATOMIC_SEQ_CST); \
+#define __ONCE(o)                                                       \
+        ({                                                              \
+                static bool (o) = false;                                \
+                !__atomic_exchange_n(&(o), true, __ATOMIC_SEQ_CST);     \
        })

 #define U64_KB UINT64_C(1024)
--- a/src/import/pull-job.c
+++ b/src/import/pull-job.c
@ -134,17 +134,37 @@ void pull_job_curl_on_finished(CurlGlue *g, CURL *curl, CURLcode result) {
        if (!j || IN_SET(j->state, PULL_JOB_DONE, PULL_JOB_FAILED))
                return;

-        if (result != CURLE_OK) {
-                r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Transfer failed: %s", curl_easy_strerror(result));
-                goto finish;
-        }
-
        code = curl_easy_getinfo(curl, CURLINFO_SCHEME, &scheme);
        if (code != CURLE_OK || !scheme) {
                r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to retrieve URL scheme.");
                goto finish;
        }

+        if (strcaseeq(scheme, "FILE") && result == CURLE_FILE_COULDNT_READ_FILE && j->on_not_found) {
+                _cleanup_free_ char *new_url = NULL;
+
+                /* This resource wasn't found, but the implementor wants to maybe let us know a new URL, query for it. */
+                r = j->on_not_found(j, &new_url);
+                if (r < 0)
+                        goto finish;
+                if (r > 0) { /* A new url to use */
+                        assert(new_url);
+
+                        r = pull_job_restart(j, new_url);
+                        if (r < 0)
+                                goto finish;
+
+                        return;
+                }
+
+                /* if this didn't work, handle like any other error below */
+        }
+
+        if (result != CURLE_OK) {
+                r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Transfer failed: %s", curl_easy_strerror(result));
+                goto finish;
+        }
+
        if (STRCASE_IN_SET(scheme, "HTTP", "HTTPS")) {
                long status;

@ -773,7 +793,7 @@ int pull_job_begin(PullJob *j) {
        if (curl_easy_setopt(j->curl, CURLOPT_XFERINFODATA, j) != CURLE_OK)
                return -EIO;

-        if (curl_easy_setopt(j->curl, CURLOPT_NOPROGRESS, 0) != CURLE_OK)
+        if (curl_easy_setopt(j->curl, CURLOPT_NOPROGRESS, 0L) != CURLE_OK)
                return -EIO;

        r = curl_glue_add(j->glue, j->curl);
--- a/src/journal-remote/journal-upload.c
+++ b/src/journal-remote/journal-upload.c
@ -261,7 +261,7 @@ int start_upload(Uploader *u,
                }

                if (STRPTR_IN_SET(arg_trust, "-", "all"))
-                        easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0,
+                        easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L,
                                    LOG_ERR, return -EUCLEAN);
                else if (arg_trust || startswith(u->url, "https://"))
                        easy_setopt(curl, CURLOPT_CAINFO, arg_trust ?: TRUST_FILE,
--- a/src/libsystemd/sd-device/sd-device.c
+++ b/src/libsystemd/sd-device/sd-device.c
@ -153,8 +153,8 @@ int device_set_syspath(sd_device *device, const char *_syspath, bool verify) {
                r = chase(_syspath, NULL, 0, &syspath, &fd);
                if (r == -ENOENT)
                         /* the device does not exist (any more?) */
-                        return log_debug_errno(SYNTHETIC_ERRNO(ENODEV),
-                                               "sd-device: Failed to chase symlinks in \"%s\".", _syspath);
+                        return log_trace_errno(SYNTHETIC_ERRNO(ENODEV),
+                                               "sd-device: Device \"%s\" not found.", _syspath);
                if (r < 0)
                        return log_debug_errno(r, "sd-device: Failed to get target of '%s': %m", _syspath);

--- a/src/libsystemd/sd-varlink/varlink-org.varlink.service.c
+++ b/src/libsystemd/sd-varlink/varlink-org.varlink.service.c
@ -4,31 +4,42 @@

 static SD_VARLINK_DEFINE_METHOD(
                GetInfo,
+                SD_VARLINK_FIELD_COMMENT("String identifying the vendor of this service"),
                SD_VARLINK_DEFINE_OUTPUT(vendor, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("String identifying the product implementing this service"),
                SD_VARLINK_DEFINE_OUTPUT(product, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("Version string of this product"),
                SD_VARLINK_DEFINE_OUTPUT(version, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("Web URL pointing to additional information about this service"),
                SD_VARLINK_DEFINE_OUTPUT(url, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("List of interfaces implemented by this service"),
                SD_VARLINK_DEFINE_OUTPUT(interfaces, SD_VARLINK_STRING, SD_VARLINK_ARRAY));

 static SD_VARLINK_DEFINE_METHOD(
                GetInterfaceDescription,
+                SD_VARLINK_FIELD_COMMENT("Name of interface to query interface description of"),
                SD_VARLINK_DEFINE_INPUT(interface, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("Interface description in Varlink IDL format"),
                SD_VARLINK_DEFINE_OUTPUT(description, SD_VARLINK_STRING, 0));

 static SD_VARLINK_DEFINE_ERROR(
                InterfaceNotFound,
+                SD_VARLINK_FIELD_COMMENT("Name of interface that was called but does not exist"),
                SD_VARLINK_DEFINE_FIELD(interface, SD_VARLINK_STRING, 0));

 static SD_VARLINK_DEFINE_ERROR(
                MethodNotFound,
+                SD_VARLINK_FIELD_COMMENT("Name of method that was called but does not exist"),
                SD_VARLINK_DEFINE_FIELD(method, SD_VARLINK_STRING, 0));

 static SD_VARLINK_DEFINE_ERROR(
                MethodNotImplemented,
+                SD_VARLINK_FIELD_COMMENT("Name of method that was called but is not implemented."),
                SD_VARLINK_DEFINE_FIELD(method, SD_VARLINK_STRING, 0));

 static SD_VARLINK_DEFINE_ERROR(
                InvalidParameter,
+                SD_VARLINK_FIELD_COMMENT("Name of the invalid parameter"),
                SD_VARLINK_DEFINE_FIELD(parameter, SD_VARLINK_STRING, 0));

 static SD_VARLINK_DEFINE_ERROR(PermissionDenied);
@ -39,11 +50,20 @@ static SD_VARLINK_DEFINE_ERROR(ExpectedMore);
 SD_VARLINK_DEFINE_INTERFACE(
                org_varlink_service,
                "org.varlink.service",
+                SD_VARLINK_INTERFACE_COMMENT("General Varlink service interface"),
+                SD_VARLINK_SYMBOL_COMMENT("Get service meta information"),
                &vl_method_GetInfo,
+                SD_VARLINK_SYMBOL_COMMENT("Get description of an implemented interface in Varlink IDL format"),
                &vl_method_GetInterfaceDescription,
+                SD_VARLINK_SYMBOL_COMMENT("Error returned if a method is called on an unknown interface"),
                &vl_error_InterfaceNotFound,
+                SD_VARLINK_SYMBOL_COMMENT("Error returned if an unknown method is called on an known interface"),
                &vl_error_MethodNotFound,
+                SD_VARLINK_SYMBOL_COMMENT("Error returned if an method is called that is known but not implemented"),
                &vl_error_MethodNotImplemented,
+                SD_VARLINK_SYMBOL_COMMENT("Error returned if a method is called with an invalid parameter"),
                &vl_error_InvalidParameter,
+                SD_VARLINK_SYMBOL_COMMENT("General permission error"),
                &vl_error_PermissionDenied,
+                SD_VARLINK_SYMBOL_COMMENT("A method was called with the 'more' flag off, but it may only be called with the flag turned on"),
                &vl_error_ExpectedMore);
--- a/src/network/generator/network-generator.c
+++ b/src/network/generator/network-generator.c
@ -21,7 +21,7 @@
  ip={dhcp|on|any|dhcp6|auto6|either6|link6|link-local}
  ip=<interface>:{dhcp|on|any|dhcp6|auto6|link6|link-local}[:[<mtu>][:<macaddr>]]
  ip=<client-IP>:[<peer>]:<gateway-IP>:<netmask>:<client_hostname>:<interface>:{none|off|dhcp|on|any|dhcp6|auto6|link6|ibft|link-local}[:[<mtu>][:<macaddr>]]
-  ip=<client-IP>:[<peer>]:<gateway-IP>:<netmask>:<client_hostname>:<interface>:{none|off|dhcp|on|any|dhcp6|auto6|link6|ibft|link-local}[:[<dns1>][:<dns2>]]
+  ip=<client-IP>:[<peer>]:<gateway-IP>:<netmask>:<client_hostname>:<interface>:{none|off|dhcp|on|any|dhcp6|auto6|link6|ibft|link-local}[:[<dns1>][:[<dns2>][:[<ntp>]]]]
  rd.route=<net>/<netmask>:<gateway>[:<interface>]
  nameserver=<IP> [nameserver=<IP> ...]
  rd.peerdns=0
@ -197,6 +197,7 @@ static Network* network_free(Network *network) {
        strv_free(network->vlan);
        free(network->bridge);
        free(network->bond);
+        free(network->ntp);

        while ((address = network->addresses))
                address_free(address);
@ -635,6 +636,27 @@ static int network_set_bond(Context *context, const char *ifname, const char *va
        return free_and_strdup(&network->bond, value);
 }

+static int network_set_ntp(Context *context, const char *ifname, const char *value) {
+        Network *network;
+        int r;
+
+        assert(context);
+        assert(ifname);
+
+        if (isempty(value))
+                return 0;
+
+        r = in_addr_from_string_auto(value, NULL, NULL);
+        if (r < 0)
+                return log_debug_errno(r, "Invalid NTP address '%s' for '%s'", value, ifname);
+
+        r = network_acquire(context, ifname, &network);
+        if (r < 0)
+                return log_debug_errno(r, "Failed to acquire network for '%s': %m", ifname);
+
+        return free_and_strdup(&network->ntp, value);
+}
+
 static int parse_cmdline_ip_mtu_mac(Context *context, const char *ifname, const char *value) {
        _cleanup_free_ char *mtu = NULL;
        int r;
@ -850,6 +872,18 @@ static int parse_cmdline_ip_address(Context *context, int family, const char *va
        if (r < 0)
                return r;

+        /* Next, try [:<ntp>] */
+        _cleanup_free_ char *ntp = NULL;
+        r = extract_ip_address_str(AF_UNSPEC, &p, &ntp);
+        if (r < 0)
+                return log_debug_errno(r, "Failed to parse NTP address in ip=%s: %m", value);
+        if (r == 0)
+                return 0;
+
+        r = network_set_ntp(context, ifname, ntp);
+        if (r < 0)
+                return r;
+
        /* refuse unexpected trailing strings */
        if (!isempty(p))
                return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Unexpected trailing string in 'ip=%s'.", value);
@ -1358,6 +1392,9 @@ void network_dump(Network *network, FILE *f) {
        if (network->bond)
                fprintf(f, "Bond=%s\n", network->bond);

+        if (network->ntp)
+                fprintf(f, "NTP=%s\n", network->ntp);
+
        fputs("\n[DHCP]\n", f);

        if (!isempty(network->hostname))
--- a/src/network/generator/network-generator.h
+++ b/src/network/generator/network-generator.h
@ -65,6 +65,7 @@ struct Network {
        char **vlan;
        char *bridge;
        char *bond;
+        char *ntp;

        /* [DHCP] */
        char *hostname;
--- a/src/network/generator/test-network-generator.c
+++ b/src/network/generator/test-network-generator.c
@ -215,6 +215,51 @@ int main(int argc, char *argv[]) {
                         "Gateway=192.168.0.1\n"
                         );

+        test_network_one("eth0", "ip", "192.168.0.10::192.168.0.1:255.255.255.0::eth0:on:10.10.10.10:10.10.10.11:10.10.10.161",
+                         "[Match]\n"
+                         "Name=eth0\n"
+                         "\n[Link]\n"
+                         "\n[Network]\n"
+                         "DHCP=yes\n"
+                         "DNS=10.10.10.10\n"
+                         "DNS=10.10.10.11\n"
+                         "NTP=10.10.10.161\n"
+                         "\n[DHCP]\n"
+                         "\n[Address]\n"
+                         "Address=192.168.0.10/24\n"
+                         "\n[Route]\n"
+                         "Gateway=192.168.0.1\n"
+                         );
+
+        test_network_one("eth0", "ip", "192.168.0.10::192.168.0.1:255.255.255.0::eth0:on:10.10.10.10::10.10.10.161",
+                         "[Match]\n"
+                         "Name=eth0\n"
+                         "\n[Link]\n"
+                         "\n[Network]\n"
+                         "DHCP=yes\n"
+                         "DNS=10.10.10.10\n"
+                         "NTP=10.10.10.161\n"
+                         "\n[DHCP]\n"
+                         "\n[Address]\n"
+                         "Address=192.168.0.10/24\n"
+                         "\n[Route]\n"
+                         "Gateway=192.168.0.1\n"
+                         );
+
+        test_network_one("eth0", "ip", "192.168.0.10::192.168.0.1:255.255.255.0::eth0:on:::10.10.10.161",
+                         "[Match]\n"
+                         "Name=eth0\n"
+                         "\n[Link]\n"
+                         "\n[Network]\n"
+                         "DHCP=yes\n"
+                         "NTP=10.10.10.161\n"
+                         "\n[DHCP]\n"
+                         "\n[Address]\n"
+                         "Address=192.168.0.10/24\n"
+                         "\n[Route]\n"
+                         "Gateway=192.168.0.1\n"
+                         );
+
        test_network_one("eth0", "ip", "[2001:1234:56:8f63::10]::[2001:1234:56:8f63::1]:64:hogehoge:eth0:on",
                         "[Match]\n"
                         "Name=eth0\n"
--- a/src/network/networkctl-list.c
+++ b/src/network/networkctl-list.c
@ -11,7 +11,6 @@
 #include "networkctl-util.h"

 int list_links(int argc, char *argv[], void *userdata) {
-        _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
        _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
        _cleanup_(link_info_array_freep) LinkInfo *links = NULL;
        _cleanup_(table_unrefp) Table *table = NULL;
@ -22,10 +21,6 @@ int list_links(int argc, char *argv[], void *userdata) {
        if (r != 0)
                return r;

-        r = acquire_bus(&bus);
-        if (r < 0)
-                return r;
-
        r = sd_netlink_open(&rtnl);
        if (r < 0)
                return log_error_errno(r, "Failed to connect to netlink: %m");
--- a/src/network/networkctl-status-link.c
+++ b/src/network/networkctl-status-link.c
@ -757,7 +757,7 @@ static int link_status_one(
                if (r < 0)
                        return table_log_add_error(r);

-                r = table_add_cell_stringf(table, NULL, "%sbps/%sbps",
+                r = table_add_cell_stringf(table, NULL, "%sBps/%sBps",
                                           FORMAT_BYTES_FULL(info->tx_bitrate, 0),
                                           FORMAT_BYTES_FULL(info->rx_bitrate, 0));
                if (r < 0)
--- a/src/network/networkd-json.c
+++ b/src/network/networkd-json.c
@ -440,14 +440,15 @@ static int network_append_json(Network *network, sd_json_variant **v) {
                        v,
                        SD_JSON_BUILD_PAIR_STRING("NetworkFile", network->filename),
                        SD_JSON_BUILD_PAIR_STRV("NetworkFileDropins", network->dropins),
-                        SD_JSON_BUILD_PAIR_BOOLEAN("RequiredForOnline", network->required_for_online),
-                        SD_JSON_BUILD_PAIR("RequiredOperationalStateForOnline",
-                                           SD_JSON_BUILD_ARRAY(SD_JSON_BUILD_STRING(link_operstate_to_string(network->required_operstate_for_online.min)),
-                                                               SD_JSON_BUILD_STRING(link_operstate_to_string(network->required_operstate_for_online.max)))),
-                        SD_JSON_BUILD_PAIR_STRING("RequiredFamilyForOnline",
-                                                  link_required_address_family_to_string(network->required_family_for_online)),
-                        SD_JSON_BUILD_PAIR_STRING("ActivationPolicy",
-                                                  activation_policy_to_string(network->activation_policy)));
+                        SD_JSON_BUILD_PAIR_BOOLEAN("RequiredForOnline", network->required_for_online > 0),
+                        SD_JSON_BUILD_PAIR_CONDITION(
+                                        operational_state_range_is_valid(&network->required_operstate_for_online),
+                                        "RequiredOperationalStateForOnline",
+                                        SD_JSON_BUILD_ARRAY(
+                                                SD_JSON_BUILD_STRING(link_operstate_to_string(network->required_operstate_for_online.min)),
+                                                SD_JSON_BUILD_STRING(link_operstate_to_string(network->required_operstate_for_online.max)))),
+                        SD_JSON_BUILD_PAIR_STRING("RequiredFamilyForOnline", link_required_address_family_to_string(network->required_family_for_online)),
+                        SD_JSON_BUILD_PAIR_STRING("ActivationPolicy", activation_policy_to_string(network->activation_policy)));
 }

 static int device_append_json(sd_device *device, sd_json_variant **v) {
--- a/src/repart/repart.c
+++ b/src/repart/repart.c
@ -179,6 +179,7 @@ static char *arg_copy_source = NULL;
 static char *arg_make_ddi = NULL;
 static char *arg_generate_fstab = NULL;
 static char *arg_generate_crypttab = NULL;
+static bool arg_relax_copy_block_security = false;

 STATIC_DESTRUCTOR_REGISTER(arg_node, freep);
 STATIC_DESTRUCTOR_REGISTER(arg_root, freep);
@ -8114,6 +8115,9 @@ static int parse_argv(int argc, char *argv[], X509 **ret_certificate, EVP_PKEY *
                        r = parse_path_argument(optarg, /* suppress_root= */ false, &arg_image);
                        if (r < 0)
                                return r;
+
+                        arg_relax_copy_block_security = false;
+
                        break;

                case ARG_IMAGE_POLICY:
@ -8515,6 +8519,8 @@ static int parse_argv(int argc, char *argv[], X509 **ret_certificate, EVP_PKEY *
                        arg_root = strdup("/sysusr");
                if (!arg_root)
                        return log_oom();
+
+                arg_relax_copy_block_security = true;
        }

        if (argc > optind) {
@ -9189,7 +9195,9 @@ static int run(int argc, char *argv[]) {
        r = context_open_copy_block_paths(
                        context,
                        loop_device ? loop_device->devno :         /* if --image= is specified, only allow partitions on the loopback device */
-                                      arg_root && !arg_image ? 0 : /* if --root= is specified, don't accept any block device */
+                                      /* if --root= is specified, don't accept any block device, unless it
+                                       * was set automatically because we are in the initrd  */
+                                      arg_root && !arg_image && !arg_relax_copy_block_security ? 0 :
                                      (dev_t) -1);                 /* if neither is specified, make no restrictions */
        if (r < 0)
                return r;
--- a/src/sysctl/sysctl.c
+++ b/src/sysctl/sysctl.c
@ -353,6 +353,7 @@ static int help(void) {
               "     --tldr             Show non-comment parts of configuration\n"
               "     --prefix=PATH      Only apply rules with the specified prefix\n"
               "     --no-pager         Do not pipe output into a pager\n"
+               "     --strict           Fail on any kind of failures\n"
               "\nSee the %s for details.\n",
               program_invocation_short_name,
               link);
--- a/src/sysext/sysext.c
+++ b/src/sysext/sysext.c
@ -1771,10 +1771,7 @@ static int merge_subprocess(
                        if (r < 0)
                                return r;

-                        r = dissected_image_decrypt_interactively(
-                                        m, NULL,
-                                        &verity_settings,
-                                        flags);
+                        r = dissected_image_decrypt(m, /* passphrase= */ NULL, &verity_settings, flags);
                        if (r < 0)
                                return r;

--- a/src/test/test-fd-util.c
+++ b/src/test/test-fd-util.c
@ -681,6 +681,134 @@ TEST(dir_fd_is_root) {
        assert_se(dir_fd_is_root_or_cwd(fd) == 0);
 }

+static void test_path_is_root_at_one(bool expected) {
+        ASSERT_OK_POSITIVE(path_is_root("/"));
+        ASSERT_OK_POSITIVE(path_is_root("/."));
+        ASSERT_OK_EQ(path_is_root("/./.."), expected);
+        ASSERT_OK_EQ(path_is_root("/.."), expected);
+        ASSERT_OK_EQ(path_is_root("/../"), expected);
+        ASSERT_OK_EQ(path_is_root("/../."), expected);
+        ASSERT_OK_EQ(path_is_root("/../.."), expected);
+
+        ASSERT_OK_ZERO(path_is_root("/usr"));
+        ASSERT_OK_ZERO(path_is_root("/./usr"));
+        ASSERT_OK_ZERO(path_is_root("/../usr"));
+        ASSERT_OK_ZERO(path_is_root("/.././usr"));
+        ASSERT_OK_ZERO(path_is_root("/../../usr"));
+
+        _cleanup_close_ int fd = -EBADF;
+        ASSERT_OK_ERRNO(fd = open("/", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
+
+        ASSERT_OK_POSITIVE(path_is_root_at(fd, NULL));
+        ASSERT_OK_POSITIVE(path_is_root_at(fd, ""));
+        ASSERT_OK_POSITIVE(path_is_root_at(fd, "."));
+        ASSERT_OK_EQ(path_is_root_at(fd, "./../"), expected);
+        ASSERT_OK_EQ(path_is_root_at(fd, "../"), expected);
+        ASSERT_OK_POSITIVE(path_is_root_at(fd, "/"));
+        ASSERT_OK_POSITIVE(path_is_root_at(fd, "/."));
+        ASSERT_OK_EQ(path_is_root_at(fd, "/./.."), expected);
+        ASSERT_OK_EQ(path_is_root_at(fd, "/.."), expected);
+        ASSERT_OK_EQ(path_is_root_at(fd, "/../"), expected);
+        ASSERT_OK_EQ(path_is_root_at(fd, "/../."), expected);
+        ASSERT_OK_EQ(path_is_root_at(fd, "/../.."), expected);
+
+        ASSERT_OK_ZERO(path_is_root_at(fd, "usr"));
+        ASSERT_OK_ZERO(path_is_root_at(fd, "./usr"));
+        ASSERT_OK_ZERO(path_is_root_at(fd, "../usr"));
+        ASSERT_OK_ZERO(path_is_root_at(fd, "/usr"));
+        ASSERT_OK_ZERO(path_is_root_at(fd, "/./usr"));
+        ASSERT_OK_ZERO(path_is_root_at(fd, "/../usr"));
+        ASSERT_OK_ZERO(path_is_root_at(fd, "/.././usr"));
+        ASSERT_OK_ZERO(path_is_root_at(fd, "/../../usr"));
+
+        safe_close(fd);
+        ASSERT_OK_ERRNO(fd = open("/../", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
+
+        ASSERT_OK_EQ(path_is_root_at(fd, NULL), expected);
+        ASSERT_OK_EQ(path_is_root_at(fd, ""), expected);
+        ASSERT_OK_EQ(path_is_root_at(fd, "."), expected);
+        ASSERT_OK_EQ(path_is_root_at(fd, "./.."), expected);
+        ASSERT_OK_EQ(path_is_root_at(fd, "../"), expected);
+        ASSERT_OK_POSITIVE(path_is_root_at(fd, "/"));
+        ASSERT_OK_POSITIVE(path_is_root_at(fd, "/."));
+        ASSERT_OK_EQ(path_is_root_at(fd, "/./.."), expected);
+        ASSERT_OK_EQ(path_is_root_at(fd, "/.."), expected);
+        ASSERT_OK_EQ(path_is_root_at(fd, "/../"), expected);
+        ASSERT_OK_EQ(path_is_root_at(fd, "/../."), expected);
+        ASSERT_OK_EQ(path_is_root_at(fd, "/../.."), expected);
+
+        ASSERT_OK_ZERO(path_is_root_at(fd, "usr"));
+        ASSERT_OK_ZERO(path_is_root_at(fd, "./usr"));
+        ASSERT_OK_ZERO(path_is_root_at(fd, "../usr"));
+        ASSERT_OK_ZERO(path_is_root_at(fd, "/usr"));
+        ASSERT_OK_ZERO(path_is_root_at(fd, "/./usr"));
+        ASSERT_OK_ZERO(path_is_root_at(fd, "/../usr"));
+        ASSERT_OK_ZERO(path_is_root_at(fd, "/.././usr"));
+        ASSERT_OK_ZERO(path_is_root_at(fd, "/../../usr"));
+}
+
+TEST(path_is_root_at) {
+        int r;
+
+        test_path_is_root_at_one(true);
+
+        r = detach_mount_namespace();
+        if (r < 0)
+                return (void) log_tests_skipped_errno(r, "Failed to detach mount namespace");
+
+        /* Interestingly, even after bind mount a path on "/", still "/" points to the previous root
+         * directory, but "/../" points to the new root directory. Hence, path_is_root("/") is true but
+         * path_is_root("/../") is false. Such spurious situation is resolved after chroot()ing to the new
+         * root directory. */
+        ASSERT_OK(mount_nofollow_verbose(LOG_DEBUG, "/", "/", NULL, MS_BIND|MS_REC, NULL));
+        log_debug("/* %s: bind mount(\"/\", \"/\") */", __func__);
+        test_path_is_root_at_one(false);
+
+        /* chroot("/") does not change anything. */
+        ASSERT_OK_ERRNO(chroot("/"));
+        log_debug("/* %s: chroot(\"/\") */", __func__);
+        test_path_is_root_at_one(false);
+
+        /* chdir("/") neither change anything. */
+        ASSERT_OK_ERRNO(chdir("/"));
+        log_debug("/* %s: chdir(\"/\") */", __func__);
+        test_path_is_root_at_one(false);
+
+        /* chdir("/../") neither change anything. */
+        ASSERT_OK_ERRNO(chdir("/../"));
+        log_debug("/* %s: chdir(\"/../\") */", __func__);
+        test_path_is_root_at_one(false);
+
+        /* After chroot("/../"), both "/" and "/../" point to the new root directory. */
+        ASSERT_OK_ERRNO(chroot("/../"));
+        log_debug("/* %s: chroot(\"/../\") */", __func__);
+        test_path_is_root_at_one(true);
+
+        /* chdir("/../") does not change anything. */
+        ASSERT_OK_ERRNO(chdir("/../"));
+        log_debug("/* %s: chdir(\"/../\") again */", __func__);
+        test_path_is_root_at_one(true);
+
+        /* bind mounting to non-root directory has no problem, of course. */
+        _cleanup_(rm_rf_physical_and_freep) char *tmp = NULL;
+        ASSERT_OK(mkdtemp_malloc("/tmp/test-path_is_root-XXXXXX", &tmp));
+        ASSERT_OK(mount_nofollow_verbose(LOG_DEBUG, "/", tmp, NULL, MS_BIND|MS_REC, NULL));
+        log_debug("/* %s: bind mount(\"/\", \"%s\") */", __func__, tmp);
+        test_path_is_root_at_one(true);
+
+        ASSERT_OK_ERRNO(chdir(tmp));
+        log_debug("/* %s: chdir(\"%s\") */", __func__, tmp);
+        test_path_is_root_at_one(true);
+
+        ASSERT_OK_ERRNO(chroot(tmp));
+        log_debug("/* %s: chroot(\"%s\") */", __func__, tmp);
+        test_path_is_root_at_one(true);
+
+        ASSERT_OK_ERRNO(chdir(tmp));
+        log_debug("/* %s: chdir(\"%s\") again */", __func__, tmp);
+        test_path_is_root_at_one(true);
+}
+
 TEST(fds_are_same_mount) {
        _cleanup_close_ int fd1 = -EBADF, fd2 = -EBADF, fd3 = -EBADF, fd4 = -EBADF;

--- a/src/test/test-log.c
+++ b/src/test/test-log.c
@ -45,6 +45,22 @@ static void test_file(void) {
        assert_se(startswith(__FILE__, RELATIVE_SOURCE_PATH "/"));
 }

+static void test_log_once_impl(void) {
+        log_once(LOG_INFO, "This should be logged in LOG_INFO at first, then in LOG_DEBUG later.");
+        log_once(LOG_DEBUG, "This should be logged only once in LOG_DEBUG.");
+        ASSERT_ERROR(log_once_errno(LOG_INFO, SYNTHETIC_ERRNO(ENOANO),
+                                 "This should be logged with errno in LOG_INFO at first, then in LOG_DEBUG later: %m"),
+                     ENOANO);
+        ASSERT_ERROR(log_once_errno(LOG_DEBUG, SYNTHETIC_ERRNO(EBADMSG),
+                                    "This should be logged only once with errno in LOG_DEBUG: %m"),
+                     EBADMSG);
+}
+
+static void test_log_once(void) {
+        for (unsigned i = 0; i < 4; i++)
+                test_log_once_impl();
+}
+
 static void test_log_struct(void) {
        log_struct(LOG_INFO,
                   "MESSAGE=Waldo PID="PID_FMT" (no errno)", getpid_cached(),
@ -236,6 +252,8 @@ int main(int argc, char* argv[]) {

        assert_se(log_info_errno(SYNTHETIC_ERRNO(EUCLEAN), "foo") == -EUCLEAN);

+        test_log_once();
+
        for (int target = 0; target < _LOG_TARGET_MAX; target++) {
                log_set_target(target);
                log_open();
--- a/src/test/test-macro.c
+++ b/src/test/test-macro.c
@ -1228,4 +1228,20 @@ TEST(ASSERT) {
        ASSERT_SIGNAL(ASSERT_NE_ID128(SD_ID128_NULL, SD_ID128_NULL), SIGABRT);
 }

+static void test_once_impl(void) {
+        static unsigned count = 0;
+
+        if (ONCE) {
+                log_info("This should be logged only once.");
+                count++;
+        }
+
+        ASSERT_EQ(count, 1u);
+}
+
+TEST(once) {
+        for (unsigned i = 0; i < 20; i++)
+                test_once_impl();
+}
+
 DEFINE_TEST_MAIN(LOG_INFO);
--- a/src/udev/udev-manager.c
+++ b/src/udev/udev-manager.c
@ -335,7 +335,7 @@ static usec_t extra_timeout_usec(void) {

        parsed = true;

-        e = getenv("SYSTEMD_UDEV_EXTRA_TIMEOUT_SEC");
+        e = secure_getenv("SYSTEMD_UDEV_EXTRA_TIMEOUT_SEC");
        if (!e)
                return saved;